Redact direct API keys in request formatting

engine_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"math"
 	"net/http"
 	"net/http/httptest"
@@ -118,6 +119,79 @@ func TestPreparedRunJSONDoesNotExposeSecretOrTargetPresence(t *testing.T) {
 	}
 }
 
+func TestRunRequestFormattingRedactsDirectAPIKey(t *testing.T) {
+	const secret = "run-request-secret"
+	req := scriptorium.RunRequest{
+		PromptID:  "generic.markdown_summary",
+		ProfileID: "local-fast",
+		APIKey:    secret,
+		Inputs: map[string]scriptorium.ArtifactRef{
+			"transcript": scriptorium.Inline("Rin opens the gate."),
+		},
+	}
+
+	for _, formatted := range []string{
+		fmt.Sprint(req),
+		fmt.Sprintf("%+v", req),
+		fmt.Sprintf("%#v", req),
+	} {
+		if strings.Contains(formatted, secret) {
+			t.Fatalf("formatted RunRequest leaked API key: %s", formatted)
+		}
+		if !strings.Contains(formatted, "APIKeySet:true") {
+			t.Fatalf("formatted RunRequest should indicate an API key is set, got %s", formatted)
+		}
+	}
+
+	payload, err := json.Marshal(req)
+	if err != nil {
+		t.Fatalf("expected RunRequest to marshal, got %v", err)
+	}
+	if strings.Contains(string(payload), secret) {
+		t.Fatalf("RunRequest JSON leaked API key: %s", payload)
+	}
+}
+
+func TestGenerateRequestFormattingRedactsDirectAPIKey(t *testing.T) {
+	const secret = "generate-request-secret"
+	req := scriptorium.GenerateRequest{
+		Prompt: scriptorium.RenderedPrompt{Messages: []scriptorium.RenderedMessage{
+			{Role: "user", Content: "secret prompt content"},
+		}},
+		Target: scriptorium.ExecutionTarget{
+			Model: "test-model",
+			ExtraParams: map[string]any{
+				"provider_option": "on",
+			},
+		},
+		APIKey: secret,
+	}
+
+	for _, formatted := range []string{
+		fmt.Sprint(req),
+		fmt.Sprintf("%+v", req),
+		fmt.Sprintf("%#v", req),
+	} {
+		if strings.Contains(formatted, secret) {
+			t.Fatalf("formatted GenerateRequest leaked API key: %s", formatted)
+		}
+		if strings.Contains(formatted, "secret prompt content") {
+			t.Fatalf("formatted GenerateRequest leaked prompt content: %s", formatted)
+		}
+		if !strings.Contains(formatted, "APIKeySet:true") {
+			t.Fatalf("formatted GenerateRequest should indicate an API key is set, got %s", formatted)
+		}
+	}
+
+	payload, err := json.Marshal(req)
+	if err != nil {
+		t.Fatalf("expected GenerateRequest to marshal, got %v", err)
+	}
+	if strings.Contains(string(payload), secret) {
+		t.Fatalf("GenerateRequest JSON leaked API key: %s", payload)
+	}
+}
+
 func TestPreparePreservesExplicitZeroExecutionOverrides(t *testing.T) {
 	engine := newExampleEngine(t)
 	zeroFloat := 0.0