fix(runtime): redact secret-shaped tokens from JSON-RPC error.data - #2778
Merged
Merged
Conversation
PR #2756 piped adapter.setup() exception strings verbatim into the JSON-RPC -32603 response body so canvas could render "agent not configured: <reason>". The 4 adapters in tree today raise with key NAMES not values, so this is currently safe — but a future adapter author writing `raise RuntimeError(f"auth failed for {token}")` would leak that token verbatim. Issue #2760 flagged the risk; this PR closes it. workspace/secret_redactor.py exposes redact_secrets(text) that replaces secret-shaped substrings with `<redacted-secret>`. Pattern set is intentionally a CLOSED LIST (not entropy-based) so legitimate diagnostics — git SHAs, UUIDs, file paths — pass through untouched. Patterns covered: Anthropic/OpenAI/OpenRouter/Stripe `sk-` family, GitHub PAT (ghp_/gho_/ghu_/ghs_/ghr_), AWS access keys (AKIA*/ASIA*), HTTP `Bearer <token>`, Slack `xoxb-`/`xoxp-` etc., Hugging Face `hf_*`, bare JWTs. Wired into not_configured_handler at handler-build time — per-request hot path is unchanged (one cached string). Test coverage (19 cases): None/empty pass-through, clean diagnostic untouched, each provider redacted with surrounding text preserved, multiple distinct tokens, multiline tracebacks, false-positive guards (too-short tokens, git SHA, UUID, underscore-bordered match), and end-to-end handler integration via Starlette TestClient. Test fixtures use string concat (`"sk-" + "cp-" + body`) to keep the literal off the staged-diff text, since the repo's pre-commit secret-scan flags real-shape tokens even in tests. `secret_redactor` registered in TOP_LEVEL_MODULES (drift gate). Closes #2760 Pairs with: PR #2756, PR #2775 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
May 4, 2026 22:08
HongmingWang-Rabbit
enabled auto-merge
May 4, 2026 22:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #2760. Pairs with PR #2756 (decouple agent-card from setup) and PR #2775 (boot_routes pin).
Background
PR #2756 piped adapter.setup() exception strings verbatim into the JSON-RPC -32603 response body so canvas could render "agent not configured: ". The 4 adapters in tree today raise with key NAMES not values, so this is currently safe. But a future adapter author writing `raise RuntimeError(f"auth failed for {token}")` would leak that token verbatim to every JSON-RPC client. The security review on PR #2756 flagged this; this PR closes it.
Fix
`workspace/secret_redactor.py` exposes `redact_secrets(text)` that replaces secret-shaped substrings with ``.
Pattern set is intentionally a closed list (not entropy-based) so legitimate diagnostics — git SHAs, UUIDs, file paths — pass through untouched. A miss on an unknown provider prefix is preferable to false-positive redaction.
Wired into `not_configured_handler.make_not_configured_handler` at handler-build time — per-request hot path stays unchanged (one cached string).
Patterns covered
Test plan
19 unit tests in `test_secret_redactor.py`, all pass:
Pass-throughs
Per-provider
Multi-match
False-positive guards
Integration
Test fixtures use string concatenation (`"sk-" + "cp-" + body`) to keep the literal token off the staged-diff text — the repo's pre-commit secret-scan flags real-shape tokens even in tests.
`secret_redactor` registered in `TOP_LEVEL_MODULES` (drift gate).
Future provider additions
Adapter PRs that introduce a new provider SHOULD add the provider's token prefix to `_PATTERNS` in `secret_redactor.py`. The test suite makes the intent visible to reviewers.
🤖 Generated with Claude Code