fix: use sha256 descriptor digest and keep operator errors fully sanitized

2026-08-11 19:24:15 +02:00
parent 929f7dcc5e
commit 82b5453c88
4 changed files with 8 additions and 10 deletions
@@ -41,10 +41,9 @@ function boundedJson(result: WorkspaceOperationResult): string {
  return encoded;
 }

-function sanitizeStderr(error: unknown): string {
-  const detail = error instanceof Error ? error.message : String(error);
-  const safe = detail.replace(/[\r\n]+/g, " ").slice(0, 512);
-  return safe.length > 0 ? `workspace maintenance failed: ${safe}\n` : "workspace maintenance failed\n";
+function sanitizeStderr(_error: unknown): string {
+  // Never return raw exception text: it may embed endpoints, tokens, or SQL.
+  return "workspace maintenance failed\n";
 }

 function parseRequest(command: string, stdin: string): Record<string, unknown> {