fix(gateway): redact fast-path console logs

rubencu · rubencu · commit 2d7b20064aa9 · 2026-05-09T22:28:03.000-04:00
diff --git a/src/cli/run-main.exit.test.ts b/src/cli/run-main.exit.test.ts
@@ -34,6 +34,7 @@ const runCrestodianMock = vi.hoisted(() =>
 const commanderParseAsyncMock = vi.hoisted(() => vi.fn(async () => {}));
 const addGatewayRunCommandMock = vi.hoisted(() => vi.fn((command: unknown) => command));
 const emitCliBannerMock = vi.hoisted(() => vi.fn());
+const enableConsoleCaptureMock = vi.hoisted(() => vi.fn());
 const progressDoneMock = vi.hoisted(() => vi.fn());
 const createCliProgressMock = vi.hoisted(() =>
   vi.fn(() => ({
@@ -95,6 +96,11 @@ vi.mock("./banner.js", () => ({
   emitCliBanner: emitCliBannerMock,
 }));
 
+vi.mock("../logging.js", async () => ({
+  ...(await vi.importActual<typeof import("../logging.js")>("../logging.js")),
+  enableConsoleCapture: enableConsoleCaptureMock,
+}));
+
 vi.mock("./container-target.js", () => ({
   maybeRunCliInContainer: maybeRunCliInContainerMock,
   parseCliContainerArgs: (argv: string[]) => ({ ok: true, container: null, argv }),
@@ -325,6 +331,17 @@ describe("runCli exit behavior", () => {
     ]);
   });
 
+  it("installs console capture before parsing the gateway foreground fast path", async () => {
+    await runCli(["node", "openclaw", "gateway", "--force"]);
+
+    expect(enableConsoleCaptureMock).toHaveBeenCalledTimes(1);
+    expect(commanderParseAsyncMock).toHaveBeenCalledTimes(1);
+    const captureOrder = enableConsoleCaptureMock.mock.invocationCallOrder[0] ?? 0;
+    const parseOrder = commanderParseAsyncMock.mock.invocationCallOrder[0] ?? 0;
+    expect(captureOrder).toBeGreaterThan(0);
+    expect(parseOrder).toBeGreaterThan(captureOrder);
+  });
+
   it("honors banner suppression on the gateway foreground fast path", async () => {
     process.env.OPENCLAW_HIDE_BANNER = "1";
 
diff --git a/src/cli/run-main.ts b/src/cli/run-main.ts
@@ -150,13 +150,15 @@ async function tryRunGatewayRunFastPath(
     { VERSION },
     { emitCliBanner },
     { resolveCliStartupPolicy },
+    { enableConsoleCapture },
   ] = await startupTrace.measure("gateway-run-imports", () =>
     Promise.all([
       import("commander"),
       import("./gateway-cli/run.js"),
       import("../version.js"),
       import("./banner.js"),
       import("./command-startup-policy.js"),
+      import("../logging.js"),
     ]),
   );
   const invocation = resolveCliArgvInvocation(argv);
@@ -182,6 +184,7 @@ async function tryRunGatewayRunFastPath(
   addGatewayRunCommand(
     gateway.command("run").description("Run the WebSocket Gateway (foreground)"),
   );
+  enableConsoleCapture();
   try {
     await startupTrace.measure("gateway-run-parse", () => program.parseAsync(argv));
   } catch (error) {
diff --git a/src/logging/console-capture.test.ts b/src/logging/console-capture.test.ts
@@ -1,4 +1,5 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { setVerbose } from "../global-state.js";
 import {
   enableConsoleCapture,
   resetLogger,
@@ -28,6 +29,7 @@ beforeEach(() => {
   loggingState.forceConsoleToStderr = false;
   loggingState.consoleTimestampPrefix = false;
   loggingState.rawConsole = null;
+  setVerbose(false);
   resetLogger();
 });
 
@@ -37,6 +39,7 @@ afterEach(() => {
   loggingState.forceConsoleToStderr = false;
   loggingState.consoleTimestampPrefix = false;
   loggingState.rawConsole = null;
+  setVerbose(false);
   resetLogger();
   setLoggerOverride(null);
   vi.restoreAllMocks();
@@ -187,6 +190,21 @@ describe("enableConsoleCapture", () => {
     other.code = "EACCES";
     expect(() => process.stdout.emit("error", other)).toThrow("EACCES");
   });
+
+  it("suppresses libsignal session dumps even in verbose mode", () => {
+    setLoggerOverride({ level: "info", file: tempLogPath() });
+    const info = vi.fn();
+    console.info = info;
+    setVerbose(true);
+    enableConsoleCapture();
+
+    console.info("Closing session:", {
+      currentRatchet: { rootKey: Buffer.from("root-key") },
+      privKey: "private-key",
+    });
+
+    expect(info).not.toHaveBeenCalled();
+  });
 });
 
 function tempLogPath() {
diff --git a/src/logging/console.ts b/src/logging/console.ts
@@ -149,12 +149,12 @@ const SUPPRESSED_CONSOLE_PREFIXES = [
 ] as const;
 
 function shouldSuppressConsoleMessage(message: string): boolean {
-  if (isVerbose()) {
-    return false;
-  }
   if (SUPPRESSED_CONSOLE_PREFIXES.some((prefix) => message.startsWith(prefix))) {
     return true;
   }
+  if (isVerbose()) {
+    return false;
+  }
   return false;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -149,12 +149,12 @@ const SUPPRESSED_CONSOLE_PREFIXES = [`
`149`	`149`	`] as const;`
`150`	`150`
`151`	`151`	`function shouldSuppressConsoleMessage(message: string): boolean {`
`152`		`- if (isVerbose()) {`
`153`		`- return false;`
`154`		`- }`
`155`	`152`	`if (SUPPRESSED_CONSOLE_PREFIXES.some((prefix) => message.startsWith(prefix))) {`
`156`	`153`	`return true;`
`157`	`154`	`}`
	`155`	`+ if (isVerbose()) {`
	`156`	`+ return false;`
	`157`	`+ }`
`158`	`158`	`return false;`
`159`	`159`	`}`
`160`	`160`