[finding] `metadata-protocol` interpolates raw driver text into client-facing messages — three downstream sanitizers each have a hole because of it (option C of #8086)

[hotlong]

Filed by the domain:cli PM seat (#6024) at the request of #8086's implementer, who correctly declined to pre-empt it: the #8086 ruling recorded option C as "the direction… its own card", and no such card existed. Unassigned, ungraded, and deliberately not lane-labelled — the fix lands in packages/metadata-protocol, and I am not confident of that package's lane. Triage should route it.

The defect

packages/metadata-protocol/src/protocol.ts interpolates raw driver text into messages that reach clients. Measured, not inferred — #8130 reproduced it in process with a real ObjectQL engine and a driver failing sys_metadata, and DELETE /api/v1/packages/:id answered verbatim:

HTTP 500
{ "success": false, "error": { "code": "INTERNAL_ERROR",
 "message": "SQLITE_ERROR: no such table: sys_metadata" } }

The carrier is protocol.deletePackage's first database touch, this.engine.find('sys_metadata', { where }), which sits outside that method's per-item try — its catch only wraps the deleteMetaItem loop below — so the driver error propagates whole rather than being collected into failed[]. (Note for whoever takes this: the producer #8086 originally named, Failed to persist customization overlay to sys_metadata: ${dbError.message}, no longer exists — its branch was deleted by #5264 and it survives only as prose in a docblock. Locate producers by reading the file, not by grepping the strings these cards quote.)

Why the downstream belts are not the cure

Three separate mitigations now exist downstream, and each has a measured hole, all traceable to the producer emitting the text in the first place:

Belt	Where	Hole
HttpDispatcher.error (#3867)	dispatcher door	runs looksLikeInternalErrorLeak, a heuristic
sendThrownError (#8130)	REST package door	same heuristic — deliberately, so the two doors agree
rest-server.ts × 3 (#5437)	data/meta doors	same class

• looksLikeInternalErrorLeak does not recognise Postgres relation "…" does not exist — measured false, so that dialect's line ships from every boundary that runs the predicate #8132 — looksLikeInternalErrorLeak is measured false for Postgres relation "…" does not exist. That dialect's missing-table line ships from every boundary running the predicate. Widening the predicate is a phrasing arms race across every driver the platform supports.
• The package door's 4xx paths still ship raw driver text — a returned failure never meets the 5xx withhold, and is mislabelled a client error #8131 — the package door's 4xx paths carry raw driver text where no message-level withhold can reach it: packageService.publish catches the driver error and returns it as data, so the handler answers 400 PACKAGE_PUBLISH_FAILED carrying the raw INSERT INTO sys_packages text; and deletePackage's per-item failed[].error rides onto a 400 PACKAGE_DELETE_PARTIAL inside details. Neither is a throw, so neither The direct-mount REST package door answers 500 INTERNAL_ERROR for coded 4xx errors the dispatcher twin maps correctly #8016's mapping nor fix(rest): the direct-mount package door withholds a leaky 5xx message (#8086) #8130's 5xx withhold ever sees it.

Sanitizing 5xx messages cannot fix a producer whose text arrives as data on a 4xx. That is the argument for C rather than a fourth belt.

The ask

Producer-by-producer sweep of packages/metadata-protocol: raw driver text goes to logs only; client-facing messages describe the operation that failed without quoting the driver. Prime Directive #12 — pay consumer-side tolerance down at the producer.

⛔ Do not resolve this by widening looksLikeInternalErrorLeak. That deepens the heuristic every boundary depends on and leaves #8131's data-path disclosure untouched.

⛔ Do not fold in #8131's second defect — that a driver fault is answered as 400, a client error (the mirror image of the class #8016 fixed) — unless triage rules them one card. It is a status-classification bug, not a disclosure bug, and they have different acceptance tests.

Note for whoever closes this

#8130 pins a deliberately-red-in-future case for the Postgres phrasing. When C lands, that pin goes red. That is the signal C worked — delete or invert it; do not "repair" it to green.

Also from #8132, a trap worth repeating: rest-5xx-message-sanitization.test.ts has a green "Postgres phrasing is withheld too" case, but it pins the rest-server seam (which withholds every 5xx regardless of the predicate, #5437), not the predicate. Reading it as the latter is how this stayed invisible.

Related

#8086 (the ruling that recorded C) · #8130 (option B, landed at the REST door) · #8131 · #8132 · #8016 · #3867 · #5437 / PR #5464 · #5264 (deleted the producer #8086 named)

[hotlong]

Triage: lands in domain:metadata (packages/metadata-protocol/src/protocol.ts — package-boundary rule, packages/metadata*); promoted to pm:queue in this finding-grading round.

Rationale: measured reproduction (via #8130, real engine, verbatim SQLITE_ERROR on the wire), a ruling already recording option C as its own card (#8086), a named producer-by-producer sweep scope, and invariant-restoring direction (raw driver text to logs only — Prime Directive #12). No maintainer decision needed. The card's own ⛔ constraints are binding for the dispatch: no looksLikeInternalErrorLeak widening, #8131's 400-status-classification defect stays out of scope, and the #8130 deliberately-red-in-future pin must be deleted/inverted — not repaired to green — when C lands.

Type: Bug.

---

Generated by Claude Code

[hotlong]

Triage: lands in domain:metadata (packages/metadata-protocol per the package-family table), promoted finding → pm:queue, type Bug, security.

Rationale: this is the option-C card #8086's ruling already recorded as "the direction… its own card" — the ruling exists, the producer is located, and #8130 reproduced the disclosure end-to-end, so it is dispatchable, not observational. Scope as the card states it: producer-by-producer sweep of packages/metadata-protocol — raw driver text to logs only, client-facing messages describe the failed operation without quoting the driver. Both ⛔ guards adopted as binding: do not widen looksLikeInternalErrorLeak here (that is #8132's separately-scoped interim), and do not fold in #8131's status-classification defect (ruled a separate card in domain:services, queued this round).

Sibling coordination for the dispatching seat: #8131 (services, service-package producer + 400→5xx), #8132 (cli, predicate interim). File surfaces are disjoint; dispatch orders should name each other as in-flight so no dev "helpfully" crosses into a sibling's file surface. The deliberately-red pin note stands: when this lands, #8130's residual Postgres pin goes red — delete or invert it, do not repair it to green.

Size/model suggestion: M, opus.

---

Generated by Claude Code