@estebanforge/pi-antigravity-bridge 1.7.0 → 1.7.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.7.1] - 2026-09-23
+
+### Fixed
+
+- **Subprocess stderr can no longer leak secrets into logs or the chat.** The `agy` CLI can print auth material (API keys, OAuth tokens, credential headers) to stderr, and six surfaces carried that text verbatim: the daily support log users attach to bug reports, the stream-json turn-failure error, the ACP connection-exit rejection reasons and `/agy doctor` tail, the web tools' failure note, and the AskAntigravity delegation exit note. A key in an auth error therefore landed on disk and in the transcript unchanged. Redaction now runs on the reassembled stderr tail at exit and getter boundaries - never per chunk - so a token split across two pipe events still matches, and the raw tail stays internal. New `redactText()` scrubs four secret-shaped pattern classes (API-key prefixes, OAuth tokens, credential headers, token-ish JSON fields), anchored with a word boundary so ordinary text like `desk-123456789012` survives, and carries no length cap because callers already bound their own output sizes. The daily log scrubber additionally scans string values, not just secret-shaped keys, and routes `Error.message` through the same pass; values are scanned before truncation so a cut token cannot lose the characters a pattern needs. Best-effort by design: a last line against leak paths, not a sandbox. Ten new tests pin the behavior, two of them spawning real processes (a secret-bearing crash and a token split across stderr chunks). 1200 tests, tsc clean.
+
 ## [1.7.0] - 2026-09-23
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@estebanforge/pi-antigravity-bridge",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Gemini provider for Pi on the Antigravity ACP server (official Google ACP) or the stream-json agy CLI. antigravity/* models in Pi's /model picker, no-patch MCP bridge: agy runs Pi's tools. ToS safe to use.",
   "keywords": [
     "pi-package",

package/src/acp/connection.ts

@@ -26,6 +26,7 @@ import path from "node:path";
 import { parseAuthPort, readLastUrl } from "./browser-capture.js";
 import { frameCarriesUsage } from "./events.js";
 import type { AgyUsage } from "../driver-types.js";
+import { redactText } from "../redact.js";
 import { JsonRpcResponseError, JsonRpcSession } from "./jsonrpc.js";
 
 export interface AcpMcpServer {
@@ -110,7 +111,9 @@ export class AcpConnection {
 	}
 
 	get stderrTail(): string {
-		return this.#stderrTail;
+		// Redacted at the boundary: the raw tail stays internal, every consumer
+		// (doctor display, driver exit logs, failure messages) sees redacted text.
+		return redactText(this.#stderrTail);
 	}
 
 	/** Gate B watch: latched true once any session/update frame carried
@@ -152,8 +155,8 @@ export class AcpConnection {
 		// try/catch in #write cannot see them. Without this listener an EPIPE
 		// (server died mid-handshake) is uncaught and kills pi.
 		child.stdin?.on("error", (err) => {
-			this.#opts.log("stdin-error", { message: err.message });
-			if (!this.#exited && !this.#killed) this.#finish(err.message);
+			this.#opts.log("stdin-error", { message: redactText(err.message) });
+			if (!this.#exited && !this.#killed) this.#finish(redactText(err.message));
 		});
 
 		const rpc = new JsonRpcSession({
@@ -169,12 +172,14 @@ export class AcpConnection {
 			this.#stderrTail = (this.#stderrTail + chunk).slice(-8192);
 		});
 		child.on("error", (err) => {
-			this.#opts.log("spawn-error", { message: err.message });
-			this.#finish(err.message);
+			this.#opts.log("spawn-error", { message: redactText(err.message) });
+			this.#finish(redactText(err.message));
 		});
 		child.on("exit", (code, signal) => {
 			this.#opts.log("exit", { code: code ?? signal ?? "?" });
-			this.#finish(this.#stderrTail.trim());
+			// The reason rides into pending-request rejections, so it must be
+			// redacted here (server stderr can carry auth material).
+			this.#finish(redactText(this.#stderrTail.trim()));
 		});
 
 		const result = (await this.request(
@@ -444,7 +449,7 @@ export class AcpConnection {
 		this.#authUrlWatcher?.close();
 		this.#authUrlWatcher = undefined;
 		this.abortAll(`connection exited: ${reason || "process gone"}`);
-		this.#opts.onExit({ code: null, signal: null, stderrTail: this.#stderrTail });
+		this.#opts.onExit({ code: null, signal: null, stderrTail: redactText(this.#stderrTail) });
 	}
 }
 

package/src/ask-tool.ts

@@ -25,6 +25,7 @@ import {
 	snapshotConversations,
 } from "./discovery.js";
 import { loadConfig, type AgyMode, type ThinkingTier } from "./config.js";
+import { redactText } from "./redact.js";
 import { acquireBridgeSuppression } from "./mcp-registration.js";
 import { AGY_EFFORT_ORDER, spawnAgyModelsRaw, toAgyEffort } from "./models.js";
 
@@ -742,8 +743,10 @@ export async function registerAskAntigravityTool(
 				}
 
 				if (outcome.exitCode !== 0) {
-					const note = details.stderr.trim()
-						? `agy exited with status ${outcome.exitCode}: ${details.stderr.trim()}`
+					// stderr can carry auth material; the note is chat-visible.
+					const stderr = redactText(details.stderr.trim());
+					const note = stderr
+						? `agy exited with status ${outcome.exitCode}: ${stderr}`
 						: `agy exited with status ${outcome.exitCode}`;
 					return {
 						content: [{ type: "text", text: text ? `${text}\n\n[${note}]` : note }],

package/src/daily-log.ts

@@ -12,7 +12,9 @@
 //   - One appendFile per record: O_APPEND keeps single-line writes atomic,
 //     so two pi tabs sharing the dir stay line-consistent.
 //   - No secrets, no prompt content: values of secret-shaped keys are
-//     redacted and long strings are truncated before they reach disk.
+//     redacted wholesale, secret-shaped material inside string values
+//     (stderr tails, error messages) is scrubbed, and long strings are
+//     truncated before they reach disk.
 //   - Retention: files older than `retentionDays` are pruned once per
 //     process, so the dir cannot grow unbounded.
 //   - Volume tiers: default installs write ONLY errors — routine logging
@@ -22,6 +24,7 @@
 
 import { appendFile, mkdir, readdir, unlink } from "node:fs/promises";
 import path from "node:path";
+import { redactText } from "./redact.js";
 
 export type LogLevel = "debug" | "info" | "warn" | "error";
 
@@ -63,14 +66,24 @@ const MAX_RECORD = 4000;
 // lives in `value`, which a name-only regex would miss.
 const SECRET_KEY = /token|secret|password|passphrase|authorization|api[-_]?key|cookie|headers/i;
 
-/** Redact secret-shaped values and cap runaway strings before disk. */
+/** Redact secret-shaped keys wholesale, scrub secrets embedded in string
+ *  values, and cap runaway strings before disk. */
 function scrub(value: unknown, depth: number): unknown {
 	if (value === null || value === undefined) return value;
 	if (value instanceof Error) {
-		return { name: value.name, message: value.message, stack: scrub(value.stack, depth) };
+		// message goes through the string branch: errors are the main carrier of
+		// subprocess stderr text (the exact leak class this scrubber exists for).
+		return {
+			name: value.name,
+			message: scrub(value.message, depth),
+			stack: scrub(value.stack, depth),
+		};
 	}
 	if (typeof value === "string") {
-		return value.length > MAX_STRING ? value.slice(0, MAX_STRING) + "…(truncated)" : value;
+		// Value scan first, truncate second: a cut token could lose the tail
+		// characters the pattern needs to match.
+		const clean = redactText(value);
+		return clean.length > MAX_STRING ? clean.slice(0, MAX_STRING) + "…(truncated)" : clean;
 	}
 	if (typeof value === "number" || typeof value === "boolean") return value;
 	if (depth >= MAX_DEPTH) return "(depth limit)";

package/src/driver.ts

@@ -19,6 +19,7 @@ import { randomUUID } from "node:crypto";
 import { parseAgyLine } from "./stream-events.js";
 import { bridgeMcpConfigDir, bridgeMcpConfigExists } from "./mcp-server.js";
 import { gateHooksStaged } from "./approval-hook.js";
+import { redactText } from "./redact.js";
 import type {
 	AgyUsage,
 	DriverActivity,
@@ -403,7 +404,9 @@ export class StreamDriver implements TurnDriver {
 				} else {
 					this.#failTurn(
 						turn,
-						this.#stderrTail.trim() || `agy exited with status ${code ?? "signal"}`,
+						// agy stderr can carry auth material; the tail becomes the
+						// user-facing error and a daily-log value.
+						redactText(this.#stderrTail.trim()) || `agy exited with status ${code ?? "signal"}`,
 					);
 				}
 			}

package/src/redact.ts

@@ -0,0 +1,27 @@
+// Secret redaction for free text: stderr tails, error messages, log string
+// values. Patterns ported from pi-antigravity-acp-provider's errors.redact
+// (MIT). No length cap here on purpose: callers already bound their own
+// output sizes (8192 stderr tails, MAX_STRING truncation), and a cap inside
+// this function would silently shorten their output.
+
+const SECRET_PATTERNS: Array<[RegExp, string]> = [
+	// API-key prefixes: Google (AIza), OpenAI-style (sk-), npm, GitHub. The
+	// left word-boundary stops mid-word matches ("desk-123456789012").
+	[/\b(?:AIza|sk-|npm_|gh[opurs]_)[A-Za-z0-9_-]{12,}/gu, "<redacted>"],
+	// Google OAuth tokens (access ya29., refresh 1//).
+	[/\b(?:ya29\.|1\/\/)[A-Za-z0-9._~+/-]{12,}/gu, "<redacted>"],
+	// Credential header values; the key text stays (useful context).
+	[/((?:authorization|cookie|set-cookie)\s*[:=]\s*(?:bearer\s+)?)[^\s,;]+/giu, "$1<redacted>"],
+	// Token-ish JSON fields; the key stays.
+	[
+		/((?:["']?(?:access_token|refresh_token|id_token|client_secret|api[-_]?key)["']?)\s*[:=]\s*["']?)[^"'\s,;&}]+/giu,
+		"$1<redacted>",
+	],
+];
+
+/** Replace secret-shaped material with `<redacted>`, preserving structure. */
+export function redactText(text: string): string {
+	let out = text;
+	for (const [pattern, replacement] of SECRET_PATTERNS) out = out.replace(pattern, replacement);
+	return out;
+}

package/src/web-tools.ts

@@ -21,6 +21,7 @@ import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync }
 import os from "node:os";
 import path from "node:path";
 import { Type } from "typebox";
+import { redactText } from "./redact.js";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export const WEB_AGENT_PREFIX = "pi-bridge-web-";
@@ -119,7 +120,7 @@ export async function runWebAgent(opts: WebRunOptions): Promise<WebRunResult> {
 	const agentName = `${WEB_AGENT_PREFIX}${process.pid}-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
 	const agentDir = path.join(root, agentName);
 	mkdirSync(agentDir, { recursive: true, mode: 0o700 });
-	// commandExecutionPolicy stays at the fork-validated "auto": the template's
+	// commandExecutionPolicy stays at the live-validated "auto": the template's
 	// tools list has no command tool and plan mode blocks edits; an unvalidated
 	// stricter enum risks agent discovery failing outright.
 	writeFileSync(
@@ -178,7 +179,7 @@ export async function runWebAgent(opts: WebRunOptions): Promise<WebRunResult> {
 			child.once("close", resolve);
 		});
 		if (!failed && opts.signal?.aborted) failed = "web run aborted";
-		if (!failed && code !== 0) failed = `agy exited with code ${code}${stderrTail ? `: ${stderrTail.trim().slice(-300)}` : ""}`;
+		if (!failed && code !== 0) failed = `agy exited with code ${code}${stderrTail ? `: ${redactText(stderrTail.trim()).slice(-300)}` : ""}`;
 		if (!failed && !allowedToolUsed) failed = `Antigravity returned an answer without an observed ${opts.gatedTool} step; refusing it as unverified`;
 		if (!failed && response === "") failed = "Antigravity web run produced no answer";
 		if (failed) {