@hue-run/sdk 0.11.2 → 0.11.3

package/CLI.md

@@ -42,7 +42,7 @@ project manifest are refused because managers can update ancestor locks; Python
 The generated `hue.setup.mjs` or `hue_setup.py` always selects `captureContent: false` /
 `capture_content=False`. For a supported application, setup installs the dependency and adds the
 managed import and middleware registration to the existing entrypoint; an unreferenced helper is
-not a completed integration. TypeScript uses `@hue-run/sdk@0.11.2`, `@opentelemetry/api@1.9.1` and
+not a completed integration. TypeScript uses `@hue-run/sdk@0.11.3`, `@opentelemetry/api@1.9.1` and
 `@opentelemetry/context-async-hooks@2.11.0`; Python setup uses its separately tested package pin.
 Content capture requires an ordinary account-managed key and a later explicit application decision.
 
@@ -255,11 +255,32 @@ again with `--auth key`.
 JSON files are parsed and merged: other servers, inputs and top-level fields are kept, only the
 selected server entry is replaced (`hue`, or `hue-<value>` with `--project`), and invalid JSON
 (including comments) is refused together with the snippet
-to add by hand. Files are written with mode `0644` through a temporary file and an atomic rename;
-symlinks are refused. `--dry-run` prints the resulting file content or commands without writing or
-running; `--print` prints only the snippet. Client CLIs run without a shell, so the
-`${HUE_MCP_KEY}` reference reaches them literally; the printed commands use single quotes for the
-same reason, and quote a URL with a query such as `?read_only=true`, whose `?` is a zsh glob.
+to add by hand. Files are written through a temporary file and an atomic rename. A new file is
+owner-only (mode `0600`, narrowed further by the umask), because other servers' literal tokens often
+end up in it; a replaced file keeps its read, write and execute permissions, so a file kept at
+`0600` is never widened, except that other accounts lose write access (they could add a command for
+the client to run). It keeps its group, and its owner when root runs the command (if root cannot
+give the file back, the write fails and the old file stays); when the group cannot be kept, the
+group and other accounts get only the access both had. Setuid, setgid and sticky bits are dropped,
+and an access control list is not kept: the replacement has only the mode bits, whose group bits are
+the list's mask, plus any default list the directory gives new files, whose entries then get up to
+the group's access. Restore a list afterwards if you use one. A symlinked file, or a symlinked
+`.cursor` or `.vscode` directory, is refused; the current directory itself may be reached through a
+symlink. The directory is checked before the file is read and again before the rename, and a
+different file found in place of the one read is refused, but not atomically: an account that can
+write the project directory and races the command can still swap in a link between the last check
+and the rename. `--dry-run` prints the resulting file content or commands without writing or
+running. In printed file content, every header and `env` value, and each other credential it
+recognizes (a known token prefix, the value of an option such as `--api-key VALUE`, `-H VALUE`,
+`-e NAME=VALUE` or `--token=VALUE`, a field or assignment such as `clientSecret`, `key` or
+`STRIPE_KEY=`, a token-like URL path segment, a URL's query values, which read `%5Bredacted%5D`), is
+shown as `[redacted]` unless the whole value is a variable or input reference such as
+`Bearer ${HUE_MCP_KEY}`; the file keeps the values. Hue's own URL shows its `toolsets`, `project`
+and `read_only` selections, with every other query value and any token-like path segment as
+`[redacted]`, there and in the lines that report what the command did; a command printed for you to
+run keeps `--url` as given. `--print` prints only the snippet. Client CLIs run without a shell, so
+the `${HUE_MCP_KEY}` reference reaches them literally; the printed commands use single quotes for
+the same reason, and quote a URL with a query such as `?read_only=true`, whose `?` is a zsh glob.
 
 After a key installation the command reminds you to export `HUE_MCP_KEY` in the shell that starts
 the client (VS Code prompts for the key instead). A desktop app started from the Dock or a launcher
@@ -300,8 +321,9 @@ a later one is a timeout. A failing answer with `x-slack-no-retry: 1` is reporte
 retrying it. Only a successful URL verification answer's body (at most 4 KiB, for its challenge) is
 sent to Hue; any other answer body stays on this machine. Each pull waits for at most 20 seconds and
 leases up to `--max` deliveries (1 to 10, default 10), which are forwarded concurrently; the next
-pull starts once they are acknowledged, and a delivery beyond `--max` is never forwarded. A pull
-that answers at once with nothing new to forward is not repeated for a second. A provider retry of
+pull starts once they are acknowledged, and a delivery beyond `--max` is never forwarded. A waiting
+pull that forwarded something is not repeated until 50 ms after it began, and one that answers at
+once with nothing new to forward is not repeated for a second. A provider retry of
 an event is a new delivery and is forwarded again with its `X-Slack-Retry-Num` and
 `X-Slack-Retry-Reason`, so the bot deduplicates by `event_id` as it does with Slack. A delivery Hue
 hands out a second time is not sent again; its recorded answer is repeated. An acknowledgement Hue
@@ -432,7 +454,7 @@ node packages/sdk-typescript/scripts/verify-package.mjs --artifacts-dir .artifac
 # Set project to an existing supported fixture; use the same directory on resume.
 project=/absolute/path/to/supported-fixture
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.11.2.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.11.3.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command setup \
   --evidence .context/setup-staging-before-claim.json
@@ -443,7 +465,7 @@ the private local handoff and finish the real browser claim, then reconcile the
 
 ```sh
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.11.2.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.11.3.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command claim \
   --evidence .context/setup-staging-after-claim.json

package/README.md

@@ -165,8 +165,10 @@ call carries `error.type` (`mcp_error`, the provider's status or error code) and
 text, credentials scrubbed (URL userinfo, query values and fragments, or the whole URL for a scheme
 other than `http(s)`, `ws(s)` and `ftp`; tokens with a known credential prefix such as `hue_sk_`,
 `sk-` or `xoxb-`; authorization-scheme credentials and an `Authorization` header's whole value;
-the value of a credential-named `key=value` or `key: value` pair, quoted or not) and cut to 1,024
-characters. An `mcp_list_tools`
+the value of a credential-named `key=value`, `key: value` or `key => value` pair, quoted, bare or
+a whole `[…]` or `{…}` (to the end of the text when it does not close), a quote that does not close
+on its line running to its end; a JSON or `%` escape such as `\n` or `%20` ends a word) and cut to
+1,024 characters and a `…`. An `mcp_list_tools`
 item becomes a `tools/list` child span with that server's `gen_ai.tool.definitions`; with
 `captureContent: false` it carries only `hue.tool.names` and `hue.tool.definitions.sha256`, the
 summary described below. Pass the request so each server's host is recorded as `server.address`

package/dist/cli/eval.js

@@ -11,7 +11,7 @@ import { createEnvironmentClient } from "../environment/client.js";
 import { agentEnvironment, isHueControlPlaneCredential, stripHueControlPlaneCredentials, writeMcpConfig, } from "../environment/world.js";
 import { EvaluationClient, HueApiError } from "../evals/client.js";
 import { TargetResult } from "../evals/types.js";
-import { CheckpointIdentityError, CheckpointStore } from "../evals/checkpoint.js";
+import { CheckpointIdentityError, CheckpointStore, checkpointPath } from "../evals/checkpoint.js";
 import { onForcedExit, runForcedExitCleanups } from "../evals/exit-cleanup.js";
 import { safeFilename } from "../evals/files.js";
 import { digest } from "../evals/json.js";
@@ -810,9 +810,13 @@ export function explain(error) {
 }
 /** `.hue/eval/<agent-key>/<project>/<leaf>` unless overridden; the SDK binds each store to one
  * project and origin, so switching keys or deployments must not collide. */
-async function prepareCheckpointDirectory(explicit, agentKey, projectId, leaf) {
+async function prepareCheckpointDirectory(explicit, agentKey, projectId, ...leaf) {
+    const segments = [
+        [projectId, "project id"],
+        ...leaf.map((part) => [part, "checkpoint kind"]),
+    ];
     if (explicit)
-        return join(resolve(explicit), projectId, leaf);
+        return checkpointPath(explicit, ...segments);
     const root = resolve(".hue", "eval");
     await mkdir(root, { recursive: true, mode: 0o700 });
     const ignore = join(root, ".gitignore");
@@ -822,7 +826,7 @@ async function prepareCheckpointDirectory(explicit, agentKey, projectId, leaf) {
     catch {
         await writeFile(ignore, "*\n", { flag: "wx", mode: 0o600 }).catch(() => undefined);
     }
-    return join(root, agentKey, projectId, leaf);
+    return checkpointPath(join(root, agentKey), ...segments);
 }
 /** Worker-side client that reports registration and claims without changing the worker. */
 class ObservedClient extends EvaluationClient {
@@ -1210,7 +1214,7 @@ async function runDirect(run, connection) {
             client,
             hue: run.hue,
             experimentId,
-            checkpointDirectory: join(store.directory, experimentId),
+            checkpointDirectory: checkpointPath(store.directory, [experimentId, "experiment id"]),
             // Outputs, error messages and explanations are stored unless opted out; --content governs
             // only the telemetry.
             persistResultContent: !values["no-output"],
@@ -1268,7 +1272,7 @@ async function runWorker(values, connection, adapter, agent, hue, output, signal
         ? undefined
         : integer("max-runs", values["max-runs"], 1, 1, 1_000_000);
     const project = await client.checkConnection();
-    const checkpointDirectory = await prepareCheckpointDirectory(values["checkpoint-dir"], agent.key, project.id, join("worker", slug(agent.revision) || "dev"));
+    const checkpointDirectory = await prepareCheckpointDirectory(values["checkpoint-dir"], agent.key, project.id, "worker", slug(agent.revision) || "dev");
     let current;
     client.onRegistered = (registered) => {
         output.log(`Registered agent ${registered.key} (revision ${registered.revision}) with ${connection.baseUrl}; waiting for runs launched from Hue${maxRuns ? ` (stops after ${maxRuns})` : " (Ctrl+C to stop)"}`);

package/dist/cli/listen.js

@@ -35,6 +35,12 @@ const MAX_RETRY_AFTER_MS = 60_000;
 const REMEMBERED_DELIVERIES = 1_024;
 /** The least time between pulls that forwarded nothing new, so repeats cannot spin. */
 const IDLE_PULL_FLOOR_MS = 1_000;
+/** The least time between the starts of pulls that forwarded something, so a Hue that answers
+ * every pull at once with new deliveries is pulled at most 20 times a second. */
+const BUSY_PULL_FLOOR_MS = 50;
+/** The most of a text from elsewhere (an error message, a URL) that is scrubbed and printed, in
+ * code points, as of a provider's error text; a longer one is cut there and `…` marks the cut. */
+const MAX_FOREIGN_TEXT = 16_384;
 /** A stop request this soon after the first is the same one: under `npx`, npm forwards the
  * terminal's SIGINT to a process group that already received it. */
 const REPEATED_STOP_MS = 1_000;
@@ -491,7 +497,16 @@ export async function runListenCommand(argv, io = {}) {
             out = out.replaceAll(secret, "[redacted]");
         return out.replace(/[^\P{Cc}\n\t]|\p{Cf}/gu, " ");
     };
-    const foreign = (text) => scrubCredentialText(text);
+    const foreign = (text) => {
+        let kept = "";
+        let seen = 0;
+        for (const character of text) {
+            if (seen++ === MAX_FOREIGN_TEXT)
+                return `${scrubCredentialText(kept, true)}…`;
+            kept += character;
+        }
+        return scrubCredentialText(text);
+    };
     const out = (line) => void stdout.write(`${clean(line)}\n`);
     const warn = (line) => void stderr.write(`${clean(line)}\n`);
     let subscription;
@@ -809,8 +824,12 @@ export async function runListenCommand(argv, io = {}) {
             // A pull that could wait but answered at once with nothing new to forward (none due, only
             // deliveries already answered, or ones this client skips) is not repeated at once, so a
             // Hue that hands them out again or refuses their acknowledgements is not pulled in a loop.
-            if (waited && !forwarded.includes(true) && performance.now() - pulledAt < IDLE_PULL_FLOOR_MS)
+            // One that forwarded something is repeated no sooner than BUSY_PULL_FLOOR_MS after it began.
+            const elapsed = performance.now() - pulledAt;
+            if (waited && !forwarded.includes(true) && elapsed < IDLE_PULL_FLOOR_MS)
                 await sleep(IDLE_PULL_FLOOR_MS, stopping.signal);
+            else if (waited && elapsed < BUSY_PULL_FLOOR_MS)
+                await sleep(BUSY_PULL_FLOOR_MS - elapsed, stopping.signal);
         }
     }
     finally {

package/dist/cli/mcp.js

@@ -1,10 +1,11 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { access, chmod, lstat, mkdir, open, readFile, rename, stat, unlink, } from "node:fs/promises";
-import { basename, delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { access, lstat, mkdir, open, readFile, rename, stat, unlink } from "node:fs/promises";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { isLoopbackHost } from "../config.js";
+import { isCredentialKey, scrubCredentialText } from "../tool-definitions.js";
 export const DEFAULT_MCP_URL = "https://mcp.hue.run/mcp";
 const SERVER_NAME = "hue";
 const ENV_VAR = "HUE_MCP_KEY";
@@ -306,6 +307,7 @@ function mergeVscodeInput(root, input, display) {
     const others = (inputs ?? []).filter((item) => !(isRecord(item) && item.id === INPUT_ID));
     return { ...root, inputs: [...others, input] };
 }
+/** The parsed file, if any, and the file it was read from, so the write can replace that one. */
 async function readJsonConfig(path, display) {
     let info;
     try {
@@ -313,7 +315,7 @@ async function readJsonConfig(path, display) {
     }
     catch (error) {
         if (error.code === "ENOENT")
-            return undefined;
+            return { config: undefined };
         throw new ConfigError(`Cannot read ${display}: ${error.message}`);
     }
     if (info.isSymbolicLink())
@@ -324,40 +326,104 @@ async function readJsonConfig(path, display) {
         throw new ConfigError(`Refusing to use ${display}: it is larger than 1 MiB.`);
     const text = await readFile(path, "utf8");
     if (!text.trim())
-        return undefined;
+        return { config: undefined, file: info };
     try {
-        return JSON.parse(text);
+        return { config: JSON.parse(text), file: info };
     }
     catch {
         throw new ConfigError(`${display} is not valid JSON (comments are not supported); fix it or add the snippet by hand.`);
     }
 }
+/**
+ * Refuses a symbolic link, or anything but a directory, between the working directory and the file
+ * (`.cursor` or `.vscode`), as the file itself is refused. The working directory and its ancestors
+ * are not checked: on macOS `/tmp` and `/var` are links, and a home directory can be one. This runs
+ * before the file is read and again before the rename. Node has no `openat`, so it cannot pin the
+ * directory against an account that can write the project and swaps a link in after the last check.
+ */
+async function rejectLinkedParents(cwd, path, display) {
+    let current = cwd;
+    for (const part of relative(cwd, dirname(path)).split(sep).filter(Boolean)) {
+        current = join(current, part);
+        let info;
+        try {
+            info = await lstat(current);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        const shown = displayPath(cwd, current);
+        if (info.isSymbolicLink())
+            throw new ConfigError(`Refusing to use ${display}: ${shown} is a symbolic link.`);
+        if (!info.isDirectory())
+            throw new ConfigError(`Refusing to use ${display}: ${shown} is not a directory.`);
+    }
+}
+/** The file's status, or undefined when there is none; a symbolic link is refused. */
 async function rejectSymlink(path, display) {
+    let info;
     try {
-        if ((await lstat(path)).isSymbolicLink())
-            throw new ConfigError(`Refusing to write ${display}: it is a symbolic link.`);
+        info = await lstat(path);
     }
     catch (error) {
         if (error.code === "ENOENT")
-            return;
+            return undefined;
         throw error;
     }
+    if (info.isSymbolicLink())
+        throw new ConfigError(`Refusing to write ${display}: it is a symbolic link.`);
+    return info;
 }
-/** Atomic write for a secret-free config file: temporary file, fsync, rename; mode 0644. */
-async function writeConfigFile(path, text, display) {
+/**
+ * Atomic write: temporary file, fsync, rename. A file it replaces keeps its permission bits, so one
+ * kept at 0600 because it holds other servers' tokens is never widened, except that other accounts
+ * lose write access; it keeps its group (or, when the group cannot be kept, its group and other
+ * accounts get only the access both had), and its owner when root runs the command. A new file is
+ * created owner-only, 0600 narrowed by the umask: people and clients add literal tokens to these
+ * files.
+ */
+async function writeConfigFile(cwd, path, text, display, read) {
     await mkdir(dirname(path), { recursive: true });
-    await rejectSymlink(path, display);
+    const existing = await rejectSymlink(path, display);
+    // The file replaced must be the one read: the content merged it, and its mode and group are kept.
+    // Another file in its place, such as one in a directory swapped in meanwhile, is refused.
+    if (existing?.dev !== read?.dev || existing?.ino !== read?.ino)
+        throw new ConfigError(`Refusing to write ${display}: it changed while the command ran.`);
     const temporary = join(dirname(path), `.${basename(path)}.${randomUUID()}.tmp`);
     try {
-        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o644);
+        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
         try {
             await handle.writeFile(text, "utf8");
+            if (existing) {
+                // Other accounts never keep write access: they could add a server command to run.
+                let mode = existing.mode & 0o775;
+                // The new file has the process's group (the directory's on macOS), which may differ. When
+                // the group cannot be kept, its members and everyone else get only what both had.
+                const created = await handle.stat();
+                if (created.gid !== existing.gid) {
+                    try {
+                        await handle.chown(-1, existing.gid);
+                    }
+                    catch {
+                        const shared = (mode >> 3) & mode & 0o007;
+                        mode = (mode & 0o700) | (shared << 3) | shared;
+                    }
+                }
+                await handle.chmod(mode);
+                // Root also gives the file back to its owner, last: changing the mode of another account's
+                // file would need CAP_FOWNER. If it cannot, the write fails and the old file stays in place,
+                // rather than leaving one its owner cannot read.
+                if (process.geteuid?.() === 0 && created.uid !== existing.uid)
+                    await handle.chown(existing.uid, -1);
+            }
             await handle.sync();
         }
         finally {
             await handle.close();
         }
-        await chmod(temporary, 0o644);
+        await rejectLinkedParents(cwd, path, display);
         await rejectSymlink(path, display);
         await rename(temporary, path);
     }
@@ -366,6 +432,147 @@ async function writeConfigFile(path, text, display) {
         throw error;
     }
 }
+const REDACTED = "[redacted]";
+/**
+ * Only references a client resolves (`${NAME}`, `${env:NAME}`, `${input:id}`), after an optional
+ * `Bearer`, `Basic` or `Token` scheme: no credential. A reference with a default does not match.
+ */
+const REFERENCE_ONLY = /^(?:(?:bearer|basic|token)[ \t]+)?(?:\$\{(?:input:[\w.-]+|(?:env:)?[A-Za-z_]\w*)\})+$/iu;
+/** Names `isCredentialKey` leaves out that configurations use for a credential field or option. */
+const CREDENTIAL_NAMES = new Set(["auth", "pat", "bearer", "env"]);
+/** `isCredentialKey`, `CREDENTIAL_NAMES`, or a name ending in `key`, `keys`, `header` or `headers`. */
+function isCredentialName(name) {
+    const normalized = name.toLowerCase().replace(/[-_]/g, "");
+    return (isCredentialKey(name) ||
+        CREDENTIAL_NAMES.has(normalized) ||
+        /(?:keys?|headers?)$/u.test(normalized));
+}
+/**
+ * An `args` option whose next item is its value and names a credential: `--api-key`, `--header`,
+ * or `-H`, the header option of curl and `mcp-remote`.
+ */
+function isCredentialOption(item) {
+    if (item === "-H")
+        return true;
+    const name = typeof item === "string" ? /^--?([A-Za-z][\w-]*)$/u.exec(item)?.[1] : undefined;
+    return name !== undefined && isCredentialName(name);
+}
+/** `--name=value`, or `NAME=value` as `env` takes it, as an `args` item. */
+const OPTION_VALUE = /^(-{0,2}([A-Za-z][\w-]*)=)(.*)$/su;
+/**
+ * The item after Docker's `-e` or `--env`, as an environment value is shown: a variable name alone
+ * (passed through from the environment) as is, `NAME=VALUE` with its value redacted. Anything else,
+ * such as the script after `node -e`, can hold a literal credential in any shape and is redacted.
+ */
+function redactEnvironmentItem(item) {
+    if (/^[A-Za-z_]\w*$/u.test(item))
+        return item;
+    const assignment = /^([A-Za-z_]\w*)=(.*)$/su.exec(item);
+    if (!assignment)
+        return REDACTED;
+    return REFERENCE_ONLY.test(assignment[2]) ? item : `${assignment[1]}=${REDACTED}`;
+}
+/** A URL path segment long and mixed enough to be a token, as some servers put their key there. */
+const TOKEN_SEGMENT = /^(?=[^/]*[A-Za-z])(?=[^/]*\d)[^/]{16,}$/u;
+/** Whether a URL path segment is token-like, or a credential `scrubCredentialText` knows. */
+function isTokenSegment(segment) {
+    return TOKEN_SEGMENT.test(segment) || scrubCredentialText(segment) !== segment;
+}
+/** A URL with each token-like path segment replaced; any other string is returned as is. */
+function redactUrlPath(value) {
+    if (!/^(?:https?|wss?):\/\//iu.test(value))
+        return value;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return value;
+    }
+    const segments = parsed.pathname.split("/");
+    if (!segments.some(isTokenSegment))
+        return value;
+    parsed.pathname = segments
+        .map((segment) => (isTokenSegment(segment) ? REDACTED : segment))
+        .join("/");
+    return parsed.href;
+}
+/** A query parameter name shown before its redacted value; any other becomes `[redacted]` whole. */
+const PARAMETER_NAME = /^[A-Za-z_][\w.-]{0,31}$/u;
+/**
+ * The URL this command writes, as its output shows it: the selections it validated (`toolsets`,
+ * `project`, and `read_only` when true or false) are kept; any other query value, and a token-like
+ * path segment, becomes `[redacted]`. `parseMcpUrl` has already refused userinfo and a fragment.
+ * Commands printed for a person to run keep the URL as given.
+ */
+function displayMcpUrl(url) {
+    const parsed = new URL(url);
+    const query = parsed.search
+        .slice(1)
+        .split("&")
+        .filter(Boolean)
+        .map((pair) => {
+        const [name = "", value = ""] = pair.split("=", 2);
+        const selection = name === "toolsets" ||
+            name === "project" ||
+            (name === "read_only" && /^(?:true|false)$/u.test(value));
+        if (selection)
+            return pair;
+        return PARAMETER_NAME.test(name) &&
+            !TOKEN_SEGMENT.test(name) &&
+            scrubCredentialText(name) === name
+            ? `${name}=${REDACTED}`
+            : REDACTED;
+    });
+    return redactUrlPath(`${parsed.origin}${parsed.pathname}${query.length ? `?${query.join("&")}` : ""}`);
+}
+/**
+ * A merged configuration as `--dry-run` prints it. Header and `env` values, strings and numbers
+ * under a key naming a credential, the value of a credential option in `args` (`--api-key VALUE`,
+ * `--key=VALUE`) and token-like URL path segments become `[redacted]` unless they only reference a
+ * variable or input; other strings lose what `scrubCredentialText` finds (a known token prefix, a
+ * `token=` pair, a URL's userinfo and query values). The server names under `serversKey` are not
+ * read as field names. `url`, the address this command writes, is shown as `shownUrl`.
+ */
+function redactConfig(root, serversKey, url, shownUrl) {
+    const redact = (value, secret, depth, names) => {
+        if (depth > 256)
+            return REDACTED;
+        if (typeof value === "number")
+            return secret ? REDACTED : value;
+        if (typeof value === "string") {
+            if (value === url)
+                return shownUrl;
+            if (REFERENCE_ONLY.test(value))
+                return value;
+            if (secret)
+                return REDACTED;
+            const option = OPTION_VALUE.exec(value);
+            if (!option)
+                return scrubCredentialText(redactUrlPath(value));
+            if (REFERENCE_ONLY.test(option[3]))
+                return value;
+            const shown = isCredentialName(option[2])
+                ? REDACTED
+                : scrubCredentialText(redactUrlPath(option[3]));
+            return `${option[1]}${shown}`;
+        }
+        if (Array.isArray(value))
+            return value.map((item, index) => {
+                const previous = value[index - 1];
+                if (!secret && typeof item === "string" && (previous === "-e" || previous === "--env"))
+                    return redactEnvironmentItem(item);
+                return redact(item, secret || isCredentialOption(previous), depth + 1, false);
+            });
+        if (!isRecord(value))
+            return value;
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            redact(item, secret || (!(names && isRecord(item)) && isCredentialName(key)), depth + 1, depth === 0 && key === serversKey),
+        ]));
+    };
+    return redact(root, false, 0, false);
+}
 async function findExecutable(name, env) {
     const searchPath = env.PATH ?? env.Path ?? "";
     const extensions = process.platform === "win32" ? (env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
@@ -653,6 +860,9 @@ export async function runMcpCommand(argv, io = {}) {
         toolsets = selected.toolsets;
     }
     url = toolsetsMcpUrl(url, toolsets);
+    const shownUrl = displayMcpUrl(url);
+    // What the command reports doing; a command a person is to run is printed as given.
+    const shownCommand = (command) => command.display.replaceAll(shellWord(url), () => shellWord(shownUrl));
     const plan = planFor(clientId, auth, scope, url, serverName);
     if (parsed.values.print) {
         stdout.write(plan.snippet);
@@ -669,7 +879,7 @@ export async function runMcpCommand(argv, io = {}) {
     if (plan.kind === "cli") {
         if (parsed.values["dry-run"]) {
             for (const command of plan.commands)
-                out(`Would run: ${command.display}`);
+                out(`Would run: ${shownCommand(command)}`);
             return 0;
         }
         let failed = false;
@@ -681,10 +891,10 @@ export async function runMcpCommand(argv, io = {}) {
                 out(command.display);
                 continue;
             }
-            out(`Running: ${command.display}`);
+            out(`Running: ${shownCommand(command)}`);
             const code = await runClientCli(executable, command.args, { cwd, env, stdout, stderr });
             if (code === 0) {
-                out(`Registered the "${serverName}" MCP server (${url}) with ${command.label}.`);
+                out(`Registered the "${serverName}" MCP server (${shownUrl}) with ${command.label}.`);
                 continue;
             }
             failed = true;
@@ -698,10 +908,14 @@ export async function runMcpCommand(argv, io = {}) {
     }
     const path = resolve(cwd, plan.file);
     const display = displayPath(cwd, path);
+    let merged;
     let content;
+    let read;
     try {
+        await rejectLinkedParents(cwd, path, display);
         const existing = await readJsonConfig(path, display);
-        let merged = mergeServerEntry(existing, plan.key, plan.entry, display, serverName);
+        read = existing.file;
+        merged = mergeServerEntry(existing.config, plan.key, plan.entry, display, serverName);
         if (plan.input)
             merged = mergeVscodeInput(merged, plan.input, display);
         content = json(merged);
@@ -712,17 +926,21 @@ export async function runMcpCommand(argv, io = {}) {
         return fail(`Could not read ${display}: ${error.message}`);
     }
     if (parsed.values["dry-run"]) {
-        out(`Would write ${display}:`);
-        stdout.write(content);
+        // Other servers' entries can hold literal tokens; the file keeps them, the output does not.
+        const shown = json(redactConfig(merged, plan.key, url, shownUrl));
+        out(shown === content
+            ? `Would write ${display}:`
+            : `Would write ${display} (credential values shown as ${REDACTED}):`);
+        stdout.write(shown);
         return 0;
     }
     try {
-        await writeConfigFile(path, content, display);
+        await writeConfigFile(cwd, path, content, display, read);
     }
     catch (error) {
         return fail(`Could not write ${display}: ${error.message}`);
     }
-    out(`Wrote ${display} with the "${serverName}" MCP server (${url}).`);
+    out(`Wrote ${display} with the "${serverName}" MCP server (${shownUrl}).`);
     for (const line of steps)
         out(line);
     return 0;

package/dist/evals/checkpoint.d.ts

@@ -1,3 +1,8 @@
+/** A server- or user-provided identifier that is safe as a single checkpoint path component:
+ * no separators, no `.`/`..`, and it stays directly inside the directory it is joined onto. */
+export declare function checkpointSegment(value: string, label: string): string;
+/** `join(directory, ...segments)` after validating every segment. */
+export declare function checkpointPath(directory: string, ...segments: [string, string][]): string;
 /** The checkpoint belongs to a run started with a different identity. When only its content
  * policy differs, `startedWith` holds the policy the unfinished run was started with. */
 export declare class CheckpointIdentityError extends Error {

package/dist/evals/checkpoint.js

@@ -1,10 +1,26 @@
 import { constants, rmSync } from "node:fs";
 import { lstat, mkdir, open, rename, rm } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { join, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
 import { onForcedExit } from "./exit-cleanup.js";
 import { digest } from "./json.js";
 const CONTENT_POLICY = ["persistResultContent", "captureContent"];
+const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/** A server- or user-provided identifier that is safe as a single checkpoint path component:
+ * no separators, no `.`/`..`, and it stays directly inside the directory it is joined onto. */
+export function checkpointSegment(value, label) {
+    if (typeof value !== "string" || !SEGMENT.test(value))
+        throw new Error(`Refusing to use ${label} ${JSON.stringify(value)} in a checkpoint path`);
+    return value;
+}
+/** `join(directory, ...segments)` after validating every segment. */
+export function checkpointPath(directory, ...segments) {
+    const root = resolve(directory);
+    const path = resolve(root, ...segments.map(([value, label]) => checkpointSegment(value, label)));
+    if (path !== root && !path.startsWith(root.endsWith(sep) ? root : root + sep))
+        throw new Error("Checkpoint path escapes its directory");
+    return path;
+}
 /** The checkpoint belongs to a run started with a different identity. When only its content
  * policy differs, `startedWith` holds the policy the unfinished run was started with. */
 export class CheckpointIdentityError extends Error {

package/dist/evals/local-worker.js

@@ -1,6 +1,6 @@
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import { randomUUID } from "node:crypto";
-import { CheckpointStore } from "./checkpoint.js";
+import { CheckpointStore, checkpointPath, checkpointSegment } from "./checkpoint.js";
 import { pinRequestedAttemptV2, requestedAttemptV2, runEnvironmentTarget, } from "./environment-target.js";
 import { runExperiment, OutcomeSerializationError, TargetOutcomeUncertainError, UncertainExecutionError, } from "./runner.js";
 /** Capability strings a registration declares; Hue offers only matching cases. */
@@ -159,14 +159,18 @@ export async function runLocalAgent(options) {
             }, Math.min(15_000, Math.max(1_000, interval)));
             let experimentFinished = false;
             try {
+                const experimentId = checkpointSegment(claim.experimentId, "experiment id");
                 const requested = requestedConfiguration
-                    ? pinRequestedAttemptV2(requestedConfiguration, (await options.client.getExperiment(claim.experimentId)).config)
+                    ? pinRequestedAttemptV2(requestedConfiguration, (await options.client.getExperiment(experimentId)).config)
                     : undefined;
                 const report = await runExperiment({
                     client: options.client,
                     hue: options.hue,
-                    experimentId: claim.experimentId,
-                    checkpointDirectory: join(directory, `experiment-${claim.experimentId}`),
+                    experimentId,
+                    checkpointDirectory: checkpointPath(directory, [
+                        `experiment-${experimentId}`,
+                        "experiment id",
+                    ]),
                     persistResultContent: true,
                     // Worker dispatch uses the case pin: directTarget never receives a world.
                     environmentEvidence: options.directTarget ? "when_pinned" : "required",