Scrub coalesced cloud text_delta and tighten key redaction

Apply scrubCloudValue on upserted text_delta rows so live status hits the same size/image limits, and broaden sensitive-key matching for AWS-style credentials without over-matching pin suffixes.

Author: esokullu

src/chrome/src/cloud-runs.js

@@ -6,7 +6,10 @@ const CLOUD_STRING_LIMIT = 16 * 1024;
 const CLOUD_RUN_PERSIST_BYTES_LIMIT = 256 * 1024;
 const CLOUD_PERSIST_BYTES_LIMIT = 4 * 1024 * 1024;
 const TERMINAL_STATUSES = new Set(['completed', 'failed', 'aborted']);
-const SENSITIVE_CLOUD_KEY = /(?:authorization|cookie|password|passwd|passphrase|passcode|pin|secret|credential|privatekey|apikey|token)$/i;
+// Suffix match on normalized keys (non-alnum stripped). Avoid bare `pin` as a
+// suffix — it over-matches `spin`, `mapPin`, etc. Short exact keys live in the set.
+const SENSITIVE_CLOUD_KEY = /(?:authorization|cookie|password|passwd|passphrase|passcode|pincode|secret|credential|privatekey|apikey|token|accesskeyid|secretaccesskey)$/i;
+const SENSITIVE_CLOUD_KEY_EXACT = new Set(['pin', 'otp', 'cvv', 'cvc', 'ssn']);
 const LARGE_IMAGE_KEY = /(?:attachimage|screenshot|image|imagedata|dataurl)$/i;
 
 function normalizedCloudKey(key) {
@@ -22,11 +25,17 @@ export function normalizeCloudBridgeUrl(value = DEFAULT_CLOUD_BRIDGE_URL) {
   return url.href;
 }
 
+function isSensitiveCloudKey(key) {
+  const normalizedKey = normalizedCloudKey(key);
+  if (!normalizedKey) return false;
+  return SENSITIVE_CLOUD_KEY.test(normalizedKey) || SENSITIVE_CLOUD_KEY_EXACT.has(normalizedKey);
+}
+
 function scrubCloudValue(value) {
   try {
     return JSON.parse(JSON.stringify(value, (key, item) => {
       const normalizedKey = normalizedCloudKey(key);
-      if (normalizedKey && SENSITIVE_CLOUD_KEY.test(normalizedKey)) {
+      if (normalizedKey && isSensitiveCloudKey(key)) {
         return '[redacted]';
       }
       if (typeof item === 'string' && /^data:image\//i.test(item)) {
@@ -181,7 +190,7 @@ export function createCloudRunController({
         if (!row?.runId) continue;
         const rawUpdates = Array.isArray(row.updates) ? row.updates : [];
         let nextUpdateSeq = 0;
-        const updates = rawUpdates.map((update, index) => {
+        const updates = rawUpdates.map((update) => {
           const candidate = Number(update?.seq);
           const seq = Number.isSafeInteger(candidate) && candidate > nextUpdateSeq
             ? candidate
@@ -252,11 +261,15 @@ export function createCloudRunController({
   function pushUpdate(run, type, data) {
     run.updatedAt = isoNow();
     const previous = run.updates.at(-1);
+    // Consecutive text_delta events upsert the same seq: content grows in place
+    // and ts advances. Full-array pollers are fine; append-only / seq-cursor
+    // clients must re-read that row (or take a full snapshot) rather than
+    // assuming each seq is immutable.
     if (type === 'text_delta' && previous?.type === 'text_delta') {
-      previous.data = {
+      previous.data = scrubCloudValue({
         ...previous.data,
         content: `${previous.data?.content || ''}${data?.content || ''}`,
-      };
+      });
       previous.ts = run.updatedAt;
       schedulePersist();
       return;

test/run.js

@@ -4180,6 +4180,12 @@ test('cloud run controller uses the visible tab and persists terminal status', a
       nested: {
         apiKey: 'sk-test',
         sessionToken: 'session-secret',
+        accessKeyId: 'AKIAEXAMPLE',
+        secretAccessKey: 'aws-secret',
+        pin: '1234',
+        pinCode: '9999',
+        spin: 'keep-me',
+        mapPin: 'also-keep',
         headers: { 'x-api-key': 'header-secret' },
       },
       screenshot: `data:image/png;base64,${'a'.repeat(600)}`,
@@ -4192,6 +4198,12 @@ test('cloud run controller uses the visible tab and persists terminal status', a
   assert.equal(running.updates[2].data.args.authorization, '[redacted]');
   assert.equal(running.updates[2].data.args.nested.apiKey, '[redacted]');
   assert.equal(running.updates[2].data.args.nested.sessionToken, '[redacted]');
+  assert.equal(running.updates[2].data.args.nested.accessKeyId, '[redacted]');
+  assert.equal(running.updates[2].data.args.nested.secretAccessKey, '[redacted]');
+  assert.equal(running.updates[2].data.args.nested.pin, '[redacted]');
+  assert.equal(running.updates[2].data.args.nested.pinCode, '[redacted]');
+  assert.equal(running.updates[2].data.args.nested.spin, 'keep-me');
+  assert.equal(running.updates[2].data.args.nested.mapPin, 'also-keep');
   assert.equal(running.updates[2].data.args.nested.headers['x-api-key'], '[redacted]');
   assert.match(running.updates[2].data.args.screenshot, /^\[image omitted:/);
   finishRun('Google');
@@ -4202,6 +4214,56 @@ test('cloud run controller uses the visible tab and persists terminal status', a
   assert.equal(session.webbrainCloudRunSnapshots[0].status, 'completed');
 });
 
+test('cloud run text_delta coalesce scrubs live status payloads', async () => {
+  const session = {};
+  const tab = { id: 22, url: 'https://webbrain.one/', active: true, windowId: 3 };
+  let finishRun;
+  let emitUpdate;
+  const controller = createCloudRunController({
+    chromeApi: {
+      tabs: {
+        query: async () => [tab],
+        get: async () => tab,
+        update: async () => tab,
+      },
+      windows: { update: async () => ({}) },
+      storage: {
+        local: { get: async () => ({ webbrainCloudBridgeEnabled: false }) },
+        session: {
+          get: async key => ({ [key]: session[key] || [] }),
+          set: async value => Object.assign(session, value),
+        },
+      },
+      runtime: { sendMessage: async () => ({ connected: false }) },
+    },
+    agent: {
+      isRunning: () => false,
+      abort: () => {},
+      processMessage: (_tabId, _task, onUpdate) => {
+        emitUpdate = onUpdate;
+        return new Promise(resolve => { finishRun = resolve; });
+      },
+    },
+    ensureOffscreen: async () => {},
+    makeRunId: () => 'run_delta_scrub',
+  });
+
+  await controller.startRun({ task: 'Stream a large reply' });
+  emitUpdate('text_delta', { content: 'a'.repeat(10 * 1024) });
+  emitUpdate('text_delta', { content: 'b'.repeat(10 * 1024) });
+  emitUpdate('text_delta', { content: 'c'.repeat(10 * 1024) });
+  const running = await controller.status({ runId: 'run_delta_scrub' });
+  assert.equal(running.updates.length, 1, 'consecutive text_delta events should upsert one seq');
+  assert.equal(running.updates[0].seq, 1);
+  assert.ok(
+    running.updates[0].data.content.length <= 16 * 1024 + 80,
+    'coalesced text_delta must re-apply CLOUD_STRING_LIMIT on the live status row',
+  );
+  assert.match(running.updates[0].data.content, /truncated .* chars for cloud persistence/);
+  finishRun('done');
+  await new Promise(resolve => setTimeout(resolve, 0));
+});
+
 test('cloud run controller keeps the newest 200 monotonically sequenced updates', async () => {
   const session = {};
   const tab = { id: 21, url: 'https://webbrain.one/', active: true, windowId: 3 };