cleveragents/cleveragents-core

Fork 3

`_mask_value()` in config.py ignores its `value` parameter — dead parameter, always returns `"****"` #8416

New issue

Open

opened 2026-04-13 18:43:04 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-13 18:43:04 +00:00

Owner

Metadata

Commit: Build: Reinforced label enforcement, and ensure implementation workers dont continue work on a mergable PR.
Branch: main
SHA: 5a9aaa79ed

Background and Context

In src/cleveragents/cli/commands/config.py, the _mask_value() helper function accepts a value: str parameter but never uses it. The function unconditionally returns "****" regardless of the input. This is a dead parameter — the function signature implies it might do partial masking (e.g., show last 4 characters of an API key), but the implementation ignores the value entirely.

Current Behavior

def _mask_value(value: str) -> str:
    """Replace a value with ``****``."""
    return "****"

The value parameter is accepted but never referenced in the function body. This is misleading: callers pass a value expecting it might influence the output (e.g., for partial masking), but it is silently discarded.

Expected Behavior

Either:

The function should use the value parameter to implement meaningful masking (e.g., show last 4 characters: "sk-...abcd" → "****abcd"), OR
The parameter should be removed if the function is intentionally a constant-return stub, and the signature updated to _mask_value() -> str

The current state violates the code quality standard that all parameters must be used, and creates confusion about the masking behaviour.

Acceptance Criteria

_mask_value() either uses its value parameter meaningfully, or the parameter is removed
All call sites are updated to match the corrected signature
If partial masking is implemented, it is consistent with the project's secret-handling conventions
No type: ignore comments are introduced

Subtasks

Decide on masking strategy (full mask vs. partial reveal of last N chars)
Update _mask_value() implementation accordingly
Update all call sites in config.py
Add unit tests for the masking behaviour
Verify agents config list output masks secrets correctly

Definition of Done

Issue is closed when _mask_value() has no dead parameters and its masking behaviour is intentional, documented, and tested.

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

## Metadata - **Commit**: Build: Reinforced label enforcement, and ensure implementation workers dont continue work on a mergable PR. - **Branch**: main - **SHA**: 5a9aaa79edaefb1a257114f054ea87facb8efe69 ## Background and Context In `src/cleveragents/cli/commands/config.py`, the `_mask_value()` helper function accepts a `value: str` parameter but never uses it. The function unconditionally returns `"****"` regardless of the input. This is a dead parameter — the function signature implies it might do partial masking (e.g., show last 4 characters of an API key), but the implementation ignores the value entirely. ## Current Behavior ```python def _mask_value(value: str) -> str: """Replace a value with ``****``.""" return "****" ``` The `value` parameter is accepted but never referenced in the function body. This is misleading: callers pass a value expecting it might influence the output (e.g., for partial masking), but it is silently discarded. ## Expected Behavior Either: 1. The function should use the `value` parameter to implement meaningful masking (e.g., show last 4 characters: `"sk-...abcd"` → `"****abcd"`), OR 2. The parameter should be removed if the function is intentionally a constant-return stub, and the signature updated to `_mask_value() -> str` The current state violates the code quality standard that all parameters must be used, and creates confusion about the masking behaviour. ## Acceptance Criteria - [ ] `_mask_value()` either uses its `value` parameter meaningfully, or the parameter is removed - [ ] All call sites are updated to match the corrected signature - [ ] If partial masking is implemented, it is consistent with the project's secret-handling conventions - [ ] No `type: ignore` comments are introduced ## Subtasks - [ ] Decide on masking strategy (full mask vs. partial reveal of last N chars) - [ ] Update `_mask_value()` implementation accordingly - [ ] Update all call sites in `config.py` - [ ] Add unit tests for the masking behaviour - [ ] Verify `agents config list` output masks secrets correctly ## Definition of Done Issue is closed when `_mask_value()` has no dead parameters and its masking behaviour is intentional, documented, and tested. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 added the

labels

2026-04-13 18:51:41 +00:00

HAL9000 added this to the v3.3.0 milestone

2026-04-13 18:51:41 +00:00

HAL9000 added

and removed

labels

2026-04-13 19:14:55 +00:00

HAL9000 modified the milestone from v3.3.0 to v3.2.0

2026-04-13 19:17:52 +00:00

HAL9000 commented

2026-04-13 19:18:58 +00:00

Author

Owner

✅ Verified — _mask_value() always returning '****' regardless of input is a dead parameter bug. This is security-adjacent: if the function is called to mask credentials in output, it may be masking the wrong value. MoSCoW: Must Have for v3.2.0 — config masking correctness is a basic security requirement. [AUTO-OWNR-1]

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — `_mask_value()` always returning `'****'` regardless of input is a dead parameter bug. This is security-adjacent: if the function is called to mask credentials in output, it may be masking the wrong value. **MoSCoW: Must Have** for v3.2.0 — config masking correctness is a basic security requirement. [AUTO-OWNR-1] --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-13 20:33:18 +00:00

[AUTO-IMP-SUP] Status: Implementation Pool Supervisor (Cycle 1) #8513

HAL9000 referenced this issue

2026-05-17 15:28:47 +00:00

fix(lsp): prevent header injection in LSP transport ASCII decoding #10608