If I connect a few AI services, does my login info get passed around?

FinchStory has to coordinate the interface, Workers, different Runtimes, and Providers. The security goal is not to let every layer see complete credentials. It is to give each component only what it needs to do the work in front of it.

The Renderer can no longer read full Provider secrets

Starting in 0.1.161, the Renderer no longer has the ability to read or reveal complete Provider secrets. Worker environments are now more narrowly scoped as well, receiving only the variables required by the current model and Runtime.

DeepSeek child processes no longer inherit the full process.env. The Codex proxy is only injected in cases that actually need it, such as Codex or Pi + ChatGPT.

Long-lived and short-lived credentials are kept further apart

Codex continues to manage its own refresh token. Pi receives only the short-lived access credential needed for the current work, not the long-lived refresh token.

Redaction now distinguishes real secrets from ordinary text

Credential Redactor now covers logs, journals, traces, turn state/events, project history, support data, and other observability boundaries. At the same time, canonical product state and observability redaction are handled as separate concerns.

Known real secrets are still removed. Ordinary uses of words such as token, password, and secret—including code and documentation examples—are no longer rewritten just because they look credential-like.

Good isolation is not “delete anything that says secret.” It is keeping real credentials only where they are genuinely needed.

This change does not alter existing Role behavior, the role-creation experience, or the supported Provider set. The full test suite increased to 378 tests.