Answer stability round 1: 0 🔴, 4 🟡 (0 misread); the driver decides what parses so a multi-host DSN still works, and the nine-key test shrinks to four

src/plugin-host/storage-provisioning.ts

@@ -16,10 +16,20 @@ export interface ProvisionResult {
   provisioned: string[];
 }
 
+// The driver's error for a DSN it can't parse carries the whole string (`input`) — password included —
+// so it is swallowed here. The driver, not `new URL`, decides what parses: it takes a multi-host DSN.
+function connect(adminUrl: string): ReturnType<typeof postgres> {
+  try {
+    return postgres(adminUrl, { connect_timeout: 10, max: 1 });
+  } catch {
+    throw new Error("PLUGIN_DB_ADMIN_URL must be a Postgres URL (its value is not shown; percent-encode special characters in a password)");
+  }
+}
+
 export async function provisionStorage(options: ProvisionOptions): Promise<ProvisionResult> {
   // Notices are left to surface: a REVOKE the account cannot perform only *warns*, and silencing
   // that would mean reporting a locked-down database that is still open to PUBLIC.
-  const sql = postgres(options.adminUrl, { connect_timeout: 10, max: 1 });
+  const sql = connect(options.adminUrl);
   try {
     const provisioned: string[] = [];
     for (const pluginId of options.pluginIds) {

src/plugin-host/storage.test.ts

@@ -108,6 +108,13 @@ test("a connection limit that is not a positive integer is refused, not interpol
   }
 });
 
+test("a malformed admin DSN is refused by name, without echoing its password", async () => {
+  await assert.rejects(
+    provisionStorage({ adminUrl: "postgres://admin:pa/ss@db:5432/plugins", connectionLimit: 10, pluginIds: [], secret: SECRET }),
+    (err: Error) => err.message.includes("PLUGIN_DB_ADMIN_URL") && !err.message.includes("pa/ss"),
+  );
+});
+
 // --- Integration: the statements above, against a real Postgres -----------------------
 // Opt-in via PLUGIN_DB_ADMIN_URL (a superuser DSN); the unit gate runs no Postgres. What the unit
 // tests cannot prove lives here: the owner may create tables, and a peer role is locked out.