nickyleachandPaperclip 81b9ac1a42 fix(server): move run secret redactions to the new table and bound registrations ...

Move the run secret redaction registry off heartbeat_runs.context_snapshot
and onto the new company-scoped run_secret_redactions table. A registered
value no longer forces a read-modify-write of the whole run context, and a
read of a fingerprint-only row (its material cleared by the sweep) returns
no plaintext instead of throwing. A read still honours a value registered
under the legacy context_snapshot key, so a run that registered a bearer
before this change stays masked.

Bound the runner API path to at most one minted, registered bearer for
each run and each distinct (adapter type, responsible user) pair, held on
the tool authority for the run's lifetime, instead of one mint for each
tool call.

Add a bounded, ordered periodic sweep that clears expired material and
keeps each row's fingerprint, following the setup-token reaper convention.
It runs at server startup and on the scheduler interval.

Co-authored-by: Paperclip <noreply@paperclip.ing>

2026-09-16 07:15:56 +00:00

..

scripts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00

src

fix(server): move run secret redactions to the new table and bound registrations

2026-09-16 07:15:56 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572)

2026-08-17 22:11:30 -05:00

package.json

fix: preserve runner recovery, warm sessions, and task outcomes (#13338)

2026-09-12 19:41:15 -05:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00