fix(status): classify credential-like remotes semantically

[andrei-hasna]

Implements Todos task 1764bc22-e701-4d77-9d68-6f06301bbce3.

Changes:

• Add a regression for a clean remote whose repository name contains token, with URL-userinfo positive control and safe-url negative control.
• Replace broad remote_url substring matching in repos status with semantic credential-like detection for URL userinfo and non-empty credential-named query parameters.
• Bump @hasna/repos to 0.1.46 and document the fix.

Verification:

• FAIL before fix: bun test src/lib/status.test.ts exited 1 with Expected: 1 / Received: 2.
• PASS: bun test src/lib/status.test.ts.
• PASS: bun test src/lib/status.test.ts src/lib/remote-identity.test.ts.
• PASS: bun run typecheck.
• PASS: bun run src/cli/index.tsx status --json; metadata-only status reported withCredentialLikeRemote=0 and hasCredentialLikeRemoteUrls=false locally.
• PASS: git diff --check.
• PASS: configured pre-commit hook.
• PASS: bun run build after commit.
• PASS: configured pre-push hook and git push pre-push scan.

Residual risk:

• Full bun test exited 1 only because docs-parity CLI-help traversal exceeded its 30000ms test timeout. A diagnostic traversal returned code=0 for every help path and found no single hanging command.

Not done:

• Not merged.
• Not published.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #74 @ 8b1b68a — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Candidate reviewed

• Base: origin/main at 12be25f.
• Commit: 8b1b68a (fix(status): classify credential-like remotes semantically).
• Read: the full diff for CHANGELOG.md, package.json, src/lib/status.ts, and src/lib/status.test.ts; full changed source/test files; and surrounding remote sanitization, scanner persistence, database, upsert, package export, and CLI status rendering paths.

Commands and gates

• git log --oneline origin/main..HEAD — exit 0; one commit.
• git diff origin/main...HEAD --stat — exit 0; 4 files, 87 insertions, 8 deletions.
• bun install — exit 0; setup only, 496 packages installed.
• bun run typecheck — exit 0; PASS; the typecheck gate emits no pass/fail count.
• bun run test — exit 0; PASS; 805 pass, 0 fail, 3579 expectations across 52 files.
• Focused semantic probe — exit 1; auth-token-camel: actual=false expected=true; probe_failures=1.

Blocking P0/P1 findings

1. P1, high confidence — src/lib/status.ts: CREDENTIAL_QUERY_KEY misses common camel-case credential parameter names such as authToken (and the same boundary shape affects accessToken/refreshToken). The supported status path is concrete: a non-empty repos.remote_url row is selected by getReposStatus, hasCredentialLikeRemoteSemantics returns false for https://git.example.test/o/r.git?authToken=marker, and the status contract reports zero credential-like remotes with health.status: ok. The PR explicitly adds non-empty credential-named query-parameter detection, so this reachable false-negative defeats the security health signal it changes. Remedy: recognize camel-case credential suffixes without returning to whole-URL substring matching, and add regression cases for a camel-case credential key plus a non-credential word containing token.

Non-blocking follow-ups

• None.

[andrei-hasna]

[REVIEW] GO — #74 @ 7026626 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Focused remediation re-review

• The named P1 is fixed in src/lib/status.ts: camel-case boundaries are segmented before matching credential query-key terms, so authToken is detected without reverting to whole-URL substring matching.
• Direct regression coverage now exercises a credential-bearing camel-case query key and a non-credential tokenizer key through getReposStatus.
• bun test src/lib/status.test.ts before the fix — exit 1; 1 pass, 1 fail; Expected: 2, Received: 1.
• bun test src/lib/status.test.ts after the fix — exit 0; 2 pass, 0 fail, 14 expectations.
• Focused semantic probe after the fix — exit 0; auth-token-camel: actual=true expected=true; tokenizer: actual=false expected=false; probe_failures=0.
• bun run typecheck after the fix — exit 0; PASS; no pass/fail count emitted.
• shield review on the staged remediation — exit 0; No security issues found in staged changes.
• The original full declared gate at 8b1b68a was bun run test exit 0 with 805 pass, 0 fail; the remediation changed only this status classifier and its focused test, so re-validation was scoped to the affected status and typecheck lanes.
• Commit 7026626338e8e8d6f2cf80b4c5b769accaea0a82 was pushed to the PR branch with the required Agent: Trebius trailer.

Blocking P0/P1 findings

• None open. The prior P1 is resolved and its direct regression passes.

Non-blocking follow-ups

• None.