Harden URL redaction in inventory/review failure output (Issue #171)

tests/test_pr_queue_inventory.py

@@ -209,6 +209,28 @@ class TestPRQueueInventory(unittest.TestCase):
         # uses project's redaction pattern (token prefix -> [REDACTED])
         # even if url leaks, the exception is redacted per pattern
 
+    @patch("mcp_server.api_get_all")
+    @patch("mcp_server.api_request")
+    @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
+    @patch("mcp_server.get_profile")
+    def test_inventory_failure_output_redacts_real_service_urls(self, mock_get_profile, _auth, mock_api, mock_get_all):
+        """Failure paths must fully redact real service hostnames and URLs from inventory output."""
+        mock_get_profile.return_value = {
+            "profile_name": "gitea-author",
+            "allowed_operations": ["read"],
+            "forbidden_operations": [],
+            "base_url": None,
+        }
+        mock_get_all.side_effect = Exception("failed to connect to https://gitea.prgs.cc/api/v1/repos/x")
+        mock_api.return_value = {"login": "jcwalker3"}
+
+        result = gitea_review_pr(pr_number=42, event="APPROVE", remote="prgs")
+        self.assertFalse(result["success"])
+        msg = result.get("message", "")
+        self.assertIn("=== PR Queue Inventory ===", msg)
+        self.assertIn("[REDACTED_URL]", msg)
+        self.assertNotIn("gitea.prgs.cc", msg)
+
     @patch("mcp_server.api_get_all")
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)