[ericcurtin]

Summary

Launch events now record the command with redacted, bounded arguments. Network events stop showing an ancestry path list as cmd_line.

Related Issue

Closes #4563

Changes

• Add sanitize_cmd_line_for_audit: redacts secrets, quotes and escapes arguments, keeps 64 args and 1024 chars.
• Set process.cmd_line on launch events.
• Drop the path-list cmd_line from network and HTTP events.
• Escape [cmd:..] and the process name in shorthand logs.
• Update docs.

Release Notes

Launch events carry a redacted process.cmd_line. Network and HTTP events no longer carry cmd_line.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, clippy -D warnings, and tests for openshell-ocsf, openshell-sandbox, and openshell-supervisor-network pass. mise run docs passes. E2E not run.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@krishicks PTAL. Launch argv is on by default here, happy to gate it behind a setting if you prefer. /ok to test 7c7c42158e7bcbad2c6b082146580967297a4881 if it looks good. Thank you!