Bind credentials to their endpoints and strike echoed tokens

[ppXD]

Bind credentials to their endpoints and strike echoed tokens

Summary

• Mask credentials embedded in URLs on every list. This covers userinfo and secret-named query values in model-credential BaseUrl and git-provider BaseUrl/ApiUrl/WebUrl.
  • CredentialUrl.KeepStoredIfMasked reads a masked value sent back as "unchanged", so edit forms and API clients that PUT or PATCH back what they GET keep the stored URL.
  • A *** left in an otherwise edited URL is refused instead of being stored as the credential (ModelCredentialService, ProviderInstanceService).
• Bind stored secrets to their endpoint. Moving a URL's scheme, host or port (CredentialUrl.SameEndpoint) now has these effects:
  • Model credential: the key must be sent again in the same update (400 model_endpoint_key_required).
  • Git provider, tokens connected: moving the base or API host is refused while non-revoked tokens are connected through it (428 provider_endpoint_credentials_bound). Those tokens are not the editor's to re-enter, so the remedy is to disconnect them first or add the new host as its own provider.
  • Git provider, OAuth client secret stored: the secret must be sent again, because the OAuth token and revoke URLs are derived from the base URL (400 provider_endpoint_secret_required).
  • Audit log: every move is logged with scheme://host:port only.
• Strike echoed credentials before anything stores or shows them.
  • LlmHttpTransport error bodies, plus an interaction.failed backstop.
  • The ExternalCallResilience SDK translation, which also drops the Original call: <url> suffix.
  • The provider calls that read refusal bodies themselves: GitLab raw /unapprove, GitLab project and group hook create/list, and GitHub repo and org hook create. Their output feeds external_call.failed, repository_webhook.last_error and *_webhook_attempt.error/response_body, all of which any team member can read.
• One shared rule for spotting credentials in text and URLs. It lives in Services/Redaction (CredentialNeedles, CredentialUrl); the agent-run redactor's behaviour is unchanged.
• Frontend:
  • The model and provider edit forms ask for the key or OAuth secret again on an endpoint move.
  • They explain masked URLs.
  • They say why a provider host move is refused while tokens are connected.

Test plan

• Unit:
  • Full suite: 13554 passed, 1 skipped.
  • ProviderRefusalEchoTests (GitLab /unapprove 401/403/500 and the scope hint; GitLab project and group hook create/list; GitHub repo and org hook create).
  • ProviderInstanceEndpointBindingTests.
  • The node-level external_call.failed test in NodeObservabilityTests.
  • CredentialNeedles.Strike, CredentialUrl.KeepStoredIfMasked, and the failure-code pins.
• Integration:
  • WebhookRegistrationCredentialEchoTests: the real registrars and providers against an echoing stub; no token in last_error, attempt.error or attempt.response_body.
  • ProviderInstanceEndpointBindingFlowTests: a refused repoint changes nothing; revoked tokens and path-only edits are allowed; the OAuth secret is required on a host move; masked values round-trip.
  • The provider, webhook, credential, OAuth, model-credential and authorization namespaces all pass.
• E2E:
  • ProviderInstanceRepointE2ETests: an Admin PATCH of baseUrl or apiUrl gets 428, the attacker stub accepts 0 connections, and a Viewer's branch read still reaches the real host. A Viewer's provider list contains no canary, and a masked PATCH keeps the stored URLs.
  • Existing ModelKeyExposureE2ETests and GitProviderErrorEchoE2ETests still pass.
• Mutation: reverting each fix turns its tests red.
• Frontend (Node 22): vitest on the edit forms and the credentialEndpoint helpers, pnpm lint (0 errors), tsc -b, pnpm build.