fix(security): redact token-shaped values from sandbox doctor --json output

[Dongni-Yang]

Summary

sandbox doctor --json resolved with the raw report, while sandbox status --json has redacted its machine-readable report since #4310. Both doctor JSON egress points now pass through the centralized redactForLog, so token-shaped values in check details no longer reach JSON consumers. Exit codes are still computed from the raw report before redaction.

Related Issue

Refs #4310 (the status --json redaction precedent this change mirrors). The asymmetry was found while verifying the redaction contract for the serving-process health design discussion on #7003 (refs only; this PR does not close either issue).

Changes

• src/lib/actions/sandbox/doctor-report.ts: the renderDoctorReport JSON branch prints via console.log, which bypasses the oclif logJson redaction boundary (fix(security): harden low-risk code scanning findings #3657); the report is now routed through redactForLog before printing.
• src/commands/sandbox/doctor.ts: the oclif --json path now returns redactForLog(report), so programmatic consumers of the resolved value — not just the logJson-printed stdout — never see raw token-shaped detail. process.exitCode is derived from the raw report first.
• Tests: one render-level and one command-boundary redaction test. Each uniquely pins its egress point: the command test mocks runSandboxDoctor (so renderDoctorReport never runs on that path), and the render test calls renderDoctorReport directly (the oclif path bypasses it via quietJson). Both were red before the fix.

Review notes:

• Pre-existing quirk (unchanged here, identical in status --json): redactFull's word-context patterns can consume a short word following a credential-shaped env-var name, e.g. …_API_KEY for NVIDIA managed health… renders as …_API_KEY <REDACTED> NVIDIA managed health…. A candidate follow-up is to give FULL_REDACT_PATTERNS the same {10,} minimum value length CONTEXT_PATTERNS already uses.
• The renderDoctorReport JSON branch currently has no production caller (the oclif command always passes quietJson: true with --json); it is redacted anyway because that console.log egress has no other redaction layer for any future direct caller.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: doctor --json is documented only as "Emit the report as JSON" with no field-level or verbatim-detail contract (docs/reference/commands.mdx); this change enforces the existing CLI redaction contract in docs/security/best-practices.mdx.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: cjagwani approved PR SHA 92aa402 after reviewing the redaction coverage, resolved automated feedback, required checks, and selected E2E.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable — this PR does not change scripts/prepare-dgx-station-host.sh.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — npm run check:diff passed (hooks skipped locally; commitlint reports one non-blocking footer-leading-blank warning)
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli src/lib/actions/sandbox/doctor-report.test.ts src/commands/sandbox/oclif-command-adapters.test.ts src/lib/actions/sandbox/doctor-flow.test.ts src/lib/actions/sandbox/doctor-inference.test.ts → 42/42 passed
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable (targeted change)
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed

---

Signed-off-by: Dongni-Yang dongniy@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Sandbox diagnostic reports in JSON mode now redact token-shaped values from returned and displayed details.
  • Preserved failure status reporting while preventing sensitive token values from appearing in machine-readable output.

• Tests

  • Added coverage confirming redaction in both CLI results and printed JSON reports.

[coderabbitai]

📝 Walkthrough

Walkthrough

Sandbox doctor JSON reports are now passed through centralized redaction before logging or returning them. Tests verify token-shaped values are replaced, hints remain unchanged, and failure exit codes are preserved.

Changes

Sandbox doctor redaction

Layer / File(s)	Summary
Redact rendered JSON reports src/lib/actions/sandbox/doctor-report.ts, src/lib/actions/sandbox/doctor-report.test.ts	Machine-readable doctor reports are redacted before JSON logging, with tests covering token removal, preserved hints, and failure status.
Redact CLI JSON returns src/commands/sandbox/doctor.ts, src/commands/sandbox/oclif-command-adapters.test.ts	The CLI returns a redacted JSON report while preserving failure exit behavior, with adapter coverage for bearer-token removal.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: security, area: cli, bug-fix

Suggested reviewers: harjothkhara

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: redacting token-shaped values from sandbox doctor JSON output.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dongniy/7003-doctor-json-redact

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 92aa402 in the dongniy/7003-doctor-... branch remains at 96%, unchanged from commit f992494 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 92aa402 in the dongniy/7003-doctor-... branch remains at 80%, unchanged from commit f992494 in the main branch.

Show a code coverage summary of the most impacted files.

File	main f992494	dongniy/7003-doctor-... 92aa402	+/-
src/lib/state/m...-acquisition.ts	89%	84%	-5%
src/lib/actions...octor-report.ts	95%	95%	0%
src/lib/agent/r...ime-manifest.ts	100%	100%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/securit...ntial-filter.ts	93%	93%	0%
src/lib/state/m...ock-identity.ts	95%	95%	0%
src/lib/state/m...lock-storage.ts	97%	97%	0%
src/lib/trace.ts	94%	94%	0%
src/lib/platform.ts	84%	89%	+5%

---

_{Updated July 22, 2026 14:56 UTC}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/actions/sandbox/doctor-report.test.ts`:
- Around line 37-56: Update the “redacts token-shaped values from the
machine-readable report” test to wrap its assertions and report rendering in a
try/finally block, calling logSpy.mockRestore() in the finally clause so the
console.log spy is always restored.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 56867ffb-9368-4380-b1ba-58948ae3f0a7

📥 Commits

Reviewing files that changed from the base of the PR and between 7be1bad and d52d3f1.

📒 Files selected for processing (4)

• src/commands/sandbox/doctor.ts
• src/commands/sandbox/oclif-command-adapters.test.ts
• src/lib/actions/sandbox/doctor-report.test.ts
• src/lib/actions/sandbox/doctor-report.ts

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume

1 optional E2E recommendation

• credential-sanitization

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Reviewed exact head 92aa402. The token redaction fix is covered, the only CodeRabbit thread is resolved/withdrawn, both review-advisor lanes report no actionable findings, and all required CI plus selected E2E passed. Approving; not merging.