fix(status): redact channel base URLs in status-all by ooiuuii · Pull Request #98599 · openclaw/openclaw

ooiuuii · 2026-07-01T11:37:34Z

What Problem This Solves

openclaw status --all builds a pasteable support report, but channel account notes printed snapshot.baseUrl verbatim. If a channel plugin or account summary includes credentials in URL userinfo or auth-like query params, those values can appear in the status report even though token fields are summarized safely.

Why This Change Was Made

This redacts URL userinfo and sensitive query params before channel base URLs are added to status notes, while keeping ordinary URLs readable.

User Impact

Operators can paste openclaw status --all output without leaking credentials hidden inside channel base URLs.

Evidence

node scripts/run-vitest.mjs src/commands/status-all/channels.test.ts
pnpm exec oxlint src/commands/status-all/channels.ts src/commands/status-all/channels.test.ts
pnpm exec oxfmt --check src/commands/status-all/channels.ts src/commands/status-all/channels.test.ts
git diff --check
node scripts/build-all.mjs cliStartup
OPENCLAW_CONFIG_PATH=<synthetic config> NO_COLOR=1 FORCE_COLOR=0 OPENCLAW_TEST_FAST=1 node openclaw.mjs status --all --timeout 1
python .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main

CLI proof excerpt from the synthetic Mattermost baseUrl:

Mattermost accounts
+----------+----------+------------------------------------------------------------------------------------------------+
| Account  | Status   | Notes                                                                                          |
+----------+----------+------------------------------------------------------------------------------------------------+
| default  | OK       | bot:config - https://***:***@mm.example.com/hooks?token=***&keep=1&api_key=***                 |
+----------+----------+------------------------------------------------------------------------------------------------+

The proof config used synthetic values oc-user, oc-pass, oc-token-raw, and oc-api-key-raw; none appeared in the status --all output.

clawsweeper · 2026-07-01T12:26:19Z

Codex review: needs maintainer review before merge. Reviewed July 2, 2026, 11:23 PM ET / 03:23 UTC.

Summary
The PR redacts channel account snapshot.baseUrl values before adding them to openclaw status --all notes and adds a regression test for URL userinfo plus auth-like query parameters.

PR surface: Source +1, Tests +32. Total +33 across 2 files.

Reproducibility: yes. Source inspection shows current main appends snapshot.baseUrl directly to status --all account notes, and the PR body provides a synthetic CLI proof path for the after-fix behavior.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #98633
Summary: This PR is the candidate fix for the canonical status-all channel base URL credential exposure report.

Members:

canonical: [Bug]: status --all can print credentials hidden in channel base URLs #98633 - The PR uses closing syntax for that open bug report, and the issue body describes the same status-all base URL credential exposure fixed by this diff.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

No ClawSweeper repair lane is needed because the current PR head has no actionable findings and the remaining action is normal maintainer review or merge.

Security
Cleared: The diff reduces sensitive diagnostic output using an existing internal redaction helper and adds no dependency, workflow, package, permission, or code-execution surface.

Review details

Best possible solution:

Land this focused status-all redaction or an equivalent change, then close the linked issue; broader channel-summary URL redaction can be tracked separately if maintainers want every status surface covered.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main appends snapshot.baseUrl directly to status --all account notes, and the PR body provides a synthetic CLI proof path for the after-fix behavior.

Is this the best way to solve the issue?

Yes for the scoped status-all bug. Reusing the existing net-policy URL redaction helper at the status-all account-note render point is narrow and avoids changing channel configuration semantics.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 898564e71aef.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from a synthetic openclaw status --all run showing the sensitive URL parts redacted and the raw test values absent.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output from a synthetic openclaw status --all run showing the sensitive URL parts redacted and the raw test values absent.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 🛠️ actively grinding: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: This is a focused fix for medium-severity diagnostic credential exposure with limited blast radius and a clean existing PR path.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output from a synthetic openclaw status --all run showing the sensitive URL parts redacted and the raw test values absent.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from a synthetic openclaw status --all run showing the sensitive URL parts redacted and the raw test values absent.

Evidence reviewed

PR surface:

Source +1, Tests +32. Total +33 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	2	1	+1
Tests	1	32	0	+32
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	34	1	+33

What I checked:

Repository policy read: Root AGENTS.md was read fully and applied; no scoped AGENTS.md owns src/commands/status-all, and no maintainer notes were present. (AGENTS.md:1, 898564e71aef)
Current main leak path: Current main appends snapshot.baseUrl directly to status-all account notes, so the linked bug is source-reproducible before this PR. (src/commands/status-all/channels.ts:139, 898564e71aef)
PR implementation: The PR replaces the raw base URL note with redactSensitiveUrlLikeString(snapshot.baseUrl) at the status-all render boundary. (src/commands/status-all/channels.ts:138, 8f4cd75020a3)
Regression coverage: The added test covers URL userinfo and token/api_key query redaction while asserting the raw synthetic values are absent. (src/commands/status-all/channels.test.ts:122, 8f4cd75020a3)
Redaction helper contract: The existing net-policy helper redacts URL userinfo and sensitive query parameters from parseable URLs and URL-like strings. (packages/net-policy/src/redact-sensitive-url.ts:80, 898564e71aef)
Status-all sharing contract: The health docs describe openclaw status --all as read-only and safe to paste for debugging, supporting redaction in this report. Public docs: docs/gateway/health.md. (docs/gateway/health.md:14, 898564e71aef)

Likely related people:

steipete: GitHub path history and local blame show repeated recent work on status-all channel rendering, channel account summary helpers, and net-policy extraction around this surface. (role: feature-history owner; confidence: high; commits: 2939ac6b72db, f80f47d408a1, 64df787448fb; files: src/commands/status-all/channels.ts, src/channels/account-summary.ts, src/channels/account-snapshot-fields.ts)
vincentkoc: Recent path history includes status channel credential-state and external channel repair work in the same status-all and channel snapshot area. (role: recent adjacent contributor; confidence: medium; commits: ce04ad83fa67, f482e4d3359c, be6263da4f51; files: src/commands/status-all/channels.ts, src/channels/account-snapshot-fields.ts)
amknight: Recent history on packages/net-policy/src/redact-sensitive-url.ts includes the tool-output secret redaction helper that this PR reuses. (role: redaction helper contributor; confidence: medium; commits: 3faf669801d0; files: packages/net-policy/src/redact-sensitive-url.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

ooiuuii · 2026-07-01T13:16:57Z

@clawsweeper re-review

clawsweeper · 2026-07-01T13:16:59Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

ooiuuii · 2026-07-03T03:11:59Z

@clawsweeper re-review

Current PR body now includes after-fix openclaw status --all CLI proof from a synthetic config showing URL userinfo and auth-like query values are redacted from the channel base URL output. It also lists the focused status-all test, lint/format checks, cliStartup build, and branch autoreview.

joshavant · 2026-07-15T00:36:07Z

Thanks, @ooiuuii, for the focused patch and especially the synthetic CLI proof. Your work established the status --all failure mode and validated the expected redaction behavior.

Related nested-URL reports showed that the invariant needed to live at the shared redactor and final snapshot/summary boundaries rather than only in the status --all renderer. That broader fix has merged as #107754 in 210340f.

Closing this PR as superseded by the broader merged fix—not as a rejection of the contribution. Thank you again.

openclaw-barnacle Bot added commands Command implementations size: XS labels Jul 1, 2026

ooiuuii mentioned this pull request Jul 1, 2026

[Bug]: status --all can print credentials hidden in channel base URLs #98633

Closed

fix(status): redact channel base URLs in status-all

8f4cd75

ooiuuii force-pushed the fix/status-channel-baseurl-redaction branch from 4802b11 to 8f4cd75 Compare July 1, 2026 13:08

joshavant mentioned this pull request Jul 14, 2026

fix(channels): prevent base URL credentials in status output #107754

Merged

joshavant closed this Jul 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(status): redact channel base URLs in status-all#98599

fix(status): redact channel base URLs in status-all#98599
ooiuuii wants to merge 1 commit into
openclaw:mainfrom
ooiuuii:fix/status-channel-baseurl-redaction

ooiuuii commented Jul 1, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

ooiuuii commented Jul 1, 2026

Uh oh!

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

ooiuuii commented Jul 3, 2026

Uh oh!

joshavant commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

ooiuuii commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ooiuuii commented Jul 1, 2026

Uh oh!

clawsweeper Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ooiuuii commented Jul 3, 2026

Uh oh!

joshavant commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ooiuuii commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 1, 2026 •

edited

Loading