No frame of a publish holds the token as a plain value; the host's errors never quote their argument (typedstandards#141 P5)

[npstorey]

P5 of the notebook-publish sprint (npstorey/typedstandards#141; the owner's rulings P4-2 = A and P4-3 = A, 2026-10-09). There is no version bump in this PR: 0.2.1 is cut by a separate release PR after it merges, and the changes are under ## Unreleased.

The rules this PR keeps.

• The token reaches each request through an httpx.Auth that holds it in a slot and withholds it from its repr, whether with a client= the caller gives or with the client the call builds. No header dict carries it.
• When an exception escapes a request, the locals of the frames it carries (httpx's, httpcore's and h11's included, and those of chained exceptions) are cleared before it propagates. So a traceback with frame locals does not show the token. A non-transport error, KeyboardInterrupt included, is re-raised as itself.
• GitHubPagesHost's errors never quote their argument. A repository or branch with a part shaped like a GitHub token (a token prefix, then 30 or more token characters) is refused; a short name with a token prefix, such as ghp_notes, is accepted.

Branch and blast zone

ts141/p5-hardening, head 003a7d32b0ebbbb22a23cde06e812875e2b20334, on bdcf377 (main, 0.2.0). There are four commits, each SSH-signed with a sign-off. Round 1 is df0bcc9 (red) and e061ad8. Round 2, after the seat's review, is 9d45109 (red) and 003a7d3. The numstat below is round 1's; round 2 adds tests/test_publish_transport.py (+179) and changes _publish.py (+30 -4), tests/test_publish_token.py (+47 -2), README.md and CHANGELOG.md. uv.lock is unchanged.

8	0	CHANGELOG.md
5	3	README.md
76	20	src/typedstandards/_publish.py
11	1	tests/publish_support.py
81	7	tests/test_publish_token.py

tests/guards.py, tests/test_guards.py, .gitleaks.toml, pyproject.toml, package.json, package-lock.json and src/typedstandards/__init__.py are unchanged. No pinned test changed. publish_support.host() gained a mode argument, whose default is the earlier behaviour.

Red, then green

At df0bcc9, the red commit, ORCH reproduced: 7 failed, 36 passed, 1 skipped in tests/test_publish_token.py.

FAILED test_no_frame_holds_the_token_when_an_exception_escapes_the_client[an error raised inside the transport-client]
FAILED test_no_frame_holds_the_token_when_an_exception_escapes_the_client[an interrupt inside the transport-client]
FAILED test_no_frame_holds_the_token_when_an_exception_escapes_the_client[a body that does not decode-client]
FAILED test_no_frame_holds_the_token_when_an_exception_escapes_the_client[an error raised by an event hook-client]
FAILED test_the_hosts_errors_never_quote_their_argument[repository]
FAILED test_the_hosts_errors_never_quote_their_argument[branch]
FAILED test_the_hosts_errors_never_quote_their_argument[api_url]

• At e061ad8, the token scanner runs every publish path with a given client and with the client the call builds. It also checks each traceback with frame locals when an exception escapes the HTTP client, for each of four exception kinds. The event-hook case applies to a given client only; that is the one skip.
• ORCH ran an independent probe on e061ad8, walking every package frame's locals: none holds the token, with a given client or the call's own. Neither the repository nor the branch error shows it.

Checks (ORCH, at e061ad8)

uv sync --locked; uv run pytest   (Python 3.12, Node 24)  -> 379 passed, 1 skipped
uv run --python 3.11 pytest                               -> 379 passed, 1 skipped
uv run ruff check .                                       -> All checks passed!
uv run ruff format --check .                              -> 46 files already formatted
gitleaks git --log-opts=origin/main..HEAD                 -> no leaks found

The implementing session also ran Python 3.14 with Node 24, and Python 3.12 with Node 22 (379 passed, 1 skipped each). It ran the wheel job from a fresh clone too: uv build, a fresh install, scripts/smoke_wheel.py, smoke check passed. The keyword-scan emulation reports 0 hits.

Round 2 (9d45109 red, 003a7d3 green), after the seat's review of e061ad8

The seat found that round 1's texts claimed more than its tests measured, because they drove httpx's mock transport only. Round 2 makes the rule hold on the real transport, and narrows the texts to what is tested.

• A test on httpx's real transport (tests/test_publish_transport.py). It uses httpx.HTTPTransport with httpcore's sync backend replaced by a stream that opens no socket and whose write fails. It runs 3 failure kinds × publish's own client and a given client. It walks every frame local of the escaping exception and its chain, and the traceback formatted with locals. A control test shows the walk reads httpcore's frames.
• Red at 9d45109, reproduced by ORCH: 8 failed, the 4 real-transport cases and 4 short-name cases. Green at 003a7d3.
• ORCH's independent probe on the real transport (httpcore 1.0.9, h11 0.16.0), with a write that raises KeyboardInterrupt: no frame holds the token at 003a7d3, with publish's own client or a given one, and the formatted traceback does not show it.
• Checks at 003a7d3 (ORCH): 392 passed, 1 skipped on Python 3.11, 3.12 and 3.14 with Node 24; ruff clean; gitleaks clean. The implementing session also ran Python 3.12 with Node 22, and the wheel job from a fresh clone (smoke check passed).
• One earlier test changed: test_the_scanner_fails_on_an_offender[frame local]. Its deliberately leaking frame sat inside the transport, which the fix now clears, so it now leaks from a later step instead. The assertion is unchanged.
• A note for later: the real-transport test imports httpcore internals. Rerun it first after any httpcore upgrade in the lock.

Model

Implemented by IMPL P2/P5 on Opus 5.5 at high effort, in two rounds. Re-verified by ORCH NOTEBOOK-PUBLISH on Opus 5.5.

🤖 Generated with Claude Code