# Keep descriptor secrets out of argv and silence re-primed status alerts · lucenx/codexbar-plasma

[View on GitCafe](https://git.cafe/lucenx/codexbar-plasma/commit/6ba10ff31063383fbffb0fee68a957301d631f53)

Repository: [lucenx/codexbar-plasma](https://git.cafe/lucenx/codexbar-plasma)

Visibility: public

Requested revision: 6ba10ff31063383fbffb0fee68a957301d631f53

Requested commit: 6ba10ff31063383fbffb0fee68a957301d631f53

Commit: 6ba10ff31063383fbffb0fee68a957301d631f53

Tree: b2febdcd23f12cbe0f163f9dccde3267a992b464

Author: Simone

Committer: Simone

## Message

```
Keep descriptor secrets out of argv and silence re-primed status alerts

writeDescriptorField routed secret fields to a stdin channel built as
`sh -c script _ "$secret"`. That kept the value off the CLI's own argv but
still published it in the shell's, which any local process can read from
/proc/<pid>/cmdline. There is no safe way to hand a secret to a command
line, so the generic writer now rejects secret fields outright and
runDescriptorCommand loses its stdin parameter. promptDescriptorSecret is
unchanged and remains the only secret-carrying path, because it reads the
value inside the script instead of receiving it as an argument. The path
was not reachable from the UI, where secret fields already render a
prompt-only button, so this removes a latent trap rather than a live leak.

primeNotifications skips providers whose refresh is pending, so after
resetNotificationMemo (triggered by any threshold or toggle change) such a
provider had no status baseline. Its first clean payload then read
previousValue === "" and announced a pre-existing incident as new. A
statusPrimed marker now distinguishes "primed with no incident" from
"never primed", and the first observation is recorded silently.

Both rules get static assertions, verified to fail against the old code.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

```

## Parents

- [d735da4482f00a4d76523e5f826668f28b67947f](https://git.cafe/lucenx/codexbar-plasma/commit/d735da4482f00a4d76523e5f826668f28b67947f?format=markdown)

[Source at this commit](https://git.cafe/lucenx/codexbar-plasma/tree/6ba10ff31063383fbffb0fee68a957301d631f53?format=markdown)