harper 5.1.20 → 5.2.0-alpha.5

package/upgrade/directives/5-2-0.ts

@@ -0,0 +1,82 @@
+'use strict';
+
+// 5.2.0 — introduces system.hdb_secret for the encrypted secrets store (#715).
+//
+// Fresh installs get the table automatically via utility/mount_hdb.ts (which iterates
+// json/systemSchema.json on first boot). This directive handles the upgrade path: existing
+// installs that already have a system schema need the new table added explicitly.
+//
+// IMPORTANT: this directive must be versioned to the first release that ships the secrets-store
+// operations depending on the table. Directives only run when
+// current_version < directive_version <= upgrade_version (see
+// directivesController.getVersionsForUpgrade), so tagging it for a later release than the
+// dependent code means it never fires and the table is missing on upgraded installs
+// (see the mis-tagging history documented in 5-1-0.ts).
+
+import { databases } from '../../resources/databases.ts';
+import systemSchema from '../../json/systemSchema.json';
+import * as terms from '../../utility/hdbTerms.ts';
+import * as initPaths from '../../dataLayer/harperBridge/lmdbBridge/lmdbUtility/initializePaths.js';
+import bridge from '../../dataLayer/harperBridge/harperBridge.ts';
+import hdbLogger from '../../utility/logging/harper_logger.ts';
+
+const SECRET_TABLE = terms.SYSTEM_TABLE_NAMES.SECRET_TABLE_NAME;
+
+async function createHdbSecretIfMissing() {
+	if (databases.system?.[SECRET_TABLE]) {
+		hdbLogger.info(`system.${SECRET_TABLE} already exists; skipping create.`);
+		// Still run the catalog patch (see patchHdbSecretIsHashAttribute).
+		await patchHdbSecretIsHashAttribute();
+		return;
+	}
+
+	hdbLogger.info(`Creating system.${SECRET_TABLE} table for the secrets store.`);
+
+	const CreateTableObject =
+		require('../../dataLayer/CreateTableObject').default || require('../../dataLayer/CreateTableObject');
+	const schema = (systemSchema as any)[SECRET_TABLE];
+	if (!schema) {
+		throw new Error(`systemSchema.${SECRET_TABLE} is missing; cannot run 5.2.0 directive.`);
+	}
+
+	initPaths.initSystemSchemaPaths(terms.SYSTEM_SCHEMA_NAME, SECRET_TABLE);
+	const createTable = new (CreateTableObject as any)(terms.SYSTEM_SCHEMA_NAME, SECRET_TABLE, schema.hash_attribute);
+	createTable.attributes = schema.attributes;
+	const primaryKeyAttribute = createTable.attributes.find(({ attribute }) => attribute === schema.hash_attribute);
+	if (primaryKeyAttribute) primaryKeyAttribute.isPrimaryKey = true;
+	createTable.audit = true;
+
+	await bridge.createTable(SECRET_TABLE, createTable);
+	await patchHdbSecretIsHashAttribute();
+}
+
+/**
+ * Ensure the hdb_secret __dbis__ primary-key entry carries is_hash_attribute: true.
+ *
+ * harperdb@4.x reads is_hash_attribute from __dbis__ to derive the LMDB DBI open flags; without
+ * it the DBI is opened with the opposite flags (DUPSORT set) and LMDB throws MDB_INCOMPATIBLE,
+ * breaking downgrade — the exact failure patchHdbDeploymentIsHashAttribute() in 5-1-0.ts guards
+ * hdb_deployment against. Idempotent: no-op when the field is already set.
+ */
+async function patchHdbSecretIsHashAttribute() {
+	const systemTable = (databases as any).system?.[SECRET_TABLE];
+	if (!systemTable?.dbisDB) return;
+
+	const dbiName = `${SECRET_TABLE}/`;
+	const primaryAttr = systemTable.dbisDB.getSync(dbiName);
+	if (!primaryAttr || primaryAttr.is_hash_attribute) return; // already correct
+	primaryAttr.is_hash_attribute = true;
+	await systemTable.dbisDB.put(dbiName, primaryAttr);
+	hdbLogger.info(
+		`Patched system.${SECRET_TABLE} __dbis__ entry with is_hash_attribute=true for harperdb@4.x downgrade compatibility.`
+	);
+}
+
+const directive520 = {
+	version: '5.2.0',
+	description: 'create system.hdb_secret table for the secrets store',
+	sync_functions: [] as Array<() => unknown>,
+	async_functions: [createHdbSecretIfMissing] as Array<() => Promise<unknown>>,
+};
+
+export default [directive520];

package/upgrade/directives/directivesController.ts

@@ -10,13 +10,14 @@ import * as hdbUtils from '../../utility/common_utils.ts';
 import * as hdbTerms from '../../utility/hdbTerms.ts';
 import hdbLog from '../../utility/logging/harper_logger.ts';
 import directive510 from './5-1-0.ts';
+import directive520 from './5-2-0.ts';
 const { DATA_VERSION, UPGRADE_VERSION } = hdbTerms.UPGRADE_JSON_FIELD_NAMES_ENUM as any;
 
 let versions: any = new Map();
 
 // All directive modules export an array of { version, sync_functions, async_functions }.
 // New directives must be imported above and registered here.
-for (const directive of directive510) {
+for (const directive of [...directive510, ...directive520]) {
 	versions.set(directive.version, directive);
 }
 

package/utility/common_utils.ts

@@ -819,7 +819,12 @@ export function convertToMS(interval: any) {
 	if (typeof interval === 'number') seconds = interval;
 	if (typeof interval === 'string') {
 		seconds = parseFloat(interval);
+		// Note the case-sensitive units: `M` is a (30-day) month, `m` is a minute.
 		switch (interval.slice(-1)) {
+			case 'y':
+			case 'Y':
+				seconds *= 86400 * 365;
+				break;
 			case 'M':
 				seconds *= 86400 * 30;
 				break;

package/utility/envFile.ts

@@ -0,0 +1,218 @@
+/**
+ * Pure helpers for inspecting and editing `.env` files behind the operations API.
+ *
+ * The goal is editor-facing, "smoke and mirrors" protection: callers can read key *names* and
+ * edit individual key/values without ever seeing — or accidentally clobbering — the other secret
+ * values in the file. This is deliberately not real security (the runtime can still read
+ * `process.env`); it only stops accidental disclosure through the editor surface.
+ *
+ * The runtime loader (`resources/loadEnv.ts`) reads `.env` files directly with `dotenv.parse()`
+ * and is intentionally NOT routed through here, so it always sees the real values. To keep the
+ * key list we report and the values we write in lockstep with what the runtime loads, this module
+ * is built around the exact behaviour of the same `dotenv` parser:
+ *
+ *   - keys match `[\w.-]+`, optionally prefixed with `export `;
+ *   - an unquoted value runs to the first `#` (inline comment) or newline;
+ *   - single-quoted values are taken literally (only the surrounding quotes are stripped) and may
+ *     span multiple lines;
+ *   - double-quoted values are stripped of their quotes and then have `\n`/`\r` expanded — dotenv
+ *     does NOT un-escape `\"` or `\\`, which constrains how we serialise values below.
+ */
+import { basename } from 'node:path';
+import { parse } from 'dotenv';
+
+/** The placeholder substituted for every value in a masked rendering. */
+export const ENV_VALUE_MASK = '********';
+
+/** dotenv's accepted key character set. Keys written through the API must match this. */
+export const ENV_KEY_REGEX = /^[\w.-]+$/;
+
+// An assignment line: optional indentation + optional `export ` prefix, a key, `=`, then the raw
+// value text. The value may begin a quoted region that continues onto subsequent lines.
+const ASSIGNMENT_LINE = /^(\s*(?:export\s+)?)([\w.-]+)\s*=(.*)$/;
+
+/**
+ * True for `.env` and `.env.<suffix>` (e.g. `.env.local`), matched by basename at any depth.
+ * Case-insensitive: a protection feature should err toward over-matching (e.g. catch `.ENV` on a
+ * case-insensitive filesystem) rather than let a secret slip through on a casing technicality.
+ */
+export function isEnvFile(file: string): boolean {
+	if (!file) return false;
+	const base = basename(file).toLowerCase();
+	return base === '.env' || base.startsWith('.env.');
+}
+
+// Template/example env files conventionally hold placeholders, not real secrets, so they are NOT
+// protected — editors may read and write them verbatim like any other file. Matched by suffix.
+const EXAMPLE_ENV_SUFFIXES = ['.example', '.sample', '.template'];
+
+/** True for non-secret template env files: `.env.example`, `.env.sample`, `.env.template`, … */
+export function isExampleEnvFile(file: string): boolean {
+	if (!isEnvFile(file)) return false;
+	const base = basename(file).toLowerCase();
+	return EXAMPLE_ENV_SUFFIXES.some((suffix) => base.endsWith(suffix));
+}
+
+/** True for `.env*` files whose values should be masked/guarded — i.e. excluding template files. */
+export function isProtectedEnvFile(file: string): boolean {
+	return isEnvFile(file) && !isExampleEnvFile(file);
+}
+
+/** The key names of an env file, in file order, de-duplicated — exactly what the runtime loads. */
+export function parseEnvKeys(text: string): string[] {
+	if (!text) return [];
+	return Object.keys(parse(text));
+}
+
+/** A value-free rendering of an env file: one `KEY=********` line per key. */
+export function renderMaskedEnv(keys: string[]): string {
+	if (!keys || keys.length === 0) return '';
+	return keys.map((key) => `${key}=${ENV_VALUE_MASK}`).join('\n') + '\n';
+}
+
+// Marker prefix for a value encrypted with the cluster env-secrets public key. The bytes after the
+// prefix are an opaque envelope (see docs/env-secret-encryption.md) that only the Pro env-secrets
+// component can decrypt; core just recognises the prefix and delegates to a registered decryptor.
+export const ENV_ENCRYPTED_PREFIX = 'enc:v1:';
+
+/** True if a parsed env value is an `enc:v1:` ciphertext envelope rather than a plaintext value. */
+export function isEncryptedEnvValue(value: unknown): boolean {
+	return typeof value === 'string' && value.startsWith(ENV_ENCRYPTED_PREFIX);
+}
+
+/**
+ * Serialise a value so that `dotenv.parse` recovers it verbatim.
+ *
+ * dotenv only *expands* escapes inside double quotes (`\n`, `\r`) and never un-escapes `\"`/`\\`,
+ * so single quotes — which it treats literally — are the most faithful container:
+ *   - no special chars                 -> bare;
+ *   - no single quote                  -> single-quoted (handles spaces, `#`, `"`, `\`, newlines);
+ *   - single quote but no `"`/`\`/`\r` -> double-quoted with newlines encoded as `\n`;
+ *   - both quote styles                -> unrepresentable; throws.
+ */
+export function formatEnvValue(value: string): string {
+	if (value === '') return '';
+	// Bare is safe only without whitespace, `#` (would begin an inline comment), or any quote
+	// character. Backslash and `=` stay literal in unquoted values, so they don't force quoting.
+	if (!/[\s#'"`]/.test(value)) return value;
+	if (!value.includes("'")) return `'${value}'`;
+	if (!value.includes('"') && !value.includes('\\') && !value.includes('\r')) {
+		return `"${value.replace(/\n/g, '\\n')}"`;
+	}
+	throw new Error('Environment value contains an unsupported combination of quote characters');
+}
+
+// Does `s` contain an unescaped `quote`? A backslash escapes the following character, but only for
+// double-quoted values — dotenv treats single-quoted and backtick-quoted values literally, so a
+// value ending in `\` (e.g. a Windows path `'C:\Users\name\'`) still closes at that quote.
+function closesQuote(s: string, quote: string): boolean {
+	const backslashEscapes = quote !== "'" && quote !== '`';
+	for (let i = 0; i < s.length; i++) {
+		if (backslashEscapes && s[i] === '\\') {
+			i++;
+			continue;
+		}
+		if (s[i] === quote) return true;
+	}
+	return false;
+}
+
+// Index of the last line occupied by the value that starts at `lines[startIdx]`. Unquoted values
+// are single-line; quoted values extend until their matching quote closes.
+function valueEndLine(lines: string[], startIdx: number, rawValue: string): number {
+	const trimmed = rawValue.replace(/^\s+/, '');
+	const quote = trimmed[0];
+	if (quote !== '"' && quote !== "'" && quote !== '`') return startIdx;
+	if (closesQuote(trimmed.slice(1), quote)) return startIdx;
+	for (let j = startIdx + 1; j < lines.length; j++) {
+		if (closesQuote(lines[j], quote)) return j;
+	}
+	return lines.length - 1; // unterminated — treat the remainder of the file as the value
+}
+
+function toMap(updates: Record<string, string> | Map<string, string>): Map<string, string> {
+	return updates instanceof Map ? new Map(updates) : new Map(Object.entries(updates));
+}
+
+interface ScanState {
+	eol: string;
+	endedWithNewline: boolean;
+	lines: string[];
+}
+
+function beginScan(text: string): ScanState {
+	const eol = text.includes('\r\n') ? '\r\n' : '\n';
+	const endedWithNewline = /\r?\n$/.test(text);
+	const lines = text.length ? text.split(/\r?\n/) : [];
+	if (endedWithNewline) lines.pop(); // drop the empty element the trailing newline produces
+	return { eol, endedWithNewline, lines };
+}
+
+/**
+ * Insert or update the given keys, leaving every other line — comments, blank lines, untouched
+ * keys, and their formatting — exactly as it was. Existing keys are replaced in place (a duplicate
+ * later assignment of an updated key is dropped so the new value wins, as dotenv keeps the last);
+ * new keys are appended. The file is created from empty text transparently.
+ */
+export function upsertEnvValues(text: string, updates: Record<string, string> | Map<string, string>): string {
+	const pending = toMap(updates);
+	const applied = new Set<string>();
+	const { eol, endedWithNewline, lines } = beginScan(text);
+
+	const out: string[] = [];
+	for (let i = 0; i < lines.length; i++) {
+		const match = ASSIGNMENT_LINE.exec(lines[i]);
+		if (match) {
+			const [, prefix, key] = match;
+			const end = valueEndLine(lines, i, match[3]);
+			if (pending.has(key)) {
+				if (!applied.has(key)) {
+					out.push(`${prefix}${key}=${formatEnvValue(pending.get(key)!)}`);
+					applied.add(key);
+				}
+				// otherwise drop the duplicate assignment of an already-updated key
+			} else {
+				for (let j = i; j <= end; j++) out.push(lines[j]);
+			}
+			i = end;
+			continue;
+		}
+		out.push(lines[i]);
+	}
+
+	let appended = false;
+	for (const [key, value] of pending) {
+		if (applied.has(key)) continue;
+		out.push(`${key}=${formatEnvValue(value)}`);
+		appended = true;
+	}
+
+	let result = out.join(eol);
+	if (result.length > 0 && (endedWithNewline || appended)) result += eol;
+	return result;
+}
+
+/** Remove the given keys (and any continuation lines of multi-line values), leaving the rest. */
+export function removeEnvKeys(text: string, keys: string | string[]): string {
+	const removeSet = new Set(Array.isArray(keys) ? keys : [keys]);
+	if (removeSet.size === 0 || !text) return text;
+	const { eol, endedWithNewline, lines } = beginScan(text);
+
+	const out: string[] = [];
+	for (let i = 0; i < lines.length; i++) {
+		const match = ASSIGNMENT_LINE.exec(lines[i]);
+		if (match) {
+			const end = valueEndLine(lines, i, match[3]);
+			if (!removeSet.has(match[2])) {
+				for (let j = i; j <= end; j++) out.push(lines[j]);
+			}
+			i = end;
+			continue;
+		}
+		out.push(lines[i]);
+	}
+
+	let result = out.join(eol);
+	if (result.length > 0 && endedWithNewline) result += eol;
+	return result;
+}

package/utility/hdbTerms.ts

@@ -179,6 +179,7 @@ export const SYSTEM_TABLE_NAMES = {
 	INFO_TABLE_NAME: 'hdb_info',
 	DEPLOYMENT_TABLE_NAME: 'hdb_deployment',
 	AGENT_SESSION_TABLE_NAME: 'hdb_agent_session',
+	SECRET_TABLE_NAME: 'hdb_secret',
 } as const;
 
 /** Hash attribute for the system info table */
@@ -278,6 +279,9 @@ export const OPERATIONS_ENUM = {
 	GET_COMPONENTS: 'get_components',
 	GET_COMPONENT_FILE: 'get_component_file',
 	SET_COMPONENT_FILE: 'set_component_file',
+	GET_ENV_KEYS: 'get_env_keys',
+	SET_ENV_VALUE: 'set_env_value',
+	DELETE_ENV_VALUE: 'delete_env_value',
 	DROP_COMPONENT: 'drop_component',
 	DROP_CUSTOM_FUNCTION: 'drop_custom_function',
 	ADD_CUSTOM_FUNCTION_PROJECT: 'add_custom_function_project',
@@ -301,6 +305,12 @@ export const OPERATIONS_ENUM = {
 	CLEAR_STATUS: 'clear_status',
 	LIST_DEPLOYMENTS: 'list_deployments',
 	GET_DEPLOYMENT: 'get_deployment',
+	SET_SECRET: 'set_secret',
+	GRANT_SECRET: 'grant_secret',
+	REVOKE_SECRET: 'revoke_secret',
+	LIST_SECRETS: 'list_secrets',
+	DELETE_SECRET: 'delete_secret',
+	GET_SECRETS_PUBLIC_KEY: 'get_secrets_public_key',
 	GET_DEPLOYMENT_PAYLOAD: 'get_deployment_payload',
 	DELETE_DEPLOYMENT_PAYLOAD: 'delete_deployment_payload',
 	AGENT_PROMPT: 'agent_prompt',
@@ -550,6 +560,11 @@ export const CONFIG_PARAMS = {
 	MCP_OPERATIONS_RATELIMIT_PERTOOLBURST: 'mcp_operations_rateLimit_perToolBurst',
 	MCP_OPERATIONS_RATELIMIT_SESSIONCONCURRENCY: 'mcp_operations_rateLimit_sessionConcurrency',
 	MCP_OPERATIONS_RATELIMIT_SESSIONPERSECOND: 'mcp_operations_rateLimit_sessionPerSecond',
+	MCP_OPERATIONS_RATELIMIT_PERCLIENTPERSECOND: 'mcp_operations_rateLimit_perClientPerSecond',
+	MCP_OPERATIONS_RATELIMIT_PERCLIENTBURST: 'mcp_operations_rateLimit_perClientBurst',
+	MCP_OPERATIONS_RATELIMIT_IDENTITYHEADER: 'mcp_operations_rateLimit_identityHeader',
+	MCP_OPERATIONS_QUOTA_RESOURCE: 'mcp_operations_quota_resource',
+	MCP_OPERATIONS_QUOTA_METHOD: 'mcp_operations_quota_method',
 	MCP_APPLICATION_MOUNTPATH: 'mcp_application_mountPath',
 	MCP_APPLICATION_ALLOW: 'mcp_application_allow',
 	MCP_APPLICATION_DENY: 'mcp_application_deny',
@@ -559,6 +574,11 @@ export const CONFIG_PARAMS = {
 	MCP_APPLICATION_RATELIMIT_PERTOOLBURST: 'mcp_application_rateLimit_perToolBurst',
 	MCP_APPLICATION_RATELIMIT_SESSIONCONCURRENCY: 'mcp_application_rateLimit_sessionConcurrency',
 	MCP_APPLICATION_RATELIMIT_SESSIONPERSECOND: 'mcp_application_rateLimit_sessionPerSecond',
+	MCP_APPLICATION_RATELIMIT_PERCLIENTPERSECOND: 'mcp_application_rateLimit_perClientPerSecond',
+	MCP_APPLICATION_RATELIMIT_PERCLIENTBURST: 'mcp_application_rateLimit_perClientBurst',
+	MCP_APPLICATION_RATELIMIT_IDENTITYHEADER: 'mcp_application_rateLimit_identityHeader',
+	MCP_APPLICATION_QUOTA_RESOURCE: 'mcp_application_quota_resource',
+	MCP_APPLICATION_QUOTA_METHOD: 'mcp_application_quota_method',
 	MCP_SESSION_IDLETIMEOUTSECONDS: 'mcp_session_idleTimeoutSeconds',
 	MCP_SESSION_ALLOWCLIENTDELETE: 'mcp_session_allowClientDelete',
 	AGENT_ENABLED: 'agent_enabled',
@@ -866,9 +886,20 @@ export const ITC_EVENT_TYPES = {
 	COMPONENT_STATUS_RESPONSE: 'component_status_response',
 	RESOURCE_OPENAPI_REQUEST: 'resource_openapi_request',
 	RESOURCE_OPENAPI_RESPONSE: 'resource_openapi_response',
+	// Main thread asks an HTTP worker for its resolved middleware chains (#1573); app HTTP
+	// middleware is only registered on worker threads, so get_status must fetch it from one.
+	MIDDLEWARE_CHAINS_REQUEST: 'middleware_chains_request',
+	MIDDLEWARE_CHAINS_RESPONSE: 'middleware_chains_response',
 	// MCP §3.7: route a client's response to a server→client request back to the
 	// worker awaiting it (the response POST can land on any worker).
 	MCP_CLIENT_RESPONSE: 'mcp_client_response',
+	// #1736: components load per-worker, so a `server.registerOperation()` made there lands in
+	// a worker-local OPERATION_FUNCTION_MAP the main-thread ops-API dispatcher can't see. A
+	// worker announces each registration (OPERATION_REGISTERED) so the main thread can forward
+	// an unrecognized operation to one registering worker for execution (REQUEST/RESPONSE).
+	OPERATION_REGISTERED: 'operation_registered',
+	OPERATION_EXECUTE_REQUEST: 'operation_execute_request',
+	OPERATION_EXECUTE_RESPONSE: 'operation_execute_response',
 } as const;
 
 /** Supported thread types */

package/utility/logging/harper_logger.ts

@@ -12,6 +12,9 @@ import * as os from 'os';
 import { PACKAGE_ROOT } from '../../utility/packageUtils.js';
 import { _assignPackageExport } from '../../globals.js';
 import { Console } from 'console';
+import { inspect, types } from 'node:util';
+
+const { isNativeError } = types;
 // store the native write function so we can call it after we write to the log file (and store it on process.stdout
 // because unit tests will create multiple instances of this module)
 let nativeStdWrite = process.env.IS_SCRIPTED_SERVICE
@@ -180,6 +183,43 @@ async function updateLogSettings() {
 	}
 }
 
+/**
+ * True when the argument is an Error (same-realm or native cross-realm). The try/catch guards
+ * exotic objects whose prototype is unreachable (e.g. a revoked Proxy, where `instanceof`
+ * throws) — the logger must never throw on any input, and util.format renders those fine raw.
+ */
+function isErrorLike(arg: any): boolean {
+	try {
+		return arg instanceof Error || isNativeError(arg);
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Replaces every Error argument with its log-safe errorForLog wrapper before the args reach
+ * Console's util.inspect formatting, which would otherwise dump the error's own-enumerable
+ * properties — where libraries and app code stash credentials (axios config headers, an
+ * hdb_secret for an outbound Authorization header) — into hdb.log (see #1734 and errorForLog).
+ * Called inside each level gate so filtered-out log calls pay nothing beyond the arg scan,
+ * and only allocates when an Error is actually present. Deliberately shallow: an Error nested
+ * inside a logged object/array is not rewritten (deep-walking every logged structure is not
+ * worth the per-call cost, and the #1734 threat is raw thrown errors).
+ */
+function sanitizeErrorArgs(args: any[]) {
+	for (let i = 0; i < args.length; i++) {
+		if (isErrorLike(args[i])) {
+			const sanitized = args.slice(0, i);
+			for (let j = i; j < args.length; j++) {
+				const arg = args[j];
+				sanitized[j] = isErrorLike(arg) ? errorForLog(arg) : arg;
+			}
+			return sanitized;
+		}
+	}
+	return args;
+}
+
 class HarperLogger extends Console {
 	[key: string]: any;
 	constructor(streams, level) {
@@ -193,35 +233,35 @@ class HarperLogger extends Console {
 	trace(...args) {
 		currentLevel = 'trace';
 		if (this.level <= LOG_LEVEL_HIERARCHY.trace) {
-			super.info(...args);
+			super.info(...sanitizeErrorArgs(args));
 		}
 		currentLevel = 'info';
 	}
 	debug(...args) {
 		currentLevel = 'debug';
 		if (this.level <= LOG_LEVEL_HIERARCHY.debug) {
-			super.info(...args);
+			super.info(...sanitizeErrorArgs(args));
 		}
 		currentLevel = 'info';
 	}
 	info(...args) {
 		currentLevel = 'info';
 		if (this.level <= LOG_LEVEL_HIERARCHY.info) {
-			super.info(...args);
+			super.info(...sanitizeErrorArgs(args));
 		}
 		currentLevel = 'info';
 	}
 	warn(...args) {
 		currentLevel = 'warn';
 		if (this.level <= LOG_LEVEL_HIERARCHY.warn) {
-			super.warn(...args);
+			super.warn(...sanitizeErrorArgs(args));
 		}
 		currentLevel = 'info';
 	}
 	error(...args) {
 		currentLevel = 'error';
 		if (this.level <= LOG_LEVEL_HIERARCHY.error) {
-			super.error(...args);
+			super.error(...sanitizeErrorArgs(args));
 		}
 		currentLevel = 'info';
 	}
@@ -230,7 +270,7 @@ class HarperLogger extends Console {
 		try {
 			currentLevel = 'fatal';
 			if (this.level <= LOG_LEVEL_HIERARCHY.fatal) {
-				super.error(...args);
+				super.error(...sanitizeErrorArgs(args));
 			}
 			currentLevel = 'info';
 		} finally {
@@ -242,13 +282,25 @@ class HarperLogger extends Console {
 		try {
 			currentLevel = 'notify';
 			if (this.level <= LOG_LEVEL_HIERARCHY.notify) {
-				super.info(...args);
+				super.info(...sanitizeErrorArgs(args));
 			}
 			currentLevel = 'info';
 		} finally {
 			logImmediately = false;
 		}
 	}
+	// Inherited Console methods that format arbitrary values would bypass sanitizeErrorArgs —
+	// guard them too so logger.log(error) / dir / table can't leak either (#1734). Their
+	// existing semantics (no level gate) are preserved; only the Error args are wrapped.
+	log(...args) {
+		super.log(...sanitizeErrorArgs(args));
+	}
+	dir(item, options?) {
+		super.dir(isErrorLike(item) ? errorForLog(item) : item, options);
+	}
+	table(data, columns?) {
+		super.table(Array.isArray(data) ? sanitizeErrorArgs(data) : isErrorLike(data) ? errorForLog(data) : data, columns);
+	}
 	withTag(tag) {
 		return loggerWithTag(tag, true, this);
 	}
@@ -291,6 +343,7 @@ module.exports = {
 	start: updateLogSettings,
 	startOnMainThread: updateLogSettings,
 	errorToString,
+	errorForLog,
 	disableStdio,
 	externalLogger,
 };
@@ -892,7 +945,101 @@ function getDefaultConfig() {
  * @return {string|string}
  */
 export function errorToString(error: any) {
-	return typeof error.message === 'string' ? `${error.constructor.name}: ${error.message}` : error.toString();
+	if (error == null) return String(error);
+	try {
+		return typeof error.message === 'string' ? `${error.constructor.name}: ${error.message}` : error.toString();
+	} catch {
+		// error is hostile (e.g. a revoked Proxy, or a getter that throws) - this must never throw,
+		// since it's called directly for response bodies (REST.ts/http.ts/JSONStream) as well as here.
+		try {
+			return Object.prototype.toString.call(error);
+		} catch {
+			return '[Unrenderable Object]';
+		}
+	}
+}
+
+// Own-enumerable Error properties considered safe to surface in logs — common diagnostic fields
+// (HTTP status, Node error codes) that libraries and app code don't use to carry secrets, unlike
+// arbitrary properties (axios' `config`/`request` with an Authorization header), which stay
+// excluded. `path` is deliberately omitted: it can reveal internal filesystem layout, and the
+// message/stack already names the failing operation.
+const LOGGABLE_ERROR_PROPS = ['code', 'status', 'statusCode', 'errno', 'syscall'];
+
+function loggablePropsSuffix(error: any): string {
+	if (typeof error !== 'object' || error === null) return '';
+	let suffix = '';
+	for (const key of LOGGABLE_ERROR_PROPS) {
+		try {
+			const value = error[key];
+			if (value !== undefined) suffix += ` ${key}=${value}`;
+		} catch {
+			// A hostile property (revoked Proxy, throwing getter) must not crash the logger - skip it.
+		}
+	}
+	return suffix;
+}
+
+function renderErrorLine(error: any): string {
+	try {
+		const base = typeof error?.stack === 'string' ? error.stack : errorToString(error);
+		return base + loggablePropsSuffix(error);
+	} catch (err) {
+		// error?.stack itself can throw on a hostile object even though errorToString cannot.
+		return `[Unrenderable Error: ${err instanceof Error ? err.message : String(err)}]`;
+	}
+}
+
+/**
+ * Renders an error to its stack (class name + message + frames) plus a small allowlist of
+ * diagnostic properties (see `LOGGABLE_ERROR_PROPS`), then appends the same for each error in its
+ * `cause` chain. Deliberately excludes every OTHER own-enumerable property — those are exactly
+ * what leaks secrets in #1734 (see `errorForLog`).
+ *
+ * The `cause` chain is not under this module's control (any code that threw the outer error could
+ * have attached a hostile `cause` - a revoked Proxy, an object with a throwing getter), so every
+ * step of the walk is defensive: this function must never throw regardless of what it's given.
+ */
+function errorToLogString(error: any) {
+	if (error == null) return String(error);
+	let output = renderErrorLine(error);
+	const seen = new Set([error]);
+	let cause: any;
+	try {
+		cause = error.cause;
+	} catch {
+		return output;
+	}
+	while (cause != null && !seen.has(cause)) {
+		seen.add(cause);
+		output += `\ncaused by: ${renderErrorLine(cause)}`;
+		try {
+			cause = cause.cause;
+		} catch {
+			break;
+		}
+	}
+	return output;
+}
+
+/**
+ * Returns a log-safe representation of an error for passing to the logger. It renders the stack
+ * (class name + message + frames) plus any `cause` chain, but NOT the error's own-enumerable
+ * properties.
+ *
+ * This deliberately avoids logging the raw Error object: Node's Console formats a logged Error with
+ * util.inspect, which dumps every own-enumerable property. Anything an app or an HTTP client library
+ * stashes on a thrown Error — a credential used for an outbound Authorization header, an axios
+ * `config`/`request` with headers — would otherwise land verbatim in hdb.log (see #1734). Those
+ * custom properties are not part of the stack, so this preserves debuggability without leaking them.
+ *
+ * A wrapper carrying the rendering on `util.inspect.custom` is returned rather than a pre-built
+ * string so the (potentially expensive) stack materialization only happens if the logger's level
+ * gate actually writes the entry — passing a raw string would force it eagerly on the discarded path.
+ */
+export function errorForLog(error: any) {
+	const render = () => errorToLogString(error);
+	return { [inspect.custom]: render, toString: render };
 }
 
 export function setMainLogger(logger: any) {
@@ -953,4 +1100,5 @@ export default {
 	externalLogger,
 	AuthAuditLog,
 	errorToString,
+	errorForLog,
 };