fix(agent): re-introduce credential scrubbing on the tinyagents tool seam (tinyhumansai#4453)

[senamakel]

Summary

Fixes the credential-scrubbing regression from the TinyAgents 1.3 → 1.5 migration (source issue: tinyhumansai#4453).

The legacy engine ran scrub_credentials over every tool output before it entered model context (v0.58.7 engine/tools.rs). On the tinyagents path, execute_openhuman_tool never scrubbed and scrub_credentials had zero production callers, so secrets in tool output (env dumps, config reads, API responses, shell output) reached model context (and thus third-party providers), session_raw transcripts, worker-thread mirrors, and the ToolCallOutcome sink — violating "Never log secrets or full PII."

Fix

• CredentialScrubMiddleware — a wrap_tool tool middleware installed on the shared assemble_turn_harness seam, so both the parent chat path and the sub-agent path are covered. It is registered as the innermost wrap layer, so it always sees the RAW tool output and always runs BEFORE the after_tool chain (summarization / caps / tokenjuice via ToolOutputMiddleware) and before the transcript push. This ordering holds regardless of after_tool registration order — deliberately robust to the middleware-ordering rework in after_tool middleware order inverted: progressive-disclosure handoff is dead code, outcome capture sees pre-cap content tinyhumansai/openhuman#4464 (the crate runs after_tool in reverse registration order; using wrap_tool sidesteps that entirely). Because every downstream surface (transcript, ToolOutputMiddleware, the ToolCallOutcome sink, session_raw persistence via persist_subagent_transcript, worker-thread mirror) derives from the scrubbed content, one scrub at this seam covers all of them.
• harness/credentials.rs stays the single source of truth for the patterns, extended beyond the legacy key/value regex to also catch the standalone formats the acceptance criteria name: bare AWS access-key IDs (AKIA…/ASIA…), OpenAI sk-… keys, and space-separated Bearer tokens. The scrub is idempotent.
• The tool result's error text is scrubbed too (it can echo the raw output and feeds the outcome sink / model-facing error surface).

Verified

• Unit tests in credentials.rs for the new AWS / OpenAI / Bearer patterns + idempotency (logic reviewed against each input; each raw secret is redacted, marker preserved).
• e2e tests in tinyagents/tests.rs drive a real turn through run_turn_via_tinyagents_shared with a tool that leaks a fake AKIA…/sk-…/Bearer token and assert redaction at the model-visible transcript, the persisted conversation, and the ToolCallOutcome sink — on both the chat and the sub-agent path.

Could NOT verify locally

• cargo check/cargo test did not finish within the time budget: this worktree shares one Cargo target dir with several sibling worktree agents, and the build serialized on the shared target lock (20+ concurrent cargo processes). The change compiles against the current APIs as read from the vendored crate (ToolMiddleware/ToolHandler/MiddlewareToolOutcome, run_turn_via_tinyagents_shared, SubagentScope), but CI is the authoritative build/test signal here. Please rely on CI for the green check.

https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[senamakel]

Superseded: re-implementing tinyhumansai#4453 fresh on current upstream/main as a PR to tinyhumansai/openhuman (upstream tinyhumansai#4483 changed the middleware area).