fix: redact output of credential tools

Signed-off-by: Grant Linville <[email protected]>

Author: g-linville

pkg/runner/monitor.go

@@ -28,3 +28,22 @@ func (n noopMonitor) Stop(string, error) {}
 func (n noopMonitor) Pause() func() {
 	return func() {}
 }
+
+type credWrapper struct {
+	m Monitor
+}
+
+func (n credWrapper) Event(e Event) {
+	if e.Type == EventTypeCallFinish {
+		e.Content = "credential tool output redacted"
+	}
+	n.m.Event(e)
+}
+
+func (n credWrapper) Stop(s string, err error) {
+	n.m.Stop(s, err)
+}
+
+func (n credWrapper) Pause() func() {
+	return n.m.Pause()
+}

pkg/runner/runner.go

@@ -858,7 +858,7 @@ func (r *Runner) handleCredentials(callCtx engine.Context, monitor Monitor, env
 				return nil, fmt.Errorf("failed to create subcall context for tool %s: %w", credToolName, err)
 			}
 
-			res, err := r.call(subCtx, monitor, env, input)
+			res, err := r.call(subCtx, credWrapper{monitor}, env, input)
 			if err != nil {
 				return nil, fmt.Errorf("failed to run credential tool %s: %w", credToolName, err)
 			}