# v2.1.0-alpha.2 — Secret-leak guard + API-key audit (v2.1 complete)

Final v2.1 "Reliability & secret safety" item.

## Added

- **`--allow-api-key-env` audit trail.** When a blocked provider key env var is
  intentionally passed through to a child agent, `run`/`handoff` record a
  conversation event with the variable **names only** — values are never read,
  logged, or stored. `createAgentEnv` now returns `passedThrough` for this.
- **Secret-leak regression scan** (`secretLeak.test.ts`): asserts provider key
  env vars are stripped from the child by default (no value can reach the agent
  or its logs), that only names are recorded when allowed through, and that the
  redaction scanner flags a leaked key value in artifact text (defense in depth).

## v2.1 status — complete

- `v2.1.0-alpha.0` — Windows-safe agent spawn.
- `v2.1.0-alpha.1` — redact before handoff (Redaction Gate).
- `v2.1.0-alpha.2` — secret-leak regression scan + API-key audit.

## Next line

- v2.2 — Trust & supply chain (untrusted-bundle/path-traversal safety, signed
  releases + provenance, supply-chain hardening).