Function redact_cmdline 

pub fn redact_cmdline(cmd: &str) -> String

Scrub credentials out of a space-joined argv before it leaves the process. Redacted: the value of any --flag value / --flag=value whose flag name mentions key/token/secret/password/bearer/auth/credential, any KEY=value env-style arg with such a key, and any bare arg that looks like a key (sk-…, ghp_…, xox…, Bearer …, or ≥ 32 chars of base64/hex with no path separator).