fix(desktop): redact the bearer token from readiness parse errors

The parser echoes the offending line or URL in its error message, and that
message goes straight into the startup rejection, so a malformed readiness URL
still leaked the token the earlier redaction covered on the output path.

Author: elkaix

apps/desktop/src/host-supervisor.ts

@@ -244,7 +244,8 @@ export function createHostSupervisor(options: HostSupervisorOptions): HostSuperv
         settled = true
         cleanupStartup()
         const diagnostic = output === '' ? '' : `\nHost output:\n${output}`
-        reject(new Error(`${error instanceof Error ? error.message : String(error)}${diagnostic}`))
+        const message = redactHostToken(error instanceof Error ? error.message : String(error))
+        reject(new Error(`${message}${diagnostic}`))
       }
       const acceptChunk = (chunk: string): void => {
         appendOutput(chunk)

apps/desktop/tests/host-supervisor.spec.ts

@@ -226,6 +226,17 @@ describe('desktop Host supervisor', () => {
     expect(logged.join('')).toContain('#token=[redacted]')
   })
 
+  it('keeps the bearer token out of a rejected malformed readiness URL', async () => {
+    const child = new FakeHostChild()
+    const supervisor = createHostSupervisor({ spawnHost: () => child })
+    const starting = supervisor.start()
+
+    child.stdout.emit('Pythinker server: https://127.0.0.1:4567/#token=s3cret\n')
+
+    await expect(starting).rejects.toThrow(/must be loopback HTTP/su)
+    await expect(starting).rejects.not.toThrow(/s3cret/su)
+  })
+
   it('keeps the bearer token out of the pre-readiness exit diagnostic', async () => {
     const child = new FakeHostChild()
     const supervisor = createHostSupervisor({ spawnHost: () => child })