Workspace(fix[lifecycle]): Redact hook command logs

why: Lifecycle hook commands may contain expanded credentials, so normal logs must not persist the command text.
what:
- Replace hook command log extras with a redacted placeholder
- Add coverage that hook failure logging keeps exit codes without leaking command text

Author: tony

src/tmuxp/util.py

@@ -23,6 +23,7 @@
 logger = logging.getLogger(__name__)
 
 PY2 = sys.version_info[0] == 2
+_REDACTED_HOOK_COMMAND = "<redacted>"
 
 
 def run_before_script(
@@ -127,7 +128,9 @@ def run_hook_commands(
     if not joined.strip():
         return
 
-    logger.info("hook commands started", extra={"tmux_hook_cmd": joined})
+    logger.info(
+        "hook commands started", extra={"tmux_hook_cmd": _REDACTED_HOOK_COMMAND}
+    )
     try:
         result = subprocess.run(
             joined,
@@ -140,15 +143,15 @@ def run_hook_commands(
     except OSError:
         logger.warning(
             "hook command failed",
-            extra={"tmux_hook_cmd": joined},
+            extra={"tmux_hook_cmd": _REDACTED_HOOK_COMMAND},
         )
         return
 
     if result.returncode != 0:
         logger.warning(
             "hook command failed",
             extra={
-                "tmux_hook_cmd": joined,
+                "tmux_hook_cmd": _REDACTED_HOOK_COMMAND,
                 "tmux_exit_code": result.returncode,
             },
         )

tests/test_util.py

@@ -213,6 +213,32 @@ def test_run_hook_commands_logs_failure(
     assert records[0].tmux_exit_code == 7
 
 
+def test_run_hook_commands_redacts_logged_command(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """run_hook_commands() keeps expanded hook commands out of logs."""
+    secret = "secret-token-for-hook-log"
+
+    with caplog.at_level(logging.INFO, logger="tmuxp.util"):
+        run_hook_commands(f"false # {secret}")
+
+    for record in caplog.records:
+        assert secret not in record.getMessage()
+        assert secret not in str(record.__dict__)
+
+    hook_records = [
+        record for record in caplog.records if hasattr(record, "tmux_hook_cmd")
+    ]
+    assert hook_records
+    assert all(record.tmux_hook_cmd == "<redacted>" for record in hook_records)
+
+    failure_records = [
+        record for record in caplog.records if hasattr(record, "tmux_exit_code")
+    ]
+    assert len(failure_records) == 1
+    assert failure_records[0].tmux_exit_code == 1
+
+
 def test_get_session_should_default_to_local_attached_session(
     server: Server,
     monkeypatch: pytest.MonkeyPatch,