fix(cli): -v logs agent-env's debug messages and only other libraries' warnings

[earakely-scale]

agent-env -v no longer writes Modal's token to its output.

Why

-v called logging.basicConfig(level=logging.DEBUG), which turns on every library's debug logging. Modal's client speaks HTTP/2 through h2, whose hpack logs each header it encodes, so a verbose run that touched Modal printed x-modal-token-id and x-modal-token-secret in plain text, hundreds of times per run. Anyone pasting -v output into an issue or a chat would hand over their Modal token. Other libraries' debug logs (botocore, httpx) can carry signed URLs and request details too.

What

-v sets DEBUG on agent-env's own loggers, agent_env and agentenv_protocol, and leaves the root logger at WARNING, so other libraries log their warnings only. The help text says so. The levels last for the command: they're a resource of its click context, as its namespace routing is, so a CLI invoked in-process leaves the caller's logging as it was.

Tests

Unit tier: 7,459 passed, with pytest's live logging on as CI runs it. New: in a fresh interpreter, as the CLI runs, agent-env's and the protocol's debug messages are logged, hpack's debug message carrying x-modal-token-secret isn't, and hpack's warning is; and a -v command run in-process leaves the loggers' levels as they were. The first commit left them at DEBUG, which broke plugin check's tests when they ran after a --verbose test in the same worker.

Live, a -v bundle run on Modal from fresh local stores: 64 lines of output, 48 of them agent-env's, none from hpack, no token. The same run logged 600 to 700 KB before, most of it hpack's header encoding.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues remain.

Summary

-v enables debug messages from agent_env and agentenv_protocol without enabling other libraries’ debug messages in a fresh process.

• Verbose CLI runs show agent-env details without other libraries’ debug logs.

_{Reviews (3) · Last reviewed commit: "Merge main (v0.9.1320) into verbose-logs..." · Reviewed by Greptile}