Repository navigation
fix(projects): take the LaunchDarkly API token as an argument, not from env - #244
davidbrackbill wants to merge 2 commits into
Conversation
…om env The directory's "Uses a credential from the user's machine" hold also covers code examples that read a token from the environment and send it to a server. The agentcontrol/projects references read LAUNCHDARKLY_API_TOKEN from env in the Python, Node.js, and Go ProjectManager, the admin CLI, and the Terraform/Ansible examples. Make the token a required argument, prompt for it in the CLI, Terraform, and Ansible examples, and bump Claude (1.0.6) and Cursor (1.0.7). Claude <claude@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 891fe3a. Configure here.
| ### List Projects | ||
| ```python | ||
| pm = ProjectManager() | ||
| pm = ProjectManager(api_token) |
There was a problem hiding this comment.
FastAPI still reads API token
Medium Severity
The FastAPI Settings class still loads launchdarkly_api_token from .env via pydantic BaseSettings, so ProjectManager keeps reading a LaunchDarkly API token from the environment. The same file's Django example no longer does this, and the new header forbids reading the token from env or .env files. Agents that follow this section will keep using a machine credential.
Triggered by learned rule: Plugin skills must not read machine credentials
Reviewed by Cursor Bugbot for commit 891fe3a. Configure here.
Skill eval results
Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline. |
- iac-automation: the docker-compose setup prompts for the token instead of passing LAUNCHDARKLY_API_TOKEN through from the host shell; the CI examples say they read it from the platform's secret store. - onboarding 0.4.1: read the bundled mcp-configure and sdk-install skills from its own folder instead of having the agent run `npx skills add`. Claude <claude@anthropic.com>
Why
Follow-up to #243: the directory still holds the latest version for "Uses a credential from the user's machine", which covers doc examples too.
Note
Left as is: CI/k8s secret-store examples, SDK-key app code, and the eval provider (#247).
Details
projectsreferences take the API token as an argument; CLI, Terraform, Ansible, compose prompt. Onboarding stops runningnpx skills add.Claude claude@anthropic.com
104 lines changed · generated by churn using cloc