fix(security): omit agent token fingerprints

tests/unit/agent-auth.test.ts

@@ -1,7 +1,8 @@
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createHmac } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   createAgentToken,
   initializeAgentTokenSigningKey,
@@ -18,9 +19,20 @@ async function createTempDir() {
 }
 
 afterEach(async () => {
+  vi.restoreAllMocks();
   await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
 });
 
+async function createSignedRawPayloadToken(profileDir: string, rawPayload: string): Promise<string> {
+  const key = await readFile(join(profileDir, "agent-api-signing.key"));
+  const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+  const body = Buffer.from(rawPayload).toString("base64url");
+  const signature = createHmac("sha256", key)
+    .update(`${header}.${body}`)
+    .digest("base64url");
+  return `${header}.${body}.${signature}`;
+}
+
 describe("agent token signing key", () => {
   it("keeps existing run tokens valid across profile reinitialization", async () => {
     const profileDir = await createTempDir();
@@ -42,4 +54,25 @@ describe("agent token signing key", () => {
 
     expect(() => initializeAgentTokenSigningKey(profileDir)).toThrow(FatalError);
   });
+
+  it("logs malformed signed token context without token fingerprints", async () => {
+    const profileDir = await createTempDir();
+    initializeAgentTokenSigningKey(profileDir);
+    const rawPayload = "{malformed-token-body";
+    const token = await createSignedRawPayloadToken(profileDir, rawPayload);
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    expect(validateAgentToken(token, {
+      runId: "run-1",
+      companyId: "company-1",
+      requestId: "req-1",
+    })).toBeNull();
+
+    expect(warn).toHaveBeenCalledWith(
+      "[agent-auth] token shape invalid: reason=payload_json_parse_failed runId=run-1 companyId=company-1 requestId=req-1",
+    );
+    const logLine = String(warn.mock.calls[0]?.[0] ?? "");
+    expect(logLine).not.toContain(rawPayload);
+    expect(logLine).not.toContain(token.slice(0, 8));
+  });
 });