From 9357f4df26d8ce8a07db9d52d3d5b9c307206d56 Mon Sep 17 00:00:00 2001
From: "Kai (Tam Nhu) Tran" <61256810+kaitranntt@users.noreply.github.com>
Date: Sat, 23 May 2026 21:39:05 -0400
Subject: [PATCH] fix(cliproxy): redact generic token query params in oauth
 trace (#1364)

---
 src/cliproxy/auth/__tests__/oauth-trace-redactor.test.ts | 7 +++++++
 src/cliproxy/auth/oauth-trace/redactor.ts                | 1 +
 2 files changed, 8 insertions(+)

diff --git a/src/cliproxy/auth/__tests__/oauth-trace-redactor.test.ts b/src/cliproxy/auth/__tests__/oauth-trace-redactor.test.ts
index 8b48261c..a60324ab 100644
--- a/src/cliproxy/auth/__tests__/oauth-trace-redactor.test.ts
+++ b/src/cliproxy/auth/__tests__/oauth-trace-redactor.test.ts
@@ -85,6 +85,13 @@ describe('redactString', () => {
     expect(out).not.toContain('AT_SECRET');
     expect(out).toBe(`access_token=${REDACTED_PLACEHOLDER}&keep=1`);
   });
+
+  test('redacts ampersand-delimited generic token query params', () => {
+    const out = redactString('access_token=AT_SECRET&token=TOKEN_SECRET');
+    expect(out).not.toContain('AT_SECRET');
+    expect(out).not.toContain('TOKEN_SECRET');
+    expect(out).toBe(`access_token=${REDACTED_PLACEHOLDER}&token=${REDACTED_PLACEHOLDER}`);
+  });
 });
 
 describe('redactUrl', () => {
diff --git a/src/cliproxy/auth/oauth-trace/redactor.ts b/src/cliproxy/auth/oauth-trace/redactor.ts
index 62c74902..40ead575 100644
--- a/src/cliproxy/auth/oauth-trace/redactor.ts
+++ b/src/cliproxy/auth/oauth-trace/redactor.ts
@@ -10,6 +10,7 @@
 const SENSITIVE_QUERY_KEYS = [
   'code',
   'state',
+  'token',
   'access_token',
   'refresh_token',
   'id_token',