fix(daemon): value-redact secrets in Gemini/NanoBot/OpenCode provider output (#10)

The daemon runs provider CLIs in full-access mode with the daemon's env
(via buildProviderEnv, which spreads process.env), so secret-named vars
such as provider API keys are present in the spawned process. Task prompts
are workspace-member-controlled, so a prompted provider can echo a secret
into its stdout/stderr, which then flows back via task output / error
diagnostics / streamed callbacks.

The agent-router execution path (claude, codex, openclaw, hermes) already
scrubs secret values from stdout/stderr with buildRedactions/redactText
(agent-router/subprocess.ts). The direct provider-runtime paths did not:

- runGeminiProviderTask (gemini)
- execProviderCommand, the shared helper used by runNanoBotProviderTask
  (nanobot) and runOpenCodeProviderTask (opencode)

These accumulated raw stdout/stderr and, for execProviderCommand, forwarded
raw chunks to the external onStdout/onStderr callbacks. The legacy
sanitizeDiagnosticText only catches recognizable shapes (KEY=value, sk-…,
Bearer …, URL params), so a bare secret value leaked.

Apply the same value-based redaction to these paths via a buildProviderRedactions
helper, and forward the redacted chunks to external callbacks. This brings
gemini/nanobot/opencode to parity with the agent-router providers.

runCodexProviderTaskAttempt / runClaudeProviderTask are left untouched:
runProviderTask routes claude and codex through the agent-router, so those
direct functions are currently unreached.

Adds a Gemini regression test that echoes a bare secret value to stdout and
asserts the returned output is redacted. Verified it fails without the fix
and passes with it. No new test regressions (3 pre-existing resume-session
test failures also fail on main).

Co-authored-by: Test User <test@example.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

packages/daemon/src/provider-runtime.test.ts

@@ -1295,6 +1295,37 @@ test("runProviderTask includes sanitized Claude stderr tail on empty stdout", as
   }
 });
 
+test("runProviderTask value-redacts bare secret values leaked into Gemini output", async () => {
+  // Gemini runs through runGeminiProviderTask (LocalSandbox.exec), not the
+  // agent-router, so its stdout/stderr were not value-redacted. The legacy
+  // diagnostic sanitizer only catches recognizable shapes (KEY=value, sk-…,
+  // Bearer …); a bare secret value echoed by the provider is only scrubbed by
+  // the value-based redaction added here, mirroring the agent-router path.
+  const workDir = mkdtempSync(join(tmpdir(), "agent-space-gemini-redact-"));
+  const binPath = join(workDir, "gemini");
+  writeFileSync(binPath, "#!/bin/sh\nprintf '%s\\n' \"leaked: $CUSTOM_API_TOKEN\"\n", "utf8");
+  chmodSync(binPath, 0o755);
+  const runtime: ProviderRuntimeRecord = {
+    id: "runtime-gemini-redact-test",
+    workspaceId: "default",
+    provider: "gemini",
+    name: "Gemini",
+    status: "online",
+    metadata: { executablePath: binPath, mode: "remote" },
+  };
+
+  try {
+    const result = await runProviderTask(runtime, "summarize", workDir, {
+      taskTimeoutMs: 1_000,
+      contextEnv: { CUSTOM_API_TOKEN: "gamma-delta-9988-echo" },
+    });
+    assert.equal(result.output.includes("gamma-delta-9988-echo"), false);
+    assert.equal(result.output.includes("[redacted:CUSTOM_API_TOKEN]"), true);
+  } finally {
+    rmSync(workDir, { recursive: true, force: true });
+  }
+});
+
 test("runProviderTask reports Claude timeouts with execution diagnostics", async () => {
   const fixture = createClaudeRuntimeFixture([
     "#!/bin/sh",

packages/daemon/src/provider-runtime.ts

@@ -13,6 +13,7 @@ import {
   type AgentRouterEvent,
   type AgentRouterHarness,
 } from "./agent-router/index.ts";
+import { buildRedactions, redactText } from "./agent-router/utils.ts";
 import { clearTaskOutputArtifacts } from "./bundle.ts";
 import { readGoogleWorkspaceReadiness } from "./google-workspace-readiness.ts";
 import { buildOpenClawProviderHealthSnapshot, inspectOpenClawDaemonAuthHealth } from "./openclaw-health.ts";
@@ -1624,13 +1625,16 @@ async function runGeminiProviderTask(
   let finalOutput = "";
   let stderr = "";
   let stdoutBuffer = "";
+  const providerEnv = buildProviderEnv(runtime, options.contextEnv);
+  const redactions = buildProviderRedactions(providerEnv);
   const result = await sandbox.exec({
     command: runtime.metadata.executablePath,
     args: providerArgs,
     timeoutMs: taskTimeoutMs,
-    env: buildProviderEnv(runtime, options.contextEnv),
+    env: providerEnv,
     onStdout: (chunk) => {
-      stdoutBuffer += chunk;
+      const value = redactText(chunk, redactions);
+      stdoutBuffer += value;
       const lines = stdoutBuffer.split(/\r?\n/);
       stdoutBuffer = lines.pop() ?? "";
 
@@ -1656,7 +1660,7 @@ async function runGeminiProviderTask(
       }
     },
     onStderr: (chunk) => {
-      stderr += chunk;
+      stderr += redactText(chunk, redactions);
     },
   });
 
@@ -1871,6 +1875,20 @@ function buildProviderEnv(runtime: ProviderRuntimeRecord, extra?: NodeJS.Process
   return env;
 }
 
+// Builds value-based redaction patterns for every secret-named entry in the
+// provider env, mirroring the agent-router path (see buildRedactions). Used to
+// scrub secret values from provider stdout/stderr before they are stored,
+// streamed to clients, or surfaced in error diagnostics.
+function buildProviderRedactions(env: NodeJS.ProcessEnv) {
+  const stringEnv: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (typeof value === "string") {
+      stringEnv[key] = value;
+    }
+  }
+  return buildRedactions(stringEnv);
+}
+
 function buildClaudeEnv(runtime: ProviderRuntimeRecord, extra?: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
   const env = buildProviderEnv(runtime, extra);
   for (const [key, value] of Object.entries(process.env)) {
@@ -1913,20 +1931,24 @@ async function execProviderCommand(
     workDir,
   });
 
+  const providerEnv = buildProviderEnv(runtime, env);
+  const redactions = buildProviderRedactions(providerEnv);
   let stdout = "";
   let stderr = "";
   const result = await sandbox.exec({
     command: runtime.metadata.executablePath,
     args,
     timeoutMs,
-    env: buildProviderEnv(runtime, env),
+    env: providerEnv,
     onStdout: (chunk) => {
-      stdout += chunk;
-      callbacks?.onStdout?.(chunk);
+      const value = redactText(chunk, redactions);
+      stdout += value;
+      callbacks?.onStdout?.(value);
     },
     onStderr: (chunk) => {
-      stderr += chunk;
-      callbacks?.onStderr?.(chunk);
+      const value = redactText(chunk, redactions);
+      stderr += value;
+      callbacks?.onStderr?.(value);
     },
   });