fix(security): resolve CodeQL high/medium code-scanning alerts

- dataManager: stop logging API key fragments in key-preservation
  warnings; log a non-reversible hashToken() prefix instead
  (js/clear-text-logging #80, #81).
- dataManager: drop no-op .replace('T','T')/.replace('Z','Z') from the
  snapshot timestamp (js/identity-replacement #78, #79).
- openaiProviderSelection: remove bypassable URL-substring host check in
  the Gemini permanent-auth-failure classifier; the function is already
  guarded by isGeminiLikeProviderId, so permission_denied alone suffices
  (js/incomplete-url-substring-sanitization #82).

Author: skullcmd

apps/api/modules/dataManager.ts

@@ -1,6 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import redis, { redisReadyPromise, Redis } from './db.js';
+import { hashToken } from './redaction.js';
 
 const BunRuntime = (globalThis as any).Bun;
 const HAS_BUN_FILE_IO =
@@ -821,7 +822,7 @@ class DataManager {
 		if (keys.length === 0) return '';
 		const preview = keys
 			.slice(0, 5)
-			.map(apiKey => `${apiKey.slice(0, 8)}...${apiKey.slice(-6)}`);
+			.map(apiKey => `#${hashToken(apiKey).slice(0, 8)}`);
 		return `${keys.length} key${keys.length === 1 ? '' : 's'} (${preview.join(', ')}${keys.length > preview.length ? ', ...' : ''})`;
 	}
 
@@ -901,9 +902,7 @@ class DataManager {
 			await ensureDir(keySnapshotDir);
 			const timestamp = new Date(now)
 				.toISOString()
-				.replace(/[-:.]/g, '')
-				.replace('T', 'T')
-				.replace('Z', 'Z');
+				.replace(/[-:.]/g, '');
 			const snapshotPath = path.join(
 				keySnapshotDir,
 				`keys-${timestamp}.json`

apps/api/modules/openaiProviderSelection.ts

@@ -681,7 +681,7 @@ function hasRecentGeminiCatalogAuthFailureSignal(provider: LoadedProviderData):
     lastError.includes('your project has been denied access') ||
     lastError.includes('project has been denied access') ||
     lastError.includes('accessnotconfigured') ||
-    (lastError.includes('permission_denied') && lastError.includes('generativelanguage.googleapis.com')) ||
+    lastError.includes('permission_denied') ||
     lastError.includes('service_disabled') ||
     lastError.includes('gemini_project_auth_failure')
   );