fix(cliproxy): redact generic token query params in oauth trace (#1364)

src/cliproxy/auth/__tests__/oauth-trace-redactor.test.ts

@@ -85,6 +85,13 @@ describe('redactString', () => {
     expect(out).not.toContain('AT_SECRET');
     expect(out).toBe(`access_token=${REDACTED_PLACEHOLDER}&keep=1`);
   });
+
+  test('redacts ampersand-delimited generic token query params', () => {
+    const out = redactString('access_token=AT_SECRET&token=TOKEN_SECRET');
+    expect(out).not.toContain('AT_SECRET');
+    expect(out).not.toContain('TOKEN_SECRET');
+    expect(out).toBe(`access_token=${REDACTED_PLACEHOLDER}&token=${REDACTED_PLACEHOLDER}`);
+  });
 });
 
 describe('redactUrl', () => {

src/cliproxy/auth/oauth-trace/redactor.ts

@@ -10,6 +10,7 @@
 const SENSITIVE_QUERY_KEYS = [
   'code',
   'state',
+  'token',
   'access_token',
   'refresh_token',
   'id_token',