fix(sandbox): replay redaction without secret-shaped history

[seonghobae]

Replacement purpose

Replace #842 with a clean-history branch from exact protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba while preserving #842 and #841 as historical evidence.

RCA

Symptom

#842 exact head c05d52742a1f2c1d28f7e5f80ff6358d70518c43 still failed Secret Scan run 31308773307 and GitHub Advanced Security recreated four unresolved gitleaks threads.

Immediate cause

The findings explicitly bind old commit 9d24ea60ac9a281b7ac9d855ad4c86e3b68db182, where test fixtures contained complete private-key markers and generic API-key-shaped literals.

Root cause and owner

Secret scanning evaluates reachable pull-request history, not only the corrected final blobs. #842 fixed the current source by synthesizing credential-shaped values at runtime, but the old fixture-bearing commits remained reachable. This is branch-history evidence owned by the repository, not a real credential or a current-source redaction defect.

Remedy selection

Rejected:

• force-push/rebase or history rewriting;
• dismissing or weakening Secret Scan;
• restoring raw signatures or suppressing tests;
• rerunning the unchanged failing history.

Implemented:

• create a new branch from exact current protected main;
• carry only the ten final fix(sandbox): redact credential-shaped subprocess evidence #842 file blobs in one non-force fast-forward commit;
• preserve subprocess/process semantics, bounded diagnostics, stdout/stderr/timeout/service-tail redaction tests, doctoring, and workflow pins;
• leave predecessor PRs intact for audit history.

Exact identity

• base: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• head: 6c1a6369fd62a52c61d023a0d7011bb3b63168b3;
• one commit, ten files;
• every final file blob matches fix(sandbox): redact credential-shaped subprocess evidence #842 exact head;
• no force update or destructive history operation was used.

Acceptance

Merge only after the exact clean head passes Sandbox Log Redaction Quality CI, Secret Scan, all required security/dependency checks, current automated review, a qualifying independent non-author formal approval, and repository protection. After protected integration, run synthetic credential-shaped protected-main acceptance for completed stdout/stderr, timeout bytes, and service tails before closing the incident.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c3c0e783-199a-4fec-ac84-f21e3cea503c

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb06cd and 2853052.

📒 Files selected for processing (10)

• .github/workflows/sandbox-log-redaction-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/sandbox-log-redaction.md
• scripts/ci/redact_sensitive_log.py
• scripts/ci/sandboxed_verify.py
• scripts/ci/sandboxed_web_e2e.py
• tests/test_opencode_security_boundaries.py
• tests/test_sandboxed_log_redaction_regression.py
• tests/test_sandboxed_verify.py
• tests/test_sandboxed_web_e2e.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

@cwl-noema-review @opencode-agent Review only exact clean-history head 6c1a6369fd62a52c61d023a0d7011bb3b63168b3. Every exact-head deterministic/security/supply-chain workflow, including Sandbox Log Redaction Quality CI and Secret Scan, is now successful. Verify that the ten current blobs preserve the final #842 stdout/stderr/timeout/service-tail redaction behavior while excluding the predecessor secret-shaped history; subprocess/process semantics, bounded diagnostics, result markers, exact action pins, and fail-closed behavior remain intact. Historical #841/#842 findings are evidence only. Review only; do not modify, merge, retarget, synthesize approval, or alter credentials/rulesets.

[coderabbitai]

@seonghobae I will review only exact head 6c1a6369fd62a52c61d023a0d7011bb3b63168b3 for #888. I will treat #841 and #842 as historical evidence only. I will not modify, merge, retarget, approve, or change credentials or rulesets.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Blocking exact-head revalidation

Do not merge current head 6c1a6369fd62a52c61d023a0d7011bb3b63168b3 yet.

Read-only comparison shows that scripts/ci/redact_sensitive_log.py is blob 1eb684086d34e7ec1a22dcde99c76033d15fc978 (576 lines), identical to closed #842. The later hardened working-tree implementation and its adversarial fixtures were not included in this commit.

A concrete gap remains in the committed source: redact_command_argv() has no program-aware short-option handling, and SENSITIVE_COMMAND_OPTIONS does not classify -p. Consequently Docker/Podman login argv shaped as login -p <credential> can preserve the credential when it is not also supplied through sensitive_values. The exact-head green checks do not cover this path.

The newer candidate had also addressed nested env -S / shell wrappers, JSON atomicity and duplicate-key/layout cases, terminal-control canonicalization, and polynomial/recursive scanner paths. Those changes must be recovered or reapplied on clean history, followed by exact-head adversarial tests, full regression/coverage, Secret Scan, and Sandbox Log Redaction Quality CI.

Current governance remains blocked independently: zero formal approvals are recorded.

[seonghobae]

Closing without merge because the branch's reachable history no longer satisfies its clean-history acceptance contract.

Exact-head Secret Scan run 31319880976 correctly re-detected the credential-shaped fixture introduced by predecessor commit 645cd792d6bebbbdc1558943f7393e22370499df; replacing the current blob could not remove that reachable evidence.

Draft successor #906 starts from exact protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba and carries the ten corrected final file blobs without force-push, rebase, scan suppression, or the fixed literal. #888 remains immutable incident evidence and its writer lease ends here.

#906 is deliberately Draft: the direct Docker/Podman login leak repair is present, while bounded wrapper recursion and atomic multiline/duplicate-key JSON redaction remain explicit source-review blockers.