chore: remove dead routes/components + fix redact/env cleanup

apps/agent-worker/src/redact.ts

@@ -1,8 +1,11 @@
-const secretPatterns = [
-  /ghs_[A-Za-z0-9_]+/g,
-  /github_pat_[A-Za-z0-9_]+/g,
-  /sk-[A-Za-z0-9_-]+/g,
-  /(client_secret|auth_secret|api_key|token|password)=([^ \n\r]+)/gi,
+const secretPatterns: { pattern: RegExp; replacement: string }[] = [
+  { pattern: /ghs_[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+  { pattern: /github_pat_[A-Za-z0-9_]+/g, replacement: '[redacted]' },
+  { pattern: /sk-[A-Za-z0-9_-]+/g, replacement: '[redacted]' },
+  {
+    pattern: /(client_secret|auth_secret|api_key|token|password)=([^ \n\r]+)/gi,
+    replacement: '$1=[redacted]',
+  },
 ];
 
 export const createRedactor = (values: string[]) => {
@@ -12,8 +15,8 @@ export const createRedactor = (values: string[]) => {
     for (const secret of secrets) {
       output = output.split(secret).join('[redacted]');
     }
-    for (const pattern of secretPatterns) {
-      output = output.replace(pattern, '$1=[redacted]');
+    for (const { pattern, replacement } of secretPatterns) {
+      output = output.replace(pattern, replacement);
     }
     return output;
   };

apps/agent-worker/tests/unit/redact.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from 'vitest';
+
+import { createRedactor } from '../../src/redact';
+
+describe('createRedactor', () => {
+  test('redacts group-less token patterns without emitting a literal $1', () => {
+    const redact = createRedactor([]);
+    const output = redact('token ghs_ABC123 and sk-xyz789 here');
+
+    expect(output).toContain('[redacted]');
+    expect(output).not.toContain('$1');
+    expect(output).not.toContain('ghs_ABC123');
+    expect(output).not.toContain('sk-xyz789');
+  });
+
+  test('redacts github_pat_ tokens to [redacted]', () => {
+    const redact = createRedactor([]);
+    const output = redact('github_pat_ABCDEF123456');
+
+    expect(output).toBe('[redacted]');
+    expect(output).not.toContain('$1');
+  });
+
+  test('keeps the key= prefix for key=value secrets', () => {
+    const redact = createRedactor([]);
+
+    expect(redact('api_key=secret')).toBe('api_key=[redacted]');
+    expect(redact('password=hunter2')).toBe('password=[redacted]');
+  });
+
+  test('redacts caller-supplied secret values verbatim', () => {
+    const redact = createRedactor(['super-secret-value']);
+
+    expect(redact('the value is super-secret-value')).toBe(
+      'the value is [redacted]',
+    );
+  });
+});