[Security] Mask connector values by explicit secret semantics

[fettpl]

Summary

• Treat every connector environment and header value as secret, including empty values and arbitrary key names.
• Return only a centralized mask token with sorted, location-aware env and headers metadata from HTTP and private desktop IPC.
• Preserve masked values only through decoded settings input at the exact existing location and key; omission deletes the value, while raw connector APIs reject mask placeholders.
• Validate connector endpoints as absolute HTTP(S) URLs without userinfo at API, persisted-file, and programmatic write boundaries.

Root cause

Connector responses inferred secrecy from key names. Non-obvious credentials such as Cookie, SESSION, and vendor-specific keys could therefore be serialized in plaintext. The contract also used one flat secret-key list, accepted unrestricted connector URLs, and did not distinguish masked settings payloads from raw runtime configuration.

Solution design

• Replace name-based classification with default-secret masking for all environment and header records.
• Expose deterministic secret metadata split by storage location.
• Keep raw values inside persisted/runtime configuration so connector execution and approval fingerprints retain their true identity.
• Restrict placeholder merging to decoded settings upserts. A mask requires an own-property match at the same location and key, including stored empty strings; unknown and cross-location placeholders fail atomically.
• Reject the reserved mask token from persisted and raw programmatic connector schemas so it cannot be stored or executed.
• Reject every syntactic URL userinfo form, including empty username/password delimiters, without reflecting the submitted or persisted URL in failures.
• Map invalid connector configuration to the same generic conflict response in HTTP and private IPC flows.

User and developer impact

Connector management no longer discloses raw environment or header values to renderer/API consumers. Existing masked edits and enable/disable operations preserve intended stored credentials, while malformed placeholders, credential-bearing URLs, and invalid persisted configuration fail closed with a generic response. Approval and execution fingerprints continue to use raw configuration values.

Dependency

Depends on #257, which provides the pinned GitHub MCP artifact/catalog path exercised by the personal-access-token preservation regression.

Exact review state

• Head: 7927f91ca7637d3d0af012abf4c450da107bf0dc
• Prerequisite: 01ac7ff18f1097da281f4603e77d751568e130be
• CI run 29734207194 — awaiting maintainer approval for fork workflows; zero jobs created.
• Security run 29734206912 — awaiting maintainer approval for fork workflows; zero jobs created.

Validation

• Focused secret/service/route/private-IPC suite — 43 passed, 0 failed, 346 assertions.
• Independent P0/P1 review — approved; the same focused suite passed independently, plus 10/10 invalid URL variants rejected and 4/4 valid URL variants accepted.
• npm --prefix frontend run check:quality — passed on the exact head.
• npm run check — passed on the exact head.
• Normal pre-push conventional-commit and frontend-quality hooks — passed.
• npm --prefix frontend run desktop:dist — passed; embedded runtime, post-pack, signature, DMG, and ZIP checks completed.
• Canonical /Applications/Local Studio.app reinstall — deep strict signature and org.local.studio.desktop bundle identity passed; /api/desktop-health returned HTTP 200 with {"ok":true}.

Acceptance coverage

• Every environment/header value is masked in list, save, and delete responses.
• Secret metadata is explicit, sorted, and location-aware.
• Placeholder preservation is limited to the same stored location/key; omissions delete.
• Mask placeholders cannot persist or reach connector execution.
• Invalid updates are atomic and return a generic conflict.
• URL userinfo is rejected at persisted, API, and programmatic boundaries without reflection.
• HTTP and private IPC use the shared connector-view mapper.
• Raw connector identity remains bound into approval and execution fingerprints.
• The Streamable HTTP regression fixture follows SDK protocol semantics for requests, notifications, and optional GET streams.

Rollout notes

Persisted connectors containing URL userinfo or the reserved mask literal now fail closed and require an explicit operator edit. No credential migration, vaulting, or automatic rewriting is performed.

Closes #239

[fettpl]

@0xSero This is ready for maintainer review at exact head 7927f91ca7637d3d0af012abf4c450da107bf0dc. The focused suite passed 43/43 with 346 assertions, full frontend and repository gates passed, independent P0/P1 review approved it, and the packaged canonical desktop app passed deep signature, launch, and HTTP 200 health checks. GitHub created the exact-head CI run and Security run, but both currently show action_required with zero jobs because fork workflows await maintainer approval.