Repository navigation
Clarify official ownership and restrict GHEALTH_BASE_URL to Google hosts - #17
Draft
born-june04 wants to merge 1 commit into
Draft
born-june04 wants to merge 1 commit into
born-june04 wants to merge 1 commit into
Conversation
Every API request carries the user's OAuth access token, but GHEALTH_BASE_URL previously accepted any host. - Allow only https://*.googleapis.com and loopback hosts by default; other hosts require GHEALTH_ALLOW_CUSTOM_BASE_URL=1 and print a warning - Tests cover host-suffix spoofing - README: state that this is Google's official CLI and link the API docs - AGENTS.md / README: neutral wording instead of agent-first framing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
AI coding agents (e.g. Claude Code) often don't trust this repo as an official Google project. In recent sessions they described it as "unofficial third-party" or a "likely impersonation project" and declined to run it. Human developers also have no clear signal, and a similarly named unofficial repo (
rudrankriyam/Google-Health-CLI) adds to the confusion.Related docs request: b/567196827 (add the CLI to developers.google.com/health/libraries)
What
Docs
ghealth)", "Official" badge + ownership line linking to the Google Health API docs, and a "Verify it's official" noteSecurity
GHEALTH_BASE_URLpreviously accepted any host, and every request carries the user's OAuth access token. It is now restricted tohttps://*.googleapis.comand loopback hosts; other hosts are ignored with a warning unlessGHEALTH_ALLOW_CUSTOM_BASE_URL=1is set.googleapis.com.evil.example,evilgoogleapis.com).Notes
go vet ./...andgo test ./...pass.