Tighten sensitive key redaction

Avoid redacting harmless operational fields like session counts while still catching credential-style keys.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

Author: xuio

dist/index.js

@@ -21339,7 +21339,7 @@ var SECRET_PATTERNS = [
   /\b[A-Za-z_][A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY)=([^\s"'`]+)\b/gi,
   privateKeyPattern
 ];
-var SENSITIVE_ENV_KEY = /(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|COOKIE|SESSION|CREDENTIAL|AUTH)/i;
+var SENSITIVE_ENV_KEY = /(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|COOKIE|CREDENTIAL|AUTH|SESSION[_-]?(KEY|TOKEN|SECRET|COOKIE))/i;
 var SAFE_ENV_KEYS = /* @__PURE__ */ new Set([
   "CODEX_HOME",
   "CODEX_DESKTOP_APP_PATH",

src/redaction.ts

@@ -18,7 +18,8 @@ const SECRET_PATTERNS: RegExp[] = [
   privateKeyPattern,
 ];
 
-const SENSITIVE_ENV_KEY = /(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|COOKIE|SESSION|CREDENTIAL|AUTH)/i;
+const SENSITIVE_ENV_KEY =
+  /(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|COOKIE|CREDENTIAL|AUTH|SESSION[_-]?(KEY|TOKEN|SECRET|COOKIE))/i;
 const SAFE_ENV_KEYS = new Set([
   "CODEX_HOME",
   "CODEX_DESKTOP_APP_PATH",