fix(cli): redact env vars from attempt debug logs

[RealBhupesh]

Summary

• Exclude task environment variable values from the managed attempt debug-log payload.
• Preserve the full response for execution, including environment variables needed to start the task.
• Add regression coverage and the required trigger.dev patch changeset.

Root cause

The started attempt debug log serialized the complete start response, which included the task environment variables.

Validation

• Targeted redaction test: 1 passed.
• Formatting and lint checks passed.
• Full CLI package build is currently blocked by pre-existing missing generated workspace dependencies and baseline TypeScript errors in this checkout.

This issue is already public. New security vulnerabilities should use the private reporting path in SECURITY.md.

Please keep this PR in draft until vouching and CI review are complete.

fixes #3566

[changeset-bot]

🦋 Changeset detected

Latest commit: f6c96ce

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
trigger.dev	Patch
@internal/dashboard-agent	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/python	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch
@internal/sdk-compat-tests	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Hi @RealBhupesh, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b00274a-69e6-4686-94d1-34009fb094d3

📥 Commits

Reviewing files that changed from the base of the PR and between 14824b0 and f6c96ce.

📒 Files selected for processing (4)

• .changeset/redact-attempt-debug-env.md
• packages/cli-v3/src/entryPoints/managed/execution.ts
• packages/cli-v3/src/entryPoints/managed/runAttemptLogData.test.ts
• packages/cli-v3/src/entryPoints/managed/runAttemptLogData.ts

---

Walkthrough

The change adds getWorkloadRunAttemptStartLogData to retain run, snapshot, and execution data while excluding envVars. The started-attempt debug log uses this filtered data instead of the raw API response. A test verifies the redaction and retained fields. A patch changeset documents the update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}