@jini-ai/core 0.6.12 → 0.6.15-rc.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @jini-ai/core
 
+## 0.6.13
+
+### Patch Changes
+
+- 7479159: Tighten diagnostic identifier exemptions and ignore ordinary header values shorter than eight characters during exact-secret masking (credential headers are masked at any length; exact secrets still match inside other text but never inside a credential label, URL scheme, secret-named query parameter or existing redaction marker, so they cannot split another credential's label). Keep null tool schemas informational. Preserve safe reader refusals for explicit plugin skill/file requests and use host-formatted plugin tool pointers for relevance, deferred instructions, and supporting files (optional for automatic use; omitted when the host supplies none).
+- c31264d: Move `canonicalJson` to `@jini-ai/core/records` so packages below devops can reuse it (the infra outbox request digest). `@jini-ai/devops/dns` re-exports it unchanged.
+- 0728914: Engine guard clean-up (`pnpm guard` 106 -> 0): layer, subpath-isolation and module-state findings fixed by moving
+  shared contracts to their owners instead of reaching across domains. Additive public API: `@jini-ai/core/filesystem`
+  (guarded-reader contracts), `useFetchQueryScope` from `@jini-ai/ui` fetch-query (per-provider query scope),
+  `@jini-ai/chat/react` re-exports of the accepted-input, run-state and agent-plugin chat-state helpers. The Claude
+  filesystem probe cache in `@jini-ai/agent-runtime` is instance-owned. No behaviour change intended; host-facing
+  breaks are listed in `owner-store-to-server` and `guard-host-ports`.
+- 6ecbdb2: Add opt-in exact-only secret redaction with literal replacement markers, preserving unmatched text and existing policies.
+- 63bacc5: OpenTelemetry and Sentry observability adapters moved out of `@jini-ai/diagnostics` into the `observability-opentelemetry` and `observability-sentry` provider plugins of `@jini-ai/provider-plugins`. Removed: the `@jini-ai/diagnostics/observability/opentelemetry` and `/observability/sentry` subpaths and every `@opentelemetry/*` / `@sentry/node` dev and optional peer dependency. The OTel plugin accepts any OTLP/HTTP endpoint plus generic request headers. Packages bundled into plugin artifacts now ship their LICENSE file.
+
 ## 0.6.12
 
 ## 0.6.11

package/README.md

@@ -100,6 +100,7 @@ Tool handlers receive required execution context first and optional `{ emitSurfa
 | subpath | what's behind it |
 |---|---|
 | `./fetch` | Framework-neutral query contracts and `FetchQueryCache`; inject transport callbacks, `Clock`, scheduler and connectivity/focus ports. No React, DOM or TanStack dependency. |
+| `./records` | `canonicalJson({ value })`, async WebCrypto `canonicalArgumentDigest({ args }, { crypto? })`, and `CanonicalJsonError`; recursively sorted Unicode code-point keys, strict JSON validation, and lowercase SHA-256 hex. |
 | `.` | The public surface above: tokens, packs, daemon composition, tool registry (descriptors only), principal, redact, auth primitives. |
 | `./composition` | **Not part of the public contract.** Exposes `authorizeToolInvocation` (resolves a registry's tool and runs its authorization gate — a security-sensitive value export, but one that only ever hands back a handler alongside an `'allow'` decision) plus type-only `AnyPack`/`RequiredTokenIds`/`MissingTokenIds` re-derivation helpers. Its sole intended consumers are `@jini-ai/daemon`'s `ToolExecutor` and `@jini-ai/server`'s `createLocalNodeDaemon`. Node's resolver will happily let any consumer import it — the boundary is enforced by `scripts/check-engine-boundaries.ts`, not by the exports map — so external adopters should treat it as off-limits regardless. |
 

package/dist/approval.d.ts

@@ -127,6 +127,7 @@ export declare function createApprovalProposalStore<TDescription>({ responseTool
     }, _optional?: {}): Promise<unknown>;
 };
 /** Apply a host classification through the same handler owner used by domain plans.
+ * A host description's string `rememberKey` opts into reusable grants; descriptions remain opaque.
  * @returns The registration with one approval handler; authorization policy is preserved.
  */
 export declare function applyApprovalPolicy<TDescription>({ registration, classify, asks, describe, askHuman, notConfirmed }: {

package/dist/approval.js

@@ -1,5 +1,6 @@
 import { humanConfirmedHandler, requireInputRecord } from './registration-kit.js';
 import { ToolInputError } from './tool-registry.js';
+import { isNonArrayRecord } from './records.js';
 /** The decision reducer shared by parked tool calls and the browser's explicit reply transport.
  * An answer never revives an aborted operation. Transport failures propagate without an effect. */
 export async function resolveApproval({ signal, askHuman }, _optional = {}) {
@@ -193,12 +194,19 @@ export function createApprovalProposalStore({ responseTool, messages }, { create
     };
 }
 /** Apply a host classification through the same handler owner used by domain plans.
+ * A host description's string `rememberKey` opts into reusable grants; descriptions remain opaque.
  * @returns The registration with one approval handler; authorization policy is preserved.
  */
 export function applyApprovalPolicy({ registration, classify, asks, describe, askHuman, notConfirmed }, optional = {}) {
     return { ...registration, handler: createApprovalHandler({
             prepare: async ({ ctx }) => classify({ input: ctx.input }),
-            describe: async ({ ctx, prepared }) => ({ ask: asks({ class: prepared }), description: await describe({ ctx, class: prepared }) }),
+            describe: async ({ ctx, prepared }) => {
+                const ask = asks({ class: prepared });
+                const description = await describe({ ctx, class: prepared });
+                const candidate = { value: description };
+                return { ask, description, ...(isNonArrayRecord(candidate) && typeof candidate.value.rememberKey === 'string'
+                        ? { rememberKey: candidate.value.rememberKey } : {}) };
+            },
             askHuman, notConfirmed,
             run: ({ ctx }, options) => registration.handler(ctx, options),
         }, optional) };

package/dist/fetch/cache.d.ts

@@ -121,6 +121,8 @@ export declare class FetchQueryCache {
     activate(): void;
     dispose(): void;
     private onOnline;
+    /** Follow newer work, retaining cached data or propagating a failed cold replacement. */
+    private supersedingResult;
     private refresh;
     private publish;
     private cancelEviction;

package/dist/fetch/cache.js

@@ -81,7 +81,7 @@ export class FetchQueryCache {
         const run = () => {
             // A queued offline refresh may have been superseded before reconnection.
             if (entry.pending !== pending)
-                return (entry.pending ?? Promise.resolve(entry.state.data));
+                return this.supersedingResult({ entry });
             this.publish(entry, { ...entry.state, isFetching: true });
             return fetch();
         };
@@ -100,7 +100,7 @@ export class FetchQueryCache {
             // Only the current request may publish or clear invalidation. An older transport
             // need not support abort: its callers follow the replacement request instead.
             if (entry.pending !== pending)
-                return (entry.pending ?? entry.state.data);
+                return this.supersedingResult({ entry });
             // Arbitration and publication share this continuation: a microtask between them would
             // let an older result overwrite a replacement accepted after arbitration.
             if (replacement !== entry.replacement) {
@@ -113,7 +113,7 @@ export class FetchQueryCache {
             return value;
         }, error => {
             if (entry.pending !== pending)
-                return (entry.pending ?? entry.state.data);
+                return this.supersedingResult({ entry });
             // A replacement write is newer than this read's failure as well as its data.
             // Keep the write's timestamp and freshness; only settle the obsolete fetch flag.
             if (replacement !== entry.replacement) {
@@ -224,6 +224,14 @@ export class FetchQueryCache {
                 void this.load({ entry, fetch: observer.fetch, staleTime: observer.staleTime });
         }
     }
+    /** Follow newer work, retaining cached data or propagating a failed cold replacement. */
+    async supersedingResult({ entry }, _options = {}) {
+        if (entry.pending)
+            return entry.pending;
+        if (entry.state.data === undefined && entry.state.error !== null)
+            throw entry.state.error;
+        return entry.state.data;
+    }
     refresh(entry) {
         const observer = entry.observers.values().next().value;
         if (observer)

package/dist/filesystem.d.ts

@@ -0,0 +1,46 @@
+/** Shared guarded-reader contracts and refusal identity; native filesystem effects remain in platform. */
+/** Refusal of a malformed, denied, escaped, or over-limit file operation. */
+export declare class FsFilePathError extends Error {
+    constructor({ message }: {
+        message: string;
+    });
+}
+export interface DenyRules {
+    segments: ReadonlySet<string>;
+    filenamePatterns: readonly RegExp[];
+}
+export interface GuardedReaderLimits {
+    maxFileBytes: number;
+    binarySniffBytes: number;
+    maxListedFiles: number;
+    maxWalkDepth: number;
+    maxWalkEntries: number;
+}
+export interface GuardedFileReader {
+    resolve(required: {
+        relativePath: string;
+    }): string;
+    read(required: {
+        relativePath: string;
+    }): {
+        content: string;
+        bytes: number;
+    };
+    readBytes(required: {
+        relativePath: string;
+        maxBytes: number;
+    }): Promise<Uint8Array>;
+    list(required: Record<string, never>, optional?: {
+        relativePath?: string;
+    }): {
+        files: string[];
+        truncated: boolean;
+    };
+    isDeniedFileName(required: {
+        fileName: string;
+    }): boolean;
+    isDeniedPathSegment(required: {
+        segmentName: string;
+    }): boolean;
+}
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/filesystem.js

@@ -0,0 +1,8 @@
+/** Shared guarded-reader contracts and refusal identity; native filesystem effects remain in platform. */
+// A distinct refusal class lets tool adapters treat rejected paths/content as actionable input
+// problems instead of redacting them as an internal crash.
+/** Refusal of a malformed, denied, escaped, or over-limit file operation. */
+export class FsFilePathError extends Error {
+    constructor({ message }) { super(message); this.name = "FsFilePathError"; }
+}
+//# sourceMappingURL=filesystem.js.map

package/dist/gated-mutations/actor-identity.js

@@ -8,6 +8,7 @@ export class WorkspaceMismatchError extends Error {
 // API key acts for a delegating user. Reject mismatches before a caller persists the row.
 // This helper performs no I/O or foreign-key checks: dependent domains own read-time orphan
 // tolerance and reconciliation, rather than making identity population depend on storage.
+// A delegator is optional, but its composite reference must be complete when supplied.
 export function appendActorReference(required, optional = {}) {
     const { referencingRowWorkspaceId, actorWorkspaceId, actorId } = required;
     const { delegatedByWorkspaceId, delegatedById } = optional;
@@ -16,6 +17,11 @@ export function appendActorReference(required, optional = {}) {
             message: `actor workspace '${actorWorkspaceId}' does not match referencing row workspace '${referencingRowWorkspaceId}'`
         });
     }
+    if ((delegatedByWorkspaceId == null) !== (delegatedById == null)) {
+        throw new WorkspaceMismatchError({
+            message: 'delegator workspace and id must be provided together'
+        });
+    }
     if (delegatedByWorkspaceId != null && delegatedByWorkspaceId !== referencingRowWorkspaceId) {
         throw new WorkspaceMismatchError({
             message: `delegator workspace '${delegatedByWorkspaceId}' does not match referencing row workspace '${referencingRowWorkspaceId}'`

package/dist/records.d.ts

@@ -1,4 +1,4 @@
-/** @file Pure object-shape predicates shared by tool input readers and render-time decoders. */
+/** @file Object-shape predicates and canonical JSON shared by tool readers and request digests. */
 /** Accept any non-null object, including arrays; never sanitizes or reads properties.
  * @complexity O(1) time and space.
  * @example isRecord({ value: [] }); // true
@@ -45,4 +45,37 @@ export declare function deleteMapRecord<Key, Row extends object>({ records, key,
     key: Key;
     fields: Partial<Row>;
 }, _optional?: Record<string, never>): void;
+/** Invalid canonical JSON input. Messages never include argument contents. */
+export declare class CanonicalJsonError extends TypeError {
+    constructor(required: {
+        readonly message: string;
+    });
+}
+/**
+ * Canonical JSON: recursively sort object keys by Unicode code point, omit undefined object
+ * properties, and preserve array order. Uses JSON scalar escaping without invoking toJSON hooks.
+ * @param required.value JSON input; shared references are allowed. Does not mutate input.
+ * @throws CanonicalJsonError for non-JSON values (including array holes) and cycles.
+ * @complexity O(s + sum(k log k * l)) time for s output bytes, k keys per object and key length l;
+ * O(s * d) worst-case space for nesting depth d, including intermediate strings and recursion.
+ * @example canonicalJson({ value: { b: 1, a: 2 } }); // '{"a":2,"b":1}'
+ */
+export declare function canonicalJson(required: {
+    readonly value: unknown;
+}, _optional?: Record<string, never>): string;
+/**
+ * SHA-256 lowercase hex over canonical UTF-8 tool arguments, shared by plugins and host gates.
+ * @param required.args JSON arguments; validation completes before hashing starts.
+ * @param optional.crypto Host WebCrypto port; defaults to the runtime's global WebCrypto.
+ * @returns An asynchronous digest, usable in browsers and Node without Node imports.
+ * @throws CanonicalJsonError for invalid arguments; WebCrypto failures propagate.
+ * @complexity Canonical serialization cost plus O(s) hashing time and space for s UTF-8 bytes.
+ */
+export declare function canonicalArgumentDigest(required: {
+    readonly args: unknown;
+}, { crypto }?: {
+    readonly crypto?: {
+        readonly subtle: Pick<typeof globalThis.crypto.subtle, 'digest'>;
+    };
+}): Promise<string>;
 //# sourceMappingURL=records.d.ts.map

package/dist/records.js

@@ -1,4 +1,4 @@
-/** @file Pure object-shape predicates shared by tool input readers and render-time decoders. */
+/** @file Object-shape predicates and canonical JSON shared by tool readers and request digests. */
 /** Accept any non-null object, including arrays; never sanitizes or reads properties.
  * @complexity O(1) time and space.
  * @example isRecord({ value: [] }); // true
@@ -43,4 +43,113 @@ export function deleteMapRecord({ records, key, fields }, _optional = {}) {
     if (record && matchesRecordFields({ record, fields }))
         records.delete(key);
 }
+/** Invalid canonical JSON input. Messages never include argument contents. */
+export class CanonicalJsonError extends TypeError {
+    constructor(required) {
+        super(required.message);
+        this.name = 'CanonicalJsonError';
+    }
+}
+/** Compare Unicode code points, including astral characters; UTF-16 sort differs above U+FFFF.
+ * @complexity O(l) time and space for the combined key length l.
+ */
+function compareJsonKeys(left, right) {
+    const a = Array.from(left);
+    const b = Array.from(right);
+    for (let index = 0; index < Math.min(a.length, b.length); index++) {
+        const difference = a[index].codePointAt(0) - b[index].codePointAt(0);
+        if (difference !== 0)
+            return difference;
+    }
+    return a.length - b.length;
+}
+/** Serialize JSON scalars without JSON.stringify's lossy non-JSON fallbacks.
+ * @throws CanonicalJsonError for unsupported types or non-finite numbers.
+ * @complexity O(s) time and space for s serialized characters.
+ */
+function canonicalScalar(value) {
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return JSON.stringify(value);
+        case 'number':
+            if (Number.isFinite(value))
+                return JSON.stringify(value);
+            throw new CanonicalJsonError({ message: 'Canonical JSON requires finite numbers.' });
+        default:
+            throw new CanonicalJsonError({ message: 'Canonical JSON requires JSON values.' });
+    }
+}
+/** Serialize own enumerable JSON fields; class instances must not silently collapse to {}.
+ * @throws CanonicalJsonError for non-JSON objects or enumerable symbol keys.
+ * @complexity O(k log k * l + s) time and O(s + k * l) space, plus recursive children.
+ */
+function canonicalObject(value, ancestors) {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new CanonicalJsonError({ message: 'Canonical JSON requires plain objects or arrays.' });
+    }
+    if (Object.getOwnPropertySymbols(value).some(key => Object.prototype.propertyIsEnumerable.call(value, key))) {
+        throw new CanonicalJsonError({ message: 'Canonical JSON requires string object keys.' });
+    }
+    const record = value;
+    // Object keys are unique, so comparing their code points gives a total order here.
+    const members = Object.keys(record).sort(compareJsonKeys).flatMap(key => {
+        const child = record[key];
+        if (child === undefined)
+            return [];
+        return [`${JSON.stringify(key)}:${canonicalValue(child, ancestors)}`];
+    });
+    return `{${members.join(',')}}`;
+}
+/** Track only active ancestors: repeated references are JSON, back-edges are cycles.
+ * @throws CanonicalJsonError for cycles or non-JSON children.
+ * @complexity O(s + sum(k log k * l)) time; O(s * d) worst-case space for depth d.
+ */
+function canonicalValue(value, ancestors) {
+    if (value === null)
+        return 'null';
+    if (typeof value !== 'object')
+        return canonicalScalar(value);
+    if (ancestors.has(value))
+        throw new CanonicalJsonError({ message: 'Canonical JSON does not support cycles.' });
+    ancestors.add(value);
+    try {
+        if (!Array.isArray(value))
+            return canonicalObject(value, ancestors);
+        // Read every index: holes must fail, and a custom iterator must not change the argument order.
+        const children = [];
+        for (let index = 0; index < value.length; index++)
+            children.push(canonicalValue(value[index], ancestors));
+        return `[${children.join(',')}]`;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+/**
+ * Canonical JSON: recursively sort object keys by Unicode code point, omit undefined object
+ * properties, and preserve array order. Uses JSON scalar escaping without invoking toJSON hooks.
+ * @param required.value JSON input; shared references are allowed. Does not mutate input.
+ * @throws CanonicalJsonError for non-JSON values (including array holes) and cycles.
+ * @complexity O(s + sum(k log k * l)) time for s output bytes, k keys per object and key length l;
+ * O(s * d) worst-case space for nesting depth d, including intermediate strings and recursion.
+ * @example canonicalJson({ value: { b: 1, a: 2 } }); // '{"a":2,"b":1}'
+ */
+export function canonicalJson(required, _optional = {}) {
+    return canonicalValue(required.value, new Set());
+}
+/**
+ * SHA-256 lowercase hex over canonical UTF-8 tool arguments, shared by plugins and host gates.
+ * @param required.args JSON arguments; validation completes before hashing starts.
+ * @param optional.crypto Host WebCrypto port; defaults to the runtime's global WebCrypto.
+ * @returns An asynchronous digest, usable in browsers and Node without Node imports.
+ * @throws CanonicalJsonError for invalid arguments; WebCrypto failures propagate.
+ * @complexity Canonical serialization cost plus O(s) hashing time and space for s UTF-8 bytes.
+ */
+export async function canonicalArgumentDigest(required, { crypto = globalThis.crypto } = {}) {
+    const json = canonicalJson({ value: required.args });
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(json));
+    return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+}
 //# sourceMappingURL=records.js.map

package/dist/redact.d.ts

@@ -44,7 +44,7 @@ export declare const AGENT_FAILURE_SECRET_SHAPE_RE: RegExp;
  * Exact path SEGMENT names refused at any depth, matched case-insensitively against each segment
  * of the caller-supplied path (never a substring — a directory named `not-secrets-actually` is not
  * a match). `secrets` is the owner's explicit example: whatever a site or app tree names its
- * credentials folder (`sites/**\/secrets/`, `apps/admin/**\/secrets/`, or anywhere else), it never
+ * credentials folder (`sites/**\/secrets/`, `app/**\/secrets/`, or anywhere else), it never
  * becomes reachable through this domain. A denied segment is refused by the guarded reader
  * AND skipped entirely by the `fs_list_files` walk — its contents are never even enumerated,
  * not merely refused once named. Besides `secrets`, the set names the
@@ -76,8 +76,10 @@ export interface SecretRedactionOptions {
     redactPii?: boolean;
     /** Exact trusted registration IDs; credential patterns always take precedence. */
     diagnosticToolIds?: readonly string[];
-    /** Conservative by default; aggressive also masks bare 20+ character opaque runs. */
-    policy?: 'conservative' | 'aggressive';
+    /** Conservative by default; aggressive masks opaque runs; exact-only replaces only supplied secrets. */
+    policy?: 'conservative' | 'aggressive' | 'exact-only';
+    /** Literal replacement under exact-only. Defaults to '[REDACTED:exact_secret]'; ignored otherwise. */
+    marker?: string;
     exactSecrets?: ReadonlyArray<string | undefined | null>;
     extraPatterns?: readonly SecretRedactionPattern[];
 }
@@ -86,10 +88,11 @@ export declare const OPAQUE_TOKEN_RE: RegExp;
 export declare const NON_SECRET_TOKEN_RE: RegExp;
 /**
  * Returns `input` with every recognised secret / PII pattern replaced by a
- * `[REDACTED:<kind>]` marker. Idempotent — re-running on already redacted
+ * `[REDACTED:<kind>]` marker. Under the default policies, idempotent — re-running on already redacted
  * text only matches new tokens. Defaults to conservative; `{ policy: 'aggressive' }`
  * additionally masks bare 20+ character opaque runs. Exact secrets and extra patterns
- * are honored under either policy.
+ * are honored under either heuristic policy. Exact-only replaces only supplied secrets in one pass,
+ * preserves unmatched characters, and inserts the optional literal marker without reprocessing it.
  *
  * Empty / non-string input passes through unchanged so the caller can use
  * this as a no-op on optional fields.

package/dist/redact.js

@@ -58,7 +58,7 @@ export const AGENT_FAILURE_SECRET_SHAPE_RE = /\b(?:AIza[\w-]+|AQ\.[\w.\/-]+|sk-[
  * Exact path SEGMENT names refused at any depth, matched case-insensitively against each segment
  * of the caller-supplied path (never a substring — a directory named `not-secrets-actually` is not
  * a match). `secrets` is the owner's explicit example: whatever a site or app tree names its
- * credentials folder (`sites/**\/secrets/`, `apps/admin/**\/secrets/`, or anywhere else), it never
+ * credentials folder (`sites/**\/secrets/`, `app/**\/secrets/`, or anywhere else), it never
  * becomes reachable through this domain. A denied segment is refused by the guarded reader
  * AND skipped entirely by the `fs_list_files` walk — its contents are never even enumerated,
  * not merely refused once named. Besides `secrets`, the set names the
@@ -125,8 +125,8 @@ const PATTERNS = [
     // the value, not the literal 'Bearer ', so the marker stays readable in
     // the redacted output ("Authorization: Bearer [REDACTED:bearer_token]").
     { name: 'bearer_token', regex: /(?<=\bBearer\s+)[A-Za-z0-9._~+/-]{16,}={0,2}/g },
-    // Email addresses. Conservative enough to require a TLD-like trailer.
-    { name: 'email', regex: /\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g },
+    // Alphabetic TLDs preserve versioned package paths in error stacks (e.g. pkg@1.2.3).
+    { name: 'email', regex: /\b[\w.+-]+@(?:[\w-]+\.)+[A-Za-z]{2,}\b/g },
     // IPv4. Reject all-zero / 255.255.255.255-ish junk shapes by gating on
     // each octet being 0-255.
     {
@@ -215,10 +215,11 @@ function isMaskedValue(value) {
 }
 /**
  * Returns `input` with every recognised secret / PII pattern replaced by a
- * `[REDACTED:<kind>]` marker. Idempotent — re-running on already redacted
+ * `[REDACTED:<kind>]` marker. Under the default policies, idempotent — re-running on already redacted
  * text only matches new tokens. Defaults to conservative; `{ policy: 'aggressive' }`
  * additionally masks bare 20+ character opaque runs. Exact secrets and extra patterns
- * are honored under either policy.
+ * are honored under either heuristic policy. Exact-only replaces only supplied secrets in one pass,
+ * preserves unmatched characters, and inserts the optional literal marker without reprocessing it.
  *
  * Empty / non-string input passes through unchanged so the caller can use
  * this as a no-op on optional fields.
@@ -241,8 +242,16 @@ export function redactSecretsWithCounts({ input }, options = {}) {
         return { redacted: input, counts };
     const marker = (name) => {
         counts[name] = (counts[name] ?? 0) + 1;
+        if (options.policy === 'exact-only')
+            return options.marker ?? '[REDACTED:exact_secret]';
         return `[REDACTED:${name}]`;
     };
+    if (options.policy === 'exact-only') {
+        return {
+            redacted: redactExactSecrets({ text: input, marker, secrets: options.exactSecrets ?? [] }, { singlePass: true }),
+            counts,
+        };
+    }
     let out = redactExactSecrets({ text: input, marker, secrets: options.exactSecrets ?? [] });
     out = redactUrlCredentials({ text: out, marker });
     out = applyPatterns({ text: out, marker, patterns: credentialPatterns(options.extraPatterns ?? []) });
@@ -279,16 +288,63 @@ function applyPatterns({ text, marker, patterns }) {
     }
     return out;
 }
-/** Masks caller-supplied secrets verbatim, longest first, ignoring empty and non-string entries. */
-function redactExactSecrets({ text, marker, secrets }) {
+// Exact secrets match as substrings at any length (a secret glued into other text stays masked),
+// but never where they overlap a span the later rules depend on: a credential label in label
+// position, a secret-named URL parameter, a URL scheme, or a complete marker. As plain substrings
+// they split labels before the label rules ran (`a` inside `password=hunter2` broke the label
+// and left `hunter2` visible; `api_key` swallowed the whole `api_key=` label), and they split
+// earlier markers (`a` inside `exact_secret`, `email` inside `[REDACTED:email]`).
+const PROTECTED_SPAN_RE = new RegExp([
+    `\\b(?:${SECRET_LABELS})\\b\\s*[:=]`,
+    '\\bbearer\\s+',
+    URL_SECRET_PARAM_RE.source.slice(0, URL_SECRET_PARAM_RE.source.lastIndexOf('=') + 1),
+    URL_CREDENTIALS_RE.source.slice(0, URL_CREDENTIALS_RE.source.indexOf(')') + 1),
+    '\\[REDACTED:[^\\]]*\\]',
+    '\\[redacted\\]',
+].join('|'), 'gi');
+/** Masks caller-supplied secrets verbatim, longest first, ignoring empty and non-string entries;
+ * an occurrence overlapping a protected span is left for the label rules. */
+function redactExactSecrets({ text, marker, secrets }, options = {}) {
     const usable = [...new Set(secrets.filter((secret) => typeof secret === 'string' && secret.length > 0))].sort((a, b) => b.length - a.length);
+    if (options.singlePass) {
+        // Match the original text once: a marker can contain a supplied secret or '$' literally.
+        let out = '';
+        let cursor = 0;
+        for (const [start, end] of mergedSecretRanges({ text, secrets: usable })) {
+            out += text.slice(cursor, start) + marker('exact_secret');
+            cursor = end;
+        }
+        return out + text.slice(cursor);
+    }
     let out = text;
     for (const secret of usable) {
         const escaped = secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        out = out.replace(new RegExp(escaped, 'g'), () => marker('exact_secret'));
+        // Recomputed per secret: a longer secret's marker is protected from the shorter ones.
+        const spans = [...out.matchAll(PROTECTED_SPAN_RE)].map(({ index, 0: span }) => ({ start: index, end: index + span.length }));
+        out = out.replace(new RegExp(escaped, 'g'), (match, offset) => spans.some(({ start, end }) => offset < end && offset + match.length > start) ? match : marker('exact_secret'));
     }
     return out;
 }
+/** Every occurrence of every secret, overlapping ranges merged: with 'abc' and 'bcdef', a left-to-right
+ * alternation would replace 'abc' and leave 'def' — part of the other secret — in the output.
+ * @complexity O(s * n) indexOf scans for s secrets over n characters, plus O(r log r) for r matches. */
+function mergedSecretRanges({ text, secrets }) {
+    const ranges = [];
+    for (const secret of secrets) {
+        for (let at = text.indexOf(secret); at !== -1; at = text.indexOf(secret, at + 1))
+            ranges.push([at, at + secret.length]);
+    }
+    ranges.sort((a, b) => a[0] - b[0]);
+    const merged = [];
+    for (const [start, end] of ranges) {
+        const last = merged.at(-1);
+        if (last && start < last[1])
+            last[1] = Math.max(last[1], end);
+        else
+            merged.push([start, end]);
+    }
+    return merged;
+}
 /** URL userinfo and signed query values: credentials recognized by their URL context. */
 function redactUrlCredentials({ text, marker }) {
     return text

package/dist/settings/dictionaries/index.d.ts

@@ -14,28 +14,6 @@
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any
  * unrecognized locale.
  */
-import { SETTINGS_DIALOG_ES } from './settings-dialog.es.js';
-import { SETTINGS_DIALOG_ID } from './settings-dialog.id.js';
-import { SETTINGS_DIALOG_DE } from './settings-dialog.de.js';
-import { SETTINGS_DIALOG_ZH_CN } from './settings-dialog.zh-CN.js';
-import { SETTINGS_DIALOG_ZH_TW } from './settings-dialog.zh-TW.js';
-import { SETTINGS_DIALOG_PT_BR } from './settings-dialog.pt-BR.js';
-import { SETTINGS_DIALOG_RU } from './settings-dialog.ru.js';
-import { SETTINGS_DIALOG_FA } from './settings-dialog.fa.js';
-import { SETTINGS_DIALOG_AR } from './settings-dialog.ar.js';
-import { SETTINGS_DIALOG_JA } from './settings-dialog.ja.js';
-import { SETTINGS_DIALOG_KO } from './settings-dialog.ko.js';
-import { SETTINGS_DIALOG_PL } from './settings-dialog.pl.js';
-import { SETTINGS_DIALOG_HU } from './settings-dialog.hu.js';
-import { SETTINGS_DIALOG_FR } from './settings-dialog.fr.js';
-import { SETTINGS_DIALOG_UK } from './settings-dialog.uk.js';
-import { SETTINGS_DIALOG_TR } from './settings-dialog.tr.js';
-import { SETTINGS_DIALOG_TH } from './settings-dialog.th.js';
-import { SETTINGS_DIALOG_IT } from './settings-dialog.it.js';
-import { SETTINGS_DIALOG_HI } from './settings-dialog.hi.js';
-import { SETTINGS_DIALOG_UR } from './settings-dialog.ur.js';
-import { SETTINGS_DIALOG_BN } from './settings-dialog.bn.js';
-export { SETTINGS_DIALOG_ES, SETTINGS_DIALOG_ID, SETTINGS_DIALOG_DE, SETTINGS_DIALOG_ZH_CN, SETTINGS_DIALOG_ZH_TW, SETTINGS_DIALOG_PT_BR, SETTINGS_DIALOG_RU, SETTINGS_DIALOG_FA, SETTINGS_DIALOG_AR, SETTINGS_DIALOG_JA, SETTINGS_DIALOG_KO, SETTINGS_DIALOG_PL, SETTINGS_DIALOG_HU, SETTINGS_DIALOG_FR, SETTINGS_DIALOG_UK, SETTINGS_DIALOG_TR, SETTINGS_DIALOG_TH, SETTINGS_DIALOG_IT, SETTINGS_DIALOG_HI, SETTINGS_DIALOG_UR, SETTINGS_DIALOG_BN, };
 /** Every non-English locale this dictionary covers, keyed the same way `@jini-ai/ui`'s
  *  `SETTINGS_DIALOG_DICTIONARIES` is. */
 export declare const SETTINGS_DIALOG_DICTIONARIES: Readonly<Record<string, Record<string, string>>>;

package/dist/settings/dictionaries/index.js

@@ -35,7 +35,6 @@ import { SETTINGS_DIALOG_IT } from './settings-dialog.it.js';
 import { SETTINGS_DIALOG_HI } from './settings-dialog.hi.js';
 import { SETTINGS_DIALOG_UR } from './settings-dialog.ur.js';
 import { SETTINGS_DIALOG_BN } from './settings-dialog.bn.js';
-export { SETTINGS_DIALOG_ES, SETTINGS_DIALOG_ID, SETTINGS_DIALOG_DE, SETTINGS_DIALOG_ZH_CN, SETTINGS_DIALOG_ZH_TW, SETTINGS_DIALOG_PT_BR, SETTINGS_DIALOG_RU, SETTINGS_DIALOG_FA, SETTINGS_DIALOG_AR, SETTINGS_DIALOG_JA, SETTINGS_DIALOG_KO, SETTINGS_DIALOG_PL, SETTINGS_DIALOG_HU, SETTINGS_DIALOG_FR, SETTINGS_DIALOG_UK, SETTINGS_DIALOG_TR, SETTINGS_DIALOG_TH, SETTINGS_DIALOG_IT, SETTINGS_DIALOG_HI, SETTINGS_DIALOG_UR, SETTINGS_DIALOG_BN, };
 /** Every non-English locale this dictionary covers, keyed the same way `@jini-ai/ui`'s
  *  `SETTINGS_DIALOG_DICTIONARIES` is. */
 export const SETTINGS_DIALOG_DICTIONARIES = {

package/dist/text/sanitize-untrusted-text.d.ts

@@ -1,3 +1,4 @@
+import { type SecretRedactionOptions } from "../redact.js";
 /**
  * Strip ANSI/terminal escape sequences (CSI `ESC [ ... final-byte`, OSC `ESC ] ... BEL-or-ST`,
  * and bare ESC-prefixed bytes) plus other C0/C1 control characters from `text`. Written as an
@@ -8,6 +9,10 @@ export declare function stripControlSequences({ text }: {
     text: string;
 }): string;
 export interface SanitizeTextOptions {
+    /** Model-facing error paths keep slugs/tool IDs that would otherwise read as opaque tokens. Default false. */
+    keepIdentifiers?: boolean;
+    /** Known credentials forwarded to core's exact-secret redactor. */
+    exactSecrets?: SecretRedactionOptions['exactSecrets'];
     /** Exact IDs from trusted registration metadata, never inferred from error text or arguments.
      * Credential rules still run first; prefixes and glued suffixes are never exempted. */
     diagnosticToolIds?: readonly string[];
@@ -19,7 +24,9 @@ export interface SanitizeTextOptions {
  * length of `text` — the one function every boundary that surfaces daemon/network-derived text
  * to stderr/stdout should route through first.
  * Trusted diagnosticToolIds exempt complete IDs (including dots) only, after credential masking.
- * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes.
+ * keepIdentifiers exempts only identifier-shaped opaque runs; every other opaque run stays masked.
+ * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes,
+ * plus core's exact-secret replacements when supplied.
  */
 export declare function sanitizeUntrustedText({ text }: {
     text: string;

package/dist/text/sanitize-untrusted-text.js

@@ -97,26 +97,41 @@ const DIAGNOSTIC_TOKENS = new Set([
     'minContains', 'maxContains', 'patternProperties', 'propertyNames', 'prefixItems',
     'contentEncoding', 'contentMediaType', 'contentSchema',
 ]);
-/** Mask credentials before preserving complete trusted IDs and UPPER_SNAKE diagnostics; redact opaque spans elsewhere. */
-function redactSecretLike({ text, diagnosticToolIds }) {
-    return redactSecrets({ input: text }, { redactPii: false })
+/** Short lowercase slugs with at least one letter-only segment and two separators.
+ * Bound both segments and total length so long passphrases do not become diagnostic exemptions.
+ * UUIDs, numeric-only runs, mixed case and letter+digit segments never qualify.
+ * @complexity O(n) in token length; pure. */
+function isIdentifierShaped({ token }) {
+    return token.length <= 31 && /[a-z]/.test(token)
+        && /^(?:[a-z]{1,15}|[0-9]{1,15})(?:[-_](?:[a-z]{1,15}|[0-9]{1,15})){2,}$/.test(token);
+}
+/** Mask credentials before preserving trusted IDs and UPPER_SNAKE diagnostics; redact opaque spans elsewhere.
+ * `keepIdentifiers` additionally exempts identifier-shaped runs (see {@link isIdentifierShaped}).
+ * @complexity Local scans of text plus core's exact-secret replacements; no I/O. */
+function redactSecretLike({ text }, options = {}) {
+    const diagnosticToolIds = new Set(options.diagnosticToolIds);
+    const keepOpaque = (match) => NON_SECRET_TOKEN_RE.test(match) || DIAGNOSTIC_TOKENS.has(match)
+        || (options.keepIdentifiers === true && isIdentifierShaped({ token: match }));
+    return redactSecrets({ input: text }, { redactPii: false, exactSecrets: options.exactSecrets ?? [] })
         .replace(LABELED_SECRET_RE, match => match.replace(/([:=]\s*)\S+$/, '$1[redacted]'))
         .replace(/\[REDACTED:[^\]\r\n]+\]/g, '[redacted]')
         // Trust whole dotted IDs so their components cannot become a general redaction bypass.
         .replace(/[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/g, token => diagnosticToolIds.has(token) ? token
-        : token.replace(OPAQUE_TOKEN_RE, match => NON_SECRET_TOKEN_RE.test(match) || DIAGNOSTIC_TOKENS.has(match) ? match : '[redacted]'));
+        : token.replace(OPAQUE_TOKEN_RE, match => keepOpaque(match) ? match : '[redacted]'));
 }
 /**
  * Strip terminal control sequences, redact anything that looks like a secret, and cap the
  * length of `text` — the one function every boundary that surfaces daemon/network-derived text
  * to stderr/stdout should route through first.
  * Trusted diagnosticToolIds exempt complete IDs (including dots) only, after credential masking.
- * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes.
+ * keepIdentifiers exempts only identifier-shaped opaque runs; every other opaque run stays masked.
+ * @complexity O(n + t) local time/space for n text bytes and t trusted ID bytes,
+ * plus core's exact-secret replacements when supplied.
  */
 export function sanitizeUntrustedText({ text }, options = {}) {
     const requestedLength = options.maxLength ?? DEFAULT_MAX_EXCERPT_LENGTH;
     const maxLength = Number.isFinite(requestedLength) ? Math.max(0, Math.floor(requestedLength)) : DEFAULT_MAX_EXCERPT_LENGTH;
-    const sanitized = redactSecretLike({ text: stripControlSequences({ text }), diagnosticToolIds: new Set(options.diagnosticToolIds) });
+    const sanitized = redactSecretLike({ text: stripControlSequences({ text }) }, options);
     if (sanitized.length <= maxLength)
         return sanitized;
     // The marker is part of the output budget, including when the budget cannot fit the full marker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/core",
-  "version": "0.6.12",
+  "version": "0.6.15-rc.2",
   "description": "The Jini kernel: typed DI tokens, pack composition and lifecycle, the tool registry, redaction, and origin/API-token auth primitives. Zero dependencies.",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,8 @@
       "./text": "universal",
       "./settings": "universal",
       "./settings/express": "node",
-      "./plugin-directory": "universal"
+      "./plugin-directory": "universal",
+      "./filesystem": "universal"
     },
     "isolation": {
       "entries": {
@@ -155,6 +156,11 @@
       "types": "./plugin-directory.d.ts",
       "import": "./plugin-directory.js",
       "default": "./plugin-directory.js"
+    },
+    "./filesystem": {
+      "types": "./dist/filesystem.d.ts",
+      "import": "./dist/filesystem.js",
+      "default": "./dist/filesystem.js"
     }
   },
   "files": [