Function redactUrlCredentials

src/utils/plugins/marketplaceManager.ts:1213–1226

* Redact userinfo (username:password) in a URL to avoid logging credentials. * * Marketplace URLs may embed credentials (e.g. GitHub PATs in * `https://user:token@github.com/org/repo`). Debug logs and progress output * are written to disk and may be included in bug reports, so credentials must

(urlString: string)

 * pass through unchanged.
 */
function redactUrlCredentials(urlString: string): string {
  try {
    const parsed = new URL(urlString)
    const isHttp = parsed.protocol === 'http:' || parsed.protocol === 'https:'
    if (isHttp && (parsed.username || parsed.password)) {
      if (parsed.username) parsed.username = '***'
      if (parsed.password) parsed.password = '***'
      return parsed.toString()
    }
  } catch {
    // Not a valid URL — safe as-is
  }
  return urlString
}

/**
 * Cache a marketplace from a URL