fix(security): match internal secret env names by shape, not exact suffix

[itskaism]

This builds on #77027 (@andrexibiza) and #77193 (@andrexibiza), which are
open against the same function and which I'd like to see land first — this is a
narrow follow-up to the part neither covers, not a competing rewrite. Happy to
rebase behind whichever merges, or to fold this into one of them if that's
easier for review.

The gap

_is_hermes_internal_secret matches a fixed set of exact suffixes: _API_KEY /
_BASE_URL for AUXILIARY_*, and _SECRET / _KEY / _TOKEN for
GATEWAY_RELAY_*. Adjacent real spellings fall straight through and reach the
child environment.

Measured end to end by spawning a real /usr/bin/env through
hermes_subprocess_env() with canary values — this is what a model-authored
shell command actually sees:

tree	secrets leaked to child
main	5
+ #77027	4
+ #77193	5
this PR	0

Still leaking after both open PRs:

AUXILIARY_VISION_APIKEY     # no separator before KEY
AUXILIARY_VISION_SECRET     # aux only matched _API_KEY / _BASE_URL
AUXILIARY_VISION_TOKEN
GATEWAY_RELAY_SECRET_V2     # suffix match ends at _SECRET

(#77027 does close GATEWAY_RELAY_PASSWORD, which is why its row is 4 and not 5.)

The fix

Match by shape rather than by an enumerated suffix list: under the
AUXILIARY_ and GATEWAY_RELAY_ prefixes, a name containing KEY / SECRET /
TOKEN / PASSWORD is internal.

This is not a new policy — it's the rule code_execution_tool.py already
applies, and the existing docstring says as much:

code_execution_tool.py already catches these via substring matching on
KEY / SECRET / TOKEN; the terminal backend's narrower name-based
blocklist did not, which is the leak this predicate closes.

The terminal backend now uses the same rule as the code-execution backend.

Not over-blocking

The docstring explicitly protects non-secret routing hints, so those are the
important negative controls:

variable	before	after
GATEWAY_RELAY_URL	visible	visible
GATEWAY_RELAY_PLATFORMS	visible	visible
PATH, HOME	visible	visible
AUXILIARY_VISION_API_KEY	stripped	stripped
GATEWAY_RELAY_SECRET	stripped	stripped

4/4 routing hints survive; the two already-caught controls are unchanged.

Tests

tests/tools/test_internal_secret_name_shape.py asserts the relation — under
these prefixes a credential-shaped name is stripped while routing hints survive
— rather than freezing a suffix list, so it keeps working as new spellings
appear.

Verified RED before GREEN: applying only the test file to unpatched main fails
6 of 10. With the fix, 10/10.

tests/tools/test_internal_secret_name_shape.py     10 passed
tests/tools/test_build_subprocess_env.py           }  29 passed
tests/tools/test_env_passthrough.py                }

All three spawn builders are affected identically (_make_run_env,
_sanitize_subprocess_env, hermes_subprocess_env), so this covers the
terminal, Docker and plain-subprocess paths.

[andrexibiza]

Bound to the child-process credential-inheritance class under #83565 (#83565) — same bug class, different surface. internal-secret name-shape matching; Wave B. Currently blocked with no check-runs at head — needs CI before it can merge. The EPIC carries the live class table, dedup adjudication, and the dependency-driven merge order.

[egilewski]

suggesting changes

The patch's whole-name credential substring matching removes valid non-secret plugin routing selectors when a task key contains a credential word. AUXILIARY_MONKEY_MODEL remains available on current main but is removed by this patch, so provider/model routing for valid keys such as monkey, keystone, secretary, and tokenizer can silently disappear from child environments. Restrict matching to credential field components after the auxiliary task component (while retaining separator-less and qualified credential spellings), or explicitly preserve auxiliary MODEL/PROVIDER fields, and add regression coverage for these key-like names across every spawn builder.

Security evidence:

trust boundary: Model-authored child processes receive environments assembled by local, container, and non-terminal subprocess builders; process environment and plugin configuration are sources, the internal-secret predicate validates names, and the child environment is the sink. The changed predicate applies even when credentials are inherited.

source/sink/invariant: The boundary must remove dynamic credentials under AUXILIARY_ and GATEWAY_RELAY_ while preserving non-secret auxiliary MODEL/PROVIDER selectors and relay routing hints. Plugin registration accepts alphanumeric/underscore task keys, and gateway bridging creates AUXILIARY_<KEY>_PROVIDER and AUXILIARY_<KEY>_MODEL; whole-name matching violates the preservation invariant.

current-main reproduction: Current main removes credential-shaped internal names while preserving normal auxiliary selectors, including AUXILIARY_MONKEY_MODEL, in a child-environment check.

PR-head or patch-replay validation: The reviewed change removes intended credential variants and preserves standard routing hints, but also removes AUXILIARY_MONKEY_MODEL, confirming the regression is introduced by this change.

positive/negative cases: Credential-shaped names are absent from child environments; documented auxiliary and relay routing hints remain visible; a valid key-like selector containing KEY is incorrectly absent.

residual bypass search: The shared sanitizer covers local, container, and non-terminal child-environment builders examined; no additional bypass was introduced by this change.

reviewer validation: Independent source review, focused regression coverage, and child-environment checks confirmed both the intended credential removal and the plugin-routing regression.

Not checked:

• Full gateway startup with a third-party auxiliary plugin
• Third-party plugin end-to-end child workflow

Signed: GPT-5.6-luna-max in Codex