fix(serve): use authority-scoped credential stripping in provider warning sanitizer

packages/cli/src/serve/workspace-providers-status.test.ts

@@ -562,6 +562,83 @@ describe('createWorkspaceProvidersStatusProvider', () => {
     expect(result.initialized).toBe(false);
   });
 
+  it('does not corrupt a pathless URL with a port followed by prose email (#8136)', async () => {
+    coreMock.throwModelsConfigError = true;
+    coreMock.modelsConfigErrorMessage =
+      'Cannot reach https://api.example:8443 - contact admin@example.com';
+    const provider = createWorkspaceProvidersStatusProvider({ env: {} });
+    await writeUserSettings({
+      security: { auth: { selectedType: 'openai' } },
+      modelProviders: {
+        openai: [{ id: 'model-a', name: 'Model A' }],
+      },
+    });
+
+    const result = await provider(workspace, true);
+
+    expect(result.errors?.[0]?.error).toBe(
+      'Cannot reach https://api.example:8443 - contact admin@example.com',
+    );
+  });
+
+  it('does not corrupt a pathless URL without a port followed by prose email (#8136)', async () => {
+    coreMock.throwModelsConfigError = true;
+    coreMock.modelsConfigErrorMessage =
+      'Cannot reach https://api.example - contact admin@example.com';
+    const provider = createWorkspaceProvidersStatusProvider({ env: {} });
+    await writeUserSettings({
+      security: { auth: { selectedType: 'openai' } },
+      modelProviders: {
+        openai: [{ id: 'model-a', name: 'Model A' }],
+      },
+    });
+
+    const result = await provider(workspace, true);
+
+    expect(result.errors?.[0]?.error).toBe(
+      'Cannot reach https://api.example - contact admin@example.com',
+    );
+  });
+
+  it('strips credentials from a pathless URL and keeps host and prose (#8136)', async () => {
+    coreMock.throwModelsConfigError = true;
+    coreMock.modelsConfigErrorMessage =
+      'Failed https://user:pass@host.example:8443 - contact admin@example.com';
+    const provider = createWorkspaceProvidersStatusProvider({ env: {} });
+    await writeUserSettings({
+      security: { auth: { selectedType: 'openai' } },
+      modelProviders: {
+        openai: [{ id: 'model-a', name: 'Model A' }],
+      },
+    });
+
+    const result = await provider(workspace, true);
+
+    expect(result.errors?.[0]?.error).toBe(
+      'Failed https://host.example:8443 - contact admin@example.com',
+    );
+    expect(JSON.stringify(result)).not.toContain('user:pass@');
+  });
+
+  it('strips a password containing @ in full (#8136)', async () => {
+    coreMock.throwModelsConfigError = true;
+    coreMock.modelsConfigErrorMessage =
+      'Failed loading provider https://user:p@ssw0rd-tail@broken.example/v1';
+    const provider = createWorkspaceProvidersStatusProvider({ env: {} });
+    await writeUserSettings({
+      security: { auth: { selectedType: 'openai' } },
+      modelProviders: {
+        openai: [{ id: 'model-a', name: 'Model A' }],
+      },
+    });
+
+    const result = await provider(workspace, true);
+
+    expect(JSON.stringify(result)).toContain('https://broken.example/v1');
+    expect(JSON.stringify(result)).not.toContain('ssw0rd-tail');
+    expect(JSON.stringify(result)).not.toContain('p@ssw0rd');
+  });
+
   async function writeUserSettings(settings: Record<string, unknown>) {
     await fs.writeFile(
       path.join(qwenHome, 'settings.json'),

packages/cli/src/serve/workspace-providers-status.ts

@@ -260,7 +260,7 @@ function sanitizeProviderWarning(warning: string): string {
 
     const segmentEnd = findUrlSegmentEnd(warning, next.index, next.marker);
     const segment = warning.slice(next.index, segmentEnd);
-    result += sanitizeProviderWarningSegment(segment, next.marker.length);
+    result += sanitizeProviderWarningSegment(segment);
 
     index = segmentEnd;
     next = findNextUrlStart(warning, index);
@@ -295,36 +295,22 @@ function findUrlSegmentEnd(
   return Math.min(lineEnd, nextUrl?.index ?? value.length);
 }
 
-function sanitizeProviderWarningSegment(
-  segment: string,
-  markerLength: number,
-): string {
-  const at = segment.indexOf('@', markerLength);
-  if (
-    at !== -1 &&
-    hasCredentialPrefix(segment, markerLength, at) &&
-    segment[at + 1] !== undefined &&
-    /[A-Za-z0-9.[\]-]/.test(segment[at + 1])
-  ) {
-    return `${segment.slice(0, markerLength)}${segment.slice(at + 1)}`;
+function sanitizeProviderWarningSegment(segment: string): string {
+  // When the whole segment is a URL that sanitizeProviderBaseUrl confirms
+  // carries real userinfo (it changes the segment), use its result directly.
+  // This handles space-containing-credential URLs that URL_LIKE_PATTERN cannot
+  // match past the whitespace, and the '@'-in-password shape (last '@' wins).
+  // The veto in sanitizeProviderBaseUrl leaves pathless-URL + prose-email
+  // shapes unchanged, so a prose email's '@' is never stripped. #8136.
+  const sanitized = sanitizeProviderBaseUrl(segment);
+  if (sanitized !== segment) {
+    return sanitized;
   }
-
   return segment.replace(URL_LIKE_PATTERN, (url) =>
     sanitizeProviderBaseUrl(url),
   );
 }
 
-function hasCredentialPrefix(
-  segment: string,
-  markerLength: number,
-  at: number,
-): boolean {
-  const colon = segment.indexOf(':', markerLength);
-  if (colon === -1 || colon > at) return false;
-  const username = segment.slice(markerLength, colon);
-  return !/[/?#\s'"`<>]/.test(username);
-}
-
 function buildCurrent(
   authType: AuthType | undefined,
   modelId: string | undefined,

packages/cli/src/utils/acpModelUtils.test.ts

@@ -249,6 +249,174 @@ describe('acpModelUtils', () => {
     ['https://user:p?x@api.example/v1', 'https://api.example/v1'],
     ['https://user:p#x@api.example/v1', 'https://api.example/v1'],
     ['https://user:secret@api.example', 'https://api.example'],
+    // #8136: pathless URL + prose email shapes. WHATWG misparses these as
+    // userinfo; the veto (all-digit port before first whitespace) protects the
+    // with-port shape, and the pathless-prose guard protects the no-colon shape.
+    [
+      'https://api.example:8443 - contact admin@example.com',
+      'https://api.example:8443 - contact admin@example.com',
+    ],
+    [
+      'https://api.example - contact admin@example.com',
+      'https://api.example - contact admin@example.com',
+    ],
+    [
+      'https://ollama.local - contact admin@example.com',
+      'https://ollama.local - contact admin@example.com',
+    ],
+    // Credentials + pathless + email: strip the credential, keep host + prose.
+    [
+      'https://user:pass@host.example:8443 - contact admin@example.com',
+      'https://host.example:8443 - contact admin@example.com',
+    ],
+    // Space-in-password: the last '@' within the bounded authority is the real
+    // userinfo terminator (the password's '@' precedes it). #8136 R1-1/R1-3.
+    [
+      'https://user:sec ret@host.example/v1 - contact admin@example.com',
+      'https://host.example/v1 - contact admin@example.com',
+    ],
+    ['https://user:p@ss word@host.example/v1', 'https://host.example/v1'],
+    // R1-2 KNOWN RESIDUAL: digit-prefix + space password is locally
+    // indistinguishable from a dotless host + port + prose email; the veto
+    // fires and the credential leaks. Same tradeoff class as R5-7, pending
+    // maintainer sign-off. #8136 R1-2.
+    ['https://user:1234 secret@host', 'https://user:1234 secret@host'],
+    // #8136 R3: passwords/hostnames the previous host-shaped-char heuristic
+    // mishandled. The structural terminator scan resolves these.
+    // Password containing '@' (pathless): strip at the LAST '@', not the first.
+    ['https://user:p@ss@host', 'https://host'],
+    // Underscore-leading host (previously outside HOST_SHAPED_CHAR): strip.
+    ['https://user:pass@_host', 'https://_host'],
+    // Tab immediately after '@' (WHATWG strips it as userinfo terminator): strip.
+    [`https://user:pass@\thost`, 'https://\thost'],
+    // Password containing '@' AND whitespace (bounded authority): the last '@'
+    // within the bounded authority is the terminator.
+    ['https://user:p@ss word@host.example/v1', 'https://host.example/v1'],
+    // Whitespace in the password (pathless): the '@' whose following text is a
+    // clean hostname is the terminator, so the password's whitespace does not
+    // end the scan. #8136 R3-5.
+    ['https://user:pass word@host', 'https://host'],
+    ['https://user:p@ss word@host', 'https://host'],
+    // Unicode whitespace in the password (WHATWG percent-encodes it): strip.
+    ['https://user:pa ss@host', 'https://host'],
+    // #8136 R3-6: prose with a path - the prose email's '@' must not destroy the
+    // host. The pathless prose veto fires regardless of a later delimiter.
+    [
+      'https://ollama.local - email admin@example.com or check /var/log/qwen',
+      'https://ollama.local - email admin@example.com or check /var/log/qwen',
+    ],
+    // #8136 R4-1: catch-branch (new URL throws) prose '@' after whitespace must
+    // not become the strip point - strip the credential, keep host + prose.
+    ['https://user:pass@host - ping admin@', 'https://host - ping admin@'],
+    // R9-7 KNOWN RESIDUAL: a real host + prose email with a VALID email domain
+    // is indistinguishable from a real credential whose terminator is that
+    // email's '@' - the prose email's host replaces the real host. (A '%zz'
+    // invalid domain makes CLEAN_HOST_AFTER fail and passes spuriously; this
+    // pins the real-domain behavior instead.) Same class as R5-1, pending
+    // maintainer sign-off.
+    ['https://user@host - contact admin@example.com', 'https://example.com'],
+    // #8136 R4-3: whitespace-less multi-'@' prose - the FIRST '@' ends the
+    // userinfo; the prose email's '@' is not a terminator.
+    [
+      'https://u:p@h,see(admin@example.com)',
+      'https://h,see(admin@example.com)',
+    ],
+    [
+      'https://u:p@h,see(admin@example.com)/x',
+      'https://h,see(admin@example.com)/x',
+    ],
+    // #8136 R4-4/R4-5: backslash - a Windows domain\user:pass@ credential strips
+    // as a single userinfo run, while '\' terminates the authority for prose.
+    ['https://DOMAIN\\user:pass@proxy', 'https://proxy'],
+    ['https://user:pass@host\\path', 'https://host\\path'],
+    // #8136 R5-3: an '@' in the password with an underscore host still strips -
+    // CLEAN_HOST_AFTER accepts underscore-leading hosts.
+    ['https://user:p@ss@_host', 'https://_host'],
+    ['https://user:pass@_host:8080', 'https://_host:8080'],
+    // #8136 R5-14: URL schemes are case-insensitive; uppercase must still strip.
+    ['HTTPS://user:pass@host/v1', 'HTTPS://host/v1'],
+    ['HTTP://user:pass@host', 'HTTP://host'],
+    // #8136 R5-2: a leading '@' (empty userinfo) does not loop and is a no-op.
+    ['https://@host', 'https://host'],
+    // #8136 R5-1/R5-7 KNOWN RESIDUAL: a dotted username + digit-prefix password
+    // followed by space is locally indistinguishable from a dotted host + port
+    // + prose email; the veto fires and the credential leaks. Same tradeoff as
+    // R1-2, pending maintainer sign-off.
+    ['https://foo.bar:1234 secret@host', 'https://foo.bar:1234 secret@host'],
+    // #8136 R1-7: IPv6 bracket + port + prose email must stay unchanged. The
+    // prose veto skips the bracket's inner colons and accepts an em-dash/empty
+    // port candidate.
+    [
+      'https://[::1]:8443 — contact admin@example.com',
+      'https://[::1]:8443 — contact admin@example.com',
+    ],
+    [
+      'https://ollama.local: please contact admin@example.com',
+      'https://ollama.local: please contact admin@example.com',
+    ],
+    // #8136 R6-1: a port followed by punctuation (`;`/`,`/`.`) + prose email.
+    [
+      'https://api.example:8443; contact admin@example.com',
+      'https://api.example:8443; contact admin@example.com',
+    ],
+    // #8136 R7-3: a port followed by multiple punctuation chars + prose email.
+    [
+      'https://api.example:8443,. contact admin@example.com',
+      'https://api.example:8443,. contact admin@example.com',
+    ],
+    // #8136 R7-10: a Unicode (IDN) host is a clean hostname — strip the credential.
+    ['https://user:pass@例子.测试/v1', 'https://例子.测试/v1'],
+    // #8136 R7-5 KNOWN RESIDUAL: an '@' in the path (npm scoped) with a
+    // host:port-shaped authority before it is stripped by the no-'@' fallback
+    // (base has the same behavior — the between-run has no whitespace). Same
+    // tradeoff class, pending maintainer sign-off.
+    [
+      'https://registry.example: check /node_modules/@qwen/pkg',
+      'https://qwen/pkg',
+    ],
+    // #8136 R7-1 KNOWN RESIDUAL: a colonless username containing whitespace
+    // (`user @host`) is indistinguishable from a prose `host @host` shape;
+    // the prose veto fires and it leaks. Pending maintainer sign-off.
+    ['https://user @host.example/v1', 'https://user @host.example/v1'],
+    // #8136 R5-12: a backslash-free authority with a later prose `a:b@c` is NOT
+    // misread as a Windows credential by findAuthorityEnd (R5-12 fixed the
+    // windowsCred scan bound). The remaining leak is the R5-1 residual class.
+    ['https://user:pass@host a:b@c', 'https://c'],
+    // #8136 R5-1/R6-3 KNOWN RESIDUAL: a real terminator in the first '@' with a
+    // dotless host after it, followed by prose with an '@host', is
+    // indistinguishable from a password containing '@' + a real terminator after
+    // whitespace (`user:p@ss word@host` -> `host`). The prose shape's host gets
+    // replaced by the prose email's domain; same tradeoff class as R1-2,
+    // pending maintainer sign-off.
+    [
+      'https://user:pass@ollama - contact admin@example.com',
+      'https://example.com',
+    ],
+    [
+      'https://user:p@ss word@host.example - contact admin@example.com',
+      'https://example.com',
+    ],
+    // #8136 repro-1 (with-path port + prose email): must stay unchanged - the
+    // path bounds the authority, so the prose '@' is never the strip point.
+    [
+      'https://api.example:8443/v1 - contact admin@example.com',
+      'https://api.example:8443/v1 - contact admin@example.com',
+    ],
+    // #8136 repro-1 verbatim (em-dash as in the issue) also stays unchanged.
+    [
+      'https://api.example:8443/v1 — contact admin@example.com',
+      'https://api.example:8443/v1 — contact admin@example.com',
+    ],
+    // URL-throwing shapes (invalid %, space in host) + prose email: do not
+    // strip the prose '@'. #8136 R2-2.
+    [
+      'https://api.example%/v1, contact admin@example.com',
+      'https://api.example%/v1, contact admin@example.com',
+    ],
+    [
+      'https://my service/v1 - contact admin@example.com',
+      'https://my service/v1 - contact admin@example.com',
+    ],
   ])('sanitizes provider base URL credentials for %s', (input, expected) => {
     expect(sanitizeProviderBaseUrl(input)).toBe(expected);
   });