This repository was archived by the owner on Sep 8, 2026. It is now read-only.

Secrets hardening and persistent hosting support for the gateway - #137

Closed

dizhaky wants to merge 43 commits into

mainfrom

claude/slack-session-94aae0

Commits on Jul 27, 2026

Add 1Password Secrets Manager integration following Bitwarden pattern
claude
committed
c1c269f
fix: resolve type checker warnings for optional onepassword-sdk import
claude
committed
87ec5f9
fix: resolve CodeQL security alerts - redact secrets from logs, use stronger hash for cache key
claude
committed
f3600ef
fix: remove token from cache key to resolve CodeQL hash-on-sensitive-data alert
claude
committed
fb07963
fix: restore bitwarden early-return structure to avoid CodeQL reanalysis, redact exception from 1password error log
claude
committed
dea92c7
fix: redact secret names and error details from Bitwarden status prints
claude
committed
abcb403
fix: resolve final CodeQL alert - redact exception message from 1Password warning log
claude
committed
2ee7925
fix: eliminate all remaining token taint paths to logging sinks
claude
committed
890c507
fix: suppress exception chains and exc_info to eliminate all CodeQL taint paths
claude
committed
a59b1b1
fix: redact exception details in 1Password CLI commands to resolve final CodeQL alert
claude
committed
b7e141b
fix: remove secret key names from debug log to cut last CodeQL taint path
claude
committed
5f634ab
chore: clarify SDK auto-install exception is safe to log in full
claude
committed
a3f3205
ci: retrigger CodeQL after GitHub 503 transient error
claude
committed
c4ffe3c
fix: do not store 1Password service account token in plaintext .env file
claude
committed
d541e13
Add official MCP memory server to project settings
claude
committed
35debf8
fix: update nix lockfile hashes for tui and web packages
claude
committed
faa34d9
ci: retrigger nix build
claude
committed
5b96213
fix: address Codex review - asyncio event loop, timeouts, config defaults, and UX fixes
claude
committed
91c3239
fix: revert bitwarden error display to avoid CodeQL taint (use safe message)
claude
committed
1418d6b
fix: remove tainted logger.debug to pass CodeQL
claude
committed
67c95ef
fix: correct DEFAULT_CONFIG keys, use sys.executable for pip, detect field collisions, enable secret rotation
claude
committed
09097bb
fix: honor lazy install gate and remove service account token from argv
claude
committed
177d283
fix: use main branch nix lockfile hashes after rebase
claude
committed
3e896db
fix: use repo pip install strategy for uv virtualenv compatibility
claude
committed
f33dd0c
fix: use correct SDK list_all() methods and narrow pre-1.0 version ceiling
claude
committed
7810d92
chore: update uv.lock for onepassword-sdk optional dependency
claude
committed
5ba29d2
fix: allow explicit 'hermes secrets onepassword install' to bypass lazy-install gate
claude
committed
f6d34fb
ci: retrigger CodeQL after GitHub 503 transient error
claude
committed
95460fb
ci: retrigger nix build
claude
committed
ca6e607
fix: address remaining Codex review findings on 1Password integration
claude
committed
483735c
fix: block dangerous process-control env vars and register OP_SERVICE_ACCOUNT_TOKEN
claude
committed
aa74dd6
fix: strengthen env-var blocklist, redact removed-key names, surface fetch errors
claude
committed
4a61d9c
fix: expand env refs in secrets config, reject duplicate field labels, gate status on enabled
claude
committed
91e2a4d
fix: relinquish previously-managed secrets when 1Password sync is disabled
claude
committed
91b4928
fix: strict env-name regex, bounded cache, skip bootstrap for secrets commands
claude
committed
4b84f6f
fix: block EDITOR/VISUAL/PAGER, scrub custom token names, non-interactive setup, surface warnings
claude
committed
3756126
fix: redact per-field/per-secret warning text from two clear-text-logging sinks
claude
committed
d2f0668
fix: scrub vault/item metadata from errors, strip null bytes, block dynamic secrets from subprocesses
claude
committed
ce374fe
fix: replace str(exc) display with a proper exception category hierarchy
claude
committed
18af401

Commits

Commits on Jul 27, 2026

Commits on Aug 1, 2026