Skip to content

fix: redact credentials from agent status messages#506

Open
Moviw wants to merge 1 commit into
openagents-org:developfrom
Moviw:fix/issue-437-redact-status-secrets
Open

fix: redact credentials from agent status messages#506
Moviw wants to merge 1 commit into
openagents-org:developfrom
Moviw:fix/issue-437-redact-status-secrets

Conversation

@Moviw

@Moviw Moviw commented Jun 20, 2026

Copy link
Copy Markdown

Summary

Redact sensitive HTTP header values before agent status messages are sent to a workspace.

  • sanitize status content centrally in BaseAdapter.sendStatus()
  • redact Authorization, *-Token, and *-Key header values
  • preserve non-sensitive headers and surrounding command text
  • cover direct helper behavior and the shared status-send path

Testing

  • node --test test/adapter-utils.test.js — 6 passed
  • Node syntax checks passed for the modified source and test files
  • full agent-connector suite: 450 passed; unrelated existing Windows/environment-dependent tests failed
  • lint could not run because the package's existing lint script references an unavailable eslint executable

Fixes #437

@vercel

vercel Bot commented Jun 20, 2026

Copy link
Copy Markdown

@Moviw is attempting to deploy a commit to the Raphael's projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Status message renders sensitive HTTP headers in plaintext, exposing workspace token

1 participant