fix(cli): avoid piping secrets through echo when using wrangler secret put
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 76/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- shell, typescript
Research direction
Start in packages/cli/src/lib/cloudflare.ts and inspect the secret-setting invocation and wranglerArgv entry point. Reproduce the counterscale install or env command with a value containing newlines, $, backticks, and spaces, then verify that the value stored by Cloudflare matches byte-for-byte.
Written by the indexing model from the issue text.
Description
Follow-up from review of #265.
In packages/cli/src/lib/cloudflare.ts, secrets are set via:
await $`echo ${value} | ${this.wranglerArgv()} secret put ${key} --config ${this.configPath}`;
Depending on zx's interpolation/echo behavior, secrets containing newlines, $, backticks, or other shell-special characters can get mangled before they reach wrangler secret put (e.g. CF_PASSWORD_HASH / CF_JWT_SECRET values).
A more robust approach is to pass the secret on stdin without a shell pipeline and without echoing it, e.g. spawn wrangler with input piping, or -e-safe quoting, so arbitrary secret values round-trip byte-for-byte.
Acceptance: setting a secret containing newlines, $, backticks, and spaces via counterscale install / env command results in the identical value stored in Cloudflare.
- Dominant language
- TypeScript
- Stars
- 2.2k
- Forks
- 136
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from benvinegar/counterscale
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
benvinegar/counterscale#272 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
benvinegar/counterscale#271 ·
-
enhancement
Difficulty 4/5 1-2 days Newbie friendliness 49/100
benvinegar/counterscale#273 ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
benvinegar/counterscale#257 ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
benvinegar/counterscale#255 ·
All issues in benvinegar/counterscale
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
components-web-app/docs#307 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
localstack/localstack-mcp-server#112 ·
Maintainers usually reply within 1 day
-
area:frontend kind:bug priority:p1 ready
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
bug ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
PhyberApex/kuroshiro#1687 ·
Maintainers usually reply within 1 day
-
Performance (Web Vitals) collector: LCP/FCP from background tabs are not discarded, inflating p75Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
umami-software/umami#4720 ·
Maintainers usually reply within 3 days