From d07f894bf6fff6cf6d9202f53733a464f377b66f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Sat, 3 Oct 2026 13:42:40 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9ABearer=20=E5=BC=95?=
 =?UTF-8?q?=E5=8F=B7=E5=80=BC=E8=84=B1=E6=95=8F=E6=AD=A3=E5=88=99=E5=8F=AA?=
 =?UTF-8?q?=E5=8C=B9=E9=85=8D=E5=88=B0=E7=AC=AC=E4=B8=80=E4=B8=AA=E7=A9=BA?=
 =?UTF-8?q?=E6=A0=BC=EF=BC=8C=E5=AF=86=E9=92=A5=E5=B0=BE=E9=83=A8=E6=BC=8F?=
 =?UTF-8?q?=E5=87=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- directThreadSanitize.ts：BEARER_VALUE 的引号分支由 \\.?["'] 改为 \\?["']，与同文件 SENSITIVE_ASSIGNMENT 的写法一致
- 原写法要求引号前必须有一个字面反斜杠，导致 Bearer "abc def" 走不到引号分支，退化到裸 token 分支后只遮到第一个空格，示例会输出 Bearer [redacted-secret] def"
- 修正后引号内的整段值都被遮掉；JSON 转义的 \"abc def\" 仍然匹配
- 同步在 directThreadSanitize.test.ts 增加带引号 Bearer 的用例（修复前该用例失败）
---
 .../chat/conversation/directThreadSanitize.ts                 | 2 +-
 apps/ai-game-creator-shell/tests/directThreadSanitize.test.ts | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/ai-game-creator-shell/src/view/project-development/chat/conversation/directThreadSanitize.ts b/apps/ai-game-creator-shell/src/view/project-development/chat/conversation/directThreadSanitize.ts
index 3f1495115..5a8780be6 100644
--- a/apps/ai-game-creator-shell/src/view/project-development/chat/conversation/directThreadSanitize.ts
+++ b/apps/ai-game-creator-shell/src/view/project-development/chat/conversation/directThreadSanitize.ts
@@ -431,7 +431,7 @@ const SENSITIVE_ASSIGNMENT = new RegExp(
 );
 
 const BEARER_VALUE =
-  /(\bbearer\b)(\s+)((?:\\.?["'][^"']*\\.?["'])|(?:<[^>]*>)|(?:\[[^\]]*\])|(?:[^\s,;，；&\]})<>]+))/gi;
+  /(\bbearer\b)(\s+)((?:\\?["'][^"']*\\?["'])|(?:<[^>]*>)|(?:\[[^\]]*\])|(?:[^\s,;，；&\]})<>]+))/gi;
 
 const CONFIG_NAMES = /(?:\.env|game-creator\.config)[^\s'"`,;:：&\]})<>]*/gi;
 
diff --git a/apps/ai-game-creator-shell/tests/directThreadSanitize.test.ts b/apps/ai-game-creator-shell/tests/directThreadSanitize.test.ts
index 2a264aa9f..434c7acb0 100644
--- a/apps/ai-game-creator-shell/tests/directThreadSanitize.test.ts
+++ b/apps/ai-game-creator-shell/tests/directThreadSanitize.test.ts
@@ -56,6 +56,10 @@ describe('directThreadSanitize', () => {
     expect(sanitizeDirectThreadText(ROOT, 'h x Bearer abc123 y')).toBe(
       'h x Bearer [redacted-secret] y',
     );
+    // 带引号的 Bearer 值（含空格）也要整段遮掉，不能只遮到第一个空格。
+    expect(sanitizeDirectThreadText(ROOT, 'h x Bearer "abc def" y')).toBe(
+      'h x Bearer [redacted-secret] y',
+    );
   });
 
   it('.env / game-creator.config 换成配置占位符', () => {