Harden registry release preflight

tests/test_cli.py

@@ -911,6 +911,38 @@ class TestRegistryPublishDryRun:
         assert _cmd_registry_publish(self.args(tool_dir)) == 1
         assert "Tool rejected" in capsys.readouterr().err
 
+    def test_strips_local_registry_metadata_from_payload(
+        self, tool_dir, monkeypatch
+    ):
+        import yaml
+
+        from cmdforge.cli.registry_commands import _cmd_registry_publish
+
+        config_path = tool_dir / "config.yaml"
+        config_path.write_text(
+            config_path.read_text()
+            + "registry_hash: sha256:stale\n"
+            + "registry_status: approved\n"
+            + "registry_owner: previous-owner\n"
+            + "registry_feedback: old feedback\n"
+        )
+        client = MagicMock()
+        client.publish_tool.return_value = {"preflight": {"errors": []}}
+        monkeypatch.setattr(
+            "cmdforge.cli.registry_commands.load_config",
+            lambda: SimpleNamespace(registry=SimpleNamespace(token="token")),
+        )
+        monkeypatch.setattr("cmdforge.registry_client.get_client", lambda: client)
+
+        assert _cmd_registry_publish(self.args(tool_dir)) == 0
+        payload = yaml.safe_load(client.publish_tool.call_args.args[0])
+        assert not {
+            "registry_hash",
+            "registry_status",
+            "registry_owner",
+            "registry_feedback",
+        }.intersection(payload)
+
     def test_non_mapping_config_returns_failure(self, tool_dir, capsys):
         from cmdforge.cli.registry_commands import _cmd_registry_publish
 

tests/test_preflight.py

@@ -107,6 +107,22 @@ class TestAnalyzeTool:
         _check_secrets(tool, report)
         assert any("secret" in w.lower() for w in report.warnings)
 
+    def test_secret_pattern_does_not_match_compound_schema_fields(self):
+        from cmdforge.tool import PromptStep, Tool
+
+        tool = Tool(
+            name="schema-docs",
+            steps=[PromptStep(
+                prompt="Document max_tokens and token_count fields",
+                provider="mock",
+                output_var="out",
+            )],
+        )
+        report = PreflightReport()
+        from cmdforge.preflight import _check_secrets
+        _check_secrets(tool, report)
+        assert report.warnings == []
+
     @pytest.mark.parametrize("version", ["1.2.3garbage", "1.2.3.4", "1.2"])
     def test_semver_rejects_trailing_or_incomplete_values(self, version):
         assert _is_semver(version) is False