Summary

• Repair the fix: add redaction patterns for JWTs, Basic auth, and custom security headers in logs.tail #67041 logs.tail redaction fix by covering raw Basic auth plus named gateway/security headers without changing auth semantics.
• Repair the fix(cli): emit JSON for gateway transport failures #79233 CLI JSON transport-error fix by formatting existing typed GatewayTransportError failures for JSON-mode health, gateway health, and devices list commands.
• Add focused regression coverage and changelog entries with contributor credit.

Fixes #66832.
Fixes #79108.
Supersedes #67041.
Supersedes #79233.

Verification

• git diff --check
• node scripts/run-vitest.mjs src/logging/redact.test.ts src/logging/log-tail-redaction.test.ts src/gateway/call.test.ts src/commands/health.test.ts src/cli/gateway-cli.coverage.test.ts src/cli/devices-cli.test.ts -- --reporter=dot
• node scripts/crabbox-wrapper.mjs run --provider blacksmith-testbox --blacksmith-org openclaw --blacksmith-workflow .github/workflows/ci-check-testbox.yml --blacksmith-job check --blacksmith-ref main --idle-timeout 90m --ttl 240m --timing-json -- CI=1 NODE_OPTIONS=--max-old-space-size=4096 OPENCLAW_TEST_PROJECTS_PARALLEL=6 OPENCLAW_VITEST_MAX_WORKERS=1 OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=900000 OPENCLAW_TESTBOX=1 OPENCLAW_TESTBOX_REMOTE_RUN=1 pnpm check:changed

Real behavior proof

Behavior addressed: logs.tail no longer returns raw Basic auth or named gateway/security header credentials; JSON-mode health/gateway health/devices list commands emit structured gateway_transport_error payloads for typed Gateway close/timeout failures instead of plain text errors.
Real environment tested: focused local Vitest through scripts/run-vitest.mjs; Blacksmith Testbox through Crabbox provider blacksmith-testbox.
Exact steps or command run after this patch: the Verification commands above, after rebasing onto origin/main.
Evidence after fix: focused tests passed 8 files / 348 tests; Testbox tbx_01krryzqc6djxxnbrpea1n3n0t, Actions run https://github.com/openclaw/openclaw/actions/runs/25968977106, exited 0.
Observed result after fix: redaction assertions remove raw fixture credentials from log-tail output, and CLI JSON assertions receive ok:false gateway_transport_error payloads without stderr fallback.
What was not tested: live gateway network failure against a real daemon; the code paths are covered with typed transport-error unit/CLI tests plus changed-gate lint/type/import-cycle checks.