Hide credentials in Git endpoint diagnostics

internal/git/display.go

@@ -0,0 +1,39 @@
+package git
+
+import (
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+var httpURLSpan = regexp.MustCompile(`(?i)https?://[^\s"'<>]+`)
+
+// DisplayURL hides HTTP userinfo without changing the endpoint used by Git.
+func DisplayURL(raw string) string {
+	lower := strings.ToLower(raw)
+	if !strings.HasPrefix(lower, "http://") && !strings.HasPrefix(lower, "https://") {
+		return raw
+	}
+	authority := raw[strings.Index(raw, "://")+3:]
+	if end := strings.IndexAny(authority, "/?#"); end >= 0 {
+		authority = authority[:end]
+	}
+	if !strings.Contains(authority, "@") {
+		return raw
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil || parsed.User == nil || parsed.Host == "" {
+		return "[redacted URL]"
+	}
+	parsed.User = url.User("redacted")
+	return parsed.String()
+}
+
+func displayDiagnostic(message string) string {
+	return httpURLSpan.ReplaceAllStringFunc(message, DisplayURL)
+}
+
+type displayError struct{ cause error }
+
+func (err displayError) Error() string { return displayDiagnostic(err.cause.Error()) }
+func (err displayError) Unwrap() error { return err.cause }