- Use model_copy(update=...) in test helpers so Pydantic ge=
validators are enforced during tests, not just env vars (NEW-1)
- Promote _extract_plan_id_from_sandbox to public staticmethod
and reuse in CLI active-plan detection to eliminate duplicate
plan-ID parsing logic (NEW-2)
- Cache _get_sandbox_dirs result for service instance lifetime
and have CLI active-plan detection use the cached listing so
/tmp is iterated only once per invocation (NEW-3)
Implement centralized redaction utility that masks API keys, tokens,
and credentials across CLI output, structlog logs, and error messages.
- Add shared/redaction.py with pattern-based secret detection (sk-*,
sk-ant-*, tok_*, Bearer tokens), sensitive key name detection,
database URL masking, custom pattern registration, and thread-safe
global show_secrets flag
- Add config/logging.py with structlog configuration integrating the
secrets_masking_processor into the processor chain
- Add --show-secrets global CLI option to reveal secrets when needed
- Redact error details in main.py, project.py, and auto_debug.py
error handlers before printing
- Wrap format_output() in formatting.py with automatic dict redaction
- Add show_secrets field and safe __repr__ to Settings model
- Add 43-scenario Behave feature (features/security_secrets.feature)
- Add 10 Robot Framework smoke tests (robot/security_secrets.robot)
- Add ASV benchmarks (benchmarks/security_secrets_bench.py)
- Add reference docs (docs/reference/secrets_handling.md)
- Fix resource_repository Behave scenario 'Resolve by ULID returns the
resource' by propagating res_type_name through context instead of
relying on fragile list_types() across SQLAlchemy sessions
- Increase subprocess timeouts in Robot Framework integration tests to
prevent SIGTERM kills under parallel execution load (10s->30s, 20s->60s,
30s->60s across 7 robot files)
Add structured data builders and Rich renderers for version, info, and
diagnostics commands. Support --format rich/plain/json/yaml output parity
and --check flag for diagnostics (exits non-zero on errors).
Includes Behave scenarios, Robot smoke tests, ASV benchmarks, and updates
existing tests to match the new Rich panel output format.
Add 19 behave scenarios covering uncovered paths in skill_service.py
and cli/commands/skill.py to bring coverage above the 97% threshold:
- show with includes, MCP servers, agent_skills, inline tools, Referenced By
- tools with mixed MCP/inline sources
- list with non-local namespaces
- remove without --yes (abort path)
- update with dependent skills (Affected Actors panel)
- service edge cases: skill_count, empty names, source filtering, no config_path
- add with missing-description YAML (validation failure)
The "Deleting a resource with edges is rejected" scenario was failing
because the ResourceEdgeModel row was flushed but never committed.
Since ResourceRepository.delete() obtains its own session from the
factory, the uncommitted edge was invisible and ResourceHasEdgesError
was never raised.
Three issues prevented the behave suite from running:
1. plan_persistence_steps.py and plan_repository_steps.py both defined
@then('the retrieved plan description should be "..."'), causing an
AmbiguousStep error that broke all ~50 feature files. Renamed the
persistence step to "the persisted plan description should be".
2. The three-level hierarchy scenario used plan IDs containing O, I,
and L which are excluded from the ULID charset. Replaced with valid
characters (O->0, I->0, L->K).
3. resource_repository_steps.py flushed but never committed the edge
row, so the delete method's separate session could not see it.
The "Deleting a resource with edges is rejected" scenario was failing
because the ResourceEdgeModel row was flushed but never committed.
Since ResourceRepository.delete() obtains its own session from the
factory, the uncommitted edge was invisible and ResourceHasEdgesError
was never raised.
The "Deleting a resource with edges is rejected" scenario was failing
because the ResourceEdgeModel row was flushed but never committed.
Since ResourceRepository.delete() obtains its own session from the
factory, the uncommitted edge was invisible and ResourceHasEdgesError
was never raised.
khyari hamza
brent.edwards
CoreRasurae
freemo
