@sema-agent/core 7.33.6 → 7.33.7

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 7.33.7 — 2026-09-28
+
+### Fix — the OpenTelemetry OTLP exporter's header lists are withheld from the tool shell and language-server children by name (#1180; security; behavior narrowing; +0 exports, +0 wire keys, `SecretEnvFindingKind` unchanged) (@server)
+
+- **Before.** `OTEL_EXPORTER_OTLP_HEADERS` and the per-signal `OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_HEADERS` carry no credential word, so the name rules passed them and the scrub never reads their value: with `Authorization=Bearer <token>`, `api-key=<token>` or `Authorization=Basic <base64>` in the engine's environment, every tool shell and language server inherited the variable and a model-chosen `env` printed the collector credential (`isSecretEnvKey` answered `false` for all four names × all three values on 7.33.6).
+- **Now.** The exporter's header-list names join the exact credential-name list: `OTEL_EXPORTER_OTLP_HEADERS`, `…_TRACES_HEADERS`, `…_METRICS_HEADERS`, `…_LOGS_HEADERS` (OpenTelemetry specification, `protocol/exporter.md`, v1.0.0 onward: the value is the request headers the exporter sends, `key1=value1,…`), `…_PROFILES_HEADERS` (opentelemetry.io OTLP exporter configuration, profiles signal) and the v0.7.0 per-signal spellings `…_SPAN_HEADERS` / `…_METRIC_HEADERS`. The name decides and the value is not read — an empty or credential-free header list is withheld too; findings are `exact-name`, confidence `high`. Exact names, not a `_HEADERS` shape: `CORS_ALLOW_HEADERS` and `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` (header names, not values) stay. The exporter's other settings (`OTEL_SERVICE_NAME`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `…_PROTOCOL`, `OTEL_RESOURCE_ATTRIBUTES`, …) are handed on as before.
+- **Who needs it.** Deployments that configure OTLP export with header authentication in the engine's environment — including a server that merges its credentials file into the engine process environment, where `OTEL_EXPORTER_OTLP_HEADERS` is one of the credential slots.
+- **Who is hurt / compensation.** A deployment that authenticates OTLP with headers and lets the model's shell inherit them: the child no longer has the variable, so an OpenTelemetry client run inside the model's shell (or a language server) exports without its authentication header and the collector may reject it. Compensation: hand the name back explicitly — `inheritEnv: [..., "OTEL_EXPORTER_OTLP_HEADERS"]` or `shellEnv: { OTEL_EXPORTER_OTLP_HEADERS: … }` on the exec env, `NodeLspManagerOptions.env` for a language server. Over-drop and residual (KL-1180): a credential-free header list is withheld too; a numbered or decorated spelling, a dotted spelling (OpenTelemetry's Java SDK also reads `otel.exporter.otlp.headers` / `OTEL_EXPORTER_OTLP.TRACES_HEADERS` as these settings), a vendor SDK's own header variable and an OTLP endpoint written with a userinfo are still handed on (values of other names are not read). The scope is the scrub's: the tool shell (`NodeExecutionEnv`, default `inheritEnv`) and the default language-server spawn; a `runSpec` oracle gate's command inherits the engine's environment as before.
+- Pins: `test/backlog1180-otlp-headers-secret-env.test.ts` — seven names × three header values (`exact-name`, `high`, value absent from findings), value-blindness (no value, empty, credential-free lists), eleven controls; the server's thirteen secret-env names each withheld by name with a harmless value; a real shell spawned by `NodeExecutionEnv` whose `env` holds none of the planted names or values and keeps the controls, with the notice naming them; the `inheritEnv` allow list and `shellEnv` put-back through a real shell; the default language-server spawn.
+
 ## 7.33.6 — 2026-09-28
 
 ### Fix — a withheld entry of git's indexed env config keeps its index, holding a placeholder entry; the record is never renumbered and the count never rewritten (#1160; 7.33.5 regression; behavior; +0 exports, +0 wire keys) (@server)

package/dist/core/secret-env.js

@@ -9,6 +9,9 @@ const SECRET_ENV_EXACT_NAMES = new Set([
     "DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH",
     "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
     "NPM_CONFIG__AUTH", "NPM_CONFIG__AUTHTOKEN",
+    "OTEL_EXPORTER_OTLP_HEADERS", "OTEL_EXPORTER_OTLP_TRACES_HEADERS", "OTEL_EXPORTER_OTLP_METRICS_HEADERS",
+    "OTEL_EXPORTER_OTLP_LOGS_HEADERS", "OTEL_EXPORTER_OTLP_PROFILES_HEADERS",
+    "OTEL_EXPORTER_OTLP_SPAN_HEADERS", "OTEL_EXPORTER_OTLP_METRIC_HEADERS",
 ]);
 const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY", "ROUTING_KEY",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.6",
+  "version": "7.33.7",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.7.json

@@ -0,0 +1,63 @@
+{
+  "repo": "core",
+  "version": "7.33.7",
+  "from": "af66de6b6e52c72e094d79a3308788bad6e08824",
+  "to": "v7.33.7",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "#1180 (security, narrowing): the OpenTelemetry OTLP exporter's header-list names — `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS,PROFILES}_HEADERS` and the specification v0.7.0 spellings `OTEL_EXPORTER_OTLP_{SPAN,METRIC}_HEADERS` — are withheld by name, value-blind, from the children the scrub covers (the tool shell `NodeExecutionEnv` with the default `inheritEnv`, the default language-server spawn) (`SecretEnvFinding.kind` = `exact-name`, confidence `high`; `SecretEnvFindingKind` unchanged)."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "config.secret_env_scrubbed",
+      "assertions": [
+        "G1.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.confidence",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.c"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@46b7fe60 sdk@8c379ef — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "27d0adda64b75d026baee92fc39e95b57bfef5a0"
+}