redact_sensitive_params (mcp/oauth_redaction.py)

OAuth URL redaction: strip security-sensitive query/fragment params for logging. Phase 4 WI-4.6 (gap-analysis §2.3). Mirrors typescript/src/services/mcp/ auth.ts:redactSensitiveUrlParams + SENSITIVE_OAUTH_PARAMS. Use this anywhere an OAuth URL might end up in a log line, telemetr

# Source: https://github.com/agentforce314/clawcodex | License: MIT | Copyright 2026 Clawd Codex Team
# Provided via justclaw.it.com; keep this notice with the code.
"""OAuth URL redaction: strip security-sensitive query/fragment params for logging.

Phase 4 WI-4.6 (gap-analysis §2.3). Mirrors typescript/src/services/mcp/
auth.ts:redactSensitiveUrlParams + SENSITIVE_OAUTH_PARAMS.

Use this anywhere an OAuth URL might end up in a log line, telemetry
event, error message, or stack trace. Both query AND fragment are
redacted — the OAuth implicit grant flow returns ``access_token`` /
``id_token`` in the URL fragment (RFC 6749 §4.2.2); failing to redact
the fragment silently leaks credentials in logs.

Matching is case-insensitive: a non-spec-compliant server emitting
``State=...`` or ``CODE=..

... (truncated -- full source via MCP)