Improve database credential redaction after betterleaks

[peyton-alt]

Summary

Redact for database credential gaps that remain after #1043 switched redaction to Betterleaks.

• Redacts low-entropy database connection strings that Betterleaks/default entropy detection miss, including Postgres keyword DSNs, SQL Server strings, ODBC strings, and JDBC/DB URL query-password forms.
• Redacts bounded DB credential values such as DB_PASSWORD=..., PGPASSWORD=..., and REDIS_PASSWORD=... while preserving placeholders and already-redacted values.
• Redacts structured JSON database password fields like {"db":{"password":"...","host":"...","user":"..."}} without redacting unrelated fields that happen to share the same value.
• Keeps over-redaction guardrails for non-credential URLs, SSH remotes, prose, paths, IDs, placeholders, and already-redacted values.
• Updates security/privacy docs to describe the split between Betterleaks, existing credentialed URI detection, and the additional DB-specific redaction layer.

Scope After #1043

• Private key block redaction is covered by Betterleaks default rules, so this PR does not add custom private-key block logic.
• Generic scheme://user:password@host URI userinfo redaction is covered by the existing credentialedURIPattern in redact/redact.go, so the DB-specific detector no longer owns userinfo URLs.
• This PR focuses on DB DSNs, DB URL query passwords, bounded DB credential values, and structured JSON DB password fields.

Also Included

Two unrelated concurrency fixes that surfaced during this work:

• cmd/entire/cli/logging/logger.go — holds the read lock across l.Log so Init/Close cannot close the log writer mid-write. Adds TestLogging_ConcurrentInitAndLog as a regression guard (now exercises Close too).
• cmd/entire/cli/dispatch_tui_test.go — drops t.Parallel() on two tests that mutate the package-level newDispatchProgram factory; adds a doc comment on the var so future contributors don't reintroduce the race.

Bundled here rather than split into separate PRs because both are small.

Testing

• GOCACHE=/tmp/entire-go-cache go test ./redact -count=1
• mise run check
• mise run lint

Notes

mise run check and mise run lint were run outside the sandbox because golangci-lint fetches its schema, Go uses the user cache, and integration tests bind localhost httptest servers.

---

Note

Medium Risk
Medium risk because it changes always-on redaction behavior (could still under- or over-redact real user data) and adjusts shared logger state access patterns under concurrency.

Overview
Improves secret redaction coverage for database credentials. redact.String now adds always-on detectors for DB connection strings (JDBC, keyword DSNs, semicolon/ODBC-style, and DB URLs with password/pwd query params) plus bounded credential assignments like DB_PASSWORD=..., while explicitly skipping placeholders/already-redacted values.

Makes JSON/JSONL redaction more field-aware. JSON replacement tracking now keys replacements by JSON field so skipped fields (e.g., session_id) don't get redacted due to value collisions elsewhere, and structured credential objects/keys (normalized variants like "DB Password") get their password values redacted without touching unrelated fields.

Hardens CLI logging under concurrency. Removes helper getters and reads logger/currentSessionID under the package RW lock inside log, and adds a concurrent Init+log stress test. Docs are updated to describe the expanded redaction layers.

^{Reviewed by Cursor Bugbot for commit 3115fad. Configure here.}

[Copilot]

Pull request overview

This PR strengthens Entire CLI’s automatic transcript redaction by adding more secret detectors (beyond entropy + gitleaks) and expanding regression coverage to reduce both under- and over-redaction in common credential formats.

Changes:

• Add redaction for full private key blocks, credentialed URIs, database DSNs/URLs, and bounded password-like key/value pairs.
• Enhance JSON/JSONL redaction to support key-scoped replacements for structured credential fields.
• Expand unit tests and update security/privacy documentation to reflect the new detection layers.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
redact/redact.go	Adds new secret detectors (private keys, credentialed URIs, connection strings, bounded credentials) and extends JSONL replacement handling.
redact/redact_test.go	Adds extensive coverage for new redaction behaviors, including guardrails against over-redaction.
docs/security-and-privacy.md	Updates documentation to describe the expanded automatic secret redaction methods.

[peyton-alt]

@BugBot review

[peyton-alt]

@BugBot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3115fad. Configure here.}