collectSecretValues

collectSecretValues(config, env): string[]

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/utils/redactSecrets.ts:183

Collect the literal secret VALUES to substitute everywhere (technique 1), from two sources:

• process-env vars whose NAME matches SECRET_ENV_NAME_RE, PLUS the specific var(s) named by any apiKeyEnvironmentVariable in the config;
• non-empty inline secret field values in the config (technique 3’s field names), so a key pasted inline is scrubbed wherever it also surfaces (transcript, log, env), not only in config.json.

env is a PARAMETER — never read ambiently — so the pass is pure, reusable (GS2-48) and deterministic in tests. Values shorter than MIN_SECRET_LITERAL_LENGTH are skipped. The result is returned longest-first so an overlapping-substring secret can’t leave a shorter one partially intact. Never throws (a hostile config getter is swallowed — patterns + structural masking still apply).

Parameters

config

unknown

env

Record<string, string | undefined>

Returns

string[]