Reject retired API credentials before use

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

Reject the retired shared credential before the Python SDK stores or encodes it. Valid credentials keep their existing selection order and encoded bytes.

Root Cause

The SDK accepted the retired credential from explicit arguments, environment variables, and direct Basic-auth encoding.

Fix

• Compare the selected credential against a SHA-256 fingerprint. No credential value is stored in source or errors.
• Check both SDK construction and the Basic-auth username boundary.
• Preserve explicit-token precedence and all four environment sources.

Validation

12 focused tests pass. New helper and test files pass Ruff. Tests use synthetic values and do not call Socket APIs.

Public Changelog

Reject a retired shared API credential with instructions to configure a replacement.

---

Note

Medium Risk
Changes credential validation on every client init and encode_key path; misconfigured digest or matching logic could block legitimate tokens or miss the retired one.

Overview
Blocks a retired shared API credential before the Python SDK stores or Base64-encodes it, with a fixed user-facing error telling customers to create a new token.

Token resolution moves into select_token, keeping the same behavior: explicit token wins (including empty string), otherwise the first set of the four SOCKET_* env vars. After resolution, reject_retired_token compares a trimmed SHA-256 digest to a baked-in fingerprint (no raw secret in repo or errors). API.encode_key also runs reject_retired_basic_auth_token, checking only the Basic-auth username segment before the first :.

Unit tests cover rejection messaging/redaction, env precedence, whitespace trimming, and non-retired tokens without network calls.

^{Reviewed by Cursor Bugbot for commit 6ebd180. Configure here.}