fix(security): sanitize credentials at every output boundary (#2111)

[konard]

Fixes #2111.

Problem

Generated output could expose credentials through terminal streams, local and development logs, uploads, GitHub comments, telemetry, or repository artifacts. Sanitizing only individual call sites also missed secrets split across stream chunks and made future publication paths easy to add unsafely.

Solution

• Add a dependency-free synchronous credential sanitizer with the required exact masking contract, broad vendor and structured-secret coverage, idempotence, residual detection, and record-aware stream handling.
• Intercept stdout and stderr for every package entry point, including split UTF-8, split-token, final-tail, and multiline private-key cases.
• Enforce strict fail-closed sanitization at GitHub, upload, telemetry, Telegram, result, report, and repository-write boundaries.
• Preserve raw development audit sources locally with owner-only permissions while staging only sanitized copies, and reject residual or unexpected files.
• Add static enforcement for publication payloads, synchronized user documentation, and release metadata.

Reproduction and regression coverage

Before this change, a credential written in pieces or passed through an unguarded publication path could reach generated output unchanged. tests/test-credential-sanitization-2111.mjs now exercises the masking contract, all-match replacement, vendor and generic formats, split chunks, private keys, terminal interception, temporary-file permissions and cleanup, upload bytes, development-log staging, fail-closed behavior, and a 1 MiB performance case.

Verification

• npx --yes node@24 scripts/run-tests.mjs --suite default — 354 test files passed
• npm run lint
• npx prettier --check <all changed JavaScript, JSON, and Markdown files>
• npm run check:duplication
• git diff --check

This is a non-visual security change; screenshots are not applicable.

[konard]

Working session summary

Implemented and finalized PR #2112, now ready for review.

Key results:

• Central credential sanitizer with exact masking contract.
• Stream-safe stdout/stderr handling, including split tokens, UTF-8, PEM keys, and final tails.
• Fail-closed GitHub, upload, telemetry, Telegram, and repository publication boundaries.
• Private sanitized intermediates while preserving raw local audit logs.
• Static enforcement, regression tests, documentation, and patch changeset.
• All 354 local test files passed; lint, Prettier, duplication, and diff checks passed.
• Fresh CI passed for exact SHA 7cc8dc74.
• Branch is clean, synchronized with main, and PR merge state is clean.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $97.615721

📊 Context and tokens usage:

• 1.5M / 200K (774%) input tokens, 180.2K / 128K (141%) output tokens

Total: (1.5M + 74.0M cached) input tokens, 180.2K output tokens, $97.615721 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: xhigh (~31999 tokens)
• Model: GPT 5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (20160KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag