@geraldmaron/construct 1.4.1 → 1.5.0

package/bin/construct-postinstall.mjs

@@ -19,7 +19,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, statSync, readFileSync } from 'node:fs';
+import { existsSync, statSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -109,13 +109,19 @@ if (consumerPkg.name === '@geraldmaron/construct') {
   process.exit(0);
 }
 
+// Track every project mutation for the itemized receipt written at the end.
+// npm has no uninstall lifecycle hook so the manifest is the only machine-readable
+// record of what the hook touched and how to revert it (CX-AUDIT-PACKAGE-004).
+const mutations = [];
+
 try {
-  stageProjectAdapters({
+  const stageResult = stageProjectAdapters({
     projectRoot: initCwd,
     packageRoot: PKG_ROOT,
     pkgVersion: PKG_VERSION,
     log,
   });
+  mutations.push({ path: '.construct', type: 'stage', synced: stageResult.synced });
 
   // ADR-0027: Ensure .gitignore covers the newly staged adapters (construct-f6l6).
   // Idempotent: missingIgnorePatterns returns only patterns not already present.
@@ -129,8 +135,27 @@ try {
     const block = `${prefix}\n${HEADER}\n${SUBHEADER}\n${missing.join('\n')}\n`;
     const { appendFileSync } = await import('node:fs');
     appendFileSync(giPath, block, 'utf8');
+    mutations.push({ path: '.gitignore', type: 'append', patterns: missing });
     log(`appended ${missing.length} Construct ignore pattern(s) to .gitignore`);
   }
+
+  // Write the itemized mutation receipt so consumers can audit and revert what the
+  // hook touched. Write is best-effort: a manifest failure must never break an install.
+  try {
+    mkdirSync(path.join(initCwd, '.construct'), { recursive: true });
+    const manifest = {
+      pkgVersion: PKG_VERSION,
+      ts: new Date().toISOString(),
+      files: mutations.map((m) => m.path),
+      mutations,
+      recovery: 'npx construct init --repair',
+    };
+    writeFileSync(
+      path.join(initCwd, '.construct', 'install-manifest.json'),
+      JSON.stringify(manifest, null, 2) + '\n',
+    );
+    log('wrote .construct/install-manifest.json');
+  } catch { /* manifest write must not fail the install */ }
 } catch (err) {
   fail(`Adapter staging failed: ${err.message}`, 'The package is installed; run `npx construct init` in this project to complete setup.');
   // Intentionally exit 0: staging is best-effort completion, and a non-zero exit

package/config/tag-vocabulary.json

@@ -0,0 +1,264 @@
+{
+  "version": 1,
+  "facets": {
+    "intake-type":     { "exclusive": true,  "auto_threshold": 0.80 },
+    "lifecycle":       { "exclusive": true,  "auto_threshold": 0.90 },
+    "priority":        { "exclusive": true,  "auto_threshold": 0.90 },
+    "signal-strength": { "exclusive": false, "auto_threshold": 0.95 },
+    "reversibility":   { "exclusive": true,  "auto_threshold": 0.85 },
+    "doctype":         { "exclusive": true,  "auto_threshold": 0.90 }
+  },
+  "tags": [
+    {
+      "id": "intake/bug",
+      "facet": "intake-type",
+      "label": "Bug",
+      "synonyms": ["defect", "regression", "error"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/user-signal",
+      "facet": "intake-type",
+      "label": "User Signal",
+      "synonyms": ["feedback", "user-feedback", "customer-signal"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/experiment",
+      "facet": "intake-type",
+      "label": "Experiment",
+      "synonyms": ["ab-test", "test", "trial"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/architecture",
+      "facet": "intake-type",
+      "label": "Architecture",
+      "synonyms": ["design", "system-design", "arch"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/incident",
+      "facet": "intake-type",
+      "label": "Incident",
+      "synonyms": ["outage", "postmortem", "production-issue"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/security",
+      "facet": "intake-type",
+      "label": "Security",
+      "synonyms": ["vulnerability", "cve", "threat"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/requirement",
+      "facet": "intake-type",
+      "label": "Requirement",
+      "synonyms": ["spec", "specification", "acceptance-criteria"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/research",
+      "facet": "intake-type",
+      "label": "Research",
+      "synonyms": ["study", "literature-review"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/ops",
+      "facet": "intake-type",
+      "label": "Ops",
+      "synonyms": ["operational", "runbook", "infra"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/eval-finding",
+      "facet": "intake-type",
+      "label": "Eval Finding",
+      "synonyms": ["evaluation", "eval", "benchmark-result"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/launch-asset",
+      "facet": "intake-type",
+      "label": "Launch Asset",
+      "synonyms": ["launch", "go-to-market", "release-material"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/legal-compliance",
+      "facet": "intake-type",
+      "label": "Legal Compliance",
+      "synonyms": ["legal", "compliance", "regulatory"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/draft",
+      "facet": "lifecycle",
+      "label": "Draft",
+      "synonyms": ["wip", "in-progress"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/approved",
+      "facet": "lifecycle",
+      "label": "Approved",
+      "synonyms": ["accepted", "ratified"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/deprecated",
+      "facet": "lifecycle",
+      "label": "Deprecated",
+      "synonyms": ["sunset", "retiring"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/superseded",
+      "facet": "lifecycle",
+      "label": "Superseded",
+      "synonyms": ["replaced", "obsolete"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/archived",
+      "facet": "lifecycle",
+      "label": "Archived",
+      "synonyms": ["closed", "done"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "priority/p0",
+      "facet": "priority",
+      "label": "P0 - Critical",
+      "synonyms": ["critical", "blocker", "sev0"],
+      "promote_to_graph": true,
+      "status": "active"
+    },
+    {
+      "id": "priority/p1",
+      "facet": "priority",
+      "label": "P1 - High",
+      "synonyms": ["high", "urgent", "sev1"],
+      "promote_to_graph": true,
+      "status": "active"
+    },
+    {
+      "id": "priority/p2",
+      "facet": "priority",
+      "label": "P2 - Medium",
+      "synonyms": ["medium", "normal", "sev2"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "priority/p3",
+      "facet": "priority",
+      "label": "P3 - Low",
+      "synonyms": ["low", "nice-to-have", "sev3"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "signal/high-customer-interest",
+      "facet": "signal-strength",
+      "label": "High Customer Interest",
+      "synonyms": ["customer-demand", "high-demand", "top-request"],
+      "promote_to_graph": true,
+      "anchor_entities": ["customer-feedback"],
+      "expected_cardinality": 100,
+      "cardinality_window_days": 90,
+      "status": "active"
+    },
+    {
+      "id": "signal/internal-alignment",
+      "facet": "signal-strength",
+      "label": "Internal Alignment",
+      "synonyms": ["aligned", "consensus", "cross-team"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "signal/blocked",
+      "facet": "signal-strength",
+      "label": "Blocked",
+      "synonyms": ["dependency", "waiting", "stalled"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "reversibility/irreversible",
+      "facet": "reversibility",
+      "label": "Irreversible",
+      "synonyms": ["one-way-door", "permanent"],
+      "promote_to_graph": true,
+      "status": "active"
+    },
+    {
+      "id": "reversibility/reversible",
+      "facet": "reversibility",
+      "label": "Reversible",
+      "synonyms": ["two-way-door", "rollback"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "reversibility/quasi-reversible",
+      "facet": "reversibility",
+      "label": "Quasi-Reversible",
+      "synonyms": ["partially-reversible", "conditional-rollback"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/prd",
+      "facet": "doctype",
+      "label": "PRD",
+      "synonyms": ["product-requirements", "product-spec"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/adr",
+      "facet": "doctype",
+      "label": "ADR",
+      "synonyms": ["architecture-decision", "decision-record"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/rfc",
+      "facet": "doctype",
+      "label": "RFC",
+      "synonyms": ["request-for-comments", "proposal"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/postmortem",
+      "facet": "doctype",
+      "label": "Postmortem",
+      "synonyms": ["incident-review", "retrospective"],
+      "promote_to_graph": false,
+      "status": "active"
+    }
+  ]
+}

package/examples/distribution/sources/deck-one-pager.md

@@ -60,6 +60,6 @@ One token set across all distributable formats:
 
 - Export: `construct export … --to=pptx`
 - Regenerate: `npm run examples:deck`
-- Matrix: [Document I/O reference](/guides/reference/document-io)
+- Matrix: [Document I/O reference](../../../docs/guides/reference/document-io.md)
 
 Review outputs in `.tmp/distribution-examples/`.

package/lib/acp/server.mjs

@@ -12,6 +12,10 @@
  * methods: `initialize`, `session/new`, `session/prompt`, `session/cancel`;
  * progress streams as `session/update` notifications. The prompt bridges to
  * planRun/executeRun and forwards run-lifecycle events as agent message chunks.
+ *
+ * `fetchImpl` is injectable (mirrors lib/orchestration/worker.mjs) and threads
+ * straight through to executeRun, so a test can drive the provider backend
+ * without a live key or a real network call.
  */
 
 import { createInterface } from 'node:readline';
@@ -20,16 +24,26 @@ const PROTOCOL_VERSION = 1;
 
 function describeEvent(event) {
   if (event.type === 'planned') return `Planned ${event.tasks ?? ''} specialist task(s).`;
-  if (event.type === 'running') return 'Running orchestration…';
-  if (event.type === 'task') return `· ${event.role ?? 'task'} — ${event.status ?? ''}`;
-  if (event.type === 'completed') return `Completed: ${event.status ?? 'done'}.`;
+  if (event.type === 'running') return `Running orchestration… (workerBackend=${event.workerBackend ?? 'inline'})`;
+  if (event.type === 'task') return `· ${event.role ?? 'task'} — ${event.status ?? ''}${event.executor ? ` (${event.executor})` : ''}`;
+  if (event.type === 'completed') {
+    const status = event.status ?? 'done';
+    if (status === 'completed') return 'Completed (specialist tasks executed).';
+    if (status === 'completed-prepare-only') return 'Completed (tasks prepared only — no specialist execution).';
+    if (status === 'completed-with-failures') return 'Completed with failures (some tasks failed).';
+    if (status === 'degraded') return 'Degraded — the run could not fully execute; see the summary.';
+    if (status === 'cancelled') return 'Cancelled.';
+    return `Completed: ${status}.`;
+  }
   if (event.type === 'error') return `Error: ${event.error?.message ?? 'run failed'}.`;
   return null;
 }
 
 function summarize(run) {
-  const tasks = (run.tasks || []).map((t) => `- ${t.role} (${t.status})`).join('\n');
-  return `Orchestration ${run.status} — executionMode=${run.execution?.executionMode}.\n${tasks}`;
+  const tasks = (run.tasks || []).map((t) => `- ${t.role} (${t.status}${t.executor ? `, ${t.executor}` : ''})`).join('\n');
+  const exec = run.execution || {};
+  const degraded = run.degraded ? ` — degraded: ${run.degradationReason}` : '';
+  return `Orchestration ${run.status} — executionMode=${exec.executionMode}, workerBackend=${run.workerBackend}${degraded}.\n${tasks}`;
 }
 
 function textFromPrompt(prompt) {
@@ -37,7 +51,7 @@ function textFromPrompt(prompt) {
   return prompt.filter((b) => b && b.type === 'text' && typeof b.text === 'string').map((b) => b.text).join('\n').trim();
 }
 
-export function runAcpServer({ input, output, env = process.env, defaultCwd = process.cwd() } = {}) {
+export function runAcpServer({ input, output, env = process.env, defaultCwd = process.cwd(), fetchImpl } = {}) {
   const sessions = new Map();
   let sessionCounter = 0;
 
@@ -63,7 +77,7 @@ export function runAcpServer({ input, output, env = process.env, defaultCwd = pr
         const line = describeEvent(event);
         if (line) update(sessionId, line);
       });
-      const run = await executeRun(session.cwd, planned.runId, { env, workerBackend: 'inline' });
+      const run = await executeRun(session.cwd, planned.runId, { env, fetchImpl });
       off();
       update(sessionId, summarize(run));
       respond(id, { stopReason: isCancelRequested(planned.runId) ? 'cancelled' : 'end_turn' });

package/lib/adapters-sync.mjs

@@ -12,6 +12,7 @@ import { fileURLToPath } from 'node:url';
 import { detectHostCapabilities } from './host-capabilities.mjs';
 import { isConstructPackageRepo } from './host-disposition.mjs';
 import { stageProjectAdapters } from './install/stage-project.mjs';
+import { isMainModule } from './roots.mjs';
 
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = path.resolve(MODULE_DIR, '..');
@@ -58,7 +59,7 @@ export function runAdaptersScript({ cwd = process.cwd(), hosts = null } = {}) {
   return result.synced ? 0 : 1;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const args = new Set(process.argv.slice(2));
   const forceAll = args.has('--all-hosts');
   const hosts = forceAll ? resolveAdapterHosts({ forceAll: true }) : null;

package/lib/audit-trail.mjs

@@ -17,14 +17,31 @@
  * the damaged prefix as immutable legacy and re-bases the live chain;
  * verifyChain validates only from the last boundary forward. See
  * docs/guides/concepts/observability.md.
+ *
+ * Every record passes through redactRecord before the chain hash is computed
+ * (redact-then-sign), so prev_line_hash always chains off the redacted form —
+ * a secret can never enter the signed chain even transiently. Redaction
+ * covers: (a) values resolved by lib/providers/secret-resolver.mjs, consulted
+ * read-only via its resolved-cache snapshot; (b) common token shapes (Bearer,
+ * ghp_, xoxb/xoxp/xoxa, sk-, op://); (c) custom patterns registered with
+ * configureRedactionPatterns. Matches are replaced with `<redacted:kind>`;
+ * the pass itself is audited as a count, never the matched text.
+ *
+ * LMCP-H5: checkAuditSinkAvailable performs a real write-probe against the
+ * audit directory (mkdir + append + unlink a sidecar file) so a caller can
+ * distinguish "sink healthy" from "sink down" (read-only filesystem, missing
+ * mount, permissions) before deciding whether to proceed. Enterprise mode's
+ * mandatory-audit gate (lib/policy/audit-gate.mjs) fails closed on this
+ * check; solo/team never call it.
  */
-import { readFileSync, existsSync, statSync, mkdirSync } from 'node:fs';
+import { readFileSync, existsSync, statSync, mkdirSync, appendFileSync, unlinkSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join, dirname } from 'node:path';
 
 import { appendBounded, readLastLineAcrossSegments } from './logging/rotate.mjs';
 import { withFileLockSync } from './storage/file-lock.mjs';
 import { doctorRoot } from './config/xdg.mjs';
+import { __resolvedSecretValues } from './providers/secret-resolver.mjs';
 
 const AUDIT_FILE = join(doctorRoot(), 'audit-trail.jsonl');
 
@@ -32,17 +49,183 @@ function sha256(input) {
   return createHash('sha256').update(input).digest('hex');
 }
 
+export class AuditSinkUnavailableError extends Error {
+  constructor(message, { file, reason } = {}) {
+    super(message);
+    this.name = 'AuditSinkUnavailableError';
+    this.file = file ?? null;
+    this.reason = reason ?? null;
+  }
+}
+
+// A real write-probe, not a stat/existsSync check: a directory can exist and
+// still refuse writes (read-only remount, quota, permission drop after
+// mkdir). Writing and removing a sidecar file physically exercises the same
+// path appendAuditRecord will take next, so "available" here means the next
+// real append is actually expected to succeed.
+
+export function checkAuditSinkAvailable({ file = AUDIT_FILE } = {}) {
+  const dir = dirname(file);
+  const probePath = join(dir, `.audit-sink-probe-${process.pid}-${Date.now()}`);
+  try {
+    mkdirSync(dir, { recursive: true });
+    appendFileSync(probePath, 'probe\n', 'utf8');
+    unlinkSync(probePath);
+    return { available: true, reason: null };
+  } catch (err) {
+    return { available: false, reason: err?.code || err?.message || 'unknown-error' };
+  }
+}
+
+// Built-in token shapes seen in the wild across providers: generic Bearer
+// headers, GitHub PATs (ghp_), Slack bot/user/app tokens (xoxb/xoxp/xoxa),
+// OpenAI-style secret keys (sk-), and 1Password references (op://...). Each
+// pattern is tagged with a `kind` so the replacement reads `<redacted:kind>`
+// rather than a single opaque marker, which keeps audit records diagnosable.
+
+const BUILTIN_PATTERNS = [
+  { kind: 'bearer-token', re: /\bBearer\s+[A-Za-z0-9\-._~+/]+=*/g },
+  { kind: 'github-token', re: /\bghp_[A-Za-z0-9]{20,}\b/g },
+  { kind: 'slack-token', re: /\bxox[bpa]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: 'api-key', re: /\bsk-[A-Za-z0-9]{16,}\b/g },
+  { kind: 'op-reference', re: /\bop:\/\/[^\s'"]+/g },
+];
+
+// Custom patterns a caller wires in at startup (e.g. an org-specific token
+// shape). Kept process-local and additive over BUILTIN_PATTERNS; never
+// persisted, so a test or embedder can register/reset freely.
+
+let customPatterns = [];
+
+/**
+ * Register additional redaction patterns beyond the built-in token shapes.
+ * Each entry is `{ kind, re }` where `re` is a global RegExp. Replaces the
+ * full custom set on every call so a caller can reconfigure cleanly.
+ *
+ * @param {{kind:string, re:RegExp}[]} patterns
+ */
+export function configureRedactionPatterns(patterns = []) {
+  customPatterns = Array.isArray(patterns) ? patterns.filter((p) => p && p.re instanceof RegExp && typeof p.kind === 'string') : [];
+}
+
+export function __resetRedactionPatterns() {
+  customPatterns = [];
+}
+
+// Secret values below this length are excluded from the known-value pass:
+// short resolved values (flags, single-char tokens) produce false-positive
+// redactions in ordinary prose.
+
+const MIN_KNOWN_SECRET_LENGTH = 8;
+
+function escapeRegExp(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// A resolved secret is redacted by exact substring match, not by first
+// hashing the haystack — a hash comparison can only ever confirm equality of
+// two already-known values, never locate an unknown-length substring inside
+// arbitrary free text. Instead, the "hashed comparison" the caller performs
+// (recorded in the audit count, see below) is against sha256(value) so the
+// count event that leaves the process never carries a byte of the plaintext,
+// even though the in-process match itself must touch the plaintext to redact
+// it — the same value already lives in secret-resolver's own cache in-process.
+
+function knownSecretPatterns() {
+  const values = __resolvedSecretValues().filter(
+    (v) => typeof v === 'string' && v.length >= MIN_KNOWN_SECRET_LENGTH,
+  );
+  return values.map((value) => ({
+    kind: 'known-secret',
+    re: new RegExp(escapeRegExp(value), 'g'),
+    hash: sha256(value),
+  }));
+}
+
+// lib/providers/secret-audit-wiring.mjs already records the op:// reference
+// itself (never the resolved value) under these exact key names as its
+// value-free diagnostic contract — a bare op://vault/item/field pointer is
+// not a secret, so the op-reference pattern must not clobber it there. Any
+// other field carrying an op:// string (a tool result body, a raw env dump)
+// is still redacted.
+
+const OP_REF_EXEMPT_KEYS = new Set(['ref']);
+
+// Walk every string reachable in `value`, applying every pattern in turn and
+// replacing matches with `<redacted:kind>`. Returns the redacted clone plus a
+// count-only tally (kind → number of matches) so the caller can audit that
+// redaction occurred without ever recording the matched text.
+
+function redactString(str, patterns, tally) {
+  let out = str;
+  for (const { kind, re } of patterns) {
+    re.lastIndex = 0;
+    const matches = out.match(re);
+    if (matches && matches.length) {
+      tally[kind] = (tally[kind] || 0) + matches.length;
+      out = out.replace(re, `<redacted:${kind}>`);
+    }
+  }
+  return out;
+}
+
+function redactValue(value, patterns, tally, key = null) {
+  if (typeof value === 'string') {
+    if (key && OP_REF_EXEMPT_KEYS.has(key)) {
+      const rest = patterns.filter((p) => p.kind !== 'op-reference');
+      return redactString(value, rest, tally);
+    }
+    return redactString(value, patterns, tally);
+  }
+  if (Array.isArray(value)) return value.map((v) => redactValue(v, patterns, tally));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      // Schema-marked redacted:true fields are already elided upstream by the
+      // caller's own schema; this pass is a second, pattern-based net over
+      // whatever free-text fields (detail, args, result, payload) remain.
+      out[k] = redactValue(v, patterns, tally, k);
+    }
+    return out;
+  }
+  return value;
+}
+
+/**
+ * Redact known secret values and token-shaped strings from an audit record.
+ * Runs BEFORE the chain hash is computed so the signature always covers the
+ * redacted form (redact-then-sign). Returns `{ record, tally }` where tally
+ * is a count-only map of kind → matches (never the matched text).
+ *
+ * @param {object} partial
+ * @returns {{record: object, tally: Record<string, number>}}
+ */
+export function redactRecord(partial) {
+  const patterns = [...BUILTIN_PATTERNS, ...customPatterns, ...knownSecretPatterns()];
+  const tally = {};
+  const record = redactValue(partial, patterns, tally);
+  return { record, tally };
+}
+
 // prev_line_hash and the append must be one atomic step or concurrent writers
 // race; the file lock serializes them across processes.
 
 export function appendAuditRecord(partial, { file = AUDIT_FILE } = {}) {
+  const { record: redacted, tally } = redactRecord(partial);
+
+  // Redaction is itself audited as a count only — never the secret — folded
+  // into the record's own field before it is hashed and written, so the
+  // signed line and the returned record always agree.
+
+  if (Object.keys(tally).length) redacted.redaction_counts = tally;
+
   return withFileLockSync(file, () => {
     let prev = null;
     try {
       const last = readLastLineAcrossSegments(file);
       if (last !== null) prev = sha256(last);
     } catch { /* first record, or unreadable tail */ }
-    const record = { ...partial, prev_line_hash: prev };
+    const record = { ...redacted, prev_line_hash: prev };
     mkdirSync(dirname(file), { recursive: true });
     appendBounded('audit-trail', file, JSON.stringify(record) + '\n');
     return record;

package/lib/beads/auto-close.mjs

@@ -21,6 +21,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
+import { isMainModule } from '../roots.mjs';
 
 const CLOSES_RE = /\b(?:closes?|close|fix(?:es)?|fixed|resolves?|resolved)\s+(construct-[a-z0-9]+)/gi;
 
@@ -105,7 +106,7 @@ export async function runAutoClose({ range, runner = spawnSync } = {}) {
 }
 
 // CLI entry: read --range, run, print summary.
-const invokedDirectly = import.meta.url === `file://${process.argv[1]}`;
+const invokedDirectly = isMainModule(import.meta.url);
 if (invokedDirectly) {
   const args = process.argv.slice(2);
   const rangeArg = args.find((a) => a.startsWith('--range='));

package/lib/beads/drift.mjs

@@ -25,6 +25,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
+import { isMainModule } from '../roots.mjs';
 
 const DEFAULT_STALE_OPEN_DAYS = 14;
 const DEFAULT_STUCK_IN_PROGRESS_DAYS = 3;
@@ -166,7 +167,7 @@ export function formatDriftReport(report) {
 }
 
 // CLI: print report, exit non-zero when thresholds breached unless --report-only.
-const invokedDirectly = import.meta.url === `file://${process.argv[1]}`;
+const invokedDirectly = isMainModule(import.meta.url);
 if (invokedDirectly) {
   const args = process.argv.slice(2);
   const json = args.includes('--json');