/**
 * Scrub likely secrets out of captured session text before it leaves the machine.
 *
 * Session transcripts now carry tool inputs (file contents from Edit/Write) and tool outputs
 * (command output, `cat .env`, printed environment), so the upload body can contain credentials.
 * `logger.redact` only covers stderr and only Coolhand's own token shape, so this is a separate,
 * broader scrubber applied to every message's content string in `parseTranscript`.
 *
 * This is best-effort defence in depth, not a guarantee: it targets common, well-shaped secret
 * formats. It deliberately errs toward over-redaction (e.g. long hex strings) rather than leaking.
 */
/** Return `text` with recognised secrets replaced by `[REDACTED]`. Safe on empty input. */
export declare function redactSecrets(text: string): string;
//# sourceMappingURL=redact-secrets.d.ts.map