class-prv-key-manager-renderer.php rendered placeholder="sk-or-..." on
the write-only password input, leaking the provider key format in page HTML.
This caused the smoke-suite write-only invariant assertion to fail (CI run
2026-06-17 job 81824705096: expect(html).not.toContain("sk-or-")). The
placeholder now reads "Paste provider API key" — neutral, no key-format
prefix, no provider information exposed in rendered HTML.
The value="" write-only invariant was already correct. The encrypted-at-rest
storage was already correct. This fixes the sole remaining output surface.
Full-codebase audit confirms no other path emits the decrypted key:
- No wp_localize_script calls anywhere in the plugin
- No REST endpoints registered
- No data attributes containing key fields
- All get_key() callers use the plaintext server-side only (HTTP auth header)
- error_log() in probe executor logs HTTP status only, never the key value
Agent-Session: prv-key-leak-fix-20260619
Squash-merge PR #6: PR Vision v0.2.3 — UI-editable encrypted provider API key
QA APPROVED: 2026-06-14-85956da7c86bed2c9e2cf60625fda0cf2e9518bb.md
All 5 CI checks green on head SHA 85956da7c8
