fix: redact commander approval reasons

scripts/src/commander.ts

@@ -31,6 +31,23 @@ function isHighRiskAction(value: string): value is HighRiskAction {
   return highRiskActions.some((action) => action === value);
 }
 
+function redactText(value: string): { text: string; redactionsApplied: number } {
+  let redactionsApplied = 0;
+  const patterns = [
+    /\b(?:sk|ghp|github_pat|xoxb|xoxp|AKIA)[A-Za-z0-9_=-]{8,}\b/g,
+    /\b(?:token|secret|password|passwd|authorization|cookie|api[_-]?key)\s*[:=]\s*[^,\s]+/gi,
+    /\bBearer\s+[A-Za-z0-9._~+/-]+=*\b/gi,
+  ];
+  let text = value;
+  for (const pattern of patterns) {
+    text = text.replace(pattern, () => {
+      redactionsApplied += 1;
+      return "<redacted>";
+    });
+  }
+  return { text, redactionsApplied };
+}
+
 function commanderHelp(): Record<string, unknown> {
   return {
     command: "commander",
@@ -270,7 +287,8 @@ function commanderApprovalRequest(args: string[]): Record<string, unknown> {
       highRiskActions,
     };
   }
-  const reason = optionValue(args, "--reason") ?? "operator-supplied reason required before live execution";
+  const rawReason = optionValue(args, "--reason") ?? "operator-supplied reason required before live execution";
+  const reason = redactText(rawReason);
   const taskId = optionValue(args, "--task-id") ?? null;
   return {
     ok: true,
@@ -279,20 +297,21 @@ function commanderApprovalRequest(args: string[]): Record<string, unknown> {
     mutation: false,
     action,
     taskId,
-    reason,
+    reason: reason.text,
+    redactionsApplied: reason.redactionsApplied,
     requiresExplicitUserApproval: true,
     claudeqq: {
       mutation: false,
       endpointShape: "POST /api/microservices/claudeqq/proxy/api/push/text",
       target: "configured primary user private chat",
-      messageTemplate: `Approval required for ${action}. Reason: ${reason}. Reply with explicit approval id before execution.`,
+      messageTemplate: `Approval required for ${action}. Reason: ${reason.text}. Reply with explicit approval id before execution.`,
       sendImplemented: false,
     },
     approvalRecordShape: {
       id: "commander-approval-<stable-id>",
       action,
       taskId,
-      reason,
+      reason: reason.text,
       status: "draft",
       approvedBy: null,
       approvedAt: null,