Reject retired credentials in CLI transports

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

Stop the Python CLI from sending the retired shared credential through its API and reachability paths. The error tells users to configure a replacement.

Root Cause

The CLI has independent HTTP and subprocess credential paths, so an SDK guard alone does not cover them.

Fix

• Validate the selected configuration credential, direct HTTP-client construction, and reachability credentials before use.
• Compare a SHA-256 fingerprint without including credential values in source or errors.
• Preserve environment and argument precedence.

Validation

10 focused tests pass, including real constructors and configuration parsing. New helper and test files pass Ruff. Tests use synthetic credentials without API requests.

Public Changelog

Reject a retired shared API credential before API requests or reachability execution.

---

Note

Medium Risk
Changes authentication validation on every CLI startup and client construction; mis-fingerprinting could block legitimate tokens, though scope is limited to one retired credential fingerprint.

Overview
Release 2.10.12 blocks a known retired Socket API credential before any HTTP or reachability work runs, instead of letting it flow through separate CLI paths.

A new reject_retired_api_token helper compares the configured token to a SHA-256 fingerprint (constant-time) and raises a clear ValueError without echoing the token. It is wired into CLI config parsing, SocketConfig / CliClient construction, and ReachabilityAnalyzer (including right before Coana runs).

API token resolution is centralized in select_api_token, keeping the existing precedence across the four SOCKET_* env vars with --api-token as fallback. Unit tests cover rejection messaging, env precedence, and safe construction without network calls.

^{Reviewed by Cursor Bugbot for commit cfada31. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but none of the reported issues met your autofix severity threshold.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cfada31. Configure here.}

[cursor]

Retired-token error escapes CLI handler

Medium Severity

reject_retired_api_token raises ValueError from CliConfig.from_args. cli catches that and calls from_args again to read --disable-blocking and --exit-code-on-api-error. The second call raises the same error, so _emit_infrastructure_error never runs and those flags are ignored. Operators get an uncaught traceback instead of the CLI's formatted infrastructure error path.

 

^{Reviewed by Cursor Bugbot for commit cfada31. Configure here.}