@slates/provider 1.0.0-rc.18 → 1.0.0-rc.19

package/src/action/attachment.ts

@@ -1,6 +1,10 @@
 export interface SlateAttachmentUrlContent {
   type: 'url';
   url: string;
+  headers?: Record<string, string>;
+  query?: Record<string, string>;
+  refreshReference?: unknown;
+  refreshAt?: string;
 }
 
 export interface SlateAttachmentInlineContent {
@@ -9,21 +13,58 @@ export interface SlateAttachmentInlineContent {
   content: string;
 }
 
+export interface SlateAttachmentUploadReferenceContent {
+  type: 'upload_reference';
+  referenceId: string;
+}
+
 export interface SlateAttachment {
   mimeType?: string;
-  content: SlateAttachmentUrlContent | SlateAttachmentInlineContent;
+  attachmentHash?: string;
+  content:
+    | SlateAttachmentUrlContent
+    | SlateAttachmentInlineContent
+    | SlateAttachmentUploadReferenceContent;
 }
 
-export let createUrlAttachment = (url: string, mimeType?: string): SlateAttachment => ({
-  mimeType,
-  content: {
-    type: 'url',
-    url
+export let createUrlAttachment = (
+  url: string,
+  opts: {
+    mimeType?: string;
+    attachmentHash?: string;
+    headers?: Record<string, string>;
+    query?: Record<string, string>;
+    refreshReference?: unknown;
+    refreshAt?: string;
+  } = {}
+): SlateAttachment => {
+  if (opts.refreshReference !== undefined && !opts.refreshAt) {
+    throw new Error('createUrlAttachment: refreshAt is required when refreshReference is set');
   }
-});
 
-export let createBase64Attachment = (content: string, mimeType?: string): SlateAttachment => ({
+  return {
+    mimeType: opts.mimeType,
+    attachmentHash: opts.attachmentHash,
+    content: {
+      type: 'url',
+      url,
+      ...(opts.headers ? { headers: opts.headers } : {}),
+      ...(opts.query ? { query: opts.query } : {}),
+      ...(opts.refreshReference !== undefined
+        ? { refreshReference: opts.refreshReference }
+        : {}),
+      ...(opts.refreshAt ? { refreshAt: opts.refreshAt } : {})
+    }
+  };
+};
+
+export let createBase64Attachment = (
+  content: string,
+  mimeType?: string,
+  attachmentHash?: string
+): SlateAttachment => ({
   mimeType,
+  attachmentHash,
   content: {
     type: 'content',
     encoding: 'base64',
@@ -31,8 +72,13 @@ export let createBase64Attachment = (content: string, mimeType?: string): SlateA
   }
 });
 
-export let createTextAttachment = (content: string, mimeType?: string): SlateAttachment => ({
+export let createTextAttachment = (
+  content: string,
+  mimeType?: string,
+  attachmentHash?: string
+): SlateAttachment => ({
   mimeType,
+  attachmentHash,
   content: {
     type: 'content',
     encoding: 'utf-8',

package/src/action/directUpload.ts

@@ -0,0 +1,59 @@
+import type { SlateAttachment } from './attachment';
+
+export interface SlateLiveInvocationInfo {
+  token: string;
+  baseUrl: string;
+  maxAttachmentSizeBytes: number;
+}
+
+export interface SlateDirectUploadInput {
+  live: SlateLiveInvocationInfo;
+  mimeType?: string;
+  filename?: string;
+  body: ReadableStream<Uint8Array> | Uint8Array;
+}
+
+export let uploadAttachmentDirect = async (
+  d: SlateDirectUploadInput
+): Promise<SlateAttachment> => {
+  let baseUrl = d.live.baseUrl.replace(/\/$/, '');
+
+  let registerRes = await fetch(`${baseUrl}/slates-hub/live-invocation/attachments`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      authorization: `Bearer ${d.live.token}`
+    },
+    body: JSON.stringify({
+      attachments: [{ mimeType: d.mimeType, filename: d.filename }]
+    })
+  });
+  if (!registerRes.ok) {
+    throw new Error(
+      `Failed to register attachment for direct upload (status ${registerRes.status})`
+    );
+  }
+
+  let { attachments } = (await registerRes.json()) as {
+    attachments: { referenceId: string; uploadUrl: string }[];
+  };
+  let registration = attachments[0];
+  if (!registration) {
+    throw new Error('Live invocation API returned no attachment registrations');
+  }
+
+  let putRes = await fetch(registration.uploadUrl, {
+    method: 'PUT',
+    ...(d.body instanceof Uint8Array ? {} : ({ duplex: 'half' } as any)),
+    headers: d.mimeType ? { 'content-type': d.mimeType } : undefined,
+    body: d.body
+  });
+  if (!putRes.ok) {
+    throw new Error(`Failed to upload attachment content (status ${putRes.status})`);
+  }
+
+  return {
+    mimeType: d.mimeType,
+    content: { type: 'upload_reference', referenceId: registration.referenceId }
+  };
+};

package/src/action/getFileUrlTool.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import type { SlateContext } from '../context/context';
+import type { SlateSpecification } from '../specification/specification';
+import { tool } from './tool';
+
+export let GET_FILE_URL_TOOL_ID = 'metorial$getFileUrl';
+
+export let getFileUrlToolInputSchema = z.object({
+  url: z.string(),
+  reference: z.any().nullable()
+});
+export type GetFileUrlToolInput = z.infer<typeof getFileUrlToolInputSchema>;
+
+export let getFileUrlToolOutputSchema = z.object({
+  url: z.string(),
+  expiresAt: z.string(),
+  headers: z.record(z.string(), z.string()).optional(),
+  query: z.record(z.string(), z.string()).optional()
+});
+export type GetFileUrlToolOutput = z.infer<typeof getFileUrlToolOutputSchema>;
+
+export type GetFileUrlHandler<ConfigType extends {}, AuthType extends {}> = (
+  context: SlateContext<ConfigType, AuthType, GetFileUrlToolInput>
+) => Promise<GetFileUrlToolOutput>;
+
+export let getFileUrlTool = <ConfigType extends {}, AuthType extends {}>(
+  spec: SlateSpecification<ConfigType, AuthType>,
+  handleGetFileUrl: GetFileUrlHandler<ConfigType, AuthType>
+) =>
+  tool(spec, {
+    key: GET_FILE_URL_TOOL_ID,
+    name: 'Get File URL',
+    description: 'Reserved: refreshes an expiring attachment download URL. Hub-internal only.'
+  })
+    .input(getFileUrlToolInputSchema)
+    .output(getFileUrlToolOutputSchema)
+    .handleInvocation(async ctx => ({
+      output: await handleGetFileUrl(ctx),
+      message: 'ok'
+    }))
+    .build();

package/src/action/index.ts

@@ -1,5 +1,6 @@
 export * from './action';
 export * from './builder';
+export * from './getFileUrlTool';
 export * from './publicTool';
 export * from './scopes';
 export * from './tool';

package/src/auth/index.ts

@@ -1,3 +1,4 @@
 export * from './auth';
 export * from './oauth';
+export * from './redact';
 export * from './types';

package/src/auth/redact.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest';
+import type { SlateAttachment } from '../action/attachment';
+import { AuthConfigSecretRedactor, redactUrlAttachmentSecrets } from './redact';
+
+describe('AuthConfigSecretRedactor', () => {
+  let authConfig = { token: '123SECRET', nested: { token2: 'also_secret' } };
+
+  it('redacts values that match a secret to placeholders', () => {
+    let redactor = new AuthConfigSecretRedactor(authConfig);
+
+    expect(
+      redactor.redact({
+        headers: { Authorization: 'Bearer 123SECRET' },
+        query: { key: 'also_secret' }
+      })
+    ).toEqual({
+      headers: { Authorization: 'Bearer 123SECRET' }, // whole-value match only, not substring
+      query: { key: '$$MT$secret$authConfig$nested.token2' }
+    });
+  });
+
+  it('redacts a bare string value', () => {
+    let redactor = new AuthConfigSecretRedactor(authConfig);
+    expect(redactor.redact('123SECRET')).toBe('$$MT$secret$authConfig$token');
+  });
+
+  it('leaves non-secret strings untouched', () => {
+    let redactor = new AuthConfigSecretRedactor(authConfig);
+    expect(redactor.redact('https://example.com/file.pdf')).toBe(
+      'https://example.com/file.pdf'
+    );
+  });
+
+  it('recurses through arrays and nested objects', () => {
+    let redactor = new AuthConfigSecretRedactor(authConfig);
+    expect(redactor.redact({ list: ['also_secret', 'plain'] })).toEqual({
+      list: ['$$MT$secret$authConfig$nested.token2', 'plain']
+    });
+  });
+
+  it('never registers an empty-string secret', () => {
+    let redactor = new AuthConfigSecretRedactor({ token: '' });
+    expect(redactor.redact({ a: '', b: '' })).toEqual({ a: '', b: '' });
+  });
+
+  it('is a no-op when there is no auth config', () => {
+    let redactor = new AuthConfigSecretRedactor(undefined);
+    expect(redactor.redact({ a: 'b' })).toEqual({ a: 'b' });
+  });
+});
+
+describe('redactUrlAttachmentSecrets', () => {
+  let authConfig = { token: '123SECRET', nested: { token2: 'also_secret' } };
+
+  let urlAttachment = (
+    overrides: Partial<Extract<SlateAttachment['content'], { type: 'url' }>> = {}
+  ): SlateAttachment => ({
+    mimeType: 'application/pdf',
+    content: { type: 'url', url: 'https://example.com/file.pdf', ...overrides }
+  });
+
+  it('redacts headers and query on url attachments', () => {
+    let attachments: SlateAttachment[] = [
+      urlAttachment({
+        headers: { Authorization: 'Bearer 123SECRET' },
+        query: { key: 'also_secret' }
+      })
+    ];
+
+    expect(redactUrlAttachmentSecrets(attachments, authConfig)).toEqual([
+      urlAttachment({
+        headers: { Authorization: 'Bearer 123SECRET' },
+        query: { key: '$$MT$secret$authConfig$nested.token2' }
+      })
+    ]);
+  });
+
+  it('leaves url attachments with no headers/query untouched', () => {
+    let attachments = [urlAttachment()];
+    expect(redactUrlAttachmentSecrets(attachments, authConfig)).toEqual(attachments);
+  });
+
+  it('leaves content and upload_reference attachments untouched', () => {
+    let attachments: SlateAttachment[] = [
+      {
+        mimeType: 'text/plain',
+        content: { type: 'content', encoding: 'utf-8', content: 'hi' }
+      },
+      { content: { type: 'upload_reference', referenceId: 'ref_1' } }
+    ];
+
+    expect(redactUrlAttachmentSecrets(attachments, authConfig)).toEqual(attachments);
+  });
+
+  it('is a no-op when there is no auth config', () => {
+    let attachments = [urlAttachment({ headers: { Authorization: 'Bearer 123SECRET' } })];
+    expect(redactUrlAttachmentSecrets(attachments, undefined)).toBe(attachments);
+  });
+
+  it('passes an undefined attachment list through unchanged', () => {
+    expect(redactUrlAttachmentSecrets(undefined, authConfig)).toBeUndefined();
+  });
+});

package/src/auth/redact.ts

@@ -0,0 +1,111 @@
+import type { SlateAttachment } from '../action/attachment';
+
+/**
+ * Placeholder prefix used to mark a redacted auth-config secret. Must match the hub's
+ * AuthConfigSecretSerializer (oss/src/slates/apps/hub/src/lib/secretSerializer.ts) exactly --
+ * the hub resolves these placeholders back to live secret values when it proxies an attachment.
+ */
+export let AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX = '$$MT$secret$authConfig$';
+
+/**
+ * Walks an auth config object and replaces any string value that exactly matches one of its
+ * leaf values with a `$$MT$secret$authConfig$<path>` placeholder. Literal, whole-value
+ * substitution only -- not a substring scan, and not a heuristic key-name/value-shape guess
+ * like the http trace redactor in '../axios/trace'.
+ */
+export class AuthConfigSecretRedactor {
+  private readonly secretToPlaceholder = new Map<string, string>();
+
+  public constructor(authConfig: Record<string, unknown> | undefined) {
+    if (authConfig) this.buildSecretMap(authConfig);
+  }
+
+  public redact<T>(value: T): T {
+    return this.transform(value, stringValue => {
+      return this.secretToPlaceholder.get(stringValue) ?? stringValue;
+    });
+  }
+
+  private buildSecretMap(value: unknown, path: string[] = []): void {
+    if (typeof value === 'string') {
+      // Never register "" -- it would replace every empty header/query value with a placeholder.
+      if (value.length === 0) return;
+
+      this.secretToPlaceholder.set(
+        value,
+        `${AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX}${path.join('.')}`
+      );
+      return;
+    }
+
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => {
+        this.buildSecretMap(item, [...path, String(index)]);
+      });
+
+      return;
+    }
+
+    if (this.isPlainObject(value)) {
+      Object.entries(value).forEach(([key, nestedValue]) => {
+        this.buildSecretMap(nestedValue, [...path, key]);
+      });
+    }
+  }
+
+  private transform<T>(value: T, transformString: (value: string) => string): T {
+    if (typeof value === 'string') {
+      return transformString(value) as T;
+    }
+
+    if (Array.isArray(value)) {
+      return value.map(item => this.transform(item, transformString)) as T;
+    }
+
+    if (this.isPlainObject(value)) {
+      let result: Record<string, unknown> = {};
+
+      Object.entries(value).forEach(([key, nestedValue]) => {
+        result[key] = this.transform(nestedValue, transformString);
+      });
+
+      return result as T;
+    }
+
+    return value;
+  }
+
+  private isPlainObject(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+  }
+}
+
+/**
+ * Applied to every finalized attachment list right before it's sent over
+ * `slates/action.tool.invoke` (see @slates/provider-handler). Only `type: 'url'` attachments
+ * carry headers/query -- content/upload_reference attachments pass through untouched.
+ */
+export let redactUrlAttachmentSecrets = (
+  attachments: SlateAttachment[] | undefined,
+  authConfig: Record<string, unknown> | undefined
+): SlateAttachment[] | undefined => {
+  if (!authConfig || !attachments) return attachments;
+
+  let redactor = new AuthConfigSecretRedactor(authConfig);
+
+  return attachments.map(attachment => {
+    if (attachment.content.type !== 'url') return attachment;
+    if (!attachment.content.headers && !attachment.content.query) return attachment;
+
+    return {
+      ...attachment,
+      content: {
+        ...attachment.content,
+        headers: attachment.content.headers
+          ? redactor.redact(attachment.content.headers)
+          : undefined,
+        query: attachment.content.query ? redactor.redact(attachment.content.query) : undefined
+      }
+    };
+  });
+};

package/src/auth/types.ts

@@ -19,7 +19,6 @@ export type SlateAuthWithOauth<
   scopes: {
     title: string;
     description?: string;
-    defaultChecked?: boolean;
     scope: string;
   }[];
 

package/src/axios/trace.ts

@@ -1,4 +1,5 @@
 import type { AxiosError, AxiosResponse, InternalAxiosRequestConfig } from 'axios';
+import { AuthConfigSecretRedactor } from '../auth/redact';
 import type { SlatePublicContext } from '../context';
 
 export interface SlateHttpTraceTextBody {
@@ -377,10 +378,12 @@ let truncateText = (text: string) => {
   };
 };
 
-let sanitizeFreeText = (text: string) => {
+let sanitizeFreeText = (text: string, redactor?: AuthConfigSecretRedactor) => {
   if (!text) return text;
 
-  let result = text;
+  // Literal auth-config secret values are replaced first -- this catches secrets sitting
+  // under a key name the heuristics below don't recognize as secret-like.
+  let result = redactor ? redactor.redact(text) : text;
 
   result = result.replace(
     HTTP_AUTH_SCHEME_PATTERN,
@@ -406,9 +409,14 @@ let sanitizeFreeText = (text: string) => {
   return result;
 };
 
-let sanitizeScalar = (value: string) => truncateText(sanitizeFreeText(value));
+let sanitizeScalar = (value: string, redactor?: AuthConfigSecretRedactor) =>
+  truncateText(sanitizeFreeText(value, redactor));
 
-let redactStructuredValue = (value: unknown, depth = 0): unknown => {
+let redactStructuredValue = (
+  value: unknown,
+  depth = 0,
+  redactor?: AuthConfigSecretRedactor
+): unknown => {
   if (value == null) return value;
   if (depth >= STRUCTURED_DEPTH_LIMIT) return '[truncated]';
 
@@ -418,13 +426,13 @@ let redactStructuredValue = (value: unknown, depth = 0): unknown => {
     typeof value === 'boolean' ||
     typeof value === 'bigint'
   ) {
-    return typeof value === 'string' ? sanitizeFreeText(value) : value;
+    return typeof value === 'string' ? sanitizeFreeText(value, redactor) : value;
   }
 
   if (Array.isArray(value)) {
     return value
       .slice(0, STRUCTURED_ENTRY_LIMIT)
-      .map(entry => redactStructuredValue(entry, depth + 1));
+      .map(entry => redactStructuredValue(entry, depth + 1, redactor));
   }
 
   if (isRecord(value)) {
@@ -433,7 +441,9 @@ let redactStructuredValue = (value: unknown, depth = 0): unknown => {
         .slice(0, STRUCTURED_ENTRY_LIMIT)
         .map(([key, entry]) => [
           key,
-          isSecretKeyName(key) ? REDACTED_VALUE : redactStructuredValue(entry, depth + 1)
+          isSecretKeyName(key)
+            ? REDACTED_VALUE
+            : redactStructuredValue(entry, depth + 1, redactor)
         ])
     );
   }
@@ -457,7 +467,8 @@ let maybeParseJson = (text: string, contentType?: string) => {
 
 let sanitizeTextBody = (
   text: string,
-  contentType?: string
+  contentType?: string,
+  redactor?: AuthConfigSecretRedactor
 ): SlateHttpTraceTextBody | undefined => {
   if (!text) return undefined;
 
@@ -465,8 +476,8 @@ let sanitizeTextBody = (
   let parsedJson = maybeParseJson(text, normalizedContentType);
   let normalizedText =
     parsedJson !== null
-      ? JSON.stringify(redactStructuredValue(parsedJson))
-      : sanitizeFreeText(text);
+      ? JSON.stringify(redactStructuredValue(parsedJson, 0, redactor))
+      : sanitizeFreeText(text, redactor);
   let { text: truncatedText, truncated } = truncateText(normalizedText);
 
   return {
@@ -487,7 +498,8 @@ let isBinaryLike = (value: unknown) => {
 
 let serializeTextBody = (
   value: unknown,
-  contentType?: string
+  contentType?: string,
+  redactor?: AuthConfigSecretRedactor
 ): SlateHttpTraceTextBody | undefined => {
   let normalizedContentType = normalizeContentType(contentType);
 
@@ -496,19 +508,23 @@ let serializeTextBody = (
   }
 
   if (typeof value === 'string') {
-    return sanitizeTextBody(value, normalizedContentType);
+    return sanitizeTextBody(value, normalizedContentType, redactor);
   }
 
   if (value instanceof URLSearchParams) {
-    return sanitizeTextBody(value.toString(), normalizedContentType);
+    return sanitizeTextBody(value.toString(), normalizedContentType, redactor);
   }
 
   if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
-    return sanitizeTextBody(String(value), normalizedContentType);
+    return sanitizeTextBody(String(value), normalizedContentType, redactor);
   }
 
   if (Array.isArray(value) || isRecord(value)) {
-    return sanitizeTextBody(JSON.stringify(redactStructuredValue(value)), 'application/json');
+    return sanitizeTextBody(
+      JSON.stringify(redactStructuredValue(value, 0, redactor)),
+      'application/json',
+      redactor
+    );
   }
 
   return undefined;
@@ -533,18 +549,21 @@ let decodeRedactedMarker = (value: string) =>
     ? value
     : value.split(REDACTED_ENCODED).join(REDACTED_VALUE);
 
-let redactHashFragment = (hash: string) => {
+let redactHashFragment = (hash: string, redactor?: AuthConfigSecretRedactor) => {
   if (!hash?.includes('=')) return hash;
   let withoutHash = hash.startsWith('#') ? hash.slice(1) : hash;
   let redacted = withoutHash.replace(
     /(?<![A-Za-z0-9])([A-Za-z0-9][A-Za-z0-9_\-.]*)=([^&]*)/g,
-    (match, key: string, _rawValue: string) =>
-      isUrlFormSecretKeyName(key) ? `${key}=${REDACTED_VALUE}` : match
+    (match, key: string, rawValue: string) => {
+      if (isUrlFormSecretKeyName(key)) return `${key}=${REDACTED_VALUE}`;
+      let literalRedacted = redactor ? redactor.redact(rawValue) : rawValue;
+      return literalRedacted !== rawValue ? `${key}=${literalRedacted}` : match;
+    }
   );
   return redacted ? `#${redacted}` : '';
 };
 
-let sanitizeUrl = (value: string) => {
+let sanitizeUrl = (value: string, redactor?: AuthConfigSecretRedactor) => {
   if (!value) return value;
 
   try {
@@ -558,14 +577,21 @@ let sanitizeUrl = (value: string) => {
     for (let key of Array.from(url.searchParams.keys())) {
       if (isUrlFormSecretKeyName(key)) {
         url.searchParams.set(key, REDACTED_VALUE);
+        continue;
       }
+
+      // Not a secret-looking key -- still catch a literal auth-config secret value.
+      let rawValue = url.searchParams.get(key) ?? '';
+      let literalRedacted = redactor ? redactor.redact(rawValue) : rawValue;
+      if (literalRedacted !== rawValue) url.searchParams.set(key, literalRedacted);
     }
 
-    url.hash = redactHashFragment(url.hash);
+    url.hash = redactHashFragment(url.hash, redactor);
 
     return decodeRedactedMarker(url.toString());
   } catch {
-    return value.replace(
+    let text = redactor ? redactor.redact(value) : value;
+    return text.replace(
       /([?&]([^=&#]+)=)([^&#]+)/g,
       (_match, prefix: string, key: string, rawValue: string) =>
         isUrlFormSecretKeyName(key) ? `${prefix}${REDACTED_VALUE}` : `${prefix}${rawValue}`
@@ -618,9 +644,12 @@ let headerEntries = (headers: unknown): [string, string][] => {
   return [];
 };
 
-let sanitizeHeaders = (headers: unknown) => {
+let sanitizeHeaders = (headers: unknown, redactor?: AuthConfigSecretRedactor) => {
   let entries = headerEntries(headers)
-    .map(([key, value]) => [key.toLowerCase(), sanitizeScalar(value).text] as [string, string])
+    .map(
+      ([key, value]) =>
+        [key.toLowerCase(), sanitizeScalar(value, redactor).text] as [string, string]
+    )
     .filter(([key]) => isSafeHeaderName(key));
 
   if (entries.length === 0) return undefined;
@@ -668,6 +697,7 @@ export let attachHttpTraceDraft = (
 ) => {
   let traceAwareConfig = config as TraceAwareAxiosRequestConfig;
   let contentType = getContentType(config.headers);
+  let redactor = new AuthConfigSecretRedactor(context._getAuthConfigForRedaction());
 
   traceAwareConfig.__slatesHttpTraceDraft = {
     context,
@@ -675,10 +705,12 @@ export let attachHttpTraceDraft = (
     startedAtMs: Date.now(),
     request: {
       method: (config.method ?? 'GET').toUpperCase(),
-      url: sanitizeUrl(buildUrl(config.baseURL, config.url)),
-      ...(sanitizeHeaders(config.headers) ? { headers: sanitizeHeaders(config.headers) } : {}),
-      ...(serializeTextBody(config.data, contentType)
-        ? { body: serializeTextBody(config.data, contentType) }
+      url: sanitizeUrl(buildUrl(config.baseURL, config.url), redactor),
+      ...(sanitizeHeaders(config.headers, redactor)
+        ? { headers: sanitizeHeaders(config.headers, redactor) }
+        : {}),
+      ...(serializeTextBody(config.data, contentType, redactor)
+        ? { body: serializeTextBody(config.data, contentType, redactor) }
         : {})
     }
   };
@@ -703,6 +735,7 @@ export let recordHttpTraceFromResponse = (response: AxiosResponse) => {
   if (!draft) return response;
   clearTraceDraft(config, draft);
 
+  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
   let contentType = getContentType(response.headers);
   draft.context.recordHttpTrace({
     startedAt: draft.startedAt,
@@ -711,11 +744,11 @@ export let recordHttpTraceFromResponse = (response: AxiosResponse) => {
     response: {
       status: response.status,
       ...(response.statusText ? { statusText: response.statusText } : {}),
-      ...(sanitizeHeaders(response.headers)
-        ? { headers: sanitizeHeaders(response.headers) }
+      ...(sanitizeHeaders(response.headers, redactor)
+        ? { headers: sanitizeHeaders(response.headers, redactor) }
         : {}),
-      ...(serializeTextBody(response.data, contentType)
-        ? { body: serializeTextBody(response.data, contentType) }
+      ...(serializeTextBody(response.data, contentType, redactor)
+        ? { body: serializeTextBody(response.data, contentType, redactor) }
         : {})
     }
   });
@@ -729,6 +762,7 @@ export let recordHttpTraceFromError = (error: AxiosError) => {
   if (!draft) return;
   clearTraceDraft(config, draft);
 
+  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
   let responseContentType = getContentType(error.response?.headers);
   draft.context.recordHttpTrace({
     startedAt: draft.startedAt,
@@ -739,11 +773,11 @@ export let recordHttpTraceFromError = (error: AxiosError) => {
           response: {
             status: error.response.status,
             ...(error.response.statusText ? { statusText: error.response.statusText } : {}),
-            ...(sanitizeHeaders(error.response.headers)
-              ? { headers: sanitizeHeaders(error.response.headers) }
+            ...(sanitizeHeaders(error.response.headers, redactor)
+              ? { headers: sanitizeHeaders(error.response.headers, redactor) }
               : {}),
-            ...(serializeTextBody(error.response.data, responseContentType)
-              ? { body: serializeTextBody(error.response.data, responseContentType) }
+            ...(serializeTextBody(error.response.data, responseContentType, redactor)
+              ? { body: serializeTextBody(error.response.data, responseContentType, redactor) }
               : {})
           }
         }