Function redact 

pub fn redact(text: &str) -> String

Scrub secret-bearing text for a developer log or protocol trace.

Removes (case-insensitively):

• Authorization: <value> headers - including the Authorization key itself - and a bare Authorization word;
• Bearer <token> credential values (the Bearer keyword is kept, the token is replaced);
• standalone cfut_* / cfwt_* token values;
• cookie header/attribute values;
• ENV_VAR=value-style assignments (the value is replaced).

The caller is responsible for routing prompt content and tool output through the debug-protocol path only when debug_protocol_enabled is true - and even then through this function.