cli-agent-runner 0.1.39__tar.gz → 0.1.40__tar.gz

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/.gitignore

@@ -27,3 +27,6 @@ agent_runner/_version.py
 .coverage
 coverage.xml
 htmlcov/
+
+# Personal /team-onboarding artifact — not project content
+ONBOARDING.md

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/CHANGELOG.md

@@ -5,7 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.1.40] - 2026-05-31
+
+### Security
+- Grace-kill child-process fields (`live_children` / `ignored_children` in `round_grace_extended` / `round_grace_kill`) no longer store raw command lines — only the executable basename + pid (and, for ignored children, which ignore-pattern matched). This structurally prevents secrets passed in a child's arguments from reaching `events-*.jsonl`. The field shape changed from a list of strings to a list of objects.
+- Free-text event excerpts that can carry agent output — `transient_error_detected.raw`, `hook_failed.error_message`/`traceback`, `serve_startup_hook_failed.exc_msg` — are now best-effort redacted (auth headers, tokens, credential URLs, `KEY=value` secrets, known key-prefixes, JWT, PEM).
+- Pre-0.1.40 `events-*.jsonl` may contain unredacted argv/excerpts — see `docs/migrations/0.1.40.md`.
+
+### Changed
+- Docs: `configuration.md` `[monitor.host_health]` example points to the generated schema table instead of restating default values.
+
+## [0.1.39] - 2026-05-29
 
 ### Fixed
 - Grace-kill (`max_grace_after_result_s`) is no longer defeated by long-lived helper subprocesses (e.g. claude's persistent Bash-tool shell-snapshot). `[runtime] grace_kill_ignore_patterns` lists regexes for cmdlines to exclude from the liveness count; the claude preset ships a matching default.

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cli-agent-runner
-Version: 0.1.39
+Version: 0.1.40
 Summary: Restart-on-exit supervisor for autonomous CLI agents
 Project-URL: Homepage, https://github.com/wan9yu/cli-agent-runner
 Project-URL: Documentation, https://github.com/wan9yu/cli-agent-runner#readme

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/agent_runner/_emit.py

@@ -112,8 +112,10 @@ def emit_transient_error_detected(
     raw: str,
 ) -> None:
     """Emit detection of a transient agent error (rate limit / 5xx / timeout)."""
+    from agent_runner._redact import redact_secrets
     from agent_runner.events import TRANSIENT_ERROR_DETECTED, emit
 
+    raw = redact_secrets(raw)
     emit(
         log_dir,
         TRANSIENT_ERROR_DETECTED,
@@ -234,12 +236,15 @@ def emit_round_grace_kill(
     *,
     round_num: int,
     grace_s: int,
-    live_children: list[str] | None = None,
+    live_children: list[dict] | None = None,
 ) -> None:
     """Emit when the subprocess was killed because the grace-after-result timer
     expired AND the agent's process group had no live worker processes left
     (a genuine hang). Distinct from round_grace_extended (grace elapsed but a
     worker was still running) and round_timeout_kill (wall-clock exceeded).
+
+    live_children: list of ``{"name": <exe basename>, "pid": <int>}`` dicts
+        (0.1.40+; previously list of cmdline strings).
     """
     from agent_runner.events import ROUND_GRACE_KILL, emit
 
@@ -257,17 +262,18 @@ def emit_round_grace_extended(
     *,
     round_num: int,
     grace_s: int,
-    live_children: list[str],
-    ignored_children: list[str] | None = None,
+    live_children: list[dict],
+    ignored_children: list[dict] | None = None,
 ) -> None:
     """Emit when the grace-after-result timer expired but the agent still had
     live worker processes (e.g. a backgrounded build), so the round was NOT
     killed; it continues until it finishes or hits round_timeout_s.
 
-    ignored_children: cmdlines that matched a grace_kill_ignore_patterns entry
-        and were excluded from the liveness count — useful for verifying
-        patterns are firing and for noticing when an upstream CLI changes
-        its helper path.
+    live_children: list of ``{"name": <exe basename>, "pid": <int>}`` dicts
+        (0.1.40+; previously list of cmdline strings).
+    ignored_children: list of ``{"name": ..., "pid": ..., "matched": <pattern>}``
+        dicts for children that matched a grace_kill_ignore_patterns entry
+        and were excluded from the liveness count (0.1.40+; previously cmdline strings).
     """
     from agent_runner.events import ROUND_GRACE_EXTENDED, emit
 

cli_agent_runner-0.1.40/agent_runner/_redact.py

@@ -0,0 +1,102 @@
+"""Mask secret-bearing tokens in semi-trusted free text before it is persisted
+to durable, default-readable event logs (events-*.jsonl).
+
+Single source of truth for secret-shaping. Pure, dependency-free, idempotent.
+BEST-EFFORT: applied only to free-text excerpts (transient error output, hook
+exception messages/tracebacks), never as the sole control. The grace-kill child
+fields avoid this entirely by storing basename+pid, not argv.
+
+Patterns are length/charset-anchored so benign argv (sk-report.md, psql -h db,
+'Basic auth disabled') passes through unchanged.
+"""
+
+from __future__ import annotations
+
+import re
+
+_MASK = "<redacted>"
+
+_LONG_FLAGS = [
+    "--token",
+    "--password",
+    "--passwd",
+    "--api-key",
+    "--apikey",
+    "--secret",
+    "--secret-access-key",
+    "--access-key",
+    "--auth",
+    "--authorization",
+    "--client-secret",
+    "--aws-session-token",
+    "--bearer",
+    "--auth-token",
+    "--private-key",
+]
+# (prefix, min-tail-len) — anchored so short filenames don't match.
+_PREFIX_RES = [
+    r"sk-ant-[A-Za-z0-9\-_]{16,}",
+    r"sk-[A-Za-z0-9]{16,}",
+    r"ghp_[A-Za-z0-9]{20,}",
+    r"gho_[A-Za-z0-9]{20,}",
+    r"ghs_[A-Za-z0-9]{20,}",
+    r"ghu_[A-Za-z0-9]{20,}",
+    r"github_pat_[A-Za-z0-9_]{20,}",
+    r"xox[bpars]-[A-Za-z0-9-]{10,}",
+    r"xapp-[A-Za-z0-9-]{10,}",
+    r"AKIA[0-9A-Z]{16}",
+    r"ASIA[0-9A-Z]{16}",
+    r"AIza[0-9A-Za-z_\-]{35}",
+    r"glpat-[A-Za-z0-9_\-]{20}",
+    r"ya29\.[A-Za-z0-9._\-]{20,}",
+    r"(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}",
+    r"npm_[A-Za-z0-9]{20,}",
+    r"hf_[A-Za-z0-9]{20,}",
+]
+
+_FLAG_RE = re.compile(r"(?i)(" + "|".join(re.escape(f) for f in _LONG_FLAGS) + r")(\s+|=)(\S+)")
+# Short HTTP-basic flag `-u user:pass` (curl/wget). Case-SENSITIVE so `-U`
+# (psql/pg username) is left alone; a colon is required so `sort -u file` and
+# bare `-u username` (no password) are not masked; and the value must NOT be a
+# URL (`://`) — a `-u <url>` is left for _URL_USERINFO_RE, which masks only the
+# userinfo and preserves the host (e.g. redis://<redacted>@cache:6379/0).
+_SHORT_USER_RE = re.compile(r"(?<![\w-])-u(\s+|=)(?!\S*://)(\S+:\S+)")
+_HEADER_NAME_RE = re.compile(
+    r"(?im)\b(Authorization|Proxy-Authorization|Cookie|Set-Cookie|"
+    r"X-Api-Key|X-Auth-Token|X-Amz-Security-Token)(\s*:\s*)([^\r\n]+)"
+)
+_SCHEME_RE = re.compile(
+    r"\b(Bearer|Basic|Token|ApiKey|Digest|Negotiate|NTLM)(\s+)([A-Za-z0-9+/=._\-]{12,})"
+)
+_URL_USERINFO_RE = re.compile(r"(?i)([a-z][a-z0-9+.\-]*://)([^/\s@]+)@")
+_URL_QUERY_RE = re.compile(
+    r"(?i)([?&#](?:access_token|api_?key|token|auth|secret|sig|signature|"
+    r"password|client_secret|x-amz-security-token|x-amz-signature)=)([^&#\s]+)"
+)
+_ENV_RE = re.compile(
+    r"(?i)((?:(?<=\s)|^)[A-Za-z_][A-Za-z0-9_]*"
+    r"(?:PASSWORD|PASSWD|PWD|TOKEN|SECRET|API[_-]?KEY|ACCESS[_-]?KEY|CREDENTIAL|PRIVATE[_-]?KEY)"
+    r"[A-Za-z0-9_]*)=(\S+)"
+)
+_PREFIX_RE = re.compile(r"(?<![A-Za-z0-9])(?:" + "|".join(_PREFIX_RES) + r")")
+_JWT_RE = re.compile(r"\beyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+")
+_PEM_RE = re.compile(
+    r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----", re.DOTALL
+)
+
+
+def redact_secrets(text: str) -> str:
+    """Return *text* with secret-bearing tokens replaced by ``<redacted>``."""
+    if not text:
+        return text
+    out = _PEM_RE.sub(_MASK, text)
+    out = _ENV_RE.sub(rf"\1={_MASK}", out)
+    out = _FLAG_RE.sub(rf"\1\2{_MASK}", out)
+    out = _SHORT_USER_RE.sub(rf"-u\1{_MASK}", out)
+    out = _HEADER_NAME_RE.sub(rf"\1\2{_MASK}", out)
+    out = _SCHEME_RE.sub(rf"\1\2{_MASK}", out)
+    out = _URL_USERINFO_RE.sub(rf"\1{_MASK}@", out)
+    out = _URL_QUERY_RE.sub(rf"\1{_MASK}", out)
+    out = _JWT_RE.sub(_MASK, out)
+    out = _PREFIX_RE.sub(_MASK, out)
+    return out

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/agent_runner/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.39'
-__version_tuple__ = version_tuple = (0, 1, 39)
+__version__ = version = '0.1.40'
+__version_tuple__ = version_tuple = (0, 1, 40)
 
 __commit_id__ = commit_id = None

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/agent_runner/agent_runtime.py

@@ -31,7 +31,7 @@ class RunResult:
     timed_out: bool
     pid: int
     killed_for_grace: bool = False
-    grace_kill_children: list[str] = field(default_factory=list)
+    grace_kill_children: list[dict] = field(default_factory=list)
 
 
 def _build_argv(command: list[str], prompt_arg_template: list[str], prompt: str) -> list[str]:
@@ -63,35 +63,43 @@ def _live_children(
     *,
     ignore_patterns: list[re.Pattern[str]] | None = None,
     max_n: int = 5,
-    max_len: int = 120,
-) -> tuple[list[str], list[str]]:
-    """Cmdlines of live (non-zombie) descendants of ``proc``, split into
-    ``(live, ignored)``: ``live`` is what counts toward the grace-kill
-    liveness check; ``ignored`` matched an ``ignore_patterns`` entry and is
-    excluded (e.g. claude's persistent shell-snapshot helper). Both lists
-    are bounded by ``max_n``/``max_len`` to keep events small. ``ignore_patterns
-    is None`` → no filtering, ``ignored`` is empty, ``live`` matches 0.1.38.
+) -> tuple[list[dict], list[dict]]:
+    """Live (non-zombie) descendants of ``proc``, split into ``(live, ignored)``.
+
+    Each entry is ``{"name": <executable basename>, "pid": <int>}``; an ignored
+    entry also carries ``"matched": <pattern str>``. We store only basename+pid,
+    NOT argv — process arguments are where secrets leak (PGPASSWORD=…, --api-key
+    …, redis://:pass@…) and these lists are persisted to events-*.jsonl.
+    Ignore-pattern MATCHING runs against the full cmdline (detection unchanged);
+    only what we STORE is minimized.
     """
     try:
         parent = psutil.Process(proc.pid)
     except (psutil.NoSuchProcess, psutil.AccessDenied):
         return [], []
-    live: list[str] = []
-    ignored: list[str] = []
+    live: list[dict] = []
+    ignored: list[dict] = []
     for child in parent.children(recursive=True):
         try:
             if child.status() == psutil.STATUS_ZOMBIE:
                 continue
-            line = " ".join(child.cmdline()) or child.name()
+            argv = child.cmdline()
+            full = " ".join(argv) or child.name()  # MATCHING only
+            name = (Path(argv[0]).name if argv else "") or child.name()
+            pid = child.pid
         except (psutil.NoSuchProcess, psutil.AccessDenied):
             continue
-        short = line[:max_len]
-        if ignore_patterns and any(p.search(line) for p in ignore_patterns):
+        matched = None
+        if ignore_patterns:
+            for p in ignore_patterns:
+                if p.search(full):
+                    matched = p.pattern
+                    break
+        if matched is not None:
             if len(ignored) < max_n:
-                ignored.append(short)
-        else:
-            if len(live) < max_n:
-                live.append(short)
+                ignored.append({"name": name, "pid": pid, "matched": matched})
+        elif len(live) < max_n:
+            live.append({"name": name, "pid": pid})
         if len(live) >= max_n and len(ignored) >= max_n:
             break
     return live, ignored
@@ -114,7 +122,7 @@ def run(
     max_grace_after_result_s: int = 0,
     progress_callback: Callable[[dict], None] | None = None,
     progress_interval_s: int = 0,
-    on_grace_extended: Callable[[list[str], list[str]], None] | None = None,
+    on_grace_extended: Callable[[list[dict], list[dict]], None] | None = None,
     grace_kill_ignore_patterns: list[re.Pattern[str]] | None = None,
 ) -> RunResult:
     """Spawn the agent subprocess and wait for exit or timeout.

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/agent_runner/hooks.py

@@ -35,6 +35,7 @@ from pathlib import Path
 from typing import Any, Protocol, runtime_checkable
 
 from agent_runner import events
+from agent_runner._redact import redact_secrets
 from agent_runner._registry import ensure_unique
 
 _HEAD_BYTES = 1024
@@ -201,7 +202,7 @@ def run_serve_startup_hooks(cfg: Any, log_dir: Path) -> bool:
             hook(cfg)
         except Exception as e:  # noqa: BLE001 — hook is plugin contract; any failure aborts serve
             exc_type = type(e).__name__
-            exc_msg = str(e)[:200]
+            exc_msg = redact_secrets(str(e))[:200]
             print(
                 f"agent-runner: serve_startup_hook {hook.name} failed: {exc_type}: {exc_msg}",
                 file=sys.stderr,
@@ -232,6 +233,6 @@ def _summarize_error(exc: BaseException, tb: str) -> dict[str, str]:
         trimmed = tb[:_HEAD_BYTES] + _TRUNC_MARKER + tb[-_TAIL_BYTES:]
     return {
         "error_type": type(exc).__name__,
-        "error_message": str(exc),
-        "traceback": trimmed,
+        "error_message": redact_secrets(str(exc)),
+        "traceback": redact_secrets(trimmed),
     }

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/docs/commands.md

@@ -101,6 +101,9 @@ back to package-only mode automatically.
 `--no-restart` forces package-only even on a systemd --user host (upgrade the
 package now, restart your service yourself).
 
+Operator walkthrough (per-deployment decision table, rollback, failure modes,
+postmortem trail): see `docs/runbook.md` § "Upgrading agent-runner".
+
 ## Observation
 
 ### `agent-runner peek [flags]`

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/docs/configuration.md

@@ -212,9 +212,10 @@ round_progress_interval_s = 0  # 0 = disabled; set >0 to emit round_progress hea
 # supervisor_stale_threshold_s = 2700  # unset = round_timeout_s * 1.5; 0 = disable
 
 [monitor.host_health]
-mem_avail_min_mb = 200        # mem_pressure fires when mem_available_mb < this
-disk_warning_pct = 90.0       # disk_warning fires when disk_used_pct >= this
-disk_critical_pct = 95.0      # disk_critical fires when disk_used_pct >= this
+# Thresholds for mem_pressure / disk_warning / disk_critical. Defaults are
+# authoritative in the config-schema table above — set a field here only to
+# override. (mem_avail_min_mb: mem_pressure when mem_available_mb below it;
+# disk_warning_pct / disk_critical_pct: fire when disk_used_pct at/above.)
 ```
 
 Comment out individual entries to disable; e.g. `# auto_stop_on = []` disables

cli_agent_runner-0.1.40/docs/migrations/0.1.40.md

@@ -0,0 +1,42 @@
+# Migrating to 0.1.40
+
+## TL;DR
+
+```bash
+pip install --upgrade cli-agent-runner==0.1.40
+```
+
+A security release. No config or behavior change for the supervisor. One
+consumer-visible field-shape change (below).
+
+## Breaking: grace-kill child fields are now objects, not strings
+
+`round_grace_extended` / `round_grace_kill` previously carried
+`live_children` / `ignored_children` as lists of command-line **strings**.
+They are now lists of **objects**:
+
+- `live_children`:   `[{"name": "<exe basename>", "pid": <int>}, ...]`
+- `ignored_children`: `[{"name": ..., "pid": ..., "matched": "<pattern>"}, ...]`
+
+If you parse these fields, update your consumer. The change exists because the
+old strings were full process command lines, which could contain a secret
+passed in a child's arguments (a DB password, an API key, a credential URL).
+Storing only basename + pid removes that leak by construction. Ignore-pattern
+matching is unchanged — it still runs against the full command line; only what
+is **stored** is minimized.
+
+## Best-effort redaction of free-text excerpts
+
+`transient_error_detected.raw`, `hook_failed.error_message`/`traceback`, and
+`serve_startup_hook_failed.exc_msg` are now passed through a redactor that masks
+auth headers, tokens, credential URLs, `KEY=value` secrets, known key-prefixes,
+JWTs, and PEM blocks. This is **best-effort defense-in-depth**, not a guarantee:
+do not pass secrets as command-line arguments to supervised agents, and treat
+`events-*.jsonl` as sensitive.
+
+## One-time action (if applicable)
+
+If pre-0.1.40 `events-*.jsonl` were shipped to a log aggregator, shared, or
+fetched cross-host (`monitor --host`), review them for secret-bearing child
+argv / error excerpts and rotate any exposed credential. Post-upgrade events
+are protected.

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/docs/runbook.md

@@ -149,7 +149,18 @@ RestartSec=5
 
 ## Upgrading agent-runner
 
-`upgrade` detects the deployment topology and takes the safe path for it:
+`upgrade` detects the deployment topology and takes the safe path for it. Pick
+by how your service runs:
+
+| Your deployment | How to upgrade | What happens |
+|---|---|---|
+| systemd `--user` (installed via `agent-runner install`) | `agent-runner upgrade [--target X.Y.Z]` | Full auto: graceful stop → pip → smoke → start, auto-rollback on smoke failure |
+| systemd **system** unit / self-managed supervisor | `agent-runner upgrade --no-restart` then restart yourself | Package-only: pip + smoke (no service touched); you run `sudo systemctl restart <unit>` |
+| container / pipx / fully hand-managed | `pip install --upgrade cli-agent-runner` then restart | Manual: you own both the install and the restart |
+
+Whichever path: a long-running supervisor only loads the new code **after it
+restarts** — that's why every non-`--user` path ends in a restart you run. The
+three paths are detailed below.
 
 ### Path 1 — systemd --user service (installed via `agent-runner install`)
 

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/tests/integration/test_grace_kill_emission.py

@@ -126,7 +126,7 @@ def test_round_grace_extended_emitted_when_worker_alive(tmp_path: Path) -> None:
     assert len(extended_events) == 1
     assert extended_events[0]["round_num"] == 1
     assert extended_events[0]["grace_s"] == 1
-    assert any("sleep" in c for c in extended_events[0]["live_children"])
+    assert any(c["name"] == "sleep" for c in extended_events[0]["live_children"])
 
     # round_grace_kill must NOT appear (round was busy, not idle)
     grace_kill_events = [e for e in events if e.get("event") == "round_grace_kill"]
@@ -165,9 +165,9 @@ def test_round_grace_extended_carries_ignored_children(tmp_path: Path) -> None:
     ev = extended_events[0]
 
     # The plain sleep goes to live_children (real worker)
-    assert any("sleep" in c for c in ev["live_children"])
+    assert any(c["name"] == "sleep" for c in ev["live_children"])
     # The exec -a snapshot-bash-test process goes to ignored_children
-    assert any("snapshot-bash-test" in c for c in ev["ignored_children"])
+    assert any(c["name"] == "snapshot-bash-test" for c in ev["ignored_children"])
 
     # round_grace_kill must NOT appear (real worker still alive)
     grace_kill_events = [e for e in events_list if e.get("event") == "round_grace_kill"]

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/tests/unit/test_agent_runtime_grace.py

@@ -97,7 +97,7 @@ def test_live_children_lists_backgrounded_child():
     try:
         time.sleep(0.5)  # let the backgrounded child spawn
         live, ignored = _live_children(p)
-        assert any("sleep" in k for k in live)
+        assert any(c["name"] == "sleep" for c in live)
         assert ignored == []
     finally:
         os.killpg(p.pid, signal.SIGKILL)
@@ -135,7 +135,7 @@ def test_grace_extended_when_result_but_child_running(tmp_path):
     assert result.timed_out is True  # round_timeout_s backstop reaped it
     assert len(extended) == 1  # emitted once, not per-tick
     live, ignored = extended[0]
-    assert any("sleep" in k for k in live)
+    assert any(c["name"] == "sleep" for c in live)
 
 
 def test_grace_kill_after_child_exits_then_idle(tmp_path):
@@ -175,8 +175,8 @@ def test_live_children_splits_on_ignore_pattern():
         time.sleep(0.5)
         live, ignored = _live_children(p, ignore_patterns=[re.compile(r"snapshot-bash-")])
         # One child should match the ignore pattern; the plain sleep goes to live.
-        assert any("snapshot-bash-" in c or "sleep" in c for c in ignored)
-        assert any("sleep" in c for c in live)
+        assert any(c["name"] in ("snapshot-bash-xyz", "sleep") for c in ignored)
+        assert any(c["name"] == "sleep" for c in live)
     finally:
         os.killpg(p.pid, signal.SIGKILL)
         p.wait()
@@ -191,7 +191,7 @@ def test_live_children_no_patterns_preserves_0138_behavior():
         time.sleep(0.5)
         live, ignored = _live_children(p)  # default None
         assert ignored == []
-        assert any("sleep" in c for c in live)
+        assert any(c["name"] == "sleep" for c in live)
     finally:
         os.killpg(p.pid, signal.SIGKILL)
         p.wait()
@@ -224,3 +224,45 @@ def test_grace_kill_fires_when_only_ignored_helper_alive(tmp_path):
     assert result.killed_for_grace is True
     assert result.duration_s < 4
     assert extended == []  # no extension emitted; reaped directly
+
+
+def test_live_children_stores_no_argv_secret():
+    """A child with a secret in argv -> stored dict carries only name+pid; the
+    secret string never appears."""
+    from agent_runner.agent_runtime import _live_children
+
+    p = subprocess.Popen(
+        ["bash", "-c", "exec -a 'tool --api-key sk-ant-SECRET123 x' sleep 30"],
+        start_new_session=True,
+    )
+    try:
+        time.sleep(0.5)
+        live, ignored = _live_children(p)
+        blob = repr(live + ignored)
+        assert "sk-ant-SECRET123" not in blob and "--api-key" not in blob
+        assert all(set(c) <= {"name", "pid", "matched"} for c in live + ignored)
+    finally:
+        os.killpg(os.getpgid(p.pid), signal.SIGKILL)
+        p.wait()
+
+
+def test_live_children_matched_records_pattern_not_argv():
+    """Ignore-pattern matches on full cmdline; the stored ignored entry records
+    the matched pattern string + basename, never the full argv."""
+    from agent_runner.agent_runtime import _live_children
+
+    # Background a subshell that exec-replaces itself with the secret in argv[0].
+    # _live_children sees the child process; matching fires on its full cmdline.
+    p = subprocess.Popen(
+        ["bash", "-c", "bash -c 'exec -a sk-MATCHME sleep 30' &\nwait"],
+        start_new_session=True,
+    )
+    try:
+        time.sleep(0.5)
+        live, ignored = _live_children(p, ignore_patterns=[re.compile(r"sk-MATCHME")])
+        assert ignored and ignored[0]["matched"] == "sk-MATCHME"
+        # Only name/pid/matched stored — not the raw cmdline
+        assert all(set(c) == {"name", "pid", "matched"} for c in ignored)
+    finally:
+        os.killpg(os.getpgid(p.pid), signal.SIGKILL)
+        p.wait()

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/tests/unit/test_claude_error_detector.py

@@ -629,3 +629,20 @@ def test_given_claude_log_with_529_overloaded_when_classified_then_api_transient
     )
     parsed = _parse_claude_log(log)
     assert parsed["transient_error"]["classification"] == "api_transient_5xx"
+
+
+def test_emit_transient_raw_redacted(tmp_path):
+    import json
+
+    from agent_runner._emit import emit_transient_error_detected
+
+    emit_transient_error_detected(
+        tmp_path,
+        classification="api_transient_5xx",
+        agent="claude",
+        reset_at_epoch=0,
+        round_num=1,
+        raw="boom Bearer sk-ant-LEAKvalue000111 tail",
+    )
+    payload = json.loads(sorted(tmp_path.glob("events-*.jsonl"))[-1].read_text().splitlines()[-1])
+    assert "sk-ant-LEAKvalue000111" not in payload["raw"] and "<redacted>" in payload["raw"]

{cli_agent_runner-0.1.39 → cli_agent_runner-0.1.40}/tests/unit/test_hooks.py

@@ -177,3 +177,12 @@ def test_dry_run_propagated_to_hook_context(tmp_path) -> None:
 
     assert captured, "post_round_hook was never called"
     assert captured[0].dry_run is True
+
+
+def test_summarize_error_redacts_message_and_traceback():
+    from agent_runner.hooks import _summarize_error
+
+    exc = RuntimeError("connect failed: postgresql://svc:S3cr3tPw0rd@db:5432/app")
+    out = _summarize_error(exc, tb="trace https://x-token:ghp_aaaaaaaaaaaaaaaaaaaa@h line 1")
+    assert "S3cr3tPw0rd" not in out["error_message"]
+    assert "ghp_aaaaaaaaaaaaaaaaaaaa" not in out["traceback"]