fix(agent_hub): BUG redact outbound secrets by content, not file path

ms_agent/agent_hub/_commands.py

@@ -426,9 +426,11 @@ def cmd_upload(
     # boilerplate is never pushed -- keeps upload and convert 1:1-consistent
     # about what "the user's own files" are.
     from ._sync import drop_unchanged_defaults, sanitize_outbound
+    redacted: list = []
     try:
         resources = drop_unchanged_defaults(
-            sanitize_outbound(resources, spec), framework, spec)
+            sanitize_outbound(resources, spec, findings=redacted), framework,
+            spec)
     except ValueError as e:
         # Fail-closed sanitize: a config file that cannot be parsed cannot be
         # verified secret-free -- abort instead of pushing plaintext keys.
@@ -450,6 +452,17 @@ def cmd_upload(
         headers=['FILE', 'SIZE'],
         color=display.COLOR_WRITTEN,
     )
+    if redacted:
+        # Before the dry-run return, so --dry-run shows what would be stripped.
+        display.table(
+            'Secrets redacted',
+            [(f.rel, f.kind, f'line {f.line}' if f.line else 'structural')
+             for f in sorted(redacted)],
+            headers=['FILE', 'KIND', 'WHERE'],
+            color=display.COLOR_MERGED,
+            note=f'{len(redacted)} secret value(s) replaced with '
+            f'[REDACTED:*] in the uploaded copy; local files are untouched.',
+        )
 
     if dry_run:
         print('\n[dry-run] nothing uploaded.')