fix(exceptions): prevent info leak from exception cause chain

[iamgp]

Summary

Fixes part of issue #348 (support module correctness batch) and issue #351 (security hardening batch).

Issue: Exception cause chain could leak internal implementation details like connection strings, query fragments, or internal paths when formatted in error output.

Fix: In PhloError._format_message(), only show the exception type name (e.g., ValueError) instead of the full message (e.g., ValueError: connection string with password=secret).

Changes

File: src/phlo/exceptions.py

• Changed f"Caused by: {type(self.cause).__name__}: {str(self.cause)}" to f"Caused by: {type(self.cause).__name__}"

File: tests/test_exceptions.py

• Updated test to expect only type name in cause string

Testing

• All 396 tests pass
• Ruff linting passes

Related Issues

Closes #348 item 2 (exception cause chain leak)
Closes #351 item 2 (Exception cause chain may leak internal implementation details)

---

[github-actions]

Cairn Quality Report

Commit: d3204f9 · View full report

Checker	Status	✅ Passed	❌ Failed	Items
ruff	passed	0	0	0
ruff-format	pass	0	0	1
pytest-3.11	passed	399	0	400
pytest-3.12	passed	399	0	400

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 3 additional findings in Devin Review.

[devin-ai-integration]

🟡 _AUTHORIZATION_SENSITIVE_PATTERN over-redacts common error context words after "authorization"

The _AUTHORIZATION_SENSITIVE_PATTERN regex \b(authorization|bearer)\b\s+\S+ unconditionally redacts whatever single word follows "authorization" or "bearer". This corrupts common error messages where these words are followed by non-sensitive context like "failed", "denied", "required", or "header".

Examples of false-positive redaction

• "authorization failed" → "authorization <redacted>" ("failed" is not a secret)
• "authorization denied" → "authorization <redacted>"
• "authorization required" → "authorization <redacted>"
• "missing authorization header" → "missing authorization <redacted>"
• "authorization error: invalid credentials" → "authorization <redacted> invalid credentials"

These are common error message patterns from HTTP clients and auth libraries. When such exceptions are wrapped as a cause in a PhloError, the diagnostic context is destroyed, making it significantly harder to debug authorization-related failures.

Prompt for agents

The _AUTHORIZATION_SENSITIVE_PATTERN at line 14 of src/phlo/exceptions.py matches any word following 'authorization' or 'bearer', causing false-positive redaction of common non-sensitive context words like 'failed', 'denied', 'required', 'header', etc.

The pattern is: r"\b(authorization|bearer)\b\s+\S+"

The intent is to catch HTTP Authorization header values like 'Authorization: Bearer <token>' or inline 'bearer <token>' patterns. But the 'authorization' alternative is too broad.

Possible fixes:
1. Remove 'authorization' from this pattern entirely since the 'bearer' alternative already catches the actual token in 'Authorization: Bearer <token>' format.
2. Make the 'authorization' alternative more specific, e.g. require a colon delimiter like 'authorization:\s+\S+' to only match header-like formats.
3. Add a negative lookahead for common non-sensitive words: 'authorization\s+(?!failed|denied|required|error|header|expired|invalid)\S+'.

Option 1 is simplest and most robust since Bearer already handles the main use case.

---

Was this helpful? React with 👍 or 👎 to provide feedback.