fix(net): redact proxy credentials from the diagnostic bundle (#190)

## The defect

The SPEC s18 diagnostic bundle writes `settings_redacted.json` via
`redact_settings()`, which built its output with `global:
s.global.clone()` -
the whole `GlobalSettings` struct verbatim.

`GlobalSettings` carries the issue #34 `proxy_url`. In `manual` mode
that URL
may embed basic-auth userinfo:

```
http://corpuser:hunter2@proxy.corp.example:8080
```

So the proxy password shipped **in plaintext** inside a bundle whose
entire
purpose is to be handed to support. Every other secret-bearing surface
in the
bundle is scrubbed (logs, crashes, and the activity CSV all go through
`Redactor`; the telemetry `install_id` is hashed) -
`settings_redacted.json`
was the hole, and its own doc comment claimed "the only redaction here
is the
install id".

Found while verifying the already-shipped #145 proxy work (issue #34).

## The fix

Strip the userinfo before serializing, keeping scheme + `host:port`
because
that is the diagnostically useful part of a proxy setting:

```
http://<redacted>@proxy.corp.example:8080
```

`redact_proxy_userinfo` is hand-rolled rather than routed through
`url::Url`
deliberately: a URL the parser rejects must still get scrubbed, never
fall
through to emitting the raw string. The authority is everything between
`://`
and the first `/`, `?` or `#`; the **last** `@` in it splits userinfo
from host
(a password may itself contain `@`).

## Tests

Two new unit tests in `src-tauri/src/commands/settings.rs`:

- `redact_settings_strips_proxy_basic_auth_credentials` - asserts the
username
and password are gone, `host:port` survives, and (the load-bearing one)
that
the **serialized JSON** carries no secret, since that is the artifact
that
  actually leaves the machine.
- `redact_proxy_userinfo_handles_every_url_shape` - no-credential
passthrough,
socks5, username-only, a password containing `@`, path/query not
mistaken for
the authority, an `@` inside a path left alone, and
unparseable-garbage-with-
  an-`@` redacted wholesale rather than passed through.

Ran locally: `cargo test -p driven-app redact_` (12 passed),
`cargo clippy -p driven-app --all-targets -- -D warnings` (clean),
`cargo fmt --all -- --check` (clean).

## Scope note

Two adjacent fields in the same struct are also cloned verbatim into the
bundle
and may carry user PII, but are **out of scope here** and reported
separately
rather than silently swept in: `custom_root_ca_path` (an absolute path
that can
contain the OS username, and which the rest of the bundle would have
hashed to
`<path:...>`) and `pre_backup_hook` / `post_backup_hook` (free-text
commands).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Qu8GxMwkuxF7JBzwRjtcw7

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: pmaxhogan

src-tauri/src/commands/settings.rs

@@ -2136,10 +2136,17 @@ struct RedactedTelemetry {
 }
 
 /// Redact the secret-bearing fields of a [`SettingsDto`] for the bundle
-/// (SPEC s18): the telemetry install id becomes `installid_<hash>`.
+/// (SPEC s18): the telemetry install id becomes `installid_<hash>`, and the
+/// issue #34 proxy URL has any `user:password@` userinfo stripped.
 fn redact_settings(s: &SettingsDto) -> RedactedSettings {
+    let mut global = s.global.clone();
+    // Issue #34 follow-up: a `manual`-mode proxy URL may embed basic-auth
+    // credentials (`http://user:password@proxy.corp:8080`). The bundle is meant
+    // to be shareable with support, so the userinfo must never ride along - the
+    // host:port survives because that is the diagnostically useful part.
+    global.proxy_url = global.proxy_url.as_deref().map(redact_proxy_userinfo);
     RedactedSettings {
-        global: s.global.clone(),
+        global,
         telemetry: RedactedTelemetry {
             enabled: s.telemetry.enabled,
             install_id: format!("installid_{}", stable_hash(&s.telemetry.install_id)),
@@ -2151,6 +2158,33 @@ fn redact_settings(s: &SettingsDto) -> RedactedSettings {
     }
 }
 
+/// Strip any `user:password@` userinfo from a proxy URL, keeping the scheme and
+/// `host:port` (issue #34 follow-up; see [`redact_settings`]).
+///
+/// Hand-rolled rather than routed through `url::Url` so a URL the parser rejects
+/// still gets scrubbed: a parse failure must never fall through to emitting the
+/// raw string. The authority is everything between `://` and the first `/`, `?`
+/// or `#`; the LAST `@` in it separates userinfo from the host (a password may
+/// itself contain an `@`).
+fn redact_proxy_userinfo(raw: &str) -> String {
+    let Some(sep) = raw.find("://") else {
+        // No scheme separator: not a URL we can split, so we cannot prove there
+        // is no credential in it. Redact wholesale rather than leak.
+        return if raw.contains('@') {
+            "<redacted>".to_string()
+        } else {
+            raw.to_string()
+        };
+    };
+    let (scheme, rest) = raw.split_at(sep + 3);
+    let authority_end = rest.find(['/', '?', '#']).unwrap_or(rest.len());
+    let (authority, tail) = rest.split_at(authority_end);
+    match authority.rfind('@') {
+        Some(at) => format!("{scheme}<redacted>@{}{tail}", &authority[at + 1..]),
+        None => raw.to_string(),
+    }
+}
+
 /// A short, stable, NON-reversible hex hash of `input` for the bundle's redacted
 /// ids (SPEC s18 `<hash>` placeholders). A 64-bit FNV-1a digest rendered as hex:
 /// good enough to correlate occurrences WITHIN one bundle without exposing the
@@ -3105,6 +3139,85 @@ mod tests {
         );
     }
 
+    #[test]
+    fn redact_settings_strips_proxy_basic_auth_credentials() {
+        // Issue #34 follow-up: `settings_redacted.json` carried `global` verbatim,
+        // so a manual-mode proxy URL with `user:password@` userinfo shipped its
+        // password in plaintext inside a bundle meant to be shared with support.
+        let mut global = default_global();
+        global.proxy_mode = "manual".to_string();
+        global.proxy_url = Some("http://corpuser:hunter2@proxy.corp.example:8080".to_string());
+        let dto = SettingsDto {
+            global,
+            telemetry: TelemetrySettings {
+                enabled: false,
+                install_id: "id".to_string(),
+                endpoint: "https://e".to_string(),
+            },
+            updater: default_updater(),
+            ui: default_ui(),
+            windows: None,
+            bundle_small_files: false,
+        };
+        let red = redact_settings(&dto);
+        let url = red.global.proxy_url.as_deref().expect("proxy url present");
+        assert!(!url.contains("hunter2"), "the password must be gone: {url}");
+        assert!(
+            !url.contains("corpuser"),
+            "the username must be gone: {url}"
+        );
+        assert!(
+            url.contains("proxy.corp.example:8080"),
+            "host:port is diagnostically useful and survives: {url}"
+        );
+
+        // The serialized bundle document must not carry the secret either - this
+        // is the artifact that actually leaves the machine.
+        let json = serde_json::to_string(&red).expect("serialize");
+        assert!(
+            !json.contains("hunter2"),
+            "the bundle JSON must not carry the proxy password: {json}"
+        );
+    }
+
+    #[test]
+    fn redact_proxy_userinfo_handles_every_url_shape() {
+        // No credentials: untouched.
+        assert_eq!(
+            redact_proxy_userinfo("http://proxy.corp:8080"),
+            "http://proxy.corp:8080"
+        );
+        // socks5 with credentials.
+        assert_eq!(
+            redact_proxy_userinfo("socks5://u:p@127.0.0.1:1080"),
+            "socks5://<redacted>@127.0.0.1:1080"
+        );
+        // Username only, no password.
+        assert_eq!(
+            redact_proxy_userinfo("http://justuser@h:1"),
+            "http://<redacted>@h:1"
+        );
+        // A password containing '@' - the LAST '@' in the authority splits it.
+        assert_eq!(
+            redact_proxy_userinfo("http://u:p@ss@h:1"),
+            "http://<redacted>@h:1"
+        );
+        // A path/query must not be mistaken for the authority, and an '@' after
+        // the authority (in a path) is not userinfo.
+        assert_eq!(
+            redact_proxy_userinfo("http://u:p@h:1/path?q=1"),
+            "http://<redacted>@h:1/path?q=1"
+        );
+        assert_eq!(
+            redact_proxy_userinfo("http://h:1/pa@th"),
+            "http://h:1/pa@th"
+        );
+        // Unparseable garbage that still contains an '@' is redacted wholesale
+        // rather than passed through.
+        assert_eq!(redact_proxy_userinfo("u:p@h:1"), "<redacted>");
+        assert_eq!(redact_proxy_userinfo("not a url"), "not a url");
+    }
+
     #[tokio::test]
     async fn schema_summary_includes_real_user_version() {
         // C3 (SPEC s18): schema.txt must carry the REAL PRAGMA user_version, not