fix(cli): redact env vars from attempt debug logs

.changeset/redact-attempt-debug-env.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Task environment variable values are no longer included in attempt debug logs.

packages/cli-v3/src/entryPoints/managed/execution.ts

@@ -25,6 +25,7 @@ import { type SnapshotState, SnapshotManager } from "./snapshot.js";
 import type { SupervisorSocket } from "./controller.js";
 import { RunNotifier } from "./notifier.js";
 import type { TaskRunProcessProvider } from "./taskRunProcessProvider.js";
+import { getWorkloadRunAttemptStartLogData } from "./runAttemptLogData.js";
 
 class ExecutionAbortError extends Error {
   constructor(message: string) {
@@ -447,7 +448,9 @@ export class RunExecution {
       podScheduledAt: this.podScheduledAt?.getTime(),
     });
 
-    this.sendDebugLog("started attempt", { start: start.data });
+    this.sendDebugLog("started attempt", {
+      start: getWorkloadRunAttemptStartLogData(start.data),
+    });
 
     return { ...start.data, metrics };
   }

packages/cli-v3/src/entryPoints/managed/runAttemptLogData.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { getWorkloadRunAttemptStartLogData } from "./runAttemptLogData.js";
+
+describe("getWorkloadRunAttemptStartLogData", () => {
+  it("omits environment variable values from the debug-log payload", () => {
+    const start = {
+      run: { friendlyId: "run_123" },
+      snapshot: { friendlyId: "snapshot_123" },
+      execution: { id: "execution_123" },
+      envVars: { API_KEY: "secret-value" },
+    };
+
+    expect(getWorkloadRunAttemptStartLogData(start)).toEqual({
+      run: start.run,
+      snapshot: start.snapshot,
+      execution: start.execution,
+    });
+  });
+});

packages/cli-v3/src/entryPoints/managed/runAttemptLogData.ts

@@ -0,0 +1,13 @@
+type WorkloadRunAttemptStartData = {
+  run: unknown;
+  snapshot: unknown;
+  execution: unknown;
+  envVars: Record<string, string>;
+};
+
+export function getWorkloadRunAttemptStartLogData<T extends WorkloadRunAttemptStartData>(
+  start: T
+): Pick<T, "run" | "snapshot" | "execution"> {
+  const { run, snapshot, execution } = start;
+  return { run, snapshot, execution };
+}