fix(webui): redact tool-title inputs before truncation

steipete · steipete · commit eae25df377da · 2026-07-10T19:08:00.000-07:00
diff --git a/src/gateway/chat-tool-titles.test.ts b/src/gateway/chat-tool-titles.test.ts
@@ -110,6 +110,29 @@ describe("generateToolCallTitles", () => {
     expect(call.context.messages[0]?.content).not.toContain(token);
   });
 
+  it("redacts secrets that straddle the prompt truncation boundary", async () => {
+    mockPreparedModel();
+    mockCompletionTitles({ "0": "Pushed with credentials" });
+    const token = ["ghp", "a1b2c3d4e5f6a1b2c3d4e5f6"].join("_");
+    // Place the secret so a slice-before-redact would cut it mid-token and
+    // leave an unmatchable fragment in the prompt.
+    const padding = "x".repeat(1_990);
+    const input = `${padding} Authorization: Bearer ${token}`;
+
+    await generateToolCallTitles({
+      cfg: {} satisfies OpenClawConfig,
+      agentId: AGENT_ID,
+      items: [{ id: "item-1", name: "bash", input }],
+    });
+
+    const call = completeWithPreparedSimpleCompletionModel.mock.calls[0]?.[0] as {
+      context: { messages: Array<{ content: string }> };
+    };
+    const content = call.context.messages[0]?.content ?? "";
+    expect(content).not.toContain(token);
+    expect(content).not.toContain(token.slice(0, 12));
+  });
+
   it("serves repeated items from the SQLite cache without a second completion", async () => {
     mockPreparedModel();
     mockCompletionTitles({ "0": "Checked repo status" });
diff --git a/src/gateway/chat-tool-titles.ts b/src/gateway/chat-tool-titles.ts
@@ -71,9 +71,10 @@ function normalizeItems(items: readonly ToolTitleRequestItem[]): ToolTitleReques
     const name = item.name.trim();
     // Redact before anything downstream (cache key + model prompt): transcript
     // args can carry raw tokens/signed URLs, and titles must not become a new
-    // secret egress path. Redaction runs in tools mode regardless of logging
-    // config.
-    const input = redactToolPayloadText(item.input.slice(0, TOOL_TITLE_INPUT_MAX_CHARS));
+    // secret egress path. Redaction runs on the full schema-bounded input and
+    // only then truncates — slicing first could bisect a secret so its
+    // fragment no longer matches any redaction pattern.
+    const input = redactToolPayloadText(item.input).slice(0, TOOL_TITLE_INPUT_MAX_CHARS);
     if (!id || !name || !input.trim() || seen.has(id)) {
       continue;
     }
