You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
pass the VS Code Marketplace PAT through the official VSCE_PAT environment variable
remove --pat <token> from the spawned command arguments
add a regression that proves the token never appears in argv
Bug
The target supplied VSCE_TOKEN as a --pat command argument. On a non-zero exit, sh1pt core includes the complete argument list in the thrown error, exposing the Marketplace PAT in logs and CI output. The official @vscode/vsce CLI defaults its PAT from VSCE_PAT, so the token does not need to be present in argv.
Validation
failing-before test captured the PAT in argv
pnpm exec vitest run packages/targets/plugin-vscode/src/index.test.ts --reporter=dot (7/7)
🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.
🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.
🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.
🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.
🤖 Auto-rebase: The branch was rebased successfully locally but could not be pushed to the fork. Please enable 'Allow edits from maintainers' in the PR settings, or rebase manually: git fetch upstream master && git rebase upstream/master.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Summary
VSCE_PATenvironment variable--pat <token>from the spawned command argumentsBug
The target supplied
VSCE_TOKENas a--patcommand argument. On a non-zero exit, sh1pt core includes the complete argument list in the thrown error, exposing the Marketplace PAT in logs and CI output. The official@vscode/vsceCLI defaults its PAT fromVSCE_PAT, so the token does not need to be present in argv.Validation
pnpm exec vitest run packages/targets/plugin-vscode/src/index.test.ts --reporter=dot(7/7)pnpm --filter @profullstack/sh1pt-target-plugin-vscode typecheckgit diff --checkOfficial behavior: https://github.com/microsoft/vscode-vsce/blob/main/src/main.ts