@khanglvm/outline-cli 0.1.3 → 0.1.5

package/src/cli.js

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import path from "node:path";
+import { createRequire } from "node:module";
 import { getAgentSkillHelp, getQuickStartAgentHelp, listHelpSections } from "./agent-skills.js";
 import {
   buildProfile,
@@ -21,9 +22,12 @@ import {
   removeProfileFromKeychain,
   secureProfileForStorage,
 } from "./secure-keyring.js";
-import { getToolContract, invokeTool, listTools } from "./tools.js";
+import { getToolContract, invokeTool, listTools, resolveToolInvocation } from "./tools.js";
 import { mapLimit, parseJsonArg, parseCsv, toInteger } from "./utils.js";
 
+const require = createRequire(import.meta.url);
+const { version: packageVersion } = require("../package.json");
+
 function configureSharedOutputOptions(command) {
   return command
     .option("--config <path>", "Config file path", defaultConfigPath())
@@ -44,23 +48,6 @@ function buildStoreFromOptions(opts) {
   });
 }
 
-async function getRuntime(opts, overrideProfileId) {
-  const configPath = path.resolve(opts.config || defaultConfigPath());
-  const config = await loadConfig(configPath);
-  const selectedProfile = getProfile(config, overrideProfileId || opts.profile);
-  const profile = hydrateProfileFromKeychain({
-    configPath,
-    profile: selectedProfile,
-  });
-  const client = new OutlineClient(profile);
-  return {
-    configPath,
-    config,
-    profile,
-    client,
-  };
-}
-
 function parseHeaders(input) {
   if (!input) {
     return {};
@@ -79,6 +66,130 @@ function parseHeaders(input) {
   return headers;
 }
 
+function isBrokenPipeError(err) {
+  return err?.code === "EPIPE" || err?.errno === -32;
+}
+
+function safeWrite(stream, content, exitCode = 0) {
+  try {
+    return stream.write(content);
+  } catch (err) {
+    if (isBrokenPipeError(err)) {
+      process.exit(exitCode);
+    }
+    throw err;
+  }
+}
+
+function installBrokenPipeGuards() {
+  const handlePipeError = (exitCode) => (err) => {
+    if (isBrokenPipeError(err)) {
+      process.exit(exitCode);
+      return;
+    }
+    throw err;
+  };
+
+  process.stdout.on("error", handlePipeError(0));
+  process.stderr.on("error", handlePipeError(process.exitCode || 1));
+}
+
+const PROFILE_ROUTING_ARG_KEYS = [
+  "query",
+  "queries",
+  "question",
+  "questions",
+  "title",
+  "titles",
+  "description",
+  "name",
+  "keywords",
+  "collectionId",
+  "documentId",
+  "parentDocumentId",
+  "id",
+  "ids",
+  "url",
+  "shareId",
+  "email",
+];
+
+function collectRoutingHints(value, bucket, depth = 0) {
+  if (value === undefined || value === null || depth > 2) {
+    return;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed) {
+      bucket.push(normalizeUrlHint(trimmed) || trimmed);
+    }
+    return;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    bucket.push(String(value));
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value.slice(0, 8)) {
+      collectRoutingHints(item, bucket, depth + 1);
+    }
+    return;
+  }
+  if (typeof value === "object") {
+    for (const [key, nested] of Object.entries(value).slice(0, 8)) {
+      if (PROFILE_ROUTING_ARG_KEYS.includes(key)) {
+        collectRoutingHints(nested, bucket, depth + 1);
+      }
+    }
+  }
+}
+
+function buildProfileRoutingQuery(context = {}) {
+  const bucket = [];
+  const tool = String(context.tool || "").trim();
+  if (tool) {
+    bucket.push(tool.replace(/[._]+/g, " "));
+  }
+  const args = context.args && typeof context.args === "object" ? context.args : {};
+  for (const key of PROFILE_ROUTING_ARG_KEYS) {
+    if (key in args) {
+      collectRoutingHints(args[key], bucket);
+    }
+  }
+  return [...new Set(bucket.map((item) => String(item || "").trim()).filter(Boolean))].join(" ");
+}
+
+function isLikelyReadOnlyToolName(tool, args = {}) {
+  if (args?.performAction === true) {
+    return false;
+  }
+  const name = String(tool || "").toLowerCase();
+  return !/(^|\.)(create|update|delete|remove|restore|duplicate|revoke|invite|suspend|activate|import|apply|rotate|cleanup|templatize|add_|remove_|permanent_delete|empty_trash|batch_update|safe_update)/.test(name);
+}
+
+async function getRuntime(opts, overrideProfileId, context = {}) {
+  const configPath = path.resolve(opts.config || defaultConfigPath());
+  const config = await loadConfig(configPath);
+  const selectedProfile = getProfile(config, overrideProfileId || opts.profile, {
+    query: buildProfileRoutingQuery(context),
+    allowAutoSelect: isLikelyReadOnlyToolName(context.tool, context.args),
+    suggestionLimit: 3,
+  });
+  const { selection: profileSelection, ...storedProfile } = selectedProfile;
+  const profile = hydrateProfileFromKeychain({
+    configPath,
+    profile: storedProfile,
+  });
+  const client = new OutlineClient(profile);
+  return {
+    configPath,
+    config,
+    profile,
+    client,
+    profileSelection,
+  };
+}
+
 const URL_HINT_PATH_MARKERS = new Set(["doc", "d", "share", "s"]);
 
 function normalizeUrlHint(value) {
@@ -144,7 +255,7 @@ function formatError(err) {
 }
 
 function writeNdjsonLine(value) {
-  process.stdout.write(`${JSON.stringify(value)}\n`);
+  safeWrite(process.stdout, `${JSON.stringify(value)}\n`);
 }
 
 function emitNdjson(payload) {
@@ -233,11 +344,12 @@ async function emitOutput(store, payload, opts, emitOptions = {}) {
 }
 
 export async function run(argv = process.argv) {
+  installBrokenPipeGuards();
   const program = new Command();
   program
     .name("outline-cli")
     .description("Agent-optimized CLI for Outline API")
-    .version("0.1.0")
+    .version(packageVersion)
     .showHelpAfterError(true);
 
   const profile = program.command("profile").description("Manage Outline profiles");
@@ -353,6 +465,11 @@ export async function run(argv = process.argv) {
     .command("list")
     .description("List configured profiles")
     .option("--config <path>", "Config file path", defaultConfigPath())
+    .option("--output <format>", "Output format: json|ndjson", "json")
+    .option("--result-mode <mode>", "Result mode: auto|inline|file", "auto")
+    .option("--inline-max-bytes <n>", "Max inline JSON payload size", "12000")
+    .option("--tmp-dir <path>", "Directory for large result files")
+    .option("--pretty", "Pretty-print JSON output", false)
     .action(async (opts) => {
       const configPath = path.resolve(opts.config || defaultConfigPath());
       const config = await loadConfig(configPath);
@@ -360,16 +477,13 @@ export async function run(argv = process.argv) {
         ...redactProfile(item),
         isDefault: config.defaultProfile === item.id,
       }));
-      const store = new ResultStore({ pretty: true });
-      await store.emit(
-        {
-          ok: true,
-          configPath,
-          defaultProfile: config.defaultProfile,
-          profiles,
-        },
-        { mode: "inline", pretty: true, label: "profile-list" }
-      );
+      const store = buildStoreFromOptions(opts);
+      await emitOutput(store, {
+        ok: true,
+        configPath,
+        defaultProfile: config.defaultProfile,
+        profiles,
+      }, opts, { mode: opts.resultMode, label: "profile-list", pretty: !!opts.pretty });
     });
 
   profile
@@ -377,40 +491,44 @@ export async function run(argv = process.argv) {
     .description("Suggest best-matching profile(s) by id/name/base-url/description/keywords")
     .option("--config <path>", "Config file path", defaultConfigPath())
     .option("--limit <n>", "Max number of profile matches to return", "5")
+    .option("--output <format>", "Output format: json|ndjson", "json")
+    .option("--result-mode <mode>", "Result mode: auto|inline|file", "auto")
+    .option("--inline-max-bytes <n>", "Max inline JSON payload size", "12000")
+    .option("--tmp-dir <path>", "Directory for large result files")
+    .option("--pretty", "Pretty-print JSON output", false)
     .action(async (query, opts) => {
       const configPath = path.resolve(opts.config || defaultConfigPath());
       const config = await loadConfig(configPath);
       const result = suggestProfiles(config, query, { limit: toInteger(opts.limit, 5) });
-      const store = new ResultStore({ pretty: true });
-      await store.emit(
-        {
-          ok: true,
-          configPath,
-          defaultProfile: config.defaultProfile,
-          ...result,
-          bestMatch: result.matches[0] || null,
-        },
-        { mode: "inline", pretty: true, label: "profile-suggest" }
-      );
+      const store = buildStoreFromOptions(opts);
+      await emitOutput(store, {
+        ok: true,
+        configPath,
+        defaultProfile: config.defaultProfile,
+        ...result,
+        bestMatch: result.matches[0] || null,
+      }, opts, { mode: opts.resultMode, label: "profile-suggest", pretty: !!opts.pretty });
     });
 
   profile
     .command("show [id]")
     .description("Show one profile (redacted)")
     .option("--config <path>", "Config file path", defaultConfigPath())
+    .option("--output <format>", "Output format: json|ndjson", "json")
+    .option("--result-mode <mode>", "Result mode: auto|inline|file", "auto")
+    .option("--inline-max-bytes <n>", "Max inline JSON payload size", "12000")
+    .option("--tmp-dir <path>", "Directory for large result files")
+    .option("--pretty", "Pretty-print JSON output", false)
     .action(async (id, opts) => {
       const configPath = path.resolve(opts.config || defaultConfigPath());
       const config = await loadConfig(configPath);
       const profileData = getProfile(config, id);
-      const store = new ResultStore({ pretty: true });
-      await store.emit(
-        {
-          ok: true,
-          configPath,
-          profile: redactProfile(profileData),
-        },
-        { mode: "inline", pretty: true, label: "profile-show" }
-      );
+      const store = buildStoreFromOptions(opts);
+      await emitOutput(store, {
+        ok: true,
+        configPath,
+        profile: redactProfile(profileData),
+      }, opts, { mode: opts.resultMode, label: "profile-show", pretty: !!opts.pretty });
     });
 
   profile
@@ -726,6 +844,7 @@ export async function run(argv = process.argv) {
   tools
     .command("contract [name]")
     .description("Show tool contract (signature, usage, best practices)")
+    .option("--pretty", "Pretty-print JSON output", false)
     .action(async (name, opts, cmd) => {
       const merged = { ...cmd.parent.opts(), ...opts };
       const store = buildStoreFromOptions(merged);
@@ -826,11 +945,21 @@ export async function run(argv = process.argv) {
   );
 
   invoke.action(async (tool, opts) => {
-    const runtime = await getRuntime(opts);
-    const store = buildStoreFromOptions(opts);
     const args = (await parseJsonArg({ json: opts.args, file: opts.argsFile, name: "args" })) || {};
+    const resolution = resolveToolInvocation(tool, args);
+    const runtime = await getRuntime(opts, undefined, {
+      tool: resolution.resolvedName,
+      args: resolution.args,
+    });
+    const store = buildStoreFromOptions(opts);
     const result = await invokeTool(runtime, tool, args);
-    await emitOutput(store, result, opts, {
+    const output = runtime.profileSelection?.autoSelected
+      ? {
+        ...result,
+        profileRouting: runtime.profileSelection,
+      }
+      : result;
+    await emitOutput(store, output, opts, {
       label: `tool-${tool.replace(/\./g, "-")}`,
       mode: opts.resultMode,
     });
@@ -858,19 +987,25 @@ export async function run(argv = process.argv) {
     const store = buildStoreFromOptions(opts);
     const clientCache = new Map();
 
-    async function runtimeForProfile(profileId) {
-      const selected = getProfile(config, profileId || opts.profile);
-      if (!clientCache.has(selected.id)) {
+    async function runtimeForProfile(profileId, context = {}) {
+      const selected = getProfile(config, profileId || opts.profile, {
+        query: buildProfileRoutingQuery(context),
+        allowAutoSelect: isLikelyReadOnlyToolName(context.tool, context.args),
+        suggestionLimit: 3,
+      });
+      const { selection: profileSelection, ...storedProfile } = selected;
+      if (!clientCache.has(storedProfile.id)) {
         const hydrated = hydrateProfileFromKeychain({
           configPath,
-          profile: selected,
+          profile: storedProfile,
         });
-        clientCache.set(selected.id, {
+        clientCache.set(storedProfile.id, {
           profile: hydrated,
           client: new OutlineClient(hydrated),
+          profileSelection,
         });
       }
-      return clientCache.get(selected.id);
+      return clientCache.get(storedProfile.id);
     }
 
     const parallel = toInteger(opts.parallel, 4);
@@ -882,7 +1017,11 @@ export async function run(argv = process.argv) {
         if (!operation.tool) {
           throw new CliError(`Operation at index ${index} is missing tool`);
         }
-        const runtime = await runtimeForProfile(operation.profile);
+        const resolution = resolveToolInvocation(operation.tool, operation.args || {});
+        const runtime = await runtimeForProfile(operation.profile, {
+          tool: resolution.resolvedName,
+          args: resolution.args,
+        });
         const payload = await invokeTool(runtime, operation.tool, operation.args || {});
         const mode = (opts.itemEnvelope || "compact").toLowerCase();
         const compactResult =
@@ -898,9 +1037,11 @@ export async function run(argv = process.argv) {
         return {
           index,
           tool: operation.tool,
+          ...(payload?.tool && payload.tool !== operation.tool ? { resolvedTool: payload.tool } : {}),
           profile: runtime.profile.id,
           ok: true,
           result: mode === "full" ? payload : compactResult,
+          ...(runtime.profileSelection?.autoSelected ? { profileRouting: runtime.profileSelection } : {}),
           ...(mode === "full" || Object.keys(compactMeta).length === 0 ? {} : { meta: compactMeta }),
         };
       } catch (err) {
@@ -948,7 +1089,7 @@ export async function run(argv = process.argv) {
       const merged = { ...cmd.parent.opts(), ...opts };
       const store = buildStoreFromOptions(merged);
       const content = await store.read(file);
-      process.stdout.write(content.content);
+      safeWrite(process.stdout, content.content);
     });
 
   tmp
@@ -976,7 +1117,7 @@ export async function run(argv = process.argv) {
     await program.parseAsync(argv);
   } catch (err) {
     const output = formatError(err);
-    process.stderr.write(`${JSON.stringify(output, null, 2)}\n`);
+    safeWrite(process.stderr, `${JSON.stringify(output, null, 2)}\n`, process.exitCode || 1);
     process.exitCode = process.exitCode || 1;
   }
 }

package/src/config-store.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import fsSync from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { CliError } from "./errors.js";
 
 export const CONFIG_VERSION = 1;
 
@@ -479,6 +480,45 @@ export function suggestProfiles(config, query, options = {}) {
   };
 }
 
+function isHighConfidenceProfileMatch(top, second, options = {}) {
+  if (!top) {
+    return false;
+  }
+
+  const minScore = Number.isFinite(Number(options.minScore)) ? Number(options.minScore) : 1.7;
+  const minGap = Number.isFinite(Number(options.minGap)) ? Number(options.minGap) : 0.55;
+  const exactSignals = new Set(["id_exact", "name_exact", "keyword_exact", "host"]);
+  const hasExactSignal = Array.isArray(top.matchedOn) && top.matchedOn.some((item) => exactSignals.has(item));
+  const gap = top.score - Number(second?.score || 0);
+
+  if (top.score >= 3.2) {
+    return true;
+  }
+  if (top.score >= minScore && gap >= minGap) {
+    return true;
+  }
+  if (hasExactSignal && top.score >= 1.2 && gap >= 0.35) {
+    return true;
+  }
+
+  return false;
+}
+
+function formatProfileSelectionError(config, message, options = {}) {
+  const availableProfiles = Object.keys(config?.profiles || {});
+  const query = String(options.query || "").trim();
+  const suggestionLimit = Number.isFinite(Number(options.suggestionLimit))
+    ? Math.max(1, Number(options.suggestionLimit))
+    : 3;
+  const suggestions = query ? suggestProfiles(config, query, { limit: suggestionLimit }).matches : [];
+
+  return new CliError(message, {
+    code: "PROFILE_SELECTION_REQUIRED",
+    availableProfiles,
+    ...(query ? { query, suggestions } : {}),
+  });
+}
+
 export function suggestProfileMetadata(input = {}, options = {}) {
   const id = String(input.id || "").trim();
   const name = String(input.name || id || "").trim();
@@ -566,13 +606,17 @@ export function listProfiles(config) {
   }));
 }
 
-export function getProfile(config, explicitId) {
+export function getProfile(config, explicitId, options = {}) {
   const profiles = config?.profiles || {};
 
   if (explicitId) {
     const profile = profiles[explicitId];
     if (!profile) {
-      throw new Error(`Profile not found: ${explicitId}`);
+      throw new CliError(`Profile not found: ${explicitId}`, {
+        code: "PROFILE_NOT_FOUND",
+        profileId: explicitId,
+        availableProfiles: Object.keys(profiles),
+      });
     }
     return {
       id: explicitId,
@@ -583,7 +627,11 @@ export function getProfile(config, explicitId) {
   if (config.defaultProfile) {
     const profile = profiles[config.defaultProfile];
     if (!profile) {
-      throw new Error(`Profile not found: ${config.defaultProfile}`);
+      throw new CliError(`Profile not found: ${config.defaultProfile}`, {
+        code: "PROFILE_NOT_FOUND",
+        profileId: config.defaultProfile,
+        availableProfiles: Object.keys(profiles),
+      });
     }
     return {
       id: config.defaultProfile,
@@ -601,12 +649,44 @@ export function getProfile(config, explicitId) {
   }
 
   if (profileIds.length > 1) {
-    throw new Error(
-      "Profile selection required: multiple profiles are saved and no default profile is set. Use --profile <id> or `outline-cli profile use <id>`."
+    const query = String(options.query || "").trim();
+    const allowAutoSelect = options.allowAutoSelect !== false;
+    const suggestionLimit = Number.isFinite(Number(options.suggestionLimit))
+      ? Math.max(1, Number(options.suggestionLimit))
+      : 3;
+
+    if (allowAutoSelect && query) {
+      const suggestions = suggestProfiles(config, query, { limit: suggestionLimit }).matches;
+      const top = suggestions[0];
+      const second = suggestions[1];
+
+      if (isHighConfidenceProfileMatch(top, second, options)) {
+        return {
+          id: top.id,
+          ...profiles[top.id],
+          selection: {
+            autoSelected: true,
+            query,
+            score: top.score,
+            matchedOn: top.matchedOn,
+          },
+        };
+      }
+    }
+
+    throw formatProfileSelectionError(
+      config,
+      "Profile selection required: multiple profiles are saved and no default profile is set. Use --profile <id> or `outline-cli profile use <id>`.",
+      {
+        query,
+        suggestionLimit,
+      }
     );
   }
 
-  throw new Error("No profiles configured. Use `outline-cli profile add <id> ...` first.");
+  throw new CliError("No profiles configured. Use `outline-cli profile add <id> ...` first.", {
+    code: "PROFILE_NOT_CONFIGURED",
+  });
 }
 
 export function redactProfile(profile) {

package/src/entry-integrity-manifest.generated.js

@@ -3,8 +3,8 @@ export const ENTRY_INTEGRITY_MANIFEST = Object.freeze({
   version: 1,
   algorithm: "sha256",
   signatureAlgorithm: "sha256-salted-manifest-v1",
-  signature: "03f876687f3972f11cce73da3da5f5f5266536bdce151a03326a813082240016",
-  generatedAt: "2026-03-06T04:21:12.443Z",
+  signature: "c69d41948b78c8ae35c0223377149ece8df5588863a010adf92a0b6ad11876d3",
+  generatedAt: "2026-03-08T01:17:47.858Z",
   files: [
   {
     "path": "src/action-gate.js",
@@ -12,19 +12,19 @@ export const ENTRY_INTEGRITY_MANIFEST = Object.freeze({
   },
   {
     "path": "src/agent-skills.js",
-    "sha256": "12d54830ec84d9e8815cd28915070453175520416c83983de2496c1734acd7a2"
+    "sha256": "d40e94a4b61922d3ee8a43ed89d5e9ce1562a2cdffd37e2f396c2a18b9a481fc"
   },
   {
     "path": "src/cli.js",
-    "sha256": "7959970b8e2d0d81de0c2e35201274f0d16744aaa2a73f001decfdad45c85522"
+    "sha256": "2b6b17a71c15954c2663397d57afde2b8825ed368bb7f71833f6191662eff079"
   },
   {
     "path": "src/config-store.js",
-    "sha256": "e0d62083c694f84895a93752738accbbd98830157227f06380ccdf8e421508fd"
+    "sha256": "3773d59d74502c75b7375c194b4f0e2c39fb43e95f739e6e4878aa1b0957a511"
   },
   {
     "path": "src/entry-integrity.js",
-    "sha256": "3463fc3a3c6d0aead8e889ecce7c323b64b09ef54c772c52ff8b7266eb8c0d69"
+    "sha256": "5f66c29e57f53f11fc1751c9a8bd41c318001e3fb6562ee6f3a593f31849e45e"
   },
   {
     "path": "src/errors.js",
@@ -42,25 +42,29 @@ export const ENTRY_INTEGRITY_MANIFEST = Object.freeze({
     "path": "src/secure-keyring.js",
     "sha256": "370d904265733f7d6b0f47b3213c7f026c95e59bc18d364dff96be90dbd7f479"
   },
+  {
+    "path": "src/summary-redaction.js",
+    "sha256": "ddd3562334e704de5d9f6068726e311a98564e7e46bcdb56d9aade7e63b65bd3"
+  },
   {
     "path": "src/tool-arg-schemas.js",
-    "sha256": "de6f389349d6688296a8e66d2d612937f31b4fc2a0efdca085d36ec5b09cab26"
+    "sha256": "51f8727255e5b2b0a4cce78495cfaed9bb1869a7ef104b22dbc170604f878feb"
   },
   {
     "path": "src/tools.extended.js",
-    "sha256": "8f29601301c7942cce8884c689916a78a22231e5f6691ecebfe09d9d4f87d6c3"
+    "sha256": "0c5317ca0b28a0b7110d9e6c81d8ca6ccd705e9b303de2f29e03f847b31df310"
   },
   {
     "path": "src/tools.js",
-    "sha256": "bfcb36045abecc758237ce9441d7e5994a4467893b09d48557749a90de424401"
+    "sha256": "96cfbb14cac2baa5221dc4e9294a0520f81c3e22a0c69ee648cd6c2354e1512e"
   },
   {
     "path": "src/tools.mutation.js",
-    "sha256": "013cee7d9815f868cca8990af39abe385239fa0f324054477d681e479605e903"
+    "sha256": "15fa3d146d99f55bc16d814ffd9360127b99eca2f9271cf751c6e5c7e4234317"
   },
   {
     "path": "src/tools.navigation.js",
-    "sha256": "8cd6ad37db2ef4d8a2ddd2eea408c8ab50b5649b620680cef07bd8f3ecea7e89"
+    "sha256": "f7118e91c2edd0e6b57591d41fe7707c68eef51cde77918495bb4ee166139339"
   },
   {
     "path": "src/tools.platform.js",

package/src/entry-integrity.js

@@ -52,6 +52,7 @@ export async function assertEntryIntegrity(rootDir = REPO_ROOT) {
   if (files.length === 0) {
     throw new CliError("Entry integrity manifest is empty", {
       code: "ENTRY_INTEGRITY_MANIFEST_EMPTY",
+      hint: "Run `npm run integrity:refresh` to regenerate local integrity metadata.",
     });
   }
 
@@ -62,6 +63,7 @@ export async function assertEntryIntegrity(rootDir = REPO_ROOT) {
       expected: manifest.signature,
       actual: computedSignature,
       keyId: ENTRY_INTEGRITY_BINDING.keyId,
+      hint: "Run `npm run integrity:refresh` after local source edits, or set `OUTLINE_CLI_SKIP_INTEGRITY_CHECK=1` for local smoke runs.",
     });
   }
 
@@ -93,6 +95,7 @@ export async function assertEntryIntegrity(rootDir = REPO_ROOT) {
       code: "ENTRY_SUBMODULE_INTEGRITY_FAILED",
       mismatchCount: mismatches.length,
       mismatches,
+      hint: "Run `npm run integrity:refresh` after local source edits, or set `OUTLINE_CLI_SKIP_INTEGRITY_CHECK=1` for local smoke runs.",
     });
   }
 

package/src/summary-redaction.js

@@ -0,0 +1,37 @@
+const SUMMARY_SECRET_LINE_PATTERNS = [
+  /(^|\n)([ \t>*+\-]*(?:[*_`~]+\s*)*(?:user(?:name)?\s*\/\s*pass(?:word)?|username\s*\/\s*password|credentials?|api[ _-]*key|access[ _-]*token|refresh[ _-]*token|client[ _-]*secret|secret|password|pass|pwd|authorization|bearer)(?:\s*[*_`~]+)*\s*:\s*)([^\n]+)/gi,
+  /(^|\n)([ \t>*+\-]*(?:[*_`~]+\s*)*(?:user(?:name)?|email|login)(?:\s*[*_`~]+)*\s*:\s*)([^\n]+)(\n[ \t>*+\-]*(?:[*_`~]+\s*)*(?:pass(?:word)?|pwd)(?:\s*[*_`~]+)*\s*:\s*)([^\n]+)/gi,
+];
+
+export function redactSensitiveSummaryText(text) {
+  if (typeof text !== "string" || text.length === 0) {
+    return text;
+  }
+
+  let redacted = text;
+  for (const pattern of SUMMARY_SECRET_LINE_PATTERNS) {
+    redacted = redacted.replace(pattern, (...parts) => {
+      const leading = parts[1] || "";
+      const prefix = parts[2] || "";
+      const secondPrefix = parts[4];
+      if (typeof secondPrefix === "string") {
+        return `${leading}${prefix}[REDACTED]${secondPrefix}[REDACTED]`;
+      }
+      return `${leading}${prefix}[REDACTED]`;
+    });
+  }
+
+  redacted = redacted.replace(/\bol_api_[A-Za-z0-9]+\b/g, "ol_api_[REDACTED]");
+  redacted = redacted.replace(/\b(?:ghp|gho|ghu|ghs|github_pat|sk|pk)_[A-Za-z0-9_]+\b/g, "[REDACTED_TOKEN]");
+  redacted = redacted.replace(/(https?:\/\/)([^\s:@/]+):([^\s@/]+)@/gi, "$1[REDACTED]@");
+
+  return redacted;
+}
+
+export function summarizeSafeText(text, maxChars) {
+  const redacted = redactSensitiveSummaryText(text);
+  if (typeof redacted !== "string") {
+    return redacted;
+  }
+  return redacted.length > maxChars ? `${redacted.slice(0, maxChars)}...` : redacted;
+}