fix(wechat): avoid logging QR poll tokens

[fallintoplace]

Summary

• Stop logging the WeChat QR status poll query string in debug output.
• Keep the real qrcode query parameter on the HTTP request so polling behavior is unchanged.
• Add regression coverage that debug logs do not include the raw QR token or qrcode=.

Why

The QR polling token is documented as secret-ish because exposing it can let someone hijack an in-flight login. The default debug path logged the full status URL, which included that token in the query string.

Validation

• npm run build:cli
• npx vitest run --project cli src/ext/wechat/qr.test.ts src/ext/wechat/login.test.ts

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Prevented sensitive QR tokens from appearing in debug output by sanitizing logged request URLs, improving privacy and security.

• Tests

  • Added a test to ensure debug logging does not expose QR tokens or sensitive query parameters during status polling.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ef6c6553-097a-43c7-9a71-04ed5502f822

📥 Commits

Reviewing files that changed from the base of the PR and between 2378cb3 and ef74c57.

📒 Files selected for processing (1)

• src/ext/wechat/qr.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/ext/wechat/qr.ts

---

📝 Walkthrough

Walkthrough

Sanitizes debug logging for WeChat QR status polling by adding a helper that formats URLs without query strings; the polling function uses it and a test ensures QR tokens and the qrcode= query substring are not present in debug output.

Changes

Debug Log Sanitization for WeChat QR Status

Layer / File(s)	Summary
Debug URL sanitization helper src/ext/wechat/qr.ts	statusPollUrlForDebug helper function strips query parameters from URLs for debug logging, keeping only origin and pathname to prevent exposure of sensitive data.
Integrate sanitization into polling function src/ext/wechat/qr.ts	pollWechatQrStatus debug logging updated to use the sanitization helper instead of logging the full URL string with query parameters.
Test debug output sanitization src/ext/wechat/qr.test.ts	New test verifies that debug logging does not leak the QR token or qrcode= query parameter, while still containing the request endpoint URL.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A tiny token hid from sight,
I trimmed the logs to keep it tight.
The path still shows where calls belong,
But secrets stay where they belong —
Hoppity hop, the logs stay right.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'fix(wechat): avoid logging QR poll tokens' directly and accurately summarizes the main change—preventing sensitive QR polling tokens from appearing in debug logs while preserving actual polling functionality.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨ Thanks for removing the WeChat QR poll token from debug logs while preserving the query parameter for polling behavior. This proposes a way to prevent token leakage in debug output and adds regression tests verifying the token no longer appears in logs.