[codex] Redact SSH tunnel diagnostics

[juliusmarminge]

Problem

SSH tunnel readiness and lifecycle logs included complete forwarded URLs and nested causes. A forwarded request can contain credentials and private path, query, or fragment data, while HTTP client causes retain the complete request. Logging those objects directly leaks the values that structured errors intentionally preserve for the cause chain.

Changes

• derive URL diagnostics through the shared safe URL helper and replace raw forwarded URL log fields
• preserve the exact HTTP transport cause on the structured readiness error chain
• convert nested causes and Effect causes into bounded structural diagnostics before logging them
• remove direct cause logging from SSH authentication, stale tunnel, tunnel creation, and target-resolution fallbacks
• retain useful correlation fields such as protocol, hostname, input/path length, query/fragment presence, ports, attempts, and error tags

Validation

• vp check
• vp test packages/ssh/src/command.test.ts packages/ssh/src/tunnel.test.ts
• vp run typecheck

The focused tests use credentials plus private path, query, and fragment sentinels and verify exact cause identity without serializing those values into logs.

---

Note

Medium Risk
Touches SSH tunnel readiness, auth retry, and diagnostic paths where mis-redaction could hide debugging signal or mishandle causes; behavior is heavily test-covered but still security-sensitive logging.

Overview
SSH tunnel and command logging no longer emit full forwarded URLs or raw nested errors, reducing leakage of credentials, paths, query params, and fragments that structured errors still keep on the in-memory cause chain.

Tunnel lifecycle and readiness logs now use getUrlDiagnostics / readinessUrlDiagnostics (protocol, hostname, lengths, query/fragment flags) instead of httpBaseUrl strings. describeReadinessCause walks Effect causes and errors with a depth cap, strips arbitrary messages, and surfaces tags/structure for log fields renamed from cause to failure (auth, stale tunnels, ready failures, target-resolve fallback logs only failureTag).

Tests assert secrets stay out of captured logs while HTTP transport causes remain identical on SshReadinessProbeError.

^{Reviewed by Cursor Bugbot for commit 9591bea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Redact sensitive data from SSH tunnel diagnostic logs

• Replaces raw URLs, cause objects, and error details in SSH tunnel logs with structured, redacted diagnostics using a new describeReadinessCauseAtDepth helper in tunnel.ts.
• describeReadinessCauseAtDepth produces depth-bounded (max depth 6) descriptions of Effect Cause trees, preventing infinite recursion on cyclic structures and avoiding exposure of secrets in logs.
• URL diagnostics are now derived via getUrlDiagnostics() and readinessUrlDiagnostics(), stripping userinfo, query, fragment, and path details from emitted log fields.
• In startSshTunnel and SshEnvironmentManager, raw cause fields are replaced with failure: describeReadinessCause(...) and raw httpBaseUrl is replaced with httpBaseUrlDiagnostics.
• In command.ts, the resolveSshTarget error log now emits only failureTag instead of the full cause object.

^{Macroscope summarized 9591bea.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 75258d17-feb5-42b7-8efc-f86851ef9293

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/redact-ssh-tunnel-diagnostics

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

Security-focused change that redacts sensitive information (credentials, secrets, paths) from SSH tunnel diagnostic logs. Changes are well-scoped with comprehensive test coverage verifying that secrets are not leaked.

^{You can customize Macroscope's approvability policy. Learn more.}