chore: add buildOutput RTK filter, drop legacy cloud sync, internal cleanup

- feat(rtk): buildOutput filter + autodetect for npm/yarn/cargo logs
- chore: remove unused cloud sync module and related routes
- ui: hide deprecated providers (qwen, iflow, antigravity)
- chore: minor tray/cli/internal adjustments

src/app/api/providers/client/route.js

@@ -2,19 +2,51 @@ import { NextResponse } from "next/server";
 import { getProviderConnections } from "@/lib/localDb";
 import { backfillCodexEmails } from "@/lib/oauth/providers";
 
-// GET /api/providers/client - List all connections for client (includes sensitive fields for sync)
+// Whitelist: only safe metadata fields exposed to UI
+const SAFE_FIELDS = [
+  "id", "provider", "authType", "name", "email", "displayName",
+  "priority", "globalPriority", "isActive", "defaultModel",
+  "testStatus", "lastError", "lastErrorAt", "errorCode",
+  "expiresAt", "lastUsedAt", "consecutiveUseCount",
+  "createdAt", "updatedAt",
+];
+
+// providerSpecificData fields safe to expose (non-secret config only)
+const SAFE_PSD_FIELDS = [
+  "baseUrl", "azureEndpoint", "deployment", "apiVersion", "accountId",
+  "region", "projectId", "resourceUrl", "proxyPoolId",
+  "connectionProxyEnabled", "connectionProxyUrl", "connectionNoProxy",
+  "githubLogin", "githubName", "githubEmail", "githubUserId",
+  "username", "firstName", "lastName", "authMethod", "authKind",
+];
+
+function maskName(name) {
+  if (typeof name !== "string" || name.length <= 16) return name;
+  // Names like "hahask-uDUOg90..." may embed API keys — mask if looks like key
+  if (/[a-zA-Z0-9_-]{32,}/.test(name)) return `${name.slice(0, 8)}***`;
+  return name;
+}
+
+function sanitize(c) {
+  const safe = {};
+  for (const f of SAFE_FIELDS) if (c[f] !== undefined) safe[f] = c[f];
+  if (safe.name) safe.name = maskName(safe.name);
+  if (c.providerSpecificData) {
+    const psd = {};
+    for (const f of SAFE_PSD_FIELDS) {
+      if (c.providerSpecificData[f] !== undefined) psd[f] = c.providerSpecificData[f];
+    }
+    safe.providerSpecificData = psd;
+  }
+  return safe;
+}
+
+// GET /api/providers/client - List connections for dashboard UI (whitelist only)
 export async function GET() {
   try {
     await backfillCodexEmails();
     const connections = await getProviderConnections();
-    
-    // Include sensitive fields for sync to cloud (only accessible from same origin)
-    const clientConnections = connections.map(c => ({
-      ...c,
-      // Don't hide sensitive fields here since this is for internal sync
-    }));
-
-    return NextResponse.json({ connections: clientConnections });
+    return NextResponse.json({ connections: connections.map(sanitize) });
   } catch (error) {
     console.log("Error fetching providers for client:", error);
     return NextResponse.json({ error: "Failed to fetch providers" }, { status: 500 });