@p697/clawket 0.4.3 → 0.4.4

package/dist/index.js

@@ -1827,7 +1827,7 @@ var BridgeRuntime = class {
       return;
     this.stopped = false;
     this.updateSnapshot({ running: true, gatewayUrl: this.options.gatewayUrl });
-    this.log(`runtime starting gatewayId=${this.options.config.gatewayId} gatewayUrl=${this.options.gatewayUrl}`);
+    this.log(`runtime starting gatewayUrl=${redactGatewayWsUrl(this.options.gatewayUrl)}`);
     void this.connectRelay();
   }
   async stop() {
@@ -2030,7 +2030,7 @@ var BridgeRuntime = class {
     }
     try {
       const issued = await issueOpenClawBootstrapToken(parsed.value);
-      this.log(`relay bootstrap token issued requestId=${requestId} deviceId=${parsed.value.deviceId} targetClientId=${replyTargetClientId || "<none>"} expiresAtMs=${issued.expiresAtMs}`);
+      this.log(`relay bootstrap token issued requestId=${requestId} targetClientId=${replyTargetClientId || "<none>"} expiresAtMs=${issued.expiresAtMs}`);
       this.sendRelayControl({
         event: "bootstrap.issued",
         requestId,
@@ -2087,7 +2087,7 @@ var BridgeRuntime = class {
     if (this.stopped || !this.isRelayOpen() || this.gatewayConnecting || this.isGatewayOpen() || this.gatewayCloseBoundaryPending)
       return;
     this.gatewayConnecting = true;
-    this.log(`gateway connect start url=${this.options.gatewayUrl}`);
+    this.log(`gateway connect start url=${redactGatewayWsUrl(this.options.gatewayUrl)}`);
     const gateway = this.createWebSocket(this.options.gatewayUrl);
     this.gatewaySocket = gateway;
     gateway.once("open", () => {
@@ -2279,13 +2279,13 @@ var BridgeRuntime = class {
       return;
     this.inFlightConnectHandshakes.delete(response.id);
     const detail = response.ok ? "ok=true" : `ok=false errorCode=${response.errorCode ?? "<none>"} errorMessage=${response.errorMessage ?? "<none>"}`;
-    this.log(`gateway connect response reqId=${response.id} method=${pending.method} elapsedMs=${Date.now() - pending.startedAtMs} ${detail}`);
+    this.log(`gateway connect response reqId=<redacted> method=${pending.method} elapsedMs=${Date.now() - pending.startedAtMs} ${detail}`);
   }
   clearInFlightConnectHandshakes(reason) {
     if (this.inFlightConnectHandshakes.size === 0)
       return;
     for (const [requestId, pending] of this.inFlightConnectHandshakes.entries()) {
-      this.log(`gateway connect response missing reqId=${requestId} method=${pending.method} elapsedMs=${Date.now() - pending.startedAtMs} reason=${reason}`);
+      this.log(`gateway connect response missing reqId=<redacted> method=${pending.method} elapsedMs=${Date.now() - pending.startedAtMs} reason=${reason}`);
     }
     this.inFlightConnectHandshakes.clear();
   }
@@ -2343,7 +2343,7 @@ var BridgeRuntime = class {
       if (pending.slowWarningLogged || elapsedMs < warnDelayMs)
         continue;
       pending.slowWarningLogged = true;
-      this.log(`gateway connect still pending reqId=${requestId} method=${pending.method} elapsedMs=${elapsedMs}`);
+      this.log(`gateway connect still pending reqId=<redacted> method=${pending.method} elapsedMs=${elapsedMs}`);
     }
   }
   pushPendingGatewayMessage(message) {
@@ -2401,7 +2401,7 @@ var BridgeRuntime = class {
     this.options.onStatus?.(this.getSnapshot());
   }
   log(line) {
-    this.options.onLog?.(line);
+    this.options.onLog?.(sanitizeRuntimeLogLine(line));
   }
   isRelayOpen() {
     return this.relaySocket?.readyState === WebSocket.OPEN;
@@ -2523,7 +2523,7 @@ function patchConnectRequestGatewayAuth(text, openClawInfo) {
 function formatConnectHandshakeMetaForLog(meta) {
   if (!meta)
     return "";
-  return ` method=${meta.method} reqId=${meta.id ?? "<none>"} noncePresent=${meta.noncePresent} nonceLength=${meta.nonceLength ?? 0} authFields=${meta.authFields.length > 0 ? meta.authFields.join(",") : "<none>"}`;
+  return ` method=${meta.method} reqId=${meta.id ? "<redacted>" : "<none>"} noncePresent=${meta.noncePresent} nonceLength=${meta.nonceLength ?? 0} authFields=${meta.authFields.length > 0 ? meta.authFields.join(",") : "<none>"}`;
 }
 function parseBootstrapRequestPayload(payload) {
   if (!payload) {
@@ -2600,9 +2600,7 @@ function redactRelayWsUrl(rawUrl) {
   if (parsed.password) {
     parsed.password = "<redacted>";
   }
-  if (parsed.searchParams.has("token")) {
-    parsed.searchParams.set("token", "<redacted>");
-  }
+  stripSensitiveSearchParams(parsed);
   return parsed.toString();
 }
 function redactAuthorizationHeader(value) {
@@ -2611,6 +2609,27 @@ function redactAuthorizationHeader(value) {
     return "<none>";
   return /^Bearer\s+/i.test(trimmed) ? "Bearer <redacted>" : "<redacted>";
 }
+function sanitizeRuntimeLogLine(line) {
+  return line.replace(/\b(gatewayId|instanceId|clientId|sourceClientId|targetClientId|deviceId|requestId|reqId|traceId)=([^\s]+)/g, "$1=<redacted>").replace(/\b(gw_[a-z0-9]+|grs_[A-Za-z0-9_-]+|gct_[A-Za-z0-9_-]+)\b/g, "<redacted>");
+}
+function redactGatewayWsUrl(rawUrl) {
+  const parsed = new URL(rawUrl);
+  if (parsed.username) {
+    parsed.username = "<redacted>";
+  }
+  if (parsed.password) {
+    parsed.password = "<redacted>";
+  }
+  parsed.hostname = "<redacted-host>";
+  stripSensitiveSearchParams(parsed);
+  return parsed.toString();
+}
+function stripSensitiveSearchParams(parsed) {
+  const sensitiveKeys = ["token", "password", "gatewayId", "clientId", "requestId", "reqId", "traceId"];
+  for (const key of sensitiveKeys) {
+    parsed.searchParams.delete(key);
+  }
+}
 function normalizeText(data) {
   if (typeof data === "string")
     return data;
@@ -3261,7 +3280,7 @@ async function main() {
       console.log("Starting bridge runtime. Press Ctrl+C to stop.");
       console.log("");
     } else {
-      emitRuntimeLine(`Starting Clawket service runtime for gateway ${config.gatewayId}`);
+      emitRuntimeLine("Starting Clawket service runtime.");
     }
     if (isServiceMode) {
       writeServiceState();
@@ -3270,17 +3289,21 @@ async function main() {
       config,
       gatewayUrl,
       onLog: (line) => {
-        emitRuntimeLine(`[clawket] ${line}`);
+        emitRuntimeLine(sanitizeRuntimeLogLine(`[clawket] ${line}`));
       },
       onStatus: (snapshot) => {
         if (snapshot.lastError) {
-          emitRuntimeLine(`[status] relay=${snapshot.relayConnected ? "up" : "down"} gateway=${snapshot.gatewayConnected ? "up" : "down"} clients=${snapshot.clientCount} error=${snapshot.lastError}`);
+          emitRuntimeLine(sanitizeRuntimeLogLine(
+            `[status] relay=${snapshot.relayConnected ? "up" : "down"} gateway=${snapshot.gatewayConnected ? "up" : "down"} clients=${snapshot.clientCount} error=${snapshot.lastError}`
+          ));
           return;
         }
-        emitRuntimeLine(`[status] relay=${snapshot.relayConnected ? "up" : "down"} gateway=${snapshot.gatewayConnected ? "up" : "down"} clients=${snapshot.clientCount}`);
+        emitRuntimeLine(sanitizeRuntimeLogLine(
+          `[status] relay=${snapshot.relayConnected ? "up" : "down"} gateway=${snapshot.gatewayConnected ? "up" : "down"} clients=${snapshot.clientCount}`
+        ));
       },
-      onPendingPairRequest: (request) => {
-        emitRuntimeLine(`[pair-request] requestId=${request.requestId} deviceId=${request.deviceId || "<unknown>"} name=${request.displayName ?? "<unknown>"}`);
+      onPendingPairRequest: () => {
+        emitRuntimeLine("[pair-request] pending");
       }
     });
     runtime.start();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@p697/clawket",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "private": false,
   "type": "module",
   "description": "Clawket CLI for pairing and running the Relay bridge runtime",