Fix the five library adoption review findings

internal/framework/llm/diagnostics.go

@@ -1,15 +1,14 @@
 package llm
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
-)
 
-const redactedSecret = "[REDACTED]"
+	"gitea.maximumdirect.net/eric/audita/internal/core/redaction"
+)
 
 var stageSanitizer = regexp.MustCompile(`[^a-zA-Z0-9_.-]+`)
 
@@ -30,18 +29,7 @@ type DiagnosticsWriter struct {
 
 // NewDiagnosticsWriter creates a diagnostics writer rooted at dir.
 func NewDiagnosticsWriter(dir string, secrets []string) *DiagnosticsWriter {
-	filtered := make([]string, 0, len(secrets))
-	for _, secret := range secrets {
-		secret = strings.TrimSpace(secret)
-		if secret != "" {
-			filtered = append(filtered, secret)
-		}
-	}
-
-	return &DiagnosticsWriter{
-		dir:     dir,
-		secrets: filtered,
-	}
+	return &DiagnosticsWriter{dir: dir, secrets: append([]string(nil), secrets...)}
 }
 
 // WriteInteraction writes request/response/error artifacts for a generic LLM
@@ -94,33 +82,13 @@ func sanitizeStageName(stage string) string {
 }
 
 func (w *DiagnosticsWriter) writeJSON(path string, payload any) error {
-	raw, err := json.MarshalIndent(payload, "", "  ")
+	redacted, err := redaction.New(w.secrets).JSON(payload)
 	if err != nil {
 		return fmt.Errorf("marshal json artifact %q: %w", filepath.Base(path), err)
 	}
-	redacted := redactJSONSecrets(raw, w.secrets)
-	if !json.Valid(redacted) {
-		return fmt.Errorf("redacted json artifact %q is invalid", filepath.Base(path))
-	}
 	redacted = append(redacted, '\n')
 	if err := os.WriteFile(path, redacted, 0o644); err != nil {
 		return fmt.Errorf("write json artifact %q: %w", filepath.Base(path), err)
 	}
 	return nil
 }
-
-func redactJSONSecrets(raw []byte, secrets []string) []byte {
-	if len(secrets) == 0 {
-		return raw
-	}
-
-	result := string(raw)
-	for _, secret := range secrets {
-		if secret == "" {
-			continue
-		}
-		result = strings.ReplaceAll(result, "Bearer "+secret, "Bearer "+redactedSecret)
-		result = strings.ReplaceAll(result, secret, redactedSecret)
-	}
-	return []byte(result)
-}

internal/framework/llm/diagnostics_test.go

@@ -61,7 +61,7 @@ func TestDiagnosticsWriterRedactsSecrets(t *testing.T) {
 		if strings.Contains(content, secret) {
 			t.Fatalf("secret leaked in %s: %s", filepath.Base(path), content)
 		}
-		if !strings.Contains(content, redactedSecret) {
+		if !strings.Contains(content, "[REDACTED]") {
 			t.Fatalf("redaction marker missing in %s: %s", filepath.Base(path), content)
 		}
 		if !json.Valid(raw) {

internal/framework/llm/runtime.go

@@ -12,6 +12,7 @@ import (
 	"sync/atomic"
 
 	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+	"gitea.maximumdirect.net/eric/audita/internal/core/redaction"
 	"gitea.maximumdirect.net/eric/audita/internal/framework/responseschema"
 	"gitea.maximumdirect.net/eric/audita/internal/prompts"
 	pk "gitea.maximumdirect.net/eric/promptkit"
@@ -95,16 +96,5 @@ func RedactError(err error, c config.Config) string {
 	if err == nil {
 		return ""
 	}
-	message := err.Error()
-	var secrets []string
-	for _, backend := range c.Backends {
-		if backend.Credential != nil && backend.Credential.Value() != "" {
-			secrets = append(secrets, backend.Credential.Value())
-		}
-	}
-	sort.Slice(secrets, func(i, j int) bool { return len(secrets[i]) > len(secrets[j]) })
-	for _, secret := range secrets {
-		message = strings.ReplaceAll(message, secret, "[REDACTED]")
-	}
-	return message
+	return redaction.New(ConfiguredSecrets(&c)).String(err.Error())
 }

internal/framework/llm/safe_view.go

@@ -6,6 +6,7 @@ import (
 
 	ck "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+	"gitea.maximumdirect.net/eric/audita/internal/core/redaction"
 	"gopkg.in/yaml.v3"
 )
 
@@ -45,10 +46,14 @@ func (r *Runtime) SelectedProfilesYAML() ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	return yaml.Marshal(struct {
+	raw, err := yaml.Marshal(struct {
 		Proposal   selectedProfileView `yaml:"proposal"`
 		Validation selectedProfileView `yaml:"validation"`
 	}{proposal, validation})
+	if err != nil {
+		return nil, err
+	}
+	return redaction.New(ConfiguredSecrets(&r.Config)).YAML(raw)
 }
 
 type derivationView struct {