@jini-ai/core 0.6.12 → 0.6.15-rc.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @jini-ai/core
 
+## 0.6.13
+
+### Patch Changes
+
+- 7479159: Tighten diagnostic identifier exemptions and ignore ordinary header values shorter than eight characters during exact-secret masking (credential headers are masked at any length; exact secrets still match inside other text but never inside a credential label, URL scheme, secret-named query parameter or existing redaction marker, so they cannot split another credential's label). Keep null tool schemas informational. Preserve safe reader refusals for explicit plugin skill/file requests and use host-formatted plugin tool pointers for relevance, deferred instructions, and supporting files (optional for automatic use; omitted when the host supplies none).
+- c31264d: Move `canonicalJson` to `@jini-ai/core/records` so packages below devops can reuse it (the infra outbox request digest). `@jini-ai/devops/dns` re-exports it unchanged.
+- 0728914: Engine guard clean-up (`pnpm guard` 106 -> 0): layer, subpath-isolation and module-state findings fixed by moving
+  shared contracts to their owners instead of reaching across domains. Additive public API: `@jini-ai/core/filesystem`
+  (guarded-reader contracts), `useFetchQueryScope` from `@jini-ai/ui` fetch-query (per-provider query scope),
+  `@jini-ai/chat/react` re-exports of the accepted-input, run-state and agent-plugin chat-state helpers. The Claude
+  filesystem probe cache in `@jini-ai/agent-runtime` is instance-owned. No behaviour change intended; host-facing
+  breaks are listed in `owner-store-to-server` and `guard-host-ports`.
+- 6ecbdb2: Add opt-in exact-only secret redaction with literal replacement markers, preserving unmatched text and existing policies.
+- 63bacc5: OpenTelemetry and Sentry observability adapters moved out of `@jini-ai/diagnostics` into the `observability-opentelemetry` and `observability-sentry` provider plugins of `@jini-ai/provider-plugins`. Removed: the `@jini-ai/diagnostics/observability/opentelemetry` and `/observability/sentry` subpaths and every `@opentelemetry/*` / `@sentry/node` dev and optional peer dependency. The OTel plugin accepts any OTLP/HTTP endpoint plus generic request headers. Packages bundled into plugin artifacts now ship their LICENSE file.
+
 ## 0.6.12
 
 ## 0.6.11

package/dist/approval.d.ts

@@ -127,6 +127,7 @@ export declare function createApprovalProposalStore<TDescription>({ responseTool
     }, _optional?: {}): Promise<unknown>;
 };
 /** Apply a host classification through the same handler owner used by domain plans.
+ * A host description's string `rememberKey` opts into reusable grants; descriptions remain opaque.
  * @returns The registration with one approval handler; authorization policy is preserved.
  */
 export declare function applyApprovalPolicy<TDescription>({ registration, classify, asks, describe, askHuman, notConfirmed }: {

package/dist/approval.js

@@ -1,5 +1,6 @@
 import { humanConfirmedHandler, requireInputRecord } from './registration-kit.js';
 import { ToolInputError } from './tool-registry.js';
+import { isNonArrayRecord } from './records.js';
 /** The decision reducer shared by parked tool calls and the browser's explicit reply transport.
  * An answer never revives an aborted operation. Transport failures propagate without an effect. */
 export async function resolveApproval({ signal, askHuman }, _optional = {}) {
@@ -193,12 +194,19 @@ export function createApprovalProposalStore({ responseTool, messages }, { create
     };
 }
 /** Apply a host classification through the same handler owner used by domain plans.
+ * A host description's string `rememberKey` opts into reusable grants; descriptions remain opaque.
  * @returns The registration with one approval handler; authorization policy is preserved.
  */
 export function applyApprovalPolicy({ registration, classify, asks, describe, askHuman, notConfirmed }, optional = {}) {
     return { ...registration, handler: createApprovalHandler({
             prepare: async ({ ctx }) => classify({ input: ctx.input }),
-            describe: async ({ ctx, prepared }) => ({ ask: asks({ class: prepared }), description: await describe({ ctx, class: prepared }) }),
+            describe: async ({ ctx, prepared }) => {
+                const ask = asks({ class: prepared });
+                const description = await describe({ ctx, class: prepared });
+                const candidate = { value: description };
+                return { ask, description, ...(isNonArrayRecord(candidate) && typeof candidate.value.rememberKey === 'string'
+                        ? { rememberKey: candidate.value.rememberKey } : {}) };
+            },
             askHuman, notConfirmed,
             run: ({ ctx }, options) => registration.handler(ctx, options),
         }, optional) };

package/dist/fetch/cache.d.ts

@@ -121,6 +121,8 @@ export declare class FetchQueryCache {
     activate(): void;
     dispose(): void;
     private onOnline;
+    /** Follow newer work, retaining cached data or propagating a failed cold replacement. */
+    private supersedingResult;
     private refresh;
     private publish;
     private cancelEviction;

package/dist/fetch/cache.js

@@ -81,7 +81,7 @@ export class FetchQueryCache {
         const run = () => {
             // A queued offline refresh may have been superseded before reconnection.
             if (entry.pending !== pending)
-                return (entry.pending ?? Promise.resolve(entry.state.data));
+                return this.supersedingResult({ entry });
             this.publish(entry, { ...entry.state, isFetching: true });
             return fetch();
         };
@@ -100,7 +100,7 @@ export class FetchQueryCache {
             // Only the current request may publish or clear invalidation. An older transport
             // need not support abort: its callers follow the replacement request instead.
             if (entry.pending !== pending)
-                return (entry.pending ?? entry.state.data);
+                return this.supersedingResult({ entry });
             // Arbitration and publication share this continuation: a microtask between them would
             // let an older result overwrite a replacement accepted after arbitration.
             if (replacement !== entry.replacement) {
@@ -113,7 +113,7 @@ export class FetchQueryCache {
             return value;
         }, error => {
             if (entry.pending !== pending)
-                return (entry.pending ?? entry.state.data);
+                return this.supersedingResult({ entry });
             // A replacement write is newer than this read's failure as well as its data.
             // Keep the write's timestamp and freshness; only settle the obsolete fetch flag.
             if (replacement !== entry.replacement) {
@@ -224,6 +224,14 @@ export class FetchQueryCache {
                 void this.load({ entry, fetch: observer.fetch, staleTime: observer.staleTime });
         }
     }
+    /** Follow newer work, retaining cached data or propagating a failed cold replacement. */
+    async supersedingResult({ entry }, _options = {}) {
+        if (entry.pending)
+            return entry.pending;
+        if (entry.state.data === undefined && entry.state.error !== null)
+            throw entry.state.error;
+        return entry.state.data;
+    }
     refresh(entry) {
         const observer = entry.observers.values().next().value;
         if (observer)

package/dist/filesystem.d.ts

@@ -0,0 +1,46 @@
+/** Shared guarded-reader contracts and refusal identity; native filesystem effects remain in platform. */
+/** Refusal of a malformed, denied, escaped, or over-limit file operation. */
+export declare class FsFilePathError extends Error {
+    constructor({ message }: {
+        message: string;
+    });
+}
+export interface DenyRules {
+    segments: ReadonlySet<string>;
+    filenamePatterns: readonly RegExp[];
+}
+export interface GuardedReaderLimits {
+    maxFileBytes: number;
+    binarySniffBytes: number;
+    maxListedFiles: number;
+    maxWalkDepth: number;
+    maxWalkEntries: number;
+}
+export interface GuardedFileReader {
+    resolve(required: {
+        relativePath: string;
+    }): string;
+    read(required: {
+        relativePath: string;
+    }): {
+        content: string;
+        bytes: number;
+    };
+    readBytes(required: {
+        relativePath: string;
+        maxBytes: number;
+    }): Promise<Uint8Array>;
+    list(required: Record<string, never>, optional?: {
+        relativePath?: string;
+    }): {
+        files: string[];
+        truncated: boolean;
+    };
+    isDeniedFileName(required: {
+        fileName: string;
+    }): boolean;
+    isDeniedPathSegment(required: {
+        segmentName: string;
+    }): boolean;
+}
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/filesystem.js

@@ -0,0 +1,8 @@
+/** Shared guarded-reader contracts and refusal identity; native filesystem effects remain in platform. */
+// A distinct refusal class lets tool adapters treat rejected paths/content as actionable input
+// problems instead of redacting them as an internal crash.
+/** Refusal of a malformed, denied, escaped, or over-limit file operation. */
+export class FsFilePathError extends Error {
+    constructor({ message }) { super(message); this.name = "FsFilePathError"; }
+}
+//# sourceMappingURL=filesystem.js.map

package/dist/gated-mutations/actor-identity.js

@@ -8,6 +8,7 @@ export class WorkspaceMismatchError extends Error {
 // API key acts for a delegating user. Reject mismatches before a caller persists the row.
 // This helper performs no I/O or foreign-key checks: dependent domains own read-time orphan
 // tolerance and reconciliation, rather than making identity population depend on storage.
+// A delegator is optional, but its composite reference must be complete when supplied.
 export function appendActorReference(required, optional = {}) {
     const { referencingRowWorkspaceId, actorWorkspaceId, actorId } = required;
     const { delegatedByWorkspaceId, delegatedById } = optional;
@@ -16,6 +17,11 @@ export function appendActorReference(required, optional = {}) {
             message: `actor workspace '${actorWorkspaceId}' does not match referencing row workspace '${referencingRowWorkspaceId}'`
         });
     }
+    if ((delegatedByWorkspaceId == null) !== (delegatedById == null)) {
+        throw new WorkspaceMismatchError({
+            message: 'delegator workspace and id must be provided together'
+        });
+    }
     if (delegatedByWorkspaceId != null && delegatedByWorkspaceId !== referencingRowWorkspaceId) {
         throw new WorkspaceMismatchError({
             message: `delegator workspace '${delegatedByWorkspaceId}' does not match referencing row workspace '${referencingRowWorkspaceId}'`

package/dist/records.d.ts

@@ -45,4 +45,14 @@ export declare function deleteMapRecord<Key, Row extends object>({ records, key,
     key: Key;
     fields: Partial<Row>;
 }, _optional?: Record<string, never>): void;
+/**
+ * Canonical JSON: object keys sorted, `undefined` members dropped, array order kept, so equal
+ * JSON-like values serialize identically regardless of key order (fingerprints, request digests).
+ * Objects serialize by own enumerable keys only, so a Date or Map becomes `{}`: pass JSON-like values.
+ * @complexity O(n log n) time over n object keys, O(n) space.
+ * @example canonicalJson({ value: { b: 1, a: 2 } }); // '{"a":2,"b":1}'
+ */
+export declare function canonicalJson(required: {
+    readonly value: unknown;
+}, _optional?: {}): string;
 //# sourceMappingURL=records.d.ts.map

package/dist/records.js

@@ -43,4 +43,23 @@ export function deleteMapRecord({ records, key, fields }, _optional = {}) {
     if (record && matchesRecordFields({ record, fields }))
         records.delete(key);
 }
+/**
+ * Canonical JSON: object keys sorted, `undefined` members dropped, array order kept, so equal
+ * JSON-like values serialize identically regardless of key order (fingerprints, request digests).
+ * Objects serialize by own enumerable keys only, so a Date or Map becomes `{}`: pass JSON-like values.
+ * @complexity O(n log n) time over n object keys, O(n) space.
+ * @example canonicalJson({ value: { b: 1, a: 2 } }); // '{"a":2,"b":1}'
+ */
+export function canonicalJson(required, _optional = {}) {
+    const { value } = required;
+    if (Array.isArray(value))
+        return `[${value.map(item => canonicalJson({ value: item })).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        const record = value;
+        const members = Object.keys(record).filter(key => record[key] !== undefined).sort()
+            .map(key => `${JSON.stringify(key)}:${canonicalJson({ value: record[key] })}`);
+        return `{${members.join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
 //# sourceMappingURL=records.js.map

package/dist/redact.d.ts

@@ -44,7 +44,7 @@ export declare const AGENT_FAILURE_SECRET_SHAPE_RE: RegExp;
  * Exact path SEGMENT names refused at any depth, matched case-insensitively against each segment
  * of the caller-supplied path (never a substring — a directory named `not-secrets-actually` is not
  * a match). `secrets` is the owner's explicit example: whatever a site or app tree names its
- * credentials folder (`sites/**\/secrets/`, `apps/admin/**\/secrets/`, or anywhere else), it never
+ * credentials folder (`sites/**\/secrets/`, `app/**\/secrets/`, or anywhere else), it never
  * becomes reachable through this domain. A denied segment is refused by the guarded reader
  * AND skipped entirely by the `fs_list_files` walk — its contents are never even enumerated,
  * not merely refused once named. Besides `secrets`, the set names the
@@ -76,8 +76,10 @@ export interface SecretRedactionOptions {
     redactPii?: boolean;
     /** Exact trusted registration IDs; credential patterns always take precedence. */
     diagnosticToolIds?: readonly string[];
-    /** Conservative by default; aggressive also masks bare 20+ character opaque runs. */
-    policy?: 'conservative' | 'aggressive';
+    /** Conservative by default; aggressive masks opaque runs; exact-only replaces only supplied secrets. */
+    policy?: 'conservative' | 'aggressive' | 'exact-only';
+    /** Literal replacement under exact-only. Defaults to '[REDACTED:exact_secret]'; ignored otherwise. */
+    marker?: string;
     exactSecrets?: ReadonlyArray<string | undefined | null>;
     extraPatterns?: readonly SecretRedactionPattern[];
 }
@@ -86,10 +88,11 @@ export declare const OPAQUE_TOKEN_RE: RegExp;
 export declare const NON_SECRET_TOKEN_RE: RegExp;
 /**
  * Returns `input` with every recognised secret / PII pattern replaced by a
- * `[REDACTED:<kind>]` marker. Idempotent — re-running on already redacted
+ * `[REDACTED:<kind>]` marker. Under the default policies, idempotent — re-running on already redacted
  * text only matches new tokens. Defaults to conservative; `{ policy: 'aggressive' }`
  * additionally masks bare 20+ character opaque runs. Exact secrets and extra patterns
- * are honored under either policy.
+ * are honored under either heuristic policy. Exact-only replaces only supplied secrets in one pass,
+ * preserves unmatched characters, and inserts the optional literal marker without reprocessing it.
  *
  * Empty / non-string input passes through unchanged so the caller can use
  * this as a no-op on optional fields.

package/dist/redact.js

@@ -58,7 +58,7 @@ export const AGENT_FAILURE_SECRET_SHAPE_RE = /\b(?:AIza[\w-]+|AQ\.[\w.\/-]+|sk-[
  * Exact path SEGMENT names refused at any depth, matched case-insensitively against each segment
  * of the caller-supplied path (never a substring — a directory named `not-secrets-actually` is not
  * a match). `secrets` is the owner's explicit example: whatever a site or app tree names its
- * credentials folder (`sites/**\/secrets/`, `apps/admin/**\/secrets/`, or anywhere else), it never
+ * credentials folder (`sites/**\/secrets/`, `app/**\/secrets/`, or anywhere else), it never
  * becomes reachable through this domain. A denied segment is refused by the guarded reader
  * AND skipped entirely by the `fs_list_files` walk — its contents are never even enumerated,
  * not merely refused once named. Besides `secrets`, the set names the
@@ -125,8 +125,8 @@ const PATTERNS = [
     // the value, not the literal 'Bearer ', so the marker stays readable in
     // the redacted output ("Authorization: Bearer [REDACTED:bearer_token]").
     { name: 'bearer_token', regex: /(?<=\bBearer\s+)[A-Za-z0-9._~+/-]{16,}={0,2}/g },
-    // Email addresses. Conservative enough to require a TLD-like trailer.
-    { name: 'email', regex: /\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g },
+    // Alphabetic TLDs preserve versioned package paths in error stacks (e.g. pkg@1.2.3).
+    { name: 'email', regex: /\b[\w.+-]+@(?:[\w-]+\.)+[A-Za-z]{2,}\b/g },
     // IPv4. Reject all-zero / 255.255.255.255-ish junk shapes by gating on
     // each octet being 0-255.
     {
@@ -215,10 +215,11 @@ function isMaskedValue(value) {
 }
 /**
  * Returns `input` with every recognised secret / PII pattern replaced by a
- * `[REDACTED:<kind>]` marker. Idempotent — re-running on already redacted
+ * `[REDACTED:<kind>]` marker. Under the default policies, idempotent — re-running on already redacted
  * text only matches new tokens. Defaults to conservative; `{ policy: 'aggressive' }`
  * additionally masks bare 20+ character opaque runs. Exact secrets and extra patterns
- * are honored under either policy.
+ * are honored under either heuristic policy. Exact-only replaces only supplied secrets in one pass,
+ * preserves unmatched characters, and inserts the optional literal marker without reprocessing it.
  *
  * Empty / non-string input passes through unchanged so the caller can use
  * this as a no-op on optional fields.
@@ -241,8 +242,16 @@ export function redactSecretsWithCounts({ input }, options = {}) {
         return { redacted: input, counts };
     const marker = (name) => {
         counts[name] = (counts[name] ?? 0) + 1;
+        if (options.policy === 'exact-only')
+            return options.marker ?? '[REDACTED:exact_secret]';
         return `[REDACTED:${name}]`;
     };
+    if (options.policy === 'exact-only') {
+        return {
+            redacted: redactExactSecrets({ text: input, marker, secrets: options.exactSecrets ?? [] }, { singlePass: true }),
+            counts,
+        };
+    }
     let out = redactExactSecrets({ text: input, marker, secrets: options.exactSecrets ?? [] });
     out = redactUrlCredentials({ text: out, marker });
     out = applyPatterns({ text: out, marker, patterns: credentialPatterns(options.extraPatterns ?? []) });
@@ -279,16 +288,63 @@ function applyPatterns({ text, marker, patterns }) {
     }
     return out;
 }
-/** Masks caller-supplied secrets verbatim, longest first, ignoring empty and non-string entries. */
-function redactExactSecrets({ text, marker, secrets }) {
+// Exact secrets match as substrings at any length (a secret glued into other text stays masked),
+// but never where they overlap a span the later rules depend on: a credential label in label
+// position, a secret-named URL parameter, a URL scheme, or a complete marker. As plain substrings
+// they split labels before the label rules ran (`a` inside `password=hunter2` broke the label
+// and left `hunter2` visible; `api_key` swallowed the whole `api_key=` label), and they split
+// earlier markers (`a` inside `exact_secret`, `email` inside `[REDACTED:email]`).
+const PROTECTED_SPAN_RE = new RegExp([
+    `\\b(?:${SECRET_LABELS})\\b\\s*[:=]`,
+    '\\bbearer\\s+',
+    URL_SECRET_PARAM_RE.source.slice(0, URL_SECRET_PARAM_RE.source.lastIndexOf('=') + 1),
+    URL_CREDENTIALS_RE.source.slice(0, URL_CREDENTIALS_RE.source.indexOf(')') + 1),
+    '\\[REDACTED:[^\\]]*\\]',
+    '\\[redacted\\]',
+].join('|'), 'gi');
+/** Masks caller-supplied secrets verbatim, longest first, ignoring empty and non-string entries;
+ * an occurrence overlapping a protected span is left for the label rules. */
+function redactExactSecrets({ text, marker, secrets }, options = {}) {
     const usable = [...new Set(secrets.filter((secret) => typeof secret === 'string' && secret.length > 0))].sort((a, b) => b.length - a.length);
+    if (options.singlePass) {
+        // Match the original text once: a marker can contain a supplied secret or '$' literally.
+        let out = '';
+        let cursor = 0;
+        for (const [start, end] of mergedSecretRanges({ text, secrets: usable })) {
+            out += text.slice(cursor, start) + marker('exact_secret');
+            cursor = end;
+        }
+        return out + text.slice(cursor);
+    }
     let out = text;
     for (const secret of usable) {
         const escaped = secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        out = out.replace(new RegExp(escaped, 'g'), () => marker('exact_secret'));
+        // Recomputed per secret: a longer secret's marker is protected from the shorter ones.
+        const spans = [...out.matchAll(PROTECTED_SPAN_RE)].map(({ index, 0: span }) => ({ start: index, end: index + span.length }));
+        out = out.replace(new RegExp(escaped, 'g'), (match, offset) => spans.some(({ start, end }) => offset < end && offset + match.length > start) ? match : marker('exact_secret'));
     }
     return out;
 }
+/** Every occurrence of every secret, overlapping ranges merged: with 'abc' and 'bcdef', a left-to-right
+ * alternation would replace 'abc' and leave 'def' — part of the other secret — in the output.
+ * @complexity O(s * n) indexOf scans for s secrets over n characters, plus O(r log r) for r matches. */
+function mergedSecretRanges({ text, secrets }) {
+    const ranges = [];
+    for (const secret of secrets) {
+        for (let at = text.indexOf(secret); at !== -1; at = text.indexOf(secret, at + 1))
+            ranges.push([at, at + secret.length]);
+    }
+    ranges.sort((a, b) => a[0] - b[0]);
+    const merged = [];
+    for (const [start, end] of ranges) {
+        const last = merged.at(-1);
+        if (last && start < last[1])
+            last[1] = Math.max(last[1], end);
+        else
+            merged.push([start, end]);
+    }
+    return merged;
+}
 /** URL userinfo and signed query values: credentials recognized by their URL context. */
 function redactUrlCredentials({ text, marker }) {
     return text

package/dist/text/sanitize-untrusted-text.d.ts

@@ -1,3 +1,4 @@
+import { type SecretRedactionOptions } from "../redact.js";
 /**
  * Strip ANSI/terminal escape sequences (CSI `ESC [ ... final-byte`, OSC `ESC ] ... BEL-or-ST`,
  * and bare ESC-prefixed bytes) plus other C0/C1 control characters from `text`. Written as an
@@ -8,6 +9,10 @@ export declare function stripControlSequences({ text }: {
     text: string;
 }): string;
 export interface SanitizeTextOptions {
+    /** Model-facing error paths keep slugs/tool IDs that would otherwise read as opaque tokens. Default false. */
+    keepIdentifiers?: boolean;
+    /** Known credentials forwarded to core's exact-secret redactor. */
+    exactSecrets?: SecretRedactionOptions['exactSecrets'];
     /** Exact IDs from trusted registration metadata, never inferred from error text or arguments.
      * Credential rules still run first; prefixes and glued suffixes are never exempted. */
     diagnosticToolIds?: readonly string[];
@@ -19,7 +24,9 @@ export interface SanitizeTextOptions {
  * length of `text` — the one function every boundary that surfaces daemon/network-derived text
  * to stderr/stdout should route through first.
  * Trusted diagnosticToolIds exempt complete IDs (including dots) only, after credential masking.
- * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes.
+ * keepIdentifiers exempts only identifier-shaped opaque runs; every other opaque run stays masked.
+ * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes,
+ * plus core's exact-secret replacements when supplied.
  */
 export declare function sanitizeUntrustedText({ text }: {
     text: string;

package/dist/text/sanitize-untrusted-text.js

@@ -97,26 +97,41 @@ const DIAGNOSTIC_TOKENS = new Set([
     'minContains', 'maxContains', 'patternProperties', 'propertyNames', 'prefixItems',
     'contentEncoding', 'contentMediaType', 'contentSchema',
 ]);
-/** Mask credentials before preserving complete trusted IDs and UPPER_SNAKE diagnostics; redact opaque spans elsewhere. */
-function redactSecretLike({ text, diagnosticToolIds }) {
-    return redactSecrets({ input: text }, { redactPii: false })
+/** Short lowercase slugs with at least one letter-only segment and two separators.
+ * Bound both segments and total length so long passphrases do not become diagnostic exemptions.
+ * UUIDs, numeric-only runs, mixed case and letter+digit segments never qualify.
+ * @complexity O(n) in token length; pure. */
+function isIdentifierShaped({ token }) {
+    return token.length <= 31 && /[a-z]/.test(token)
+        && /^(?:[a-z]{1,15}|[0-9]{1,15})(?:[-_](?:[a-z]{1,15}|[0-9]{1,15})){2,}$/.test(token);
+}
+/** Mask credentials before preserving trusted IDs and UPPER_SNAKE diagnostics; redact opaque spans elsewhere.
+ * `keepIdentifiers` additionally exempts identifier-shaped runs (see {@link isIdentifierShaped}).
+ * @complexity Local scans of text plus core's exact-secret replacements; no I/O. */
+function redactSecretLike({ text }, options = {}) {
+    const diagnosticToolIds = new Set(options.diagnosticToolIds);
+    const keepOpaque = (match) => NON_SECRET_TOKEN_RE.test(match) || DIAGNOSTIC_TOKENS.has(match)
+        || (options.keepIdentifiers === true && isIdentifierShaped({ token: match }));
+    return redactSecrets({ input: text }, { redactPii: false, exactSecrets: options.exactSecrets ?? [] })
         .replace(LABELED_SECRET_RE, match => match.replace(/([:=]\s*)\S+$/, '$1[redacted]'))
         .replace(/\[REDACTED:[^\]\r\n]+\]/g, '[redacted]')
         // Trust whole dotted IDs so their components cannot become a general redaction bypass.
         .replace(/[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/g, token => diagnosticToolIds.has(token) ? token
-        : token.replace(OPAQUE_TOKEN_RE, match => NON_SECRET_TOKEN_RE.test(match) || DIAGNOSTIC_TOKENS.has(match) ? match : '[redacted]'));
+        : token.replace(OPAQUE_TOKEN_RE, match => keepOpaque(match) ? match : '[redacted]'));
 }
 /**
  * Strip terminal control sequences, redact anything that looks like a secret, and cap the
  * length of `text` — the one function every boundary that surfaces daemon/network-derived text
  * to stderr/stdout should route through first.
  * Trusted diagnosticToolIds exempt complete IDs (including dots) only, after credential masking.
- * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes.
+ * keepIdentifiers exempts only identifier-shaped opaque runs; every other opaque run stays masked.
+ * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes,
+ * plus core's exact-secret replacements when supplied.
  */
 export function sanitizeUntrustedText({ text }, options = {}) {
     const requestedLength = options.maxLength ?? DEFAULT_MAX_EXCERPT_LENGTH;
     const maxLength = Number.isFinite(requestedLength) ? Math.max(0, Math.floor(requestedLength)) : DEFAULT_MAX_EXCERPT_LENGTH;
-    const sanitized = redactSecretLike({ text: stripControlSequences({ text }), diagnosticToolIds: new Set(options.diagnosticToolIds) });
+    const sanitized = redactSecretLike({ text: stripControlSequences({ text }) }, options);
     if (sanitized.length <= maxLength)
         return sanitized;
     // The marker is part of the output budget, including when the budget cannot fit the full marker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/core",
-  "version": "0.6.12",
+  "version": "0.6.15-rc.1",
   "description": "The Jini kernel: typed DI tokens, pack composition and lifecycle, the tool registry, redaction, and origin/API-token auth primitives. Zero dependencies.",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,8 @@
       "./text": "universal",
       "./settings": "universal",
       "./settings/express": "node",
-      "./plugin-directory": "universal"
+      "./plugin-directory": "universal",
+      "./filesystem": "universal"
     },
     "isolation": {
       "entries": {
@@ -155,6 +156,11 @@
       "types": "./plugin-directory.d.ts",
       "import": "./plugin-directory.js",
       "default": "./plugin-directory.js"
+    },
+    "./filesystem": {
+      "types": "./dist/filesystem.d.ts",
+      "import": "./dist/filesystem.js",
+      "default": "./dist/filesystem.js"
     }
   },
   "files": [