Credential redaction for inspect output and debug logging.
+
+
+
+
+
+
+
+
Defined Under Namespace
@@ -165,7 +175,7 @@
VERSION =
-
Traditional Constant Location
+
Current gem version exposed at the traditional constant location.
@@ -324,12 +334,12 @@
-68
-69
-70
+62
+63
+64
-
# File 'lib/auth/sanitizer/core.rb', line 68
+
# File 'lib/auth/sanitizer/core.rb', line 62defdefault_filtered_keysDEFAULT_FILTERED_KEYS
@@ -386,12 +396,12 @@
-39
-40
-41
+36
+37
+38
-
# File 'lib/auth/sanitizer/core.rb', line 39
+
# File 'lib/auth/sanitizer/core.rb', line 36define_singleton_method(:filtered_label)dofiltered_label_provider_mutex.synchronize{filtered_label_provider}.call
@@ -414,10 +424,9 @@
This method returns an undefined value.
Install a custom provider for the filtered label.
-
The provider is called each time a new {FilteredAttributes}- or
-{SanitizedLogger}-bearing object is initialized, allowing the label to
-track a host gemโs live configuration while still being snapshotted per
-object instance.
+
The provider callable is invoked each time a new {FilteredAttributes}- or
+{SanitizedLogger}-bearing object is initialized, allowing the label to track a host gemโs
+live configuration while still being snapshotted per object instance.
Mixin that redacts sensitive instance variables in #inspect output.
-
Classes include this module and declare which attribute names should be
-filtered via filtered_attributes. Matching and replacement behavior is
-delegated to {ThingFilter}, which is initialized once per object.
+
Classes include this module and declare attribute names to filter via filtered_attributes.
+Matching and replacement behavior is delegated to {ThingFilter}, initialized once per object.
-
This means existing objects keep the filter configuration that was present
-when they were initialized, even if global config or class-level filter
-declarations change later.
+
This means existing objects keep the filter configuration that was present when they were
+initialized, even if global config or class-level filter declarations change later.
The label used for redaction is resolved from filtered_label
at object initialization time. Host gems may customize this by installing a
@@ -267,13 +265,13 @@
+23
+24
25
-26
-27
-28
+26
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 25
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 23defincluded(base)base.extend(ClassMethods)
@@ -328,15 +326,15 @@
+94
95
96
97
98
-99
-100
+99
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 95
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 94definspectinspected=super
@@ -389,12 +387,12 @@
+87
88
-89
-90
+89
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 88
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 87defthing_filter@thing_filter
diff --git a/docs/Auth/Sanitizer/FilteredAttributes/ClassMethods.html b/docs/Auth/Sanitizer/FilteredAttributes/ClassMethods.html
index 728174c..756691e 100644
--- a/docs/Auth/Sanitizer/FilteredAttributes/ClassMethods.html
+++ b/docs/Auth/Sanitizer/FilteredAttributes/ClassMethods.html
@@ -280,14 +280,14 @@
+59
60
61
62
-63
-64
+63
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 60
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 59deffiltered_attribute_names(base)return[]unlessbase.instance_variable_defined?(:@filtered_attribute_names)
@@ -319,6 +319,21 @@
Parameters:
+
+
+ base
+
+
+ (Class)
+
+
+
+ —
+
The class the attributes are declared on
+
+
+
+
attributes
@@ -343,12 +358,12 @@
+51
52
-53
-54
+53
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 52
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 51deffiltered_attributes(base,*attributes)base.instance_variable_set(:@filtered_attribute_names,attributes.map(&:to_sym))
@@ -402,12 +417,12 @@
+77
78
-79
-80
+79
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 78
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 77deffiltered_attribute_namesClassMethods.filtered_attribute_names(self)
@@ -461,12 +476,12 @@
+70
71
-72
-73
+72
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 71
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 70deffiltered_attributes(*attributes)ClassMethods.filtered_attributes(self,*attributes)
diff --git a/docs/Auth/Sanitizer/FilteredAttributes/InitializerMethods.html b/docs/Auth/Sanitizer/FilteredAttributes/InitializerMethods.html
index 1152e11..02fbce7 100644
--- a/docs/Auth/Sanitizer/FilteredAttributes/InitializerMethods.html
+++ b/docs/Auth/Sanitizer/FilteredAttributes/InitializerMethods.html
@@ -162,16 +162,16 @@
+34
+35
36
37
38
39
-40
-41
-42
+40
-
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 36
+
# File 'lib/auth/sanitizer/filtered_attributes.rb', line 34definitialize(*args,&block)super
diff --git a/docs/Auth/Sanitizer/SanitizedLogger.html b/docs/Auth/Sanitizer/SanitizedLogger.html
index 19a935a..7964f39 100644
--- a/docs/Auth/Sanitizer/SanitizedLogger.html
+++ b/docs/Auth/Sanitizer/SanitizedLogger.html
@@ -104,12 +104,11 @@
Overview
-
Logger wrapper that redacts sensitive values from debug output before
-delegating to the underlying logger instance.
+
Logger wrapper that redacts sensitive values from debug output before delegating to the
+underlying logger instance.
-
This class is intentionally narrow in scope: it only sanitizes string
-messages emitted through the logging path and leaves request/response
-behavior unchanged.
+
This class is intentionally narrow in scope: it only sanitizes string messages emitted
+through the logging path and leaves request/response behavior unchanged.
The underlying {ThingFilter} is initialized once when the logger wrapper is
created, so later config changes do not alter the behavior of existing
@@ -639,13 +638,13 @@
+25
26
27
-28
-29
+28
-
# File 'lib/auth/sanitizer/sanitized_logger.rb', line 26
+
Gem source files evaluated into the anonymous namespace, in load order.
+
+
+
+
+
+
+
+
%w[auth/sanitizer/version.rb
@@ -213,8 +223,6 @@
-23
-24
25
26
27
@@ -224,10 +232,12 @@
31
32
33
-34
+34
+35
+36
-
# File 'lib/auth_sanitizer/loader.rb', line 23
+
# File 'lib/auth_sanitizer/loader.rb', line 25defload_isolatednamespace=Module.new
diff --git a/docs/file.AGENTS.html b/docs/file.AGENTS.html
index 4411faa..6b5d6fa 100644
--- a/docs/file.AGENTS.html
+++ b/docs/file.AGENTS.html
@@ -192,10 +192,6 @@
Executables (from kettle-dev)
kettle-pre-release
Pre-release validation
-
-
kettle-changelog
-
Changelog generation
-
kettle-dvcs
DVCS (git) workflow automation
diff --git a/docs/file.CHANGELOG.html b/docs/file.CHANGELOG.html
index 5cd6e7d..7e761bb 100644
--- a/docs/file.CHANGELOG.html
+++ b/docs/file.CHANGELOG.html
@@ -70,7 +70,7 @@
and yes, platform and engine support are part of the public API.
Please file a bug if you notice a violation of semantic versioning.
-
BRANCH COVERAGE: 100.00% โ 34/34 branches in 7 files
+
98.08% documented
+
+
+
Added
+
+
+
kettle-jem-template-20260720-005 - README Support & Community links now
+include RubyForum.
+
kettle-jem-template-20260726-001 - Projects now include YARD lint
+configuration and documentation dependencies so documentation issues fail
+before generated docs are refreshed.
+
+
kettle-jem-template-20260727-001 - Spec harness documentation now lists the
+RSpec helpers provided by kettle-test.
+
+
kettle-jem-template-20260913-001 - Templating now also surfaces a review
+entry in dependency_conflicts.resolve when a direct development
+dependency doesnโt support one or more of this projectโs declared
+engines: and has no template-managed modular home (e.g. sqlite3 on
+jruby). Review each entry and pick a resolution per the projectโs own
+engine support needs.
+
+
+
Changed
+
+
+
+
kettle-jem-template-20260716-002 - Generated gemspec manifests now ship fewer
+repository-only files by default to reduce downstream distro packaging churn.
+
+
kettle-jem-template-20260720-002 - Development Gemfiles now use the released
+tree_sitter_language_pack gem 1.13.3 or newer by default.
+
kettle-jem-template-20260725-002 - Version specs now use anonymous_loader to
+cover version.rb without redefining constants, or are removed when version
+specs are not managed for the project.
+
+
kettle-jem-template-20260728-001 - Generated Ruby workflows now use clearer
+setup-ruby-flash planning and can prepare appraisal-only jobs without
+installing the main Gemfile bundle.
+
+
+
kettle-jem-template-20260801-001 - Generated README gem dashboard links now
+use ClickGems instead of BestGems.
kettle-jem-template-20260720-003 - StructuredMerge Git diff driver config now
+uses the installed smorg-rb driver command.
+
kettle-jem-template-20260725-001 - Release pull request branches beginning
+with feature/release now run JRuby and TruffleRuby workflows.
+
kettle-jem-template-20260726-002 - Generated version files now document their
+version namespace and constants, reducing warning-only YARD lint output.
+
kettle-jem-template-20260726-003 - Coverage upload steps now treat Coveralls,
+QLTY, and Codecov as optional, so provider outages do not fail CI when local
+coverage thresholds still pass.
+
kettle-jem-template-20260728-002 - Generated RuboCop configs now ignore the
+same gemfiles/vendor/bundle tree as .gitignore, so vendored dependency
+installs are not reported as project lint debt.
+
kettle-jem-template-20260728-003 - Generated dep-heads workflows now run
+TruffleRuby jobs with current RubyGems and Bundler, avoiding setup failures
+before the test suite starts.
+
kettle-jem-template-20260728-004 - Generated dep-heads workflows now use the
+setup-ruby Bundler install path for direct appraisal Gemfiles, avoiding rv
+lockfile parser failures on Git and path dependencies.
+
kettle-jem-template-20260728-005 - VersionGem bootstrap now creates the
+missing canonical version spec when a project only has shim namespace version
+specs.
+
kettle-jem-template-20260729-001 - Generated JRuby 9.4 workflows now use the
+legacy manual bundle install path, avoiding setup-time Bundler full-index
+failures against gem.coop.
+
+
kettle-jem-template-20260730-001 - Gemspec package file enumeration now runs
+relative to the gemspec directory, so release package contents stay correct
+even when the gemspec is loaded from another working directory.
+
+
kettle-jem-template-20260801-002 - Generated RSpec helpers now normalize
+managed configuration block bindings structurally, preventing mixed block
+parameter names from producing invalid configuration after a merge.
+
kettle-jem-template-20260801-003 - Generated project metadata and
+documentation now normalize configured underscore hostnames to valid
+hyphenated hostnames.
+
kettle-jem-template-20260801-004 - Generated organization README logos now
+use GitHubโs stable organization avatar endpoint instead of assuming a
+matching Galtzo-hosted asset exists.
+
+
kettle-jem-template-20260802-001 - Devcontainer JSON files now merge as JSONC,
+preserving comments and trailing commas during template updates.
+
+
+
Fix load-order NameError: uninitialized constant Auth::Sanitizer::Version by removing a duplicate VersionGem::Basic class_eval from auth/sanitizer/core (the version constant is loaded after core in auth/sanitizer.rb).
+
+
Gemspec no longer defines a top-level Auth constant when evaluated on Ruby < 3.1 (e.g. by bundler/setup); the version file now loads into an anonymous module via Module#module_eval on all supported Rubies. This un-breaks the isolated-loading specs and the ruby-2.4 CI workflow.
+
+
+
Security
+
+
+
SanitizedLogger now redacts configured keys in Ruby Hash#inspect output (both Ruby 3.4+ {"key" => "value"} / {key: "value"} and pre-3.4 hash-rocket formats), fixes a mangling bug where the form-pair pattern partially matched :key=>"value" pairs, and no longer raises on invalid-encoded message bytes. This closes the OAUTH_DEBUG cleartext-logging bypass reported for oauth2 as GHSA-cmh8-5q25-68v6, where Faraday renders Hash request bodies with pretty_inspect. Reported by iamibi.
Create your feature branch (git checkout -b my-new-feature)
@@ -91,9 +91,25 @@
Help out!
Push to the branch (git push origin my-new-feature)
Make sure to add tests for it. This is important, so it doesnโt break in a future release.
Create new Pull Request.
-
Announce it in the channel for this org in the Discord!
+
Announce it in the project tag on RubyForum or the org channel on Discord!
+
Ruby engine CI branches
+
+
Pull requests run MRI workflows by default. JRuby and TruffleRuby workflows are
+available by branch naming convention so ordinary PRs do not spend CI time on
+alternate Ruby engines.
+
+
+
Use a branch named jruby/* to run JRuby workflows for a pull request.
+
Use a branch named truffleruby/* to run TruffleRuby workflows for a pull
+request.
+
Use a branch named engines/* to run both JRuby and TruffleRuby workflows for
+a pull request.
+
+
+
Pushes to the default branch continue to run the configured engine workflows.
+
Executables vs Rake tasks
Executables shipped by dependencies, such as kettle-dev, and stone_checksums, are available
@@ -195,7 +211,7 @@
Environment Variables for L
Use git diff --no-ext-diff to compare against Gitโs built-in diff output.
Use git diff --no-textconv when a textconv projection obscures the raw file bytes you need to inspect.
If Git reports a missing smorg-* executable, rerun bundle install and the setup command above, then check git config --local --get-regexp '^diff\.smorg-'.
-
To remove managed local entries, run K_JEM_TEMPLATING=true kettle-jem install --undo; remove global command registrations with git config --global --unset-all diff.smorg-ruby.command.
+
To remove managed local entries, run K_JEM_TEMPLATING=true kettle-jem install --undo; remove global command registrations with git config --global --unset-all diff.smorg-rb.command, git config --global --unset-all merge.smorg-rb.driver, and git config --global --unset-all merge.smorg-rb.name.
For a quick starting point, this repositoryโs mise.toml defines the shared defaults, and .env.local can override them locally. Copy .env.local.example to .env.local, use KEY=value lines, and either activate mise in your shell or run commands through mise exec -C /path/to/project -- ....
Many paths lead to being a sponsor or a backer of this project. Are you on such a path?
@@ -80,11 +80,12 @@
๐ค A request for help
so if you value the work I am doing, I need your support.
Please consider sponsoring me or the project.
-
To join the community or get help ๐๏ธ Join the Discord.
+
To join the community or get help, use RubyForum or Discord.
-
+
+
-
To say โthanks!โ โ๏ธ Join the Discord or ๐๏ธ send money.
+
To say โthanks!โ โ๏ธ Join the community or ๐๏ธ send money.
๐ ๐ ๐
diff --git a/docs/file.LICENSE.html b/docs/file.LICENSE.html
index ddc51eb..c4a1ee9 100644
--- a/docs/file.LICENSE.html
+++ b/docs/file.LICENSE.html
@@ -65,7 +65,7 @@
Choose the option that best fits your use case:
if ci_badges.map(&:color).detect { it != "green"} โ๏ธ let me know on Discord or RubyForum, as I may have missed the notification.
@@ -149,7 +149,7 @@
๐ก Info you can shake a stick at
Tokens to Remember
-
+
@@ -163,7 +163,7 @@
๐ก Info you can shake a stick at
Works with Truffle Ruby
-
+
@@ -187,13 +187,13 @@
๐ก Info you can shake a stick at
Support & Community
-
+
Source
-
+
@@ -232,7 +232,7 @@
๐ก Info you can shake a stick at
Compatibility
-
Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
+
Compatible with MRI Ruby 2.2.0+, JRuby, and TruffleRuby.
CI workflows and Appraisals are generated for MRI Ruby 2.4+.
This test floor is configured by ruby.test_minimum in .kettle-jem.yml and
may be higher than the gemโs runtime compatibility floor when legacy Rubies are
@@ -251,63 +251,125 @@
If you need some ideas of where to help, you could work on adding more code coverage,
-or if it is already ๐ฏ (see below) check issues or PRs,
-or use the gem and think about how it could be better.
+check issues or PRs, or use the gem and think about how it could be better.
The .rubocop_gradual.lock file tracks all current RuboCop violations in the project. This allows the team to:
+
The .rubocop_gradual.lock file is a work list, not a permanent baseline. Every entry represents a style issue that should be resolved by either fixing the code or making an intentional exception explicit.
+
+
This allows the team to:
-
Prevent new violations while gradually fixing existing ones
+
Prevent new violations while existing issues are handled deliberately
Track progress on code style improvements
-
Ensure CI builds donโt fail due to pre-existing violations
+
Distinguish temporary work items from intentional project style exceptions
Common Commands
@@ -126,29 +128,30 @@
Workflow
Before submitting a PR, run bundle exec rake rubocop_gradual:autocorrect
a. or just the default bundle exec rake, as autocorrection is a pre-requisite of the default task.
-
If there are new violations, either:
+
If there are violations, either:
Fix them in your code
-
Run bundle exec rake rubocop_gradual:force_update to update the lock file (only for violations you canโt fix immediately)
+
Normalize intentional deviations with an explicit config or inline exception
+
Run bundle exec rake rubocop_gradual:force_update only for temporary work items you cannot fix immediately
Commit the updated .rubocop_gradual.lock file along with your changes
-
Never add inline RuboCop disables
+
Explicit Style Exceptions
-
Do not add inline rubocop:disable / rubocop:enable comments anywhere in the codebase (including specs, except when following the few existing rubocop:disable patterns for a rule already being disabled elsewhere in the code). We handle exceptions in two supported ways:
+
Do not treat .rubocop_gradual.lock as a baseline. Treat it as a list of work that must be fixed or normalized into the styleguide.
-
-
Permanent/structural exceptions: prefer adjusting the RuboCop configuration (e.g., in .rubocop.yml) to exclude a rule for a path or file pattern when it makes sense project-wide.
-
Temporary exceptions while improving code: record the current violations in .rubocop_gradual.lock via the gradual workflow:
-
-
-bundle exec rake rubocop_gradual:autocorrect (preferred; will autocorrect what it can and update the lock only if no new violations were introduced)
-
If needed, bundle exec rake rubocop_gradual:force_update (as a last resort when you cannot fix the newly reported violations immediately)
-
-
-
+
Prefer this order:
+
+
+
Fix the code so it follows the configured styleguide.
+
For intentional project conventions, add the narrowest useful override in .rubocop.yml or .rubocop_rspec.yml.
+
For local intentional deviations, add a tightly scoped inline rubocop:disable / rubocop:enable around the exact line or block.
+
Keep an entry in .rubocop_gradual.lock only as temporary work to be resolved later.
+
+
+
Use configuration overrides when a deviation is structural, generated, path-specific, or applies consistently to a small set of files. Use inline disables when the exception is local and the reason is clearer at the code site than in global config.
In general, treat the rules as guidance to follow; fix violations rather than ignore them. For example, RSpec conventions in this project expect described_class to be used in specs that target a specific class under test.
@@ -156,8 +159,8 @@
Benefits of rubocop_gradual
Allows incremental adoption of code style rules
-
Prevents CI failures due to pre-existing violations
-
Provides a clear record of code style debt
+
Prevents CI failures due to temporary pre-existing violations
+
Provides a clear work list of code style debt
Enables focused efforts on improving code quality over time
if ci_badges.map(&:color).detect { it != "green"} โ๏ธ let me know on Discord or RubyForum, as I may have missed the notification.
@@ -149,7 +149,7 @@
๐ก Info you can shake a stick at
Tokens to Remember
-
+
@@ -163,7 +163,7 @@
๐ก Info you can shake a stick at
Works with Truffle Ruby
-
+
@@ -187,13 +187,13 @@
๐ก Info you can shake a stick at
Support & Community
-
+
Source
-
+
@@ -232,7 +232,7 @@
๐ก Info you can shake a stick at
Compatibility
-
Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
+
Compatible with MRI Ruby 2.2.0+, JRuby, and TruffleRuby.
CI workflows and Appraisals are generated for MRI Ruby 2.4+.
This test floor is configured by ruby.test_minimum in .kettle-jem.yml and
may be higher than the gemโs runtime compatibility floor when legacy Rubies are
@@ -251,63 +251,125 @@
If you need some ideas of where to help, you could work on adding more code coverage,
-or if it is already ๐ฏ (see below) check issues or PRs,
-or use the gem and think about how it could be better.
+check issues or PRs, or use the gem and think about how it could be better.
๐ 
+
+
+
+
