🤖 fix: redact MCP command env values and credential URLs in settings backup export - #3985

Open

ibetitsmike wants to merge 116 commits into

mainfrom

mike/backup-mcp-redaction

Commits on Aug 26, 2026

fix: redact MCP command env values and credential URLs in settings backup export
ibetitsmike
committed
cbfabe7
fix: consume whole shell words in command redaction and resolve redacted URLs on restore
ibetitsmike
committed
7c2d5ad

Commits on Aug 27, 2026

Commits on Aug 28, 2026

fix: scan issued-token shapes linearly and keep Slack placeholders reviewable
ibetitsmike
committed
bebb378
fix: restrict executable-name checks to command positions and track find callbacks
ibetitsmike
committed
b3af0c6
fix: resolve published-document operands against the configured root
ibetitsmike
committed
b61ab5a
fix: cover stdin-redirected documents, coproc/function bodies, and resource wrappers
ibetitsmike
committed
94ebaee
fix: track systemd executor command operands
ibetitsmike
committed
4721d66
fix: check CMake and CTest operands
ibetitsmike
committed
6323869
fix: reset parser state at separators, normalize operand paths, end deno tracking at the entrypoint
ibetitsmike
committed
373125f
fix: localize Java argument files and sweep command-valued Git config keys
ibetitsmike
committed
431e16c
fix: match the current user's named-home spelling of the settings root
ibetitsmike
committed
f3c88b0
fix: localize JShell startup files that name auto-published documents
ibetitsmike
committed
138ef24
fix: localize hash -p remapping to published files and treat alias as shell state
ibetitsmike
committed
5e1586a
chore: remove a stray review reply artifact from the repository root
ibetitsmike
committed
16763b5
fix: localize every hash -p remap and the enable builtin loader
ibetitsmike
committed
518a5f3
fix: keep the script boundary after interpreter -- and track setarch hard links
ibetitsmike
committed
21b23b8
fix: track Erlang erl -eval, -run, and -s evaluation options
ibetitsmike
committed
664b844
fix: localize cd into the collected root, gc.recentObjectsHook, and canonical root spellings
ibetitsmike
committed
d579b58
fix: gate stdin localization on executable input, resolve relative cd chains, and track java -jar
ibetitsmike
committed
5e06d58
fix: localize !-valued submodule updates and bare names on a published PATH entry
ibetitsmike
committed
8bb9fec
fix: account for ambient cwd and loader execution in backup commands
ibetitsmike
committed
19c9cdd
fix: localize npm launchers under inherited preloads and interactive Python under PYTHONSTARTUP
ibetitsmike
committed
8cfe2e0
fix: account for env cwd, PHPRC, and Git executable search paths
ibetitsmike
committed
733a118
fix: track PATH scripts, runtime hooks, and wrapper working directories
ibetitsmike
committed
d5cc1ae
fix: track mise command execution boundaries
ibetitsmike
committed
a1ff70a
fix: resolve executable operands from shell cwd and track sqlite init files
ibetitsmike
committed
909a744
fix: localize Lua launchers under an inherited published LUA_INIT file
ibetitsmike
committed
2dad64e
fix: canonicalize inherited PATH entries and localize under dynamic-loader preloads
ibetitsmike
committed
4e44d82
fix: resolve loader search paths, inherited PYTHONPATH/CLASSPATH archives, and git -c overrides
ibetitsmike
committed
c66a998
fix: canonicalize inherited env paths, track boot class paths and sqlite -cmd
ibetitsmike
committed
8aaafbd
fix: localize direct java boot-class-path archives
ibetitsmike
committed
225b3db
fix: localize under inherited git config overrides and openssl config operands
ibetitsmike
committed
97f6154
fix: localize git launchers under inherited execution hooks
ibetitsmike
committed
ee5108a
fix: track deprecated Git parameters and LLDB command files
ibetitsmike
committed
8774b65
fix: track Perl debugger, uv run, GDB commands, and Ninja builds
ibetitsmike
committed
9f57e37
fix: expand inherited JVM argument-file coverage
ibetitsmike
committed
ad20e8e
fix: track direct runtime loaders and inherited build hooks
ibetitsmike
committed
f68116c
fix: cover symlinked operands and inherited runtime hooks
ibetitsmike
committed
e6352db