const sensitiveAssignments = /\b(api[_-]?key|token|secret|password|passwd|credential|dsn|rcon(?:[_-]?(?:password|token))?)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi;
const privateEndpoint = /\b(?:https?|wss?):\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|10(?:\.\d{1,3}){3}|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2})(?::\d+)?[^\s"'<>]*/gi;
const hostPath = /(?:[A-Za-z]:\\|\/(?:Users|home|private|var|etc|opt|root|tmp)\/)[^\s"'<>]*/g;

export function safeDiagnosticText(value: string | undefined, fallback = "诊断信息已隐藏"): string | undefined {
  if (!value) {
    return value;
  }
  const sanitized = value
    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
    .replace(/\b(?:sk|rk)-[A-Za-z0-9_-]{8,}\b/g, "[secret]")
    .replace(/\bsecret:\/\/[^\s"'<>]+/gi, "secret://[redacted]")
    .replace(/\b(?:postgres(?:ql)?|mysql|redis|mongodb(?:\+srv)?):\/\/[^\s"'<>]+/gi, "[dsn]")
    .replace(/\b(?:unix|tcp):\/\/[^\s"'<>]+/gi, "[socket]")
    .replace(privateEndpoint, "[private-endpoint]")
    .replace(hostPath, "[host-path]")
    .replace(/\bpid\s*[:=#]?\s*\d+\b/gi, "PID [redacted]")
    .replace(sensitiveAssignments, (_match, label: string) => `${label}=[redacted]`)
    .slice(0, 480)
    .trim();
  return sanitized || fallback;
}