Files
marathon/crates/app/Cargo.toml
Sienna Meridian Satterwhite 25550e2165 fix(security): redact sensitive session IDs in marathonctl output
Addresses CodeQL cleartext-logging alerts (#1, #2, #3) by implementing
session ID redaction for CLI output.

Changes:
- Extract marathonctl into standalone crate (crates/marathonctl)
- Add session ID redaction showing only first 8 characters by default
- Add --show-sensitive/-s flag for full session IDs when debugging
- Implement beautiful ratatui-based UI module with inline viewport
- Add .envrc to .gitignore for secure token management
- Document GitHub token setup in CONTRIBUTING.md

The CLI now provides a secure-by-default experience while maintaining
debugging capabilities through explicit opt-in flags. Session IDs are
redacted to format "abc-def-..." unless --show-sensitive is specified.

UI module provides easy-to-use builder APIs (ui::table, ui::grid, ui::list)
that render beautiful terminal output without hijacking the terminal.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-07 19:15:10 +00:00

60 lines
1.4 KiB
TOML

[package]
name = "app"
version = "0.1.0"
edition.workspace = true
[features]
default = ["desktop"]
desktop = [] # macOS only
ios = []
headless = []
[dependencies]
libmarathon = { path = "../libmarathon" }
libmarathon-macros = { path = "../macros" }
inventory.workspace = true
rkyv.workspace = true
bevy = { version = "0.17.2", default-features = false, features = [
# bevy_render, bevy_core_pipeline, bevy_pbr are now vendored in libmarathon
"bevy_ui",
"bevy_text",
"png",
] }
egui.workspace = true
glam.workspace = true
winit.workspace = true
raw-window-handle = "0.6"
uuid.workspace = true
anyhow.workspace = true
tokio.workspace = true
tracing.workspace = true
tracing-subscriber.workspace = true
tracing-appender.workspace = true
serde.workspace = true
rand.workspace = true
iroh = { workspace = true, features = ["discovery-local-network"] }
iroh-gossip.workspace = true
futures-lite.workspace = true
bytes.workspace = true
crossbeam-channel.workspace = true
clap.workspace = true
ratatui = "0.29"
crossterm = "0.28"
[target.'cfg(target_os = "ios")'.dependencies]
objc = "0.2"
raw-window-handle = "0.6"
tracing-oslog.workspace = true
[dev-dependencies]
iroh = { workspace = true, features = ["discovery-local-network"] }
iroh-gossip.workspace = true
tempfile.workspace = true
futures-lite.workspace = true
rkyv.workspace = true
bytes.workspace = true
[lib]
name = "app"
crate-type = ["staticlib", "cdylib", "lib"]