Inspiration
Our hackathon starter kit was an Agent platform that runs model-generated shell commands inside a real workspace. Two things made us nervous every time we demoed it. First, when a run failed, all we got back was a single error string — no idea which step broke, what command ran, or where the time went. Second, the agent reads API keys from its environment and from files, and then happily echoes them back into chat replies, error messages, and logs. One screenshot of a failed run could leak a live credential. We wanted to fix both without asking anyone to change how they use the platform.
What it does
It's a trace, audit, and secret-redaction middleware that sits over the platform's existing runner seam.
- Every Agent Run becomes a diagnosable trace — a tree of categorized spans (model calls, tool calls, sandbox execution, workspace ops, policy decisions) with status, duration, and the real error. There are Tree and Timeline views, a "jump to the failing step" button, linked retry chains, live streaming over SSE, and JSON export.
- No credential reaches a stored or displayed artifact. One detection engine spots vendor API keys, JWTs, private keys, URL credentials, and
password/token/secretassignments, plus the deployment's own keys. It scrubs the agent's reply and errors before they're returned, and runs every trace span through the same engine before anything is written to disk. What's kept is a{rule, count}summary — never the value. - A real guardrail, not just a log — prompts are checked against a size-limit policy before they reach the runtime, recorded as a policy-decision span; a blocked run never invokes the model.
How we built it
A RedactingRunner decorator wraps whichever runner is active (local process or container), so one implementation covers both runtime profiles with no fork. Redaction happens before storage, not before display — a secret on disk has already leaked — so the trace store and the API error handler both call the same pure redaction.ts function. The detection engine is backed by a corpus test: ~30 real secret formats must redact, and a false-positive corpus of git SHAs, UUIDs, and lockfile hashes must not.
Why it matters
An agent platform that runs untrusted output is only trustworthy if you can see what it did and know that watching it won't expose your secrets. This middleware makes every run auditable and safe-by-construction for every downstream reader — UI, API, export, and logs — without changing the platform's interface.
What's next
Rewrite secrets in workspace files (not just the return channel), catch bare high-entropy secrets with no surrounding context, and extend the placeholder allowlist beyond English.
Log in or sign up for Devpost to join the conversation.