[Minitour]

Summary

Fourth round of Qodo follow-ups for the v2.4.0 release, on top of #354. Both comments on #354 were valid.

Stacked on #354: merge this into fix/release-240-review-3 first, then #354 into fix/release-240-review-2, #353 into fix/release-240-review, and #352 into develop.

What changed

• AWS-style keys with low entropy (secret-redaction.ts): the 40-character mixed-case rule from fix: second round of v2.4.0 release review follow-ups #353 is back alongside the entropy check, so a key like AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/a1B2 is blanked again.
• Tests now exercise the value rules (secret-redaction.test.ts): LETTER_TOKEN_URL and AWS_SECRET contained TOKEN and SECRET, so the name rule blanked them before the value was checked. They are renamed to MIRROR_URL and AWS_VALUE, and LOW_ENTROPY_40 covers the case above.

Test plan

• Redaction tests pass.
• Each rule is covered: removing the URL token rule fails the test on MIRROR_URL, and removing the 40-character rule fails it on LOW_ENTROPY_40.
• bunx tsc --noEmit passes.

Checklist

• Tests added or updated
• bunx tsc --noEmit passes
• Docs updated (if user-facing): not needed

🤖 Generated with Claude Code

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore low-entropy 40-character key redaction

🐞 Bug fix 🧪 Tests 🕐 10-20 Minutes

AI Description

• Restore the 40-character mixed-case key rule so low-entropy AWS-style secrets are blanked.
• Rename fixtures to verify URL-token and key-value redaction without sensitive-name matches.

Diagram

graph TD
  A["Server API"] --> B["Env redaction"] --> C{"Sensitive name?"} -->|no| D{"Credential value?"} -->|no| E{"Base64 secret?"} -->|no| G["Keep value"]
  C -->|yes| F["Blank value"]
  D -->|yes| F
  E -->|yes| F

Loading

High-Level Assessment

Keep the targeted 40-character rule alongside the existing entropy check: entropy alone misses the demonstrated key, while replacing the broader value checks would risk changing path handling. Generic fixture names are appropriate because they make the tests exercise value-based redaction.

Files changed (2) +14 / -5

Bug fix (1) +7 / -1

secret-redaction.tsRestore the 40-character mixed-case key rule +7/-1

Restore the 40-character mixed-case key rule

• Treats qualifying 40-character Base64-style values as secrets regardless of Shannon entropy, while retaining the existing character checks and entropy fallback.

src/server/secret-redaction.ts

Tests (1) +7 / -4

secret-redaction.test.tsExercise value-based redaction with generic fixture names +7/-4

Exercise value-based redaction with generic fixture names

• Renames the URL-token and AWS-key fixtures so sensitive-name matching cannot satisfy their assertions. Adds a low-entropy 40-character mixed-case value and expects it to be blanked.

src/server/tests/secret-redaction.test.ts

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Some relative paths appear blank in the editor 🐞 Bug ≡ Correctness

Description

isBase64Secret now returns true for any 40-character, mixed-case value with a digit that passes
its Base64-alphabet check, even when the value is a low-entropy relative path. For example,
opt/Ghidra11/support/analyzeHeadlessTool meets those conditions, so a server using it as a literal
environment value receives an empty string in the project API response and edit form.

Code

src/server/secret-redaction.ts[R77-79]

+	if (value.length === 40 && /[A-Z]/.test(value) && /[a-z]/.test(value)) {
+		return true;
+	}

Evidence

The example is exactly 40 characters, contains uppercase and lowercase letters and digits, and
consists solely of characters accepted by the initial regex. The added branch therefore blanks it
through the literal-env redaction path; project responses use that path, and the editor loads its
returned env map.

src/server/secret-redaction.ts[73-80]
src/server/secret-redaction.ts[103-114]
src/server/secret-redaction.ts[128-136]
src/server/project-routes.ts[198-224]
web-ui/src/features/projects/components/tools/ServerDialog.tsx[91-100]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new 40-character shortcut blanks legitimate low-entropy relative paths, hiding their configured values in the server editor.
## Fix Focus Areas
- src/server/secret-redaction.ts[73-80]
- src/server/__tests__/secret-redaction.test.ts[99-120]
## Recommended Fix
Distinguish path-shaped values, such as relative paths with multiple word-like segments, before applying the low-entropy 40-character shortcut. Add a test for a 40-character relative path while retaining coverage for the low-entropy key.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Some relative paths appear blank in the editor 🐞 Bug ≡ Correctness

isBase64Secret now returns true for any 40-character, mixed-case value with a digit that passes
its Base64-alphabet check, even when the value is a low-entropy relative path. For example,
opt/Ghidra11/support/analyzeHeadlessTool meets those conditions, so a server using it as a literal
environment value receives an empty string in the project API response and edit form.

Agent Prompt

## Issue description
The new 40-character shortcut blanks legitimate low-entropy relative paths, hiding their configured values in the server editor.

## Fix Focus Areas
- src/server/secret-redaction.ts[73-80]
- src/server/__tests__/secret-redaction.test.ts[99-120]

## Recommended Fix
Distinguish path-shaped values, such as relative paths with multiple word-like segments, before applying the low-entropy 40-character shortcut. Add a test for a 40-character relative path while retaining coverage for the low-entropy key.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools