fix(agents): redact service request diagnostics

vincentkoc · vincentkoc · commit f71255e47566 · 2026-07-11T16:22:22.000+08:00
diff --git a/src/agents/provider-local-service.test.ts b/src/agents/provider-local-service.test.ts
@@ -762,18 +762,24 @@ describe("provider local service", () => {
     const healthUrl = `http://127.0.0.1:${port}/v1/models`;
     const diagnosticSecret = "local-service-diagnostic-secret";
     const inheritedDiagnosticSecret = "inherited-local-service-diagnostic-secret";
+    const headerDiagnosticSecret = "header-local-service-diagnostic-secret";
+    const argumentDiagnosticSecret = "argument-local-service-diagnostic-secret";
     let startupError: Error | undefined;
     vi.stubEnv("INHERITED_DIAGNOSTIC_TOKEN", inheritedDiagnosticSecret);
 
     try {
       await ensureProviderLocalService({
         providerId: "local-diagnostics",
         baseUrl: `http://127.0.0.1:${port}/v1`,
+        headers: {
+          Authorization: `Bearer ${headerDiagnosticSecret}`,
+        },
         service: {
           command: process.execPath,
           args: [
             "-e",
-            `const noise="x".repeat(9000);process.stderr.write(noise+" "+process.env.DIAGNOSTIC_SECRET+" "+process.env.INHERITED_DIAGNOSTIC_TOKEN);process.exit(17);`,
+            `const http=require("node:http");const noise="x".repeat(9000);const server=http.createServer((req,res)=>{process.stderr.write(noise+" "+process.env.DIAGNOSTIC_SECRET+" "+process.env.INHERITED_DIAGNOSTIC_TOKEN+" "+process.argv[1]+" "+req.headers.authorization);res.writeHead(503,{"connection":"close"});res.end("not ready");server.close();setTimeout(()=>process.exit(17),20);});server.listen(${port},"127.0.0.1");`,
+            argumentDiagnosticSecret,
           ],
           env: { DIAGNOSTIC_SECRET: diagnosticSecret },
           healthUrl,
@@ -793,6 +799,8 @@ describe("provider local service", () => {
     expect(startupError?.message).toContain("[redacted]");
     expect(startupError?.message).not.toContain(diagnosticSecret);
     expect(startupError?.message).not.toContain(inheritedDiagnosticSecret);
+    expect(startupError?.message).not.toContain(headerDiagnosticSecret);
+    expect(startupError?.message).not.toContain(argumentDiagnosticSecret);
     expect(Buffer.byteLength(startupError?.message ?? "")).toBeLessThanOrEqual(8 * 1024 + 256);
     expect(getManagedProviderLocalServiceDiagnosticsForTest()).toEqual([]);
   });
diff --git a/src/agents/provider-local-service.ts b/src/agents/provider-local-service.ts
@@ -434,6 +434,8 @@ async function startAndWaitForLocalService(params: {
       chunk,
       service.env,
       process.env,
+      service.args,
+      healthHeaders,
     );
   };
   const captureStderr = (chunk: Buffer | string) => {
@@ -442,6 +444,8 @@ async function startAndWaitForLocalService(params: {
       chunk,
       service.env,
       process.env,
+      service.args,
+      healthHeaders,
     );
   };
   child.stdout?.on("data", captureStdout);
@@ -504,6 +508,8 @@ function appendLocalServiceOutputTail(
   chunk: Buffer | string,
   serviceEnv: Record<string, string> | undefined,
   inheritedEnv: NodeJS.ProcessEnv,
+  serviceArgs: string[] | undefined,
+  healthHeaders: HeadersInit | undefined,
 ): string {
   let redacted = redactSensitiveText(`${current}${chunk.toString()}`, { mode: "tools" });
   for (const value of Object.values(serviceEnv ?? {})) {
@@ -516,6 +522,16 @@ function appendLocalServiceOutputTail(
       redacted = redacted.replaceAll(value, "[redacted]");
     }
   }
+  for (const value of serviceArgs ?? []) {
+    if (value) {
+      redacted = redacted.replaceAll(value, "[redacted]");
+    }
+  }
+  for (const [, value] of new Headers(healthHeaders)) {
+    if (value) {
+      redacted = redacted.replaceAll(value, "[redacted]");
+    }
+  }
   const bytes = Buffer.from(redacted);
   if (bytes.byteLength <= LOCAL_SERVICE_OUTPUT_TAIL_MAX_BYTES) {
     return redacted;
