mirror of https://github.com/garrytan/gstack.git
c8f078b482
error_message was uploaded with only quote/newline escaping — stack traces
and failed-API errors can embed credentials, private paths, and hostnames,
and the sync path strips only _repo_slug/_branch.
New lib/redact-engine.ts export redactFindingSpans(): replaces EVERY
finding's span with <REDACTED-{id}> regardless of tier (applyRedactions is
the interactive PII-only path and exits nonzero on credential findings, so
it can't serve machine egress). Returns null when a span can't be located —
callers drop the whole payload rather than risk a leak.
gstack-telemetry-log pipes error_message through it at LOG time, so the
local JSONL at rest is clean too; surrounding text survives for crash
triage. FAIL CLOSED: bun missing, engine error, or non-JSON-string output
all null the field. Tests pin: embedded ghp_ token → <REDACTED-github.pat>
with context intact; redactor unavailable → null; raw bytes on disk never
contain the token.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| bin-context.ts | ||
| conductor-env-shim.ts | ||
| gbrain-exec.ts | ||
| gbrain-guards.ts | ||
| gbrain-local-status.ts | ||
| gbrain-sources.ts | ||
| gstack-decision-semantic.ts | ||
| gstack-decision.ts | ||
| gstack-memory-helpers.ts | ||
| jsonl-store.ts | ||
| redact-audit-log.ts | ||
| redact-engine.ts | ||
| redact-patterns.ts | ||
| staging-guard.ts | ||
| worktree.ts | ||