fix(config): mask all secret fields in config show

Author: XXPermanentXX

packages/commands/src/commands/config/show.ts

@@ -1,5 +1,6 @@
 import { defineCommand, detectOutputFormat, maskToken } from "bailian-cli-core";
 import { emitResult } from "bailian-cli-runtime";
+import { SECRET_KEYS } from "./shared.ts";
 
 export default defineCommand({
   description: "Display current configuration",
@@ -20,13 +21,9 @@ export default defineCommand({
       config_file: store.path,
     };
 
-    if (typeof result.api_key === "string") result.api_key = maskToken(result.api_key);
-    if (typeof result.access_token === "string")
-      result.access_token = maskToken(result.access_token);
-    if (typeof result.access_key_id === "string")
-      result.access_key_id = maskToken(result.access_key_id);
-    if (typeof result.access_key_secret === "string")
-      result.access_key_secret = maskToken(result.access_key_secret);
+    for (const key of SECRET_KEYS) {
+      if (typeof result[key] === "string") result[key] = maskToken(result[key]);
+    }
 
     emitResult(result, format);
   },

packages/commands/tests/e2e/config.e2e.test.ts

@@ -81,6 +81,29 @@ describe("e2e: config", () => {
     expect(stdout).toMatch(/config_file|timeout|base_url/i);
   });
 
+  test("config show 脱敏 security_token", async () => {
+    const configDir = mkdtempSync(join(tmpdir(), "bl-config-show-secret-"));
+    try {
+      const securityToken = "sts-sensitive-token";
+      writeFileSync(
+        join(configDir, "config.json"),
+        JSON.stringify({ security_token: securityToken }, null, 2) + "\n",
+      );
+
+      const { stdout, stderr, exitCode } = await runCommandE2e(
+        CONFIG_ROUTES,
+        ["config", "show", "--output", "json"],
+        { BAILIAN_CONFIG_DIR: configDir },
+      );
+      expect(exitCode, stderr).toBe(0);
+      const data = parseStdoutJson<{ security_token?: string }>(stdout);
+      expect(data.security_token).toBe("sts-...oken");
+      expect(stdout).not.toContain(securityToken);
+    } finally {
+      rmSync(configDir, { recursive: true, force: true });
+    }
+  });
+
   test("config set 缺少 --key / --value 时报用法错误并退出 (2)", async () => {
     const { stderr, exitCode } = await runCommandE2e(CONFIG_ROUTES, ["config", "set", "--quiet"]);
     expect(exitCode, stderr).toBe(2);