mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
## Why Remote plugin bundle download URLs can contain signature tokens in query parameters. Including the full URL in errors or debug output exposes those tokens. ## What changed Omit the download URL from `ValidatedRemotePluginBundle` debug output. Report download hosts instead of full URLs, strip URLs from underlying HTTP errors, and report only the scheme for unsupported final URLs. Invalid URL errors retain the parse error without echoing the input. ## Testing Extend tests to check that signature tokens stay out of bundle debug output, unsupported final URL errors, and app-server installation errors while preserving signed request URLs and HTTP status diagnostics. GitOrigin-RevId: 8edda4847feae4f2bcb12fbb414a3a25bde53814