feat: safely control Shell Target

internal/profile/profile.go

@@ -172,10 +172,16 @@ func normalizeBypassEntry(raw string) (string, error) {
 
 var credentialPattern = regexp.MustCompile(`(?i)(https?|socks5h?)://([^/@\s:]+):([^@\s]*)@`)
 
+// RedactText removes URL passwords from diagnostic text without requiring the
+// surrounding text to be a valid URL.
+func RedactText(value string) string {
+	return credentialPattern.ReplaceAllString(value, `${1}://${2}:REDACTED@`)
+}
+
 func ObscureURL(value string) string {
 	u, err := url.Parse(value)
 	if err != nil || u.User == nil {
-		return credentialPattern.ReplaceAllString(value, `${1}://${2}:REDACTED@`)
+		return RedactText(value)
 	}
 	if _, present := u.User.Password(); !present {
 		return value