mirror of
https://github.com/ruvnet/RuView.git
synced 2026-10-22 06:32:35 -05:00
Mathew Beaneandclaude-flow
d78a221607
--password puts the WiFi password in argv, where ps and shell history can see it (#1754). This adds two ways to give it without that: - --password-file PATH reads it from a file, dropping one trailing newline (\n or \r\n). The file must exist and not be empty. If group or others can read it, the script refuses and suggests chmod 600. --allow-insecure-password-file accepts such a file with a warning, for read-only mounts such as 0444 secrets. - When --ssid is given with no password flag and stdin is a terminal, the script asks with getpass. It reuses a saved password only if it was saved for the same SSID. Without a terminal (scripts, CI) nothing is asked and the existing missing-credentials check applies. --password still works, but now prints a one-line warning on stderr that points at --password-file. The two flags are mutually exclusive. The firmware README examples now use --password-file. Tests: 10 new tests in tests/test_provision_secrets.py, with placeholder credentials and getpass and the flasher stubbed. 8 fail on the previous commit; the other 2 check that nothing is asked without a terminal or when a saved password matches the SSID. The suite goes from 25 to 35 passing. Refs #1754 Co-Authored-By: claude-flow <ruv@ruv.net>