From 31bb55147ab769f1c7ab0015cbe8232fcb70fb7e Mon Sep 17 00:00:00 2001 From: Abdullah Khan <60121741+Abdkhan14@users.noreply.github.com> Date: Mon, 9 Nov 2026 13:04:22 -0500 Subject: [PATCH 1/2] fix(cli): Redact onboarding run tokens from telemetry The docs guide for onboarding progress tells agents to pass the run token as a -f flag to sentry api. That puts the value in the flag.raw-field telemetry tag. Add a RUN_TOKEN pattern to redactCredentialText so the token is replaced with [REDACTED] in every outgoing envelope. Refs VDY-366 Co-authored-by: Cursor --- packages/cli/src/lib/credential-redaction.ts | 5 ++++- packages/cli/test/lib/credential-redaction.test.ts | 13 +++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/packages/cli/src/lib/credential-redaction.ts b/packages/cli/src/lib/credential-redaction.ts index d119e080b..3c0101a46 100644 --- a/packages/cli/src/lib/credential-redaction.ts +++ b/packages/cli/src/lib/credential-redaction.ts @@ -31,6 +31,8 @@ const SENTRY_CREDENTIAL = new RegExp( String.raw`\bsntry[suc]_[A-Za-z0-9._~+/=-]+(?:(?:\r\n|(?! )[\s\x00-\x1f\x7f-\x9f]|${ESCAPED_CONTROL})[ \t]*[A-Za-z0-9._~+/=-]+)*`, "gi", ); +// Onboarding run tokens grant write access to a run's progress. +const RUN_TOKEN = /(\brun_?token\\*["']?\s*[=:]\s*\\*["']?)[A-Za-z0-9]+/gi; /** * Use the runtime's final delimiter because an invalid token can contain quotes. @@ -87,5 +89,6 @@ export function redactCredentialText(text: string): string { : `${quote}[REDACTED]${quote}`, ) .replace(BEARER_CREDENTIAL, "Bearer [REDACTED]") - .replace(SENTRY_CREDENTIAL, "[REDACTED]"); + .replace(SENTRY_CREDENTIAL, "[REDACTED]") + .replace(RUN_TOKEN, "$1[REDACTED]"); } diff --git a/packages/cli/test/lib/credential-redaction.test.ts b/packages/cli/test/lib/credential-redaction.test.ts index 21c4eb9d1..f0e1fcd22 100644 --- a/packages/cli/test/lib/credential-redaction.test.ts +++ b/packages/cli/test/lib/credential-redaction.test.ts @@ -42,6 +42,19 @@ describe("credential redaction", () => { expect(redactCredentialText(message)).toBe(message); }); + test.each([ + [ + "runToken=SYNTHETIC0,stage=connect_agent", + "runToken=[REDACTED],stage=connect_agent", + ], + ['{"runToken":"SYNTHETIC0"}', '{"runToken":"[REDACTED]"}'], + ])("redacts onboarding run tokens: %s", (input, expected) => { + expect(redactCredentialText(input)).toBe(expected); + expect( + JSON.parse(redactCredentialText(JSON.stringify({ message: input }))), + ).toEqual({ message: expected }); + }); + test.each([ "sntrys_SYNTHETIC_PAYLOAD\n_SYNTHETIC_SECRET", "sntryu_SYNTHETIC_PAYLOAD\r\n_SYNTHETIC_SECRET", From 983e14f2bbbcc315be0fd4e49082f49b05310820 Mon Sep 17 00:00:00 2001 From: Abdullah Khan <60121741+Abdkhan14@users.noreply.github.com> Date: Mon, 9 Nov 2026 13:16:28 -0500 Subject: [PATCH 2/2] ref(cli): Explain why run tokens match on the field name Co-authored-by: Cursor --- packages/cli/src/lib/credential-redaction.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/cli/src/lib/credential-redaction.ts b/packages/cli/src/lib/credential-redaction.ts index 3c0101a46..51eceb4fb 100644 --- a/packages/cli/src/lib/credential-redaction.ts +++ b/packages/cli/src/lib/credential-redaction.ts @@ -31,7 +31,8 @@ const SENTRY_CREDENTIAL = new RegExp( String.raw`\bsntry[suc]_[A-Za-z0-9._~+/=-]+(?:(?:\r\n|(?! )[\s\x00-\x1f\x7f-\x9f]|${ESCAPED_CONTROL})[ \t]*[A-Za-z0-9._~+/=-]+)*`, "gi", ); -// Onboarding run tokens grant write access to a run's progress. +// Onboarding run tokens grant write access to a run's progress. They have no +// prefix to match on, so match the field name instead. const RUN_TOKEN = /(\brun_?token\\*["']?\s*[=:]\s*\\*["']?)[A-Za-z0-9]+/gi; /**