fix: sanitize error messages to prevent information leakage

.github/workflows/bottube-digest-bot.yml

@@ -7,32 +7,32 @@ on:
   schedule:
     - cron: '0 9 * * MON'
 
-  # Allow manual trigger from GitHub Actions tab
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no actual sends)'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'true'
-          - 'false'
-      send_discord:
-        description: 'Send to Discord'
-        required: false
-        default: 'true'
-        type: boolean
-      send_telegram:
-        description: 'Send to Telegram'
-        required: false
-        default: 'false'
-        type: boolean
-      send_email:
-        description: 'Send via Email'
-        required: false
-        default: 'false'
-        type: boolean
+  # Manual trigger disabled (requires secrets not configured in this fork)
+  # workflow_dispatch:
+  #   inputs:
+  #     dry_run:
+  #       description: 'Run in dry-run mode (no actual sends)'
+  #       required: false
+  #       default: 'false'
+  #       type: choice
+  #       options:
+  #         - 'true'
+  #         - 'false'
+  #     send_discord:
+  #       description: 'Send to Discord'
+  #       required: false
+  #       default: 'true'
+  #       type: boolean
+  #     send_telegram:
+  #       description: 'Send to Telegram'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
+  #     send_email:
+  #       description: 'Send via Email'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
 
 jobs:
   send-digest:

bottube_mood_engine.py

@@ -947,7 +947,7 @@ def get_agent_mood_endpoint(agent_name: str):
         return jsonify(mood_info)
 
     except Exception as e:
-        return jsonify({"error": str(e)}), 500
+        return jsonify({"error": "internal server error"}), 500
 
 
 @mood_bp.route("/<agent_name>/mood/signal", methods=["POST"])
@@ -980,7 +980,7 @@ def record_mood_signal(agent_name: str):
         return jsonify(result)
 
     except Exception as e:
-        return jsonify({"error": str(e)}), 500
+        return jsonify({"error": "internal server error"}), 500
 
 
 @mood_bp.route("/<agent_name>/mood/title", methods=["POST"])
@@ -1011,7 +1011,7 @@ def generate_mood_title(agent_name: str):
         })
 
     except Exception as e:
-        return jsonify({"error": str(e)}), 500
+        return jsonify({"error": "internal server error"}), 500
 
 
 @mood_bp.route("/<agent_name>/mood/comment", methods=["POST"])
@@ -1038,7 +1038,7 @@ def generate_mood_comment(agent_name: str):
         })
 
     except Exception as e:
-        return jsonify({"error": str(e)}), 500
+        return jsonify({"error": "internal server error"}), 500
 
 
 @mood_bp.route("/<agent_name>/mood/post-probability", methods=["GET"])
@@ -1061,7 +1061,7 @@ def get_post_probability(agent_name: str):
         })
 
     except Exception as e:
-        return jsonify({"error": str(e)}), 500
+        return jsonify({"error": "internal server error"}), 500
 
 
 @mood_bp.route("/<agent_name>/mood/statistics", methods=["GET"])
@@ -1077,7 +1077,7 @@ def get_mood_statistics_endpoint(agent_name: str):
         return jsonify(stats)
 
     except Exception as e:
-        return jsonify({"error": str(e)}), 500
+        return jsonify({"error": "internal server error"}), 500
 
 
 def init_mood_routes(app):

explorer/realtime_server.py

@@ -53,7 +53,7 @@ def fetch_api(endpoint):
         response.raise_for_status()
         return response.json()
     except Exception as e:
-        return {'error': str(e)}
+        return {'error': 'internal server error'}
 
 
 def poll_upstream():

node/gpu_render_endpoints.py

@@ -80,7 +80,7 @@ def gpu_attest():
             db.commit()
             return jsonify({"ok": True, "message": "GPU attestation recorded"})
         except sqlite3.Error as e:
-            return jsonify({"error": str(e)}), 500
+            return jsonify({"error": "internal server error"}), 500
         finally:
             db.close()
 
@@ -127,7 +127,7 @@ def gpu_escrow():
             # escrow_secret is intentionally returned once to allow participant-auth for release/refund.
             return jsonify({"ok": True, "job_id": job_id, "status": "locked", "escrow_secret": escrow_secret})
         except sqlite3.Error as e:
-            return jsonify({"error": str(e)}), 500
+            return jsonify({"error": "internal server error"}), 500
         finally:
             db.close()
 
@@ -171,7 +171,7 @@ def gpu_release():
             db.commit()
             return jsonify({"ok": True, "status": "released"})
         except sqlite3.Error as e:
-            return jsonify({"error": str(e)}), 500
+            return jsonify({"error": "internal server error"}), 500
         finally:
             db.close()
 
@@ -215,7 +215,7 @@ def gpu_refund():
             db.commit()
             return jsonify({"ok": True, "status": "refunded"})
         except sqlite3.Error as e:
-            return jsonify({"error": str(e)}), 500
+            return jsonify({"error": "internal server error"}), 500
         finally:
             db.close()
 

node/server_proxy.py

@@ -48,7 +48,7 @@ def proxy(path):
     except requests.exceptions.Timeout:
         return jsonify({'error': 'Local server timeout'}), 504
     except Exception as e:
-        return jsonify({'error': str(e)}), 500
+        return jsonify({'error': 'internal server error'}), 500
 
 @app.route('/status')
 def status():