@inflexa-ai/harness 0.48.0 → 0.48.2

package/dist/input-sanitization.js

@@ -3,9 +3,17 @@
  * What runs is exactly what is declared here.
  *
  * `normalizeUnicode` and `redactSecrets` are applied once to the incoming user
- * message by the chat route (change 6), and never to assistant messages or tool
- * results. `stripNulCharacters` is the exception — it applies to tool results.
+ * message by the chat route, and never to assistant messages or to the result
+ * that a tool gives the model. `stripNulCharacters` is the exception — it
+ * applies to tool results.
+ *
+ * `redactSecretForms`, `redactSecretFields`, and `redactSecretAssignments` are
+ * the value-only rules: only the shown values of a tool call (`loop/tool-value.ts`)
+ * get them. They are name-based rules that would mark prose and sequences in a
+ * user message. The model reads the unchanged result.
  */
+import { isUnknownArray } from "./lib/unknown-array.js";
+import { parseUnknownRecord } from "./lib/unknown-containers.js";
 /**
  * C0/C1 control characters and DEL, excluding `\t` (U+0009) and `\n`
  * (U+000A) which are legitimate whitespace in user prose.
@@ -92,3 +100,180 @@ export function redactSecrets(text) {
     }
     return out;
 }
+/**
+ * The words that end the name of a field that holds a secret. A name is compared with the case, `_`, and `-` removed.
+ * The name must END with the word, not hold it: `max_tokens`, `tokenizer`, and `tokenCount` hold no secret. `pass` also
+ * ends a name such as `bypass`, which costs a shown fact only. `pwd` is not a word: `PWD` is the working directory.
+ */
+const SECRET_NAME_WORDS = [
+    "password",
+    "passwd",
+    "pass",
+    "secret",
+    "secretkey",
+    "token",
+    "apikey",
+    "accesskey",
+    "privatekey",
+    "credential",
+    "credentials",
+    "authorization",
+    "cookie",
+];
+function isSecretName(name) {
+    const folded = name.toLowerCase().replaceAll("_", "").replaceAll("-", "");
+    return SECRET_NAME_WORDS.some((word) => folded.endsWith(word));
+}
+const SECRET_FIELD_MARKER = "[REDACTED: Secret Field]";
+const SECRET_ASSIGNMENT_MARKER = "[REDACTED: Secret Assignment]";
+const PASSWORD_MARKER = "[REDACTED: Password]";
+const SECRET_FLAG_MARKER = "[REDACTED: Secret Flag]";
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- an argv element that is a long option, `--name`, with no value in it. The name is bounded, thus the test of an element is bounded.
+const ARGV_FLAG = /^--([A-Za-z0-9][A-Za-z0-9_.-]{0,80})$/;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the credential of an argv element after `-u` or `--user`: the user, a colon, and the password to the end of the element. The user holds no colon, so the match has one reading.
+const ARGV_CREDENTIAL = /^([^:]*):[\s\S]*$/;
+/**
+ * A copy of an array of strings in which the element after a `--name` element with a secret name is the redaction
+ * marker, and the element after `-u` or `--user` loses its password. A command line that is an array of words has no
+ * text in which the flag rules can see the flag and its value together.
+ */
+function redactArgvValues(array) {
+    return array.map((element, index) => {
+        const before = array[index - 1];
+        if (typeof element !== "string" || typeof before !== "string")
+            return redactSecretFields(element);
+        if (before === "-u" || before === "--user")
+            return element.replace(ARGV_CREDENTIAL, `$1:${PASSWORD_MARKER}`);
+        const flag = ARGV_FLAG.exec(before);
+        if (flag?.[1] !== undefined && isSecretName(flag[1]) && !element.startsWith("--"))
+            return SECRET_FLAG_MARKER;
+        return element;
+    });
+}
+/**
+ * A copy of a JSON value in which the value of each object field with a secret name is the redaction marker. The
+ * walk goes to each depth, thus the `GITHUB_TOKEN` field of an `env` object is found. An array applies the rule of
+ * {@link redactArgvValues} to its strings. The rule belongs to the values of a tool call only. `redactSecrets` stays
+ * free of any name-based rule, because a user message holds prose and sequences that such a rule would mark.
+ */
+export function redactSecretFields(value) {
+    if (isUnknownArray(value))
+        return redactArgvValues(value);
+    const record = parseUnknownRecord(value);
+    if (record === undefined)
+        return value;
+    const out = {};
+    for (const [name, field] of Object.entries(record)) {
+        out[name] = isSecretName(name) && field !== null && field !== undefined ? SECRET_FIELD_MARKER : redactSecretFields(field);
+    }
+    return out;
+}
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the shell and environment form NAME=value, with a quoted value that ends at its closing quote (an escaped quote inside a double-quoted value does not end it) or a value up to the next separator. A quote that does not close holds the rest of the text, because a cut text can end inside a secret. A name has at most 80 characters, thus a long run of name characters costs a bounded scan at each start. A value does not start with `=`, thus a comparison `token == x` stays whole, and a value that an earlier rule already replaced stays as it is.
+const ASSIGNMENT = /([A-Za-z0-9_.-]{1,80})=(?!=|\[REDACTED: [A-Za-z ]{1,30}\])("(?:[^"\\]|\\.)*(?:"|\\?$)|'[^']*(?:'|$)|[^\s"'\\&;,]+)/g;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- a quoted field `"name": value`. The value is a string that ends at its closing quote (an escaped quote inside it does not end it, and a quote that does not close holds the rest of the text), or a number or a bare word that ends at a separator. A bare value does not start a nested object or array.
+const QUOTED_FIELD = /"([^"\\\s]{1,80})"(\s*:\s*)(?:"((?:[^"\\]|\\.)*)(?:"|\\?$)|([^\s",}\]{[][^\s",}\]]*))/g;
+/**
+ * Replace the value of each `NAME=value` assignment and of each quoted `"name": value` field whose name ends with a
+ * secret word. A caller runs it on a plain text or on one string of a JSON value, never on serialized JSON, because a
+ * JSON escape hides the quotes that the rules read. It runs on the text of a tool call value only. See
+ * {@link redactSecretFields}.
+ */
+export function redactSecretAssignments(text) {
+    return text
+        .replace(ASSIGNMENT, (whole, name) => (isSecretName(name) ? `${name}=${SECRET_ASSIGNMENT_MARKER}` : whole))
+        .replace(QUOTED_FIELD, (whole, name, colon, quoted) => {
+        if (!isSecretName(name))
+            return whole;
+        return quoted === undefined ? `"${name}"${colon}${SECRET_FIELD_MARKER}` : `"${name}"${colon}"${SECRET_FIELD_MARKER}"`;
+    });
+}
+const PRIVATE_KEY_MARKER = "[REDACTED: Private Key]";
+const URL_PASSWORD_MARKER = "[REDACTED: URL Password]";
+const SECRET_PAIR_MARKER = "[REDACTED: Secret Pair]";
+const COOKIE_MARKER = "[REDACTED: Cookie]";
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the begin line and the end line of a PEM private-key block. The label is bounded and holds no newline, thus each line is read once.
+const PRIVATE_KEY_LINE = /-----(BEGIN|END) [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+/**
+ * Replace each private-key block, from its begin line to its end line. A begin line with no end line hides the rest of
+ * the text. An end line with no begin line before it hides the text from the start of the text, or from the end of the
+ * block before it, because a window or a cut can start inside a block.
+ */
+function redactPrivateKeyBlocks(text) {
+    let out = "";
+    let copied = 0;
+    let blockStart = -1;
+    for (const line of text.matchAll(PRIVATE_KEY_LINE)) {
+        if (line[1] === "BEGIN") {
+            if (blockStart < 0)
+                blockStart = line.index;
+            continue;
+        }
+        out += text.slice(copied, blockStart >= 0 ? blockStart : copied) + PRIVATE_KEY_MARKER;
+        copied = line.index + line[0].length;
+        blockStart = -1;
+    }
+    if (blockStart >= 0)
+        return out + text.slice(copied, blockStart) + PRIVATE_KEY_MARKER;
+    return out + text.slice(copied);
+}
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- a URL with a user and a password, `scheme://user:password@host`. The user holds no colon, so the match has one reading, and the password ends at the first `@`, `/`, or space.
+const URL_PASSWORD = /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/?#"'`]{0,200}):[^\s@/"'`]{1,500}@/gi;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the `-u user:password` and `--user user:password` options of curl and similar tools, with an unquoted, a double-quoted, or a single-quoted credential. The user holds no colon, so the match has one reading.
+const USER_OPTION = /(^|\s)(-u|--user)(\s+|=)(?:"([^":\s]*):[^"]*"?|'([^':\s]*):[^']*'?|([^\s:"']*):\S*)/g;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- a `Cookie` or `Set-Cookie` header, whose value runs to the end of its line.
+const COOKIE_HEADER = /(^|\s)((?:Set-)?Cookie)([ \t]*:[ \t]*)[^\r\n]+/gi;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- a command flag `--name value` or `--name=value`. The value is a quoted string (a quote that does not close holds the rest of the text) or the next word. A word that starts a flag is no value.
+const COMMAND_FLAG = /(^|\s)--([A-Za-z0-9][A-Za-z0-9_.-]{0,80})(=|\s+)(?!--)("(?:[^"\\]|\\.)*(?:"|\\?$)|'[^']*(?:'|$)|\S+)/g;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the start of a `name: value` pair of a header or of YAML: the name after a line start, a space, a comma, an opening bracket, or an opening quote, then its colon. The name has at most 80 characters, thus the scan at each start is bounded.
+const PAIR_START = /(^|[\s,{("'])([A-Za-z][A-Za-z0-9_.-]{0,80})[ \t]*:[ \t]*/gm;
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the value of a `name: value` pair, read at the end of its start: a quoted string, or the text up to the end of the line or the next quote.
+const PAIR_VALUE = /"(?:[^"\\\r\n]|\\.)*"?|'[^'\r\n]*'?|[^\r\n"']+/y;
+/**
+ * Replace the value of each `name: value` pair whose name ends with a secret word. The scan goes on after the colon of
+ * a name that holds no secret, thus a secret pair later on the same line is found. Each step moves forward, thus the
+ * cost is linear.
+ */
+function redactNameValuePairs(text) {
+    // The patterns carry `lastIndex`, and this function runs to its end with no await, thus no call reads it between two steps of another.
+    const start = PAIR_START;
+    const value = PAIR_VALUE;
+    start.lastIndex = 0;
+    let out = "";
+    let copied = 0;
+    for (let pair = start.exec(text); pair !== null; pair = start.exec(text)) {
+        const name = pair[2] ?? "";
+        const end = pair.index + pair[0].length;
+        if (!isSecretName(name)) {
+            // The blanks after the colon stay available as the lead of the next name.
+            start.lastIndex = end - (pair[0].length - pair[0].trimEnd().length);
+            continue;
+        }
+        value.lastIndex = end;
+        const shown = value.exec(text);
+        if (shown === null)
+            continue;
+        out += `${text.slice(copied, end)}${SECRET_PAIR_MARKER}`;
+        copied = end + shown[0].length;
+        start.lastIndex = copied;
+    }
+    return out + text.slice(copied);
+}
+/**
+ * Replace the secret that each of these forms holds: a private-key block, the password of a URL, the password of a
+ * `-u user:password` option, the value of a `Cookie` header, the value of a `--name value` flag, the value of a
+ * `name: value` pair, and each form of {@link redactSecretAssignments}. A name must end with a secret word.
+ * It covers these forms only: a text can hold a secret in a different form. It runs on the text of a tool call value
+ * only, on a plain text or on one string of a JSON value.
+ */
+export function redactSecretForms(text) {
+    const withoutKeys = redactPrivateKeyBlocks(text);
+    const withoutUrlPasswords = withoutKeys.replace(URL_PASSWORD, `$1:${URL_PASSWORD_MARKER}@`);
+    const withoutUserOptions = withoutUrlPasswords.replace(USER_OPTION, (_whole, lead, option, joint, double, single, bare) => {
+        const quote = double !== undefined ? '"' : single !== undefined ? "'" : "";
+        const user = double ?? single ?? bare ?? "";
+        return `${lead}${option}${joint}${quote}${user}:${PASSWORD_MARKER}${quote}`;
+    });
+    const withoutCookies = withoutUserOptions.replace(COOKIE_HEADER, `$1$2$3${COOKIE_MARKER}`);
+    const withoutFlags = withoutCookies.replace(COMMAND_FLAG, (whole, lead, name, joint) => isSecretName(name) ? `${lead}--${name}${joint}${SECRET_FLAG_MARKER}` : whole);
+    return redactSecretAssignments(redactNameValuePairs(withoutFlags));
+}

package/dist/loop/run-loop.js

@@ -34,8 +34,10 @@ import { createCallPolicy } from "./call-policy.js";
 import { createRunScriptTool } from "../tools/script/run-script.js";
 import { COMPACTION_MAX_REQUESTS } from "./compaction.js";
 import { addChatUsage, hasReportedUsage, recordAgentRun } from "./metrics.js";
-import { adaptTools, deniedReason, foldCallRecords, isFatalToolError, modelViewOf, recordedInputOf, ToolCallOutputSchema, } from "./tool-adapter.js";
+import { adaptTools, deniedReason, foldCallRecords, isFatalToolError, modelViewOf, recordedInputOf, ToolCallOutputSchema, viewInputValue, } from "./tool-adapter.js";
+import { computeDetail } from "./tool-detail.js";
 import { READ_TOOL_OUTPUT_TOOL_ID } from "./tool-output.js";
+import { textToolValue } from "./tool-value.js";
 /** The reason of a call that asks for approval in a loop where no surface can answer. */
 const NO_APPROVER_REASON = "This action needs the approval of the user, and no one can answer here. Thus it did not run.";
 /** The harness request after a reply that a failed request cut. The model reads its partial reply, and continues it. */
@@ -514,6 +516,16 @@ async function runSeries(agent, opts, calls, log, target, spec) {
         const decision = await opts.approve(request, { toolCallId: toolCall.toolCallId, toolName: toolCall.toolName });
         return decision.kind === "approved" ? undefined : deniedReason(decision.feedback);
     };
+    // A refused call and a denied call do not run, thus the loop gives their events the detail and the view input of the tool.
+    // Only a root loop shows values, as the tool adapter does.
+    const shownRoot = source.callPath.length <= 1;
+    const callShownOf = (toolCall) => {
+        const tool = toolsById.get(toolCall.toolName);
+        if (tool === undefined)
+            return { detail: {}, input: undefined };
+        const detail = computeDetail(tool, toolCall.input, log);
+        return { detail: detail === undefined ? {} : { detail }, input: shownRoot ? viewInputValue(tool, toolCall.input, log) : undefined };
+    };
     const seriesSteps = [];
     let open = openStep();
     let failure;
@@ -548,8 +560,25 @@ async function runSeries(agent, opts, calls, log, target, spec) {
             const refusal = calls.refusalOf({ toolName: toolCall.toolName, input: toolCall.input }, spec.mask);
             if (refusal !== undefined) {
                 // A refused call does not run, thus its two events come from here.
-                await opts.emit({ type: "tool-started", source, toolUseId: toolCall.toolCallId, name: toolCall.toolName, input: toolCall.input });
-                await opts.emit({ type: "tool-finished", source, toolUseId: toolCall.toolCallId, name: toolCall.toolName, outcome: "error" });
+                const shown = callShownOf(toolCall);
+                await opts.emit({
+                    type: "tool-started",
+                    source,
+                    toolUseId: toolCall.toolCallId,
+                    name: toolCall.toolName,
+                    ...shown.detail,
+                    input: shown.input,
+                });
+                await opts.emit({
+                    type: "tool-finished",
+                    source,
+                    toolUseId: toolCall.toolCallId,
+                    name: toolCall.toolName,
+                    outcome: "error",
+                    ...shown.detail,
+                    input: shown.input,
+                    error: shownRoot ? textToolValue(refusal) : undefined,
+                });
                 return { type: "denied", reason: refusal };
             }
             let denial;
@@ -565,8 +594,24 @@ async function runSeries(agent, opts, calls, log, target, spec) {
             if (denial === undefined)
                 return undefined;
             deniedByTheUser.set(toolCall.toolCallId, denial);
-            await opts.emit({ type: "tool-started", source, toolUseId: toolCall.toolCallId, name: toolCall.toolName, input: toolCall.input });
-            await opts.emit({ type: "tool-finished", source, toolUseId: toolCall.toolCallId, name: toolCall.toolName, outcome: "denied" });
+            const shown = callShownOf(toolCall);
+            await opts.emit({
+                type: "tool-started",
+                source,
+                toolUseId: toolCall.toolCallId,
+                name: toolCall.toolName,
+                ...shown.detail,
+                input: shown.input,
+            });
+            await opts.emit({
+                type: "tool-finished",
+                source,
+                toolUseId: toolCall.toolCallId,
+                name: toolCall.toolName,
+                outcome: "denied",
+                ...shown.detail,
+                input: shown.input,
+            });
             return { type: "denied", reason: denial };
         },
         stopWhen: () => stops(),

package/dist/loop/tool-adapter.d.ts

@@ -17,6 +17,7 @@
 import { type ToolSet, type UIMessageStreamWriter } from "ai";
 import type { ToolResultOutput } from "@ai-sdk/provider-utils";
 import { z } from "zod";
+import type { ToolCallValue } from "../contracts/chat-events.js";
 import type { AgentSession } from "../auth/types.js";
 import type { Logger } from "../lib/logger.js";
 import type { ProviderCapabilities } from "../providers/types.js";
@@ -94,5 +95,12 @@ export declare function foldCallRecords(tools: readonly Tool[], calls: readonly
     readonly toolCallId: string;
     readonly output?: ToolCallOutput;
 }[], log: Logger): void;
+/**
+ * The shown input of a call: the `input` member of the view of the tool, run on the input after the parse with the input
+ * schema. The parse is inside the guard, because a schema with an async refinement throws on a synchronous parse. A
+ * tool with no `input` member, an input that fails the parse, a member that throws, and a value that breaks a rule give
+ * no value, and each of the last two logs one warning. A value never fails a call.
+ */
+export declare function viewInputValue(tool: Tool, rawInput: unknown, log: Logger): ToolCallValue | undefined;
 /** The prose of a rejected approval is the only account that the model gets of the denial. */
 export declare function deniedReason(feedback: string | undefined): string;

package/dist/loop/tool-adapter.js

@@ -29,6 +29,7 @@ import { isToolError, readToolCallRecord, readToolResultImages, } from "../tools
 import { recordKeyFor } from "./accounting.js";
 import { computeDetail, computeResultDetail } from "./tool-detail.js";
 import { excerptOf, keptTextOf, TOOL_RESULT_CAP, toolOutputRef } from "./tool-output.js";
+import { errorToolValue, makeToolCallValue } from "./tool-value.js";
 const ToolResultImageSchema = z.object({ base64: z.string(), mediaType: z.string() });
 const JsonSchema = z.json();
 /**
@@ -157,9 +158,19 @@ async function runToolCall(tool, input, options, run) {
     const startedAt = performance.now();
     const { toolCallId } = options;
     const detail = computeDetail(tool, input, run.log);
+    // Only a root call shows values: no reader shows the values of a sub-agent call or of a nested call of a script.
+    const showsValues = run.source.callPath.length <= 1;
     // The emit and the call start before the first await: a call that runs in the body of a workflow takes its
     // function ids in the order of the calls, thus a replay gives each call its own child.
-    const started = run.emit({ type: "tool-started", source: run.source, toolUseId: toolCallId, name: tool.id, input, ...detailField(detail) });
+    const shownInput = showsValues ? viewInputValue(tool, input, run.log) : undefined;
+    const started = run.emit({
+        type: "tool-started",
+        source: run.source,
+        toolUseId: toolCallId,
+        name: tool.id,
+        ...detailField(detail),
+        input: shownInput,
+    });
     const ctx = {
         invocationId: toolCallId,
         session: run.session,
@@ -168,7 +179,9 @@ async function runToolCall(tool, input, options, run) {
         turnUsage: run.turnUsage,
     };
     // One wait reads the two, thus a failed emit leaves no rejection of the call unread.
-    const [, settled] = await Promise.all([started, settleCall(tool, input, ctx, run)]);
+    const [, settled] = await Promise.all([started, settleCall(tool, input, ctx, run, showsValues)]);
+    // The values come from the output before the cut for the model, thus a host shows the start and the end of the whole text.
+    const shownError = showsValues && settled.output.outcome === "error" ? viewErrorValue(tool, settled.output.text) : undefined;
     const output = await cutLongOutput(settled.output, tool.id, toolCallId, run);
     await run.emit({
         type: "tool-finished",
@@ -178,10 +191,13 @@ async function runToolCall(tool, input, options, run) {
         outcome: output.outcome,
         ...detailField(settled.detail ?? detail),
         durationMs: Math.round(performance.now() - startedAt),
+        input: shownInput,
+        result: settled.result,
+        error: shownError,
     });
     return output;
 }
-async function settleCall(tool, input, ctx, run) {
+async function settleCall(tool, input, ctx, run, showsValues) {
     const parsed = tool.inputSchema.safeParse(input);
     let data;
     if (parsed.success) {
@@ -209,7 +225,11 @@ async function settleCall(tool, input, ctx, run) {
         }
         // The one place a result description runs: the ok value in hand, the
         // input already validated, and the guard inside the compute.
-        return { output: okOutput(tool.id, result.value, run), detail: computeResultDetail(tool, data, result.value, run.log) };
+        return {
+            output: okOutput(tool.id, result.value, run),
+            detail: computeResultDetail(tool, data, result.value, run.log),
+            result: showsValues ? viewResultValue(tool, data, result.value, run.log) : undefined,
+        };
     }
     catch (err) {
         if (isFatalToolError(err))
@@ -218,6 +238,57 @@ async function settleCall(tool, input, ctx, run) {
         return { output: errorOutput(toolErrorContent(err)) };
     }
 }
+/**
+ * The value of the output of a view member, or `undefined`. A value that breaks a rule or does not serialize gives no
+ * value and logs one warning with the reason, as a member that throws does. A member that gives `undefined` gives no
+ * value and no warning.
+ */
+function shownValue(tool, member, output, log) {
+    const made = makeToolCallValue(output);
+    if (made.isErr()) {
+        log.warn(`the ${member} view of a tool gave a value that cannot show`, { tool: tool.id, reason: made.error });
+        return undefined;
+    }
+    return made.value;
+}
+/**
+ * The shown input of a call: the `input` member of the view of the tool, run on the input after the parse with the input
+ * schema. The parse is inside the guard, because a schema with an async refinement throws on a synchronous parse. A
+ * tool with no `input` member, an input that fails the parse, a member that throws, and a value that breaks a rule give
+ * no value, and each of the last two logs one warning. A value never fails a call.
+ */
+export function viewInputValue(tool, rawInput, log) {
+    const view = tool.view;
+    if (typeof view?.input !== "function")
+        return undefined;
+    try {
+        const parsed = recordedInputOf(tool.inputSchema, rawInput);
+        if (parsed === undefined)
+            return undefined;
+        return shownValue(tool, "input", view.input(parsed), log);
+    }
+    catch (err) {
+        log.warn("the input view of a tool failed", { tool: tool.id, ...log.errorFields(err) });
+        return undefined;
+    }
+}
+/** The shown result of a call that ended `ok`: the `result` member of the view, run on the parsed input and the ok value. The guard is that of {@link viewInputValue}. */
+function viewResultValue(tool, parsedInput, result, log) {
+    const view = tool.view;
+    if (typeof view?.result !== "function")
+        return undefined;
+    try {
+        return shownValue(tool, "result", view.result(parsedInput, result), log);
+    }
+    catch (err) {
+        log.warn("the result view of a tool failed", { tool: tool.id, ...log.errorFields(err) });
+        return undefined;
+    }
+}
+/** The shown error of a call that ended `error`, when the view declares `error`. `text` is the error text that the model reads, before the cut. */
+function viewErrorValue(tool, text) {
+    return tool.view?.error === true ? errorToolValue(text) : undefined;
+}
 /**
  * The ok output of a value. The JSON data loses each NUL, and the pictures leave
  * it. A wire that carries no picture in a tool result gets the text alone, and

package/dist/loop/tool-detail.d.ts

@@ -71,13 +71,17 @@ export declare function capCodePoints(text: string, max: number): string;
  * Normalize whatever a hook returned into an emittable detail, or `undefined`.
  *
  * In order: reject anything that is not a usable string, strip control
- * characters, collapse to one line, redact secrets, then cap the length.
+ * characters, redact the text forms of the tool call values (a flag, an
+ * assignment, a pair, a cookie, a URL password), collapse to one line, redact
+ * the prefixed secret formats, then cap the length.
  *
  * The control-character strip is the harness's existing `normalizeUnicode`,
  * which is also what the chat route applies to user prose — a detail is
  * rendered by a host, so a terminal escape sequence in it is an injection.
  * Redaction runs before the cap, so a secret cannot survive by being cut in
  * half, and after the strip, so an embedded control byte cannot break a pattern.
+ * The text forms run before the collapse, because a form such as a cookie header
+ * or a `name: value` pair ends at the end of its line.
  */
 export declare function normalizeDetail(raw: unknown): ToolCallDetail | undefined;
 /**

package/dist/loop/tool-detail.js

@@ -16,7 +16,7 @@
  *    each get the line breaks, the control characters, the secret redaction, and
  *    the length cap slightly wrong. Here it is one auditable path.
  */
-import { normalizeUnicode, redactSecrets } from "../input-sanitization.js";
+import { normalizeUnicode, redactSecretForms, redactSecrets } from "../input-sanitization.js";
 import { collapseWhitespace } from "../lib/text.js";
 /**
  * The length cap, in characters. A full workspace path with a line range fits
@@ -75,13 +75,17 @@ export function capCodePoints(text, max) {
  * Normalize whatever a hook returned into an emittable detail, or `undefined`.
  *
  * In order: reject anything that is not a usable string, strip control
- * characters, collapse to one line, redact secrets, then cap the length.
+ * characters, redact the text forms of the tool call values (a flag, an
+ * assignment, a pair, a cookie, a URL password), collapse to one line, redact
+ * the prefixed secret formats, then cap the length.
  *
  * The control-character strip is the harness's existing `normalizeUnicode`,
  * which is also what the chat route applies to user prose — a detail is
  * rendered by a host, so a terminal escape sequence in it is an injection.
  * Redaction runs before the cap, so a secret cannot survive by being cut in
  * half, and after the strip, so an embedded control byte cannot break a pattern.
+ * The text forms run before the collapse, because a form such as a cookie header
+ * or a `name: value` pair ends at the end of its line.
  */
 export function normalizeDetail(raw) {
     if (typeof raw !== "string" || raw.length === 0)
@@ -89,7 +93,7 @@ export function normalizeDetail(raw) {
     // `normalizeUnicode` leaves tab, newline and carriage return in place (they
     // are legitimate whitespace in prose); the collapse below is what turns them
     // into the single line this contract promises.
-    const oneLine = collapseWhitespace(normalizeUnicode(raw));
+    const oneLine = collapseWhitespace(redactSecretForms(normalizeUnicode(raw)));
     if (oneLine.length === 0)
         return undefined;
     const capped = capCodePoints(redactSecrets(oneLine), DETAIL_MAX_LENGTH);

package/dist/loop/tool-value.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The shown values of a tool call: its input, its result, and its error.
+ *
+ * The emit site makes each value one time, and a host only shows it. A tool declares what it shows through its view
+ * (`tools/tool-view.ts`), and {@link makeToolCallValue} turns the output of a view member into a value with a kind.
+ * Each leaf of a value gets the steps below on its own. The steps run in this order, because each step
+ * protects the next one: the control characters go first, thus a control byte inside a secret cannot stop a pattern.
+ * The secrets go before the cut, thus a cut cannot divide a secret and let one half pass. The shown text can differ
+ * from the text that the model reads.
+ */
+import type { Result } from "neverthrow";
+import type { ToolCallLeaf, ToolCallValue } from "../contracts/chat-events.js";
+import type { EmitEvent } from "./types.js";
+import type { ChatStreamEvent } from "../providers/types.js";
+/** A text longer than this is cut. The unit is the UTF-16 code unit. */
+export declare const TOOL_VALUE_CAP: number;
+/** The start of a cut text holds the shape of a value. */
+export declare const TOOL_VALUE_HEAD_CHARS: number;
+/** The end of a cut text holds the errors of a command, thus it gets more room than the start. */
+export declare const TOOL_VALUE_TAIL_CHARS: number;
+/**
+ * The text past each shown part that the rules also read. A secret at the edge of a shown part is whole in its window
+ * when it is shorter than this margin, thus the rules see it as they see it in the whole text.
+ */
+export declare const TOOL_VALUE_CLEAN_MARGIN: number;
+/** The leaf of a plain text: control characters out, each secret out, then the cut. */
+export declare function textToolValue(text: string): ToolCallLeaf;
+/** The leaf of source code. The rules and the cut are those of {@link textToolValue}. `language` is checked with the whole value. */
+export declare function codeToolValue(language: string, text: string): ToolCallLeaf;
+/**
+ * The leaf of a JSON value. A string shows as a JSON string, and each other value shows as its JSON text.
+ * The field-name rule runs first, then the text rules on each string, then the serialization, then the cut: a text
+ * rule never meets a JSON escape, which would hide the end of a quoted secret.
+ * A long JSON text gets the rules on a copy of each end of the value only, and its marker counts the JSON text of the
+ * original value. Only the serialization of the whole value grows with its size, and the model path pays it already.
+ * A value with no JSON text, and a value that does not serialize, for example a cycle, give no leaf: a value is a
+ * diagnostic and never fails a call.
+ */
+export declare function jsonToolValue(value: unknown): ToolCallLeaf | undefined;
+/**
+ * The leaf of an error text. The adapter writes the error of a tool as the JSON text `{ "error": message, ... }`, and
+ * the leaf shows the message. Each other error text, for example a refusal of the call policy, shows whole.
+ */
+export declare function errorToolValue(text: string): ToolCallLeaf;
+/**
+ * The value of the output of a view member: a helper object gives its kind, a string gives a `text` leaf, and each other
+ * value gives a `json` leaf. Each leaf gets the cleaning and the cap of its kind. The result holds no value for an output
+ * that is absent (silent), and for a `fields` value with no field. It holds the reason for an output that cannot show: a
+ * value with no JSON text, a value that does not serialize, and a value that breaks a rule of the kinds (more fields than
+ * the limit, a nested `fields` value, a bad field name, a bad language). The caller logs the reason. It never throws.
+ */
+export declare function makeToolCallValue(output: unknown): Result<ToolCallValue | undefined, string>;
+/**
+ * The event without the three values. A forwarder of loop events to the stream of a run calls it, because no reader
+ * of that stream shows a value, and a value costs bytes on each event.
+ */
+export declare function withoutToolValues(event: EmitEvent | ChatStreamEvent): EmitEvent | ChatStreamEvent;