fix(config): redact credentials in Debug impls Refs #1784

Apply custom fmt::Debug to TelegramConfig, DiscordConfig, SlackConfig,
MatrixConfig (tinyclaw), GiteaConfig (tracker), and Settings
(github-runner-server) so that tokens, passwords, and webhook secrets
are replaced with ***REDACTED*** in all debug output.

Also gate terraphim_rlm e2e tests behind cfg(feature = "firecracker")
and simplify infer_supports_stdin match arm in spawner.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

Author: forge-admin

crates/terraphim_github_runner_server/src/config/mod.rs

@@ -118,4 +118,5 @@ mod tests {
         assert!(out.contains("None"));
         assert!(!out.contains("github-token"));
     }
+    }
 }

crates/terraphim_rlm/tests/e2e_validation.rs

@@ -15,6 +15,8 @@
 //! in default workspace builds.
 #![cfg(feature = "firecracker")]
 
+#![cfg(feature = "firecracker")]
+
 use terraphim_rlm::{
     config::{BackendType, RlmConfig},
     executor::{Capability, ExecutionEnvironment},

crates/terraphim_tinyclaw/src/config.rs

@@ -781,6 +781,71 @@ model = "llama3.2"
         );
     }
 
+    #[test]
+    fn test_telegram_config_debug_redacts_token() {
+        let cfg = TelegramConfig {
+            token: "secret-telegram-bot-token".to_string(),
+            allow_from: vec!["user1".to_string()],
+        };
+        let output = format!("{:?}", cfg);
+        assert!(
+            !output.contains("secret-telegram-bot-token"),
+            "token must not appear in TelegramConfig Debug output"
+        );
+        assert!(output.contains("***REDACTED***"));
+    }
+
+    #[test]
+    fn test_discord_config_debug_redacts_token() {
+        let cfg = DiscordConfig {
+            token: "secret-discord-bot-token".to_string(),
+            allow_from: vec!["user1".to_string()],
+        };
+        let output = format!("{:?}", cfg);
+        assert!(
+            !output.contains("secret-discord-bot-token"),
+            "token must not appear in DiscordConfig Debug output"
+        );
+        assert!(output.contains("***REDACTED***"));
+    }
+
+    #[test]
+    fn test_slack_config_debug_redacts_tokens() {
+        let cfg = SlackConfig {
+            bot_token: "xoxb-secret-bot-token".to_string(),
+            app_token: "xapp-secret-app-token".to_string(),
+            allow_from: vec!["U01234567".to_string()],
+        };
+        let output = format!("{:?}", cfg);
+        assert!(
+            !output.contains("xoxb-secret-bot-token"),
+            "bot_token must not appear in SlackConfig Debug output"
+        );
+        assert!(
+            !output.contains("xapp-secret-app-token"),
+            "app_token must not appear in SlackConfig Debug output"
+        );
+        assert!(output.contains("***REDACTED***"));
+    }
+
+    #[test]
+    fn test_matrix_config_debug_redacts_password() {
+        let cfg = MatrixConfig {
+            homeserver_url: "https://matrix.example.com".to_string(),
+            username: "bot_user".to_string(),
+            password: "super-secret-matrix-password".to_string(),
+            allow_from: vec!["@user:example.com".to_string()],
+        };
+        let output = format!("{:?}", cfg);
+        assert!(
+            !output.contains("super-secret-matrix-password"),
+            "password must not appear in MatrixConfig Debug output"
+        );
+        assert!(output.contains("***REDACTED***"));
+        assert!(output.contains("matrix.example.com"));
+        assert!(output.contains("bot_user"));
+    }
+
     #[test]
     fn test_llm_config_debug_does_not_leak_api_key() {
         let cfg = LlmConfig {

crates/terraphim_tracker/src/gitea.rs

@@ -1575,6 +1575,23 @@ mod tests {
         }
     }
 
+    #[test]
+    fn gitea_config_debug_redacts_token() {
+        let config = GiteaConfig::new(
+            "https://git.example.com".to_string(),
+            "secret-gitea-api-token".to_string(),
+            "owner".to_string(),
+            "repo".to_string(),
+        );
+        let output = format!("{:?}", config);
+        assert!(
+            !output.contains("secret-gitea-api-token"),
+            "token must not appear in GiteaConfig Debug output"
+        );
+        assert!(output.contains("***REDACTED***"));
+        assert!(output.contains("git.example.com"));
+    }
+
     #[test]
     fn normalise_issue_converts_fields() {
         let config = test_config();