fix(transport): redact rpcUrl credentials before logging them

[ntdatt812]

Summary

A connection profile's rpcUrl is stored verbatim — normalizeRpcUrl deliberately keeps query and hash "byte-for-byte intact" and does not touch userinfo — so it can carry user:pass@ or ?token=. That is precisely what redactRpcUrlForLog exists for, and what its own test already pins:

expect(redactRpcUrlForLog('https://user:pass@host.example/rpc?token=secret#/token'))
  .toBe('https://host.example/rpc');

Four construction-time log lines passed the raw URL instead of the redacted one:

file	line
services/transport/CloudHttpTransport.ts	38
services/transport/LanHttpTransport.ts	37
services/transport/TransportManager.ts	83, 93

coreRpcClient.ts and configPersistence.ts already route through the helper; these four were the ones left out.

What makes it clear-cut

transport:cloud was already careful with the other secret on the same line — it reports the bearer token by presence, never by value:

log('[transport:cloud] created rpcUrl=%s token=%s', rpcUrl, bearerToken ? 'set' : 'none');
//                                                  ^^^^^^ raw          ^^^^^^^^ masked

So the token is protected and the URL beside it is not.

Reproduction

Captured from the real debug namespaces on this branch's parent, with
rpcUrl = https://svc:HUNTER2@core.example.com/rpc?token=SUPERSECRET#/tok:

transport:cloud [transport:cloud] created rpcUrl=%s token=%s
    https://svc:HUNTER2@core.example.com/rpc?token=SUPERSECRET#/tok set

Both the password and the query token are in the log line. Anyone with DEBUG=transport:* — or anyone reading a log a user pastes into an issue — gets them.

After the change the same line reads https://core.example.com/rpc.

Verification

app/src/services/transport/logRedaction.test.ts — four tests that capture what the namespaces actually emit (by swapping debug.log) rather than asserting on the source. They cover both transports and both TransportManager selection branches, assert the secrets are absent, and assert the origin+path survives so the log stays useful.

Reverting only the three src files, keeping the test:

Tests  4 failed (4)     <- without the fix
Tests  4 passed (4)     <- with it

All four are bug proofs; none of them pass on the old code.

Wider run, using the repo's own config:

pnpm exec vitest run --config test/vitest.config.ts \
  src/services/transport src/utils/__tests__/configPersistence.test.ts \
  src/services/__tests__/coreRpcClient.test.ts
-> Test Files 10 passed (10)   Tests 241 passed (241)

prettier --check ., eslint src and tsc --noEmit each exit 0.

Scope

Deliberately narrow: only the redaction of an already-logged value changes. No log line is added or removed, no behaviour outside logging is touched, and redactRpcUrlForLog itself is unchanged.

Summary by CodeRabbit

• Bug Fixes

  • Improved connection logging to hide credentials, tokens, and other sensitive URL details.
  • Preserved safe connection information and token-presence reporting in diagnostic logs.
  • Applied protection consistently across cloud, LAN, and transport selection logs.

• Tests

  • Added coverage verifying that sensitive connection details never appear during transport setup.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 234 embedded · openrouter/openai/text-embedding-3-small

[tinysweeper]

How this change flows

1 changed behaviour across 8 relationships. 4 surrounding behaviours are shown (60 graph nodes walked). 45 further behaviours left out to keep the diagram readable.

flowchart LR
  n0["TransportManager<br/>changed"]:::changed
  n1["getTransport"]:::impacted
  n2["manager"]:::impacted
  n3["manager"]:::impacted
  n4["t"]:::impacted
  n2 -->|calls| n0
  n2 -->|uses| n0
  n2 -->|tests| n0
  n3 -->|calls| n0
  n3 -->|tests| n0
  n4 -->|calls| n1
  n4 -->|tests| n1
  n4 -->|calls| n2
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

_{Green: changed behaviour. Grey: surrounding behaviour. Arrows name the call, use, implementation, or test relationship. Orange: has findings. Red: has a finding that blocks the merge.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 40121e7c-92d4-4c44-a211-bf74fbad5638

📥 Commits

Reviewing files that changed from the base of the PR and between ded703d and 9b27816.

📒 Files selected for processing (4)

• app/src/services/transport/CloudHttpTransport.ts
• app/src/services/transport/LanHttpTransport.ts
• app/src/services/transport/TransportManager.ts
• app/src/services/transport/logRedaction.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Transport constructors and selection logs now redact credentials and tokens from RPC URLs. New tests verify safe URL logging and secret removal for cloud, LAN, and manager-based transport creation.

Changes

Transport log URL redaction

Layer / File(s)	Summary
Apply URL redaction to transport logs app/src/services/transport/CloudHttpTransport.ts, app/src/services/transport/LanHttpTransport.ts, app/src/services/transport/TransportManager.ts	Cloud and LAN transport logs, including manager selection logs, now redact RPC URLs. Cloud logs still report whether a bearer token is set.
Validate secret-free logging app/src/services/transport/logRedaction.test.ts	Tests capture debug output and verify that credentials and tokens are absent while the safe URL portion remains logged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9b278

The change removes credentials and URL tokens from four transport debug logs without altering transport behavior; no actionable merge-blocking risk remains.

Suggested labels: bug

Suggested reviewers: al629176

Poem

A rabbit guards the logs tonight,
No secret hops into the light.
URLs keep their safer face,
Tokens vanish without a trace.
Tests thump paws: “The path is right!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: redacting RPC URL credentials before logging them.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}