Under the hood
MCPB and plugin MCP-config loading errors now redact URLs and file paths before logging them
What
Across several places that load MCPB packages and plugin MCP configuration, such as downloading an MCPB package, checking a modification-time cache, resolving a directory-loaded plugin's source, and loading .mcp.json, raw URLs and file paths that end up in log or error messages are now passed through a redaction helper first, and diffs are formatted through a separate helper. For example, a log line now reads Downloading MCPB from ${mf(e)} instead of including the raw URL directly.
Why
This keeps potentially sensitive URLs and file paths out of logs and error output when something goes wrong loading MCPB packages or plugin MCP configuration.