feat(shared): redact paths from DatabaseError messages (W-3.5-SEC-L1)

[h2devx]

Summary

Third fix of the v0.5 hardening cycle (HANDOFF.md §6.21 roadmap row 4). Closes warning W-3.5-SEC-L1 for DatabaseError (HANDOFF §6.6).

DatabaseError.openFailed(path, cause) and DatabaseError.migrationDirectoryInvalid(dir, ...) previously interpolated absolute paths into the message field. Pino redacts keys (DEFAULT_REDACT_PATHS) but does NOT redact message content — paths leaked to structured logs / observability exporters, revealing user home dir + repo layout.

This PR moves those paths from message to a new structured field details: { path } / details: { dir, reason }. Public factory signatures are unchanged (backward-compat). Pino DEFAULT_REDACT_PATHS gains 4 new globs covering details.path / details.dir (top-level + 1-segment-wrapped).

What changed

Code

• code/src/shared/infrastructure/errors/database-error.ts (+49/-10) — details: Readonly<Record<string, unknown>> field added; `openFailed` and `migrationDirectoryInvalid` move path/dir from message to details; 8 other factories gain consistent `details` shape with non-sensitive data (extension name, sql length, operation name, version numbers).
• code/src/shared/infrastructure/logger/pino-logger.ts (+12/-0) — DEFAULT_REDACT_PATHS gains: `details.path`, `details.dir`, `.details.path`, `.details.dir` (covers standalone + wrapped-in-err shapes).

Tests (+12 tests, all VALOR)

• `openFailed`: `message NOT contains path` + `details.path === path`.
• `migrationDirectoryInvalid`: `message NOT contains dir` + `details.dir === dir` + `details.reason === reason`.
• 8 secondary factories: `details === { ... }` shape pinned per factory.
• Backward-compat test: callers can read path via `details.path` (replaces old substring-on-message pattern).
• Pino end-to-end redact: feed envelope to logger, capture stdout, assert path NOT in output, assert sibling field (reason) IS visible.

Audit factories inventory (10 total)

Factory	Had path leak?	Modified?
`openFailed(path, cause)`	YES	path → details.path
`migrationDirectoryInvalid(dir, reason, cause)`	YES	dir/reason → details
`encryptionKeyRejected`	no	details: {} (consistency)
`extensionLoadFailed`	no	details.extensionName
`prepareFailed`	no	details.sqlLength
`execFailed`	no	details: {}
`transactionFailed`	no	details: {}
`connectionClosed`	no	details.operation
`migrationAheadOfCode`	no	details.dbVersion + codeMaxVersion
`migrationFailed`	no	details.version + name

Security audit result

APPROVED WITH OBSERVATIONS (security-auditor). Backward-compat verified independently (no callers read path via message-substring). Tests pin redacted output end-to-end (not just config). No new wire-leak via JSON-RPC error-mapper (Tier 3.5 does NOT serialize `details` field).

3 non-blocking observations tracked for v0.5+ follow-up:

• O-1 (LOW, OUT-OF-SCOPE): 9+ Error factories in workspace/secrets/curator modules still interpolate `rootPath`/`startPath`/`hookPath` into `message` — same leak pattern as W-3.5-SEC-L1, also flowing to wire JSON-RPC via error-mapper. W-3.5-SEC-L1 is NOT categorically closed by this PR — only closed for DatabaseError. Recommendation: open W-3.5-SEC-L2 (or extend L1) follow-up to apply same `details: { path }` pattern across all error factories before v0.5 GA. Affected files:
  • `workspace/infrastructure/errors/workspace-infrastructure-error.ts` (9 factories)
  • `workspace/application/errors/workspace-application-error.ts` (NoWorkspaceAtPathError)
  • `secrets/infrastructure/errors/foreign-hook-exists-error.ts`
  • `curator/infrastructure/errors/curator-infrastructure-error.ts` (scanFailed)
• O-2 (INFO): pino `` glob is single-segment only. Wrapped envelopes deeper than `{ outer: { err: { details: { path } } } }` would NOT be redacted. No call-site affected today (verified). For v0.5 audit logging, consider proactive `.*.details.path` patterns.
• O-3 (INFO): Add JSDoc warning on `DatabaseError.details` advising NOT to include in JSON-RPC `data` envelope (avoids future regression where audit data would leak to wire).

Test plan

• `npm run typecheck` EXIT=0
• `npm run lint` EXIT=0 (--max-warnings 0)
• `npm run lint:tests` EXIT=0 (--max-warnings 0)
• `npm run validate:modules` EXIT=0
• `npm run build` EXIT=0
• `npm test` EXIT=0 — 2578/2578 tests pass (+4 vs baseline 2574)

OWASP mapping

• A09:2021 Security Logging Failures — closed (for DatabaseError; tracked O-1 for other classes).
• A05:2021 Security Misconfiguration — strengthened (defaults expanded to redact structured path fields).

🤖 Generated with Claude Code