fix(OUT-3739): redact sensitive server logs

[cursor]

Changes

• Remove marketplace tokens and token payloads from task app page render logs.
• Stop CopilotAPI logs from printing request tokens, API keys, auth headers, and webhook payload bodies.
• Redact sensitive debug output in the local Copilot SDK patch script.

Testing Criteria

• Ran ./node_modules/.bin/eslint src/utils/CopilotAPI.ts 'src/app/(home)/page.tsx' src/app/client/page.tsx 'src/app/detail/[task_id]/[user_type]/page.tsx'.
• Ran node --check src/lib/patch-copilot-node-sdk.js.

Notes

• OUT-3739's router-state exception appears to be a single Next.js App Router malformed/stale RSC request before first-party route code. This PR addresses the sensitive log exposure found in the Sentry breadcrumbs during triage.

Impact & Surface Area of Change

• Server-side logging only. Task loading, Copilot API calls, notification fetches, and webhook dispatch behavior should be unchanged except that logs no longer include credentials or full payload bodies.

  

[linear-code]

OUT-3739

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tasks-app	Ready	Preview, Comment	May 14, 2026 2:10pm