2 Commits

Include renames

Author	SHA1	Message	Date
BaaRai	69831f5cdf	fix(security): apply New options so the secret scrub actually runs ... New accepted opts ...Option but never called them, so scrubSecrets stayed false in the binary and ScrubSecretEnv was unreachable: the protection merged in #136 never engaged. The unit test passed because it called the scrub function directly instead of going through New. Apply the options in the constructor and add a test that builds a Server through New with WithSecretScrub and asserts the secrets are gone. Verified to fail without the loop.	2026-11-03 23:47:49 +01:00
BaaRai	e6f4de5ddc	fix(security): scrub startup secrets before any child can spawn ... The scrub ran in main after server.New returned, but New resumes every non-terminal task before returning, and those loops start workers that run shells. Move the scrub into New, right after both environment readers, and start MCP discovery after it as well: both paths spawn child processes. New takes an option rather than scrubbing unconditionally. The test suite builds several servers in one process and still needs ARTEX_PG_DSN on later calls, so only the binary opts in.	2026-11-03 22:14:35 +01:00