Strip credentials from every emitted log line

[superuser404notfound]

EngineLog logs whole URLs on purpose: host, path and query are what a playback report is diagnosed from. Media servers routinely put the access token in that same query (Jellyfin's api_key= is the case at hand), so [AetherEngine] load url=, [NativeAVPlayerHost] load url= and asset.url= carried a live credential into every sink at once. Emission uses .public privacy, so a Console.app capture or a sysdiagnose held it in clear text, and the host handler passed it to whatever in-app log a consumer built on it.

This belongs in the engine rather than in each consumer: the engine composes the line, it reaches three sinks a consumer does not control, and a host-side scrub only ever covers the one sink that host owns. Sodalite had just enabled its diagnostic log for App Store users so reporters can hand logs over, which is precisely the situation where an unredacted line ships a token.

What changed

• Both public emit overloads funnel through one private deliver(), which runs the line through LogRedaction before OSLog and before the handler. Public API is unchanged; the redactor is internal, so docs/api.md needs no entry.
• Redaction happens at the funnel, never at the call sites, so a URL logged by code added later is covered without its author knowing the redactor exists.
• Covered names are generic rather than Jellyfin-specific: api_key, apikey, access_token, token, secret, password, signature, x-emby-token, x-mediabrowser-token, connect.sid, in the query form, both header forms (Token="…", X-Emby-Token: …) and the cookie form. Values are replaced whole, never truncated to a prefix.
• Everything else about a URL survives, which is the part a playback bug is diagnosed from.

Performance

The redactor works on UTF-8 bytes and allocates its output only once something matches. That is not premature. The first version compared Characters and built a lowercased String per position, which cost enough on this path to shift request timing in ServedFromMemoryProgressTests: emit is called from the demuxer and the segment producer, so anything per-line here is per-line everywhere. That test caught it and passes again.

Verification

11 new tests cover the forms, the boundary rule that keeps hasToken=true and [SWDiag] enq=… intact, and that the host handler never receives the raw token. Full suite: 2125 tests in 299 suites pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RbWZLwBVLGM1xUVXa9NeJ1