[DavidCockerill]

📝 Summary

Documents Mask credential values in the agent's config and log reads and in its read_log results (HarperFast/harper#3412): when the built-in agent reads its config or logs scope, or calls read_log, the value of every credential-named key comes back as *s. The page now says which keys and forms are masked, how config files are parsed, what is refused, and what is not covered. The 5.4 release note gets an entry with rotation guidance for sessions recorded earlier.

Refs HarperFast/harper#3097 · Refs #674 · Feature PR: HarperFast/harper#3412

🔧 Changes

• reference/configuration/options.md — a new Masked credential values section under the agent's filesystem scopes, and the old "the agent reads it" sentence about config secrets replaced: a widened configScope now refuses large or binary files such as database files and backups.
• release-notes/v5-lincoln/5.4.md — a Credential Values Are Masked in the Agent's Config and Log Reads entry under Built-in Agent.

✅ Verification

• Every claim checked against the harper#3412 code and tests: key pattern, YAML parse with escaped keys and aliases, key-only masking of a broken file, the 256 KiB and UTF-8 refusals, byte-for-byte masking in config files, read_log's refused filter and PEM refusal.
• prettier --check passes on both files; the new anchor #masked-credential-values matches the heading the release note links.

🤖 Generated with Claude Code

_{🤖 Generated by Claude Opus 5.5 (Claude Code); posted via @DavidCockerill.}

Related PRs: #727 overlaps (open; edits the same agent options and 5.4 Built-in Agent section), #717 overlaps (merged; this replaces its config-secrets sentence), 2 others independent

_{Review-Coverage: authored=claude; ran=gemini,codex; adjudicated=domain; blocked=muse(failed); declined=cursor-grok,cursor-composer,cursor-kimi,cursor-muse; rounds=2; full=1 @ ffb2f20}

_{Review-Attention: skim ~2m (decisions: masking-docs-location, release-note-rotate-advice, mask-length-disclosure) @ ffb2f20}

[github-actions]

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-745

This preview will update automatically when you push new commits.

[github-actions]

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-745

This preview will update automatically when you push new commits.