fix: redact credentials from URLs in logs, exceptions, and persisted state

[jpshackelford]

Summary

Fixes #2152

This PR addresses a security issue where credentials embedded in plugin source URLs (e.g., https://oauth2:SECRET_TOKEN@gitlab.com/org/private-repo) were being exposed in:

1. Application logs - Clone URLs and git commands were logged with credentials visible
2. Exception messages - Error messages included full URLs with credentials
3. Persisted conversation state - Plugin source URLs with credentials were stored in ResolvedPluginSource

Changes

• New utility function: redact_url_credentials(url) in git/utils.py that replaces credentials in URLs with **** (e.g., https://****@gitlab.com/org/repo)
• Updated run_git_command(): Redacts credentials from error logs, debug logs, and GitCommandError exception messages/command fields
• Updated cached_repo.py: Redacts credentials in clone log messages
• Updated plugin/fetch.py: Redacts credentials in PluginFetchError exceptions and warning logs
• Updated plugin/types.py: ResolvedPluginSource.from_plugin_source() now redacts credentials before persistence (credentials are only needed at fetch time)
• Public API export: redact_url_credentials is exported from openhands.sdk for cross-repo usage (related to Security: Credentials in plugin source URLs exposed via API responses OpenHands#12959)

Example

Before:

INFO - Cloning repository from https://oauth2:SECRET_TOKEN@gitlab.com/org/repo.git

After:

INFO - Cloning repository from https://****@gitlab.com/org/repo.git

Checklist

• If the PR is changing/adding functionality, are there tests to reflect this?
• If there is an example, have you run the example to make sure that it works?
• If there are instructions on how to run the code, have you followed the instructions and made sure that it works?
• If the feature is significant enough to require documentation, is there a PR open on the OpenHands/docs repository with the same branch name?
• Is the github CI passing?

@jpshackelford can click here to continue refining the PR

---

Agent Server images for this PR

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	eclipse-temurin:17-jdk	Link
python	amd64, arm64	nikolaik/python-nodejs:python3.13-nodejs22	Link
golang	amd64, arm64	golang:1.21-bookworm	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:e05f9de-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-e05f9de-python \
  ghcr.io/openhands/agent-server:e05f9de-python

All tags pushed for this build

ghcr.io/openhands/agent-server:e05f9de-golang-amd64
ghcr.io/openhands/agent-server:e05f9de-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:e05f9de-golang-arm64
ghcr.io/openhands/agent-server:e05f9de-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:e05f9de-java-amd64
ghcr.io/openhands/agent-server:e05f9de-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:e05f9de-java-arm64
ghcr.io/openhands/agent-server:e05f9de-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:e05f9de-python-amd64
ghcr.io/openhands/agent-server:e05f9de-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-amd64
ghcr.io/openhands/agent-server:e05f9de-python-arm64
ghcr.io/openhands/agent-server:e05f9de-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-arm64
ghcr.io/openhands/agent-server:e05f9de-golang
ghcr.io/openhands/agent-server:e05f9de-java
ghcr.io/openhands/agent-server:e05f9de-python

About Multi-Architecture Support

• Each variant tag (e.g., e05f9de-python) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., e05f9de-python-amd64) are also available if needed

[github-actions]

API breakage checks (Griffe)

Result: Passed

Action log

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
openhands-sdk/openhands/sdk
__init__.py	22	2	90%	76–77
openhands-sdk/openhands/sdk/git
cached_repo.py	129	4	96%	391–392, 427–428
utils.py	126	26	79%	125–127, 152–154, 188–189, 196–201, 206–207, 217–222, 232–234, 262
openhands-sdk/openhands/sdk/plugin
fetch.py	79	9	88%	156–157, 159, 167–168, 172, 338–339, 343
types.py	198	5	97%	64, 67, 253, 584, 591
TOTAL	19813	5761	70%

[github-actions]

Agent server REST API breakage checks (OpenAPI)

Result: Failed

Log excerpt (first 1000 characters)

{"asctime": "2026-03-10 01:44:47,482", "levelname": "WARNING", "name": "openhands.agent_server.config", "filename": "config.py", "lineno": 173, "message": "\u26a0\ufe0f OH_SECRET_KEY was not defined. Secrets will not be persisted between restarts."}
::error title=openhands-agent-server REST API::Breaking REST API change detected without MINOR version bump (1.12.0 -> 1.12.0).

Breaking REST API changes detected compared to baseline release:
- the 'file' request property type/format changed from 'string'/'' to 'string'/'binary'
/home/runner/work/software-agent-sdk/software-agent-sdk/.venv/lib/python3.13/site-packages/litellm/llms/custom_httpx/async_client_cleanup.py:66: DeprecationWarning: There is no current event loop
  loop = asyncio.get_event_loop()

Action log

[all-hands-bot]

🟢 Good taste - Clean security fix with pragmatic design.

Key Insight: Simple regex-based redaction applied consistently across logs, exceptions, and persisted state. The decision to redact credentials in ResolvedPluginSource is sound design - credentials are only needed at fetch time, and resolved plugins reference local cached paths for subsequent access.

What Works:

• Focused redact_url_credentials() function does one thing well
• Comprehensive test coverage testing real behavior (not mocks) ✓
• Handles edge cases correctly (ports, special chars, SSH URLs unchanged)
• Applied consistently: logs, error messages, exceptions, persistence

Design Decision (Good):
Redacting in ResolvedPluginSource.from_plugin_source() prevents credential leakage in conversation state without breaking functionality - resolved plugins use cached repo_path, so re-authentication not needed.

✅ Worth merging - Solves real security problem (#2152) with minimal complexity. No agent behavior changes, just safer logging and persistence.