fix: redact credentialed URLs in diagnostics and drop the unconditional reinstall claim

Two CodeRabbit findings on the pinner sentence:

- Requirement strings reach warnings and repair issues - text users
  paste into public bug reports - and a direct reference may embed
  tokens; URL userinfo and query parameters are now redacted textually
  in both the violation and pinner sentences.
- Home Assistant reinstalls a manifest requirement only when setup
  finds it unsatisfied; the sentence now says exactly that instead of
  claiming a reinstall on every setup.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QiuyTYBQ2opBVPp8xzMq3r

Author: kingpanther13

custom_components/ha_mcp_tools/dependency_diagnostics.py

@@ -36,6 +36,7 @@
 from __future__ import annotations
 
 import json
+import re
 from collections import deque
 from collections.abc import Iterator
 from dataclasses import dataclass
@@ -546,31 +547,48 @@ def _exception_text(exc: BaseException) -> str:
 
 def _violation_sentence(violation: DependencyViolation) -> str:
     """One sentence naming an unsatisfied requirement and who declared it."""
+    requirement = _redact_requirement(violation.requirement)
     if violation.installed is None:
         if violation.required_by == REQUESTED_BY:
             return f"Package {violation.package} is not installed."
         return (
             f"Package {violation.package} is not installed, but "
-            f"'{violation.requirement}' is required by {violation.required_by}."
+            f"'{requirement}' is required by {violation.required_by}."
         )
     return (
         f"Installed {violation.package} {violation.installed} does not satisfy "
-        f"'{violation.requirement}' required by {violation.required_by}."
+        f"'{requirement}' required by {violation.required_by}."
     )
 
 
+def _redact_requirement(raw: str) -> str:
+    """``raw`` with URL credentials and query parameters removed.
+
+    Requirement strings reach user-facing warnings and repair issues —
+    text users paste into public bug reports — and a direct reference may
+    embed tokens (``mcp @ https://user:token@host/pkg.whl?sig=...``).
+    Textual redaction rather than URL parsing keeps this total: an input
+    no parser accepts still comes back with its userinfo and query gone.
+    """
+    if "://" not in raw:
+        return raw
+    redacted = re.sub(r"://[^/@\s]*@", "://", raw)
+    return re.sub(r"\?\S*", "", redacted)
+
+
 def _pinner_sentence(pinner: PinningIntegration) -> str:
     """One sentence naming a pinning integration and why the pin keeps coming back.
 
-    "Whenever ... is set up" rather than "at every startup": the manifest
-    scan is directory-wide, and a dormant integration's requirement is only
-    enforced once something sets it up — the softer claim is truthful for
-    both the configured culprit and a leftover directory.
+    The enforcement claim is conditional on purpose: the manifest scan is
+    directory-wide, a dormant integration's requirement is only processed
+    once something sets it up, and even then Home Assistant reinstalls it
+    only when the installed version does not satisfy it.
     """
     return (
         f"The custom integration '{pinner.name}' ({pinner.domain}) pins "
-        f"'{pinner.requirement}' in its manifest, and Home Assistant "
-        f"reinstalls that requirement whenever the integration is set up."
+        f"'{_redact_requirement(pinner.requirement)}' in its manifest, and "
+        f"Home Assistant may reinstall that requirement when the "
+        f"integration's setup finds it unsatisfied."
     )
 
 

tests/src/unit/test_dependency_diagnostics.py

@@ -656,6 +656,31 @@ def test_message_less_exception_falls_back_to_its_type(self):
 
         assert message.startswith("The underlying failure is: ImportError.")
 
+    def test_credentialed_url_requirements_are_redacted(self):
+        """CodeRabbit on #2245: repair details get pasted into public issues."""
+        message = describe_dependency_failure(
+            None,
+            [
+                DependencyViolation(
+                    package="mcp",
+                    installed=_PINNED_MCP,
+                    requirement="mcp@ https://user:vsecret@host.invalid/m.whl?vsig=1",
+                    required_by="something 1.0",
+                )
+            ],
+            [
+                PinningIntegration(
+                    domain="p",
+                    name="P",
+                    requirement="mcp @ https://user:psecret@host.invalid/m.whl?ptok=2",
+                )
+            ],
+        )
+
+        for leaked in ("vsecret", "psecret", "vsig=1", "ptok=2", "user:"):
+            assert leaked not in message
+        assert "host.invalid" in message
+
     def test_nothing_found_says_so(self):
         assert (
             describe_dependency_failure(None, [], [])