fix(reply): omit auth labels in /new and /reset

src/auto-reply/reply.triggers.trigger-handling.filters-usage-summary-current-model-provider.test.ts

@@ -382,7 +382,9 @@ describe("trigger handling", () => {
       );
       const text = Array.isArray(res) ? res[0]?.text : res?.text;
       expect(text).toContain("api-key");
-      expect(text).toMatch(/\u2026|\.{3}/);
+      expect(text).toContain("****");
+      expect(text).toContain("sk-t");
+      expect(text).not.toContain("1234567890abcdef");
       expect(text).toContain("(anthropic:work)");
       expect(text).not.toContain("mixed");
       expect(runEmbeddedPiAgentMock).not.toHaveBeenCalled();

src/auto-reply/reply/get-reply-run.media-only.test.ts

@@ -80,6 +80,7 @@ vi.mock("./typing-mode.js", () => ({
 }));
 
 import { runReplyAgent } from "./agent-runner.js";
+import { routeReply } from "./route-reply.js";
 
 function baseParams(
   overrides: Partial<Parameters<typeof runPreparedReply>[0]> = {},
@@ -204,4 +205,20 @@ describe("runPreparedReply media-only handling", () => {
     });
     expect(vi.mocked(runReplyAgent)).not.toHaveBeenCalled();
   });
+
+  it("omits auth key labels from /new and /reset confirmation messages", async () => {
+    await runPreparedReply(
+      baseParams({
+        resetTriggered: true,
+      }),
+    );
+
+    const resetNoticeCall = vi.mocked(routeReply).mock.calls[0]?.[0] as
+      | { payload?: { text?: string } }
+      | undefined;
+    expect(resetNoticeCall?.payload?.text).toContain("✅ New session started · model:");
+    expect(resetNoticeCall?.payload?.text).not.toContain("🔑");
+    expect(resetNoticeCall?.payload?.text).not.toContain("api-key");
+    expect(resetNoticeCall?.payload?.text).not.toContain("env:");
+  });
 });

src/auto-reply/reply/get-reply-run.ts

@@ -1,7 +1,6 @@
 import crypto from "node:crypto";
 import { resolveSessionAuthProfileOverride } from "../../agents/auth-profiles/session-override.js";
 import type { ExecToolDefaults } from "../../agents/bash-tools.js";
-import { resolveModelAuthLabel } from "../../agents/model-auth-label.js";
 import {
   abortEmbeddedPiRun,
   isEmbeddedPiRunActive,
@@ -325,18 +324,10 @@ export async function runPreparedReply(
     if (channel && to) {
       const modelLabel = `${provider}/${model}`;
       const defaultLabel = `${defaultProvider}/${defaultModel}`;
-      const modelAuthLabel = resolveModelAuthLabel({
-        provider,
-        cfg,
-        sessionEntry,
-        agentDir,
-      });
-      const authSuffix =
-        modelAuthLabel && modelAuthLabel !== "unknown" ? ` · 🔑 ${modelAuthLabel}` : "";
       const text =
         modelLabel === defaultLabel
-          ? `✅ New session started · model: ${modelLabel}${authSuffix}`
-          : `✅ New session started · model: ${modelLabel} (default: ${defaultLabel})${authSuffix}`;
+          ? `✅ New session started · model: ${modelLabel}`
+          : `✅ New session started · model: ${modelLabel} (default: ${defaultLabel})`;
       await routeReply({
         payload: { text },
         channel,