[agentHits]

What is this PR about?

Ports 9b80df3a0 fix: redact compose service response secrets, which only existed on the deleted agentHits-prod release line (local copy backup/agentHits-Prod-before-delete-20261006). The 7da5612c0 sync replaced compose.ts with the AgentHits-Dev version, so the fix never reached AgentHits-Dev.

On AgentHits-Dev, compose router responses already redact env and git provider secrets. But compose.one, create, update, delete, deployTemplate and move still returned two fields to anyone with read access to the service:

• customGitUrl with embedded credentials (https://token@host/...);
• composeFile with inline secrets.

The environment router already redacts both fields.

Changes

• A new redactComposeSecrets helper in the compose router is used by all six responses. It redacts env and git provider secrets as before, and now also masks customGitUrl credentials (redactSensitiveText).
• composeFile is always redacted in mutation responses; the UI only reads composeId from them.
• In compose.one, composeFile is redacted only for callers without envVars.read. The compose file editor loads the file from compose.one, so a verbatim port would show __DOKPLOY_REDACTED_SECRET__ in the editor. The static owner, admin and member roles all have envVars.read, so only custom roles without it get the placeholder.
• service-environment-reveal.test.ts covers compose.one with and without envVars.read, and the update response, including the placeholder round trip on save.

Behaviour changes

• A credentialed custom Git URL now shows a placeholder instead of the token. Saving the form unchanged keeps the stored URL (the existing preserveSecretPlaceholderFields path). To change the URL, paste it in full; edits around the placeholder are discarded.
• Out of scope: getConvertedCompose (requires service.create) still returns the compose file, and application.one still returns a raw customGitUrl.

Checklist

• Dedicated branch fix/redact-compose-response-secrets from origin/AgentHits-Dev (e52547d4d).
• bun run test -- --run service-environment-reveal: 6 passed. Against the old compose.ts, the 3 compose tests fail.
• Related suites (__test__/security/, the compose router importers, the environment secret boundary): 18 files / 175 tests passed.
• bun run test -- --run: 232 files passed. Only deploy/application.real.test.ts fails, because no local Docker socket is available.
• bun run typecheck in apps/dokploy: passed.
• Biome on the changed files and git diff --check: passed.
• The UI was not checked in a browser.

🤖 Generated with Claude Code