cff06439fa
Three-part follow-up from the 2026-04-22 privacy postmortem:
1. OAUTH_CLIENT_ID verified as public Claude Code constant (not a secret).
Added gitleaks allowlist entry. The value 9d1c250a-e61b-44d9-88ed-5944d1962f5e
is the public PKCE client ID used by the Claude Code CLI — public clients in
PKCE flows have no client secret, so the ID itself carries no secret value.
Introduced in commit b87992f (the 2026-04-11 drift incident); the constant
mirrors what cli.js embeds for its OAuth token-refresh flow.
2. README.md API key example made clearly fake (ocp_example12345abcde...) to
avoid gitleaks false-positives and clarify to readers it is not real.
The ocp_ prefix IS the real prefix (keys.mjs line 80: randomBytes(24).base64url),
so the prior example could be mistaken for a real truncated key.
3. PR template: added Privacy self-check section for PUBLIC repos below the
existing 5.3 user-visible change self-check section.
4. .gitleaks.toml: new file with allowlist for the three confirmed non-issues
(OAUTH_CLIENT_ID constant, README placeholder regex, old plan doc path).
No code or behavior change beyond the docs, README, and new config file.
Closes part of ocp#44.
Co-authored-by: Tao Deng <dtzp555@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
3.3 KiB
Pull Request
Summary
Claude Code Alignment Evidence (REQUIRED)
Per ALIGNMENT.md, every PR that touches server.mjs or any network-facing surface must fill out this section. PRs with this section blank or unchecked will receive a request changes review and cannot be merged.
-
Corresponding
cli.jsreference. I have identified thecli.jsfunction and line range that performs the operation this PR forwards. Citation (formatcli.js:NNNNorcli.js vE4 <functionName>): -
If
cli.jsdoes not perform this operation, I have stated this explicitly below and justified the scope underALIGNMENT.mdRule 2. (Note: in almost all cases this means the PR should be closed, not merged. Proxy layers do not invent endpoints.) -
Commit message citations. Every "Claude Code uses X" or "cli.js uses X" assertion in every commit of this PR is immediately followed by a
cli.js:NNNNorcli.js vE4 <functionName>citation. I have verified this by rereading each commit message.
Type of change
- Bug fix (alignment with existing
cli.jsbehavior) - Feature (new
cli.jsbehavior now surfaced through OCP) - Refactor (no wire-level behavior change)
- Deletion (unalignable feature removal per
ALIGNMENT.mdUnalignable Policy) - Documentation / governance
Reviewer checklist
Reviewers: this section is for you, not the author. Do not approve until every box is checked.
- I opened
cli.jsat the cited line range and confirmed the operation matches. - I ran (or confirmed CI ran)
.github/workflows/alignment.ymland it passed. - I am not the commit author of any commit in this PR (Iron Rule 10).
- If the PR asserts scope without a
cli.jscitation, I confirmed the justification is sound perALIGNMENT.mdRule 2.
Related
ALIGNMENT.mdRule(s) invoked:- Related issue / prior PR:
- Historical lesson reference (if relevant):
User-visible change self-check (铁律第五律 5.3)
- This PR has user-visible changes → README has corresponding documentation (paste diff link or line range)
- This PR has no user-visible changes → stated "no user-visible change" in summary above
Reviewers: if "user-visible" is checked but README diff is empty, block merge (per 5.3 reviewer gate).
Privacy self-check (for PUBLIC repos) — Iron Rule adjacent
- This PR does not introduce real names, nicknames, or handles that identify specific individuals. All references use role-based terms (
project maintainer,contributor,user,reviewer). - This PR does not introduce literal personal paths (
/Users/<username>/,/home/<username>/). Uses$HOME/or~/instead. - This PR does not introduce personal machine hostnames. Uses role-based names or generic descriptors.
- This PR does not introduce personal email addresses beyond automated placeholders like
noreply@<vendor>.com.
Reviewers: if any of the above is violated and the repo is PUBLIC, block merge and request scrub.