@indigoai-us/hq-cli 5.345.147 → 5.345.149

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.87","bundleSha256":"916fb28a230f0f0dd83cfaa87366670512898636a137c74a4c989a261301cf5e","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.88","bundleSha256":"7e9ee380eae55e059a474fd5f415e8aeb16088805b761d791318d5299645becd","formatVersion":1}

package/dist/index.d.ts

@@ -3,6 +3,15 @@ import "./node-preflight.js";
 import "./node-network-compat-fast.js";
 import { isVersionRequest } from "./version-request.js";
 import { isFastCoreRequest } from "./fast-scaffold.js";
+/**
+ * Whether the install follow-up would read the registry or spawn the mesh
+ * daemon. False for fast routes' callers, and for commands that are not run
+ * from an npm install: the PATH repair needs the npm shim folder above
+ * node_modules, and the daemon step needs the installed package. Inlined so
+ * those routes do not load user-path.ts. Keep the skip rules aligned with
+ * install-followup.ts.
+ */
+export declare function installFollowupWouldDoWork(argv: readonly string[], env: NodeJS.ProcessEnv, platform: NodeJS.Platform): boolean;
 type PackageUseLeaseLoader = () => Promise<void>;
 type PackageUseUpdateProbe = () => Promise<boolean>;
 /** Resolves true once the command was re-run (exit code already set). */
@@ -18,6 +27,7 @@ declare function runCliEntry(entryUrl: string, dispatch: () => void, loadLease?:
 export declare const __test__: {
     isVersionRequest: typeof isVersionRequest;
     isFastCoreRequest: typeof isFastCoreRequest;
+    installFollowupWouldDoWork: typeof installFollowupWouldDoWork;
     dispatchWithPackageUseLease: typeof dispatchWithPackageUseLease;
     waitForUpdateThenReexec: typeof waitForUpdateThenReexec;
     runCliEntry: typeof runCliEntry;

package/dist/index.js

@@ -16,6 +16,7 @@ import { installWindowsHideDefault } from "./utils/windows-hide-default.js";
 import { fileURLToPath } from "node:url";
 import { parseMonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
 import { createRequire } from "node:module";
+import { hookEnginePathArgs, runHookEnginePath } from "./hook-engine-path.js";
 function cygpathMixedPath(value) {
     // Require only a Node builtin: the package supports Node releases before
     // require(ESM) became available, and this runs in the synchronous dispatcher.
@@ -155,10 +156,48 @@ async function runMonitorCheckFastWithRecovery(request) {
         return;
     await runMainWithInstallTreeRecovery();
 }
+/**
+ * Whether the install follow-up would read the registry or spawn the mesh
+ * daemon. False for fast routes' callers, and for commands that are not run
+ * from an npm install: the PATH repair needs the npm shim folder above
+ * node_modules, and the daemon step needs the installed package. Inlined so
+ * those routes do not load user-path.ts. Keep the skip rules aligned with
+ * install-followup.ts.
+ */
+export function installFollowupWouldDoWork(argv, env, platform) {
+    if (env.HQ_INSTALL_FOLLOWUP === "1" || env.HQ_STAGED_INSTALL === "1")
+        return false;
+    const args = argv.slice(2).filter((arg) => arg !== "--verbose");
+    if (args[0] === "mesh" && args[1] === "daemon")
+        return false;
+    if (args[0] === "daemon" && (args[1] === "run" || args[1] === "install"))
+        return false;
+    if (platform === "win32")
+        return /[/\\]node_modules[/\\]/i.test(argv[1] ?? "");
+    return /node_modules[/\\]@indigoai-us[/\\]hq-cli[/\\]/i.test(argv[1] ?? "");
+}
 function dispatchCliEntry() {
     // Before anything spawns: a background hq on Windows (no terminal) hides the
     // console window of every child it starts (feedback_351a40d5).
     installWindowsHideDefault();
+    const engineArgs = hookEnginePathArgs(process.argv);
+    if (engineArgs !== null) {
+        void runHookEnginePath(engineArgs);
+        return;
+    }
+    // cmd.exe code page 437 prints em dashes as mojibake. Pipes stay UTF-8.
+    // Loaded only on Windows so Linux fast routes do not pay for the module.
+    if (process.platform === "win32") {
+        void import("./lib/windows/console-encoding.js").then(({ installWindowsConsoleEncoding }) => {
+            installWindowsConsoleEncoding();
+        }).catch(() => undefined).then(() => {
+            dispatchCliRoutes();
+        });
+        return;
+    }
+    dispatchCliRoutes();
+}
+function dispatchCliRoutes() {
     if (process.platform === "win32" && coreCommandHasPathOperands(process.argv)) {
         // Keep cygpath off non-Windows and non-path command routes.
         process.argv = normalizeCorePathOperands(process.argv, "win32", cygpathMixedPath);
@@ -166,6 +205,37 @@ function dispatchCliEntry() {
     const versionRequest = isVersionRequest(process.argv);
     const helpRequest = !versionRequest && isCommandHelpRequest(process.argv);
     const parsedFastCore = versionRequest || helpRequest ? null : parseFastCore(process.argv);
+    const monitorRequest = versionRequest || helpRequest ? null : parseMonitorCheckFastRequest(process.argv);
+    const secretsRequest = versionRequest || helpRequest || monitorRequest || parsedFastCore
+        ? null
+        : parseSecretsEnvFastRequest(process.argv);
+    const mcpRequest = !versionRequest &&
+        !helpRequest &&
+        !monitorRequest &&
+        !parsedFastCore &&
+        !secretsRequest &&
+        isMcpServeRequest(process.argv);
+    // `--version`, hook, MCP, and secrets fast routes must not pay for PATH or
+    // daemon work, so they never start PowerShell or reg.exe. The module stays
+    // unloaded when there is nothing to do, so a Linux fast route does not
+    // import it.
+    if (!versionRequest && !monitorRequest && !parsedFastCore && !secretsRequest && !mcpRequest
+        && installFollowupWouldDoWork(process.argv, process.env, process.platform)) {
+        void import("./lib/windows/install-followup.js").then(({ runWindowsInstallFollowup }) => {
+            try {
+                runWindowsInstallFollowup({ argv: process.argv });
+            }
+            catch {
+                // Install repair must not turn into a failed command.
+            }
+        }).catch(() => undefined).then(() => {
+            dispatchCliCommand(versionRequest, helpRequest, parsedFastCore, monitorRequest, secretsRequest, mcpRequest);
+        });
+        return;
+    }
+    dispatchCliCommand(versionRequest, helpRequest, parsedFastCore, monitorRequest, secretsRequest, mcpRequest);
+}
+function dispatchCliCommand(versionRequest, helpRequest, parsedFastCore, monitorRequest, secretsRequest, mcpRequest) {
     if (versionRequest) {
         // Bare `--version` is the CLI semver only (the contract field updaters
         // compare). `hq version` and `--json` print the labelled HQ/CLI report.
@@ -196,11 +266,11 @@ function dispatchCliEntry() {
             await runMainWithInstallTreeRecovery();
         });
     }
-    else if (parseMonitorCheckFastRequest(process.argv)) {
+    else if (monitorRequest) {
         // The Stop hook runs this every turn in every session. Answer the common
         // no-active-lane case from the lane-record directory alone; anything the
         // fast route cannot prove falls back to the full command graph.
-        void runMonitorCheckFastWithRecovery(parseMonitorCheckFastRequest(process.argv));
+        void runMonitorCheckFastWithRecovery(monitorRequest);
     }
     else if (parsedFastCore?.entry.kind === "native" &&
         (process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "true" ||
@@ -216,8 +286,8 @@ function dispatchCliEntry() {
         // existing full-graph route.
         void runNativeFastRouteWithRecovery(parsedFastCore);
     }
-    else if (parseSecretsEnvFastRequest(process.argv)) {
-        const request = parseSecretsEnvFastRequest(process.argv);
+    else if (secretsRequest) {
+        const request = secretsRequest;
         void import("./secrets-env-fast-route.js").then(async (route) => {
             await route.dispatchSecretsEnvFastRequest(request, {
                 isEnabled: () => route.secretsEnvFastRouteEnabled(request),
@@ -231,7 +301,7 @@ function dispatchCliEntry() {
             });
         });
     }
-    else if (isMcpServeRequest(process.argv)) {
+    else if (mcpRequest) {
         // Keep the minimal startup route; runMcpServe applies the hq-flags gate.
         void import("./commands/mcp-serve.js").then(({ runMcpServe }) => runMcpServe());
     }
@@ -367,6 +437,7 @@ void runCliEntry(import.meta.url, dispatchCliEntry);
 export const __test__ = {
     isVersionRequest,
     isFastCoreRequest,
+    installFollowupWouldDoWork,
     dispatchWithPackageUseLease,
     waitForUpdateThenReexec,
     runCliEntry,

package/dist/lazy-commands.js

@@ -3,6 +3,7 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { COMMAND_CATALOG } from "./command-catalog.generated.js";
+import { installUnknownCommandSuggestions } from "./unknown-command.js";
 const commandCatalog = COMMAND_CATALOG;
 /**
  * One entry for every root, including groups that are assembled by several
@@ -105,6 +106,7 @@ export function findRuntimeHqRoot(start, parentOf = dirname, isRoot = (directory
 export function registerCommandCatalog(program) {
     for (const command of commandCatalog)
         program.addCommand(commandDefinition(command));
+    installUnknownCommandSuggestions(program);
 }
 function commandForToken(token) {
     return commandCatalog.find((candidate) => candidate.name === token || candidate.aliases.includes(token));

package/dist/lib/agent-kit/inbox-redact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Owner STS credentials ride on an agent inbox item as
+ * `actingContext.credentials`. The mirror files are readable by whatever
+ * model has file tools, so those credentials are removed before a write and
+ * again on read. Only `mode`, `ownerPersonUid`, `ownerRole`, and `expiresAt`
+ * stay on `actingContext`. Any other key under that object is dropped.
+ *
+ * A scrub that cannot write (EPERM, ENOSPC, and the same class) is counted
+ * and skipped. It does not throw into the poller or a reader. The next poll
+ * or read tries again. Failure logs are a count and errno codes, never a
+ * path or a file byte.
+ *
+ * `hq dm` output drops the rest of `actingContext` as well. That stricter
+ * stdout rule lives with the command; credential removal has this one
+ * implementation.
+ */
+import type { AgentKitPaths } from "./paths.js";
+export interface InboxScrubReport {
+    scrubbed: number;
+    failures: number;
+    /** Errno names only. Never paths, file names, or file contents. */
+    codes: string[];
+}
+/**
+ * One writer at a time for the mirror directory. The journal is rewritten
+ * in place when credentials are scrubbed and appended when a message arrives;
+ * those two must not overlap or the rewrite can drop the append.
+ * Returns undefined when the directory is missing or the lock is not acquired.
+ */
+export declare function withInboxMirrorLock<T>(inboxDir: string, waitMs: number, fn: () => T): T | undefined;
+/**
+ * Remove credential and unknown `actingContext` keys. Allowed delegation
+ * fields are copied through. Does not mutate `item`.
+ */
+export declare function redactAgentInboxItem<T>(item: T): T;
+/**
+ * Rewrite mirror files that still contain delegated credentials, drop torn
+ * journal lines that contain them, and delete stale `*.json.tmp.*` files.
+ * A clean directory is left untouched, so repeating the call is a no-op.
+ * Returns how many records were rewritten or removed. Write and rename
+ * errors are counted on the report and are not thrown.
+ */
+export declare function scrubInboxMirror(paths: Pick<AgentKitPaths, "inboxDir">, log?: (report: InboxScrubReport) => void): number;
+//# sourceMappingURL=inbox-redact.d.ts.map

package/dist/lib/agent-kit/inbox-redact.js

@@ -0,0 +1,361 @@
+/**
+ * Owner STS credentials ride on an agent inbox item as
+ * `actingContext.credentials`. The mirror files are readable by whatever
+ * model has file tools, so those credentials are removed before a write and
+ * again on read. Only `mode`, `ownerPersonUid`, `ownerRole`, and `expiresAt`
+ * stay on `actingContext`. Any other key under that object is dropped.
+ *
+ * A scrub that cannot write (EPERM, ENOSPC, and the same class) is counted
+ * and skipped. It does not throw into the poller or a reader. The next poll
+ * or read tries again. Failure logs are a count and errno codes, never a
+ * path or a file byte.
+ *
+ * `hq dm` output drops the rest of `actingContext` as well. That stricter
+ * stdout rule lives with the command; credential removal has this one
+ * implementation.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writePrivateFile } from "./private-file.js";
+const INBOX_JSONL_NAME = "inbox.jsonl";
+const STATE_FILES = new Set(["seen-ids.json", "done-ids.json"]);
+const LOCK_DIR_NAME = ".inbox-write.lock";
+const LOCK_STALE_MS = 30_000;
+const ACTING_CONTEXT_KEYS = ["mode", "ownerPersonUid", "ownerRole", "expiresAt"];
+const ALLOWED_ACTING_KEYS = new Set(ACTING_CONTEXT_KEYS);
+/** Substrings that mark a torn line or temp. The values themselves are not logged. */
+const CREDENTIAL_MARKERS = ["\"credentials\"", "secretAccessKey", "sessionToken", "accessKeyId"];
+function emptyTally() {
+    return { scrubbed: 0, failures: 0, codes: [] };
+}
+function errnoCode(err) {
+    const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+    return typeof code === "string" && /^[A-Z][A-Z0-9]{1,15}$/.test(code) ? code : "ERR";
+}
+function noteFailure(tally, err) {
+    tally.failures += 1;
+    const code = errnoCode(err);
+    if (!tally.codes.includes(code))
+        tally.codes.push(code);
+}
+function sleepMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * One writer at a time for the mirror directory. The journal is rewritten
+ * in place when credentials are scrubbed and appended when a message arrives;
+ * those two must not overlap or the rewrite can drop the append.
+ * Returns undefined when the directory is missing or the lock is not acquired.
+ */
+export function withInboxMirrorLock(inboxDir, waitMs, fn) {
+    let dirStat;
+    try {
+        dirStat = fs.lstatSync(inboxDir);
+    }
+    catch {
+        return undefined;
+    }
+    if (!dirStat.isDirectory())
+        return undefined;
+    const lockDir = path.join(inboxDir, LOCK_DIR_NAME);
+    const deadline = Date.now() + Math.max(0, waitMs);
+    for (;;) {
+        try {
+            fs.mkdirSync(lockDir);
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                return undefined;
+            try {
+                if (Date.now() - fs.statSync(lockDir).mtimeMs > LOCK_STALE_MS)
+                    fs.rmdirSync(lockDir);
+            }
+            catch {
+                /* the holder released it, or it is not a directory */
+            }
+            if (Date.now() >= deadline)
+                return undefined;
+            sleepMs(20);
+            continue;
+        }
+        try {
+            return fn();
+        }
+        finally {
+            try {
+                fs.rmdirSync(lockDir);
+            }
+            catch {
+                /* already released */
+            }
+        }
+    }
+}
+function actingContextRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const acting = value.actingContext;
+    if (!acting || typeof acting !== "object" || Array.isArray(acting))
+        return null;
+    return acting;
+}
+function actingNeedsRewrite(acting) {
+    return Object.keys(acting).some((key) => !ALLOWED_ACTING_KEYS.has(key));
+}
+function allowlistedActing(acting) {
+    const kept = {};
+    for (const key of ACTING_CONTEXT_KEYS) {
+        if (Object.prototype.hasOwnProperty.call(acting, key))
+            kept[key] = acting[key];
+    }
+    return kept;
+}
+function textHasCredentialMaterial(text) {
+    return CREDENTIAL_MARKERS.some((marker) => text.includes(marker));
+}
+function isStaleJsonTemp(name) {
+    return (name.includes(".json.tmp.") ||
+        name.includes(".jsonl.tmp.") ||
+        name.endsWith(".json.tmp") ||
+        name.endsWith(".jsonl.tmp"));
+}
+/**
+ * Remove credential and unknown `actingContext` keys. Allowed delegation
+ * fields are copied through. Does not mutate `item`.
+ */
+export function redactAgentInboxItem(item) {
+    const acting = actingContextRecord(item);
+    if (!acting || !actingNeedsRewrite(acting))
+        return item;
+    const record = item;
+    const kept = allowlistedActing(acting);
+    if (Object.keys(kept).length === 0) {
+        const { actingContext: _actingContext, ...without } = record;
+        return without;
+    }
+    return { ...record, actingContext: kept };
+}
+/**
+ * One journal record per line. A torn line cannot be parsed, and an
+ * interrupted append can still hold a credential on that line. Drop those
+ * lines. A torn line with no credential marker stays, so a truncated
+ * message that is not a secret is not thrown away.
+ */
+function redactJsonl(text) {
+    let changed = 0;
+    const kept = [];
+    for (const line of text.split("\n")) {
+        if (!line.trim()) {
+            kept.push(line);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            if (!textHasCredentialMaterial(line)) {
+                kept.push(line);
+                continue;
+            }
+            changed += 1;
+            continue;
+        }
+        const acting = actingContextRecord(parsed);
+        if (!acting || !actingNeedsRewrite(acting)) {
+            kept.push(line);
+            continue;
+        }
+        changed += 1;
+        kept.push(JSON.stringify(redactAgentInboxItem(parsed)));
+    }
+    return { text: kept.join("\n"), changed };
+}
+function scrubJsonFile(file, tally) {
+    let text;
+    try {
+        const st = fs.lstatSync(file);
+        if (!st.isFile())
+            return;
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        noteFailure(tally, err);
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        if (!textHasCredentialMaterial(text))
+            return;
+        try {
+            fs.unlinkSync(file);
+            tally.scrubbed += 1;
+        }
+        catch (err) {
+            noteFailure(tally, err);
+        }
+        return;
+    }
+    const acting = actingContextRecord(parsed);
+    if (!acting || !actingNeedsRewrite(acting))
+        return;
+    try {
+        // The temp writePrivateFile creates is the redacted body, not the original.
+        writePrivateFile(file, `${JSON.stringify(redactAgentInboxItem(parsed), null, 2)}\n`, 0o600);
+        tally.scrubbed += 1;
+    }
+    catch (err) {
+        noteFailure(tally, err);
+    }
+}
+function redactedTempBody(text) {
+    try {
+        return `${JSON.stringify(redactAgentInboxItem(JSON.parse(text)), null, 2)}\n`;
+    }
+    catch {
+        return "\n";
+    }
+}
+/** Delete a leftover `*.json.tmp.*` from a crashed atomic write. Rewrite it if it cannot be removed. */
+function discardStaleTemp(file, tally) {
+    let text;
+    try {
+        const st = fs.lstatSync(file);
+        if (!st.isFile())
+            return;
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        text = undefined;
+    }
+    const poisoned = text !== undefined && textHasCredentialMaterial(text);
+    try {
+        fs.unlinkSync(file);
+        if (poisoned)
+            tally.scrubbed += 1;
+        return;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        if (text === undefined) {
+            noteFailure(tally, err);
+            return;
+        }
+    }
+    if (text === undefined)
+        return;
+    try {
+        writePrivateFile(file, redactedTempBody(text), 0o600);
+        if (poisoned)
+            tally.scrubbed += 1;
+    }
+    catch (err) {
+        noteFailure(tally, err);
+    }
+}
+function scrubJournal(journal, tally) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        let before;
+        try {
+            before = fs.readFileSync(journal, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return;
+            noteFailure(tally, err);
+            return;
+        }
+        const redacted = redactJsonl(before);
+        if (redacted.changed === 0)
+            return;
+        let latest;
+        try {
+            latest = fs.readFileSync(journal, "utf8");
+        }
+        catch (err) {
+            noteFailure(tally, err);
+            return;
+        }
+        if (latest !== before)
+            continue;
+        try {
+            writePrivateFile(journal, redacted.text, 0o600);
+        }
+        catch (err) {
+            noteFailure(tally, err);
+            return;
+        }
+        try {
+            if (fs.readFileSync(journal, "utf8") === redacted.text) {
+                tally.scrubbed += redacted.changed;
+                return;
+            }
+        }
+        catch {
+            /* the next pass, or the next read, rewrites whatever landed */
+        }
+    }
+    noteFailure(tally, Object.assign(new Error("inbox scrub did not land"), { code: "EAGAIN" }));
+}
+function scanInboxDir(inboxDir) {
+    const tally = emptyTally();
+    let names;
+    try {
+        names = fs.readdirSync(inboxDir);
+    }
+    catch (err) {
+        noteFailure(tally, err);
+        return tally;
+    }
+    for (const name of names) {
+        if (isStaleJsonTemp(name)) {
+            discardStaleTemp(path.join(inboxDir, name), tally);
+            continue;
+        }
+        if (!name.endsWith(".json") || STATE_FILES.has(name))
+            continue;
+        scrubJsonFile(path.join(inboxDir, name), tally);
+    }
+    scrubJournal(path.join(inboxDir, INBOX_JSONL_NAME), tally);
+    return tally;
+}
+function defaultScrubLog(report) {
+    if (report.scrubbed > 0) {
+        console.error(`inbox: scrubbed ${report.scrubbed} mirrored record(s) containing delegated credentials`);
+    }
+    if (report.failures > 0) {
+        const codes = report.codes.length > 0 ? report.codes.join(",") : "ERR";
+        console.error(`inbox: scrub failed for ${report.failures} file(s) (${codes})`);
+    }
+}
+/**
+ * Rewrite mirror files that still contain delegated credentials, drop torn
+ * journal lines that contain them, and delete stale `*.json.tmp.*` files.
+ * A clean directory is left untouched, so repeating the call is a no-op.
+ * Returns how many records were rewritten or removed. Write and rename
+ * errors are counted on the report and are not thrown.
+ */
+export function scrubInboxMirror(paths, log = defaultScrubLog) {
+    let tally = emptyTally();
+    try {
+        // Missing directory: do not create it. Lock not acquired: leave the files
+        // for the next read rather than rewriting the journal without the lock.
+        tally = withInboxMirrorLock(paths.inboxDir, 2_000, () => scanInboxDir(paths.inboxDir)) ?? tally;
+    }
+    catch (err) {
+        noteFailure(tally, err);
+    }
+    if (tally.scrubbed > 0 || tally.failures > 0) {
+        log({ scrubbed: tally.scrubbed, failures: tally.failures, codes: tally.codes });
+    }
+    return tally.scrubbed;
+}
+//# sourceMappingURL=inbox-redact.js.map

package/dist/lib/agent-kit/inbox-state.js

@@ -10,6 +10,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { redactAgentInboxItem, scrubInboxMirror } from "./inbox-redact.js";
 import { writePrivateFile } from "./private-file.js";
 const DONE_IDS_NAME = "done-ids.json";
 const MAX_DONE_IDS = 5000;
@@ -37,6 +38,14 @@ export function markInboxDone(paths, ids) {
 }
 /** Every mirrored entry, oldest first, de-duplicated by id (last write wins). */
 export function readMirroredInbox(paths) {
+    // Files written before credential redaction are rewritten here. A failed
+    // rewrite is retried on the next read. It must not hide mail already on disk.
+    try {
+        scrubInboxMirror(paths);
+    }
+    catch {
+        /* scrubInboxMirror records write failures and does not throw them */
+    }
     let text;
     try {
         text = fs.readFileSync(path.join(paths.inboxDir, INBOX_JSONL), "utf8");
@@ -49,7 +58,7 @@ export function readMirroredInbox(paths) {
         if (!line.trim())
             continue;
         try {
-            const entry = JSON.parse(line);
+            const entry = redactAgentInboxItem(JSON.parse(line));
             if (typeof entry.id === "string" && entry.id) {
                 byId.delete(entry.id);
                 byId.set(entry.id, entry);
@@ -144,7 +153,7 @@ export async function mergeAgentInbox(paths, fetchServerInbox) {
                 const raw = m;
                 const id = typeof raw.id === "string" ? raw.id : typeof raw.messageId === "string" ? raw.messageId : null;
                 if (id && !byId.has(id))
-                    byId.set(id, { ...raw, id });
+                    byId.set(id, redactAgentInboxItem({ ...raw, id }));
             }
         }
         else {

package/dist/lib/agent-kit/mcp/tools.js

@@ -18,6 +18,7 @@
 import { CLI_VERSION } from "../../../cli-version.js";
 import { peekIdToken } from "../../../utils/id-token.js";
 import { isRecipientUid } from "../../../lib/notify-recipient.js";
+import { redactAgentInboxItem } from "../inbox-redact.js";
 import { markInboxDone, mergeAgentInbox, readDoneIds, summarizeInboxEntry } from "../inbox-state.js";
 import { AttachmentCompanyUnresolvedError, fetchChatAttachment } from "./attachments.js";
 import { errorResult, McpToolInputError, textResult } from "./jsonrpc.js";
@@ -287,7 +288,7 @@ export function buildAgentMcpTools(clients) {
                 const rows = [...byId.values()]
                     .filter((e) => includeDone || !done.has(e.id))
                     .slice(0, limit)
-                    .map((e) => summarizeInboxEntry(e, done.has(e.id)));
+                    .map((e) => summarizeInboxEntry(redactAgentInboxItem(e), done.has(e.id)));
                 const hasFiles = rows.some((r) => r.attachments?.length);
                 return textResult(clampOutput(JSON.stringify({
                     count: rows.length,