fix(aria2): harden protocol and torrent transfers

src/utils/downloads.test.ts

@@ -60,6 +60,20 @@ describe('download persistence progress snapshots', () => {
     expect(sanitized.lastResolverFallback).toBeUndefined();
   });
 
+  it('marks redacted downloads that need credentials after restart', () => {
+    const persisted = redactDownloadForPersistence({
+      ...item('paused'),
+      username: 'alice',
+      password: 'secret',
+      cookies: 'session=redacted',
+      headers: 'Authorization: redacted',
+    });
+    expect(persisted.credentialsRequired).toBe(true);
+    expect(persisted.password).toBeUndefined();
+    expect(persisted.cookies).toBeUndefined();
+    expect(persisted.headers).toBeUndefined();
+  });
+
   it.each(['queued', 'staged', 'retrying', 'processing'] as const)(
     'keeps byte counters for %s snapshots',
     (status) => {

src/utils/downloads.ts

@@ -566,6 +566,10 @@ const VOLATILE_PROGRESS_STATUSES = new Set([
  */
 export const redactDownloadForPersistence = (item: DownloadItem): DownloadItem => {
   const copy: DownloadItem = { ...item };
+  if (item.credentialsRequired === true
+    || DOWNLOAD_SECRET_FIELDS.some(field => Boolean(item[field]))) {
+    copy.credentialsRequired = true;
+  }
   delete copy.fraction;
   delete copy.speed;
   delete copy.eta;