fix: main red on TypeScript CI — ledger redaction over-masks paths and leaks curl -u credentials (regression from #1117)

[anandgupta42]

Summary

origin/main has been red on the TypeScript CI job since ~2026-09-04 07:28Z, blocking all PRs. 5 tests in packages/opencode/test/session/compaction-ledger.test.ts fail.

Root cause

#1117 (14ba9bb9e7, "mask filesystem paths in telemetry error text") added a POSIX-path masking rule to Telemetry.maskString (packages/opencode/src/altimate/telemetry/index.ts). SessionCompaction.redactLedgerDetail (packages/opencode/src/session/compaction.ts) calls Telemetry.maskString(value) FIRST, then runs its own -u/--user curl-credential redaction. Two consequences of that ordering:

1. Over-masking (4 tests): every write path (2+ segments) collapses to the literal <path>, so the session ledger can no longer report which file was written.
2. Credential leak (1 test) — the important one: when curl is invoked path-qualified (e.g. /usr/bin/curl -u alice password ...), maskString's path rule replaces the curl/curl.exe token with <path> before redactLedgerDetail's curl-context lookback runs. The lookback then can't find curl, so the space-separated (non-colon) -u alice password idiom is not recognized as a credential and passes through unredacted. This text is persisted into a later model prompt across compaction — a real cross-compaction credential leak.

This is main-only; not present in v0.10.0 or any released version.

Fix

See linked PR.