snulbug 0.2.5__tar.gz → 0.2.6__tar.gz

{snulbug-0.2.5 → snulbug-0.2.6}/CHANGELOG.md

@@ -6,6 +6,21 @@ The format is based on Keep a Changelog, and this project follows semantic versi
 
 ## [Unreleased]
 
+## [0.2.6] - 2026-10-24
+
+Trusted internal lease selection and gateway credential-boundary hardening.
+
+- Add trusted, request-local Python/ASGI lease-ID selection for embedding gateways, reusing identity bindings, expiry/revocation checks, policy previews, and atomic call budgets. Reject conflicting selections without recovering or injecting lease credentials.
+- Consume lease credential headers at the upstream boundary, including custom header names, facade transport plugins, and streamed HTTP requests. Include configured custom lease-header names in replay/audit redaction.
+- Validate supplied selections on facade discovery without consuming calls, and reject lease denials on bodyless HTTP stream opens before forwarding.
+- Require certifi 2026.10.19 or later and update the lockfile to remove compromised emSign CA trust roots ([GHSA-6q48-6c7w-9gw2](https://github.com/advisories/GHSA-6q48-6c7w-9gw2)).
+
+Upgrade note: public clients continue to send their existing lease headers, but
+upstream applications no longer receive them. Keep lease enforcement at the
+gateway; embedding hosts must independently authorize any internally selected
+lease reference. No change to renewal/expiry configuration or MCP protocol defaults.
+See the [trusted selection integration guide](docs/mcp-proxy.md#trusted-internal-lease-selection).
+
 ## [0.2.5] - 2026-10-23
 
 Public-origin preservation for shared MCP and HTTP gateways.

{snulbug-0.2.5 → snulbug-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: snulbug
-Version: 0.2.5
+Version: 0.2.6
 Summary: A local-dev MCP policy proxy with Lua policies, replay logs, and learned least-privilege bundles
 Project-URL: Homepage, https://github.com/nahuaque/snulbug
 Project-URL: Repository, https://github.com/nahuaque/snulbug
@@ -23,6 +23,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: httpx<1,>=0.28
 Requires-Dist: jsonschema<5,>=4.23
 Requires-Dist: lupa>=2.5

{snulbug-0.2.5 → snulbug-0.2.6}/docs/devcontainers.md

@@ -10,8 +10,8 @@ servers with a shared control plane.
 ```json
 {
   "features": {
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.5": {
-      "version": "0.2.5",
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.6": {
+      "version": "0.2.6",
       "mode": "member-agent",
       "policy_profile": "tunnel-safe",
       "registry": "redis://redis:6379/0",

{snulbug-0.2.5 → snulbug-0.2.6}/docs/mcp-proxy.md

@@ -996,6 +996,13 @@ Send the returned `x-snulbug-lease` header with MCP requests. The proxy hot-load
 the JSON file on each call, so new leases and revocations do not require a proxy
 restart.
 
+The lease credential terminates at snulbug. The default and configured lease
+headers are stripped before upstream HTTP forwarding, including streaming and
+facade transports; upstream applications do not receive the client's lease token.
+An embedding gateway can instead select an exact lease reference through the
+[trusted Python/ASGI selection API](#trusted-internal-lease-selection), without
+recovering a credential or injecting a synthetic header.
+
 Create an invite when you want snulbug to package the share URL, bearer header,
 lease header, and downstream client snippets together:
 
@@ -1644,3 +1651,66 @@ application = create_proxy_application(
 
 You can run that ASGI app with Uvicorn, Hypercorn, Daphne, or another ASGI
 server.
+
+### Trusted Internal Lease Selection
+
+A hosting gateway that already authenticates a caller and authorizes a task can
+pass its exact lease ID in request-local ASGI context. Configure the existing
+lease store and policy normally:
+
+```python
+from snulbug import create_proxy_application, select_mcp_lease
+
+proxy = create_proxy_application(
+    "http://127.0.0.1:9000",
+    "policy.snulbug/policy.lua",
+    lease_file="leases.json",
+    lease_required=True,
+)
+
+
+def with_task_selection(proxy, resolve_authorized_lease):
+    async def application(scope, receive, send):
+        if scope["type"] == "http":
+            # The host authenticates the caller and authorizes this exact task.
+            lease_id = await resolve_authorized_lease(scope)
+            if lease_id is not None:
+                scope = select_mcp_lease(scope, lease_id=lease_id)
+        await proxy(scope, receive, send)
+
+    return application
+```
+
+`resolve_authorized_lease` belongs to the hosting application. It must return only
+an authorized reference, not an arbitrary caller-selected ID. Public headers,
+query parameters, request bodies, Lua context, and replay logs never populate
+trusted selection automatically. Do not copy any of them into this context
+without independent authentication and authorization. This is an in-process
+integration boundary, not protection against malicious Python code in the host.
+
+`select_mcp_lease(scope, lease_id=...)` returns a shallow scope copy containing a
+frozen `TrustedLeaseSelection` at `TRUSTED_LEASE_SCOPE_KEY`. A trusted ASGI
+integration can also set that typed value directly; strings and JSON mappings at
+the key fail closed. Selecting a different ID on an already selected scope raises
+`ValueError`. No global or session selection is retained.
+
+Selection is **not approval**. Snulbug resolves the exact ID from its configured
+store and runs the same identity bindings, expiry, revocation, tool/argument
+restrictions, and call-budget checks as header-based requests. Existing OAuth and
+Lua checks remain in force. Discovery and Lua/catalog previews do not consume
+calls; final `tools/call` admission consumes once under the existing store lock.
+No new lease, credential recovery, renewal, or TTL extension is performed.
+
+If a lease header is also supplied, it must validate to the selected lease.
+Different or invalid credentials and duplicate headers are rejected, even when
+leases are optional. An unknown ID never falls back to another available lease.
+Denials use `lease.selection_conflict`, `lease.selection_invalid`, or the existing
+lease reason codes. Lease audit metadata identifies `selection = "trusted"` or
+`"header"` and retains the lease/task/invite references without a plaintext token.
+
+The original scope headers remain available inside snulbug for preview and audit
+redaction, including configured custom lease-header names, but are filtered at
+the outbound boundary. Facade transport plugins
+receive a scope without the lease credential headers or trusted selection object.
+Business task selection and grant/revision permissions remain the host's concern;
+snulbug continues to own lease enforcement and accounting.

{snulbug-0.2.5 → snulbug-0.2.6}/docs/release.md

@@ -59,7 +59,7 @@ python -m zipfile -l dist/snulbug-*.whl
 8. Install from TestPyPI in a clean environment and smoke test:
 
 ```bash
-uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ snulbug==0.2.5 --help
+uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ snulbug==0.2.6 --help
 ```
 
 9. Run the manual `Publish` workflow with `repository = pypi` when the TestPyPI
@@ -67,4 +67,4 @@ uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org
 10. Create the GitHub release and tag after the PyPI package is available.
 
 The `Publish` workflow uses `workflow_dispatch`, not a tag trigger. Creating or
-pushing `v0.2.5` does not publish a package or automatically create a GitHub release.
+pushing `v0.2.6` does not publish a package or automatically create a GitHub release.

{snulbug-0.2.5 → snulbug-0.2.6}/examples/codespace_local_gateway/.devcontainer/devcontainer.json

@@ -2,7 +2,7 @@
   "name": "snulbug Codespace MCP member",
   "features": {
     "ghcr.io/devcontainers/features/python:1": {},
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.5": {
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.6": {
       "install_source": "github",
       "github_ref": "main",
       "mode": "member-agent",

{snulbug-0.2.5 → snulbug-0.2.6}/features/snulbug/README.md

@@ -6,7 +6,7 @@ workspace helpers for Codespaces/devcontainers.
 ```json
 {
   "features": {
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.5": {
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.6": {
       "install_source": "github",
       "github_ref": "main",
       "mode": "member-agent",

{snulbug-0.2.5 → snulbug-0.2.6}/features/snulbug/devcontainer-feature.json

@@ -1,6 +1,6 @@
 {
   "id": "snulbug",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "name": "snulbug",
   "description": "Install snulbug and optional helpers for MCP policy gateways and remote fabric members in devcontainers.",
   "documentationURL": "https://github.com/nahuaque/snulbug/blob/main/docs/devcontainers.md",

{snulbug-0.2.5 → snulbug-0.2.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "snulbug"
-version = "0.2.5"
+version = "0.2.6"
 description = "A local-dev MCP policy proxy with Lua policies, replay logs, and learned least-privilege bundles"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -35,6 +35,7 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
+    "certifi>=2026.10.19",
     "httpx>=0.28,<1",
     "jsonschema>=4.23,<5",
     "lupa>=2.5",

{snulbug-0.2.5 → snulbug-0.2.6}/snulbug/__init__.py

@@ -1,6 +1,6 @@
 """Local-dev MCP policy proxy and programmable Lua ASGI policy layer."""
 
-__version__ = "0.2.5"
+__version__ = "0.2.6"
 
 from .auth_providers import (
     AuthProvider,
@@ -201,13 +201,16 @@ from .inspection import format_mcp_inspection_report, inspect_mcp_log
 from .lab import format_mcp_auth_lab_report, run_mcp_auth_lab, run_mcp_lab
 from .learn import amend_mcp_policy, learn_mcp_policy
 from .leases import (
+    TRUSTED_LEASE_SCOPE_KEY,
     LeasePolicyConfig,
+    TrustedLeaseSelection,
     cleanup_inactive_leases,
     create_lease,
     list_leases,
     reactivate_lease,
     renew_lease,
     revoke_lease,
+    select_mcp_lease,
 )
 from .manifests import load_manifest, manifest_digest, sign_upstream_manifest, verify_upstream_manifest, write_manifest
 from .mcp_auth import (
@@ -500,6 +503,8 @@ __all__ = [
     "LuaMiddleware",
     "LuaRuntimeError",
     "LeasePolicyConfig",
+    "TrustedLeaseSelection",
+    "TRUSTED_LEASE_SCOPE_KEY",
     "LIFECYCLE_STATES",
     "MemoryFabricRuntimeStateStore",
     "MemoryStateStore",
@@ -764,6 +769,7 @@ __all__ = [
     "render_gateway_toml",
     "replay_record_log",
     "revoke_lease",
+    "select_mcp_lease",
     "revoke_mcp_share_invite",
     "revoke_mcp_share_lease",
     "run_mcp_auth_lab",

{snulbug-0.2.5 → snulbug-0.2.6}/snulbug/leases.py

@@ -24,6 +24,7 @@ LEASE_HEADER = "x-snulbug-lease"
 LEASE_TOKEN_PREFIX = "sbl_"
 LEASE_RENEWAL_METHOD = "snulbug/lease/renew"
 LEASE_RENEWAL_HEADER = "x-snulbug-renewal"
+TRUSTED_LEASE_SCOPE_KEY = "snulbug.trusted_lease"
 _STORE_LOCK = threading.RLock()
 
 
@@ -91,6 +92,35 @@ class LeasePolicyConfig:
     header: str = LEASE_HEADER
 
 
+@dataclass(frozen=True)
+class TrustedLeaseSelection:
+    """An exact lease reference selected by trusted, in-process gateway code."""
+
+    lease_id: str
+
+    def __post_init__(self) -> None:
+        if (
+            not isinstance(self.lease_id, str)
+            or not self.lease_id
+            or len(self.lease_id) > 256
+            or any(character.isspace() or ord(character) < 32 or ord(character) == 127 for character in self.lease_id)
+        ):
+            raise ValueError("lease_id must be a non-empty, bounded lease reference without whitespace")
+
+
+def select_mcp_lease(scope: Scope, *, lease_id: str) -> Scope:
+    """Copy a request scope with a trusted selection; does not authorize or consume it.
+
+    Call only after the hosting gateway authorizes the selection. Never populate
+    this context from an unvalidated public header, query parameter, or body.
+    """
+
+    selection = TrustedLeaseSelection(lease_id)
+    if TRUSTED_LEASE_SCOPE_KEY in scope and scope[TRUSTED_LEASE_SCOPE_KEY] != selection:
+        raise ValueError("request already has a different or invalid trusted lease selection")
+    return {**scope, TRUSTED_LEASE_SCOPE_KEY: selection}
+
+
 @_lease_transaction
 def create_lease(
     path: str | Path,
@@ -411,38 +441,16 @@ def preview_mcp_lease_catalog(
     if config.lease_file is None:
         return metadata
 
-    token = _header_value(scope, config.header)
-    if token is None:
-        metadata["skipped"] = "missing_header"
-        if config.required:
+    _store, lease = _resolve_presented_lease(scope, config=config, metadata=metadata)
+    metadata["catalog_checked"] = metadata["checked"]
+    if lease is None:
+        if config.required and not metadata.get("blocked"):
             metadata["reason_code"] = "lease.missing"
             metadata["blocked"] = True
+        if metadata.get("blocked"):
             metadata["allowed"] = False
         return metadata
 
-    metadata["checked"] = True
-    metadata["catalog_checked"] = True
-    try:
-        store = _load_store(config.lease_file, create_missing=False)
-    except FileNotFoundError:
-        metadata["reason_code"] = "lease.store_missing"
-        metadata["blocked"] = True
-        metadata["allowed"] = False
-        return metadata
-    except ValueError as exc:
-        metadata["reason_code"] = "lease.store_invalid"
-        metadata["error"] = str(exc)
-        metadata["blocked"] = True
-        metadata["allowed"] = False
-        return metadata
-
-    lease = _find_lease(store, token)
-    if lease is None:
-        metadata["reason_code"] = "lease.invalid"
-        metadata["blocked"] = True
-        metadata["allowed"] = False
-        return metadata
-
     invite_metadata = _lease_invite_metadata(lease.get("invite"))
     metadata.update(
         {
@@ -502,33 +510,12 @@ def _evaluate_locked_lease_policy(
     if config.lease_file is None:
         return True, metadata
 
-    token = _header_value(scope, config.header)
-    if token is None:
-        metadata["skipped"] = "missing_header"
-        if config.required and method == "tools/call":
+    store, lease = _resolve_presented_lease(scope, config=config, metadata=metadata)
+    if lease is None:
+        if config.required and method == "tools/call" and not metadata.get("blocked"):
             metadata["reason_code"] = "lease.missing"
             metadata["blocked"] = True
-            return False, metadata
-        return True, metadata
-
-    metadata["checked"] = True
-    try:
-        store = _load_store(config.lease_file, create_missing=False)
-    except FileNotFoundError:
-        metadata["reason_code"] = "lease.store_missing"
-        metadata["blocked"] = True
-        return False, metadata
-    except ValueError as exc:
-        metadata["reason_code"] = "lease.store_invalid"
-        metadata["error"] = str(exc)
-        metadata["blocked"] = True
-        return False, metadata
-
-    lease = _find_lease(store, token)
-    if lease is None:
-        metadata["reason_code"] = "lease.invalid"
-        metadata["blocked"] = True
-        return False, metadata
+        return not metadata.get("blocked", False), metadata
 
     invite_metadata = _lease_invite_metadata(lease.get("invite"))
     metadata.update(
@@ -543,7 +530,7 @@ def _evaluate_locked_lease_policy(
             **_lease_auth_metadata(lease, auth_context),
         }
     )
-    params = request.get("params")
+    params = request.get("params") if isinstance(request, Mapping) else None
     params = params if isinstance(params, Mapping) else {}
     tool = params.get("name")
     if isinstance(tool, str):
@@ -566,6 +553,55 @@ def _evaluate_locked_lease_policy(
     return True, metadata
 
 
+def _resolve_presented_lease(
+    scope: Scope,
+    *,
+    config: LeasePolicyConfig,
+    metadata: dict[str, Any],
+) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
+    """Resolve references inside the caller's existing consumption transaction."""
+
+    trusted = scope.get(TRUSTED_LEASE_SCOPE_KEY)
+    target = config.header.lower().encode("latin-1")
+    values = [value.decode("latin-1").strip() for name, value in scope.get("headers", []) if name.lower() == target]
+    reason = None
+    if TRUSTED_LEASE_SCOPE_KEY in scope and not isinstance(trusted, TrustedLeaseSelection):
+        reason = "lease.selection_invalid"
+    elif len(values) > 1:
+        reason = "lease.selection_conflict"
+    elif values and not values[0]:
+        reason = "lease.invalid"
+    elif not values and trusted is None:
+        metadata["skipped"] = "missing_header"
+        return None, None
+    metadata["checked"] = True
+    metadata["selection"] = "trusted" if trusted is not None else "header"
+    store = None
+    lease = None
+    if reason is None:
+        try:
+            store = _load_store(config.lease_file, create_missing=False)
+        except FileNotFoundError:
+            reason = "lease.store_missing"
+        except ValueError as exc:
+            reason = "lease.store_invalid"
+            metadata["error"] = str(exc)
+        else:
+            if trusted is not None:
+                matches = [item for item in _leases(store) if item.get("id") == trusted.lease_id]
+                lease = matches[0] if len(matches) == 1 else None
+            else:
+                lease = _find_lease(store, values[0])
+            if lease is None:
+                reason = "lease.invalid"
+            elif trusted is not None and values and _find_lease(store, values[0]) is not lease:
+                reason = "lease.selection_conflict"
+    if reason is not None:
+        metadata.update(reason_code=reason, blocked=True)
+        return None, None
+    return store, lease
+
+
 def preview_mcp_lease_coverage(
     request: Mapping[str, Any] | None,
     path: str | Path,
@@ -983,15 +1019,6 @@ def _drop_empty(value: Mapping[str, Any]) -> dict[str, Any]:
     return {str(key): item for key, item in value.items() if item not in (None, [], {}, "")}
 
 
-def _header_value(scope: Scope, name: str) -> str | None:
-    target = name.lower().encode("latin-1")
-    for raw_name, raw_value in scope.get("headers", []):
-        if raw_name.lower() == target:
-            value = raw_value.decode("latin-1").strip()
-            return value or None
-    return None
-
-
 def _tool_allowed(tool: str, allow_tools: Any) -> bool:
     if not isinstance(allow_tools, Sequence) or isinstance(allow_tools, str | bytes | bytearray):
         return False

{snulbug-0.2.5 → snulbug-0.2.6}/snulbug/proxy.py

@@ -33,8 +33,10 @@ from .fabric import annotate_topology_audit, build_fabric_audit_metadata
 from .fabric_control import summarize_fabric_control_state
 from .http_routes import HttpRoutesMiddleware
 from .leases import (
+    LEASE_HEADER,
     LEASE_RENEWAL_HEADER,
     LEASE_RENEWAL_METHOD,
+    TRUSTED_LEASE_SCOPE_KEY,
     LeasePolicyConfig,
     enforce_mcp_lease_policy,
     mcp_lease_error_response,
@@ -98,6 +100,7 @@ from .middleware import ASGIApp, LuaConfig, LuaMiddleware, Receive, Scope, Send
 from .policy_backoff import PolicyBackoffConfig
 from .public_origin import PublicOriginMiddleware
 from .recorder import append_record, build_request_record, record_audit_event
+from .redaction import RedactionConfig, redact_secrets
 from .request_explanations import (
     upstream_failure,
     upstream_failure_message,
@@ -303,8 +306,10 @@ class ReverseProxyApp:
             scope,
             config=self.lease_policy,
         )
-        if not lease_allowed and isinstance(request, Mapping):
-            response = mcp_lease_error_response(request, lease_metadata)
+        if not lease_allowed:
+            response = mcp_lease_error_response(request or {}, lease_metadata)
+            if request is None:
+                response["status"] = 403
             _set_proxy_metadata(
                 scope,
                 {
@@ -429,6 +434,7 @@ class ReverseProxyApp:
                     self._target(scope),
                     credential=self.upstream_credential,
                     timeout=self.config.timeout,
+                    lease_header=self.lease_policy.header,
                 )
             else:
                 response = await asyncio.to_thread(self._forward, scope, body)
@@ -515,7 +521,7 @@ class ReverseProxyApp:
         connection = self._connection()
         try:
             target = self._target(scope)
-            headers = _request_headers(scope.get("headers", []), self._upstream)
+            headers = _request_headers(scope.get("headers", []), self._upstream, lease_header=self.lease_policy.header)
             request = _jsonrpc_request(body)
             if is_modern_request(request):
                 headers = modern_request_headers(headers, request)
@@ -1055,6 +1061,18 @@ class McpFacadeProxyApp:
                 )
                 return
 
+            # Tool execution is charged later, after route admission. Discovery
+            # and other methods validate a supplied selection without charging it.
+            if request.get("method") != "tools/call":
+                lease_allowed, lease_metadata = enforce_mcp_lease_policy(request, scope, config=self.lease_policy)
+                _set_proxy_metadata(
+                    scope,
+                    {"lease": lease_metadata, "access": _composed_access_metadata(scope, lease=lease_metadata)},
+                )
+                if not lease_allowed:
+                    await _send_response(send, **mcp_lease_error_response(request, lease_metadata))
+                    return
+
             progress_allowed, progress_request_metadata = enforce_mcp_progress_request_policy(
                 request,
                 config=self.progress_policy,
@@ -1864,6 +1882,8 @@ class McpFacadeProxyApp:
         body: bytes,
         request: Mapping[str, Any],
     ) -> dict[str, Any]:
+        scope = {**scope, "headers": _strip_lease_headers(scope.get("headers", []), self.lease_policy.header)}
+        scope.pop(TRUSTED_LEASE_SCOPE_KEY, None)
         transport = get_upstream_transport(upstream.transport)
         if is_modern_request(request) and transport.http_target(upstream) is None and upstream.transport != "stdio":
             return _json_response(
@@ -1887,6 +1907,7 @@ class McpFacadeProxyApp:
                         _exact_target(routes.parsed[upstream.name]),
                         credential=upstream.credential,
                         timeout=self.timeout,
+                        lease_header=self.lease_policy.header,
                     )
                     if scope.get(STREAM_SCOPE_KEY) is not None
                     else asyncio.to_thread(self._forward_http, routes, upstream, scope, body)
@@ -1912,7 +1933,9 @@ class McpFacadeProxyApp:
         parsed = routes.parsed[upstream.name]
         connection = _connection(parsed, self.timeout)
         try:
-            headers = _request_headers(scope.get("headers", []), parsed, content_length=len(body))
+            headers = _request_headers(
+                scope.get("headers", []), parsed, content_length=len(body), lease_header=self.lease_policy.header
+            )
             request = _jsonrpc_request(body)
             if is_modern_request(request):
                 headers = modern_request_headers(headers, request)
@@ -2007,6 +2030,7 @@ class ProxyRecorderMiddleware:
         policy: str | Path,
         record_out: str | Path | None = None,
         redact_records: bool = True,
+        lease_header: str = LEASE_HEADER,
         tunnel_audit: TunnelAuditConfig | None = None,
         topology_audit: Mapping[str, Any] | None = None,
         event_dispatcher: Any = None,
@@ -2015,6 +2039,8 @@ class ProxyRecorderMiddleware:
         self.policy = policy
         self.record_out = Path(record_out) if record_out is not None else None
         self.redact_records = redact_records
+        self.redaction_config = RedactionConfig()
+        self.redaction_config.secret_keys.add(lease_header.lower())
         self.tunnel_audit = tunnel_audit or TunnelAuditConfig()
         self.topology_audit = dict(topology_audit or {})
         self.event_dispatcher = event_dispatcher
@@ -2047,12 +2073,13 @@ class ProxyRecorderMiddleware:
             metadata=metadata,
             redact=self.redact_records
             or any(name.lower() == LEASE_RENEWAL_HEADER.encode() for name, _value in scope.get("headers", [])),
+            redaction_config=self.redaction_config,
         )
         # Renewal is an audited control operation, not a replayable Lua decision.
         if self.record_out is not None and "lease_renewal" not in metadata:
             append_record(self.record_out, record)
         if self.event_dispatcher is not None:
-            audit_event = record_audit_event(record)
+            audit_event = redact_secrets(record_audit_event(record), self.redaction_config)
             self.event_dispatcher.emit(decision_console_event(record, audit_event=audit_event))
 
     def _enabled(self) -> bool:
@@ -3354,6 +3381,7 @@ def create_proxy_application(
             policy=policy,
             record_out=record_out,
             redact_records=redact_records,
+            lease_header=lease_header,
             tunnel_audit=TunnelAuditConfig(provider=tunnel_provider, public_url=tunnel_public_url),
             topology_audit=topology_audit,
             event_dispatcher=event_dispatcher,
@@ -4445,9 +4473,10 @@ def _request_headers(
     upstream: SplitResult,
     *,
     content_length: int | None = None,
+    lease_header: str = LEASE_HEADER,
 ) -> dict[str, str]:
     headers: dict[str, str] = {}
-    for name, value in raw_headers:
+    for name, value in _strip_lease_headers(raw_headers, lease_header):
         lower_name = name.lower()
         if lower_name in HOP_BY_HOP_HEADERS or lower_name in {b"host", b"content-length", b"x-snulbug-renewal"}:
             continue
@@ -4458,6 +4487,11 @@ def _request_headers(
     return headers
 
 
+def _strip_lease_headers(raw_headers: list[tuple[bytes, bytes]], header: str) -> list[tuple[bytes, bytes]]:
+    sensitive = {LEASE_HEADER.encode("ascii"), header.lower().encode("latin-1"), LEASE_RENEWAL_HEADER.encode("ascii")}
+    return [(name, value) for name, value in raw_headers if name.lower() not in sensitive]
+
+
 def _strip_cloudflare_access_credentials(raw_headers: Any) -> list[tuple[bytes, bytes]]:
     stripped = []
     sensitive = {
@@ -4835,9 +4869,18 @@ def _headers_to_mapping(headers: list[tuple[bytes, bytes]]) -> dict[str, str | l
     return result
 
 
-async def _forward_stream_http(scope: Scope, body: bytes, parsed: Any, target: str, *, credential: Any, timeout: float):
+async def _forward_stream_http(
+    scope: Scope,
+    body: bytes,
+    parsed: Any,
+    target: str,
+    *,
+    credential: Any,
+    timeout: float,
+    lease_header: str = LEASE_HEADER,
+):
     request = _jsonrpc_request(body)
-    headers = _request_headers(scope.get("headers", []), parsed, content_length=len(body))
+    headers = _request_headers(scope.get("headers", []), parsed, content_length=len(body), lease_header=lease_header)
     headers = modern_request_headers(headers, request)
     headers = apply_credential_header(headers, credential)
     return await scope[STREAM_SCOPE_KEY].forward_http(

{snulbug-0.2.5 → snulbug-0.2.6}/snulbug/recorder.py

@@ -6,7 +6,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-from .redaction import build_audit_event, redact_secrets
+from .redaction import RedactionConfig, build_audit_event, redact_secrets
 from .simulator import simulate_policy
 
 RECORD_TYPE = "snulbug.request_record"
@@ -60,6 +60,7 @@ def build_request_record(
     metadata: Mapping[str, Any] | None = None,
     recorded_at: str | None = None,
     redact: bool = False,
+    redaction_config: RedactionConfig | None = None,
 ) -> dict[str, Any]:
     """Build a replayable request record from an already executed policy result."""
 
@@ -80,7 +81,7 @@ def build_request_record(
     if metadata is not None:
         record["metadata"] = dict(metadata)
     if redact:
-        record = redact_secrets(record)
+        record = redact_secrets(record, redaction_config)
         record["redacted"] = True
     return record