fix: redact caller argv before it reaches the agent session history

[ctrl-alt-automate]

Summary

Fixes the HIGH finding of GHSA-5f6j-w3xx-jx8g: the agent session history recorded the caller's full argv unredacted, so a secret carried on a command line (jit vault set <path> <value>, or a token in a jit run -- tool --token=… tail) was persisted in plaintext to agent-history.jsonl and rendered back by jit audit / jit agent history — while the application audit log promises it "records that a command RAN, not the secret it may have carried" and cli/auditrecord.go already masks these exact positions in jit's own os.Args.

Three layers, one shared judgement:

• auditlog.RedactCommandLine (new): the credential-shaped RedactText pass plus an unconditional mask of a jit vault set line's value positionals — the entropy test alone would let a weak value ("hunter2") through, the same reason sanitizeInvocationArgs masks that position for jit's own args. Positional counting is reliable here because every flag that command can see is a boolean; a future value-taking flag would over-mask, never leak. Placed in auditlog because both producers need the identical judgement and it is the leaf they already share (the same reasoning RedactToken's export comment records).
• caller.command() routes argv through it, so every By — unlock, use aggregate, serve-error, grant end — is masked at the single point it is minted, and no future recording site can forget to.
• historyLog.load / readNewEvents scrub By on read, so a legacy line written before this fix stops leaking the moment it is displayed (seeded ring, jit agent history, jit audit text + JSON) rather than the year it rotates out of the 2MB file.

The path of a jit vault set stays legible (it is the one part an investigation needs and is not a secret), including the value-from-prompt/--stdin form where masking the last positional would have redacted the path itself.

Test plan

• New tests: TestRedactCommandLine* (auditlog — grammar, flags, -- terminator, multi-word values, path-only forms, non-jit lines), TestUnlockEventNeverRecordsACredentialFromTheCallersArgv, TestUnlockEventMasksAVaultSetValueTooWeakForTheEntropyTest, TestUnlockEventKeepsVaultSetPathWhenValueCameFromPrompt, TestRecordServeErrorRedactsTheRejectedPeersArgv (agent), TestHistoryLogLoadScrubsLegacyPlaintextBy (cli)
• go build ./... && go test -race -timeout 2m ./... — full suite green
• gofmt -l ./cmd ./internal (clean), go vet ./..., go mod verify && go mod tidy (no drift)
• staticcheck ./... @v0.7.0, govulncheck ./... @v1.6.0, gosec -exclude-generated ./... @v2.28.0 — all clean
• Maintainer: consider a one-shot trim/rewrite of existing agent-history.jsonl files if you want poisoned legacy lines gone from disk (this PR scrubs them on every read, but the bytes remain in the file until rotation)

Reported privately first per SECURITY.md; the advisory (GHSA-5f6j-w3xx-jx8g) has the full analysis, including two smaller findings this PR deliberately does not touch.

[menitasa]

Thanks for the report and the fix. The mechanism (redact at the one point argv becomes a By, plus a read-time scrub for legacy lines) is exactly right, and we've kept it. A deep review of the branch confirmed the direction but found the redactor itself both under- and over-masked, so I've pushed a follow-up commit on top of yours rather than round-tripping through review comments:

• RedactCommandLine now judges each field with redactArg (the KEY=VALUE-splitting, path-exempting judgement Redact already applies to jit's own args) instead of a whole-line RedactText pass. That fixes the two big ones: --token=ghp_... / KEY=VALUE glued secrets were still leaking (the prefix test never saw past the key, and short vendor tokens are under the entropy floor), and ordinary versioned paths, including the vault path your grammar pass deliberately kept, were being entropy-masked out of By, permanently.
• The vault-set grammar is now ONE exported implementation (auditlog.MaskVaultSetValues) shared with sanitizeInvocationArgs, which previously masked only the last positional; it also catches a dash-prefixed value ("-hunter2") that positionalIndexes waved through as a flag. A drift test walks the live cobra command so the flag list can't rot.
• The same doctrine now covers the sibling surfaces the chokepoint missed: use-aggregation keys on the raw command (redaction could merge two different callers into one misattributed event), mount-run service-log lines, GrantStatus.Command, and a client-side scrub for a still-running pre-fix agent serving raw ring events over the status RPC.
• Your unchecked test-plan item is done: scrubLegacy() rewrites agent-history.jsonl once at service startup, so legacy plaintext leaves the disk rather than waiting out rotation; already-clean lines are kept byte-for-byte.

All of your tests still pass unchanged. Merging once CI is green.

[menitasa]

Reviewed the full diff (deep multi-agent review, 10 findings) and fixed all findings in the follow-up commit 2c7f19d. Mechanism is right, tests are thorough, DCO present.