fix: redact sensitive data from diagnostics files before sharing

[roomote-v0]

Related GitHub Issue

Closes: #12284

Description

This PR attempts to address the security concern raised in Issue #12284, where diagnostic files generated for support contain sensitive information (API keys, tokens, secrets) that users might accidentally share.

Key changes:

• New redaction utility (src/utils/redact.ts): Pattern-based redaction for common API key formats (Anthropic, OpenAI, OpenRouter, Google, AWS, GitHub), Bearer tokens, environment variable secrets, and JSON key-value secrets. Includes both string-level (redactSensitiveInfo) and recursive object-level (redactDiagnosticsData) redaction.
• Applied in diagnostics handler (src/core/webview/diagnosticsHandler.ts): redactDiagnosticsData() is called on the full diagnostics payload (including conversation history) before writing to the temp file.
• Updated header comment: The diagnostics file now informs users that sensitive data has been automatically redacted, while still advising manual review before sharing.

Design choices:

• Pattern-based approach catches known API key formats without being overly aggressive on normal text
• Object keys known to hold secrets (e.g., apiKey, password, token) are fully redacted regardless of value pattern
• Redaction is applied recursively to handle nested conversation history structures

Feedback and guidance are welcome.

Test Procedure

• 22 unit tests for the redaction utility covering all key/token patterns, edge cases, nested objects, and realistic payloads
• 6 updated diagnostics handler tests verifying redaction is invoked and header comment is updated
• All tests pass: cd src && npx vitest run utils/__tests__/redact.spec.ts and cd src && npx vitest run core/webview/__tests__/diagnosticsHandler.spec.ts
• Lint and type checks pass

Pre-Submission Checklist

• Issue Linked: This PR is linked to an approved GitHub Issue (see "Related GitHub Issue" above).
• Scope: My changes are focused on the linked issue (one major feature/fix per PR).
• Self-Review: I have performed a thorough self-review of my code.
• Testing: New and/or updated tests have been added to cover my changes.
• Documentation Impact: No documentation updates are required.
• Contribution Guidelines: I have read and agree to the Contributor Guidelines.

Documentation Updates

• No documentation updates are required.

Additional Notes

The redaction patterns cover the most common API key formats. Additional patterns can be added as needed for other providers or secret formats.

Interactively review PR in Roo Code Cloud