fix(secrets): prevent capture and sentinel credential retention (#102420)

steipete · web-flow · commit d6ec1c6ceab3 · 2026-07-09T05:50:28.000+01:00
* fix(secrets): harden sentinel capture lifecycle

* chore: leave release notes to release automation
diff --git a/packages/ai/src/providers/anthropic.test.ts b/packages/ai/src/providers/anthropic.test.ts
@@ -152,7 +152,7 @@ describe("Anthropic provider", () => {
   });
 
   it("keeps sentinel-backed Foundry Authorization headers on bearer routing", async () => {
-    const sentinel = "oc-sent-v1-0123456789abcdef01234567";
+    const sentinel = "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end";
     configureAiTransportHost({
       buildModelFetch: () => async () => new Response(null, { status: 500 }),
       resolveSecretSentinel: (value) => value.replaceAll(sentinel, "Bearer entra-access-token"),
diff --git a/packages/ai/src/providers/google-client-auth.test.ts b/packages/ai/src/providers/google-client-auth.test.ts
@@ -32,7 +32,7 @@ import { streamGoogle } from "./google.js";
 const context = {
   messages: [{ role: "user", content: "hello", timestamp: 0 }],
 } satisfies Context;
-const sentinel = "oc-sent-v1-0123456789abcdef01234567";
+const sentinel = "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end";
 
 function googleModel(): Model<"google-generative-ai"> {
   return {
diff --git a/packages/ai/src/providers/openai-chatgpt-responses.test.ts b/packages/ai/src/providers/openai-chatgpt-responses.test.ts
@@ -129,7 +129,7 @@ describe("streamOpenAICodexResponses transport", () => {
     const realToken = createJwt({
       "https://api.openai.com/auth": { chatgpt_account_id: "acct-sentinel" },
     });
-    const sentinel = "oc-sent-v1-0123456789abcdef01234567";
+    const sentinel = "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end";
     configureAiTransportHost({
       resolveSecretSentinel: (value) => value.replaceAll(sentinel, realToken),
     });
diff --git a/packages/ai/src/providers/openai-responses.test.ts b/packages/ai/src/providers/openai-responses.test.ts
@@ -69,17 +69,17 @@ describe("OpenAI Responses provider", () => {
         baseUrl: "https://gateway.ai.cloudflare.com/v1/account/gateway/openai",
       }),
       context,
-      { apiKey: "oc-sent-v1-0123456789abcdef01234567" },
+      { apiKey: "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end" },
     ).result();
 
     const config = openAiMockState.configs[0] as {
       apiKey?: string;
       defaultHeaders?: Record<string, string | null>;
       fetch?: unknown;
     };
-    expect(config.apiKey).toBe("oc-sent-v1-0123456789abcdef01234567");
+    expect(config.apiKey).toBe("oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end");
     expect(config.defaultHeaders?.["cf-aig-authorization"]).toBe(
-      "Bearer oc-sent-v1-0123456789abcdef01234567",
+      "Bearer oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end",
     );
     expect(config.fetch).toBe(hostFetch);
   });
diff --git a/src/agents/provider-local-service.test.ts b/src/agents/provider-local-service.test.ts
@@ -191,7 +191,7 @@ describe("provider local service", () => {
 
   it("rejects unknown sentinels before starting a local service", async () => {
     const port = await freePort();
-    const unknown = "oc-sent-v1-fedcba987654321001234567";
+    const unknown = "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end";
     const model = attachModelProviderLocalService(
       {
         id: "demo",
diff --git a/src/agents/provider-secret-egress.test.ts b/src/agents/provider-secret-egress.test.ts
@@ -79,7 +79,7 @@ describe("unwrapModelHeaderSentinelsForProviderEgress", () => {
       {
         auth: {
           mode: "authorization-bearer",
-          token: "oc-sent-v1-00000000000000000000dead",
+          token: "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end",
         },
       },
     );
diff --git a/src/agents/provider-transport-fetch.test.ts b/src/agents/provider-transport-fetch.test.ts
@@ -261,7 +261,7 @@ describe("buildGuardedModelFetch", () => {
   });
 
   it("rejects unknown sentinel-shaped values before guarded fetch", async () => {
-    const unknown = "oc-sent-v1-fedcba987654321001234567";
+    const unknown = "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end";
     await expect(
       buildGuardedModelFetch(sentinelModel())("https://api.openai.com/v1/responses", {
         headers: { Authorization: `Bearer ${unknown}` },
diff --git a/src/agents/provider-transport-fetch.ts b/src/agents/provider-transport-fetch.ts
@@ -30,6 +30,7 @@ import type { Model } from "../llm/types.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { resolveDebugProxySettings } from "../proxy-capture/env.js";
 import {
+  containsSecretSentinel,
   resolveSecretSentinel,
   SECRET_SENTINEL_PATTERN,
   swapSecretSentinelsInText,
@@ -770,15 +771,15 @@ function headersContainSecretSentinel(headers: HeadersInit | undefined): boolean
     return false;
   }
   for (const value of new Headers(headers).values()) {
-    if (value.includes("oc-sent-v1-")) {
+    if (containsSecretSentinel(value)) {
       return true;
     }
   }
   return false;
 }
 
 function swapSecretSentinelsInUrl(url: string): { text: string; unknown: string[] } {
-  if (!url.includes("oc-sent-v1-")) {
+  if (!containsSecretSentinel(url)) {
     return { text: url, unknown: [] };
   }
   const unknown = new Set<string>();
@@ -798,7 +799,7 @@ function swapSecretSentinelsForEgress(params: { url: string; headers?: HeadersIn
   url: string;
   headers?: Headers;
 } {
-  if (!params.url.includes("oc-sent-v1-") && !headersContainSecretSentinel(params.headers)) {
+  if (!containsSecretSentinel(params.url) && !headersContainSecretSentinel(params.headers)) {
     return { url: params.url };
   }
   const urlSwap = swapSecretSentinelsInUrl(params.url);
diff --git a/src/logging/redact.test.ts b/src/logging/redact.test.ts
@@ -73,6 +73,16 @@ describe("registered exact secret values", () => {
     expect(redactSensitiveText(`raw ${secret}`, { mode: "off" })).not.toContain(secret);
   });
 
+  it("masks JSON-escaped registered values", () => {
+    const secret = 'quoted-"secret\\line\nvalue';
+    registerSecretValueForRedaction(secret);
+
+    const json = JSON.stringify({ credential: secret });
+    expect(redactSensitiveText(json, { mode: "off" })).not.toContain(
+      JSON.stringify(secret).slice(1, -1),
+    );
+  });
+
   it("evicts the oldest value after 512 registrations", () => {
     const first = "exact-registry-value-000";
     registerSecretValueForRedaction(first);
diff --git a/src/logging/secret-redaction-registry.ts b/src/logging/secret-redaction-registry.ts
@@ -34,19 +34,31 @@ export function registerSecretValueForRedaction(value: string): void {
   if (value.length < MIN_SECRET_VALUE_LENGTH) {
     return;
   }
-  registerOneSecretValue(value);
   // URL egress percent-encodes injected values; redact that surface form too.
   const encoded = encodeURIComponent(value);
   if (encoded !== value) {
     registerOneSecretValue(encoded);
   }
+  // Captured structured payloads are serialized before persistence, so retain
+  // the JSON string-content form for credentials with escaped characters.
+  const jsonEscaped = JSON.stringify(value).slice(1, -1);
+  if (jsonEscaped !== value) {
+    registerOneSecretValue(jsonEscaped);
+  }
+  // Keep the raw value newest so bounded-registry eviction cannot drop the
+  // active credential while retaining only a transformed representation.
+  registerOneSecretValue(value);
 }
 
 /** Returns whether a value has SecretRef provenance in the process registry. */
 export function isSecretValueRegisteredForRedaction(value: string): boolean {
   return registeredValues.has(value);
 }
 
+export function hasRegisteredSecretValuesForRedaction(): boolean {
+  return registeredValues.size > 0;
+}
+
 /** Replaces registered exact values while preserving the caller's mask convention. */
 export function redactRegisteredSecretValues(
   text: string,
diff --git a/src/media-understanding/image.test.ts b/src/media-understanding/image.test.ts
@@ -265,7 +265,7 @@ describe("describeImageWithModel", () => {
 
   it("unwraps a sentinel only at the direct MiniMax VLM handoff", async () => {
     getApiKeyForModelMock.mockResolvedValueOnce({
-      apiKey: "oc-sent-v1-0123456789abcdef01234567",
+      apiKey: "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end",
       source: "test",
       mode: "api-key",
     });
@@ -283,7 +283,7 @@ describe("describeImageWithModel", () => {
     });
 
     expect(unwrapSecretSentinelsForProviderEgressMock).toHaveBeenCalledWith(
-      "oc-sent-v1-0123456789abcdef01234567",
+      "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end",
       "MiniMax VLM request",
     );
     const [, fetchOptionsValue] = requireFirstMockCall(fetchMock, "fetch");
diff --git a/src/proxy-capture/runtime.test.ts b/src/proxy-capture/runtime.test.ts
@@ -7,6 +7,7 @@ import {
 import type { DebugProxySettings } from "./env.js";
 import {
   captureHttpExchange,
+  captureWsEvent,
   finalizeDebugProxyCapture,
   initializeDebugProxyCapture,
   type DebugProxyCaptureRuntimeDeps,
@@ -54,7 +55,11 @@ const deps: DebugProxyCaptureRuntimeDeps = {
     payload: { data?: Buffer | string | null; contentType?: string },
   ) => ({
     contentType: payload.contentType,
-    ...(typeof payload.data === "string" ? { dataText: payload.data } : {}),
+    ...(typeof payload.data === "string"
+      ? { dataText: payload.data }
+      : Buffer.isBuffer(payload.data)
+        ? { dataText: payload.data.toString("utf8") }
+        : {}),
   }),
   safeJsonString: (value: unknown) => (value == null ? undefined : JSON.stringify(value)),
 };
@@ -227,6 +232,107 @@ describe("debug proxy runtime", () => {
     });
   });
 
+  it("redacts registered values from every persisted WebSocket field", () => {
+    const secret = 'mattermost-"capture\\secret\nline';
+    registerSecretValueForRedaction(secret);
+
+    captureWsEvent(
+      {
+        url: `wss://chat.example.test/api/v4/websocket?token=${encodeURIComponent(secret)}`,
+        direction: "outbound",
+        kind: "ws-frame",
+        flowId: "mattermost-auth",
+        payload: JSON.stringify({ action: "authentication_challenge", data: { token: secret } }),
+        errorText: `failed with ${secret}`,
+        meta: { subsystem: "mattermost-websocket", detail: secret },
+      },
+      settings,
+      deps,
+    );
+    captureWsEvent(
+      {
+        url: "wss://chat.example.test/api/v4/websocket",
+        direction: "inbound",
+        kind: "ws-frame",
+        flowId: "mattermost-auth",
+        payload: Buffer.from(JSON.stringify({ echoedToken: secret })),
+      },
+      settings,
+      deps,
+    );
+
+    const [outbound, inbound] = events;
+    expect(outbound?.path).toBe("/api/v4/websocket?token=%5BREDACTED%5D");
+    expect(outbound?.dataText).toContain('"token":"[REDACTED]"');
+    expect(outbound?.errorText).toBe("failed with [REDACTED]");
+    expect(JSON.parse(String(outbound?.metaJson))).toStrictEqual({
+      subsystem: "mattermost-websocket",
+      detail: "[REDACTED]",
+    });
+    expect(inbound?.dataText).toContain('"echoedToken":"[REDACTED]"');
+    expect(JSON.stringify(events)).not.toContain(secret);
+    expect(JSON.stringify(events)).not.toContain(JSON.stringify(secret).slice(1, -1));
+  });
+
+  it("redacts registered credential bytes from otherwise non-UTF-8 frames", () => {
+    const secret = "binary-frame-capture-secret";
+    registerSecretValueForRedaction(secret);
+    const payload = Buffer.concat([
+      Buffer.from([0xff, 0x00]),
+      Buffer.from(secret, "utf8"),
+      Buffer.from([0xfe]),
+    ]);
+
+    captureWsEvent(
+      {
+        url: "wss://chat.example.test/api/v4/websocket",
+        direction: "outbound",
+        kind: "ws-frame",
+        flowId: "binary-auth",
+        payload,
+      },
+      settings,
+      deps,
+    );
+
+    expect(events[0]?.dataText).toBe("[REDACTED BINARY PAYLOAD]");
+    expect(events[0]?.dataText).not.toContain(secret);
+  });
+
+  it("redacts registered values from HTTP payloads and metadata", async () => {
+    const secret = 'http-"capture\\secret\nline';
+    const contentTypeSecret = "http-content-type-secret";
+    registerSecretValueForRedaction(secret);
+    registerSecretValueForRedaction(contentTypeSecret);
+
+    captureHttpExchange(
+      {
+        url: "https://api.example.test/v1/messages",
+        method: "POST",
+        requestHeaders: { "content-type": `application/json; token=${contentTypeSecret}` },
+        requestBody: JSON.stringify({ credential: secret }),
+        response: new Response(JSON.stringify({ echoedCredential: secret }), {
+          status: 200,
+          headers: { "content-type": `application/json; token=${contentTypeSecret}` },
+        }),
+        meta: { credential: secret },
+      },
+      settings,
+      deps,
+    );
+    await waitForResponseSettled();
+
+    const request = events.find((event) => event.kind === "request");
+    const response = events.find((event) => event.kind === "response");
+    expect(request?.dataText).toContain('"credential":"[REDACTED]"');
+    expect(request?.metaJson).toContain('"credential":"[REDACTED]"');
+    expect(request?.contentType).toBe("application/json; token=[REDACTED]");
+    expect(response?.dataText).toContain('"echoedCredential":"[REDACTED]"');
+    expect(response?.metaJson).toContain('"credential":"[REDACTED]"');
+    expect(response?.contentType).toBe("application/json; token=[REDACTED]");
+    expect(JSON.stringify(events)).not.toContain(secret);
+  });
+
   it("redacts registered values from failed global-fetch capture events", async () => {
     const secret = "capture-failure/secret";
     registerSecretValueForRedaction(secret);
@@ -376,7 +482,9 @@ describe("debug proxy runtime", () => {
     // Some seams hand capture a Response-like object that cannot be cloned. It
     // must still be observable (status/headers) via the shared metadata path,
     // tagged bodyCapture: "unavailable" (distinct from the "too-large" cap path).
-    const headers = new Headers({ "content-type": "application/json" });
+    const secret = "metadata-only-content-type-secret";
+    registerSecretValueForRedaction(secret);
+    const headers = new Headers({ "content-type": `application/json; token=${secret}` });
     captureHttpExchange(
       {
         url: "https://api.openai.com/v1/uncloneable",
@@ -392,8 +500,29 @@ describe("debug proxy runtime", () => {
     const response = events.find((event) => event.kind === "response");
     expect(response).toBeDefined();
     expect(response?.status).toBe(503);
+    expect(response?.contentType).toBe("application/json; token=[REDACTED]");
     expect(JSON.parse(String(response?.metaJson))).toMatchObject({ bodyCapture: "unavailable" });
     expect(response).not.toHaveProperty("dataText");
     expect(events.some((event) => event.kind === "error")).toBe(false);
   });
+
+  it("records Response-like status metadata when the Headers API is absent", async () => {
+    initializeDebugProxyCapture("test", settings, deps);
+    captureHttpExchange(
+      {
+        url: "https://api.openai.com/v1/no-headers-api",
+        method: "GET",
+        response: { status: 204 } as unknown as Response,
+      },
+      settings,
+      deps,
+    );
+    await waitForResponseSettled();
+    finalizeDebugProxyCapture(settings, deps);
+
+    const response = events.find((event) => event.kind === "response");
+    expect(response?.status).toBe(204);
+    expect(response?.contentType).toBeUndefined();
+    expect(JSON.parse(String(response?.metaJson))).toMatchObject({ bodyCapture: "unavailable" });
+  });
 });
diff --git a/src/proxy-capture/runtime.ts b/src/proxy-capture/runtime.ts
diff --git a/src/secrets/sentinel.test.ts b/src/secrets/sentinel.test.ts
diff --git a/src/secrets/sentinel.ts b/src/secrets/sentinel.ts

Original file line number	Diff line number	Diff line change
`@@ -191,7 +191,7 @@ describe("provider local service", () => {`
`191`	`191`
`192`	`192`	`it("rejects unknown sentinels before starting a local service", async () => {`
`193`	`193`	`const port = await freePort();`
`194`		`- const unknown = "oc-sent-v1-fedcba987654321001234567";`
	`194`	`+ const unknown = "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end";`
`195`	`195`	`const model = attachModelProviderLocalService(`
`196`	`196`	`{`
`197`	`197`	`id: "demo",`
Original file line number	Diff line number	Diff line change
`@@ -79,7 +79,7 @@ describe("unwrapModelHeaderSentinelsForProviderEgress", () => {`
`79`	`79`	`{`
`80`	`80`	`auth: {`
`81`	`81`	`mode: "authorization-bearer",`
`82`		`- token: "oc-sent-v1-00000000000000000000dead",`
	`82`	`+ token: "oc-sent-v2.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.end",`
`83`	`83`	`},`
`84`	`84`	`},`
`85`	`85`	`);`
Original file line number	Diff line number	Diff line change
`@@ -30,6 +30,7 @@ import type { Model } from "../llm/types.js";`
`30`	`30`	`import { createSubsystemLogger } from "../logging/subsystem.js";`
`31`	`31`	`import { resolveDebugProxySettings } from "../proxy-capture/env.js";`
`32`	`32`	`import {`
	`33`	`+ containsSecretSentinel,`
`33`	`34`	`resolveSecretSentinel,`
`34`	`35`	`SECRET_SENTINEL_PATTERN,`
`35`	`36`	`swapSecretSentinelsInText,`
`@@ -770,15 +771,15 @@ function headersContainSecretSentinel(headers: HeadersInit \| undefined): boolean`
`770`	`771`	`return false;`
`771`	`772`	`}`
`772`	`773`	`for (const value of new Headers(headers).values()) {`
`773`		`- if (value.includes("oc-sent-v1-")) {`
	`774`	`+ if (containsSecretSentinel(value)) {`
`774`	`775`	`return true;`
`775`	`776`	`}`
`776`	`777`	`}`
`777`	`778`	`return false;`
`778`	`779`	`}`
`779`	`780`
`780`	`781`	`function swapSecretSentinelsInUrl(url: string): { text: string; unknown: string[] } {`
`781`		`- if (!url.includes("oc-sent-v1-")) {`
	`782`	`+ if (!containsSecretSentinel(url)) {`
`782`	`783`	`return { text: url, unknown: [] };`
`783`	`784`	`}`
`784`	`785`	`const unknown = new Set<string>();`
`@@ -798,7 +799,7 @@ function swapSecretSentinelsForEgress(params: { url: string; headers?: HeadersIn`
`798`	`799`	`url: string;`
`799`	`800`	`headers?: Headers;`
`800`	`801`	`} {`
`801`		`- if (!params.url.includes("oc-sent-v1-") && !headersContainSecretSentinel(params.headers)) {`
	`802`	`+ if (!containsSecretSentinel(params.url) && !headersContainSecretSentinel(params.headers)) {`
`802`	`803`	`return { url: params.url };`
`803`	`804`	`}`
`804`	`805`	`const urlSwap = swapSecretSentinelsInUrl(params.url);`