Harden registry release preflight

src/cmdforge/cli/registry_commands.py

@@ -522,6 +522,17 @@ def _cmd_registry_publish(args):
         if not name or not version:
             print("Error: config.yaml must have 'name' and 'version' fields", file=sys.stderr)
             return 1
+        # Registry fields are local installation/status metadata. Including a
+        # previous release's hash or owner in a new payload makes content
+        # identity depend on stale registry state.
+        for key in (
+            "registry_hash",
+            "registry_status",
+            "registry_owner",
+            "registry_feedback",
+        ):
+            data.pop(key, None)
+        config_yaml = yaml.dump(data, default_flow_style=False, sort_keys=False)
     except yaml.YAMLError as e:
         print(f"Error: Invalid YAML in config.yaml: {e}", file=sys.stderr)
         return 1

src/cmdforge/preflight.py

@@ -207,7 +207,14 @@ def _check_secrets(tool: Tool, report: PreflightReport):
         if hasattr(step, "prompt"):
             prompt_lower = step.prompt.lower()
             for pat in secret_patterns:
-                if pat in prompt_lower:
+                # Do not flag schema/field names such as max_tokens or
+                # token_count. Underscores are identifier characters here,
+                # even though regex \b would treat them inconsistently around
+                # compound names.
+                if re.search(
+                    rf"(?<![a-z0-9_]){re.escape(pat)}(?![a-z0-9_])",
+                    prompt_lower,
+                ):
                     report.warnings.append(
                         f"Prompt step contains potential secret pattern '{pat}'"
                     )