feat: harden self-managed reconciliation

server/redact.ts

@@ -10,10 +10,24 @@ const AWS_ACCESS_KEY_ID = /\bAKIA[0-9A-Z]{16}\b/g;
 // OpenSSH and other PEM private key headers embedded anywhere in a string.
 const PRIVATE_KEY_HEADER = /-----BEGIN [A-Z ]*PRIVATE KEY-----/g;
 
+// Secret-bearing environment assignments are commonly included in provider
+// and command error messages (for example, DB_PASSWORD=...).
+const SECRET_ASSIGNMENT =
+  /\b([A-Z][A-Z0-9_]*(?:PASSWORD|PASSWD|TOKEN|SECRET|CREDENTIAL|PRIVATE_KEY|ACCESS_KEY|CONNECTION_STRING|DATABASE_URL)[A-Z0-9_]*)\s*[=:]\s*([^\s,;\]}]+)/gi;
+const SECRET_FIELD =
+  /(["']?(?:password|passwd|token|secret|credential|privateKey|accessKey|connectionString|databaseUrl)["']?\s*:\s*["']?)([^"'\s,}\]]+)/gi;
+const SECRET_DATA =
+  /((?:["'](?:kind|type)["']\s*:\s*["'](?:Secret|secret)["'][\s\S]{0,1000}?["'](?:data|stringData)["']\s*:\s*)\{[^{}]*\})/gi;
+
 /** Redact common credential-bearing substrings while leaving everything else intact. */
 export function redactString(value: string): string {
   return value
     .replace(AWS_ACCESS_KEY_ID, REDACTED)
     .replace(PRIVATE_KEY_HEADER, REDACTED)
+    .replace(SECRET_ASSIGNMENT, (_match, key) => `${key}=${REDACTED}`)
+    .replace(SECRET_FIELD, (_match, prefix) => `${prefix}${REDACTED}`)
+    .replace(SECRET_DATA, (_match, prefix) =>
+      prefix.replace(/\{[^{}]*\}$/, `{${REDACTED}}`),
+    )
     .replace(URL_CREDENTIALS, (_match, scheme) => `${scheme}${REDACTED}@`);
 }