fix(mcp): local-path redaction regex misses the most common stack-trace shape, risking a real path leak upstream

[JSONbored]

Context

packages/loopover-mcp/lib/local-branch.js:214-220 (redactLocalPath) and packages/loopover-mcp/bin/loopover-mcp.js:3628-3631 (redactLocalValidationPaths) both gate on a prefix character class (^|[\s"'=])that omits( — the exact prefix Node/Python stack traces use (at Object. (/Users/alice/secretproject/file.js:10:5)). Verified directly: redactLocalPath("at Object. (/Users/alice/secretproject/file.js:10:5)")` returns the string unredacted, while a space-prefixed path redacts correctly.

The bin/ copy is the more serious instance: it sanitizes --validation/--validation-summary text (sanitizeValidationText → validationEntry) that flows into analyzeCurrentBranch/buildBranchAnalysisPayload and is POSTed to the LoopOver API — so a local absolute path embedded in pasted test-runner stack-trace output can leak upstream despite the function's entire purpose being to strip exactly this.

Requirements

• Add ( to the prefix character class both redactLocalPath and redactLocalValidationPaths gate on, so a parenthesis-prefixed path is redacted the same as a space-prefixed one.
• Verify no other common prefix shape (e.g. a path immediately following : in file:///... or similar) is also missed while fixing this — a thorough fix, not just the one reproduced case.

Test Coverage Requirements

99%+ Codecov patch coverage on both functions' changed branches; add a regression test for the exact stack-trace-shaped input above for both redactLocalPath and redactLocalValidationPaths.

Deliverables

• Both redaction functions correctly redact a (-prefixed local path.
• Regression tests for both.

Expected Outcome

A local absolute path embedded in stack-trace-shaped validation output is redacted before ever being sent to the LoopOver API, closing a real privacy leak.

Links & Resources

• packages/loopover-mcp/lib/local-branch.js:214-220
• packages/loopover-mcp/bin/loopover-mcp.js:3628-3631

[linear-code]

JSO-4342