fix: normalize safe keys and strip empty dict-style env values

- Uppercase safe keys in compileConfig so Advanced Settings safe keys
  work regardless of input casing (matches isSensitiveKey lookup)
- Strip empty values from dict-style environment blocks in stripNoise,
  matching existing array-style behavior
- Remove unused openPrivateBin/openGist imports from main.ts
- Add regression tests for both fixes

Co-authored-by: ajbturnberry <ajbturnberry@users.noreply.github.com>

Author: cursoragent

src/config.ts

@@ -61,7 +61,7 @@ export function compileConfig(config: SanitizerConfig): {
   }
   return {
     sensitivePatterns: compiled,
-    safeKeys: new Set(config.safeKeys),
+    safeKeys: new Set(config.safeKeys.map(k => k.toUpperCase())),
   }
 }
 

src/main.ts

@@ -5,7 +5,7 @@ import { redactCompose } from './redact'
 import { stripNoise } from './noise'
 import { detectAdvisories, type Advisory } from './advisories'
 import { loadConfig, saveConfig, resetConfig, compileConfig, type SanitizerConfig } from './config'
-import { copyToClipboard, openPrivateBin, openGist } from './clipboard'
+import { copyToClipboard } from './clipboard'
 import { createShortNotice, createPiiWarning, createFullDisclaimer } from './disclaimer'
 import { el } from './dom'
 import { parseServices } from './services'

src/noise.ts

@@ -62,7 +62,10 @@ function stripNoiseEnvDict(env: Record<string, unknown>): Record<string, unknown
   const result: Record<string, unknown> = {}
   for (const [key, value] of Object.entries(env)) {
     if (!isNoiseEnvKey(key)) {
-      result[key] = value
+      const strValue = value == null ? '' : String(value)
+      if (strValue !== '') {
+        result[key] = value
+      }
     }
   }
   return result

tests/config.test.ts

@@ -85,6 +85,17 @@ describe('config', () => {
     expect(compiled.safeKeys.has('OTHER')).toBe(false)
   })
 
+  it('compileConfig normalizes safe keys to uppercase for case-insensitive lookup', () => {
+    const config = {
+      sensitivePatterns: ['secret'],
+      safeKeys: ['auth_token', 'MY_KEY'],
+    }
+    const compiled = compileConfig(config)
+    expect(compiled.safeKeys.has('AUTH_TOKEN')).toBe(true)
+    expect(compiled.safeKeys.has('MY_KEY')).toBe(true)
+    expect(compiled.safeKeys.has('auth_token')).toBe(false)
+  })
+
   it('compileConfig skips invalid regex patterns gracefully', () => {
     const config = {
       sensitivePatterns: ['valid', '[invalid', 'also_valid'],

tests/noise.test.ts

@@ -275,4 +275,25 @@ describe('stripNoise', () => {
     expect(env).not.toContain('UNBOUND_NAMESERVERS=')
     expect(env).toContain('PUID=1000')
   })
+
+  it('strips empty env values in dict style', () => {
+    const input = {
+      services: {
+        app: {
+          environment: {
+            VPN_PIA_USER: '',
+            VPN_LAN_NETWORK: '',
+            UNBOUND_NAMESERVERS: '',
+            PUID: '1000',
+          },
+        },
+      },
+    }
+    const result = stripNoise(input)
+    const env = (result['services'] as Record<string, Record<string, unknown>>)['app']?.['environment'] as Record<string, unknown>
+    expect(env).not.toHaveProperty('VPN_PIA_USER')
+    expect(env).not.toHaveProperty('VPN_LAN_NETWORK')
+    expect(env).not.toHaveProperty('UNBOUND_NAMESERVERS')
+    expect(env).toHaveProperty('PUID', '1000')
+  })
 })

tests/redact.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from 'vitest'
 import { redactCompose } from '../src/redact'
+import { compileConfig } from '../src/config'
 
 describe('redactCompose', () => {
   it('redacts sensitive env vars in dict style', () => {
@@ -262,6 +263,25 @@ services:
     expect(result.stats.redactedEnvVars).toBe(1)
   })
 
+  it('respects lowercase safe keys via compileConfig (Advanced Settings path)', () => {
+    const input = `
+services:
+  app:
+    environment:
+      AUTH_TOKEN: should-be-safe
+      SECRET: should-be-redacted
+`
+    const compiled = compileConfig({
+      sensitivePatterns: ['secret', 'auth', 'token'],
+      safeKeys: ['auth_token'],
+    })
+    const result = redactCompose(input, compiled)
+    expect(result.error).toBeNull()
+    expect(result.output).toContain('should-be-safe')
+    expect(result.output).not.toContain('should-be-redacted')
+    expect(result.stats.redactedEnvVars).toBe(1)
+  })
+
   it('uses custom config with array-style env vars', () => {
     const input = `
 services: