@indigoai-us/hq-cli 5.202.0 → 5.203.0

package/dist/commands/integrations-connect.js

@@ -20,6 +20,7 @@ import chalk from "chalk";
 import open from "open";
 import { DEFAULT_VAULT_API_URL, ensureCognitoIdToken, } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
+import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, connectionDomain, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
 import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBlueprint, startOAuth, } from "./integrations-api.js";
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
@@ -292,7 +293,7 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
                 : found.discovery.authMode === "oauth"
                     ? "oauth"
                     : "none",
-            label: found.discovery.displayName,
+            label: redactUrlsInText(found.discovery.displayName),
         };
     }
     if (opts.mcpUrl) {
@@ -302,11 +303,11 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
                 ...(opts.provider ? { provider: opts.provider } : {}),
                 ...(opts.displayName ? { displayName: opts.displayName } : {}),
             },
-            label: opts.displayName ?? opts.provider ?? opts.mcpUrl,
+            label: redactUrlsInText(opts.displayName ?? opts.provider ?? opts.mcpUrl),
         };
     }
     if (opts.entryId) {
-        return { ref: { catalogEntryId: opts.entryId }, label: opts.entryId };
+        return { ref: { catalogEntryId: opts.entryId }, label: redactUrlsInText(opts.entryId) };
     }
     if (!app) {
         throw new IntegrationsCliError("Name an app to connect — a domain (`hq integrations connect linear.app`), or use --mcp-url / --docs-url / --entry-id.", { expected: true });
@@ -324,10 +325,10 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
             return {
                 ref: { domain: app },
                 ...(match?.authClass ? { authClass: match.authClass } : {}),
-                label: match?.name || app,
+                label: redactUrlsInText(match?.name || app),
             };
         }
-        return catalogEntryToTarget(match, { ref: { domain: app }, label: app });
+        return catalogEntryToTarget(match, { ref: { domain: app }, label: redactUrlsInText(app) });
     }
     // A bare name (`notion`, `atlassian`) is how the catalog reads to a person —
     // the rows are titled `notion.com`, `atlassian.com`. Resolve it to that row
@@ -337,9 +338,9 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
     // unmatched → fall back to the server-side query resolver.
     const named = await findCatalogEntryByName(token, companyUid, app);
     if (named) {
-        return catalogEntryToTarget(named, { ref: { query: app }, label: app });
+        return catalogEntryToTarget(named, { ref: { query: app }, label: redactUrlsInText(app) });
     }
-    return { ref: { query: app }, label: app };
+    return { ref: { query: app }, label: redactUrlsInText(app) };
 }
 /**
  * Turn a matched catalog entry into a connect target, preferring its opaque
@@ -353,13 +354,13 @@ function catalogEntryToTarget(match, fallback) {
         return {
             ref: { catalogEntryId: match.entryId },
             ...(match.authClass ? { authClass: match.authClass } : {}),
-            label: match.name || fallback.label,
+            label: redactUrlsInText(match.name || fallback.label),
         };
     }
     return {
         ref: { domain: match.domain },
         ...(match.authClass ? { authClass: match.authClass } : {}),
-        label: match.name || fallback.label,
+        label: redactUrlsInText(match.name || fallback.label),
     };
 }
 /** Best-effort catalog lookup by domain; never fails the connect. */
@@ -507,15 +508,15 @@ async function connectViaOAuth(token, companyUid, target, opts) {
         // that beats it, but ordering it this way means the happy path never
         // depends on that buffer.
         const pendingCode = listener.waitForCode(started.state);
-        console.error(chalk.dim(`Waiting for you to sign in to ${started.displayName || target.label}…`));
+        console.error(chalk.dim(`Waiting for you to sign in to ${redactUrlsInText(started.displayName || target.label)}…`));
         if (opts.browser === false) {
-            console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+            console.error(`Open this URL to sign in:\n  ${redactSensitiveUrl(started.authorizationUrl)}`);
         }
         else {
             // A failed browser launch (headless box, no handler) is recoverable —
             // print the URL and keep waiting rather than aborting the sign-in.
             await open(started.authorizationUrl).catch(() => {
-                console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+                console.error(`Open this URL to sign in:\n  ${redactSensitiveUrl(started.authorizationUrl)}`);
             });
         }
         let code;
@@ -596,9 +597,9 @@ companySlug, origin) {
  */
 function targetSelectionHint(opts) {
     if (opts.mcpUrl)
-        return `Server address to enter there: ${opts.mcpUrl}`;
+        return `Server address to enter there: ${redactSensitiveUrl(opts.mcpUrl)}`;
     if (opts.docsUrl)
-        return `Found from these docs: ${opts.docsUrl}`;
+        return `Found from these docs: ${redactSensitiveUrl(opts.docsUrl)}`;
     if (opts.entryId)
         return `Catalog entry: ${opts.entryId}`;
     return undefined;
@@ -656,10 +657,10 @@ function loopbackTimeoutHandoff(target, opts) {
 }
 function printConsoleDestination(target, opts, url) {
     if (url) {
-        console.error(`Open this page and connect ${target.label} from it:\n  ${url}`);
+        console.error(`Open this page and connect ${redactUrlsInText(target.label)} from it:\n  ${redactSensitiveUrl(url)}`);
     }
     else {
-        console.error(`Open your HQ console's Integrations page and connect ${target.label} there. ` +
+        console.error(`Open your HQ console's Integrations page and connect ${redactUrlsInText(target.label)} there. ` +
             "(This session points at a control plane whose console address is not " +
             "derivable — set HQ_CONSOLE_URL to name it.)");
     }
@@ -707,9 +708,9 @@ async function consoleHandoff(target, opts) {
  * credentials — but only the console can collect them, so say what is needed
  * and hand the page over rather than restating the refusal and stopping.
  */
-async function bringYourOwnClientHandoff(target, opts, reason, redirectUri) {
-    console.error(chalk.yellow(reason));
-    console.error(`${target.label} needs an OAuth app you register with the provider yourself.`);
+export async function bringYourOwnClientHandoff(target, opts, reason, redirectUri) {
+    console.error(chalk.yellow(redactUrlsInText(reason)));
+    console.error(`${redactUrlsInText(target.label)} needs an OAuth app you register with the provider yourself.`);
     // Prefer finishing here. The recovery needs two things the terminal can
     // supply — the callback URL to register, and a client id + secret — and
     // hq-pro sends the first one back on exactly these errors. Falling through
@@ -719,7 +720,7 @@ async function bringYourOwnClientHandoff(target, opts, reason, redirectUri) {
     if (redirectUri && command) {
         console.error("");
         console.error(`In the provider's developer portal, register this callback URL:`);
-        console.error(`  ${redirectUri}`);
+        console.error(`  ${redactSensitiveUrl(redirectUri)}`);
         console.error(`Then run:`);
         console.error(`  ${command}`);
         console.error(chalk.dim("The secret is read from stdin, so it stays out of your shell history. " +
@@ -747,7 +748,7 @@ function byoClientCommand(target, opts) {
     const { mcpUrl, provider } = target.ref;
     if (!mcpUrl)
         return null;
-    const parts = ["hq integrations connect", `--mcp-url ${shellQuote(mcpUrl)}`];
+    const parts = ["hq integrations connect", `--mcp-url ${shellQuote(redactSensitiveUrl(mcpUrl))}`];
     if (opts.company)
         parts.push(`--company ${shellQuote(opts.company)}`);
     if (provider)
@@ -849,8 +850,8 @@ async function userClientSignIn(token, companyUid, target, opts, client, request
         // authorize step on this path too.
         ...(requestedScopes ? { scopes: requestedScopes } : {}),
     });
-    console.error(`Open this URL to sign in to ${started.displayName || target.label}:`);
-    console.error(`  ${started.authorizationUrl}`);
+    console.error(`Open this URL to sign in to ${redactUrlsInText(started.displayName || target.label)}:`);
+    console.error(`  ${redactSensitiveUrl(started.authorizationUrl)}`);
     const googleHint = googleClientTypeHint(client.clientId, started.authorizationUrl);
     if (googleHint)
         console.error(chalk.yellow(googleHint));
@@ -879,7 +880,7 @@ export function googleClientTypeHint(clientId, authorizationUrl) {
         // An unparseable URL still gets the client-type half of the hint.
     }
     return ("This Google OAuth client must be of type \"Web application\" (a \"Desktop app\" client will not work)" +
-        (redirectUri ? `, with this authorized redirect URI:\n  ${redirectUri}` : "."));
+        (redirectUri ? `, with this authorized redirect URI:\n  ${redactSensitiveUrl(redirectUri)}` : "."));
 }
 /**
  * Second chance at a credential when the target's auth mode wasn't known up
@@ -917,7 +918,7 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
     const { installation, connection } = result;
     const toolCount = result.mcp?.tools?.length;
     const revived = connection.id === expectedRevivedConnectionId;
-    console.log(chalk.green(`${revived ? "Revived" : "Connected"} ${chalk.bold(installation.displayName)}`) +
+    console.log(chalk.green(`${revived ? "Revived" : "Connected"} ${chalk.bold(redactUrlsInText(installation.displayName))}`) +
         (typeof toolCount === "number" ? chalk.dim(` — ${toolCount} tools available`) : ""));
     console.log(chalk.dim(`  connection: ${connection.id}`));
     if (installation.status === "needs_credentials") {
@@ -1073,7 +1074,7 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
         });
         return true;
     }
-    const label = existing.installation?.displayName ?? slug;
+    const label = redactUrlsInText(existing.installation?.displayName ?? slug);
     console.log(chalk.green(`${label} is already connected.`));
     console.log(chalk.dim(`  Sign in again:  hq integrations reconnect --provider ${slug}\n` +
         `  Add a second:   hq integrations connect ${shellQuote(app)} --force`));
@@ -1104,7 +1105,7 @@ export function registerConnectCommands(integrations) {
         }
         if (entries.length === 0) {
             console.log(query
-                ? `Nothing matched '${query}'. Try a domain, e.g. hq integrations catalog linear.app`
+                ? `Nothing matched '${redactUrlsInText(query)}'. Try a domain, e.g. hq integrations catalog linear.app`
                 : "The catalog is empty right now.");
             return;
         }
@@ -1129,9 +1130,9 @@ export function registerConnectCommands(integrations) {
             ]
                 .filter(Boolean)
                 .join(" · ");
-            console.log(`${chalk.bold(entry.name)}  ${chalk.dim(entry.domain)}  ${chalk.dim(tags)}`);
+            console.log(`${chalk.bold(redactUrlsInText(entry.name))}  ${chalk.dim(redactUrlsInText(entry.domain))}  ${chalk.dim(tags)}`);
             if (entry.description)
-                console.log(chalk.dim(`  ${entry.description}`));
+                console.log(chalk.dim(`  ${redactUrlsInText(entry.description)}`));
         }
         console.log(chalk.dim(`\n${entries.length} apps. Connect one with: hq integrations connect <domain>`));
     });
@@ -1151,18 +1152,18 @@ export function registerConnectCommands(integrations) {
             printJson(blueprint);
             return;
         }
-        console.log(`${chalk.bold(blueprint.displayName)}  ${chalk.dim(blueprint.domain)}`);
+        console.log(`${chalk.bold(redactUrlsInText(blueprint.displayName))}  ${chalk.dim(redactUrlsInText(blueprint.domain))}`);
         if (blueprint.summary)
-            console.log(chalk.dim(blueprint.summary));
+            console.log(chalk.dim(redactUrlsInText(blueprint.summary)));
         for (const surface of blueprint.surfaces) {
             const auth = surface.authStatus === "none" ? "no auth" : `auth: ${surface.authStatus}`;
-            console.log(`  ${chalk.bold(surface.kind)}  ${surface.name}  ${chalk.dim(`${auth} · ${surface.readiness.strategy}`)}`);
+            console.log(`  ${chalk.bold(redactUrlsInText(surface.kind))}  ${redactUrlsInText(surface.name)}  ${chalk.dim(`${auth} · ${redactUrlsInText(surface.readiness.strategy)}`)}`);
         }
         for (const credential of blueprint.credentials) {
-            console.log(chalk.dim(`  needs: ${credential.label}${credential.generateUrl ? ` (${credential.generateUrl})` : ""}`));
+            console.log(chalk.dim(`  needs: ${redactUrlsInText(credential.label)}${credential.generateUrl ? ` (${redactSensitiveUrl(credential.generateUrl)})` : ""}`));
         }
         for (const warning of blueprint.warnings) {
-            console.log(chalk.yellow(`  ! ${warning.message}`));
+            console.log(chalk.yellow(`  ! ${redactUrlsInText(warning.message)}`));
         }
     });
     integrations
@@ -1183,11 +1184,11 @@ export function registerConnectCommands(integrations) {
             return;
         }
         const { discovery } = found;
-        console.log(`${chalk.bold(discovery.displayName)}  ${chalk.dim(discovery.mcpUrl)}`);
+        console.log(`${chalk.bold(redactUrlsInText(discovery.displayName))}  ${chalk.dim(redactSensitiveUrl(discovery.mcpUrl))}`);
         console.log(chalk.dim(`  sign-in: ${discovery.authMode} · ${discovery.verification} · confidence ${discovery.confidence}`));
         // Quoted: a docs URL routinely carries `&`, which would background the
         // command when pasted, and `;` would run whatever follows it.
-        console.log(chalk.dim(`\nConnect it with: hq integrations connect --docs-url ${shellQuote(docsUrl)}`));
+        console.log(chalk.dim(`\nConnect it with: hq integrations connect --docs-url ${shellQuote(redactSensitiveUrl(docsUrl))}`));
     });
     integrations
         .command("connect [app]")
@@ -1249,8 +1250,8 @@ export function registerConnectCommands(integrations) {
                 if (opts.json)
                     printJson(details);
                 else {
-                    console.log(chalk.yellow(details.reason));
-                    console.log(chalk.yellow(`Re-add it with: ${details.fixPath}`));
+                    console.log(chalk.yellow(redactUrlsInText(details.reason)));
+                    console.log(chalk.yellow(`Re-add it with: ${redactUrlsInText(details.fixPath)}`));
                 }
                 return;
             }

package/dist/commands/integrations-core.d.ts

@@ -152,12 +152,10 @@ export declare class IntegrationsCliError extends Error {
     readonly rpcCode?: number;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
-     * refused to register HQ automatically. It is what the admin must register
-     * with the provider before their own OAuth app can be used, and it is NOT a
-     * secret — every authorization server already receives it in the authorize
-     * URL. Taken from the response rather than assembled locally so the CLI
-     * prints the callback this backend will actually redirect to, instead of a
-     * guess at its route that would send the admin to register the wrong URL.
+     * refused to register HQ automatically. The provider must register the exact
+     * callback this backend will redirect to, so the CLI preserves the server
+     * value for the OAuth recovery flow. It may contain sensitive query data;
+     * keep it non-enumerable and redact it at display boundaries.
      */
     readonly redirectUri?: string;
     constructor(message: string, opts?: {

package/dist/commands/integrations-core.js

@@ -13,6 +13,7 @@ import chalk from "chalk";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
+import { redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { connectionHealthNotice } from "../lib/integrations/health.js";
 import { bareProvider } from "../lib/integrations/provider-slug.js";
 export { bareProvider } from "../lib/integrations/provider-slug.js";
@@ -53,16 +54,14 @@ export class IntegrationsCliError extends Error {
     rpcCode;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
-     * refused to register HQ automatically. It is what the admin must register
-     * with the provider before their own OAuth app can be used, and it is NOT a
-     * secret — every authorization server already receives it in the authorize
-     * URL. Taken from the response rather than assembled locally so the CLI
-     * prints the callback this backend will actually redirect to, instead of a
-     * guess at its route that would send the admin to register the wrong URL.
+     * refused to register HQ automatically. The provider must register the exact
+     * callback this backend will redirect to, so the CLI preserves the server
+     * value for the OAuth recovery flow. It may contain sensitive query data;
+     * keep it non-enumerable and redact it at display boundaries.
      */
     redirectUri;
     constructor(message, opts = {}) {
-        super(message);
+        super(redactUrlsInText(message));
         this.name = "IntegrationsCliError";
         this.expected = opts.expected ?? false;
         if (opts.code)
@@ -73,8 +72,12 @@ export class IntegrationsCliError extends Error {
             this.oauthProtected = opts.oauthProtected;
         if (opts.rpcCode !== undefined)
             this.rpcCode = opts.rpcCode;
-        if (opts.redirectUri !== undefined)
-            this.redirectUri = opts.redirectUri;
+        if (opts.redirectUri !== undefined) {
+            Object.defineProperty(this, "redirectUri", {
+                value: opts.redirectUri,
+                enumerable: false,
+            });
+        }
     }
 }
 /**
@@ -473,7 +476,7 @@ export function queuedOutcome(payload) {
     return null;
 }
 export function printJson(value) {
-    console.log(JSON.stringify(value, null, 2));
+    console.log(JSON.stringify(redactSensitiveUrls(value), null, 2));
 }
 /**
  * Print why a connection is unusable and how to repair it, directly beneath its
@@ -492,8 +495,8 @@ export function printHealthNotice(connection) {
     const notice = connectionHealthNotice(connection);
     if (!notice)
         return;
-    console.log(chalk.yellow(`  ${notice.headline}`));
+    console.log(chalk.yellow(`  ${redactUrlsInText(notice.headline)}`));
     if (notice.remediation)
-        console.log(chalk.yellow(`  ${notice.remediation}`));
+        console.log(chalk.yellow(`  ${redactUrlsInText(notice.remediation)}`));
 }
 //# sourceMappingURL=integrations-core.js.map

package/dist/commands/integrations-import.js

@@ -10,6 +10,7 @@ import * as path from "node:path";
 import chalk from "chalk";
 import { ensureCognitoIdToken, ensureCognitoToken, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { bareProvider, IntegrationsCliError, printJson } from "./integrations-core.js";
 import { installIntegration, startOAuth } from "./integrations-api.js";
 import { loadRevealedSecrets } from "./secrets.js";
@@ -222,11 +223,11 @@ async function importRemote(token, companyUid, name, entry, dryRun) {
 function renderOutcomes(outcomes) {
     console.log("Connector                 Outcome             Details");
     for (const outcome of outcomes) {
-        console.log(`${outcome.name.padEnd(25)} ${outcome.status.padEnd(19)} ${outcome.reason ?? outcome.path ?? ""}`);
+        console.log(`${redactUrlsInText(outcome.name).padEnd(25)} ${outcome.status.padEnd(19)} ${redactUrlsInText(outcome.reason ?? outcome.path ?? "")}`);
     }
     for (const outcome of outcomes.filter((item) => item.status === "shared-for-local")) {
-        console.log(chalk.dim(`  Shared manifest: ${outcome.path}`));
-        console.log(chalk.dim(`  Teammate install: ${outcome.installCommand}`));
+        console.log(chalk.dim(`  Shared manifest: ${redactUrlsInText(outcome.path ?? "")}`));
+        console.log(chalk.dim(`  Teammate install: ${redactUrlsInText(outcome.installCommand ?? "")}`));
     }
     if (outcomes.some((item) => item.status === "shared-for-local")) {
         console.log(chalk.yellow("  Local connector credentials were replaced with ${secret:ENV_NAME}. Set them with `hq secrets` before installing."));
@@ -235,9 +236,10 @@ function renderOutcomes(outcomes) {
         console.log(chalk.yellow("  Local connector argument credentials were replaced with ${secret:FLAG_NAME}. Set them with `hq secrets` before installing."));
     }
     for (const outcome of outcomes.filter((item) => item.status === "needs-signin")) {
-        console.log(chalk.yellow(`  ${outcome.name} needs sign-in: ${outcome.reason}`));
-        if (outcome.authorizationUrl)
-            console.log(chalk.yellow(`  Open this URL to sign in:\n  ${outcome.authorizationUrl}`));
+        console.log(chalk.yellow(`  ${redactUrlsInText(outcome.name)} needs sign-in: ${redactUrlsInText(outcome.reason ?? "")}`));
+        if (outcome.authorizationUrl) {
+            console.log(chalk.yellow(`  Open this URL to sign in:\n  ${redactSensitiveUrl(outcome.authorizationUrl)}`));
+        }
     }
 }
 export function registerImportCommands(integrations) {

package/dist/commands/integrations-manage.js

@@ -16,6 +16,7 @@ import readline from "node:readline";
 import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
+import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
 import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
@@ -95,7 +96,7 @@ function confirm(message) {
     });
 }
 function connectionLabel(connection) {
-    return connection.installation?.displayName ?? bareProvider(connection.provider);
+    return redactUrlsInText(connection.installation?.displayName ?? bareProvider(connection.provider));
 }
 /**
  * The category of match must mirror `selectConnection`: an exact provider id
@@ -219,12 +220,13 @@ export function registerManageCommands(integrations) {
         if (connection.status === "revoked") {
             const details = revokedConnectionDetails(connection, opts.company);
             console.log(chalk.yellow(`  Revoked — ${details.reason}`));
-            console.log(chalk.yellow(`  Re-add: ${details.fixPath}`));
+            console.log(chalk.yellow(`  Re-add: ${redactUrlsInText(details.fixPath)}`));
         }
         if (install?.domain)
-            console.log(chalk.dim(`  domain:      ${install.domain}`));
-        if (install?.surface?.url)
-            console.log(chalk.dim(`  endpoint:    ${install.surface.url}`));
+            console.log(chalk.dim(`  domain:      ${redactUrlsInText(install.domain)}`));
+        if (install?.surface?.url) {
+            console.log(chalk.dim(`  endpoint:    ${redactSensitiveUrl(install.surface.url)}`));
+        }
         const policy = connection.writePolicy;
         if (policy) {
             console.log(chalk.dim(`  changes:     ${policy} — ${POLICY_BLURB[policy] ?? ""}`));
@@ -547,7 +549,7 @@ export function registerManageCommands(integrations) {
             const who = row.memberOrAgentName ?? row.memberOrAgent;
             console.log(`${chalk.dim(row.timestamp)}  ${chalk.bold(row.outcome)}  ${row.toolName}  ${chalk.dim(who)}`);
             if (row.reason)
-                console.log(chalk.dim(`    ${row.reason}`));
+                console.log(chalk.dim(`    ${redactUrlsInText(row.reason)}`));
         }
         // hq-pro caps its own feed at 50 events; say so rather than letting a
         // truncated list read as "that is everything that ever happened".

package/dist/commands/integrations.js

@@ -52,6 +52,7 @@ import { randomUUID } from "node:crypto";
 import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printHealthNotice, printJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
@@ -130,7 +131,7 @@ function connectionLabel(connection) {
     const slug = bareProvider(connection.provider);
     const displayName = connection.installation?.displayName?.trim();
     return displayName && displayName.toLowerCase() !== slug.toLowerCase()
-        ? `${slug} (${displayName})`
+        ? `${slug} (${redactUrlsInText(displayName)})`
         : slug;
 }
 function printToolSchema(tool) {
@@ -138,7 +139,7 @@ function printToolSchema(tool) {
         console.log(chalk.dim("  Input schema was not reported by this app."));
         return;
     }
-    const schema = JSON.stringify(tool.inputSchema, null, 2);
+    const schema = JSON.stringify(redactSensitiveUrls(tool.inputSchema), null, 2);
     console.log(chalk.dim("  Input schema:"));
     console.log(chalk.dim(schema.split("\n").map((line) => `  ${line}`).join("\n")));
 }
@@ -152,7 +153,7 @@ function reportRevokedConnection(connection, opts) {
     else {
         console.log(chalk.yellow(`${connectionLabel(connection)}: status=revoked`));
         console.log(chalk.yellow(`  ${details.reason}`));
-        console.log(`  Re-add: ${details.fixPath}`);
+        console.log(`  Re-add: ${redactUrlsInText(details.fixPath)}`);
     }
     if (opts.fail) {
         throw new IntegrationsCliError(`status=revoked. ${details.reason} Re-add with: ${details.fixPath}`, { expected: true });
@@ -190,6 +191,9 @@ export function registerIntegrationsCommand(program) {
                 .join(" · ");
             console.log(`${chalk.bold(connectionLabel(c))}  ${chalk.dim(flags)}`);
             console.log(chalk.dim(`  connection: ${c.id}`));
+            const endpoint = c.installation?.surface?.url;
+            if (endpoint)
+                console.log(chalk.dim(`  endpoint: ${redactSensitiveUrl(endpoint)}`));
             printHealthNotice(c);
         }
     });
@@ -236,7 +240,7 @@ export function registerIntegrationsCommand(program) {
             const badge = formatToolBadge(tool);
             console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}  ${chalk.dim(`on ${connectionLabel(connection)}`)}`);
             if (tool.description)
-                console.log(chalk.dim(`  ${tool.description}`));
+                console.log(chalk.dim(`  ${redactUrlsInText(tool.description)}`));
             printToolSchema(tool);
             return;
         }
@@ -246,7 +250,7 @@ export function registerIntegrationsCommand(program) {
         }
         console.log(chalk.dim(`App: ${connectionLabel(connection)}`));
         for (const tool of tools) {
-            const label = tool.title && tool.title !== tool.name ? `  ${chalk.dim(tool.title)}` : "";
+            const label = tool.title && tool.title !== tool.name ? `  ${chalk.dim(redactUrlsInText(tool.title))}` : "";
             const required = requiredInputHint(tool.inputSchema);
             const badge = formatToolBadge(tool);
             console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}${label}${required ? `  ${chalk.dim(required)}` : ""}`);

package/dist/commands/lanes.d.ts

@@ -46,6 +46,7 @@ export interface LanesCommandDeps {
     throttleDeps?: ThrottleDeps;
     existsSync?: (p: string) => boolean;
     readFileSync?: (p: string, encoding: "utf8") => string;
+    readStdin?: () => string;
     homedir?: () => string;
     mesh?: LanesMesh;
     sleep?: (ms: number) => Promise<void>;