Second fixes batch

tests/storage/db/repositories/test_stack_logs.py

@@ -50,3 +50,36 @@ class TestInsert:
             text("SELECT query FROM stack_logs WHERE activity_id = 'act-3'")
         ).fetchone()
         assert len(dict(row._mapping)["query"]) == 20000
+
+    def test_secrets_redacted_from_stacks(self, pg_conn):
+        # The ``llm`` stack component is built from every public attr of
+        # the LLM and includes the provider secret + the caller's key.
+        # These must never persist (the unified-logs endpoint returns
+        # stacks verbatim).
+        repo = _repo(pg_conn)
+        repo.insert(
+            activity_id="act-secret",
+            level="error",
+            stacks=[
+                {
+                    "component": "llm",
+                    "data": {
+                        "api_key": "sk-deployment-secret",
+                        "user_api_key": "agent-key",
+                        "OPENAI_API_KEY": "sk-env",
+                        "model": "gpt-x",
+                        "prompt_tokens": 42,
+                    },
+                }
+            ],
+        )
+        row = pg_conn.execute(
+            text("SELECT stacks FROM stack_logs WHERE activity_id = 'act-secret'")
+        ).fetchone()
+        data = dict(row._mapping)["stacks"][0]["data"]
+        assert data["api_key"] == "[REDACTED]"
+        assert data["user_api_key"] == "[REDACTED]"
+        assert data["OPENAI_API_KEY"] == "[REDACTED]"
+        # Non-secret fields (incl. token *counts*) are untouched.
+        assert data["model"] == "gpt-x"
+        assert data["prompt_tokens"] == 42