feat: add safe logging helper

TASKS.md

@@ -82,5 +82,37 @@ Requirements:
 - Log safe metadata (tool name, timestamp, model, input/output size, duration, success/failure, error type).
 - No stack traces in logs.
 - No sensitive data in logs.
+- Defensive redaction of secret field names and Bearer tokens in metadata values.
+- Support levels: info, warn, error, silent (invalid levels throw).
+
+Status: ✅ Complete
+
+---
+
+## Phase 2 - OpenAI Integration
+
+### Task 2.1 - OpenAI client wrapper
+
+Create `src/openai/client.js`.
+
+Requirements:
+- Create a minimal OpenAI API client using the OpenAI SDK.
+- Accept API key from configuration (never hardcoded).
+- Support configurable model and temperature.
+- Implement streaming via the Responses API.
+
+Status: ⏳ Pending
+
+### Task 2.2 - Response builder
+
+Create `src/openai/responses.js`.
+
+Requirements:
+- Build structured OpenAI Responses API payloads from tool inputs.
+- Apply character budget checks before sending.
+- Redact secrets using `redact()` before constructing the request.
+- Never include openaiApiKey in request logs or error messages.
+- Handle OpenAI API errors gracefully (authentication, rate limits, timeouts).
+- Return safe advisory-formatted text responses.
 
 Status: ⏳ Pending