replicate_compare: scrub API token from curl error messages so a failed call never leaks it

4b9b81ee4838ac81a3a3821d86c2dbedb4108890 · 2026-05-19 13:09:30 -0700 · SteveStudio2

Files touched

M scripts/replicate_compare.js

Diff

commit 4b9b81ee4838ac81a3a3821d86c2dbedb4108890
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 13:09:30 2026 -0700

    replicate_compare: scrub API token from curl error messages so a failed call never leaks it
---
 scripts/replicate_compare.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/scripts/replicate_compare.js b/scripts/replicate_compare.js
index 52313d9..9f33388 100644
--- a/scripts/replicate_compare.js
+++ b/scripts/replicate_compare.js
@@ -39,7 +39,13 @@ function loadReplicateToken() {
 
 function genReplicate(prompt, seed, outPath) {
   const TOKEN = loadReplicateToken();
-  if (!TOKEN) throw new Error('REPLICATE_API_TOKEN not found in env or ~/Projects/secrets-manager/.env');
+  if (!TOKEN) throw new Error('REPLICATE_API_TOKEN not set in wallco-ai/.env');
+  // curl puts the token in argv, so a failed command echoes it in the error.
+  // sh() runs the command but scrubs the token out of any thrown message.
+  const sh = (cmd, opts) => {
+    try { return execSync(cmd, opts); }
+    catch (e) { throw new Error(String((e && e.message) || e).split(TOKEN).join('r8_***REDACTED')); }
+  };
 
   const MODEL_VERSION = process.env.SDXL_MODEL_VERSION || '7762fd07cf82c948538e41f63f77d685e02b063e37e496e96eefd46c929f9bdc';
   const WIDTH  = parseInt(process.env.REPLICATE_WIDTH  || '1024', 10);
@@ -58,7 +64,7 @@ function genReplicate(prompt, seed, outPath) {
     },
   };
 
-  const submit = execSync(`curl -sf -m 30 -H 'Authorization: Bearer ${TOKEN}' -H 'Content-Type: application/json' -X POST 'https://api.replicate.com/v1/predictions' -d @-`,
+  const submit = sh(`curl -sf -m 30 -H 'Authorization: Bearer ${TOKEN}' -H 'Content-Type: application/json' -X POST 'https://api.replicate.com/v1/predictions' -d @-`,
     { input: JSON.stringify(body), encoding: 'utf8' });
   let pred;
   try { pred = JSON.parse(submit); } catch { throw new Error('Replicate submit non-JSON: ' + submit.slice(0, 200)); }
@@ -68,7 +74,7 @@ function genReplicate(prompt, seed, outPath) {
   let final;
   while (Date.now() - start < 3 * 60_000) {
     execSync('sleep 3');
-    const poll = execSync(`curl -sf -m 10 -H 'Authorization: Bearer ${TOKEN}' 'https://api.replicate.com/v1/predictions/${pred.id}'`, { encoding: 'utf8' });
+    const poll = sh(`curl -sf -m 10 -H 'Authorization: Bearer ${TOKEN}' 'https://api.replicate.com/v1/predictions/${pred.id}'`, { encoding: 'utf8' });
     const p = JSON.parse(poll);
     if (p.status === 'succeeded') { final = p; break; }
     if (p.status === 'failed' || p.status === 'canceled') {

← 85d2777 replicate_compare: read REPLICATE_API_TOKEN only from projec · back to Wallco Ai · refiner-compare: all 3 columns complete — 50 ComfyUI + 25 Re d36364c →