Add CLI command group `agents automation-profile` with add, remove,
list, and show subcommands for managing automation profiles that
control plan execution autonomy.
Changes:
- New `automation_profile.py` CLI module with YAML config input,
schema_version guard, namespaced name validation, --update support,
and all output formats (json/yaml/plain/table/rich)
- Register automation-profile in main CLI app
- Add deprecation warnings for --automation-level on plan use and
set-automation-level commands
- Update CLI reference docs with command examples, built-in profiles
list, and deprecation notes
- 26 Behave scenarios covering all commands and error paths
- 9 Robot Framework integration smoke tests
- ASV benchmarks for CLI parsing performance
- Mark A6.cli items complete in implementation_plan.md
Add tree, inspect, link-child, and unlink-child subcommands to the
agents resource CLI group. Extend ResourceRegistryService with
link_child, unlink_child, get_children, and get_resource_tree methods.
- tree: display resource hierarchy with --depth, --type, and format options
- inspect: show resource details with --tree and --file options
- link-child/unlink-child: manage DAG edges with cycle detection
- 24 Behave scenarios, 4 Robot integration tests, ASV benchmarks
- CLI reference documentation in docs/reference/resource_cli.md
- Use model_copy(update=...) in test helpers so Pydantic ge=
validators are enforced during tests, not just env vars (NEW-1)
- Promote _extract_plan_id_from_sandbox to public staticmethod
and reuse in CLI active-plan detection to eliminate duplicate
plan-ID parsing logic (NEW-2)
- Cache _get_sandbox_dirs result for service instance lifetime
and have CLI active-plan detection use the cached listing so
/tmp is iterated only once per invocation (NEW-3)
- Add best-effort active plan detection from sandbox mtimes to
protect running plans from cleanup (B1)
- Add ge= validators on all retention settings to prevent unsafe
negative/zero values; checkpoint max requires ge=2 (B3, NB6)
- Handle CoW sandbox plan_id extraction (ca-cow-sandbox- prefix)
so copy-on-write sandboxes are also protected (NB4)
- Add OSError guards in sandbox dir iteration for race safety (NB7)
- Add TODO markers and CLI notice for unimplemented session cleanup (NB1)
- Rebase onto develop-hamza-1 to incorporate SEC5 changes (B2)
Implement centralized redaction utility that masks API keys, tokens,
and credentials across CLI output, structlog logs, and error messages.
- Add shared/redaction.py with pattern-based secret detection (sk-*,
sk-ant-*, tok_*, Bearer tokens), sensitive key name detection,
database URL masking, custom pattern registration, and thread-safe
global show_secrets flag
- Add config/logging.py with structlog configuration integrating the
secrets_masking_processor into the processor chain
- Add --show-secrets global CLI option to reveal secrets when needed
- Redact error details in main.py, project.py, and auto_debug.py
error handlers before printing
- Wrap format_output() in formatting.py with automatic dict redaction
- Add show_secrets field and safe __repr__ to Settings model
- Add 43-scenario Behave feature (features/security_secrets.feature)
- Add 10 Robot Framework smoke tests (robot/security_secrets.robot)
- Add ASV benchmarks (benchmarks/security_secrets_bench.py)
- Add reference docs (docs/reference/secrets_handling.md)
brent.edwards
freemo
khyari hamza
mngrif
hamza.khyari
aditya
