feat(cli): redact access_token in config output

src/cli/shared.test.ts

@@ -131,6 +131,16 @@ models:
       const models = redacted.models as Record<string, Record<string, unknown>>;
       expect(models.default.api_key).toBe('***');
     });
+
+    it('redacts access_token (matrix)', () => {
+      const config = {
+        matrix: { homeserver_url: 'https://matrix.example.org', access_token: 'mx-secret' },
+        models: { default: { provider: 'anthropic', model: 'claude' } },
+      };
+      const redacted = redactSecrets(config);
+      const matrix = redacted.matrix as Record<string, unknown>;
+      expect(matrix.access_token).toBe('***');
+    });
   });
 
   describe('getDataDir', () => {