Protect RCON diagnostics and redact player addresses (Refs #61)

src/lib/server/pipeline/worker.ts

@@ -24,6 +24,7 @@ import { observedPlayerCapacity } from '../fleet/player-capacity.js';
 import type { PlayerCapacityObservation } from '../../server-capacity.js';
 import { withHostRequestContext } from '../hosts/request-context.js';
 import { withOperationSource } from '../hosts/operation-context.js';
+import { failureReplySnippet } from '../integrations/rcon-diagnostics.js';
 
 const TICK_MS = 15_000;
 const RETENTION_INTERVAL_MS = 5 * 60_000;
@@ -227,7 +228,7 @@ async function refreshServerStatus(server: string, snapshot: MonitoringSnapshot,
                     gameObservation = probe;
                     const now = probe.observedAt;
                     updates.last_checked_at = now;
-                    updates.last_reply_snippet = result.rawReply ?? null;
+                    updates.last_reply_snippet = failureReplySnippet(result);
                     if (result.ok) {
                         capacity = result.status.capacity ?? null;
                         Object.assign(updates, successfulStatusFields(result, now));
@@ -261,7 +262,7 @@ export function statusEntry(srv: ServerRow, observe = serverObservation, capacit
     return { server: srv.name, players: final.last_players, capacity: capacity?.capacity ?? null,
         capacityObservedAt: capacity?.capacity_observed_at ?? null, map: final.last_map ?? srv.map,
         gametype: final.last_gametype, roster: final.roster, health: final.health, lastSeenAt: final.last_seen_at,
-        lastError: final.last_error, replySnippet: final.replySnippet,
+        lastError: final.last_error,
         endpoint: srv.game_port ? { host: srv.rcon_host ?? config.rcon.host, port: srv.game_port } : null, reason: final.last_error ? final.last_error.split(':')[0] as RconFailure : null,
         activeSince: final.active_since, inactiveSince: final.inactive_since,
         gameStartedAt: final.game_started_at, gameEndedAt: final.game_ended_at,