fix: hide camelCase secrets in --dry-run and --debug output

[Bradenream]

Summary

--dry-run and --debug print request and response bodies to stderr. They hid only a fixed list of lowercase names: password, secret, token, api_key and a few more. The Voiceflow API names its fields in camelCase, so most of the secrets it carries printed in full:

• integration credentials: apiKeySecret, keySecret, secretKey, oauthSecretKey, webhookSecret, webhookSecretKey, authHeaderValue
• a secret's value in secret create and secret set-value
• Authorization values in API tool and MCP server headers. In responses this applies to API tool headers, which the API returns as saved; MCP header values come back already masked.

Coding agents keep stderr in their transcripts, so a dry run or a debug run leaked these.

The rule now comes from a survey of all 868 property names in the OpenAPI spec (internal/client/redact.go):

• Names are compared without case or separators. Those ending in secret, secretkey, password, token, apikey or privatekey are hidden, which covers every name the old list had. Counts such as maxTokens and identifiers such as accountSid, apiKeySid, keyId and accessTokenID stay visible.
• credentials is hidden whole.
• A {key, value} pair whose key names a credential, such as an Authorization header, hides its value.
• The secret endpoints have defaultValue and value hidden. Elsewhere they stay visible, so a variable's default still shows.
• Booleans, numbers and null are never hidden, so hasPassword: true still shows.

Before and after

	master	this PR
Secret names the rule hides, out of the spec's 868	4	11, plus hasPassword, which stays visible as a boolean
test/redaction.test.ts (4 --dry-run and 2 --debug leak routes)	6 leak	6 hidden, ordinary fields kept

Test plan

• gofmt, go vet ./... and go test ./... pass; go.mod is unchanged.

• internal/client/redact_test.go covers:

  • the surveyed secret names and the identifiers next to them;
  • every name the old list hid;
  • credential containers, header pairs and the secret endpoints.

  Removing any of the three parts of the rule fails at least one test.

• test/redaction.test.ts: each case sends a canary in a secret field, through --dry-run or through --debug against a local server, and checks the canary never reaches stderr while ordinary fields do. All 6 leak on master.

• Full suite with fix: restore vf docs search, and make the test suite hermetic and green #37 applied: 84/84. With fix: restore vf docs search, and make the test suite hermetic and green #37, fix: stop waiting on the silent stdin an agent's shell hands vf #38 and the other three fixes from this batch: 101/101.

• CI: CLI behaviour shows master's 4 existing failures until fix: restore vf docs search, and make the test suite hermetic and green #37 merges.

#39 also edits internal/client/diagnostics.go, and the two apply cleanly together.

Not covered: if the API ever sent a malformed response, the SDK's own parse error could quote a raw field value. Only the API could cause that, so it is left as is.

[Copilot]

Copilot review overview

🟡 Changes recommended

Credential-pair redaction incorrectly converts null, boolean, and numeric values into redaction strings.

Review effort: Balanced
Findings: 1

Open (1)

• Credential-pair branch rewrites non-string secret values · New

What changed in this PR

Improves diagnostic redaction to prevent camelCase credentials and secret endpoint values from leaking through stderr.

Changes:

• Adds normalized, suffix-based secret detection.
• Redacts credential pairs and secret endpoint fields.
• Adds Go and CLI behavior tests.

File	Description
internal/​client/​redact.go	Defines expanded redaction rules.
internal/​client/​diagnostics.go	Applies rules to diagnostic bodies.
internal/​client/​redact_test.go	Tests redaction logic.
test/​redaction.test.ts	Tests CLI dry-run/debug output.

Files not reviewed (1)

• internal/client/diagnostics.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[effervescentia]

Merge activity

• Oct 2, 6:41 PM UTC: The merge label 'merge' was detected. This PR will be added to the Graphite merge queue once it meets the requirements.
• Oct 2, 6:41 PM UTC: effervescentia added this pull request to the Graphite merge queue.
• Oct 2, 6:42 PM UTC: CI is running for this pull request on a draft pull request (#49) due to your merge queue CI optimization settings.
• Oct 2, 6:42 PM UTC: Merged by the Graphite merge queue via draft PR: #49.