core: redact sensitive headers in the fetch log

[cliffhall]

Summary

Redact sensitive header values in the fetch tracker before any request/response is recorded: Authorization, Cookie, Set-Cookie, Proxy-Authorization, X-Api-Key, and x-mcp-remote-auth are replaced with a [REDACTED] marker.

Why

createFetchTracker entries flow to the in-memory list (visible in the UI), the pino logger, and persisted session storage. None of those sinks should ever see live bearer tokens or session cookies — especially once OAuth tokens ride these requests.

Reference implementation (PR #1510)

Re-implement informed by these changes at 33fac3f:

• core/mcp/fetchTracking.ts — SENSITIVE_HEADERS set, REDACTED_HEADER_VALUE, redactSensitiveHeaders() applied to both request and response headers before recording (+48/−7)
• clients/web/src/test/core/mcp/fetchTracking.test.ts — redaction tests (+119)

Depends on

Nothing — Wave 1 foundation, parallel-safe.

Notes

• Redact case-insensitively; apply before the entry reaches any sink (logger, in-memory, persistence).
• Coverage gate ≥90 on all four dimensions.

Part of the PR #1510 decomposition (see tracking issue).

[cliffhall]

Smoke test & AGENTS.md audit — PR #1585

Checked out v2/1561-redact-headers (commit 38102706), npm install at root, and exercised the redaction two ways: (1) calling redactSensitiveHeaders directly with a mixed-casing header set, and (2) driving the real entry path through createFetchTracker with a fake fetch and capturing the recorded trackRequest entry. No Playwright — a throwaway tsx script printing real before/after output (included below).

Smoke method

• Direct: redactSensitiveHeaders({ Authorization, Cookie, Set-Cookie, Proxy-Authorization, X-Api-Key, x-mcp-remote-auth, Content-Type, X-Trace-Id }) with mixed casing.
• Entry path: createFetchTracker(fakeFetch, { trackRequest }) → await tracked(url, { headers: { Authorization, x-mcp-remote-auth, Content-Type } }), response carrying Set-Cookie; then inspected the captured entry's requestHeaders / responseHeaders.

Real output

=== Part A: redactSensitiveHeaders (mixed casing) ===
REDACTED sentinel = "[REDACTED]"

BEFORE (original object):
{
  "Authorization": "Bearer super-secret-token",
  "Cookie": "session=abc123",
  "Set-Cookie": "session=abc123; HttpOnly",
  "Proxy-Authorization": "Basic zzz",
  "X-Api-Key": "sk-live-9999",
  "x-mcp-remote-auth": "Bearer inspector-backend-token",
  "Content-Type": "application/json",
  "X-Trace-Id": "trace-42"
}

AFTER (returned copy):
{
  "Authorization": "[REDACTED]",
  "Cookie": "[REDACTED]",
  "Set-Cookie": "[REDACTED]",
  "Proxy-Authorization": "[REDACTED]",
  "X-Api-Key": "[REDACTED]",
  "x-mcp-remote-auth": "[REDACTED]",
  "Content-Type": "application/json",
  "X-Trace-Id": "trace-42"
}

Live/original object untouched? true
Returned is a different object? true

  [OK] Authorization redacted (casing preserved: true)
  [OK] Cookie redacted (casing preserved: true)
  [OK] Set-Cookie redacted (casing preserved: true)
  [OK] Proxy-Authorization redacted (casing preserved: true)
  [OK] X-Api-Key redacted (casing preserved: true)
  [OK] x-mcp-remote-auth redacted (casing preserved: true)
  [OK] Content-Type preserved = "application/json"
  [OK] X-Trace-Id preserved = "trace-42"

Case-insensitivity spot check:
  {"authorization":"[REDACTED]","AUTHORIZATION":"[REDACTED]","x-API-key":"[REDACTED]"}

=== Part B: createFetchTracker records a redacted entry ===
Recorded request headers:
{
  "authorization": "[REDACTED]",
  "content-type": "application/json",
  "x-mcp-remote-auth": "[REDACTED]"
}
Recorded response headers:
{
  "content-type": "text/plain",
  "set-cookie": "[REDACTED]"
}
Entry-path redaction correct? true

ALL SMOKE CHECKS PASSED ✅

Confirmed: all six sensitive headers become [REDACTED] case-insensitively, benign headers and original key casing are preserved, the returned object is a distinct copy, and the live/original header object is untouched. The same holds through the real createFetchTracker entry path for both request and response headers.

AGENTS.md compliance

• Mantine: N/A — this is core/ (no React/UI surface in the diff).

• TypeScript: No any, no @ts-ignore / @ts-expect-error / eslint-disable / v8 ignore anywhere in the diff. redactSensitiveHeaders is fully typed (Record<string, string> → Record<string, string>); SENSITIVE_HEADERS is a ReadonlySet<string>. (The two "any" matches in the diff are prose in the commit message / a code comment, not a type.)

• Coverage (cd clients/web && npm run test:coverage, full unit + integration suite, 3242 tests passing) — core/mcp/fetchTracking.ts:

  Dimension	%	Covered/Total
  Statements	100	59/59
  Branches	100	33/33
  Functions	100	9/9
  Lines	100	57/57

  All four dimensions ≥ 90 (all at 100). Note: running the fetchTracking.test.ts file in isolation reports Functions 88.88% only because createFetchTracker / isLongLivedStreamResponse are additionally exercised by the transport & integration suites; the full-suite aggregate is 100%.

Verdict

✅ PASS. Redaction works correctly and case-insensitively across all six sensitive headers, preserves casing and benign headers, does not mutate the live object, and the recorded entry is redacted through the real tracker path. Fully typed with no suppressions and 100% per-file coverage. No violations found. Recommend merge.

Smoke test script (throwaway, not committed)

// Smoke test for PR #1585 — redact sensitive headers in the fetch log (issue #1561)
// Run: cd clients/web && npx tsx smoke-redact-1561.mts
import {
  redactSensitiveHeaders,
  createFetchTracker,
  REDACTED_HEADER_VALUE,
} from "../../core/mcp/fetchTracking.ts";
import type { FetchRequestEntryBase } from "../../core/mcp/types.ts";

const line = (s: string) => console.log(s);

// ---- Part A: direct redactSensitiveHeaders with mixed casing ----
const original: Record<string, string> = {
  Authorization: "Bearer super-secret-token",
  Cookie: "session=abc123",
  "Set-Cookie": "session=abc123; HttpOnly",
  "Proxy-Authorization": "Basic zzz",
  "X-Api-Key": "sk-live-9999",
  "x-mcp-remote-auth": "Bearer inspector-backend-token",
  "Content-Type": "application/json",
  "X-Trace-Id": "trace-42",
};

const snapshot = JSON.stringify(original);
const redacted = redactSensitiveHeaders(original);

line("=== Part A: redactSensitiveHeaders (mixed casing) ===");
line("REDACTED sentinel = " + JSON.stringify(REDACTED_HEADER_VALUE));
line("");
line("BEFORE (original object):");
line(JSON.stringify(original, null, 2));
line("");
line("AFTER (returned copy):");
line(JSON.stringify(redacted, null, 2));
line("");
line("Live/original object untouched? " + (JSON.stringify(original) === snapshot));
line("Returned is a different object? " + (redacted !== original));
line("");

const expectRedacted = [
  "Authorization", "Cookie", "Set-Cookie",
  "Proxy-Authorization", "X-Api-Key", "x-mcp-remote-auth",
];
const expectKept = ["Content-Type", "X-Trace-Id"];
let ok = true;
for (const k of expectRedacted) {
  const pass = redacted[k] === REDACTED_HEADER_VALUE;
  ok &&= pass;
  line(`  [${pass ? "OK" : "FAIL"}] ${k} redacted (casing preserved: ${k in redacted})`);
}
for (const k of expectKept) {
  const pass = redacted[k] === original[k];
  ok &&= pass;
  line(`  [${pass ? "OK" : "FAIL"}] ${k} preserved = ${JSON.stringify(redacted[k])}`);
}

const caseCheck = redactSensitiveHeaders({
  authorization: "a", AUTHORIZATION: "b", "x-API-key": "c",
});
line("");
line("Case-insensitivity spot check:");
line("  " + JSON.stringify(caseCheck));
ok &&=
  caseCheck.authorization === REDACTED_HEADER_VALUE &&
  caseCheck.AUTHORIZATION === REDACTED_HEADER_VALUE &&
  caseCheck["x-API-key"] === REDACTED_HEADER_VALUE;

// ---- Part B: drive the fetch-tracker entry path end-to-end ----
line("");
line("=== Part B: createFetchTracker records a redacted entry ===");
let captured: FetchRequestEntryBase | undefined;
const fakeFetch: typeof fetch = async () =>
  new Response("pong", {
    status: 200,
    headers: { "Set-Cookie": "sess=leak-me; HttpOnly", "Content-Type": "text/plain" },
  });
const tracked = createFetchTracker(fakeFetch, {
  trackRequest: (entry) => { captured = entry; },
});

await tracked("https://example.test/mcp", {
  method: "POST",
  headers: {
    Authorization: "Bearer LIVE-TOKEN-DO-NOT-LOG",
    "x-mcp-remote-auth": "Bearer BACKEND-TOKEN",
    "Content-Type": "application/json",
  },
});

line("Recorded request headers:");
line(JSON.stringify(captured?.requestHeaders, null, 2));
line("Recorded response headers:");
line(JSON.stringify(captured?.responseHeaders, null, 2));

const reqH = captured?.requestHeaders ?? {};
const resH = captured?.responseHeaders ?? {};
const bPass =
  reqH["authorization"] === REDACTED_HEADER_VALUE &&
  reqH["x-mcp-remote-auth"] === REDACTED_HEADER_VALUE &&
  reqH["content-type"] === "application/json" &&
  resH["set-cookie"] === REDACTED_HEADER_VALUE &&
  resH["content-type"] === "text/plain";
line("Entry-path redaction correct? " + bPass);
ok &&= bPass;

line("");
line(ok ? "ALL SMOKE CHECKS PASSED ✅" : "SMOKE CHECKS FAILED ❌");
process.exit(ok ? 0 : 1);