feat: Add --redact-body-fields option to prevent credentials in tapes

[NikoRoberts]

Summary

Add --redact-body-fields CLI option to redact sensitive JSON fields in request and response bodies during tape recording. This prevents credentials like passwords, tokens, and API keys from being written to disk.

What was done

Implemented body field redaction in Proxay core:

1. CLI Option

proxay --mode record --host https://api.example.com \
  --tapes-dir ./tapes \
  --redact-body-fields password,access_token,refresh_token,api_key

2. Implementation Details

• Location: src/persistence.ts (redaction before serialization)
• Parsing: UTF8-encoded JSON bodies only (binary/non-JSON unchanged)
• Matching: Case-insensitive field names
• Recursion: Handles nested objects and arrays
• Redaction value: XXXX (matches existing --redact-headers pattern)

3. Example

Before redaction:

{"email": "user@example.com", "password": "secret123"}

After redaction:

{"email": "user@example.com", "password": "XXXX"}

Changes

Core Files

• src/cli.ts - Added --redact-body-fields option
• src/server.ts - Wired option to Persistence layer
• src/persistence.ts - Implemented redaction logic
  • redactBodyFields() - Main entry point
  • redactBufferFields() - JSON parsing and Buffer conversion
  • redactObjectFields() - Recursive field redaction

Tests Added (9 comprehensive tests)

• ✅ Redacts simple JSON fields
• ✅ Case-insensitive matching
• ✅ Nested object redaction
• ✅ Array handling
• ✅ Response body redaction
• ✅ Non-JSON body handling (returns unchanged)
• ✅ Binary body handling (returns unchanged)
• ✅ Empty body handling
• ✅ No-op when no fields specified

[CLAassistant]

All committers have signed the CLA.

[timdawborn]

LGTM apart from the linting issues.

[Camcan]

Nicely done @NikoRoberts
I assume we've considered redacting fields by default and have arrived here through some deliberation? I'd have imagined there are very few instances where we'd not want to be redacting *_key & *_token values in logs.

[NikoRoberts]

@Camcan the main reasoning is that it isn't the default today and it would then mean that all tapes need re-recording. If we want to change that default I would suggest we do a major version change