fix(security): redact clear-text logging surfaces (wave 1)

[KooshaPari]

Summary

• redact raw request/response payload bytes before request logging
• replace websocket log URL/session disclosure with endpoint+hashed session labels
• hash registry client/model IDs in suspension debug logs

Verification

• go test ./pkg/llmproxy/api/middleware ./pkg/llmproxy/registry
• note: executor package test baseline on main currently has unrelated compile failures (gemini_cli_executor_model_test: normalizeGeminiCLIModel)

Security

Targets open CodeScanning clear-text logging findings in these files.

General approach: Do not log the raw error value coming from thinking.ApplyThinking (or any error that may encapsulate sensitive model/alias info) in clear text. Instead, log only non-sensitive, high-level information: whether an error occurred, a generic reason, and possibly a safe, coarse-grained classification (e.g., error type/code) that does not contain user- or tenant-specific data.

Best targeted fix: Modify logCodexWebsocketDisconnected in pkg/llmproxy/executor/codex_websockets_executor.go so that when err is non-nil, we do not interpolate err directly with %v. Instead:

• Detect whether err is a *thinking.ThinkingError and, if so, log only its Code (and maybe a generic message) rather than the full error string.
• For non-thinking errors, log a generic string such as "internal_error" or just omit the error details.
• Keep existing sanitization for sessionID, authID, and wsURL via sanitizeCodexSessionID, sanitizeCodexWebsocketLogField, and sanitizeCodexWebsocketLogEndpoint.

Concretely:

1. Update the if err != nil block in logCodexWebsocketDisconnected:

   • Replace err=%v with err=%s and pass a redacted string returned by a new helper, e.g., sanitizeCodexError(err).

2. Introduce a new helper function in the same file, e.g.:

   func sanitizeCodexError(err error) string {
       if err == nil {
           return ""
       }
       // Avoid leaking sensitive details; provide only coarse-grained info.
       if te, ok := err.(*thinking.ThinkingError); ok && te != nil {
           if te.Code != "" {
               return fmt.Sprintf("thinking_error(%s)", te.Code)
           }
           return "thinking_error"
       }
       return "error"
   }

   This uses only existing imports (fmt and thinking are already imported in this file).

3. Ensure no other code changes are required: callers still pass the same err value, but the log line is now safe because it no longer prints the raw error string.

No changes are required in the other files (sdk/cliproxy/auth/conductor.go, pkg/llmproxy/registry/*.go, pkg/llmproxy/thinking/*.go) since they are not directly responsible for logging; they only participate in the dataflow.

---

In general terms, the fix is to ensure that any error value (err) that may encapsulate sensitive information (here, model IDs from API key–specific aliasing) is not logged in clear text. Instead, log only non-sensitive metadata (e.g., that an error occurred, session identifiers already sanitized, reason string) or a redacted form of the error.

In this codebase, the problematic logging happens in logCodexWebsocketDisconnected in pkg/llmproxy/runtime/executor/codex_websockets_executor.go:

if err != nil {
    log.Infof("codex websockets: upstream disconnected session=%s auth=%s endpoint=%s reason=%s err=%v", ...)
    return
}

To fix this without changing external behavior of the executor, we can keep the fact that an error occurred but remove or neutralize the direct %v formatting of err. Since we are not allowed to change imports outside the shown snippet and we already have logrus imported, we can simply:

• Change the logging to avoid printing err altogether, or
• Replace it with a generic placeholder (e.g., "err=failed") that does not include sensitive content.

Given the project’s patterns (it already uses redaction helpers for other log fields), the most conservative and simple fix is to drop the error detail from this high-level info log and rely on other, lower-level logs to capture error specifics if needed. Concretely:

• In logCodexWebsocketDisconnected, replace the Infof call in the err != nil branch with a version that omits err from the format string and arguments.
• Leave the rest of the function and file unchanged; no new imports or helper methods are necessary.

This ensures that no sensitive data inside err (including possible model IDs) is logged in clear text while preserving the operational signal that a disconnection occurred and whether it was due to an error.

---