fix(security): redact gateway auth token from console output

src/lib/agent-onboard.test.ts

@@ -25,8 +25,8 @@ const uiAgent = {
 // Regression fixture for issue #2078 — matches the text a user sees when
 // no token is available and prevents the wording from regressing to
 // something that implies port 8642 is a browser UI.
-const buildUrlsLoopback = (token: string | null, port: number): string[] => {
-  const hash = token ? `#token=${token}` : "";
+const buildUrlsLoopback = (token: string | null, port: number, forDisplay?: boolean): string[] => {
+  const hash = token ? (forDisplay ? "#token=REDACTED" : `#token=${token}`) : "";
   return [`http://127.0.0.1:${port}/${hash}`];
 };
 
@@ -76,17 +76,20 @@ describe("printDashboardUi — regression for #2078 (port 8642 is not a chat UI)
     expect(noteSpy).not.toHaveBeenCalled();
   });
 
-  it("prints tokenized URL with save-now warning for UI-kind agents", () => {
+  it("prints redacted token URL with retrieval hint for UI-kind agents", () => {
     printDashboardUi("sandbox-y", "tok", uiAgent, {
       note: noteSpy,
       buildControlUiUrls: buildUrlsLoopback,
     });
 
     const output = logSpy.mock.calls.map((args) => String(args[0])).join("\n");
-    expect(output).toContain(
-      "Ficticious UI (tokenized URL; treat it like a password; save it now - it will not be printed again)",
-    );
+    expect(output).toContain("Ficticious UI");
+    expect(output).not.toContain("tokenized URL; treat it like a password");
     expect(output).toContain("Port 19000 must be forwarded before opening this URL.");
-    expect(output).toContain("http://127.0.0.1:19000/#token=tok");
+    // Token should be redacted in display output
+    expect(output).toContain("http://127.0.0.1:19000/#token=REDACTED");
+    expect(output).not.toContain("#token=tok");
+    // Should print instructions for retrieving the full token
+    expect(output).toContain("To get the full token: nemoclaw sandbox-y connect");
   });
 });

src/lib/agent-onboard.ts

@@ -226,12 +226,12 @@ export function getAgentDashboardInfo(agent: AgentDefinition): {
  * back to the original UI-style output used by browser dashboards.
  */
 export function printDashboardUi(
-  _sandboxName: string,
+  sandboxName: string,
   token: string | null,
   agent: AgentDefinition,
   deps: {
     note: (msg: string) => void;
-    buildControlUiUrls: (token: string | null, port: number) => string[];
+    buildControlUiUrls: (token: string | null, port: number, forDisplay?: boolean) => string[];
   },
 ): void {
   const info = getAgentDashboardInfo(agent);
@@ -252,13 +252,16 @@ export function printDashboardUi(
   }
 
   if (token) {
-    console.log(
-      `  ${info.displayName} ${label} (tokenized URL; treat it like a password; save it now - it will not be printed again)`,
-    );
+    console.log(`  ${info.displayName} ${label}`);
     console.log(`  Port ${info.port} must be forwarded before opening this URL.`);
-    for (const url of deps.buildControlUiUrls(token, info.port)) {
+    // Print URLs with the token redacted (forDisplay=true) so the
+    // gateway auth token does not appear in terminal scrollback or
+    // CI/CD build logs. The full token can be retrieved via:
+    //   nemoclaw <name> connect → jq '.gateway.auth.token' /sandbox/.openclaw/openclaw.json
+    for (const url of deps.buildControlUiUrls(token, info.port, true)) {
       console.log(`  ${url}`);
     }
+    console.log(`  To get the full token: nemoclaw ${sandboxName} connect → jq '.gateway.auth.token' /sandbox/.openclaw/openclaw.json`);
   } else {
     deps.note("  Could not read gateway token from the sandbox (download failed).");
     console.log(`  ${info.displayName} ${label}`);

src/lib/dashboard.test.ts

@@ -120,4 +120,21 @@ describe("buildControlUiUrls", () => {
     const urls = buildControlUiUrls("my-token", 19000);
     expect(urls).toEqual(["http://127.0.0.1:19000/#token=my-token"]);
   });
+
+  it("redacts token in URL when forDisplay is true", () => {
+    const urls = buildControlUiUrls("my-secret-token", 18789, true);
+    expect(urls[0]).toContain("#token=my-s***********");
+    expect(urls[0]).not.toContain("my-secret-token");
+  });
+
+  it("fully masks short tokens (<=4 chars) when forDisplay is true", () => {
+    const urls = buildControlUiUrls("abcd", 18789, true);
+    expect(urls[0]).toContain("#token=****");
+    expect(urls[0]).not.toContain("abcd");
+  });
+
+  it("returns full token in URL when forDisplay is false", () => {
+    const urls = buildControlUiUrls("my-secret-token");
+    expect(urls[0]).toContain("#token=my-secret-token");
+  });
 });

src/lib/dashboard.ts

@@ -37,11 +37,35 @@ export function resolveDashboardForwardTarget(
   }
 }
 
+/**
+ * Redact a token for safe display — show only the first 4 characters
+ * and replace the rest with asterisks. Returns the full token when
+ * embedding in a URL fragment (forDisplay=false).
+ */
+function redactToken(token: string, forDisplay: boolean): string {
+  if (!forDisplay) return token;
+  if (token.length <= 4) return "*".repeat(token.length);
+  return token.slice(0, 4) + "*".repeat(token.length - 4);
+}
+
+/**
+ * Build Control UI URLs.
+ *
+ * @param token       Gateway auth token (null if unavailable)
+ * @param port        Dashboard port
+ * @param forDisplay  When true, the token is redacted in the URL so it
+ *                    is safe to print to stdout/CI logs. Callers that
+ *                    need a clickable URL for programmatic use should
+ *                    pass false (or omit — default is false for
+ *                    backward compatibility).
+ */
 export function buildControlUiUrls(
   token: string | null = null,
   port: number = CONTROL_UI_PORT,
+  forDisplay: boolean = false,
 ): string[] {
-  const hash = token ? `#token=${token}` : "";
+  const displayToken = token ? redactToken(token, forDisplay) : "";
+  const hash = token ? `#token=${displayToken}` : "";
   const baseUrl = `http://127.0.0.1:${port}`;
   const urls = [`${baseUrl}${CONTROL_UI_PATH}${hash}`];
   const chatUi = (process.env.CHAT_UI_URL || "").trim().replace(/\/$/, "");