fix(cli,sdk): reduce sensitive diagnostic data

Reduces sensitive values retained in CLI and SDK diagnostics. Build
command logs redact build arguments, environment pulls secure
destination permissions before writing, Git metadata removes URL
credentials, and retry telemetry records only a small safe set of URL
and response details without changing requests or retry behavior.

Mono-RevId: e6854bf5379682e208a49fcfa7477d8b799dc849

Author: carderne

.changeset/quiet-credentials.md

@@ -0,0 +1,6 @@
+---
+"trigger.dev": patch
+"@trigger.dev/sdk": patch
+---
+
+Reduce sensitive values in CLI and SDK diagnostics, secure files created by `trigger env pull`, and remove credentials from collected Git remote metadata.

packages/cli-v3/src/commands/env.ts

@@ -3,7 +3,6 @@ import { tryCatch } from "@trigger.dev/core";
 import chalk from "chalk";
 import Table from "cli-table3";
 import type { Command } from "commander";
-import { writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { z } from "zod";
 import {
@@ -15,6 +14,7 @@ import {
 import { loadConfig } from "../config.js";
 import { printInitialBanner } from "../utilities/initialBanner.js";
 import { logger } from "../utilities/logger.js";
+import { writePrivateEnvFile } from "../utilities/privateEnvFile.js";
 import { getProjectClient } from "../utilities/session.js";
 import { spinner } from "../utilities/windows.js";
 import { login } from "./login.js";
@@ -385,13 +385,17 @@ async function _envPullCommand(options: z.infer<typeof EnvPullOptions>) {
 
   const outputPath = resolve(process.cwd(), options.output);
 
-  const [error] = await tryCatch(writeFile(outputPath, "", { flag: "wx", mode: 0o600 }));
+  const envContent = userVariables
+    .map(([key, value]) => `${key}=${serializeDotenvValue(value)}`)
+    .join("\n");
 
-  if (error && "code" in error && error.code !== "EEXIST") {
-    throw error;
+  const [createError] = await tryCatch(writePrivateEnvFile(outputPath, envContent + "\n", "wx"));
+
+  if (createError && (!isNodeError(createError) || createError.code !== "EEXIST")) {
+    throw createError;
   }
 
-  if (error && "code" in error && error.code === "EEXIST" && !options.force) {
+  if (createError && !options.force) {
     const shouldOverwrite = await confirm({
       message: `File ${options.output} already exists. Overwrite?`,
       initialValue: false,
@@ -403,14 +407,10 @@ async function _envPullCommand(options: z.infer<typeof EnvPullOptions>) {
     }
   }
 
-  const envContent = userVariables
-    .map(([key, value]) => `${key}=${serializeDotenvValue(value)}`)
-    .join("\n");
-
   $spinner.start(`Writing to ${options.output}`);
-  const [writeError] = await tryCatch(
-    writeFile(outputPath, envContent + "\n", { encoding: "utf-8", mode: 0o600 })
-  );
+  const [writeError] = createError
+    ? await tryCatch(writePrivateEnvFile(outputPath, envContent + "\n", "w"))
+    : [undefined];
 
   if (writeError) {
     $spinner.stop(`Failed to write to ${options.output}`);
@@ -431,6 +431,10 @@ async function _envPullCommand(options: z.infer<typeof EnvPullOptions>) {
   outro(`Project: ${projectRef} | Environment: ${envInfo}`);
 }
 
+function isNodeError(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error && "code" in error;
+}
+
 const serializeDotenvValue = (v: unknown): string => {
   if (v == null || v === undefined) return "";
 

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -8,9 +8,28 @@ import {
   BUILD_IMAGE,
   DEFAULT_PACKAGES,
   TOOLCHAIN_PACKAGES,
+  formatCommandForDiagnostics,
   generateContainerfile,
 } from "./buildImage.js";
 
+describe("formatCommandForDiagnostics", () => {
+  it("redacts build argument values without changing the executable arguments", () => {
+    const args = ["build", "--build-arg", "PUBLIC=value", "--build-arg", "SECRET=very-secret", "."];
+
+    expect(formatCommandForDiagnostics(args)).toBe(
+      "build --build-arg PUBLIC=[REDACTED] --build-arg SECRET=[REDACTED] ."
+    );
+    expect(args).toEqual([
+      "build",
+      "--build-arg",
+      "PUBLIC=value",
+      "--build-arg",
+      "SECRET=very-secret",
+      ".",
+    ]);
+  });
+});
+
 const images: Array<[BuildRuntime, string, string]> = [
   [
     "node-24",

packages/cli-v3/src/deploy/buildImage.ts

@@ -245,7 +245,7 @@ async function remoteBuildImage(options: DepotBuildImageOptions): Promise<BuildI
     outputOptions.join(","),
   ].filter(Boolean) as string[];
 
-  logger.debug(`depot ${args.join(" ")}`, { cwd: options.cwd });
+  logger.debug(`depot ${formatCommandForDiagnostics(args)}`, { cwd: options.cwd });
 
   // Step 4: Build and push the image
   const childProcess = depot(args, {
@@ -599,7 +599,7 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu
     ".", // The build context
   ].filter(Boolean) as string[];
 
-  logger.debug(`docker ${args.join(" ")}`, { cwd: options.cwd });
+  logger.debug(`docker ${formatCommandForDiagnostics(args)}`, { cwd: options.cwd });
 
   const buildProcess = x("docker", args, {
     nodeOptions: {
@@ -685,6 +685,20 @@ function extractLogs(outputs: string[]) {
   return cleanedOutputs.map((line) => line.trim()).join("\n");
 }
 
+export function formatCommandForDiagnostics(args: string[]): string {
+  return args
+    .map((arg, index) => {
+      if (args[index - 1] !== "--build-arg") {
+        return arg;
+      }
+
+      const separatorIndex = arg.indexOf("=");
+      const key = separatorIndex === -1 ? arg : arg.slice(0, separatorIndex);
+      return `${key}=[REDACTED]`;
+    })
+    .join(" ");
+}
+
 export type GenerateContainerfileOptions = {
   runtime: BuildRuntime;
   build: BuildManifest["build"];

packages/cli-v3/src/utilities/gitMeta.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { sanitizeGitRemoteUrl } from "./gitMeta.js";
+
+describe("sanitizeGitRemoteUrl", () => {
+  it.each([
+    ["https://token@example.com/org/repo.git", "https://example.com/org/repo.git"],
+    ["https://user:password@example.com/org/repo.git", "https://example.com/org/repo.git"],
+    ["ssh://git@example.com/org/repo.git", "ssh://example.com/org/repo.git"],
+    ["https:/user:secret@example.com/org/repo.git", "https://example.com/org/repo.git"],
+    ["https:user:secret@example.com/org/repo.git", "https://example.com/org/repo.git"],
+    ["https:\\user:secret@example.com\\org\\repo.git", "https://example.com/org/repo.git"],
+    [" https:/user:secret@example.com/org/repo.git ", "https://example.com/org/repo.git"],
+  ])("strips userinfo from URL and scheme-looking remotes", (remote, expected) => {
+    expect(sanitizeGitRemoteUrl(remote)).toBe(expected);
+  });
+
+  it.each([
+    "git@example.com:org/repo.git",
+    "example.com:org/repo.git",
+    "/workspace/repo",
+    "../repo",
+    "./repo",
+    "repo",
+    "C:\\workspace\\repo",
+    "file:///workspace/repo.git",
+  ])("preserves scp-style and local remotes", (remote) => {
+    expect(sanitizeGitRemoteUrl(remote)).toBe(remote);
+  });
+
+  it.each([
+    "https://user:secret@ invalid/repo.git",
+    "https:/user:secret@ invalid/repo.git",
+    " https:/user:secret@ invalid/repo.git ",
+  ])("omits malformed URL-style remotes", (remote) => {
+    expect(sanitizeGitRemoteUrl(remote)).toBeUndefined();
+  });
+});

packages/cli-v3/src/utilities/gitMeta.ts

@@ -35,7 +35,7 @@ export async function createGitMeta(directory: string): Promise<GitMeta | undefi
 
   return {
     source: "local",
-    remoteUrl: remoteUrl ?? undefined,
+    remoteUrl: sanitizeGitRemoteUrl(remoteUrl ?? undefined),
     commitAuthorName: commit.author.name,
     commitMessage: commit.subject,
     commitRef: commit.branch,
@@ -102,6 +102,27 @@ async function getOriginUrl(configPath: string): Promise<string | null> {
   return null;
 }
 
+export function sanitizeGitRemoteUrl(remoteUrl: string | undefined): string | undefined {
+  if (remoteUrl === undefined) {
+    return;
+  }
+
+  try {
+    const url = new URL(remoteUrl);
+    if (!url.username && !url.password) {
+      return remoteUrl;
+    }
+
+    url.username = "";
+    url.password = "";
+    return url.href;
+  } catch {
+    return remoteUrl.includes("://") || /^[a-z][a-z\d+.-]*:/i.test(remoteUrl.trim())
+      ? undefined
+      : remoteUrl;
+  }
+}
+
 function errorToString(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
@@ -170,7 +191,7 @@ async function getGitHubActionsMeta(): Promise<GitMeta> {
   return {
     provider: "github",
     source: "github_actions",
-    remoteUrl,
+    remoteUrl: sanitizeGitRemoteUrl(remoteUrl),
     commitSha,
     commitRef,
     // In CI, the workspace is always clean
@@ -197,7 +218,7 @@ function getGitHubAppMeta(): GitMeta {
   return {
     provider: "github",
     source: "trigger_github_app",
-    remoteUrl: process.env.GITHUB_REPOSITORY_URL,
+    remoteUrl: sanitizeGitRemoteUrl(process.env.GITHUB_REPOSITORY_URL),
     commitSha: process.env.GITHUB_HEAD_COMMIT_SHA,
     commitRef: process.env.GITHUB_REF?.replace(/^refs\/(heads|tags)\//, ""),
     commitMessage: process.env.GITHUB_HEAD_COMMIT_MESSAGE,

packages/cli-v3/src/utilities/privateEnvFile.test.ts

@@ -0,0 +1,65 @@
+import { chmod, mkdtemp, readFile, stat, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { writePrivateEnvFile } from "./privateEnvFile.js";
+
+describe("writePrivateEnvFile", () => {
+  it("creates private files", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "trigger-env-"));
+    const outputPath = join(directory, ".env.local");
+
+    await writePrivateEnvFile(outputPath, "SECRET=value\n", "wx");
+
+    expect(await readFile(outputPath, "utf8")).toBe("SECRET=value\n");
+    expect((await stat(outputPath)).mode & 0o777).toBe(0o600);
+  });
+
+  it("creates private files in overwrite mode when the path is absent", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "trigger-env-"));
+    const outputPath = join(directory, ".env.local");
+
+    await writePrivateEnvFile(outputPath, "SECRET=value\n", "w");
+
+    expect(await readFile(outputPath, "utf8")).toBe("SECRET=value\n");
+    expect((await stat(outputPath)).mode & 0o777).toBe(0o600);
+  });
+
+  it("does not replace an existing file in exclusive mode", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "trigger-env-"));
+    const outputPath = join(directory, ".env.local");
+    await writeFile(outputPath, "old=value\n");
+
+    await expect(writePrivateEnvFile(outputPath, "SECRET=value\n", "wx")).rejects.toMatchObject({
+      code: "EEXIST",
+    });
+
+    expect(await readFile(outputPath, "utf8")).toBe("old=value\n");
+  });
+
+  it("tightens an existing file before replacing its contents", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "trigger-env-"));
+    const outputPath = join(directory, ".env.local");
+    await writeFile(outputPath, "old=value\n", { mode: 0o644 });
+    await chmod(outputPath, 0o644);
+
+    await writePrivateEnvFile(outputPath, "SECRET=value\n", "w");
+
+    expect(await readFile(outputPath, "utf8")).toBe("SECRET=value\n");
+    expect((await stat(outputPath)).mode & 0o777).toBe(0o600);
+  });
+
+  it("preserves symlinks while tightening and replacing their target", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "trigger-env-"));
+    const targetPath = join(directory, "target.env");
+    const outputPath = join(directory, ".env.local");
+    await writeFile(targetPath, "old=value\n", { mode: 0o644 });
+    await chmod(targetPath, 0o644);
+    await symlink(targetPath, outputPath);
+
+    await writePrivateEnvFile(outputPath, "SECRET=value\n", "w");
+
+    expect(await readFile(targetPath, "utf8")).toBe("SECRET=value\n");
+    expect((await stat(targetPath)).mode & 0o777).toBe(0o600);
+  });
+});

packages/cli-v3/src/utilities/privateEnvFile.ts

@@ -0,0 +1,19 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+
+export async function writePrivateEnvFile(
+  outputPath: string,
+  content: string,
+  flags: "wx" | "w"
+): Promise<void> {
+  const openFlags = flags === "wx" ? flags : constants.O_WRONLY | constants.O_CREAT;
+  const file = await open(outputPath, openFlags, 0o600);
+
+  try {
+    await file.chmod(0o600);
+    await file.truncate(0);
+    await file.writeFile(content, { encoding: "utf8" });
+  } finally {
+    await file.close();
+  }
+}

packages/trigger-sdk/src/v3/retry.test.ts

@@ -0,0 +1,56 @@
+import { SEMATTRS_HTTP_URL } from "@opentelemetry/semantic-conventions";
+import { describe, expect, it } from "vitest";
+import {
+  createAttributesFromHeaders,
+  createFetchAttributes,
+  createFetchResponseAttributes,
+} from "./retry.js";
+
+describe("retry fetch telemetry", () => {
+  it("omits URL credentials, query parameters, and fragments", () => {
+    const attributes = createFetchAttributes(
+      "https://user:password@example.com/path?token=secret#fragment"
+    );
+
+    expect(attributes[SEMATTRS_HTTP_URL]).toBe("https://example.com/path");
+  });
+
+  it("records only explicitly allowed response headers", () => {
+    const attributes = createAttributesFromHeaders(
+      new Headers({
+        authorization: "secret",
+        "content-type": "application/json",
+        "retry-after": "10",
+        "set-cookie": "session=secret",
+        "x-api-key": "secret",
+        "x-ratelimit-remaining": "9",
+      })
+    );
+
+    expect(attributes).toEqual({
+      "http.response.header.content-type": "application/json",
+      "http.response.header.retry-after": "10",
+    });
+  });
+
+  it("keeps status and content length response diagnostics", () => {
+    const attributes = createFetchResponseAttributes(
+      new Response(null, {
+        status: 429,
+        statusText: "Too Many Requests",
+        headers: {
+          "content-length": "123",
+          "set-cookie": "session=secret",
+        },
+      })
+    );
+
+    expect(attributes).toMatchObject({
+      "http.status_code": 429,
+      "http.status_text": "Too Many Requests",
+      "http.response_content_length": "123",
+      "http.response.header.content-length": "123",
+    });
+    expect(attributes).not.toHaveProperty("http.response.header.set-cookie");
+  });
+});