feat(tci): log the process behind local TCI clients. Principle VIII.

CMakeLists.txt

@@ -831,6 +831,7 @@ set(CORE_SOURCES
     src/core/SpotCommandPolicy.cpp
     src/core/SpotModeResolver.cpp
     src/core/TciServer.cpp
+    src/core/TciPeerProcess.cpp
     src/core/TciProtocol.cpp
     src/core/TciRoutingState.cpp
     src/core/RadioCertification.cpp
@@ -2142,6 +2143,11 @@ target_link_libraries(aethercore PUBLIC
     aether_afskdemod
     ${CMAKE_DL_LIBS}   # NvidiaAfxFilter dlopen
 )
+if(WIN32)
+    # TciPeerProcess: GetExtendedTcpTable (iphlpapi) + the exe version
+    # resource (version) for the TCI client-identity log line (#5087).
+    target_link_libraries(aethercore PRIVATE iphlpapi version)
+endif()
 
 target_link_libraries(AetherSDR PRIVATE
     qgeoview           # gui/map only

docs/log-redaction.md

@@ -52,6 +52,11 @@ broken real triage before, so do not "fix" them:
 
 - Callsign — FCC public record, and the primary way a report is identified
 - Radio model, firmware and software version (including 4-part build numbers)
+- TCI client identity — the `process="…"` and `version="…"` fields on the
+  `TciServer: client` line (#5087, maintainer ruling on #5130). The client's
+  executable path is never logged; it lives only in the Network Diagnostics
+  tooltip. `version="` is one of the two prefixes that exempt a 4-part
+  number from the IPv4 rule (the other is `ver=`).
 - Port numbers, slice/stream ids, frequencies, modes
 - Identifiers that merely end in a keyword, e.g. `keytoken=`
 - **C++ qualified names** — `WanConnection::sendCommand`, `std::vector`. 48 log

src/core/AsyncLogWriter.cpp

@@ -267,11 +267,14 @@ QString redactPii(const QString& msg)
     out.replace(*ipv6CompressedRe, QStringLiteral("[v6-redacted]"));
 
     // IPv4 addresses: 192.168.50.121 -> *.*.*. 121 (keep last octet).
-    // The word boundary skips v/V-prefixed version strings; the ver=
-    // lookbehind and trailing digit check skip firmware/software versions
-    // with build numbers such as software_ver=4.2.18.41174.
+    // The word boundary skips v/V-prefixed version strings; the ver= and
+    // version=" lookbehinds and the trailing digit check skip
+    // firmware/software versions with build numbers such as
+    // software_ver=4.2.18.41174 and the TCI client identity line's
+    // version="2.2.159.0" (#5087). Quoting alone exempts nothing — only
+    // those two literal prefixes do.
     static const QRegularExpression* ipRe = new QRegularExpression(
-        R"((?<!ver=)\b(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d))(?!\d))");
+        R"((?<!ver=)(?<!version=")\b(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d))(?!\d))");
     out.replace(*ipRe, QStringLiteral("*.*.*. \\1"));
 
     // Radio serial: 4424-1213-8600-7836 -> ****-****-****-7836