[atharvamhaske]

Fixes #5985.

The Rust client puts the engine token in a gateway request's rvt-token query parameter (build_gateway_url in remote_manager.rs). When the send fails, reqwest quotes the full request URL in its error, so the token ended up in any log or message that printed the error:

error sending request for url (http://127.0.0.1:59835/gateway/counter/action/increment?rvt-namespace=default&rvt-method=getOrCreate&rvt-key=a&rvt-runner=default&rvt-crash-policy=sleep&rvt-token=secret-engine-token): client error (Connect): tcp connect error: Connection refused (os error 61)

send_request now calls reqwest::Error::without_url on a failed send. The error keeps its cause (error sending request: client error (Connect): ...) but not the URL.

Why only this call

• reqwest attaches the URL only to errors raised while sending: connect failures, timeouts, redirects and builder errors. Errors from reading the body (bytes, text, json) carry no URL, so the response reads in handle.rs were not leaking.
• The other send() calls in remote_manager.rs go to /metadata and /actors. Those send the token in the x-rivet-token header, and their URLs hold only the namespace, actor name, key and IDs.
• WebSocket dials: tokio-tungstenite's connect_async reports a failed dial as an I/O or HTTP error, without the URL. Only the blocking tungstenite::connect, which this client does not use, builds the Unable to connect to {url} error.

Testing

rivetkit-rust/packages/client/tests/error_redaction.rs builds a client with a token against a closed local port, calls an action through get_or_create, and checks that neither {:#} nor {:?} of the error contains the token. It fails on main with the output above and passes with this change. cargo test -p rivetkit-client passes.

[RivetAgent]

The changes look good; no high-confidence issues found.

• Blocking / Should-fix / Nit: None. The change in rivetkit-rust/packages/client/src/remote_manager.rs:535 removes the URL from failed-send errors, and tests/error_redaction.rs:22–25 checks both display and debug formatting for token leakage.

No CLAUDE.md files were found. GitHub status and prior comments could not be checked because CLI authentication was unavailable. Tests were not run.

Copy prompt to fix all

Fix all actionable findings in the latest Ironworks code review on PR rivet-dev/rivet#5987. Inspect every referenced location, address each finding without changing unrelated behavior, run the relevant tests, and summarize what changed.

[abcxff]

Thanks! will work on upstreaming this and some of your other prs