@cortexkit/aft 0.64.0 → 0.65.0

package/README.md

@@ -1,6 +1,6 @@
 # @cortexkit/aft
 
-Unified CLI for [Agent File Tools (AFT)](https://github.com/cortexkit/aft) — setup, doctor, and diagnostics across supported agent harnesses.
+Unified CLI for [Agent Foundational Toolkit (AFT)](https://github.com/cortexkit/aft) — setup, doctor, and diagnostics across supported agent harnesses.
 
 ## Usage
 

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * @cortexkit/aft — unified CLI for Agent File Tools.
+ * @cortexkit/aft — unified CLI for Agent Foundational Toolkit.
  *
  * Entry point parses argv and dispatches to commands. Harness selection
  * (OpenCode, Pi) is auto-detected from installed config paths; explicit

package/dist/index.js

@@ -263,10 +263,87 @@ function relativePathEscapesRoot(rel, platform = process.platform) {
 }
 var init_path_display = () => {};
 
+// ../aft-bridge/dist/wait-clock.js
+class WaitClock {
+  wallNow;
+  awakeNow;
+  wall;
+  awake;
+  skew = 0;
+  elapsed;
+  suspendCount = 0;
+  lastSuspendEnd = Number.NEGATIVE_INFINITY;
+  constructor(wallNow = Date.now, awakeNow = () => performance.now()) {
+    this.wallNow = wallNow;
+    this.awakeNow = awakeNow;
+    this.wall = wallNow();
+    this.awake = awakeNow();
+    this.elapsed = this.awake;
+  }
+  now() {
+    const wall = this.wallNow();
+    const awake = this.awakeNow();
+    const active = Math.max(0, awake - this.awake);
+    this.skew = Math.max(0, this.skew + wall - this.wall - active);
+    this.elapsed += active;
+    if (this.skew >= SUSPEND_SKEW_MS) {
+      this.elapsed += this.skew;
+      this.lastSuspendEnd = this.elapsed;
+      this.skew = 0;
+      this.suspendCount++;
+    }
+    this.wall = wall;
+    this.awake = awake;
+    return this.elapsed;
+  }
+}
+
+class RequestDeadline {
+  clock;
+  allowResume;
+  deadline;
+  suspendCount;
+  resumed = false;
+  constructor(clock, timeoutMs, allowResume = true) {
+    this.clock = clock;
+    this.allowResume = allowResume;
+    this.deadline = clock.now() + timeoutMs;
+    this.suspendCount = clock.suspendCount;
+  }
+  remaining() {
+    const now = this.clock.now();
+    if (now >= this.deadline && this.allowResume && !this.resumed && this.clock.suspendCount > this.suspendCount && this.clock.lastSuspendEnd >= this.deadline) {
+      this.resumed = true;
+      this.deadline = now + RESUME_ALLOWANCE_MS;
+    }
+    return Math.max(0, this.deadline - now);
+  }
+}
+var SUSPEND_SKEW_MS = 1000, RESUME_ALLOWANCE_MS = 1e4, DEADLINE_POLL_MS = 250;
+
 // ../aft-bridge/dist/bash-hints.js
+function abortableSleep(ms, signal) {
+  if (signal?.aborted)
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    const done = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms);
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+var watchClock;
 var init_bash_hints = __esm(() => {
   init_bash_format();
   init_path_display();
+  watchClock = {
+    source: new WaitClock,
+    now: () => watchClock.source.now(),
+    sleep: abortableSleep
+  };
 });
 
 // ../aft-bridge/dist/test-child-environment.js
@@ -882,6 +959,7 @@ var init_bridge = __esm(() => {
   binaryFingerprintAsyncReader = binaryContentHash;
   SYSTEM_CLOCK = {
     now: () => Date.now(),
+    awakeNow: () => performance.now(),
     setTimeout: (callback, ms) => setTimeout(callback, ms),
     clearTimeout: (timer) => clearTimeout(timer)
   };
@@ -961,6 +1039,7 @@ var init_bridge = __esm(() => {
     hangWindowMinMs;
     hangProbeTimeoutMs;
     clock;
+    waitClock;
     lateShellReplyGraceMs;
     maxRestarts;
     configured = false;
@@ -997,6 +1076,7 @@ var init_bridge = __esm(() => {
       this.hangWindowMinMs = options?.hangWindowMinMs ?? DEFAULT_MIN_HANG_WINDOW_MS;
       this.hangProbeTimeoutMs = options?.hangProbeTimeoutMs ?? DEFAULT_HANG_PROBE_TIMEOUT_MS;
       this.clock = options?.clock ?? SYSTEM_CLOCK;
+      this.waitClock = new WaitClock(() => this.clock.now(), () => this.clock.awakeNow?.() ?? this.clock.now());
       this.lateShellReplyGraceMs = options?.lateShellReplyGraceMs ?? DEFAULT_LATE_SHELL_REPLY_GRACE_MS;
       this.maxRestarts = options?.maxRestarts ?? 3;
       this.errorPrefix = options?.errorPrefix ?? "[aft-bridge]";
@@ -1363,11 +1443,17 @@ var init_bridge = __esm(() => {
         const keepBridgeOnTimeout = passive || command === "bash_drain_completions" || options?.keepBridgeOnTimeout === true;
         const child = this.process;
         const response = await new Promise((resolve, reject) => {
-          const timer = this.clock.setTimeout(() => {
+          const deadline = new RequestDeadline(this.waitClock, effectiveTimeoutMs);
+          const expire = () => {
             const entry = this.pending.get(id);
             if (!entry)
               return;
-            if (keepBridgeOnTimeout && this.holdForLateShellReply(id, entry, effectiveTimeoutMs, requestSessionId)) {
+            const remaining = deadline.remaining();
+            if (remaining > 0) {
+              entry.timer = this.clock.setTimeout(expire, Math.min(remaining, DEADLINE_POLL_MS));
+              return;
+            }
+            if (keepBridgeOnTimeout && !deadline.resumed && this.holdForLateShellReply(id, entry, effectiveTimeoutMs, requestSessionId)) {
               return;
             }
             this.pending.delete(id);
@@ -1380,11 +1466,12 @@ var init_bridge = __esm(() => {
               this.warnVia(timeoutMsg);
             }
             if (keepBridgeOnTimeout) {
-              entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`));
+              entry.reject(new BridgeTransportTimeoutError(command, effectiveTimeoutMs, `${this.errorPrefix} Request "${command}" (id=${id}) timed out after ${effectiveTimeoutMs}ms`, deadline.resumed && SHELL_TASK_COMMANDS.has(command) ? { kind: "unknown" } : undefined));
               return;
             }
             entry.reject(new Error(`${this.errorPrefix} request "${command}" timed out after ${effectiveTimeoutMs}ms (bridge busy/under load); bridge kept warm — retry. A timed-out mutation may still complete; inspect before repeating it.`));
-          }, effectiveTimeoutMs);
+          };
+          const timer = this.clock.setTimeout(expire, Math.min(effectiveTimeoutMs, DEADLINE_POLL_MS));
           const entry = {
             resolve,
             reject,
@@ -1940,14 +2027,21 @@ var init_bridge = __esm(() => {
       };
       entry.resolve = (response) => settle(shellOutcomeFromLateReply(response));
       this.clock.clearTimeout(entry.timer);
-      entry.timer = this.clock.setTimeout(() => {
+      const deadline = new RequestDeadline(this.waitClock, graceMs, false);
+      const expire = () => {
         if (this.pending.get(id) !== entry)
           return;
+        const remaining = deadline.remaining();
+        if (remaining > 0) {
+          entry.timer = this.clock.setTimeout(expire, Math.min(remaining, DEADLINE_POLL_MS));
+          return;
+        }
         this.pending.delete(id);
         entry.onSettled?.();
         this.warnVia(`Request "${entry.command}" (id=${id}) got no reply within ${graceMs}ms after its deadline`);
         settle({ kind: "unknown" });
-      }, graceMs);
+      };
+      entry.timer = this.clock.setTimeout(expire, Math.min(graceMs, DEADLINE_POLL_MS));
       return true;
     }
     accountForBashTaskResponse(command, response) {
@@ -2840,10 +2934,11 @@ var init_durable_log = __esm(() => {
   init_storage_paths();
   DEFAULT_LOG_BYTES = 32 * 1024 * 1024;
 });
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/envelope.js
-var MAX_FRAME_BODY_LEN, FrameType, FRAME_TYPE_MAX, Priority, AdmissionClass;
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/envelope.js
+var MAX_FRAME_BODY_LEN, MAX_DELIVERED_FRAME_LEN, FrameType, FRAME_TYPE_MAX, Priority, AdmissionClass;
 var init_envelope = __esm(() => {
   MAX_FRAME_BODY_LEN = 64 * 1024 * 1024;
+  MAX_DELIVERED_FRAME_LEN = 4 * 1024 * 1024;
   (function(FrameType) {
     FrameType[FrameType["Request"] = 0] = "Request";
     FrameType[FrameType["Response"] = 1] = "Response";
@@ -2871,7 +2966,7 @@ var init_envelope = __esm(() => {
   })(AdmissionClass || (AdmissionClass = {}));
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/socket.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/socket.js
 var WRITE_BORROWED, WRITE_TRACKED_BORROWED;
 var init_socket = __esm(() => {
   init_envelope();
@@ -2879,17 +2974,17 @@ var init_socket = __esm(() => {
   WRITE_TRACKED_BORROWED = Symbol("subc.socket.writeTrackedBorrowed");
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/auth.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/auth.js
 var init_auth = __esm(() => {
   init_socket();
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/connection-file.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/connection-file.js
 var init_connection_file = __esm(() => {
   init_envelope();
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/launch-nonce.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/launch-nonce.js
 var PROCESS_CELL_KEY, U64_MAX, I32_MAX, RedactedLaunchNonce;
 var init_launch_nonce = __esm(() => {
   PROCESS_CELL_KEY = Symbol.for("@cortexkit/subc-client/launch-nonce/v1");
@@ -2914,15 +3009,14 @@ var init_launch_nonce = __esm(() => {
     }
   };
 });
-
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/route-handle.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/route-handle.js
 var connectionToken, reverseRequests;
 var init_route_handle = __esm(() => {
   connectionToken = new WeakMap;
   reverseRequests = new WeakMap;
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/client.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/client.js
 import { debuglog } from "node:util";
 var debug, EMPTY_BODY, errorFrameFlags, SCOPE_ROUTE_CLOSE_REASONS, ROUTE_OPEN_ADMISSION_PRESSURE_REASONS;
 var init_client = __esm(() => {
@@ -2944,8 +3038,7 @@ var init_client = __esm(() => {
   ]);
   ROUTE_OPEN_ADMISSION_PRESSURE_REASONS = new Set(["open_admission_full", "target_binds_full"]);
 });
-
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/provider.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/provider.js
 var init_provider = __esm(() => {
   init_auth();
   init_client();
@@ -2956,7 +3049,7 @@ var init_provider = __esm(() => {
   init_socket();
 });
 
-// ../../node_modules/.bun/@cortexkit+subc-client@0.21.2/node_modules/@cortexkit/subc-client/dist/index.js
+// ../../node_modules/.bun/@cortexkit+subc-client@0.24.5/node_modules/@cortexkit/subc-client/dist/index.js
 var init_dist = __esm(() => {
   init_client();
   init_route_handle();
@@ -3562,8 +3655,9 @@ function translateDataLayerPaths(map, prefix, out) {
     }
   }
   for (const path of REMOVED_DATA_LAYER_PATHS) {
-    if (hasPath(map, path))
-      out.removedKeys.push(`${prefix}${path}`);
+    const [container, leaf] = path.split(".");
+    if (container && leaf && takeNested(map, container, leaf).found)
+      recordRetired(out, prefix, path);
   }
 }
 function dropRemovedDataLayerKeys(map) {
@@ -3815,7 +3909,6 @@ function translateConfigDocument(map, tier) {
     warnings: [],
     legacyInput: false,
     retiredKeys: [],
-    removedKeys: [],
     retiredEnabledFalse: false
   };
   translateBlock(map, tier === "user", "base", out);
@@ -3826,7 +3919,6 @@ function translateConfigDocument(map, tier) {
     }
   }
   out.retiredKeys = sortedUnique(out.retiredKeys);
-  out.removedKeys = sortedUnique(out.removedKeys);
   return out;
 }
 function canonicalJson(value) {
@@ -18498,8 +18590,22 @@ function safeRealpath(p) {
 function looksLikeSecret(value) {
   return value.length >= 16 && /^[A-Za-z0-9_\-.~+/=]+$/.test(value) && /[0-9]/.test(value) && /[A-Z]/.test(value) && /[a-z]/.test(value);
 }
+function looksLikeAssignmentSecret(value) {
+  return !["/", "~/", "./", "../"].some((prefix) => value.startsWith(prefix)) && !value.includes("://") && looksLikeSecret(value);
+}
 function isSensitiveKeyName(keyName) {
-  return SENSITIVE_KEY_WORD.test(keyName) || SEGMENTED_KEY_WORD.test(keyName) || CAMEL_CASE_KEY_WORD.test(keyName);
+  return keyName !== "PWD" && (SENSITIVE_KEY_WORD.test(keyName) || SEGMENTED_KEY_WORD.test(keyName) || CAMEL_CASE_KEY_WORD.test(keyName) || SHORT_PASSWORD_NAME.test(keyName));
+}
+function shouldRedactAssignment(prefix, keyName, value, offset, content, commandContext) {
+  if (keyName.toLowerCase() === "key" && /[?&]/.test(content[offset - 1] ?? "")) {
+    return false;
+  }
+  return isSensitiveKeyName(keyName) || commandContext && prefix.trimEnd().endsWith("=") && looksLikeAssignmentSecret(value);
+}
+function redactAssignments(content, commandContext) {
+  let sanitized = content.replace(unquotedSensitiveKeyValuePattern, (match, prefix, keyName, valueQuote, value, offset, input) => shouldRedactAssignment(prefix, keyName, value, offset, input, commandContext) ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}` : match);
+  sanitized = sanitized.replace(bareSensitiveKeyValuePattern, (match, prefix, keyName, value, offset, input) => shouldRedactAssignment(prefix, keyName, value, offset, input, commandContext) ? `${prefix}${SECRET_PLACEHOLDER}` : match);
+  return sanitized;
 }
 function redactSecrets(content) {
   let sanitized = content;
@@ -18512,64 +18618,179 @@ function redactSecrets(content) {
   sanitized = sanitized.replace(CREDENTIAL_QUERY_PATTERN, `$1${SECRET_PLACEHOLDER}`);
   sanitized = sanitized.replace(KEY_QUERY_PATTERN, (match, prefix, value) => looksLikeSecret(value) ? `${prefix}${SECRET_PLACEHOLDER}` : match);
   sanitized = sanitized.replace(quotedSensitiveKeyValuePattern, (match, prefix, _keyQuote, keyName, valueQuote) => isSensitiveKeyName(keyName) ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}` : match);
-  sanitized = sanitized.replace(unquotedSensitiveKeyValuePattern, (match, prefix, keyName, valueQuote) => isSensitiveKeyName(keyName) ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}` : match);
-  sanitized = sanitized.replace(bareSensitiveKeyValuePattern, (match, prefix, keyName) => isSensitiveKeyName(keyName) ? `${prefix}${SECRET_PLACEHOLDER}` : match);
+  sanitized = redactAssignments(sanitized, false);
   sanitized = sanitized.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^@\s/?#]+@/gi, `$1${URL_CREDENTIAL_PLACEHOLDER}@`);
   sanitized = sanitized.replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "<EMAIL>");
+  sanitized = sanitized.replace(/^([^\r\n]*\bbash spawned task=[^\r\n]*? cmd=)([^\r\n]*)/gm, (_match, prefix, command) => `${prefix}${redactAssignments(command, true)}`);
   return sanitized;
 }
-function sanitizeContent(content) {
-  const username = userInfo().username;
-  const home = homedir17();
+function sanitizeContent(content, context = {}) {
+  const username = context.username ?? userInfo().username;
+  const home = context.home ?? homedir17();
   let sanitized = redactSecrets(content);
   const cwd = process.cwd();
-  for (const candidate of new Set([cwd, safeRealpath(cwd)])) {
-    if (candidate && candidate !== "/" && candidate !== home) {
-      sanitized = sanitized.replace(new RegExp(escapeRegex(candidate), "g"), "<PROJECT>");
+  const roots = new Set([
+    cwd,
+    safeRealpath(cwd),
+    ...(context.projectRoots ?? []).flatMap((root) => root.startsWith("~/") ? [root, home + root.slice(1)] : [root]),
+    ...reportProjectRoots(decodedView(content).text)
+  ]);
+  const candidates = [...roots].filter((root) => Boolean(root));
+  for (const root of candidates) {
+    const real = safeRealpath(root);
+    if (real)
+      roots.add(real);
+  }
+  for (const root of [...roots].filter((root) => Boolean(root)).sort((a, b) => b.length - a.length)) {
+    if (/^(?:\/|[A-Za-z]:[/\\]|~\/)/.test(root) && root !== home && !/^(?:[/\\]|[A-Za-z]:[/\\])$/.test(root)) {
+      sanitized = replacePath(sanitized, root, "<PROJECT>");
+    }
+  }
+  if (home && home !== "/")
+    sanitized = replacePath(sanitized, home, "~");
+  sanitized = replaceDecoded(sanitized, /(?:(?<![\p{L}\p{N}_/.-])|(?<=file:\/\/)|(?<=file:\/\/\/))(?:\/(?:home|Users)\/|[A-Za-z]:\/Users\/)([^/\s"'<>`,;:?#&()[\]{}=]+)/gu, (match) => ({ offset: match[0].length - match[1].length, value: "<USER>" }));
+  return redactUsername(sanitized, username);
+}
+function decodedView(content) {
+  let units = Array.from({ length: content.length }, (_, i) => ({
+    char: content[i],
+    start: i,
+    end: i + 1
+  }));
+  const decoded = [];
+  for (let i = 0;i < units.length; ) {
+    const byte = content.slice(i, i + 3);
+    const first = /^%[\da-f]{2}$/i.test(byte) ? Number.parseInt(byte.slice(1), 16) : -1;
+    const width = first < 128 ? 1 : first >= 194 && first <= 223 ? 2 : first <= 239 ? 3 : 4;
+    const spelling = content.slice(i, i + width * 3);
+    if (first >= 0 && /^(?:%[\da-f]{2})+$/i.test(spelling)) {
+      try {
+        const value = decodeURIComponent(spelling);
+        for (const char of value.split(""))
+          decoded.push({ char, start: i, end: i + spelling.length });
+        i += spelling.length;
+        continue;
+      } catch {}
     }
+    decoded.push(units[i++]);
   }
-  if (home) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex(home), "g"), "~");
+  units = [];
+  for (let i = 0;i < decoded.length; i++) {
+    const unit = decoded[i];
+    const next = decoded[i + 1];
+    if (unit.char === "\\" && next && (next.char === "/" || next.char === "\\")) {
+      units.push({ char: "/", start: unit.start, end: next.end });
+      i++;
+    } else
+      units.push({ ...unit, char: unit.char === "\\" ? "/" : unit.char });
   }
-  sanitized = sanitized.replace(/\/Users\/[^/\s"']+/g, "/Users/<USER>");
-  sanitized = sanitized.replace(/\/home\/[^/\s"']+/g, "/home/<USER>");
-  sanitized = sanitized.replace(/([A-Za-z]:\\\\Users\\\\)[^\\\\"'\s]+/g, "$1<USER>");
-  sanitized = sanitized.replace(/([A-Za-z]:\\Users\\)[^\\"'\s]+/g, "$1<USER>");
-  sanitized = sanitized.replace(/([A-Za-z]:\/Users\/)[^/\s"']+/g, "$1<USER>");
-  if (username) {
-    sanitized = redactUsername(sanitized, username);
+  return { text: units.map((unit) => unit.char).join(""), units };
+}
+function replaceDecoded(content, pattern, replacement) {
+  const view = decodedView(content);
+  let result = "";
+  let cursor = 0;
+  for (const match of view.text.matchAll(pattern)) {
+    const change = replacement(match);
+    if (!change)
+      continue;
+    const { offset, value } = change;
+    const start = view.units[match.index + offset].start;
+    const end = view.units[match.index + match[0].length - 1].end;
+    result += content.slice(cursor, start) + value;
+    cursor = end;
   }
-  return sanitized;
+  return result + content.slice(cursor);
 }
-function sanitizeValue(value) {
+function replacePath(content, path, value) {
+  const normalized = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!normalized)
+    return content;
+  const pattern = new RegExp(`(?:(?<![\\p{L}\\p{N}_/.-])|(?<=file://)|(?<=file:///))${escapeRegex(normalized)}(?=$|[/\\s"'<>\`,;:)\\]?#&])`, /^[A-Za-z]:/.test(path) ? "giu" : "gu");
+  return replaceDecoded(content, pattern, () => ({ offset: 0, value }));
+}
+function reportProjectRoots(content) {
+  return [
+    ...content.matchAll(/(?:project root set: |watcher started: )([^\r\n]+)/g),
+    ...content.matchAll(/(?:\broot=|"(?:projectRoot|project_root|canonical_root)"\s*:\s*)("[^"]+"|'[^']+'|[^\s"'<>`,;]+)/g)
+  ].map((match) => match[1].trim().replace(/^["']|["']$/g, "")).filter((root) => /^(?:\/|[A-Za-z]:\/)/.test(root));
+}
+function sanitizeValue(value, context = {}) {
+  const scoped = {
+    ...context,
+    projectRoots: [...context.projectRoots ?? [], ...projectRootsFromValue(value)]
+  };
+  return sanitizeNestedValue(value, scoped);
+}
+function sanitizeNestedValue(value, context) {
   if (typeof value === "string") {
-    return sanitizeContent(value);
+    return sanitizeContent(value, context);
   }
   if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeValue(entry));
+    return value.map((entry) => sanitizeNestedValue(entry, context));
   }
   if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeValue(entry)]));
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeNestedValue(entry, context)]));
   }
   return value;
 }
+function projectRootsFromValue(value) {
+  if (!value || typeof value !== "object")
+    return [];
+  if (Array.isArray(value))
+    return value.flatMap(projectRootsFromValue);
+  const object = value;
+  const roots = [object.projectRoot, object.project_root, object.canonical_root].filter((root) => typeof root === "string");
+  const index = object.index;
+  if (index && Array.isArray(index.roots)) {
+    for (const root of index.roots)
+      if (root && typeof root.path === "string")
+        roots.push(root.path);
+  }
+  return [...roots, ...Object.values(object).flatMap(projectRootsFromValue)];
+}
 function redactUsername(content, username) {
   if (!username)
     return content;
-  return content.replace(new RegExp(`(?<![\\p{L}\\p{N}_])${escapeRegex(username)}(?![\\p{L}\\p{N}_])`, "gu"), "<USER>");
+  if (!COMMON_ACCOUNT_NAMES.has(username.toLowerCase())) {
+    return replaceDecoded(content, new RegExp(`(?<![\\p{L}\\p{N}_])${escapeRegex(username)}(?![\\p{L}\\p{N}_])`, "gu"), () => ({ offset: 0, value: "<USER>" }));
+  }
+  return replaceDecoded(content, new RegExp(`(?<![\\p{L}\\p{N}_/.-])~${escapeRegex(username)}(?![\\p{L}\\p{N}_])|(?<![\\p{L}\\p{N}_/.-])${escapeRegex(username)}(?=@[\\p{L}\\p{N}])`, "gu"), (match) => ({ offset: match[0].startsWith("~") ? 1 : 0, value: "<USER>" }));
 }
-var SECRET_PLACEHOLDER = "<REDACTED_SECRET>", URL_CREDENTIAL_PLACEHOLDER = "***", KEY_NAME = "[A-Za-z_][A-Za-z0-9_.-]*", SENSITIVE_KEY_WORD, SEGMENTED_KEY_WORD, CAMEL_CASE_KEY_WORD, JWT_PATTERN, AWS_ACCESS_KEY_ID_PATTERN, CREDENTIAL_QUERY_PATTERN, KEY_QUERY_PATTERN, quotedSensitiveKeyValuePattern, unquotedSensitiveKeyValuePattern, bareSensitiveKeyValuePattern;
+var SECRET_PLACEHOLDER = "<REDACTED_SECRET>", URL_CREDENTIAL_PLACEHOLDER = "***", KEY_NAME = "[A-Za-z_][A-Za-z0-9_.-]*", SENSITIVE_KEY_WORD, SEGMENTED_KEY_WORD, CAMEL_CASE_KEY_WORD, SHORT_PASSWORD_NAME, JWT_PATTERN, AWS_ACCESS_KEY_ID_PATTERN, CREDENTIAL_QUERY_PATTERN, KEY_QUERY_PATTERN, quotedSensitiveKeyValuePattern, unquotedSensitiveKeyValuePattern, bareSensitiveKeyValuePattern, COMMON_ACCOUNT_NAMES;
 var init_sanitize = __esm(() => {
   SENSITIVE_KEY_WORD = /(?:token|password|secret|api[_-]?key|passwd|pwd|credential)/i;
   SEGMENTED_KEY_WORD = /(?:^|[_.-])key(?:$|[_.-])/i;
   CAMEL_CASE_KEY_WORD = /[a-z0-9]Key(?:$|[A-Z_.-])/;
+  SHORT_PASSWORD_NAME = /(?:^|_)(?:pw|pass)$/i;
   JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
   AWS_ACCESS_KEY_ID_PATTERN = /\b(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}\b/g;
   CREDENTIAL_QUERY_PATTERN = /([?&](?:[a-z0-9_-]*token|api[_-]?key|apikey|[a-z0-9_-]*secret|password|passwd|pwd)=)[^&\s#"'<>]+/gi;
   KEY_QUERY_PATTERN = /([?&]key=)([^&\s#"'<>]+)/gi;
   quotedSensitiveKeyValuePattern = new RegExp(String.raw`((['"])(${KEY_NAME})\2[^\S\r\n]*:[^\S\r\n]*)(['"])([^'"\r\n]+)\4`, "gi");
   unquotedSensitiveKeyValuePattern = new RegExp(String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)(['"])([^'"\r\n]+)\3`, "gi");
-  bareSensitiveKeyValuePattern = new RegExp(String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)([^\s,;&'"]+)`, "gi");
+  bareSensitiveKeyValuePattern = new RegExp(String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)([^\s,;&|<>()'"]+)`, "gi");
+  COMMON_ACCOUNT_NAMES = new Set([
+    "root",
+    "admin",
+    "administrator",
+    "user",
+    "dev",
+    "developer",
+    "test",
+    "guest",
+    "ubuntu",
+    "debian",
+    "pi",
+    "runner",
+    "vagrant",
+    "ec2-user",
+    "centos",
+    "git",
+    "docker",
+    "build",
+    "ci"
+  ]);
 });
 
 // src/lib/bridge-tool-failures.ts
@@ -18871,7 +19092,7 @@ function previewConfigMigration(targets) {
       continue;
     const translated = structuredClone(raw);
     const translation = translateConfigDocument(translated, target.tier);
-    if (!translation.legacyInput && translation.removedKeys.length === 0)
+    if (!translation.legacyInput)
       continue;
     dropRemovedDataLayerKeys(translated);
     const changes = diffConfig(raw, translated);
@@ -21838,6 +22059,13 @@ async function runIssueFlow(argv) {
   const selectedSession = await promptForIssueSession(adapters[0]);
   const selectedBareSessionId = selectedSession?.id.replace(/^ses_/, "") ?? null;
   const report = await collectDiagnostics(adapters);
+  const sanitizeContext = {
+    projectRoots: [
+      ...adapters.flatMap((adapter) => projectRootsFromValue(readJsoncFile(adapter.detectConfigPaths().aftConfig).value)),
+      ...adapters.flatMap((adapter) => projectRootsFromValue(listRecentSessions(adapter))),
+      ...projectRootsFromValue(report)
+    ]
+  };
   const logResults = adapters.flatMap((adapter) => {
     const path = adapter.getLogFile();
     const { logText, errors, notice } = collectIssueLog(path, selectedSession);
@@ -21867,7 +22095,7 @@ ${engine.logText || "<no log output>"}
   });
   const logSections = logResults.map((result) => result.section).join(`
 `);
-  const recentErrorLines = extractRecentErrors(logResults.map((result) => sanitizeContent(result.errors)).join(`
+  const recentErrorLines = extractRecentErrors(logResults.map((result) => sanitizeContent(result.errors, sanitizeContext)).join(`
 `), 20);
   const recentErrorsSection = recentErrorLines.length === 0 ? "_No error-shaped log lines found in recent history._" : ["```", recentErrorLines.join(`
 `), "```"].join(`
@@ -21897,7 +22125,7 @@ ${engine.logText || "<no log output>"}
     "_Usernames and home paths have been stripped from this report._"
   ].join(`
 `);
-  const body = capBodyToGithubLimit(sanitizeContent(rawBody));
+  const body = capBodyToGithubLimit(sanitizeContent(rawBody, sanitizeContext));
   const reviewFile = writeIssueReviewFile(body);
   if (!reviewFile) {
     outro("Done — could not write the issue report.");
@@ -21922,7 +22150,7 @@ https://github.com/cortexkit/aft/issues/new and paste the contents of ${outPath}
     outro("Done.");
     return 1;
   }
-  const finalBody = capBodyToGithubLimit(sanitizeContent(reviewedBody));
+  const finalBody = capBodyToGithubLimit(sanitizeContent(reviewedBody, sanitizeContext));
   const finalTitle = deriveIssueTitleFromBody(finalBody);
   if (isGhInstalled()) {
     log2.info("Opening GitHub issue via `gh`…");

package/dist/lib/sanitize.d.ts

@@ -6,16 +6,22 @@ export declare function escapeRegex(value: string): string;
  */
 export declare function redactSecrets(content: string): string;
 /**
- * Strip personally identifiable path segments and usernames from arbitrary
- * text. Used on log contents, diagnostic JSON blocks, and the final issue body
- * so reports never leak usernames or home-directory paths.
+ * Redact known project/home paths and identifying usernames in logs,
+ * diagnostic JSON blocks and the final issue body.
  */
-export declare function sanitizeContent(content: string): string;
+export declare function sanitizeContent(content: string, context?: SanitizeContext): string;
+export interface SanitizeContext {
+    projectRoots?: readonly string[];
+    home?: string;
+    username?: string;
+}
 /**
  * Recursively sanitize any value by deep-walking objects/arrays. Strings are
  * passed through `sanitizeContent`; other primitives are preserved.
  */
-export declare function sanitizeValue(value: unknown): unknown;
-/** Redact a username only as a whole word or path segment, never inside identifiers. */
+export declare function sanitizeValue(value: unknown, context?: SanitizeContext): unknown;
+/** Collect only declared root fields, never arbitrary file/config/cache paths. */
+export declare function projectRootsFromValue(value: unknown): string[];
+/** Mask distinctive usernames as whole words; common names only in identity positions. */
 export declare function redactUsername(content: string, username: string): string;
 //# sourceMappingURL=sanitize.d.ts.map

package/dist/lib/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/lib/sanitize.ts"],"names":[],"mappings":"AAGA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAiED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA+CrD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAkCvD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAarD;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMxE"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/lib/sanitize.ts"],"names":[],"mappings":"AAGA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAiID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA4CrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CAwCtF;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAkFD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAMpF;AAiBD,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAa9D;AA0BD,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBxE"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cortexkit/aft",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "type": "module",
-  "description": "Unified CLI for Agent File Tools (AFT) — setup, one-shot index snapshots, doctor, and diagnostics across supported agent harnesses (OpenCode, Pi)",
+  "description": "Unified CLI for Agent Foundational Toolkit (AFT) — setup, one-shot index snapshots, doctor, and diagnostics across supported agent harnesses (OpenCode, Pi)",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
   "dependencies": {
     "@clack/core": "^1.4.2",
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/aft-bridge": "0.64.0",
+    "@cortexkit/aft-bridge": "0.65.0",
     "comment-json": "^4.6.2"
   },
   "devDependencies": {