feat: context links for Slack-originated HTTP sessions

[AztecBot]

Summary

• Recognize Slack URLs in link field and display as Slack origin with ↗ icon on dashboard and workspace pages
• Promote link to slackLink when session has a Slack URL but no slack_channel metadata (e.g. AztecBot sessions triggered via HTTP /run)
• Add hourly OAuth token refresh via systemd timer (bin/refresh-oauth.sh)

Test plan

• Open workspace page for an AztecBot-triggered session — should show ↗ Slack link
• Dashboard should show "slack" origin badge for sessions with Slack URL in link field
• Slack-originated sessions still show ↗ link as before
• GitHub PR/CI links still display correctly as context links

🤖 Generated with Claude Code

In general, to fix clear-text logging of sensitive information, either stop logging the sensitive field altogether or transform it into a non-sensitive representation (e.g., masked, hashed, or replaced with a stable opaque identifier). Here, meta.email can contain a real email address or a string derived from an OAuth access token. We should avoid writing this directly to the console and instead display only redacted information that still allows the user to distinguish slots (e.g., masked email or short hash).

Best fix, minimally changing behavior:

1. Keep readCredsMeta as-is so that internal logic still has full details.
2. In credsCommand, before logging, derive a safe, redacted version of the identity:
   • If meta.email is "unknown" or "error", show it as-is.
   • If it starts with "token:", replace it with a generic label such as "token:<redacted>" or "token:<hash>" without exposing the original prefix.
   • Otherwise, treat it as an email-like identifier and mask it (e.g., j***e@example.com), preserving only minimal characters.
3. Use this redacted string in the console.log instead of the raw meta.email.

This keeps functionality (you can still see which slot is which) while preventing clear-text sensitive data from reaching logs. All edits are within cli.ts in the shown snippet: we’ll adjust the for (const slot of slots) loop around line 1791 to compute a safe display identity and log that instead of meta.email. No new imports are needed.

To fix the problem, we should stop logging the sensitive meta.email field directly and instead log only non-sensitive, high-level information (e.g., whether an associated account is known/unknown/errored) or a deliberately anonymized indicator. This preserves the behavior of showing which slot was activated while avoiding printing any email address or token-derived identifier.

The best minimal change here is to modify the log at line 1843 to omit meta.email entirely or replace it with a generic status that does not expose the actual email/token. Since other code does not appear to depend on the exact format of this string (it is just CLI output), changing the message text will not affect program logic.

Concretely, in cli.ts:

• Keep readCredsMeta as-is; it still returns email for internal use if needed in the future.

• Update the console.log on line 1843 from:

  console.log(`  ● Activated: ${slotName} (${meta.email})`);

  to something like:

  console.log(`  ● Activated: ${slotName}${meta.email === "error" ? " (account lookup failed)" : ""}`);

  or even just:

  console.log(`  ● Activated: ${slotName}`);

  Either variant removes the sensitive value from the logs. I’ll choose the simplest and safest: log only the slot name.

No new imports or helper methods are required; this is a single-line change in the same file.

---

General approach: Avoid logging any data derived from OAuth credentials (email address or token prefix). The confirmation log should only contain non-sensitive information such as the slot name, or at most a coarse, non-identifying status (e.g., “Saved current credentials”).

Best targeted fix here: Keep readCredsMeta unchanged (it may be used elsewhere) but stop including meta.email in the console.log call on line 1870. We can still call readCredsMeta if needed for other reasons, but for this alert we only need to remove ${meta.email} from the message. The minimal change is to alter:

const meta = readCredsMeta(slotDir);
console.log(`  Saved current credentials → ${slotName} (${meta.email})`);

to:

const meta = readCredsMeta(slotDir);
console.log(`  Saved current credentials → ${slotName}`);

This preserves behavior (credentials are still saved, meta is still computed if needed later) while eliminating clear-text logging of sensitive data. No new imports or helper functions are needed.