feat: centralize redaction and data minimization for all egress paths (#19)

[TINGyu123644]

Summary

Centralize redaction and data minimization for all data egress paths (issue #19).

Changes

New: Unified Redaction Module

Single source of truth for all secret redaction across the codebase:

• patterns.ts — All secret detection patterns in one place:

  • API keys (sk-, sk-ant-, rk-, pk-, ak-)
  • AWS access keys (AKIA...)
  • Bearer tokens, X-Api-Key headers
  • JWT tokens, GitHub tokens (ghp_, github_pat_)
  • LangSmith keys (lsv2_pt_, lsv2_sk_)
  • Connection strings (postgres://, mongodb://, etc.)
  • URL query secrets (?api_key=, ?token=)
  • Base64 blobs

• redactor.ts — Core Redactor class:

  • Privacy levels: minimal (names/status only), standard (content after redaction), full (complete trace, still credential-redacted)
  • Deep object sanitization: recursively walks nested objects/arrays
  • Secret field detection by name (apiKey, token, password, cookie...)
  • Portfolio payload downgrade: portfolio tool results are reduced to schema summaries at standard/minimal levels
  • Tool call sanitization: args, result, error message all sanitized

• canary.ts — CanaryScanner for leak detection:

  • Generates fake canary secrets (OpenAI, AWS, GitHub, JWT, LangSmith...)
  • Scans strings, objects, and multi-artifact batches
  • Detects both injected canaries and residual secret patterns

Consolidation

• diagnostics/redact.ts — now re-exports from unified module (backward compatible)
• evaluation/redactor.ts — now re-exports from unified module (backward compatible)
• All scattered redaction logic now shares one rule set

Acceptance Criteria Coverage

• Reusable unified redaction contract — logs, diagnostics, telemetry, eval all use the same rules
• Provider keys, Authorization, cookie, connection string covered with tests
• Secrets in nested tool args/results, HTTP errors, URL query params all handled
• Default telemetry content policy defined via privacy levels
• Redaction never falls back to raw payload — redacted output is always safe
• Run id, tool name, latency, status all preserved through redaction
• Canary scanner included for CI leak detection
• Production Agent path end-to-end canary run (requires running full app with real provider)

Privacy Levels

Level	Content	Use case
minimal	Names, status, timings only	Strict privacy / on-device
standard	Content after redaction; portfolio downgraded	Default / recommended
full	Complete trace, still credential-redacted	Explicit opt-in debugging

Closes #19

[helsome]

当前先不通过，缺少可审核的测试报告。这个 PR 涉及统一脱敏/隐私边界，属于需要明确验证证据的改动。

请在 PR 描述或评论中补充实际测试报告，至少包含：

• 实际执行的命令；
• Bun/OS 等关键环境信息；
• 每组测试的 pass/fail 数量；
• 若存在失败，说明是否可在当前 main 复现；
• 针对本 PR 的脱敏用例结果：Authorization/Cookie/API key/connection string/嵌套 tool args/result/error/URL query 等；
• CanaryScanner 或等价泄漏检查的实际执行结果。

不要求为了这个 PR 搭完整生产 E2E，但需要证明新增隐私规则确实跑过、结果可复现。补齐测试报告后再 review。

[helsome]

#64 已覆盖同一个 #19 方向，并且当前实现/测试证据更完整：统一 privacy 模块、日志/diagnostics/eval/error/telemetry/export 边界接线、Bun 1.4.2 + Windows 环境、focused tests、全仓 baseline 对照及 canary 扫描均已提交。为避免两套 redaction contract 并行维护，本 PR 作为重复实现关闭。若这里有 #64 未覆盖且独立有价值的点，可后续拆成窄 PR。