@hasna/instructions 0.4.11 → 0.4.12

package/dist/cli/index.js

@@ -7550,6 +7550,9 @@ function scanSecrets(content, format) {
   const r = redactContent(content, format);
   return r.redacted;
 }
+function isSecretVarName(name) {
+  return SECRET_KEY_PATTERN.test(name);
+}
 var SECRET_KEY_PATTERN, VALUE_PATTERNS, MIN_SECRET_VALUE_LEN = 8;
 var init_redact = __esm(() => {
   SECRET_KEY_PATTERN = /^(.*_?API_?KEY|.*_?TOKEN|.*_?SECRET|.*_?PASSWORD|.*_?PASSWD|.*_?CREDENTIAL|.*_?AUTH(?:_TOKEN|_KEY|ORIZATION)?|.*_?PRIVATE_?KEY|.*_?ACCESS_?KEY|.*_?CLIENT_?SECRET|.*_?SIGNING_?KEY|.*_?ENCRYPTION_?KEY|.*_AUTH_TOKEN)$/i;
@@ -12289,30 +12292,86 @@ async function syncToDisk(opts = {}) {
   }
   return result;
 }
-function buildDiff(expectedContent, targetPath) {
+function redactionPlaceholders(storedLine) {
+  const found = [...storedLine.match(CERTAIN_PLACEHOLDER_RE) ?? []];
+  const assigned = storedLine.match(ASSIGNED_PLACEHOLDER_RE);
+  if (assigned) {
+    const name = assigned[3] ?? assigned[4] ?? assigned[5];
+    if (name && isSecretVarName(name))
+      found.push(assigned[2]);
+  }
+  return found;
+}
+function redactFormatForTarget(targetPath, storedFormat) {
+  const p = targetPath.toLowerCase();
+  if (/(^|\/)\.(zshrc|zprofile|bashrc|bash_profile|profile|zshenv|env)$/.test(p) || p.endsWith(".env"))
+    return "shell";
+  if (/(^|\/)\.(npmrc|yarnrc|curlrc|netrc)$/.test(p))
+    return "ini";
+  return storedFormat;
+}
+function storedPlaceholderIsLiteralOnDisk(storedLine, diskLine) {
+  return redactionPlaceholders(storedLine).some((p) => !diskLine.includes(p));
+}
+function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
   if (!existsSync9(path))
     return `(file not found on disk: ${path})`;
   const diskContent = readFileSync6(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
+  const format = redactFormatForTarget(targetPath, storedFormat);
   const stored = expectedContent.split(`
 `);
   const disk = diskContent.split(`
 `);
+  const { content: redactedDiskContent, redacted } = showSecrets ? { content: diskContent, redacted: [] } : redactContent(diskContent, format);
+  const redactedDisk = redactedDiskContent.split(`
+`);
+  const reasonByLine = new Map;
+  for (const r of redacted)
+    if (!reasonByLine.has(r.line))
+      reasonByLine.set(r.line, r.reason);
   const lines = [`--- stored (DB)`, `+++ disk (${path})`];
   const maxLen = Math.max(stored.length, disk.length);
   for (let i = 0;i < maxLen; i++) {
+    const lineNo = i + 1;
     const s = stored[i];
     const dk = disk[i];
     if (s === dk) {
       if (s !== undefined)
         lines.push(` ${s}`);
-    } else {
+      continue;
+    }
+    if (showSecrets || dk === undefined) {
       if (s !== undefined)
         lines.push(`-${s}`);
       if (dk !== undefined)
         lines.push(`+${dk}`);
+      continue;
+    }
+    const structural = s !== undefined && storedPlaceholderIsLiteralOnDisk(s, dk);
+    const patterned = reasonByLine.has(lineNo);
+    if (!structural && !patterned) {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      lines.push(`+${dk}`);
+      continue;
+    }
+    if (structural) {
+      const placeholder = redactionPlaceholders(s).find((p) => !dk.includes(p)) ?? "a placeholder";
+      lines.push(`~line ${lineNo} differs: stored \`${s}\`, disk holds a literal value for ${placeholder} \u2014 redacted (use --show-secrets on a TTY to reveal)`);
+      continue;
+    }
+    const safe = redactedDisk[i] ?? "";
+    const reason = reasonByLine.get(lineNo);
+    if (s !== undefined && safe === s) {
+      lines.push(`~line ${lineNo} differs: stored \`${s}\`, disk holds a literal value (${reason}) \u2014 redacted (use --show-secrets on a TTY to reveal)`);
+    } else {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      lines.push(`+${safe}`);
+      lines.push(`~line ${lineNo}: disk value redacted (${reason}) \u2014 use --show-secrets on a TTY to reveal`);
     }
   }
   return lines.join(`
@@ -12327,15 +12386,16 @@ async function diffConfig(config, opts = {}) {
   if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
     return "(generated output \u2014 managed by fan-out)";
   }
+  const showSecrets = opts.showSecrets ?? false;
   if (config.target_path) {
-    const diff = buildDiff(config.content, config.target_path);
+    const diff = buildDiff(config.content, config.target_path, config.format, showSecrets);
     if (!diff.includes("no diff"))
       diffs.push(diff);
   }
   if (config.outputs.length > 0) {
     for (const output of config.outputs) {
       const expected = applyTransform(config, output, { configs: contextConfigs });
-      const diff = buildDiff(expected, output.target_path);
+      const diff = buildDiff(expected, output.target_path, detectFormat(output.target_path), showSecrets);
       if (!diff.includes("no diff"))
         diffs.push(diff);
     }
@@ -12406,7 +12466,7 @@ function detectFormat(filePath) {
     return "ini";
   return "text";
 }
-var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES;
+var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES, CERTAIN_PLACEHOLDER_RE, ASSIGNED_PLACEHOLDER_RE;
 var init_sync = __esm(() => {
   init_config_store();
   init_apply();
@@ -12470,6 +12530,8 @@ var init_sync = __esm(() => {
     { file: ".agents/mcp_config.json", category: "mcp", agent: "antigravity", format: "json" },
     { file: ".qwen/settings.json", category: "agent", agent: "qwen", format: "json" }
   ];
+  CERTAIN_PLACEHOLDER_RE = /\{\{[A-Za-z_][A-Za-z0-9_]*\}\}/g;
+  ASSIGNED_PLACEHOLDER_RE = /[=:]\s*(["']?)(\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Z][A-Z0-9_]*)|%([A-Za-z_][A-Za-z0-9_]*)%)\1\s*,?\s*$/;
 });
 
 // src/lib/package-manager-guard.ts
@@ -15430,12 +15492,18 @@ program.command("apply <id>").description("Apply a config to its target_path and
     process.exit(1);
   }
 });
-program.command("diff [id]").description("Show diff between stored config and disk (omit id for --all)").option("--all", "diff every known config against disk").action(async (id, opts) => {
+program.command("diff [id]").description("Show diff between stored config and disk (omit id for --all). Credential values on disk are redacted.").option("--all", "diff every known config against disk").option("--show-secrets", "render credential values from disk verbatim (interactive TTY only)").action(async (id, opts) => {
   try {
+    if (opts.showSecrets && !process.stdout.isTTY) {
+      console.error(chalk.red("--show-secrets refuses to run on a non-TTY: the output would be captured verbatim into a log or transcript."));
+      console.error(chalk.dim("Run it in an interactive terminal, or use the redacted default."));
+      process.exit(1);
+    }
+    const showSecrets = Boolean(opts.showSecrets);
     const store = resolveConfigStore();
     if (id) {
       const config = await store.getConfig(id);
-      console.log(await diffConfig(config, { store }));
+      console.log(await diffConfig(config, { store, showSecrets }));
       return;
     }
     const configs = await store.listConfigs({ kind: "file" });
@@ -15443,7 +15511,7 @@ program.command("diff [id]").description("Show diff between stored config and di
     for (const c of configs) {
       if (!c.target_path)
         continue;
-      const diff = await diffConfig(c, { store });
+      const diff = await diffConfig(c, { store, showSecrets });
       if (diff.includes("no diff") || diff.includes("not found"))
         continue;
       drifted++;

package/dist/index.js

@@ -5515,6 +5515,9 @@ function scanSecrets(content, format) {
 function hasSecrets(content, format) {
   return scanSecrets(content, format).length > 0;
 }
+function isSecretVarName(name) {
+  return SECRET_KEY_PATTERN.test(name);
+}
 
 // src/lib/session-render-contract.ts
 var CODEWITH_NATIVE_IMPORTS_ENV = "HASNA_CONFIGS_CODEWITH_NATIVE_IMPORTS";
@@ -11680,30 +11683,88 @@ async function syncToDisk(opts = {}) {
   }
   return result;
 }
-function buildDiff(expectedContent, targetPath) {
+var CERTAIN_PLACEHOLDER_RE = /\{\{[A-Za-z_][A-Za-z0-9_]*\}\}/g;
+var ASSIGNED_PLACEHOLDER_RE = /[=:]\s*(["']?)(\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Z][A-Z0-9_]*)|%([A-Za-z_][A-Za-z0-9_]*)%)\1\s*,?\s*$/;
+function redactionPlaceholders(storedLine) {
+  const found = [...storedLine.match(CERTAIN_PLACEHOLDER_RE) ?? []];
+  const assigned = storedLine.match(ASSIGNED_PLACEHOLDER_RE);
+  if (assigned) {
+    const name = assigned[3] ?? assigned[4] ?? assigned[5];
+    if (name && isSecretVarName(name))
+      found.push(assigned[2]);
+  }
+  return found;
+}
+function redactFormatForTarget(targetPath, storedFormat) {
+  const p = targetPath.toLowerCase();
+  if (/(^|\/)\.(zshrc|zprofile|bashrc|bash_profile|profile|zshenv|env)$/.test(p) || p.endsWith(".env"))
+    return "shell";
+  if (/(^|\/)\.(npmrc|yarnrc|curlrc|netrc)$/.test(p))
+    return "ini";
+  return storedFormat;
+}
+function storedPlaceholderIsLiteralOnDisk(storedLine, diskLine) {
+  return redactionPlaceholders(storedLine).some((p) => !diskLine.includes(p));
+}
+function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
   if (!existsSync11(path))
     return `(file not found on disk: ${path})`;
   const diskContent = readFileSync9(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
+  const format = redactFormatForTarget(targetPath, storedFormat);
   const stored = expectedContent.split(`
 `);
   const disk = diskContent.split(`
 `);
+  const { content: redactedDiskContent, redacted } = showSecrets ? { content: diskContent, redacted: [] } : redactContent(diskContent, format);
+  const redactedDisk = redactedDiskContent.split(`
+`);
+  const reasonByLine = new Map;
+  for (const r of redacted)
+    if (!reasonByLine.has(r.line))
+      reasonByLine.set(r.line, r.reason);
   const lines = [`--- stored (DB)`, `+++ disk (${path})`];
   const maxLen = Math.max(stored.length, disk.length);
   for (let i = 0;i < maxLen; i++) {
+    const lineNo = i + 1;
     const s = stored[i];
     const dk = disk[i];
     if (s === dk) {
       if (s !== undefined)
         lines.push(` ${s}`);
-    } else {
+      continue;
+    }
+    if (showSecrets || dk === undefined) {
       if (s !== undefined)
         lines.push(`-${s}`);
       if (dk !== undefined)
         lines.push(`+${dk}`);
+      continue;
+    }
+    const structural = s !== undefined && storedPlaceholderIsLiteralOnDisk(s, dk);
+    const patterned = reasonByLine.has(lineNo);
+    if (!structural && !patterned) {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      lines.push(`+${dk}`);
+      continue;
+    }
+    if (structural) {
+      const placeholder = redactionPlaceholders(s).find((p) => !dk.includes(p)) ?? "a placeholder";
+      lines.push(`~line ${lineNo} differs: stored \`${s}\`, disk holds a literal value for ${placeholder} \u2014 redacted (use --show-secrets on a TTY to reveal)`);
+      continue;
+    }
+    const safe = redactedDisk[i] ?? "";
+    const reason = reasonByLine.get(lineNo);
+    if (s !== undefined && safe === s) {
+      lines.push(`~line ${lineNo} differs: stored \`${s}\`, disk holds a literal value (${reason}) \u2014 redacted (use --show-secrets on a TTY to reveal)`);
+    } else {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      lines.push(`+${safe}`);
+      lines.push(`~line ${lineNo}: disk value redacted (${reason}) \u2014 use --show-secrets on a TTY to reveal`);
     }
   }
   return lines.join(`
@@ -11718,15 +11779,16 @@ async function diffConfig(config, opts = {}) {
   if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
     return "(generated output \u2014 managed by fan-out)";
   }
+  const showSecrets = opts.showSecrets ?? false;
   if (config.target_path) {
-    const diff = buildDiff(config.content, config.target_path);
+    const diff = buildDiff(config.content, config.target_path, config.format, showSecrets);
     if (!diff.includes("no diff"))
       diffs.push(diff);
   }
   if (config.outputs.length > 0) {
     for (const output of config.outputs) {
       const expected = applyTransform(config, output, { configs: contextConfigs });
-      const diff = buildDiff(expected, output.target_path);
+      const diff = buildDiff(expected, output.target_path, detectFormat(output.target_path), showSecrets);
       if (!diff.includes("no diff"))
         diffs.push(diff);
     }

package/dist/lib/diff-redaction.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=diff-redaction.test.d.ts.map

package/dist/lib/diff-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-redaction.test.d.ts","sourceRoot":"","sources":["../../src/lib/diff-redaction.test.ts"],"names":[],"mappings":""}

package/dist/lib/redact.d.ts

@@ -26,4 +26,13 @@ export declare function redactContent(content: string, format: RedactFormat): Re
 export declare function scanSecrets(content: string, format: RedactFormat): RedactedVar[];
 /** Returns true if content contains any detectable secrets. */
 export declare function hasSecrets(content: string, format: RedactFormat): boolean;
+/**
+ * Is this variable NAME secret-shaped? (`NPM_TOKEN` yes, `PATH`/`HOME` no.)
+ *
+ * Exported so callers reasoning about placeholder names — notably the diff
+ * renderer, which must tell a redaction artefact from an ordinary shell
+ * variable — share this module's single definition of "secret-shaped" instead
+ * of duplicating the pattern and drifting from it.
+ */
+export declare function isSecretVarName(name: string): boolean;
 //# sourceMappingURL=redact.d.ts.map

package/dist/lib/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAgND,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,YAAY,CAQjF;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,WAAW,EAAE,CAGhF;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAEzE"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAgND,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,YAAY,CAQjF;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,WAAW,EAAE,CAGhF;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/lib/sync.d.ts

@@ -43,6 +43,16 @@ export interface SyncToDiskOptions {
 export declare function syncToDisk(opts?: SyncToDiskOptions): Promise<SyncResult>;
 export interface DiffConfigOptions {
     store?: ConfigStore;
+    /**
+     * Render the raw disk content, INCLUDING any credential values it holds.
+     *
+     * Off by default and deliberately hard to reach: the CLI refuses it on a
+     * non-TTY, mirroring `secrets get --show`. Everything a tool prints is
+     * persisted verbatim into the session transcript, and agent output is also
+     * served as run evidence — so an unredacted diff writes a live credential
+     * into a durable, fetchable artefact.
+     */
+    showSecrets?: boolean;
 }
 export declare function diffConfig(config: Config, opts?: DiffConfigOptions): Promise<string>;
 export declare function detectCategory(filePath: string): ConfigCategory;

package/dist/lib/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/lib/sync.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrH,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAW/E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,YAAY,EAQ/C,CAAC;AAwDF,eAAO,MAAM,aAAa,EAAE,WAAW,EAwDtC,CAAC;AAIF,eAAO,MAAM,oBAAoB;;cAC2B,cAAc;WAAsB,WAAW;YAAwB,YAAY;GAc9I,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAqGhF;AAGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,wBAAsB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAmClF;AAGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAwBD,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B9F;AAGD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAU/D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAgBzD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAQ3D;AAGD,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/lib/sync.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrH,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAW/E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,YAAY,EAQ/C,CAAC;AAwDF,eAAO,MAAM,aAAa,EAAE,WAAW,EAwDtC,CAAC;AAIF,eAAO,MAAM,oBAAoB;;cAC2B,cAAc;WAAsB,WAAW;YAAwB,YAAY;GAc9I,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAqGhF;AAGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,wBAAsB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAmClF;AAGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA8JD,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B9F;AAGD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAU/D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAgBzD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAQ3D;AAGD,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC"}

package/dist/mcp/index.js

@@ -5170,6 +5170,7 @@ var exports_redact = {};
 __export(exports_redact, {
   scanSecrets: () => scanSecrets,
   redactContent: () => redactContent,
+  isSecretVarName: () => isSecretVarName,
   hasSecrets: () => hasSecrets
 });
 function redactShell(content) {
@@ -5343,6 +5344,9 @@ function scanSecrets(content, format) {
 function hasSecrets(content, format) {
   return scanSecrets(content, format).length > 0;
 }
+function isSecretVarName(name) {
+  return SECRET_KEY_PATTERN.test(name);
+}
 var SECRET_KEY_PATTERN, VALUE_PATTERNS, MIN_SECRET_VALUE_LEN = 8;
 var init_redact = __esm(() => {
   SECRET_KEY_PATTERN = /^(.*_?API_?KEY|.*_?TOKEN|.*_?SECRET|.*_?PASSWORD|.*_?PASSWD|.*_?CREDENTIAL|.*_?AUTH(?:_TOKEN|_KEY|ORIZATION)?|.*_?PRIVATE_?KEY|.*_?ACCESS_?KEY|.*_?CLIENT_?SECRET|.*_?SIGNING_?KEY|.*_?ENCRYPTION_?KEY|.*_AUTH_TOKEN)$/i;
@@ -6515,30 +6519,86 @@ async function syncToDisk(opts = {}) {
   }
   return result;
 }
-function buildDiff(expectedContent, targetPath) {
+function redactionPlaceholders(storedLine) {
+  const found = [...storedLine.match(CERTAIN_PLACEHOLDER_RE) ?? []];
+  const assigned = storedLine.match(ASSIGNED_PLACEHOLDER_RE);
+  if (assigned) {
+    const name = assigned[3] ?? assigned[4] ?? assigned[5];
+    if (name && isSecretVarName(name))
+      found.push(assigned[2]);
+  }
+  return found;
+}
+function redactFormatForTarget(targetPath, storedFormat) {
+  const p = targetPath.toLowerCase();
+  if (/(^|\/)\.(zshrc|zprofile|bashrc|bash_profile|profile|zshenv|env)$/.test(p) || p.endsWith(".env"))
+    return "shell";
+  if (/(^|\/)\.(npmrc|yarnrc|curlrc|netrc)$/.test(p))
+    return "ini";
+  return storedFormat;
+}
+function storedPlaceholderIsLiteralOnDisk(storedLine, diskLine) {
+  return redactionPlaceholders(storedLine).some((p) => !diskLine.includes(p));
+}
+function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
   if (!existsSync5(path))
     return `(file not found on disk: ${path})`;
   const diskContent = readFileSync3(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
+  const format = redactFormatForTarget(targetPath, storedFormat);
   const stored = expectedContent.split(`
 `);
   const disk = diskContent.split(`
 `);
+  const { content: redactedDiskContent, redacted } = showSecrets ? { content: diskContent, redacted: [] } : redactContent(diskContent, format);
+  const redactedDisk = redactedDiskContent.split(`
+`);
+  const reasonByLine = new Map;
+  for (const r of redacted)
+    if (!reasonByLine.has(r.line))
+      reasonByLine.set(r.line, r.reason);
   const lines = [`--- stored (DB)`, `+++ disk (${path})`];
   const maxLen = Math.max(stored.length, disk.length);
   for (let i = 0;i < maxLen; i++) {
+    const lineNo = i + 1;
     const s = stored[i];
     const dk = disk[i];
     if (s === dk) {
       if (s !== undefined)
         lines.push(` ${s}`);
-    } else {
+      continue;
+    }
+    if (showSecrets || dk === undefined) {
       if (s !== undefined)
         lines.push(`-${s}`);
       if (dk !== undefined)
         lines.push(`+${dk}`);
+      continue;
+    }
+    const structural = s !== undefined && storedPlaceholderIsLiteralOnDisk(s, dk);
+    const patterned = reasonByLine.has(lineNo);
+    if (!structural && !patterned) {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      lines.push(`+${dk}`);
+      continue;
+    }
+    if (structural) {
+      const placeholder = redactionPlaceholders(s).find((p) => !dk.includes(p)) ?? "a placeholder";
+      lines.push(`~line ${lineNo} differs: stored \`${s}\`, disk holds a literal value for ${placeholder} \u2014 redacted (use --show-secrets on a TTY to reveal)`);
+      continue;
+    }
+    const safe = redactedDisk[i] ?? "";
+    const reason = reasonByLine.get(lineNo);
+    if (s !== undefined && safe === s) {
+      lines.push(`~line ${lineNo} differs: stored \`${s}\`, disk holds a literal value (${reason}) \u2014 redacted (use --show-secrets on a TTY to reveal)`);
+    } else {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      lines.push(`+${safe}`);
+      lines.push(`~line ${lineNo}: disk value redacted (${reason}) \u2014 use --show-secrets on a TTY to reveal`);
     }
   }
   return lines.join(`
@@ -6553,15 +6613,16 @@ async function diffConfig(config, opts = {}) {
   if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
     return "(generated output \u2014 managed by fan-out)";
   }
+  const showSecrets = opts.showSecrets ?? false;
   if (config.target_path) {
-    const diff = buildDiff(config.content, config.target_path);
+    const diff = buildDiff(config.content, config.target_path, config.format, showSecrets);
     if (!diff.includes("no diff"))
       diffs.push(diff);
   }
   if (config.outputs.length > 0) {
     for (const output of config.outputs) {
       const expected = applyTransform(config, output, { configs: contextConfigs });
-      const diff = buildDiff(expected, output.target_path);
+      const diff = buildDiff(expected, output.target_path, detectFormat(output.target_path), showSecrets);
       if (!diff.includes("no diff"))
         diffs.push(diff);
     }
@@ -6632,7 +6693,7 @@ function detectFormat(filePath) {
     return "ini";
   return "text";
 }
-var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES;
+var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES, CERTAIN_PLACEHOLDER_RE, ASSIGNED_PLACEHOLDER_RE;
 var init_sync = __esm(() => {
   init_config_store();
   init_apply();
@@ -6696,6 +6757,8 @@ var init_sync = __esm(() => {
     { file: ".agents/mcp_config.json", category: "mcp", agent: "antigravity", format: "json" },
     { file: ".qwen/settings.json", category: "agent", agent: "qwen", format: "json" }
   ];
+  CERTAIN_PLACEHOLDER_RE = /\{\{[A-Za-z_][A-Za-z0-9_]*\}\}/g;
+  ASSIGNED_PLACEHOLDER_RE = /[=:]\s*(["']?)(\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Z][A-Z0-9_]*)|%([A-Za-z_][A-Za-z0-9_]*)%)\1\s*,?\s*$/;
 });
 
 // src/lib/sync-dir.ts
@@ -6792,7 +6855,7 @@ var init_sync_dir = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/instructions",
-    version: "0.4.11",
+    version: "0.4.12",
     description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
     type: "module",
     main: "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/instructions",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "description": "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
   "type": "module",
   "main": "dist/index.js",