fix(redact): value-aware secret redaction across all output surfaces (#4 HIGH-2, #7)

[ruvnet]

What / why

Fixes HIGH-2 from the AQE beta-feedback (#4): the "bundle is sanitised" promise was value-blind. Five copies of the same recursive redactor (diag.ts, export-config.ts, threat-model.ts, genome.ts, score.ts) keyed only on object-KEY names, so a secret-shaped value in a field not named secret/token/key — e.g. a token pasted into a vars entry — sailed straight into the harness diag --bundle output that the docs tell users to paste into a GitHub issue.

Also closes finding #7 for this surface: the 5 duplicated redaction regexes become one source of truth.

Change — new src/redact.ts

• looksLikeSecretValue(s) — conservative, precision-favouring: known provider prefixes (sk-/ghp_/AKIA/AIza/glpat/xox…), PEM blocks, JWTs, and generic ≥40-char mixed-case alphanumeric tokens. The mixed-case+digit rule deliberately excludes lowercase-hex git SHAs, uppercase-hex digests, and dashed UUIDs, so common non-secret identifiers are not redacted.
• redactSecretsDeep(value, {keyRe, replacement}) — redacts by key name and by value shape. Each call site keeps its own keyRe + replacement token (<redacted> for bundles, [REDACTED] for score/genome/threat), so existing behaviour is preserved and only more is redacted (strictly safer).
• Removes a dead branch in diag.sanitiseManifest (an else if that re-tested the key).

Live-verify (real harness diag --bundle)

"name": "demo",                         # ordinary value — kept
"deploy_webhook": "<redacted>",         # secret-shaped value under a NON-secret key — redacted
"note": "a1b2c3d4...e7f8a9b0",          # git SHA — kept (no false positive)

Raw secret occurrences in the bundle: 0.

Tests

• 20 new (redact.test.ts): looksLikeSecretValue precision (7 real tokens redact; SHA/UUID/version/path/sentence kept), redactSecretsDeep key + value + nested + array + token cases, and the diag --bundle leak integration (secret-shaped value in a non-secret manifest field is absent from the bundle).
• Full create-agent-harness suite 381/381; tsc clean.

Not in this PR (noted for follow-up)

secrets.ts HIGH-2 part (a) — secrets fetch prints the raw secret to stdout "for piping" (documented behaviour) and validate-token leaks the exact char-length. Changing the print default is a CLI-UX decision better made by a maintainer; happy to follow up.

🤖 Generated with claude-flow