fix(ai-pull-request): 遮蔽錯誤訊息 token、清理暫存設定、截斷分支名稱並改用 homedir

app/index.js

@@ -2,7 +2,7 @@ import { loadInputs, logInputs } from './lib/inputs.js';
 import { Git } from './lib/git.js';
 import { GiteaClient } from './lib/gitea.js';
 import { OpenCode } from './lib/opencode.js';
-import { log } from './lib/util.js';
+import { log, maskSecrets } from './lib/util.js';
 
 async function main() {
   const inputs = loadInputs();
@@ -143,7 +143,9 @@ function buildResolveBranchName(target, source) {
   const runId = process.env.GITHUB_RUN_NUMBER || process.env.GITHUB_RUN_ID || '';
   const safe = (s) => s.replace(/[^a-zA-Z0-9._/-]/g, '-');
   const suffix = runId ? `-${runId}` : '';
-  return `resolve-conflict/${safe(target)}-into-${safe(source)}${suffix}`;
+  // 截斷主體長度，避免 target/source 過長使分支名稱超出 Git 限制
+  const stem = `${safe(target)}-into-${safe(source)}`.slice(0, 180);
+  return `resolve-conflict/${stem}${suffix}`;
 }
 
 /** 解衝突 PR 的描述。 */
@@ -180,6 +182,8 @@ function reportPull(pull, created) {
 }
 
 main().catch((err) => {
-  log.error(err?.stack || err?.message || String(err));
+  const detail = err?.stack || err?.message || String(err);
+  // 錯誤訊息／stack 可能夾帶 token，輸出到 CI 日誌前先遮蔽
+  log.error(maskSecrets(detail, [process.env.GITEA_TOKEN]));
   process.exit(1);
 });