Mask padded credentials as sent to providers

internal/framework/llm/native_adapter_test.go

@@ -27,7 +27,7 @@ type transportFunc func(*http.Request) (*http.Response, error)
 func (f transportFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
 
 func TestRoleClientUsesNativeTargetAndRedactsCredential(t *testing.T) {
-	t.Setenv("AUDITA_TEST_KEY", "synthetic-secret-value")
+	t.Setenv("AUDITA_TEST_KEY", "  synthetic-secret-value\t ")
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "config.yml"), []byte("version: 3\n"), 0644); err != nil {
 		t.Fatal(err)

internal/framework/llm/secrets.go

@@ -3,6 +3,7 @@ package llm
 import (
 	"context"
 	"os"
+	"strings"
 
 	"gitea.maximumdirect.net/eric/audita/v3/internal/core/redaction"
 )
@@ -41,6 +42,10 @@ func (r *Runtime) ConfiguredSecrets(ctx context.Context, additionalEnvNames ...s
 	for name := range names {
 		if value := os.Getenv(name); value != "" {
 			secrets = append(secrets, value)
+			// PromptKit trims the value before sending it to the provider.
+			if trimmed := strings.TrimSpace(value); trimmed != "" && trimmed != value {
+				secrets = append(secrets, trimmed)
+			}
 		}
 	}
 	return secrets