[spark-compete] [severity:2] fix(chipLoop): err.stderr not redacted — raw subprocess output in error string

src/chipLoop.ts

@@ -5,6 +5,7 @@ import { promisify } from 'node:util';
 import { resolvePythonCommand } from './pythonCommand';
 import { withHiddenWindows } from './hiddenProcess';
 import { resolveBuilderRepoPath } from './builderRepoPath';
+import { redactText } from './redaction';
 
 const execFileAsync = promisify(execFile);
 
@@ -71,7 +72,7 @@ export async function runChipLoop(chipKey: string, rounds: number, suggestLimit
       error: parsed.error ?? undefined,
     };
   } catch (err: any) {
-    const stderr = typeof err?.stderr === 'string' ? err.stderr.slice(-400) : '';
+    const stderr = typeof err?.stderr === 'string' ? redactText(err.stderr.slice(-400)) : '';
     return { ok: false, error: err?.message ? `${err.message}${stderr ? ': ' + stderr : ''}` : 'loop exec failed' };
   }
 }

tests/test_chip_loop_redact.test.ts

@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+
+function redactText(text: string): string {
+	return text.replace(/\S{8,}/g, '[REDACTED]');
+}
+
+function buildLoopError(errMsg: string, stderrRaw: string): { ok: boolean; error: string } {
+	const stderr = stderrRaw ? redactText(stderrRaw.slice(-400)) : '';
+	return { ok: false, error: errMsg ? `${errMsg}${stderr ? ': ' + stderr : ''}` : 'loop exec failed' };
+}
+
+describe('chipLoop stderr redaction', () => {
+	it('raw stderr not included in error string', () => {
+		const res = buildLoopError('exec failed', 'SECRET_TOKEN=abc123xyz long secret value');
+		expect(res.error).not.toContain('abc123xyz');
+	});
+	it('result is not ok', () => {
+		expect(buildLoopError('err', 'stderr').ok).toBe(false);
+	});
+	it('error message contains redacted sentinel', () => {
+		const res = buildLoopError('exec failed', 'longpasswordsecretvalue');
+		expect(res.error).toContain('[REDACTED]');
+	});
+	it('falls back to loop exec failed when no message', () => {
+		const res = buildLoopError('', '');
+		expect(res.error).toBe('loop exec failed');
+	});
+	it('original error message is preserved', () => {
+		const res = buildLoopError('chip loop failed', 'secretdata12345');
+		expect(res.error).toMatch(/^chip loop failed/);
+	});
+});