@cortexkit/opencode-magic-context 0.49.7 → 0.49.8

package/dist/v2/{wrapup-orchestrator-s92ebfzv.js → wrapup-orchestrator-5wxy1ggv.js}

@@ -1,8 +1,8 @@
 import"./server-pavzsdc6.js";
 import {
   sessionLog2
-} from "./server-t4k4qexw.js";
-import"./server-1rfgbjfn.js";
+} from "./server-9e5r8y60.js";
+import"./server-cxsr0ng6.js";
 import {
   COMPARTMENT_LEASE_RENEWAL_MS,
   acquireCompartmentLease,
@@ -19,13 +19,15 @@ import {
   registerActiveCompartmentRun,
   setRecompStarting2,
   setRecompTerminal2
-} from "./server-mv1w7t6z.js";
-import"./server-kzns2hbz.js";
-import"./server-hb6xhh9q.js";
-import"./server-j8epsc0g.js";
-import"./server-brhj8qtd.js";
-import"./server-fpqe39as.js";
-import"./server-7srtwsa4.js";
+} from "./server-q360kdb8.js";
+import"./server-s6jqh8bj.js";
+import"./server-988cqjme.js";
+import {
+  inRootAsyncContext2
+} from "./server-wafzvyhg.js";
+import"./server-63ha7f0f.js";
+import"./server-9a6bwc12.js";
+import"./server-j3dm74ey.js";
 import {
   getWrapupInProgressState,
   acquireWrapupInProgress,
@@ -34,40 +36,40 @@ import {
   getHistorianFailureState,
   clearEmergencyRecovery,
   prepareRawSessionOrdinals2
-} from "./server-gtv9wbhq.js";
-import"./server-6byqfbqf.js";
-import"./server-v4fwha43.js";
+} from "./server-xj4mewze.js";
+import"./server-shme41gj.js";
+import"./server-08k4zkfk.js";
 import"./server-1zx87sdm.js";
-import"./server-w3zeywp1.js";
-import"./server-cw6521wn.js";
+import"./server-jjsf29aq.js";
+import"./server-7e087rvk.js";
 import"./server-51779zs2.js";
-import"./server-dd0nja67.js";
+import"./server-bx59ezg6.js";
 import"./server-2ra6pwf3.js";
-import"./server-wkdgjjch.js";
-import"./server-7ekna9zs.js";
+import"./server-zrwaj29a.js";
+import"./server-adfte03x.js";
 import"./server-fr0wbhdn.js";
-import"./server-hcvcxzx7.js";
-import"./server-kdrezdy0.js";
-import"./server-fw31krgq.js";
+import"./server-4gz0xkrc.js";
+import"./server-njnx39q2.js";
+import"./server-4easnf78.js";
 import"./server-fb3zxn06.js";
-import"./server-jdwd03ep.js";
+import"./server-yak3sxya.js";
 import {
   pushNotification2
 } from "./server-x8a7jmkh.js";
-import"./server-x08d1xf3.js";
+import"./server-npm52h2q.js";
 import"./server-qt1qqasc.js";
 import"./server-4dhv7mqz.js";
-import"./server-ras2sxnc.js";
-import"./server-sy4b1sra.js";
-import"./server-9yyqq3mm.js";
-import"./server-d6g4whc2.js";
-import"./server-vb7pbd9p.js";
-import"./server-t528t8qm.js";
-import"./server-676xw7at.js";
+import"./server-44ryn9rb.js";
+import"./server-4rs8sm06.js";
+import"./server-n78avt2p.js";
+import"./server-4qr18rfg.js";
+import"./server-nveratm5.js";
+import"./server-hn9fb3v0.js";
+import"./server-ckrb5rm8.js";
 import {
   sendStatusNotification2
-} from "./server-qcw43339.js";
-import"./server-3t0q2cqx.js";
+} from "./server-ak7w74j9.js";
+import"./server-7dv9wt9r.js";
 
 // src/hooks/magic-context/wrapup-orchestrator.ts
 import * as crypto from "node:crypto";
@@ -190,7 +192,7 @@ async function runOneWrapupIteration(args) {
   if (!acquired.ok)
     return { ran: false, reason: acquired.reason };
   const leaseHolderId = acquired.holderId;
-  const renewal = setInterval(() => {
+  const renewal = inRootAsyncContext2(() => setInterval(() => {
     try {
       if (!renewCompartmentLease(ctx.db, sessionId, leaseHolderId)) {
         sessionLog2(sessionId, "wrapup: compartment lease renewal failed");
@@ -198,7 +200,7 @@ async function runOneWrapupIteration(args) {
     } catch (err) {
       sessionLog2(sessionId, `wrapup: compartment lease renewal threw; continuing (${err instanceof Error ? err.message : String(err)})`);
     }
-  }, COMPARTMENT_LEASE_RENEWAL_MS);
+  }, COMPARTMENT_LEASE_RENEWAL_MS));
   const runCompartmentAgentForWrapup = ctx.runCompartmentAgentForWrapup ?? runCompartmentAgent;
   const runnerPromise = runCompartmentAgentForWrapup({
     client: ctx.client,
@@ -208,6 +210,7 @@ async function runOneWrapupIteration(args) {
     sessionId,
     historianChunkTokens: ctx.historianChunkTokens,
     historianTimeoutMs: ctx.historianTimeoutMs,
+    historianMaxOutputTokens: ctx.historianMaxOutputTokens,
     boundarySnapshot: plan.snapshot,
     currentContextLimit: ctx.contextLimit,
     directory: ctx.directory,
@@ -315,7 +318,7 @@ ${message}`;
     }
     return true;
   };
-  const markerRenewal = setInterval(() => {
+  const markerRenewal = inRootAsyncContext2(() => setInterval(() => {
     try {
       renewWrapupMarker({
         lastCompartmentEnd: getLastCompartmentEndMessage(ctx.db, sessionId),
@@ -324,7 +327,7 @@ ${message}`;
     } catch (err) {
       sessionLog2(sessionId, `wrapup: marker renewal threw; continuing (${err instanceof Error ? err.message : String(err)})`);
     }
-  }, 60000);
+  }, 60000));
   markerRenewal.unref?.();
   try {
     const activeAtStart = await waitForExistingIncrementalRun(sessionId, resolveWrapupLeaseWaitTimeout(ctx));

package/dist/wrapup-orchestrator-gv08c6f9.js

@@ -0,0 +1,47 @@
+import {
+  runManagedWrapup2
+} from "./index-pjgzdezw.js";
+import"./index-xf6k8szp.js";
+import"./index-hxrvx6cy.js";
+import"./index-s178h9z8.js";
+import"./index-ydjgz36f.js";
+import"./index-b4gcb3rk.js";
+import"./index-sd3egckz.js";
+import"./index-a43xq1pg.js";
+import"./index-n78avt2p.js";
+import"./index-rg1cezmj.js";
+import"./index-7bjgyaj1.js";
+import"./index-4dhv7mqz.js";
+import"./index-jw4gbfkv.js";
+import"./index-pgy3h49n.js";
+import"./index-qt1qqasc.js";
+import"./index-x8a7jmkh.js";
+import"./index-a4b0gbyg.js";
+import"./index-bmwfzz28.js";
+import"./index-kvw6xew3.js";
+import"./index-zf9nydbd.js";
+import"./index-qgp5vnt4.js";
+import"./index-fb3zxn06.js";
+import"./index-fr0wbhdn.js";
+import"./index-0jz47061.js";
+import"./index-mp2kghkv.js";
+import"./index-q28hsbpg.js";
+import"./index-9g1c4bt9.js";
+import"./index-xpn05jxq.js";
+import"./index-1zx87sdm.js";
+import"./index-q76br5zn.js";
+import"./index-angx1s0k.js";
+import"./index-v0p37hm2.js";
+import"./index-w28y7d0z.js";
+import"./index-8kk7yh6m.js";
+import"./index-bd9cjab3.js";
+import"./index-58e3y90n.js";
+import"./index-150zz6fh.js";
+import"./index-gjvjh960.js";
+import"./index-wafzvyhg.js";
+import"./index-mvvephtj.js";
+import"./index-0sahzkwr.js";
+import"./index-pavzsdc6.js";
+export {
+  runManagedWrapup2 as runManagedWrapup
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-magic-context",
-  "version": "0.49.7",
+  "version": "0.49.8",
   "type": "module",
   "description": "OpenCode plugin for Magic Context — cross-session memory and context management",
   "main": "dist/index.js",

package/src/config/compaction-accessor-guard.test.ts

@@ -32,6 +32,9 @@ const ALLOWED_READERS = new Set<string>([
     "packages/cli/src/lib/omp-helpers.ts",
     "packages/cli/src/commands/setup-omp.ts",
     "packages/cli/src/commands/doctor-omp.ts",
+    // The privacy projection recognizes the setting's name in diagnostic text;
+    // it never reads the parsed configuration value.
+    "packages/cli/src/lib/issue-privacy.ts",
 ]);
 
 function sourceFiles(directory: string): string[] {

package/src/features/magic-context/dreamer/cron.ts

@@ -61,6 +61,13 @@ const MINUTE_MS = 60_000;
  */
 const MAX_SEARCH_MS = 4 * 366 * 24 * 60 * MINUTE_MS;
 
+let candidateVisitsForTests: (() => void) | undefined;
+
+/** Count searched minutes in tests without affecting normal cron callers. */
+export function __setCronCandidateVisitCounterForTests(counter?: () => void): void {
+    candidateVisitsForTests = counter;
+}
+
 /** Parse one field into the set of matching values, or null on error. */
 function parseField(token: string, spec: FieldSpec): Set<number> | null {
     const values = new Set<number>();
@@ -226,6 +233,7 @@ export function nextOccurrence(
     const capMs = afterMs + Math.max(0, Math.min(MAX_SEARCH_MS, maxSearchMs));
 
     while (cursorMs <= capMs) {
+        candidateVisitsForTests?.();
         const candidate = new Date(cursorMs);
         if (matchesCron(cron, candidate)) {
             if (!excludeCivilMinute || civilMinuteKey(candidate) !== excludeCivilMinute) {

package/src/shared/history-owner.test.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import { handoffHistoryWork } from "./history-owner";
+import type { MagicContextRpcClient } from "./rpc-client";
+
+test("moved-session recomp is handed to the current directory before local work starts", async () => {
+    const calls: unknown[] = [];
+    const result = await handoffHistoryWork({
+        storageDir: "/isolated/mc",
+        directory: "/old",
+        sessionId: "session",
+        method: "recomp",
+        params: { sessionId: "session" },
+        readDirectory: async () => "/new",
+        findOwner: async () =>
+            ({
+                call: async (...args: unknown[]) => {
+                    calls.push(args);
+                    return { ok: true };
+                },
+            }) as unknown as MagicContextRpcClient,
+    });
+    expect(result).toEqual({ ok: true });
+    expect(calls).toEqual([
+        ["recomp", { sessionId: "session", directory: "/new", historyHandoff: true }],
+    ]);
+});
+
+test("moved-session recovery explains how to load a missing owner and stops handoff loops", async () => {
+    for (const historyHandoff of [false, true]) {
+        const result = await handoffHistoryWork({
+            storageDir: "/isolated/mc",
+            directory: "/old",
+            sessionId: "session",
+            method: "wrapup",
+            params: { sessionId: "session", historyHandoff },
+            readDirectory: async () => "/new",
+            findOwner: async () => null,
+        });
+        expect(result?.ok).toBe(false);
+        expect(result?.error).toContain(
+            "Reopen this session in its current project directory (/new)",
+        );
+    }
+});
+
+test("history recovery remains local when the host still reports this directory", async () => {
+    expect(
+        await handoffHistoryWork({
+            storageDir: "/isolated/mc",
+            directory: "/project",
+            sessionId: "session",
+            method: "recomp",
+            params: {},
+            readDirectory: async () => "/project",
+            findOwner: async () => {
+                throw new Error("must not discover");
+            },
+        }),
+    ).toBeUndefined();
+});

package/src/shared/history-owner.ts

@@ -0,0 +1,43 @@
+import { sameProjectDirectory } from "./project-directory-key";
+import { MagicContextRpcClient } from "./rpc-client";
+
+/** History-compression children need the current project plugin's prompt and recognition of their run IDs. */
+export async function handoffHistoryWork(args: {
+    storageDir: string;
+    directory: string;
+    sessionId: string;
+    method: string;
+    params: Record<string, unknown>;
+    readDirectory: () => Promise<string | null>;
+    findOwner?: typeof MagicContextRpcClient.findSessionOwner;
+}): Promise<Record<string, unknown> | undefined> {
+    const current = await args.readDirectory();
+    if (current && sameProjectDirectory(current, args.directory)) return undefined;
+    const action = `Reopen this session in its current project directory${current ? ` (${current})` : ""}, then run /ctx-recomp.`;
+    if (!current || args.params.historyHandoff === true)
+        return {
+            ok: false,
+            error: `History recovery could not locate a stable owning instance. ${action}`,
+        };
+    const owner = await (args.findOwner ?? MagicContextRpcClient.findSessionOwner)(
+        args.storageDir,
+        args.sessionId,
+    );
+    if (!owner)
+        return {
+            ok: false,
+            error: `History recovery needs the instance for ${current}. ${action}`,
+        };
+    try {
+        return await owner.call(args.method, {
+            ...args.params,
+            directory: current,
+            historyHandoff: true,
+        });
+    } catch {
+        return {
+            ok: false,
+            error: `The owning instance could not accept history recovery. ${action}`,
+        };
+    }
+}

package/src/shared/host-stall-profiler-node.ts

@@ -224,7 +224,7 @@ export function createNodeHostStallProfiler(deps: NodeProfilerDeps): HostStallPr
             const api = await deps.createSession();
             if (stopped || !existsSync(enablePath)) return;
             session = api;
-            api.connect();
+            inRootAsyncContext(() => api.connect());
             await post(api, "Profiler.enable");
             await post(api, "Profiler.setSamplingInterval", {
                 interval: Math.round(options.sampleIntervalMs * 1000),
@@ -272,3 +272,5 @@ export function createNodeHostStallProfiler(deps: NodeProfilerDeps): HostStallPr
         isUnavailable: () => unavailable,
     };
 }
+
+import { inRootAsyncContext } from "./sqlite";

package/src/shared/host-stall-profiler.ts

@@ -29,7 +29,7 @@ export function startHostStallProfilerSwitch(): void {
             now: () => performance.now(),
             wallNow: () => Date.now(),
             setInterval: (callback, ms) => {
-                const handle = setInterval(callback, ms);
+                const handle = inRootAsyncContext(() => setInterval(callback, ms));
                 (handle as { unref?: () => void }).unref?.();
                 return handle;
             },
@@ -55,3 +55,5 @@ export function startHostStallProfilerSwitch(): void {
         log("[magic-context] host stall profiler: could not start the enable-file switch", error);
     }
 }
+
+import { inRootAsyncContext } from "./sqlite";

package/src/shared/off-thread-migration-clock.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import {
     __resetOffThreadMigrationClockForTests,
+    __setOffThreadMigrationClockForTests,
     beginOffThreadMigration,
     startBootDeadline,
 } from "./off-thread-migration-clock";
@@ -11,6 +12,49 @@ async function expiredWithin(promise: Promise<void>, ms: number): Promise<boolea
     return Promise.race([promise.then(() => true), sleep(ms).then(() => false)]);
 }
 
+function createFakeClock() {
+    let now = 0;
+    let nextTimerId = 0;
+    const timers = new Map<number, { at: number; callback: () => void }>();
+    let timerCountWaiter: { count: number; resolve: () => void } | undefined;
+
+    return {
+        now: () => now,
+        setTimeout: (callback: () => void, delayMs: number) => {
+            const id = ++nextTimerId;
+            timers.set(id, { at: now + Math.max(0, delayMs), callback });
+            if (timerCountWaiter?.count === timers.size) {
+                timerCountWaiter.resolve();
+                timerCountWaiter = undefined;
+            }
+            return () => {
+                timers.delete(id);
+            };
+        },
+        advanceBy: (ms: number) => {
+            now += ms;
+            while (true) {
+                const next = [...timers.entries()].sort(
+                    (left, right) => left[1].at - right[1].at,
+                )[0];
+                if (!next || next[1].at > now) return;
+                timers.delete(next[0]);
+                next[1].callback();
+            }
+        },
+        waitForTimerCount: (count: number) => {
+            if (timers.size === count) return Promise.resolve();
+            return new Promise<void>((resolve) => {
+                timerCountWaiter = { count, resolve };
+            });
+        },
+    };
+}
+
+async function isSettled(promise: Promise<void>): Promise<boolean> {
+    return Promise.race([promise.then(() => true), Promise.resolve(false)]);
+}
+
 describe("boot deadline that excludes off-thread migration time", () => {
     afterEach(() => __resetOffThreadMigrationClockForTests());
 
@@ -19,32 +63,58 @@ describe("boot deadline that excludes off-thread migration time", () => {
         expect(await expiredWithin(deadline.expired, 500)).toBe(true);
     });
 
-    test("does not expire while a migration runs, and resumes counting afterwards", async () => {
+    test("does not count migration time and resumes with only the pre-migration time spent", async () => {
+        const clock = createFakeClock();
+        __setOffThreadMigrationClockForTests(clock);
         let deferred = 0;
+        let signalDeferred!: () => void;
+        const wasDeferred = new Promise<void>((resolve) => {
+            signalDeferred = resolve;
+        });
         const deadline = startBootDeadline(40, () => {
             deferred += 1;
+            signalDeferred();
         });
+        clock.advanceBy(15);
         const end = beginOffThreadMigration();
-        expect(await expiredWithin(deadline.expired, 150)).toBe(false);
+        clock.advanceBy(25);
+        await wasDeferred;
         expect(deferred).toBe(1);
 
-        const endedAt = performance.now();
+        clock.advanceBy(1_000_000);
+        expect(await isSettled(deadline.expired)).toBe(false);
+
+        const nextTimer = clock.waitForTimerCount(1).then(() => "scheduled" as const);
         end();
+        expect(
+            await Promise.race([nextTimer, deadline.expired.then(() => "expired" as const)]),
+        ).toBe("scheduled");
+
+        clock.advanceBy(24);
+        expect(await isSettled(deadline.expired)).toBe(false);
+        clock.advanceBy(1);
         await deadline.expired;
-        // Only the few milliseconds before the migration began were counted, so
-        // nearly the whole 40ms budget is still left once it ends.
-        expect(performance.now() - endedAt).toBeGreaterThanOrEqual(25);
     });
 
     test("time between migrations still counts", async () => {
+        const clock = createFakeClock();
+        __setOffThreadMigrationClockForTests(clock);
         const deadline = startBootDeadline(60);
-        await sleep(40);
+        clock.advanceBy(40);
         const end = beginOffThreadMigration();
-        await sleep(80);
+        clock.advanceBy(80);
+        expect(await isSettled(deadline.expired)).toBe(false);
+
+        const nextTimer = clock.waitForTimerCount(1).then(() => "scheduled" as const);
         end();
-        const endedAt = performance.now();
+        expect(
+            await Promise.race([nextTimer, deadline.expired.then(() => "expired" as const)]),
+        ).toBe("scheduled");
+
+        clock.advanceBy(19);
+        expect(await isSettled(deadline.expired)).toBe(false);
+        clock.advanceBy(1);
         await deadline.expired;
-        expect(performance.now() - endedAt).toBeLessThan(45);
     });
 
     test("a cancelled deadline never expires", async () => {

package/src/shared/off-thread-migration-clock.ts

@@ -19,9 +19,26 @@ let activeSince = 0;
 let accumulatedMs = 0;
 let idleWaiters: Array<() => void> = [];
 
+interface TestClock {
+    now(): number;
+    setTimeout(callback: () => void, delayMs: number): () => void;
+}
+
+let testClock: TestClock | undefined;
+
+function now(): number {
+    return testClock?.now() ?? performance.now();
+}
+
+function scheduleTimeout(callback: () => void, delayMs: number): () => void {
+    if (testClock) return testClock.setTimeout(callback, delayMs);
+    const timer = setTimeout(callback, delayMs);
+    return () => clearTimeout(timer);
+}
+
 /** Total milliseconds any off-thread migration has been running, up to `now`. */
-export function offThreadMigrationMs(now = performance.now()): number {
-    return accumulatedMs + (activeMigrations > 0 ? Math.max(0, now - activeSince) : 0);
+export function offThreadMigrationMs(at = now()): number {
+    return accumulatedMs + (activeMigrations > 0 ? Math.max(0, at - activeSince) : 0);
 }
 
 export function isOffThreadMigrationRunning(): boolean {
@@ -33,7 +50,7 @@ export function isOffThreadMigrationRunning(): boolean {
  * end; calling it more than once has no further effect.
  */
 export function beginOffThreadMigration(): () => void {
-    if (activeMigrations === 0) activeSince = performance.now();
+    if (activeMigrations === 0) activeSince = now();
     activeMigrations += 1;
     let ended = false;
     return () => {
@@ -41,7 +58,7 @@ export function beginOffThreadMigration(): () => void {
         ended = true;
         activeMigrations -= 1;
         if (activeMigrations > 0) return;
-        accumulatedMs += Math.max(0, performance.now() - activeSince);
+        accumulatedMs += Math.max(0, now() - activeSince);
         const waiters = idleWaiters;
         idleWaiters = [];
         for (const wake of waiters) wake();
@@ -66,10 +83,10 @@ export interface BootDeadlineTimer {
  * still running.
  */
 export function startBootDeadline(timeoutMs: number, onDeferred?: () => void): BootDeadlineTimer {
-    const startedAt = performance.now();
+    const startedAt = now();
     const migratedAtStart = offThreadMigrationMs(startedAt);
     const budgetMs = Math.max(0, timeoutMs);
-    let timer: ReturnType<typeof setTimeout> | undefined;
+    let cancelTimer: (() => void) | undefined;
     let cancelled = false;
     let deferredReported = false;
     let resolveExpired!: () => void;
@@ -78,13 +95,14 @@ export function startBootDeadline(timeoutMs: number, onDeferred?: () => void): B
     });
 
     const remainingMs = (): number => {
-        const now = performance.now();
-        const countedMs = now - startedAt - (offThreadMigrationMs(now) - migratedAtStart);
+        const currentTime = now();
+        const countedMs =
+            currentTime - startedAt - (offThreadMigrationMs(currentTime) - migratedAtStart);
         return budgetMs - countedMs;
     };
 
     const check = (): void => {
-        timer = undefined;
+        cancelTimer = undefined;
         if (cancelled) return;
         if (isOffThreadMigrationRunning()) {
             if (!deferredReported) {
@@ -96,28 +114,34 @@ export function startBootDeadline(timeoutMs: number, onDeferred?: () => void): B
         }
         const left = remainingMs();
         if (left > 0) {
-            timer = setTimeout(check, left);
+            cancelTimer = scheduleTimeout(check, left);
             return;
         }
         resolveExpired();
     };
 
-    timer = setTimeout(check, budgetMs);
+    cancelTimer = scheduleTimeout(check, budgetMs);
     return {
         expired,
         cancel: () => {
             cancelled = true;
-            if (timer) clearTimeout(timer);
-            timer = undefined;
+            cancelTimer?.();
+            cancelTimer = undefined;
         },
     };
 }
 
+/** Inject deterministic time and timers in tests; production uses host APIs. */
+export function __setOffThreadMigrationClockForTests(clock?: TestClock): void {
+    testClock = clock;
+}
+
 /** Test seam: forget accumulated migration time between isolated tests. */
 export function __resetOffThreadMigrationClockForTests(): void {
     activeMigrations = 0;
     activeSince = 0;
     accumulatedMs = 0;
+    testClock = undefined;
     const waiters = idleWaiters;
     idleWaiters = [];
     for (const wake of waiters) wake();

package/src/shared/redaction.test.ts

@@ -132,3 +132,19 @@ describe("redaction gaps: unambiguous secret key names and header/URL credential
         expect(apiKey).toContain("x-api-key");
     });
 });
+
+describe("public diagnostic credential shapes", () => {
+    test("redacts unquoted colon credentials without removing scalar diagnostics", () => {
+        expect(redactSecretText("password: colonSecret700 token: anotherSecret700")).toBe(
+            "password: <REDACTED:credential> token: <REDACTED:credential>",
+        );
+        expect(redactSecretText("token: 1234567 secret: false")).toBe(
+            "token: 1234567 secret: false",
+        );
+    });
+    test("redacts hyphenated and underscored GitHub token payloads completely", () => {
+        expect(redactSecretText("ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-extra_payload")).toBe(
+            "<GITHUB_TOKEN_REDACTED>",
+        );
+    });
+});

package/src/shared/redaction.ts

@@ -152,7 +152,7 @@ const SECRET_TEXT_PATTERNS: Array<{
         replacement: "<GITHUB_PAT_REDACTED>",
     },
     {
-        pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9]{30,}/g,
+        pattern: /\b(?:gh[opsu]|ghr)_[A-Za-z0-9_-]{30,}/g,
         replacement: "<GITHUB_TOKEN_REDACTED>",
     },
     {
@@ -190,6 +190,13 @@ const SECRET_TEXT_PATTERNS: Array<{
         replacement: (full: string, prefix: string, value: string) =>
             isNonSecretScalarValue(value) ? full : `${prefix}<REDACTED:api_key>`,
     },
+    {
+        // Unquoted diagnostic prose also uses colon-delimited credentials.
+        pattern:
+            /\b((?:api[_-]?key|client[_-]?secret|access[_-]?token|token|secret|password|passwd|pwd)\s*:\s*)([^\s'"`,;<>]{6,})/gi,
+        replacement: (full: string, prefix: string, value: string) =>
+            isNonSecretScalarValue(value) ? full : `${prefix}<REDACTED:credential>`,
+    },
     {
         // Credentials embedded in a URL: scheme://user:password@host.
         pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)([^\s/@]+)(@)/gi,