feat: wire wechat archive through langbot and n8n

scripts/src/platform-infra-langbot.ts

@@ -1014,6 +1014,29 @@ function prepareSecretMaterial(langbot: LangBotConfig): SecretMaterial {
   };
 }
 
+export function readLangBotRuntimeConfig(): Record<string, unknown> {
+  const langbot = readLangBotConfig();
+  const target = resolveTarget(langbot, "G14");
+  return {
+    publicBaseUrl: target.publicExposure.publicBaseUrl,
+    expectedNamespace: target.namespace,
+    apiKeyName: langbot.apiKey.key,
+    valuesPrinted: false,
+  };
+}
+
+export function readLangBotSecretMaterial(): Record<string, unknown> {
+  const langbot = readLangBotConfig();
+  const secret = prepareSecretMaterial(langbot);
+  return {
+    apiKey: secret.values.apiKey,
+    apiKeyFingerprint: fingerprintValues({ [langbot.apiKey.key]: secret.values.apiKey }, [langbot.apiKey.key]),
+    sourceRef: langbot.apiKey.sourceRef,
+    keyName: langbot.apiKey.key,
+    valuesPrinted: false,
+  };
+}
+
 function prepareFrpcSecret(langbot: LangBotConfig, target: LangBotTarget): FrpcSecretMaterial {
   const exposure = target.publicExposure;
   const sourcePath = join(secretRoot(langbot), exposure.frpc.tokenSourceRef);
@@ -1556,7 +1579,7 @@ function publicHttpProbe(baseUrl: string, path: string, apiKey: string | null):
     url,
     status: Number.isInteger(status) ? status : null,
     bodyBytes: Buffer.byteLength(body, "utf8"),
-    bodyPreview: body.slice(0, 2000),
+    bodyPreview: redactText(body).slice(0, 2000),
     stderrTail: redactText(stderr).slice(-2000),
     apiKeyUsed: apiKey !== null,
     valuesPrinted: false,
@@ -1708,7 +1731,11 @@ function compactCapture(result: SshCaptureResult, options: { full?: boolean } =
 }
 
 function redactText(text: string): string {
-  return text.replace(/lbk_[A-Za-z0-9_-]+/gu, "lbk_<redacted>").replace(/postgresql:\/\/[^@\s]+@/gu, "postgresql://<redacted>@");
+  return text
+    .replace(/lbk_[A-Za-z0-9_-]+/gu, "lbk_<redacted>")
+    .replace(/(postgres(?:ql)?:\/\/)[^@\s"']+@/giu, "$1<redacted>@")
+    .replace(/(Bearer\s+)[A-Za-z0-9._~+/=-]+/giu, "$1<redacted>")
+    .replace(/(["']?(?:token|password|secret|api[_-]?key|apikey|jwt[_-]?secret|database[_-]?url)["']?\s*[:=]\s*["']?)[^"',\s}]+(["']?)/giu, "$1<redacted>$2");
 }
 
 function redactRepoPath(path: string): string {