@aiwg/cli 2026.10.8 → 2026.10.9

package/dist/src/artifacts/cli.js

@@ -24,9 +24,9 @@ import { resolveIndexWorkers } from './index-preparation.js';
 import { SUPPORTED_VIEWS } from './corpus-views/renderers.js';
 import { parseResourceSelector, readVerifiedRegularFile, } from '../resources/web-release.js';
 import { findPackageRoot } from '../cli/find-package-root.js';
-import { createResourceCredentialProvider } from '../auth/resource-credentials.js';
+import { createResourceCredentialProvider, prepareResourceCredentials } from '../auth/resource-credentials.js';
 const MAX_RESOURCE_TRUST_ROOT_BYTES = 64 * 1024;
-function webReleaseOptionsFromEnvironment() {
+function webReleaseOptionsFromEnvironment(credentialProvider = createResourceCredentialProvider(process.env)) {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
     const cacheRoot = process.env.AIWG_RESOURCE_CACHE_ROOT;
     const trustRootFile = process.env.AIWG_RESOURCE_TRUST_ROOT_FILE;
@@ -44,7 +44,7 @@ function webReleaseOptionsFromEnvironment() {
         }
     }
     return {
-        credentialProvider: createResourceCredentialProvider(process.env),
+        credentialProvider,
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),
@@ -1465,6 +1465,8 @@ const DISCOVER_VALUE_FLAGS = new Set([
  * @implements #1214
  */
 async function handleDiscover(args) {
+    const credentials = await prepareResourceCredentials(args);
+    args = credentials.args;
     const { discoverCapability } = await import('./query-engine.js');
     const cwd = process.cwd();
     // Parse the positional phrase. Flags may appear before or after it — the
@@ -1526,7 +1528,7 @@ async function handleDiscover(args) {
     const offline = flags.includes('--offline');
     const webReleaseOptions = resourceSource === 'local'
         ? undefined
-        : webReleaseOptionsFromEnvironment();
+        : webReleaseOptionsFromEnvironment(credentials.credentialProvider);
     await discoverCapability(cwd, {
         phrase,
         typeFilter,
@@ -1578,6 +1580,8 @@ function showFlagValues(flags, name) {
     return values;
 }
 async function handleShow(args) {
+    const credentials = await prepareResourceCredentials(args);
+    args = credentials.args;
     const { showArtifact, showMetadata } = await import('./query-engine.js');
     const cwd = process.cwd();
     const positional = [];
@@ -1676,7 +1680,7 @@ async function handleShow(args) {
     const offline = flags.includes('--offline');
     const webReleaseOptions = resourceSource === 'local'
         ? undefined
-        : webReleaseOptionsFromEnvironment();
+        : webReleaseOptionsFromEnvironment(credentials.credentialProvider);
     const params = {
         name,
         boundRuleBodies: flags.includes('--bound-rule-bodies'),

package/dist/src/auth/config.js

@@ -1,5 +1,5 @@
-import fs from "node:fs";
 import path from "node:path";
+import { readPrivateValueFile } from "./sensitive-input.js";
 export const DEFAULT_AUTH_BASE_URL = "https://releases.aiwg.io";
 export const DEFAULT_AUTH_CLIENT_ID = "aiwg-cli";
 export const DEFAULT_AUTH_SCOPES = ["releases:read", "profile:read"];
@@ -24,14 +24,9 @@ export function authConfigFromEnvironment(env = process.env) {
         throw new Error("AIWG auth scopes are invalid");
     return { baseUrl, clientId, scopes, requestTimeoutMs: 30_000 };
 }
-export function explicitResourceToken(env = process.env) {
+export async function explicitResourceToken(env = process.env) {
     if (env.AIWG_RESOURCE_TOKEN_FILE) {
-        const pathname = path.resolve(env.AIWG_RESOURCE_TOKEN_FILE);
-        const stat = fs.lstatSync(pathname);
-        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) {
-            throw new Error("AIWG_RESOURCE_TOKEN_FILE must be a non-symlink regular file with mode 0600");
-        }
-        return fs.readFileSync(pathname, "utf8").trim() || null;
+        return await readPrivateValueFile(path.resolve(env.AIWG_RESOURCE_TOKEN_FILE), "AIWG_RESOURCE_TOKEN_FILE") || null;
     }
     return env.AIWG_RESOURCE_TOKEN?.trim() || null;
 }

package/dist/src/auth/resource-credentials.js

@@ -1,12 +1,19 @@
 import { explicitResourceToken } from "./config.js";
 import { createCredentialStore } from "./credential-store.js";
+import { resolveSensitiveInput, sensitiveInputOptions } from "./sensitive-input.js";
 /**
  * Resolve credentials for protected release downloads. Explicit compatibility
  * inputs take precedence over interactive-login credentials.
  */
-export function createResourceCredentialProvider(env = process.env, store) {
+export function createResourceCredentialProvider(env = process.env, store, source = {}, dependencies = {}) {
+    const hasSource = source.interactive || source.stdin || source.file !== undefined || source.store !== undefined || source.env !== undefined;
+    // A command may fetch several manifests and bodies. Never consume stdin or
+    // ask for the same explicit credential more than once, including on failure.
+    let resolvedSource;
     return async () => {
-        const explicit = explicitResourceToken(env);
+        if (hasSource)
+            return resolvedSource ??= resolveSensitiveInput({ ...source, prefix: 'resource-token' }, { ...dependencies, environment: env });
+        const explicit = await explicitResourceToken(env);
         if (explicit)
             return explicit;
         const selected = store ?? createCredentialStore();
@@ -22,4 +29,30 @@ export function createResourceCredentialProvider(env = process.env, store) {
         }
     };
 }
+/** Parse once before command-specific positional parsing or helper forwarding. */
+export async function prepareResourceCredentials(args, env = process.env, store, dependencies = {}) {
+    const source = sensitiveInputOptions(args, 'resource-token');
+    const remaining = [];
+    const valueFlags = ['--resource-token-file', '--resource-token-store', '--resource-token-env'];
+    for (let index = 0; index < args.length; index++) {
+        const token = args[index];
+        if (token === '--') {
+            remaining.push(...args.slice(index));
+            break;
+        }
+        if (valueFlags.includes(token)) {
+            index++;
+            continue;
+        }
+        if (valueFlags.some(flag => token.startsWith(`${flag}=`)) ||
+            token === '--resource-token-stdin' || token === '--resource-token-interactive')
+            continue;
+        remaining.push(token);
+    }
+    const credentialProvider = createResourceCredentialProvider(env, store, source, dependencies);
+    if (source.interactive || source.stdin || source.file !== undefined || source.store !== undefined || source.env !== undefined) {
+        await credentialProvider();
+    }
+    return { args: remaining, credentialProvider, omitEnv: ['AIWG_RESOURCE_TOKEN', ...(source.env ? [source.env] : [])] };
+}
 //# sourceMappingURL=resource-credentials.js.map

package/dist/src/cli/handlers/diagnose.js

@@ -40,9 +40,22 @@ export const diagnoseHandler = {
     description: 'Produce a shareable support bundle (logs + env + config) for bug reports',
     category: 'maintenance',
     aliases: [],
+    async help() {
+        return { exitCode: 0, message: [
+                'Usage: aiwg diagnose [--stdout] [--include-secrets]',
+                '',
+                '--stdout          Print the bundle as JSON instead of writing a tarball.',
+                '--include-secrets Disable sanitization. Output contains secrets; review it before sharing.',
+            ].join('\n') };
+    },
     async execute(ctx) {
+        if (ctx.args.includes('--help') || ctx.args.includes('-h'))
+            return diagnoseHandler.help(ctx);
         const stdoutMode = ctx.args.includes('--stdout');
         const includeSecrets = ctx.args.includes('--include-secrets');
+        if (includeSecrets) {
+            process.stderr.write('Warning: --include-secrets output contains secrets. Review it before sharing.\n');
+        }
         const cwd = getProjectDir(ctx, ctx.args);
         const log = getLogger('cli:diagnose');
         const span = log.span('diagnose', { stdoutMode, includeSecrets });

package/dist/src/cli/handlers/resource-versions.js

@@ -3,13 +3,14 @@ import { loadResourceTrustRootFile, readVerifiedRegularFile, resolveWebRelease,
 import { getProjectDir } from "../../config/aiwg-config.js";
 import { cleanWebResourceCache } from "../../resources/cache-cleanup.js";
 import { writeWebResourceLock } from "../../resources/lockfile.js";
-import { createResourceCredentialProvider } from "../../auth/resource-credentials.js";
+import { createResourceCredentialProvider, prepareResourceCredentials } from "../../auth/resource-credentials.js";
 const MAX_RESOURCE_MANIFEST_BYTES = 4 * 1024 * 1024;
 const DEFAULT_CHANNELS = ["stable", "latest", "canary", "main"];
 function usage() {
     return [
         "Usage: aiwg versions <list|resolve|show|clean-cache> [selector] [--json] [--pretty] [--offline]",
         "",
+        "Protected releases: --resource-token-stdin, --resource-token-file <path>, --resource-token-store <name>, --resource-token-env <NAME>, --resource-token-interactive",
         "Examples:",
         "  aiwg versions list --json",
         "  aiwg versions resolve stable --json",
@@ -75,7 +76,7 @@ function parseArgs(args) {
         channels,
     };
 }
-function webReleaseOptionsFromEnvironment() {
+function webReleaseOptionsFromEnvironment(credentialProvider = createResourceCredentialProvider(process.env)) {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
     const cacheRoot = process.env.AIWG_RESOURCE_CACHE_ROOT;
     const trustRootFile = process.env.AIWG_RESOURCE_TRUST_ROOT_FILE;
@@ -83,7 +84,7 @@ function webReleaseOptionsFromEnvironment() {
         ? undefined
         : loadResourceTrustRootFile(path.resolve(trustRootFile));
     return {
-        credentialProvider: createResourceCredentialProvider(process.env),
+        credentialProvider,
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),
@@ -168,14 +169,16 @@ export const versionsHandler = {
             return { exitCode: 0 };
         }
         let parsed;
+        let credentials;
         try {
-            parsed = parseArgs(ctx.args);
+            credentials = await prepareResourceCredentials(ctx.args);
+            parsed = parseArgs(credentials.args);
         }
         catch (error) {
             return { exitCode: 2, message: error instanceof Error ? error.message : String(error) };
         }
         try {
-            const baseOptions = webReleaseOptionsFromEnvironment();
+            const baseOptions = webReleaseOptionsFromEnvironment(credentials.credentialProvider);
             if (parsed.subcommand === "clean-cache") {
                 const result = cleanWebResourceCache(getProjectDir(ctx, ctx.args), {
                     cacheRoot: process.env.AIWG_RESOURCE_CACHE_ROOT,

package/dist/src/cli/handlers/script-runner.js

@@ -57,10 +57,13 @@ export class DefaultScriptRunner {
             const stdio = options.capture
                 ? ['pipe', options.stdoutFd ?? 'pipe', 'pipe']
                 : 'inherit';
+            const environment = { ...process.env, ...options.env };
+            for (const name of options.omitEnv ?? [])
+                delete environment[name];
             const child = spawn('node', [fullPath, ...args], {
                 stdio,
                 cwd: options.cwd || process.cwd(),
-                env: { ...process.env, ...options.env },
+                env: environment,
             });
             // Always drain captured pipes, even after the diagnostic cap is reached.
             // stdout is not part of HandlerResult; discard it. Retain only the first
@@ -146,10 +149,13 @@ export class DefaultScriptRunner {
     async runDeployment(fullPath, args, options) {
         const previousConsole = globalThis.console;
         const previousRoot = process.env.AIWG_ROOT;
+        const omitted = new Map((options.omitEnv ?? []).map(name => [name, process.env[name]]));
         const stderrLimit = 1024 * 1024;
         const diagnostics = [];
         let diagnosticBytes = 0;
         try {
+            for (const name of omitted.keys())
+                delete process.env[name];
             if (options.env?.AIWG_ROOT !== undefined)
                 process.env.AIWG_ROOT = options.env.AIWG_ROOT;
             if (options.capture) {
@@ -187,6 +193,12 @@ export class DefaultScriptRunner {
         }
         finally {
             globalThis.console = previousConsole;
+            for (const [name, value] of omitted) {
+                if (value === undefined)
+                    delete process.env[name];
+                else
+                    process.env[name] = value;
+            }
             if (previousRoot === undefined)
                 delete process.env.AIWG_ROOT;
             else

package/dist/src/cli/handlers/use.js

@@ -65,7 +65,7 @@ import { verifyModelWrapperDeployment } from '../../models/wrapper-deployment.js
 import { aggregateUseDeploymentResult, buildDryRunUseResult, renderUseDeploymentResult, verifyProviderDeployment, } from '../services/deployment-verification.js';
 import { finalizeProviderTransformationReceipt, providerReceiptHasLocalSources, sourceVerificationsFromSignedWebRelease, } from '../../providers/transformation-receipt-integration.js';
 import { loadResourceTrustRootFile, resolveWebRelease, } from '../../resources/web-release.js';
-import { createResourceCredentialProvider } from '../../auth/resource-credentials.js';
+import { createResourceCredentialProvider, prepareResourceCredentials } from '../../auth/resource-credentials.js';
 /**
  * Valid framework identifiers
  */
@@ -102,7 +102,7 @@ export async function resolveProviderReceiptSource(options) {
         release = await resolveWebRelease({ ...releaseOptions, selector: versionInfo.version, offline: true });
     }
     catch {
-        const credentialProvider = createResourceCredentialProvider(process.env);
+        const credentialProvider = options.credentialProvider ?? createResourceCredentialProvider(process.env);
         const token = await credentialProvider();
         // Protected production resources require the authenticated release
         // credential. A configured alternate endpoint may intentionally be public.
@@ -1697,6 +1697,7 @@ function createUseScriptRunner(frameworkRoot) {
     const runner = createScriptRunner(frameworkRoot);
     return {
         async run(script, args, options = {}) {
+            options = { ...options, omitEnv: useDeployment?.resourceCredentials?.omitEnv ?? ['AIWG_RESOURCE_TOKEN'] };
             if (script === 'tools/agents/deploy-agents.mjs')
                 args = useDeploymentArgs(args);
             if (!usePreviewActions)
@@ -2472,6 +2473,9 @@ Bundles:
   <addon> | <extension>     Any installed addon or extension name
 
 Options:
+  --resource-token-stdin | --resource-token-file <path> | --resource-token-store <name>
+  --resource-token-env <NAME> | --resource-token-interactive
+                            Select the optional protected release bearer
   --provider <name>         Target provider (default: .aiwg/aiwg.config providers)
   --target <dir>            Deploy into <dir> instead of the current directory
   --scope project|user      Deploy to the project (default) or the user scope
@@ -2543,11 +2547,22 @@ export class UseHandler {
         return { exitCode: 0, message: USE_HELP, rawOutput: true };
     }
     async execute(ctx) {
+        let resourceCredentials = useDeployment?.resourceCredentials;
+        try {
+            if (!resourceCredentials) {
+                resourceCredentials = await prepareResourceCredentials(ctx.args);
+                ctx = { ...ctx, args: resourceCredentials.args };
+            }
+        }
+        catch (error) {
+            return { exitCode: 2, message: error instanceof Error ? error.message : String(error) };
+        }
         const invalidOption = validateUseOptions(ctx.args, this.preparedProviderContinuations);
         if (invalidOption)
             return { exitCode: 2, message: invalidOption };
         const previousDeployment = useDeployment;
         useDeployment = {
+            resourceCredentials,
             version: previousDeployment?.version ?? resolveDeployVersion(ctx.frameworkRoot || await getFrameworkRoot()),
             skipContextFiles: previousDeployment?.skipContextFiles || ctx.args.includes('--no-context-files'),
             contextFiles: previousDeployment?.contextFiles ?? [],
@@ -2730,7 +2745,7 @@ export class UseHandler {
                             scope: effectiveScope,
                             requestedBundles: [requestedBundle],
                         };
-                        const sourceResolution = await resolveProviderReceiptSource(receiptOptions);
+                        const sourceResolution = await resolveProviderReceiptSource({ ...receiptOptions, credentialProvider: useDeployment?.resourceCredentials?.credentialProvider });
                         await finalizeProviderTransformationReceipt({ ...receiptOptions, ...sourceResolution });
                     }
                     catch (error) {

package/dist/src/resources/web-release.js

@@ -433,6 +433,9 @@ async function fetchBytes(fetcher, url, label, maxBytes, bearerToken) {
     catch (error) {
         if (timedOut)
             throw new Error(`${label} request timed out after ${RESOURCE_FETCH_TIMEOUT_MS}ms`);
+        const message = error instanceof Error ? error.message : String(error);
+        if (bearerToken && message.includes(bearerToken))
+            throw new Error(message.split(bearerToken).join('[REDACTED]'));
         throw error;
     }
     finally {
@@ -1072,80 +1075,88 @@ export async function resolveWebRelease(options = {}) {
         const headers = { ...(init.headers || {}), ...(bearerToken ? { authorization: `Bearer ${bearerToken}` } : {}) };
         return (options.fetcher ?? globalThis.fetch)(input, { ...init, headers });
     };
-    if (selector.kind === "exact") {
-        if (options.offline)
-            return resolveOfflineExact(cacheRoot, selector, selector.value, publicKeyPem, base);
-        const fetcher = authorize;
-        if (!fetcher)
-            throw new Error("No fetch implementation is available for AIWG web resources");
-        return fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selector.value, publicKeyPem);
-    }
-    if (selector.kind === "range" || selector.kind === "digest") {
-        if (!options.offline && selector.kind === "digest") {
-            for (const version of cachedReleaseVersions(cacheRoot)) {
-                if (!cachedDigests(cacheRoot, version).includes(selector.digest))
-                    continue;
-                try {
-                    return verifyCachedGeneration(cacheRoot, version, selector.digest, selector, publicKeyPem, base, selector.digest);
-                }
-                catch {
-                    // A corrupt immutable generation cannot bypass signed index resolution.
+    try {
+        if (selector.kind === "exact") {
+            if (options.offline)
+                return resolveOfflineExact(cacheRoot, selector, selector.value, publicKeyPem, base);
+            const fetcher = authorize;
+            if (!fetcher)
+                throw new Error("No fetch implementation is available for AIWG web resources");
+            return await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selector.value, publicKeyPem);
+        }
+        if (selector.kind === "range" || selector.kind === "digest") {
+            if (!options.offline && selector.kind === "digest") {
+                for (const version of cachedReleaseVersions(cacheRoot)) {
+                    if (!cachedDigests(cacheRoot, version).includes(selector.digest))
+                        continue;
+                    try {
+                        return verifyCachedGeneration(cacheRoot, version, selector.digest, selector, publicKeyPem, base, selector.digest);
+                    }
+                    catch {
+                        // A corrupt immutable generation cannot bypass signed index resolution.
+                    }
                 }
             }
+            const fetcher = authorize;
+            const index = await resolveVersionIndex(base, fetcher, cacheRoot, publicKeyPem, options.offline, options.onDiagnostic);
+            const selected = selectVersionFromIndex(index, selector);
+            if (options.offline) {
+                return resolveOfflineExact(cacheRoot, selector, selected.version, publicKeyPem, base, selected.releaseManifestSha256);
+            }
+            if (!fetcher)
+                throw new Error("No fetch implementation is available for AIWG web resources");
+            return await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selected.version, publicKeyPem, selected.releaseManifestSha256);
         }
-        const fetcher = authorize;
-        const index = await resolveVersionIndex(base, fetcher, cacheRoot, publicKeyPem, options.offline, options.onDiagnostic);
-        const selected = selectVersionFromIndex(index, selector);
         if (options.offline) {
-            return resolveOfflineExact(cacheRoot, selector, selected.version, publicKeyPem, base, selected.releaseManifestSha256);
+            const cached = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
+            if (!cached)
+                throw new Error(`AIWG resource channel ${selector.value} is not cached; offline mode cannot fetch it`);
+            const release = resolveOfflineExact(cacheRoot, selector, cached.manifest.version, publicKeyPem, base, cached.manifest.releaseManifestSha256, cached.manifest.sequence);
+            return cached.manifest.expiresAt ? { ...release, channelExpiresAt: cached.manifest.expiresAt } : release;
         }
+        const fetcher = authorize;
         if (!fetcher)
             throw new Error("No fetch implementation is available for AIWG web resources");
-        return fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selected.version, publicKeyPem, selected.releaseManifestSha256);
-    }
-    if (options.offline) {
-        const cached = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
-        if (!cached)
-            throw new Error(`AIWG resource channel ${selector.value} is not cached; offline mode cannot fetch it`);
-        const release = resolveOfflineExact(cacheRoot, selector, cached.manifest.version, publicKeyPem, base, cached.manifest.releaseManifestSha256, cached.manifest.sequence);
-        return cached.manifest.expiresAt ? { ...release, channelExpiresAt: cached.manifest.expiresAt } : release;
-    }
-    const fetcher = authorize;
-    if (!fetcher)
-        throw new Error("No fetch implementation is available for AIWG web resources");
-    const channelPrefix = `resources/channels/${selector.value}`;
-    let prior = null;
-    try {
-        prior = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
+        const channelPrefix = `resources/channels/${selector.value}`;
+        let prior = null;
+        try {
+            prior = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
+        }
+        catch {
+            prior = null;
+        }
+        const fetched = await fetchMetadata(fetcher, resourceUrl(base, `${channelPrefix}.json`), `channel ${selector.value}`, MAX_SIGNED_METADATA_BYTES, prior?.validator);
+        if (fetched.notModified) {
+            cacheChannel(cacheRoot, prior.manifest, prior.bytes, prior.signatureBytes, prior.digest, fetched.validator);
+            options.onDiagnostic?.({ resource: "channel", outcome: "conditional-hit", validator: prior.validator.etag ? "etag" : "last-modified" });
+            const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, prior.manifest.version, publicKeyPem, prior.manifest.releaseManifestSha256, prior.manifest.sequence);
+            return prior.manifest.expiresAt ? { ...release, channelExpiresAt: prior.manifest.expiresAt } : release;
+        }
+        const channelBytes = fetched.bytes;
+        const channelSignatureBytes = await fetchBytes(fetcher, resourceUrl(base, `${channelPrefix}.sig`), `channel ${selector.value} signature`, MAX_SIGNATURE_BYTES);
+        const channelDigest = verifySignedResourceBytes(channelBytes, channelSignatureBytes, publicKeyPem, `channel ${selector.value}`);
+        const channel = validateChannelManifest(parseJson(channelBytes, `channel ${selector.value}`), selector.value);
+        if (prior && channel.sequence < prior.manifest.sequence) {
+            throw new Error(`channel ${selector.value} sequence rollback detected (${channel.sequence} < ${prior.manifest.sequence})`);
+        }
+        if (prior &&
+            channel.sequence === prior.manifest.sequence &&
+            (channelDigest !== prior.digest ||
+                channel.version !== prior.manifest.version ||
+                channel.releaseManifestSha256 !== prior.manifest.releaseManifestSha256)) {
+            throw new Error(`channel ${selector.value} sequence ${channel.sequence} has conflicting signed metadata`);
+        }
+        const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, channel.version, publicKeyPem, channel.releaseManifestSha256, channel.sequence);
+        cacheChannel(cacheRoot, channel, channelBytes, channelSignatureBytes, channelDigest, fetched.validator);
+        options.onDiagnostic?.({ resource: "channel", outcome: prior?.validator ? "revalidated" : "unconditional", validator: fetched.validator?.etag ? "etag" : fetched.validator?.lastModified ? "last-modified" : "none" });
+        return channel.expiresAt ? { ...release, channelExpiresAt: channel.expiresAt } : release;
     }
-    catch {
-        prior = null;
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (bearerToken && message.includes(bearerToken))
+            throw new Error(message.split(bearerToken).join('[REDACTED]'));
+        throw error;
     }
-    const fetched = await fetchMetadata(fetcher, resourceUrl(base, `${channelPrefix}.json`), `channel ${selector.value}`, MAX_SIGNED_METADATA_BYTES, prior?.validator);
-    if (fetched.notModified) {
-        cacheChannel(cacheRoot, prior.manifest, prior.bytes, prior.signatureBytes, prior.digest, fetched.validator);
-        options.onDiagnostic?.({ resource: "channel", outcome: "conditional-hit", validator: prior.validator.etag ? "etag" : "last-modified" });
-        const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, prior.manifest.version, publicKeyPem, prior.manifest.releaseManifestSha256, prior.manifest.sequence);
-        return prior.manifest.expiresAt ? { ...release, channelExpiresAt: prior.manifest.expiresAt } : release;
-    }
-    const channelBytes = fetched.bytes;
-    const channelSignatureBytes = await fetchBytes(fetcher, resourceUrl(base, `${channelPrefix}.sig`), `channel ${selector.value} signature`, MAX_SIGNATURE_BYTES);
-    const channelDigest = verifySignedResourceBytes(channelBytes, channelSignatureBytes, publicKeyPem, `channel ${selector.value}`);
-    const channel = validateChannelManifest(parseJson(channelBytes, `channel ${selector.value}`), selector.value);
-    if (prior && channel.sequence < prior.manifest.sequence) {
-        throw new Error(`channel ${selector.value} sequence rollback detected (${channel.sequence} < ${prior.manifest.sequence})`);
-    }
-    if (prior &&
-        channel.sequence === prior.manifest.sequence &&
-        (channelDigest !== prior.digest ||
-            channel.version !== prior.manifest.version ||
-            channel.releaseManifestSha256 !== prior.manifest.releaseManifestSha256)) {
-        throw new Error(`channel ${selector.value} sequence ${channel.sequence} has conflicting signed metadata`);
-    }
-    const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, channel.version, publicKeyPem, channel.releaseManifestSha256, channel.sequence);
-    cacheChannel(cacheRoot, channel, channelBytes, channelSignatureBytes, channelDigest, fetched.validator);
-    options.onDiagnostic?.({ resource: "channel", outcome: prior?.validator ? "revalidated" : "unconditional", validator: fetched.validator?.etag ? "etag" : fetched.validator?.lastModified ? "last-modified" : "none" });
-    return channel.expiresAt ? { ...release, channelExpiresAt: channel.expiresAt } : release;
 }
 export async function fetchVerifiedRawResource(release, resourcePath, options = {}) {
     assertSafeRelativePath(resourcePath, "raw resource path");

package/dist/src/storage/backends/fortemi.js

@@ -38,6 +38,7 @@
  */
 import { createHash } from 'node:crypto';
 import { debuglog } from 'node:util';
+import { hasSecretLookingLiterals } from '../../mcp/credentials.mjs';
 const FORTEMI_QUERY_LIMIT = 50;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function schemaProperties(tool) {
@@ -82,7 +83,7 @@ export function resolveMcpRequestHeaders(server, environment = process.env) {
     const headers = { ...(server.headers ?? {}) };
     for (const [header, envName] of Object.entries(server.headerEnv ?? {})) {
         if (!ENV_NAME.test(envName)) {
-            throw new Error(`storage(fortemi): invalid environment variable reference "${envName}"`);
+            throw new Error('storage(fortemi): invalid environment variable reference; use ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
         }
         const value = environment[envName];
         if (!value) {
@@ -382,20 +383,31 @@ export const createDefaultMcpClient = async (serverName, registryOverride, envir
     }
     // Lazy imports keep unit tests that inject a stub isolated from transports.
     const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
+    const hasCredentials = [server.env, server.headers, server.envFrom, server.headerEnv]
+        .some(map => Object.keys(map ?? {}).length > 0);
+    if (hasCredentials && server.type === 'stdio' && debuglog('child_process').enabled) {
+        throw new Error('MCP stdio credentials require NODE_DEBUG child_process logging to be disabled.');
+    }
+    // Reuse the registry resolver for file/store references. Preserve legacy env
+    // bytes and Authorization's existing Bearer prefix at the transport boundary.
     const hasNewReferences = [...Object.values(server.headerEnv ?? {}), ...Object.values(server.envFrom ?? {})]
         .some(reference => /^(?:file|store):/.test(reference));
-    // Keep legacy header/environment behavior unchanged. New locators are resolved
-    // only at connection time and never fed back to the registry or config writers.
-    if (hasNewReferences && server.type === 'stdio' && debuglog('child_process').enabled) {
-        throw new Error('MCP file/store stdio credentials require NODE_DEBUG child_process logging to be disabled.');
-    }
     const resolved = hasNewReferences
         ? await resolveMcpCredentialMaps(server, { ...sensitiveInput, environment })
-        : undefined;
-    const secrets = resolved ? [
-        ...Object.keys(server.envFrom ?? {}).map(key => resolved.env?.[key]),
-        ...Object.keys(server.headerEnv ?? {}).map(key => resolved.headers?.[key]),
-    ].filter((value) => Boolean(value)).sort((a, b) => b.length - a.length) : [];
+        : { env: server.env ? { ...server.env } : undefined, headers: resolveMcpRequestHeaders(server, environment) };
+    if (!hasNewReferences) {
+        for (const [key, name] of Object.entries(server.envFrom ?? {})) {
+            if (!ENV_NAME.test(name) || !environment[name]) {
+                throw new Error('storage(fortemi): envFrom requires a set ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
+            }
+            resolved.env = { ...resolved.env, [key]: environment[name] };
+        }
+    }
+    const secrets = [
+        ...Object.entries(resolved.env ?? {}).filter(([key, value]) => key in (server.envFrom ?? {}) || hasSecretLookingLiterals({ name: server.name, env: { [key]: value } })).map(([, value]) => value),
+        ...Object.values(resolved.headers ?? {}),
+        ...Object.values(resolved.headers ?? {}).map(value => value.replace(/^Bearer /i, '')),
+    ].filter(Boolean).sort((a, b) => b.length - a.length);
     const redact = (text) => secrets.reduce((text, secret) => text.split(secret).join('[REDACTED]'), text);
     const protect = async (operation) => {
         try {
@@ -421,8 +433,8 @@ export const createDefaultMcpClient = async (serverName, registryOverride, envir
             transport = new StdioClientTransport({
                 command: server.command ?? '',
                 args: server.args ?? [],
-                env: resolved?.env ?? server.env,
-                ...(hasNewReferences ? { stderr: 'pipe' } : {}),
+                env: resolved.env,
+                ...(hasCredentials ? { stderr: 'pipe' } : {}),
             });
         }
         else {
@@ -430,8 +442,8 @@ export const createDefaultMcpClient = async (serverName, registryOverride, envir
                 throw new Error(`storage(fortemi): MCP server "${serverName}" has no URL`);
             }
             const url = validateRemoteMcpUrl(server.url);
-            const headers = resolved?.headers ?? resolveMcpRequestHeaders(server, environment);
-            if (resolved) {
+            const headers = resolved.headers ?? {};
+            if (hasNewReferences) {
                 for (const header of Object.keys(server.headerEnv ?? {})) {
                     if (header.toLowerCase() === 'authorization')
                         headers[header] = `Bearer ${headers[header]}`;
@@ -462,36 +474,28 @@ export const createDefaultMcpClient = async (serverName, registryOverride, envir
             }
         }
         const client = new Client({ name: 'aiwg-storage-fortemi-adapter', version: '1.0.0' }, { capabilities: {} });
-        if (hasNewReferences && server.type === 'stdio') {
+        if (hasCredentials && server.type === 'stdio') {
             // The recipient's stderr can contain credentials. Drain without forwarding.
             transport.stderr?.on('data', () => { });
         }
-        if (hasNewReferences)
-            await protect(() => client.connect(transport));
-        else
-            await client.connect(transport);
+        await protect(() => client.connect(transport));
         return {
             async callTool(name, args) {
                 const call = async () => unwrapMcpToolResult(await client.callTool({ name, arguments: args }));
-                return hasNewReferences ? protectResult(await protect(call)) : call();
+                return protectResult(await protect(call));
             },
             async listTools() {
-                return hasNewReferences ? protectResult(await protect(() => client.listTools())) : client.listTools();
+                return protectResult(await protect(() => client.listTools()));
             },
             serverVersion() {
-                return hasNewReferences ? protectResult(client.getServerVersion()) : client.getServerVersion();
+                return protectResult(client.getServerVersion());
             },
             async close() {
-                if (hasNewReferences)
-                    await protect(() => client.close());
-                else
-                    await client.close();
+                await protect(() => client.close());
             },
         };
     }
     catch (error) {
-        if (!hasNewReferences)
-            throw error;
         throw new Error(redact(error instanceof Error ? error.message : 'MCP transport failed'));
     }
 };

package/dist/src/storage/backends/logseq.js

@@ -32,20 +32,26 @@
  * @issue #958
  */
 import { existsSync } from 'fs';
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { mkdir, readFile, readdir, rm, stat, writeFile } from 'fs/promises';
 import { dirname, join, relative, resolve, sep } from 'path';
 const LOGSEQ_CONFIG_DIR = 'logseq';
 const DEFAULT_API_URL = 'http://127.0.0.1:12315/api';
 export class LogseqAdapter {
+    sensitiveInput;
     /** Absolute path to the Logseq graph root. */
     graph;
     apiUrl;
     useApi;
+    apiTokenEnv;
     apiWarned = false;
-    constructor(config) {
+    constructor(config, sensitiveInput = {}) {
+        this.sensitiveInput = sensitiveInput;
         this.graph = resolve(expandHome(config.graph));
         this.apiUrl = config.apiUrl ?? DEFAULT_API_URL;
         this.useApi = config.useApi ?? true;
+        this.apiTokenEnv = config.apiTokenEnv;
     }
     async init() {
         if (!existsSync(this.graph)) {
@@ -61,7 +67,14 @@ export class LogseqAdapter {
     async probeApi() {
         if (this.apiWarned)
             return;
-        const token = process.env['LOGSEQ_API_TOKEN'];
+        const input = credentialReferenceInput(this.apiTokenEnv ?? 'LOGSEQ_API_TOKEN', 'Logseq apiTokenEnv');
+        // Keep the optional legacy environment path, including its missing-token warning.
+        const token = input.env
+            ? (this.sensitiveInput.environment ?? process.env)[input.env]
+            : await resolveSensitiveInput(input, this.sensitiveInput);
+        if (!token && this.apiTokenEnv !== undefined) {
+            throw new Error('storage(logseq): apiTokenEnv is not set; use ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
+        }
         if (!token) {
             this.apiWarned = true;
             process.stderr.write(`storage(logseq): API requested (useApi: true) but LOGSEQ_API_TOKEN is not set.\n` +
@@ -89,7 +102,7 @@ export class LogseqAdapter {
         }
         catch {
             this.apiWarned = true;
-            process.stderr.write(`storage(logseq): API server at ${this.apiUrl} is not reachable.\n` +
+            process.stderr.write(`storage(logseq): API server is not reachable.\n` +
                 `  AIWG will continue with direct file writes against the graph.\n` +
                 `  Start Logseq with the API server enabled, or set "useApi": false to suppress.\n`);
         }

package/dist/src/storage/backends/postgres.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { createHash } from 'node:crypto';
 import { loadFeaturePackage } from '../../features/runtime.js';
 import { STORAGE_BACKEND_CONTRACT, } from '../backend-contract.js';
@@ -27,6 +29,7 @@ export class PostgresBackendError extends Error {
  */
 export class PostgresStorageBackend {
     options;
+    sensitiveInput;
     descriptor = {
         contract: STORAGE_BACKEND_CONTRACT,
         backend: 'postgres-direct',
@@ -50,8 +53,9 @@ export class PostgresStorageBackend {
     statementTimeoutMs;
     lockTimeoutMs;
     idleTransactionTimeoutMs;
-    constructor(options) {
+    constructor(options, sensitiveInput = {}) {
         this.options = options;
+        this.sensitiveInput = sensitiveInput;
         validateIdentity(options.tenant, 'tenant');
         validateIdentity(options.subsystem, 'subsystem');
         this.pool = options.pool;
@@ -69,7 +73,7 @@ export class PostgresStorageBackend {
     }
     async init() {
         if (!this.pool)
-            this.pool = await createPool(this.options);
+            this.pool = await createPool(this.options, this.sensitiveInput);
         if (this.options.schemaMode !== 'migrate') {
             const schema = await this.runQuery('SELECT schema_version FROM aiwg_storage_schema WHERE singleton = true');
             if (Number(schema.rows[0]?.schema_version) !== 1) {
@@ -187,7 +191,7 @@ export class PostgresStorageBackend {
     }
     /** Hold an exported PostgreSQL snapshot open while parallel consumers page it. */
     async openSnapshotLease() {
-        const exporter = await this.requiredPool().connect();
+        const exporter = await this.connect();
         let closed = false;
         try {
             await exporter.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
@@ -208,8 +212,11 @@ export class PostgresStorageBackend {
                     try {
                         await exporter.query('COMMIT');
                     }
+                    catch (error) {
+                        throw classifyPostgresError(error);
+                    }
                     finally {
-                        exporter.release(false);
+                        releaseClient(exporter, false);
                     }
                 },
             };
@@ -219,7 +226,7 @@ export class PostgresStorageBackend {
                 await exporter.query('ROLLBACK');
             }
             catch { /* preserve original error */ }
-            exporter.release(true);
+            releaseClient(exporter, true);
             throw classifyPostgresError(error);
         }
     }
@@ -228,7 +235,7 @@ export class PostgresStorageBackend {
             throw new PostgresBackendError('AIWG_POSTGRES_SNAPSHOT_INVALID', 'exported snapshot identifier is malformed');
         }
         const boundedLimit = bounded(limit, 1000, 1, 10_000, 'limit');
-        const client = await this.requiredPool().connect();
+        const client = await this.connect();
         let failed = false;
         try {
             await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
@@ -252,7 +259,7 @@ export class PostgresStorageBackend {
             throw classifyPostgresError(error);
         }
         finally {
-            client.release(failed);
+            releaseClient(client, failed);
         }
     }
     async changes(cursor) {
@@ -322,12 +329,17 @@ export class PostgresStorageBackend {
         });
     }
     async close() {
-        if (this.ownsPool && this.pool)
-            await this.pool.end();
+        try {
+            if (this.ownsPool && this.pool)
+                await this.pool.end();
+        }
+        catch (error) {
+            throw classifyPostgresError(error);
+        }
         this.pool = undefined;
     }
     async withTransaction(operation, isolation = 'SERIALIZABLE') {
-        const client = await this.requiredPool().connect();
+        const client = await this.connect();
         let failed = false;
         try {
             await client.query(`BEGIN ISOLATION LEVEL ${isolation}`);
@@ -347,7 +359,7 @@ export class PostgresStorageBackend {
             throw classifyPostgresError(error);
         }
         finally {
-            client.release(failed);
+            releaseClient(client, failed);
         }
     }
     assertMutationIdentity(mutation) {
@@ -356,6 +368,14 @@ export class PostgresStorageBackend {
             throw new PostgresBackendError('AIWG_POSTGRES_IDENTITY_MISMATCH', 'mutation identity is outside this backend tenant/subsystem');
         }
     }
+    async connect() {
+        try {
+            return await this.requiredPool().connect();
+        }
+        catch (error) {
+            throw classifyPostgresError(error);
+        }
+    }
     requiredPool() {
         if (!this.pool)
             throw new PostgresBackendError('AIWG_POSTGRES_NOT_INITIALIZED', 'call init() before using the PostgreSQL backend');
@@ -370,11 +390,18 @@ export class PostgresStorageBackend {
         }
     }
 }
-async function createPool(options) {
+async function createPool(options, sensitiveInput) {
     const envName = options.connectionStringEnv ?? 'AIWG_POSTGRES_URL';
-    const connectionString = process.env[envName];
+    const input = credentialReferenceInput(envName, 'PostgreSQL connectionStringEnv');
+    let connectionString;
+    try {
+        connectionString = input.env ? (sensitiveInput.environment ?? process.env)[input.env] : await resolveSensitiveInput(input, sensitiveInput);
+    }
+    catch (error) {
+        throw new PostgresBackendError('AIWG_POSTGRES_CREDENTIAL_UNAVAILABLE', error.message);
+    }
     if (!connectionString) {
-        throw new PostgresBackendError('AIWG_POSTGRES_CREDENTIAL_UNAVAILABLE', `PostgreSQL connection locator ${envName} is not set`);
+        throw new PostgresBackendError('AIWG_POSTGRES_CREDENTIAL_UNAVAILABLE', 'PostgreSQL connectionStringEnv is not set; use ENV_NAME (default AIWG_POSTGRES_URL), file:ABSOLUTE_PATH or store:NAME.');
     }
     if (options.ssl === undefined) {
         throw new PostgresBackendError('AIWG_POSTGRES_TLS_REQUIRED', 'PostgreSQL remote connections require explicit ssl=require or ssl=verify-full');
@@ -382,24 +409,29 @@ async function createPool(options) {
     if (options.ssl === 'disable' && !isLoopbackPostgresUrl(connectionString)) {
         throw new PostgresBackendError('AIWG_POSTGRES_TLS_REQUIRED', 'ssl=disable is limited to explicit loopback development endpoints');
     }
-    const pg = await loadFeaturePackage('pg');
-    const defaultExport = pg.default;
-    const Pool = (pg.Pool ?? defaultExport?.Pool);
-    if (!Pool)
-        throw new PostgresBackendError('AIWG_POSTGRES_DRIVER_INVALID', 'optional pg package does not export Pool');
-    const pool = new Pool({
-        connectionString,
-        max: bounded(options.maxConnections, DEFAULT_POOL_MAX, 1, 100, 'maxConnections'),
-        connectionTimeoutMillis: bounded(options.connectionTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'connectionTimeoutMs'),
-        statement_timeout: bounded(options.statementTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'statementTimeoutMs'),
-        application_name: options.applicationName ?? 'aiwg',
-        ssl: options.ssl === 'disable' ? false : { rejectUnauthorized: options.ssl === 'verify-full' },
-    });
-    // pg emits idle-client failures at pool scope. Registering a listener keeps
-    // server restarts from becoming uncaught process exceptions; failed clients
-    // are evicted by pg and the next backend operation reconnects normally.
-    pool.on?.('error', () => undefined);
-    return pool;
+    try {
+        const pg = await loadFeaturePackage('pg');
+        const defaultExport = pg.default;
+        const Pool = (pg.Pool ?? defaultExport?.Pool);
+        if (!Pool)
+            throw new PostgresBackendError('AIWG_POSTGRES_DRIVER_INVALID', 'optional pg package does not export Pool');
+        const pool = new Pool({
+            connectionString,
+            max: bounded(options.maxConnections, DEFAULT_POOL_MAX, 1, 100, 'maxConnections'),
+            connectionTimeoutMillis: bounded(options.connectionTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'connectionTimeoutMs'),
+            statement_timeout: bounded(options.statementTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'statementTimeoutMs'),
+            application_name: options.applicationName ?? 'aiwg',
+            ssl: options.ssl === 'disable' ? false : { rejectUnauthorized: options.ssl === 'verify-full' },
+        });
+        // pg emits idle-client failures at pool scope. Registering a listener keeps
+        // server restarts from becoming uncaught process exceptions; failed clients
+        // are evicted by pg and the next backend operation reconnects normally.
+        pool.on?.('error', () => undefined);
+        return pool;
+    }
+    catch (error) {
+        throw classifyPostgresError(error);
+    }
 }
 function isLoopbackPostgresUrl(connectionString) {
     try {
@@ -468,6 +500,15 @@ function classifyPostgresError(error) {
     if (['40001', '40P01', '55P03', '57014', '57P01', '57P02', '57P03', '08000', '08003', '08006', '08001'].includes(code)) {
         return new PostgresBackendError('AIWG_POSTGRES_RETRYABLE', `retryable PostgreSQL failure (${code})`, true);
     }
-    return error instanceof Error ? error : new Error(String(error));
+    // Drivers may echo the entire connection string, passwords or server detail.
+    return new PostgresBackendError('AIWG_POSTGRES_OPERATION_FAILED', 'PostgreSQL operation failed; check connectivity, credentials and server configuration.');
+}
+function releaseClient(client, failed) {
+    try {
+        client.release(failed);
+    }
+    catch (error) {
+        throw classifyPostgresError(error);
+    }
 }
 //# sourceMappingURL=postgres.js.map

package/dist/src/storage/backends/postgrest.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { STORAGE_BACKEND_CONTRACT } from '../backend-contract.js';
 import { postgresBatchId, postgresPayloadDigest } from './postgres.js';
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -18,6 +20,7 @@ export class PostgrestBackendError extends Error {
 /** PostgreSQL accessMode=postgrest; not a separate storage engine. */
 export class PostgrestStorageBackend {
     options;
+    sensitiveInput;
     descriptor = {
         contract: STORAGE_BACKEND_CONTRACT,
         backend: 'postgres-postgrest',
@@ -42,8 +45,9 @@ export class PostgrestStorageBackend {
     maxResponseBytes;
     maxBatchSize;
     maxPageSize;
-    constructor(options) {
+    constructor(options, sensitiveInput = {}) {
         this.options = options;
+        this.sensitiveInput = sensitiveInput;
         this.baseUrl = normalizeBaseUrl(options.baseUrl);
         this.fetchImpl = options.fetch ?? globalThis.fetch;
         if (!this.fetchImpl)
@@ -185,7 +189,7 @@ export class PostgrestStorageBackend {
             headers['Content-Type'] = options.contentType ?? 'application/json';
         if (options.prefer)
             headers.Prefer = options.prefer;
-        const authorization = this.authorization();
+        const authorization = await this.authorization();
         if (authorization)
             headers.Authorization = authorization;
         let response;
@@ -195,8 +199,8 @@ export class PostgrestStorageBackend {
                 signal: AbortSignal.timeout(this.timeoutMs),
             });
         }
-        catch (error) {
-            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', error instanceof Error ? error.message : String(error), true);
+        catch {
+            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', 'PostgREST transport failed; check connectivity and authorization.', true);
         }
         if (response.status === 204)
             return undefined;
@@ -204,15 +208,23 @@ export class PostgrestStorageBackend {
         if (declaredLength > this.maxResponseBytes) {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_TOO_LARGE', `response exceeds ${this.maxResponseBytes} byte ceiling`);
         }
-        const responseBody = await response.text();
+        let responseBody;
+        try {
+            responseBody = await response.text();
+        }
+        catch {
+            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', 'PostgREST response could not be read.', true);
+        }
         if (Buffer.byteLength(responseBody) > this.maxResponseBytes) {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_TOO_LARGE', `response exceeds ${this.maxResponseBytes} byte ceiling`);
         }
         if (!response.ok) {
-            const databaseError = parseDatabaseError(responseBody);
+            const secrets = authorization
+                ? [authorization, authorization.trim(), authorization.trim().replace(/^\S+\s+/, '')].filter(Boolean) : [];
+            const databaseError = parseDatabaseError(responseBody, secrets);
             const retryable = response.status === 408 || response.status === 425 || response.status === 429 ||
                 response.status >= 500 || isRetryableDatabaseCode(databaseError.databaseCode);
-            const exposedCode = databaseError.message?.startsWith('AIWG_')
+            const exposedCode = /^AIWG_[A-Z0-9_]+$/.test(databaseError.message ?? '')
                 ? databaseError.message
                 : retryable ? 'AIWG_POSTGREST_RETRYABLE' : 'AIWG_POSTGREST_REQUEST_FAILED';
             throw new PostgrestBackendError(exposedCode, `PostgREST request failed with HTTP ${response.status}${databaseError.databaseCode ? ` (database ${databaseError.databaseCode})` : ''}`, retryable, parseRetryAfter(response.headers.get('retry-after')));
@@ -224,12 +236,19 @@ export class PostgrestStorageBackend {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_INVALID', 'PostgREST returned invalid JSON');
         }
     }
-    authorization() {
+    async authorization() {
         if (!this.options.authorizationEnv)
             return undefined;
-        const value = process.env[this.options.authorizationEnv];
+        const input = credentialReferenceInput(this.options.authorizationEnv, 'PostgREST authorizationEnv');
+        let value;
+        try {
+            value = input.env ? (this.sensitiveInput.environment ?? process.env)[input.env] : await resolveSensitiveInput(input, this.sensitiveInput);
+        }
+        catch (error) {
+            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', error.message);
+        }
         if (!value)
-            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', `authorization locator ${this.options.authorizationEnv} is not set`);
+            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', 'PostgREST authorizationEnv is not set; use ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
         return value;
     }
     assertMutationIdentity(mutation) {
@@ -294,12 +313,17 @@ function parseCsv(input) {
     }
     return { header, rows: output };
 }
-function parseDatabaseError(body) {
+function parseDatabaseError(body, secrets) {
     try {
         const parsed = JSON.parse(body);
+        // Decode JSON escapes before redaction: encoded echoes must not become codes.
+        const redact = (value) => typeof value === 'string'
+            ? secrets.reduce((text, secret) => text.split(secret).join('[REDACTED]'), value) : undefined;
+        const databaseCode = redact(parsed.code);
+        const message = redact(parsed.message);
         return {
-            ...(typeof parsed.code === 'string' ? { databaseCode: parsed.code } : {}),
-            ...(typeof parsed.message === 'string' ? { message: parsed.message } : {}),
+            ...(databaseCode && /^[A-Z0-9]{5}$/.test(databaseCode) ? { databaseCode } : {}),
+            ...(message ? { message } : {}),
         };
     }
     catch {

package/dist/src/storage/config.js

@@ -14,6 +14,7 @@
  * @issue #953
  */
 import { existsSync } from 'fs';
+import { credentialReferenceInput } from '../mcp/credentials.mjs';
 import { readFile } from 'fs/promises';
 import { resolve, isAbsolute, join } from 'path';
 import { homedir } from 'os';
@@ -171,8 +172,12 @@ function validateBackendConfig(raw, source) {
             requireString(obj, 'vault', source);
             return obj;
         case 'logseq':
-            rejectUnknownKeys(obj, ['type', 'graph', 'apiUrl', 'useApi'], source, 'backend');
+            rejectUnknownKeys(obj, ['type', 'graph', 'apiUrl', 'apiTokenEnv', 'useApi'], source, 'backend');
             requireString(obj, 'graph', source);
+            if (obj['apiTokenEnv'] !== undefined) {
+                requireString(obj, 'apiTokenEnv', source);
+                credentialReferenceInput(obj['apiTokenEnv'], 'Logseq apiTokenEnv');
+            }
             return obj;
         case 'notion': {
             rejectUnknownKeys(obj, ['type', 'parent', 'externalIdProperty'], source, 'backend');

package/dist/src/uhp/config.js

@@ -100,6 +100,10 @@ export function validateUhpConfig(config) {
         if (!profile.credential || profile.credential.source !== 'env' || !/^[A-Z_][A-Z0-9_]*$/.test(profile.credential.name ?? '')) {
             errors.push(`${where}.credential: must be an env secret reference with an uppercase variable name`);
         }
+        if (profile.credential && typeof profile.credential === 'object'
+            && Object.keys(profile.credential).some(key => key !== 'source' && key !== 'name')) {
+            errors.push(`${where}.credential: must contain only source and name; inline credentials are forbidden`);
+        }
         if (profile.defaultHarness !== undefined && !OBJECT_ID.test(profile.defaultHarness))
             errors.push(`${where}.defaultHarness: malformed UHP harness id`);
         if (profile.defaultModel !== undefined && !MODEL_ID.test(profile.defaultModel))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.8",
+  "version": "2026.10.9",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",