[codex] remove unsafe debug tools and harden history handling

CLAUDE.md

@@ -82,13 +82,12 @@ The `syncutil` package provides shared utilities for sync-based CLI tools:
 
 ### CLI Tools (`cmd/`)
 
-See `cmd/README.md` for detailed documentation. Key tools:
+See `README.md` for installation and command documentation. Key tools:
 - **`things-cloud-cli`** — Preferred CLI for reads, safe dry-run writes, CRUD,
   recurring tasks, completed/logbook evidence, and batch operations
 - **`things-cli`** — Backward-compatible alias for older integrations
 - **`things-mcp`** — Stdio MCP server for agent hosts
 - **`thingsync`** — JSON-based sync with workflow views (today, inbox, review, patterns)
-- **`synctest`** — Human-readable sync output for testing
 
 ### Test Infrastructure
 

client.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"log"
 	"net/http"
-	"net/http/httputil"
 	"net/url"
 )
 
@@ -118,17 +117,16 @@ func (c *Client) do(req *http.Request) (*http.Response, error) {
 	req.Header.Set("Things-Client-Info", base64.StdEncoding.EncodeToString(ciJSON))
 
 	if c.Debug {
-		bs, _ := httputil.DumpRequest(req, true)
-		log.Println("REQUEST:", string(bs))
+		log.Printf("REQUEST: %s %s", req.Method, req.URL.Redacted())
 	}
 
 	resp, err := c.client.Do(req)
 	if c.Debug {
-		if err == nil {
-			bs, _ := httputil.DumpResponse(resp, true)
-			log.Println("RESPONSE:", string(bs))
+		if err != nil {
+			log.Printf("RESPONSE ERROR: %v", err)
+		} else {
+			log.Printf("RESPONSE: %s", resp.Status)
 		}
-		log.Println()
 	}
 	return resp, err
 }

client_test.go

@@ -1,11 +1,14 @@
 package thingscloud
 
 import (
+	"bytes"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"strings"
 	"testing"
 )
 
@@ -73,3 +76,40 @@ func TestClient_UserAgent(t *testing.T) {
 		t.Error("things-client-info header is missing or empty")
 	}
 }
+
+func TestClient_DebugLoggingRedactsSensitiveData(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"private":"response-body"}`))
+	}))
+	defer ts.Close()
+
+	var logs bytes.Buffer
+	oldOutput := log.Writer()
+	log.SetOutput(&logs)
+	t.Cleanup(func() { log.SetOutput(oldOutput) })
+
+	c := New(ts.URL, "test@example.com", "secret-password")
+	c.Debug = true
+	req, err := http.NewRequest("POST", "/test", strings.NewReader(`{"password":"new-secret"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Password secret-password")
+
+	resp, err := c.do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	got := logs.String()
+	for _, sensitive := range []string{"secret-password", "new-secret", "response-body", "Authorization"} {
+		if strings.Contains(got, sensitive) {
+			t.Errorf("debug log contains sensitive value %q", sensitive)
+		}
+	}
+	if !strings.Contains(got, "REQUEST: POST") || !strings.Contains(got, "RESPONSE: 200 OK") {
+		t.Errorf("debug log is missing request or response metadata: %q", got)
+	}
+}