Fix the five library adoption review findings

internal/framework/llm/diagnostics.go

@@ -1,15 +1,14 @@
 package llm
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
-)
 
-const redactedSecret = "[REDACTED]"
+	"gitea.maximumdirect.net/eric/audita/internal/core/redaction"
+)
 
 var stageSanitizer = regexp.MustCompile(`[^a-zA-Z0-9_.-]+`)
 
@@ -30,18 +29,7 @@ type DiagnosticsWriter struct {
 
 // NewDiagnosticsWriter creates a diagnostics writer rooted at dir.
 func NewDiagnosticsWriter(dir string, secrets []string) *DiagnosticsWriter {
-	filtered := make([]string, 0, len(secrets))
-	for _, secret := range secrets {
-		secret = strings.TrimSpace(secret)
-		if secret != "" {
-			filtered = append(filtered, secret)
-		}
-	}
-
-	return &DiagnosticsWriter{
-		dir:     dir,
-		secrets: filtered,
-	}
+	return &DiagnosticsWriter{dir: dir, secrets: append([]string(nil), secrets...)}
 }
 
 // WriteInteraction writes request/response/error artifacts for a generic LLM
@@ -94,33 +82,13 @@ func sanitizeStageName(stage string) string {
 }
 
 func (w *DiagnosticsWriter) writeJSON(path string, payload any) error {
-	raw, err := json.MarshalIndent(payload, "", "  ")
+	redacted, err := redaction.New(w.secrets).JSON(payload)
 	if err != nil {
 		return fmt.Errorf("marshal json artifact %q: %w", filepath.Base(path), err)
 	}
-	redacted := redactJSONSecrets(raw, w.secrets)
-	if !json.Valid(redacted) {
-		return fmt.Errorf("redacted json artifact %q is invalid", filepath.Base(path))
-	}
 	redacted = append(redacted, '\n')
 	if err := os.WriteFile(path, redacted, 0o644); err != nil {
 		return fmt.Errorf("write json artifact %q: %w", filepath.Base(path), err)
 	}
 	return nil
 }
-
-func redactJSONSecrets(raw []byte, secrets []string) []byte {
-	if len(secrets) == 0 {
-		return raw
-	}
-
-	result := string(raw)
-	for _, secret := range secrets {
-		if secret == "" {
-			continue
-		}
-		result = strings.ReplaceAll(result, "Bearer "+secret, "Bearer "+redactedSecret)
-		result = strings.ReplaceAll(result, secret, redactedSecret)
-	}
-	return []byte(result)
-}