[Security / Bug] Project .prime/settings.json overrides global agentTraces opt-out (CWE-863) & git URL credential redaction (fix ready in #3886)

[stealthmark-io]

Summary

Per CONTRIBUTING.md, opening a Discussion first so a maintainer can review and vouch PR #3886 (stealthmark-io/prime-agent@6538a97).

During a static audit of crates/pa-core, our team at StealthMark Security found an asymmetric precedence bug in SettingsManager::get_agent_traces_enabled() alongside unredacted HTTP(S) git remote credentials in active_git_context().

---

1. Project .prime/settings.json Can Override Global agentTraces Opt-Out / Default-Off (crates/pa-core/src/settings/manager.rs:418-435)

• For product telemetry (get_telemetry_enabled(), manager.rs:839-847), SettingsManager evaluates .all(...) across [self.global, self.project, self.runtime_overrides] so a project config cannot override a global opt-out.
• However, get_agent_traces_enabled() (manager.rs:418-424) and agent_traces_choice_written() (manager.rs:429-435) read from self.merged.agent_traces (deep_merge(&global, &project)), where SettingsScope::Project (<cwd>/.prime/settings.json) wins over SettingsScope::Global (~/.prime/settings.json).
• Impact: If a user has opted out globally ("agentTraces": {"enabled": false}) or left it unset (default off), opening a third-party repository that contains .prime/settings.json with {"agentTraces": {"enabled": true}} flips get_agent_traces_enabled() to true and marks agent_traces_choice_written() as true, allowing ContinuousTraceUpload (continuous.rs:130-141) to upload session transcripts using the user's PRIME_API_KEY / inference credential (agent_traces.rs:95-109).

2. Embedded HTTP(S) Credentials in active_git_context() (crates/pa-core/src/agent_traces.rs:369-443)

• active_git_context() extracts git.repoUrl from session git_state or headers and attaches it to X-Git-Repo without stripping embedded HTTP(S) userinfo@ tokens (e.g., https://x-access-token:<token>@github.com/org/repo.git).

---

Fix & Unit Tests Ready in PR #3886 (6538a97)

We prepared a minimal patch in PR #3886 (6538a97) that:

1. Requires self.global.agent_traces.enabled == Some(true) as the baseline consent gate while still allowing self.project or self.runtime_overrides to veto (enabled: false) trace uploads for sensitive workspaces (preserving mixed_consent_fixture in continuous/tests.rs:704).
2. Scopes agent_traces_choice_written() to self.global.agent_traces.
3. Strips HTTP(S) userinfo@ credentials in sanitize_git_repo_url() with unit tests (project_settings_cannot_override_global_agent_traces_opt_out_or_unset and active_git_context_strips_embedded_http_credentials).

Happy to have a maintainer take a look and re-open/vouch #3886!