@gcunharodrigues/wrxn 0.17.0 → 0.18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/hooks/sidecar.cjs

@@ -15,21 +15,38 @@ const path = require('path');
 // secretScan — replicated here because each self-contained install-only module imports no shared
 // kernel-lib (node stdlib only), exactly as it is duplicated across dream.cjs / sync.cjs. CASE-SENSITIVE:
 // the token shapes are case-specific. A coalesced sidecar must never harden a credential onto disk.
-const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // FULL PEM block (BEGIN…END) — MUST precede the header-only line so redaction consumes the body, not just the header
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header (fallback: a lone/truncated header with no END)
-  /Bearer\s+[A-Za-z0-9\-._~+/]{16,}=*/i, // HTTP bearer / Authorization token (case-insensitive scheme)
+// The CANONICAL secret-shape set (#39) — kept BYTE-IDENTICAL across every copy (dream / sync / harvest /
+// memory-synth + this one), drift-pinned by adapter-drift-guard.test.cjs. Each self-contained module
+// replicates the set (the install-only adapters import no shared module — node stdlib only), so the pin is
+// what keeps the copies honest. CASE-SENSITIVE except where a shape carries its own /i flag.
+const SECRET_PATTERNS_CANON = [
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
+];
+// sidecar-LOCAL extras (#38) the canonical set does not subsume — broader / hooks-layer-specific, so they
+// are NOT part of the drift-pinned core. Kept so sidecar never weakens (no pre-existing match is lost).
+const SIDECAR_EXTRA = [
+  /Bearer\s+[A-Za-z0-9\-._~+/]{16,}=*/i, // case-insensitive bearer scheme, 16-char floor (broader than the canonical Bearer)
   // password=/pwd= assignment (=, :, quoted JSON/YAML). The keyword is EITHER fully quoted ("password":)
   // OR bare (password=) — never a lone trailing quote, so a path ending in "passwd" used as a JSON key
   // (e.g. "../../etc/passwd": …) is NOT misread as an assignment (it would falsely refuse a sidecar write).
   /(?:["'](?:password|passwd|pwd)["']|(?:password|passwd|pwd))\s*[:=]\s*["']?[^\s"',;)&}{]+/i,
   /[a-z][a-z0-9+.\-]+:\/\/[^\s:/@]+:[^\s/@]+@\S+/i, // URI connection string with inline creds (scheme://user:pass@host)
-  /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/, // JWT: base64url header(eyJ…).payload.signature
+  /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/, // JWT (eyJ header; shorter min than the canonical JWT)
 ];
+const SECRET_PATTERNS = [...SECRET_PATTERNS_CANON, ...SIDECAR_EXTRA];
 
 function secretScan(text) {
   const s = String(text || ''); // NOT lowercased — the token shapes are case-sensitive.

package/payload/.wrxn/dream.cjs

@@ -421,11 +421,20 @@ function negativeFilter(text) {
 // token shapes are case-specific). Evidence quotes are audit-only (never written to a page) so they
 // stay out of scope here, like the negative filters.
 const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
 function secretScan(text) {

package/payload/.wrxn/harvest.cjs

@@ -653,11 +653,20 @@ function isKebab(s) {
 // A merged survivor must never harden a session secret into recalled prose. Same patterns + case-sensitive
 // scope as dream/sync — replicated because each install-only adapter is self-contained (node stdlib only).
 const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
 function secretScan(text) {

package/payload/.wrxn/memory-synth.cjs

@@ -24,19 +24,28 @@ const path = require('path');
 const https = require('https');
 const { spawnSync } = require('child_process');
 
-// ── default tiering (PRD) ──────────────────────────────────────────────────────
-// handoff + dream default to gemini/gemini-3.1-flash-lite, falling back to claude/claude-sonnet-4-6.
-// The seeded memory.config.json is this object serialized; an operator edits it and `wrxn update`
-// preserves it (seeded class). Claude stays the fallback so a keyless fresh install still writes a
-// baton via the operator's CLI auth (no GEMINI_API_KEY → gemini gated → claude carries it).
+// ── default tiering (PRD + #59) ────────────────────────────────────────────────
+// handoff stays FAST — gemini-3.1-flash-lite with thinkingBudget:0 (reasoning OFF), because handoff is on the
+// 180s session-start hold path. dream REASONS — gemini-3.5-flash with thinkingBudget:-1 (dynamic, the model
+// decides) + maxOutputTokens:8192 (sized for reasoning + the ~4.3k-char dream JSON so it can't truncate),
+// because dream runs off the critical path where quality matters. Both fall back to claude/claude-sonnet-4-6.
+// The seeded memory.config.json is DEFAULTS serialized; an operator edits it and `wrxn update` preserves it
+// (seeded class), so EXISTING installs keep their config and only FRESH installs get these defaults (no
+// migration). Claude stays the fallback so a keyless fresh install still writes a baton via the operator's CLI
+// auth (no GEMINI_API_KEY → gemini gated → claude carries it). thinkingBudget: 0 off / -1 dynamic / N>0 bounded.
+// DEFAULT_TASK is the conservative per-task default for any task NOT named in DEFAULTS.tasks (reasoning off,
+// preserving #30's safe default); handoff + dream pin their own tiering below.
 const DEFAULT_TASK = {
-  primary: { engine: 'gemini', model: 'gemini-3.1-flash-lite' },
+  primary: { engine: 'gemini', model: 'gemini-3.1-flash-lite', thinkingBudget: 0 },
   fallback: { engine: 'claude', model: 'claude-sonnet-4-6' },
 };
 const DEFAULTS = {
   tasks: {
     handoff: clone(DEFAULT_TASK),
-    dream: clone(DEFAULT_TASK),
+    dream: {
+      primary: { engine: 'gemini', model: 'gemini-3.5-flash', thinkingBudget: -1, maxOutputTokens: 8192 },
+      fallback: { engine: 'claude', model: 'claude-sonnet-4-6' },
+    },
   },
 };
 
@@ -178,6 +187,51 @@ const THINK_MAX = 600;
 const TOOL_USE_MAX = 300;
 const TOOL_RESULT_MAX = 200;
 
+// Hook-injected framework-context sentinels. SessionStart emits <wrxn-orientation> (which embeds the
+// ENTIRE prior baton as the resume surface); UserPromptSubmit emits <synapse-rules>/<recall-surface>/
+// <reference-candidate> each turn; <system-reminder> wraps harness notes. All land verbatim in the
+// transcript. Left in, they out-mass a light session's real turns → the synth re-emits the embedded
+// prior baton (fresh `wrote`, frozen content) — the content-channel rot of #62. Strip them BEFORE
+// chunking. The blob builder is the ONE shared surface, so the claude and gemini paths both benefit.
+const INJECTED_SENTINELS = ['wrxn-orientation', 'synapse-rules', 'recall-surface', 'reference-candidate', 'system-reminder'];
+// ReDoS bound (#62): the phase-1 closed-block strip is ~quadratic on a pathological part (many opens, no
+// closes). A real injected block (orientation embeds a ≤400-word baton) is a few KB; this cap sits far
+// above that yet below the multi-second regex range, so the strip stays effectively linear.
+const INJECTED_STRIP_MAX = 65536;
+
+/**
+ * Strip hook-injected framework-context blocks from one transcript text part BEFORE chunking. Two phases:
+ *   1. every well-delimited `<tag>…</tag>` block, anywhere (multi-line via [\s\S]; nested/sequential safe);
+ *   2. a part-LEADING unclosed `<tag>…` (transcript truncated mid-block) → stripped to end-of-part.
+ * The phase-2 strip is ANCHORED to part-leading (`^\s*` — after optional whitespace, incl. the newline a
+ * phase-1 removal leaves) because real framework injections are always part-leading. A sentinel merely
+ * MENTIONED mid-prose is therefore NOT a leading match, so its trailing text survives (Finding A). PURE
+ * and FAIL-OPEN: any fault returns the input unchanged — a filter fault must NEVER break the blob. Node
+ * stdlib only. Mirrors the redactSecrets scrub discipline. (#62)
+ * @param {string} text
+ * @returns {string}
+ */
+function stripInjectedContext(text) {
+  try {
+    let out = String(text || '');
+    // ReDoS guard (Finding B): skip a part far larger than any real injected block — it is ordinary content
+    // (a pasted file/log) with nothing part-leading to strip, so returning it as-is can never hang.
+    if (out.length > INJECTED_STRIP_MAX) return out;
+    // Phase 1 — remove every well-delimited block anywhere (low risk; sequential + nested blocks collapse).
+    for (const tag of INJECTED_SENTINELS) {
+      out = out.replace(new RegExp(`<${tag}>[\\s\\S]*?</${tag}>`, 'g'), '');
+    }
+    // Phase 2 — remove a part-LEADING unclosed remainder to end-of-part (after phase 1, any leading injected
+    // block left dangling by truncation is part-leading). Anchored so a mid-prose mention keeps its tail.
+    for (const tag of INJECTED_SENTINELS) {
+      out = out.replace(new RegExp(`^\\s*<${tag}>[\\s\\S]*$`), '');
+    }
+    return out;
+  } catch {
+    return String(text || ''); // a filter fault never breaks the blob
+  }
+}
+
 /**
  * Build a bounded plain-text blob from a Claude Code transcript (JSONL string).
  * @param {string} jsonlText the raw transcript file contents
@@ -199,12 +253,12 @@ function buildTranscriptBlob(jsonlText) {
     const c = m.content;
     const parts = [];
     if (typeof c === 'string') {
-      parts.push(c);
+      parts.push(stripInjectedContext(c)); // a SessionStart-injected orientation often arrives as string content
     } else if (Array.isArray(c)) {
       for (const p of c) {
         if (!p || typeof p !== 'object') continue;
         if (p.type === 'text') {
-          parts.push(p.text || '');
+          parts.push(stripInjectedContext(p.text || '')); // UserPromptSubmit sentinels prepend the user's text part
         } else if (p.type === 'thinking') {
           parts.push('[thinking] ' + String(p.thinking || '').slice(0, THINK_MAX));
         } else if (p.type === 'tool_use') {
@@ -272,15 +326,17 @@ function buildClaudeSpec({ model, prompt, blob }) {
  * `x-goog-api-key` header, the task prompt as `system_instruction` and the blob as user content
  * (mirrors the proven aimem-handoff-synth call). PURE.
  *
- * `thinking` controls the `generationConfig.thinkingConfig` directive (#30): when true (default) the spec
- * carries `{ thinkingBudget: 0 }`, which DISABLES model-side thinking on thinking-default models (a verified
- * HTTP-200 no-op on non-thinking models) so reasoning tokens never consume the output budget and the answer
- * is never split into a dropped `thought` part. Pass `false` to OMIT the directive — the AC3 retry path for
- * forced-thinking models (gemma-class) that reject thinkingConfig with an HTTP 400.
+ * `thinkingBudget` is the PER-ENGINE reasoning directive (#59, generalizing #30): a NUMBER sets
+ * `generationConfig.thinkingConfig = { thinkingBudget }` — `0` disables model-side thinking (a verified
+ * HTTP-200 no-op on non-thinking models), `-1` lets the model decide (dynamic), `N>0` bounds it to N thinking
+ * tokens. An ABSENT budget defaults to `0` (preserves #30's safe default). An explicit `null` OMITS
+ * thinkingConfig entirely — the AC3 retry path for forced-thinking models (gemma-class) that reject the
+ * directive with an HTTP 400. `maxOutputTokens` is the per-engine output cap (default GEMINI_MAX_OUTPUT_TOKENS).
  */
-function buildGeminiSpec({ model, prompt, blob, apiKey, thinking = true }) {
-  const generationConfig = { temperature: 0.2, maxOutputTokens: GEMINI_MAX_OUTPUT_TOKENS };
-  if (thinking) generationConfig.thinkingConfig = { thinkingBudget: 0 };
+function buildGeminiSpec({ model, prompt, blob, apiKey, thinkingBudget = 0, maxOutputTokens = GEMINI_MAX_OUTPUT_TOKENS }) {
+  const generationConfig = { temperature: 0.2, maxOutputTokens };
+  // a NUMBER (incl. 0 and -1) sets the directive; an explicit `null` OMITS it (the AC3 retry-without path).
+  if (thinkingBudget !== null) generationConfig.thinkingConfig = { thinkingBudget };
   return {
     engine: 'gemini',
     method: 'POST',
@@ -450,11 +506,12 @@ async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = default
     callOnce = () => invoke(spec);
   } else if (engine.engine === 'gemini') {
     if (!apiKey) return { text: null, attempts: 0 }; // missing key fails this engine (→ fallback / null), no request, no retry.
+    const { thinkingBudget, maxOutputTokens } = engine; // per-engine reasoning config (#59); absent → buildGeminiSpec defaults (0 / 4096).
     callOnce = async () => {
-      const r = await invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinking: true }));
+      const r = await invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinkingBudget, maxOutputTokens }));
       if (r && r.thinkingUnsupported) {
-        // this model rejects the thinkingConfig directive (forced-thinking / gemma-class) — retry once without it.
-        return invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinking: false }));
+        // this model rejects the thinkingConfig directive (forced-thinking / gemma-class) — retry once without it (same cap).
+        return invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinkingBudget: null, maxOutputTokens }));
       }
       return r;
     };
@@ -615,22 +672,31 @@ function stripPreamble(text) {
 // becomes the durable baton. Pattern-based (high-signal vendor token shapes, JWTs incl. Bearer
 // payloads, and `KEY/TOKEN/SECRET/PASSWORD=value` assignments); each match → `[REDACTED]`. Conservative
 // by design: it never rewrites ordinary prose, only well-known credential shapes.
-const REDACTIONS = [
-  /\bAKIA[0-9A-Z]{16}\b/g, // AWS access key id
-  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, // GitHub PAT / OAuth / refresh / server tokens
-  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, // Slack tokens
-  /\bsk-[A-Za-z0-9]{20,}\b/g, // OpenAI-style secret keys
-  /\bAIza[0-9A-Za-z._-]{10,}\b/g, // Google / Gemini API keys
-  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/g, // JWTs (incl. Bearer payloads): the discriminating `eyJ…` header gates it
-  /\bnpm_[A-Za-z0-9]{20,}\b/g, // npm publish / automation tokens (≥20 covers the 36-char granular form + variable-length CI tokens)
-  /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, // GitHub fine-grained PATs
-  /\bsk_(?:live|test)_[A-Za-z0-9]{20,}\b/g, // Stripe live/test secret keys
-  /\bsk-proj-[A-Za-z0-9_-]{20,}\b/g, // OpenAI project-scoped keys (underscore form not caught by sk-…)
-  /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g, // PEM private-key blocks
-  /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g, // opaque Bearer tokens (non-JWT)
-  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/gi, // KEY/TOKEN/SECRET = value
+// The ONE canonical secret-shape set — drift-pinned byte-identical to the dream / sync / harvest copies
+// by adapter-drift-guard.test.cjs. Non-global base: redaction derives a g-flagged clone below. (Dropping
+// the older inline \b boundaries is deliberate and fail-safe — a redactor erring broader never under-scrubs.)
+const SECRET_PATTERNS = [
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
+// Redaction form: every shape made global so EVERY occurrence on a line is scrubbed (not just the first).
+// Each clone PRESERVES its own flags (e.g. the /i assignment shape) and only ADDS g — so detection and
+// redaction never diverge. String#replace resets a global regex's lastIndex per call → reuse is safe.
+const REDACTIONS = SECRET_PATTERNS.map((re) => new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g'));
+
 /**
  * Redact common secret shapes from `text`, replacing each match with `[REDACTED]`. PURE. Ordinary prose
  * is preserved verbatim — only credential-looking substrings are scrubbed.
@@ -957,7 +1023,7 @@ async function run(args, { invoke = defaultInvoke, out = process.stdout, err = p
     return 2;
   }
   const root = rootArg || findInstallRoot(path.dirname(path.resolve(file))) || process.cwd();
-  const blob = readTranscriptBlob(file);
+  const blob = redactSecrets(readTranscriptBlob(file)); // scrub BEFORE the blob egresses to the external model — parity with runHandoff:729 / runDream:866 (#63).
   const config = loadConfig(root);
   const apiKey = loadEnv(root).GEMINI_API_KEY;
   const text = await synthesize({ task, prompt, blob, config, apiKey, invoke });

package/payload/.wrxn/memory.config.json

@@ -1,11 +1,11 @@
 {
   "tasks": {
     "handoff": {
-      "primary": { "engine": "gemini", "model": "gemini-3.1-flash-lite" },
+      "primary": { "engine": "gemini", "model": "gemini-3.1-flash-lite", "thinkingBudget": 0 },
       "fallback": { "engine": "claude", "model": "claude-sonnet-4-6" }
     },
     "dream": {
-      "primary": { "engine": "gemini", "model": "gemini-3.1-flash-lite" },
+      "primary": { "engine": "gemini", "model": "gemini-3.5-flash", "thinkingBudget": -1, "maxOutputTokens": 8192 },
       "fallback": { "engine": "claude", "model": "claude-sonnet-4-6" }
     }
   }

package/payload/.wrxn/sync.cjs

@@ -264,11 +264,20 @@ async function driftFromDoor(root, { transport, timeoutMs } = {}) {
 // no shared kernel-lib import), exactly as findInstallRoot/flag/fail are duplicated across these files.
 // CASE-SENSITIVE: the token shapes are case-specific.
 const SECRET_PATTERNS = [
-  /AKIA[0-9A-Z]{16}/,                    // AWS access key id
-  /gh[pousr]_[A-Za-z0-9]{36}/,           // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)
-  /npm_[A-Za-z0-9]{36}/,                 // npm automation token
-  /sk-[A-Za-z0-9]{20,}/,                 // OpenAI-style secret key
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,  // PEM private-key header
+  /AKIA[0-9A-Z]{16}/, // AWS access key id
+  /gh[pousr]_[A-Za-z0-9]{20,}/, // GitHub token (ghp_/gho_/ghu_/ghs_/ghr_); {20,} covers the 36-char + CI forms
+  /github_pat_[A-Za-z0-9_]{22,}/, // GitHub fine-grained PAT
+  /xox[baprs]-[A-Za-z0-9-]{10,}/, // Slack token
+  /sk-[A-Za-z0-9]{20,}/, // OpenAI-style secret key
+  /sk-proj-[A-Za-z0-9_-]{20,}/, // OpenAI project-scoped key (underscore form sk-… misses)
+  /AIza[0-9A-Za-z._-]{10,}/, // Google / Gemini API key
+  /sk_(?:live|test)_[A-Za-z0-9]{20,}/, // Stripe live/test secret key
+  /npm_[A-Za-z0-9]{20,}/, // npm publish / automation token
+  /\bey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\b/, // JWT (incl. Bearer payloads); the eyJ… header gates it
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/, // PEM block (FULL — must precede the header fallback so redaction eats the body)
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM header (fallback: a lone/truncated header with no END)
+  /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/, // opaque Bearer token (non-JWT)
+  /\b[A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD)\b\s*[:=]\s*\S+/i, // KEY/TOKEN/SECRET/PASSWORD = value
 ];
 
 function secretScan(text) {