codereview-loop 0.13.0__py3-none-any.whl

codereview/herdrhost.py

@@ -0,0 +1,373 @@
+#!/usr/bin/env python3
+"""codereview herdr pane hosting (Epic K3a) — an OPTIONAL
+transport for agent seats the user already configured.
+
+Herdr (github.com/herdrdev/herdr) is a terminal runtime that
+hosts coding-agent CLIs in supervised panes. A seat whose name
+is listed under `[hosting] herdr = [...]` in the saved user
+config may run inside a herdr pane instead of a headless
+subprocess, so the user can watch (and intervene in) the run
+from herdr's UI. Nothing else changes: same spec, same prompt
+contract, same record discipline, same gate. Herdr never
+becomes a hard dependency — with herdr absent, too old, or
+schema-mismatched, the adapter is inert, the seats run
+headless exactly as before, and the run record carries one
+line saying why (the CLI puts it in `herdr_hosting` via
+record_extra).
+
+Binding layer: herdr's CLI wrappers only (`herdr workspace
+create`, `herdr pane run`, `herdr pane get`, `herdr api
+snapshot`, ...). Raw socket access is a separate later
+decision, per the K spec. Two surface choices worth stating:
+
+  * The seat is launched with `pane run`, not `agent start`.
+    `agent start` launches a RECOGNISED agent kind for
+    interactive prompting; a CodeReview seat is a one-shot
+    command with a file/stdin/stdout contract, which is
+    exactly what herdr's own automation docs assign to pane
+    commands ("shells, tests, servers, CI watchers, and other
+    ordinary terminal processes"). The packet itself is never
+    typed: the pane command line redirects stdin FROM the
+    prompt file and names it in $CODEREVIEW_PROMPT (passed
+    via `workspace create --env`, never typed either) — the
+    same contract the headless runner gives the seat.
+  * There is no `events` CLI in herdr: events.subscribe /
+    events.wait exist only on the socket API. The wrapper-
+    layer subscription is therefore a supervised watch —
+    repeated `pane get` polls standing in for
+    pane.agent_status_changed / pane.exited — and any break
+    in that watch (a failed poll, a vanished pane) is treated
+    as the socket layer's `events_lost`: reconcile ONCE via
+    `herdr api snapshot` (session.snapshot), then continue
+    only if the snapshot shows the same pane with the same
+    terminal_id. A pane that is gone, or whose terminal_id
+    changed (herdr restarted and restored layout — a resumed
+    session whose in-flight context cannot be proven
+    identical, spec U5), is a recorded seat failure. There is
+    no silent resume, ever: the adapter never re-creates a
+    pane or re-runs a command inside an attempt.
+
+Truth seniority (K spec §5.1, K2 §4.2): the seat's outcome is
+decided by OUR files — the capture files and the exit-code
+file the pane command writes — exactly as the headless runner
+decides from its subprocess. Herdr's agent_status is signal
+#4, advisory only: it is recorded in the run's hosting
+receipt and may surface an advisory blocked:input episode in
+the seat-state trace while the seat runs; it never raises,
+clears, or re-weights a finding, and when it disagrees with
+the files, the files win and the disagreement stays in the
+receipt's observations.
+
+Environment discipline (spec U7): the pane is the user's own
+terminal session — herdr injects its HERDR_* variables and
+the user's shell environment applies. We add exactly one
+variable of our own, CODEREVIEW_PROMPT (a path, not a
+secret), plus HOME when the seat spec says home=private.
+Operator API keys are never added to a pane: the headless
+allow-list exists so keys stay out of agent processes, and
+hosting does not smuggle them back in through the terminal.
+
+Version discipline: the adapter feature-detects against
+`herdr api schema --json` (the method and event names below
+must all be present) and enforces MIN_HERDR_VERSION. The
+floor and the name list are set from the herdr tree inspected
+at build time (0.9.5, protocol 22); U8's cross-release schema
+diff could not be run from a single clone, so the floor is
+the oldest 0.9.x line and the schema check does the real
+work on every run.
+
+Live-smoke status: UNVERIFIED on the build machine — no real
+herdr is installed there (and no Rust toolchain to build
+one). The full lifecycle is tested against a stub `herdr`
+executable implementing the used CLI surface; a real-herdr
+smoke remains an open verification item, recorded as such in
+the changelog.
+"""
+
+from __future__ import annotations
+
+import contextvars
+import json
+import os
+import re
+import shutil
+import subprocess
+
+# Oldest herdr the adapter will drive (see module docstring).
+MIN_HERDR_VERSION = (0, 9, 0)
+
+# The socket methods the used CLI wrappers stand on, and the
+# event types the wrapper-layer watch stands in for. All must
+# appear in `herdr api schema --json`; a herdr missing any of
+# them is a schema mismatch and the adapter stays inert.
+REQUIRED_METHODS = (
+    "workspace.create", "workspace.close",
+    "pane.get", "pane.close", "pane.send_input",
+    "agent.get", "session.snapshot",
+)
+REQUIRED_EVENTS = ("pane.agent_status_changed", "pane.exited")
+
+# Bound on a single herdr CLI call (seconds). The seat's own
+# timeout bounds the run; these calls are control-plane only.
+CLI_TIMEOUT = 15
+
+# The current job's hosting-receipt box (a list), installed by
+# core._review_job exactly as seatstate.CURRENT is: a hosted
+# seat callable appends one receipt per attempt, and the job
+# owner attaches the LAST one (the determining attempt's) to
+# the result as `hosting`. ContextVar so concurrent jobs on
+# pooled threads never share a box. Default None: no box, no
+# receipts — headless runs are untouched.
+RECEIPTS = contextvars.ContextVar(
+    "codereview_herdr_receipts", default=None)
+
+
+class HerdrError(Exception):
+    """One herdr CLI call failed (exit != 0, timeout, or
+    unparseable output). The message carries the herdr stderr
+    tail when there is one — recorded, never invented."""
+
+
+def parse_version(text):
+    """'herdr 0.9.5' / '0.9.5-preview.123' -> (0, 9, 5);
+    None when no dotted triple is present."""
+    m = re.search(r"(\d+)\.(\d+)\.(\d+)", text or "")
+    if not m:
+        return None
+    return tuple(int(g) for g in m.groups())
+
+
+def version_str(version):
+    return ".".join(str(n) for n in version)
+
+
+def schema_names(schema_text):
+    """All method/event names a schema document mentions.
+    Walks every string in the parsed JSON (method names live
+    under `schemas.request`, event names under
+    `schemas.event` / `schemas.subscription_event`, but the
+    walk does not depend on that layout — a schema that
+    reorganises its sections still feature-detects)."""
+    try:
+        doc = json.loads(schema_text)
+    except (ValueError, TypeError, RecursionError):
+        return set()
+    names = set()
+    stack = [doc]
+    while stack:
+        node = stack.pop()
+        if isinstance(node, dict):
+            stack.extend(node.values())
+        elif isinstance(node, list):
+            stack.extend(node)
+        elif isinstance(node, str) and re.fullmatch(
+                r"[a-z_]+\.[a-z_]+", node):
+            names.add(node)
+    return names
+
+
+def _default_run(argv, timeout):
+    """(returncode, stdout, stderr) for one herdr CLI call.
+    A timeout or a missing binary is returncode -1 with the
+    reason on stderr — callers turn it into HerdrError."""
+    try:
+        proc = subprocess.run(
+            argv, capture_output=True, text=True, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        return -1, "", f"timed out after {timeout}s"
+    except OSError as exc:
+        return -1, "", f"could not run: {exc}"
+    return proc.returncode, proc.stdout or "", proc.stderr or ""
+
+
+class HerdrHost:
+    """A detected, feature-checked herdr session, driven
+    through its CLI. One instance serves a whole run; every
+    hosted seat attempt creates and closes its own workspace
+    (labelled, so leftovers are recognisable)."""
+
+    def __init__(self, binary, version, run_fn=None):
+        self.binary = binary
+        self.version = version  # tuple, e.g. (0, 9, 5)
+        self._run = run_fn or _default_run
+
+    @property
+    def version_text(self):
+        return version_str(self.version)
+
+    def _cli(self, args, timeout=CLI_TIMEOUT):
+        rc, out, err = self._run([self.binary, *args], timeout)
+        if rc != 0:
+            tail = (err or out).strip()[-300:]
+            raise HerdrError(
+                f"herdr {' '.join(args[:2])} exited {rc}"
+                + (f": {tail}" if tail else ""))
+        return out
+
+    def _cli_json(self, args, timeout=CLI_TIMEOUT):
+        out = self._cli(args, timeout=timeout)
+        try:
+            doc = json.loads(out)
+        except (ValueError, RecursionError) as exc:
+            # RecursionError: output nested past the
+            # interpreter limit is unparseable for our
+            # purposes (P3-08), not a crash in the caller.
+            raise HerdrError(
+                f"herdr {' '.join(args[:2])} returned "
+                f"unparseable output: {exc}") from exc
+        if not isinstance(doc, dict):
+            # Every consumer of this helper calls .get on the
+            # result; a bare list/null/scalar is a malformed
+            # envelope and must fail as HerdrError (which
+            # detect() turns inert), never as AttributeError
+            # in snapshot()/create_workspace()/pane_get().
+            raise HerdrError(
+                f"herdr {' '.join(args[:2])} returned a "
+                f"non-object document "
+                f"({type(doc).__name__})")
+        if "error" in doc:
+            raise HerdrError(
+                f"herdr {' '.join(args[:2])} reported "
+                f"{str(doc['error'])[:300]}")
+        # CLI responses are envelopes ({"id":..., "result":{...}});
+        # accept a bare payload too, so a wrapper that prints the
+        # result directly still binds.
+        if isinstance(doc.get("result"), dict):
+            return doc["result"]
+        return doc
+
+    # -- session ------------------------------------------------
+    def snapshot(self):
+        """session.snapshot -> the snapshot dict (workspaces,
+        tabs, panes, agents). Reconciliation source of truth
+        after any watch break."""
+        result = self._cli_json(["api", "snapshot"])
+        snap = result.get("snapshot")
+        return snap if isinstance(snap, dict) else result
+
+    # -- panes --------------------------------------------------
+    def create_workspace(self, cwd, label, env=None):
+        """-> (workspace_id, pane_id) for a fresh CodeReview
+        workspace whose root pane sits in `cwd`. `env` rides
+        herdr's own --env (the launched process's environment)
+        — values are never typed into the pane."""
+        args = ["workspace", "create", "--cwd", cwd,
+                "--label", label, "--no-focus"]
+        for key in sorted((env or {})):
+            args += ["--env", f"{key}={env[key]}"]
+        result = self._cli_json(args)
+        pane = result.get("root_pane") or {}
+        workspace = result.get("workspace") or {}
+        pane_id = pane.get("pane_id")
+        workspace_id = workspace.get("workspace_id")
+        if not pane_id or not workspace_id:
+            if workspace_id:
+                # Half-created: the workspace exists server-
+                # side and this id is the only handle anyone
+                # will ever have on it — close it now rather
+                # than leak it.
+                try:
+                    self.close_workspace(workspace_id)
+                except HerdrError:
+                    pass
+            raise HerdrError(
+                "herdr workspace create returned no "
+                "root_pane/workspace ids")
+        return workspace_id, pane_id
+
+    def pane_run(self, pane_id, command_line):
+        """Submit one command line to the pane's shell
+        (pane.send_input under the wrapper; quiet on success).
+        The line is a launcher for the seat command — the
+        review packet itself is never in it (it travels by
+        file; see the module docstring)."""
+        self._cli(["pane", "run", pane_id, command_line])
+
+    def pane_get(self, pane_id):
+        """-> the PaneInfo dict for `pane_id`, or None when
+        herdr answers cleanly that no such pane exists.
+        Transport failures raise HerdrError."""
+        result = self._cli_json(["pane", "get", pane_id])
+        pane = result.get("pane")
+        return pane if isinstance(pane, dict) else result
+
+    def close_workspace(self, workspace_id):
+        self._cli(["workspace", "close", workspace_id])
+
+    def close_pane(self, pane_id):
+        self._cli(["pane", "close", pane_id])
+
+
+def detect(environ=None, which_fn=None, run_fn=None):
+    """Probe the machine for a usable herdr, in the spec's
+    order: on PATH -> version floor -> schema feature-detect
+    -> reachable session. Returns a plan dict:
+
+        {"active": True,  "host": HerdrHost, "version": (x,y,z),
+         "reason": None}
+        {"active": False, "host": None, "version": ... or None,
+         "reason": "<one line, recorded verbatim in the record>"}
+
+    `environ` is accepted for symmetry with userconfig (the
+    probe reads HERDR_SOCKET_PATH's presence from it for the
+    reason line); which_fn/run_fn are injectable for tests."""
+    environ = os.environ if environ is None else environ
+    which_fn = shutil.which if which_fn is None else which_fn
+    run_fn = _default_run if run_fn is None else run_fn
+    binary = which_fn("herdr")
+    if not binary:
+        return {"active": False, "host": None, "version": None,
+                "reason": "herdr not found on PATH"}
+    rc, out, err = run_fn([binary, "--version"], CLI_TIMEOUT)
+    if rc != 0:
+        tail = (err or out).strip()[-200:]
+        return {"active": False, "host": None, "version": None,
+                "reason": "herdr --version failed"
+                + (f": {tail}" if tail else "")}
+    version = parse_version(out)
+    if version is None:
+        return {"active": False, "host": None, "version": None,
+                "reason": "herdr --version printed no version: "
+                + (out.strip()[:120] or "(empty)")}
+    if version < MIN_HERDR_VERSION:
+        return {"active": False, "host": None,
+                "version": version,
+                "reason": f"herdr {version_str(version)} is "
+                f"below the adapter minimum "
+                f"{version_str(MIN_HERDR_VERSION)}"}
+    host = HerdrHost(binary, version, run_fn=run_fn)
+    rc, out, err = run_fn([binary, "api", "schema", "--json"],
+                          CLI_TIMEOUT)
+    if rc != 0:
+        tail = (err or out).strip()[-200:]
+        return {"active": False, "host": None,
+                "version": version,
+                "reason": "herdr api schema --json failed"
+                + (f": {tail}" if tail else "")}
+    names = schema_names(out)
+    missing = [n for n in REQUIRED_METHODS + REQUIRED_EVENTS
+               if n not in names]
+    if missing:
+        return {"active": False, "host": None,
+                "version": version,
+                "reason": "herdr schema mismatch: missing "
+                + ", ".join(missing)}
+    try:
+        host.snapshot()
+    except HerdrError as exc:
+        where = ("HERDR_SOCKET_PATH is set"
+                 if environ.get("HERDR_SOCKET_PATH")
+                 else "no HERDR_SOCKET_PATH set")
+        return {"active": False, "host": None,
+                "version": version,
+                "reason": f"no reachable herdr session "
+                f"({where}): {exc}"}
+    return {"active": True, "host": host, "version": version,
+            "reason": None}
+
+
+def inert_line(plan):
+    """The ONE line the run record carries when hosting was
+    configured but the adapter stayed inert (record_extra key
+    `herdr_hosting`, written by the CLI)."""
+    return f"inert: {plan['reason']}"

codereview/hooks.py

@@ -0,0 +1,261 @@
+#!/usr/bin/env python3
+"""Lifecycle hooks — Epic L3 of the adopted roadmap.
+
+A project may declare shell commands in the `[hooks]` table of
+its `.codereview.toml` (validated by policy.py in the B1 style)
+that fire at three points in a review run's lifecycle:
+
+  pre-run       before any seat call — fired by the CLI once
+                every setup step has succeeded and the run is
+                committed;
+  on-blocked    after the record is written, when the run's
+                first seat (in record order) ended in a K2
+                blocked class (quota / auth / input / stalled).
+                The name means a SEAT blocked, not that the
+                gate verdict is BLOCKED (P6-09): a PASS run
+                with a blocked seat fires it, a BLOCKED run
+                with no blocked seat does not. The [hooks]
+                policy key `on_seat_blocked` is accepted as
+                an alias for `on_blocked` (policy.py folds
+                it into the same slot);
+  post-verdict  after the record is written, on every run that
+                configures it.
+
+A hook receives the event name and — for the two post-record
+events — the run record's path, in the CODEREVIEW_HOOK_EVENT
+/ CODEREVIEW_HOOK_RECORD environment variables, and as the
+positional parameters $1 / $2 OF THE COMMAND STRING: the
+command runs under `sh -c` with those values as its $1 / $2,
+so a shell-string command (`hook.sh "$1" "$2"`) forwards them
+to the script, while a bare script path receives no arguments
+and must read the environment variables (P5-10, pinned by
+tests/test_phase5_fixes.py).
+
+Execution is the Epic C evidence sandbox, reused whole: a hook
+runs as a single-command `evidence.collect` config, so it gets
+the C5 confinement verbatim — a throwaway copy of the tree as
+cwd (.git excluded, deleted afterwards), an environment built
+from the allow-list (no provider keys, no tokens), no network
+by default, a wall-clock timeout enforced by killing the whole
+process group, and output stored as sha256 + a redacted tail.
+There is deliberately no second executor in this module.
+
+Timing contract for the post-record events: the record is
+written first (so the path handed to the hooks exists and the
+file already carries the verdict and the pre-run result), the
+hooks fire, and then the CLI appends their results to the
+record's `hooks` section and rewrites the record once at the
+same path. The file a hook reads is therefore the file that
+ends up carrying the complete hooks ledger.
+
+Enforcement flows one way only. A hook's result is data for
+the record; a hook that fails, times out, or names a missing
+command is recorded and the run continues. Nothing in this
+module returns a value the gate reads — there is no path by
+which a hook can change a verdict, a finding, or any other
+gate input, and `fire_hook` never raises.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import shlex
+
+from . import evidence as _evidence
+from .core import redact_secrets
+
+SCHEMA = "codereview.hooks/1"
+
+# Event names, in lifecycle order, mapped to their [hooks]
+# policy keys. Mirrors policy._HOOK_COMMAND_KEYS; a test pins
+# the two together so they cannot drift.
+EVENTS = ("pre-run", "on-blocked", "post-verdict")
+_EVENT_KEYS = {"pre-run": "pre_run", "on-blocked": "on_blocked",
+               "post-verdict": "post_verdict"}
+
+# A hook with no configured timeout gets the evidence runner's
+# own default bound — one timeout discipline for every command
+# the sandbox executes (C5).
+DEFAULT_TIMEOUT = _evidence.DEFAULT_TIMEOUT
+
+
+def hooks_from_policy(policy):
+    """The hooks config carried by a loaded policy dict, or
+    None when the policy configures no hook command (no
+    [hooks] table, or a table with only a timeout). The
+    returned dict is keyed by policy key (pre_run / on_blocked
+    / post_verdict) plus an optional "timeout"."""
+    if not isinstance(policy, dict):
+        return None
+    hooks = policy.get("hooks") or {}
+    config = {}
+    for event in EVENTS:
+        command = hooks.get(_EVENT_KEYS[event])
+        if isinstance(command, str) and command.strip():
+            config[_EVENT_KEYS[event]] = command
+    if not config:
+        return None
+    if hooks.get("timeout") is not None:
+        config["timeout"] = hooks["timeout"]
+    return config
+
+
+def first_blocked_trigger(reviewer_reports):
+    """The on-blocked trigger for a finished round: the first
+    reviewer report (in record order) whose seat ended in a K2
+    blocked class, as {"seat", "lens", "class", "state_source"}
+    — or None when no seat blocked.
+
+    Both seat-state slots are read: `seat_state` is the seat
+    that finally served (or failed), and `seat_state_primary`
+    is the primary seat's own terminal state when a fallback
+    served in its place — a primary that blocked on quota is
+    the run's first blocked seat even though the fallback's
+    report row reads done. `state_source` names which slot
+    matched, so the record says exactly what was read."""
+    for report in reviewer_reports or []:
+        if not isinstance(report, dict):
+            continue
+        for key in ("seat_state", "seat_state_primary"):
+            state = report.get(key)
+            if isinstance(state, dict) \
+                    and state.get("state") == "blocked":
+                return {"seat": report.get("provider"),
+                        "lens": report.get("lens"),
+                        "class": state.get("class"),
+                        "state_source": key}
+    return None
+
+
+def _wrapped_command(command, event, record_path):
+    """The shell string the sandbox executes for a hook: the
+    event and record path exported as environment variables,
+    then the user's command run by a nested shell with the
+    same values as positional arguments $1 / $2 ($0 is a fixed
+    label). Every interpolated value is shlex-quoted; the user
+    command itself is data to the outer shell, quoted whole."""
+    record = record_path or ""
+    return (
+        f"CODEREVIEW_HOOK_EVENT={shlex.quote(event)} "
+        f"CODEREVIEW_HOOK_RECORD={shlex.quote(record)} "
+        f"sh -c {shlex.quote(command)} codereview-hook "
+        f"{shlex.quote(event)} {shlex.quote(record)}")
+
+
+def fire_hook(command, event, source_dir, record_path=None,
+              timeout=None, environ=None):
+    """Run one hook command through the evidence sandbox and
+    return its ledger entry. Never raises: a hook that cannot
+    even start (the sandbox itself failed) is an "error" entry,
+    exactly like an evidence item that could not run.
+
+    The entry: {"event", "command", "record_path", "status",
+    "exit_code", "duration_s", "output_sha256", "output_tail",
+    "network_mode", "detail"} — status/exit/duration/output
+    are the evidence item's own fields, so a hook's outcome is
+    recorded with the same fidelity as required evidence.
+
+    The stored "command" is redacted (P6-13): a hook command
+    is operator text that can embed a credential (a curl
+    header, a token argument), and the record is a durable
+    artefact that travels. The EXECUTED command is the raw
+    string, unchanged — only the ledger copy passes through
+    the same redact_secrets the evidence tails get."""
+    if timeout is None:
+        timeout = DEFAULT_TIMEOUT
+    entry = {"event": event, "command": redact_secrets(command),
+             "record_path": record_path}
+    config = {
+        "commands": [{
+            "name": f"hook:{event}",
+            "command": _wrapped_command(command, event,
+                                        record_path),
+            "required": False,
+            "timeout": timeout}],
+        "timeout": timeout,
+    }
+    try:
+        record = _evidence.collect(config, source_dir,
+                                   environ=environ)
+        items = record.get("items") or []
+        item = items[0] if items else {}
+    except Exception as exc:  # noqa: BLE001 — recorded, not raised
+        item = {"status": "error", "exit_code": None,
+                "duration_s": 0.0,
+                "output_sha256": hashlib.sha256(b"").hexdigest(),
+                "output_tail": "", "network_mode": None,
+                "detail": f"hook could not run: {exc}"}
+    entry.update({
+        "status": item.get("status"),
+        "exit_code": item.get("exit_code"),
+        "duration_s": item.get("duration_s"),
+        "output_sha256": item.get("output_sha256"),
+        "output_tail": item.get("output_tail") or "",
+        "network_mode": item.get("network_mode"),
+        "detail": item.get("detail") or "",
+    })
+    return entry
+
+
+class HookRunner:
+    """One run's hook ledger: fires each configured event at
+    most once, in the order the CLI calls them, and accumulates
+    the results the record's `hooks` section carries.
+
+    `blocked_trigger` is set by the CLI (from
+    first_blocked_trigger) before on-blocked fires; the
+    on-blocked result carries it as its "trigger"."""
+
+    def __init__(self, config, source_dir, environ=None):
+        self.config = dict(config or {})
+        self.source_dir = source_dir
+        self.environ = environ
+        self.results = []
+        self.blocked_trigger = None
+        self._fired = set()
+
+    def configured_events(self):
+        """The configured event names, in lifecycle order."""
+        return [event for event in EVENTS
+                if self.config.get(_EVENT_KEYS[event])]
+
+    def configured(self, event):
+        return event in self.configured_events()
+
+    def fire(self, event, record_path=None):
+        """Fire `event` if it is configured and has not fired
+        yet; return its ledger entry, or None when the event
+        does not fire (unconfigured, or already fired — each
+        event fires exactly once per run)."""
+        if event in self._fired or not self.configured(event):
+            return None
+        self._fired.add(event)
+        entry = fire_hook(
+            self.config[_EVENT_KEYS[event]], event,
+            self.source_dir, record_path=record_path,
+            timeout=self.config.get("timeout"),
+            environ=self.environ)
+        if event == "on-blocked" \
+                and self.blocked_trigger is not None:
+            entry["trigger"] = dict(self.blocked_trigger)
+        self.results.append(entry)
+        return entry
+
+    def section(self):
+        """The record's `hooks` section, or None when no hook
+        is configured (a hookless run's record carries no hooks
+        key at all — byte-identical to before Epic L3)."""
+        if not self.configured_events():
+            return None
+        return {
+            "schema": SCHEMA,
+            # The configured commands are recorded redacted
+            # (P6-13, same rule as the results entries): the
+            # config itself keeps the raw text for execution.
+            "events": [{"event": event,
+                        "command": redact_secrets(
+                            self.config[_EVENT_KEYS[event]])}
+                       for event in self.configured_events()],
+            "blocked_trigger": self.blocked_trigger,
+            "results": list(self.results),
+        }