Apply redactions to snapshot metadata

[max-sixty]

Summary

This PR implements consistent redaction behavior for both snapshot content and metadata, addressing a long-standing inconsistency where Settings.add_redaction() worked for snapshot content but not for metadata set via Settings.set_info().

Problem

Previously, redactions were only applied to snapshot content during serialization, not to metadata. This created surprising behavior for users of libraries like insta-cmd that capture sensitive data (API keys, credentials, etc.) in snapshot metadata.

Before this change:

---
info:
  env:
    API_KEY: sk_live_abc123def456  # ⚠️ Secret exposed!
---
content here

After this change:

---
info:
  env:
    API_KEY: "[REDACTED]"  # ✅ Redacted
---
content here

Implementation

Core Changes

1. Created shared redaction helper (Redactions::apply_to_content())

   • Eliminates code duplication between metadata and content redaction
   • Both paths now use identical redaction logic

2. Modified ActualSettings::info() to apply redactions to metadata

   • Metadata is redacted eagerly when set (prevents sensitive data in memory)
   • Content is still redacted lazily during serialization

3. Updated documentation

   • set_info(): Documents that redactions are automatically applied
   • set_raw_info(): Documents that it does NOT apply redactions (low-level API)

Test Coverage

Added two tests documenting the behavior:

• test_metadata_redaction: Validates set_info() applies redactions
• test_metadata_raw_info_no_redaction: Validates set_raw_info() does not

Snapshots clearly show the difference:

--- set_info() snapshot
+++ set_raw_info() snapshot
 info:
-  secret: "[REDACTED]"
+  secret: sensitive_value

Benefits

1. Security: Easier to prevent secrets in snapshots
2. Consistency: Redactions work the same everywhere
3. User expectations: add_redaction() now applies to all serialized data
4. Minimal change: ~30 lines of implementation code

Breaking Changes

Low impact: Existing snapshots with sensitive data in metadata will change (values will become redacted). This is the intended behavior and improves security.

Migration: Users can either:

• Update snapshots (recommended - secrets should be redacted)
• Remove specific redactions if certain metadata values must be preserved
• Use set_raw_info() for the low-level API that bypasses redactions

Testing

• ✅ All 164 tests pass (added 2 new tests)
• ✅ All lints pass (pre-commit)
• ✅ No compiler warnings
• ✅ Snapshot tests validate both redaction and non-redaction behavior

Related

Addresses the use case described in the proposal where libraries like insta-cmd need to redact environment variables captured in metadata.

🤖 Generated with Claude Code

[max-sixty]

@mitsuhiko lmk if you have any thoughts here, otherwise I'll likely merge. it's quite helpful to be able to redact for insta-cmd (though open if a different interface makes sense)

+ ofc open to feedback from others