fix(ops): restore redacted gateway diagnostics

[Pigbibi]

Summary

• fix invalid Python shell declarations in manual gateway workflows
• redact account, network, email, and credential-like values from remote diagnostic output
• cover workflow syntax and redaction behavior in CI

Validation

• bash tests/test_install_2fa_bot_watcher.sh
• bash tests/test_wait_for_ib_gateway_ready.sh
• bash tests/test_workflow_shared_config.sh
• bash tests/test_docker_compose_ports.sh
• bash tests/test_redact_gateway_diagnostics.sh
• python3 -m py_compile scripts/redact_gateway_diagnostics.py
• actionlint .github/workflows/*.yml

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: blocking findings were cleared by independent Codex arbitration

⚖️ Codex Review Arbitration

✅ clear: The prior security finding is demonstrably fixed in the cumulative diff. In .github/workflows/diagnose.yml, SSH diagnostic output is now piped through redact_diagnostics, and its sensitive_assignment_pattern explicitly matches optionally quoted sensitive keys with : or = separators, covering structured forms that the prior regex missed. The repository test tests/test_workflow_shared_config.sh extracts that exact Python redactor and asserts redaction for both json={"access_token":"json-secret","other":1} and "cookie": "session-secret; second=value", while also asserting the raw secrets no longer appear in output. That is concrete source-of-truth evidence that the historical blocking leak path has been addressed.

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/diagnose.yml

The new github-script resolver no longer enforces that IB_GATEWAY_TARGETS_JSON is an object or array. targets is built with Object.entries(loaded).map(...), so JSON strings and some other scalar values are silently accepted instead of failing validation, which can produce a bogus matrix (for example, one job per character if the variable is a JSON string) and send later steps down confusing failure paths. The same broken resolver block is copied into capture-screen.yml and remote-maintenance.yml too. (line 35)

Suggestion: Validate loaded before transforming it: explicitly accept only arrays and plain objects, and call core.setFailed("IB_GATEWAY_TARGETS_JSON must be an object or list") for any other JSON type.

2. 🟡 [MEDIUM] Reliability in .github/workflows/diagnose.yml

The inline redactor removes everything from a sensitive key to the end of the line (...\s*[:=]\s*).*(\r?\n)?$). On single-line JSON or structured logs, one token/secret field near the front will erase all later non-sensitive fields, so operators lose the rest of the diagnostic payload exactly when they need it during an incident. (line 243)

Suggestion: Redact only the sensitive value span instead of the remainder of the line. For JSON-like output, match quoted/unquoted value tokens precisely and preserve the rest of the record after the redacted field.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e613732e9b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a478bf20c9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".