API-320: login key hygiene — no echoes, no history, right URL - #534
API-320: login key hygiene — no echoes, no history, right URL#534gulshngill wants to merge 1 commit into
Conversation
Three hygiene fixes to `nansen login`, re-landed from closed #507 without its MCP-stack coupling: - VERIFICATION_FAILED relayed upstream error text verbatim, and that text can contain the key (echoed request headers/bodies). Redact the key (raw and trimmed) before it reaches any user-visible surface. redactSecret lives in cli.js -- not commands/mcp.js -- so this carries no MCP dependency. - The invalid-key resolution sent users to /auth/agent-setup, which auto-mints a key on load and is plan-capped (Free = 1), so a user whose key was rejected could hit a 403 on arrival. Point it at the key management view (API-390 decision, matching nansen-ra and the Kong 401). - Help text led with `--api-key <key>`, which lands the literal key in shell history. Lead with --human and command substitution, and say explicitly which forms are recorded. Tests: redaction (raw + trimmed, message and data payload), resolution URL pinned with agent-setup excluded, help ordering. The redaction tests were verified to fail against the unfixed code. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pr-reviewer Summary for #b1813a1📝 1 finding Review completed. Please address the findings below. Findings by Severity
Review effort: 2/5 (Simple) SummaryThis PR ships three well-scoped security and UX fixes to Findings
|
![nansen-pr-reviewer[bot]](https://avatars.githubusercontent.com/in/2987756?s=60&v=4){kind=small}
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a moderate effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
- Review comment contains non-blocking feedback
If you have any concerns, please request a manual review.
1 participant
Why
First slice of API-320, re-landed from closed #507 without its MCP-stack coupling (see the close-out rationale on #507). Three login hygiene fixes, all on
maintoday:VERIFICATION_FAILEDrelayed upstreamerror.messageverbatim, and upstream errors can contain the key (echoed request headers, undici header-validation errors). Now redacted — raw and trimmed forms — before any user-visible surface, including the structureddatapayload./auth/agent-setupauto-firesPOST /api-keyson load and is plan-capped (Free = 1) — a user whose key was just rejected could land on a 403. Now points at the key management viewapp.nansen.ai/api?tab=api, matching the API-390 standardisation already merged in nansen-ra#3452 and nansen-api#1832. The no-key path keepsagent-setup— there, minting is the point.--api-key <key>puts the literal key in shell history. Help now leads with--humanand command substitution, and states explicitly which forms are recorded.redactSecretlives incli.js— deliberately notcommands/mcp.js— so nothing here depends on the in-flight MCP stack (#487/#508); this merges independently of both.Verification
data, resolution URL pinned (agent-setupexcluded), help ordering. The redaction tests were run against the unfixed code and fail — they are real pins, not decorations.Remaining API-320 work (not this PR)
--env-ref+ backup redaction — follow-up after API-397: One-step MCP install (nansen mcp install <client>) #487/API-318: Addnansen mcp verify— client-independent authenticated MCP setup verification #508 land (implementation preserved onfeat/api-320-credential-handling).nansen loginstorage.Checklist
src/schema.json— n/a, no new commands or flagsREADME.md— n/a, help text is in-CLI🤖 Generated with Claude Code