Fix suggestion token redaction scope (#4403) (#4483)

Author: Widthdom

changelog.d/unreleased/4403.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 4403
+affected:
+  - src/CodeIndex/Diagnostics/DiagnosticRedactor.cs
+  - tests/CodeIndex.Tests/DiagnosticRedactorTests.cs
+---
+
+## English
+
+- **Suggestion persistence preserves ordinary identifiers and recipe IDs (#4403)** — high-entropy detection now requires uppercase, lowercase, and numeric signals inside the same token, so later text no longer causes long PascalCase method names or slash/hyphen audit identifiers to be redacted while actual mixed-character secrets remain protected.
+
+## 日本語
+
+- **提案の永続化で通常の識別子と recipe ID を保持するようになりました (#4403)** — high-entropy 判定で大文字・小文字・数字が同じ token 内にあることを必須にしたため、後続テキストの影響で長い PascalCase メソッド名や slash/hyphen 形式の audit 識別子が伏字になることを防ぎつつ、実際の混合文字 secret は引き続き保護します。

src/CodeIndex/Diagnostics/DiagnosticRedactor.cs

@@ -63,7 +63,7 @@ internal static class DiagnosticRedactor
         RegexTimeout);
 
     private static readonly Regex HighEntropyTokenPattern = new(
-        @"\b(?=[A-Za-z0-9._~+/=-]{32,}\b)(?=.*[A-Z])(?=.*[a-z])(?=.*\d)[A-Za-z0-9._~+/=-]+\b",
+        @"\b(?=[A-Za-z0-9._~+/=-]{32,}\b)(?=[A-Za-z0-9._~+/=-]*[A-Z])(?=[A-Za-z0-9._~+/=-]*[a-z])(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]+\b",
         RegexOptions.CultureInvariant | RegexOptions.Compiled,
         RegexTimeout);
 

tests/CodeIndex.Tests/DiagnosticRedactorTests.cs

@@ -29,6 +29,17 @@ public void RedactSuggestionText_UsesSharedTypedPolicy_Issue3933()
             redactedTypes.Order(StringComparer.Ordinal));
     }
 
+    [Theory]
+    [InlineData("PersistSuggestionsAtomically writes 12 records")]
+    [InlineData("Recipe risky-code/environment-secret-source; representative result count 3")]
+    public void RedactSuggestionText_DoesNotBorrowEntropySignalsFromLaterText_Issue4403(string text)
+    {
+        var redacted = DiagnosticRedactor.RedactSuggestionText(text, out var redactedTypes);
+
+        Assert.Equal(text, redacted);
+        Assert.Empty(redactedTypes);
+    }
+
     [Theory]
     [InlineData("--github-token")]
     [InlineData("github_token")]