Harden CLI lane filtering and diagnostics redaction

internal/core/diagnostics/run_dir.go

@@ -42,6 +42,10 @@ type RetentionDecisionInput struct {
 	HasWarnings   bool
 }
 
+type RedactedEffectiveConfigPayload interface {
+	RedactedDiagnosticsPayload() any
+}
+
 // InvocationMetadata captures non-secret invocation details for diagnostics.
 type InvocationMetadata struct {
 	Operation      string    `json:"operation"`
@@ -134,8 +138,11 @@ func (r *RunDirectory) WriteInvocationMetadata(metadata InvocationMetadata) erro
 	return r.WriteJSONArtifact(ArtifactInvocationMetadata, metadata)
 }
 
-func (r *RunDirectory) WriteRedactedEffectiveConfig(payload any) error {
-	return r.WriteJSONArtifact(ArtifactEffectiveConfig, payload)
+func (r *RunDirectory) WriteRedactedEffectiveConfig(payload RedactedEffectiveConfigPayload) error {
+	if payload == nil {
+		return fmt.Errorf("redacted effective config payload must not be nil")
+	}
+	return r.WriteJSONArtifact(ArtifactEffectiveConfig, payload.RedactedDiagnosticsPayload())
 }
 
 func (r *RunDirectory) WriteResolvedPipeline(payload any) error {

internal/core/diagnostics/run_dir_test.go

@@ -167,7 +167,7 @@ func TestWriteInvocationMetadataPreservesProvidedRunIDAndStartTime(t *testing.T)
 func TestWriteTypedArtifacts(t *testing.T) {
 	runDir := newTestRunDirectory(t)
 
-	if err := runDir.WriteRedactedEffectiveConfig(map[string]any{"redacted": true}); err != nil {
+	if err := runDir.WriteRedactedEffectiveConfig(fakeRedactedEffectiveConfig{payload: map[string]any{"redacted": true}}); err != nil {
 		t.Fatalf("WriteRedactedEffectiveConfig: %v", err)
 	}
 	if err := runDir.WriteResolvedPipeline(map[string]any{"pipeline": "test"}); err != nil {
@@ -200,6 +200,24 @@ func TestWriteTypedArtifacts(t *testing.T) {
 	}
 }
 
+func TestWriteRedactedEffectiveConfigWritesPayloadReturnedByProvider(t *testing.T) {
+	runDir := newTestRunDirectory(t)
+
+	if err := runDir.WriteRedactedEffectiveConfig(fakeRedactedEffectiveConfig{
+		payload: map[string]any{
+			"api_key": "[REDACTED]",
+			"model":   "test-model",
+		},
+	}); err != nil {
+		t.Fatalf("WriteRedactedEffectiveConfig: %v", err)
+	}
+
+	data := string(readArtifact(t, runDir, ArtifactEffectiveConfig))
+	if !strings.Contains(data, `"api_key": "[REDACTED]"`) || !strings.Contains(data, `"model": "test-model"`) {
+		t.Fatalf("unexpected effective config artifact: %s", data)
+	}
+}
+
 func TestWriteErrorLogWritesPlainTextWithTrailingNewline(t *testing.T) {
 	runDir := newTestRunDirectory(t)
 
@@ -320,3 +338,11 @@ func readArtifact(t *testing.T, runDir *RunDirectory, name string) []byte {
 	}
 	return data
 }
+
+type fakeRedactedEffectiveConfig struct {
+	payload any
+}
+
+func (f fakeRedactedEffectiveConfig) RedactedDiagnosticsPayload() any {
+	return f.payload
+}