@herbertgao/pi-extensions 2026.8.11 → 2026.8.13

package/node_modules/@luxusai/pi-hindsight/extensions/utils/diagnostics.ts

@@ -0,0 +1,319 @@
+import type { ResolvedConfig } from "../types.js";
+import {
+  PI_HINDSIGHT_CLIENT_PACKAGE,
+  PI_HINDSIGHT_CLIENT_RANGE,
+  PI_HINDSIGHT_SUPPORTED_NODE,
+  PI_HINDSIGHT_SUPPORTED_NPM,
+  PI_HINDSIGHT_SUPPORTED_TYPEBOX,
+  PI_HINDSIGHT_USER_AGENT,
+  PI_HINDSIGHT_VERSION,
+} from "../version.js";
+import {
+  baseTags,
+  findRepoRoot,
+  formatProjectIdentityForStatus,
+  resolveProjectIdentity,
+} from "../banks/banking.js";
+import { stableSessionId } from "./session.js";
+import { createMemoryIdentity } from "../operations/memory-identity.js";
+import { expandObservationScopes } from "../lifecycle/observation-scopes.js";
+import type { ImportManifestEntry } from "../imports/import-plan.js";
+import {
+  formatHindsightActivity,
+  formatHindsightStatus,
+  type HindsightActivity,
+} from "./status.js";
+import { buildStatusFields } from "./status-fields.js";
+import type { ScopeMigratePlan } from "../operations/scope-migrate.js";
+
+export interface DebugReportArgs {
+  cwd: string;
+  sessionFile?: string;
+  projectBankId: string;
+  config: ResolvedConfig;
+  queueLength: number;
+  queuePath?: string;
+  queueMalformedLines?: number;
+  queueReadError?: string | null;
+  deadLetterPath?: string;
+  deadLetterLength?: number;
+  deadLetterMalformedLines?: number;
+  deadLetterReadError?: string | null;
+  importManifestPath?: string;
+  importManifestError?: string | null;
+  importManifestAction?: string | null;
+  importCount?: number;
+  latestImport?: ImportManifestEntry;
+  health?: { ok: boolean; error?: string };
+  activity?: HindsightActivity;
+  memoryCount?: number;
+  queueRemaining?: number;
+  scopeMigrate?: ScopeMigratePlan;
+  /** Memory readiness: queue, git seed receipt, knowledge-page capability. */
+  sync?: unknown;
+}
+
+export function bankSelectionMessage(projectBankId: string, config: ResolvedConfig): string {
+  if (!config.banks.project.enabled) {
+    return config.banks.user.enabled && config.banks.user.bankId
+      ? `Hindsight life/user bank: ${config.banks.user.bankId}`
+      : "Hindsight coding bank disabled and no life/user bank configured.";
+  }
+  const mode = config.scope.mode;
+  if (config.banks.project.bankId) {
+    return mode === "isolated-bank"
+      ? `Hindsight isolated bank: ${projectBankId}`
+      : `Hindsight coding bank (domain-tagged): ${projectBankId}`;
+  }
+  return mode === "isolated-bank"
+    ? `Hindsight isolated bank auto-selected: ${projectBankId}. Set banks.project.bankId to pin.`
+    : `Hindsight coding bank path-derived (set banks.project.bankId for a shared domain bank): ${projectBankId}`;
+}
+
+export function memoryProfile(
+  config: ResolvedConfig,
+): "project-only" | "project+global" | "global-only" | "none" {
+  if (!config.banks.project.enabled) return config.banks.user.enabled ? "global-only" : "none";
+  if (config.banks.user.enabled) return "project+global";
+  return "project-only";
+}
+
+export function safeConfig(config: ResolvedConfig): ResolvedConfig {
+  return {
+    ...config,
+    hindsight: {
+      ...config.hindsight,
+      ...(config.hindsight.apiKey ? { apiKey: "[set]" } : {}),
+      ...(config.hindsight.apiKeyRef ? { apiKeyRef: config.hindsight.apiKeyRef } : {}),
+    },
+  };
+}
+
+export function observationScopeDiagnostics(args: {
+  cwd: string;
+  sessionFile?: string;
+  projectBankId: string;
+  config: ResolvedConfig;
+}): { enabled: boolean; scopes: string[][] | null; error: string | null; action: string | null } {
+  const identity = {
+    ...createMemoryIdentity(args.cwd, args.config, args.sessionFile),
+    projectBankId: args.projectBankId,
+  };
+  try {
+    return {
+      enabled: args.config.observations.enabled,
+      scopes: args.config.observations.enabled
+        ? expandObservationScopes(args.config.observations.scopes, identity)
+        : [],
+      error: null,
+      action: null,
+    };
+  } catch (error) {
+    return {
+      enabled: args.config.observations.enabled,
+      scopes: null,
+      error: error instanceof Error ? error.message : String(error),
+      action: "Fix observations.scopes placeholders or disable observations.enabled.",
+    };
+  }
+}
+
+export function formatDebugReport(args: DebugReportArgs): string {
+  const sessionId = stableSessionId(args.sessionFile, args.cwd);
+  const projectIdentity = resolveProjectIdentity(args.cwd, args.config);
+  const tags = baseTags(args.cwd, sessionId, args.config);
+  const observationScopes = observationScopeDiagnostics(args);
+  const health = args.health
+    ? args.health.ok
+      ? "reachable"
+      : `unreachable: ${args.health.error}`
+    : "not checked";
+  const activity = args.activity ?? "idle";
+  return JSON.stringify(
+    {
+      enabled: args.config.enabled,
+      integration: {
+        packageVersion: PI_HINDSIGHT_VERSION,
+        userAgent: PI_HINDSIGHT_USER_AGENT,
+        hindsightBaseUrl: args.config.hindsight.baseUrl,
+        clientPackage: PI_HINDSIGHT_CLIENT_PACKAGE,
+        clientRange: PI_HINDSIGHT_CLIENT_RANGE,
+        compatibility: {
+          node: PI_HINDSIGHT_SUPPORTED_NODE,
+          npm: PI_HINDSIGHT_SUPPORTED_NPM,
+          typebox: PI_HINDSIGHT_SUPPORTED_TYPEBOX,
+          hindsightServer:
+            "Hindsight 0.8+ with append update_mode support; advanced tools are capability-gated.",
+          policy: "Pi-first 1.0 integration; global platform admin parity is out of scope.",
+        },
+      },
+      health,
+      ...(args.sync !== undefined ? { sync: args.sync } : {}),
+      cwd: args.cwd,
+      repoRoot: findRepoRoot(args.cwd),
+      sessionFile: args.sessionFile ?? null,
+      sessionId,
+      statusFields: buildStatusFields(args.config, {
+        cwd: args.cwd,
+        projectBankId: args.projectBankId,
+        queueLength: args.queueLength,
+        ...(args.deadLetterLength !== undefined ? { deadLetterLength: args.deadLetterLength } : {}),
+        ...(args.health
+          ? {
+              healthOk: args.health.ok,
+              ...(args.health.error ? { healthError: args.health.error } : {}),
+            }
+          : {}),
+      }),
+      projectScope: {
+        projectId: projectIdentity.projectId,
+        basis: projectIdentity.basis,
+        source: projectIdentity.source,
+        tag: `project:${projectIdentity.projectId}`,
+        legacyRepoTag: `repo:${projectIdentity.legacyRepoKey}`,
+        summary: formatProjectIdentityForStatus(projectIdentity),
+        dualTagWindow:
+          "Retain and recall dual-tag project:<id> and legacy repo:<path-hash> so path moves and older banks stay recoverable.",
+      },
+      scopeMigrate: args.scopeMigrate ?? null,
+      memoryProfile: memoryProfile(args.config),
+      projectBankId: args.projectBankId,
+      projectBankSelection: args.config.banks.project.bankId
+        ? "configured"
+        : args.config.banks.project.derive,
+      bankMissions: {
+        projectConfigured: Boolean(
+          args.config.banks.project.retainMission ||
+          args.config.banks.project.reflectMission ||
+          args.config.banks.project.observationsMission,
+        ),
+        globalConfigured: Boolean(
+          args.config.banks.user.retainMission ||
+          args.config.banks.user.reflectMission ||
+          args.config.banks.user.observationsMission,
+        ),
+      },
+      observations: observationScopes,
+      overrideProjectBankId:
+        "Set PI_HINDSIGHT_PROJECT_BANK_ID or .pi/hindsight.json banks.project.bankId",
+      globalBankId: args.config.banks.user.enabled ? (args.config.banks.user.bankId ?? null) : null,
+      memoryRoutes: {
+        recall: [
+          ...(args.config.banks.project.enabled ? ["project"] : []),
+          ...(args.config.banks.user.enabled && args.config.banks.user.bankId ? ["global"] : []),
+        ],
+        autoRetain: args.config.banks.project.enabled ? "project" : null,
+      },
+      tags,
+      queuePath: args.config.retain.queuePath,
+      queueLength: args.queueLength,
+      queue: {
+        path: args.queuePath ?? args.config.retain.queuePath,
+        active: args.queueLength,
+        malformedLines: args.queueMalformedLines ?? 0,
+        error: args.queueReadError ?? null,
+        deadLetterPath: args.deadLetterPath ?? null,
+        deadLetter: args.deadLetterLength ?? 0,
+        deadLetterMalformedLines: args.deadLetterMalformedLines ?? 0,
+        deadLetterError: args.deadLetterReadError ?? null,
+        action:
+          args.queueReadError ||
+          args.deadLetterReadError ||
+          (args.queueMalformedLines ?? 0) > 0 ||
+          (args.deadLetterMalformedLines ?? 0) > 0 ||
+          (args.deadLetterLength ?? 0) > 0
+            ? "Inspect queue files, fix malformed JSONL offline if needed, then open /hindsight and press f to flush after Hindsight is reachable."
+            : null,
+      },
+      serverRequirements: {
+        appendUpdateMode: "required (Hindsight 0.8+)",
+        clientPackage: PI_HINDSIGHT_CLIENT_PACKAGE,
+        clientRange: PI_HINDSIGHT_CLIENT_RANGE,
+        action: "Upgrade to Hindsight 0.8+ if live append retain fails.",
+      },
+      imports: {
+        manifestPath: args.importManifestPath ?? args.config.import.manifestPath,
+        error: args.importManifestError ?? null,
+        action: args.importManifestError
+          ? (args.importManifestAction ??
+            "Move or repair the import manifest, then open /hindsight and press i to re-run import.")
+          : null,
+        count: args.importCount ?? 0,
+        latest: args.latestImport
+          ? {
+              documentId: args.latestImport.documentId,
+              sourceFile: args.latestImport.sourceFile,
+              importedAt: args.latestImport.importedAt,
+              messageCount: args.latestImport.messageCount,
+              leafId: args.latestImport.leafId,
+              sessionId: args.latestImport.sessionId,
+              contentHash: args.latestImport.contentHash,
+              ...(args.latestImport.importMode ? { importMode: args.latestImport.importMode } : {}),
+              ...(args.latestImport.toolResults
+                ? { toolResults: args.latestImport.toolResults }
+                : {}),
+              ...(args.latestImport.importQualityProfile
+                ? { importQualityProfile: args.latestImport.importQualityProfile }
+                : {}),
+              ...(args.latestImport.projectionVersion
+                ? { projectionVersion: args.latestImport.projectionVersion }
+                : {}),
+              ...(args.latestImport.importProfile
+                ? { importProfile: args.latestImport.importProfile }
+                : {}),
+              ...(args.latestImport.chunkIndex !== undefined
+                ? { chunkIndex: args.latestImport.chunkIndex }
+                : {}),
+              ...(args.latestImport.messageRange
+                ? { messageRange: args.latestImport.messageRange }
+                : {}),
+              ...(args.latestImport.updateMode ? { updateMode: args.latestImport.updateMode } : {}),
+            }
+          : null,
+      },
+      status: args.config.status,
+      statusPreview:
+        formatHindsightStatus(args.config, {
+          cwd: args.cwd,
+          projectBankId: args.projectBankId,
+          activity,
+          ...(args.memoryCount !== undefined ? { memoryCount: args.memoryCount } : {}),
+          ...(args.queueRemaining !== undefined ? { queueRemaining: args.queueRemaining } : {}),
+        }) ?? null,
+      activity: formatHindsightActivity(activity, args.memoryCount, args.queueRemaining),
+      recall: {
+        enabled: args.config.recall.enabled,
+        budget: args.config.recall.budget,
+        maxTokens: args.config.recall.maxTokens,
+        types: args.config.recall.types,
+        contextTurns: args.config.recall.contextTurns,
+        roles: args.config.recall.roles,
+        maxQueryChars: args.config.recall.maxQueryChars,
+        queryPreamble: args.config.recall.queryPreamble,
+        projectQueryPreamble: args.config.recall.projectQueryPreamble,
+        globalQueryPreamble: args.config.recall.globalQueryPreamble,
+        includeDateInQuery: args.config.recall.includeDateInQuery,
+        includeRepoHintsInQuery: args.config.recall.includeRepoHintsInQuery,
+        storeLastRecall: args.config.recall.storeLastRecall,
+        storeLastRecallFailures: args.config.recall.storeLastRecallFailures,
+        lastRecallPath: args.config.recall.lastRecallPath,
+        topK: args.config.recall.topK,
+        timeoutMs: args.config.recall.timeoutMs,
+        injectionPosition: args.config.recall.injectionPosition,
+        minScores: args.config.recall.minScores,
+      },
+      retain: {
+        enabled: args.config.retain.enabled,
+        async: args.config.retain.async,
+        updateMode: args.config.retain.updateMode,
+        redactSecrets: args.config.retain.redactSecrets,
+        content: args.config.retain.content,
+        toolFilter: args.config.retain.toolFilter,
+        strip: args.config.retain.strip,
+      },
+      config: safeConfig(args.config),
+    },
+    null,
+    2,
+  );
+}

package/node_modules/@luxusai/pi-hindsight/extensions/utils/messages.ts

@@ -0,0 +1,325 @@
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+import type { ResolvedConfig } from "../types.js";
+
+function stringValue(value: unknown, fallback = ""): string {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return fallback;
+}
+
+function toolName(message: Record<string, unknown>, part?: Record<string, unknown>): string {
+  return stringValue(part?.name ?? message.toolName ?? message.name, "unknown");
+}
+
+function toolAllowed(name: string, filter: { include?: string[]; exclude?: string[] }): boolean {
+  if (filter.include && !filter.include.includes(name)) return false;
+  return !filter.exclude?.includes(name);
+}
+
+/** Keys tried, in order, for a compact tool-action target (coding-agents write-back discipline). */
+const TOOL_TARGET_KEYS = [
+  "file_path",
+  "path",
+  "notebook_path",
+  "command",
+  "pattern",
+  "query",
+  "url",
+  "name",
+  "id",
+] as const;
+
+const ACTION_TARGET_CAP = 100;
+
+/**
+ * Compact tool input to a primary target string (file path, command, pattern, …).
+ * Full args/outputs bury decisions in mechanical noise; retain only WHAT was touched.
+ */
+export function toolActionTarget(input: unknown): string {
+  let target = "";
+  if (input && typeof input === "object") {
+    const rec = input as Record<string, unknown>;
+    for (const key of TOOL_TARGET_KEYS) {
+      const value = rec[key];
+      if (typeof value === "string" && value.trim()) {
+        target = value.trim().split("\n")[0] ?? "";
+        break;
+      }
+    }
+  } else if (typeof input === "string") {
+    target = input.trim().split("\n")[0] ?? "";
+  }
+  if (target.length > ACTION_TARGET_CAP) target = `${target.slice(0, ACTION_TARGET_CAP)}…`;
+  return target;
+}
+
+function compactToolCallPart(name: string, args: unknown): Record<string, unknown> {
+  const target = toolActionTarget(args);
+  return {
+    type: "toolCall",
+    name,
+    // Compact form: name + primary target only (no full argument object / no outputs).
+    arguments: target ? { target } : {},
+  };
+}
+
+function textFromContent(
+  content: unknown,
+  options: {
+    includeText: boolean;
+    includeThinking: boolean;
+    includeToolCall: boolean;
+    includeUnknownJson?: boolean;
+    toolCallFilter?: { include?: string[]; exclude?: string[] };
+    /** When true (default), tool calls become name+target only. */
+    compactToolCalls?: boolean;
+  },
+): string {
+  if (typeof content === "string") return options.includeText ? content : "";
+  if (!Array.isArray(content)) return options.includeText ? JSON.stringify(content ?? "") : "";
+  return content
+    .map((part) => {
+      if (part && typeof part === "object" && "type" in part) {
+        const p = part as Record<string, unknown>;
+        if (p.type === "text") return options.includeText ? stringValue(p.text) : "";
+        if (p.type === "thinking")
+          return options.includeThinking ? stringValue(p.thinking ?? p.text) : "";
+        if (p.type === "toolCall") {
+          if (!options.includeToolCall) return "";
+          const name = stringValue(p.name, "unknown");
+          if (options.toolCallFilter && !toolAllowed(name, options.toolCallFilter)) return "";
+          if (options.compactToolCalls !== false) {
+            const target = toolActionTarget(p.arguments);
+            return target ? `[action ${name} ${target}]` : `[action ${name}]`;
+          }
+          return `[toolCall ${name}] ${JSON.stringify(p.arguments ?? {})}`;
+        }
+        if (p.type === "image") return options.includeText ? "[image omitted]" : "";
+      }
+      return options.includeText && options.includeUnknownJson !== false
+        ? JSON.stringify(part)
+        : "";
+    })
+    .filter(Boolean)
+    .join("\n");
+}
+
+function projectContent(
+  content: unknown,
+  options: {
+    includeText: boolean;
+    includeThinking: boolean;
+    includeToolCall: boolean;
+    toolCallFilter?: { include?: string[]; exclude?: string[] };
+    compactToolCalls?: boolean;
+  },
+): unknown {
+  if (typeof content === "string") return options.includeText ? content : "";
+  if (!Array.isArray(content)) return options.includeText ? (content ?? "") : "";
+  const projected = content
+    .map((part) => {
+      if (part && typeof part === "object" && "type" in part) {
+        const p = part as Record<string, unknown>;
+        if (p.type === "text") return options.includeText ? part : undefined;
+        if (p.type === "thinking") return options.includeThinking ? part : undefined;
+        if (p.type === "toolCall") {
+          if (!options.includeToolCall) return undefined;
+          const name = stringValue(p.name, "unknown");
+          if (options.toolCallFilter && !toolAllowed(name, options.toolCallFilter))
+            return undefined;
+          if (options.compactToolCalls !== false) {
+            return compactToolCallPart(name, p.arguments);
+          }
+          return part;
+        }
+        if (p.type === "image") return options.includeText ? part : undefined;
+      }
+      return options.includeText ? part : undefined;
+    })
+    .filter((part): part is unknown => part !== undefined);
+  return projected.length ? projected : "";
+}
+
+function stripFields(record: Record<string, unknown>, fields: string[]): Record<string, unknown> {
+  const out = { ...record };
+  fields.forEach((field) => delete out[field]);
+  return out;
+}
+
+function messageTimestamp(message: Record<string, unknown>): string {
+  return new Date(
+    typeof message.timestamp === "number" ? message.timestamp : Date.now(),
+  ).toISOString();
+}
+
+export function projectMessage(
+  message: AgentMessage,
+  config?: ResolvedConfig,
+): Record<string, unknown> {
+  const m = message as unknown as Record<string, unknown>;
+  const role = stringValue(m.role, "unknown");
+  const retain = config?.retain;
+  const isAssistant = role === "assistant";
+  const includeAssistantText = retain?.content.assistant.includes("text") ?? true;
+  const includeThinking = retain?.content.assistant.includes("thinking") ?? false;
+  const includeToolCall = retain?.content.assistant.includes("toolCall") ?? true;
+  const compactToolCalls = retain?.compactToolCalls !== false;
+  const base: Record<string, unknown> = {
+    role,
+    timestamp: messageTimestamp(m),
+    content: projectContent(m.content, {
+      includeText: !isAssistant || includeAssistantText,
+      includeThinking: isAssistant && includeThinking,
+      includeToolCall: isAssistant && includeToolCall,
+      compactToolCalls,
+      ...(retain ? { toolCallFilter: retain.toolFilter.toolCall } : {}),
+    }),
+  };
+  if (role === "toolResult") {
+    base.toolName = m.toolName;
+    base.isError = m.isError;
+  }
+  if (role === "assistant") {
+    base.model = m.model;
+    base.stopReason = m.stopReason;
+  }
+  return stripFields(base, retain?.strip.message ?? []);
+}
+
+export function projectMessageText(
+  message: AgentMessage,
+  config?: ResolvedConfig,
+): Record<string, unknown> {
+  const m = message as unknown as Record<string, unknown>;
+  const role = stringValue(m.role, "unknown");
+  const retain = config?.retain;
+  const isAssistant = role === "assistant";
+  const includeAssistantText = retain?.content.assistant.includes("text") ?? true;
+  const includeThinking = retain?.content.assistant.includes("thinking") ?? false;
+  const includeToolCall = retain?.content.assistant.includes("toolCall") ?? true;
+  const compactToolCalls = retain?.compactToolCalls !== false;
+  const base: Record<string, unknown> = {
+    role,
+    timestamp: messageTimestamp(m),
+    content: textFromContent(m.content, {
+      includeText: !isAssistant || includeAssistantText,
+      includeThinking: isAssistant && includeThinking,
+      includeToolCall: isAssistant && includeToolCall,
+      includeUnknownJson: false,
+      compactToolCalls,
+      ...(retain ? { toolCallFilter: retain.toolFilter.toolCall } : {}),
+    }),
+  };
+  if (role === "toolResult") {
+    base.toolName = m.toolName;
+    base.isError = m.isError;
+  }
+  if (role === "assistant") {
+    base.model = m.model;
+    base.stopReason = m.stopReason;
+  }
+  return stripFields(base, retain?.strip.message ?? []);
+}
+
+export function isInjectedHindsightMemory(message: unknown): boolean {
+  const record = message as { content?: unknown; customType?: unknown; type?: unknown };
+  if (
+    record.customType === "hindsight-recall" ||
+    record.type === "hindsight-recall" ||
+    record.customType === "hindsight-mental-models" ||
+    record.type === "hindsight-mental-models"
+  ) {
+    return true;
+  }
+  const text = textFromContent(record.content, {
+    includeText: true,
+    includeThinking: false,
+    includeToolCall: true,
+  }).trim();
+  // Only prefix matches: substring contains would drop legitimate discussion of these tags.
+  return (
+    text.startsWith("<hindsight-memory>") ||
+    text.startsWith("<hindsight_memories>") ||
+    text.startsWith("<hindsight-mental-models>") ||
+    text.startsWith("<mental_models>")
+  );
+}
+
+function toolResultContent(
+  message: Record<string, unknown>,
+  mode: "error" | "summary" | "content",
+): string {
+  const text = textFromContent(message.content, {
+    includeText: true,
+    includeThinking: false,
+    includeToolCall: false,
+  });
+  if (mode === "summary") return text.length > 500 ? `${text.slice(0, 500)}…` : text;
+  return text;
+}
+
+function projectToolResult(
+  message: AgentMessage,
+  config: ResolvedConfig,
+): Record<string, unknown> | undefined {
+  const m = message as unknown as Record<string, unknown>;
+  const name = toolName(m);
+  if (!toolAllowed(name, config.retain.toolFilter.toolResult)) return undefined;
+  const modes = config.retain.content.toolResult;
+  if (m.isError) {
+    if (!modes.includes("error")) return undefined;
+    return stripFields(
+      {
+        role: "toolResult",
+        timestamp: messageTimestamp(m),
+        toolName: name,
+        isError: true,
+        content: toolResultContent(m, "error"),
+      },
+      config.retain.strip.message,
+    );
+  }
+  if (modes.includes("content")) return projectMessage(message, config);
+  if (modes.includes("summary")) {
+    return stripFields(
+      {
+        role: "toolResult",
+        timestamp: messageTimestamp(m),
+        toolName: name,
+        isError: false,
+        content: toolResultContent(m, "summary"),
+      },
+      config.retain.strip.message,
+    );
+  }
+  return undefined;
+}
+
+function hasAssistantContentToRetain(message: AgentMessage, config: ResolvedConfig): boolean {
+  return Boolean(projectMessage(message, config).content);
+}
+
+export function projectMessages(
+  messages: AgentMessage[],
+  config: ResolvedConfig,
+): Record<string, unknown>[] {
+  return messages
+    .filter((message) => !isInjectedHindsightMemory(message))
+    .map((message) => {
+      const role = (message as unknown as { role?: string }).role;
+      if (role === "user")
+        return config.retain.content.user.includes("text")
+          ? projectMessage(message, config)
+          : undefined;
+      if (role === "assistant") {
+        if (!hasAssistantContentToRetain(message, config)) return undefined;
+        return projectMessage(message, config);
+      }
+      if (role === "toolResult") return projectToolResult(message, config);
+      return projectMessage(message, config);
+    })
+    .filter((message): message is Record<string, unknown> => Boolean(message))
+    .map((message) => stripFields(message, config.retain.strip.topLevel));
+}

package/node_modules/@luxusai/pi-hindsight/extensions/utils/sanitize.ts

@@ -0,0 +1,42 @@
+const SECRET_PATTERNS: Array<[RegExp, string]> = [
+  [/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{12,}/gi, "$1[REDACTED]"],
+  [/\b(sk-[A-Za-z0-9_-]{12,})\b/g, "[REDACTED_API_KEY]"],
+  [/\b(ghp_[A-Za-z0-9_]{12,})\b/g, "[REDACTED_GITHUB_TOKEN]"],
+  [
+    /\b([A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*\s*=\s*)[^\s\n"',}]+/gi,
+    "$1[REDACTED]",
+  ],
+  [
+    /\b((?:api[_-]?key|token|secret|password|authorization)\s*:\s*)["']?[^\s\n"',}]+["']?/gi,
+    "$1[REDACTED]",
+  ],
+  [
+    /(["'](?:api[_-]?key|token|secret|password|authorization)["']\s*:\s*)["'][^"']+["']/gi,
+    '$1"[REDACTED]"',
+  ],
+  [/\b((?:Cookie|Set-Cookie)\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
+  [/(https?:\/\/)([^\s/@]+):([^\s/@]+)@/gi, "$1[REDACTED]@"],
+];
+
+const SENSITIVE_QUERY_PARAM = /(?:token|key|secret|password|api[_-]?key|apikey)/i;
+
+function redactUrlQuerySecrets(input: string): string {
+  return input.replace(/https?:\/\/[^\s"'<>]+/gi, (url) =>
+    url.replace(/([?&])([^=&#\s]+)=([^&#\s]+)/g, (match, separator, key) => {
+      if (!SENSITIVE_QUERY_PARAM.test(String(key))) return String(match);
+      return `${String(separator)}${String(key)}=[REDACTED]`;
+    }),
+  );
+}
+
+export function redactSecrets(input: string): string {
+  const text = SECRET_PATTERNS.reduce(
+    (current, [pattern, replacement]) => current.replace(pattern, replacement),
+    input,
+  );
+  return redactUrlQuerySecrets(text);
+}
+
+export function redactError(error: unknown): string {
+  return redactSecrets(error instanceof Error ? error.message : String(error));
+}