Module redact 

Redact secret settings keys from the full-config JSON before it is sent to any renderer/frontend connection.

Found in PR #2751 review: voice:groqApiKey’s own doc comment claims “Read server-side only, never sent to the renderer,” but get_full_config()’s outbound JSON (the initial config event, the getfullconfig RPC, and the post-setconfig broadcast — all three call sites in server/websocket.rs) was never actually filtered, so the real plaintext key has always reached every renderer connection’s JS memory. PR #2751 introduced a masked-dot Settings UI for this key (MaskedKeyField) that visually implies the opposite. This module makes the doc comment’s claim actually true.

The renderer’s UI only needs to know a value IS set, never what it is, so redaction replaces the real value with a fixed non-empty placeholder (distinguishable from “unset”) rather than merely blanking it. The write path (setconfig → merge_settings_to_disk/merge_settings_into_current) is untouched — this only filters the server → renderer read direction.

Constants

REDACTED_PLACEHOLDER 🔒

Placeholder written in place of a redacted value. Any renderer code that merely checks “is a key set” (e.g. MaskedKeyField’s locked-state gate) keeps working unchanged; nothing should ever display this string as if it were the real value.

REDACTED_SETTINGS_KEYS 🔒

Settings keys whose values must never reach a renderer connection. Extend this list as more secret-shaped fields get a Settings UI (e.g. the messaging-bridge bot tokens proposed in docs/specs/SPEC_SETTINGS_MESSAGING_BRIDGES_SECTION_2026_08_22.md).

Functions

redact_full_config_for_renderer

Redact known-secret keys in-place on an already-serialized full-config JSON value. Call this on every path that sends config to a renderer; never on the in-memory ConfigState state or the on-disk file.