[dan-petty]

redact_text and mask_uri_credentials left the user name of a URL as written when the URL had no password. A service can take a token as the user name, and httpx2 sends such a URL as Basic authentication. So a token showed in masked text, and the same URL with a password was masked.

The user name is now masked in every scheme: in redact_text and *** in mask_uri_credentials. A parser cannot tell a token from a name such as git, so both are masked, as pip does. The sanitizer docstring states the rule. Cost: the user name of a clone URL is masked too, and the host and the path still show.

Closes #2662

Change: openspec/changes/archive/2026-11-05-2662-mask-url-user-name-without-password/

[dan-petty]

Test record for this pull request. The body keeps no test results.

Fail-to-pass (uv run devops ci fail-to-pass --base origin/main, exit 0): 19 tests fail on the base and pass with the fix. They are in tests/security/test_secret_redaction.py, tests/security/test_redaction_properties.py, tests/ai/client/test_url_credential_masking.py and tests/k8s/test_gitea_doctor.py. The log is .data/agent/fail-to-pass.log in the worktree.

Narrow runs after the rebase onto origin/main: 1602 tests pass in tests/security, tests/ai/client/test_url_credential_masking.py, tests/k8s/test_gitea_doctor.py and tests/invariants/test_architectural_invariants.py. devops openspec check passes.

Review finding fixed. One review finding was right. The spec, the design and the module docstring said that both functions return a URL with an @ and no userinfo as it was. mask_uri_credentials returns <masked-url> for such a text (fail closed, #1109) and this change does not touch that branch. The three texts now name each function, and tests/ai/client/test_url_credential_masking.py holds both forms for mask_uri_credentials.

Full uv run devops ci on the final code, local devcontainer host. All gates pass except test and coverage. The test run has 10 failures and 1 error. None comes from this change:

• 6 cases of tests/ai/rag/test_rag_qdrant_span.py fail because the name of this branch holds the word user. The tracer puts the branch name in the span attributes vcs.ref.name and vcs.branch, and the test reads it as a leak. The 6 cases pass on a detached head, which is the state of a GitHub runner. Open issue fix(tests): a branch name with a secret word fails a span test #3638 covers this.
• 4 tests fail because of the state of this host: test_get_ssh_key_prefix_resolution, test_find_project_config_path_skips_directory (a stray /tmp/config.yaml), test_mark_only_commands_under_global_dry_run and test_the_direct_executor_refuses_a_network_profile_before_it_starts_the_tool[direct]. They fail the same way on the main checkout. Open issues fix(ci): host state fails four tests and one case #3585, fix(tests): four tests fail on the devcontainer host #3590 and fix(ci): host-state tests fail and the suite exceeds 5 minutes #3593 cover them.
• The test step took 6m 19s on this host, over the 5 minute budget. Issue fix(ci): host-state tests fail and the suite exceeds 5 minutes #3593 covers it.

The 18820 other tests pass.