fix: redact prompt cache keys in doctor output

Author: ndycode

index.ts

@@ -158,6 +158,7 @@ import { paintUiText, formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyVa
 import {
 	buildBeginnerChecklist,
 	buildBeginnerDoctorFindings,
+	formatPromptCacheKey,
 	recommendBeginnerNextAction,
 	summarizeBeginnerAccounts,
 	type BeginnerAccountSnapshot,
@@ -5217,7 +5218,7 @@ while (attempted.size < Math.max(1, accountCount)) {
 									ui,
 									"Prompt cache",
 									runtime.promptCacheEnabledRequests > 0
-										? `enabled=${runtime.promptCacheEnabledRequests}, missing=${runtime.promptCacheMissingRequests}, lastKey=${runtime.lastPromptCacheKey ?? "none"}`
+										? `enabled=${runtime.promptCacheEnabledRequests}, missing=${runtime.promptCacheMissingRequests}, lastKey=${formatPromptCacheKey(runtime.lastPromptCacheKey)}`
 										: `enabled=0, missing=${runtime.promptCacheMissingRequests}, lastKey=none`,
 									"muted",
 								),
@@ -5262,7 +5263,7 @@ while (attempted.size < Math.max(1, accountCount)) {
 							`  Runtime failures: failed=${runtime.failedRequests}, rateLimited=${runtime.rateLimitedResponses}, authRefreshFailed=${runtime.authRefreshFailures}, server=${runtime.serverErrors}, network=${runtime.networkErrors}`,
 						);
 						lines.push(
-							`  Prompt cache: enabled=${runtime.promptCacheEnabledRequests}, missing=${runtime.promptCacheMissingRequests}, lastKey=${runtime.lastPromptCacheKey ?? "none"}`,
+							`  Prompt cache: enabled=${runtime.promptCacheEnabledRequests}, missing=${runtime.promptCacheMissingRequests}, lastKey=${formatPromptCacheKey(runtime.lastPromptCacheKey)}`,
 						);
 					}
 					return lines.join("\n");

lib/ui/beginner.ts

@@ -50,6 +50,13 @@ export interface BeginnerAccountSummary {
 	unlabeled: number;
 }
 
+export function formatPromptCacheKey(value: string | null | undefined): string {
+	const normalized = value?.trim();
+	if (!normalized) return "none";
+	if (normalized.length <= 8) return normalized;
+	return `${normalized.slice(0, 8)}...`;
+}
+
 export function summarizeBeginnerAccounts(
 	accounts: BeginnerAccountSnapshot[],
 	now: number,

test/beginner-ui.test.ts

@@ -3,6 +3,7 @@ import {
 	buildBeginnerChecklist,
 	buildBeginnerDoctorFindings,
 	explainRuntimeErrorCategory,
+	formatPromptCacheKey,
 	recommendBeginnerNextAction,
 	summarizeBeginnerAccounts,
 	type BeginnerAccountSnapshot,
@@ -210,3 +211,19 @@ describe("explainRuntimeErrorCategory", () => {
 		expect(hint).toContain("codex-doctor");
 	});
 });
+
+describe("formatPromptCacheKey", () => {
+	it("returns none for empty values", () => {
+		expect(formatPromptCacheKey(null)).toBe("none");
+		expect(formatPromptCacheKey(undefined)).toBe("none");
+		expect(formatPromptCacheKey("   ")).toBe("none");
+	});
+
+	it("keeps short values as-is", () => {
+		expect(formatPromptCacheKey("ses_1234")).toBe("ses_1234");
+	});
+
+	it("redacts longer values to an 8-char prefix", () => {
+		expect(formatPromptCacheKey("ses_prompt_cache_key_123")).toBe("ses_prom...");
+	});
+});