Skip to content

fix(sdk): keep credentials private in storage and logs - #4318

Merged
Alberto Schiabel (jkomyno) merged 14 commits into
nextfrom
fix/private-credential-storage
Sep 2, 2026
Merged

fix(sdk): keep credentials private in storage and logs#4318
Alberto Schiabel (jkomyno) merged 14 commits into
nextfrom
fix/private-credential-storage

Conversation

@jkomyno

@jkomyno Alberto Schiabel (jkomyno) commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • write CLI user data, pending login sessions, and agent identities through one atomic 0600 helper
  • repair 0644 credential files created by older CLI versions before reading them
  • redact credential-shaped structured values from CLI user-context diagnostics
  • redact secret-shaped text at both TypeScript and Python SDK log-output boundaries, including Pusher auth responses and exception tracebacks
  • preserve Python logger compatibility: errors remain untruncated, disabled levels remain lazy, and malformed placeholders cannot expose arguments

Local reproduction

Under the normal 022 umask, next created a plaintext credential file with mode 0644. The pre-fix CLI user-context and TypeScript SDK debug paths also emitted sentinel credentials. The private atomic writer changes an existing 0644 target to 0600, and the upgrade tests now prove all three legacy credential files are tightened without changing their contents.

Verification

  • CLI permission upgrade tests: 31 passed across user data, pending login, and agent identity paths
  • CLI source and test typechecks passed
  • TypeScript core logging, redaction, and Pusher tests: 17 passed
  • TypeScript core source and type-test typechecks passed
  • Python logging regression tests: 5 passed
  • focused Ruff, Prettier, Oxlint, and git diff --check passed

The focused CLI runner needed a temporary local alias for the pre-existing missing #ssrf_guard mapping in the CLI Vitest config. The alias was removed after verification and is not part of this PR.

Contributor context

Credit to Syed Anas Mohiuddin, independent security researcher, for reporting the legacy CLI credential-file permission issue.

Supersedes #4300 · Glen review. The implementation also covers agent credentials, retains atomic writes, and applies redaction at the shared SDK logging boundary.

@vercel

vercel Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Sep 2, 2026 10:17pm UTC

Request Review

@github-actions

github-actions Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Security Audit Warning

The pnpm audit --prod check found security vulnerabilities in production dependencies.

Please review and fix the vulnerabilities. You can try running:

pnpm audit --fix --prod
Audit output 
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ extract-zip unvalidated symlink path traversal         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ extract-zip                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=2.0.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=2.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__packages__cli>extract-zip                          │
│                     │                                                        │
│                     │ ts__packages__cli-local-tools>extract-zip              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jmr9-qjv8-65gv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to host confusion via skipped IDN  │
│                     │ canonicalization on scheme-relative references         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.1.3 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-5jgf-p345-68v8      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to server-side request forgery via │
│                     │ malformed IPv6 normalization                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.0.0 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f65p-4m7j-42xc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to server-side request forgery via │
│                     │ repeated hostname percent-decoding                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.1.2 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fph4-wmhf-6fwf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to host confusion via              │
│                     │ percent-encoded scheme normalization                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.0.0 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jqff-g426-hqxp      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ qs array-limit bypass via bracket-key comma parsing    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=6.14.2 <=6.15.3                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.15.4                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>body-parser>qs   │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>qs               │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express-rate-            │
│                     │ limit>express>body-parser>qs                           │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why qs` for more        │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-x5fp-wj9c-mxmx      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ qs: Denial of Service via Attacker Controlled isBuffer │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=2.2.5 <6.16.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.16.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>body-parser>qs   │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>qs               │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express-rate-            │
│                     │ limit>express>body-parser>qs                           │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why qs` for more        │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-4mjr-xmp4-gh2g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ @ai-sdk/provider-utils has an Uncontrolled Resource    │
│                     │ Consumption issue                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @ai-sdk/provider-utils                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=3.0.97                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.0.98                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@ai-sdk/provider-utils                 │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/mcp>@mastra/core>@ai-sdk/provider-utils     │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v4>@mastra/core>@ai-sdk/provider-utils                 │
│                     │                                                        │
│                     │ ... Found 14 paths, run `pnpm why                      │
│                     │ @ai-sdk/provider-utils` for more information           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-866g-f22w-33x8      │
└─────────────────────┴────────────────────────────────────────────────────────┘
8 vulnerabilities found
Severity: 1 low | 2 moderate | 5 high

@github-actions

github-actions Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Preview this PR's installer

The hermetic install E2E suite passed for this commit. These commands run the PR's installer scripts against the latest published CLI release — they preview installer behavior, not unreleased binaries.

curl -fsSL "https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install.sh" | sh
curl -fsSL "https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install.sh" | COMPOSIO_INSTALL_SHELL=none sh

The first command is the default flow: it installs the CLI and configures your shell automatically. The second installs only, without touching shell startup files.

Shell-specific setup routes (the override points the variant at this PR's base installer):

curl -fsSL "https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install/bash.sh" | COMPOSIO_INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install.sh" sh
curl -fsSL "https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install/zsh.sh" | COMPOSIO_INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install.sh" sh
curl -fsSL "https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install/fish.sh" | COMPOSIO_INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/ComposioHQ/composio/99cd71903e08def1714bec6d2cf13cce2fea484f/install.sh" sh

cursor[bot]
cursor Bot reviewed Aug 31, 2026
View reviewed changes
Comment thread python/composio/utils/logging.py Resolved
@jkomyno
Alberto Schiabel (jkomyno) force-pushed the fix/private-credential-storage branch from 3b3a9d3 to 9e12619 Compare August 31, 2026 16:43
cursor[bot]
cursor Bot reviewed Aug 31, 2026
View reviewed changes
Comment thread python/composio/utils/logging.py Resolved
@jkomyno
Alberto Schiabel (jkomyno) force-pushed the fix/private-credential-storage branch from 9e12619 to 581d4f8 Compare August 31, 2026 16:54
@jkomyno Alberto Schiabel (jkomyno) mentioned this pull request Sep 1, 2026
Closed
cursor[bot]
cursor Bot reviewed Sep 2, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 7c23bc4. Configure here.

Comment thread ts/packages/cli/src/utils/atomic-write.ts Resolved
@jkomyno
fix(cli): keep credential reads available
7a89858 
Make legacy permission repair best-effort and cover chmod failures with a filesystem fixture.

Refs #4318
@jkomyno
fix(cli): secure atomic credential staging
b56c428 
Create random staging files exclusively, retry collisions without touching pre-existing paths, and cover the collision path with a filesystem fixture.

Refs #4318
@jkomyno
fix(sdk): harden structured log redaction
02221b2 
Redact Python logging metadata, retain sanitized exception records, align the auth alias, and cover quoted multiword secrets in both SDKs.

Refs #4318
@jkomyno
fix(python): bound structured log redaction
9827ba3 
Handle cyclic, deeply nested, and oversized logging metadata without recursion failures or unbounded traversal.

Refs #4318
@jkomyno
fix(sdk): close credential privacy edge cases
718bcb3
@jkomyno
fix(sdk): cover privacy boundary cases
ff917a5
@jkomyno
fix(sdk): redact prefixed structured secrets
e4f308c
@jkomyno
fix(sdk): close remaining privacy edge cases
e01544a
@jkomyno
fix(sdk): preserve symbol-prefixed log fields
3e76f90
@jkomyno
fix(sdk): avoid redacting quoted log context
ed8a0cd
@jkomyno
test(py): set exception notes without add_note for 3.10
99cd719 
BaseException.add_note only exists on Python 3.11+, so the redaction
test failed on the 3.10 CI matrix. Assign __notes__ directly, which is
what the traceback module reads on every supported version.

Claude-Session: https://claude.ai/code/session_01Y7Ni3QEBDGShSrEtwQS5bA
@jkomyno
Alberto Schiabel (jkomyno) merged commit 1d31c80 into next Sep 2, 2026
42 checks passed
@jkomyno
Alberto Schiabel (jkomyno) deleted the fix/private-credential-storage branch September 2, 2026 23:45

This branch was successfully deployed

1 active deployment
Preview — 99cd7190 Deployed Sep 2, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jkomyno