Improve secret redaction transparency

dev/test_openwebui_filters.py

@@ -279,6 +279,40 @@ class SecretRedactionTests(unittest.IsolatedAsyncioTestCase):
         result = await guard.outlet(outlet)
         self.assertNotIn("abcdefghijklmnopqrstuvwxyz", result["messages"][0]["content"])
 
+    async def test_documentation_placeholders_and_paths_are_not_redacted(self):
+        module = _load("secret_redaction")
+        guard = module.Filter()
+        content = "\n".join(
+            [
+                'ROUTER_API_KEY=${ROUTER_API_KEY:?required}',
+                'API_KEY=/etc/mike-ai/router-api-key',
+                'access_token=<YOUR_TOKEN>',
+                'password=[REDACTED]',
+                'API-Key: Inhalt von /etc/mike-ai/router-api-key',
+            ]
+        )
+        redacted, counts = guard._redact(content)
+        self.assertEqual(redacted, content)
+        self.assertEqual(counts, {})
+
+    async def test_notification_reports_category_and_origin_but_not_value(self):
+        module = _load("secret_redaction")
+        guard = module.Filter()
+        events = []
+
+        async def emit(event):
+            events.append(event)
+
+        secret = "realistic-secret-value-123456"
+        body = {"messages": [{"role": "tool", "content": f"api_key={secret}"}]}
+        result = await guard.inlet(body, __event_emitter__=emit)
+        self.assertNotIn(secret, result["messages"][0]["content"])
+        description = events[0]["data"]["description"]
+        self.assertIn("API-Key: 1", description)
+        self.assertIn("Werkzeugausgaben", description)
+        self.assertIn("nicht protokolliert", description)
+        self.assertNotIn(secret, description)
+
 
 class QuickActionTests(unittest.IsolatedAsyncioTestCase):
     async def asyncSetUp(self):