fix: avoid echoing invalid channel token values (#1542)

Avoids echoing invalid channel token values in config output.

tests/unit/commands/config-channels-command.test.ts

@@ -1,5 +1,14 @@
-import { describe, expect, it } from 'bun:test';
-import { parseChannelsCommandArgs } from '../../../src/commands/config-channels-command';
+import { afterEach, describe, expect, it, spyOn } from 'bun:test';
+import {
+  handleConfigChannelsCommand,
+  parseChannelsCommandArgs,
+} from '../../../src/commands/config-channels-command';
+
+const originalExitCode = process.exitCode;
+
+afterEach(() => {
+  process.exitCode = originalExitCode ?? 0;
+});
 
 describe('config channels command parser', () => {
   it('parses selection, unattended mode, and token channel input', () => {
@@ -31,4 +40,34 @@ describe('config channels command parser', () => {
     expect(clearAll.clearTokenAll).toBe(true);
     expect(clearOne.clearTokenChannel).toBe('discord');
   });
+
+  it('marks invalid set-token values without retaining secret-like input', () => {
+    const secretValue = 'telegram=SECRET_BOT_TOKEN_12345';
+    const result = parseChannelsCommandArgs(['--set-token', secretValue]);
+
+    expect(result.setTokenInvalid).toBe(true);
+    expect(JSON.stringify(result)).not.toContain(secretValue);
+    expect(JSON.stringify(result)).not.toContain('SECRET_BOT_TOKEN_12345');
+  });
+});
+
+describe('config channels command handler', () => {
+  it('does not echo invalid set-token values to stderr', async () => {
+    const secretValue = 'telegram=SECRET_BOT_TOKEN_12345';
+    const errors: string[] = [];
+    const errorSpy = spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
+      errors.push(args.map(String).join(' '));
+    });
+
+    try {
+      await handleConfigChannelsCommand(['--set-token', secretValue]);
+    } finally {
+      errorSpy.mockRestore();
+    }
+
+    expect(process.exitCode).toBe(1);
+    expect(errors.join('\n')).toContain('Invalid --set-token value');
+    expect(errors.join('\n')).not.toContain(secretValue);
+    expect(errors.join('\n')).not.toContain('SECRET_BOT_TOKEN_12345');
+  });
 });