Resolve typed credentials safely

internal/app/commands_test.go

@@ -217,7 +217,7 @@ seriatim:
   binary: ` + seriatimBinary + `
 audita:
   binary: ` + auditaBinary + `
-  llm_api_key_env: OPENROUTER_API_KEY
+  llm_api_key: OPENROUTER_API_KEY
 notification:
   mode: noop
 `
@@ -262,6 +262,28 @@ inputs:
 	if !strings.Contains(stdout.String(), "stage=polish executed=1 skipped=0") {
 		t.Fatalf("stdout = %q, want polish execution", stdout.String())
 	}
+	foundReference := false
+	if err := filepath.WalkDir(workRoot, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil || entry.IsDir() {
+			return walkErr
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		if bytes.Contains(data, []byte("from-secret-file")) {
+			t.Fatalf("workspace output %q exposed credential value", path)
+		}
+		if bytes.Contains(data, []byte("OPENROUTER_API_KEY")) {
+			foundReference = true
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("inspect polish outputs: %v", err)
+	}
+	if !foundReference {
+		t.Fatal("polish outputs omitted safe credential reference")
+	}
 }
 
 func TestExecuteRunFailsWhenExplicitSecretsDirMissing(t *testing.T) {