fix(wechat): avoid logging QR poll tokens

src/ext/wechat/qr.test.ts

@@ -113,6 +113,31 @@ describe("pollWechatQrStatus", () => {
     expect(result.ilink_user_id).toBe("user-abc");
   });
 
+  it("does not leak the secret-ish qrcode token or query parameter if debug logging is enabled", async () => {
+    const qrToken = "secret-qr-cookie";
+    const debugEvents: string[] = [];
+    const { fetch, calls } = makeFetch(() => ({
+      ok: true,
+      status: 200,
+      body: JSON.stringify({ status: "wait" }),
+    }));
+
+    await pollWechatQrStatus({
+      baseUrl: "https://ilinkai.weixin.qq.com",
+      qrcode: qrToken,
+      fetch,
+      onDebug: (event) => debugEvents.push(event),
+    });
+
+    expect(calls[0]?.url).toContain(`qrcode=${qrToken}`);
+    const debugText = debugEvents.join("\n");
+    expect(debugText).toContain(
+      "poll request → https://ilinkai.weixin.qq.com/ilink/bot/get_qrcode_status",
+    );
+    expect(debugText).not.toContain(qrToken);
+    expect(debugText).not.toContain("qrcode=");
+  });
+
   it("returns 'wait' on transport-level failure so the orchestrator simply retries", async () => {
     const failing: FetchLike = async () => {
       throw new Error("ECONNRESET");

src/ext/wechat/qr.ts

@@ -123,6 +123,10 @@ function ensureTrailingSlash(url: string): string {
   return url.endsWith("/") ? url : `${url}/`;
 }
 
+function statusPollUrlForDebug(url: URL): string {
+  return `${url.origin}${url.pathname}`;
+}
+
 /** Bootstrap a new QR session against the fixed iLink host. The returned
  *  `qrcode` is the cookie used for subsequent polling; `qrcodeUrl` is what
  *  the operator scans in WeChat. */
@@ -214,7 +218,7 @@ export async function pollWechatQrStatus(params: {
 
   try {
     let response: Awaited<ReturnType<FetchLike>>;
-    params.onDebug?.(`poll request → ${url.toString()}`);
+    params.onDebug?.(`poll request → ${statusPollUrlForDebug(url)}`);
     try {
       response = await transport(url.toString(), {
         method: "GET",