@gaunt-sloth/core 2.0.0-alpha.19 → 2.0.0-alpha.20

package/dist/utils/debugDump.js

@@ -3,8 +3,9 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { inspect } from 'node:util';
 import { ensureGlobalGslothDir } from '#src/utils/globalConfigUtils.js';
-import { getSlothVersion } from '#src/utils/systemUtils.js';
+import { env, getSlothVersion } from '#src/utils/systemUtils.js';
 import { getDebugLogBuffer } from '#src/utils/debugUtils.js';
+import { REDACTED, collectSecretValues, redactText, redactValue, } from '#src/utils/redactSecrets.js';
 /**
  * Best-effort git repo state (branch/remote/dirty). Uses `execFileSync` — NOT the existing
  * `execAsync` helper in systemUtils.ts (a promisified wrapper used elsewhere for `gh` calls) —
@@ -71,21 +72,143 @@ function safeStringify(value) {
         return inspect(value, { showHidden: false, depth: 5, colors: false });
     }
 }
+/**
+ * The filesystem-safe directory-name segment for one dump: the ISO timestamp with `:` and `.`
+ * (illegal on Windows, noisy everywhere) replaced by `-`. This is the ONLY path component
+ * debugDump generates — and the only one it is responsible for sanitizing. The parent it is joined
+ * under (the global `~/.gsloth` dir) is supplied by the environment and may legitimately carry a
+ * drive-letter colon on Windows (`C:\…`), which is not ours to strip. Exported so the invariant
+ * "the generated segment is colon-free" is testable on any platform without asserting anything
+ * about the (platform-dependent) parent path (GS2-50).
+ */
+export function debugDumpDirName(date = new Date()) {
+    return date.toISOString().replace(/[:.]/g, '-');
+}
+/**
+ * GS2-54 (gap 3) — a live LangChain chat model is detected structurally, NOT by field name: a real
+ * `BaseChatModel` exposes `_llmType()` and `invoke()` as functions. This duck-type is the LOAD-BEARING
+ * invariant that lets us strip a *live* model to a descriptor (below) WITHOUT also flattening a plain
+ * `{ type, model, apiKey }` config object — the latter must keep flowing through {@link redactValue}'s
+ * field-masking (key kept, value masked). Do NOT "simplify" this into an unconditional strip.
+ */
+function isLiveChatModel(llm) {
+    if (llm == null || typeof llm !== 'object')
+        return false;
+    const m = llm;
+    return typeof m._llmType === 'function' || typeof m.invoke === 'function';
+}
+/**
+ * GS2-54 (gap 3) — a short, secret-free descriptor for a live chat model, mirroring the spirit of
+ * `configCommand.ts`'s `redactConfigForPrint`. Never returns the live object or any of its internals
+ * (client instances, cached kwargs, inline keys) — only a `type` + `model` label. Each field probe
+ * is guarded so a hostile/exotic getter can't throw out of here.
+ */
+function describeLiveModel(config, llm) {
+    const m = llm;
+    let type = 'unknown';
+    try {
+        const t = (typeof m._llmType === 'function' ? m._llmType() : undefined) ??
+            (Array.isArray(m.lc_namespace) ? m.lc_namespace.join('/') : undefined) ??
+            (typeof config.type === 'string'
+                ? config.type
+                : undefined) ??
+            m.constructor?.name;
+        if (typeof t === 'string' && t.length > 0)
+            type = t;
+    }
+    catch {
+        // keep 'unknown' — a throwing getter must not defeat the strip
+    }
+    let model = 'unknown';
+    try {
+        const md = config.modelDisplayName;
+        const mdl = (typeof md === 'string' && md.length > 0 ? md : undefined) ??
+            (typeof m.model === 'string' ? m.model : undefined) ??
+            (typeof m.modelName === 'string' ? m.modelName : undefined);
+        if (typeof mdl === 'string' && mdl.length > 0)
+            model = mdl;
+    }
+    catch {
+        // keep 'unknown'
+    }
+    return { type, model };
+}
+/**
+ * GS2-54 (gap 3) — defense-in-depth for the CONFIG artifact: return a shallow clone of `config` with
+ * a *live* `llm` (a `BaseChatModel`) replaced by a `{ type, model }` descriptor, so the model's large
+ * internal surface (client objects, cached kwargs, inline keys) never reaches disk — rather than
+ * relying on {@link redactValue}'s field-masking alone. PURE: never mutates the caller's config.
+ * FAIL-SAFE: on any error, or when `llm` is absent / not a live model, return the ORIGINAL config
+ * unchanged so {@link redactValue}'s existing GS2-47 masking still applies (never less-redacted).
+ */
+function stripLiveModelForConfig(config) {
+    try {
+        if (config == null || typeof config !== 'object' || Array.isArray(config))
+            return config;
+        const record = config;
+        if (!('llm' in record) || !isLiveChatModel(record.llm))
+            return config;
+        return { ...record, llm: describeLiveModel(record, record.llm) };
+    }
+    catch {
+        return config; // fail safe: fall back to redactValue over the untouched config
+    }
+}
+/**
+ * GS2-47 — render the CONFIG artifact: {@link redactValue} applies sensitive-field masking (keys
+ * kept, values masked) plus literal/pattern string redaction, then {@link safeStringify}. Fail-safe:
+ * any throw yields the fully-withheld marker rather than raw content ("redact more on error, never
+ * write a raw artifact because redaction hiccuped").
+ *
+ * GS2-54 (gap 3) — before redaction, {@link stripLiveModelForConfig} swaps a live `llm` for a
+ * `{ type, model }` descriptor so the live model's internals never serialize. This runs on a fresh
+ * clone only; the caller's config (and the {@link collectSecretValues} harvest already taken from it)
+ * is untouched, so inline secrets inside the model are still scrubbed from the OTHER artifacts.
+ */
+function renderConfig(config, redact, secrets) {
+    if (!redact)
+        return safeStringify(config);
+    try {
+        return safeStringify(redactValue(stripLiveModelForConfig(config), secrets));
+    }
+    catch {
+        return REDACTED;
+    }
+}
+/**
+ * GS2-47 — render a non-config STRUCTURED artifact (transcript, env, git-state): stringify (never
+ * throws), then literal/pattern-redact the text. Structural field-masking is intentionally NOT
+ * applied here (config-only, per the brief) so a legitimately `token`/`secret`-named field in tool
+ * output is not blanket-masked. {@link redactText} is itself fail-safe.
+ */
+function renderStructured(value, redact, secrets) {
+    const raw = safeStringify(value);
+    return redact ? redactText(raw, secrets) : raw;
+}
 /**
  * Write one timestamped `/debug-dump` archive under the GLOBAL `~/.gsloth/debug-dumps/<timestamp>/`
  * (via `ensureGlobalGslothDir()` — mirrors how `resolveHistoryDbPath()` builds its path under the
  * same dir — NOT the per-project cwd-relative helper of the same name elsewhere in this codebase).
  * Contains: the full transcript, the resolved config, env/version info, the in-memory debugLog
- * ring buffer, and (best-effort) git repo state. Everything is dumped raw/unsanitized — this node
- * ships deliberately unsanitized (GS2-47 adds redaction on top later); the caller is responsible
- * for surfacing the "may contain secrets" warning to the user.
+ * ring buffer, and (best-effort) git repo state.
+ *
+ * GS2-47 — unless `input.redact === false`, the shared secret-redaction pass
+ * ({@link file://./redactSecrets.ts}) is applied to EVERY artifact before it is written: the literal
+ * values of secret-named env vars + inline config secrets are substituted everywhere, a tight set of
+ * provider-key/auth-header patterns is masked, and the config's sensitive fields are masked in place.
+ * On opt-out the archive is raw and the caller surfaces the loud "may contain secrets" warning.
  */
 export function writeDebugDump(input) {
-    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const redact = input.redact !== false; // default ON; only an explicit `false` opts out
+    const timestamp = debugDumpDirName();
     const archiveDir = resolve(ensureGlobalGslothDir(), 'debug-dumps', timestamp);
     mkdirSync(archiveDir, { recursive: true });
-    writeFileSync(resolve(archiveDir, 'transcript.json'), safeStringify(input.transcript), 'utf8');
-    writeFileSync(resolve(archiveDir, 'config.json'), safeStringify(input.config), 'utf8');
+    // Technique 1 (load-bearing): the literal secret values to scrub across ALL artifacts, gathered
+    // from env (by secret-named var) + the config (apiKeyEnvironmentVariable's target + inline
+    // secrets). `env` is the systemUtils accessor (process.env); collection is itself fail-safe.
+    const secrets = redact ? collectSecretValues(input.config, env) : [];
+    writeFileSync(resolve(archiveDir, 'transcript.json'), renderStructured(input.transcript, redact, secrets), 'utf8');
+    writeFileSync(resolve(archiveDir, 'config.json'), renderConfig(input.config, redact, secrets), 'utf8');
     // getSlothVersion() reads the installed package.json via the install dir set at CLI startup
     // (setEntryPoint); guarded so a dump can never fail just because that wasn't wired (e.g. an
     // unusual embedding), falling back to 'unknown'.
@@ -102,11 +225,11 @@ export function writeDebugDump(input) {
         platform: process.platform,
         model: input.modelDisplayName ?? 'unknown',
     };
-    writeFileSync(resolve(archiveDir, 'env.json'), safeStringify(envInfo), 'utf8');
-    writeFileSync(resolve(archiveDir, 'debug-log.txt'), getDebugLogBuffer().join('\n'), 'utf8');
+    writeFileSync(resolve(archiveDir, 'env.json'), renderStructured(envInfo, redact, secrets), 'utf8');
+    writeFileSync(resolve(archiveDir, 'debug-log.txt'), redact ? redactText(getDebugLogBuffer().join('\n'), secrets) : getDebugLogBuffer().join('\n'), 'utf8');
     const gitState = collectGitState(input.cwd ?? process.cwd());
     if (gitState) {
-        writeFileSync(resolve(archiveDir, 'git-state.json'), safeStringify(gitState), 'utf8');
+        writeFileSync(resolve(archiveDir, 'git-state.json'), renderStructured(gitState, redact, secrets), 'utf8');
     }
     return { archiveDir };
 }

package/dist/utils/debugDump.js.map

@@ -1 +1 @@
-{"version":3,"file":"debugDump.js","sourceRoot":"","sources":["../../src/utils/debugDump.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAoC7D;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAc,EAAU,EAAE,CACrC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEZ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QAE1D,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC,CAAC,0DAA0D;QAChF,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,sEAAsE;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CACzB,KAAK,EACL,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACZ,IAAI,OAAO,GAAG,KAAK,UAAU;gBAAE,OAAO,cAAc,GAAG,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC;YAC/E,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;YACnD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC;oBAAE,OAAO,YAAY,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EACD,CAAC,CACF,CAAC;QACF,OAAO,IAAI,IAAI,MAAM,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9E,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/F,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAEvF,4FAA4F;IAC5F,4FAA4F;IAC5F,iDAAiD;IACjD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG;QACd,UAAU;QACV,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;KAC3C,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAE/E,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"debugDump.js","sourceRoot":"","sources":["../../src/utils/debugDump.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,UAAU,EACV,WAAW,GACZ,MAAM,6BAA6B,CAAC;AA4CrC;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAc,EAAU,EAAE,CACrC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEZ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QAE1D,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC,CAAC,0DAA0D;QAChF,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,sEAAsE;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CACzB,KAAK,EACL,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACZ,IAAI,OAAO,GAAG,KAAK,UAAU;gBAAE,OAAO,cAAc,GAAG,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC;YAC/E,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;YACnD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC;oBAAE,OAAO,YAAY,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EACD,CAAC,CACF,CAAC;QACF,OAAO,IAAI,IAAI,MAAM,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAS,IAAI,IAAI,EAAE;IACtD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,CAAC,GAAG,GAA+C,CAAC;IAC1D,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,MAA+B,EAC/B,GAAW;IAEX,MAAM,CAAC,GAAG,GAMT,CAAC;IACF,IAAI,IAAI,GAAG,SAAS,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GACL,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,CAAC,OAAQ,MAA6B,CAAC,IAAI,KAAK,QAAQ;gBACtD,CAAC,CAAE,MAA4B,CAAC,IAAI;gBACpC,CAAC,CAAC,SAAS,CAAC;YACd,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,IAAI,KAAK,GAAG,SAAS,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACnC,MAAM,GAAG,GACP,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACnD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,GAAG,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,MAAe;IAC9C,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACzF,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QACtE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAa,CAAC,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,gEAAgE;IACjF,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,MAAe,EAAE,MAAe,EAAE,OAA0B;IAChF,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,WAAW,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,MAAe,EAAE,OAA0B;IACnF,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,gDAAgD;IACvF,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9E,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,gGAAgG;IAChG,2FAA2F;IAC3F,6FAA6F;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,aAAa,CACX,OAAO,CAAC,UAAU,EAAE,iBAAiB,CAAC,EACtC,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EACnD,MAAM,CACP,CAAC;IACF,aAAa,CACX,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,EAClC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAC3C,MAAM,CACP,CAAC;IAEF,4FAA4F;IAC5F,4FAA4F;IAC5F,iDAAiD;IACjD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG;QACd,UAAU;QACV,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;KAC3C,CAAC;IACF,aAAa,CACX,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAC/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAC1C,MAAM,CACP,CAAC;IAEF,aAAa,CACX,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,EACpC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7F,MAAM,CACP,CAAC;IAEF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CACX,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACrC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAC3C,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}

package/dist/utils/redactSecrets.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @packageDocumentation
+ * GS2-47 — a shared, reusable secret-redaction pass for diagnostic output.
+ *
+ * Built for `/debug-dump` ({@link file://./debugDump.ts}) but deliberately generic and
+ * dependency-free — it takes `env` as a PARAMETER rather than reading `process.env`, so the pass is
+ * pure, deterministic in tests, and reusable by GS2-48's crash-report handler (which hard-depends on
+ * this module). Nothing here reads ambient process state.
+ *
+ * DESIGN DECISION (settled by the coordinator, GS2-47): **PATTERN-ONLY** redaction — we do NOT scan
+ * for high-entropy strings. Rationale: pattern-only is safe to reason about and near-zero
+ * false-positive; entropy scanning catches marginally more but produces false-positive redactions
+ * the user has to squint through, degrading the dump's debug value. A high-entropy scanner is a
+ * DELIBERATELY-DEFERRED option (a config surface for it could be added later if ever warranted) and
+ * is intentionally NOT implemented here.
+ *
+ * Three techniques, in priority order:
+ *  1. [load-bearing] Known-secret VALUE substitution — collect the literal values of secret-named
+ *     env vars + inline config secrets, then substitute every occurrence across ALL artifacts. This
+ *     catches a leaked key wherever it surfaces (config, env, transcript, log) with no guessing.
+ *  2. Provider key/token PATTERNS — a tight, documented, prefix-anchored set of well-known key
+ *     shapes plus explicit auth-header contexts. We never blanket-redact long alphanumeric strings.
+ *  3. Sensitive config-FIELD masking — mask the VALUES of secret-named config keys while preserving
+ *     structure (the key stays; only the value becomes the marker).
+ *
+ * Fail-safe throughout: on any internal error the functions redact MORE (return the marker), never
+ * less — a redaction hiccup must never cause raw content to be emitted.
+ */
+/** The visible, greppable placeholder substituted for every redacted secret value. */
+export declare const REDACTED = "<redacted>";
+/**
+ * Collect the literal secret VALUES to substitute everywhere (technique 1), from two sources:
+ *  - process-env vars whose NAME matches {@link SECRET_ENV_NAME_RE}, PLUS the specific var(s) named
+ *    by any `apiKeyEnvironmentVariable` in the config;
+ *  - non-empty inline secret field values in the config (technique 3's field names), so a key pasted
+ *    inline is scrubbed wherever it *also* surfaces (transcript, log, env), not only in config.json.
+ *
+ * `env` is a PARAMETER — never read ambiently — so the pass is pure, reusable (GS2-48) and
+ * deterministic in tests. Values shorter than {@link MIN_SECRET_LITERAL_LENGTH} are skipped. The
+ * result is returned longest-first so an overlapping-substring secret can't leave a shorter one
+ * partially intact. Never throws (a hostile config getter is swallowed — patterns + structural
+ * masking still apply).
+ */
+export declare function collectSecretValues(config: unknown, env: Record<string, string | undefined>): string[];
+/**
+ * Redact a STRING: substitute every known literal secret value (technique 1, longest-first), then
+ * apply the provider key/auth patterns (technique 2). Never throws — on any error it returns the
+ * fully-withheld marker (fail safe: redact MORE, never emit the raw text). Applying it twice is
+ * safe (re-redacting already-redacted text is a no-op).
+ */
+export declare function redactText(text: string, secrets: readonly string[]): string;
+/**
+ * Deep-redact an arbitrary value for serialization: mask the VALUES of secret-named fields
+ * (technique 3 — structure preserved: the key stays, only its value becomes the marker) and run
+ * {@link redactText} over every string leaf (techniques 1 + 2). Circular refs are broken; functions
+ * and bigints are rendered the way `safeStringify` would, so the result is JSON-safe. Pure — never
+ * mutates the input. `apiKeyEnvironmentVariable` is intentionally NOT masked (it is a var name).
+ *
+ * Intended for the CONFIG artifact (where field-name masking is wanted). Non-config artifacts use
+ * {@link redactText} over their stringified form instead (literal + pattern only), so a legitimate
+ * `token`/`secret`-named field in tool output is not blanket-masked.
+ */
+export declare function redactValue(value: unknown, secrets: readonly string[]): unknown;

package/dist/utils/redactSecrets.js

@@ -0,0 +1,238 @@
+/**
+ * @packageDocumentation
+ * GS2-47 — a shared, reusable secret-redaction pass for diagnostic output.
+ *
+ * Built for `/debug-dump` ({@link file://./debugDump.ts}) but deliberately generic and
+ * dependency-free — it takes `env` as a PARAMETER rather than reading `process.env`, so the pass is
+ * pure, deterministic in tests, and reusable by GS2-48's crash-report handler (which hard-depends on
+ * this module). Nothing here reads ambient process state.
+ *
+ * DESIGN DECISION (settled by the coordinator, GS2-47): **PATTERN-ONLY** redaction — we do NOT scan
+ * for high-entropy strings. Rationale: pattern-only is safe to reason about and near-zero
+ * false-positive; entropy scanning catches marginally more but produces false-positive redactions
+ * the user has to squint through, degrading the dump's debug value. A high-entropy scanner is a
+ * DELIBERATELY-DEFERRED option (a config surface for it could be added later if ever warranted) and
+ * is intentionally NOT implemented here.
+ *
+ * Three techniques, in priority order:
+ *  1. [load-bearing] Known-secret VALUE substitution — collect the literal values of secret-named
+ *     env vars + inline config secrets, then substitute every occurrence across ALL artifacts. This
+ *     catches a leaked key wherever it surfaces (config, env, transcript, log) with no guessing.
+ *  2. Provider key/token PATTERNS — a tight, documented, prefix-anchored set of well-known key
+ *     shapes plus explicit auth-header contexts. We never blanket-redact long alphanumeric strings.
+ *  3. Sensitive config-FIELD masking — mask the VALUES of secret-named config keys while preserving
+ *     structure (the key stays; only the value becomes the marker).
+ *
+ * Fail-safe throughout: on any internal error the functions redact MORE (return the marker), never
+ * less — a redaction hiccup must never cause raw content to be emitted.
+ */
+/** The visible, greppable placeholder substituted for every redacted secret value. */
+export const REDACTED = '<redacted>';
+/**
+ * Minimum length for a collected VALUE to be treated as a substitutable secret literal (technique
+ * 1). Guards against redacting trivial values ("1", "on", a short model name) that happen to be the
+ * value of a secret-named env var — substituting those everywhere would gut the dump's debug value
+ * with false positives (exactly the trap the pattern-only decision avoids). Short sensitive *config*
+ * fields are still masked structurally by key name (technique 3), so nothing sensitive slips through
+ * this floor.
+ */
+const MIN_SECRET_LITERAL_LENGTH = 6;
+/** Max recursion depth for the config walks — a guard against pathological/deep object graphs. */
+const MAX_REDACT_DEPTH = 12;
+/**
+ * env-var NAME shapes whose VALUE is a secret to substitute everywhere (technique 1): `*_API_KEY`,
+ * `*_TOKEN`, `*_SECRET`, `*_KEY`, and anything containing `PASSWORD`. Case-insensitive.
+ */
+const SECRET_ENV_NAME_RE = /(?:_API_KEY|_TOKEN|_SECRET|_KEY)$|PASSWORD/i;
+/**
+ * Config-FIELD NAME shapes whose VALUE is masked in place (technique 3), matched case-insensitively
+ * at any depth. Mirrors `configCommand.ts`'s `redactConfigForPrint` set for cross-surface
+ * consistency. NOTE: `apiKeyEnvironmentVariable` also matches `api?key`, but it holds a var NAME
+ * (not a secret) and is what technique 1 reads to find the real key's value — so it is EXCLUDED via
+ * {@link NON_SECRET_KEY_NAMES}.
+ */
+const SECRET_KEY_RE = /(api[-_]?key|secret|token|password|passwd|authorization|bearer|credential)/i;
+/** Field names that match {@link SECRET_KEY_RE} but must NOT be masked (they hold a var name). */
+const NON_SECRET_KEY_NAMES = new Set(['apikeyenvironmentvariable']);
+/**
+ * Provider key / auth-header PATTERNS (technique 2) — a tight, prefix-anchored set. Each entry is
+ * `[regex, replacement]`. Kept deliberately narrow (well-known key prefixes + explicit auth
+ * contexts); we do NOT blanket-redact long alphanumeric strings — that IS the entropy trap the
+ * pattern-only decision avoids. A long opaque token is only redacted when it sits in an auth context
+ * (`Bearer …` / `Authorization: …`), never on its own.
+ */
+const PROVIDER_PATTERNS = [
+    // OpenAI (`sk-…`) and Anthropic (`sk-ant-…`, also `sk-`-prefixed) secret keys.
+    [/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}/g, REDACTED],
+    // Google API keys (`AIza…`).
+    [/\bAIza[0-9A-Za-z_-]{16,}/g, REDACTED],
+    // xAI (`xai-…`).
+    [/\bxai-[A-Za-z0-9_-]{16,}/g, REDACTED],
+    // Groq (`gsk_…`).
+    [/\bgsk_[A-Za-z0-9_-]{16,}/g, REDACTED],
+    // GS2-54 (gap 2) — GitHub tokens. Classic/scoped PATs share the `gh[oprsu]_` prefix (personal
+    // `ghp_`, OAuth `gho_`, user-to-server `ghu_`, server-to-server `ghs_`, refresh `ghr_`); the value
+    // is base62 (no `_`). Prefix-anchored + a length floor, same tight style as the provider keys —
+    // NOT a blanket long-alphanumeric redaction (that IS the entropy trap avoided).
+    [/\bgh[oprsu]_[A-Za-z0-9]{16,}/g, REDACTED],
+    // GS2-54 (gap 2) — GitHub fine-grained PATs (`github_pat_…`); the value carries an inner `_`, so
+    // its charset includes `_`. Distinct prefix from the classic rule above (`github_` ≠ `gh[oprsu]_`).
+    [/\bgithub_pat_[A-Za-z0-9_]{16,}/g, REDACTED],
+    // GS2-54 (gap 2) — credentials embedded in a URL (`scheme://user:password@host`). Redact the
+    // `user:password` userinfo, KEEP the scheme + host so the artifact stays debuggable. Bounded: the
+    // userinfo stops at `@` (and the password never spans `/` or whitespace), so it cannot swallow the
+    // rest of the URL/line. A URL without userinfo (`https://host:port/path`) has no `user:pass@` and
+    // is left untouched.
+    [/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, `$1${REDACTED}@`],
+    // GS2-54 (gap 1) — an `Authorization` header value (`Authorization: <scheme?> <credential>` /
+    // `"Authorization":"…"`): keep the header name + separator, redact the value REGARDLESS OF SCHEME.
+    // Generalized beyond the old fixed `Bearer|Basic|Token|Digest|Negotiate` list so a non-standard
+    // scheme (`ApiKey <secret>`, an unknown scheme, `AWS4-HMAC-SHA256 Credential=…`) no longer leaks
+    // its token beside the marker. Bounded to <scheme> + ONE credential token (two token runs max,
+    // separated by horizontal whitespace only — never a newline), so it can never swallow following
+    // prose the way the original `[^"]+` did. An optional value-quote is consumed so JSON
+    // `"Authorization":"…"` works too. Runs before the SigV4 and standalone-`Bearer` rules so a normal
+    // header collapses to a single marker; a SigV4 header's `Credential=…` is eaten here and its
+    // trailing `Signature=…` is mopped up by the next rule.
+    [
+        /(\bAuthorization["']?\s*[:=]\s*["']?)[A-Za-z0-9._~+/=-]+(?:[ \t]+[A-Za-z0-9._~+/=-]+)?/gi,
+        `$1${REDACTED}`,
+    ],
+    // GS2-54 (gap 1) — AWS SigV4 authorization components. The header is comma-separated `key=value`
+    // pairs; redact the SENSITIVE `Credential=…` (access-key id) and `Signature=…` values wherever they
+    // appear (header value OR a presigned-URL `X-Amz-Credential=…&X-Amz-Signature=…` query), keeping the
+    // key name for debuggability. `SignedHeaders=…` is just header names and is intentionally NOT
+    // touched. The value charset excludes whitespace/comma/quote/`&`, so it stops at the component
+    // boundary and never swallows the next pair or trailing prose.
+    [/\b(Credential|Signature)=[A-Za-z0-9._~+/=-]+/gi, `$1=${REDACTED}`],
+    // A standalone `Bearer <token>` — keep the scheme word, redact only the credential. A long opaque
+    // token is redacted ONLY in this auth context, never on its own (that is the entropy trap avoided).
+    [/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, `$1${REDACTED}`],
+];
+/**
+ * Collect the literal secret VALUES to substitute everywhere (technique 1), from two sources:
+ *  - process-env vars whose NAME matches {@link SECRET_ENV_NAME_RE}, PLUS the specific var(s) named
+ *    by any `apiKeyEnvironmentVariable` in the config;
+ *  - non-empty inline secret field values in the config (technique 3's field names), so a key pasted
+ *    inline is scrubbed wherever it *also* surfaces (transcript, log, env), not only in config.json.
+ *
+ * `env` is a PARAMETER — never read ambiently — so the pass is pure, reusable (GS2-48) and
+ * deterministic in tests. Values shorter than {@link MIN_SECRET_LITERAL_LENGTH} are skipped. The
+ * result is returned longest-first so an overlapping-substring secret can't leave a shorter one
+ * partially intact. Never throws (a hostile config getter is swallowed — patterns + structural
+ * masking still apply).
+ */
+export function collectSecretValues(config, env) {
+    const values = new Set();
+    const add = (v) => {
+        if (typeof v === 'string' && v.length >= MIN_SECRET_LITERAL_LENGTH)
+            values.add(v);
+    };
+    // (a) env vars whose NAME looks secret → their VALUE is a literal to scrub.
+    try {
+        for (const [name, value] of Object.entries(env ?? {})) {
+            if (SECRET_ENV_NAME_RE.test(name))
+                add(value);
+        }
+    }
+    catch {
+        // ignore — a broken env object is not fatal to redaction.
+    }
+    // (b) walk the config for `apiKeyEnvironmentVariable` (→ read that env var's value) and inline
+    //     secret-named field values.
+    const seen = new WeakSet();
+    const walk = (node, depth) => {
+        if (node === null || typeof node !== 'object' || depth > MAX_REDACT_DEPTH)
+            return;
+        if (seen.has(node))
+            return;
+        seen.add(node);
+        if (Array.isArray(node)) {
+            for (const item of node)
+                walk(item, depth + 1);
+            return;
+        }
+        for (const [key, value] of Object.entries(node)) {
+            if (key.toLowerCase() === 'apikeyenvironmentvariable' && typeof value === 'string') {
+                add(env?.[value]); // resolve the NAMED env var's VALUE (the var name itself is not a secret)
+            }
+            else if (SECRET_KEY_RE.test(key) && !NON_SECRET_KEY_NAMES.has(key.toLowerCase())) {
+                add(value);
+            }
+            walk(value, depth + 1);
+        }
+    };
+    try {
+        walk(config, 0);
+    }
+    catch {
+        // fail safe: a hostile getter threw — we simply have fewer literals; patterns + structural
+        // masking still cover the artifacts. Never rethrow (redaction must not break the dump).
+    }
+    return [...values].sort((a, b) => b.length - a.length);
+}
+/**
+ * Redact a STRING: substitute every known literal secret value (technique 1, longest-first), then
+ * apply the provider key/auth patterns (technique 2). Never throws — on any error it returns the
+ * fully-withheld marker (fail safe: redact MORE, never emit the raw text). Applying it twice is
+ * safe (re-redacting already-redacted text is a no-op).
+ */
+export function redactText(text, secrets) {
+    try {
+        let out = text;
+        for (const secret of secrets) {
+            if (secret)
+                out = out.split(secret).join(REDACTED); // literal — no regex escaping needed
+        }
+        for (const [re, replacement] of PROVIDER_PATTERNS) {
+            out = out.replace(re, replacement);
+        }
+        return out;
+    }
+    catch {
+        return REDACTED; // fail safe
+    }
+}
+/**
+ * Deep-redact an arbitrary value for serialization: mask the VALUES of secret-named fields
+ * (technique 3 — structure preserved: the key stays, only its value becomes the marker) and run
+ * {@link redactText} over every string leaf (techniques 1 + 2). Circular refs are broken; functions
+ * and bigints are rendered the way `safeStringify` would, so the result is JSON-safe. Pure — never
+ * mutates the input. `apiKeyEnvironmentVariable` is intentionally NOT masked (it is a var name).
+ *
+ * Intended for the CONFIG artifact (where field-name masking is wanted). Non-config artifacts use
+ * {@link redactText} over their stringified form instead (literal + pattern only), so a legitimate
+ * `token`/`secret`-named field in tool output is not blanket-masked.
+ */
+export function redactValue(value, secrets) {
+    const seen = new WeakSet();
+    const walk = (node, depth) => {
+        if (typeof node === 'string')
+            return redactText(node, secrets);
+        if (typeof node === 'function')
+            return `[Function: ${node.name || 'anonymous'}]`;
+        if (typeof node === 'bigint')
+            return node.toString();
+        if (node === null || typeof node !== 'object')
+            return node;
+        if (seen.has(node))
+            return '[Circular]';
+        if (depth > MAX_REDACT_DEPTH)
+            return '[Truncated]';
+        seen.add(node);
+        if (Array.isArray(node))
+            return node.map((item) => walk(item, depth + 1));
+        const out = {};
+        for (const [key, val] of Object.entries(node)) {
+            if (SECRET_KEY_RE.test(key) && !NON_SECRET_KEY_NAMES.has(key.toLowerCase())) {
+                out[key] = REDACTED; // mask the value, keep the key — shape is part of the debug signal
+            }
+            else {
+                out[key] = walk(val, depth + 1);
+            }
+        }
+        return out;
+    };
+    return walk(value, 0);
+}
+//# sourceMappingURL=redactSecrets.js.map

package/dist/utils/redactSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactSecrets.js","sourceRoot":"","sources":["../../src/utils/redactSecrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;GAGG;AACH,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,6EAA6E,CAAC;AAEpG,kGAAkG;AAClG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,iBAAiB,GAA6C;IAClE,+EAA+E;IAC/E,CAAC,mCAAmC,EAAE,QAAQ,CAAC;IAC/C,6BAA6B;IAC7B,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,iBAAiB;IACjB,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,kBAAkB;IAClB,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,8FAA8F;IAC9F,mGAAmG;IACnG,gGAAgG;IAChG,gFAAgF;IAChF,CAAC,+BAA+B,EAAE,QAAQ,CAAC;IAC3C,iGAAiG;IACjG,oGAAoG;IACpG,CAAC,iCAAiC,EAAE,QAAQ,CAAC;IAC7C,6FAA6F;IAC7F,kGAAkG;IAClG,mGAAmG;IACnG,kGAAkG;IAClG,qBAAqB;IACrB,CAAC,iDAAiD,EAAE,KAAK,QAAQ,GAAG,CAAC;IACrE,8FAA8F;IAC9F,mGAAmG;IACnG,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,sFAAsF;IACtF,mGAAmG;IACnG,6FAA6F;IAC7F,wDAAwD;IACxD;QACE,0FAA0F;QAC1F,KAAK,QAAQ,EAAE;KAChB;IACD,iGAAiG;IACjG,oGAAoG;IACpG,qGAAqG;IACrG,8FAA8F;IAC9F,+FAA+F;IAC/F,+DAA+D;IAC/D,CAAC,gDAAgD,EAAE,MAAM,QAAQ,EAAE,CAAC;IACpE,kGAAkG;IAClG,oGAAoG;IACpG,CAAC,uCAAuC,EAAE,KAAK,QAAQ,EAAE,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,GAAuC;IAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAQ,EAAE;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,yBAAyB;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC;IAEF,4EAA4E;IAC5E,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACtD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,+FAA+F;IAC/F,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QAClD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,GAAG,gBAAgB;YAAE,OAAO;QAClF,IAAI,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,2BAA2B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnF,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,0EAA0E;YAC/F,CAAC;iBAAM,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,KAAK,CAAC,CAAC;YACb,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,wFAAwF;IAC1F,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAA0B;IACjE,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,qCAAqC;QAC3F,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAClD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,CAAC,YAAY;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAA0B;IACpE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAW,EAAE;QACrD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,OAAO,IAAI,KAAK,UAAU;YAC5B,OAAO,cAAe,IAA0B,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC;QAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC;YAAE,OAAO,YAAY,CAAC;QAClD,IAAI,KAAK,GAAG,gBAAgB;YAAE,OAAO,aAAa,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YACzE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,mEAAmE;YAC1F,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/utils/systemPromptNotes.d.ts

@@ -55,6 +55,98 @@ export declare function appendOsShellNote(systemPrompt: string | undefined): str
  * it in the shared path. Returns the note alone when there is no base prompt.
  */
 export declare function appendCwdNote(systemPrompt: string | undefined, cwd: string): string;
+/** GS2-35 — the configured Git co-author identity (both fields optional; each defaults on its own). */
+export interface CommitCoAuthor {
+    name?: string;
+    email?: string;
+}
+/**
+ * GS2-35: append the commit co-authoring rule to the composed code-mode system prompt.
+ *
+ * Gaunt Sloth has **no dedicated git-commit tool** — the agent commits by calling
+ * `run_shell_command` with `git commit`, composing the message (including any trailer) itself. Left
+ * unguided, models emit `Co-Authored-By: <their own model name>` (e.g. `Claude`, `GPT`, `Gemini`)
+ * from trained habit, which is **factually wrong**: the commit was produced by *Gaunt Sloth*, not by
+ * the model. This note is the fix at the correct layer — first-party prompt guidance that (a) states
+ * the exact trailer to emit and (b) forbids a model-name co-author.
+ *
+ * The identity is config-driven (`commit.coAuthor` in {@link import('#src/config/types.js').GthConfig}).
+ * Each field falls back INDEPENDENTLY to the Gaunt Sloth account
+ * ({@link DEFAULT_COMMIT_CO_AUTHOR_NAME} / {@link DEFAULT_COMMIT_CO_AUTHOR_EMAIL}) — so a partial
+ * override (name only, or a config that bypassed the loader) still yields a complete trailer, and a
+ * fully-absent config yields the default account. Blank/whitespace values are treated as unset.
+ *
+ * Backend-agnostic: composed through the shared code path so BOTH the lean `GthLangChainAgent` and
+ * the deep `GthDeepAgent` inject it (the git-commit capability rides on `run_shell_command`, which
+ * both backends expose in code mode). Returns the note alone when there is no base prompt.
+ */
+export declare function appendCommitCoAuthorNote(systemPrompt: string | undefined, coAuthor?: CommitCoAuthor): string;
+/**
+ * GS2-34/GS2-53 — the resolved active-model identity, as a STRUCTURED value.
+ *
+ * `hasProvider` is the authoritative "a real provider half was resolved" signal — carried
+ * explicitly rather than inferred from `identity.includes(':')`, because a bare model name can
+ * itself contain a colon (e.g. an Ollama/HF tag `gemma3:27b`) and would otherwise be mistaken for a
+ * `provider:model` string. It is true iff a non-empty provider (configured `type` OR a non-empty
+ * `_llmType()`) formed the leading `provider:` segment; false when `identity` is the bare model.
+ */
+export interface ResolvedModelIdentity {
+    /** `provider:model` when a provider resolved, otherwise the bare `model`. */
+    identity: string;
+    /** True iff a real provider formed the `provider:` segment (never merely a colon in the model). */
+    hasProvider: boolean;
+}
+/**
+ * GS2-34: resolve the active model identity from the effective config, for injection into the
+ * system prompt by {@link appendModelContextNote}.
+ *
+ * Both halves are read the SAME way the rest of gsloth already surfaces the active model:
+ *   - MODEL: `config.modelDisplayName` (the string the status line renders — set by the loader from
+ *     `llm.model`), falling back to the live model's own `model` field.
+ *   - PROVIDER: the configured `config.modelProviderType` (the raw `llm.type` the loader stashed —
+ *     `openrouter`/`deepseek`/`xai`/`anthropic`/…) when present, otherwise the live LangChain
+ *     model's `_llmType()` (the source the AG-UI `/info` endpoint reports). GS2-53 — preferring the
+ *     configured `type` fixes the OpenAI-compatible shims (openrouter/deepseek/xai all extend
+ *     ChatOpenAI, so their `_llmType()` reports `openai`): a `type: openrouter` config now injects
+ *     `openrouter:<model>`, not `openai:<model>`. The `type` is absent for module configs (which
+ *     hand us an already-built LLM), where we fall back to `_llmType()` unchanged. The MODEL half is
+ *     always exact.
+ *
+ * Returns `{ identity: 'provider:model', hasProvider: true }` when both resolve, `{ identity:
+ * 'model', hasProvider: false }` when only the model resolves, and `undefined` when the model is
+ * unknown (a provider with no model is not a usable identity) — in which case {@link
+ * appendModelContextNote} injects nothing, leaving the prompt exactly as before. `hasProvider` is
+ * the authoritative provider-present flag (GS2-53), so a bare model whose NAME contains a colon
+ * (e.g. `gemma3:27b`) is correctly reported as `hasProvider: false`. `_llmType()` is called
+ * defensively (guarded) so a provider whose accessor throws can never break prompt assembly (and is
+ * skipped entirely when a configured `type` is present).
+ */
+export declare function resolveModelIdentity(config: {
+    llm?: {
+        _llmType?: () => string;
+        model?: string;
+    };
+    modelDisplayName?: string;
+    modelProviderType?: string;
+} | null | undefined): ResolvedModelIdentity | undefined;
+/**
+ * GS2-34: append the active model-identity note to the composed system prompt.
+ *
+ * The agent otherwise has no reliable knowledge of which `provider:model` is serving it, so it
+ * cannot answer "what model are you?" accurately or reason about its own capabilities/limits. This
+ * injects a single first-party line naming the resolved identity (see {@link resolveModelIdentity}).
+ *
+ * Injected in EVERY mode (chat/ask/code/exec), NOT gated to `code` like the cwd/os-shell/commit
+ * notes: "which model are you?" can be asked in any session, so the identity must be visible
+ * everywhere. Config-gated by `injectModelContext` (default ON): a caller passes an `undefined`
+ * `modelIdentity` — because the config opted out (`injectModelContext: false`) or because no model
+ * could be resolved — and the base prompt is returned UNCHANGED (no line), preserving the current
+ * prompt byte-for-byte.
+ *
+ * A short capability note from the GS2-6 model catalog is a DEFERRED follow-up (GS2-6 has not
+ * landed): this injects the bare `provider:model` identity only.
+ */
+export declare function appendModelContextNote(systemPrompt: string | undefined, modelIdentity: ResolvedModelIdentity | undefined): string | undefined;
 /**
  * EXT-32: hard per-server cap on injected MCP instruction length.
  *