Skip to content

feat: confidential value policy and render engine - #10509

Merged
CurryYangxx merged 6 commits into
developfrom
feat/confidential-policy
Oct 19, 2026
Merged

feat: confidential value policy and render engine#10509
CurryYangxx merged 6 commits into
developfrom
feat/confidential-policy

Conversation

@CurryYangxx

@CurryYangxx CurryYangxx commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Introduces getConfidentialValuePolicy() as the single decision point for reveal/mask across all render purposes. Adds forceReveal to BaseRenderContextOptions and getSettings() to BaseRenderContext.
  • Updates buildRenderContext() to track per-key confidentiality via EnvironmentRenderLayer so isConfidential KV pairs are masked before entering renderSubContext() — preview masking cannot pollute subsequent send.
  • Wires maskOrDecryptVaultDataIfNecessary() through the same policy so SECRET reveal/mask now follows hideSecretValuesInPreviewAndConsole.

@CurryYangxx
CurryYangxx added this pull request to stack #10481 September 16, 2026 10:23
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch from c83dbc6 to 873424d Compare September 16, 2026 10:29
@CurryYangxx
CurryYangxx marked this pull request as draft September 16, 2026 10:30
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 2 times, most recently from 9c95c3c to 6f9d184 Compare September 17, 2026 09:29
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 2 times, most recently from bbefb74 to d51f384 Compare September 17, 2026 11:50
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 3 times, most recently from e6f9550 to 3cca128 Compare September 28, 2026 10:31
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch from 3cca128 to 5fb5c5a Compare September 28, 2026 10:31
@CurryYangxx CurryYangxx changed the title feat(phase3-engine): confidential value policy and render engine feat: confidential value policy and render engine Sep 28, 2026
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch from aa48058 to a090ca2 Compare September 29, 2026 09:31
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 3 times, most recently from 3e48d66 to 33a3049 Compare September 30, 2026 06:50
@CurryYangxx
CurryYangxx marked this pull request as ready for review September 30, 2026 07:01
@CurryYangxx
CurryYangxx requested review from cwangsmv and a balanced review from Copilot September 30, 2026 07:01
Copilot AI reviewed Sep 30, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions

github-actions Bot commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ KSAI Review: Finished

  1. 07:05 UTC Tracing rendering and masking logic across changed modules
  2. 07:07 UTC Tracing render context secrets handling across related modules
  3. 07:09 UTC Tracing sensitive-value handling through render and network layers
  4. 07:11 UTC Tracing how secrets flow through rendering and export paths
Run report (federated) · 1 paid run · $0.1521 total
# Engine Result Model Turns Cost
1 opencode success glm-5.3-flash/max 53 $0.1516

Reviewing cost $0.1516; deciding how to run it cost $0.0005

@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 2 times, most recently from 0d36a24 to 47da75c Compare October 13, 2026 08:39
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch from 47da75c to 014bce5 Compare October 13, 2026 08:40
Base automatically changed from feat/mark-env-confidential to develop October 14, 2026 07:19
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 7 times, most recently from a122115 to 3738631 Compare October 19, 2026 06:11
cwangsmv
cwangsmv previously approved these changes Oct 19, 2026
View reviewed changes
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch from 3738631 to b6fa9b9 Compare October 19, 2026 08:07
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch 2 times, most recently from 8a73c9c to 601ded1 Compare October 19, 2026 09:07
CurryYangxx and others added 6 commits October 19, 2026 17:38
@CurryYangxx @claude
feat(phase3-engine): implement confidential value policy and render e…
fbd6636 
…ngine

Introduce getConfidentialValuePolicy() as the single decision point for
reveal/mask across all render surfaces (Phase 3.0). Extend RenderPurpose
with 'codegen' and add forceReveal/getSettings() to BaseRenderContext.

Update buildRenderContext() to track per-key ConfidentialValueKind via
EnvironmentRenderLayer so normal-confidential KV pairs are masked before
entering renderSubContext() — preview cannot pollute subsequent send
(Phase 3.1).

Wire maskOrDecryptVaultDataIfNecessary() through the same policy so
SECRET reveal/mask follows hideSecretValuesInPreviewAndConsole.

Add explicit purpose:'codegen' to exportHarWithRequest/exportHarRequest
IPC path so Generate Code always masks confidential values independent of
the user setting (Phase 3.4 IPC layer).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@CurryYangxx @claude
refactor(phase3-engine): remove codegen purpose — generate-code calle…
bf57cfc 
…rs use preview

codegen and preview now have identical policy semantics (both controlled by
hideSecretValuesInPreviewAndConsole; forceReveal only applies at call-site for
preview). Keeping a separate purpose added complexity with no behavioural benefit.

Remove 'codegen' from RenderPurpose, drop the codegen branch from
getConfidentialValuePolicy, and restore shouldMaskExternalVaultTag to intercept
only 'preview'. Generate Code / Copy as cURL callers will pass purpose:'preview'
instead (updated in the UI branch).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@CurryYangxx @claude
refactor(phase3-engine): extract buildEnvironmentRenderLayers from bu…
cd39eab 
…ildRenderContext

Pure extract-function: the environment layer construction is unchanged,
just moved into its own exported function so downstream stacked PRs
(T9/T10 confidential-value prefill) can reuse the same layer
enumeration instead of re-implementing it. buildRenderContext's
behavior is unchanged and remains covered by render.test.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@CurryYangxx @claude
fix(phase3-engine): stop buildEnvironmentRenderLayers mutating the an…
4eac65b 
…cestors array

for (const doc of (ancestors || []).reverse()) reversed the caller's
array in place. Now that the layer construction is extracted into a
standalone function, downstream callers (e.g. a T9/T10 prefill pass
that enumerates the same layers before the real render pass) can
receive the same ancestors array and call it twice, flipping the
folder precedence order on the second call. Copy before reversing so
the caller's array is left untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@CurryYangxx
update
55fb07a
@CurryYangxx
fix: comment
b8d6311
@CurryYangxx
CurryYangxx force-pushed the feat/confidential-policy branch from 601ded1 to b8d6311 Compare October 19, 2026 09:38
@CurryYangxx
CurryYangxx merged commit e192271 into develop Oct 19, 2026
24 checks passed
@CurryYangxx
CurryYangxx deleted the feat/confidential-policy branch October 19, 2026 09:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@cwangsmv cwangsmv cwangsmv approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@CurryYangxx @cwangsmv