fix(status): redact channel base URLs in status-all

ooiuuii · ooiuuii · commit 8f4cd75020a3 · 2026-07-01T21:08:26.000+08:00
diff --git a/src/commands/status-all/channels.test.ts b/src/commands/status-all/channels.test.ts
@@ -122,6 +122,38 @@ describe("buildChannelsTable", () => {
     expect(detailRow?.Notes).toContain("credential not checked");
   });
 
+  it("redacts sensitive channel base URL material in account notes", async () => {
+    mocks.listReadOnlyChannelPluginsForConfig.mockReturnValue([
+      {
+        ...discordPlugin,
+        config: {
+          ...discordPlugin.config,
+          describeAccount: () => ({
+            baseUrl:
+              "https://oc-user:oc-pass@mm.example.com/hooks?token=oc-token-raw&keep=1&api_key=oc-api-key-raw",
+          }),
+        },
+      },
+    ]);
+    mocks.resolveInspectedChannelAccount.mockResolvedValue({
+      account: {
+        tokenStatus: "available",
+        tokenSource: "config",
+      },
+      enabled: true,
+      configured: true,
+    });
+
+    const table = await buildChannelsTable({ channels: { discord: { enabled: true } } });
+
+    const notes = table.details[0]?.rows[0]?.Notes;
+    expect(notes).toContain("https://***:***@mm.example.com/hooks?token=***&keep=1&api_key=***");
+    expect(notes).not.toContain("oc-user");
+    expect(notes).not.toContain("oc-pass");
+    expect(notes).not.toContain("oc-token-raw");
+    expect(notes).not.toContain("oc-api-key-raw");
+  });
+
   it("shows configured official external channels when the plugin is missing", async () => {
     mocks.listReadOnlyChannelPluginsForConfig.mockReturnValue([]);
     mocks.missingOfficialExternalChannels.add("feishu");
diff --git a/src/commands/status-all/channels.ts b/src/commands/status-all/channels.ts
@@ -4,6 +4,7 @@
 import fs from "node:fs";
 import { asRecord } from "@openclaw/normalization-core/record-coerce";
 import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";
+import { redactSensitiveUrlLikeString } from "../../../packages/net-policy/src/redact-sensitive-url.js";
 import { sanitizeForLog } from "../../../packages/terminal-core/src/ansi.js";
 import { resolveInspectedChannelAccount } from "../../channels/account-inspection.js";
 import { hasConfiguredUnavailableCredentialStatus } from "../../channels/account-snapshot-fields.js";
@@ -137,7 +138,7 @@ const buildAccountNotes = (params: {
     notes.push("secret unavailable in this command path");
   }
   if (snapshot.baseUrl) {
-    notes.push(snapshot.baseUrl);
+    notes.push(redactSensitiveUrlLikeString(snapshot.baseUrl));
   }
   if (snapshot.port != null) {
     notes.push(`port:${snapshot.port}`);
