fix(security): redact all proxy credentials and drop the phantom ecdsa dependency

[groupthinking]

Canonical issue

Closes #1437

Outcome

Lands the two security fixes from #1378 that were orphaned by the secret-purge force-push. Both original PRs (#1118, #1156) share no ancestry with main, so neither could be rebased or cherry-picked — both were reimplemented against current main, and in one case the original premise had to be re-verified before it could be trusted.

Proxy credentials stop leaking into logs. redact_proxy_credentials bailed out unless the configured WEBSHARE_PROXY_URL appeared byte-for-byte, so a host that urllib3 had case-normalised, a percent-encoded form echoed by yt-dlp, a CalledProcessError argv repr, or any other proxy variable passed straight through into log output.

The ecdsa advisory is cleared by removing the path to it. GHSA-wj6h-64fc-37mp has no patched release, so upgrading was never an option. python-jose was its sole dependent and is never imported.

Scope

• Included:
  • src/youtube_extension/utils/proxy.py — two-pass redaction; accepts non-str; never raises.
  • shared/libs/youtube_proxy.py — the drifted standalone copy, whose three logger calls in the retry handler are the actual leak site.
  • tests/unit/test_proxy_utils.py — new; the module had no coverage at all.
  • pyproject.toml, requirements.txt, uv.lock — drop python-jose.
• Explicitly excluded:
  • passlib — the same template-only phantom, but no advisory. Flagged in both manifests, not removed unilaterally.
  • The rest of Re-cut work orphaned by the secret-purge force-push (26 PRs) #1378 (fix(pipeline): preserve captured transcript on analysis timeout #1075, fix(auth): restore Google OAuth configuration in Vercel production #903, fix: route every transcript client through the centralized proxy (#1087) #1129, …) — still needs re-cutting.

Risk

• Risk level: low
• Failure mode, redaction: over-redaction destroying diagnostics. Explicitly tested against — an @ in a path, query, or fragment, and a bare host:port, all pass through untouched, and a match can never span two URLs. The helper is also now total: a hostile __str__ yields <unprintable error>, a redaction failure yields <redaction failed>. Both fail closed rather than raising inside an except block or returning text that cannot be vouched for.
• Failure mode, dependency: removing something actually needed. uv lock also removed rsa; verified its only dependent was python-jose too, and that google-auth in this resolution needs cryptography + pyasn1-modules, not rsa. Zero residual references to ecdsa, rsa, or python-jose in uv.lock, and zero AST-level imports of any of them.
• Rollback: git revert. Two independent commits; either can be reverted alone.

Verification

Head de6f36cae.

• The new tests are non-vacuous — 22 of 38 fail against the implementation on main, all 38 pass after the change. Checked by restoring main's two source files and re-running.
• Every leak reproduced before fixing — five cases, listed in Two unlanded security fixes orphaned by the force-push: proxy credential leak and the ecdsa advisory #1437, each confirmed leaking on main and confirmed clean after.
• Both helper copies tested — the suite parametrises over the canonical and shared/libs implementations, so neither can drift into leaking alone. Regex source verified byte-identical across the two.
• python-jose really is phantom — verified by AST parse, not grep: zero jose imports in src/, shared/, scripts/. The one textual hit is inside a string template.
• Generated projects unaffected — code_generator.py writes its own requirements.txt pinning python-jose[cryptography]==3.3.0 for the project it emits.
• Runtime intact — backend imports and serves 11 routes; code_generator (which holds the template) imports.
• Full unit suite — 8,035 passed, 5 xpassed, 0 failed.
• Lint — no new ruff findings; shared/libs/youtube_proxy.py holds at 8 pre-existing, unchanged.

Production evidence

Not applicable — no runtime behaviour changes for users. The redaction change only affects what is written to logs (strictly less credential material), and the dependency change removes packages that were never imported. Under MERGE_POLICY.md gate 4, previews gate apps/web/**; this touches none.

A correction worth recording

The original #1156 was titled "drop phantom python-jose". On current main that premise no longer looked true — grep finds from jose import JWTError, jwt in code_generator.py. Had I trusted the old PR's framing, I would have either skipped the fix as stale or removed a dependency that appeared to be in use.

Parsing the file settled it: the hit is inside a string literal the generator emits, and there are zero jose imports at AST level. The premise held; the grep was just the wrong instrument. Same shape as the merge-base lesson from the branch audit — the cheap signal disagreed with the true one.

Agent handoff

• One canonical issue is linked — Two unlanded security fixes orphaned by the force-push: proxy credential leak and the ecdsa advisory #1437
• No competing PR implements the same issue — fix(security): stop proxy credentials leaking from subprocess errors #1118 and fix(deps): drop phantom python-jose to clear unfixable ecdsa advisory #1156 are closed; this supersedes both
• Acceptance criteria are satisfied — all six in Two unlanded security fixes orphaned by the force-push: proxy credential leak and the ecdsa advisory #1437
• Required checks pass on the current head
• Human decision is requested only for: merging, and whether to also drop passlib

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 7, 2026 8:45pm

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dcf766d7-1f33-4092-ab6d-771abb2f2990

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (589 lines changed)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 98187c4.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
pip/pyjwt	2.13.0	Unknown	Unknown

Scanned Files

• requirements.txt
• uv.lock

[groupthinking]

CI caught a real miss, and the fix changes generator output — please read

test and Generate and Upload Coverage failed on de6f36cae with:

FAILED tests/unit/test_code_generator.py::TestGeneratedFastAPIBehaviour::test_unimplemented_endpoints_fail_loudly - ModuleNotFoundError: No module named 'jose'
FAILED tests/unit/test_code_generator.py::TestGeneratedFastAPIBehaviour::test_token_helpers_are_real_implementations   - ModuleNotFoundError: No module named 'jose'
FAILED tests/unit/test_code_generator.py::TestGeneratedFastAPIBehaviour::test_signing_fails_closed_without_a_secret_key - ModuleNotFoundError: No module named 'jose'

What I got wrong

I verified "zero jose imports at AST level" across src/, shared/ and scripts/ — but never checked tests/. TestGeneratedFastAPIBehaviour does not inspect the generated source, it executes the emitted FastAPI app. That app imports jose, so removing the dependency broke it.

My local suite passed 8,035/0 only because the venv still had python-jose installed from an earlier editable install. CI installs fresh, so it saw the truth and I didn't. The claim in the PR body that the dependency was unused was too broad — it was unused by EventRelay's runtime, not by its tests.

Those tests are regression cover for #1257, where the template shipped placeholder endpoints returning 200 so a generated project passed a naive smoke test while being non-functional. Making them skip when jose is unavailable would have restored green by making them vacuous — precisely the failure mode this repo has been digging out of. Not an option.

Why not just move it to the dev extra

That fixes CI while leaving ecdsa in uv.lock, so the advisory survives — and every generated project still inherits it. It would have made the PR green without achieving what the PR is for.

What I did instead

The template now emits PyJWT:

-from jose import JWTError, jwt
+import jwt
+from jwt import PyJWTError

encode/decode signatures are identical; only the exception type changes. PyJWT is maintained and has no open advisory; python-jose pulls ecdsa, whose GHSA-wj6h-64fc-37mp has no patched release.

This changes generator output. Projects generated with the authentication feature now get pyjwt>=2.10.1 in their requirements.txt instead of python-jose[cryptography]==3.3.0. I judged that in scope — the whole point is clearing an advisory, and a generated project should not ship a known-vulnerable transitive dependency — but it is a product-behaviour change, so say the word and I'll revert to the dev-extra approach instead, accepting that ecdsa stays in the lockfile.

pyjwt goes in the dev extra, not the runtime dependencies: EventRelay never imports it; only the generated app the tests execute does.

Verification, this time in an environment matching CI

I uninstalled python-jose, ecdsa and rsa from the venv first, so import jose genuinely fails — the condition that masked the bug is gone.

• tests/unit/test_code_generator.py — 96 passed
• Full unit suite — 8,035 passed, 0 failed
• uv.lock — ecdsa, python-jose, rsa all absent; pyjwt present
• ruff — clean on every touched file

Head is now 5cefd7d8e.

---

Generated by Claude Code

[linear-code]

GRV-363