Preserve telemetry in redaction

Keep credential-style token keys redacted without hiding token usage counters in diagnostics.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

Author: xuio

dist/index.js

@@ -21339,7 +21339,7 @@ var SECRET_PATTERNS = [
   /\b[A-Za-z_][A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY)=([^\s"'`]+)\b/gi,
   privateKeyPattern
 ];
-var SENSITIVE_ENV_KEY = /(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|COOKIE|CREDENTIAL|AUTH|SESSION[_-]?(KEY|TOKEN|SECRET|COOKIE))/i;
+var SENSITIVE_ENV_KEY = /(API[_-]?KEY|SECRET|PASSWORD|PRIVATE[_-]?KEY|COOKIE|CREDENTIAL|AUTH|BEARER|(^|[_-])TOKEN$|ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN|OAUTH[_-]?TOKEN|SESSION[_-]?(KEY|TOKEN|SECRET|COOKIE))/i;
 var SAFE_ENV_KEYS = /* @__PURE__ */ new Set([
   "CODEX_HOME",
   "CODEX_DESKTOP_APP_PATH",

src/redaction.ts

@@ -19,7 +19,7 @@ const SECRET_PATTERNS: RegExp[] = [
 ];
 
 const SENSITIVE_ENV_KEY =
-  /(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|COOKIE|CREDENTIAL|AUTH|SESSION[_-]?(KEY|TOKEN|SECRET|COOKIE))/i;
+  /(API[_-]?KEY|SECRET|PASSWORD|PRIVATE[_-]?KEY|COOKIE|CREDENTIAL|AUTH|BEARER|(^|[_-])TOKEN$|ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN|OAUTH[_-]?TOKEN|SESSION[_-]?(KEY|TOKEN|SECRET|COOKIE))/i;
 const SAFE_ENV_KEYS = new Set([
   "CODEX_HOME",
   "CODEX_DESKTOP_APP_PATH",

test/logging.test.ts

@@ -66,6 +66,7 @@ describe("logging", () => {
         api_key: "plain-api-key-canary",
         authorization: "plain-authorization-canary",
         nested: { cookie: "plain-cookie-canary" },
+        tokenUsage: { totalTokens: 15 },
       }),
     });
 
@@ -76,6 +77,7 @@ describe("logging", () => {
     expect(lines[0]).not.toContain("plain-api-key-canary");
     expect(lines[0]).not.toContain("plain-authorization-canary");
     expect(lines[0]).not.toContain("plain-cookie-canary");
+    expect(lines[0]).toContain("totalTokens");
     expect(JSON.parse(lines[0]!).event).toBe("mcp.tool.call");
   });