Include full Debug-formatted errors in cloud agent traces.#13586
Include full Debug-formatted errors in cloud agent traces.#13586vorporeal wants to merge 2 commits into
Conversation
|
I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![oz-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR switches cloud-agent tracing instrumentation from Display-formatted errors to Debug-formatted errors across the agent driver, attachment, environment, server API, team metadata, git credentials, and managed secrets paths.
Concerns
- One changed top-level agent-driver span can now serialize nested
AgentDriverErrorDebug fields that were intentionally absent from Display output, including raw third-party harness auth preflight stdout/stderr stored inHarnessAuthCheckFailed.detail.
Security
- The
AgentDriver::run_internalerr(Debug)change can bypass the existingsafe_error!redaction boundary for auth preflight details and send potentially sensitive command output into cloud-agent traces.
Verdict
Found: 0 critical, 1 important, 0 suggestions
Request changes
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
| /// a `ModelSpawner` lets us express the high-level process linearly rather than in a | ||
| /// series of callbacks and state machine updates. | ||
| #[tracing::instrument(name = "AgentDriver::run_internal", skip_all, err, fields(tags.cloud_agent = true))] | ||
| #[tracing::instrument(name = "AgentDriver::run_internal", skip_all, err(Debug), fields(tags.cloud_agent = true))] |
There was a problem hiding this comment.
AgentDriverError's Debug output includes fields that Display intentionally hides; for example run_single_preflight stores raw auth-check block output in HarnessAuthCheckFailed.detail, so this span can emit third-party CLI auth stdout/stderr into cloud-agent traces and bypass the existing safe_error! redaction boundary. Keep this top-level driver error redacted or add a safe Debug wrapper before enabling Debug-format tracing here.
2 participants
Description
#[tracing::instrument(err)]formats the error using itsDisplayformat, which only includes the human-readable representation of the top error in the causal chain. We useanyhowandthiserrorfor richer, structured errors, and so we should switch toerr(Debug)in order to get the full structured error data.