Harden CLI lane filtering and diagnostics redaction

internal/core/config/redaction_test.go

@@ -35,3 +35,67 @@ func TestRedactedConfigRemovesAPIKeyValues(t *testing.T) {
 		t.Fatalf("redaction mutated original config")
 	}
 }
+
+func TestConfigRedactedDiagnosticsPayloadRedactsAPIKeys(t *testing.T) {
+	cfg := Default()
+	profile := cfg.LLMProfiles[pipeline.DefaultLLMProfile]
+	profile.APIKey = "secret"
+	profile.Model = "test-model"
+	cfg.LLMProfiles[pipeline.DefaultLLMProfile] = profile
+
+	payload, ok := cfg.RedactedDiagnosticsPayload().(Config)
+	if !ok {
+		t.Fatalf("expected Config payload, got %T", cfg.RedactedDiagnosticsPayload())
+	}
+	if payload.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != redactedSecret {
+		t.Fatalf("expected API key redacted, got %+v", payload.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if payload.LLMProfiles[pipeline.DefaultLLMProfile].Model != "test-model" {
+		t.Fatalf("expected non-secret fields preserved, got %+v", payload.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if cfg.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != "secret" {
+		t.Fatalf("redacted diagnostics payload mutated original config")
+	}
+}
+
+func TestEffectiveConfigRedactedDiagnosticsPayloadRedactsAndCopies(t *testing.T) {
+	cfg := validConfig()
+	profile := cfg.LLMProfiles[pipeline.DefaultLLMProfile]
+	profile.APIKey = "secret"
+	cfg.LLMProfiles[pipeline.DefaultLLMProfile] = profile
+	lane := cfg.Pipelines["example"].Artifacts["events"]
+	lane.Extract.Options = map[string]any{"temperature": 0.2}
+	cfg.Pipelines["example"].Artifacts["events"] = lane
+
+	effective, err := cfg.Resolve(ResolveInput{
+		PipelineID: "example",
+		Only:       []string{"events"},
+		Catalog:    fakeCatalog(t),
+	})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+
+	payload, ok := effective.RedactedDiagnosticsPayload().(EffectiveConfig)
+	if !ok {
+		t.Fatalf("expected EffectiveConfig payload, got %T", effective.RedactedDiagnosticsPayload())
+	}
+	if payload.Config.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != redactedSecret {
+		t.Fatalf("expected nested API key redacted, got %+v", payload.Config.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if cfg.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != "secret" {
+		t.Fatalf("redacted diagnostics payload mutated source config")
+	}
+	if payload.PipelineID != effective.PipelineID || payload.ResolvedPipeline.Digest != effective.ResolvedPipeline.Digest {
+		t.Fatalf("expected pipeline metadata preserved, got %+v", payload)
+	}
+
+	payload.Only[0] = "changed"
+	if effective.Only[0] != "events" {
+		t.Fatalf("expected only lanes to be copied")
+	}
+	payload.ResolvedPipeline.ArtifactLanes[0].Extract.Options["temperature"] = 1.0
+	if effective.ResolvedPipeline.ArtifactLanes[0].Extract.Options["temperature"] != 0.2 {
+		t.Fatalf("expected resolved pipeline options to be copied")
+	}
+}