redactSourceConfig (core/source-config-redact.ts)

Redacts sensitive webhook secrets from source config objects before serialization, ensuring no leaks.

// Source: https://github.com/inbrainfun/inbrain | License: MIT | Copyright 2026 Inbrain Contributors
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Redact secrets from sources.config before serializing (v0.40 D15.4).
 *
 * Codex outside-voice catch on the v0.40 plan: `webhook show` hides the
 * secret, but any OTHER surface that returns raw `sources.config` (the
 * sources list --json, an MCP get_source op, an HTTP admin API) would
 * leak it. This module is the single redaction primitive every serializer
 * routes through.
 *
 * `scripts/check-source-config-leak.sh` grep-guards against future drift.
 */

const SECRET_KEYS: ReadonlySet<string> = new Set([
  'webhook_secret',
]);

/**
 * Return a shallow copy of `config` with every key in SECRET_KEYS replaced
 * wi

... (truncated -- full source via MCP)