- Use model_copy(update=...) in test helpers so Pydantic ge=
validators are enforced during tests, not just env vars (NEW-1)
- Promote _extract_plan_id_from_sandbox to public staticmethod
and reuse in CLI active-plan detection to eliminate duplicate
plan-ID parsing logic (NEW-2)
- Cache _get_sandbox_dirs result for service instance lifetime
and have CLI active-plan detection use the cached listing so
/tmp is iterated only once per invocation (NEW-3)
- Add best-effort active plan detection from sandbox mtimes to
protect running plans from cleanup (B1)
- Add ge= validators on all retention settings to prevent unsafe
negative/zero values; checkpoint max requires ge=2 (B3, NB6)
- Handle CoW sandbox plan_id extraction (ca-cow-sandbox- prefix)
so copy-on-write sandboxes are also protected (NB4)
- Add OSError guards in sandbox dir iteration for race safety (NB7)
- Add TODO markers and CLI notice for unimplemented session cleanup (NB1)
- Rebase onto develop-hamza-1 to incorporate SEC5 changes (B2)
Implement centralized redaction utility that masks API keys, tokens,
and credentials across CLI output, structlog logs, and error messages.
- Add shared/redaction.py with pattern-based secret detection (sk-*,
sk-ant-*, tok_*, Bearer tokens), sensitive key name detection,
database URL masking, custom pattern registration, and thread-safe
global show_secrets flag
- Add config/logging.py with structlog configuration integrating the
secrets_masking_processor into the processor chain
- Add --show-secrets global CLI option to reveal secrets when needed
- Redact error details in main.py, project.py, and auto_debug.py
error handlers before printing
- Wrap format_output() in formatting.py with automatic dict redaction
- Add show_secrets field and safe __repr__ to Settings model
- Add 43-scenario Behave feature (features/security_secrets.feature)
- Add 10 Robot Framework smoke tests (robot/security_secrets.robot)
- Add ASV benchmarks (benchmarks/security_secrets_bench.py)
- Add reference docs (docs/reference/secrets_handling.md)
hamza.khyari
khyari hamza