Skip to content

[spark-compete] fix: redact hook/log paths from user-facing list output#1430

Open
Esc1200 wants to merge 1 commit into
vibeforge1111:masterfrom
Esc1200:esc1200/fix/hook-path-leak
Open

[spark-compete] fix: redact hook/log paths from user-facing list output#1430
Esc1200 wants to merge 1 commit into
vibeforge1111:masterfrom
Esc1200:esc1200/fix/hook-path-leak

Conversation

@Esc1200

@Esc1200 Esc1200 commented Jun 7, 2026

Copy link
Copy Markdown

[spark-compete] Redact internal hook/log paths from CLI list output

Team: drophub_sir (members: esc1200, drophub_sir, spark-agent)
Author: Esc1200

Actual Behavior

cli.py leaks internal filesystem paths in three user-facing output locations:

  1. Line 11444 (cmd_fix secrets --redact-logs): Prints full file paths of redacted log files (e.g. /home/user/.spark/logs/process.log) instead of just filenames.
  2. Line 11488 (cmd_fix autostart): Prints hook file paths (e.g. /home/user/.spark/hooks/spark-autostart.sh) alongside hook name and installed status.
  3. Line 12084 (specialization_loop_status_command): Constructs PYTHONPATH inline with internal swarm_root/apps/bridge/src paths using raw str() conversion instead of the existing prepend_pythonpath helper.

Expected Behavior

  • Redacted log file display should show only filenames (not full paths).
  • Hooks list should show only name and installed status (no file paths).
  • PYTHONPATH construction should use the centralized prepend_pythonpath helper for consistency.

Repro Steps

  1. spark fix secrets --redact-logs — observe full filesystem paths printed for each redacted log file.
  2. spark fix autostart — observe hook file paths printed in the Hooks section.
  3. specialization_loop_status_command uses inline PYTHONPATH construction leaking internal directory structure.

Before/After Proof

  • Before: print(f" {path}") prints full path; hook output includes hook.get('path'); PYTHONPATH built with raw str(bridge_src).
  • After: print(f" {Path(path).name}") shows filename only; hook output omits path; PYTHONPATH uses prepend_pythonpath(env, [bridge_src]).

Changes

  • src/spark_cli/cli.py: 3 lines changed (3 insertions, 4 deletions)
    • Line 11444: Path(path).name replaces full path display
    • Line 11488: Remove {hook.get('path')} from hooks output
    • Line 12080-12084: Replace inline PYTHONPATH construction with prepend_pythonpath helper

- cmd_fix secrets: show only filename (not full path) for redacted log files
- cmd_fix autostart: remove hook file path from hooks list display
- specialization_loop_status_command: use prepend_pythonpath helper
  instead of inline PYTHONPATH construction with internal paths

Severity: MEDIUM
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant