@intentic/sandbox-contract 1.248.0 → 1.249.0

package/src/command-run.ts

@@ -1,78 +0,0 @@
-import type { CommandRun } from "./schemas/ci.js";
-
-/* THE HEADING OVER A SETTLED RUN, three or four words, because it is read at a glance and from across a view
- * the user may have walked back into, and because it is read in TWO places that must agree: the card the app
- * floats over the workspace, and the notification the daemon sends to a phone when the user is not there to
- * see the card. Two copies of these words drifted once ("Checks failed" on the card, "Check failed" on the
- * phone), which is the whole reason the sentence lives in the package both sides already share.
- *
- * `subject` is what ran, in the words the button used: "Checks" for the pre-push check, "Push" for the push,
- * and the verb the user actually clicked ("Publish", "Sync") where the flow knows it. `passed` is included
- * for totality; no card is raised for it, a pass sends the push and says so where the click was. */
-export interface FollowRunOptions<R extends CommandRun> {
-    // The wait between "is it done yet" questions.
-    readonly intervalMs: number;
-    // Stop following: the caller has moved on. Resolves undefined rather than throwing, the run itself is
-    // still going wherever it was, and nobody here has anything to report about it.
-    readonly signal?: AbortSignal | undefined;
-    // Every state read, settled or not, for a surface that draws progress (the terminal to open, the command).
-    readonly onState?: ((run: R) => void) | undefined;
-    // A poll that could not be read. NOT the run failing: it is still going on the daemon, and the next tick
-    // usually reconnects, so following continues; the caller decides what to show meanwhile.
-    readonly onError?: ((cause: unknown) => void) | undefined;
-}
-
-const sleep = (ms: number, signal: AbortSignal | undefined): Promise<void> =>
-    new Promise((resolve) => {
-        const timer = setTimeout(done, ms);
-        function done(): void {
-            clearTimeout(timer);
-            signal?.removeEventListener("abort", done);
-            resolve();
-        }
-        signal?.addEventListener("abort", done, { once: true });
-    });
-
-/* FOLLOW A RUN TO ITS VERDICT: read its state until it is no longer running, and answer with the settled run.
- * The one loop under every surface that starts a command and waits for the answer, the web's run watcher and
- * an extension's push pill alike, because a daemon that answers "started" at once (prepush.contract.ts,
- * git.contract.ts push) leaves every caller to write this loop, and each one that did wrote the dropped-poll
- * case differently. Reads once immediately, so a run that has already settled is answered without a wait. */
-export const followCommandRun = async <R extends CommandRun>(read: () => Promise<R>, options: FollowRunOptions<R>): Promise<R | undefined> => {
-    const { intervalMs, signal, onState, onError } = options;
-    for (;;) {
-        if (signal?.aborted === true) {
-            return undefined;
-        }
-        try {
-            const run = await read();
-            onState?.(run);
-            if (run.status !== "running") {
-                return run;
-            }
-        } catch (cause) {
-            onError?.(cause);
-        }
-        await sleep(intervalMs, signal);
-    }
-};
-
-export const commandRunOutcome = (run: Pick<CommandRun, "status" | "timedOut">, subject: string): string => {
-    if (run.timedOut === true) {
-        return `${subject} timed out`;
-    }
-    switch (run.status) {
-        case "error":
-            return `${subject} couldn't run`;
-        case "cancelled":
-            return `${subject} stopped`;
-        case "failed":
-            return `${subject} failed`;
-        case "passed":
-            return `${subject} passed`;
-        default:
-            // `idle` reaches a card only when the command was cleared between the click and the request, there
-            // is no run any more, so it says so rather than implying one ran and said nothing.
-            return `${subject} didn't run`;
-    }
-};

package/src/contract-lock.test.ts

@@ -1,23 +0,0 @@
-import { readFileSync } from "node:fs";
-import { expect, test } from "vitest";
-import { currentLock } from "./contract-lock.js";
-
-/* The committed lock and the code must say the same thing: see contract-lock.ts for what the pair buys.
- *
- * This is the HALF that runs everywhere the tests run; the other half (a shrunk lock needs a declared break)
- * lives in _tools/checks/contract-shrink.mjs, which has git and this suite does not.
- *
- * ITS OWN BUDGET, because the default one is a HANG DETECTOR and this test does real work: it serializes every
- * schema this package exports, ~500 of them, to JSON Schema. That is ~100ms with the machine to itself and it
- * measured 8.8s on a runner running every package's suite at once, so vitest's 5s default failed it as a hang
- * over a contract that had not moved: green on a box, red on a busy runner, the trap _tools/testing/src/vitest
- * .ts is written against. 30s is well clear of the work and still reports a genuine hang inside half a minute. */
-test("contract.lock.json matches the schemas this package exports", { timeout: 30_000 }, () => {
-    const committed: unknown = JSON.parse(readFileSync(new URL("../contract.lock.json", import.meta.url), "utf8"));
-    expect(
-        currentLock(),
-        "the wire contract moved — run `pnpm --filter @intentic/sandbox-contract lock` and commit contract.lock.json with this change. " +
-            "If a schema or field was removed or changed (not added), land it as a `type!:` commit with a `Breaking-Note:` trailer " +
-            "saying, in the user's words, what stops working and what to do instead.",
-    ).toEqual(committed);
-});

package/src/contract-lock.ts

@@ -1,66 +0,0 @@
-/* THE WIRE SURFACE, AS ONE COMPARABLE DOCUMENT, every zod schema this package exports, serialized to JSON
- * Schema and sorted into a canonical shape. `contract.lock.json` at the package root is this function's
- * committed output, and the pair is what makes "did the contract change?" a question git can answer.
- *
- * Two readers depend on that answer. contract-lock.test.ts fails whenever the committed file is out of step
- * with the code, so a contract change always lands WITH its lock diff, visible in review, attributable to a
- * commit. And the contract-shrink check (_tools/checks/) compares the committed lock against its merge-base to insist that a
- * SHRUNK surface, a schema or field removed, a type changed, arrives as a `!` commit carrying a
- * `Breaking-Note:` trailer, which is what feeds the release's "Breaking changes" section and the update card's
- * warning. Additions pass freely; every persisted-manifest reader parses loosely, so growth breaks nobody.
- *
- * Serialized from the package's EXPORTS rather than a hand-kept list, on the repo's own rule (AGENTS.md:
- * "guard invariants by discovery, not enumeration"): a schema added tomorrow is in the lock tomorrow, and a
- * schema that stops being exported is a removal the lock shows. `unrepresentable: "any"` keeps the rare
- * function-valued corner from throwing, it serializes as `{}`, which still diffs when it moves. */
-
-import { z } from "zod";
-import * as contract from "./index.js";
-
-// Canonical ordering, so two runs of the same code are byte-identical and a lock diff is a contract diff
-// rather than a key-order shuffle. Arrays keep their order, for `required` and `enum` lists the order zod
-// emits is stable, and sorting them would hide a reorder that is genuinely no change at all anyway.
-const sorted = (value: unknown): unknown => {
-    if (Array.isArray(value)) {
-        return value.map(sorted);
-    }
-    if (typeof value === "object" && value !== null) {
-        return Object.fromEntries(
-            Object.keys(value)
-                .sort()
-                .map((key) => [key, sorted((value as Record<string, unknown>)[key])]),
-        );
-    }
-    return value;
-};
-
-export const currentLock = (): Record<string, unknown> => {
-    const lock: Record<string, unknown> = {};
-    for (const name of Object.keys(contract).sort()) {
-        const value = (contract as Record<string, unknown>)[name];
-        if (!(value instanceof z.ZodType)) {
-            continue;
-        }
-        try {
-            const schema = sorted(z.toJSONSchema(value, { unrepresentable: "any" })) as Record<string, unknown>;
-            // The dialect banner is identical on all ~500 entries, pure weight, no surface.
-            delete schema["$schema"];
-            lock[name] = schema;
-        } catch {
-            // A schema JSON Schema cannot express at all still holds a place in the lock: its appearance,
-            // disappearance, or transition to serializable are each a surface change worth a diff.
-            lock[name] = "<unserializable>";
-        }
-    }
-    return lock;
-};
-
-/* ONE LINE PER SCHEMA, on purpose, not JSON.stringify(lock, null, 4). Pretty-printed, the lock is a 35k-line
- * wall nobody scrolls; a line per export keeps it ~500 lines and makes `git diff` read as the list of WHICH
- * surfaces moved, which is the level a reviewer reviews at. The path-level detail lives in the tooling: the
- * lock test diffs parsed objects and the contract-shrink check names the exact removed paths, so nothing is lost by
- * not laying the structure out vertically. */
-export const serializeLock = (lock: Record<string, unknown>): string =>
-    `{\n${Object.entries(lock)
-        .map(([name, schema]) => `${JSON.stringify(name)}: ${JSON.stringify(schema)}`)
-        .join(",\n")}\n}\n`;

package/src/conversation-ids.ts

@@ -1,207 +0,0 @@
-/* THE NAME A NEW CONVERSATION IS BORN WITH.
- *
- * A conversation's id is not an internal key, it is the most PUBLIC string this app produces. The same value
- * becomes the git branch (`agent/<id>`), the worktree directory on disk, the id in the page's address, and the
- * name printed on every board card (SessionChip). So it is read far more often than it is dereferenced, and by
- * eyes rather than by code: in `git branch`, in a terminal `cd`, on a card in a lane of twenty.
- *
- * It used to be `crypto.randomUUID()`, and a UUID fails every one of those readings. Forty-two characters of
- * hex that no one can say, remember, or tell apart from the card next to it, two agents differ in the fourth
- * character and look identical at a glance, which is exactly when the board is being scanned rather than read.
- * It was also the widest line on a card that has a title to show. The app already knew this everywhere else:
- * the tmux session for the very same turn is called `agent-32b6cb04` (session-names.ts), eight characters,
- * because eight is what a human uses.
- *
- * So a new conversation gets a name instead: `swift-otter-k9m2`. The pair is the part a person actually uses,
- * sayable over a call, distinguishable at a glance, and memorable for the hour anyone cares about it. The
- * four-character tail is the part that makes it an id: the pairs alone would start colliding within a few
- * hundred conversations (a workspace passes that in a month), and a branch name that collides is a worktree
- * that refuses to be created. Random rather than a timestamp because a timestamp in base36 is eight characters
- * of its own and would put the length straight back.
- *
- * The shape satisfies ConversationIdSchema (`^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$`) by construction, every word
- * here is lowercase a–z, the tail is lowercase base36, and the separator is the one the regex allows. That
- * guard is the injection guard for the branch name and the path, so it is the one thing about this module that
- * is not a matter of taste; the test beside it holds the whole generated space to it.
- *
- * Conversations the SANDBOX starts keep their own minters and their own prefixes (an automation's fire is
- * `a-<automation>-<time>`, a CI fix is DERIVED from the run it fixes, see below), those names say WHERE the
- * conversation came from, which beats a random pair for a card the user did not ask for. This is the default
- * for the ones a person opens.
- */
-
-/* The two halves of the name. Kept short (nothing over seven letters) because the whole point is a string that
- * fits on a card, and visually distinct from one another, no near-rhymes and no two words sharing a first
- * syllable, since a name is only useful here if it can be told apart from its neighbour in the lane. */
-const ADJECTIVES = [
-    "amber",
-    "brave",
-    "brisk",
-    "calm",
-    "clear",
-    "coral",
-    "crisp",
-    "deft",
-    "eager",
-    "fair",
-    "fleet",
-    "glad",
-    "grand",
-    "keen",
-    "kind",
-    "lively",
-    "lucid",
-    "mellow",
-    "merry",
-    "mild",
-    "noble",
-    "plain",
-    "prime",
-    "proud",
-    "quick",
-    "quiet",
-    "rapid",
-    "ready",
-    "rich",
-    "ripe",
-    "sharp",
-    "sleek",
-    "smart",
-    "snug",
-    "solid",
-    "spry",
-    "stark",
-    "steady",
-    "still",
-    "stout",
-    "sunny",
-    "swift",
-    "tidy",
-    "true",
-    "vivid",
-    "warm",
-    "wise",
-    "witty",
-] as const;
-
-const NOUNS = [
-    "alder",
-    "anchor",
-    "arbor",
-    "arrow",
-    "aspen",
-    "badger",
-    "basin",
-    "beacon",
-    "birch",
-    "bison",
-    "cedar",
-    "cinder",
-    "comet",
-    "condor",
-    "cove",
-    "crane",
-    "delta",
-    "ember",
-    "falcon",
-    "fern",
-    "fjord",
-    "forge",
-    "gale",
-    "glade",
-    "harbor",
-    "heron",
-    "ivy",
-    "lantern",
-    "ledger",
-    "lichen",
-    "lynx",
-    "maple",
-    "marsh",
-    "meadow",
-    "mesa",
-    "moth",
-    "otter",
-    "pebble",
-    "pine",
-    "quarry",
-    "quill",
-    "raven",
-    "reef",
-    "ridge",
-    "rowan",
-    "sable",
-    "sage",
-    "shale",
-    "spruce",
-    "summit",
-    "thistle",
-    "tundra",
-    "vale",
-    "willow",
-    "wren",
-] as const;
-
-// How many base36 characters the disambiguating tail carries. Four is 1.7M values per word pair, which puts a
-// collision far past the life of any workspace, and is still short enough to be ignored while reading.
-const TAIL_LENGTH = 4;
-
-// A Uint32Array draw has 2^32 possible values. Reject the short remainder above the last full bucket before
-// dividing it into `upperBound` equal ranges; folding that remainder back with `%` makes its first few answers
-// slightly more likely, which is exactly the bias a CSPRNG is meant to avoid.
-const UINT32_RANGE = 0x1_0000_0000;
-const randomBelow = (upperBound: number): number => {
-    const bucketSize = Math.floor(UINT32_RANGE / upperBound);
-    const limit = bucketSize * upperBound;
-    while (true) {
-        const value = crypto.getRandomValues(new Uint32Array(1))[0]!;
-        if (value < limit) {
-            return Math.floor(value / bucketSize);
-        }
-    }
-};
-
-// Uniform over the array, drawn from the platform CSPRNG, `Math.random()` is seeded per process, and two
-// browser tabs opened in the same instant are exactly the case this must not produce the same name for.
-const pick = <T>(values: readonly T[]): T => values[randomBelow(values.length)]!;
-
-// Lowercase base36, one character per draw: 0-9a-z, all of which the id guard accepts.
-const tail = (): string => Array.from({ length: TAIL_LENGTH }, () => randomBelow(36).toString(36)).join("");
-
-/* A fresh conversation id: `<adjective>-<noun>-<tail>`, e.g. `swift-otter-k9m2`. Sixteen characters or so
- * against a UUID's thirty-six, and the first eleven of them are the ones a person reads. */
-export const newConversationId = (): string => `${pick(ADJECTIVES)}-${pick(NOUNS)}-${tail()}`;
-
-/* WHAT A CI FIX CONVERSATION IS CALLED, and the one id in this file that is DERIVED rather than drawn.
- *
- * It is derived because the question "has anybody already put an agent on this failure?" has to be answerable
- * from the failure alone. Nothing records that anywhere: the fleet roster IS the record (the conversation, its
- * worktree, its branch, its live status), and a roster is keyed by id, so an id nothing can re-compute is a
- * record nothing can read. This one used to carry a timestamp and a per-process counter, which made every fix
- * unfindable the moment the click was over: the board could offer "Fix with agent" and nothing else, forever,
- * however many agents were already working on the row.
- *
- * Deriving it settles a second question the same way. One failed run is now one conversation, so a second press
- * (from another tab, or from a reader who did not scroll to the state) CONTINUES the fix rather than starting a
- * rival agent on a rival branch: the daemon refuses while the turn is live, and adds a turn to the same session
- * once it is not. The old recipe made a fresh worktree every time.
- *
- * THE REPOSITORY IS IN IT because a run id belongs to one forge project, not to the workspace: two repos can
- * each have a run 42, and without the repo their failures would share a conversation. It is slugified rather
- * than hashed because this string is read by people, in `git branch` (`agent/ci-fix-web-4213`), in a path and
- * on a card, and `ci-fix-a3f91c-4213` answers the join just as well while saying nothing. Two repositories
- * whose names agree for the first REPO_SLUG_MAX characters share a slug, and would then share a fix
- * conversation for identically-numbered runs, a pairing rare enough to prefer the readable name over guarding
- * against it.
- */
-export const CI_FIX_PREFIX = "ci-fix-";
-// Leaves ~24 characters for the run id inside ConversationIdSchema's 64, which is twice the widest id either
-// forge mints.
-const REPO_SLUG_MAX = 32;
-const repoSlug = (repo: string): string =>
-    repo
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, "-")
-        .slice(0, REPO_SLUG_MAX)
-        .replace(/^-+|-+$/g, "") || "repo";
-export const ciFixConversationId = (repo: string, runId: number): string => `${CI_FIX_PREFIX}${repoSlug(repo)}-${runId}`;

package/src/credential-material.ts

@@ -1,181 +0,0 @@
-/* WHETHER A FILE ACTUALLY HOLDS A CREDENTIAL, the fact that `secrets.access` only guesses at from a path.
- *
- * The classifier next door (command-classes.ts) reads shell text, so the strongest thing it can honestly say
- * about `sed … ~/.npmrc` is "this names a file that USUALLY holds a token". Usually is not always, and the gap
- * is where the class earns its reputation: most `~/.npmrc` files are three lines of registry config, most
- * `.env` files in a monorepo are ports and feature flags, `~/.ssh/known_hosts` is a list of public keys, and a
- * file that does not exist reads nothing at all. A card raised over one of those is not a near miss, it is
- * noise, and noise is what teaches an owner to answer the card without reading it, which is precisely how a
- * real credential read gets waved through six weeks later.
- *
- * So the class is split in two. The path table says WHICH FILES ARE WORTH LOOKING AT; this says WHAT A
- * CREDENTIAL LOOKS LIKE once one has been opened. It lives here, beside that table, because the two halves are
- * one definition of the class and an enforcement point that has a filesystem should not have to invent the
- * second half for itself (guard/credential-files.ts is the sandbox's fs half; a caller with no filesystem, the
- * browser or the machine agent, simply never asks and the path stands on its name alone).
- *
- * PURE, over the file's own text: no fs, no path logic, nothing to configure. That keeps this package free of
- * a runtime the editor bundle cannot have, and keeps the rule testable as a table of strings.
- *
- * IT ANSWERS THE EASY DIRECTION WELL AND THE HARD ONE CONSERVATIVELY. Everything below is written to say YES
- * on anything credential-shaped, because a yes costs one card and a no costs the whole rule: the only use of
- * this answer is to REMOVE a class the path table already added, so a false yes leaves behavior exactly as it
- * was and a false no silently un-gates a real read.
- */
-
-/* A KEY THAT NAMES A CREDENTIAL, AND ITS VALUE. Matched as a suffix of whatever the key is spelled as, because
- * these files say the same thing a dozen ways and only the last word carries the meaning: `NPM_TOKEN`,
- * `//registry.npmjs.org/:_authToken`, `"accessToken"`, `aws_secret_access_key`, `password =`.
- *
- * The three value arms are the three ways a value is quoted across the formats this ever sees: JSON's double
- * quotes, a shell-ish dotenv's single quotes, and an ini file's bare rest-of-line.
- *
- * THE SEPARATOR MAY NOT CROSS A LINE, which is the difference between reading a file and reading a soup: with
- * `\s*` around it, an empty `GITHUB_TOKEN=` borrows the NEXT line as its value, and a dotenv of nine blank
- * placeholders reads as eight credentials. Every format here puts a value on its key's own line. */
-const CREDENTIAL_ASSIGNMENT =
-    /(?:auth[_-]?token|access[_-]?token|refresh[_-]?token|api[_-]?key|access[_-]?key|secret[_-]?key|client[_-]?secret|private[_-]?key|passwo?rd|passphrase|credentials?|secret|token|bearer)["']?[ \t]*[:=][ \t]*(?:"([^"\n]*)"|'([^'\n]*)'|([^\s"',;}\n]*))/gi;
-
-/* A VALUE THAT IS NOT A CREDENTIAL EVEN THOUGH ITS KEY SAYS IT IS: the empty one, the one still holding the
- * template's own words, and the one deferring to an environment variable or a secret reference. Every dotenv
- * that ships in a repo is made of these, and firing on `GITHUB_TOKEN=${GITHUB_TOKEN}` would put a card in front
- * of reading a file whose entire content is the absence of a secret. */
-const PLACEHOLDER =
-    /^(?:\$\{?[\w:.-]+\}?|\{\{[^}]*\}\}|<[^>]*>|%\w+%|x{3,}|\*{3,}|\.{3,}|…|(?:your|my|our|the)[-_\s].*|change[-_]?me|replace[-_]?(?:me|this|with)|todo|tbd|fixme|none|null|nil|undefined|true|false|example|placeholder|redacted|dummy|sample|test|fake|secret|password|token|value|here)$/i;
-
-/* Shorter than any credential a service actually issues. It clears the dev-compose defaults an agent reads all
- * day (`POSTGRES_PASSWORD=dev`, `password=x`), which are not what a card asking about credential material is
- * for, and it is well under the shortest real token below (a 36-character npm one). */
-const MIN_VALUE = 6;
-
-/* A CREDENTIAL RECOGNISABLE WITHOUT ITS KEY: the issuers whose tokens carry their own prefix, the PEM and PuTTY
- * headers that ARE the private key file, and a URL that carries a password in its userinfo (which is the whole
- * content of `.git-credentials`, and the shape a `DATABASE_URL` hides one in).
- *
- * These are checked first and independently of any key, because half of these files have no `key = value` in
- * them at all.
- *
- * SPLIT IN TWO because the two halves are MASKED differently (maskCredentialMaterial below) though they DETECT
- * identically: a structural shape matches a header or an authority whose surroundings must survive the mask (a
- * PEM's body is the secret, not its `-----BEGIN` line; a URL's host is not the secret), and an issued token is
- * the credential entire, wherever it turns up, with nothing around it to keep. */
-const STRUCTURAL_SHAPES = [
-    /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/,
-    /PuTTY-User-Key-File-\d/,
-    /* scheme://user:password@host — the password is the point; a Sentry DSN (`https://key@host`) has no colon
-     * before the `@` and is deliberately not this. A userinfo that is nothing but asterisks is a password
-     * somebody already masked (maskCredentialMaterial below leaves this exact shape behind), and reading it as
-     * a credential would have a masked file still answer "yes, there is one in here". */
-    /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:(?!\*+@)[^\s/@]{3,}@/i,
-];
-
-const ISSUED_TOKENS = [
-    /\bnpm_[A-Za-z0-9]{30,}/,
-    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}/,
-    /\bgithub_pat_[A-Za-z0-9_]{50,}/,
-    /\bglpat-[A-Za-z0-9_-]{16,}/,
-    /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
-    /\bsk-[A-Za-z0-9_-]{20,}/,
-    /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}/,
-    /\bAKIA[0-9A-Z]{16}\b/,
-    /\bASIA[0-9A-Z]{16}\b/,
-    /\bAIza[0-9A-Za-z_-]{35}\b/,
-    /\bhf_[A-Za-z0-9]{30,}/,
-    /\bdop_v1_[a-f0-9]{60,}/,
-    // A JWT: three base64url segments, the first two of which decode from `{"` and so always begin `ey`.
-    /\bey[A-Za-z0-9_-]{10,}\.ey[A-Za-z0-9_-]{10,}\./,
-];
-
-const TOKEN_SHAPES = [...STRUCTURAL_SHAPES, ...ISSUED_TOKENS];
-
-/* A VALUE DEFERRED TO SOMEWHERE ELSE, removed before anything is read, because it is not one value but two
- * things to get wrong. `STRIPE_SECRET={{secret:STRIPE}}` holds no credential — that is the platform's own
- * convention for a file that must not hold one — and yet it reads as a credential twice over: the outer
- * assignment has a substantial-looking value, and the reference's own `secret:STRIPE` is a second `key: value`
- * inside it. Cutting them out first is simpler and steadier than teaching the value patterns to survive them. */
-const DEFERRED_VALUE = /\{\{[^}\n]*\}\}|\$\{[^}\n]*\}/g;
-
-// Does this file's text hold something worth a card? Handed the WHOLE file by its caller, which is why the
-// caller (not this) is the one that decides how much of a large file is worth reading.
-export const holdsCredentialMaterial = (file: string): boolean => {
-    const text = file.replace(DEFERRED_VALUE, "");
-    if (TOKEN_SHAPES.some((pattern) => pattern.test(text))) {
-        return true;
-    }
-    for (const match of text.matchAll(CREDENTIAL_ASSIGNMENT)) {
-        const value = (match[1] ?? match[2] ?? match[3] ?? "").trim();
-        if (value.length >= MIN_VALUE && !PLACEHOLDER.test(value)) {
-            return true;
-        }
-    }
-    return false;
-};
-
-/* THE SAME DEFINITION APPLIED RATHER THAN ASKED: the text back with every credential in it blanked, and
- * everything else byte for byte.
- *
- * WHERE IT RUNS is what lets it be this blunt (sandbox agent/agent-redaction.ts): only over a tool result whose
- * INPUT named credential material — a Read of `.env`, a `cat ~/.npmrc`, a Grep through `~/.aws`. The name
- * heuristics that run over ARBITRARY output have to be timid, and the timidity is measured rather than
- * theoretical: matching on the key alone rewrote `oauthToken === undefined` mid-comparison and broke a JSON
- * body at `"cacheReadTokens":26170149`. This pass is pointed at a file the path table already calls a
- * credential store, where a `key = value` IS the credential and there is no prose to protect.
- *
- * IT COVERS THE HALF THE VAULT CANNOT. Value masking is exact and complete for what this sandbox STORES, and
- * blind to everything else: the project's own `.env`, a token a deploy minted an hour ago, whatever the owner
- * pasted into the repo this agent was pointed at. Those are the credentials a read actually leaks, and with
- * them blanked a read is worth about as much to a stranger as the file's key names — which is what lets the
- * command gate stop asking about READS and ask about SENDING (sandbox guard/actions.ts).
- *
- * THE MASK IS ANONYMOUS, never a `{{secret:name}}` reference. A reference is a promise that the exits resolve
- * it back to a value, and this pass is inferring from shape: minting one would put a token in the model's hands
- * that resolves to nothing, discovered when the deploy 401s. The cost is stated plainly: a file the model
- * rewrites wholesale from a masked read loses the value it was never shown. That is the same trade the terminal
- * filter has always made, and the alternative is handing the model the credential so it can copy it back.
- *
- * A PuTTY `.ppk` body is the known gap: unlike PEM it has no closing line to bound the mask, so its key
- * material survives this pass. The file still reads as credential material to everything else here, so the gate
- * still asks before a command carrying it reaches the internet. */
-const MASK = "***";
-
-// The `g` twins, built once: the tables above are written without `g` because `test` is what the detector
-// wants, and `replace`/`replaceAll` demands one.
-const globally = (patterns: readonly RegExp[]): readonly RegExp[] => patterns.map((pattern) => new RegExp(pattern.source, `${pattern.flags}g`));
-const ISSUED_TOKENS_G = globally(ISSUED_TOKENS);
-const CREDENTIAL_ASSIGNMENT_G = new RegExp(CREDENTIAL_ASSIGNMENT.source, CREDENTIAL_ASSIGNMENT.flags);
-
-/* The two structural shapes that mask to something other than themselves. A PEM's header and footer stay so the
- * model can still see WHICH key it is looking at and that a key is what it is looking at; a URL keeps its scheme,
- * user and host, because a `DATABASE_URL` with the host blanked is a connection string nobody can debug. */
-const PRIVATE_KEY_BLOCK = /(-----BEGIN ((?:[A-Z0-9]+ )*)PRIVATE KEY-----)[\s\S]*?(-----END \2PRIVATE KEY-----)/g;
-const URL_PASSWORD = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)(?!\*+@)[^\s/@]{3,}@/gi;
-
-/* A VALUE THAT OPENS A DEFERRED REFERENCE, skipped whole. The detector cuts these out before it looks
- * (DEFERRED_VALUE); masking cannot cut anything out, so it recognises the OPENER instead — and the opener is
- * what a truncated one leaves behind. `STRIPE_SECRET={{secret:STRIPE}}` is the case that matters: the bare-value
- * arm stops at the first `}`, so what reaches this test is `{{secret:STRIPE`, which no whole-value placeholder
- * pattern can match and which masking would turn into `***}}` — this workspace's own convention for a file that
- * holds no credential, silently vandalised. Anchored at the start so a generated password that merely CONTAINS
- * a `$` is still masked. */
-const DEFERRED_OPENER = /^(?:\{\{|\$)/;
-
-export const maskCredentialMaterial = (text: string): string =>
-    ISSUED_TOKENS_G.reduce((masked, token) => masked.replace(token, MASK), text)
-        .replace(PRIVATE_KEY_BLOCK, `$1\n${MASK}\n$3`)
-        .replace(URL_PASSWORD, `$1${MASK}@`)
-        /* The value of a credential-named assignment, in place, with its key, separator and quoting left
-         * standing: `GITHUB_TOKEN="***"` is a line the model can still reason about and still rewrite, where a
-         * blanked-out line is a config it cannot read at all. The skips are the detector's own — a value too
-         * short to be issued, a template's placeholder, a `${VAR}` or `{{secret:NAME}}` deferred elsewhere —
-         * so the two halves agree on what a credential is and nothing is masked that was never one. */
-        .replace(CREDENTIAL_ASSIGNMENT_G, (match, ...groups: unknown[]) => {
-            const value = (groups[0] ?? groups[1] ?? groups[2] ?? "") as string;
-            const trimmed = value.trim();
-            if (trimmed.length < MIN_VALUE || PLACEHOLDER.test(trimmed) || DEFERRED_OPENER.test(trimmed)) {
-                return match;
-            }
-            // The value is the last thing the pattern matched, so its own text locates it inside the match
-            // without the pattern having to hand back offsets.
-            const at = match.lastIndexOf(value);
-            return `${match.slice(0, at)}${MASK}${match.slice(at + value.length)}`;
-        });