fix(status): show active provider route instead of legacy provider bucket (Gitlawb#1673)

* fix(status): show active provider route instead of legacy bucket

The /status command collapsed many concrete providers (OpenRouter, Groq,
Ollama, Fireworks AI, etc.) into a single "OpenAI-compatible" label, making
multi-provider setups hard to verify and debug.

When apiProvider resolves to the generic "openai" bucket, /status now uses
route metadata to surface the real active route:
  Provider route: OpenRouter
  Transport: OpenAI-compatible API
  OpenAI base URL: https://openrouter.ai/api/v1
  Model: anthropic/claude-sonnet-4.5
  Credential: OPENROUTER_API_KEY configured

The legacy "OpenAI-compatible" label and fallback are preserved for unknown
custom base URLs. Dedicated provider buckets (nvidia-nim, minimax, codex,
github, xai, gemini, bedrock, vertex, foundry, firstParty, mistral) already
have accurate labels and are left untouched.

Credential display uses env-var names only (never values). Transport kind and
route label come from the existing descriptor-driven route metadata; no new
hardcoded provider maps or network calls are introduced.

* fix(status): include route status defaults

* fix(status): address route status review findings

* fix(status): cover route secret redaction review

* fix(status): avoid duplicate route resolution

* fix(status): redact base URL query credentials

* fix(status): harden status URL secret redaction

* fix(status): redact route secrets in status text

* test(status): cover fallback URL fragment redaction

* test(status): isolate route status provider imports

* fix(status): redact encoded route secrets

* fix(status): redact encoded query secrets safely

* fix(status): redact nested encoded query secrets

* fix(status): redact encoded secret substrings

* fix(status): redact strict encoded secret variants

Author: chioarub

src/utils/providerProfile.test.ts

@@ -1588,6 +1588,7 @@ test('maskSecretForDisplay preserves only a short prefix and suffix', () => {
 test('redactSecretValueForDisplay masks poisoned display fields that equal configured secrets', () => {
   const apiKey = 'sk-secret-12345678'
   const authHeaderValue = 'hicap-header-secret'
+  const routeApiKey = 'gsk-route-secret-value'
 
   assert.equal(
     redactSecretValueForDisplay(apiKey, { OPENAI_API_KEY: apiKey }),
@@ -1599,10 +1600,49 @@ test('redactSecretValueForDisplay masks poisoned display fields that equal confi
     }),
     'hic...ret',
   )
+  assert.equal(
+    redactSecretValueForDisplay(routeApiKey, { GROQ_API_KEY: routeApiKey }),
+    'gsk...lue',
+  )
   assert.equal(
     redactSecretValueForDisplay('gpt-4o', { OPENAI_API_KEY: apiKey }),
     'gpt-4o',
   )
+  assert.equal(
+    redactSecretValueForDisplay('gpt-4o', { OPENAI_MODEL: 'gpt-4o' }),
+    'gpt-4o',
+  )
+})
+
+test('redactSecretValueForDisplay collects common secret env suffixes', () => {
+  const secretEnvCases = [
+    ['ROUTE_API_KEY', 'route-api-secret-value'],
+    ['ROUTE_AUTH_HEADER_VALUE', 'route-auth-header-secret'],
+    ['SERVICE_PASSWORD', 'database-password-secret'],
+    ['SERVICE_SECRET', 'service-secret-value'],
+    ['AWS_SECRET_ACCESS_KEY', 'aws-secret-access-value'],
+    ['OAUTH_SECRET_KEY', 'oauth-secret-key-value'],
+    ['GITHUB_TOKEN', 'github-token-secret'],
+  ] as const
+
+  for (const [key, value] of secretEnvCases) {
+    const source = { [key]: value }
+
+    assert.equal(
+      redactSecretValueForDisplay(value, source),
+      maskSecretForDisplay(value),
+    )
+    assert.equal(sanitizeProviderConfigValue(value, source), undefined)
+  }
+
+  assert.equal(
+    redactSecretValueForDisplay('gpt-4o', { OPENAI_MODEL: 'gpt-4o' }),
+    'gpt-4o',
+  )
+  assert.equal(
+    sanitizeProviderConfigValue('gpt-4o', { OPENAI_MODEL: 'gpt-4o' }),
+    'gpt-4o',
+  )
 })
 
 test('sanitizeProviderConfigValue drops secret-like poisoned values', () => {

src/utils/providerSecrets.test.ts

@@ -20,6 +20,7 @@ import {
 const FAKE_OPENAI_KEY = 'sk-fake-openai-1234567890abcdef'
 const FAKE_GEMINI_KEY = 'AIzaSyFAKEGEMINIkey1234567890abcdefghijklmnopqr'
 const FAKE_GITHUB_PAT = 'ghp_FAKEgithubPat0123456789abcdefghij'
+const FAKE_GITHUB_USER_TOKEN = 'ghu_1234567890abcdef1234567890abcdef1234'
 const FAKE_LONG_OPAQUE = 'live-pr-1234567890abcdefABCDEF1234567890abcdef'
 const FAKE_JWT_TOKEN = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
 
@@ -179,6 +180,7 @@ describe('redactSecretValueForDisplay', () => {
     expect(redactSecretValueForDisplay('sk-ant-fakeAnthropicToken-1234567890')).toBe('sk-...890')
     expect(redactSecretValueForDisplay('AIzaSyFAKEGEMINIkey1234567890abcdefghijklmnopqr')).toBe('AIz...pqr')
     expect(redactSecretValueForDisplay(FAKE_GITHUB_PAT)).toBe('ghp...hij')
+    expect(redactSecretValueForDisplay(FAKE_GITHUB_USER_TOKEN)).toBe('ghu...234')
     expect(redactSecretValueForDisplay(FAKE_LONG_OPAQUE)).toBe('liv...def')
     expect(redactSecretValueForDisplay(FAKE_JWT_TOKEN)).toBe('eyJ...w5c')
   })
@@ -242,11 +244,12 @@ describe('redactSecretSubstringsForDisplay', () => {
     const leakedKey = 'sk-liveLeakToken1234567890ABCdef'
 
     const redacted = redactSecretSubstringsForDisplay(
-      `Invalid API key: ${leakedKey}`,
+      `Invalid API key: ${leakedKey}; GitHub token: ${FAKE_GITHUB_USER_TOKEN}`,
     )
 
-    expect(redacted).toBe('Invalid API key: sk-...def')
+    expect(redacted).toBe('Invalid API key: sk-...def; GitHub token: ghu...234')
     expect(redacted).not.toContain(leakedKey)
+    expect(redacted).not.toContain(FAKE_GITHUB_USER_TOKEN)
   })
 
   test('redacts JWT-shaped values embedded in longer messages', () => {
@@ -285,6 +288,7 @@ describe('sanitizeProviderConfigValue', () => {
     expect(sanitizeProviderConfigValue('sk-ant-looks-like-a-key-1234567890')).toBeUndefined()
     expect(sanitizeProviderConfigValue('AIzaSySomeGeminiKey1234567890abcdefghijklmnopqr')).toBeUndefined()
     expect(sanitizeProviderConfigValue(FAKE_GITHUB_PAT)).toBeUndefined()
+    expect(sanitizeProviderConfigValue(FAKE_GITHUB_USER_TOKEN)).toBeUndefined()
     expect(sanitizeProviderConfigValue(FAKE_JWT_TOKEN)).toBeUndefined()
   })
 

src/utils/providerSecrets.ts

@@ -90,13 +90,14 @@ const SECRET_PREFIX_PATTERNS = [
   /^AIza/,
   /^ghp_/,
   /^gho_/,
+  /^ghu_/,
   /^ghs_/,
   /^ghr_/,
   /^github_pat_/,
 ]
 
 const SECRET_PREFIX_SUBSTRING_PATTERN =
-  /(?:sk-ant-|sk-|AIza|ghp_|gho_|ghs_|ghr_|github_pat_)[A-Za-z0-9._-]{8,}/g
+  /(?:sk-ant-|sk-|AIza|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_)[A-Za-z0-9._-]{8,}/g
 const JWT_SUBSTRING_PATTERN =
   /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g
 
@@ -152,16 +153,38 @@ function hasLowerUpperDigit(value: string): boolean {
   return hasLower && hasUpper && hasDigit
 }
 
+// Redaction sources may be full process env objects, so also collect values
+// from generic credential-bearing suffixes. The descriptor registry covers
+// known providers; this defensive path covers custom routes and cloud/database
+// auth variables that can still be surfaced through status/config displays.
+function isSecretEnvKey(
+  key: string,
+  knownKeys: ReadonlySet<string>,
+): boolean {
+  return (
+    knownKeys.has(key) ||
+    key.endsWith('_API_KEY') ||
+    key.endsWith('_AUTH_HEADER_VALUE') ||
+    key.endsWith('_PASSWORD') ||
+    key.endsWith('_SECRET') ||
+    key.endsWith('_SECRET_ACCESS_KEY') ||
+    key.endsWith('_SECRET_KEY') ||
+    key.endsWith('_TOKEN')
+  )
+}
+
 function collectSecretValues(
   sources: Array<SecretValueSource | null | undefined>,
 ): string[] {
-  const knownKeys = getKnownProviderSecretEnvKeys()
+  const knownKeys = new Set(getKnownProviderSecretEnvKeys())
   const values = new Set<string>()
 
   for (const source of sources) {
     if (!source) continue
 
-    for (const key of knownKeys) {
+    for (const key of Object.keys(source)) {
+      if (!isSecretEnvKey(key, knownKeys)) continue
+
       const value = sanitizeApiKey(source[key])?.trim()
       if (value) {
         values.add(value)