fix: pass code_file=True to redact_sensitive_text in execute_code and terminal

[annguyenNous]

Fixes #33801

Problem

redact_sensitive_text() corrupts code syntax in tool output from execute_code and terminal. The function has a code_file=True parameter that skips ENV-assignment and JSON-field regex patterns which cause false positives on code output.

file_tools.py already uses code_file=True for both read_file (line 573) and write_file (line 996), but code_execution_tool.py and terminal_tool.py were missing it.

Fix

Added code_file=True to all 4 redact_sensitive_text calls:

• tools/code_execution_tool.py line 998: stdout_text
• tools/code_execution_tool.py line 1381: stdout_text
• tools/code_execution_tool.py line 1382: stderr_text
• tools/terminal_tool.py line 2122: output

Behavior Change

Pattern	Before (broken)	After (fixed)
MAX_TOKENS = 100	MAX_TOKENS = ***	MAX_TOKENS = 100
"apiKey": "test"	"apiKey": "***"	"apiKey": "test"
sk-proj-abc123...	sk-pro...1234 (still redacted)	sk-pro...1234 (still redacted)

Prefix patterns, auth headers, private keys, DB connstrings, JWTs, and URL secrets are still redacted even with code_file=True.

[liuhao1024]

Verified: correctly extends code_file=True to all terminal/code-execution redaction call sites.

Consistency check: file_tools.py already uses code_file=True (lines 573, 996). This PR brings code_execution_tool.py (3 sites) and terminal_tool.py (1 site) in line with that pattern. All 4 call sites in the diff are accounted for — no omissions.

Semantic correctness: code_file=True skips ENV-assignment (OPENAI_API_KEY=...) and JSON-field ("apiKey": "...") regex patterns to avoid false positives on code output where MAX_TOKENS=4096 or "apiKey" fixtures are legitimate. Prefix patterns (sk-, ghp_), auth headers, private keys, DB connstrings, JWTs, and URL secrets remain active — so actual secrets in terminal output are still caught.

Scope completeness: browser_tool.py and browser_camofox.py also call redact_sensitive_text without code_file=True, but those handle browser extraction/analysis context (not code output), so the default behavior is appropriate there.

[teknium1]

Thanks — the code_file=True insight for terminal + execute_code output was correct and is part of the merged fix #54061 (674e16e).

It wasn't sufficient on its own, though: _DB_CONNSTR_RE isn't gated by code_file, so passing the flag didn't fix the reported postgresql:// f-string corruption. The merged change fixes the root cause in the regex itself (forbid whitespace in the userinfo/password groups so the match can't span a newline) plus brace-template preservation, and includes your code_file=True plumbing. Closing as addressed by #54061.