Security Patch

[gajendraxdev]

Summary by CodeRabbit

• New Features

  • Added a friendly AI setup/auth error card with a one-click shortcut to AI settings.
  • Settings can now open directly to a specific tab (including AI).

• Bug Fixes

  • Vault list, dialogs, confirmations, notifications, and connection labels now consistently respect the host-address privacy toggle.
  • Improved resilience to incomplete AI configuration and missing/invalid API key handling, including clearer guidance and better provider selection/persistence.
  • Fixed AI settings updates to avoid overwriting concurrent changes; improved agent-mode routing for short/greeting inputs.

• Chores

  • Updated app versions to 2.22.2.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0a06b673-a35d-49d0-93d7-28ee4645e926

📥 Commits

Reviewing files that changed from the base of the PR and between 9d196bc and 164d3e3.

📒 Files selected for processing (2)

• src/features/connections/domain/connectionDisplay.ts
• tests/connectionDisplay.test.mjs

---

📝 Walkthrough

Walkthrough

This release updates AI configuration recovery, provider setup errors, agent submission routing, settings deep links, AI persistence rollback, and privacy-aware vault labels. It also adds related tests and bumps the application version to 2.22.2.

Changes

AI configuration and setup flows

Layer / File(s)	Summary
AI configuration defaults and recovery src-tauri/src/ai/types.rs, src-tauri/src/ai/config.rs	AiConfig now supports explicit defaults, partial deserialization, and soft recovery for incomplete AI settings.
AI setup errors and submission routing src/components/ai/*, tests/sidebarSubmit.test.mjs	AI setup errors use shared friendly messages and settings CTAs, missing provider keys are detected before submission, and agent input always follows the agent path.
Settings deep links and AI persistence src/store/settingsSlice.ts, src/components/settings/SettingsModal.tsx	Settings can open on a requested tab, while AI updates persist merged state and scope rollback to changed keys.
Release metadata CHANGELOG.md, package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json	Release notes and application versions are updated to 2.22.2.

Vault privacy-aware labels

Layer / File(s)	Summary
Privacy formatting and default vault labels src/features/connections/domain/connectionDisplay.ts, src/components/modals/useAutoVault.ts, tests/connectionDisplay.test.mjs	Shared helpers redact endpoint data when required and generate key-vault labels without raw user-host endpoints.
Privacy-aware vault interfaces src/components/settings/tabs/vault/*	Vault titles, lists, connection rows, controls, and accessibility labels now follow the host-address visibility setting.
Privacy-safe vault actions src/components/settings/tabs/vault/hooks/*, src/components/settings/tabs/vault/privacyLabel.ts	Assignment, restore, sync, and delete messages use privacy-transformed labels.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AiSidebar
  participant ProviderKeyStore
  participant AiSetupErrorCard
  participant SettingsModal
  AiSidebar->>ProviderKeyStore: Load saved provider key
  ProviderKeyStore-->>AiSidebar: Return key or missing-key result
  AiSidebar->>AiSetupErrorCard: Render setup error
  AiSetupErrorCard->>SettingsModal: Open AI settings tab

Loading

Possibly related PRs

• zync-sh/zync#65: Related to AI configuration parsing and effective settings behavior.
• zync-sh/zync#82: Related to the connection and privacy label helpers reused by vault updates.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is generic and does not describe the specific AI, vault privacy, or settings changes in this patch.	Rename the PR to summarize the main change, such as AI setup/error handling and vault privacy label updates.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix vault privacy, AI settings parsing, and missing-key UX (2.22.2)

🐞 Bug fix ✨ Enhancement 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Redact host/IP details in vault labels and related modals when privacy is off.
• Harden AI settings persistence/deserialization; prevent unintended provider and mode fallbacks.
• Show missing/invalid API key errors inline with a Settings → AI deep link.

Diagram

graph TD
  A["Settings store (settingsSlice)"] --> B["Settings modal"] --> C["AI sidebar"] --> D["AI chat thread"]
  A --> E["connectionDisplay utils"] --> F["Vault UI (lists/modals/toasts)"]
  C --> G["Tauri AI config (Rust)"]
  D --> B

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Persist normalized privacy-safe vault labels

• ➕ Eliminates need for runtime redaction across all vault surfaces
• ➕ Avoids future regressions when new UI surfaces are added
• ➖ Mutates stored user data and may remove information users intentionally encoded
• ➖ Requires migration logic and careful handling of existing labels and history

2. Typed error codes for AI setup failures (vs string matching)

• ➕ More robust than regex/string matching across providers and translations
• ➕ Easier to localize and to attach structured CTAs (e.g., open Settings, retry)
• ➖ Requires backend/API changes and coordination across UI and Tauri layers
• ➖ More invasive than the current patch-level UX fix

3. Schema-versioned AI settings with explicit migrations

• ➕ Clear forward/backward compatibility story for partial/older settings shapes
• ➕ Keeps deserialization logic simpler over time
• ➖ More code and ongoing maintenance for a relatively small settings object
• ➖ Overkill if settings shape changes remain infrequent

Recommendation: Current approach is appropriate for a patch release: keep stored data unchanged (privacy via display-only redaction), tolerate partial AI config by merging with defaults, and improve UX with an inline error card + Settings deep link. If AI provider set grows or error UX becomes more complex, consider moving to typed error codes to remove reliance on string matching.

Files changed (28) +575 / -117

Enhancement (7) +204 / -8

AiChatMessage.tsxRender AI errors via shared setup error card +6/-5

Render AI errors via shared setup error card

• Replaces the inline error bubble with AiSetupErrorCard and wires in the active provider from settings. Standardizes messaging and enables Settings → AI navigation when appropriate.

src/components/ai/AiChatMessage.tsx

AiSetupErrorCard.tsxAdd reusable in-chat AI setup/auth error UI with Settings CTA +44/-0

Add reusable in-chat AI setup/auth error UI with Settings CTA

• Introduces a chat-inline error card that maps raw errors to friendly copy and conditionally shows a one-click 'Open Settings → AI' button. Provider can be passed explicitly or inferred from settings.

src/components/ai/AiSetupErrorCard.tsx

ConversationThread.tsxUse AiSetupErrorCard for agent error bubbles +6/-3

Use AiSetupErrorCard for agent error bubbles

• Replaces the prior red error bubble UI with AiSetupErrorCard to unify AI error presentation and support Settings deep-linking.

src/components/ai/ConversationThread.tsx

aiSetupErrors.tsCentralize AI setup error copy and friendly error mapping +67/-0

Centralize AI setup error copy and friendly error mapping

• Adds shared messages for Ollama readiness and model selection, plus helpers to detect key-required providers and map backend errors into chat-friendly text + CTA visibility. Normalizes Settings arrow formatting and supports provider-labeled key messages.

src/components/ai/aiSetupErrors.ts

SettingsModal.tsxSupport deep-linking Settings to a focused tab +9/-0

Support deep-linking Settings to a focused tab

• Adds an effect to focus SettingsModal on a requested tab when opened, then clears the focus request. Enables one-click navigation from chat errors into Settings → AI.

src/components/settings/SettingsModal.tsx

privacyLabel.tsAdd settings-backed privacyLabel helper for vault messages +13/-0

Add settings-backed privacyLabel helper for vault messages

• Introduces a helper that reads the current privacy setting from the store and formats labels via formatPrivacyAwareLabel. Provides a single place to apply privacy rules for confirms/toasts.

src/components/settings/tabs/vault/privacyLabel.ts

connectionDisplay.tsAdd privacy-aware label redaction and safer default vault key labels +59/-0

Add privacy-aware label redaction and safer default vault key labels

• Adds formatPrivacyAwareLabel to strip embedded user@host patterns and redact literal IPv4 when privacy mode is off. Adds buildDefaultKeyVaultLabel to ensure newly created key labels never embed endpoints and avoid using raw IPs as label stems.

src/features/connections/domain/connectionDisplay.ts

Bug fix (15) +251 / -99

config.rsSoft-parse partial AI config instead of falling back to defaults +29/-11

Soft-parse partial AI config instead of falling back to defaults

• Replaces hard failure behavior with a tolerant merge: when AI config JSON is missing fields, merges non-null overlay values into default config and retries deserialization. Prevents silent provider/model resets when settings.ai is partial.

src-tauri/src/ai/config.rs

types.rsAdd serde defaults for AiConfig fields +32/-1

Add serde defaults for AiConfig fields

• Introduces explicit serde defaults for provider, enabled, and ollama URL, and provides a manual Default impl. Ensures partial AI config objects still deserialize successfully.

src-tauri/src/ai/types.rs

AiSidebar.tsxFail fast for missing API keys and keep Agent mode from flipping to Ask +61/-33

Fail fast for missing API keys and keep Agent mode from flipping to Ask

• Adds provider API-key precheck for BYOK providers and posts setup/auth errors directly into the active chat thread (Ask or Agent) with consistent copy. Removes greeting-based auto-routing from Agent to Ask and centralizes setup-error posting logic.

src/components/ai/AiSidebar.tsx

sidebarSubmit.tsRemove greeting heuristic that rerouted Agent to Ask +0/-5

Remove greeting heuristic that rerouted Agent to Ask

• Deletes shouldTreatAgentInputAsAsk, ensuring agent submissions are not silently rerouted based on short greetings.

src/components/ai/sidebarSubmit.ts

useAutoVault.tsGenerate default key vault labels without embedding user@host +6/-2

Generate default key vault labels without embedding user@host

• Switches default secured-key vault label generation to buildDefaultKeyVaultLabel, avoiding endpoint leakage in newly-created labels by design.

src/components/modals/useAutoVault.ts

CredentialHistoryModal.tsxRedact vault item labels in history modal when privacy is off +15/-5

Redact vault item labels in history modal when privacy is off

• Applies formatPrivacyAwareLabel to modal title, revision labels, and aria-labels using the current show-host-addresses setting. Prevents IP/endpoint leakage in demos and screenshots.

src/components/settings/tabs/vault/CredentialHistoryModal.tsx

ManageAssignmentsModal.tsxUse privacy-aware connection labels in assignments modal +14/-5

Use privacy-aware connection labels in assignments modal

• Updates list rendering to use getConnectionDisplayLabels and redacts item label in modal title based on privacy setting. Avoids showing username@host:port when privacy is disabled.

src/components/settings/tabs/vault/ManageAssignmentsModal.tsx

RestoreConflictModal.tsxRedact conflict labels based on privacy toggle +4/-1

Redact conflict labels based on privacy toggle

• Formats conflict item labels via formatPrivacyAwareLabel so restore previews do not expose embedded endpoints when privacy is off.

src/components/settings/tabs/vault/RestoreConflictModal.tsx

RotateCredentialModal.tsxMake rotate modal titles privacy-aware +8/-1

Make rotate modal titles privacy-aware

• Uses formatPrivacyAwareLabel for the rotate modal title to avoid exposing embedded endpoints under privacy mode.

src/components/settings/tabs/vault/RotateCredentialModal.tsx

VaultCredentialDetailModal.tsxApply privacy-aware labels for credential detail and assigned hosts +22/-12

Apply privacy-aware labels for credential detail and assigned hosts

• Redacts credential labels in titles and uses getConnectionDisplayLabels for assigned host display, preventing endpoint leakage across detail views.

src/components/settings/tabs/vault/VaultCredentialDetailModal.tsx

VaultItemsPanel.tsxRedact vault list item labels and aria attributes +15/-8

Redact vault list item labels and aria attributes

• Uses formatPrivacyAwareLabel for list display and all related aria-label/title strings (inspect/sync/history/delete). Ensures privacy toggle consistently affects vault list UI.

src/components/settings/tabs/vault/VaultItemsPanel.tsx

useAssignCredentialModal.tsUse privacy-safe labels in assignment toasts/prompts +4/-2

Use privacy-safe labels in assignment toasts/prompts

• Routes user-visible confirm/toast strings through privacyLabel so messages don't leak endpoints when privacy is disabled.

src/components/settings/tabs/vault/hooks/useAssignCredentialModal.ts

useHistoryModal.tsUse privacy-safe labels in restore confirm/toast messages +5/-3

Use privacy-safe labels in restore confirm/toast messages

• Updates confirm dialog text, success toasts, and disconnect prompts to use privacyLabel instead of raw vault labels.

src/components/settings/tabs/vault/hooks/useHistoryModal.ts

useVaultPanelActions.tsRedact labels in sync/delete confirmations and toasts +7/-4

Redact labels in sync/delete confirmations and toasts

• Applies privacyLabel to sync and delete workflows so user-visible strings do not reveal embedded IPs/endpoints under privacy mode.

src/components/settings/tabs/vault/hooks/useVaultPanelActions.ts

settingsSlice.tsPersist full AI settings object and add Settings tab deep-link API +29/-6

Persist full AI settings object and add Settings tab deep-link API

• Adds SettingsTabId + settingsFocusTab state and extends openSettings(tab?) to support focusing a specific tab on open. Updates updateAiSettings to always persist the full ai object and to rollback only changed keys on failure to preserve concurrent updates.

src/store/settingsSlice.ts

Tests (2) +106 / -7

connectionDisplay.test.mjsAdd unit tests for privacy-aware label formatting and vault label defaults +45/-0

Add unit tests for privacy-aware label formatting and vault label defaults

• Extends tests to cover formatPrivacyAwareLabel redaction behavior and buildDefaultKeyVaultLabel rules (no embedded endpoints; avoid IP-based stems).

tests/connectionDisplay.test.mjs

sidebarSubmit.test.mjsUpdate sidebar submit tests after removing greeting-based routing +61/-7

Update sidebar submit tests after removing greeting-based routing

• Replaces shouldTreatAgentInputAsAsk tests with coverage for submitAskQuery and submitAgentGoal behaviors (context collection, run start, input reset).

tests/sidebarSubmit.test.mjs

Documentation (1) +11 / -0

CHANGELOG.mdDocument 2.22.2 security/privacy and AI fixes +11/-0

Document 2.22.2 security/privacy and AI fixes

• Adds a 2.22.2 release entry describing vault privacy redaction, AI settings hardening, agent routing behavior, and missing-key UX improvements. Updates bullets to reference the release commit hash for consistency.

CHANGELOG.md

Other (3) +3 / -3

package.jsonBump app version to 2.22.2 +1/-1

Bump app version to 2.22.2

• Updates the npm package version from 2.22.1 to 2.22.2 to match the release.

package.json

Cargo.tomlBump Tauri crate version to 2.22.2 +1/-1

Bump Tauri crate version to 2.22.2

• Updates the Rust package version to 2.22.2 for the desktop app build.

src-tauri/Cargo.toml

tauri.conf.jsonBump Tauri config version to 2.22.2 +1/-1

Bump Tauri config version to 2.22.2

• Updates the Tauri config version to align with the release versioning.

src-tauri/tauri.conf.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. IPv6 privacy leak ✓ Resolved 🐞 Bug ⛨ Security

Description

When Settings → General → Show host addresses in lists is OFF, formatPrivacyAwareLabel() redacts
user@host and IPv4 literals but can still display standalone IPv6 literals (e.g. "fe80::1") and bare
bracketed endpoints like "user@[fe80::1]", leaking host addresses in vault list/modal labels. Vault
UI components now use this helper for display, so this gap undermines the privacy-mode guarantee for
IPv6 users.

Code

src/features/connections/domain/connectionDisplay.ts[R130-160]

+const IPV4_IN_TEXT_RE = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
+// Bare `user@host` / `user@host:port` (host may be IPv4, hostname, or simple IPv6).
+const BARE_USER_HOST_RE = /([^\s@()[\]]+)@([^\s@()[\],;]+)(?::\d+)?/g;
+
+/**
+ * Privacy-safe display for free-text labels that may embed endpoints
+ * (e.g. vault items like `ci-staging key (jenkins@140.238.226.234)`).
+ * Does not rewrite stored data — display only.
+ *
+ * Contract when `showHostAddressesInLists` is false:
+ * - Strip embedded `user@host` endpoints (parenthetical or bare), any host form.
+ * - Redact leftover literal IPv4.
+ * - Standalone non-IP hostnames used as display names (not `user@host`) stay visible —
+ *   same intent as {@link getConnectionPrimaryLabel}.
+ */
+export function formatPrivacyAwareLabel(
+    label: string,
+    showHostAddressesInLists: boolean = DEFAULT_SHOW_HOST_ADDRESSES_IN_LISTS,
+): string {
+    if (showHostAddressesInLists || !label) return label;
+
+    // `(user@host[:port])` → `(user)` (common auto-vault naming)
+    let result = label.replace(/\(([^@()\s]+)@[^)\s]+\)/g, '($1)');
+
+    // Bare `user@host[:port]` → `user` (IPs and hostnames)
+    result = result.replace(BARE_USER_HOST_RE, '$1');
+
+    // Any remaining literal IPv4
+    result = result.replace(IPV4_IN_TEXT_RE, '•••');
+
+    return result.replace(/\(\s*\)/g, '').replace(/\s{2,}/g, ' ').trim();

Relevance

⭐⭐⭐ High

Repo prioritizes privacy/security leaks; showHostAddressesInLists introduced in PR#82; similar
leakage fixes accepted (PR#85).

PR-#82
PR-#85

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new privacy helper only redacts IPv4 literals and uses an endpoint regex that excludes bracketed
hosts, so certain IPv6 address forms remain visible in privacy mode. Vault list UI now renders
labels through this helper, and existing tests cover only IPv4 cases (no IPv6 coverage), making the
leak unguarded by tests.

src/features/connections/domain/connectionDisplay.ts[130-161]
src/features/connections/domain/connectionDisplay.ts[6-14]
src/components/settings/tabs/vault/VaultItemsPanel.tsx[114-131]
tests/connectionDisplay.test.mjs[142-167]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`formatPrivacyAwareLabel()` is intended to remove host addresses when `showHostAddressesInLists` is false, but it currently:
- only redacts leftover IPv4 literals (`IPV4_IN_TEXT_RE`), and
- does not match bare bracketed IPv6 endpoints like `user@[fe80::1]` (because `BARE_USER_HOST_RE` excludes `[`/`]`).

As a result, IPv6 addresses can still appear in privacy mode in vault UI surfaces that call this helper.

### Issue Context
The helper is now used to render vault item labels in lists/modals (e.g. `VaultItemsPanel`), so any unredacted host literals are visible during demos/screenshares.

### Fix Focus Areas
- src/features/connections/domain/connectionDisplay.ts[130-161]
- tests/connectionDisplay.test.mjs[142-167]
- src/components/settings/tabs/vault/VaultItemsPanel.tsx[114-131]

### Implementation notes
- Add an IPv6-in-text redaction step (e.g., `IPV6_IN_TEXT_RE`) similar to `IPV4_IN_TEXT_RE`.
- Extend endpoint stripping to handle bracketed IPv6 in bare form (e.g., match `user@\[[^\]]+\](:port)?` and reduce to `user`).
- Add regression tests for:
 - `formatPrivacyAwareLabel('backup fe80::1 key', false)`
 - `formatPrivacyAwareLabel('ops@[fe80::1]', false)`
 - (optional) `formatPrivacyAwareLabel('key (ops@[fe80::1])', false)` to confirm existing behavior stays correct.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/features/connections/domain/connectionDisplay.ts`:
- Around line 182-184: Update buildDefaultKeyVaultLabel so bracketed IPv6 hosts
are normalized by removing their surrounding brackets before calling
isLikelyIpAddress. Ensure bracketed IP addresses are treated like unbracketed
IPs and do not become the label stem, while preserving existing behavior for
hostnames and other host formats.

In `@src/store/settingsSlice.ts`:
- Around line 452-462: Update the rollback logic in the AI settings persistence
catch block to revert each changed key only when the current value still equals
this call’s optimistic nextAi value. Build rollbackPatch from that per-key
comparison, preserving newer concurrent values while retaining the existing
state update flow.

In `@tests/sidebarSubmit.test.mjs`:
- Line 17: Update runTest to await the callback before logging PASS, keeping the
await inside its existing try/catch so rejected promises are handled and
reported as failures. Ensure both asynchronous test callbacks complete before
runTest returns.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b118b700-469b-4bed-8110-4c6f4dcc2da4

📥 Commits

Reviewing files that changed from the base of the PR and between 7d58bc3 and a4687a4.

⛔ Files ignored due to path filters (1)

• src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (28)

• CHANGELOG.md
• package.json
• src-tauri/Cargo.toml
• src-tauri/src/ai/config.rs
• src-tauri/src/ai/types.rs
• src-tauri/tauri.conf.json
• src/components/ai/AiChatMessage.tsx
• src/components/ai/AiSetupErrorCard.tsx
• src/components/ai/AiSidebar.tsx
• src/components/ai/ConversationThread.tsx
• src/components/ai/aiSetupErrors.ts
• src/components/ai/sidebarSubmit.ts
• src/components/modals/useAutoVault.ts
• src/components/settings/SettingsModal.tsx
• src/components/settings/tabs/vault/CredentialHistoryModal.tsx
• src/components/settings/tabs/vault/ManageAssignmentsModal.tsx
• src/components/settings/tabs/vault/RestoreConflictModal.tsx
• src/components/settings/tabs/vault/RotateCredentialModal.tsx
• src/components/settings/tabs/vault/VaultCredentialDetailModal.tsx
• src/components/settings/tabs/vault/VaultItemsPanel.tsx
• src/components/settings/tabs/vault/hooks/useAssignCredentialModal.ts
• src/components/settings/tabs/vault/hooks/useHistoryModal.ts
• src/components/settings/tabs/vault/hooks/useVaultPanelActions.ts
• src/components/settings/tabs/vault/privacyLabel.ts
• src/features/connections/domain/connectionDisplay.ts
• src/store/settingsSlice.ts
• tests/connectionDisplay.test.mjs
• tests/sidebarSubmit.test.mjs

💤 Files with no reviewable changes (1)

• src/components/ai/sidebarSubmit.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/features/connections/domain/connectionDisplay.ts`:
- Around line 140-141: Update IPV6_BRACKETED_IN_TEXT_RE to require at least two
colons within bracketed hosts while retaining the existing hexadecimal, dot, and
bracket matching. Preserve redaction of valid bracketed IPv6 forms and stop
matching ordinary labels such as [1], [db], or [0].

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fc434907-08f4-4092-ab26-e3ae1d6c5c78

📥 Commits

Reviewing files that changed from the base of the PR and between a4687a4 and 9d196bc.

📒 Files selected for processing (5)

• CHANGELOG.md
• src/features/connections/domain/connectionDisplay.ts
• src/store/settingsSlice.ts
• tests/connectionDisplay.test.mjs
• tests/sidebarSubmit.test.mjs

🚧 Files skipped from review as they are similar to previous changes (4)

• CHANGELOG.md
• tests/connectionDisplay.test.mjs
• tests/sidebarSubmit.test.mjs
• src/store/settingsSlice.ts