No-paste credential terminal for the paper lane: hidden-prompt store, read-only paper rate-limit probe - #203

Seamless, no-paste credential practice for the paper lane. Keys go from the operator's keyboard straight into the per-host store. They never pass through an agent, a chat, a command line or shell history.

Tools (tools/credentials/)

• open_credential_terminal.sh <entry-id> [--probe] opens a new terminal window: Windows Terminal on WSL2, a console window as fallback, Terminal.app on macOS, or an X terminal on Linux. If none is available, it prints the one command to run. The window runs a generated session script that holds commands only and deletes itself on exit. Before anything is typed, the script:

  • prints the checkout commit;
  • refuses if the credential tools have uncommitted changes;
  • clears PYTHONPATH, LD_PRELOAD, BASH_ENV and similar variables;
  • runs Python with -I.

  Paths and the distro name are validated before they reach cmd.exe or wt.exe, the window starts with wsl.exe -u <user> --exec, and a failed launch is reported.

• set_credential.py <entry-id> accepts only operator-supplied stored entries (required, optional or paid) whose file sits directly in the store.

  • It reads each value with hidden input, and refuses when the terminal cannot hide input.
  • It writes export NAME=value lines, the documented format that every parser accepts.
  • The file is 0600 in the 0700 store, written through an O_DIRECTORY|O_NOFOLLOW handle.
  • Replacing an existing file needs a hidden replace.
  • A value with ~, non-ASCII or shell-special characters is refused.

• alpaca_rate_limit_probe.py is a paper-only read-only probe.

  • It sends one GET /v2/account to the fixed paper host, follows no redirect and reads no body.
  • It reports only the HTTP status and the x-ratelimit-* headers, writing any result file via a temp file and replace.
  • It checks the key file after opening it: same inode, owner, exactly 0600, one link, and a 0700 directory.
  • Agents may run it with --env-file "$PAPER_ENV_FILE".

Scope. Live broker keys are out of scope for this repository; live trading is handled outside it. An earlier draft of this branch had a live mode, and the independent review's high finding on it has been removed together with the mode. The alpaca-paper inventory note records the scope.

Verification

• 51 tests (tests.test_credential_tools, tests.test_credential_status, tests.test_secret_path_guard), run with fake values only. They include:
  • an end-to-end check with two local HTTP servers that redirects are never followed;
  • a check that a result path which is a symlink is replaced, not followed;
  • the hard-link, mode, directory and worktree refusals;
  • the launcher dry run and argument checks.
• validate.py and evidence_manifest.py --check pass; only the sha256 and byte counts of the two changed registered files were updated.
• gitleaks: no leaks.
• Native check: on this host's dedicated paper account, the probe returned HTTP 200 with x-ratelimit-limit: 200 (199 remaining).

Review. The first independent review raised 1 high, 2 medium and 12 low findings, all addressed. The high one was live keys at rest, now removed with the live scope. A follow-up review of the redesign is in progress; its findings will be applied before merge.

🤖 Generated with Claude Code