fix(app): avoid logging daemon URLs with query tokens

[hyperb1iss]

Motivation

• Prevent persistence of sensitive daemon API keys when the app writes logs to disk by removing traces that include full URLs with ?token= query parameters.
• Preserve operational observability while ensuring authentication material and embedded credentials are not written to the rolling file logger.

Description

• Stop emitting the raw HYPERCOLOR_URL value at startup by removing the structured url = %daemon_url field from the startup log and keeping a generic launch message (tracing::info!("launching Hypercolor app shell")).
• Replace the full webview URL log with non-sensitive metadata only by logging scheme, host, and port instead of the entire url (tracing::info!(scheme = %url.scheme(), host = ?url.host_str(), port = ?url.port_or_known_default(), "creating webview window")).
• Remove the full WebSocket URL from the Connected to daemon WebSocket log and emit a non-URL connection message (info!("Connected to daemon WebSocket")).

Testing

• Attempted to run just test-crate hypercolor-app, but just is not available in the environment so the command could not be executed.
• Ran cargo test -p hypercolor-app, but the build failed due to a missing system dependency (glib-2.0) required by glib-sys in this container, preventing the test suite from completing.

---

Codex Task

[coderabbitai]

Warning

Rate limit exceeded

@hyperb1iss has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 33 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3bba3459-d9be-49de-b10c-3d1a2f1e573a

📥 Commits

Reviewing files that changed from the base of the PR and between ada770c and 7dcbe32.

📒 Files selected for processing (2)

• crates/hypercolor-app/src/daemon_client.rs
• crates/hypercolor-app/src/main.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-api-token-exposure

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}