diff --git a/packages/sdk-typescript/src/daemon/ui/render.ts b/packages/sdk-typescript/src/daemon/ui/render.ts
index 08ef2ca321..2dc67e517e 100644
--- a/packages/sdk-typescript/src/daemon/ui/render.ts
+++ b/packages/sdk-typescript/src/daemon/ui/render.ts
@@ -357,7 +357,12 @@ export function daemonBlockToPlainText(
       ]
         .filter(Boolean)
         .join(' ');
-      const preview = daemonToolPreviewToPlainText(block.preview);
+      // wenshao review (review 4350741340): forward `opts` so
+      // `sanitizeUrls` + `maxFieldLength` reach the preview's URL fields
+      // (web_fetch URL, image_generation thumbnailUrl). The HTML path at
+      // line 509 already did this; plainText was missed in the prior
+      // doudouOUC fix.
+      const preview = daemonToolPreviewToPlainText(block.preview, opts);
       const status = `status: ${block.status}`;
       return [header, preview, status].filter(Boolean).join('\n');
     }
diff --git a/packages/sdk-typescript/test/unit/daemonUi.test.ts b/packages/sdk-typescript/test/unit/daemonUi.test.ts
index e355d05073..52b784165b 100644
--- a/packages/sdk-typescript/test/unit/daemonUi.test.ts
+++ b/packages/sdk-typescript/test/unit/daemonUi.test.ts
@@ -4270,3 +4270,29 @@ describe('KNOWN_DEVICE_FLOW_ERROR_KINDS stays in sync with public type', async (
     expect(KNOWN_DEVICE_FLOW_ERROR_KINDS).toHaveLength(6);
   });
 });
+
+describe('daemonBlockToPlainText forwards opts (wenshao review 4350741340)', () => {
+  it('sanitizes URL on tool preview when opts.sanitizeUrls is set', async () => {
+    const {
+      daemonBlockToPlainText,
+      createDaemonToolPreview,
+    } = await import('../../src/daemon/ui/index.js');
+    const block = {
+      id: 'b',
+      kind: 'tool' as const,
+      toolCallId: 't',
+      title: 'fetch',
+      status: 'completed',
+      preview: createDaemonToolPreview(
+        { url: 'https://api.example.com/x?token=SECRET&q=keep', method: 'GET' },
+        { toolName: 'WebFetch', toolKind: 'tool' },
+      ),
+      clientReceivedAt: 1,
+      createdAt: 1,
+      updatedAt: 1,
+    };
+    const sanitized = daemonBlockToPlainText(block, { sanitizeUrls: true });
+    expect(sanitized).not.toContain('SECRET');
+    expect(sanitized).toContain('keep');
+  });
+});