PR #72319: fix(agents): redact secrets in tool call output to Control UI

• Repository: openclaw/openclaw
• Author: volcano303
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/72319

Description (problem / solution / changelog)

Fixes #72283

Problem

Tool call results streamed to the Control UI render configuration JSON in plaintext, including provider API keys (OpenRouter, Ollama, Tavily…), channel credentials, and auth tokens. The same data is already redacted in /config show (config.get) and skills.update responses — tool call output was bypassing the redaction layer.

The leak is reproducible by asking the assistant to inspect plugin/model configuration: any tool whose text output happens to contain credentials (read of a config file, bash/exec running cat, plugin/MCP tools dumping their state) emits the plaintext over the agent-event websocket.

Fix

sanitizeToolResult() in src/agents/pi-embedded-subscribe.tools.ts is the chokepoint every tool result passes through on its way to the Control UI — both handleToolExecutionUpdate (partial) and handleToolExecutionEnd (final) call it before emitAgentEvent.

This PR runs each text content block through the existing redactSensitiveText(..., { mode: "tools" }) helper from src/logging/redact.ts before truncation. That utility already covers the patterns called out in the issue — JSON apiKey, ENV-style *_KEY=/*_TOKEN=/*_SECRET= assignments, Authorization: Bearer …, PEM blocks, and common token prefixes (sk-, ghp_, xox[baprs]-, AIza…, pplx-, gsk_, npm_, Telegram bot tokens) — and is the same utility used elsewhere for log redaction.

Production change: 1 import + 1 line. No new abstractions, no per-tool patches.

Tests

Added 5 new cases to pi-embedded-subscribe.tools.test.ts covering:

• JSON-style "apiKey": "…" field
• ENV-style OPENROUTER_API_KEY=… assignment
• Bare common-prefix tokens (sk-…, ghp_…)
• Authorization: Bearer … header
• Passthrough of non-sensitive text (no false positives)
• Existing image-content stripping behavior preserved (regression check)

Verification

• pnpm exec vitest run src/agents/pi-embedded-subscribe.tools.test.ts — 8/8 passed
• pnpm tsgo:core:test — exit 0, no diagnostics
• Manual repro of issue's steps (open Control UI, ask for plugin/model config, confirm credentials are masked in tool call output)

Changed files

• src/agents/pi-embedded-subscribe.handlers.tools.test.ts (modified, +87/-1)
• src/agents/pi-embedded-subscribe.handlers.tools.ts (modified, +5/-3)
• src/agents/pi-embedded-subscribe.tools.test.ts (modified, +126/-1)
• src/agents/pi-embedded-subscribe.tools.ts (modified, +47/-21)
• src/logging/redact.ts (modified, +16/-0)