repositories/redactRepoConfig.ts

* Mask credential-bearing values in a derived Terrateam repo config before the console renders it. `repo_configs.data` is the effective config as committed, so it can carry literal secrets: `hooks.*.{pre,post}[].env` maps on `run`/`gates` ops (the usual place a token is pasted),

// Source: https://github.com/stategraph/stategraph | License: MPL-2.0 | Copyright under Patent Claims infringed by Covered Software in the absence of | Modified files must remain under MPL-2.0
// Modifications to this file must remain under MPL-2.0.
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Mask credential-bearing values in a derived Terrateam repo config before
 * the console renders it.
 *
 * `repo_configs.data` is the effective config as committed, so it can carry
 * literal secrets: `hooks.*.{pre,post}[].env` maps on `run`/`gates` ops (the
 * usual place a token is pasted), `storage.plans.secret_access_key` for the
 * S3 plan store, and anything a team names like a credential. Commands are
 * left visible — masking them would hide what the config does — a

... (truncated -- full source via MCP)