Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

openclaw status --all can print channel account baseUrl values with embedded URL credentials or auth-like query parameters in the pasteable status report.

Steps to reproduce

1. Configure a channel account with a baseUrl that contains URL userinfo or sensitive query parameters, for example a Mattermost base URL shaped like https://user:[email protected]/hooks?token=value&api_key=value.
2. Run openclaw status --all.
3. Inspect the channel account details section.

Expected behavior

The status report should redact URL userinfo and sensitive query parameter values before printing channel account base URLs.

Actual behavior

Before PR #98599, the status-all channel account notes appended snapshot.baseUrl directly. A pasteable support report could therefore include credentials hidden in URL userinfo or auth-like query params.

OpenClaw version

Current main before PR #98599.

Operating system

Windows 11 for the local proof. The affected path is platform-independent status report rendering.

Install method

Source checkout / built local CLI.

Model

N/A

Provider / routing chain

N/A

Logs

After PR #98599, a local built CLI proof with a synthetic Mattermost baseUrl prints:

Mattermost accounts
+----------+----------+------------------------------------------------------------------------------------------------+
| Account  | Status   | Notes                                                                                          |
+----------+----------+------------------------------------------------------------------------------------------------+
| default  | OK       | bot:config · https://***:***@mm.example.com/hooks?token=***&keep=1&api_key=***                 |
+----------+----------+------------------------------------------------------------------------------------------------+

The raw synthetic values oc-user, oc-pass, oc-token-raw, and oc-api-key-raw were not present in the output.

Screenshots, recordings, and evidence

PR #98599 includes focused regression coverage and a local built CLI proof using:

OPENCLAW_CONFIG_PATH=<synthetic config> NO_COLOR=1 FORCE_COLOR=0 OPENCLAW_TEST_FAST=1 node openclaw.mjs status --all --timeout 1

Impact and severity

Affected: operators who paste openclaw status --all output for debugging while a channel account baseUrl contains embedded credentials or auth-like query params.

Severity: Medium. This is a diagnostic data exposure risk in support reports.

Frequency: Reproducible when affected URL-shaped config values are present.

Consequence: Credentials hidden in URLs can be copied into issue reports, chats, or logs.

Additional information

Fix PR: #98599