From 5fc2d9e64d960b666c56476e4467ea46a556ccb7 Mon Sep 17 00:00:00 2001 From: Ben Barclay Date: Thu, 16 Jul 2026 08:44:43 +1000 Subject: [PATCH] docs(auth): scrub Fly.io host detail from quarantine-log comment (#60145) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hermes-agent is public/OSS; the forensic-logging comment in _quarantine_nous_oauth_state named 'Fly' (the specific managed-hosting compute provider) twice. Reword generically ('a hosted agent', 'a managed log drain may be WARNING-only') — the behaviour is unchanged, only the comment. Follows the same scrub applied to the boot re-seed helper (#59983) before merge; this one slipped through in #59976. --- hermes_cli/auth.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hermes_cli/auth.py b/hermes_cli/auth.py index 8804bcbeca15..24fc0da192a4 100644 --- a/hermes_cli/auth.py +++ b/hermes_cli/auth.py @@ -4923,11 +4923,11 @@ def _quarantine_nous_oauth_state( reason: str, ) -> None: """Keep routing metadata but remove dead OAuth material so it is not replayed.""" - # Forensic logging BEFORE we clear the token material. A NAS-hosted Fly agent + # Forensic logging BEFORE we clear the token material. A hosted agent # can take a terminal invalid_grant and get quarantined here silently: the # only downstream signal is a "No access token found" WARNING once the pool - # is already empty, which is too late to root-cause. The Fly log drain is - # WARNING-only, so this MUST be logger.warning (INFO never reaches the drain). + # is already empty, which is too late to root-cause. A managed log drain may + # be WARNING-only, so this MUST be logger.warning (INFO never reaches it). # # Redaction safety: emit ONLY the 12-char SHA-256 hex prefix of the refresh # token (correlates to NAS's refreshTokenHash without leaking the secret) plus