[Security] Redact persisted secrets and harden controller file permissions

[fettpl]

Summary

Redact controller and engine output before it reaches persistent logs, console streams, event streams, API tails, or failure diagnostics, and enforce owner-only handling for sensitive controller files. The implementation uses one bounded, stateful credential-redaction model across scalar, structured, query-string, environment, CLI, fragmented, multiline, and cross-stream forms.

The change also makes controller startup and restart paths fail closed when runtime paths, process identity, systemd or launchd ownership, or listener ownership cannot be verified.

Closes #229

Root cause

Controller output previously reached several sinks through independent paths. That allowed credentials split across writes, streams, records, structured values, or query continuations to escape scalar-only sanitization. Sensitive files also depended on ambient creation modes and pathname checks that did not consistently protect reopen, migration, replacement, and service-management boundaries.

Solution design

• Use a bounded stateful redactor with normalized secret-key semantics and fail-closed handling for malformed or incomplete credential-like records.
• Route stdout, stderr, explicit errors, engine output, Docker replay/follow output, console methods, warnings, and fatal diagnostics through ordered redaction state before protected sinks receive data.
• Redact before controller log files, event callbacks, recent failure tails, API responses, and SSE events, while retaining defensive redaction at read boundaries.
• Create, reopen, migrate, and atomically replace sensitive files through owner/mode, symlink, inode, descriptor, and ancestor-identity checks. Controller data directories use 0700; sensitive files use 0600.
• Apply umask 077 before controller imports and service/process startup, and buffer startup warnings until the redacting console is installed.
• Migrate historical raw logs through the same bounded redactor before serving them, including interrupted and oversized migrations.
• Replace pattern-wide process signaling with exact UID, executable, cwd, argv, start-identity, service-unit, and listener verification in installer, daemon, and remote-deploy paths.
• Integrate the reviewed implementation on exact dependency [CI/CD] Gate every release on the exact commit that passed CI #244 commit 3cdd3a6402308c1d7a25816205cdedd7e73688f6 and current main 08bcba27f137f9c3d0206ea811d0aa7548a2dfa6.

Acceptance criteria

• Recognized credentials are absent from newly persisted controller and engine logs.
• Console output, file logs, Docker/API tails, SSE log events, engine events, and failure tails receive redacted output.
• Fragmented, multiline, cross-stream, structured, CLI, environment, and query-string credentials retain redaction state until a safe boundary.
• Sensitive files use owner-only modes and existing permissive modes are repaired safely.
• Symlink, replacement, identity-drift, foreign-process, foreign-unit, and bind-race cases fail closed.
• Installer and service launch paths enforce a private umask and suppress unredacted supervisor stdout/stderr persistence.
• Security tests use synthetic credential values only.

Validation

• Final independently reviewed commit: 2c38b8924d2a099c41efb83f81c90176c4b3786b; no P0/P1 blockers found.
• npm run check: passed in full, including contracts, repository structure, frontend quality/build, controller typechecks, lint, standards, dependency/duplication/dead-code audits, and the controller test suite.
• Exact-head security suite: 112 tests, 1,071 assertions, 0 failures.
• Launchd success and foreign-loaded-service regression cases passed.
• Shell syntax checks and git diff --check passed; the tracked worktree was clean before publication.
• Normal pre-push hooks passed on the published exact head, including the complete frontend quality/build gate; no hook was bypassed.
• npm run desktop:dist passed and produced the macOS distribution artifacts.
• The generated app was ad-hoc signed for local acceptance; strict deep signature verification passed before and after canonical installation.
• /Applications/Local Studio.app reported bundle ID org.local.studio.desktop, version 2.1.0, launched successfully, and returned HTTP 200 with {"ok":true} from /api/desktop-health.

The repository does not define npm --prefix frontend run test or root npm run test:integration; those unavailable commands are not represented as passing.

UI changes

No intentional UI change. Frontend files are present only through the exact #244 dependency included in this branch.

Risks and rollout notes

• Malformed credential-like query keys intentionally fail closed and may conservatively over-redact the associated value; ordinary and explicitly non-secret query data remains intact.
• Controller restart operations now refuse to proceed when process, unit, path, or listener ownership cannot be established. Operators may need to resolve foreign or ambiguous processes explicitly.
• Historical logs are migrated in place, but credentials that may already have been copied outside the managed log directory should still be rotated.
• Local desktop verification used an ad-hoc signature because no valid Developer ID identity was available; release signing and notarization remain handled by the release workflow.

[fettpl]

@0xSero PR #253 is now mergeable at independently approved exact head 2c38b8924d2a099c41efb83f81c90176c4b3786b. The full repository gate, 112-test security suite, shell checks, normal pre-push hook, and canonical desktop distribution/reinstall/signature/health acceptance all passed. Current-head CI and Security runs are action_required with no executable jobs, pending upstream workflow approval; no genuine CI failure is present. Please approve the runs and review when convenient.