From 509db497b28ffe3c51ea3e394dc80228dbd0437b Mon Sep 17 00:00:00 2001 From: Jeff MAURY Date: Mon, 15 Jun 2026 15:34:52 +0200 Subject: [PATCH] refactor(cli): expose only config keys in provider list JSON/YAML output Update provider_to_json() to only include config keys (not values) in structured output, matching the security model used for credentials. This prevents potential exposure of sensitive configuration values. Changed field name from "config" to "config_keys" to clarify that only keys are included, consistent with "credential_keys" field naming. --- crates/openshell-cli/src/run.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/crates/openshell-cli/src/run.rs b/crates/openshell-cli/src/run.rs index 2ef9500c4..392d39d31 100644 --- a/crates/openshell-cli/src/run.rs +++ b/crates/openshell-cli/src/run.rs @@ -4796,9 +4796,10 @@ fn provider_to_json(provider: &Provider) -> serde_json::Value { serde_json::json!(credential_keys), ); - // Config (non-secret configuration) + // Config keys (keys only, not values) if !provider.config.is_empty() { - obj.insert("config".to_string(), serde_json::json!(provider.config)); + let config_keys: Vec = provider.config.keys().cloned().collect(); + obj.insert("config_keys".to_string(), serde_json::json!(config_keys)); } // Metadata fields (only if metadata exists)