Make history-redact output disclosure-safe across SDK, CLI, MCP, and telemetry

Merged
UN
3mo ago
+623-58

Summary

  • replace secret-bearing history-redact result fields with non-reversible matcher counts
  • sanitize CLI recovery, typo guidance, telemetry, and MCP-facing output
  • add canary coverage for applied, dry-run, no-op, rejected, SDK, MCP, and telemetry paths
  • document the public contract and regenerate the package-owned changelog

Project management

Verification

  • 417 test files, 6,691 tests
  • 100% statements / branches / functions / lines
  • lint, zero-duplicate, static quality and 100% docstring gates
  • contracts, SDK surface, security scan, docs links, context/retrieval/token gates
  • isolated temporary-directory canary acceptance across dry-run, applied, no-op, and invalid-regex paths

Closes #864

Summary by Sourcery

Ensure history-redact never discloses matcher or replacement material across SDK, CLI, MCP, and telemetry, and update outputs to report only non-sensitive counts.

New Features:

  • Expose a redactSensitiveCommandArgs helper to sanitize history-redact arguments before use in CLI recovery, typo guidance, and diagnostics.

Bug Fixes:

  • Prevent history-redact from echoing literal, regex, and replacement inputs in CLI, SDK, MCP responses, telemetry, and error messages.
  • Normalize invalid --regex errors and history-redact item-id change messages to avoid leaking matcher material.

Enhancements:

  • Change history-redact pattern reporting to expose only matcher counts and default-replacement selection, replacing prior echoing of literal and regex values.
  • Extend telemetry sensitive-key detection and sanitization to treat history-redact matcher and replacement inputs as sensitive.
  • Document the history-redact output contract and update the changelog for the new disclosure-safe behavior.

Tests:

  • Add CLI, SDK, MCP, and telemetry tests to assert that history-redact never surfaces matcher or replacement values and that reported pattern metadata matches the new contract.
  • Expand history-redact unit tests to cover regex parsing, redaction rule construction, and dry-run behavior under the new non-echoing patterns API.

Summary by cubic

Make history-redact outputs disclosure-safe by replacing raw matchers/replacements with non-reversible counts and scrubbing sensitive inputs across CLI, SDK, MCP, recovery, and telemetry. Fixes GH-864 and closes diagnostic gaps so secrets never appear in success, failure, or diagnostics.

  • Bug Fixes

    • SDK: HistoryRedactResult.patterns now reports literal_count, regex_count, total_count, and replacement_is_default; removed literals, regex, and replacement.
    • CLI: recovery payloads, typo guidance, and example commands redact values for --literal, --regex, --replacement; inherited recovery fields are sanitized; equals-form typos are redacted; value-less sensitive flags preserve following option tokens.
    • Telemetry: treats redaction inputs as sensitive (including plural and inline assignments); scrubs argv/option payloads while keeping safe counts.
    • MCP: tool responses never include matcher or replacement material.
    • Docs/Changelog: documented the disclosure-safe contract and noted GH-864.

  • Migration

    • Replace any use of patterns.literals, patterns.regex, and patterns.replacement with literal_count, regex_count, total_count, and replacement_is_default.
    • Do not rely on raw matcher or replacement values; they are intentionally unavailable in CLI/SDK/MCP/telemetry.
    • Use history.replacements and the new counts for reporting.
    • Error messages for invalid regex and id-change warnings are now generic and won’t echo user input.