fix: redact sensitive query and form logging

[jbeckwith-oai]

Summary

• Redact camelCase token/key names, singular/plural credential containers, nested, array-style, and percent-encoded credential query parameters from both INFO request-completion logs and DEBUG request-start logs while preserving safe parameters and the original request URL.
• Structurally redact application/x-www-form-urlencoded request and response bodies with the existing URL-query sanitizer, preserving safe fields, duplicate parameters, and the original request body.
• Omit malformed or oversized form payloads and unsupported textual payloads, including XML, instead of logging secrets from formats that cannot be safely scrubbed.
• Add a separate focused security regression matrix using a real Logger/StringIO and a framework-provided delegated Minitest::Mock; keep the existing 943-line logging test file below the 1,000-line maintainability boundary.

Castiron impact

No upstream Castiron/compiler, template, OpenAPI schema, regeneration, or companion source change is required.

I inspected Castiron's actual Ruby render_tree_from_views implementation in api/castiron/crates/castiron-render-ruby/src/output.rs: it emits package roots/indexes, generated clients, resources, models, and resource tests, but does not emit lib/openai/internal/logging.rb. Its resource_test_path emits test/pkgxyz/resources/<resource>_test.rb, not the SDK-owned test/openai/logging_security_test.rb added here. The only generator-owned observability boundary is the client constructor, and its upstream companion openai/openai#1277393 is already merged. The later generated SDK update changed .castiron.stats.yml while preserving this logging overlay; merged #384 independently records the same ownership analysis. This PR changes neither generated constructor signatures nor RBI/RBS declarations.

Verification

• Reproduced the vulnerability before the fix: all six new security regression tests failed on the unmodified implementation.
• Ruby 4.0.6 full suite: 632 tests, 2,832 assertions, zero failures.
• Ruby 3.3.12 full suite: 632 tests, 2,832 assertions, zero failures.
• Dedicated logging security matrix: 6 tests, 297 assertions on both Ruby versions, including array-style parameters, camelCase accessKey, and plural credentials[value] review feedback.
• Existing logging/stream regression suite: 35 tests, 358 assertions.
• Full RuboCop: 1,390 files, no offenses.
• Sorbet: bundle exec rake typecheck:sorbet, no errors.
• RBS validation: 1,212 files, no errors.
• Package build: bundle exec rake build:gem.
• Explicit thermo-nuclear maintainability review completed before pushing; simplified the credential matcher and reused the existing canonical query sanitizer.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.867s for Ruby SDK PR #389.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	160ms
tests/chat-completions-create.test.ts	✅ Passed	257ms
tests/chat-completions-stream.test.ts	✅ Passed	158ms
tests/files-content-binary.test.ts	✅ Passed	140ms
tests/files-create-multipart.test.ts	✅ Passed	146ms
tests/files-list-pagination.test.ts	✅ Passed	171ms
tests/initialize-config.test.ts	✅ Passed	176ms
tests/instance-isolation.test.ts	✅ Passed	211ms
tests/models-list.test.ts	✅ Passed	224ms
tests/responses-background-lifecycle.test.ts	✅ Passed	237ms
tests/responses-body-method-errors.test.ts	✅ Passed	370ms
tests/responses-cancel-timeout.test.ts	✅ Passed	284ms
tests/responses-cancel.test.ts	✅ Passed	265ms
tests/responses-compact-retries.test.ts	✅ Passed	280ms
tests/responses-compact.test.ts	✅ Passed	222ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	157ms
tests/responses-create-advanced.test.ts	✅ Passed	196ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.015s
tests/responses-create-errors.test.ts	✅ Passed	268ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	166ms
tests/responses-create-retries.test.ts	✅ Passed	310ms
tests/responses-create-stream-failures.test.ts	✅ Passed	198ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	235ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.349s
tests/responses-create-stream.test.ts	✅ Passed	102ms
tests/responses-create-terminal-states.test.ts	✅ Passed	253ms
tests/responses-create-timeout.test.ts	✅ Passed	241ms
tests/responses-create.test.ts	✅ Passed	239ms
tests/responses-delete.test.ts	✅ Passed	232ms
tests/responses-input-items-errors.test.ts	✅ Passed	182ms
tests/responses-input-items-list.test.ts	✅ Passed	176ms
tests/responses-input-items-options.test.ts	✅ Passed	256ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	280ms
tests/responses-input-tokens-count.test.ts	✅ Passed	233ms
tests/responses-malformed-inputs.test.ts	✅ Passed	1.994s
tests/responses-not-found-errors.test.ts	✅ Passed	293ms
tests/responses-parse.test.ts	✅ Passed	223ms
tests/responses-retrieve-retries.test.ts	✅ Passed	267ms
tests/responses-retrieve.test.ts	✅ Passed	256ms
tests/responses-stored-method-errors.test.ts	✅ Passed	688ms
tests/retry-behavior.test.ts	✅ Passed	3.294s
tests/sdk-error-shape.test.ts	✅ Passed	359ms

View OkTest run #31736752424

_{SDK merge (24037d75070b) · head (72da8fd7f039) · base (0531498c5498) · OkTest (a845fa206fa4)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9edaec267

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

Found one remaining gap in the credential-key matcher that can still expose query/form secrets.

[HAYDEN-OAI]

Re-reviewed the updated credential matcher across INFO completion paths, DEBUG request URLs, and URL-encoded request/response bodies. The new case-sensitive uppercase-Key branch covers camelCase key suffixes without redacting lowercase safe names such as monkey, while credentials? covers both singular and plural nested containers. Array, nested, and percent-decoded boundary handling remain consistent.