From d35cbb75a3439464a237e7ddacef4b8697100541 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=A7=A6=E5=A5=87?= Date: Sat, 23 May 2026 22:31:49 +0800 Subject: [PATCH] fix(daemon-ui): forward opts in daemonBlockToPlainText tool case wenshao review 4350741340 (2026-05-23 13:00): the prior doudouOUC review fixed only the HTML path; the plainText tool case still called `daemonToolPreviewToPlainText(block.preview)` without `opts`, so `sanitizeUrls` + `maxFieldLength` were silently ignored when consumers used the plain-text projection (logs, clipboard, terminal mirroring). Symmetric fix to the HTML path (line 509). Added test verifying token stripping reaches `web_fetch.url` via plainText path. Validation: 153/153 SDK tests, SDK + WebUI typecheck clean. Generated with AI Co-authored-by: Claude Opus 4.7 --- .../sdk-typescript/src/daemon/ui/render.ts | 7 ++++- .../sdk-typescript/test/unit/daemonUi.test.ts | 26 +++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/packages/sdk-typescript/src/daemon/ui/render.ts b/packages/sdk-typescript/src/daemon/ui/render.ts index 08ef2ca321a..2dc67e517ec 100644 --- a/packages/sdk-typescript/src/daemon/ui/render.ts +++ b/packages/sdk-typescript/src/daemon/ui/render.ts @@ -357,7 +357,12 @@ export function daemonBlockToPlainText( ] .filter(Boolean) .join(' '); - const preview = daemonToolPreviewToPlainText(block.preview); + // wenshao review (review 4350741340): forward `opts` so + // `sanitizeUrls` + `maxFieldLength` reach the preview's URL fields + // (web_fetch URL, image_generation thumbnailUrl). The HTML path at + // line 509 already did this; plainText was missed in the prior + // doudouOUC fix. + const preview = daemonToolPreviewToPlainText(block.preview, opts); const status = `status: ${block.status}`; return [header, preview, status].filter(Boolean).join('\n'); } diff --git a/packages/sdk-typescript/test/unit/daemonUi.test.ts b/packages/sdk-typescript/test/unit/daemonUi.test.ts index e355d050735..52b784165bb 100644 --- a/packages/sdk-typescript/test/unit/daemonUi.test.ts +++ b/packages/sdk-typescript/test/unit/daemonUi.test.ts @@ -4270,3 +4270,29 @@ describe('KNOWN_DEVICE_FLOW_ERROR_KINDS stays in sync with public type', async ( expect(KNOWN_DEVICE_FLOW_ERROR_KINDS).toHaveLength(6); }); }); + +describe('daemonBlockToPlainText forwards opts (wenshao review 4350741340)', () => { + it('sanitizes URL on tool preview when opts.sanitizeUrls is set', async () => { + const { + daemonBlockToPlainText, + createDaemonToolPreview, + } = await import('../../src/daemon/ui/index.js'); + const block = { + id: 'b', + kind: 'tool' as const, + toolCallId: 't', + title: 'fetch', + status: 'completed', + preview: createDaemonToolPreview( + { url: 'https://api.example.com/x?token=SECRET&q=keep', method: 'GET' }, + { toolName: 'WebFetch', toolKind: 'tool' }, + ), + clientReceivedAt: 1, + createdAt: 1, + updatedAt: 1, + }; + const sanitized = daemonBlockToPlainText(block, { sanitizeUrls: true }); + expect(sanitized).not.toContain('SECRET'); + expect(sanitized).toContain('keep'); + }); +});