feat(leak-guard): suggest a scrub command on block #25

Merged

clawdie merged 1 commit from feat/leak-guard-suggested-scrub into main

2026-07-04 11:08:28 +02:00

clawdie commented

2026-07-04 11:03:14 +02:00

Owner

On a leak block, leak-guard now prints a review-gated, ready-to-run scrub instead of leaving you to hand-edit:

tailnet IP / MagicDNS leaks → a copy-paste sed -i.bak -E (single-quoted; the patterns only match real leaks, so a 100.x.x.x placeholder or <tailnet-name> is never touched)
config-listed public IPs → pointed at, told to replace with <osa-public-ip>

Deliberately not silent auto-masking — rewriting under the author would hide that a real value was in the diff and risk clobbering legitimate example IPs. Block-by-default stays; the fix is one reviewed command away.

Self-test unchanged (asserts exit codes, not output) and still passes.

🤖 Generated with Claude Code

On a leak block, leak-guard now prints a **review-gated, ready-to-run scrub** instead of leaving you to hand-edit: - tailnet IP / MagicDNS leaks → a copy-paste `sed -i.bak -E` (single-quoted; the patterns only match *real* leaks, so a `100.x.x.x` placeholder or `<tailnet-name>` is never touched) - config-listed public IPs → pointed at, told to replace with `<osa-public-ip>` **Deliberately not silent auto-masking** — rewriting under the author would hide that a real value was in the diff and risk clobbering legitimate example IPs. Block-by-default stays; the fix is one reviewed command away. Self-test unchanged (asserts exit codes, not output) and still passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

clawdie added 1 commit

2026-07-04 11:03:20 +02:00

feat(leak-guard): suggest a scrub command on block (not silent auto-mask)

leak-guard / guard (pull_request) Successful in 11s

Details

01b9810e25

When leak-guard blocks, it now prints a ready-to-run, review-gated scrub:
- tailnet IP / MagicDNS leaks → a copy-paste `sed -i.bak -E` with
  single-quoted expressions that only match REAL leaks (a 100.x.x.x
  placeholder or <tailnet-name> won't match), across the offending files
- config-listed public IPs → pointed at (no single canonical placeholder
  to guess), told to replace with <osa-public-ip>

Deliberately NOT silent auto-masking: rewriting under the author would hide
that a real value was in the diff and risk clobbering legitimate example
IPs. Block-by-default stays; the fix is now one reviewed command away.

Self-test unchanged (asserts exit codes, not output) and still passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

clawdie merged commit 3a99fe3764 into main

2026-07-04 11:08:28 +02:00

clawdie referenced this pull request from a commit

2026-07-04 11:08:30 +02:00

Merge pull request 'feat(leak-guard): suggest a scrub command on block' (#25) from feat/leak-guard-suggested-scrub into main

clawdie deleted branch feat/leak-guard-suggested-scrub

2026-07-04 11:08:37 +02:00