orchestrate: redact quoted JSON keys and whole values in redactBody

[h-kod]

What

redactBody's SENSITIVE_ASSIGNMENT_RE wraps the key alternatives in \b. A key that sits next to a quote character - exactly how it appears in a pasted JSON body - never matches, because " is a non-word character and the boundary logic inverts at it:

{"Authorization": "Bearer eyJhbG.sig"}   -> no redaction, reasons: []
{"api_key": "sk-123", "name": "x"}       -> no redaction, reasons: []

The same pattern also stops the value at the first space (\S+), which is #242's point: api_key = super secret value here kept the tail (secret value here") in the returned body.

The fix

Two changes to the one pattern:

1. Optional surrounding quotes on the key - "?"key"?", so quoted JSON keys match while bare keys keep matching as before.
2. Lazy whole-value capture instead of \S+ - the value runs to a real assignment boundary: end of line, an unquoted , / ; / } (JSON-ish contexts), or the closing quote. Values containing spaces (Bearer <jwt>) are redacted whole.

Behaviour preserved:

password: hunter2                        -> password=[redacted]
blocked: docker rate-limit on redis:7    -> unchanged (no sensitive key)
the authorization header was missing     -> unchanged (no assignment)

Relation to #242

#242 (open PR) fixes the value-side truncation. This PR fixes the key side - the \b-vs-quote interaction that lets pasted JSON bodies through with zero redaction - which that PR does not touch; its own before/after examples still leak when the body is JSON-shaped. Both changes compose cleanly; happy to rebase on whichever lands first.

Tests

Extended redact-body.test.ts with the quoted-JSON case, values containing spaces, and non-redaction of ordinary prose. 6/6 passing locally (repo tests run under bun:test; verified with a local vitest shim since bun is not installed on this machine).

Note for reviewers: the value-boundary regex treats ' and " inside unquoted values as terminators, so a secret containing a literal quote character would be truncated there. That is strictly better than the current behaviour (which truncated at the first space) and keeps the pattern a single pass; flagging it deliberately rather than over-fitting the regex.

---

Note

Medium Risk
Touches secret-redaction regex used before posting comment bodies. The change is defensive, but incomplete matching can still leak credentials, so the new patterns need careful review.

Overview
Fixes redactBody leaking secrets in pasted JSON and space-containing values. Quoted keys like "api_key" now match, and values are redacted as a whole instead of stopping at the first space (Bearer <jwt> tails no longer leak).

Quoted values now close with the same quote that opened them (so apostrophes inside "it's a secret" are not treated as terminators). Unquoted values run to , / ; / } and consume that separator so the assignment actually matches.

Tests cover JSON bodies, spaced quoted values, unquoted separator cases, and inner apostrophes.

^{Reviewed by Cursor Bugbot for commit f1be9ac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 2bfdfc9. Configure here.}