Discard credential-bearing Codex app-server error text #329

Description

Main 66764b6f65964d1422e63aa5c575333b5bafb0e0 copies arbitrary Codex JSON-RPC error.message and failed account/login/completed.params.error strings into AppServerError::Refused. Truncating to 200 characters preserves short credentials. The sign-in handler displays to_string().

The mock-transport tests cli_request_errors_discard_credential_bearing_messages and cli_login_failures_discard_credential_bearing_messages both fail on that main revision. They inject only Bearer SYNTHETIC_CREDENTIAL_7DA8 or code=SYNTHETIC_CREDENTIAL_7DA8 through an in-memory channel. No actual CLI, auth files or provider calls.

Closed #72 / PR #112 fixed retired C# paths. This Rust path is distinct; PR #313/#321 are excluded.

Why

Credential-bearing CLI failure text can reach the sign-in diagnostic. Truncation is not redaction.

Goal

Discard arbitrary CLI error text at the Rust error boundary while keeping useful fixed diagnostics.

Acceptance Criteria

• Request errors and failed login notifications omit synthetic tokens, authorization codes and cookies in Display and Debug.
• Short, multiline and oversized messages obey the guarantee.
• Successful, cancelled, timed-out and signed-out behavior remains covered.

Definition of Done

• Bounded Rust fix with mock-transport regression coverage.
• Four Rust gates, required hosted checks and clean current-head independent review.
• Guarded merge and verified clean-main sync; no application launch or deployment.

Validation

• cargo test -p codexbar-providers --test codex_error_privacy --locked: before the fix 0 passed, 2 failed with synthetic credential leak assertions; after the fix all pass.
• Run the format, Clippy, production binary and workspace test gates from AGENTS.md on Laptop headlessly.

Source: Chief7da8 bounded synthetic error-redaction assignment. This is source-security work without layout or interaction changes.