nickyleachandPaperclip f3144b17ca fix(server): mask a registered bearer by fingerprint on every registry read ...

The redaction registry only replaced the exact stored value of a run's
own registrations. A bearer minted on one run and pasted into another
run's or issue's text stayed unmasked, and a row swept clear of its
material could no longer resolve any plain text to match against.

Add a second pass to the three read functions. It finds each
JWT-shaped candidate in the value, hashes it, and checks the hash
against the company's registry. A match needs no decryption, because
the candidate found in the text already is the plain text, so a row
whose material the sweep cleared still masks. The lookup scopes to
the company only, so it also covers a value pasted across runs and
issues. It batches its query over the whole candidate set instead of
querying once per run or per candidate.

Co-authored-by: Paperclip <noreply@paperclip.ing>

2026-09-16 07:31:37 +00:00

..

scripts

feat: add experimental persistent agent chat (#13284)

2026-09-12 08:56:04 -05:00

src

fix(server): mask a registered bearer by fingerprint on every registry read

2026-09-16 07:31:37 +00:00

.gitattributes

chore(db): treat Drizzle migration snapshots as binary in diffs (#11254)

2026-08-11 21:37:07 -07:00

CHANGELOG.md

chore: release v0.3.1

2026-03-12 13:09:22 -05:00

drizzle.config.ts

Expand data model with companies, approvals, costs, and heartbeats

2026-02-17 09:07:22 -06:00

package.json

chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 (#12262)

2026-09-03 15:16:02 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

feat(workspaces): sign the workspace login handoff and gate readiness (#11671)

2026-08-19 02:37:02 -05:00