Prepare ForgeFlow for public release

tests/log-redaction.test.mjs

@@ -2,7 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import redaction from '../src/main/log-redaction.cjs';
 
-const { redactSecrets, sanitizeForDiagnostics, pathAlias, stableAlias } = redaction;
+const { redactSecrets, sanitizeForDiagnostics, pathAlias, stableAlias, redactPrivateInfrastructure } = redaction;
 
 test('redacts runtime credentials, structured secrets, private keys and URL credentials', () => {
   const token = ['gitea', 'TEST', 'ONLY', 'SecretToken123456'].join('_');
@@ -31,15 +31,22 @@ test('sanitizes nested sensitive keys and aliases user paths', () => {
 });
 
 test('strict privacy mode replaces stable identifiers deterministically', () => {
-  const first = sanitizeForDiagnostics({ fullName: 'jens/private-project', login: 'jens' }, { strictIdentifiers: true });
-  const second = sanitizeForDiagnostics({ fullName: 'jens/private-project', login: 'jens' }, { strictIdentifiers: true });
+  const first = sanitizeForDiagnostics({ fullName: 'jens/private-project', login: 'jens', host: '192.168.10.20', basePath: '/mnt/user/appdata' }, { strictIdentifiers: true });
+  const second = sanitizeForDiagnostics({ fullName: 'jens/private-project', login: 'jens', host: '192.168.10.20', basePath: '/mnt/user/appdata' }, { strictIdentifiers: true });
   assert.equal(first.fullName, second.fullName);
   assert.equal(first.login, second.login);
   assert.notEqual(first.fullName, 'jens/private-project');
   assert.match(first.fullName, /^fullname-[a-f0-9]{12}$/);
+  assert.notEqual(first.host, '192.168.10.20');
+  assert.notEqual(first.basePath, '/mnt/user/appdata');
   assert.equal(stableAlias('same', 'repo'), stableAlias('same', 'repo'));
 });
 
+test('strict privacy redacts private addresses, infrastructure URLs and server paths in log text', () => {
+  const result = redactPrivateInfrastructure('host 192.168.10.20 url https://internal.example.test/status path /mnt/user/appdata/example');
+  assert.doesNotMatch(result, /192\.168\.10\.20|internal\.example\.test|\/mnt\/user\/appdata/);
+});
+
 test('path aliasing handles slash variants', () => {
   const result = pathAlias('C:\\Users\\Jens\\src and C:/Users/Jens/src', { homeDir: 'C:\\Users\\Jens', cwd: 'D:\\ForgeFlow' });
   assert.doesNotMatch(result, /Users[\\/]Jens/);