Implement centralized redaction utility that masks API keys, tokens,
and credentials across CLI output, structlog logs, and error messages.
- Add shared/redaction.py with pattern-based secret detection (sk-*,
sk-ant-*, tok_*, Bearer tokens), sensitive key name detection,
database URL masking, custom pattern registration, and thread-safe
global show_secrets flag
- Add config/logging.py with structlog configuration integrating the
secrets_masking_processor into the processor chain
- Add --show-secrets global CLI option to reveal secrets when needed
- Redact error details in main.py, project.py, and auto_debug.py
error handlers before printing
- Wrap format_output() in formatting.py with automatic dict redaction
- Add show_secrets field and safe __repr__ to Settings model
- Add 43-scenario Behave feature (features/security_secrets.feature)
- Add 10 Robot Framework smoke tests (robot/security_secrets.robot)
- Add ASV benchmarks (benchmarks/security_secrets_bench.py)
- Add reference docs (docs/reference/secrets_handling.md)
khyari hamza
d815339c52