pr-vision

peptide-repo/pr-vision

Fork 0

Commit Graph

Author	SHA1	Message	Date
peptiderepo	85956da7c8	PR Vision v0.2.3: fix PHPCS escape-output violations in key manager renderer WordPress.Security.EscapeOutput.OutputNotEscaped (x3): - Lines 110+148: inline esc_url( admin_url() ) directly in echo; drop pre-assigned $form_url - Line 128: replace $disabled variable with literal-conditional ( $is_const ? ' disabled aria-disabled="true"' : '' ) — no dynamic value PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket (x1): - Line 116: move esc_html( opening to its own line so arg starts on next line Full file audit: no other unescaped echo found; $nonce data-attr uses esc_attr(), $ajax_url uses esc_url(), inline <script> has existing phpcs:ignore. No behavior change; password input still renders empty. CHANGELOG [0.2.3]: one-line note — output-escaping hardening in key manager renderer. Agent-Session: geomonitor / 2026-06-15	2026-06-15 03:41:09 +00:00
peptiderepo	67499506ba	PR Vision v0.2.3: UI-editable provider API key, encrypted + write-only Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL), PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax. Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc option > none. All probe + test paths read key through PRV_Key_Store::get_key(). Security: - Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext). - Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored. - Plaintext never in options, logs, exceptions, page source, REST, or JS. - manage_options + nonce on set/remove/test. wp-config precedence enforced. - write-only UI: password input always renders empty; status text only. - uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc. Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php (encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence, write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/ CHANGELOG all updated in this commit. Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui	2026-06-15 03:08:54 +00:00

Author

SHA1

Message

Date

peptiderepo

85956da7c8

PR Vision v0.2.3: fix PHPCS escape-output violations in key manager renderer

WordPress.Security.EscapeOutput.OutputNotEscaped (x3):
- Lines 110+148: inline esc_url( admin_url() ) directly in echo; drop pre-assigned $form_url
- Line 128: replace $disabled variable with literal-conditional
  ( $is_const ? ' disabled aria-disabled="true"' : '' ) — no dynamic value

PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket (x1):
- Line 116: move esc_html( opening to its own line so arg starts on next line

Full file audit: no other unescaped echo found; $nonce data-attr uses esc_attr(),
$ajax_url uses esc_url(), inline <script> has existing phpcs:ignore.
No behavior change; password input still renders empty.

CHANGELOG [0.2.3]: one-line note — output-escaping hardening in key manager renderer.

Agent-Session: geomonitor / 2026-06-15

2026-06-15 03:41:09 +00:00

peptiderepo

67499506ba

PR Vision v0.2.3: UI-editable provider API key, encrypted + write-only

Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL),
PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax.

Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc
option > none. All probe + test paths read key through PRV_Key_Store::get_key().

Security:
- Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext).
- Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored.
- Plaintext never in options, logs, exceptions, page source, REST, or JS.
- manage_options + nonce on set/remove/test. wp-config precedence enforced.
- write-only UI: password input always renders empty; status text only.
- uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc.

Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php
(encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence,
write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/
CHANGELOG all updated in this commit.

Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui

2026-06-15 03:08:54 +00:00

2 Commits