feat: add cross-platform thothctl

tools/thothctl/internal/output/sanitize_test.go

@@ -0,0 +1,35 @@
+package output
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestSanitizeRedactsPasswordTokenAndKeyFields(t *testing.T) {
+	t.Parallel()
+
+	got := Sanitize("DB_PASSWORD=hunter2\naccess_token: abc123\napi-key = quoted-value\nplain=safe\n", nil)
+	want := "DB_PASSWORD=[REDACTED]\naccess_token: [REDACTED]\napi-key = [REDACTED]\nplain=safe\n"
+	if got != want {
+		t.Errorf("Sanitize() = %q, want %q", got, want)
+	}
+}
+
+func TestSanitizeRedactsSecretFileContents(t *testing.T) {
+	t.Parallel()
+
+	secretFile := filepath.Join(t.TempDir(), "provider-token")
+	if err := os.WriteFile(secretFile, []byte("top-secret-value\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	secrets, err := SecretValuesFromFiles([]string{secretFile})
+	if err != nil {
+		t.Fatalf("SecretValuesFromFiles() error = %v", err)
+	}
+	got := Sanitize("request failed for top-secret-value", secrets)
+	if got != "request failed for [REDACTED]" {
+		t.Errorf("Sanitize() = %q, want redacted secret", got)
+	}
+}