changelog(unreleased): secret-guard (pi-extensions a88fa99) and pi-task model fallback (pi-toolkit 3760d90)

Both arrive with the next build without a pin change, because CI resolves
pi-extensions and pi-toolkit main at build time. The components table now names
them: pi-extensions 143a214 -> a88fa99, and a new pi-toolkit row 9c87ee8 ->
3760d90. Both ids were checked against ls-remote, and the baked values against
/etc/pi-devbox/build-manifest.json on a v1.10.2 device.

CHANGELOG.md

@@ -17,7 +17,8 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 | Component | Baked in v1.10.2 | Next build | Why |
 |---|---|---|---|
-| pi-extensions | `143a214` | **`f885199`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` extension: keeps the Bedrock SSO session alive (below) |
+| pi-extensions | `143a214` | **`a88fa99`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` (keeps the Bedrock SSO session alive) and `secret-guard.ts` (keeps secret env values out of model context); both below |
+| pi-toolkit | `9c87ee8` | **`3760d90`** (or later: CI resolves `main` at build time) | `pi-task`: optional model fallback when the primary model fails auth before acting (below) |
 | pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) |
 
 ### Added
@@ -51,6 +52,43 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   so removing the mount later is harmless (measured with pi 1.0.0). README:
   "Custom model providers (`models.json`)".
 
+- **secret-guard (pi-extensions `secret-guard.ts`): secret env values never reach
+  the model, the session file or the palace feed.** It replaces the exact value
+  of every env var whose name says secret (`…TOKEN`, `…API_KEY`, `…PASSWORD`, …)
+  with `<redacted:NAME>`, the same rule and placeholder as mempalace-toolkit's
+  feed redactor. It applies to every tool result (MCP tools included), to the
+  context of each request (covering user `!` commands and older sessions), and it
+  blocks a `write`/`edit` that would write such a placeholder back over the real
+  value. `$NAME` still expands in commands; only the output coming back is
+  rewritten.
+
+  Measured motivation, 2026-10-12: an agent's own `sed` failed to redact
+  `MEMPALACE_REMOTE_TOKEN=…` from `env | grep` output. The raw value had been in
+  local session files for two months, so each of those sessions had sent it to
+  its model provider. The palace stayed clean only because the feed redactor
+  works.
+
+  Not covered:
+  - live streaming output while a tool runs;
+  - the stored entry of a user `!` command;
+  - secrets not in the environment;
+  - `pi-task` children, which run `--no-extensions`.
+
+  `PI_SECRET_GUARD=off` disables it.
+
+- **`pi-task` model fallback (pi-toolkit `bin/pi-task`).** A
+  `pi-task.fallbackProfiles` block in `settings.json` (per effort tier:
+  provider/id/thinking) lets a task retry once on another model. The retry
+  happens only when the primary fails with an auth-class error (an expired SSO
+  token, an invalid key) **before** it has called a tool or changed a watched
+  file, and with at least 30 s of wall budget left. Both attempts are recorded in
+  `result.json` and the audit dir, and the result line is tagged `[FALLBACK]`.
+  Without the block, behaviour is unchanged. It was needed because pi reports
+  such a failure only inside its JSON stream: `stopReason=error`, rc 0. Before
+  this, an expired Bedrock session failed every task as "no fenced json
+  envelope". The `fork` tool does not read this key. Documented in pi-toolkit's
+  README.
+
 - **Long Bedrock runs no longer die at "Token is expired" when the AWS SSO
   session ends: `/aws-sso` (pi-extensions `aws-sso.ts`) runs `aws sso login` for
   you just after the session ends.** Off until `/aws-sso on` (or