From 93de6fbb228fdcd9cd2b82f715ddfa9b698a44eb Mon Sep 17 00:00:00 2001 From: jariy17 Date: Mon, 31 Aug 2026 18:07:14 +0000 Subject: [PATCH] fix(eval): mark --header and --bearer-token sensitive in eval simulate Follow-up to #2071. These flags carry secrets (CUSTOM_JWT bearer token, auth headers) but were logged in cleartext by the withLogging debug middleware. The canonical 'runtime invoke' handler already marks both sensitive; apply the same to the on-demand and batch-evaluation simulate handlers. --- src/handlers/eval/batch-evaluation/simulate/index.tsx | 5 ++++- src/handlers/eval/ondemand/simulate/index.tsx | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/handlers/eval/batch-evaluation/simulate/index.tsx b/src/handlers/eval/batch-evaluation/simulate/index.tsx index 4246021fe..2573b6a3a 100644 --- a/src/handlers/eval/batch-evaluation/simulate/index.tsx +++ b/src/handlers/eval/batch-evaluation/simulate/index.tsx @@ -21,11 +21,14 @@ export const createSimulateBatchEvaluationHandler = (core: Core, _io: AppIO) => 'JSON payload template; {input} is the scenario input, e.g. {"prompt":"{input}"}', z.string().optional(), ), - flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional()), + flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional(), { + sensitive: true, + }), flag( "bearer-token", "CUSTOM_JWT bearer token (for JWT-auth runtimes)", z.string().optional(), + { sensitive: true }, ), flag("user-id", "runtime user id", z.string().optional()), flag("dataset", "dataset source: local JSONL path or a dataset id", z.string().optional()), diff --git a/src/handlers/eval/ondemand/simulate/index.tsx b/src/handlers/eval/ondemand/simulate/index.tsx index 37c0b41db..094b8a4be 100644 --- a/src/handlers/eval/ondemand/simulate/index.tsx +++ b/src/handlers/eval/ondemand/simulate/index.tsx @@ -22,11 +22,14 @@ export const createSimulateOnDemandHandler = (core: Core, _io: AppIO) => 'JSON payload template; {input} is the scenario input, e.g. {"prompt":"{input}"}', z.string().optional(), ), - flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional()), + flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional(), { + sensitive: true, + }), flag( "bearer-token", "CUSTOM_JWT bearer token (for JWT-auth runtimes)", z.string().optional(), + { sensitive: true }, ), flag("user-id", "runtime user id", z.string().optional()), flag("dataset", "dataset source: local JSONL path or a dataset id", z.string().optional()),