privacy scan, array param fix, and the dead command builder - #32
Merged
Merged
Conversation
`privacy scan` reports the fields the filter would touch, grouped by schema, and
which operations return them:
$ spec2cli privacy scan ./api.yaml
4 fields would be redacted:
Customer
email, full_name, phone, cpf
Returned by:
GET /customers
Turning the filter on without being able to see its reach was a bad trade in
both directions: too little and personal data goes out anyway, too much and a
field the caller needed comes back redacted with no hint why. Detection is by
name and format, so an unusually named field is missed — which is the reason to
be able to look. Part of #22; the runtime filtering half already shipped.
Array parameters given as JSON were sent as raw strings. The extractor names an
array after its items — `string[]`, not `array` — so the check for structured
types never matched and `["a","b"]` reached the server quoted.
The dead commander-builder module is gone. It had not been on the runtime path
for some time, duplicated command building, and had already drifted: #31 changed
it while the live path moved on. That is the same shape of divergence that let
--dry-run print credentials in the clear.
Its JSON-parameter tests are replaced against the live path, and doing so is what
surfaced the array bug: the old ones hand-built their Operation objects with
`type: "array"`, a value the extractor never produces, so they passed while the
behaviour they claimed to cover was broken.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QpcUFZcRHNurdJ2diVg37T
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three things that came out of clearing the backlog.
privacy scan--filter-piishipped without any way to see what it touches. That is a bad trade in both directions: too little and personal data reaches the model anyway, too much and a field the caller needed comes back redacted with no hint why.$ spec2cli privacy scan ./api.yaml Shop API 4 fields would be redacted: Customer email full_name phone cpf Returned by: GET /customers--output jsongives the field list as data. Detection is by field name and format, so an unusually named field is missed — which is precisely the reason to be able to look. Addresses the reporting half of #22; runtime filtering already existed.Array params were sent as strings
The extractor names an array type after its items —
string[], notarray— so the check for structured types never matched.--tags '["a","b"]'reached the server as a quoted string rather than an array.This had a passing test. The test hand-built its
Operationwithtype: "array", a value the extractor never produces, so it exercised a shape that does not occur and stayed green while the real path was broken. Rewriting it to go through the extractor is what surfaced the bug.The dead command builder
src/executor/commander-builder.tshad not been on the runtime path for some time. It duplicated command building and had already drifted — #31 changed it while the live path moved on. That is the same shape of divergence that let--dry-runprint credentials in the clear, so it is deleted rather than fixed.Its JSON-parameter tests are replaced against
dynamic-commands.ts.Also
bench/harness/lean-agent.mjs— the experiment that would settle the Phase B question. The ~880-operation crossover is a property of the agent: Claude Code resends ~31k tokens per turn, which is what makes a discovery step expensive. A lean loop resends far less and should cross over much sooner. It needsANTHROPIC_API_KEYand has not been run; if context-per-turn lands near 2k rather than 31k,PROGRESSIVE_THRESHOLDshould come down.Testing
212 tests, up from 209 — net of 12 deleted with the dead module and 15 added.
🤖 Generated with Claude Code
https://claude.ai/code/session_01QpcUFZcRHNurdJ2diVg37T