fix(selfhost): trim and redact D1 probe API token in probe errors

[JSONbored]

Motivation

• Prevent accidental disclosure of the Cloudflare D1 API token when header construction or fetch errors include the raw token in error messages.
• Make the probe opt-in safe by refusing obviously-broken tokens that could cause rejected-header errors.

Description

• Trim CLOUDFLARE_D1_MONITOR_API_TOKEN and reject config when the token is empty or contains control characters in resolveD1SizeProbeConfig (src/selfhost/d1-size-probe.ts).
• Add redactD1ProbeSecret and update the probe error logger to redact the configured token from logged error messages before writing JSON logs, and change the logger to accept the probe config so it can access config.apiToken (src/selfhost/d1-size-probe.ts).
• Route both the database-info and per-table fetch failure paths through the new redacting logger while preserving the existing stale-sample fallback semantics (src/selfhost/d1-size-probe.ts).
• Add unit tests covering token trimming, control-character rejection, and redaction of the API token from logged probe errors, and ensure mocks are restored between tests (test/unit/selfhost-d1-size-probe.test.ts).

Testing

• Ran the probe unit tests with npx vitest run test/unit/selfhost-d1-size-probe.test.ts, which passed (29 tests).
• Ran TypeScript typecheck with npm run typecheck -- --pretty false, which passed.
• Ran the self-host env reference check with npm run selfhost:env-reference:check, which passed.
• Attempted full coverage with npm run test:coverage and npm run test:ci, but the broader suite coverage run encountered unrelated test/coverage infra issues in the full test suite (existing queue.test.ts stack overflow and coverage tooling error); these issues are external to the changes in this PR.
• Attempted dependency audit with npm audit --audit-level=moderate, but the registry audit endpoint returned 403 Forbidden in this environment (external issue).

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.74%. Comparing base (f46aa4a) to head (06bfefa).
⚠️ Report is 52 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4361   +/-   ##
=======================================
  Coverage   93.74%   93.74%           
=======================================
  Files         387      387           
  Lines       36398    36400    +2     
  Branches    13330    13330           
=======================================
+ Hits        34120    34122    +2     
  Misses       1621     1621           
  Partials      657      657           

Files with missing lines	Coverage Δ
src/selfhost/d1-size-probe.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-09 04:46:11 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This PR trims and validates the CLOUDFLARE_D1_MONITOR_API_TOKEN in resolveD1SizeProbeConfig (rejecting empty or control-character-containing tokens) and adds redactD1ProbeSecret to strip the token out of logged probe error messages before truncation. Both fetch-failure call sites in runD1SizeProbe were updated to pass config through to the logger, and the redact-then-slice ordering is correct (avoids leaking a truncated, partially-redacted token). Tests exercise the trimmed-token header value, control-character rejection, and end-to-end log redaction with a real thrown error, and properly restore mocks between tests.

Nits — 4 non-blocking

• redactD1ProbeSecret (src/selfhost/d1-size-probe.ts) does a literal substring match — if a thrown error ever contained the token in an encoded/escaped form (URL-encoded, JSON-escaped), it would not be redacted; low risk given the current call sites but worth noting the assumption.
• The PR description doesn't link an open issue — worth asking for one per repo convention, though the change itself is a narrow, well-scoped security fix rather than scope creep.
• Consider a short code comment on redactD1ProbeSecret noting it only catches an exact literal match, so future call sites that might encode/transform the token before throwing aren't assumed to be covered.
• Ask the contributor to link the eligible open issue this closes, per repo contribution policy.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 49 registered-repo PR(s), 41 merged, 504 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 49 PR(s), 504 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 49 PR(s), 504 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review