@hiai-gg/hiai-opencode 0.1.6 → 0.1.8

package/src/features/opencode-skill-loader/types.ts

@@ -1,38 +0,0 @@
-import type { CommandDefinition } from "../claude-code-command-loader/types"
-import type { SkillMcpConfig } from "../skill-mcp-manager/types"
-
-export type SkillScope = "builtin" | "config" | "user" | "project" | "opencode" | "opencode-project"
-
-export interface SkillMetadata {
-  name?: string
-  description?: string
-  model?: string
-  "argument-hint"?: string
-  agent?: string
-  subtask?: boolean
-  license?: string
-  compatibility?: string
-  metadata?: Record<string, string>
-  "allowed-tools"?: string | string[]
-  mcp?: SkillMcpConfig
-}
-
-export interface LazyContentLoader {
-  loaded: boolean
-  content?: string
-  load: () => Promise<string>
-}
-
-export interface LoadedSkill {
-  name: string
-  path?: string
-  resolvedPath?: string
-  definition: CommandDefinition
-  scope: SkillScope
-  license?: string
-  compatibility?: string
-  metadata?: Record<string, string>
-  allowedTools?: string[]
-  mcpConfig?: SkillMcpConfig
-  lazyContent?: LazyContentLoader
-}

package/src/features/run-continuation-state/constants.ts

@@ -1 +0,0 @@
-export const CONTINUATION_MARKER_DIR = ".bob/run-continuation"

package/src/features/run-continuation-state/index.ts

@@ -1,3 +0,0 @@
-export * from "./types"
-export * from "./constants"
-export * from "./storage"

package/src/features/run-continuation-state/storage.ts

@@ -1,80 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
-import { join } from "node:path"
-import { CONTINUATION_MARKER_DIR } from "./constants"
-import type {
-  ContinuationMarker,
-  ContinuationMarkerSource,
-  ContinuationMarkerState,
-} from "./types"
-
-function getMarkerPath(directory: string, sessionID: string): string {
-  return join(directory, CONTINUATION_MARKER_DIR, `${sessionID}.json`)
-}
-
-export function readContinuationMarker(
-  directory: string,
-  sessionID: string,
-): ContinuationMarker | null {
-  const markerPath = getMarkerPath(directory, sessionID)
-  if (!existsSync(markerPath)) return null
-
-  try {
-    const raw = readFileSync(markerPath, "utf-8")
-    const parsed = JSON.parse(raw)
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null
-    return parsed as ContinuationMarker
-  } catch {
-    return null
-  }
-}
-
-export function setContinuationMarkerSource(
-  directory: string,
-  sessionID: string,
-  source: ContinuationMarkerSource,
-  state: ContinuationMarkerState,
-  reason?: string,
-): ContinuationMarker {
-  const now = new Date().toISOString()
-  const existing = readContinuationMarker(directory, sessionID)
-  const next: ContinuationMarker = {
-    sessionID,
-    updatedAt: now,
-    sources: {
-      ...(existing?.sources ?? {}),
-      [source]: {
-        state,
-        ...(reason ? { reason } : {}),
-        updatedAt: now,
-      },
-    },
-  }
-
-  const markerPath = getMarkerPath(directory, sessionID)
-  mkdirSync(join(directory, CONTINUATION_MARKER_DIR), { recursive: true })
-  writeFileSync(markerPath, JSON.stringify(next, null, 2), "utf-8")
-  return next
-}
-
-export function clearContinuationMarker(directory: string, sessionID: string): void {
-  const markerPath = getMarkerPath(directory, sessionID)
-  if (!existsSync(markerPath)) return
-
-  try {
-    rmSync(markerPath)
-  } catch {
-  }
-}
-
-export function isContinuationMarkerActive(marker: ContinuationMarker | null): boolean {
-  if (!marker) return false
-  return Object.values(marker.sources).some((entry) => entry?.state === "active")
-}
-
-export function getActiveContinuationMarkerReason(marker: ContinuationMarker | null): string | null {
-  if (!marker) return null
-  const active = Object.entries(marker.sources).find(([, entry]) => entry?.state === "active")
-  if (!active || !active[1]) return null
-  const [source, entry] = active
-  return entry.reason ?? `${source} continuation is active`
-}

package/src/features/run-continuation-state/types.ts

@@ -1,15 +0,0 @@
-export type ContinuationMarkerSource = "todo" | "stop"
-
-export type ContinuationMarkerState = "idle" | "active" | "stopped"
-
-export interface ContinuationMarkerSourceEntry {
-  state: ContinuationMarkerState
-  reason?: string
-  updatedAt: string
-}
-
-export interface ContinuationMarker {
-  sessionID: string
-  updatedAt: string
-  sources: Partial<Record<ContinuationMarkerSource, ContinuationMarkerSourceEntry>>
-}

package/src/features/skill-mcp-manager/AGENTS.md

@@ -1,111 +0,0 @@
-# src/features/skill-mcp-manager/ — Skill-Embedded MCP Client Lifecycle
-
-**Generated:** 2026-04-11
-
-## OVERVIEW
-
-18 files. Manages **tier 3** of the MCP system: skill-embedded MCP servers declared in SKILL.md YAML frontmatter. Per-session client isolation, dual transport (stdio + HTTP), OAuth 2.0 with step-up authentication, idle cleanup.
-
-## THREE-TIER MCP CONTEXT
-
-| Tier | Manager | Scope |
-|------|---------|-------|
-| 1. Built-in | `createBuiltinMcps()` (src/mcp/) | Global, 3 remote HTTP |
-| 2. Claude Code | `claude-code-mcp-loader` (src/features/) | From `.mcp.json` |
-| 3. **Skill-embedded** | **`SkillMcpManager` (this module)** | **Per-session, from SKILL.md YAML** |
-
-## CLIENT KEY FORMAT
-
-```
-${sessionID}:${skillName}:${serverName}
-```
-
-Enables: per-session isolation, same skill usable in multiple sessions concurrently, multiple servers per skill.
-
-## DUAL TRANSPORT
-
-| Type | File | Backend |
-|------|------|---------|
-| **stdio** | `stdio-client.ts` | `StdioClientTransport` (local process) |
-| **http** | `http-client.ts` | `StreamableHTTPClientTransport` (remote) |
-
-**Detection** (connection-type.ts): explicit `type` field → URL presence → command presence. Legacy `"sse"` mapped to http.
-
-## STATE
-
-```typescript
-interface SkillMcpManagerState {
-  clients: Map<clientKey, ManagedClient>              // Active connections
-  pendingConnections: Map<clientKey, Promise<Client>> // Race prevention
-  disconnectedSessions: Map<sessionID, generation>    // Stale connection detection
-  authProviders: Map<url, OAuthProvider>              // OAuth state per server
-  inFlightConnections: Map<sessionID, count>          // Connection counting
-}
-```
-
-## KEY FILES
-
-| File | Purpose |
-|------|---------|
-| `manager.ts` | `SkillMcpManager` class — main API (getOrCreateClient, disconnectSession, listTools, callTool, etc.) |
-| `types.ts` | `ManagedStdioClient`, `ManagedHttpClient`, `SkillMcpManagerState`, `ConnectionType` |
-| `connection.ts` | Client factory with race prevention, retry, env var expansion |
-| `connection-type.ts` | Detect stdio vs http from config (legacy sse → http) |
-| `stdio-client.ts` | Stdio transport factory |
-| `http-client.ts` | HTTP transport factory |
-| `cleanup.ts` | SIGINT/SIGTERM handlers, idle timer (60s interval, 5min TTL) |
-| `oauth-handler.ts` | OAuth token management, refresh, step-up (403 scope escalation) |
-| `env-cleaner.ts` | Filter npm/pnpm/yarn config + 25+ secret patterns (_KEY, _SECRET, _TOKEN) |
-| `error-redaction.ts` | Redact sensitive data from error messages before logging |
-
-## LIFECYCLE INTEGRATION
-
-**Hook**: `src/plugin/event.ts` on `session.deleted`:
-```typescript
-await managers.skillMcpManager.disconnectSession(sessionInfo.id)
-```
-
-## LIFECYCLE FLOW
-
-```
-1. session.created      → No action (lazy connection)
-2. First MCP tool call  → getOrCreateClient() creates + caches
-3. Ongoing use          → lastUsedAt timestamp updated
-4. Idle >5min           → cleanup timer removes
-5. session.deleted      → disconnectSession() closes session clients
-6. Process exit         → disconnectAll() via SIGINT/SIGTERM handlers
-```
-
-## RACE CONDITION PREVENTION
-
-- **pendingConnections**: Deduplicates concurrent connection attempts for same key
-- **inFlightConnections**: Per-session counter, prevents premature cleanup during connection setup
-- **shutdownGeneration**: Counter-based stale connection detection after disconnect
-
-## PUBLIC API
-
-```typescript
-class SkillMcpManager {
-  constructor(options?: { createOAuthProvider? })
-  getOrCreateClient(info, config): Promise<Client>
-  disconnectSession(sessionID): Promise<void>
-  disconnectAll(): Promise<void>
-  listTools/Resources/Prompts(info, context): Promise<...[]>
-  callTool(info, context, name, args): Promise<unknown>
-  readResource(info, context, uri): Promise<unknown>
-  getPrompt(info, context, name, args): Promise<unknown>
-  getConnectedServers(): string[]
-  isConnected(info): boolean
-}
-```
-
-## RETRY SEMANTICS
-
-- `getOrCreateClientWithRetry()` — 3 attempts with force reconnect on failure
-- `withOperationRetry()` — OAuth-aware wrapper: step-up on 403, token refresh on 401
-
-## SECURITY
-
-- **env-cleaner.ts** — strips npm/pnpm config vars (prevents pnpm project isolation issues) and secret patterns before stdio spawn
-- **error-redaction.ts** — masks tokens/secrets in error messages before logger.log
-- **OAuth isolation** — auth providers keyed by server URL, tokens never cross servers

package/src/features/skill-mcp-manager/cleanup.ts

@@ -1,153 +0,0 @@
-import type { ManagedClient, SkillMcpManagerState } from "./types"
-
-async function closeManagedClient(managed: ManagedClient): Promise<void> {
-  try {
-    await managed.client.close()
-  } catch {
-    // Ignore close errors - process may already be terminated
-  }
-
-  try {
-    await managed.transport.close()
-  } catch {
-    // Transport may already be terminated
-  }
-}
-
-export function registerProcessCleanup(state: SkillMcpManagerState): void {
-  if (state.cleanupRegistered) return
-  state.cleanupRegistered = true
-
-  const cleanup = async (): Promise<void> => {
-    state.shutdownGeneration++
-    for (const managed of state.clients.values()) {
-      await closeManagedClient(managed)
-    }
-    state.clients.clear()
-    state.pendingConnections.clear()
-    state.disconnectedSessions.clear()
-  }
-
-  // Note: Node's 'exit' event is synchronous-only, so we rely on signal handlers for async cleanup.
-  // Signal handlers invoke the async cleanup function and ignore errors so they don't block or throw.
-  // Don't call process.exit() here - let the background-agent manager handle the final process exit.
-  // Use void + catch to trigger async cleanup without awaiting it in the signal handler.
-
-  const register = (signal: NodeJS.Signals) => {
-    const listener = () => void cleanup().catch(() => {})
-    state.cleanupHandlers.push({ signal, listener })
-    process.on(signal, listener)
-  }
-
-  register("SIGINT")
-  register("SIGTERM")
-  if (process.platform === "win32") {
-    register("SIGBREAK")
-  }
-}
-
-export function unregisterProcessCleanup(state: SkillMcpManagerState): void {
-  if (!state.cleanupRegistered) return
-  for (const { signal, listener } of state.cleanupHandlers) {
-    process.off(signal, listener)
-  }
-  state.cleanupHandlers = []
-  state.cleanupRegistered = false
-}
-
-export function startCleanupTimer(state: SkillMcpManagerState): void {
-  if (state.cleanupInterval) return
-
-  state.cleanupInterval = setInterval(() => {
-    void cleanupIdleClients(state).catch(() => {})
-  }, 60_000)
-
-  state.cleanupInterval.unref()
-}
-
-export function stopCleanupTimer(state: SkillMcpManagerState): void {
-  if (!state.cleanupInterval) return
-  clearInterval(state.cleanupInterval)
-  state.cleanupInterval = null
-}
-
-async function cleanupIdleClients(state: SkillMcpManagerState): Promise<void> {
-  const now = Date.now()
-
-  for (const [key, managed] of state.clients) {
-    if (now - managed.lastUsedAt > state.idleTimeoutMs) {
-      state.clients.delete(key)
-      await closeManagedClient(managed)
-    }
-  }
-
-  if (state.clients.size === 0 && state.pendingConnections.size === 0) {
-    stopCleanupTimer(state)
-    unregisterProcessCleanup(state)
-  }
-}
-
-export async function disconnectSession(state: SkillMcpManagerState, sessionID: string): Promise<void> {
-  let hasPendingForSession = false
-  for (const key of state.pendingConnections.keys()) {
-    if (key.startsWith(`${sessionID}:`)) {
-      hasPendingForSession = true
-      break
-    }
-  }
-  if (hasPendingForSession) {
-    state.disconnectedSessions.set(sessionID, (state.disconnectedSessions.get(sessionID) ?? 0) + 1)
-  }
-  const keysToRemove: string[] = []
-
-  for (const [key, managed] of state.clients.entries()) {
-    if (key.startsWith(`${sessionID}:`)) {
-      keysToRemove.push(key)
-      // Delete from map first to prevent re-entrancy during async close
-      state.clients.delete(key)
-      await closeManagedClient(managed)
-    }
-  }
-
-  for (const key of state.pendingConnections.keys()) {
-    if (key.startsWith(`${sessionID}:`)) {
-      keysToRemove.push(key)
-    }
-  }
-
-  for (const key of keysToRemove) {
-    state.pendingConnections.delete(key)
-  }
-
-  if (state.clients.size === 0 && state.pendingConnections.size === 0) {
-    stopCleanupTimer(state)
-    unregisterProcessCleanup(state)
-  }
-}
-
-export async function disconnectAll(state: SkillMcpManagerState): Promise<void> {
-  state.shutdownGeneration++
-  state.disposed = true
-  stopCleanupTimer(state)
-  unregisterProcessCleanup(state)
-
-  const clients = Array.from(state.clients.values())
-  state.clients.clear()
-  state.pendingConnections.clear()
-  state.disconnectedSessions.clear()
-  state.inFlightConnections.clear()
-  state.authProviders.clear()
-
-  for (const managed of clients) {
-    await closeManagedClient(managed)
-  }
-}
-
-export async function forceReconnect(state: SkillMcpManagerState, clientKey: string): Promise<boolean> {
-  const existing = state.clients.get(clientKey)
-  if (!existing) return false
-
-  state.clients.delete(clientKey)
-  await closeManagedClient(existing)
-  return true
-}

package/src/features/skill-mcp-manager/connection-type.ts

@@ -1,26 +0,0 @@
-import type { ClaudeCodeMcpServer } from "../claude-code-mcp-loader/types"
-import type { ConnectionType } from "./types"
-
-/**
- * Determines connection type from MCP server configuration.
- * Priority: explicit type field > url presence > command presence
- */
-export function getConnectionType(config: ClaudeCodeMcpServer): ConnectionType | null {
-  // Explicit type takes priority
-  if (config.type === "http" || config.type === "sse") {
-    return "http"
-  }
-  if (config.type === "stdio") {
-    return "stdio"
-  }
-
-  // Infer from available fields
-  if (config.url) {
-    return "http"
-  }
-  if (config.command) {
-    return "stdio"
-  }
-
-  return null
-}

package/src/features/skill-mcp-manager/connection.ts

@@ -1,146 +0,0 @@
-import type { ClaudeCodeMcpServer } from "../claude-code-mcp-loader/types"
-import { expandEnvVarsInObject } from "../claude-code-mcp-loader/env-expander"
-import { forceReconnect } from "./cleanup"
-import { getConnectionType } from "./connection-type"
-import { createHttpClient } from "./http-client"
-import { createStdioClient } from "./stdio-client"
-import type { McpClient, SkillMcpClientConnectionParams, SkillMcpClientInfo, SkillMcpManagerState } from "./types"
-
-function removeClientIfCurrent(state: SkillMcpManagerState, clientKey: string, client: McpClient): void {
-  const managed = state.clients.get(clientKey)
-  if (managed?.client === client) {
-    state.clients.delete(clientKey)
-  }
-}
-
-const PROJECT_SCOPES = new Set(["project", "opencode-project", "local"])
-
-export async function getOrCreateClient(params: {
-  state: SkillMcpManagerState
-  clientKey: string
-  info: SkillMcpClientInfo
-  config: ClaudeCodeMcpServer
-}): Promise<McpClient> {
-  const { state, clientKey, info, config } = params
-
-  if (state.disposed) {
-    throw new Error(`MCP manager for "${info.sessionID}" has been shut down, cannot create new connections.`)
-  }
-
-  const existing = state.clients.get(clientKey)
-  if (existing) {
-    existing.lastUsedAt = Date.now()
-    return existing.client
-  }
-
-  // Prevent race condition: if a connection is already in progress, wait for it
-  const pending = state.pendingConnections.get(clientKey)
-  if (pending) {
-    return pending
-  }
-
-  const isTrusted = !PROJECT_SCOPES.has(info.scope ?? "")
-  const expandedConfig = expandEnvVarsInObject(config, { trusted: isTrusted })
-  let currentConnectionPromise!: Promise<McpClient>
-  state.inFlightConnections.set(info.sessionID, (state.inFlightConnections.get(info.sessionID) ?? 0) + 1)
-  currentConnectionPromise = (async () => {
-    const disconnectGenAtStart = state.disconnectedSessions.get(info.sessionID) ?? 0
-    const shutdownGenAtStart = state.shutdownGeneration
-
-    const client = await createClient({ state, clientKey, info, config: expandedConfig })
-
-    const isStale = state.pendingConnections.has(clientKey) && state.pendingConnections.get(clientKey) !== currentConnectionPromise
-    if (isStale) {
-      removeClientIfCurrent(state, clientKey, client)
-      try { await client.close() } catch {}
-      throw new Error(`Connection for "${info.sessionID}" was superseded by a newer connection attempt.`)
-    }
-
-    if (state.shutdownGeneration !== shutdownGenAtStart) {
-      removeClientIfCurrent(state, clientKey, client)
-      try { await client.close() } catch {}
-      throw new Error(`Shutdown occurred during MCP connection for "${info.sessionID}"`)
-    }
-
-    const currentDisconnectGen = state.disconnectedSessions.get(info.sessionID) ?? 0
-    if (currentDisconnectGen > disconnectGenAtStart) {
-      await forceReconnect(state, clientKey)
-      throw new Error(`Session "${info.sessionID}" disconnected during MCP connection setup.`)
-    }
-
-    return client
-  })()
-
-  state.pendingConnections.set(clientKey, currentConnectionPromise)
-
-  try {
-    const client = await currentConnectionPromise
-    return client
-  } finally {
-    if (state.pendingConnections.get(clientKey) === currentConnectionPromise) {
-      state.pendingConnections.delete(clientKey)
-    }
-    const remaining = (state.inFlightConnections.get(info.sessionID) ?? 1) - 1
-    if (remaining <= 0) {
-      state.inFlightConnections.delete(info.sessionID)
-      state.disconnectedSessions.delete(info.sessionID)
-    } else {
-      state.inFlightConnections.set(info.sessionID, remaining)
-    }
-  }
-}
-
-export async function getOrCreateClientWithRetryImpl(params: {
-  state: SkillMcpManagerState
-  clientKey: string
-  info: SkillMcpClientInfo
-  config: ClaudeCodeMcpServer
-}): Promise<McpClient> {
-  const { state, clientKey } = params
-
-  try {
-    return await getOrCreateClient(params)
-  } catch (error) {
-    const didReconnect = await forceReconnect(state, clientKey)
-    if (!didReconnect) {
-      throw error
-    }
-    return await getOrCreateClient(params)
-  }
-}
-
-async function createClient(params: {
-  state: SkillMcpManagerState
-  clientKey: string
-  info: SkillMcpClientInfo
-  config: ClaudeCodeMcpServer
-}): Promise<McpClient> {
-  const { info, config } = params
-  const connectionType = getConnectionType(config)
-
-  if (!connectionType) {
-    throw new Error(
-      `MCP server "${info.serverName}" has no valid connection configuration.\n\n` +
-      `The MCP configuration in skill "${info.skillName}" must specify either:\n` +
-      `  - A URL for HTTP connection (remote MCP server)\n` +
-      `  - A command for stdio connection (local MCP process)\n\n` +
-      `Examples:\n` +
-      `  HTTP:\n` +
-      `    mcp:\n` +
-      `      ${info.serverName}:\n` +
-      `        url: https://mcp.example.com/mcp\n` +
-      `        headers:\n` +
-      "          Authorization: Bearer ${API_KEY}\n\n" +
-      `  Stdio:\n` +
-      `    mcp:\n` +
-      `      ${info.serverName}:\n` +
-      `        command: npx\n` +
-      `        args: [-y, @some/mcp-server]`
-    )
-  }
-
-  if (connectionType === "http") {
-    return await createHttpClient(params satisfies SkillMcpClientConnectionParams)
-  }
-  return await createStdioClient(params satisfies SkillMcpClientConnectionParams)
-}

package/src/features/skill-mcp-manager/env-cleaner.ts

@@ -1,59 +0,0 @@
-// Filters npm/pnpm/yarn config env vars that break MCP servers in pnpm projects (#456)
-// Also filters secret-containing env vars to prevent exposure to malicious stdio MCP servers (#B-02)
-export const EXCLUDED_ENV_PATTERNS: RegExp[] = [
-  // npm/pnpm/yarn config patterns (original)
-  /^NPM_CONFIG_/i,
-  /^npm_config_/,
-  /^YARN_/,
-  /^PNPM_/,
-  /^NO_UPDATE_NOTIFIER$/,
-
-  // Specific high-risk secret env vars (explicit blocks)
-  /^ANTHROPIC_API_KEY$/i,
-  /^AWS_ACCESS_KEY_ID$/i,
-  /^AWS_SECRET_ACCESS_KEY$/i,
-  /^GOOGLE_APPLICATION_CREDENTIALS$/i,
-  /^GOOGLE_CLOUD_PROJECT$/i,
-  /^GITHUB_TOKEN$/i,
-  /^DATABASE_URL$/i,
-  /^OPENAI_API_KEY$/i,
-  /^AZURE_/i,
-  /^GCP_/i,
-  /^FIREBASE_/i,
-  /^HEROKU_/i,
-  /^DOCKER_AUTH/i,
-  /^KUBECONFIG$/i,
-  /^VAULT_/i,
-
-  // Suffix-based patterns for common secret naming conventions
-  /_KEY$/i,
-  /_SECRET$/i,
-  /_TOKEN$/i,
-  /_PASSWORD$/i,
-  /_CREDENTIAL$/i,
-  /_CREDENTIALS$/i,
-  /_API_KEY$/i,
-]
-
-export function createCleanMcpEnvironment(
-  customEnv: Record<string, string> = {}
-): Record<string, string> {
-  const mergedEnv: Record<string, string> = {}
-
-  for (const [key, value] of Object.entries(process.env)) {
-    if (value === undefined) continue
-    mergedEnv[key] = value
-  }
-
-  Object.assign(mergedEnv, customEnv)
-
-  const cleanEnv: Record<string, string> = {}
-  for (const [key, value] of Object.entries(mergedEnv)) {
-    const shouldExclude = EXCLUDED_ENV_PATTERNS.some((pattern) => pattern.test(key))
-    if (!shouldExclude) {
-      cleanEnv[key] = value
-    }
-  }
-
-  return cleanEnv
-}

package/src/features/skill-mcp-manager/error-redaction.ts

@@ -1,47 +0,0 @@
-// Redacts sensitive tokens from error messages to prevent credential exposure
-// Follows same patterns as env-cleaner.ts for consistency
-
-const SENSITIVE_PATTERNS: RegExp[] = [
-  // API keys and tokens in common formats
-  /[a-zA-Z0-9_-]*(?:api[_-]?key|apikey)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:auth[_-]?token|authtoken)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:access[_-]?token|accesstoken)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:secret)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{16,})/gi,
-  /[a-zA-Z0-9_-]*(?:password)["\s]*[:=]["\s]*([a-zA-Z0-9_-]{8,})/gi,
-
-  // Bearer tokens
-  /bearer\s+([a-zA-Z0-9_-]{20,})/gi,
-
-  // Common token prefixes
-  /sk-[a-zA-Z0-9]{20,}/g, // OpenAI-style secret keys
-  /gh[pousr]_[a-zA-Z0-9]{20,}/gi, // GitHub tokens
-  /glpat-[a-zA-Z0-9_-]{20,}/gi, // GitLab tokens
-  /[A-Za-z0-9_]{20,}-[A-Za-z0-9_]{10,}-[A-Za-z0-9_]{10,}/g, // Common JWT-like patterns
-]
-
-const REDACTION_MARKER = "[REDACTED]"
-
-/**
- * Redacts sensitive tokens from a string.
- * Used for error messages that may contain command-line arguments or environment info.
- */
-export function redactSensitiveData(input: string): string {
-  let result = input
-
-  for (const pattern of SENSITIVE_PATTERNS) {
-    result = result.replace(pattern, REDACTION_MARKER)
-  }
-
-  return result
-}
-
-/**
- * Redacts sensitive data from an Error object, returning a new Error.
- * Preserves the stack trace but redacts the message.
- */
-export function redactErrorSensitiveData(error: Error): Error {
-  const redactedMessage = redactSensitiveData(error.message)
-  const redactedError = new Error(redactedMessage)
-  redactedError.stack = error.stack ? redactSensitiveData(error.stack) : undefined
-  return redactedError
-}