[gu-feng418]

search_code sent the model's query to OpenRouter unmasked, both for the embedding (embed([query], 'query')) and for the rerank, while the candidate chunks were already run through redactSecrets. A token the model had copied into its own query therefore reached a third-party service — the same hole web_search closed in #73, and reachable in Ask mode because search_code is a read-only tool that subagents may call too.

The fix is the one the issue suggests: redact once before both calls (const sent = redactSecrets(query)), the way web.ts:168-169 does for its query.

Closes #286.

Verification

• New regression test in src/main/search/code_index.test.ts (masks secrets in the query before it leaves to the embedding and the reranker (#286)) asserts the fake embedder's 'query' call and reranker.seen.query both carry fix the login that stores [REDACTED:_____].
• Fail-first check: the same scratch run against the unpatched file (git show HEAD:src/main/search/code_index.ts) shows the raw ghp_… token reaching both the embedder and the reranker, so the test does pin the behaviour rather than passing vacuously.
• npx vitest run --project unit src/main/search/code_index.test.ts → 29 passed.
• npx tsc --noEmit -p tsconfig.node.json, npx eslint on both files and npx prettier --check on both files → clean.
• Full npx vitest run --project unit: 1633 passed, 5 test files failed — apply_patch, edit_backups, file_operations, shell and tools, every one of them with The native file helper was not found. Build it with npm run build:sandbox. That helper needs a C compiler, which this machine has not, so npm run test:unit could not be used as-is; none of those five files import code_index / CodeIndex / search_code (checked by grep), so nothing there is affected by this change.