feat(core): pause/resume protocol with ExecutionPhase lifecycle

Move LogSanitizer to core. Fix github-advanced-security warning

Resolve: #71
Signed-off-by: Aleksandr Suvorov <asuvorov@hensu.io>

Author: alxsuv

hensu-core/README.md

@@ -392,7 +392,8 @@ hensu-core/src/main/java/io/hensu/core/
 ├── template/                      # {variable} placeholder resolution
 ├── util/
 │   ├── AgentOutputValidator.java  # LLM output safety checks (control chars, Unicode tricks, size)
-│   └── JsonUtil.java              # Dependency-free JSON extraction utilities
+│   ├── JsonUtil.java              # Dependency-free JSON extraction utilities
+│   └── LogSanitizer.java         # Strips CR/LF from logged values to prevent log injection
 └── state/                         # Execution state and persistence
     ├── HensuState.java            # Mutable runtime state during execution
     ├── HensuSnapshot.java         # Immutable checkpoint record for persistence

hensu-core/src/main/java/io/hensu/core/execution/pipeline/ReviewPostProcessor.java

@@ -11,6 +11,7 @@
 import io.hensu.core.review.ReviewOutcome;
 import io.hensu.core.state.ExecutionPhase;
 import io.hensu.core.state.HensuState;
+import io.hensu.core.util.LogSanitizer;
 import io.hensu.core.workflow.node.StandardNode;
 import java.util.Map;
 import java.util.logging.Logger;
@@ -101,7 +102,11 @@ private ProcessorOutcome handleDecision(
             case ReviewDecision.Approve approve -> handleApprove(approve, context);
             case ReviewDecision.Backtrack backtrack -> handleBacktrack(backtrack, nodeId, context);
             case ReviewDecision.Reject reject -> {
-                logger.info("Rejecting node: " + nodeId + " due to: " + reject.getReason());
+                logger.info(
+                        "Rejecting node: "
+                                + LogSanitizer.sanitize(nodeId)
+                                + " due to: "
+                                + LogSanitizer.sanitize(reject.getReason()));
                 yield ProcessorOutcome.terminal(
                         new ExecutionResult.Rejected(reject.getReason(), context.state()));
             }

…ensu/server/validation/LogSanitizer.java …ava/io/hensu/core/util/LogSanitizer.javahensu-server/src/main/java/io/hensu/server/validation/LogSanitizer.java renamed to hensu-core/src/main/java/io/hensu/core/util/LogSanitizer.java hensu-server/src/main/java/io/hensu/server/validation/LogSanitizer.java renamed to hensu-core/src/main/java/io/hensu/core/util/LogSanitizer.java

@@ -1,4 +1,4 @@
-package io.hensu.server.validation;
+package io.hensu.core.util;
 
 /// Strips control characters from strings to prevent log injection.
 ///
@@ -7,9 +7,9 @@
 /// allowing attackers to forge log entries.
 ///
 /// Apply to any user-derived value before passing it to a logger:
-/// ```
-/// LOG.infov("Processing: id={0}", LogSanitizer.sanitize(userInput));
-/// ```
+/// {@snippet :
+/// logger.info("Processing: id=" + LogSanitizer.sanitize(userInput));
+/// }
 public final class LogSanitizer {
 
     private LogSanitizer() {}

…/server/validation/LogSanitizerTest.java …io/hensu/core/util/LogSanitizerTest.javahensu-server/src/test/java/io/hensu/server/validation/LogSanitizerTest.java renamed to hensu-core/src/test/java/io/hensu/core/util/LogSanitizerTest.java hensu-server/src/test/java/io/hensu/server/validation/LogSanitizerTest.java renamed to hensu-core/src/test/java/io/hensu/core/util/LogSanitizerTest.java

@@ -1,4 +1,4 @@
-package io.hensu.server.validation;
+package io.hensu.core.util;
 
 import static org.assertj.core.api.Assertions.assertThat;
 

hensu-server/README.md

@@ -403,7 +403,6 @@ hensu-server/
 │   │   ├── ValidMessageValidator     # Size-limit + control-character validator
 │   │   ├── ValidWorkflow.java              # Custom constraint for Workflow bodies
 │   │   ├── ValidWorkflowValidator.java     # Deep-validates workflow object graph
-│   │   ├── LogSanitizer.java               # Strips CR/LF for log injection prevention
 │   │   ├── IllegalArgumentExceptionMapper.java      # Maps IllegalArgumentException → 400
 │   │   └── ConstraintViolationExceptionMapper.java  # Global 400 error mapper
 │   ├── config/                            # CDI configuration

hensu-server/src/main/java/io/hensu/server/api/ExecutionEventResource.java

@@ -1,9 +1,9 @@
 package io.hensu.server.api;
 
+import io.hensu.core.util.LogSanitizer;
 import io.hensu.server.security.RequestTenantResolver;
 import io.hensu.server.streaming.ExecutionEvent;
 import io.hensu.server.streaming.ExecutionEventBroadcaster;
-import io.hensu.server.validation.LogSanitizer;
 import io.hensu.server.validation.ValidId;
 import io.smallrye.mutiny.Multi;
 import jakarta.inject.Inject;

hensu-server/src/main/java/io/hensu/server/api/ExecutionResource.java

@@ -1,8 +1,8 @@
 package io.hensu.server.api;
 
 import io.hensu.core.resume.ResumeInput;
+import io.hensu.core.util.LogSanitizer;
 import io.hensu.server.security.RequestTenantResolver;
-import io.hensu.server.validation.LogSanitizer;
 import io.hensu.server.validation.ValidId;
 import io.hensu.server.workflow.ExecutionNotFoundException;
 import io.hensu.server.workflow.ExecutionOutput;

hensu-server/src/main/java/io/hensu/server/api/McpGatewayResource.java

@@ -1,7 +1,7 @@
 package io.hensu.server.api;
 
+import io.hensu.core.util.LogSanitizer;
 import io.hensu.server.mcp.McpSessionManager;
-import io.hensu.server.validation.LogSanitizer;
 import io.hensu.server.validation.ValidId;
 import io.hensu.server.validation.ValidMessage;
 import io.smallrye.mutiny.Multi;

hensu-server/src/main/java/io/hensu/server/api/WorkflowResource.java

@@ -1,8 +1,8 @@
 package io.hensu.server.api;
 
+import io.hensu.core.util.LogSanitizer;
 import io.hensu.core.workflow.Workflow;
 import io.hensu.server.security.RequestTenantResolver;
-import io.hensu.server.validation.LogSanitizer;
 import io.hensu.server.validation.ValidId;
 import io.hensu.server.validation.ValidWorkflow;
 import io.hensu.server.workflow.WorkflowNotFoundException;

hensu-server/src/main/java/io/hensu/server/mcp/McpSessionManager.java

@@ -1,6 +1,6 @@
 package io.hensu.server.mcp;
 
-import io.hensu.server.validation.LogSanitizer;
+import io.hensu.core.util.LogSanitizer;
 import io.smallrye.mutiny.Multi;
 import io.smallrye.mutiny.Uni;
 import io.smallrye.mutiny.subscription.MultiEmitter;