@cruxy/cli 1.5.0 → 1.7.0

package/dist/hooks/config.js

@@ -1,5 +1,6 @@
 import { promises as fs } from "node:fs";
 import path from "node:path";
+import { isReservedSlash } from "../cli/command-catalog.js";
 import { globalDir } from "../config/paths.js";
 import { COMMANDS_DIR_NAME, GLOBAL_DIR_NAME, HOOKS_FILE_NAME, } from "../constants.js";
 import { defaultBlocking, HOOK_SOURCE_PRECEDENCE, HookSpecSchema, SlashFrontmatterSchema, } from "./types.js";
@@ -143,6 +144,23 @@ async function scanCommandsDir(source, dir, out, errors) {
             });
             continue;
         }
+        // A reserved name is refused HERE, at load, and excluded from the catalog
+        // (P10 track 0). Both halves matter. Loading it and letting it lose the
+        // race later is what shipped before: `commands/status.md` parsed, appeared
+        // in `cruxy hooks list` and in the palette, and could not run, because the
+        // shells dispatch `/status` themselves several branches before the custom
+        // catalogue is consulted. Nothing said so at load and nothing said so at
+        // use. Keeping it in the catalog with a warning would fix half of that and
+        // leave the palette advertising a command that does nothing.
+        if (isReservedSlash(name)) {
+            errors.push({
+                source,
+                file,
+                name,
+                message: `"/${name}" is a built-in command and cannot be overridden — rename this file`,
+            });
+            continue;
+        }
         let text;
         try {
             text = await fs.readFile(file, "utf8");

package/dist/hooks/index.js

@@ -2,6 +2,6 @@ export { HOOK_EVENTS, HOOK_SOURCE_PRECEDENCE, HookSpecSchema, HooksFileSchema, S
 export { defaultHookSources, loadHookCatalog, } from "./config.js";
 export { fileTrustStore, fingerprintHooks, isTrusted, memoryTrustStore, trustPath, } from "./trust.js";
 export { HookRunner, } from "./runner.js";
-export { BUILTIN_SLASH_COMMANDS, expandTemplate, isBuiltinSlash, resolveSlash, } from "./slash.js";
+export { expandTemplate, resolveSlash } from "./slash.js";
 export { buildHooksService, } from "./service.js";
 export { buildHooksRouter, } from "./router.js";

package/dist/hooks/router.js

@@ -79,7 +79,7 @@ export async function buildHooksRouter(opts) {
     for (const root of opts.workspace.roots()) {
         const catalog = await loadCatalog(root);
         for (const err of catalog.errors) {
-            opts.logger.warn(`ignoring malformed ${err.source} hook/command "${err.name}" in ${root.name}: ${err.message}`);
+            opts.logger.warn(`ignoring ${err.source} hook/command "${err.name}" in ${root.name}: ${err.message}`);
         }
         // Each root's runner owns ONLY its project hooks. User hooks are global —
         // loaded once (from the primary, whose `sources.user` is identical for every

package/dist/hooks/service.js

@@ -5,15 +5,15 @@ import { defaultHookSources, loadHookCatalog, } from "./config.js";
 import { HookRunner } from "./runner.js";
 import { fileTrustStore } from "./trust.js";
 /**
- * Load the catalog and assemble the {@link HooksService}. Malformed definitions
- * are surfaced (never eval'd, never silently dropped) through the logger; the
- * valid ones proceed.
+ * Load the catalog and assemble the {@link HooksService}. Rejected definitions
+ * — malformed, or a command name the shells reserve — are surfaced (never
+ * eval'd, never silently dropped) through the logger; the valid ones proceed.
  */
 export async function buildHooksService(opts) {
     const sources = opts.sources ?? defaultHookSources(opts.cwd);
     const catalog = await loadHookCatalog(sources);
     for (const err of catalog.errors) {
-        opts.logger.warn(`ignoring malformed ${err.source} hook/command "${err.name}": ${err.message}`);
+        opts.logger.warn(`ignoring ${err.source} hook/command "${err.name}": ${err.message}`);
     }
     const trust = opts.trust ?? fileTrustStore();
     const runner = new HookRunner({

package/dist/hooks/slash.js

@@ -1,29 +1,13 @@
+import { isReservedSlash } from "../cli/command-catalog.js";
 /**
- * Custom slash-command resolution (C.19). Builtins are reserved and always win —
- * a custom command can never shadow `/help`, `/exit`, etc. A resolved custom
- * command is either a `prompt` (expanded to safe text fed to the agent) or a
- * `shell` binding (executed through the SAME gate + sandbox as everything else,
- * by the caller). Nothing here executes anything; it only resolves + expands.
- */
-/** The builtin slash commands (C.13) — reserved, not overridable. */
-export const BUILTIN_SLASH_COMMANDS = [
-    "help",
-    "clear",
-    "compact",
-    "reload",
-    "plan",
-    "exit",
-    "quit",
-];
-const BUILTINS = new Set(BUILTIN_SLASH_COMMANDS);
-/** Is `name` (no leading slash) a reserved builtin? */
-export function isBuiltinSlash(name) {
-    return BUILTINS.has(name);
-}
-/**
- * Resolve one input line. Non-slash input and unknown names → `none`. Builtins
- * short-circuit to `builtin` BEFORE the custom catalog is consulted, so a custom
- * command named after a builtin is inert (surfaced separately at load time).
+ * Resolve one input line. Non-slash input and unknown names → `none`. Reserved
+ * names short-circuit to `builtin` BEFORE the custom catalog is consulted.
+ *
+ * This is now belt-and-braces rather than the only guard: the loader refuses a
+ * command file whose name is reserved, so the colliding spec should never reach
+ * this catalogue at all. It stays because a caller may assemble a spec list by
+ * some other route, and the failure mode this prevents — a project-authored
+ * `shell` command answering to `/clear` — is not one to leave to a single check.
  */
 export function resolveSlash(line, commands) {
     const trimmed = line.trim();
@@ -34,7 +18,7 @@ export function resolveSlash(line, commands) {
     const args = space === -1 ? "" : trimmed.slice(space + 1).trim();
     if (name === "")
         return { kind: "none" };
-    if (isBuiltinSlash(name))
+    if (isReservedSlash(name))
         return { kind: "builtin", name };
     const spec = commands.find((c) => c.name === name);
     if (!spec)

package/dist/lsp/index.js

@@ -1,5 +1,5 @@
 export * from "./types.js";
-export { DEFAULT_SPECS, EXT_TO_LANGUAGE, LspRegistry, binaryOnPath, languageForFile, } from "./registry.js";
+export { DEFAULT_SPECS, EXT_TO_LANGUAGE, LspRegistry, binaryOnPath, languageForFile, resolveBinary, } from "./registry.js";
 export { StdioTransport, TransportTimeoutError, killTree, } from "./transport.js";
 export { Server } from "./server.js";
 export { LspPool } from "./pool.js";

package/dist/lsp/registry.js

@@ -58,27 +58,45 @@ export function languageForFile(filePath) {
     return EXT_TO_LANGUAGE[ext] ?? null;
 }
 /**
- * Default binary-presence check: resolves `command` the way a shell would.
+ * Resolve `command` to an executable FILE, the way a shell would, or `null`.
+ *
  * An absolute/relative path is tested directly; a bare name is searched across
- * `PATH` (with `PATHEXT` on win32). Pure filesystem probing — never spawns.
- * Injectable via {@link LspRegistry} so tests can force present/absent.
+ * `PATH`. On win32 each candidate is also tried with every `PATHEXT` suffix,
+ * which is the only way `pnpm` finds `pnpm.cmd` — Windows installs almost every
+ * npm-shipped tool as a `.cmd` shim, and a lookup that tries the bare name alone
+ * reports a globally installed binary as absent.
+ *
+ * Pure filesystem probing — never spawns. THE ONLY PATH RESOLVER in the CLI
+ * besides `tools/shell/resolve-shell.ts`'s win32 shell hunt, deliberately: a
+ * third one would be a third place for the PATHEXT rule to be forgotten.
  */
-export const binaryOnPath = (command) => {
+export function resolveBinary(command, dirs = (process.env.PATH ?? "")
+    .split(path.delimiter)
+    .filter(Boolean)) {
+    // An explicit path names the file outright — nothing to search.
     if (command.includes(path.sep) || command.includes("/")) {
-        return isExecutable(command);
+        return isExecutable(command) ? command : null;
     }
-    const dirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
+    // PATHEXT only, never a bare `command` fallback on win32: a directory that
+    // holds `pnpm.cmd` usually holds an extensionless `pnpm` beside it (the sh
+    // shim npm installs for Git Bash), and that one cannot be spawned there.
     const exts = process.platform === "win32"
         ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")
         : [""];
     for (const dir of dirs) {
         for (const ext of exts) {
-            if (isExecutable(path.join(dir, command + ext)))
-                return true;
+            const candidate = path.join(dir, command + ext);
+            if (isExecutable(candidate))
+                return candidate;
         }
     }
-    return false;
-};
+    return null;
+}
+/**
+ * Default binary-presence check — {@link resolveBinary} reduced to a yes/no.
+ * Injectable via {@link LspRegistry} so tests can force present/absent.
+ */
+export const binaryOnPath = (command) => resolveBinary(command) !== null;
 function isExecutable(candidate) {
     try {
         const stat = fs.statSync(candidate);

package/dist/memory/secrets.js

@@ -59,3 +59,46 @@ export function containsSecret(text) {
     }
     return { secret: false };
 }
+/**
+ * The global twins of {@link SECRET_PATTERNS}, built once.
+ *
+ * Detection asks "is there one?" and can stop at the first hit; redaction has to
+ * replace EVERY occurrence, which needs the `g` flag — and a `g` regex carries
+ * `lastIndex` state that would make `containsSecret` return alternating answers
+ * for the same input. So the two uses get their own objects rather than sharing
+ * one and remembering to reset it.
+ */
+const GLOBAL_PATTERNS = SECRET_PATTERNS.map(({ kind, re }) => ({ kind, re: new RegExp(re.source, `${re.flags}g`) }));
+/**
+ * Replace every recognised secret in `text` with an opaque marker (P10 track 5).
+ *
+ * THE SAME DENYLIST as detection, deliberately — a `/redact` that used a
+ * different pattern set from the one that refuses a memory write would give two
+ * different answers about what counts as a secret, and the weaker of the two
+ * would be the one a user found out about.
+ *
+ * The marker is fixed text with no quotes, backslashes or control characters, so
+ * a redacted string survives being embedded in JSON unchanged — which is what
+ * lets a `tool_use` input be redacted by round-tripping through its serialised
+ * form rather than by walking an arbitrary shape.
+ *
+ * Everything the pattern matched goes, including a `api_key =` prefix on the
+ * generic assignment rule. Keeping the field name would read better and would
+ * leak the shape of the thing next to a marker announcing that something was
+ * there; the marker's `kind` already says as much as is safe to say.
+ */
+export function redactSecrets(text) {
+    const kinds = [];
+    let count = 0;
+    let out = text;
+    for (const { kind, re } of GLOBAL_PATTERNS) {
+        re.lastIndex = 0;
+        out = out.replace(re, () => {
+            count++;
+            if (!kinds.includes(kind))
+                kinds.push(kind);
+            return `[redacted ${kind}]`;
+        });
+    }
+    return { text: out, kinds, count };
+}

package/dist/plan/service.js

@@ -10,6 +10,9 @@ import { makeSubmitPlanTool } from "./submit-plan.js";
  * read-only + `submit_plan` registry so the agent cannot act before approval;
  * execution runs with the full registry, one step at a time, per-action U.3
  * gating intact.
+ *
+ * A propose phase that ends with NO plan is a completed conversational turn, not
+ * an error — see the `!holder.plan` branch below.
  */
 /** Default cap on plan revisions before failing loud. */
 export const MAX_PLAN_REVISIONS = 3;
@@ -81,9 +84,31 @@ export async function runPlanSession(args) {
             onRequestUsage: args.onRequestUsage,
         }));
         if (!holder.plan) {
-            throw planInvalid("the model ended its turn without calling submit_plan");
+            // NO PLAN IS NOT A FAILURE. The propose phase's registry is read-only plus
+            // `submit_plan`, so a turn that ends without a plan has structurally not
+            // ACTED — it has ANSWERED. "what does this function do?" is a perfectly
+            // ordinary thing to type while a planning mode is on, and the model
+            // replying to it is the correct outcome, not a malformed plan.
+            //
+            // Throwing here was also silently LOSING that reply. The session records
+            // the user's turn before the runner is called and adopts the returned
+            // history after it returns, so an exception left the question on disk with
+            // no answer beside it — a transcript that is wrong, not merely unhelpful.
+            // Returning the accumulated history keeps the answer in both.
+            //
+            // This holds on a revision pass too: a model that answers a piece of
+            // feedback with a question instead of a new plan is asking the user
+            // something, and the user can now answer it on the next turn.
+            return finish();
         }
         const plan = holder.plan;
+        // The one thing that IS invalid: a plan object with nothing executable in
+        // it. `submit_plan` rejects this to the model's face, so reaching it means
+        // something set the holder directly — fail loud rather than run an empty
+        // approval prompt over zero steps.
+        if (plan.steps.length === 0) {
+            throw planInvalid("submit_plan produced a plan with no steps");
+        }
         const decision = await promptPlanDecision(plan, args.io);
         if (decision.kind === "abort") {
             // Committed output goes through the renderer, not the prompt io (P3):

package/dist/plan/submit-plan.js

@@ -38,6 +38,17 @@ export function makeSubmitPlanTool(holder) {
             if (input.steps.length === 0) {
                 return { ok: false, error: "a plan must have at least one step" };
             }
+            // `min(1)` counts characters, so a title of `" "` clears zod and then
+            // trims to nothing — a step that renders as an empty row in the approval
+            // prompt and as an empty instruction during execution. Rejected the same
+            // way as any other tool-input error, so the model resubmits.
+            const blank = input.steps.findIndex((s) => s.title.trim() === "" || s.rationale.trim() === "");
+            if (blank !== -1) {
+                return {
+                    ok: false,
+                    error: `step ${blank + 1} has a blank title or rationale — every step needs both`,
+                };
+            }
             const steps = input.steps.map((s, i) => ({
                 id: String(i + 1),
                 title: s.title.trim(),

package/dist/render/capabilities.js

@@ -1,7 +1,14 @@
 import { shouldUseColor } from "../errors/index.js";
 import { detectScreenReader, detectUnicode } from "../theme/index.js";
-/** Set-and-non-empty (the NO_COLOR convention): any non-empty value counts. */
-function isSet(value) {
+/**
+ * Set-and-non-empty (the NO_COLOR convention): any non-empty value counts.
+ *
+ * Exported so every cruxy env flag reads the SAME rule. The README states it
+ * once for all of them — `CRUXY_ASCII=false` enables ASCII — and a flag that
+ * quietly parsed its value instead would make that documentation wrong for one
+ * variable with nothing to point at.
+ */
+export function isSet(value) {
     return value !== undefined && value !== "";
 }
 /** Fallback width when the terminal reports none (non-TTY, pipe, unknown). */

package/dist/render/context-view.js

@@ -51,8 +51,8 @@ export function contextReportLines(report, t, width = Infinity) {
     // The headline, worded exactly as the panel words it — same estimate, same
     // caveats, so the detail view can never read as the more authoritative one.
     lines.push(`${t.strong(`${approx(reading.used)} / ${formatTokens(reading.total)} budget`)} ` +
-        t.muted(`(estimated · budget is a local setting, not the model's window)`));
-    lines.push(t.muted(`${report.messages} message${report.messages === 1 ? "" : "s"} · compacts above ${approx(reading.compactAt)}`));
+        t.muted(`(estimated${t.sep}budget is a local setting, not the model's window)`));
+    lines.push(t.muted(`${report.messages} message${report.messages === 1 ? "" : "s"}${t.sep}compacts above ${approx(reading.compactAt)}`));
     // ── where the tokens are ──────────────────────────────────────────────────
     const historyTokens = report.parts.reduce((sum, p) => sum + p.tokens, 0);
     lines.push("");

package/dist/render/index.js

@@ -8,7 +8,7 @@ import { TtyRenderer } from "./tty-renderer.js";
 import { TuiRenderer } from "../tui/renderer.js";
 import { GitStatusCache } from "../tui/git-status.js";
 import { ToolVersions } from "../tui/tool-versions.js";
-import { supportsTui } from "../tui/supports.js";
+import { supportsTui, usesAltScreen } from "../tui/supports.js";
 export { detectCapabilities, detectReducedMotion, resolveColumns, resolveRows, DEFAULT_COLUMNS, DEFAULT_ROWS, } from "./capabilities.js";
 export { attachResize, processResizeSignal, } from "./resize.js";
 export { fit, fitMiddle, reflow, stripAnsi, visibleWidth, kvStack, MIN_VALUE_COLS, } from "./layout.js";
@@ -53,6 +53,11 @@ export function createRenderer(out = process.stdout, err = process.stderr, env =
             // Constructed, not started: `ToolVersions` probes nothing until the
             // renderer paints the panel, so this costs an object and no subprocess.
             tools: new ToolVersions(),
+            // Resolved against THIS factory's env (Q4 track 3), not `process.env`.
+            // The renderer's own default reads the real environment, which is right
+            // for a direct construction and wrong here: an injected env exists
+            // precisely so a caller can describe a terminal that is not this one.
+            altScreen: usesAltScreen(caps, env),
         });
     }
     return caps.cursor

package/dist/render/plan-view.js

@@ -61,7 +61,7 @@ export function planChecklist(steps, t, maxRows = Infinity, width = Infinity) {
         return [];
     const done = steps.filter((s) => s.status === "done").length;
     const failed = steps.filter((s) => s.status === "failed").length;
-    const header = t.strong(`plan ${done}/${steps.length}${failed > 0 ? t.danger(` · ${failed} failed`) : ""}`);
+    const header = t.strong(`plan ${done}/${steps.length}${failed > 0 ? t.danger(`${t.sep}${failed} failed`) : ""}`);
     const finish = (lines) => Number.isFinite(width)
         ? lines.map((l) => fit(l, width, t.glyph.ellipsis))
         : lines;

package/dist/render/status-view.js

@@ -40,7 +40,7 @@ function groupLocations(locations) {
  */
 function diskLines(locations, t) {
     return groupLocations(locations).map((group, i) => {
-        const text = formatCapacity(group.capacity);
+        const text = formatCapacity(group.capacity, t.glyph.sep);
         const level = capacityLevel(group.capacity);
         const value = level === "critical"
             ? t.danger(text)
@@ -53,7 +53,7 @@ function diskLines(locations, t) {
 /** The full `/status` block as lines to print. */
 export function sessionStatusLines(status, t, width = Infinity) {
     const lines = [t.heading("status")];
-    lines.push(row("session", `${status.sessionId.slice(0, 8)} ${t.muted(`· ${status.turns} turn${status.turns === 1 ? "" : "s"}`)}`, t));
+    lines.push(row("session", `${status.sessionId.slice(0, 8)} ${t.muted(`${t.glyph.sep} ${status.turns} turn${status.turns === 1 ? "" : "s"}`)}`, t));
     // The mode leads the safety half, and carries its description rather than its
     // name alone. The objection that removed the auto-approve config flag was that
     // it disarmed the gate with nothing on screen saying so; a status screen
@@ -68,7 +68,7 @@ export function sessionStatusLines(status, t, width = Infinity) {
     if (status.context) {
         const { used, total, compactAt } = status.context;
         lines.push(row("context", `${t.strong(`~${formatTokens(used)} / ${formatTokens(total)} budget`)} ` +
-            t.muted(`· compacts above ~${formatTokens(compactAt)}`), t));
+            t.muted(`${t.glyph.sep} compacts above ~${formatTokens(compactAt)}`), t));
     }
     // A sandbox that is ON but whose runtime we cannot name is reported as on
     // WITHOUT a name, rather than omitted — the safety-relevant half is that it
@@ -89,9 +89,9 @@ export function sessionStatusLines(status, t, width = Infinity) {
         const { total, running, needingApproval } = status.jobs;
         const detail = total === 0
             ? t.muted("none this session")
-            : `${total} · ${running} running` +
+            : `${total}${t.sep}${running} running` +
                 (needingApproval > 0
-                    ? t.warning(` · ${needingApproval} awaiting approval`)
+                    ? t.warning(`${t.sep}${needingApproval} awaiting approval`)
                     : "");
         lines.push(row("jobs", detail, t));
     }

package/dist/render/units.js

@@ -0,0 +1,22 @@
+/**
+ * Display units shared by every surface that shows a token figure (P10 track 3).
+ *
+ * `compactTokens` lived in `tui/limits-panel.ts` while it was the rail's alone.
+ * `/budget` states the same quantity — weighted tokens — against the same server
+ * windows, and the two must not round differently: a panel reading `8.5M` beside
+ * a command reading `8500000` is one fact wearing two faces.
+ */
+/** 14_000_000 → "14M", 8_700_000 → "8.7M", 125_000 → "125k", 900 → "900". */
+export function compactTokens(n) {
+    const abs = Math.abs(n);
+    if (abs >= 1_000_000)
+        return `${trimZero(n / 1_000_000)}M`;
+    if (abs >= 1_000)
+        return `${trimZero(n / 1_000)}k`;
+    return `${Math.round(n)}`;
+}
+/** One decimal, but only when it says something: 8.7 stays, 14.0 becomes 14. */
+function trimZero(n) {
+    const one = n.toFixed(1);
+    return one.endsWith(".0") ? one.slice(0, -2) : one;
+}

package/dist/session/index.js

@@ -15,6 +15,7 @@ export { PROJECTS_DIR_NAME, RESERVED_SUBDIRS, SESSION_FILE_EXT, projectDir, proj
 export { SessionLog } from "./log.js";
 export { defaultExportName, exportMarkdown, } from "./export.js";
 export { foldEvents, readEvents, readMeta, replaySession } from "./replay.js";
+export { redactMessages } from "./redact.js";
 export { findSession, isAmbiguous, listSessions, summarizeSession, } from "./list.js";
 export { cwdMismatchWarning, describeSession, loadResume, relativeAge, resumeById, resumePicker, shortId, PICKER_LIMIT, } from "./resume.js";
 export { SESSION_FILE_VERSION, SessionEventSchema, SessionMetaSchema, } from "./types.js";

package/dist/session/log.js

@@ -92,6 +92,25 @@ export class SessionLog {
             outputTokens,
         });
     }
+    /**
+     * `/redact` (P10 track 5): from here on, replay masks every recognised secret
+     * in the history recorded SO FAR.
+     *
+     * The one writer in this class that changes how EARLIER lines are read. It
+     * does not touch them — see the class header on why this file is only ever
+     * appended to — and it deliberately records no secret material: `kinds` and
+     * `count` say what was found, which is all a reader could already work out by
+     * running the same detector.
+     */
+    redact(kinds, count) {
+        this.write({
+            kind: "redact",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            kinds,
+            count,
+        });
+    }
     runId() {
         const id = this.currentRunId?.();
         return id === undefined ? {} : { runId: id };

package/dist/session/redact.js

@@ -0,0 +1,74 @@
+import { redactSecrets } from "../memory/secrets.js";
+/**
+ * Mask every recognised secret across a whole message array.
+ *
+ * Returns a NEW array (and new blocks) rather than mutating: the caller's array
+ * is the one the recorder's watermark is measured against, and replacing it
+ * wholesale is what `Session` already does after every turn.
+ */
+export function redactMessages(messages) {
+    const kinds = [];
+    let count = 0;
+    const scrub = (text) => {
+        const r = redactSecrets(text);
+        count += r.count;
+        for (const k of r.kinds)
+            if (!kinds.includes(k))
+                kinds.push(k);
+        return r.text;
+    };
+    const out = messages.map((message) => {
+        if (typeof message.content === "string") {
+            return { ...message, content: scrub(message.content) };
+        }
+        return {
+            ...message,
+            content: message.content.map((block) => scrubBlock(block, scrub)),
+        };
+    });
+    return { messages: out, kinds, count };
+}
+/**
+ * One content block.
+ *
+ * `tool_use.input` is arbitrary JSON and is where the highest-risk material
+ * actually lands — a `run_command` whose argv carries a token, an HTTP tool with
+ * an auth header. It is redacted by round-tripping through its serialised form
+ * rather than by walking an unknown shape: the marker contains no character JSON
+ * escapes, so the string stays parseable, and a parse failure (which should be
+ * impossible) leaves the block untouched rather than corrupting a history the
+ * provider has to accept on the next turn.
+ *
+ * An unknown block kind is passed through unchanged. A newer cruxy's block must
+ * survive an older one reading the file (`ContentBlockSchema` says so), and
+ * inventing a redaction for a shape this build cannot interpret would be the
+ * lossy behaviour that rule exists to prevent.
+ */
+function scrubBlock(block, scrub) {
+    if (block.type === "text")
+        return { ...block, text: scrub(block.text) };
+    if (block.type === "tool_result") {
+        return { ...block, content: scrub(block.content) };
+    }
+    if (block.type === "tool_use") {
+        if (block.input === undefined)
+            return block;
+        let serialised;
+        try {
+            serialised = JSON.stringify(block.input);
+        }
+        catch {
+            return block; // not serialisable — leave it exactly as it was
+        }
+        const scrubbed = scrub(serialised);
+        if (scrubbed === serialised)
+            return block;
+        try {
+            return { ...block, input: JSON.parse(scrubbed) };
+        }
+        catch {
+            return block;
+        }
+    }
+    return block;
+}

package/dist/session/replay.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { modeFromFlags } from "../agent/mode.js";
+import { redactMessages } from "./redact.js";
 import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
 /**
  * Replay: fold an append-only event log back into the state a session needs to
@@ -74,6 +75,7 @@ export function foldEvents(events, skipped = 0) {
     // timestamp.
     let planMode = false;
     let mode = null;
+    let redactions = 0;
     const usage = { input_tokens: 0, output_tokens: 0 };
     for (const event of events) {
         switch (event.kind) {
@@ -101,6 +103,19 @@ export function foldEvents(events, skipped = 0) {
                 usage.input_tokens += event.inputTokens;
                 usage.output_tokens += event.outputTokens;
                 break;
+            case "redact":
+                // Exactly what `Session.redact` did in memory: mask every recognised
+                // secret across the history AS IT STANDS. Position in the fold is the
+                // whole meaning of the event — messages appended afterwards are not
+                // covered, because at the moment the user asked, they did not exist.
+                //
+                // The event's own `kinds`/`count` are deliberately not consulted: they
+                // record what the writing build found, and this build's denylist may
+                // have grown since. Re-running the detector is what makes a redaction
+                // get stronger over time rather than being frozen at write time.
+                messages = redactMessages(messages).messages;
+                redactions++;
+                break;
             case "meta":
                 break;
         }
@@ -114,6 +129,7 @@ export function foldEvents(events, skipped = 0) {
         // could be on, so nothing is being inferred.
         mode: mode ?? modeFromFlags(planMode, false),
         skipped,
+        redactions,
     };
 }
 /** Read and parse a session file into its events, counting unusable lines. */

package/dist/session/resume.js

@@ -71,6 +71,14 @@ export function loadResume(session, cwd) {
         warnings.push(`${state.skipped} unreadable line${state.skipped === 1 ? "" : "s"} in the session log were skipped — ` +
             `the restored history may be incomplete`);
     }
+    if (state.redactions > 0) {
+        // Said on resume because the alternative is a user finding `[redacted …]`
+        // in a transcript and not knowing whether cruxy did it or the model wrote
+        // it. The second clause is the part that is easy to leave out and matters
+        // most: `/redact` never rewrote the file it is being replayed from.
+        warnings.push(`this session was redacted ${state.redactions === 1 ? "once" : `${state.redactions} times`} — ` +
+            `secrets are masked in the restored history, but the original text is still in ${session.file}`);
+    }
     return { session, state, warnings };
 }
 /**

package/dist/session/types.js

@@ -211,6 +211,43 @@ export const UsageEventSchema = z
     outputTokens: z.number().int().nonnegative(),
 })
     .passthrough();
+/**
+ * `/redact` (P10 track 5): every recognised secret in the history SO FAR is
+ * masked from this point in the fold onwards.
+ *
+ * A NEW EVENT RATHER THAN A REWRITE, and that is the entire design. Editing the
+ * earlier lines would mean re-serialising the file, which costs the two
+ * properties this format exists for — O(1) writes per turn, and a crash costing
+ * a torn last line instead of a conversation (see the module header, and
+ * `log.ts` on why temp-then-rename is wrong here). So a redaction changes how
+ * earlier lines are READ, and the earlier lines stay exactly as they were.
+ *
+ * THE EVENT CARRIES NO SECRET, deliberately: recording the strings to remove
+ * would write them into the log in order to say they should not be there. The
+ * fold re-derives the spans by re-running the detector, which is deterministic
+ * over the same messages and gives a reader nothing it could not already see.
+ *
+ * `kinds` and `count` are what the pass FOUND — a record for the user, not an
+ * instruction to the fold. The fold ignores them; a build whose denylist has
+ * since grown will legitimately mask more than the number written here, and
+ * treating the count as authoritative would cap it at what an older build knew.
+ *
+ * An older cruxy that has never heard of this kind SKIPS the line (`replay.ts`)
+ * and shows the unredacted history. That is the honest failure for a
+ * forward-compatibility rule that must not lose conversations, and it is why the
+ * command says the file itself still holds the raw text.
+ */
+export const RedactEventSchema = z
+    .object({
+    kind: z.literal("redact"),
+    at: z.string(),
+    runId: z.string().optional(),
+    /** Secret kinds the pass matched, for the record. Not read by the fold. */
+    kinds: z.array(z.string()).default([]),
+    /** Spans replaced at write time. Not read by the fold. */
+    count: z.number().int().nonnegative().default(0),
+})
+    .passthrough();
 /** Every event, discriminated on `kind`. */
 export const SessionEventSchema = z.discriminatedUnion("kind", [
     SessionMetaSchema,
@@ -220,4 +257,5 @@ export const SessionEventSchema = z.discriminatedUnion("kind", [
     PlanModeEventSchema,
     SessionModeEventSchema,
     UsageEventSchema,
+    RedactEventSchema,
 ]);