nickyleachandPaperclip 74b3e024eb fix(server): mint the run bearer through a register-first wrapper ...

The run bearer minted for a run must reach the redaction registry
before any code can use it, so a later read of run or issue text can
mask it. Add mintAndRegisterRunBearer(), the only allowed caller of
createLocalAgentJwt. It mints, then registers the token with the run
secret redaction registry before returning it. A registration failure
propagates and returns no token, so the caller aborts before it
injects a bearer into an adapter or a tool call.

Route all three mint sites through the wrapper: the legacy adapter
dispatch path and the two native-runtime tool paths (create_project
and call_api). A source-scanning test pins createLocalAgentJwt to have
no caller outside the wrapper and the unit tests.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-09-16 06:43:14 +00:00

..

scripts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00

src

fix(server): mint the run bearer through a register-first wrapper

2026-09-16 06:43:14 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572)

2026-08-17 22:11:30 -05:00

package.json

fix: preserve runner recovery, warm sessions, and task outcomes (#13338)

2026-09-12 19:41:15 -05:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00