nickyleachandPaperclip ba465523ea fix(server): redact an agent-authored run bearer before persistence ...

Close a gap in the JWT candidate scanner: it took only the first three
dot-joined segments of a chain, so a dotted prefix right before a
bearer hid the real token from the fingerprint lookup. The scanner now
offers every three-segment window in a chain, and both the read mask
and the new write-time redactor share this one scanner.

Add redactAuthoredRunBearer(): an exact registered-bearer match first,
then a narrow JWT-shaped fallback that requires the header segment to
decode as JSON with an alg member. This keeps an unexpanded variable,
a placeholder, and the redaction marker untouched.

Call it from addComment() for an agent-authored body, and from
create() and update() for an agent-authored issue description — the
two writers of issues.description. Each read runs on the caller's own
transaction connection, and a failed lookup aborts the write instead
of persisting unredacted text.

Co-authored-by: Paperclip <noreply@paperclip.ing>

2026-09-16 08:01:26 +00:00

..

scripts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00

src

fix(server): redact an agent-authored run bearer before persistence

2026-09-16 08:01:26 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572)

2026-08-17 22:11:30 -05:00

package.json

fix: preserve runner recovery, warm sessions, and task outcomes (#13338)

2026-09-12 19:41:15 -05:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00