fix(#6165): tighten auth_header redactor pattern to prevent JSON corruption

[fullsend-ai-coder]

Summary

Tightens the auth_header structural pattern in internal/security/redactor.go to fix two compounding bugs: (1) the \S{8,} capture group consumed JSON structural characters (", }, ]), corrupting JSON output after mask() replaced the match, and (2) the 8-character minimum triggered false positives on short technical references in triage agent output discussing auth headers.

Changes

• Replace (\S{8,}) with ([^\s"'}\]),;]{16,}) in the auth_header regex — excludes JSON/YAML structural delimiters from the capture group and raises the minimum match length from 8 to 16 characters
• Add four test cases covering: false positive rejection, JSON structure preservation, real secret detection, and the specific \S eating past JSON closing quotes regression

Testing

• All existing tests in internal/security/ pass
• Four new test cases pass covering the documented failure modes
• go vet passes
• Patch coverage at 100% for defaultStructuralPatterns

---

Closes #6165

Post-script verification

• Branch is not main/master (agent/6165-fix-auth-header-pattern)
• Secret scan passed (gitleaks — 3c7f5d034d3f9ace8efd3608a6322903da907809..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:57 AM UTC · Completed 7:13 AM UTC

Commit: 009cbf5 · View workflow run →

[fullsend-ai-review]

Review

Findings

Low

• [edge-case] internal/security/redactor.go:172 — Raising the auth_header minimum match length from 8 to 16 creates a coverage gap for short auth tokens (8–15 chars), such as Base64-encoded Basic auth credentials (e.g., Authorization: Basic dXNlcjpwdw== at 12 chars). This is an intentional tradeoff documented in issue auth_header sanitizer pattern produces false positives on auth-related issues and corrupts JSON output #6165 — short tokens are lower-risk and the previous 8-char threshold caused false positives on short technical references like token_value. Prefix-based patterns still catch tokens with known prefixes (ghp_, sk-, etc.).

Previous run

Review

Findings

Low

• [edge-case] internal/security/redactor.go:172 — Raising the auth_header minimum match length from 8 to 16 creates a coverage gap for short auth tokens (8–15 chars), such as Base64-encoded Basic auth credentials (e.g., Authorization: Basic dXNlcjpwdw== at 12 chars). This is an intentional tradeoff documented in issue auth_header sanitizer pattern produces false positives on auth-related issues and corrupts JSON output #6165 — short tokens are lower-risk and the previous 8-char threshold caused false positives on short technical references like token_value. Prefix-based patterns still catch tokens with known prefixes (ghp_, sk-, etc.).

---

Labels: PR modifies internal security scanner/redactor code and fixes a documented bug

[ifireball]

/fs-fix fix CI issue and review comments

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 8:41 AM UTC · Completed 8:53 AM UTC

Commit: 009cbf5 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Fixed CI failure caused by a test expectation that encoded the old buggy auth_header behavior (double-masking and quote-eating). The test now expects the correct output where the prefix pattern redacts the token and structural delimiters are preserved. Acknowledged the reviewer's low-severity finding about the 8-to-16 minimum as an intentional tradeoff per #6165.

Fixed (1):

1. CI test failure in TestExtractSafeContext/bash_with_github_token_redacted (internal/runtime/claude_progress_test.go): Updated test expectation to match the new auth_header regex behavior. The old test expected '***' because the previous \S{8,} pattern would double-mask the already-redacted prefix output and consume the closing single quote. The new regex correctly stops at structural delimiters, so the prefix pattern's 'ghp_...' mask is preserved and the closing quote is not eaten.

Disagreed (1):

1. auth_header 8-to-16 char minimum creates coverage gap for short auth tokens: The reviewer's own analysis acknowledges this is an intentional tradeoff documented in issue auth_header sanitizer pattern produces false positives on auth-related issues and corrupts JSON output #6165. Short tokens (8-15 chars) are lower-risk, the previous 8-char threshold caused false positives on technical references, and prefix-based patterns still catch tokens with known prefixes. No code change warranted.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 8:54 AM UTC · Ended 9:06 AM UTC

Commit: a1d49d9 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:54 AM UTC · Completed 9:06 AM UTC

Commit: a1d49d9 · View workflow run →