[thiras]

What

A failed chain call printed SPONSORD_RPC_URL in the daemon's exit error, the keeper's warnings and the HTTP API's warn/error lines. That URL often carries a provider API key in its path. The cause: reqwest's Display ends in for url (<url>), and alloy forwards it.

This PR follows decdn-node's fix (decdn/decdn#958) and closes every path I found:

• Errors. ChainPool renders each chain-call error's source() chain with the URLs stripped (redacted(), built on decdn_common::redact::strip_urls). It strips each link separately and skips a link that repeats the one before it. Its errors therefore never contain the URL, and they now keep the failure class (connection refused, timeout, DNS, TLS), which alloy's outer Display leaves out.
• top_up markers. top_up errors still downcast to decdn's TopUpUnconfirmed (the top-up may have mined) and AllowanceShortfall; redacted_top_up re-attaches them after redaction.
• Log sites. keeper.rs and http.rs render errors through sanitize_err_chain as a backstop.
• Exit. main() prints its error through sanitize_err_chain instead of returning it to std's Termination impl.
• RUST_LOG=debug. alloy's ReqwestTransport debug span records the URL, and every reqwest and hyper event inside that span would print it. main() now builds the RUST_LOG filter with alloy_transport_http=info added, which hides only that span and alloy's own debug/trace events.
• --help and Debug. --help hides the URL's value, as it does for the token and password. ChainConfig's Debug shows the URL's length instead of the URL.
• Bind order. The listener is bound before the keeper starts. A bind failure can no longer drop a top-up between the approve and the top-up.

Before:

Error: read PaymentPool.usdc(): error sending request for url (http://127.0.0.1:9/v3/<key>)

After:

Error: read PaymentPool.usdc(): error sending request: client error (Connect): tcp connect error: Connection refused (os error 111)

Closes #38

Reviewer notes

• Start with redacted and redacted_top_up in crates/sponsord-core/src/pool.rs, then init_tracing in crates/sponsord/src/main.rs.
• Why redacted strips each link before joining. If strip_urls ran on the joined string, it would eat the : after a removed URL, because it consumes up to the next whitespace.
• What still shows at trace. hyper still logs connecting to <host>:<port>, but nothing logs the path. trace_logging_does_not_print_the_rpc_url checks this, including RUST_LOG=alloy_transport_http=trace,trace.
• Not changed: default log level. With RUST_LOG unset, sponsord still prints only ERROR events, as fmt::init did. That means the warnings this PR sanitizes are hidden unless operators set RUST_LOG.
• Not changed: keeper retry after TopUpUnconfirmed. Before this PR too, the keeper retries every failure on its next tick, including TopUpUnconfirmed, so an unconfirmed top-up can be sent twice. The marker is preserved, so a follow-up can handle it.
• Dependencies.
  • decdn-common is new as a direct dependency, but it was already in Cargo.lock at the pinned commit (7f938e6).
  • sponsord now declares tracing-subscriber's env-filter feature explicitly. Before, it was only enabled because decdn's crates enable it.
  • The cargo update -p … lists, the [patch] example in CONTRIBUTING and the deny.toml comment now include decdn-common.
• Test support.
  • FakePool failures read like reqwest's error and name FAKE_RPC_URL.
  • New fail_remaining_reads switch.
  • New CapturedLog, which captures tracing output on the test's thread. It sits behind test-support, which enables the optional tracing-subscriber dependency.
• No contract changes. The HTTP API, sponsor.toml and the archive names are unchanged.

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run --workspace: 131 passed
• Pool, keeper or daemon code changed: cargo nextest run --features sponsord-core/anvil-e2e,sponsord/anvil-e2e -p sponsord-core -p sponsord --test chain_pool --test binary_anvil: 2 passed
• User-visible change: entry in the changed crate's crates/<dir>/CHANGELOG.md (sponsord, sponsord-core, both under Security)
• Installer archive names, ~/.decdn/sponsor.toml or an sponsord-api type touched: not touched
• PR title uses a type the pr-title check allows

I also ran cargo test --doc --workspace, cargo doc with -D warnings, the check-*.sh scripts, cargo-deny-warn.sh, pytest .github/scripts/tests (144 passed) and markdownlint.

To check that the tests catch the leaks, I reverted the fixes and reran them. Each of these redaction tests failed with its fix reverted:

• pool::tests::an_unreachable_rpc_url_stays_out_of_the_error
• both keeper failure tests
• api::failed_chain_read_is_503
• startup_redacts_rpc_url
• trace_logging_does_not_print_the_rpc_url, with the filter cap removed

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The keeper’s remaining-read warning still needs regression coverage for RPC URL redaction.

Review effort: Balanced
Findings: 1

Open (1)

• Add keeper test for sanitized remaining-read failure warning · New

What changed in this PR

Protects RPC provider credentials by removing URLs from daemon errors and logs while preserving failure causes.

Changes:

• Redacts chain errors, keeper/API logs, and fatal exit output.
• Adds log capture and regression coverage.
• Updates dependencies, maintenance instructions, and changelogs.

File	Description
RELEASING.md	Updates dependency refresh instructions.
crates/​sponsord/​tests/​startup_redacts_rpc_url.rs	Tests startup error redaction.
crates/​sponsord/​tests/​api.rs	Checks API warning redaction.
crates/​sponsord/​src/​main.rs	Sanitizes fatal errors.
crates/​sponsord/​src/​http.rs	Sanitizes request error logs.
crates/​sponsord/​CHANGELOG.md	Documents the security fix.
crates/​sponsord/​Cargo.toml	Adds redaction dependency.
crates/​sponsord-core/​src/​test_support.rs	Adds log capture and URL-bearing failures.
crates/​sponsord-core/​src/​pool.rs	Redacts chain errors at source.
crates/​sponsord-core/​src/​keeper.rs	Sanitizes warnings and tests top-up failures.
crates/​sponsord-core/​CHANGELOG.md	Documents core redaction changes.
crates/​sponsord-core/​Cargo.toml	Adds redaction and test-support dependencies.
CONTRIBUTING.md	Updates local dependency overrides.
Cargo.toml	Declares shared redaction dependency.
Cargo.lock	Records dependency additions.
AGENTS.md	Updates dependency refresh guidance.
.github/​workflows/​ci.yml	Updates canary dependency refresh.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.