feat(redact): add value-pattern redaction for JWTs and PEM blocks

[protosphinx]

Why

The README documents three categories of default redaction on every record run: key-name patterns (*_token, authorization, etc.), JWTs, and PEM blocks. The key-name category was implemented; the JWT and PEM categories were not. Any real-world recording that passes a bearer JWT or an inline private key in a JSON-RPC message would land those secrets in the transcript file unredacted.

What

• Adds DEFAULT_REDACT_VALUE_PATTERNS: RegExp[] to src/redact.ts: a JWT three-segment base64url pattern and a PEM -----BEGIN block pattern.
• Adds redactValues(value, patterns) to src/redact.ts: walks a value tree and replaces any string whose content matches a pattern with <REDACTED>, independent of key name.
• Wires both into the stdio record path in src/record.ts: each frame is now run through redactValues(redactDeep(msg, keyPatterns), DEFAULT_REDACT_VALUE_PATTERNS).

Tests

• 11 new test cases added to test/redact.test.ts.
• Covers: JWT redaction, PEM redaction, nested values, arrays, empty-pattern short-circuit, near-JWT not redacted (two segments only), combined JWT+PEM in the same object, and DEFAULT_REDACT_VALUE_PATTERNS membership checks.

Self-merge gate

• all CI checks pass
• LOC delta < 250 (added + removed): 116 insertions, 4 deletions
• no public-API surface change: src/index.ts not touched; redactDeep signature unchanged
• no runtime-dependency additions
• no workflow file changes
• tests added or extended: 11 new test cases in test/redact.test.ts

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddc62d0077

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Redact Bearer-prefixed JWT values

The new JWT value pattern only matches strings that are exactly header.payload.signature, so common values like "Bearer <jwt>" are not redacted. This leaves a real secret-leak path whenever a bearer token appears under a non-sensitive key name (so key-based redaction does not trigger), which is exactly the case this value-based pass is meant to cover.

Useful? React with 👍 / 👎.