fix(desktop): route Rive diagnostics through core redaction

[seekskyworld]

Fixes #4925

Summary

• route Rive diagnostic text through the shared core secret redactor
• apply the shared sensitive-key heuristic to structured Rive values
• cover GitHub, Google, Slack token forms and nested credential keys

Motivation

Rive diagnostics used a narrower private redaction implementation, so newly supported credential forms could remain in error envelopes or output tails. Sharing the core implementation keeps diagnostic boundaries aligned as coverage evolves.

Validation

• npm --workspace @maka/core run build
• npm --workspace @maka/desktop run build:main
• node --test apps/desktop/dist/main/tests/rive-workflow-tool.test.js (9/9)
• npx biome check apps/desktop/src/main/rive-cli.ts apps/desktop/src/main/tests/rive-workflow-tool.test.ts

[Astro-Han]

Reviewed exact head 329cde2307bd02f066e357891007374609ec3197.

I found one blocking security regression. apps/desktop/src/main/rive-cli.ts:180-182 now delegates all text redaction to @maka/core/redaction, but the previous Rive boundary explicitly masked standalone Bearer <token> values. The core pattern at packages/core/src/redaction.ts:47-48 only masks bearer values when preceded by an authorization or proxy-authorization header key, and the provider-token patterns at :58-64 do not match an arbitrary bearer value. Consequently a reachable Rive diagnostic such as Bearer opaque-session-token can remain in the emitted output/tails handled at rive-cli.ts:264-302 and in the error projection.

The new regression test at apps/desktop/src/main/__tests__/rive-workflow-tool.test.ts:249-261 covers GitHub, Google, Slack, and sensitive-key forms but does not preserve the former standalone Bearer case. Please add that coverage to the shared core redactor and a Rive regression test before considering this change complete.

The exact-head hosted label and test checks passed. I could not run the local desktop typecheck because this checkout has no usable tsc, and I did not run a separate Electron smoke test.

Automated review notice: This is an AI-assisted review and does not replace independent human review.

[seekskyworld]

Addressed the review finding in 007581eed.

• Restored standalone Bearer <token> masking in the shared core redactor.
• Added core coverage for an unkeyed bearer value.
• Extended the Rive redaction regression to cover bearer output.

Validation: core build, core redaction tests (27/27), Desktop main build, Rive tests (9/9), Biome, ASF headers, and git diff --check pass.

[Astro-Han]

Reviewed exact head 007581eed6c9d214f50b09ff96e2c0e2bbe2c64f.

The previous standalone Bearer redaction regression is fixed. packages/core/src/redaction.ts:49,82 now restores the standalone Bearer <token> pattern, and packages/core/src/__tests__/redaction.test.ts:58-63 asserts both the exact replacement and absence of the token. The Rive boundary test at apps/desktop/src/main/__tests__/rive-workflow-tool.test.ts:248-256 exercises redactRiveText() with the same form. Rive stdout/stderr chunks and tails use this path at apps/desktop/src/main/rive-cli.ts:270-297, while structured error envelopes use redactRiveValue() at :323,332.

I found no new P0-P3 correctness or security issue in the four-file increment. The exact-head hosted test check passed, and the merge-tree and diff check are clean. The local core typecheck could not start because this checkout has no usable tsc; no provider-native Rive or Electron smoke was run.

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[me2seeks]

Automated review by OpenAI Codex, operated by me2seeks, at 007581eed6c9d214f50b09ff96e2c0e2bbe2c64f. This is not an independent human review.

One P1 redaction regression remains after the earlier Bearer fix: quoted multiword assignment values are only partially masked by the shared implementation.

1. Optimal for the actual problem: centralizing redaction is correct, but current behavior drops existing protection for quoted secrets with spaces.
2. Production code that can be deleted: the private Rive regex chain can disappear once its existing input coverage is preserved by the shared authority; that deletion proof is not yet closed.
3. Low-quality tests that can be deleted or replaced: none identified. New token-form tests miss this removed quoted-value behavior.
4. Deeper refactor: no; fix quoted assignment parsing in the shared authority and verify the real Rive boundary.
5. Ready to merge: no, diagnostic output and error tails can expose part of a previously masked credential.
6. Residual risks / verification: compared exact old Rive and current shared functions on quoted password and client_secret examples, and traced stdout/stderr emission and error-tail callers. No real Rive binary or Electron smoke was run. This affects credential confidentiality; material security changes require independent human review under CONTRIBUTING.md.

[me2seeks]

[P1] Preserve masking of quoted secrets containing spaces

Delegating to the shared redactor loses a form covered by the removed Rive regex. Exact before/after execution for password="correct horse battery staple" gives password=[REDACTED] before, but password="[redacted] horse battery staple" now. Likewise client_secret: 'two secret words' now leaves secret words visible. The core assignment regex stops at whitespace even inside quotes; these inputs are ordinary CLI diagnostic text, not JSON, so the structured-JSON path does not help. Rive forwards this result through emitOutput for stdout/stderr and stores it in error tails (rive-cli.ts:270-297). Extend the shared authority to consume the whole quoted value and keep a regression at the Rive boundary before removing the old coverage.