fix(doctor): redact gateway health targets

giodl73-repo · giodl73-repo · commit 1b00f70e3c02 · 2026-06-27T17:05:53.000-07:00
diff --git a/src/flows/doctor-core-checks.runtime.test.ts b/src/flows/doctor-core-checks.runtime.test.ts
@@ -579,6 +579,31 @@ describe("doctor gateway runtime checks", () => {
     });
   });
 
+  it("redacts sensitive remote gateway URLs from health finding targets", async () => {
+    mocks.buildGatewayProbeConnectionDetails.mockResolvedValueOnce({
+      url: "wss://user:pass@gateway.example.test/rpc?token=secret&safe=value",
+    });
+    mocks.probeGatewayStatus.mockResolvedValueOnce({
+      ok: false,
+      error: "remote gateway did not answer",
+    });
+
+    const findings = await collectGatewayHealthFindings({
+      cfg: { gateway: { mode: "remote", remote: { url: "wss://gateway.example.test/rpc" } } },
+    });
+
+    expect(findings).toContainEqual({
+      checkId: "core/doctor/gateway-health",
+      severity: "warning",
+      message: "Gateway is not reachable: remote gateway did not answer",
+      path: "gateway.remote.url",
+      target: "wss://***:***@gateway.example.test/rpc?token=***&safe=value",
+      fixHint: "Verify the remote Gateway URL, network path, TLS settings, and credentials.",
+    });
+    expect(JSON.stringify(findings)).not.toContain("user:pass");
+    expect(JSON.stringify(findings)).not.toContain("token=secret");
+  });
+
   it("reports missing local gateway daemon service", async () => {
     mocks.readGatewayServiceState.mockResolvedValueOnce({
       installed: false,
diff --git a/src/flows/doctor-core-checks.runtime.ts b/src/flows/doctor-core-checks.runtime.ts
@@ -1,4 +1,5 @@
 // Doctor runtime checks inspect tool names, browser residue, and runtime state.
+import { redactSensitiveUrlLikeString } from "@openclaw/net-policy/redact-sensitive-url";
 import { TOOL_NAME_SEPARATOR } from "../agents/agent-bundle-mcp-names.js";
 import {
   type McpToolCatalogDiagnostic,
@@ -52,6 +53,10 @@ type BundleMcpToolRuntime = Awaited<ReturnType<typeof createBundleMcpToolRuntime
 const PROVIDER_CATALOG_ORDERS = ["simple", "profile", "paired", "late"] as const;
 const PROVIDER_CATALOG_ORDER_SET = new Set<ProviderCatalogOrder>(PROVIDER_CATALOG_ORDERS);
 
+function formatGatewayHealthTarget(url: string): string {
+  return redactSensitiveUrlLikeString(url);
+}
+
 export function detectUnavailableSkills(cfg: OpenClawConfig): SkillStatusEntry[] {
   const agentId = resolveDefaultAgentId(cfg);
   const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
@@ -77,7 +82,7 @@ export async function collectGatewayHealthFindings(
         checkId: "core/doctor/gateway-health",
         severity: "warning",
         message: `Gateway health probe could not be prepared: ${formatErrorMessage(error)}`,
-        path: ctx.cfg.gateway?.mode === "remote" ? "gateway.url" : "gateway",
+        path: ctx.cfg.gateway?.mode === "remote" ? "gateway.remote.url" : "gateway",
         fixHint:
           "Fix Gateway connection configuration, then rerun `openclaw doctor --lint --only core/doctor/gateway-health`.",
       },
@@ -101,8 +106,8 @@ export async function collectGatewayHealthFindings(
       checkId: "core/doctor/gateway-health",
       severity: "warning",
       message: `Gateway is not reachable: ${probe.error ?? "status probe failed"}`,
-      path: mode === "remote" ? "gateway.url" : "gateway.mode",
-      target: probeDetails.url,
+      path: mode === "remote" ? "gateway.remote.url" : "gateway.mode",
+      target: formatGatewayHealthTarget(probeDetails.url),
       fixHint:
         mode === "remote"
           ? "Verify the remote Gateway URL, network path, TLS settings, and credentials."
