Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

logs.tail likely fails to redact several credential and assertion formats before returning log lines to operator.read clients. The current regex-based redaction covers some common token patterns, but it does not clearly cover generic JWTs, X-OpenClaw-Token, x-pomerium-jwt-assertion, or Basic auth headers. If those values appear in logs, logs.tail can expose live secrets or auth assertions to read-scoped clients.

Steps to reproduce

1. Ensure gateway logging is enabled to a readable log file.
2. Write or trigger a log line containing one of these formats, for example:

X-OpenClaw-Token: supersecretgatewaytoken1234567890

or

x-pomerium-jwt-assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature

or

Authorization: Basic c2VjcmV0OnBhc3M=

3. Connect to the gateway with a client that has operator.read scope.
4. Call logs.tail.
5. Inspect the returned lines payload and check whether the sensitive value is fully redacted.

Expected behavior

logs.tail should redact these credential and assertion formats before returning log lines to the client.

Actual behavior

The current default redaction patterns do not clearly cover these formats, so logs.tail may return them insufficiently redacted or fully visible.

OpenClaw version

v2026.4.14-104-g2985cec204

Operating system

Ubuntu 24.04

Install method

No response

Model

Not model specific

Provider / routing chain

client / Control UI / websocket client -> OpenClaw gateway -> logs.tail -> log file read -> redacted lines returned to caller

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response