security: mask all secrets in build logs (start.sh)

- Add _mask_val() helper to show only first 6 + **** + last 4 chars
- Mask OPENROUTER_API_KEY, FEISHU_APP_SECRET, FIRECRAWL_API_KEY in stdout
- Mask AUTH_TOKEN in startup summary
- Secrets still written correctly to .env file (unchanged)
- Prevents secrets from appearing in public HF Space build logs

start.sh

@@ -58,7 +58,15 @@ fi
 ENV_FILE="$HERMES_HOME/.env"
 ENV_DATA="/data/hermes/.env"
 
+# Helper: mask a secret value for safe logging (show first 6 + **** + last 4)
+_mask_val() {
+    local val="$1"
+    if [ -z "$val" ] || [ ${#val} -lt 12 ]; then echo "****"; return; fi
+    echo "${val:0:6}****${val: -4}"
+}
+
 # Generate .env from Space Secrets (environment variables injected by HF)
+# SECURITY: secrets are written to file ONLY — never echoed to stdout/build logs
 if [ ! -f "$ENV_DATA" ] && [ -n "$OPENROUTER_API_KEY" ]; then
     echo "Generating .env from Space Secrets..."
     {
@@ -73,7 +81,12 @@ if [ ! -f "$ENV_DATA" ] && [ -n "$OPENROUTER_API_KEY" ]; then
         [ -n "$FIRECRAWL_API_KEY" ] && echo "FIRECRAWL_API_KEY=$FIRECRAWL_API_KEY"
     } > "$ENV_DATA"
     chmod 600 "$ENV_DATA"
-    echo "Created .env from Space Secrets"
+    echo "Created .env from Space Secrets (keys masked below)"
+    echo "  OPENROUTER_API_KEY=$(_mask_val "$OPENROUTER_API_KEY")"
+    [ -n "$OPENAI_API_KEY" ] && echo "  OPENAI_API_KEY=$(_mask_val "$OPENAI_API_KEY")"
+    [ -n "$FEISHU_APP_ID" ] && echo "  FEISHU_APP_ID=$FEISHU_APP_ID"
+    [ -n "$FEISHU_APP_SECRET" ] && echo "  FEISHU_APP_SECRET=$(_mask_val "$FEISHU_APP_SECRET")"
+    [ -n "$FIRECRAWL_API_KEY" ] && echo "  FIRECRAWL_API_KEY=$(_mask_val "$FIRECRAWL_API_KEY")"
 fi
 
 # Fallback: if no secrets and no persistent data
@@ -394,7 +407,7 @@ echo "=== All services started ==="
 echo "  Gateway:  http://127.0.0.1:8642 (with Python watchdog in entry.py)"
 echo "  WebUI:    http://127.0.0.1:6060"
 echo "  Proxy:    http://0.0.0.0:7860"
-echo "  Auth Token: $AUTH_TOKEN"
+echo "  Auth Token: $(_mask_val "$AUTH_TOKEN")"
 echo ""
 
 # Start Python proxy on :7860 (main HF Space port)