fix: redact output of credential tools (#500)

Signed-off-by: Grant Linville <[email protected]>

Author: g-linville

pkg/runner/runner.go

@@ -542,7 +542,7 @@ func (r *Runner) resume(callCtx engine.Context, monitor Monitor, env []string, s
 				Time:        time.Now(),
 				CallContext: callCtx.GetCallContext(),
 				Type:        EventTypeCallFinish,
-				Content:     *state.Continuation.Result,
+				Content:     getFinishEventContent(*state, callCtx),
 			})
 			if callCtx.Tool.Chat {
 				return &State{
@@ -786,6 +786,15 @@ func (r *Runner) subCalls(callCtx engine.Context, monitor Monitor, env []string,
 	return state, callResults, nil
 }
 
+func getFinishEventContent(state State, callCtx engine.Context) string {
+	// If it is a credential tool, the finish event contains its output, which is sensitive, so we don't return it.
+	if callCtx.ToolCategory == engine.CredentialToolCategory {
+		return ""
+	}
+
+	return *state.Continuation.Result
+}
+
 func (r *Runner) handleCredentials(callCtx engine.Context, monitor Monitor, env []string) ([]string, error) {
 	// Since credential tools (usually) prompt the user, we want to only run one at a time.
 	r.credMutex.Lock()