From d6fe190fce0ea3ab39abc3704454778de6deaf34 Mon Sep 17 00:00:00 2001 From: Chuck <33324927+ChuckBuilds@users.noreply.github.com> Date: Thu, 17 Sep 2026 09:06:40 -0400 Subject: [PATCH] fix(update): don't log pip's output from the health check's reinstall pip can echo a private index URL with embedded credentials; permission_utils redacts it, the stdlib-only verifier cannot, so it logs the exit code only. Co-Authored-By: Claude Opus 5 --- scripts/utils/auto_update_verify.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/utils/auto_update_verify.py b/scripts/utils/auto_update_verify.py index d089cbec..d75fe276 100644 --- a/scripts/utils/auto_update_verify.py +++ b/scripts/utils/auto_update_verify.py @@ -214,7 +214,8 @@ class Verifier: # Only a refused command line is worth the next candidate. A pip # that ran and failed, or timed out, would just do it again. if not any(phrase in (result.stderr or '') for phrase in SUDO_REFUSAL_PHRASES): - self.log(f'reinstalling {rel} failed: {(result.stderr or "").strip()[-300:]}') + # Not pip's output: it can echo an index URL's credentials. + self.log(f'reinstalling {rel} failed (exit {result.returncode})') return False return False