@cjhyy/code-shell-core 0.6.0-rc.16 → 0.6.0-rc.18

package/dist/engine/model-facade.js

@@ -30,7 +30,7 @@ export class ModelFacade {
         this.client = client;
         this.transcript = transcript;
     }
-    async call(systemPrompt, messages, tools, onStream, signal) {
+    async call(systemPrompt, messages, tools, onStream, signal, recordingOptions) {
         const startMs = Date.now();
         const msgCount = messages.length;
         const sid = getCurrentSid();
@@ -42,7 +42,7 @@ export class ModelFacade {
             // Image base64 payloads stay out of recorded prompts — see
             // logging/sanitize-messages.ts. Transcripts keep the full bytes
             // (needed for replay); logs do not.
-            messages: sanitizeMessages(messages),
+            messages: sanitizeMessages(messages, recordingOptions),
             tools,
             systemPrompt,
         }, reqId);
@@ -111,7 +111,7 @@ export class ModelFacade {
     /**
      * Call without streaming — used as fallback when streaming fails.
      */
-    async callWithoutStreaming(systemPrompt, messages, tools, signal) {
+    async callWithoutStreaming(systemPrompt, messages, tools, signal, recordingOptions) {
         const startMs = Date.now();
         const msgCount = messages.length;
         const sid = getCurrentSid();
@@ -122,7 +122,7 @@ export class ModelFacade {
             stream: false,
             // Image base64 payloads stay out of recorded prompts — same rule
             // as the streaming path above.
-            messages: sanitizeMessages(messages),
+            messages: sanitizeMessages(messages, recordingOptions),
             tools,
             systemPrompt,
         }, reqId);

package/dist/engine/parse-task.d.ts

@@ -29,6 +29,16 @@ export interface ParsedImage {
     dataUrl: string;
     /** Just the base64 payload, with the data-URL prefix stripped. */
     base64: string;
+    /** Stable on-disk path, usually cwd-relative for staged desktop attachments. */
+    path?: string;
+    /** Wire hash attr, usually `sha256:<hex>`. */
+    hash?: string;
+    /** Size in bytes from wire metadata. Core must still verify with stat when reading. */
+    size?: number;
+    /** Source channel that produced this attachment. */
+    origin?: string;
+    /** Session directory that owns the staged attachment. */
+    sessionId?: string;
 }
 export interface ParsedTask {
     /** Remaining plain-text portion (image blocks removed, surrounding whitespace trimmed). */

package/dist/engine/parse-task.js

@@ -117,6 +117,11 @@ export function parseTaskWithImages(task) {
             name: attrs.name ?? "",
             dataUrl: `data:${finalMime};base64,${base64}`,
             base64,
+            ...(attrs.path ? { path: attrs.path } : {}),
+            ...(attrs.hash ? { hash: attrs.hash } : {}),
+            ...(attrs.size && Number.isFinite(Number(attrs.size)) ? { size: Number(attrs.size) } : {}),
+            ...(attrs.origin ? { origin: attrs.origin } : {}),
+            ...(attrs.sessionid ? { sessionId: attrs.sessionid } : {}),
         });
         return "";
     });

package/dist/engine/streaming-tool-queue.d.ts

@@ -1,13 +1,16 @@
 /**
- * Streaming tool queue — enqueues tools for execution during streaming,
- * starts concurrency-safe tools immediately, queues unsafe tools for
- * sequential execution.
+ * Tool execution queue for a completed model response.
+ *
+ * Despite the historical name, TurnLoop currently enqueues tool calls only
+ * after `callModelWithFallback()` returns a complete LLMResponse. The queue's
+ * job is concurrency policy inside that post-response batch: start
+ * concurrency-safe tools as soon as they are enqueued, keep unsafe tools
+ * sequential, and return results in original tool-call order.
  *
  * Usage:
  *   const queue = new StreamingToolQueue(executor);
- *   // During streaming, as tool_use blocks arrive:
+ *   // After the full LLMResponse is available:
  *   queue.enqueue(toolCall);
- *   // After streaming completes:
  *   const results = await queue.drain();
  */
 import type { ToolCall, ToolResult } from "../types.js";
@@ -21,8 +24,9 @@ export declare class StreamingToolQueue {
     private draining;
     constructor(executor: ToolExecutor);
     /**
-     * Enqueue a tool for execution. Concurrency-safe tools start immediately;
-     * unsafe tools are queued for sequential execution during drain().
+     * Enqueue a tool from the completed response. Concurrency-safe tools start
+     * immediately within this post-response phase; unsafe tools are queued for
+     * sequential execution during drain().
      */
     enqueue(call: ToolCall): void;
     /**

package/dist/engine/streaming-tool-queue.js

@@ -1,13 +1,16 @@
 /**
- * Streaming tool queue — enqueues tools for execution during streaming,
- * starts concurrency-safe tools immediately, queues unsafe tools for
- * sequential execution.
+ * Tool execution queue for a completed model response.
+ *
+ * Despite the historical name, TurnLoop currently enqueues tool calls only
+ * after `callModelWithFallback()` returns a complete LLMResponse. The queue's
+ * job is concurrency policy inside that post-response batch: start
+ * concurrency-safe tools as soon as they are enqueued, keep unsafe tools
+ * sequential, and return results in original tool-call order.
  *
  * Usage:
  *   const queue = new StreamingToolQueue(executor);
- *   // During streaming, as tool_use blocks arrive:
+ *   // After the full LLMResponse is available:
  *   queue.enqueue(toolCall);
- *   // After streaming completes:
  *   const results = await queue.drain();
  */
 export class StreamingToolQueue {
@@ -21,8 +24,9 @@ export class StreamingToolQueue {
         this.executor = executor;
     }
     /**
-     * Enqueue a tool for execution. Concurrency-safe tools start immediately;
-     * unsafe tools are queued for sequential execution during drain().
+     * Enqueue a tool from the completed response. Concurrency-safe tools start
+     * immediately within this post-response phase; unsafe tools are queued for
+     * sequential execution during drain().
      */
     enqueue(call) {
         this.callOrder.push(call.id);

package/dist/engine/turn-loop.d.ts

@@ -143,6 +143,7 @@ export declare class TurnLoop {
     private lastCtxEmit;
     private currentTurnUsage;
     private currentCumulativeUsage;
+    private readonly sensitiveToolResultRedactions;
     private readonly pendingImageMessages;
     /**
      * Consecutive on_stop blocks (Goal mode kept the agent going). Reset to 0
@@ -203,6 +204,8 @@ export declare class TurnLoop {
     private markStopped;
     private prepareMessagesForModel;
     private markPendingImagesConsumed;
+    private redactConsumedSensitiveToolResults;
+    private modelCallRecordingOptions;
     private trackFreshImageMessage;
     private emitHook;
     /**
@@ -219,6 +222,7 @@ export declare class TurnLoop {
      * Run the multi-turn agent loop until completion.
      */
     run(initialMessages: Message[]): Promise<TurnLoopResult>;
+    private runUnredacted;
     /**
      * Call model with streaming fallback.
      * If streaming fails, emit tombstone and retry non-streaming.

package/dist/engine/turn-loop.js

@@ -17,6 +17,7 @@ import { isAbortError } from "../llm/client-base.js";
 import { crossedReactiveThreshold } from "./reactive-threshold.js";
 import { COMPLETE_GOAL_TOOL_NAME } from "../tool-system/builtin/complete-goal.js";
 import { CANCEL_GOAL_TOOL_NAME } from "../tool-system/builtin/cancel-goal.js";
+import { redactSensitiveToolResultsInMessages, toolResultForDisplay, toolResultTranscriptText, toolResultsForDisplay, } from "../tool-system/tool-result-redaction.js";
 import { addTokenUsage, cacheHitRateFromUsage, cumulativeCacheHitRate, } from "./session-usage.js";
 import { createGoalBudgetTracker, recordGoalUsage, goalBudgetExceeded, applyGoalExtension, limitProximity, GOAL_DEFAULT_MAX_STOP_BLOCKS, } from "./goal.js";
 /**
@@ -59,6 +60,7 @@ export class TurnLoop {
         cacheCreationTokens: 0,
     };
     currentCumulativeUsage;
+    sensitiveToolResultRedactions = new Map();
     pendingImageMessages = new Set();
     /**
      * Consecutive on_stop blocks (Goal mode kept the agent going). Reset to 0
@@ -237,6 +239,20 @@ export class TurnLoop {
         }
         return result.messages;
     }
+    redactConsumedSensitiveToolResults(messages) {
+        if (this.sensitiveToolResultRedactions.size === 0)
+            return messages;
+        const redacted = redactSensitiveToolResultsInMessages(messages, this.sensitiveToolResultRedactions);
+        this.sensitiveToolResultRedactions.clear();
+        return redacted;
+    }
+    modelCallRecordingOptions() {
+        if (this.sensitiveToolResultRedactions.size === 0)
+            return undefined;
+        return {
+            sensitiveToolResultRedactions: new Map(this.sensitiveToolResultRedactions),
+        };
+    }
     trackFreshImageMessage(message) {
         if (messageHasBase64ImagePayload(message)) {
             this.pendingImageMessages.add(message);
@@ -356,6 +372,10 @@ export class TurnLoop {
      * Run the multi-turn agent loop until completion.
      */
     async run(initialMessages) {
+        const result = await this.runUnredacted(initialMessages);
+        return { ...result, messages: this.redactConsumedSensitiveToolResults(result.messages) };
+    }
+    async runUnredacted(initialMessages) {
         let messages = [...initialMessages];
         let finalText = "";
         const budgetTracker = createBudgetTracker();
@@ -414,13 +434,18 @@ export class TurnLoop {
                 // returns; instead, each return-causing branch logs its own terminal
                 // event (model_error, completed, etc.).
                 const turnId = newTurnId();
+                const assistantMessageId = `assistant_${turnId}`;
                 const tlog = logger.child({ turn: this.turnCount, turnId });
                 this.currentTurnLog = tlog;
                 const turnStartedAt = Date.now();
                 tlog.info("turn.start", { cat: "turn", messageCount: messages.length });
                 // Tag downstream tool-exec / permission lines with this turn's IDs.
                 this.deps.toolExecutor.setLogger(tlog);
-                this.config.onStream?.({ type: "stream_request_start", turnNumber: this.turnCount });
+                this.config.onStream?.({
+                    type: "stream_request_start",
+                    turnNumber: this.turnCount,
+                    messageId: assistantMessageId,
+                });
                 const turnStartHook = await this.emitHook("on_turn_start", {
                     turnNumber: this.turnCount,
                 });
@@ -460,16 +485,25 @@ export class TurnLoop {
                 // Pre-check: downgrade image payloads that have already had their one
                 // model-consumption turn, then run context management. Fresh images in
                 // pendingImageMessages are preserved through this next model request.
+                const hasPendingSensitiveToolResults = this.sensitiveToolResultRedactions.size > 0;
                 messages = this.prepareMessagesForModel(messages);
-                // Context management (async — may trigger LLM summarization)
-                messages = await this.deps.contextManager.manageAsync(messages);
-                // manageAsync can itself issue an LLM summarization call lasting several
-                // seconds; if the signal aborted during it, stop here rather than
-                // proceeding into the (expensive) main model call. Belt to the loop-top
-                // brace: this catches an abort that landed *inside* context management.
-                if (this.config.signal?.aborted) {
-                    this.markStopped();
-                    return { text: finalText, reason: "aborted_streaming", messages };
+                if (hasPendingSensitiveToolResults) {
+                    tlog.info("turn.sensitive_tool_result_context_management_skipped", {
+                        cat: "turn",
+                        count: this.sensitiveToolResultRedactions.size,
+                    });
+                }
+                else {
+                    // Context management (async — may trigger LLM summarization)
+                    messages = await this.deps.contextManager.manageAsync(messages);
+                    // manageAsync can itself issue an LLM summarization call lasting several
+                    // seconds; if the signal aborted during it, stop here rather than
+                    // proceeding into the (expensive) main model call. Belt to the loop-top
+                    // brace: this catches an abort that landed *inside* context management.
+                    if (this.config.signal?.aborted) {
+                        this.markStopped();
+                        return { text: finalText, reason: "aborted_streaming", messages };
+                    }
                 }
                 // No pre-llm ctx emit here: the messages-only estimate would be ~16k
                 // smaller than the real prompt (system + tools not included), making
@@ -483,7 +517,9 @@ export class TurnLoop {
                 // call. Microcompact is lossless (just clearing redundant
                 // tool_results) so we suppress hook emits for it to keep token
                 // overhead down.
-                const pending = this.deps.consumePendingCompactInfo?.();
+                const pending = hasPendingSensitiveToolResults
+                    ? null
+                    : this.deps.consumePendingCompactInfo?.();
                 if (pending && pending.strategy !== "micro") {
                     const compactHook = await this.emitHook("post_compact", {
                         strategy: pending.strategy,
@@ -498,11 +534,12 @@ export class TurnLoop {
                 // Model call (with streaming fallback and max_output_tokens continuation)
                 // Track tool IDs streamed during this turn to avoid duplicate UI events
                 this.streamedToolIds.clear();
-                // Streaming tool queue: start concurrency-safe tools during streaming
+                // Tool queue is created before the call, but enqueue happens only after
+                // the complete LLMResponse is available below.
                 const streamingQueue = new StreamingToolQueue(this.deps.toolExecutor);
                 let response;
                 try {
-                    response = await this.callModelWithFallback(messages);
+                    response = await this.callModelWithFallback(messages, assistantMessageId);
                 }
                 catch (err) {
                     if (err instanceof ContextLimitError) {
@@ -513,13 +550,14 @@ export class TurnLoop {
                             tlog.warn("turn.ptl_recovery", { cat: "turn", retry, roundsToDrop: retry });
                             messages = dropOldestRounds(messages, retry);
                             try {
-                                response = await this.callModelWithFallback(messages);
+                                response = await this.callModelWithFallback(messages, assistantMessageId);
                                 recovered = true;
                                 break;
                             }
                             catch (retryErr) {
                                 if (!(retryErr instanceof ContextLimitError)) {
                                     this.config.onStream?.({ type: "error", error: formatFriendlyError(retryErr) });
+                                    messages = this.redactConsumedSensitiveToolResults(messages);
                                     return { text: finalText, reason: "model_error", messages };
                                 }
                             }
@@ -530,6 +568,7 @@ export class TurnLoop {
                                 type: "error",
                                 error: "Context limit exceeded after 3 recovery attempts",
                             });
+                            messages = this.redactConsumedSensitiveToolResults(messages);
                             return { text: finalText, reason: "prompt_too_long", messages };
                         }
                     }
@@ -543,14 +582,17 @@ export class TurnLoop {
                         // interrupted turn folds behind the process-card header on reload).
                         this.patchOrphanedToolUses(messages);
                         this.markStopped();
+                        messages = this.redactConsumedSensitiveToolResults(messages);
                         return { text: finalText, reason: "aborted_streaming", messages };
                     }
                     else {
                         this.patchOrphanedToolUses(messages);
                         this.config.onStream?.({ type: "error", error: formatFriendlyError(err) });
+                        messages = this.redactConsumedSensitiveToolResults(messages);
                         return { text: finalText, reason: "model_error", messages };
                     }
                 }
+                messages = this.redactConsumedSensitiveToolResults(messages);
                 // Record the response once into current-turn and whole-session counters.
                 if (response.usage?.promptTokens !== undefined) {
                     this.recordResponseUsage(response.usage);
@@ -659,6 +701,7 @@ export class TurnLoop {
                     });
                     this.config.onStream?.({
                         type: "assistant_message",
+                        messageId: assistantMessageId,
                         message: {
                             role: "assistant",
                             content: "（Goal 预算已耗尽，强制停止。）",
@@ -671,6 +714,7 @@ export class TurnLoop {
                     // No tool use — final answer
                     this.config.onStream?.({
                         type: "assistant_message",
+                        messageId: assistantMessageId,
                         message: { role: "assistant", content: finalText },
                     });
                     await this.emitHook("on_turn_end", {
@@ -746,6 +790,7 @@ export class TurnLoop {
                         });
                         this.config.onStream?.({
                             type: "assistant_message",
+                            messageId: assistantMessageId,
                             message: {
                                 role: "assistant",
                                 content: `（Goal 续跑已达 ${maxStopBlocks} 次上限，先停下。）`,
@@ -765,6 +810,7 @@ export class TurnLoop {
                     if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
                         continue;
                     }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
                 // Tool execution phase
@@ -809,8 +855,13 @@ export class TurnLoop {
                 const resultBlocks = [];
                 for (const result of results) {
                     resultBlocks.push(toolResultToBlock(result));
-                    this.deps.transcript.appendToolResult(result.id, result.toolName, result.result, result.error, result.contentBlocks);
-                    this.config.onStream?.({ type: "tool_result", result });
+                    const streamResult = toolResultForDisplay(result);
+                    const transcriptResult = toolResultTranscriptText(result);
+                    if (result.sensitive && transcriptResult !== undefined) {
+                        this.sensitiveToolResultRedactions.set(result.id, transcriptResult);
+                    }
+                    this.deps.transcript.appendToolResult(result.id, result.toolName, transcriptResult, result.error, result.sensitive ? undefined : result.contentBlocks);
+                    this.config.onStream?.({ type: "tool_result", result: streamResult });
                 }
                 // Fire-and-forget tool use summary (non-blocking). The whole chain is
                 // best-effort observability — a thrown onStream handler, a failed dynamic
@@ -821,9 +872,13 @@ export class TurnLoop {
                         .then(({ generateToolUseSummary }) => {
                         if (!this.deps.model.summarize)
                             return;
-                        return generateToolUseSummary(toolCalls, results, this.deps.model.summarize).then((summary) => {
+                        return generateToolUseSummary(toolCalls, toolResultsForDisplay(results), this.deps.model.summarize).then((summary) => {
                             if (summary) {
-                                this.config.onStream?.({ type: "tool_summary", summary });
+                                this.config.onStream?.({
+                                    type: "tool_summary",
+                                    summary,
+                                    toolCallIds: toolCalls.map((toolCall) => toolCall.id),
+                                });
                             }
                         });
                     })
@@ -878,6 +933,7 @@ export class TurnLoop {
                     if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
                         continue;
                     }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
                 // Goal mode: user-initiated cancellation. cancel_goal is the "strong
@@ -906,12 +962,14 @@ export class TurnLoop {
                     });
                     this.config.onStream?.({
                         type: "assistant_message",
+                        messageId: assistantMessageId,
                         message: { role: "assistant", content: finalText },
                     });
                     messages.push({ role: "assistant", content: finalText });
                     if (this.consumeQueuedSteer(messages, "finalize_backfill")) {
                         continue;
                     }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
                     return { text: finalText, reason: "completed", messages };
                 }
                 if (budgetDecision === "nudge") {
@@ -972,6 +1030,7 @@ export class TurnLoop {
             // no error event, so the UI shows only the "你停止了本轮" line.
             if (isAbortError(err) || this.config.signal?.aborted) {
                 this.markStopped();
+                messages = this.redactConsumedSensitiveToolResults(messages);
                 return { text: finalText, reason: "aborted_streaming", messages };
             }
             this.currentTurnLog.error("turn.unhandled_error", {
@@ -980,6 +1039,7 @@ export class TurnLoop {
                 stack: err.stack?.split("\n").slice(0, 4).join("\n"),
             });
             this.config.onStream?.({ type: "error", error: formatFriendlyError(err) });
+            messages = this.redactConsumedSensitiveToolResults(messages);
             return { text: finalText, reason: "model_error", messages };
         }
         // Max turns reached — do one final summarization call (no tools)
@@ -989,8 +1049,18 @@ export class TurnLoop {
             turnCount: this.turnCount,
         });
         this.consumeQueuedSteer(messages, "finalize_backfill");
+        const hasPendingSensitiveToolResults = this.sensitiveToolResultRedactions.size > 0;
         messages = this.prepareMessagesForModel(messages);
-        messages = this.deps.contextManager.manage(messages);
+        if (hasPendingSensitiveToolResults) {
+            logger.info("turn.sensitive_tool_result_context_management_skipped", {
+                cat: "turn",
+                count: this.sensitiveToolResultRedactions.size,
+                phase: "max_turns_summary",
+            });
+        }
+        else {
+            messages = this.deps.contextManager.manage(messages);
+        }
         messages.push({
             role: "user",
             content: "<system-reminder>Turn limit reached. Provide a final summary of what you accomplished and what remains to be done. Do NOT call any tools.</system-reminder>",
@@ -998,7 +1068,7 @@ export class TurnLoop {
         this.emitCtxFromMessages(messages);
         try {
             const summaryResponse = await this.deps.model.call(this.deps.systemPrompt, this.prepareMessagesForModel(messages), [], // No tools available for summary turn
-            this.config.onStream, this.config.signal);
+            this.config.onStream, this.config.signal, this.modelCallRecordingOptions());
             messages = this.markPendingImagesConsumed(messages);
             if (summaryResponse.text) {
                 finalText = summaryResponse.text;
@@ -1015,14 +1085,14 @@ export class TurnLoop {
             });
             messages.push({ role: "assistant", content: finalText });
         }
-        this.config.onStream?.({ type: "turn_complete", reason: "max_turns" });
+        messages = this.redactConsumedSensitiveToolResults(messages);
         return { text: finalText, reason: "max_turns", messages };
     }
     /**
      * Call model with streaming fallback.
      * If streaming fails, emit tombstone and retry non-streaming.
      */
-    async callModelWithFallback(messages) {
+    async callModelWithFallback(messages, assistantMessageId) {
         // Wrap stream callback to track tool_use_start events and reactive compaction
         let streamingResponseTokens = 0;
         let reactiveBucket = -1;
@@ -1054,7 +1124,7 @@ export class TurnLoop {
             }
             : undefined;
         try {
-            return await this.deps.model.call(this.deps.systemPrompt, messages, this.deps.tools, wrappedStream, this.config.signal);
+            return await this.deps.model.call(this.deps.systemPrompt, messages, this.deps.tools, wrappedStream, this.config.signal, this.modelCallRecordingOptions());
         }
         catch (err) {
             // If it's a context or rate limit error, don't fallback — propagate
@@ -1074,14 +1144,25 @@ export class TurnLoop {
             // really just a cancel. The signal is the authoritative cancel source.
             if (isAbortError(err) || this.config.signal?.aborted)
                 throw err;
+            // Sensitive tool results are model-facing exactly once. A streaming
+            // fallback would re-send the same pending plaintext in a second request,
+            // so fail the turn and let the unified exit redact returned history.
+            if (this.sensitiveToolResultRedactions.size > 0) {
+                this.config.onStream?.({ type: "tombstone", messageId: assistantMessageId });
+                this.currentTurnLog.warn("turn.streaming_fallback_skipped_sensitive", {
+                    cat: "turn",
+                    error: err.message,
+                });
+                throw err;
+            }
             // Streaming might have partially emitted — send tombstone to revoke
-            this.config.onStream?.({ type: "tombstone", messageId: `turn_${this.turnCount}` });
+            this.config.onStream?.({ type: "tombstone", messageId: assistantMessageId });
             this.currentTurnLog.warn("turn.streaming_fallback", {
                 cat: "turn",
                 error: err.message,
             });
             // Retry without streaming
-            return await this.deps.model.callWithoutStreaming(this.deps.systemPrompt, messages, this.deps.tools, this.config.signal);
+            return await this.deps.model.callWithoutStreaming(this.deps.systemPrompt, messages, this.deps.tools, this.config.signal, this.modelCallRecordingOptions());
         }
     }
     get currentTurn() {

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export declare const VERSION = "0.6.0-rc.15";
+export declare const VERSION = "0.6.0-rc.18";
 export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionWorkspace, ContextUsageAnchor, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 export { Engine, loadAgentDefinitionsForCwd } from "./engine/engine.js";
@@ -109,7 +109,7 @@ export { migrateConfig, configVersionOf, CURRENT_CONFIG_VERSION, type MigrationS
 export { SettingsSchema, validateSettings } from "./settings/schema.js";
 export { settingsJsonSchema, writeSettingsSchemaFile } from "./settings/schema-export.js";
 export { personalizationFrom, type PersonalizationConfig } from "./settings/personalization.js";
-export { CredentialStore, type CredentialScope, type MaskedCredential, type Credential, type CredentialType, type CredentialStoreFile, formatNetscapeCookies, parseCookieJar, type CookieLike, useCredentialToolDef, useCredentialToolDefFor, sweepStaleCredentialCookies, type EncryptionCipher, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./credentials/index.js";
+export { CredentialStore, type CredentialScope, type MaskedCredential, type Credential, type CredentialType, type CredentialStoreFile, formatNetscapeCookies, parseCookieJar, type CookieLike, useCredentialToolDef, useCredentialToolDefFor, sweepStaleCredentialCookies, getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, type CredentialAccess, type CredentialAccessScope, type CredentialMetadata, type CredentialSnapshot, type CredentialSnapshotEntry, type EncryptionCipher, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./credentials/index.js";
 /** @internal Shared with the in-repo TUI/desktop hosts; not stable SDK surface. */
 export { getSessionId, switchSession, getOriginalCwd, setOriginalCwd, getProjectRoot, setProjectRoot, getCwdState, getIsInteractive, updateLastInteractionTime, flushInteractionTime, markScrollActivity, type AttributedCounter, type ChannelEntry, } from "./state.js";
 /** @internal Shared primitives for the in-repo TUI/desktop hosts; not stable SDK surface. */

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.6.0-rc.15";
+export const VERSION = "0.6.0-rc.18";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Engine (primary API) ────────────────────────────────────────
@@ -127,7 +127,7 @@ export { migrateConfig, configVersionOf, CURRENT_CONFIG_VERSION, } from "./setti
 export { SettingsSchema, validateSettings } from "./settings/schema.js";
 export { settingsJsonSchema, writeSettingsSchemaFile } from "./settings/schema-export.js";
 export { personalizationFrom } from "./settings/personalization.js";
-export { CredentialStore, formatNetscapeCookies, parseCookieJar, useCredentialToolDef, useCredentialToolDefFor, sweepStaleCredentialCookies, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./credentials/index.js";
+export { CredentialStore, formatNetscapeCookies, parseCookieJar, useCredentialToolDef, useCredentialToolDefFor, sweepStaleCredentialCookies, getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./credentials/index.js";
 // ─── State (runtime singletons shared with TUI) ──────────────────
 /** @internal Shared with the in-repo TUI/desktop hosts; not stable SDK surface. */
 export { getSessionId, switchSession, getOriginalCwd, setOriginalCwd, getProjectRoot, setProjectRoot, getCwdState, getIsInteractive, updateLastInteractionTime, flushInteractionTime, markScrollActivity, } from "./state.js";

package/dist/logging/sanitize-messages.d.ts

@@ -21,17 +21,25 @@
  * pure-text turns pay essentially nothing on the fast path.
  */
 import type { Message } from "../types.js";
+export interface SanitizeMessagesOptions {
+    /**
+     * Tool-result IDs whose model-facing plaintext must be replaced before the
+     * request is written to any recorder/log sink. The original messages still
+     * go to the provider; this option is only for diagnostic copies.
+     */
+    sensitiveToolResultRedactions?: ReadonlyMap<string, string>;
+}
 /**
  * Walk a single message's content and replace image-payload blocks with
  * metadata stubs. Returns a new value — the input is not mutated.
  */
-export declare function sanitizeContent(content: Message["content"]): Message["content"];
+export declare function sanitizeContent(content: Message["content"], options?: SanitizeMessagesOptions): Message["content"];
 /**
  * Walk a {@link Message}[] array and sanitize every entry's content.
  * Returns the *same* array reference when no message held an image (fast
  * path for the overwhelmingly common pure-text case).
  */
-export declare function sanitizeMessages(messages: readonly Message[]): Message[];
+export declare function sanitizeMessages(messages: readonly Message[], options?: SanitizeMessagesOptions): Message[];
 /**
  * Recursively walk a value and return a *new* value with secret-looking
  * fields replaced by "[redacted]". Used by the logger (so anything ending up

package/dist/logging/sanitize-messages.js

@@ -75,19 +75,28 @@ function sanitizeImageUrlPart(part) {
         image_url: {
             // Keep the data-URL header so reviewers can see the MIME, but strip
             // the payload. "data:image/png;base64,<omitted, 12345 bytes>"
-            url: comma === -1
-                ? url
-                : `${url.slice(0, comma + 1)}<omitted, ${payloadLen} bytes>`,
+            url: comma === -1 ? url : `${url.slice(0, comma + 1)}<omitted, ${payloadLen} bytes>`,
             omitted: true,
             bytes: payloadLen,
         },
     };
 }
+function getSensitiveToolResultReplacement(block, options) {
+    const redactions = options?.sensitiveToolResultRedactions;
+    if (!redactions || redactions.size === 0)
+        return undefined;
+    if (!block || typeof block !== "object")
+        return undefined;
+    const b = block;
+    if (b.type !== "tool_result" || typeof b.tool_use_id !== "string")
+        return undefined;
+    return redactions.get(b.tool_use_id);
+}
 /**
  * Walk a single message's content and replace image-payload blocks with
  * metadata stubs. Returns a new value — the input is not mutated.
  */
-export function sanitizeContent(content) {
+export function sanitizeContent(content, options) {
     if (typeof content === "string")
         return content;
     if (!Array.isArray(content))
@@ -95,6 +104,12 @@ export function sanitizeContent(content) {
     let touched = false;
     const out = [];
     for (const block of content) {
+        const sensitiveReplacement = getSensitiveToolResultReplacement(block, options);
+        if (sensitiveReplacement !== undefined) {
+            out.push({ ...block, content: sensitiveReplacement });
+            touched = true;
+            continue;
+        }
         if (isImageBlock(block)) {
             out.push(sanitizeImageBlock(block));
             touched = true;
@@ -114,11 +129,11 @@ export function sanitizeContent(content) {
  * Returns the *same* array reference when no message held an image (fast
  * path for the overwhelmingly common pure-text case).
  */
-export function sanitizeMessages(messages) {
+export function sanitizeMessages(messages, options) {
     let touched = false;
     const out = [];
     for (const m of messages) {
-        const sanitized = sanitizeContent(m.content);
+        const sanitized = sanitizeContent(m.content, options);
         if (sanitized !== m.content) {
             touched = true;
             out.push({ ...m, content: sanitized });