Skip to content

fix(cliagent): redact command error messages - #99

Open
XnLemon wants to merge 4 commits into
mainfrom
codex/phase2-codex-claude-error-redaction
Open

fix(cliagent): redact command error messages#99
XnLemon wants to merge 4 commits into
mainfrom
codex/phase2-codex-claude-error-redaction

Conversation

@XnLemon

@XnLemon XnLemon commented Jul 11, 2026

Copy link
Copy Markdown
Owner

Objective

Redact model-visible Codex and ClaudeCode CLI command error messages for Phase2 redaction closure.

Completed Changes

  • Route Codex CLI run-error and flow-error ResponseError.Message through the shared platform redactor.
  • Route Codex CLI error assistant content through the same redactor so command stdout/stderr secrets are not exposed to the model-visible stream.
  • Route ClaudeCode CLI run-error and flow-error ResponseError.Message through the shared platform redactor.
  • Route ClaudeCode CLI error assistant content through the same redactor.
  • Preserve raw output hook semantics by keeping hook inputs as original stdout/stderr/error before model-visible redaction.
  • Add regression coverage for Authorization, api_key, and Cookie leakage across run-error and flow-error paths, plus assertions that non-sensitive diagnostic context remains visible.

Validation

  • go test ./agent/codex -run TestCodexAgent_Run_ResumeAndCreateErrorsReturnRunError|TestCodexAgent_Run_RawOutputHookReceivesCommandError|TestCodexAgent_Run_RawOutputHookError
  • go test ./agent/claudecode -run TestClaudeCodeAgent_Run_CommandError|TestClaudeCodeAgent_Run_RawOutputHookError
  • go vet ./agent/codex ./agent/claudecode
  • git diff --check
  • Subagent open-code-review first pass: 0 High / 0 Medium / 2 Low
  • Subagent open-code-review final pass: 0 High / 0 Medium / 0 Low

Known Risks / Limitations

  • Full go test ./agent/codex ./agent/claudecode is blocked in this Windows environment by the pre-existing TestExecCommandRunner_Run dependency on sh in PATH.
  • This increment is scoped to Codex and ClaudeCode CLI command error events.

Follow-up Work

  • Continue Phase2 closure by scanning remaining model-visible server, model-provider, and graph error surfaces.

@coderabbitai

coderabbitai Bot commented Jul 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@XnLemon, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 548af6a5-ed82-47ff-ac66-fea3fd5e86b0

📥 Commits

Reviewing files that changed from the base of the PR and between 361e2a4 and 4ceedac.

📒 Files selected for processing (4)
  • agent/claudecode/claude_agent.go
  • agent/claudecode/claude_agent_test.go
  • agent/codex/codex_agent.go
  • agent/codex/codex_agent_test.go
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/phase2-codex-claude-error-redaction

Comment @coderabbitai help to get the list of available commands.

@XnLemon
XnLemon force-pushed the codex/phase2-dify-error-event-redaction branch from 7ec56fe to 15ac566 Compare July 11, 2026 13:39
@XnLemon
XnLemon force-pushed the codex/phase2-codex-claude-error-redaction branch from 985d9be to f9efda8 Compare July 11, 2026 13:39
@XnLemon
XnLemon changed the base branch from codex/phase2-dify-error-event-redaction to main July 13, 2026 02:23
XnLemon and others added 2 commits July 13, 2026 10:26
@XnLemon @xianingawa-wq
platform: add minimum closed-loop multi-tenant foundation (#47)
361e2a4 
* platform: add multi-tenant contracts

* platform/gateway: add text loop

* platform/toolpolicy: add governance bridge

* platform/channeladapter: add adapter outbox skeleton

* platform/gateway: enqueue outbound handoff

* platform/storagerouter: add storage routing contracts

* platform/gateway: add session lease

* platform: add gray routing helpers

* platform: add tenant budget helpers

* platform: validate storage migration modes

* platform: validate audit policies

* platform: validate audit records

* platform: add capacity estimator

* platform/channeladapter: replay dead letters

* platform: populate audit record ids

* platform: validate audit sink writes

* platform: add usage record contracts

* platform: add usage sink contracts

* platform: add config version contracts

* platform: select config version by session gray bucket

* platform: add config version lifecycle helpers

* platform: add usage summary contracts

* platform: add audit query contracts

* platform: add config version diff contracts

* platform: add config gray status summary

* platform: add operational action audit contracts

* platform: add config cache invalidation contracts

* platform: add secret rotation status contracts

* platform: add backend migration status contracts

* platform: add storage router status summary

* platform: add config operation summary contracts

* platform/toolpolicy: add approval summary contract

* fix(platform): enforce binding ACL and redact outbox errors

* fix(platform): redact gateway audit error reasons

* fix(toolpolicy): enforce auditable policy identity

* platform: harden identity and idempotency contracts

* platform: tighten routing identity contracts

* fix(platform): reconcile hardened contracts with gateway

* platform: add budget decision audit contracts

* platform/gateway: add minimum loop acceptance test

* platform/gateway: add outbound dispatch acceptance test

* platform/gateway: correlate audit trace ids

* platform/gateway: add trace skeleton spans

* platform/gateway: enable runner session trace

* platform/gateway: add message event trace contract

* feat(platform): mark tool call trace spans

Adds safe platform tool-call trace contract spans. Independent re-review reported P0/P1 clear; CodeRabbit only reported a trivial test-helper nitpick.

* feat(platform): trace memory search spans

Adds safe memory search trace spans on the current memory.Reader boundary. Independent review reported P0/P1 clear; local focused validation and build passed.

* feat(platform): trace memory write spans

Adds safe memory write trace spans for add/update/delete/clear. Independent review reported P0/P1 clear; local focused validation and build passed.

* feat(platform): mark summary create trace spans

Adds summary-create trace contract markers for Redis/PostgreSQL summary creation spans. Independent review reported P0/P1 clear; local focused validation and build passed.

* fix(platform): address CI checks

* fix(platform): address CodeRabbit review feedback

* fix(platform): bound in-memory sink records

---------

Co-authored-by: xnlemon <xianingawa@gmail.com>
@xianingawa-wq xnlemonOwo-zhengjs
fix(cliagent): redact command error messages
4ceedac
@XnLemon
XnLemon force-pushed the codex/phase2-codex-claude-error-redaction branch from f9efda8 to 4ceedac Compare July 13, 2026 02:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@XnLemon @xianingawa-wq