fix(security): redact invalid Bedrock bearer credentials

[HAYDEN-OAI]

Summary

• Keep invalid Amazon Bedrock bearer credentials out of native HTTP-header error messages, stacks, causes, and uncontrolled logs.
• Apply the same narrow, cause-free TypeError sanitization to dependency-free and AWS-backed Bedrock providers and the existing BedrockOpenAI client.
• Preserve valid authorization values, credential-provider failures, custom caller-header diagnostics, request-header identity, redirect protections, and network behavior.

Regression-first proof

The new real-public-client regression produced 37 failing / 12 passing cases before the production change; all 49 cases pass afterward. Coverage spans static and rotating credentials across all three public Bedrock entrypoints, malformed line-feed/carriage-return/CRLF/NUL/Unicode values, default logging, absent causes, unsent requests, caller-header isolation, provider-error identity, and valid authentication.

A focused inline lint exception documents why preserving the original credential-bearing error as cause would recreate the privacy issue.

Verification

• 349 focused Bedrock tests passing.
• 3,878 handwritten tests across 122 files passing.
• 559 generated tests across 82 files passing against an isolated random-port mock.
• Repository formatting/lint and strict TypeScript.
• Full CommonJS/ESM package build; published-source TypeScript 4.9 and current TypeScript.
• publint (only the pre-existing vendor warning) and packed-package Node 22 checks.
• 24 additional built-package CJS/ESM privacy checks across dependency-free, AWS-backed, and legacy Bedrock clients with both static and rotating credentials.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 11.448s for Node SDK PR #2419.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	165ms
tests/chat-completions-create.test.ts	✅ Passed	293ms
tests/chat-completions-stream.test.ts	✅ Passed	226ms
tests/files-content-binary.test.ts	✅ Passed	154ms
tests/files-create-multipart.test.ts	✅ Passed	160ms
tests/files-list-pagination.test.ts	✅ Passed	189ms
tests/initialize-config.test.ts	✅ Passed	184ms
tests/instance-isolation.test.ts	✅ Passed	111ms
tests/models-list.test.ts	✅ Passed	166ms
tests/responses-background-lifecycle.test.ts	✅ Passed	236ms
tests/responses-body-method-errors.test.ts	✅ Passed	394ms
tests/responses-cancel-timeout.test.ts	✅ Passed	241ms
tests/responses-cancel.test.ts	✅ Passed	224ms
tests/responses-compact-retries.test.ts	✅ Passed	269ms
tests/responses-compact.test.ts	✅ Passed	231ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	190ms
tests/responses-create-advanced.test.ts	✅ Passed	261ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.144s
tests/responses-create-errors.test.ts	✅ Passed	393ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	177ms
tests/responses-create-retries.test.ts	✅ Passed	268ms
tests/responses-create-stream-failures.test.ts	✅ Passed	214ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.177s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.719s
tests/responses-create-stream.test.ts	✅ Passed	135ms
tests/responses-create-terminal-states.test.ts	✅ Passed	353ms
tests/responses-create-timeout.test.ts	✅ Passed	257ms
tests/responses-create.test.ts	✅ Passed	239ms
tests/responses-delete.test.ts	✅ Passed	225ms
tests/responses-input-items-errors.test.ts	✅ Passed	169ms
tests/responses-input-items-list.test.ts	✅ Passed	184ms
tests/responses-input-items-options.test.ts	✅ Passed	119ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	262ms
tests/responses-input-tokens-count.test.ts	✅ Passed	211ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.369s
tests/responses-not-found-errors.test.ts	✅ Passed	315ms
tests/responses-parse.test.ts	✅ Passed	234ms
tests/responses-retrieve-retries.test.ts	✅ Passed	333ms
tests/responses-retrieve.test.ts	✅ Passed	256ms
tests/responses-stored-method-errors.test.ts	✅ Passed	675ms
tests/retry-behavior.test.ts	✅ Passed	3.15s
tests/sdk-error-shape.test.ts	✅ Passed	518ms

View OkTest run #32315693828

_{SDK merge (c47e20788f04) · head (ef115577754c) · base (387bbc8d267a) · OkTest (2b1bdfd25e98)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5253a8ce3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jbeckwith-oai]

Independent two-pass review confirms the existing unresolved malformed-bearer discussion; no duplicate inline comment is needed. P2: Node Headers accepts several forbidden HTTP field-value control bytes, so exception-only sanitization in both Bedrock authentication paths allows malformed bearer credentials to reach the transport instead of rejecting them before fetch. The default Node transport fails without exposing the credential, so a default P1 disclosure claim would overstate the impact; supported custom transports may provide less-safe diagnostics. Explicitly reject forbidden control bytes in both paths while preserving valid horizontal tabs, supported byte values, and existing Unicode handling.

[jbeckwith-oai]

Independent two-pass security review found a Medium credential-integrity gap in the new Bedrock bearer validator: accepted tokens ending in HTTP whitespace are silently changed by native Headers before dispatch.

[github-actions]

Castiron custom code

⚠️ Report unavailable for ef115577754c.

The report setup or validation failed. Inspect the workflow run.