Harden registry release preflight

tests/test_preflight.py

@@ -107,6 +107,22 @@ class TestAnalyzeTool:
         _check_secrets(tool, report)
         assert any("secret" in w.lower() for w in report.warnings)
 
+    def test_secret_pattern_does_not_match_compound_schema_fields(self):
+        from cmdforge.tool import PromptStep, Tool
+
+        tool = Tool(
+            name="schema-docs",
+            steps=[PromptStep(
+                prompt="Document max_tokens and token_count fields",
+                provider="mock",
+                output_var="out",
+            )],
+        )
+        report = PreflightReport()
+        from cmdforge.preflight import _check_secrets
+        _check_secrets(tool, report)
+        assert report.warnings == []
+
     @pytest.mark.parametrize("version", ["1.2.3garbage", "1.2.3.4", "1.2"])
     def test_semver_rejects_trailing_or_incomplete_values(self, version):
         assert _is_semver(version) is False