@ai-setting/roy-agent-core 1.7.53 → 1.7.55

package/dist/env/workflow/types/run.d.ts

@@ -186,6 +186,25 @@ export interface NodeExecutionContext {
     askUser(query: string): never;
     /** Patch agent sub-session id onto latest workflow.node.start (agent nodes) */
     attachAgentSessionToLastStart?(nodeId: string, agentSessionId: string): Promise<void>;
+    /**
+     * Register (or refresh) an agent sub-session entry in the parent workflow
+     * session's `metadata.agentSessions` (Task #4412 C1).
+     *
+     * AgentNode must use this instead of doing its own
+     * `get → push → update` on the parent metadata. That read-modify-write is
+     * unsafe once dispatch is concurrent: N sibling agent nodes all read the
+     * same parent snapshot and each writes back its own array-with-one-extra
+     * entry, so the last writer wins and every sibling's marker is silently
+     * dropped (measured: 4 concurrent agents → only 2 markers survive).
+     *
+     * The engine implements this by routing the mutation through the same
+     * per-session serialization queue it uses for its own metadata writes, so
+     * the whole class of lost updates is closed by construction.
+     *
+     * Optional for backward compatibility with hand-built contexts in tests;
+     * AgentNode falls back to the legacy inline RMW when it is absent.
+     */
+    registerAgentSubSession?(nodeId: string, agentSessionId: string): Promise<void>;
     /**
      * Abort signal for this node's execution (Task #1976).
      *

package/dist/env/workflow/utils/agent-session-metadata.d.ts

@@ -9,6 +9,19 @@ export declare function updateAgentSessionStatus(agentSessions: AgentSessionRef[
  * Convenience wrapper over updateAgentSessionStatus for symmetry with Failed/Stopped.
  */
 export declare function markAgentSessionCompleted(agentSessions: AgentSessionRef[] | undefined, nodeId: string): AgentSessionRef[];
+/**
+ * Register (or refresh) a node's agent sub-session reference.
+ *
+ * Replaces an existing entry for the same `nodeId` (refresh + reset to
+ * 'active') or appends a new one. Returns a new array; does not mutate input.
+ *
+ * Task #4412 C1: this used to be inline in `AgentNode.createAgentSubSession()`
+ * operating directly on the metadata it had just read, which loses entries when
+ * sibling agent nodes register concurrently. Extracted here so the engine can
+ * run it *inside* its serialized metadata queue (where the array it receives is
+ * guaranteed to be the current one).
+ */
+export declare function upsertAgentSession(agentSessions: AgentSessionRef[] | undefined, nodeId: string, agentSessionId: string): AgentSessionRef[];
 /**
  * Mark a single node's agent session as 'failed'.
  */

package/dist/env/workflow/utils/index.js

@@ -14,7 +14,7 @@ import {
   hasClosedOutputContract,
   validateTemplateContracts,
   validateWorkflowDefinition
-} from "../../../shared/@ai-setting/roy-agent-core-na73mym1.js";
+} from "../../../shared/@ai-setting/roy-agent-core-a4vzsn0g.js";
 import {
   TemplateResolver,
   init_template_resolver,

package/dist/env/workflow/utils/redact-command-secrets.d.ts

@@ -0,0 +1,70 @@
+/**
+ * @fileoverview redact-command-secrets.ts — Mask inline secrets in shell commands
+ * before they are embedded in a user/agent-visible error message (Task #4392 P0-2).
+ *
+ * Background: #4385 §5.5 diff-1 asks for `Tool exited with code N` to be enriched
+ * with the command that was run. That command may legitimately contain inline
+ * credentials (`twine upload --password=...`, `curl -H "Authorization: Bearer ..."`,
+ * `PIP_INDEX_TOKEN=... npm publish`), which must NOT leak into:
+ *   - `workflow.node.end` session messages,
+ *   - trace span attributes,
+ *   - the LLM context of the next turn.
+ *
+ * This helper is a *best-effort* shell-string masker (complementary to
+ * `sensitive-redact.ts`, which only redacts object **field names**). It never
+ * tries to parse shell; it matches the common credential shapes:
+ *
+ *   1. `KEY=value` / `KEY: value` / `--flag value` / `--flag=value`
+ *      where KEY looks sensitive (`ASSIGNMENT_RE`, `FLAG_RE`).
+ *   2. `<Scheme> <credential>` auth headers — `Authorization: Bearer <token>`,
+ *      `Basic <base64>`, `Token <value>`, `Digest <value>` (`AUTH_SCHEME_RE`).
+ *      The value is a *separate* word from the scheme, hence its own rule.
+ *   3. URL query credentials — `?token=`, `&api_key=`, `&secret=`, `&sig=`
+ *      (`URL_QUERY_RE`).
+ *   4. URL userinfo credentials — `https://user:pass@host` (`URL_USERINFO_RE`).
+ *   5. Short-option credentials — `curl -u user:pass`, `docker login -p <pw>`,
+ *      `mysql -pVALUE` (`SHORT_CRED_RE`).
+ *
+ * ## Why rules 2–5 exist (Task #4419, from #4417 §B-1)
+ *
+ * The original implementation only had rules 1, and its bare-value branch stops
+ * at the first whitespace. `Authorization: Bearer <token>` is *two* words, so it
+ * masked `Bearer` and left the token intact. #4417 measured 9 of 14 real command
+ * shapes still leaking. Rules 2–5 close those holes.
+ *
+ * ## Ordering / idempotency
+ *
+ * The rules are applied in a fixed order and each rule already skips values that
+ * equal the `[REDACTED]` sentinel, so `redact(redact(x)) === redact(x)` holds.
+ * Rule 2 is applied **before** rule 1: rule 1 would otherwise see
+ * `Authorization: Bearer` and mask only the scheme word, leaving an
+ * `Authorization: [REDACTED] <token>` remainder that rule 2 can no longer anchor.
+ *
+ * ## Non-goals
+ *
+ * - No shell parsing / word-splitting (quoting, `$VAR` expansion, heredocs).
+ * - Environment-variable *references* (`$TOKEN`, `${TOKEN}`) are left alone —
+ *   the variable name is not itself a secret, and masking it destroys the
+ *   diagnostic value of the message.
+ */
+/**
+ * Mask inline secrets inside a single shell command string.
+ *
+ * Idempotent: masked values (`[REDACTED]`) are left as-is.
+ *
+ * @param command - The raw command string (may be multi-line).
+ * @returns The command with sensitive values replaced by `[REDACTED]`.
+ */
+export declare function redactCommandSecrets(command: string): string;
+/**
+ * Collapse a multi-line command into a single readable line and truncate it.
+ *
+ * Rationale: error messages are rendered as one line in `workflow.node.end`
+ * messages and in most logs; embedding raw newlines makes them unreadable and
+ * breaks naive `grep`-based diagnosis.
+ *
+ * @param command - Raw command (possibly multi-line, possibly huge).
+ * @param maxLen - Maximum length of the returned string (default 120).
+ * @returns Single-line, whitespace-normalized, truncated command.
+ */
+export declare function summarizeCommand(command: string, maxLen?: number): string;

package/dist/env/workflow/utils/shell-dialect-lint.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @fileoverview Shell dialect lint for workflow `tool` node commands
+ * (Task #4392 P0-3; root cause proven in Task #4385 §3.2.1).
+ *
+ * ## Why this exists
+ *
+ * The built-in `bash` tool spawns its command with Node's
+ * `child_process.spawn(command, [], { shell: true })`
+ * (see `env/tool/built-in/bash-effect.ts`). On POSIX, `shell: true` resolves to
+ * **`/bin/sh`**, which on Debian/Ubuntu is a symlink to **dash** — *not* bash.
+ *
+ * Every bash-only construct therefore fails inside a workflow tool node. Worse,
+ * half of them fail **silently**:
+ *
+ * | construct            | dash behaviour                | exit | loud? |
+ * | -------------------- | ----------------------------- | ---- | ----- |
+ * | `set -o pipefail`    | `Illegal option -o pipefail`  | 2    | ✅    |
+ * | `${PIPESTATUS[0]}`   | `Bad substitution`            | 2    | ✅    |
+ * | `${V//a/b}`          | `Bad substitution`            | 2    | ✅    |
+ * | `${BASH_SOURCE[0]}`  | `Bad substitution`            | 2    | ✅    |
+ * | `A=(1 2 3)`          | `Syntax error: "(" unexpected`| 2    | ✅    |
+ * | `function f() {}`    | `Syntax error: "(" unexpected`| 2    | ✅    |
+ * | `[[ ... ]]`          | `[[: not found`               | 127  | ✅    |
+ * | `source <file>`      | `source: not found`           | 0    | ❌    |
+ * | `echo -e "a\tb"`     | prints a literal `-e`         | 0    | ❌    |
+ * | `$RANDOM`            | empty string                  | 0    | ❌    |
+ *
+ * Task #4385 measured **63** `/bin/sh:` signature hits across 45 sessions, and
+ * these account for 27 of the workflow-creator's `exit 2` failures.
+ *
+ * ## Severity policy
+ *
+ * These findings are **warnings, never errors**. The 76 workflows already in
+ * `workflows.db` must keep validating cleanly, and a `dash`-safe workflow can
+ * legitimately contain the *string* `pipefail` inside an embedded heredoc that
+ * is executed by `bash -c` on purpose. Blocking on a heuristic regex would be
+ * wrong; surfacing it loudly for the author to judge is right.
+ *
+ * ## What is deliberately NOT flagged
+ *
+ * - `. <file>` (POSIX dot-command) — the correct replacement for `source`.
+ * - `$?`, `$0`, `$1`… — POSIX.
+ * - `[ ... ]` — POSIX test.
+ * - `sed 's/a/b/'` — no `${...}` involved.
+ * - Text inside shell **comments** (`# ...`) — cannot fail at runtime.
+ */
+/** A single detected bash-ism. */
+export interface ShellDialectFinding {
+    /** Stable rule name, e.g. `pipefail`. Used in machine-readable output. */
+    name: string;
+    /** Actionable replacement hint written for an LLM/tool author to act on. */
+    fix: string;
+    /** Short excerpt of the offending command (surrounding context). */
+    excerpt: string;
+}
+/**
+ * Detect bash-only constructs in a shell command intended for the `bash` tool.
+ *
+ * @param command - The raw command string (from `config.command`).
+ * @returns One finding per *distinct* rule that matched. Repeated occurrences of
+ *          the same rule are collapsed (a 50-line script using `$RANDOM` ten
+ *          times should produce one warning, not ten).
+ */
+export declare function lintShellDialect(command: string): ShellDialectFinding[];
+/**
+ * Render findings as one actionable line each, prefixed with the node id.
+ *
+ * Format is deliberately stable so it can be asserted in tests and grepped in
+ * logs:
+ *   `[shell-dialect] node "build-x" uses bash-only "pipefail": <fix> | near: <excerpt>`
+ *
+ * @param nodeId - The workflow node id that owns the command.
+ * @param findings - Output of `lintShellDialect`.
+ */
+export declare function formatShellDialectFindings(nodeId: string, findings: ShellDialectFinding[]): string[];

package/dist/env/workflow/utils/validate-workflow-definition.d.ts

@@ -13,6 +13,14 @@
  *     read `.result` off a **tool** node (which has no such field) and the
  *     engine silently substituted an empty string.
  *
+ *   Layer 3 — **Shell dialect lint** (Task #4392 P0-3, see
+ *     `shell-dialect-lint.ts`): the `bash` tool spawns with `shell: true`,
+ *     i.e. `/bin/sh` = dash. bash-only constructs (`set -o pipefail`,
+ *     `${PIPESTATUS[0]}`, `[[ ]]`, `source`, arrays, `$RANDOM`, `echo -e`, ...)
+ *     either fail loudly or -- worse -- silently no-op. Reported as **warning**
+ *     only: existing registered workflows must not be invalidated by a
+ *     heuristic regex.
+ *
  * Wraps everything in a defensive try/catch so callers (workflow_add tool,
  * `workflow add` CLI, workflow_validate tool, TaskTagPlugin.extractWorkflow)
  * always get a consistent `{ valid, errors, warnings, infos }` shape — even
@@ -46,6 +54,14 @@ export interface ValidateWorkflowOptions {
      * incrementally).
      */
     skipTemplateContracts?: boolean;
+    /**
+     * Skip the Layer-3 shell-dialect lint. Defaults to `false`.
+     *
+     * Layer 3 emits **warnings only**, so there is rarely a reason to disable it;
+     * this switch exists for corpus/regression tests that pin the exact warning
+     * set of already-registered workflows.
+     */
+    lintShellDialect?: boolean;
 }
 /**
  * Validate a workflow definition (structure + template contracts).
@@ -55,3 +71,9 @@ export interface ValidateWorkflowOptions {
  * @returns `{ valid, errors, warnings, infos, findings }` — never throws.
  */
 export declare function validateWorkflowDefinition(definition: unknown, options?: ValidateWorkflowOptions): ValidateWorkflowResult;
+/**
+ * Walk every `tool` node of a definition and lint its shell command(s).
+ *
+ * @returns Formatted, actionable warning lines (empty when clean).
+ */
+export declare function collectShellDialectWarnings(definition: unknown): string[];

package/dist/index.js

@@ -21,7 +21,7 @@ import {
 import {
   PromptComponent,
   PromptStore
-} from "./shared/@ai-setting/roy-agent-core-stnddvx9.js";
+} from "./shared/@ai-setting/roy-agent-core-12d2xap8.js";
 import {
   LLMComponent,
   LLMConfigSchema,
@@ -29,7 +29,7 @@ import {
   ModelLimitsSchema,
   ProviderCapabilitiesSchema,
   ProviderConfigSchema
-} from "./shared/@ai-setting/roy-agent-core-p8ak03s0.js";
+} from "./shared/@ai-setting/roy-agent-core-w527pcpe.js";
 import"./shared/@ai-setting/roy-agent-core-adg9ghbt.js";
 import {
   ATTACH_FILE_MAX_BYTES,
@@ -66,10 +66,10 @@ import {
   BaseEnvironment,
   generateDescendingId,
   generateId
-} from "./shared/@ai-setting/roy-agent-core-4sx6sdb2.js";
+} from "./shared/@ai-setting/roy-agent-core-cd62e9p1.js";
 import {
   TaskComponent
-} from "./shared/@ai-setting/roy-agent-core-39xejr39.js";
+} from "./shared/@ai-setting/roy-agent-core-e2z1etk4.js";
 import"./shared/@ai-setting/roy-agent-core-amkqnyzy.js";
 import {
   SQLiteTaskStore,
@@ -78,7 +78,7 @@ import {
 import"./shared/@ai-setting/roy-agent-core-7g03zkkb.js";
 import"./shared/@ai-setting/roy-agent-core-rn57psp0.js";
 import"./shared/@ai-setting/roy-agent-core-8gxth0eh.js";
-import"./shared/@ai-setting/roy-agent-core-p2r27era.js";
+import"./shared/@ai-setting/roy-agent-core-mxdc756a.js";
 import"./shared/@ai-setting/roy-agent-core-tbrn9wdm.js";
 import {
   BountyIMInstance,
@@ -92,7 +92,7 @@ import {
   larkCliHandler,
   resolveBountyIMSystemPrompt,
   timerHandler
-} from "./shared/@ai-setting/roy-agent-core-ph5qbqcx.js";
+} from "./shared/@ai-setting/roy-agent-core-j2nvedt6.js";
 import {
   BUILT_IN_EVENT_SOURCE_TYPES,
   BUILT_IN_EVENT_SOURCE_TYPE_LIST,
@@ -109,7 +109,7 @@ import {
 import {
   TaskTagPlugin,
   createAutoTaskPlugin
-} from "./shared/@ai-setting/roy-agent-core-hch2geta.js";
+} from "./shared/@ai-setting/roy-agent-core-g36jevrk.js";
 import {
   EventStoreImpl,
   getSharedEventStore,
@@ -122,12 +122,12 @@ import {
 import {
   getBuiltInPrompt,
   getBuiltInPromptNames
-} from "./shared/@ai-setting/roy-agent-core-gdsqp6j8.js";
-import"./shared/@ai-setting/roy-agent-core-brwzs8wf.js";
-import"./shared/@ai-setting/roy-agent-core-j8e92gj8.js";
+} from "./shared/@ai-setting/roy-agent-core-6masakz4.js";
+import"./shared/@ai-setting/roy-agent-core-9h72sk1n.js";
+import"./shared/@ai-setting/roy-agent-core-b5ew8t0k.js";
 import {
   WorkflowComponent
-} from "./shared/@ai-setting/roy-agent-core-4vpk40ss.js";
+} from "./shared/@ai-setting/roy-agent-core-8eqngasy.js";
 import {
   init_node_registry_helper,
   registerDecoratorNodeType
@@ -140,25 +140,25 @@ import {
   createWorkflowFromClass
 } from "./shared/@ai-setting/roy-agent-core-h0x19xgn.js";
 import"./shared/@ai-setting/roy-agent-core-1ce3fqrk.js";
-import"./shared/@ai-setting/roy-agent-core-vvxb9522.js";
+import"./shared/@ai-setting/roy-agent-core-6qxh4xrm.js";
 import {
   SessionComponent
-} from "./shared/@ai-setting/roy-agent-core-yd21n6c7.js";
+} from "./shared/@ai-setting/roy-agent-core-zvemdfx5.js";
 import {
   MemorySessionStore
-} from "./shared/@ai-setting/roy-agent-core-h93v6p6y.js";
+} from "./shared/@ai-setting/roy-agent-core-7qy3nffr.js";
 import"./shared/@ai-setting/roy-agent-core-hhrg314p.js";
 import"./shared/@ai-setting/roy-agent-core-7evvpfwc.js";
-import"./shared/@ai-setting/roy-agent-core-35s1w7tc.js";
+import"./shared/@ai-setting/roy-agent-core-aer5kw1j.js";
 import"./shared/@ai-setting/roy-agent-core-6atd905e.js";
 import"./shared/@ai-setting/roy-agent-core-6167phd4.js";
-import"./shared/@ai-setting/roy-agent-core-x8n1r7h4.js";
+import"./shared/@ai-setting/roy-agent-core-2bscfrr1.js";
 import"./shared/@ai-setting/roy-agent-core-1db4vpc6.js";
 import"./shared/@ai-setting/roy-agent-core-ze068vc9.js";
 import"./shared/@ai-setting/roy-agent-core-fs36xgcs.js";
 import"./shared/@ai-setting/roy-agent-core-9csa89jx.js";
 import"./shared/@ai-setting/roy-agent-core-7exqwax1.js";
-import"./shared/@ai-setting/roy-agent-core-na73mym1.js";
+import"./shared/@ai-setting/roy-agent-core-a4vzsn0g.js";
 import"./shared/@ai-setting/roy-agent-core-tjg71zqp.js";
 import"./shared/@ai-setting/roy-agent-core-ddwa0n6h.js";
 import"./shared/@ai-setting/roy-agent-core-8s9jd2qy.js";
@@ -170,7 +170,7 @@ import {
 import {
   AgentComponent,
   AgentComponentConfigSchema
-} from "./shared/@ai-setting/roy-agent-core-3tv1q6f2.js";
+} from "./shared/@ai-setting/roy-agent-core-ytr2w0vb.js";
 import {
   ToolComponent,
   ToolRegistry,
@@ -186,7 +186,7 @@ import {
   getXDGPaths
 } from "./shared/@ai-setting/roy-agent-core-qxnbvgwe.js";
 import"./shared/@ai-setting/roy-agent-core-dv714bqh.js";
-import"./shared/@ai-setting/roy-agent-core-pk1b3kvf.js";
+import"./shared/@ai-setting/roy-agent-core-2b8jtv7m.js";
 import {
   buildOpencodeHeaders,
   createInvokeConfig,
@@ -195,7 +195,7 @@ import {
   isOpencodeEndpoint,
   isOpencodeProvider,
   parseModelString
-} from "./shared/@ai-setting/roy-agent-core-zy3hqfwg.js";
+} from "./shared/@ai-setting/roy-agent-core-0hq21px2.js";
 import"./shared/@ai-setting/roy-agent-core-c1v263jn.js";
 import {
   AskUserError,

package/dist/shared/@ai-setting/{roy-agent-core-stnddvx9.js → roy-agent-core-12d2xap8.js}

@@ -1,6 +1,6 @@
 import {
   builtInPrompts
-} from "./roy-agent-core-gdsqp6j8.js";
+} from "./roy-agent-core-6masakz4.js";
 import {
   getXDGPath
 } from "./roy-agent-core-qxnbvgwe.js";

package/dist/shared/@ai-setting/{roy-agent-core-pk1b3kvf.js → roy-agent-core-2b8jtv7m.js}

@@ -1,6 +1,6 @@
 import {
   safeParseToolArgs
-} from "./roy-agent-core-zy3hqfwg.js";
+} from "./roy-agent-core-0hq21px2.js";
 
 // src/env/session/session-message-converter.ts
 import { randomUUID } from "crypto";

package/dist/shared/@ai-setting/{roy-agent-core-x8n1r7h4.js → roy-agent-core-2bscfrr1.js}

@@ -7,6 +7,157 @@ import {
   __legacyDecorateClassTS
 } from "./roy-agent-core-fs0mn2jk.js";
 
+// src/env/workflow/utils/redact-command-secrets.ts
+function replaceTrailing(match, raw) {
+  if (raw.length === 0)
+    return match;
+  const idx = match.lastIndexOf(raw);
+  if (idx < 0)
+    return match;
+  return match.slice(0, idx) + MASK;
+}
+function looksLikeCredentialCommand(command) {
+  return PASSWORD_FLAG_TOOL_RE.test(command);
+}
+function looksLikeShortATool(command) {
+  return SHORT_A_TOOL_RE.test(command);
+}
+function looksLikePasswordValue(value) {
+  if (value.length === 0)
+    return false;
+  if (PATH_LIKE_RE.test(value))
+    return false;
+  if (NUMERIC_RE.test(value))
+    return false;
+  return true;
+}
+function redactCommandSecrets(command) {
+  if (!command)
+    return command;
+  let out = command;
+  out = out.replace(AUTH_SCHEME_RE, (match, prefix, scheme, value) => isMasked(value) ? match : `${prefix}${scheme} ${MASK}`);
+  out = out.replace(URL_USERINFO_RE, (match, head, value, at) => isMasked(value) ? match : `${head}${MASK}${at}`);
+  out = out.replace(URL_QUERY_RE, (match, amp, name, eq, value) => {
+    if (!SENSITIVE_QUERY_KEY_RE.test(name))
+      return match;
+    if (isMasked(value))
+      return match;
+    return `${amp}${name}${eq}${MASK}`;
+  });
+  out = out.replace(SHORT_U_RE, (match, lead, flag, user, pass) => {
+    if (isMasked(pass))
+      return match;
+    const name = user.slice(0, -1);
+    if (UID_GID_RE.test(name) && UID_GID_RE.test(pass))
+      return match;
+    if (name === pass)
+      return match;
+    return `${lead}${flag}${user}${MASK}`;
+  });
+  out = out.replace(LONG_USER_RE, (match, lead, flag, user, pass) => {
+    if (isMasked(pass))
+      return match;
+    const name = user.slice(0, -1);
+    if (UID_GID_RE.test(name) && UID_GID_RE.test(pass))
+      return match;
+    if (name === pass)
+      return match;
+    return `${lead}${flag}${user}${MASK}`;
+  });
+  if (looksLikeCredentialCommand(command)) {
+    const maskPassword = (match, lead, flag, dq, sq, bare) => {
+      const value = dq ?? sq ?? bare ?? "";
+      if (isMasked(value) || !looksLikePasswordValue(value))
+        return match;
+      if (dq !== undefined)
+        return `${lead}${flag}"${MASK}"`;
+      if (sq !== undefined)
+        return `${lead}${flag}'${MASK}'`;
+      return lead + flag + MASK;
+    };
+    out = out.replace(SHORT_P_SPACED_RE, maskPassword);
+    out = out.replace(SHORT_P_ATTACHED_RE, maskPassword);
+  }
+  out = out.replace(AUTH_FAILURE_CRED_RE, (match, head, user, pass) => isMasked(pass) ? match : `${head}${user}:${MASK}`);
+  out = out.replace(AWS_SET_SECRET_RE, (match, key, value) => isMasked(value) ? match : `${key} ${MASK}`);
+  if (looksLikeShortATool(command)) {
+    out = out.replace(SHORT_A_SECRET_RE, (match, lead, flag, value) => isMasked(value) || !looksLikePasswordValue(value) ? match : `${lead}${flag}${MASK}`);
+    out = out.replace(SHORT_A_ATTACHED_RE, (match, lead, flag, value) => isMasked(value) || !looksLikePasswordValue(value) ? match : `${lead}${flag}${MASK}`);
+  }
+  out = out.replace(ASSIGNMENT_RE, (match, key, dq, sq, bare) => {
+    if (!SENSITIVE_KEY_RE.test(key))
+      return match;
+    const value = dq ?? sq ?? bare ?? "";
+    if (value === MASK)
+      return match;
+    const isAuthHeaderKey = /^(?:proxy-)?authorization$/i.test(key);
+    if (isAuthHeaderKey && AUTH_SCHEME_WORD_RE.test(value))
+      return match;
+    const raw = dq !== undefined ? `"${value}"` : sq !== undefined ? `'${value}'` : value;
+    return replaceTrailing(match, raw);
+  });
+  out = out.replace(FLAG_RE, (match, lead, flag, _sep, dq, sq, bare) => {
+    if (!SENSITIVE_KEY_RE.test(flag))
+      return match;
+    const value = dq ?? sq ?? bare ?? "";
+    if (value === MASK)
+      return match;
+    const raw = dq !== undefined ? `"${value}"` : sq !== undefined ? `'${value}'` : value;
+    return replaceTrailing(match, raw);
+  });
+  return out;
+}
+function summarizeCommand(command, maxLen = 120) {
+  if (!command)
+    return "";
+  const collapsed = command.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= maxLen)
+    return collapsed;
+  return `${collapsed.slice(0, maxLen)}…`;
+}
+var MASK = "[REDACTED]", SENSITIVE_KEY_RE, BARE_VALUE = `[^\\s;&|]+[^\\s;&|"'<>()]|[^\\s;&|]`, ASSIGNMENT_RE, FLAG_RE, AUTH_SCHEME_RE, SENSITIVE_QUERY_KEY_RE, URL_QUERY_RE, URL_USERINFO_RE, AUTH_FAILURE_CRED_RE, SHORT_U_RE, LONG_USER_RE, UID_GID_RE, SHORT_P_SPACED_RE, SHORT_P_ATTACHED_RE, isMasked = (value) => (value ?? "").trim() === MASK, AUTH_SCHEME_WORD_RE, PASSWORD_FLAG_TOOL_RE, SHORT_A_TOOL_RE, SHORT_A_SECRET_RE, SHORT_A_ATTACHED_RE, AWS_SET_SECRET_RE, PATH_LIKE_RE, NUMERIC_RE;
+var init_redact_command_secrets = __esm(() => {
+  SENSITIVE_KEY_RE = /(?:pass(?:word|wd|phrase)?|token|secret|api[_-]?key|apikey|credential|authorization|private[_-]?key)/i;
+  ASSIGNMENT_RE = new RegExp(`(?<![A-Za-z0-9_.-])([A-Za-z0-9_][A-Za-z0-9_.-]*)\\s*[=:]\\s*(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  FLAG_RE = new RegExp(`(^|[\\s])(--?[A-Za-z0-9][A-Za-z0-9_.-]*)(=\\s*|\\s+)(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  AUTH_SCHEME_RE = new RegExp(`((?:Proxy-)?Authorization["']?\\s*[:=]\\s*["']?\\s*)(Bearer|Basic|Token|Digest)\\s+(${BARE_VALUE}|\\[REDACTED\\])`, "gi");
+  SENSITIVE_QUERY_KEY_RE = new RegExp([
+    "^pass(?:word|wd)?$",
+    "^pwd$",
+    "^token$",
+    "^access[_-]?token$",
+    "^refresh[_-]?token$",
+    "^id[_-]?token$",
+    "^secret$",
+    "^client[_-]?secret$",
+    "^api[_-]?key$",
+    "^apikey$",
+    "^credential$",
+    "^credentials$",
+    "^sig$",
+    "^signature$",
+    "^auth$",
+    "^authorization$",
+    "^private[_-]?key$"
+  ].join("|"), "i");
+  URL_QUERY_RE = /([?&])([A-Za-z_][A-Za-z0-9_.-]*)(=)([^&#\s"']+)/g;
+  URL_USERINFO_RE = /(\/\/[^/\s:@]+:)([^/\s"']+)(@)/g;
+  AUTH_FAILURE_CRED_RE = /(\b(?:auth(?:entication|orization)?|login|credentials?|password|passwd|token)\b[^\n:]{0,40}?[\s"'])([A-Za-z0-9_.-]{1,64}):([^\s;&|"'<>]{3,})/gi;
+  SHORT_U_RE = /(^|\s)(-u\s+)([^:\s]+:)([^\s;&|"']+)/g;
+  LONG_USER_RE = /(^|\s)(--user(?:=|\s+))([^:\s]+:)([^\s;&|"']+)/g;
+  UID_GID_RE = /^\d+$/;
+  SHORT_P_SPACED_RE = new RegExp(`(^|\\s)(-p\\s+)(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  SHORT_P_ATTACHED_RE = new RegExp(`(^|\\s)(-p)(?:"([^"]*)"|'([^']*)'|(${BARE_VALUE}))`, "g");
+  AUTH_SCHEME_WORD_RE = /^(?:bearer|basic|token|digest|negotiate|ntlm)$/i;
+  PASSWORD_FLAG_TOOL_RE = /(?<![\w/.-])(?:docker\s+login|helm\s+(?:registry\s+)?login|mysql|mysqldump|mariadb|sshpass)\b/i;
+  SHORT_A_TOOL_RE = /(?<![\w/.-])redis-cli\b/i;
+  SHORT_A_SECRET_RE = new RegExp(`(^|\\s)(-a\\s+)(?!-)(${BARE_VALUE})`, "g");
+  SHORT_A_ATTACHED_RE = new RegExp(`(^|\\s)(-a)(${BARE_VALUE})`, "g");
+  AWS_SET_SECRET_RE = new RegExp(`\\b((?:aws[_-])?(?:secret[_-]?access[_-]?key|session[_-]?token))\\s+(?!set\\b)([^=\\s;&|][^\\s;&|]*[^\\s;&|"'<>()]|[^=\\s;&|])`, "gi");
+  PATH_LIKE_RE = /^(?:\/|\.\/|\.\.\/|~\/)/;
+  NUMERIC_RE = /^\d+$/;
+});
+
 // src/env/workflow/nodes/tool-node.ts
 function isPositiveNumber(v) {
   return typeof v === "number" && Number.isFinite(v) && v > 0;
@@ -23,9 +174,39 @@ function getToolTimeoutMs(input, config) {
   }
   return DEFAULT_TOOL_TIMEOUT_MS;
 }
-var DEFAULT_TOOL_TIMEOUT_MS = 60000, ToolNode;
+function redactTail(text, tailChars) {
+  const window = text.length > tailChars + REDACT_TAIL_SLACK ? text.slice(-(tailChars + REDACT_TAIL_SLACK)) : text;
+  return redactCommandSecrets(window).trim().slice(-tailChars).trim();
+}
+function redactErrorForOutput(err) {
+  const message = redactCommandSecrets(err.message);
+  const stack = typeof err.stack === "string" ? redactCommandSecrets(err.stack) : undefined;
+  if (message === err.message && stack === err.stack)
+    return err;
+  const clone = new Error(message, { cause: err });
+  clone.name = err.name;
+  if (stack)
+    clone.stack = stack;
+  return clone;
+}
+function buildExitCodeError(exitCode, md, toolInput) {
+  const parts = [`Tool exited with code ${exitCode}`];
+  const rawCommand = toolInput && typeof toolInput === "object" ? toolInput.command ?? toolInput.cmd : undefined;
+  if (typeof rawCommand === "string" && rawCommand.trim().length > 0) {
+    const safe = summarizeCommand(redactCommandSecrets(rawCommand));
+    if (safe.length > 0) {
+      parts.push(`command: ${safe}`);
+    }
+  }
+  const stdout = typeof md.stdout === "string" ? md.stdout : "";
+  const stdoutTail = redactTail(stdout, 300);
+  parts.push(stdoutTail.length > 0 ? `stdout tail: ${stdoutTail}` : "(no stdout)");
+  return parts.join(" | ");
+}
+var DEFAULT_TOOL_TIMEOUT_MS = 60000, REDACT_TAIL_SLACK = 4096, ToolNode;
 var init_tool_node = __esm(() => {
   init_decorator();
+  init_redact_command_secrets();
   ToolNode = class ToolNode {
     definition;
     toolRegistry;
@@ -125,7 +306,7 @@ var init_tool_node = __esm(() => {
           }
         }
         const extractedOutput = this.extractFromWrapper(output);
-        const wrapperError = this.extractErrorFromWrapper(output);
+        const wrapperError = this.extractErrorFromWrapper(output, input);
         return {
           output: extractedOutput,
           error: wrapperError,
@@ -134,7 +315,7 @@ var init_tool_node = __esm(() => {
       } catch (error) {
         return {
           output: undefined,
-          error: error instanceof Error ? error : new Error(String(error)),
+          error: error instanceof Error ? redactErrorForOutput(error) : new Error(redactCommandSecrets(String(error))),
           durationMs: Date.now() - startTime
         };
       }
@@ -159,7 +340,7 @@ var init_tool_node = __esm(() => {
       }
       return result;
     }
-    extractErrorFromWrapper(value) {
+    extractErrorFromWrapper(value, toolInput) {
       if (value === null || value === undefined) {
         return;
       }
@@ -172,10 +353,10 @@ var init_tool_node = __esm(() => {
       }
       const err = obj.error;
       if (typeof err === "string" && err.length > 0) {
-        return err;
+        return redactCommandSecrets(err);
       }
       if (err instanceof Error) {
-        return err;
+        return redactErrorForOutput(err);
       }
       const md = obj.metadata;
       if (md) {
@@ -185,7 +366,7 @@ var init_tool_node = __esm(() => {
         }
         if (typeof md.exit_code === "number" && md.exit_code !== 0) {
           const stderr = typeof md.stderr === "string" ? md.stderr : "";
-          return stderr.length > 0 ? stderr : `Tool exited with code ${md.exit_code}`;
+          return stderr.length > 0 ? redactCommandSecrets(stderr) : buildExitCodeError(md.exit_code, md, toolInput);
         }
       }
       return `Tool execution failed (success=false, no error message)`;