kiwi-code 0.0.511__tar.gz → 0.0.512__tar.gz

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: kiwi-code
-Version: 0.0.511
+Version: 0.0.512
 Summary: A textual-based terminal user interface application
 Project-URL: Homepage, https://kiwicode.ai
 Author-email: Anurag <anurag@meetkiwi.co>

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kiwi-code"
-version = "0.0.511"
+version = "0.0.512"
 description = "A textual-based terminal user interface application"
 readme = {file = "README.md", content-type = "text/markdown"}
 requires-python = ">=3.11,<4.0"

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/src/kiwi_runtime/commands.py

@@ -1,6 +1,8 @@
 """One-off and interactive commands."""
 import asyncio
+import json
 import os
+import re
 import shlex
 import signal
 import subprocess
@@ -9,6 +11,7 @@ import time
 import uuid
 from collections import deque
 from typing import Any
+from urllib.parse import unquote, urlsplit
 
 from kiwi_runtime.constants import (
     IS_WINDOWS,
@@ -222,13 +225,94 @@ async def _kill_command(proc: asyncio.subprocess.Process) -> None:
         pass
 
 
+#: Values shorter than this are not masked: too likely to match ordinary output.
+_MIN_MASKED_LEN = 6
+#: What a forwarded variable's name may be; anything else is refused.
+_ENV_NAME = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+#: At most this many forwarded variables, each at most this long.
+_MAX_ENV_VARS = 64
+_MAX_ENV_VALUE = 16_384
+
+
+def command_env(value: Any) -> dict[str, str] | None:
+    """
+    The `env` a one-off or interactive command message carries (connection credentials
+    the backend resolved for it), checked: string names a shell accepts, string values, a
+    bounded number. Anything else is dropped rather than half-applied. None when there is none.
+    """
+    if not isinstance(value, dict) or not value:
+        return None
+    env: dict[str, str] = {}
+    for key, val in list(value.items())[:_MAX_ENV_VARS]:
+        if isinstance(key, str) and _ENV_NAME.match(key) and isinstance(val, str) and len(val) <= _MAX_ENV_VALUE:
+            env[key] = val
+    return env or None
+
+
+#: Strings in a JSON credential (a service account's private key and the like) shorter
+#: than this are not masked on their own: field names, types, project ids.
+_MIN_JSON_SECRET_LEN = 16
+
+
+def _secret_parts(value: str) -> list[str]:
+    """
+    What of a forwarded value a command could print and must not: the value itself; for a
+    header like "Bearer <token>", the token; for a database connection string, its
+    password; for a JSON credential (BigQuery), its long string fields (a private key).
+    Kept in step with the backend's terminal_tool._secret_parts and the extension's
+    runtime/commandEnv.ts.
+    """
+    parts = [value]
+    _, _, token = value.partition(" ")
+    parts.append(token)
+    if "://" in value:
+        try:
+            password = urlsplit(value).password
+        except ValueError:
+            password = None
+        if password:
+            parts += [password, unquote(password)]
+    if value.lstrip().startswith("{"):
+        try:
+            loaded = json.loads(value)
+        except ValueError:
+            loaded = None
+        if isinstance(loaded, dict):
+            for field in loaded.values():
+                if isinstance(field, str) and len(field) >= _MIN_JSON_SECRET_LEN:
+                    parts += [field, field.replace("\n", "\\n")]
+    return parts
+
+
+def mask_secrets(text: str, env: dict[str, str] | None) -> str:
+    """
+    Every forwarded value in `text` replaced by its variable's name, in case the command
+    printed one: each value whole, and the parts of it that are secrets on their own
+    (`_secret_parts`). (The backend masks again; this keeps it from leaving the machine
+    at all.)
+    """
+    if not text or not env:
+        return text
+    pairs = [
+        (part, key)
+        for key, value in env.items()
+        for part in _secret_parts(value)
+        if len(part) >= _MIN_MASKED_LEN
+    ]
+    for value, key in sorted(pairs, key=lambda p: len(p[0]), reverse=True):
+        text = text.replace(value, f"[{key}]")
+    return text
+
+
 async def run_command(
     command: str,
     timeout: int = 30,
     mode: str = "restricted",
     allowed_dirs: list[str] | None = None,
+    env: dict[str, str] | None = None,
 ) -> dict:
-    """Execute a shell command and return stdout, stderr, exit_code."""
+    """Execute a shell command and return stdout, stderr, exit_code. `env` is added to this
+    command's environment only, on top of the runtime's own; it is not logged."""
     # Validate in restricted mode
     if mode == "restricted" and allowed_dirs:
         ok, reason = validate_command(command, allowed_dirs)
@@ -248,6 +332,8 @@ async def run_command(
             "stdin": asyncio.subprocess.DEVNULL,
             "cwd": cwd,
         }
+        if env:
+            popen_kwargs["env"] = {**os.environ, **env}
         if not IS_WINDOWS:
             popen_kwargs["start_new_session"] = True
 
@@ -294,8 +380,11 @@ async def run_interactive_command(
     mode: str = "restricted",
     allowed_dirs: list[str] | None = None,
     request_id: str | None = None,
+    env: dict[str, str] | None = None,
 ) -> dict:
-    """Execute a command with the user's terminal attached for interactive I/O."""
+    """Execute a command with the user's terminal attached for interactive I/O. `env` is
+    added to this command's environment only, as for run_command. What the command prints
+    goes to the user's terminal, never to the server: the server gets only the exit code."""
     if mode == "restricted" and allowed_dirs:
         ok, reason = validate_command(command, allowed_dirs)
         if not ok:
@@ -317,6 +406,8 @@ async def run_interactive_command(
             mode=mode,
             allowed_dirs=allowed_dirs,
             timeout_sec=timeout_eff,
+            env=env,
+            mask=(lambda text: mask_secrets(text, env)) if env else None,
         )
 
     try:
@@ -346,6 +437,8 @@ async def run_interactive_command(
                         old_term = None
 
                 popen_kwargs: dict[str, Any] = {"shell": True, "cwd": cwd}
+                if env:
+                    popen_kwargs["env"] = {**os.environ, **env}
                 if not IS_WINDOWS:
                     popen_kwargs["start_new_session"] = True
                 # The command writes to the terminal directly; what was printed goes first.

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/src/kiwi_runtime/handlers.py

@@ -5,7 +5,7 @@ import sys
 from typing import Any, Awaitable, Callable
 
 from kiwi_runtime.checkpoints import _set_current_run_id
-from kiwi_runtime.commands import _looks_interactive_oneoff, run_interactive_command
+from kiwi_runtime.commands import _looks_interactive_oneoff, command_env, run_interactive_command
 from kiwi_runtime.constants import IS_WINDOWS
 from kiwi_runtime.fs.handler import FS_HANDLERS, handle_fs_request
 from kiwi_runtime.restricted import validate_command
@@ -79,8 +79,10 @@ async def _command(state: _RuntimeState, msg: dict[str, Any]) -> None:
         timeout_sec = int(msg.get("timeout_sec", 30) or 30)
     except Exception:
         timeout_sec = 30
+    # App connection credentials for this command only (the "command_env" capability).
+    env = command_env(msg.get("env"))
     try:
-        state.command_queue.put_nowait((str(request_id), str(command), timeout_sec))
+        state.command_queue.put_nowait((str(request_id), str(command), timeout_sec, env))
     except asyncio.QueueFull:
         print_cmd_log(request_id, f"{RED}FAILED{RESET}", False)
         await state.reply(_command_result(request_id, "Runtime command queue full; please retry."))
@@ -90,6 +92,8 @@ async def _interactive(state: _RuntimeState, msg: dict[str, Any]) -> None:
     request_id = msg.get("request_id", "")
     command = msg.get("command", "")
     print_cmd_log(request_id, f"$ {BOLD}{command}{RESET} {GREY}(interactive){RESET}")
+    # Connection credentials for this command only; never logged.
+    env = command_env(msg.get("env"))
 
     try:
         timeout_sec = int(msg.get("timeout_sec", 120) or 120)
@@ -103,6 +107,7 @@ async def _interactive(state: _RuntimeState, msg: dict[str, Any]) -> None:
             mode=state.mode,
             allowed_dirs=state.allowed_dirs,
             request_id=request_id,
+            env=env,
         )
         exit_code = result["exit_code"]
         success = exit_code == 0

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/src/kiwi_runtime/link.py

@@ -11,7 +11,7 @@ from pathlib import Path
 import websockets
 
 from kiwi_runtime.auth import _get_valid_access_token, login
-from kiwi_runtime.commands import run_command
+from kiwi_runtime.commands import mask_secrets, run_command
 from kiwi_runtime.constants import MAX_INBOUND_FRAME_BYTES
 from kiwi_runtime.fs.handler import FS_MAX_CONCURRENCY
 from kiwi_runtime.handlers import handle_message
@@ -32,7 +32,10 @@ from kiwi_runtime.ui import (
 #   goodbye      sends {"type": "goodbye"} before an intentional exit
 #   outbox       keeps what it could not send and delivers it after reconnecting
 #   pty_survive  keeps its PTY sessions across a reconnect and lists them at auth
-RUNTIME_CAPABILITIES = ["goodbye", "outbox", "pty_survive"]
+#   command_env  takes an `env` mapping on a one-off or interactive command (connection
+#                credentials), adds it to that command's environment only, and masks it in
+#                the output
+RUNTIME_CAPABILITIES = ["goodbye", "outbox", "pty_survive", "command_env"]
 
 RECONNECT_BASE_DELAY_SEC = 1.5
 RECONNECT_MAX_DELAY_SEC = 30.0
@@ -89,11 +92,11 @@ async def _command_worker(state: _RuntimeState, mode: str, allowed_dirs: list[st
     """Runs one-off commands from the queue; a result outlives the connection it was asked
     on. Each command is its own shell, so several workers run them side by side."""
     while True:
-        request_id, command, timeout_sec = await state.command_queue.get()
+        request_id, command, timeout_sec, env = await state.command_queue.get()
         state.running_commands.append(command)
         try:
             result = await run_command(
-                command, timeout=timeout_sec or 30, mode=mode, allowed_dirs=allowed_dirs
+                command, timeout=timeout_sec or 30, mode=mode, allowed_dirs=allowed_dirs, env=env
             )
             try:
                 exit_code = int(result.get("exit_code", 0))
@@ -111,6 +114,14 @@ async def _command_worker(state: _RuntimeState, mode: str, allowed_dirs: list[st
         finally:
             state.running_commands.remove(command)
             state.command_queue.task_done()
+        if env:
+            # A credential the command printed must not reach the server, the model or the
+            # chat: each value is replaced by its variable's name.
+            result = {
+                **result,
+                "stdout": mask_secrets(result.get("stdout", ""), env),
+                "stderr": mask_secrets(result.get("stderr", ""), env),
+            }
         await state.link.send(json.dumps({"type": "result", "request_id": request_id, **result}))
 
 

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/src/kiwi_runtime/sessions.py

@@ -149,9 +149,12 @@ if not IS_WINDOWS:
             cols: int = 120,
             rows: int = 40,
             on_exit: Callable[[], None] | None = None,
+            env: dict[str, str] | None = None,
         ):
             self.session_id = session_id
             self.command = command
+            # Added to this process's environment only (connection credentials); not logged.
+            self.env = env
             self.cols = cols
             self.rows = rows
             self.master_fd = None
@@ -190,6 +193,7 @@ if not IS_WINDOWS:
                 stderr=self.slave_fd,
                 preexec_fn=_own_terminal,
                 cwd=cwd,
+                env={**os.environ, **self.env} if self.env else None,
             )
 
             os.close(self.slave_fd)
@@ -422,9 +426,12 @@ class PipeProcess:
         rows: int = 40,
         mode: str = "restricted",
         allowed_dirs: list[str] | None = None,
+        env: dict[str, str] | None = None,
     ):
         self.session_id = session_id
         self.command = command
+        # Added to this process's environment only (connection credentials); not logged.
+        self.env = env
         self.cols = cols
         self.rows = rows
         self.proc = None
@@ -444,6 +451,7 @@ class PipeProcess:
         self.cwd = cwd
         self.ws = ws
         self._sentinel_buffer = ""
+        env = {**os.environ, **self.env} if self.env else None
 
         if IS_WINDOWS:
             shell = os.environ.get("COMSPEC", "cmd.exe")
@@ -457,6 +465,7 @@ class PipeProcess:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.STDOUT,
                 cwd=cwd,
+                env=env,
                 creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,
             )
         else:
@@ -467,6 +476,7 @@ class PipeProcess:
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.STDOUT,
                 cwd=cwd,
+                env=env,
             )
 
         self._read_task = asyncio.create_task(self._read_loop(ws))

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/src/kiwi_runtime/tui_bridge.py

@@ -5,7 +5,7 @@ import os
 import uuid
 from datetime import datetime
 from pathlib import Path
-from typing import Any
+from typing import Any, Callable
 
 from kiwi_runtime.constants import (
     IS_WINDOWS,
@@ -30,8 +30,17 @@ def _tui_managed_control_dir() -> Path | None:
 
 
 class _LocalInteractivePTYBridge:
-    def __init__(self, *, control_dir: Path, request_id: str, command: str) -> None:
+    def __init__(
+        self,
+        *,
+        control_dir: Path,
+        request_id: str,
+        command: str,
+        mask: Callable[[str], str] | None = None,
+    ) -> None:
         self.control_dir = control_dir
+        # Hides forwarded credentials in what is written to output.log for the TUI to show.
+        self._mask = mask
         self.request_id = request_id
         self.command = command
         self.session_dir = control_dir / "interactive"
@@ -75,6 +84,10 @@ class _LocalInteractivePTYBridge:
     def append_output(self, data: str) -> None:
         if not data:
             return
+        if self._mask is not None:
+            # Chunk by chunk: a value split across two reads is not caught. The file stays on
+            # this machine and nothing of it is sent to the server.
+            data = self._mask(data)
         with open(self.output_path, "a", encoding="utf-8", errors="replace") as fp:
             fp.write(data)
             fp.flush()
@@ -179,6 +192,8 @@ async def run_tui_managed_interactive_command(
     mode: str = "restricted",
     allowed_dirs: list[str] | None = None,
     timeout_sec: int | None = None,
+    env: dict[str, str] | None = None,
+    mask: Callable[[str], str] | None = None,
 ) -> dict:
     if mode == "restricted" and allowed_dirs:
         ok, reason = validate_command(command, allowed_dirs)
@@ -186,7 +201,9 @@ async def run_tui_managed_interactive_command(
             return {"stdout": "", "stderr": reason, "exit_code": 1}
 
     cwd = allowed_dirs[0] if allowed_dirs else None
-    bridge = _LocalInteractivePTYBridge(control_dir=control_dir, request_id=request_id, command=command)
+    bridge = _LocalInteractivePTYBridge(
+        control_dir=control_dir, request_id=request_id, command=command, mask=mask
+    )
     await asyncio.to_thread(bridge.activate)
     await asyncio.to_thread(bridge.append_output, f"$ {command}\r\n")
 
@@ -202,9 +219,10 @@ async def run_tui_managed_interactive_command(
                 40,
                 mode=mode,
                 allowed_dirs=allowed_dirs,
+                env=env,
             )
         else:
-            pty_proc = PTYProcess(session_id, command, 120, 40)
+            pty_proc = PTYProcess(session_id, command, 120, 40, env=env)
         await pty_proc.start(bridge, cwd=cwd)
         input_task = asyncio.create_task(bridge.pump_inputs(pty_proc))
 

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/tests/test_runtime_connection.py

@@ -313,7 +313,7 @@ async def test_it_states_what_it_can_do_when_it_authenticates(backend, run_runti
     run_runtime()
     auth = (await until(lambda: backend.auths))[0]
 
-    assert auth["capabilities"] == ["goodbye", "outbox", "pty_survive"]
+    assert auth["capabilities"] == ["goodbye", "outbox", "pty_survive", "command_env"]
     assert auth["pty_sessions"] == []
     assert auth["max_frame_bytes"] == runtime.MAX_INBOUND_FRAME_BYTES
 
@@ -642,6 +642,162 @@ async def test_one_off_commands_sent_together_run_side_by_side(backend, run_runt
     assert {m["request_id"] for m in backend.messages("result")} == {f"r{n}" for n in range(runtime.COMMAND_WORKERS)}
 
 
+# --- app connection credentials on a one-off command ("command_env") ----------------------
+
+
+async def test_a_command_gets_the_variables_it_was_sent_and_its_output_is_masked(backend, run_runtime):
+    """The backend resolved the user's saved connections into `env`: they reach that one
+    command, and a value it printed comes back as its variable's name."""
+    run_runtime()
+    await until(lambda: backend.sockets)
+    env = {
+        "AUTOBOTS_CONN_WORKDAY_PROD_AUTHORIZATION": "Bearer wd-secret-token-123",
+        "AWS_SECRET_ACCESS_KEY": "aws-secret-key-0001",
+    }
+
+    await backend.send({
+        "type": "command",
+        "request_id": "with-env",
+        "command": 'echo "$AUTOBOTS_CONN_WORKDAY_PROD_AUTHORIZATION"; echo "token=${AUTOBOTS_CONN_WORKDAY_PROD_AUTHORIZATION#Bearer }"; echo "$AWS_SECRET_ACCESS_KEY" >&2',
+        "timeout_sec": 10,
+        "env": env,
+    })
+    await until(lambda: backend.messages("result"))
+    result = backend.messages("result")[0]
+
+    assert result["exit_code"] == 0
+    assert result["stdout"] == "[AUTOBOTS_CONN_WORKDAY_PROD_AUTHORIZATION]\ntoken=[AUTOBOTS_CONN_WORKDAY_PROD_AUTHORIZATION]\n"
+    assert result["stderr"] == "[AWS_SECRET_ACCESS_KEY]\n"
+
+
+async def test_the_variables_are_for_that_command_only(backend, run_runtime):
+    run_runtime()
+    await until(lambda: backend.sockets)
+
+    await backend.send({"type": "command", "request_id": "a", "command": "echo set", "timeout_sec": 10,
+                        "env": {"AUTOBOTS_CONN_X_AUTHORIZATION": "secret-value-1"}})
+    await until(lambda: backend.messages("result"))
+    await backend.send({"type": "command", "request_id": "b", "command": 'echo "[${AUTOBOTS_CONN_X_AUTHORIZATION:-}]"', "timeout_sec": 10})
+    await until(lambda: len(backend.messages("result")) == 2)
+
+    later = next(m for m in backend.messages("result") if m["request_id"] == "b")
+    assert later["stdout"] == "[]\n"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="PTY")
+async def test_an_interactive_command_under_the_tui_gets_the_variables_masked_on_screen(tmp_path, monkeypatch):
+    """Under the TUI an interactive command runs on a PTY whose output the TUI reads from
+    output.log: the variables reach it, a printed value is masked there, and the server is
+    told only that it ended."""
+    from kiwi_runtime.commands import run_interactive_command
+
+    monkeypatch.setenv("KIWI_TUI_MANAGED", "1")
+    monkeypatch.setenv("KIWI_RUNTIME_CONTROL_DIR", str(tmp_path))
+    result = await run_interactive_command(
+        'test "$AUTOBOTS_CONN_GH_AUTHORIZATION" = "Bearer gh-secret-token-9" && echo "ok $AUTOBOTS_CONN_GH_AUTHORIZATION"',
+        timeout_sec=10,
+        mode="full",
+        request_id="i1",
+        env={"AUTOBOTS_CONN_GH_AUTHORIZATION": "Bearer gh-secret-token-9"},
+    )
+
+    shown = (tmp_path / "interactive" / "output.log").read_text()
+    assert result == {"stdout": "(interactive session completed)", "stderr": "", "exit_code": 0}
+    assert "ok [AUTOBOTS_CONN_GH_AUTHORIZATION]" in shown
+    assert "gh-secret-token-9" not in shown
+
+
+async def test_an_interactive_command_in_a_plain_terminal_gets_the_variables(tmp_path, monkeypatch):
+    from kiwi_runtime.commands import run_interactive_command
+
+    monkeypatch.delenv("KIWI_TUI_MANAGED", raising=False)
+    out = tmp_path / "seen"
+    result = await run_interactive_command(
+        f'printf %s "$AUTOBOTS_DB_PG_URL" > "{out}"',
+        timeout_sec=10,
+        mode="full",
+        env={"AUTOBOTS_DB_PG_URL": "fake-connection-string-0001"},
+    )
+
+    assert result["exit_code"] == 0
+    assert out.read_text() == "fake-connection-string-0001"
+    assert "AUTOBOTS_DB_PG_URL" not in os.environ
+
+
+async def test_an_interactive_message_carries_its_variables_to_the_command(monkeypatch):
+    seen: dict[str, Any] = {}
+
+    async def fake_run(command, **kwargs):
+        seen.update(kwargs)
+        return {"stdout": "(interactive session completed)", "stderr": "", "exit_code": 0}
+
+    monkeypatch.setattr(handlers, "run_interactive_command", fake_run)
+    replies: list[dict] = []
+    ran: list[Any] = []
+
+    class _Requests:
+        def submit(self, lane, job):
+            ran.append(job)
+
+    class _State:
+        mode = "full"
+        allowed_dirs: list[str] = []
+        requests = _Requests()
+
+        async def reply(self, msg):
+            replies.append(msg)
+
+    await handlers._interactive(_State(), {"type": "interactive", "request_id": "r", "command": "gh auth status",
+                                           "env": {"AUTOBOTS_CONN_GH_AUTHORIZATION": "Bearer t-123456", "1BAD": "x"}})
+    await ran[0]()
+
+    assert seen["env"] == {"AUTOBOTS_CONN_GH_AUTHORIZATION": "Bearer t-123456"}
+    assert replies[0]["exit_code"] == 0
+
+
+def test_only_well_formed_variables_are_taken():
+    from kiwi_runtime.commands import command_env
+
+    assert command_env(None) is None
+    assert command_env({}) is None
+    assert command_env("A=B") is None
+    assert command_env({"GOOD_1": "v", "1BAD": "v", "BAD-NAME": "v", "NOT_TEXT": 3, "LONG": "x" * 20_000}) == {"GOOD_1": "v"}
+
+
+def test_a_printed_database_password_or_private_key_is_masked():
+    """forward_databases_direct: a connection string's password and a BigQuery key, printed
+    on their own, are as secret as the whole value."""
+    import json as _json
+
+    from kiwi_runtime.commands import mask_secrets
+
+    # Made up, and put together from parts so secret scanners do not take them for real.
+    pem, body = "PRIVATE" + " KEY", "fake-key-body-for-tests-0001"
+    key = f"-----BEGIN {pem}-----\n{body}\n-----END {pem}-----\n"
+    word, encoded = "fake@word-99", "fake%40word-99"
+    env = {
+        "AUTOBOTS_DB_WAREHOUSE_URL": "postgresql://" + f"analyst:{encoded}@db.internal:5432/sales",
+        "AUTOBOTS_DB_BQ_CREDENTIALS_JSON": _json.dumps({"type": "service_account", "private_key": key}),
+    }
+    printed = f"pw={word} enc={encoded}\nraw: {key}json: {_json.dumps(key)}\n"
+
+    masked = mask_secrets(printed, env)
+
+    for secret in [word, encoded, body]:
+        assert secret not in masked
+    assert masked.startswith("pw=[AUTOBOTS_DB_WAREHOUSE_URL] enc=[AUTOBOTS_DB_WAREHOUSE_URL]\n")
+    assert "raw: [AUTOBOTS_DB_BQ_CREDENTIALS_JSON]" in masked
+    assert 'json: "[AUTOBOTS_DB_BQ_CREDENTIALS_JSON]"' in masked
+
+
+def test_masking_leaves_short_values_and_ordinary_text_alone():
+    from kiwi_runtime.commands import mask_secrets
+
+    assert mask_secrets("value is abc", {"SHORT": "abc"}) == "value is abc"
+    assert mask_secrets("no secrets here", {"K": "long-secret-value"}) == "no secrets here"
+    assert mask_secrets("x long-secret-value y", None) == "x long-secret-value y"
+
+
 # --- requests do not hold up the receive loop ---------------------------------------------
 
 

{kiwi_code-0.0.511 → kiwi_code-0.0.512}/uv.lock

@@ -412,7 +412,7 @@ wheels = [
 
 [[package]]
 name = "kiwi-code"
-version = "0.0.511"
+version = "0.0.512"
 source = { editable = "." }
 dependencies = [
     { name = "codeglass" },