From b6d71f32eeca941caa5cfc6914017f25f13195d5 Mon Sep 17 00:00:00 2001
From: ryder777777 <ryder777777@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:32:15 +0000
Subject: [PATCH] feat(agents): add passphrase constants and redactConfig
 secret-redaction alias (#107)

---
 oracledesk-stellar/agents/core/config.test.ts | 9 +++++++++
 oracledesk-stellar/agents/core/config.ts      | 6 ++++++
 2 files changed, 15 insertions(+)

diff --git a/oracledesk-stellar/agents/core/config.test.ts b/oracledesk-stellar/agents/core/config.test.ts
index f8ba3a7..e07c051 100644
--- a/oracledesk-stellar/agents/core/config.test.ts
+++ b/oracledesk-stellar/agents/core/config.test.ts
@@ -4,6 +4,8 @@ import { Keypair, StrKey } from "@stellar/stellar-sdk";
 import {
   AgentConfigError,
   describeConfig,
+  redactConfig,
+  TESTNET_PASSPHRASE,
   loadAgentConfig,
   MAINNET_OPT_IN,
   NETWORKS,
@@ -316,3 +318,10 @@ test("parseTunables validates the same fields without a deployment", () => {
   assert.equal(parseTunables({ SLIPPAGE_BPS: "100" }).trading.slippageBps, 100);
   assert.throws(() => parseTunables({ SLIPPAGE_BPS: "1.0" }), AgentConfigError);
 });
+
+test("passphrase constants and redactConfig alias never expose secrets", async () => {
+  assert.equal(TESTNET_PASSPHRASE, NETWORKS.testnet.passphrase);
+  const cfg = await load(LIVE).run();
+  const redacted = JSON.stringify(redactConfig(cfg));
+  assert.ok(!redacted.includes(AGENT.secret()));
+});
diff --git a/oracledesk-stellar/agents/core/config.ts b/oracledesk-stellar/agents/core/config.ts
index b349523..7d474cb 100644
--- a/oracledesk-stellar/agents/core/config.ts
+++ b/oracledesk-stellar/agents/core/config.ts
@@ -542,3 +542,9 @@ export function describeConfig(cfg: AgentConfig): Record<string, unknown> {
     maker: { ...maker, defaultSeedStroops: maker.defaultSeedStroops.toString() },
   };
 }
+
+export const TESTNET_PASSPHRASE = NETWORKS.testnet.passphrase;
+export const FUTURENET_PASSPHRASE = NETWORKS.futurenet.passphrase;
+export const LOCAL_PASSPHRASE = NETWORKS.local.passphrase;
+export const MAINNET_PASSPHRASE = NETWORKS.mainnet.passphrase;
+export const redactConfig = describeConfig;