@compr/opscontext-mcp 2.8.4 → 2.9.1

package/dist/cli.js

@@ -651,7 +651,8 @@ import { listLearnings, parseSince, learningsToChunks, learningsStats, formatLea
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
 import { activate, deactivate, getActivationStatus, gateCheck, } from "./activation.js";
 import { syncTierA, syncTierB, loadCommunityStore, communityRulesToChunks, mergeWithDedup, STORE_PATH as COMMUNITY_STORE_PATH, } from "./community-sync.js";
-import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, } from "./audit.js";
+import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, restoreSegment, scrubAuditLog, } from "./audit.js";
+import { redactPayload } from "./secret-shapes.js";
 import { loadRepoPolicy, parsePolicy, formatPolicySummary, formatValidationErrors, repoPolicyPath, } from "./policy.js";
 import { buildCostReport } from "./cost-report.js";
 import { getStagedFiles, runSecretScan, runDocCoverage, runCommitMessageRequired, runRuleParity, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, formatCommitMessageViolations, formatCommitMessageViolationsJson, formatRuleParityViolations, formatRuleParityViolationsJson, } from "./hooks.js";
@@ -1996,6 +1997,68 @@ function cliAuditRotate(args) {
         process.exit(2);
     }
 }
+/** Remove credentials from records already written. [LOCK] [SCRUB-IS-ACKNOWLEDGED-REDACTION] */
+function cliAuditScrub(args) {
+    const reasonAt = args.indexOf("--reason");
+    const reason = reasonAt >= 0 ? args[reasonAt + 1] ?? "" : "";
+    const apply = args.includes("--apply");
+    const r = scrubAuditLog({ apply, reason, redact: redactPayload, actor: "cli" });
+    if (r.refusedReason) {
+        console.error(`\nNot scrubbed: ${r.refusedReason}\n`);
+        process.exit(1);
+    }
+    const hit = r.files.filter((f) => f.redacted > 0);
+    console.log(`\nAudit scrub${apply ? "" : ", DRY RUN, nothing written"}\n`);
+    console.log(`  records to redact  ${r.redactedRecords}${apply ? " (redacted)" : ""}, in ${hit.length} of ${r.files.length} file(s)`);
+    for (const [id, n] of Object.entries(r.counts).sort((a, b) => b[1] - a[1])) {
+        console.log(`    ${id.padEnd(24)} ${n}`);
+    }
+    if (!apply) {
+        if (r.redactedRecords > 0)
+            console.log(`\n  Run again with --apply --reason "<why>" to rewrite them and acknowledge it on the chain.\n`);
+        return;
+    }
+    console.log(`  acknowledged by    ${r.acknowledgements.length} audit.redact record(s)`);
+    const after = verifyChain();
+    console.log(`\n  audit-verify now: ${after.ok ? "OK" : "FAILED"}, ${after.total} record(s), ` +
+        `${(after.redactedIndices ?? []).length} redacted and acknowledged, ${(after.tamperedIndices ?? []).length} altered.\n`);
+    if (!after.ok)
+        process.exit(2);
+}
+/** Put a lost block of audit records back from a backup. [LOCK] [RESTORE-ONLY-CLOSES-A-PROVEN-GAP] */
+function cliAuditRestore(args) {
+    const reasonAt = args.indexOf("--reason");
+    const reason = reasonAt >= 0 ? args[reasonAt + 1] ?? "" : "";
+    const apply = args.includes("--apply");
+    const file = args.find((a, i) => !a.startsWith("--") && !(reasonAt >= 0 && i === reasonAt + 1));
+    if (!file) {
+        console.error(`usage: contextengine audit-restore <file.jsonl> [--apply --reason "<where the records came from and why>"]`);
+        console.error(`   Without --apply it only checks the file and says what it would do.`);
+        process.exit(1);
+    }
+    const r = restoreSegment(resolve(file), { apply, reason, actor: "cli" });
+    if (r.refusedReason) {
+        console.error(`\nNot restored: ${r.refusedReason}\n`);
+        process.exit(1);
+    }
+    console.log(`\nAudit restore${apply ? "" : ", DRY RUN, nothing written"}\n`);
+    console.log(`  block             ${r.records} record(s), ${r.firstTs} to ${r.lastTs}`);
+    console.log(`  every record      matches its own hash`);
+    console.log(`  fits between      ${r.after} and ${r.before}`);
+    console.log(`  closes            the orphan at index ${r.orphanIndex}`);
+    if (!apply) {
+        console.log(`  would write       audit-archive/${r.segmentFile}`);
+        console.log(`\n  Run again with --apply --reason "<where the records came from and why>" to write it.\n`);
+        return;
+    }
+    console.log(`  wrote             audit-archive/${r.segmentFile}`);
+    console.log(`  recorded as       audit.restore, hash ${r.record.hash.slice(0, 16)}...`);
+    const after = verifyChain();
+    console.log(`\n  audit-verify now: ${after.ok ? "OK" : "FAILED"}, ${after.total} record(s), ` +
+        `${(after.orphanIndices ?? []).length} orphan(s), ${(after.tamperedIndices ?? []).length} altered.\n`);
+    if (!after.ok)
+        process.exit(2);
+}
 /** Acknowledge deliberately redacted audit records on the chain. [LOCK] [REDACTION-IS-A-CHAINED-RECORD] */
 function cliAuditRedactAck(args) {
     const idxAt = args.indexOf("--index");
@@ -2058,6 +2121,8 @@ async function cliAuditVerify() {
         console.error(`\n   Orphaned records (parent hash absent from the log):`);
         console.error(`     ${o.slice(0, 10).join(", ")}${o.length > 10 ? `, … (+${o.length - 10} more)` : ""}`);
         console.error(`   This means earlier records were deleted or the log was truncated.`);
+        console.error(`   If a backup holds the missing records, 'contextengine audit-restore <file>' checks`);
+        console.error(`   that they fill this gap exactly, and puts them back with --apply.`);
     }
     if (forks.length > 0) {
         console.error(`\n   (Also ${forks.length} concurrent-append fork(s) — benign, see docs.)`);
@@ -2552,6 +2617,14 @@ Usage:
                                        the size ceiling (default 50000 live records),
                                        whichever is more. The chain stays linear: segments
                                        are part of the verified history, never deleted.
+  contextengine audit-restore <file> [--apply --reason "..."]
+                                       Put a lost block of records back from a backup. Only
+                                       fills a gap audit-verify reports, at a segment boundary,
+                                       after checking every record's hash. Dry run by default.
+  contextengine audit-scrub [--apply --reason "..."]
+                                       Remove credentials (keys, tokens, passwords in commands
+                                       and URLs) from captured records already written, and
+                                       acknowledge each rewrite on the chain. Dry run by default.
   contextengine cost [--session ID] [--project NAME] [--run wf_ID] [--days N] [--top N] [--json]
                                        Multi-agent spend from Claude Code transcripts. Always prints
                                        VOLUME (tokens), VALUED COST (API list prices — notional on a
@@ -2757,6 +2830,12 @@ else if (command === "audit-redact-ack") {
 else if (command === "audit-rotate") {
     cliAuditRotate(process.argv.slice(3));
 }
+else if (command === "audit-restore") {
+    cliAuditRestore(process.argv.slice(3));
+}
+else if (command === "audit-scrub") {
+    cliAuditScrub(process.argv.slice(3));
+}
 else if (command === "servers") {
     const fleet = listServers();
     const health = computeFleetHealth({ version: readPackageVersion(), report: fleet });

package/dist/detector.js

@@ -79,7 +79,9 @@ function stableStringify(v) {
 }
 function getText(r) {
     const p = r.payload || {};
-    return String(p.text ?? p.preview ?? p.args_preview ?? "");
+    // A prompt kept as a fingerprint only ([PROMPT-TEXT-IS-NOT-KEPT]) compares as one token: equal
+    // for an exact repeat, different otherwise.
+    return String(p.text ?? p.text_fingerprint ?? p.preview ?? p.args_preview ?? "");
 }
 function sessionKey(r) {
     const p = r.payload || {};
@@ -120,7 +122,7 @@ function detectLoop(events) {
             }
         }
         if (dupes >= 2) {
-            const snippet = getText(prompts[i]).slice(0, 80);
+            const snippet = typeof prompts[i].payload?.text === "string" ? getText(prompts[i]).slice(0, 80) : "(prompt text not kept)";
             return mk("loop", "warn", `Same prompt sent ${dupes + 1}× in 5 min`, matches, { repetitions: dupes + 1, snippet });
         }
     }
@@ -188,7 +190,9 @@ function detectFabrication(events, cwd) {
 function detectDrift(events) {
     // Per-session: if the last 3 prompts are jointly far (low overlap) from
     // the session's FIRST prompt, the conversation has drifted off-topic.
-    const bySession = groupBy(events.filter((e) => e.event === "browser.prompt" || e.event === "vscode.prompt_submit"), sessionKey);
+    // Word overlap needs words: prompts kept as a fingerprint only are left out, or every session
+    // would read as drifted. [LOCK] [PROMPT-TEXT-IS-NOT-KEPT]
+    const bySession = groupBy(events.filter((e) => (e.event === "browser.prompt" || e.event === "vscode.prompt_submit") && typeof e.payload?.text === "string"), sessionKey);
     for (const [sid, prompts] of bySession) {
         if (prompts.length < 4)
             continue;

package/dist/hooks.js

@@ -43,7 +43,7 @@
 //      project gets its own `.contextengine/policy.json`. This rule only
 //      applies to the repo it lives in. Cross-repo enforcement is a
 //      separate concern (org-policy distribution via `extends:`).
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { existsSync, readFileSync } from "fs";
 import { createHash } from "crypto";
 import { join } from "path";
@@ -107,25 +107,36 @@ export function matchesAnyGlob(path, globs) {
  * Errors from git (not a repo, no staged changes, etc.) are RE-THROWN, not
  * swallowed. The caller decides whether "no staged changes" is fatal.
  */
+// [LOCKED] [STAGED-PATH-IS-AN-ARGUMENT-NEVER-A-SHELL-STRING] - 2026-09-25
+// [NEVER] build a shell command string from a staged path, a policy path, or any other value a
+//         repository controls. Pass it as one argv element to execFileSync, list names with -z,
+//         and address the file with a `:(literal)` pathspec (here) or a `:path` blob spec
+//         (contentAfterCommit below).
+// WHY: until 2.9.0 this ran `git diff --cached -- "<name>"` through a shell, escaping only the
+//      double quote. Proven in a scratch repo on 2026-09-25: a staged file named
+//      `note$(touch PROOF).md` ran `touch` while the pre-commit scanner parsed the staged list,
+//      so a cloned repo or a pull request could run a command on the committer's machine. The
+//      same line also lost every non-ASCII name: `--name-only` prints `caf\303\251.md` C-quoted,
+//      the shell lookup found no such file, the catch skipped it, and a planted key in `café.md`
+//      was never scanned. A plain pathspec is a glob too: `a*.md` also matched `ab.md`.
+// FIX: execFileSync("git", [...]) with the name as its own argument (no shell exists to expand
+//      it), `-z` so git prints raw names, `:(literal)` so a name matches only itself, and a
+//      32 MB buffer so a large file is not skipped silently. tests/hooks.test.ts and
+//      tests/rule-parity.test.ts stage those exact names.
 export function getStagedFiles(repoRoot) {
-    const nameOutput = execSync("git diff --cached --name-only --diff-filter=ACMR", {
-        cwd: repoRoot,
-        encoding: "utf-8",
-    }).trim();
-    if (!nameOutput)
+    const nameOutput = execFileSync("git", ["diff", "--cached", "--name-only", "-z", "--diff-filter=ACMR"], { cwd: repoRoot, encoding: "utf-8" });
+    const fileNames = nameOutput.split("\0").filter((f) => f.length > 0);
+    if (fileNames.length === 0)
         return [];
-    const fileNames = nameOutput.split("\n");
     const result = [];
     for (const file of fileNames) {
         let diff;
         try {
-            diff = execSync(`git diff --cached --unified=0 -- "${file.replace(/"/g, '\\"')}"`, {
-                cwd: repoRoot,
-                encoding: "utf-8",
-            });
+            diff = execFileSync("git", ["diff", "--cached", "--unified=0", "--", `:(literal)${file}`], { cwd: repoRoot, encoding: "utf-8", maxBuffer: 32 * 1024 * 1024 });
         }
         catch {
-            // Binary file, deleted, or path that doesn't roundtrip — skip safely.
+            // git could not diff this path (index and worktree disagree in a way git refuses to
+            // print, or the diff exceeds the buffer): nothing to parse, skip it.
             continue;
         }
         const addedLines = [];
@@ -586,7 +597,9 @@ export function formatDocCoverageViolationsJson(violations) {
 function contentAfterCommit(repoRoot, rel, stagedSet, useWorktree) {
     if (!useWorktree && stagedSet.has(rel)) {
         try {
-            return execSync(`git show :"${rel}"`, {
+            // [LOCK] [STAGED-PATH-IS-AN-ARGUMENT-NEVER-A-SHELL-STRING]: `rel` comes from policy.json,
+            // which a cloned repo controls; it is an argv element, never part of a shell string.
+            return execFileSync("git", ["show", `:${rel}`], {
                 cwd: repoRoot,
                 encoding: "utf-8",
                 maxBuffer: 32 * 1024 * 1024,

package/dist/http-server.d.ts

@@ -10,6 +10,12 @@ declare function loadSecret(): string | null;
 declare function constantTimeEqual(a: string, b: string): boolean;
 /** Validate an event has the minimum shape we'll write to audit. */
 declare function validateEvent(e: IncomingEvent, idx: number): string | null;
+/**
+ * The payload as it will be written: every string redacted, and the per-shape counts recorded
+ * under `redacted_at_ingest` when anything was removed. The only path from the network to the
+ * log. [LOCK] [CAPTURE-IS-REDACTED-AT-THE-DOOR] (src/secret-shapes.ts)
+ */
+export declare function prepareCapturedPayload(payload: Record<string, unknown>, event?: string): Record<string, unknown>;
 /**
  * Boot the local event-ingest HTTP server. Returns the listening port or null
  * if the port was already in use (caller may decide whether to retry on
@@ -20,6 +26,7 @@ declare function validateEvent(e: IncomingEvent, idx: number): string | null;
 export declare function startEventIngestServer(): Promise<number | null>;
 export declare function stopEventIngestServer(): Promise<void>;
 export declare const _internal: {
+    prepareCapturedPayload: typeof prepareCapturedPayload;
     loadSecret: typeof loadSecret;
     constantTimeEqual: typeof constantTimeEqual;
     validateEvent: typeof validateEvent;

package/dist/http-server.js

@@ -23,6 +23,7 @@ import { join } from "path";
 import { homedir } from "os";
 import { timingSafeEqual } from "crypto";
 import { safeAppend } from "./audit.js";
+import { redactPayload, textFingerprint } from "./secret-shapes.js";
 const PORT = parseInt(process.env.OPSCONTEXT_EVENT_PORT || "7842", 10);
 const HOST = "127.0.0.1";
 const SECRET_FILE = join(homedir(), ".contextengine", "extension-secret");
@@ -73,6 +74,40 @@ function validateEvent(e, idx) {
     }
     return null;
 }
+/**
+ * The payload as it will be written: every string redacted, and the per-shape counts recorded
+ * under `redacted_at_ingest` when anything was removed. The only path from the network to the
+ * log. [LOCK] [CAPTURE-IS-REDACTED-AT-THE-DOOR] (src/secret-shapes.ts)
+ */
+export function prepareCapturedPayload(payload, event) {
+    const { value, counts, changed } = redactPayload(dropPromptText(payload, event));
+    return changed ? { ...value, redacted_at_ingest: counts } : value;
+}
+/**
+ * [LOCKED] [PROMPT-TEXT-IS-NOT-KEPT] - 2026-09-25
+ * [NEVER] write the text of a prompt or an AI response to the audit log by default.
+ * WHY: the owner's decision, 2026-09-25. The text fed one feature, the loop and drift alarm, which
+ *      fired 0 times in three months of real use; meanwhile it held the owner's typed passwords
+ *      and logins. A record of "prompt sent at 10:02, 340 characters" keeps the evidence of
+ *      activity without keeping what was said.
+ * FIX: prompts (vscode.prompt_submit, browser.prompt) and responses (browser.response) keep their
+ *      length and a keyed fingerprint (textFingerprint), so an exact repeat is still detectable.
+ *      Commands and tool input stay, redacted: they are the record of what an agent did.
+ *      OPSCONTEXT_KEEP_PROMPT_TEXT=1 keeps the (redacted) text, for someone who wants it.
+ */
+const PROMPT_TEXT_EVENTS = new Set(["vscode.prompt_submit", "browser.prompt", "browser.response"]);
+function dropPromptText(payload, event) {
+    if (!event || !PROMPT_TEXT_EVENTS.has(event) || process.env.OPSCONTEXT_KEEP_PROMPT_TEXT === "1")
+        return payload;
+    if (typeof payload.text !== "string")
+        return payload;
+    const { text, ...rest } = payload;
+    return {
+        ...rest,
+        char_count: typeof rest.char_count === "number" ? rest.char_count : text.length,
+        text_fingerprint: textFingerprint(text),
+    };
+}
 function sendJson(res, status, body) {
     const json = JSON.stringify(body);
     res.writeHead(status, {
@@ -143,7 +178,8 @@ function handleEvents(req, res) {
         for (const ev of batch.events) {
             const actor = typeof ev.actor === "string" ? ev.actor : "browser-ext";
             // event/payload were validated above — cast is safe.
-            safeAppend(ev.event, ev.payload, actor);
+            // [LOCK] [CAPTURE-IS-REDACTED-AT-THE-DOOR]: redact before the append, never after.
+            safeAppend(ev.event, prepareCapturedPayload(ev.payload, ev.event), actor);
             written++;
         }
         sendJson(res, 200, { ok: true, written });
@@ -233,6 +269,7 @@ export function stopEventIngestServer() {
 // Test helpers (not exported in dist surface in production use — but the
 // module is small enough that tests can import them directly).
 export const _internal = {
+    prepareCapturedPayload,
     loadSecret,
     constantTimeEqual,
     validateEvent,

package/dist/index.js

@@ -4,6 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { loadSources, loadProjectDirs, loadConfig, resolveProjectDir } from "./config.js";
 import { ingestSources } from "./ingest.js";
+import { redactSecrets } from "./secret-shapes.js";
 import { summarizeSource } from "./source-summary.js";
 import { searchChunks } from "./search.js";
 import { initEmbeddings, embedChunks, embedKeyOf, vectorSearch, isEmbeddingsReady, } from "./embeddings.js";
@@ -152,6 +153,8 @@ async function buildIndex(opts) {
         console.error(`[ContextEngine] 🌐 Injected ${added} community rule chunks ` +
             `(${skipped} dedup'd vs local; ${store.rules.length} total in cache)`);
     }
+    // [LOCK] [INDEX-NEVER-SERVES-A-CREDENTIAL]: before the adapters, whose block can return early.
+    chunks = chunks.map(redactChunk);
     // Collect from plugin adapters
     if (config.adapters && config.adapters.length > 0) {
         if (opts.loadAdapters) {
@@ -161,11 +164,27 @@ async function buildIndex(opts) {
         }
         const adapterChunks = await collectFromAdapters(config.adapters);
         if (adapterChunks.length > 0) {
-            chunks.push(...adapterChunks);
+            chunks.push(...adapterChunks.map(redactChunk));
             console.error(`[ContextEngine] 🔌 Adapters contributed ${adapterChunks.length} chunks`);
         }
     }
 }
+/**
+ * [LOCKED] [INDEX-NEVER-SERVES-A-CREDENTIAL] - 2026-09-25
+ * [NEVER] let a chunk into the index, the shared index file or a search result without passing
+ *         its text through redactSecrets().
+ * WHY: on 2026-09-25 the shared index held database URLs with their passwords (read from dotenv
+ *      files, whose masking skipped the password inside a URL), sshpass and mysql passwords from
+ *      runbooks and memory notes, and Google API keys: 55 sources in all. search_context hands
+ *      chunks to every AI agent that asks, and the index file rides the weekly backup.
+ * FIX: every chunk, whatever collected it (docs, code, ops collectors, learnings, community rules,
+ *      adapters), is redacted with the capture shapes (src/secret-shapes.ts) as the index is built.
+ *      The source files are not touched: cleaning those is the owner's call, file by file.
+ */
+function redactChunk(c) {
+    const r = redactSecrets(c.content);
+    return Object.keys(r.counts).length > 0 ? { ...c, content: r.text } : c;
+}
 /** Load the model once; every caller shares the same promise. */
 function ensureModel() {
     if (!modelInit)

package/dist/rubric.js

@@ -9,7 +9,7 @@
  * WHAT THIS IS NOT: hidden behaviour. This file contains numbers and nothing else — no network
  * calls, no file access, no data collection. Every code path in this package ships readable,
  * including the two (and only two) network calls the tool ever makes: licence activation and the
- * daily heartbeat, both in activation.js. Full source: https://github.com/FASTPROD/ContextEngine
+ * daily heartbeat, both in activation.js. Full source: https://github.com/FASTPROD/opscontext-mcp
  *
  * Your project data never leaves your machine. See the Privacy section of the README, and verify
  * it in the source rather than taking our word for it.

package/dist/secret-shapes.d.ts

@@ -0,0 +1,28 @@
+export interface SecretShape {
+    id: string;
+    re: RegExp;
+    /** Group 1 is context to keep (a flag, a key name, `scheme://user:`); the rest is replaced. */
+    keepPrefix?: boolean;
+    /** Return true to leave a match alone (a function call, a type name). */
+    skip?: (value: string, after: string) => boolean;
+}
+export declare const SECRET_SHAPES: SecretShape[];
+/**
+ * Keyed fingerprint of a text: HMAC-SHA-256 with a key that never leaves this machine, first 16
+ * hex characters. Two identical prompts get the same fingerprint, so exact repeats stay
+ * detectable; without the key a short prompt ("yes", "go on") cannot be guessed back from it.
+ */
+export declare function textFingerprint(text: string): string;
+export interface RedactionResult {
+    text: string;
+    counts: Record<string, number>;
+}
+/** Replace every credential shape in `input`. Returns the new text and the count per shape. */
+export declare function redactSecrets(input: string): RedactionResult;
+/** Redact every string inside a JSON-like value, returning a copy and the merged counts. */
+export declare function redactPayload<T>(value: T): {
+    value: T;
+    counts: Record<string, number>;
+    changed: boolean;
+};
+//# sourceMappingURL=secret-shapes.d.ts.map

package/dist/secret-shapes.js

@@ -0,0 +1,132 @@
+// [LOCKED] [CAPTURE-IS-REDACTED-AT-THE-DOOR] - 2026-09-25
+// [NEVER] write captured text (prompts, commands, tool input, errors) to the audit log without
+//         passing it through redactPayload(), and never narrow these shapes without replaying
+//         them against a real log first.
+// WHY: until 2.8.4 the Claude Code hook sent the first 4,000 characters of every prompt and
+//      the first 200 of every command straight into audit.log; only the browser extension
+//      filtered. A scan on 2026-09-24 found credentials that had sat there for three months:
+//      a Stripe live key, production database passwords inside connection URLs, SSH passwords
+//      after `sshpass -p`, API tokens after `Bearer`. The log is hash-chained and archived for
+//      good, so a secret written once stays forever unless a redaction is acknowledged.
+// FIX: every capture event goes through one door, POST /events in src/http-server.ts, and that
+//      door redacts every string of the payload with the shapes below before the append. The
+//      same shapes drive `contextengine audit-scrub`, which cleans records written before this.
+//      The hook's cut at 200 characters can split a secret; a fragment under a shape's minimum
+//      length is not caught. A password written in plain words is not caught either.
+//
+import { createHmac, randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+const QUOTED_OR_BARE = String.raw `(?:'[^']*'|"[^"]*"|[^\s'"]+)`;
+export const SECRET_SHAPES = [
+    { id: "private_key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g },
+    { id: "aws_access_key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { id: "aws_secret_key", re: /(aws_secret_access_key["']?\s*[:=]\s*["']?)[A-Za-z0-9/+=]{40}/gi, keepPrefix: true },
+    { id: "stripe_key", re: /\b(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}/g },
+    { id: "stripe_webhook_secret", re: /\bwhsec_[0-9A-Za-z]{16,}/g },
+    { id: "github_token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[0-9A-Za-z]{30,}|\bgithub_pat_[0-9A-Za-z_]{40,}/g },
+    { id: "anthropic_key", re: /\bsk-ant-[0-9A-Za-z_-]{20,}/g },
+    { id: "openai_key", re: /\bsk-(?!ant-)(?:proj-|svcacct-|admin-)?[0-9A-Za-z_-]{32,}/g },
+    { id: "slack_token", re: /\bxox[abposr]-[0-9A-Za-z-]{10,}/g },
+    { id: "slack_webhook", re: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]+/g },
+    { id: "google_api_key", re: /\bAIza[0-9A-Za-z_-]{35}/g },
+    { id: "npm_token", re: /\bnpm_[0-9A-Za-z]{36}\b/g },
+    { id: "sendgrid_key", re: /\bSG\.[0-9A-Za-z_-]{16,}\.[0-9A-Za-z_-]{16,}/g },
+    { id: "telegram_bot_token", re: /\b\d{8,10}:AA[0-9A-Za-z_-]{33}\b/g },
+    { id: "jwt", re: /\beyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g },
+    // scheme://user:SECRET@host, the shape of every database URL found on 2026-09-24.
+    { id: "url_password", re: /(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@'"`]+:)[^\s@/'"`]+(?=@)/gi, keepPrefix: true },
+    { id: "sshpass_password", re: new RegExp(String.raw `(\bsshpass\s+-p\s*)${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
+    { id: "sshpass_env", re: new RegExp(String.raw `(\bSSHPASS=)${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
+    // mysql -pSECRET (the value is glued to the flag; a bare -p prompts and is left alone).
+    { id: "mysql_password", re: new RegExp(String.raw `(\bmysql(?:dump|admin)?\b[^\n]*?\s-p)(?=[^\s-])${QUOTED_OR_BARE}`, "g"), keepPrefix: true },
+    { id: "password_flag", re: new RegExp(String.raw `(--password[=\s]\s*)${QUOTED_OR_BARE}`, "gi"), keepPrefix: true },
+    { id: "bearer_token", re: /(\bbearer\s+)(?=[0-9A-Za-z._~+/-]{20,})[0-9A-Za-z._~+/-]+=*/gi, keepPrefix: true },
+    { id: "basic_auth", re: /(\bauthorization:\s*basic\s+)[A-Za-z0-9+/]{8,}=*/gi, keepPrefix: true },
+    { id: "curl_user_password", re: /(\bcurl\b[^\n]*?\s(?:-u|--user)\s*['"]?[^\s:'"]+:)[^\s'"]+/g, keepPrefix: true },
+    { id: "api_key_header", re: /(\bx-api-key:\s*)[^\s'"]{8,}/gi, keepPrefix: true },
+    // name = value, the long tail. Skips variables, env lookups, paths, placeholders already
+    // redacted, type names and function calls.
+    {
+        id: "credential_assignment",
+        // A backtick opens a value too: "password: `...`" in Markdown, found in the real log.
+        re: /(\b[\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret)["'`]?\s*[:=]\s*["'`]?)(?![$<{*/~.[]|process\.env|os\.environ|getenv)[^\s'"`,;)}\]]{6,}/gi,
+        keepPrefix: true,
+        skip: (value, after) => after.startsWith("(") ||
+            (/^[A-Za-z_$][\w$.]*\(/.test(value) && after.startsWith(")")) || // getToken(user), not a value
+            /^(?:string|number|boolean|null|undefined|true|false|none|str|int|bool|any|object|required|optional)$/i.test(value),
+    },
+];
+/**
+ * Keyed fingerprint of a text: HMAC-SHA-256 with a key that never leaves this machine, first 16
+ * hex characters. Two identical prompts get the same fingerprint, so exact repeats stay
+ * detectable; without the key a short prompt ("yes", "go on") cannot be guessed back from it.
+ */
+export function textFingerprint(text) {
+    return createHmac("sha256", fingerprintKey()).update(text).digest("hex").slice(0, 16);
+}
+let cachedKey = null;
+function fingerprintKey() {
+    const dir = join(process.env.CONTEXTENGINE_HOME || join(homedir(), ".contextengine"), "keys");
+    const path = join(dir, "fingerprint.key");
+    if (cachedKey?.path === path)
+        return cachedKey.key;
+    if (!existsSync(path)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        try {
+            writeFileSync(path, randomBytes(32).toString("hex"), { mode: 0o600, flag: "wx" });
+        }
+        catch {
+            /* another process created it first: read theirs */
+        }
+    }
+    cachedKey = { path, key: Buffer.from(readFileSync(path, "utf-8").trim(), "hex") };
+    return cachedKey.key;
+}
+/** Replace every credential shape in `input`. Returns the new text and the count per shape. */
+export function redactSecrets(input) {
+    const counts = {};
+    let text = input;
+    for (const shape of SECRET_SHAPES) {
+        shape.re.lastIndex = 0;
+        text = text.replace(shape.re, (...args) => {
+            const match = args[0];
+            const offset = args[args.length - 2];
+            const whole = args[args.length - 1];
+            const prefix = shape.keepPrefix ? String(args[1] ?? "") : "";
+            const value = match.slice(prefix.length);
+            if (value.startsWith("[REDACTED:"))
+                return match; // already done: keeps a second pass a no-op
+            if (shape.skip?.(value, whole.slice(offset + match.length)))
+                return match;
+            counts[shape.id] = (counts[shape.id] ?? 0) + 1;
+            return `${prefix}[REDACTED:${shape.id}]`;
+        });
+    }
+    return { text, counts };
+}
+/** Redact every string inside a JSON-like value, returning a copy and the merged counts. */
+export function redactPayload(value) {
+    const counts = {};
+    const walk = (v) => {
+        if (typeof v === "string") {
+            const r = redactSecrets(v);
+            for (const [k, n] of Object.entries(r.counts))
+                counts[k] = (counts[k] ?? 0) + n;
+            return r.text;
+        }
+        if (Array.isArray(v))
+            return v.map(walk);
+        if (v && typeof v === "object") {
+            const out = {};
+            for (const [k, x] of Object.entries(v))
+                out[k] = walk(x);
+            return out;
+        }
+        return v;
+    };
+    const out = walk(value);
+    return { value: out, counts, changed: Object.keys(counts).length > 0 };
+}
+//# sourceMappingURL=secret-shapes.js.map

package/dist/server-registry.d.ts

@@ -25,7 +25,17 @@ export interface ServerReport {
 }
 /** More concurrent servers than this and every doc change costs that many re-embeds. */
 export declare const SERVER_COUNT_WARN = 3;
-/** Short content hash of the script a server loaded; the build identity. */
+/**
+ * Short content hash of the build a server loaded: every `.js` file next to its entry script.
+ *
+ * [LOCKED] [BUILD-HASH-COVERS-EVERY-MODULE] - 2026-09-25
+ * [NEVER] fingerprint a build by its entry file alone.
+ * WHY: the hash used to cover dist/index.js only. The 2026-09-24 audit fix changed audit.js and
+ *      cli.js, index.js stayed byte-identical, and `contextengine servers` reported "0 on an old
+ *      build" for 29 servers that were still running the code that had erased archived history.
+ * FIX: hash the name and content of every .js file in the entry's folder, in name order. A
+ *      script outside such a folder falls back to its own content.
+ */
 export declare function buildHashOf(scriptPath: string): string | null;
 export declare function isAlive(pid: number): boolean;
 /**

package/dist/server-registry.js

@@ -12,8 +12,8 @@
 //      goes on exit, and a lister removes records whose pid is dead. `contextengine servers`
 //      and the end-session checklist compare each record's build hash with the file on disk
 //      now, and warn when more than SERVER_COUNT_WARN servers run at once.
-import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "fs";
-import { join } from "path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { basename, dirname, join } from "path";
 import { homedir } from "os";
 import { createHash } from "crypto";
 import { execFileSync } from "child_process";
@@ -23,15 +23,40 @@ const HEARTBEAT_MS = 60_000;
 function registryDir() {
     return join(process.env.CONTEXTENGINE_HOME || join(homedir(), ".contextengine"), "servers");
 }
-/** Short content hash of the script a server loaded; the build identity. */
+/**
+ * Short content hash of the build a server loaded: every `.js` file next to its entry script.
+ *
+ * [LOCKED] [BUILD-HASH-COVERS-EVERY-MODULE] - 2026-09-25
+ * [NEVER] fingerprint a build by its entry file alone.
+ * WHY: the hash used to cover dist/index.js only. The 2026-09-24 audit fix changed audit.js and
+ *      cli.js, index.js stayed byte-identical, and `contextengine servers` reported "0 on an old
+ *      build" for 29 servers that were still running the code that had erased archived history.
+ * FIX: hash the name and content of every .js file in the entry's folder, in name order. A
+ *      script outside such a folder falls back to its own content.
+ */
 export function buildHashOf(scriptPath) {
     try {
-        return createHash("sha256").update(readFileSync(scriptPath)).digest("hex").slice(0, 12);
+        const dir = dirname(scriptPath);
+        const files = readdirSync(dir).filter((f) => f.endsWith(".js")).sort();
+        if (!files.includes(basename(scriptPath))) {
+            return createHash("sha256").update(readFileSync(scriptPath)).digest("hex").slice(0, 12);
+        }
+        const signature = files.map((f) => { const s = statSync(join(dir, f)); return `${f}:${s.size}:${s.mtimeMs}`; }).join("|");
+        const cached = buildHashCache.get(dir);
+        if (cached && cached.signature === signature)
+            return cached.hash;
+        const h = createHash("sha256");
+        for (const f of files)
+            h.update(f).update("\0").update(readFileSync(join(dir, f))).update("\0");
+        const hash = h.digest("hex").slice(0, 12);
+        buildHashCache.set(dir, { signature, hash });
+        return hash;
     }
     catch {
         return null;
     }
 }
+const buildHashCache = new Map();
 function parentName(ppid) {
     try {
         // Hardcoded argv, no shell: the only variable is a number.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compr/opscontext-mcp",
-  "version": "2.8.4",
+  "version": "2.9.1",
   "description": "OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.",
   "type": "module",
   "main": "dist/index.js",
@@ -47,12 +47,12 @@
   "author": {
     "name": "PROD LLC (operating brand of CSS LLC, Swiss, est. 2005)",
     "email": "yannick@compr.ch",
-    "url": "https://github.com/FASTPROD/ContextEngine/blob/main/docs/about.md"
+    "url": "https://github.com/FASTPROD/opscontext-mcp/blob/main/docs/about.md"
   },
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/FASTPROD/ContextEngine.git"
+    "url": "https://github.com/FASTPROD/opscontext-mcp.git"
   },
   "homepage": "https://compr.fr",
   "bugs": {