@cohortapp/agent-sdk 2.11.15 → 2.12.0

package/lib/setup/sections/model.test.mjs

@@ -0,0 +1,240 @@
+/**
+ * model.test.mjs — model/provider setup section (order 30) tests.
+ *
+ * The oauth-token mode is the fleet DEFAULT (§3.9): the operator pastes the
+ * output of `claude setup-token`, headless reads CLAUDE_CODE_OAUTH_TOKEN from
+ * the environment, and .env ends up 0600 with the token + the prefer flag.
+ *
+ * Run: node --test lib/setup/sections/model.test.mjs
+ */
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync, statSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import model, { AUTH_MODES, DEFAULT_AUTH_MODE } from "./model.mjs";
+import * as io from "../io.mjs";
+
+const MAESTRO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+
+function tmpRoot(envBody) {
+  const root = mkdtempSync(join(tmpdir(), "maestro-modelsec-"));
+  if (envBody !== undefined) writeFileSync(join(root, ".env"), envBody);
+  return root;
+}
+function ctxFor(root, answers = {}, extra = {}) {
+  return { agentRoot: root, maestroRoot: MAESTRO_ROOT, flags: { headless: true }, headless: true, answers, io, ...extra };
+}
+function readEnv(root) { return readFileSync(join(root, ".env"), "utf-8"); }
+function withEnv(patch, fn) {
+  const saved = {};
+  for (const k of Object.keys(patch)) { saved[k] = process.env[k]; if (patch[k] === undefined) delete process.env[k]; else process.env[k] = patch[k]; }
+  return Promise.resolve().then(fn).finally(() => {
+    for (const k of Object.keys(patch)) { if (saved[k] === undefined) delete process.env[k]; else process.env[k] = saved[k]; }
+  });
+}
+
+test("section shape: id/order=30/hooks; oauth-token is the default of three modes", () => {
+  assert.equal(model.id, "model");
+  assert.equal(model.order, 30);
+  for (const h of ["detect", "prompt", "apply", "verify"]) assert.equal(typeof model[h], "function");
+  assert.deepEqual([...AUTH_MODES], ["oauth-token", "subscription", "api-key"]);
+  assert.equal(DEFAULT_AUTH_MODE, "oauth-token");
+});
+
+test("headless with no answers: provider defaults to oauth-token and the token is read from CLAUDE_CODE_OAUTH_TOKEN", async () => {
+  const root = tmpRoot("");
+  try {
+    await withEnv({ CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-fromenv" }, async () => {
+      const ctx = ctxFor(root);
+      await model.prompt(ctx);
+      assert.equal(ctx.answers.model.provider, "oauth-token");
+      assert.equal(ctx.answers.model.hasToken, true);
+      assert.equal(ctx.answers.claudeOauthToken, "sk-ant-oat01-fromenv", "the value lives under the key the checkpoint redacts, never under answers.model");
+      await model.apply(ctx);
+    });
+    const env = readEnv(root);
+    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-fromenv$/m);
+    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
+    assert.doesNotMatch(env, /^ANTHROPIC_API_KEY=/m);
+    assert.equal(statSync(join(root, ".env")).mode & 0o777, 0o600, ".env is chmod 600 after apply");
+    const d = await model.detect(ctxFor(root));
+    assert.equal(d.status, "complete");
+    assert.match(d.summary, /OAuth token/i);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("the prompt copy tells the operator to run `claude setup-token` on any machine and paste the result", async () => {
+  const root = tmpRoot("");
+  try {
+    const seen = [];
+    const spyIo = {
+      ...io,
+      select: async (_ctx, opts) => { seen.push(opts); return opts.default; },
+      secret: async (_ctx, opts) => { seen.push(opts); return "pasted-token"; },
+      confirm: async (_ctx, opts) => { seen.push(opts); return false; },
+    };
+    const ctx = ctxFor(root, {}, { io: spyIo });
+    await model.prompt(ctx);
+    const select = seen.find((o) => o.key === "provider");
+    assert.ok(select, "the provider select ran");
+    assert.equal(select.default, "oauth-token");
+    const tokenChoice = select.choices.find((c) => c.value === "oauth-token");
+    assert.match(tokenChoice.label, /claude setup-token/);
+    const secret = seen.find((o) => o.key === "claudeOauthToken");
+    assert.ok(secret, "the token secret prompt ran");
+    assert.match(secret.message, /claude setup-token/);
+    assert.match(secret.message, /any machine/i);
+    assert.match(secret.message, /paste/i);
+    assert.equal(secret.env, "CLAUDE_CODE_OAUTH_TOKEN");
+    assert.equal(ctx.answers.claudeOauthToken, "pasted-token");
+    assert.equal(ctx.answers.model.hasToken, true);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("apply is idempotent and never clobbers an existing token", async () => {
+  const root = tmpRoot("CLAUDE_CODE_OAUTH_TOKEN=old-token\n");
+  try {
+    const ctx = ctxFor(root, { provider: "oauth-token", claudeOauthToken: "new-token" });
+    await model.prompt(ctx);
+    await model.apply(ctx);
+    await model.apply(ctx);
+    const env = readEnv(root);
+    assert.equal((env.match(/^CLAUDE_CODE_OAUTH_TOKEN=/gm) || []).length, 1);
+    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=old-token$/m);
+    assert.equal((env.match(/^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/gm) || []).length, 1);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("oauth-token chosen but no token available: still writes the prefer flag, detect reports keychain mode", async () => {
+  const root = tmpRoot("");
+  try {
+    await withEnv({ CLAUDE_CODE_OAUTH_TOKEN: undefined }, async () => {
+      const ctx = ctxFor(root);
+      await model.prompt(ctx);
+      await model.apply(ctx);
+    });
+    const env = readEnv(root);
+    assert.doesNotMatch(env, /^CLAUDE_CODE_OAUTH_TOKEN=/m);
+    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
+    const d = await model.detect(ctxFor(root));
+    assert.equal(d.status, "complete");
+    assert.match(d.summary, /keychain/i);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("subscription (keychain) and api-key modes keep working", async () => {
+  const a = tmpRoot("");
+  const b = tmpRoot(undefined); // no .env at all → created 0600
+  try {
+    const ca = ctxFor(a, { provider: "subscription" });
+    await model.prompt(ca); await model.apply(ca);
+    assert.match(readEnv(a), /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
+    assert.doesNotMatch(readEnv(a), /^CLAUDE_CODE_OAUTH_TOKEN=/m);
+
+    const cb = ctxFor(b, { provider: "api-key", anthropicApiKey: "sk-ant-api03-x" });
+    await model.prompt(cb); await model.apply(cb);
+    assert.ok(existsSync(join(b, ".env")));
+    assert.match(readEnv(b), /^ANTHROPIC_API_KEY=sk-ant-api03-x$/m);
+    assert.doesNotMatch(readEnv(b), /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=/m);
+    assert.equal(statSync(join(b, ".env")).mode & 0o777, 0o600);
+    const d = await model.detect(ctxFor(b));
+    assert.match(d.summary, /API key/);
+  } finally { rmSync(a, { recursive: true, force: true }); rmSync(b, { recursive: true, force: true }); }
+});
+
+test("legacy flat answers (no answers.model) still resolve; a bare token answer implies oauth-token", async () => {
+  const root = tmpRoot("");
+  try {
+    const ctx = ctxFor(root, { claudeOauthToken: "flat-token" });
+    await model.apply(ctx); // no prompt() — the headless resume path
+    const env = readEnv(root);
+    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=flat-token$/m);
+    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("verify uses the injectable probe (ctx.deps.probeClaude) and surfaces auth + detail", async () => {
+  const root = tmpRoot("CLAUDE_CODE_OAUTH_TOKEN=t\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
+  try {
+    const seen = [];
+    const probeClaude = (agentRoot) => { seen.push(agentRoot); return { ok: true, mode: "subscription", auth: "unknown", name: "Claude auth", detail: "could not verify" }; };
+    const r = await model.verify(ctxFor(root, {}, { deps: { probeClaude } }));
+    assert.deepEqual(seen, [root]);
+    assert.equal(r.ok, true);
+    assert.equal(r.checks[0].auth, "unknown");
+    assert.equal(r.checks[0].detail, "could not verify");
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+// ---------------------------------------------------------------------------
+// Review 2026-09-08 findings
+// ---------------------------------------------------------------------------
+
+test("a .env seeded from .env.example (empty `KEY=` lines) is FILLED IN, not treated as already set", async () => {
+  // .env.example ships `CLAUDE_CODE_OAUTH_TOKEN=` and `MAESTRO_PREFER_SUBSCRIPTION_AUTH=`
+  // as empty placeholders, and doctor's remedy is "copy from .env.example" —
+  // so this is the common path, and it used to leave the seat with no auth.
+  const root = tmpRoot(readFileSync(join(MAESTRO_ROOT, ".env.example"), "utf-8"));
+  try {
+    await withEnv({ CLAUDE_CODE_OAUTH_TOKEN: undefined }, async () => {
+      const ctx = ctxFor(root, { provider: "oauth-token", claudeOauthToken: "sk-ant-oat01-REAL" });
+      await model.prompt(ctx);
+      await model.apply(ctx);
+    });
+    const env = readEnv(root);
+    assert.match(env, /^CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-REAL$/m);
+    assert.equal((env.match(/^CLAUDE_CODE_OAUTH_TOKEN=/gm) || []).length, 1, "the placeholder line is replaced in place, not duplicated");
+    assert.match(env, /^MAESTRO_PREFER_SUBSCRIPTION_AUTH=1$/m);
+    assert.equal((env.match(/^MAESTRO_PREFER_SUBSCRIPTION_AUTH=/gm) || []).length, 1);
+    const d = await model.detect(ctxFor(root));
+    assert.equal(d.status, "complete");
+    assert.match(d.summary, /OAuth token/i);
+    // The api-key lane had the same latent bug.
+    const b = tmpRoot("ANTHROPIC_API_KEY=\n");
+    try {
+      const cb = ctxFor(b, { provider: "api-key", anthropicApiKey: "sk-ant-api03-x" });
+      await model.prompt(cb); await model.apply(cb);
+      assert.match(readEnv(b), /^ANTHROPIC_API_KEY=sk-ant-api03-x$/m);
+      assert.equal((readEnv(b).match(/^ANTHROPIC_API_KEY=/gm) || []).length, 1);
+    } finally { rmSync(b, { recursive: true, force: true }); }
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("the pasted token and API key never sit in ctx.answers.model — nothing for progress.json to leak", async () => {
+  const root = tmpRoot("");
+  try {
+    const spyIo = {
+      ...io,
+      select: async (_ctx, opts) => opts.default,
+      secret: async (_ctx, _opts) => "sk-ant-oat01-PASTED",
+      confirm: async () => false,
+    };
+    const ctx = ctxFor(root, {}, { io: spyIo });
+    await model.prompt(ctx);
+    const flat = JSON.stringify(ctx.answers.model);
+    assert.doesNotMatch(flat, /PASTED/, "answers.model carries no credential value");
+    assert.equal(ctx.answers.model.provider, "oauth-token");
+    assert.equal(ctx.answers.model.hasToken, true);
+    // The secret lives under its own top-level key, which the checkpoint's
+    // SECRET_ANSWER_KEY_RE already strips on every save.
+    assert.equal(ctx.answers.claudeOauthToken, "sk-ant-oat01-PASTED");
+    await model.apply(ctx);
+    assert.match(readEnv(root), /^CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-PASTED$/m);
+
+    const b = tmpRoot("");
+    try {
+      const spyB = { ...spyIo, select: async () => "api-key", secret: async () => "sk-ant-api03-PASTED" };
+      const cb = ctxFor(b, {}, { io: spyB });
+      await model.prompt(cb);
+      assert.doesNotMatch(JSON.stringify(cb.answers.model), /PASTED/);
+      assert.equal(cb.answers.anthropicApiKey, "sk-ant-api03-PASTED");
+      await model.apply(cb);
+      assert.match(readEnv(b), /^ANTHROPIC_API_KEY=sk-ant-api03-PASTED$/m);
+    } finally { rmSync(b, { recursive: true, force: true }); }
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});

package/lib/setup/sections/org.mjs

@@ -35,6 +35,7 @@ import { mergeAgentJson, readAgentJson } from "../sot.mjs";
 import { cohortPullEnv, pullAndPlan } from "../enroll-from-cohort.mjs";
 import { bootstrapAndPersist } from "../../org/bootstrap-context.mjs";
 import { runGenerator } from "../run-generator.mjs";
+import { looksLikeOrgId } from "../../cli/doctor-checks.mjs";
 
 const CONFIG_REL = join("config", "org.yaml");
 
@@ -332,7 +333,9 @@ export default {
     });
     ctx.answers.orgBase = base;
     if (!base) return;
-    ctx.answers.orgId = await io.text(ctx, { message: "Org id / slug (optional)", key: "orgId", env: "COHORT_ORG_ID", default: "" });
+    ctx.answers.orgId = await io.text(ctx, { message: "Org ID (optional — the ID, org_default_<slug>, NOT the slug)", key: "orgId", env: "COHORT_ORG_ID", default: "" });
+    const idWarning = orgIdWarning(ctx.answers.orgId);
+    if (idWarning) io.note(`  ⚠ ${idWarning}`, { dim: false });
 
     // Two honest credential lanes (hq now ships pairing.request/approve):
     //   apikey  — an admin mints an org API key (Bearer) which you paste here.
@@ -442,12 +445,20 @@ export default {
     checks.push({ name: "config/org.yaml present", ok: cfgPresent, remedy: cfgPresent ? undefined : "run `maestro setup --only org`" });
 
     const cfg = await readOrgConfig(ctx.agentRoot);
+    // F2: the org-ID pin is compared by hq with strict equality against the
+    // org ID; the slug 401s every call. Judged here (the wizard's own gate)
+    // as well as by doctor, so a slug never survives setup unremarked.
+    const pin = String((cfg && cfg.org && cfg.org.cohort && cfg.org.cohort.orgId) || "").trim();
+    if (pin) {
+      const w = orgIdWarning(pin);
+      checks.push({ name: "COHORT_ORG_ID is the org ID (not the slug)", ok: !w, remedy: w || undefined });
+    }
     const enabled = isEnabled(cfg);
     if (!enabled) {
       // Org enrollment is OPTIONAL — a not-yet-enrolled agent WARNs (remedy shown)
       // but does not hard-fail setup. ok=true so the agent can run standalone.
       checks.push({ name: "org knowledge plane (not enrolled — optional)", ok: true, remedy: "set org.cohort.base + token in config/org.yaml, or pair with the org admin" });
-      return { ok: true, checks };
+      return { ok: checks.every((c) => c.ok), checks };
     }
 
     // Best-effort, NON-BLOCKING reachability probe. A GET /v1/snapshot round-trips
@@ -473,3 +484,17 @@ export default {
     return { ok: checks.every((c) => c.ok), checks };
   },
 };
+
+/**
+ * F2: is this COHORT_ORG_ID value the org SLUG rather than the org ID? Pure.
+ * hq compares the `x-org-id` pin with strict equality against the org ID
+ * (`org_default_<slug>`), so a slug 401s every call the agent makes — and the
+ * wizard used to invite exactly that with "Org id / slug (optional)".
+ * @param {string} value
+ * @returns {string|null} a warning naming the likely ID, or null when fine/blank
+ */
+export function orgIdWarning(value) {
+  const v = String(value || "").trim();
+  if (!v || looksLikeOrgId(v)) return null;
+  return `COHORT_ORG_ID=${v} looks like the org SLUG — hq compares the pin strictly against the org ID (org_default_<slug>), so every call would 401. Use the ID, probably org_default_${v.toLowerCase()} (Cohort → Settings shows it); \`maestro doctor\` checks it against the server.`;
+}

package/lib/setup/sections/org.test.mjs

@@ -6,13 +6,13 @@
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { mkdtempSync, existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import yaml from "js-yaml";
 
-import org, { buildOrgConfig, readOrgConfig, pullProfileIntoAgentConfig, orgContextShapesBacklog, requestPairing, deriveAgentIdentity } from "./org.mjs";
+import org, { buildOrgConfig, readOrgConfig, pullProfileIntoAgentConfig, orgContextShapesBacklog, requestPairing, deriveAgentIdentity, orgIdWarning } from "./org.mjs";
 import { isEnabled } from "../../org/client.mjs";
 import { readAgentJson, writeAgentJson } from "../sot.mjs";
 import * as io from "../io.mjs";
@@ -311,3 +311,36 @@ test("verify does NOT block / hard-fail on an unreachable enabled server (fail-o
   assert.ok(reach, "a reachability check is recorded");
   assert.equal(reach.ok, true, "reachability must never hard-fail setup");
 });
+
+// ---------------------------------------------------------------------------
+// F2 (audit 2026-09-08): the wizard must not silently accept the org SLUG as
+// COHORT_ORG_ID — hq compares the pin with strict equality against the org ID
+// (`org_default_<slug>`), so a slug 401s every call.
+// ---------------------------------------------------------------------------
+
+test("orgIdWarning: a slug-shaped value gets a warning naming the ID form; an ID or blank gets none", () => {
+  assert.equal(orgIdWarning(""), null);
+  assert.equal(orgIdWarning("org_default_acme"), null);
+  const w = orgIdWarning("acme");
+  assert.match(w, /slug/i);
+  assert.match(w, /org_default_acme/);
+  assert.match(w, /401/);
+});
+
+test("verify: a slug-shaped orgId in config/org.yaml is a failing check with the remedy; the ID form passes", async () => {
+  const root = tmpRoot();
+  try {
+    await org.apply(ctxFor(root, { orgBase: "https://cohort.example", orgId: "acme", orgToken: "tok-123" }));
+    const bad = await org.verify(ctxFor(root));
+    const shape = bad.checks.find((c) => /COHORT_ORG_ID/.test(c.name));
+    assert.ok(shape, "the shape check ran");
+    assert.equal(shape.ok, false);
+    assert.match(shape.remedy, /org_default_acme/);
+    assert.equal(bad.ok, false);
+
+    writeFileSync(join(root, "config", "org.yaml"), "org:\n  cohort:\n    enabled: true\n    base: https://cohort.example\n    orgId: org_default_acme\n    token: tok-123\n");
+    const good = await org.verify(ctxFor(root));
+    const shape2 = good.checks.find((c) => /COHORT_ORG_ID/.test(c.name));
+    assert.ok(shape2 && shape2.ok === true, "the ID form is accepted");
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});

package/lib/setup/sections/verify.mjs

@@ -209,10 +209,15 @@ export default {
       const where = r.section ? ` [${r.section}]` : "";
       io.note(`${mark} ${r.name}${where}`);
       if (!r.ok && r.remedy) io.note(`      ↳ ${r.remedy}`, { dim: true });
+      else if (r.ok && r.detail) io.note(`      ↳ ${r.detail}`, { dim: true });
     }
     if (result.probe && !result.probe.ok && result.probe.remedy) {
       io.note(`  ✗ ${result.probe.name}`);
       io.note(`      ↳ ${result.probe.remedy}`, { dim: true });
+    } else if (result.probe && result.probe.ok && result.probe.detail) {
+      // Fail-open outcomes (auth "unknown") pass the gate but are never silent.
+      io.note(`  ✓ ${result.probe.name}`);
+      io.note(`      ↳ ${result.probe.detail}`, { dim: true });
     }
   },
 };

package/lib/setup/state.mjs

@@ -63,29 +63,49 @@ export const SECRET_ANSWER_KEY_RE =
  * actually lives.
  *
  * The dropped key names are recorded on `_redacted` so the file still SAYS what
- * was removed. Names are not secrets; values are.
+ * was removed. Names are not secrets; values are. The scan RECURSES: section
+ * bags (`answers.model`, …) are objects, and a credential nested one level
+ * down is exactly as leaked as a top-level one.
  *
  * @param {object|null|undefined} answers
  * @returns {{answers:object, redacted:string[]}}
  */
 export function redactSecretAnswers(answers) {
   const src = answers && typeof answers === "object" ? answers : {};
-  const out = {};
   const redacted = [];
-  for (const [k, v] of Object.entries(src)) {
-    if (k === "_redacted") continue;
-    if (SECRET_ANSWER_KEY_RE.test(k) && typeof v === "string" && v) {
-      redacted.push(k);
-      continue;
-    }
-    out[k] = v;
-  }
+  const out = redactInto(src, "", redacted);
+  delete out._redacted;
   const prior = Array.isArray(src._redacted) ? src._redacted : [];
   const all = [...new Set([...prior, ...redacted])].sort();
   if (all.length) out._redacted = all;
   return { answers: out, redacted };
 }
 
+/**
+ * The recursive walk behind redactSecretAnswers. Sections keep their own bag
+ * under `answers.<section>` (e.g. `answers.model = {provider, …}`), so a
+ * credential one level down used to sail past a top-level-only scan and land
+ * in the 0644 checkpoint — the .env was chmod 600 for nothing. Every object at
+ * every depth is scanned; arrays are walked element-wise (a dropped key inside
+ * an element leaves the element in place so indices stay stable). Dotted
+ * paths (`model.oauthToken`) go on `_redacted` so the file still says what
+ * was removed.
+ */
+function redactInto(value, path, redacted) {
+  if (Array.isArray(value)) return value.map((v, i) => redactInto(v, `${path}[${i}]`, redacted));
+  if (value === null || typeof value !== "object") return value;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    const full = path ? `${path}.${k}` : k;
+    if (SECRET_ANSWER_KEY_RE.test(k) && typeof v === "string" && v) {
+      redacted.push(full);
+      continue;
+    }
+    out[k] = redactInto(v, full, redacted);
+  }
+  return out;
+}
+
 /** Absolute path to the progress file for an agent root. */
 export function progressPath(agentRoot) {
   return join(agentRoot, PROGRESS_REL);

package/lib/setup/state.test.mjs

@@ -8,7 +8,7 @@
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync, mkdirSync, existsSync, readFileSync } from "node:fs";
+import { mkdtempSync, writeFileSync, mkdirSync, existsSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -90,3 +90,26 @@ test("mergeAnswers updates without disturbing sections", () => {
   assert.equal(p.answers.tone, "warm");
   assert.equal(p.sections.identity.status, "complete");
 });
+
+test("redactSecretAnswers recurses: a credential nested under a section bag never reaches progress.json", () => {
+  const root = mkdtempSync(join(tmpdir(), "setup-state-nested-"));
+  try {
+    mergeAnswers(root, {
+      claudeOauthToken: "sk-ant-oat01-FLAT",
+      model: { provider: "oauth-token", oauthToken: "sk-ant-oat01-NESTED", apiKey: "sk-ant-api03-NESTED", routing: false },
+      deep: { a: { b: { apiKey: "sk-deep" } }, keep: "yes" },
+      list: [{ token: "in-a-list" }, "plain"],
+    });
+    const raw = readFileSync(progressPath(root), "utf-8");
+    assert.doesNotMatch(raw, /FLAT|NESTED|sk-deep|in-a-list/, "no credential value on disk at any depth");
+    const p = loadProgress(root);
+    assert.equal(p.answers.model.provider, "oauth-token", "non-secret siblings survive");
+    assert.equal(p.answers.model.routing, false);
+    assert.equal(p.answers.deep.keep, "yes");
+    assert.deepEqual(p.answers.list, [{}, "plain"]);
+    assert.ok(p.answers._redacted.includes("claudeOauthToken"));
+    assert.ok(p.answers._redacted.includes("model.oauthToken"));
+    assert.ok(p.answers._redacted.includes("model.apiKey"));
+    assert.ok(p.answers._redacted.includes("deep.a.b.apiKey"));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});

package/lib/singleton.js

@@ -46,10 +46,16 @@ function locksDir() {
  *
  * Handles stale PID files (process died without cleanup).
  *
+ * By default SIGINT/SIGTERM handlers are installed that release the lock and
+ * `process.exit(0)`. A caller that must run its own shutdown on those signals
+ * (the session supervisor forwards SIGTERM to its multiplexer before exiting)
+ * passes `{ signals: false }`; the `exit` cleanup is registered either way.
+ *
  * @param {string} name - Service name (e.g., "slack-events", "daemon", "huddle-server")
+ * @param {{signals?: boolean}} [opts]
  * @returns {boolean}
  */
-export function acquireLock(name) {
+export function acquireLock(name, opts = {}) {
   const dir = locksDir();
   mkdirSync(dir, { recursive: true });
   const pidFile = join(dir, `${name}.pid`);
@@ -96,8 +102,10 @@ export function acquireLock(name) {
     try { unlinkSync(pidFile); } catch { /* ignore */ }
   };
   process.on("exit", cleanup);
-  process.on("SIGINT", () => { cleanup(); process.exit(0); });
-  process.on("SIGTERM", () => { cleanup(); process.exit(0); });
+  if (opts.signals !== false) {
+    process.on("SIGINT", () => { cleanup(); process.exit(0); });
+    process.on("SIGTERM", () => { cleanup(); process.exit(0); });
+  }
 
   return true;
 }

package/lib/singleton.test.mjs

@@ -133,3 +133,19 @@ test("a legacy pid-only lock for a live PID is honoured", () => {
 });
 
 test.after(() => rmSync(root, { recursive: true, force: true }));
+
+test("acquireLock(name, {signals:false}) installs no SIGTERM/SIGINT handlers — the caller owns shutdown; exit cleanup stays", () => {
+  const term = process.listenerCount("SIGTERM");
+  const int = process.listenerCount("SIGINT");
+  const exit = process.listenerCount("exit");
+  assert.equal(acquireLock("owned", { signals: false }), true);
+  assert.equal(process.listenerCount("SIGTERM"), term, "no SIGTERM handler");
+  assert.equal(process.listenerCount("SIGINT"), int, "no SIGINT handler");
+  assert.equal(process.listenerCount("exit"), exit + 1, "the exit cleanup is still registered");
+  releaseLock("owned");
+  // Default behaviour unchanged: signal handlers are installed.
+  assert.equal(acquireLock("default"), true);
+  assert.equal(process.listenerCount("SIGTERM"), term + 1);
+  assert.equal(process.listenerCount("SIGINT"), int + 1);
+  releaseLock("default");
+});

package/lib/subagents/lock.mjs

@@ -245,7 +245,7 @@ export function queueOutbox(agentRoot, op, payload) {
     const seq = String(++outboxSeq).padStart(4, "0");
     const salt = randomBytes(3).toString("hex");
     const p = join(outboxDir(agentRoot), `${ts}-${seq}-${salt}-${String(op).replace(/[^\w.-]/g, "_")}.json`);
-    writeFileSync(p, JSON.stringify({ op: String(op), payload: payload || {}, queuedAt: new Date().toISOString() }, null, 2));
+    writeJsonAtomic(p, { op: String(op), payload: payload || {}, queuedAt: new Date().toISOString() });
     return p;
   } catch {
     return null;