Redact support recovery paths by default

TESTING_GUIDE.md

@@ -74,7 +74,7 @@ Use `docs/test-doc-maintenance-plan.md` before moving oversized suites or adding
   Pure or mostly pure behavior tests with in-memory inputs.
   `DbPathResolverPureTests` keeps only path, injected-input, and URI validation cases that neither read process-global state nor open SQLite, allowing them to run outside the `SQLite pool sensitive` collection. Keep environment/current-directory resolution, real database and metadata probes, pool resets, and static test seams in `DbPathResolverTests`.
   Search snippet origin-priority coverage keeps PascalCase, snake_case, and phrase queries in coordinated mixed comment/string/code fixtures so identifier focus, same-line code-column clamping, over-1-MiB valid chunks, final-window dropped counts, filtered-origin refocusing, and the phrase control share one contract.
-  Recovery-command coverage asserts structured argv, current `dotnet`/apphost prefix preservation, replay of option-like paths, and display-only escaping for both POSIX sh and PowerShell, including spaces, quotes, dollar signs, and shell metacharacters.
+  Recovery-command coverage keeps resolved execution arguments separate from support-safe display arguments. Assert structured argv, current `dotnet`/apphost prefix preservation, replay of option-like paths under CLI `--show-paths`, default CLI/MCP redaction metadata, and correct quoting for both POSIX sh and PowerShell. Include paths with spaces, quotes, dollar signs, shell metacharacters, POSIX home/temp roots, Windows drives, UNC roots, option-like source names such as `--db`, and file-URI database query parameters containing raw/encoded paths, percent-encoded sensitive keys, or path values with embedded sensitive assignments. Default-output assertions must reject the fixture's full absolute paths and secrets while preserving safe URI controls. Pair this with `status --config` coverage for default DB/data/log path and URI-query redaction, always-redacted secrets, and explicit `--show-paths`.
   Console writer synchronization coverage yields between character writes instead of sleeping per character; use enough whole-line iterations to expose interleaving without adding wall-clock delay.
 - `SymbolExtractor*Tests.cs` and `ReferenceExtractor*Tests.cs`
   Extractor coverage is split by language or feature area with partial test classes, while shared helpers remain on the root `SymbolExtractorTests` / `ReferenceExtractorTests` parts.
@@ -986,7 +986,7 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
   インメモリ入力中心の、純粋またはほぼ純粋な振る舞いのテスト。
   `DbPathResolverPureTests` には process-global state を読まず SQLite も開かない path、注入済み入力、URI validation の case だけを置き、`SQLite pool sensitive` collection の外で実行できるようにします。環境変数 / current directory の解決、実 database / metadata probe、pool reset、static test seam は `DbPathResolverTests` に残してください。
   search snippet の origin 優先順位 coverage は PascalCase、snake_case、phrase query を連携した comment / string / code 混在 fixture にまとめ、identifier focus、同一行の code 列への clamping、1 MiB を超える有効 chunk、最終 window の dropped count、filter 後 origin への再 focus、phrase の control を一つの contract として検証します。
-  recovery command の coverage では構造化 argv、現在の `dotnet` / apphost prefix の維持、option と紛らわしい path の再実行、POSIX sh と PowerShell 双方の表示専用 escaping を、空白、quote、dollar sign、shell metacharacter を含めて検証します。
+  recovery command の coverage では、解決済みの実行引数とサポート共有向けの表示引数を分離して検証します。構造化 argv、現在の `dotnet` / apphost prefix の維持、CLI `--show-paths` による option と紛らわしい path の再実行、既定の CLI/MCP redaction metadata、POSIX sh と PowerShell 双方の正しい quoting を確認してください。空白、quote、dollar sign、shell metacharacter、POSIX の home/temp root、Windows drive、UNC root、`--db` のように option と紛らわしい source 名、raw / encoded path、percent-encoded な機密 key、機密 assignment を内包する path 値を持つ file-URI database query parameter を含めます。既定出力に fixture の完全な絶対パスや secret が残らず、安全な URI control は維持されることを assertion にします。`status --config` の DB/data/log path と URI query の既定 redaction、mode に関係なく維持される secret redaction、明示的 `--show-paths` も対で検証してください。
   console writer synchronization coverageは文字writeごとのsleepではなくyieldを使い、wall-clock delayを追加せずinterleavingを露出できる十分なwhole-line iterationを維持してください。
 - `SymbolExtractor*Tests.cs` と `ReferenceExtractor*Tests.cs`
   extractor のカバレッジは言語または機能領域ごとの partial test class に分割し、共有 helper は root 側の `SymbolExtractorTests` / `ReferenceExtractorTests` に残します。

changelog.d/unreleased/4860.security.md

@@ -0,0 +1,20 @@
+---
+category: security
+issues:
+  - 4860
+affected:
+  - src/CodeIndex/Cli/ExcerptRecoveryCommandFormatter.cs
+  - src/CodeIndex/Cli/QueryCommandRunner.Status.cs
+  - src/CodeIndex/Diagnostics/DiagnosticSanitizer.cs
+  - src/CodeIndex/Models/QueryResults.cs
+  - DEVELOPER_GUIDE.md
+  - TESTING_GUIDE.md
+---
+
+## English
+
+- **Recovery commands and `status --config` now redact machine-specific paths by default (#4860)** — CLI and MCP recovery metadata now sanitizes absolute binary, assembly, source, and database arguments—including path-valued or sensitive file-URI query segments—before rendering support-shareable commands, while `status --config` applies the same default to DB, data, log, and URI-query paths and always masks secrets. Percent-encoded sensitive keys and path values containing sensitive assignments are sanitized without exposing either component. Option-like source names cannot be mistaken for the DB flag. `paths_redacted`, substitution, and redaction metadata make the result explicit; local CLI users can opt into safely quoted resolved path values with `--show-paths`. This completes the residual support-output hardening identified after #4313.
+
+## 日本語
+
+- **復旧コマンドと `status --config` が機械固有のパスを既定で伏せるようになりました (#4860)** — CLI/MCP の復旧 metadata は、path 値や機密値を持つ file URI query segment を含む binary、assembly、source、database の絶対パスを、サポート共有用 command の生成前に sanitization します。`status --config` も DB、data、log、URI query の path に同じ既定を適用し、secret は常に伏せます。percent-encoded な機密 key と、機密 assignment を含む path 値も、どちらの成分も露出させず sanitization します。option と紛らわしい source 名を DB flag と取り違えることもありません。`paths_redacted`、置換要否、redaction metadata で状態を明示し、ローカル CLI では `--show-paths` により安全に quote された解決済み path 値を opt-in できます。これは #4313 後に確認された残余の support-output hardening を完了する変更です。

src/CodeIndex/Cli/CliFlagSchema.cs

@@ -177,6 +177,10 @@ public static bool HasAuthoritativeHelpOptions(string command) =>
     private static readonly string[] BodyCommands = ["definition", "references", "callers", "callees", "impact", "inspect"];
     private static readonly string[] InspectFieldCommands = ["inspect"];
     private static readonly string[] InspectSourceExcerptCommands = ["inspect", "excerpt"];
+    private static readonly string[] RecoveryPathCommands =
+    [
+        "definition", "references", "callers", "callees", "excerpt", "inspect", "impact",
+    ];
 
     private static readonly string[] MaxLineWidthCommands =
     [
@@ -422,7 +426,7 @@ private static IReadOnlyList<CliFlag> BuildAll()
             new() { Name = "--optimize", Description = "Optimize the existing FTS5 table without scanning files", PrimaryCommands = Set("index") },
             new() { Name = "--symbols-only", Description = "Build chunks and symbols while skipping reference graph extraction", PrimaryCommands = Set("index") },
             new() { Name = "--dry-run", Description = "Preview without writing", PrimaryCommands = Set("index", "backfill-fold", "optimize", "vacuum") },
-            new() { Name = "--show-paths", Description = "Show full database paths in maintenance diagnostics; paths are redacted by default", PrimaryCommands = Set("index", "backfill-fold", "optimize", "vacuum", "db") },
+            new() { Name = "--show-paths", Description = "Show resolved local paths in maintenance diagnostics, recovery commands, or status --config output", PrimaryCommands = Set(RecoveryPathCommands.Concat(["index", "backfill-fold", "optimize", "vacuum", "db", "status"]).ToArray()) },
             new() { Name = "--dry-run-path-limit", ValuePlaceholder = "<n>", Description = "Dry run only: candidate path processing limit before truncated lower-bound estimates", PrimaryCommands = Set("index") },
             new() { Name = "--no-checkpoint", Description = "Skip the automatic DB checkpoint before maintenance", PrimaryCommands = Set("backfill-fold") },
             new() { Name = "--force", Description = "Bypass the per-database index lock", PrimaryCommands = Set("index") },
@@ -439,7 +443,7 @@ private static IReadOnlyList<CliFlag> BuildAll()
             new() { Name = "--debounce", ValuePlaceholder = "<ms>", Description = "Watch only: coalesce file events into one update after <ms> of quiet (default 500)", PrimaryCommands = Set("index") },
             new() { Name = "--watch-pending-path-limit", ValuePlaceholder = "<n>", Description = "Watch only: changed-path queue limit before full-rescan fallback", PrimaryCommands = Set("index") },
             new() { Name = "--output", ShortName = "-o", ValuePlaceholder = "<path>", Description = "Report bundle or suggestions export output path", PrimaryCommands = Set("report", "suggestions") },
-            new() { Name = "--redact-paths", Description = "Report: accepted for doctor/report parity; report paths are redacted by default", PrimaryCommands = Set("report") },
+            new() { Name = "--redact-paths", Description = "Redact machine-specific paths (the default for recovery/config JSON and reports)", PrimaryCommands = Set(RecoveryPathCommands.Concat(["status", "report"]).ToArray()) },
             new() { Name = "--no-log", Description = "Exclude global tool log from bundle", PrimaryCommands = Set("report") },
             new() { Name = "--include-args", Description = "Include args in bundle log", PrimaryCommands = Set("report") },
             new() { Name = "--log-lines", ValuePlaceholder = "<n>", Description = "Number of log lines to include in bundle (clamped to 2000)", PrimaryCommands = Set("report") },