@@ -182,6 +182,20 @@ vi.mock("./debug-commands.js", () => ({
182182if (!raw.startsWith("/debug")) {
183183return null;
184184}
185+const parts = raw.trim().split(/\s+/);
186+const action = parts[1];
187+if (action === "set") {
188+const assignment = raw.slice(raw.indexOf(" set ") + 5).trim();
189+const equalsIndex = assignment.indexOf("=");
190+return {
191+action: "set",
192+path: assignment.slice(0, equalsIndex),
193+value: JSON.parse(assignment.slice(equalsIndex + 1)),
194+};
195+}
196+if (action === "unset") {
197+return { action: "unset", path: parts.slice(2).join(" ") };
198+}
185199return { action: "show" };
186200}),
187201}));
@@ -527,6 +541,56 @@ describe("command gating", () => {
527541expect(output).not.toContain("OPENCLAW_CONFIG_SET_CANARY_TOKEN_65623");
528542});
529543544+it("redacts secret-shaped fields from /debug show replies", async () => {
545+getConfigOverridesMock.mockReturnValueOnce({
546+gateway: {
547+auth: {
548+token: "OPENCLAW_DEBUG_SHOW_CANARY_TOKEN_65623",
549+},
550+},
551+channels: {
552+telegram: {
553+botToken: "OPENCLAW_DEBUG_SHOW_CANARY_BOT_TOKEN_65623",
554+},
555+},
556+messages: {
557+ackReaction: ":)",
558+},
559+});
560+const params = buildParams("/debug show", {
561+commands: { debug: true, text: true },
562+channels: { whatsapp: { allowFrom: ["*"] } },
563+} as OpenClawConfig);
564+params.command.senderIsOwner = true;
565+566+const result = await handleDebugCommand(params, true);
567+const output = result?.reply?.text ?? "";
568+569+expect(output).toContain("Debug overrides (memory-only)");
570+expect(output).toContain(REDACTED_SENTINEL);
571+expect(output).toContain("ackReaction");
572+expect(output).not.toContain("OPENCLAW_DEBUG_SHOW_CANARY_TOKEN_65623");
573+expect(output).not.toContain("OPENCLAW_DEBUG_SHOW_CANARY_BOT_TOKEN_65623");
574+});
575+576+it("redacts secret-shaped values from /debug set acknowledgements", async () => {
577+const params = buildParams(
578+'/debug set gateway.auth.token="OPENCLAW_DEBUG_SET_CANARY_TOKEN_65623"',
579+{
580+commands: { debug: true, text: true },
581+channels: { whatsapp: { allowFrom: ["*"] } },
582+} as OpenClawConfig,
583+);
584+params.command.senderIsOwner = true;
585+586+const result = await handleDebugCommand(params, true);
587+const output = result?.reply?.text ?? "";
588+589+expect(output).toContain("Debug override set: gateway.auth.token=");
590+expect(output).toContain(REDACTED_SENTINEL);
591+expect(output).not.toContain("OPENCLAW_DEBUG_SET_CANARY_TOKEN_65623");
592+});
593+530594it("returns explicit unauthorized replies for native privileged commands", async () => {
531595const configParams = buildParams("/config show", {
532596commands: { config: true, text: true },
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。