fix(adapters,security): S-4 rss/browser redaction use the shared contracts key table

- contracts: isSensitiveQueryParam (whole-name match on SENSITIVE_QUERY_PARAMS
  or isSensitiveKey), the single source for query credential names
- rss/redact: drop local SENSITIVE_QUERY_KEYS; param checks go through
  isSensitiveQueryParam (+ caller extras); REDACTED re-exported from contracts
- browser/redact: CREDENTIAL_PARAM built from SENSITIVE_QUERY_PARAMS, JSON keys
  also checked with isSensitiveKey; keeps only its own rules (path passkey,
  cookie names, a11y password fields); remove stray regex statement
- redact-consistency.test: 24 credential spellings (pass_key, c_secure_pass,
  refresh_token, password, uid_key, auth, ...) masked by contracts, rss and
  browser alike; plain params untouched; rss extract/unredact round-trip

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/adapters/src/rss/index.ts

@@ -16,7 +16,7 @@ export {
   parseFeed,
   RSS_EXPIRED_MESSAGES,
 } from "./parse.ts";
-export { extractSecretParams, REDACTED, redactText, redactUrl, SENSITIVE_QUERY_KEYS, unredactUrl } from "./redact.ts";
+export { extractSecretParams, REDACTED, redactText, redactUrl, unredactUrl } from "./redact.ts";
 export { buildRssLinkRequest, extractRssLink, RSS_LINK_CONF, type RssLinkConf, rssSiteDomain } from "./rss-link.ts";
 export {
   type FeedCursor,

packages/adapters/src/rss/redact.ts

@@ -1,31 +1,17 @@
+import { isSensitiveQueryParam, REDACTED } from "@umt/contracts";
+
 /**
  * URL/文本脱敏。含 passkey 的 URL 不得进入日志、错误信息、模型上下文(REQ §4.1)。
  * 规则:query 中凭据类参数值替换为 [REDACTED],URL userinfo 一并抹除。
+ * 凭据参数名的键表只有一份,在 `@umt/contracts` 的 redact.ts(SENSITIVE_QUERY_PARAMS / isSensitiveKey)。
  */
 
-export const REDACTED = "[REDACTED]";
-
-/** 视为凭据的 query 参数名(小写比较)。 */
-export const SENSITIVE_QUERY_KEYS: ReadonlySet<string> = new Set([
-  "passkey",
-  "token",
-  "authkey",
-  "auth",
-  "torrent_pass",
-  "rsskey",
-  "apikey",
-  "api_key",
-  "access_token",
-  "secret",
-  "sign",
-  "downhash",
-  "credential",
-  "key",
-]);
+export { REDACTED };
 
+/** 参数判定统一取 `@umt/contracts` 的共享键表(isSensitiveQueryParam);extra 为调用方追加的站点特有参数名 */
 function isSensitiveKey(key: string, extra?: Iterable<string>): boolean {
+  if (isSensitiveQueryParam(key)) return true;
   const k = key.toLowerCase();
-  if (SENSITIVE_QUERY_KEYS.has(k)) return true;
   if (extra) for (const e of extra) if (e.toLowerCase() === k) return true;
   return false;
 }