Advanced developer workflows

Add higher-level debugging workflows without weakening the core guarantees for content integrity, authorization, predictable CLI output, and portability.

scan reports likely secrets without uploading. --redact-secrets applies a versioned built-in rule set locally before upload; custom redaction expressions are explicit and bounded against pathological runtime. Findings and redacted values are never sent as telemetry.

Redaction is best-effort and must not claim that content is secret-free. JSON output identifies rule names and locations without printing matched secret values.

CI mode is non-interactive, supports token environment overrides, emits stable JSON, and returns documented exit codes. Metadata can capture provider and run identifiers as ordinary bounded fields without granting those values trust.

A bundle has a manifest and multiple named entries. Paths are normalized, relative, unique, and protected against traversal. Size, file-count, and compression-expansion limits apply to the complete bundle. Authorization and expiration apply to the bundle as one object.

Diff accepts two authorized text inputs, detects binary content, and enforces size and compute limits. Server-side diff endpoints do not disclose whether an unauthorized comparison target exists. Local-versus-remote comparisons may run entirely in the CLI.

Exports use a versioned manifest, checksums, and streaming content files. Imports validate the complete manifest and report conflicts before mutation. Hosted-to-self-hosted migration composes export and import, checkpoints progress, and is safe to resume without duplicating pastes.

Workspace exports require workspace-owner authorization. Platform-wide export is an operator recovery tool, not an admin-panel convenience action.

Encryption occurs before upload using a versioned, authenticated-encryption envelope. Servers store ciphertext and minimal algorithm metadata and cannot preview, highlight, scan, search, redact, or recover encrypted content. Keys are never placed in normal URL query parameters, logs, API payload metadata, or server storage.

Key derivation, recipient sharing, recovery, browser decryption, and URL-fragment key UX require a dedicated cryptographic design review before implementation.

Git, Docker, Kubernetes, and journal integrations are thin CLI adapters over existing commands. They do not shell-expand user input, silently elevate privileges, or add service-specific server APIs. Each helper shows or documents the source command and preserves raw bytes until the upload boundary.

Progress against this proposal is tracked in the RFD 6 implementation checklist.