From eb99baee234e51e71710649e3fb7b02e3b09267d Mon Sep 17 00:00:00 2001
From: 777genius <quantjumppro@gmail.com>
Date: Fri, 22 May 2026 21:01:36 +0300
Subject: [PATCH] fix(runtime): sanitize provider error output

---
 .../input/registerRuntimeProviderManagementIpc.ts |  6 +++---
 ...gentTeamsRuntimeProviderManagementCliClient.ts | 15 ++++++++-------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/src/features/runtime-provider-management/main/adapters/input/registerRuntimeProviderManagementIpc.ts b/src/features/runtime-provider-management/main/adapters/input/registerRuntimeProviderManagementIpc.ts
index 10c27974..1e4b1fe5 100644
--- a/src/features/runtime-provider-management/main/adapters/input/registerRuntimeProviderManagementIpc.ts
+++ b/src/features/runtime-provider-management/main/adapters/input/registerRuntimeProviderManagementIpc.ts
@@ -57,11 +57,11 @@ function sanitizeRuntimeProviderIpcErrorMessage(message: string): string {
     .replace(/\b(or-[A-Za-z0-9_-]{12,})\b/g, 'or-...redacted')
     .replace(/\b(AIza[A-Za-z0-9_-]{20,})\b/g, 'AIza...redacted')
     .replace(
-      /\b([A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?token|auth[_-]?token|token|secret|password|[_-]key)["'\s:=]+)([A-Za-z0-9._~+/=_-]{12,})/gi,
+      /\b([a-z0-9_.-]*(?:api[-_]?key|(?:access|auth)[-_]?token|token|secret|password|[-_]key)["'\s:=]+)([a-z0-9._~+/=-]{12,})/gi,
       '$1...redacted'
     )
-    .replace(/\b(key["'\s:=]+)([A-Za-z0-9._~+/=_-]{12,})/gi, '$1...redacted')
-    .replace(/\b(bearer\s+)([A-Za-z0-9._~+/=_-]{12,})/gi, '$1...redacted')
+    .replace(/\b(key["'\s:=]+)([a-z0-9._~+/=-]{12,})/gi, '$1...redacted')
+    .replace(/\b(bearer\s+)([a-z0-9._~+/=-]{12,})/gi, '$1...redacted')
     .trim();
   return truncateRuntimeProviderIpcErrorDetail(sanitized);
 }
diff --git a/src/features/runtime-provider-management/main/infrastructure/AgentTeamsRuntimeProviderManagementCliClient.ts b/src/features/runtime-provider-management/main/infrastructure/AgentTeamsRuntimeProviderManagementCliClient.ts
index a979d611..74dd732a 100644
--- a/src/features/runtime-provider-management/main/infrastructure/AgentTeamsRuntimeProviderManagementCliClient.ts
+++ b/src/features/runtime-provider-management/main/infrastructure/AgentTeamsRuntimeProviderManagementCliClient.ts
@@ -118,18 +118,19 @@ function sanitizeRuntimeProviderResponse<T extends RuntimeProviderManagementErro
   response: T
 ): T {
   const sanitizedResponse = sanitizeRuntimeProviderOutputValue(response) as T;
-  if (sanitizedResponse.error === null) {
+  const sanitizedError = (sanitizedResponse as { error?: unknown }).error;
+  if (sanitizedError === null) {
     const responseWithoutNullError = { ...sanitizedResponse };
     delete (responseWithoutNullError as { error?: unknown }).error;
-    return responseWithoutNullError as T;
+    return responseWithoutNullError;
   }
-  if (!sanitizedResponse.error) {
+  if (!sanitizedError) {
     return sanitizedResponse;
   }
 
   return {
     ...sanitizedResponse,
-    error: sanitizeRuntimeProviderError(sanitizedResponse.error),
+    error: sanitizeRuntimeProviderError(sanitizedError),
   };
 }
 
@@ -409,11 +410,11 @@ function redactSensitiveText(value: string): string {
     .replace(/\b(or-[A-Za-z0-9_-]{12,})\b/g, 'or-...redacted')
     .replace(/\b(AIza[A-Za-z0-9_-]{20,})\b/g, 'AIza...redacted')
     .replace(
-      /\b([A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?token|auth[_-]?token|token|secret|password|[_-]key)["'\s:=]+)([A-Za-z0-9._~+/=_-]{12,})/gi,
+      /\b([a-z0-9_.-]*(?:api[-_]?key|(?:access|auth)[-_]?token|token|secret|password|[-_]key)["'\s:=]+)([a-z0-9._~+/=-]{12,})/gi,
       '$1...redacted'
     )
-    .replace(/\b(key["'\s:=]+)([A-Za-z0-9._~+/=_-]{12,})/gi, '$1...redacted')
-    .replace(/\b(bearer\s+)([A-Za-z0-9._~+/=_-]{12,})/gi, '$1...redacted');
+    .replace(/\b(key["'\s:=]+)([a-z0-9._~+/=-]{12,})/gi, '$1...redacted')
+    .replace(/\b(bearer\s+)([a-z0-9._~+/=-]{12,})/gi, '$1...redacted');
 }
 
 function formatCommandForDisplay(context: RuntimeProviderCommandContext): string {