Skip to content

feat(observability): allowlist phase-label names to prevent path/secret leakage in TUI #1035

Description

@sahrizvi

Deferred from the v0.9.3 pre-release review.

Current behavior

SessionStatus.publishPhase(name, ...) in packages/opencode/src/session/status.ts accepts any string for the name argument. Today the set produced by bootstrap.* spans is static and benign, and the TUI's packages/tui/src/util/phase-label.ts falls back to "Thinking..." on unknown names.

Gap

There is no validation at the publishPhase call site that the name is limited to a registered set. A future span whose name accidentally embeds a filesystem path, a secret, or a sensitive env reference would surface as a user-visible TUI label without any signal that it was unintended.

Proposal

Add a Set<string> of known phase names. publishPhase logs a warning (not throws) when an unregistered name is used and drops the label. Cover with a unit test that asserts a warning fires on an unregistered name so a regression is loud.

Why deferred

Guardrail against a future regression; the current phase-name set is static and benign so there is no user-visible risk today.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions