[agentHits]

What is this PR about?

Stops secrets from leaking through log text and mutation responses. Four commits, one per area:

1. Database restore and password-change errors. On a local server a failed mysql/mariadb restore streams Error: <command text> from backup.restoreBackupWithLogs, and the command held the password as mysql -u root -p<password>, which redactSensitiveText did not mask. The same form was used by mysql/mariadb changePassword for the root password, and that error text goes back to the caller.
   • The password now reaches the container via docker exec -e DOKPLOY_DB_PASSWORD=... and the client reads it as -p"$DOKPLOY_DB_PASSWORD".
   • redactSensitiveText masks a value glued to -p after mysql/mariadb client names. -p followed by a space, uppercase -P (port) and other tools' -p (docker, ssh, compose, mkdir) are left alone.
   • Env assignments and --password style flags are now masked in full even when shell-quote escaped &, | or quotes in the value. Before, a password with & or | (both allowed by the schema) was masked only up to that character.
2. Compose previews. compose.randomizeCompose, compose.isolatedDeployment and compose.getConvertedCompose now return the compose file only to callers with envVars.read. Other callers get __DOKPLOY_REDACTED_SECRET__. This is the same rule compose.one uses for composeFile.
3. Shared env in mutation responses.
   • environment.update and environment.remove return env only with environmentEnvVars.read.
   • project.update and project.remove return env only with projectEnvVars.read.
   • project.duplicate hides env and project.env by the same permissions. This matters most with duplicateInSameProject, where the response is the source environment.
   • The env and project-env redaction is now in redactEnvironmentSharedEnvFor, which service reads also use.
4. Member listings. user.all and user.one select only the user profile fields the UI reads: id, names, email, emailVerified, image, banned, twoFactorEnabled and createdAt. Before, they returned the whole user row, including licenseKey, Stripe ids, trustedOrigins and the ban reason and expiry.

What changes for each role:

• Owners and admins: nothing visible.
• Members without env read permissions: they see the placeholder in compose previews, and env values are redacted in these mutation responses.
• API clients: fields outside the member profile whitelist are no longer returned by user.all and user.one.

Checks

• CI=true bunx vitest run --config __test__/vitest.config.ts on the security, backup, backups, compose, environment, placement, users and database folders: 73 files passed, 1 skipped (518 tests passed).
• Full suite: only __test__/deploy/application.real.test.ts fails, as expected locally (no Docker socket).
• Each new or updated test fails on the original code. I checked this by reverting the source files to origin/AgentHits-Dev and re-running: 16 failures.
• Two tests run the generated restore and password-change commands through a docker stub. They confirm that mysql and mariadb still receive -p<password> and the ALTER USER statement.
• bun run typecheck: exit 0.
• bunx biome check <changed files>: 0 errors.

Rollout notes

• mysql and mariadb restore and password change now call the client through sh -c inside the container (the official images include sh). These were not run against a live database container.
• Restore and password-change logs now show DOKPLOY_DB_PASSWORD=__DOKPLOY_REDACTED_SECRET__ where they used to show the raw -p<password>.
• No migrations or settings changes.

🤖 Generated with Claude Code