aegis-bridge 2.3.3 → 2.3.4

package/dist/channels/webhook.js

@@ -6,6 +6,7 @@
  */
 import { webhookEndpointSchema, getErrorMessage } from '../validation.js';
 import { validateWebhookUrl } from '../ssrf.js';
+import { redactSecretsFromText } from '../utils/redact-headers.js';
 export class WebhookChannel {
     name = 'webhook';
     endpoints;
@@ -124,7 +125,7 @@ export class WebhookChannel {
                 }
             }
             catch (e) {
-                lastError = getErrorMessage(e);
+                lastError = redactSecretsFromText(getErrorMessage(e), ep.headers);
                 if (attempt < maxRetries) {
                     const delay = WebhookChannel.backoff(attempt);
                     console.warn(`Webhook ${ep.url} error for ${event} (attempt ${attempt}/${maxRetries}): ${lastError}, retrying in ${Math.round(delay)}ms`);

package/dist/utils/redact-headers.d.ts

@@ -0,0 +1,13 @@
+/**
+ * redact-headers.ts — Redact sensitive header values for safe logging.
+ *
+ * Issue #582: Prevent webhook custom headers (Authorization, Cookie, etc.)
+ * from leaking into error logs on delivery failures.
+ */
+/** Return a copy of `headers` with sensitive values replaced. */
+export declare function redactHeaders(headers: Record<string, string>): Record<string, string>;
+/**
+ * Scrub any sensitive header *values* from arbitrary text.
+ * If a fetch error message happens to include a header value, this removes it.
+ */
+export declare function redactSecretsFromText(text: string, headers: Record<string, string> | undefined): string;

package/dist/utils/redact-headers.js

@@ -0,0 +1,55 @@
+/**
+ * redact-headers.ts — Redact sensitive header values for safe logging.
+ *
+ * Issue #582: Prevent webhook custom headers (Authorization, Cookie, etc.)
+ * from leaking into error logs on delivery failures.
+ */
+/** Header names whose values should be treated as secrets. Case-insensitive. */
+const SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'x-auth-token',
+    'api-key',
+    'apikey',
+    'proxy-authorization',
+    'x-csrf-token',
+    'www-authenticate',
+    'proxy-authenticate',
+]);
+function isSensitive(headerName) {
+    return SENSITIVE_HEADER_NAMES.has(headerName.toLowerCase());
+}
+function redactValue(value) {
+    if (value.length <= 8)
+        return '[REDACTED]';
+    return `${value.slice(0, 4)}...[REDACTED]`;
+}
+/** Return a copy of `headers` with sensitive values replaced. */
+export function redactHeaders(headers) {
+    const result = {};
+    for (const [name, value] of Object.entries(headers)) {
+        result[name] = isSensitive(name) ? redactValue(value) : value;
+    }
+    return result;
+}
+/**
+ * Scrub any sensitive header *values* from arbitrary text.
+ * If a fetch error message happens to include a header value, this removes it.
+ */
+export function redactSecretsFromText(text, headers) {
+    if (!headers)
+        return text;
+    let result = text;
+    for (const [name, value] of Object.entries(headers)) {
+        if (!isSensitive(name) || !value)
+            continue;
+        // Skip very short values — too many false positives
+        if (value.length < 4)
+            continue;
+        result = result.replaceAll(value, '[REDACTED]');
+    }
+    return result;
+}
+//# sourceMappingURL=redact-headers.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aegis-bridge",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "type": "module",
   "description": "Orchestrate Claude Code sessions via API. Create, brief, monitor, refine, ship.",
   "main": "dist/server.js",