fix(opencode): redact secrets in advisory mode

[Kerberosmansour (kerberosmansour)]

Summary

• apply secret redaction to tool output in advisory mode as well as enforce mode
• keep clean output unchanged
• add a regression test proving a GitHub token is redacted in advisory mode

Root cause

The output hook returned early for every advisory-mode request, coupling non-blocking policy enforcement to the independent requirement to avoid leaking detected credentials.

Validation

• cd agent-governance-opencode && npm run check — 26/26 tests passed
• changed-line spelling and whitespace checks passed

Closes #3665

Tracking and related work

• Primary issue: [Bug]: advisory mode disables secret redaction #3665; the closure directive above remains authoritative.
• Related follow-ups [Feature]: make secret patterns configurable and add common token formats #3667 and [Feature]: optionally scrub hidden instruction carriers from tool output #3670 are intentionally not implemented here.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	MEDIUM
Overall	MEDIUM

Automated check by AGT Contributor Check.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Imran Siddique (imran-siddique)]

The coupling this removes is the interesting part, so worth stating it as a security property rather than a bug fix.

if (!findings.length || state.policy.mode === "advisory") made redaction conditional on enforcement mode. Those are two different requirements. Enforcement mode answers "may this proceed"; redaction answers "may this be shown". An operator running advisory mode has chosen not to block, which is not the same as choosing to have detected credentials passed through into tool output. The mode name reinforces the wrong expectation: advisory reads as detect-and-report, and what it actually did was detect and hand the secret over. Your root-cause line says exactly this and it is the right framing.

Two things I checked rather than took on trust.

The reason simplification from findings.length ? AGT advisory: ... : "" to "" is safe. After the change that branch is reachable only when findings.length is zero, so the ternary could never have produced anything but the empty string. No advisory detail is lost, because the path that carries detail is now the one that continues rather than returns.

The test constructs its fixture as "ghp_" + "c".repeat(40) instead of writing the token literally. That is the right way to test a redactor: it exercises the github-token pattern without committing a credential-shaped literal that secret scanners will flag forever afterwards. Asserting both /AGT_REDACTED:github-token/ matches and /ghp_c{40}/ does not is the correct pair, since a redactor that appends a marker without removing the original would pass a one-sided assertion.

Deliberately leaving #3667 and #3670 out is the right instinct on a fix like this.

The gitleaks failure here was a platform outage, curl: (22) The requested URL returned error: 503 fetching the gitleaks binary, not anything in your diff. I re-ran it and it passes.

No approve bit on this repo, so a comment, but I would merge it, and of your five open opencode PRs this is the one I would take first.