fix(cli): redact env vars from attempt debug logs

.changeset/redact-attempt-debug-env.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Task environment variable values are no longer included in attempt debug logs.

packages/cli-v3/src/entryPoints/managed/execution.ts

@@ -25,6 +25,7 @@ import { type SnapshotState, SnapshotManager } from "./snapshot.js";
 import type { SupervisorSocket } from "./controller.js";
 import { RunNotifier } from "./notifier.js";
 import type { TaskRunProcessProvider } from "./taskRunProcessProvider.js";
+import { getWorkloadRunAttemptStartLogData } from "./runAttemptLogData.js";
 
 class ExecutionAbortError extends Error {
  constructor(message: string) {
@@ -447,7 +448,9 @@ export class RunExecution {
  podScheduledAt: this.podScheduledAt?.getTime(),
  });
 
- this.sendDebugLog("started attempt", { start: start.data });
+ this.sendDebugLog("started attempt", {
+ start: getWorkloadRunAttemptStartLogData(start.data),
+ });
 
  return { ...start.data, metrics };
  }

packages/cli-v3/src/entryPoints/managed/runAttemptLogData.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { getWorkloadRunAttemptStartLogData } from "./runAttemptLogData.js";
+
+describe("getWorkloadRunAttemptStartLogData", () => {
+ it("omits environment variable values from the debug-log payload", () => {
+ const start = {
+ run: { friendlyId: "run_123" },
+ snapshot: { friendlyId: "snapshot_123" },
+ execution: { id: "execution_123" },
+ envVars: { API_KEY: "secret-value" },
+ };
+
+ expect(getWorkloadRunAttemptStartLogData(start)).toEqual({
+ run: start.run,
+ snapshot: start.snapshot,
+ execution: start.execution,
+ });
+ });
+});

packages/cli-v3/src/entryPoints/managed/runAttemptLogData.ts

@@ -0,0 +1,13 @@
+type WorkloadRunAttemptStartData = {
+ run: unknown;
+ snapshot: unknown;
+ execution: unknown;
+ envVars: Record<string, string>;
+};
+
+export function getWorkloadRunAttemptStartLogData<T extends WorkloadRunAttemptStartData>(
+ start: T
+): Pick<T, "run" | "snapshot" | "execution"> {
+ const { run, snapshot, execution } = start;
+ return { run, snapshot, execution };
+}