fix: redact --svc-param values in config show

internal/cli/cli_test.go

@@ -1344,6 +1344,14 @@ another_flag: 123
 				"agent-card": "https://yaml-extra-agent.example.com",
 			},
 		},
+		{
+			name:     "svc-param Authorization values are redacted",
+			filename: "creds.yaml",
+			content:  "svc-param:\n  - \"Authorization=Bearer SECRET123\"\n  - \"X-Trace=abc\"\n",
+			wantVals: map[string]string{
+				"svc-param": "Authorization=<redacted>,X-Trace=abc",
+			},
+		},
 		{
 			name:     "json config with additional properties ignored",
 			filename: "extra.json",

internal/clicfg/binder.go

@@ -50,7 +50,7 @@ func Bind(flags *pflag.FlagSet, store *Store) ([]FlagBinding, error) {
 
 		sensitive := false
 		switch f.Name {
-		case "auth", "bearer", "api-key":
+		case "auth":
 			sensitive = true
 		}
 
@@ -92,6 +92,9 @@ func Bind(flags *pflag.FlagSet, store *Store) ([]FlagBinding, error) {
 		binding.Source = source.String()
 		binding.Path = source.Path
 		binding.Value = formatValue(value)
+		if f.Name == "svc-param" {
+			binding.Value = redactServiceParams(binding.Value)
+		}
 		bindings = append(bindings, binding)
 	})
 
@@ -104,6 +107,20 @@ func Bind(flags *pflag.FlagSet, store *Store) ([]FlagBinding, error) {
 	return bindings, nil
 }
 
+// redactServiceParams hides the value of each Authorization service parameter.
+func redactServiceParams(value string) string {
+	entries := strings.Split(value, ",")
+	for i, entry := range entries {
+		if !strings.HasPrefix(strings.ToLower(entry), "authorization") {
+			continue
+		}
+		if sep := strings.IndexAny(entry, ":="); sep >= 0 {
+			entries[i] = entry[:sep+1] + "<redacted>"
+		}
+	}
+	return strings.Join(entries, ",")
+}
+
 func flagValueString(f *pflag.Flag) string {
 	if sv, ok := f.Value.(pflag.SliceValue); ok {
 		return strings.Join(sv.GetSlice(), ",")