Module redact 

Secret redaction for connector and config values surfaced to operators (the ctx sources / GET /tools/sources listing, the workspaces discovery tool, and any future config-introspection surface).

Policy is deny-by-default: when emitting an arbitrary connector config map — for example a script connector’s extra table, whose ${VAR} values are env-expanded and may be credentials — only an allowlist of known-safe structural keys is shown verbatim; URL-bearing keys have their embedded credentials stripped; every other value is replaced with REDACTED.

This satisfies SPEC-0014 R48/R49: redact credentials, tokens, and env-expanded values, not only fields whose names literally contain secret/token.

Constants

REDACTED

Marker substituted for any redacted value.

SAFE_KEYS 🔒

Structural, non-secret connector keys that are safe to show verbatim.

URL_KEYS 🔒

Keys whose values are URLs: shown with embedded credentials stripped.

Functions

redact_connector_map

Redact an arbitrary connector-config table, deny-by-default.

redact_url

Strip credentials (userinfo) from a URL.

redact_value 🔒