UAT: `agents config list` incorrectly masks non-secret config values containing "token" or "key" in key name #1735

New issue

Open

opened 2026-04-02 23:38:14 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:38:14 +00:00

Owner

Metadata

Branch: fix/config-list-secret-masking-regex
Commit Message: fix(cli): narrow _SECRET_PATTERNS regex to avoid masking non-secret token-budget config keys
Milestone: v3.6.0
Parent Epic: #936

Description

The agents config list command uses a regex pattern (api[_-]?key|token|secret|password) to identify secret keys that should be masked. This regex is too broad and matches config keys that contain "token" or "key" as a substring of a non-secret word in the key name.

Affected keys incorrectly masked:

context.hot.max-tokens (value: 16000) — masked as **** because "token" appears in the key
context.budget.response-reserve-tokens (value: 4096) — masked as ****
context.summarize.max-tokens (value: 1000) — masked as ****
context.pipeline.budget-packer.min-fragment-tokens (value: 10) — masked as ****
context.pipeline.preamble-generator.max-tokens (value: 200) — masked as ****

Expected behavior: Only keys that actually store secrets (API keys, auth tokens, passwords) should be masked. Keys like context.hot.max-tokens are integer configuration values, not secrets.

Actual behavior: These non-secret integer values are displayed as **** in the output, making it impossible to see their actual values without using --show-secrets.

Code location: src/cleveragents/cli/commands/config.py, lines 54–55:

_SECRET_PATTERNS: re.Pattern[str] = re.compile(
    r"(api[_\-]?key|token|secret|password)", re.IGNORECASE
)

The regex matches "token" anywhere in the key name. It should be more specific — e.g., matching only when "token" appears as a standalone word at the end of the key (like provider.huggingface.token) rather than as part of "max-tokens" or "reserve-tokens".

Steps to reproduce:

agents config list
# Observe that context.hot.max-tokens shows **** instead of 16000
agents config list --show-secrets
# Observe that context.hot.max-tokens now shows 16000

Impact: Users cannot see the values of context token budget configuration keys without using --show-secrets, which is misleading and confusing since these are not secrets.

Subtasks

Audit all registered config keys to enumerate which ones are genuinely secret (API keys, auth tokens, passwords)
Redesign _SECRET_PATTERNS regex to use word-boundary or end-of-key anchors so "token" only matches standalone secret keys (e.g., provider.*.token) and not substrings like "max-tokens" or "reserve-tokens"
Verify that all known secret keys (provider.*.api-key, provider.*.token, etc.) are still correctly masked after the regex change
Verify that all known non-secret token-budget keys (context.*.max-tokens, context.*.reserve-tokens, etc.) are no longer masked
Update or add Behave unit tests in features/ covering the masking logic for both secret and non-secret key patterns
Update or add Robot Framework integration tests in robot/ for agents config list output

Definition of Done

agents config list displays correct integer values for all *.max-tokens and *.reserve-tokens config keys without --show-secrets
agents config list still masks all genuinely secret keys (API keys, auth tokens, passwords)
_SECRET_PATTERNS regex uses word-boundary or end-of-key anchors to prevent false-positive masking
All new and updated Behave scenarios pass (nox -e unit_tests)
All new and updated Robot Framework tests pass (nox -e integration_tests)
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-uat-tester

## Metadata - **Branch**: `fix/config-list-secret-masking-regex` - **Commit Message**: `fix(cli): narrow _SECRET_PATTERNS regex to avoid masking non-secret token-budget config keys` - **Milestone**: v3.6.0 - **Parent Epic**: #936 ## Description The `agents config list` command uses a regex pattern `(api[_-]?key|token|secret|password)` to identify secret keys that should be masked. This regex is too broad and matches config keys that contain `"token"` or `"key"` as a substring of a non-secret word in the key name. **Affected keys incorrectly masked:** - `context.hot.max-tokens` (value: `16000`) — masked as `****` because `"token"` appears in the key - `context.budget.response-reserve-tokens` (value: `4096`) — masked as `****` - `context.summarize.max-tokens` (value: `1000`) — masked as `****` - `context.pipeline.budget-packer.min-fragment-tokens` (value: `10`) — masked as `****` - `context.pipeline.preamble-generator.max-tokens` (value: `200`) — masked as `****` **Expected behavior:** Only keys that actually store secrets (API keys, auth tokens, passwords) should be masked. Keys like `context.hot.max-tokens` are integer configuration values, not secrets. **Actual behavior:** These non-secret integer values are displayed as `****` in the output, making it impossible to see their actual values without using `--show-secrets`. **Code location:** `src/cleveragents/cli/commands/config.py`, lines 54–55: ```python _SECRET_PATTERNS: re.Pattern[str] = re.compile( r"(api[_\-]?key|token|secret|password)", re.IGNORECASE ) ``` The regex matches `"token"` anywhere in the key name. It should be more specific — e.g., matching only when `"token"` appears as a standalone word at the end of the key (like `provider.huggingface.token`) rather than as part of `"max-tokens"` or `"reserve-tokens"`. **Steps to reproduce:** ```bash agents config list # Observe that context.hot.max-tokens shows **** instead of 16000 agents config list --show-secrets # Observe that context.hot.max-tokens now shows 16000 ``` **Impact:** Users cannot see the values of context token budget configuration keys without using `--show-secrets`, which is misleading and confusing since these are not secrets. ## Subtasks - [ ] Audit all registered config keys to enumerate which ones are genuinely secret (API keys, auth tokens, passwords) - [ ] Redesign `_SECRET_PATTERNS` regex to use word-boundary or end-of-key anchors so `"token"` only matches standalone secret keys (e.g., `provider.*.token`) and not substrings like `"max-tokens"` or `"reserve-tokens"` - [ ] Verify that all known secret keys (`provider.*.api-key`, `provider.*.token`, etc.) are still correctly masked after the regex change - [ ] Verify that all known non-secret token-budget keys (`context.*.max-tokens`, `context.*.reserve-tokens`, etc.) are no longer masked - [ ] Update or add Behave unit tests in `features/` covering the masking logic for both secret and non-secret key patterns - [ ] Update or add Robot Framework integration tests in `robot/` for `agents config list` output ## Definition of Done - [ ] `agents config list` displays correct integer values for all `*.max-tokens` and `*.reserve-tokens` config keys without `--show-secrets` - [ ] `agents config list` still masks all genuinely secret keys (API keys, auth tokens, passwords) - [ ] `_SECRET_PATTERNS` regex uses word-boundary or end-of-key anchors to prevent false-positive masking - [ ] All new and updated Behave scenarios pass (`nox -e unit_tests`) - [ ] All new and updated Robot Framework tests pass (`nox -e integration_tests`) - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-uat-tester

freemo added this to the v3.6.0 milestone

2026-04-02 23:40:11 +00:00

freemo commented

2026-04-02 23:42:19 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Priority/High (confirmed) — incorrect masking of config values is a usability bug
MoSCoW: MoSCoW/Should Have — the config list command masking non-secret values makes debugging difficult. The command works but produces misleading output. Should Have.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Priority/High (confirmed) — incorrect masking of config values is a usability bug - **MoSCoW**: MoSCoW/Should Have — the config list command masking non-secret values makes debugging difficult. The command works but produces misleading output. Should Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo added a new dependency

2026-04-02 23:44:44 +00:00

#936 Epic: Output Rendering Pipeline Integration — Wire Commands to OutputSession Framework

freemo referenced this issue

2026-04-02 23:48:06 +00:00

[UAT-SUPERVISOR] Progress Report — Cycle 451 — v3.7.0 #1778

freemo added the