fix(diagnostics): redact target userinfo

Author: cv

src/lib/diagnostics/managed-transport.test.ts

@@ -33,6 +33,13 @@ describe("safeTargetRef", () => {
   it("drops query and userinfo from non-URL values", () => {
     expect(safeTargetRef("user:secret@host:8080?token=x")).toBe("host:8080");
   });
+
+  it("drops every userinfo segment before the final at sign", () => {
+    const target = "user:secret@second:credential@host:8080?token=x";
+
+    expect(safeTargetRef(target)).toBe("host:8080");
+    expect(safeTargetRef(target)).not.toContain("credential");
+  });
 });
 
 describe("safeCauseChain", () => {

src/lib/diagnostics/managed-transport.ts

@@ -93,7 +93,8 @@ export function safeTargetRef(value: string): string {
     }
   }
   const withoutQuery = value.split(/[?#]/, 1)[0] ?? "";
-  return withoutQuery.replace(/^[^@]*@/, "");
+  const finalAt = withoutQuery.lastIndexOf("@");
+  return finalAt === -1 ? withoutQuery : withoutQuery.slice(finalAt + 1);
 }
 
 const MAX_CAUSE_DEPTH = 8;