Skip to content

fix(ui): don't redact valid repo/login names in miner commands - #457

Merged
JSONbored merged 1 commit into
JSONbored:mainfrom
galuis116:fix/miner-command-overredaction
Jun 8, 2026
Merged

fix(ui): don't redact valid repo/login names in miner commands#457
JSONbored merged 1 commit into
JSONbored:mainfrom
galuis116:fix/miner-command-overredaction

Conversation

@galuis116

@galuis116 galuis116 commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

Closes #456.
pr457-miner-command-real-section-wide

sanitizeMinerCommand's private-term redaction had an optional value-assignment group, so it matched bare standalone words (wallet, hotkey, coldkey, mnemonic, trust-score, …). Since login/repoFullName are already validated by safeGitHubLogin/safeRepoFullName, a legitimate name containing one of those words got corrupted while the command stayed marked copyable: true, state: "ready" — so the user copies a broken command with [redacted] in place of their real repo/login. Common in a Bittensor/crypto ecosystem (e.g. metamask/wallet-adapter).

Changes

  • Require the term=value / term: value form so only real secret leakage is redacted, not validated names.
  • Add a test with login trust-score and repo metamask/wallet-adapter asserting the names survive and the command stays runnable.

Verification

  • Full unit suite green (1247 passed). The new test fails against the old code (old output redacted wallet-adapter[redacted]-adapter).

@galuis116
galuis116 requested a review from JSONbored as a code owner June 7, 2026 06:11
@dosubot dosubot Bot added the size:XS label Jun 7, 2026
@github-actions github-actions Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jun 7, 2026
@ghost

ghost commented Jun 7, 2026

Copy link
Copy Markdown

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal Result Evidence Action
Gate result ⚠️ Skipped #457 is no longer open. No action.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

@JSONbored JSONbored left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@galuis116 the sanitizer fix matches the bug in #456.

A few notes:

  • Requiring term=value / term: value before redaction preserves valid repo/login names like wallet-adapter and trust-score.
  • The regression test covers the broken command case well.
  • This still changes visible command output in the UI, so the PR needs screenshot evidence in the PR description.

Required changes:

  • Add JPG/PNG UI evidence showing the affected command surface with a valid repo/login containing one of the previously redacted terms.
  • Keep the screenshot in the PR description, not committed to the repo.

Validation expected:

  • Rerun the focused miner command test and the UI checks relevant to the command surface.

@galuis116

Copy link
Copy Markdown
Contributor Author

@galuis116 the sanitizer fix matches the bug in #456.

A few notes:

  • Requiring term=value / term: value before redaction preserves valid repo/login names like wallet-adapter and trust-score.
  • The regression test covers the broken command case well.
  • This still changes visible command output in the UI, so the PR needs screenshot evidence in the PR description.

Required changes:

  • Add JPG/PNG UI evidence showing the affected command surface with a valid repo/login containing one of the previously redacted terms.
  • Keep the screenshot in the PR description, not committed to the repo.

Validation expected:

  • Rerun the focused miner command test and the UI checks relevant to the command surface.

screenshot added.

sanitizeMinerCommand's private-term redaction used an optional assignment group, so bare words (wallet, hotkey, trust-score) in already-validated login/repo names were redacted, producing broken commands still marked copyable/ready. Require the term=value form so only real secret leakage is redacted.
@JSONbored
JSONbored force-pushed the fix/miner-command-overredaction branch from 720bfed to 991031f Compare June 8, 2026 22:55
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@JSONbored JSONbored left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@galuis116 this is ready from my side on the rebased head.\n\nA few notes:\n- The sanitizer now targets assignment-style sensitive values instead of redacting legitimate repo/login words.\n- The regression test covers the important Bittensor-adjacent case: login trust-score and repo metamask/wallet-adapter stay runnable and copyable.\n- I rebased the branch through GitHub update-branch, and the current head has green validate and non-Gittensory checks.\n\nNo code changes requested.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

No open projects
Status: Done

Development

Successfully merging this pull request may close these issues.

Miner command sanitizer redacts legitimate repo/login names, producing broken "ready" commands

2 participants