fix(core): redact simple structured logger output

Author: carderne

packages/core/src/v3/utils/structuredLogger.ts

@@ -1,3 +1,5 @@
+import { redact } from "../../logger.js";
+
 type StructuredArgs = (Record<string, unknown> | undefined)[];
 
 export interface StructuredLogger {
@@ -88,14 +90,14 @@ export class SimpleStructuredLogger implements StructuredLogger {
     level: string,
     ...args: StructuredArgs
   ) {
-    const structuredLog = {
+    const structuredLog = redact({
       timestamp: new Date(),
       message,
       $name: this.name,
       $level: level,
       ...this.fields,
       ...(args.length === 1 ? args[0] : args),
-    };
+    }) as Record<string, unknown>;
 
     if (SimpleStructuredLogger.onLog) {
       try {

packages/core/test/logger.test.ts

@@ -1,4 +1,5 @@
 import { Logger, redact } from "../src/logger.js";
+import { SimpleStructuredLogger } from "../src/v3/utils/structuredLogger.js";
 
 function captureLogLine(fn: () => void): Record<string, any> {
   const spy = vi.spyOn(console, "info").mockImplementation(() => {});
@@ -167,6 +168,26 @@ describe("Logger redaction", () => {
   });
 });
 
+describe("SimpleStructuredLogger redaction", () => {
+  it("redacts fields and arguments with the default deny-list", () => {
+    const logger = new SimpleStructuredLogger("test");
+
+    const line = captureLogLine(() =>
+      logger.child({ headers: { authorization: "Bearer should-not-appear" } }).info("run started", {
+        payload: { secret: "value" },
+        apiKey: "tr_prod_should_not_appear",
+        harmless: "keep me",
+      })
+    );
+
+    expect(line.headers).toMatch(/^\[filtered/);
+    expect(line.payload).toMatch(/^\[filtered/);
+    expect(line.apiKey).toMatch(/^\[filtered/);
+    expect(line.harmless).toBe("keep me");
+    expect(JSON.stringify(line)).not.toContain("should-not-appear");
+  });
+});
+
 describe("redact()", () => {
   it("applies the same default deny-list and truncation as the Logger", () => {
     const result = redact({