feat: add secret redaction utility

src/utils/redact.js

@@ -1 +1,29 @@
 // Secret redaction utility.
+// Detects common secret patterns and replaces values with [REDACTED].
+
+export function redact(input) {
+  const str = typeof input === 'string' ? input : String(input);
+  let out = str;
+
+  // PEM blocks (multi-line): replace content between BEGIN/END markers
+  out = out.replace(
+    /(-----BEGIN[\s\S]*?PRIVATE KEY-----)[\s\S]*?(-----END[\s\S]*?PRIVATE KEY-----)/,
+    '$1\n[REDACTED]\n$2'
+  );
+
+  // Bearer tokens: preserve "Bearer " prefix
+  out = out.replace(/(Bearer\s+)(["']?\w[\w.-]+["']?)/g, '$1[REDACTED]');
+
+  // Git credentials: https://user:password@host → https://user:[REDACTED]@host
+  out = out.replace(/(https:\/\/\w+:)\S+(?=@)/, '$1[REDACTED]');
+
+  // Key=value secrets — quoted (double or single): capture up to matching close quote
+  const Q_PATTERN = /((?:OPENAI_API_KEY|API_KEY|TOKEN|SECRET|PASSWORD)[_\w]*)[ ]*=[ ]*(["'])(.*?)\2/gi;
+  out = out.replace(Q_PATTERN, '$1=$2[REDACTED]$2');
+
+  // Key=value secrets — unquoted: capture non-whitespace value
+  const U_PATTERN = /((?:OPENAI_API_KEY|API_KEY|TOKEN|SECRET|PASSWORD)[_\w]*)[ ]*=(?![\0`"'])([\S]+)/gi;
+  out = out.replace(U_PATTERN, '$1=[REDACTED]');
+
+  return out;
+}