[Repo Assist] fix(security): apply TokenSanitizer to WSL diagnostic output

[github-actions]

🤖 Repo Assist — automated AI assistant.

Summary

DiagnosticFormatter.SanitizeForDiagnostic (and the engine-level copy) applied only SecretRedactor.Redact, which uses a regex that matches key=value patterns (gateway-token=..., bootstrap-token=..., etc). It did not cover raw token formats that appear when a CLI tool echoes its own arguments in an error message, for example:

Error: failed to authenticate with token a3f8c2e1...  ← 64-char hex

TokenSanitizer already has BareGatewayHexTokenPattern ([0-9a-f]{64}) and LongBase64UrlPattern ([A-Za-z0-9_-]{43}) that catch these. The fix simply chains both sanitizers together.

Root cause

Both SanitizeForDiagnostic methods (lines ~730 and ~1150 in LocalGatewaySetup.cs) ended after SecretRedactor.Redact. TokenSanitizer.Sanitize was already used elsewhere in the file (line 2159) for the same purpose but was missing from the diagnostic path.

Fix

// Before:
var sanitized = SecretRedactor.Redact(value).Replace("\0", string.Empty).Trim();

// After:
var sanitized = TokenSanitizer.Sanitize(SecretRedactor.Redact(value)).Replace("\0", string.Empty).Trim();

Both SanitizeForDiagnostic copies updated identically.

Relation to issue #281

This addresses item #4 from issue #281:

"Add tests that simulate stdout/stderr containing --token and ensure persisted diagnostics contain only redacted values."

The --token flag value itself is a CLI argument handled by RedactArgument, which replaces the whole argument. The gap this PR closes is raw tokens that appear in subprocess error output (stdout/stderr), not in the argument list.

Test Status

New tests added (24 total):

• LocalGatewaySetupSecretRedactorTests (15 tests) — key-value patterns: gateway-token=, bootstrap-token=, device-token:, auth-token=, setup-code=, setup_code=, secret:, private-key=; case-insensitive; non-secret text unchanged; empty string
• LocalGatewaySetupDiagnosticFormatterTests (7 tests) — exit code included; stdout/stderr included; empty stdout/stderr omitted; key-value gateway token in stdout redacted; raw 64-char hex token in stderr redacted ← the new scenario; long output truncated; null bytes stripped

Baseline comparison (Linux runner):

• dotnet test OpenClaw.Tray.Tests --no-restore — 718 passed / 7 pre-existing failures / 1 skipped (was 694/7/1 before; same 7 pre-existing failures, 24 new passing tests)
• dotnet test OpenClaw.Shared.Tests --no-restore — all passed ✅ (exit code 0)
• build.ps1 — requires Windows; infrastructure limitation on Linux runner

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a

[shanselman]

Validated locally on Windows after latest changes: \.\build.ps1, \dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore, and \dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore\ all passed. Note: build.ps1 still reports the existing Windows 10 SDK detection warning, but the build completed successfully.