Keep credentials out of reprs; count only live ssh-agents in tests

A failing CI test printed a test key through SSHKey's default repr. Push
credentials, AgentConfig's tokens and MatrixConfig's token are now
excluded from their reprs, so no failure or log line can print them. In
CI's container killed ssh-agents linger as zombies, so the tests count
only live ones.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_config.py

@@ -360,3 +360,10 @@ def test_a_push_token_needs_its_user_and_excludes_a_key() -> None:
         build(gitea__push_user="pusher")
     with pytest.raises(ConfigError, match="not both"):
         build(gitea__push_user="p", gitea__push_token="t", gitea__push_key="~/k")
+
+
+def test_no_credential_appears_in_the_config_repr() -> None:
+    config = build(gitea__push_user="pusher", gitea__push_token="${TEST_GITEA_TOKEN}")
+    text = repr(config)
+    for secret in SECRETS.values():
+        assert secret not in text

nisse-dev/tests/test_git.py

@@ -135,10 +135,25 @@ def test_a_failed_push_still_kills_its_agent(
 
 
 def _agents() -> set[str]:
+    """Live ssh-agents. A killed one lingers as a zombie in a CI container,
+    where nothing reaps orphans, so zombies don't count."""
     out = subprocess.run(
         ["pgrep", "-x", "ssh-agent"], capture_output=True, text=True, check=False
     ).stdout
-    return set(out.split())
+    live = set()
+    for pid in out.split():
+        try:
+            stat = Path(f"/proc/{pid}/stat").read_text()
+        except FileNotFoundError:
+            continue
+        if stat.rsplit(")", 1)[1].split()[0] != "Z":
+            live.add(pid)
+    return live
+
+
+def test_credentials_never_appear_in_a_repr() -> None:
+    assert "s3cr3t" not in repr(HTTPSToken("pusher", "s3cr3t"))
+    assert "PRIVATE" not in repr(SSHKey("-----BEGIN OPENSSH PRIVATE KEY-----"))
 
 
 def test_a_remote_url_is_quoted_not_interpreted(repo: GitRepo, tmp_path: Path) -> None: