The browser broker redacted log lines (password=/token=/macaroon key=value, 64+ hex, 64+ base64) while the node-side tool only untrusted-wrapped — so a log line carrying rpcpassword=<32-hex> crossed to cloud backends below the egress screen's threshold. Port the broker's three patterns to the tool boundary as a pure line redactor + JSON walker; unit-tested (124 assistant tests green). Co-Authored-By: Claude <noreply@anthropic.com>