redactSecrets (utils/logRedaction.ts)

* Log redaction safety net (free-claude-code port, Fase 8.3). Final defense-in-depth layer: scrubs credentials that slip into log MESSAGES or arbitrary object/error values, regardless of call site. It complements — does not replace — the call-site maskers (`src/mitm/maskSecrets.t

// Source: https://github.com/iskyewinter-collab/Omniroute | License: MIT | Copyright 2026 diegosouzapw
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Log redaction safety net (free-claude-code port, Fase 8.3).
 *
 * Final defense-in-depth layer: scrubs credentials that slip into log MESSAGES or
 * arbitrary object/error values, regardless of call site. It complements — does not
 * replace — the call-site maskers (`src/mitm/maskSecrets.ts`, `src/lib/logPayloads.ts`),
 * and runs in the pino `hooks.logMethod` (main thread, so it works with transports).
 *
 * Patterns are strictly bounded (single, non-overlapping character classes with `{n,}`
 * limits) to avoid catastrophic backtracking on untrusted input — see CLAUDE.md
 * "PII & Stream Sanitization Learnings" §1.


... (truncated -- full source via MCP)