@1agh/maude 1.0.11 → 1.3.0

package/README.md

@@ -1,6 +1,6 @@
 # Maude
 
-A personal marketplace of Claude Code plugins. Two plugins today, plus a `maude` CLI for scaffolding and running the bundled dev tooling.
+A personal marketplace of Claude Code and Codex plugins. Two plugins today, plus a `maude` CLI for scaffolding and running the bundled dev tooling.
 
 <!-- Demo video lives at https://github.com/1aGh/maude/releases/download/v0.16.0/demo.mp4 once uploaded.
      Until then the inline tag below stays a soft 404; landing page at https://maude.sh autoplays the same file. -->
@@ -18,6 +18,8 @@ Plus the **`maude`** CLI — `maude init` scaffolds a fresh `.ai/` workspace fro
 
 ## Quick start
 
+**Codex CLI:** use the [native plugin installation guide](docs/native-plugins.md). It uses the same workflow procedures; Studio ACP support is a separate follow-up.
+
 > **Using Maude Desktop?** With only **Claude Code installed**, the desktop app's built-in chat panel auto-loads the `design` + `flow` plugins for its session — `/design:*` and `/flow:*` just work, nothing to install (power users who already installed the plugins see a no-op, no double-load). The steps below are the **manual / power-user path** — for the `maude` CLI, the web `maude design serve` flow, or driving `/design:*` from your own terminal Claude Code. Full detail: [maude.sh/desktop](https://maude.sh/desktop).
 
 ### 1. Add the marketplace inside Claude Code

package/apps/studio/acp/bridge.ts

@@ -8,7 +8,6 @@
 // (env.ts): the child inherits the environment MINUS `ANTHROPIC_API_KEY`, so
 // auth precedence falls through to the user's Pro/Max subscription.
 
-import { readFileSync } from 'node:fs';
 import { appendFile, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 
@@ -32,6 +31,7 @@ import {
 import { scrubAgentEnv } from './env.ts';
 import type { SdkPluginConfig } from './plugin-bootstrap.ts';
 import { resolveAdapterEntry, resolveAgentRuntime, resolveClaudePath } from './probe.ts';
+import { countTranscriptLinesAt, stripInlineBlobs } from './transcript-io.ts';
 import {
   isWriteToolName,
   looksLikeWriteToolCall,
@@ -207,18 +207,16 @@ type Spawned = ReturnType<typeof Bun.spawn>;
 const VALID_SESSION_ID = /^[A-Za-z0-9_-]{1,128}$/;
 
 /** Raw non-empty line count of a transcript file — the re-attach seam's seed.
- *  Deliberately duplicated from `transcript.ts`'s `chatTranscriptSeq` rather
- *  than imported: importing would pull the transcript READER (and its
- *  designRoot/chatId path convention) into the bridge, which knows only an
- *  absolute file path. The two MUST count identically — raw non-empty lines,
- *  never parsed lines, since a corrupt line would otherwise shift every later
- *  seq and permanently desync the seam. */
+ *  Delegates to the ONE shared implementation in `transcript-io.ts`, which
+ *  `transcript.ts`'s `chatTranscriptSeq` also calls. These two counters MUST
+ *  agree — a disagreement shifts every later seq and permanently desyncs the
+ *  seam — and until #119 they were two hand-copied bodies kept in step only by
+ *  a comment. `transcript-io.ts` takes an absolute path and nothing else, so
+ *  sharing it does NOT drag the reader's designRoot/chatId path convention into
+ *  the bridge (the original reason for the duplication). It also counts in
+ *  bounded chunks rather than materializing a multi-hundred-MB file. */
 function countTranscriptLines(path: string): number {
-  try {
-    return readFileSync(path, 'utf8').split('\n').filter(Boolean).length;
-  } catch {
-    return 0; // no transcript yet — first turn of this chat
-  }
+  return countTranscriptLinesAt(path);
 }
 
 // `loadSession`'s replay can, in principle, never settle if the underlying
@@ -1760,7 +1758,14 @@ export class AcpBridge {
     if (claimedSeq === undefined) this.transcriptLines += 1;
     try {
       await mkdir(dirname(path), { recursive: true });
-      await appendFile(path, `${JSON.stringify({ ts: Date.now(), ...entry })}\n`);
+      // #119 — elide inline binary payloads (base64 image/audio `data`, `data:`
+      // URIs) before they reach disk. A tool result carrying a screenshot was
+      // persisted verbatim at up to 1.36 MB PER LINE, and nothing ever read it
+      // back: `readChatMessages` projects a tool call down to its name and
+      // done-flag. In a screenshot-heavy design project that was 66–76% of the
+      // transcript's bytes. Prose, tool arguments and file contents are NOT
+      // touched — those are the audit record of what steered the agent.
+      await appendFile(path, `${JSON.stringify(stripInlineBlobs({ ts: Date.now(), ...entry }))}\n`);
     } catch {
       /* transcript is best-effort; never block the chat on disk errors */
     }

package/apps/studio/acp/index.ts

@@ -101,14 +101,28 @@ const BEAT_MS = 4000;
 
 interface AgentActivityTracker {
   onUpdate(update: SessionUpdate): void;
-  /** Turn finished (normal, cancel, error) or socket closed — clear banners. */
-  endTurn(): void;
+  /**
+   * Turn finished (normal, cancel, error) or socket closed — clear banners.
+   * T16: `done` publishes what the turn wrote as ONE project action; anything
+   * else (cancel, error, token limit, reap) keeps it unpublished for the
+   * person's decision. Default `failed` — only a clean end publishes.
+   */
+  endTurn(outcome?: 'done' | 'failed'): void;
+  /** The prompt this turn answers — the action's history label. */
+  beginTurn?(prompt: string): void;
 }
 
 /** Exported for tests (acp-ai-activity.test.ts); not part of the Acp surface. */
-export function createAgentActivityTracker(ctx: Context, ai: AiActivity): AgentActivityTracker {
+export function createAgentActivityTracker(
+  ctx: Context,
+  ai: AiActivity,
+  chatId = 'default'
+): AgentActivityTracker {
   const kindByToolCall = new Map<string, string>(); // toolCallId → kind
   const lastBeat = new Map<string, number>(); // ai-activity key → last beat ms
+  const actionKey = `acp:${chatId}`;
+  let turnLabel = 'Claude edit';
+  let actionOpen = false;
 
   function keyFor(p: unknown): string | null {
     if (typeof p !== 'string' || !p) return null;
@@ -145,6 +159,11 @@ export function createAgentActivityTracker(ctx: Context, ai: AiActivity): AgentA
     for (const p of candidates) {
       const key = keyFor(p);
       if (!key) continue;
+      if (!actionOpen) {
+        // T16 — the turn's first canvas edit opens its project action.
+        actionOpen = true;
+        ctx.syncControl?.current?.()?.beginAiAction?.(actionKey, turnLabel);
+      }
       const last = lastBeat.get(key);
       if (last == null) {
         ai.start(key, AGENT_AUTHOR);
@@ -156,13 +175,25 @@ export function createAgentActivityTracker(ctx: Context, ai: AiActivity): AgentA
     }
   }
 
-  function endTurn(): void {
+  function endTurn(outcome: 'done' | 'failed' = 'failed'): void {
     for (const key of lastBeat.keys()) ai.end(key);
     lastBeat.clear();
     kindByToolCall.clear();
+    if (actionOpen) {
+      actionOpen = false;
+      void ctx.syncControl
+        ?.current?.()
+        ?.endAiAction?.(actionKey, outcome)
+        ?.catch(() => {});
+    }
+  }
+
+  function beginTurn(prompt: string): void {
+    const words = prompt.replace(/\s+/g, ' ').trim().slice(0, 80);
+    turnLabel = words ? `Claude: ${words}` : 'Claude edit';
   }
 
-  return { onUpdate, endTurn };
+  return { onUpdate, endTurn, beginTurn };
 }
 
 // ── Detached bridge lifetime (feature-acp-write-path-scope Addendum, Task 8) ──
@@ -328,7 +359,7 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
         return null;
       }
     }
-    const tracker = aiActivity ? createAgentActivityTracker(ctx, aiActivity) : null;
+    const tracker = aiActivity ? createAgentActivityTracker(ctx, aiActivity, chatId) : null;
     // Declared before the bridge so the callbacks below can close over it —
     // they fan out to `entry.sinks`, which changes as sockets come and go,
     // rather than capturing one socket the way the per-socket design did.
@@ -548,9 +579,14 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
     // first await, so a socket that closes during the spawn still counts as a
     // live turn rather than an abandoned bridge.
     entry.turnActive = true;
+    entry.tracker?.beginTurn?.(text);
+    let turnOutcome: 'done' | 'failed' = 'failed';
     try {
       await bridge.ensureStarted();
       const { stopReason } = await bridge.prompt(text, sanitizeChatId(chatId));
+      // Only a turn that ended on its own publishes; a cancel, a refusal or a
+      // token limit leaves its edits for the person (T16).
+      if (stopReason === 'end_turn') turnOutcome = 'done';
       broadcast(entry, { t: 'connected', sessionId: bridge.sessionId });
       broadcast(entry, { t: 'turn-end', stopReason });
     } catch (err) {
@@ -564,7 +600,7 @@ export function createAcp(ctx: Context, aiActivity?: AiActivity): Acp {
       // RC5 — the turn is over (success, error, or cancel-induced stop): clear
       // every "Claude is editing …" banner this turn raised. The 30 s heartbeat
       // grace still covers a crashed dev-server round-trip.
-      entry.tracker?.endTurn();
+      entry.tracker?.endTurn(turnOutcome);
       // The turn was the only reason a detached bridge was being kept alive; now
       // that it's done, let the ordinary TTL run out rather than holding the
       // subprocess indefinitely for a client that never came back.

package/apps/studio/acp/transcript-io.ts

@@ -0,0 +1,394 @@
+// Low-level transcript file IO — the primitives that must never load a whole
+// `<designRoot>/_chat/<chatId>.jsonl` into memory, plus the writer-side blob
+// sanitizer that keeps those files small in the first place.
+//
+// WHY THIS MODULE EXISTS (issue #119). Transcripts are append-only and were
+// never capped, rotated, or pruned, and `appendTranscript` persisted every ACP
+// session update VERBATIM — including base64 image payloads from tool results
+// (a `maude design screenshot`, a `Read` of a PNG). A dogfood project reached
+// 554 MB across 24 transcripts, the largest 177 MB in 1733 lines, of which
+// 66–76% was base64 that NOTHING ever reads back (`readChatMessages` projects
+// tool calls down to `{ toolName, done }` and discards `content` entirely).
+//
+// Every reader then did `readFileSync(utf8).split('\n').map(JSON.parse)` over
+// the whole file, and `listChats()` did it for EVERY transcript in the
+// directory — on a code path the client fires at every turn end. Measured
+// under Bun against that project: 661 ms of fully synchronous, event-loop-
+// blocking work and 1.29 GB peak RSS per call, climbing to ~1.9 GB retained.
+// That is one defect presenting as two symptoms: the RSS is the churn, and the
+// "stuck chat" is the same single-threaded loop that serves the ACP socket
+// being blocked by it.
+//
+// The rule this module enforces: a transcript's SIZE must not be able to
+// determine the cost of reading it. Every function here is bounded — by a
+// reusable buffer, a prefix cap, or a tail cap — regardless of file size.
+
+import { closeSync, fstatSync, openSync, readSync } from 'node:fs';
+
+/** Chunk size for the streaming line counter. One reused buffer, never a
+ *  string — the whole point is not to materialize the file. */
+const COUNT_CHUNK_BYTES = 64 * 1024;
+
+const NEWLINE = 0x0a;
+
+/**
+ * Raw non-empty line count of a transcript, read in bounded chunks.
+ *
+ * **This is THE single implementation of the re-attach seam's counter.**
+ * `transcript.ts`'s `chatTranscriptSeq` and `bridge.ts`'s
+ * `countTranscriptLines` both delegate here. They used to be two hand-copied
+ * bodies kept in agreement by a comment ("The two MUST count identically...");
+ * the invariant is now structural, which is the only way it stays true. The
+ * bridge's original objection to sharing — that importing the transcript
+ * READER would drag `designRoot`/`chatId` path conventions into a module that
+ * knows only an absolute path — is respected: this module takes a path and
+ * nothing else.
+ *
+ * Semantics are byte-identical to the string form it replaces,
+ * `readFileSync(f, 'utf8').split('\n').filter(Boolean).length`:
+ *   - segments are split on `\n` ONLY, so a lone `\r` (a CRLF file) is a
+ *     non-empty segment and IS counted, exactly as `filter(Boolean)` counts it;
+ *   - a trailing newline does not add a segment;
+ *   - a final line with no trailing newline DOES count.
+ * Splitting on a single byte is also why chunking is safe for UTF-8: 0x0A can
+ * never occur inside a multi-byte sequence, so a chunk boundary can never
+ * split a character in a way that changes the count.
+ *
+ * A missing/unreadable file is `0` — "no transcript yet", the first turn of a
+ * chat — never a throw. Callers treat the seam's seed as best-effort.
+ */
+export function countTranscriptLinesAt(path: string): number {
+  let fd: number;
+  try {
+    fd = openSync(path, 'r');
+  } catch {
+    return 0;
+  }
+  try {
+    const buf = Buffer.allocUnsafe(COUNT_CHUNK_BYTES);
+    let count = 0;
+    let segmentBytes = 0;
+    for (;;) {
+      const read = readSync(fd, buf, 0, COUNT_CHUNK_BYTES, null);
+      if (read <= 0) break;
+      for (let i = 0; i < read; i++) {
+        if (buf[i] === NEWLINE) {
+          if (segmentBytes > 0) count++;
+          segmentBytes = 0;
+        } else {
+          segmentBytes++;
+        }
+      }
+    }
+    // A final line with no trailing newline is still a line.
+    if (segmentBytes > 0) count++;
+    return count;
+  } catch {
+    return 0;
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+      /* already closed / never opened cleanly — nothing to salvage */
+    }
+  }
+}
+
+/** How much of a transcript's HEAD `readChatHead` will look at. The first
+ *  user line is structurally near the top (at most a `role:'bootstrap'` brief
+ *  precedes it), so this is generous by orders of magnitude — it exists to cap
+ *  the pathological case, not to trim the normal one. */
+export const HEAD_SCAN_BYTES = 1024 * 1024;
+
+/** How much of a transcript's TAIL `readTranscriptTail` will hydrate. Bounds
+ *  the one reader that genuinely needs entry CONTENT. Historical transcripts
+ *  bloated by inline blobs (pre-#119) exceed this; the newest ~8 MB is the part
+ *  a user can still meaningfully scroll, and the client's seq-based replay
+ *  (`readChatLinesAfter`) covers anything appended after hydration. */
+export const TAIL_HYDRATE_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Read at most `maxBytes` from the START of a file and return whole lines.
+ *
+ * A truncated trailing line is DROPPED rather than handed back for parsing —
+ * a half-line is not a record, and `JSON.parse` on it would throw on every
+ * call. `complete` reports whether the whole file fit, so a caller can tell
+ * "no user line in this chat" from "no user line in the part I looked at".
+ */
+export function readHeadLines(
+  path: string,
+  maxBytes: number = HEAD_SCAN_BYTES
+): { lines: string[]; complete: boolean } {
+  let fd: number;
+  try {
+    fd = openSync(path, 'r');
+  } catch {
+    return { lines: [], complete: true };
+  }
+  try {
+    // `fstatSync(fd)` — NOT `statSync(path)`. The descriptor is already open,
+    // so sizing from the path re-resolves a name that may no longer be the
+    // file we hold (security review F5). Same reason every read below is
+    // positional on `fd`.
+    const size = fstatSync(fd).size;
+    const want = Math.min(size, maxBytes);
+    const buf = Buffer.allocUnsafe(want);
+    let filled = 0;
+    while (filled < want) {
+      const read = readSync(fd, buf, filled, want - filled, filled);
+      if (read <= 0) break;
+      filled += read;
+    }
+    const complete = filled >= size;
+    let text = buf.subarray(0, filled).toString('utf8');
+    if (!complete) {
+      // Drop the partial tail line — everything after the last newline.
+      const cut = text.lastIndexOf('\n');
+      text = cut === -1 ? '' : text.slice(0, cut);
+    }
+    return { lines: text.split('\n').filter(Boolean), complete };
+  } catch {
+    return { lines: [], complete: true };
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+      /* nothing to salvage */
+    }
+  }
+}
+
+/**
+ * Read at most `maxBytes` from the END of a file and return whole lines.
+ *
+ * The leading partial line is dropped by slicing at the first newline INSIDE
+ * the buffer, before decoding — which is also what makes the tail read
+ * UTF-8-safe: cutting at a 0x0A byte can never land mid-character, whereas
+ * decoding the raw window first could corrupt the boundary character.
+ *
+ * `truncated` tells the caller some older history was skipped.
+ */
+export function readTailLines(
+  path: string,
+  maxBytes: number = TAIL_HYDRATE_BYTES
+): { lines: string[]; truncated: boolean } {
+  let fd: number;
+  try {
+    fd = openSync(path, 'r');
+  } catch {
+    return { lines: [], truncated: false };
+  }
+  try {
+    const size = fstatSync(fd).size;
+    if (size <= maxBytes) {
+      const buf = Buffer.allocUnsafe(size);
+      let filled = 0;
+      while (filled < size) {
+        const read = readSync(fd, buf, filled, size - filled, filled);
+        if (read <= 0) break;
+        filled += read;
+      }
+      return {
+        lines: buf.subarray(0, filled).toString('utf8').split('\n').filter(Boolean),
+        truncated: false,
+      };
+    }
+    const start = size - maxBytes;
+    const buf = Buffer.allocUnsafe(maxBytes);
+    let filled = 0;
+    while (filled < maxBytes) {
+      const read = readSync(fd, buf, filled, maxBytes - filled, start + filled);
+      if (read <= 0) break;
+      filled += read;
+    }
+    const window = buf.subarray(0, filled);
+    const nl = window.indexOf(NEWLINE);
+    // No newline in an 8 MB window means one absurd line; hydrate nothing
+    // rather than hand back a fragment that cannot parse.
+    const whole = nl === -1 ? Buffer.alloc(0) : window.subarray(nl + 1);
+    return { lines: whole.toString('utf8').split('\n').filter(Boolean), truncated: true };
+  } catch {
+    return { lines: [], truncated: false };
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+      /* nothing to salvage */
+    }
+  }
+}
+
+/**
+ * The tail window AND its absolute line offset, resolved from ONE size
+ * snapshot on ONE descriptor.
+ *
+ * WHY THIS EXISTS RATHER THAN CALLING THE TWO READERS IN SEQUENCE (security
+ * review F4). `readChatLinesAfter` used to do `countTranscriptLinesAt(file)`
+ * and then `readTailLines(file)` as separate passes. The bridge appends to
+ * this exact file continuously during a live turn, so lines landing between
+ * the two passes left `total` stale-low while `tail.length` was fresh-high:
+ * `offset = total - tail.length` under-counted (and could go negative) and
+ * every emitted `seq` shifted with it. That is precisely the permanent
+ * re-attach desync — replaying content the client already has, or skipping
+ * content it never got — that the seam exists to prevent, reintroduced by the
+ * fix for #119 rather than by the bug.
+ *
+ * Both passes here are bounded by the same `size`, so anything appended
+ * mid-read is invisible to BOTH and the arithmetic stays self-consistent. The
+ * client picks those newer lines up on its next attach, which is exactly what
+ * the seq marker is for.
+ */
+export function readTailWithSeq(
+  path: string,
+  maxBytes: number = TAIL_HYDRATE_BYTES
+): { lines: string[]; offset: number; total: number } {
+  let fd: number;
+  try {
+    fd = openSync(path, 'r');
+  } catch {
+    return { lines: [], offset: 0, total: 0 };
+  }
+  try {
+    const size = fstatSync(fd).size;
+    const total = countLinesInRange(fd, size);
+    const lines = readTailInRange(fd, size, maxBytes);
+    // `total` counts every non-empty line in [0, size); `lines` counts those
+    // wholly inside the window. The difference is the prefix we skipped —
+    // including the partial line the window dropped, which IS a whole line in
+    // the file and so is correctly counted by `total`.
+    return { lines, offset: Math.max(0, total - lines.length), total };
+  } catch {
+    return { lines: [], offset: 0, total: 0 };
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+      /* nothing to salvage */
+    }
+  }
+}
+
+/** Non-empty line count over `[0, size)` of an already-open descriptor. */
+function countLinesInRange(fd: number, size: number): number {
+  const buf = Buffer.allocUnsafe(COUNT_CHUNK_BYTES);
+  let count = 0;
+  let segmentBytes = 0;
+  let pos = 0;
+  while (pos < size) {
+    const read = readSync(fd, buf, 0, Math.min(COUNT_CHUNK_BYTES, size - pos), pos);
+    if (read <= 0) break;
+    for (let i = 0; i < read; i++) {
+      if (buf[i] === NEWLINE) {
+        if (segmentBytes > 0) count++;
+        segmentBytes = 0;
+      } else {
+        segmentBytes++;
+      }
+    }
+    pos += read;
+  }
+  if (segmentBytes > 0) count++;
+  return count;
+}
+
+/** Whole lines from the last `maxBytes` of `[0, size)` on an open descriptor. */
+function readTailInRange(fd: number, size: number, maxBytes: number): string[] {
+  const want = Math.min(size, maxBytes);
+  const start = size - want;
+  const buf = Buffer.allocUnsafe(want);
+  let filled = 0;
+  while (filled < want) {
+    const read = readSync(fd, buf, filled, want - filled, start + filled);
+    if (read <= 0) break;
+    filled += read;
+  }
+  const window = buf.subarray(0, filled);
+  if (start === 0) return window.toString('utf8').split('\n').filter(Boolean);
+  const nl = window.indexOf(NEWLINE);
+  const whole = nl === -1 ? Buffer.alloc(0) : window.subarray(nl + 1);
+  return whole.toString('utf8').split('\n').filter(Boolean);
+}
+
+// ── Writer-side blob sanitizer ───────────────────────────────────────────────
+
+/**
+ * Inline payloads at or above this size are elided from the persisted line.
+ * Well above any real text chunk (agent message chunks are hundreds of bytes),
+ * well below the megabyte-scale base64 that caused #119.
+ */
+export const INLINE_BLOB_MAX_BYTES = 4096;
+
+/** Keys whose STRING value carries an inline binary payload in the ACP content
+ *  vocabulary. `data` is the base64 field on image/audio content blocks; `uri`
+ *  can carry a `data:` URL of the same magnitude; `blob` is MCP's
+ *  `EmbeddedResource` carrier (security review F2 — the likeliest real-world
+ *  way a megabyte payload would otherwise still reach disk).
+ *
+ *  NOT exhaustive by construction: an array-of-byte-numbers encoding
+ *  (`data: [65, 65, …]`) passes straight through, as does any key we have not
+ *  named. This is a SIZE control, not a security boundary — do not treat it
+ *  as one. */
+const BLOB_KEYS = new Set(['data', 'uri', 'blob']);
+
+/** Marker left in place of an elided payload, so a reader (or a human reading
+ *  the jsonl as the audit record it is) sees that something was dropped and how
+ *  big it was, rather than a silently absent field. */
+export interface ElidedBlob {
+  _maudeElided: 'inline-blob';
+  bytes: number;
+}
+
+function isElidableBlob(key: string, value: unknown): value is string {
+  return BLOB_KEYS.has(key) && typeof value === 'string' && value.length >= INLINE_BLOB_MAX_BYTES;
+}
+
+/**
+ * Structural clone of a transcript entry with inline binary payloads replaced
+ * by a size marker.
+ *
+ * This is a WRITE-path guard, and it is safe precisely because the read path
+ * never wanted these bytes: `readChatMessages` keeps only a tool call's name
+ * and done-flag. Eliding them changes nothing a user can see, and removes
+ * 66–76% of the bytes of a screenshot-heavy transcript.
+ *
+ * Deliberately conservative — it rewrites only `data`/`uri` strings at or over
+ * `INLINE_BLOB_MAX_BYTES`. Prose, tool arguments, diffs and file contents are
+ * untouched: they are the audit record of what steered an auto-approving
+ * agent, and that record is load-bearing (see the note on `stripContextBlock`
+ * in `transcript.ts`).
+ *
+ * A `data:` URI is elided whole rather than kept as a truncated prefix — half a
+ * base64 payload is not more useful than none, and a truncated `data:` URI that
+ * still LOOKS like a URI is worse than an honest marker.
+ */
+export function stripInlineBlobs<T>(value: T): T {
+  return clone(value) as T;
+}
+
+function clone(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(clone);
+  if (value === null || typeof value !== 'object') return value;
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    const next = isElidableBlob(k, v)
+      ? ({ _maudeElided: 'inline-blob', bytes: v.length } satisfies ElidedBlob)
+      : clone(v);
+    if (k === '__proto__') {
+      // `JSON.parse` makes `__proto__` an OWN property, but plain assignment
+      // hits the `Object.prototype.__proto__` setter and swaps the clone's
+      // prototype instead of storing a key — so the field vanishes from the
+      // serialized line (security review F6). It cannot pollute
+      // `Object.prototype` here, but silently dropping a key WOULD dent the
+      // audit record this sanitizer otherwise takes care to preserve.
+      Object.defineProperty(out, k, {
+        value: next,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      });
+      continue;
+    }
+    out[k] = next;
+  }
+  return out;
+}