fix(auto-reply): redact secrets in /debug show and /debug set output

Alix-007 · Alix-007 · commit 6041b7ae9cc5 · 2026-06-15T23:09:58.000+08:00
PR #88496 routed /config show and /config set chat output through the shared schema-aware redaction path, but the sibling /debug commands in the same handler were left untouched. /debug show JSON-stringified the full runtime override tree verbatim and /debug set echoed the raw value, so a secret-shaped override (e.g. gateway.auth.token, channels.*.botToken) set via /debug set was rendered in plaintext to chat-visible output. Apply redactConfigObject(overrides, schema.uiHints) to the override tree before rendering /debug show, and reuse formatConfigSetValueLabel for the /debug set acknowledgement, matching the existing /config redaction contract. Non-secret fields and env placeholders are preserved.
diff --git a/src/auto-reply/reply/commands-config.ts b/src/auto-reply/reply/commands-config.ts
@@ -248,7 +248,9 @@ export const handleDebugCommand: CommandHandler = async (params, allowTextComman
         reply: { text: "⚙️ Debug overrides: (none)" },
       };
     }
-    const json = JSON.stringify(overrides, null, 2);
+    const schema = loadGatewayRuntimeConfigSchema();
+    const redactedOverrides = redactConfigObject(overrides, schema.uiHints);
+    const json = JSON.stringify(redactedOverrides, null, 2);
     return {
       shouldContinue: false,
       reply: {
@@ -292,8 +294,14 @@ export const handleDebugCommand: CommandHandler = async (params, allowTextComman
         reply: { text: `⚠️ ${result.error ?? "Invalid override."}` },
       };
     }
-    const valueLabel =
-      typeof debugCommand.value === "string"
+    const parsedOverridePath = parseConfigPath(debugCommand.path);
+    const valueLabel = parsedOverridePath.path
+      ? formatConfigSetValueLabel({
+          path: parsedOverridePath.path,
+          value: debugCommand.value,
+          uiHints: loadGatewayRuntimeConfigSchema().uiHints,
+        })
+      : typeof debugCommand.value === "string"
         ? `"${debugCommand.value}"`
         : JSON.stringify(debugCommand.value);
     return {
diff --git a/src/auto-reply/reply/commands-gating.test.ts b/src/auto-reply/reply/commands-gating.test.ts
@@ -182,6 +182,20 @@ vi.mock("./debug-commands.js", () => ({
     if (!raw.startsWith("/debug")) {
       return null;
     }
+    const parts = raw.trim().split(/\s+/);
+    const action = parts[1];
+    if (action === "set") {
+      const assignment = raw.slice(raw.indexOf(" set ") + 5).trim();
+      const equalsIndex = assignment.indexOf("=");
+      return {
+        action: "set",
+        path: assignment.slice(0, equalsIndex),
+        value: JSON.parse(assignment.slice(equalsIndex + 1)),
+      };
+    }
+    if (action === "unset") {
+      return { action: "unset", path: parts.slice(2).join(" ") };
+    }
     return { action: "show" };
   }),
 }));
@@ -527,6 +541,56 @@ describe("command gating", () => {
     expect(output).not.toContain("OPENCLAW_CONFIG_SET_CANARY_TOKEN_65623");
   });
 
+  it("redacts secret-shaped fields from /debug show replies", async () => {
+    getConfigOverridesMock.mockReturnValueOnce({
+      gateway: {
+        auth: {
+          token: "OPENCLAW_DEBUG_SHOW_CANARY_TOKEN_65623",
+        },
+      },
+      channels: {
+        telegram: {
+          botToken: "OPENCLAW_DEBUG_SHOW_CANARY_BOT_TOKEN_65623",
+        },
+      },
+      messages: {
+        ackReaction: ":)",
+      },
+    });
+    const params = buildParams("/debug show", {
+      commands: { debug: true, text: true },
+      channels: { whatsapp: { allowFrom: ["*"] } },
+    } as OpenClawConfig);
+    params.command.senderIsOwner = true;
+
+    const result = await handleDebugCommand(params, true);
+    const output = result?.reply?.text ?? "";
+
+    expect(output).toContain("Debug overrides (memory-only)");
+    expect(output).toContain(REDACTED_SENTINEL);
+    expect(output).toContain("ackReaction");
+    expect(output).not.toContain("OPENCLAW_DEBUG_SHOW_CANARY_TOKEN_65623");
+    expect(output).not.toContain("OPENCLAW_DEBUG_SHOW_CANARY_BOT_TOKEN_65623");
+  });
+
+  it("redacts secret-shaped values from /debug set acknowledgements", async () => {
+    const params = buildParams(
+      '/debug set gateway.auth.token="OPENCLAW_DEBUG_SET_CANARY_TOKEN_65623"',
+      {
+        commands: { debug: true, text: true },
+        channels: { whatsapp: { allowFrom: ["*"] } },
+      } as OpenClawConfig,
+    );
+    params.command.senderIsOwner = true;
+
+    const result = await handleDebugCommand(params, true);
+    const output = result?.reply?.text ?? "";
+
+    expect(output).toContain("Debug override set: gateway.auth.token=");
+    expect(output).toContain(REDACTED_SENTINEL);
+    expect(output).not.toContain("OPENCLAW_DEBUG_SET_CANARY_TOKEN_65623");
+  });
+
   it("returns explicit unauthorized replies for native privileged commands", async () => {
     const configParams = buildParams("/config show", {
       commands: { config: true, text: true },
