Files
oh-my-pi/packages/coding-agent/src
Mathews-Tom a305af9587 fix(secrets): never emit a plain replace secret equal to the Z/ZZ sentinel
A plain replace-mode secret (or the redacted key) whose entire value is
exactly the deterministic sentinel (`Z`/`ZZ`) was emitted unchanged,
shipping the raw value to the provider. Scope a distinctness guard to
whole configured-secret replacements so the output differs from the input
while staying length-preserving and deterministic; a plain secret only
matches its own literal, so the perturbed output remains a fixed point
under re-obfuscation. Per-chunk remainder redaction keeps the sentinel
fixed-point for cross-restart idempotence.
2026-06-22 19:53:36 +05:30
..
2026-06-21 02:45:48 +02:00
2026-06-08 15:47:57 -03:00