merge: wave 2 executor (01-02) into main

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

paperclip-reference/server/src/__tests__/redaction.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+import { REDACTED_EVENT_VALUE, redactEventPayload, sanitizeRecord } from "../redaction.js";
+
+describe("redaction", () => {
+  it("redacts sensitive keys and nested secret values", () => {
+    const input = {
+      apiKey: "abc123",
+      nested: {
+        AUTH_TOKEN: "token-value",
+        safe: "ok",
+      },
+      env: {
+        OPENAI_API_KEY: "sk-openai",
+        OPENAI_API_KEY_REF: {
+          type: "secret_ref",
+          secretId: "11111111-1111-1111-1111-111111111111",
+        },
+        OPENAI_API_KEY_PLAIN: {
+          type: "plain",
+          value: "sk-plain",
+        },
+        PAPERCLIP_API_URL: "http://localhost:3100",
+      },
+    };
+
+    const result = sanitizeRecord(input);
+
+    expect(result.apiKey).toBe(REDACTED_EVENT_VALUE);
+    expect(result.nested).toEqual({
+      AUTH_TOKEN: REDACTED_EVENT_VALUE,
+      safe: "ok",
+    });
+    expect(result.env).toEqual({
+      OPENAI_API_KEY: REDACTED_EVENT_VALUE,
+      OPENAI_API_KEY_REF: {
+        type: "secret_ref",
+        secretId: "11111111-1111-1111-1111-111111111111",
+      },
+      OPENAI_API_KEY_PLAIN: {
+        type: "plain",
+        value: REDACTED_EVENT_VALUE,
+      },
+      PAPERCLIP_API_URL: "http://localhost:3100",
+    });
+  });
+
+  it("redacts jwt-looking values even when key name is not sensitive", () => {
+    const input = {
+      session: "aaa.bbb.ccc",
+      normal: "plain",
+    };
+
+    const result = sanitizeRecord(input);
+
+    expect(result.session).toBe(REDACTED_EVENT_VALUE);
+    expect(result.normal).toBe("plain");
+  });
+
+  it("redacts payload objects while preserving null", () => {
+    expect(redactEventPayload(null)).toBeNull();
+    expect(redactEventPayload({ password: "hunter2", safe: "value" })).toEqual({
+      password: REDACTED_EVENT_VALUE,
+      safe: "value",
+    });
+  });
+});