Function redact_command_text 

pub fn redact_command_text(s: &str) -> String

AGGRESSIVE scrub for one-off display of a command the user is about to approve (the Confirm prompt preview and the confirmer’s message). It trades false positives for recall, so it must NOT be used for stored text the model or user later reads back (context archive, memory, traces): those use redact_value / redact_text only. On top of redact_text it adds:

• any Authorization: / Cookie: / Set-Cookie: header value;
• Bearer <tok>;
• name=value / name: value where the name contains api_key, access_key, token, secret, password/passwd or credential, and for a compound identifier (aws_secret_access_key) a whitespace separator;
• UPPER_SNAKE *_KEY=value (case-sensitive);
• --flag value / --flag=value with the keyword anywhere in the flag;
• sk-… / sk_… keys and JWTs.