@lensmcp/bridge 1.18.2 → 1.18.4

package/index.d.ts

@@ -1,6 +1,6 @@
 export { createBridgeServer, makePublisher, handleClientEnvelope, findFreePort, type BridgeServer, type BridgeServerOptions, type BridgeDeps, } from './lib/server.js';
 export { envelopeToEvent } from './lib/event-mappers.js';
+export { redactUrl, redactText, redactDeep, isSecretParam, clip, safeText, safeTitle, REDACTED, MAX_TITLE_CHARS, MAX_MESSAGE_CHARS, MAX_URL_CHARS, } from './lib/redact.js';
 export { resolveEnvSink, resetEnvSinkCache, udsEnvSink } from './lib/env-sink.js';
 export { DEFAULT_WS_HOST, DEFAULT_WS_PORT, ENV_WS_HOST, ENV_WS_PORT, ENV_SESSION_ID, } from './lib/constants.js';
 export type { ClientEnvelope, EnvSink } from './lib/types.js';
-//# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,4 +1,5 @@
 export { createBridgeServer, makePublisher, handleClientEnvelope, findFreePort, } from './lib/server.js';
 export { envelopeToEvent } from './lib/event-mappers.js';
+export { redactUrl, redactText, redactDeep, isSecretParam, clip, safeText, safeTitle, REDACTED, MAX_TITLE_CHARS, MAX_MESSAGE_CHARS, MAX_URL_CHARS, } from './lib/redact.js';
 export { resolveEnvSink, resetEnvSinkCache, udsEnvSink } from './lib/env-sink.js';
 export { DEFAULT_WS_HOST, DEFAULT_WS_PORT, ENV_WS_HOST, ENV_WS_PORT, ENV_SESSION_ID, } from './lib/constants.js';

package/lib/constants.d.ts

@@ -22,4 +22,3 @@ export declare const ENV_WS_HOST = "LENSMCP_WS_HOST";
 export declare const ENV_WS_PORT = "LENSMCP_WS_PORT";
 /** Env var: session id stamped onto every event the bridge publishes. */
 export declare const ENV_SESSION_ID = "LENSMCP_SESSION_ID";
-//# sourceMappingURL=constants.d.ts.map

package/lib/env-sink.d.ts

@@ -4,4 +4,3 @@ export declare function resolveEnvSink(): EnvSink | null;
 export declare function resetEnvSinkCache(): void;
 /** Reconnecting NDJSON client over a Unix domain socket (see session/uds.ts). */
 export declare function udsEnvSink(path: string): EnvSink;
-//# sourceMappingURL=env-sink.d.ts.map

package/lib/event-mappers.d.ts

@@ -5,6 +5,23 @@ import type { ClientEnvelope } from './types.js';
  * `BaseEvent` consumed by the LensMCP event bus. The bridge publishes
  * these; reducers in `@lensmcp/<app>` materialise them into
  * `runtime://browser/*` resources.
+ *
+ * ── Substance is the point ──────────────────────────────────────────────────
+ * This mapper decides what a reader of `runtime://browser/errors` can actually
+ * learn. Measured on foodguard (2026-07-30) an entry looked like:
+ *
+ *     { id, timestamp, severity: 'error', source: 'client-runtime',
+ *       fingerprint: 'runtime:52331dbd', tabId: 'tab-gal0r3bs',
+ *       raw: { kind: 'error', at: 1785450203325, tabId: 'tab-gal0r3bs' } }
+ *
+ * — no message, no stack, no URL, no status. The resource could report that
+ * two errors happened and nothing whatsoever about what they were. A signal
+ * that is correct but undiagnosable is only half a signal, so every branch
+ * below now carries identity: a title that names the failure, a bounded
+ * message/stack, and for a request its method, URL and STATUS.
+ *
+ * Every string that reaches `title`/`message` is redacted and bounded first
+ * (`./redact.js`) — enrichment is exactly what creates the leak risk, so the
+ * two land together. See that module for what is and is not scrubbed.
  */
 export declare function envelopeToEvent(env: ClientEnvelope, sessionId?: string): BaseEvent;
-//# sourceMappingURL=event-mappers.d.ts.map

package/lib/event-mappers.js

@@ -1,16 +1,48 @@
 import { fingerprint, ulid } from '@lensmcp/core';
+import { redactDeep, redactText, redactUrl, safeText, safeTitle } from './redact.js';
 const SESSION_ID_PLACEHOLDER = 'pending';
 /**
  * Translate a single client-runtime envelope into the normalised
  * `BaseEvent` consumed by the LensMCP event bus. The bridge publishes
  * these; reducers in `@lensmcp/<app>` materialise them into
  * `runtime://browser/*` resources.
+ *
+ * ── Substance is the point ──────────────────────────────────────────────────
+ * This mapper decides what a reader of `runtime://browser/errors` can actually
+ * learn. Measured on foodguard (2026-07-30) an entry looked like:
+ *
+ *     { id, timestamp, severity: 'error', source: 'client-runtime',
+ *       fingerprint: 'runtime:52331dbd', tabId: 'tab-gal0r3bs',
+ *       raw: { kind: 'error', at: 1785450203325, tabId: 'tab-gal0r3bs' } }
+ *
+ * — no message, no stack, no URL, no status. The resource could report that
+ * two errors happened and nothing whatsoever about what they were. A signal
+ * that is correct but undiagnosable is only half a signal, so every branch
+ * below now carries identity: a title that names the failure, a bounded
+ * message/stack, and for a request its method, URL and STATUS.
+ *
+ * Every string that reaches `title`/`message` is redacted and bounded first
+ * (`./redact.js`) — enrichment is exactly what creates the leak risk, so the
+ * two land together. See that module for what is and is not scrubbed.
  */
 export function envelopeToEvent(env, sessionId = SESSION_ID_PLACEHOLDER) {
     // Per-tab identity stamped by the client runtime — keys browser://tabs.
     const tab = env.tabId ? { tabId: env.tabId } : {};
     switch (env.kind) {
-        case 'error':
+        case 'error': {
+            // A cross-origin script yields the opaque "Script error." with no stack
+            // and no file. Saying so is more use than a bare message, because the
+            // fix is a `crossorigin` attribute rather than anything in the app.
+            const opaque = !env.stack && !env.source && (!env.message || env.message === 'Script error.');
+            const name = env.name && env.name !== 'Error' ? `${env.name}: ` : '';
+            // Opaque FIRST: the browser's own "Script error." is a message, but a
+            // useless one — naming the cause points at the actual fix (a
+            // `crossorigin` attribute on the script tag), which the raw string does not.
+            const title = opaque
+                ? 'Uncaught cross-origin script error (no detail available — add crossorigin to the script tag)'
+                : env.message
+                    ? `${name}${env.message}`
+                    : `Uncaught ${env.name ?? 'error'}`;
             return {
                 id: ulid(),
                 sessionId,
@@ -23,16 +55,51 @@ export function envelopeToEvent(env, sessionId = SESSION_ID_PLACEHOLDER) {
                     kind: 'runtime',
                     identity: `error:${normaliseStackTopFrame(env.stack)}`,
                     file: env.source,
-                    detail: env.message,
+                    // The message is the discriminator between two errors thrown from
+                    // the same frame. Without it every anonymous error collapsed into
+                    // one fingerprint, so a count of them meant nothing.
+                    detail: env.message ?? env.name,
                 }),
-                title: env.message,
-                message: env.stack ?? env.message,
+                title: safeTitle(title),
+                message: safeText(env.stack ?? env.message),
                 location: env.source
-                    ? { file: env.source, line: env.lineno, column: env.colno }
+                    ? { file: redactUrl(env.source), line: env.lineno, column: env.colno }
                     : undefined,
-                raw: env,
+                // `raw` is read too — redact it as thoroughly as the rendered fields,
+                // or the credential just moves one key deeper.
+                raw: {
+                    ...env,
+                    ...(env.message ? { message: redactText(env.message) } : {}),
+                    ...(env.stack ? { stack: safeText(env.stack) } : {}),
+                    ...(env.source ? { source: redactUrl(env.source) } : {}),
+                },
+            };
+        }
+        case 'resource-error': {
+            const url = env.url ? redactUrl(env.url) : undefined;
+            return {
+                id: ulid(),
+                sessionId,
+                timestamp: env.at,
+                source: 'client-runtime',
+                category: 'runtime',
+                severity: 'error',
+                context: { sessionId, ...tab },
+                fingerprint: fingerprint({
+                    kind: 'runtime',
+                    // Path-normalised so a cache-busted asset does not mint a new
+                    // fingerprint on every reload, while two different failing assets
+                    // stay distinct.
+                    identity: `resource-error:${env.tagName}:${normaliseUrl(env.url ?? '')}`,
+                }),
+                title: safeTitle(`Failed to load <${env.tagName}>${url ? ` ${url}` : ''}`),
+                ...(url ? { relatedUrls: [url] } : {}),
+                raw: { ...env, ...(url ? { url } : {}) },
             };
-        case 'unhandledrejection':
+        }
+        case 'unhandledrejection': {
+            const name = env.name && env.name !== 'Error' ? `${env.name}: ` : '';
+            const summary = env.reason.split('\n')[0] ?? env.reason;
             return {
                 id: ulid(),
                 sessionId,
@@ -45,13 +112,27 @@ export function envelopeToEvent(env, sessionId = SESSION_ID_PLACEHOLDER) {
                     kind: 'runtime',
                     identity: `unhandledrejection:${env.reason.slice(0, 80)}`,
                 }),
-                title: 'Unhandled promise rejection',
-                message: env.reason,
-                raw: env,
+                // The reason belongs in the title. "Unhandled promise rejection" on
+                // its own is a category, not a finding — a reader had to open `raw` to
+                // learn anything, and the status-line summary showed only the category.
+                title: safeTitle(`Unhandled promise rejection: ${name}${summary}`),
+                message: safeText(env.stack ?? env.reason),
+                raw: {
+                    ...env,
+                    reason: redactText(env.reason),
+                    ...(env.stack ? { stack: safeText(env.stack) } : {}),
+                },
             };
+        }
         case 'console': {
             const severity = env.level === 'error' ? 'error' : env.level === 'warn' ? 'warning' : 'info';
-            const text = env.args.map(stringify).join(' ');
+            // Redact the args FIRST, then join. Joining first and scrubbing the
+            // result only catches credential SHAPES (a JWT, a `Bearer …`) — it
+            // cannot know that a key literally named `apiKey` holds one, so
+            // `console.log({ apiKey })` leaked into `message` while `raw.args` was
+            // correctly redacted. Redacting at the structured end catches both.
+            const args = redactDeep(env.args);
+            const text = args.map(stringify).join(' ');
             return {
                 id: ulid(),
                 sessionId,
@@ -65,12 +146,18 @@ export function envelopeToEvent(env, sessionId = SESSION_ID_PLACEHOLDER) {
                     identity: `console:${env.level}:${text.slice(0, 80)}`,
                 }),
                 title: `console.${env.level}`,
-                message: text,
-                raw: env,
+                message: safeText(text),
+                // Console args are the one genuinely unstructured captured payload —
+                // `console.log('auth', { token })` is ordinary debugging code.
+                raw: { ...env, args },
             };
         }
         case 'fetch': {
             const failed = env.error !== undefined || (env.status !== undefined && env.status >= 400);
+            const url = redactUrl(env.url);
+            const status = env.status !== undefined
+                ? ` → ${env.status}${env.statusText ? ` ${env.statusText}` : ''}`
+                : '';
             return {
                 id: ulid(),
                 sessionId,
@@ -83,10 +170,10 @@ export function envelopeToEvent(env, sessionId = SESSION_ID_PLACEHOLDER) {
                     kind: 'network',
                     identity: `${env.method}:${normaliseUrl(env.url)}:${env.status ?? 'err'}`,
                 }),
-                title: `${env.method} ${env.url}${env.status !== undefined ? ` → ${env.status}` : ''}`,
-                message: env.error,
-                relatedUrls: [env.url],
-                raw: env,
+                title: safeTitle(`${env.method} ${url}${status}`),
+                message: safeText(env.error),
+                relatedUrls: [url],
+                raw: { ...env, url },
             };
         }
         case 'route':
@@ -116,27 +203,70 @@ export function envelopeToEvent(env, sessionId = SESSION_ID_PLACEHOLDER) {
                 message: env.userAgent,
                 raw: env,
             };
-        case 'publish':
+        case 'publish': {
             // Pre-formed publish envelope from in-page instrumentation. Trust
             // its source/category (the producer is our own injected code); the
             // reducers gate on those, and the context carries the flow id so
             // React renders correlate with the originating user action.
+            const net = networkDetails(env.category, env.raw);
+            // A FAILED REQUEST IS AN ERROR, wherever it was published from.
+            //
+            // `flow-fetch` classified every non-ok response as `warning`, so a 4xx
+            // or 5xx never reached `runtime://browser/failed-requests` (the runtime
+            // reducer routes only `severity === 'error'` there). On foodguard that
+            // silently hid 116 real failures — 98×401, 10×503, 8×502. Normalising
+            // here rather than only at the publisher means the invariant holds for
+            // any producer, including an app pinned to an older instrumentation
+            // build.
+            const severity = net && net.status !== undefined && net.status >= 400
+                ? 'error'
+                : (env.severity ?? 'info');
+            // The publisher embedded the un-redacted URL in its own title AND its
+            // own fingerprint (flow-fetch builds both from the raw URL); swap in the
+            // redacted form rather than dropping either. The substitution is
+            // deterministic, so the fingerprint stays a stable dedupe key.
+            const scrub = (s) => net && net.url !== net.redactedUrl ? s.split(net.url).join(net.redactedUrl) : s;
+            const title = scrub(env.title);
             return {
                 id: ulid(),
                 sessionId,
                 timestamp: env.at,
                 source: env.source,
                 category: env.category,
-                severity: (env.severity ?? 'info'),
+                severity,
                 context: { sessionId, ...tab, ...(env.context ?? {}) },
-                fingerprint: env.fingerprint ?? fingerprint({ kind: 'publish', identity: env.title }),
-                title: env.title,
-                message: env.message,
-                raw: env.raw,
+                fingerprint: env.fingerprint
+                    ? scrub(env.fingerprint)
+                    : fingerprint({ kind: 'publish', identity: title }),
+                title: safeTitle(title),
+                message: safeText(env.message),
+                ...(net ? { relatedUrls: [net.redactedUrl] } : {}),
+                raw: net
+                    ? { ...redactDeep(env.raw), url: net.redactedUrl }
+                    : redactDeep(env.raw),
             };
+        }
     }
 }
 // --- helpers ---
+/**
+ * Pull `{ url, status }` off a network `publish` envelope's `raw` (the shape
+ * `flow-fetch` emits: `fetch-start` / `fetch-done` / `fetch-error`). Returns
+ * undefined for anything that is not a network publish carrying a URL, so
+ * every other publish passes through untouched.
+ */
+function networkDetails(category, raw) {
+    if (category !== 'network' || !raw || typeof raw !== 'object')
+        return undefined;
+    const r = raw;
+    if (typeof r.url !== 'string' || r.url.length === 0)
+        return undefined;
+    return {
+        url: r.url,
+        redactedUrl: redactUrl(r.url),
+        ...(typeof r.status === 'number' ? { status: r.status } : {}),
+    };
+}
 function normaliseStackTopFrame(stack) {
     if (!stack)
         return 'unknown';

package/lib/redact.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Redaction + bounding for browser-originated event text.
+ *
+ * ── Why this exists ─────────────────────────────────────────────────────────
+ * Until now the browser taps recorded almost nothing about an error, so there
+ * was nothing to leak. Enriching them (message, stack, method/URL/status)
+ * changes that: a request URL routinely carries a credential in its query
+ * string (`?access_token=…`, `?code=…` on an OAuth callback, `?key=…` on a
+ * Google API), and an error message can quote a JWT or an `Authorization`
+ * header. Those values then land in `runtime://browser/*`, which an agent
+ * reads and may quote into a transcript.
+ *
+ * So enrichment and redaction ship together, in the same place. This module is
+ * applied in `envelopeToEvent` — the ONE function every browser envelope
+ * crosses on its way to the bus — rather than at each tap, so a tap cannot
+ * forget it and a hand-rolled client cannot bypass it.
+ *
+ * `nx.json` has carried a `redaction: { headers, paths }` block since the init
+ * generator was written, with no reader anywhere in the repo. This is the
+ * first code to honour that intent; the lists below are a superset of it.
+ *
+ * ── Deliberately NOT done here ──────────────────────────────────────────────
+ * • Request/response HEADERS are never captured in the first place (the taps
+ *   read none), which is the strongest possible defence — nothing to redact.
+ *   Keep it that way; do not add header capture without extending this module.
+ * • Request/response BODIES are likewise never captured.
+ * • Free text is scrubbed for credential SHAPES (JWT, `Bearer …`), not parsed
+ *   for arbitrary URLs. A URL embedded in a stack frame keeps its query
+ *   string. Widening that means running the URL redactor over every message,
+ *   which is a cost/false-positive trade not worth making blind.
+ */
+/** Replacement for a redacted value. Short, obvious, greppable. */
+export declare const REDACTED = "REDACTED";
+/**
+ * Bounds. `raw` is structurally clamped to 32KiB by the bus transform
+ * (`createEventClamp`, wired in `@lensmcp/session`), but `title`/`message` are
+ * NOT — they are plain strings on `BaseEvent` and reach every reader
+ * unclamped. A stack from a deep React tree is routinely tens of KB, so these
+ * are the bounds that actually keep an event small.
+ */
+export declare const MAX_TITLE_CHARS = 300;
+export declare const MAX_MESSAGE_CHARS = 4096;
+export declare const MAX_URL_CHARS = 1024;
+/** Is this query-parameter name carrying a credential? */
+export declare function isSecretParam(name: string): boolean;
+/**
+ * Strip credentials from a URL, preserving every other byte.
+ *
+ * Implemented as a regex rewrite rather than `new URL(...)` on purpose:
+ * `URL` re-encodes as it round-trips (`+` vs `%20`, dropped default ports,
+ * sorted-looking output), which would mean the URL an agent reads is not the
+ * URL the app requested. It also throws on relative inputs, which is most of
+ * what a SPA fetches. This keeps the string byte-identical apart from the
+ * redacted values, and never throws.
+ *
+ * Redacts, in order: userinfo, then any query OR fragment parameter whose name
+ * looks like a credential. The fragment matters — an OAuth implicit-flow
+ * callback puts the access token there (`#access_token=…`).
+ */
+export declare function redactUrl(url: string): string;
+/**
+ * Scrub credential SHAPES out of free text (an error message, a stack, a
+ * console line). Cheap, linear, and tuned for precision over recall — a false
+ * positive destroys the diagnostic value this whole change is adding.
+ */
+export declare function redactText(text: string): string;
+/**
+ * Bound a string, marking what was removed. Marker text matches
+ * `@lensmcp/storage`'s `clampEventRaw` so the two truncations read the same in
+ * a transcript.
+ */
+export declare function clip(value: string, max: number): string;
+/** Redact then bound — the standard treatment for any captured free text. */
+export declare function safeText(value: string | undefined, max?: number): string | undefined;
+/** Redact then bound — the standard treatment for a captured title. */
+export declare function safeTitle(value: string): string;
+/**
+ * Scrub credential shapes out of every string leaf of an arbitrary value.
+ *
+ * Needed for `console` arguments, which are the one captured payload that is
+ * genuinely unstructured — `console.log('auth', { token })` is ordinary
+ * debugging code, and the whole point of this change is that those payloads
+ * now reach a transcript. Bounded on depth and array length so a pathological
+ * object cannot make the bridge the slow part of a page's logging.
+ *
+ * Values are returned by reference when nothing changed, so the common case
+ * (no credential anywhere) allocates nothing.
+ */
+export declare function redactDeep(value: unknown, depth?: number): unknown;

package/lib/redact.js

@@ -0,0 +1,215 @@
+/**
+ * Redaction + bounding for browser-originated event text.
+ *
+ * ── Why this exists ─────────────────────────────────────────────────────────
+ * Until now the browser taps recorded almost nothing about an error, so there
+ * was nothing to leak. Enriching them (message, stack, method/URL/status)
+ * changes that: a request URL routinely carries a credential in its query
+ * string (`?access_token=…`, `?code=…` on an OAuth callback, `?key=…` on a
+ * Google API), and an error message can quote a JWT or an `Authorization`
+ * header. Those values then land in `runtime://browser/*`, which an agent
+ * reads and may quote into a transcript.
+ *
+ * So enrichment and redaction ship together, in the same place. This module is
+ * applied in `envelopeToEvent` — the ONE function every browser envelope
+ * crosses on its way to the bus — rather than at each tap, so a tap cannot
+ * forget it and a hand-rolled client cannot bypass it.
+ *
+ * `nx.json` has carried a `redaction: { headers, paths }` block since the init
+ * generator was written, with no reader anywhere in the repo. This is the
+ * first code to honour that intent; the lists below are a superset of it.
+ *
+ * ── Deliberately NOT done here ──────────────────────────────────────────────
+ * • Request/response HEADERS are never captured in the first place (the taps
+ *   read none), which is the strongest possible defence — nothing to redact.
+ *   Keep it that way; do not add header capture without extending this module.
+ * • Request/response BODIES are likewise never captured.
+ * • Free text is scrubbed for credential SHAPES (JWT, `Bearer …`), not parsed
+ *   for arbitrary URLs. A URL embedded in a stack frame keeps its query
+ *   string. Widening that means running the URL redactor over every message,
+ *   which is a cost/false-positive trade not worth making blind.
+ */
+/** Replacement for a redacted value. Short, obvious, greppable. */
+export const REDACTED = 'REDACTED';
+/**
+ * Bounds. `raw` is structurally clamped to 32KiB by the bus transform
+ * (`createEventClamp`, wired in `@lensmcp/session`), but `title`/`message` are
+ * NOT — they are plain strings on `BaseEvent` and reach every reader
+ * unclamped. A stack from a deep React tree is routinely tens of KB, so these
+ * are the bounds that actually keep an event small.
+ */
+export const MAX_TITLE_CHARS = 300;
+export const MAX_MESSAGE_CHARS = 4096;
+export const MAX_URL_CHARS = 1024;
+/**
+ * Substrings that make a query-parameter name a credential regardless of how
+ * it is spelled or delimited. These are safe as substrings — no ordinary
+ * parameter name contains them innocently.
+ */
+const SECRET_SUBSTRINGS = [
+    'token',
+    'secret',
+    'password',
+    'passwd',
+    'apikey',
+    'credential',
+    'assertion',
+    'signature',
+];
+/**
+ * Whole delimiter-separated words that make a parameter name a credential.
+ * Matched per-word (splitting on `-`, `_`, `.`) rather than as substrings,
+ * because the short ones collide: `auth` is a substring of `author`, `key` of
+ * `keywords`, `sig` of `sign_up_date`. Word matching keeps `?author=jane` and
+ * `?keywords=x` intact while still catching `?api_key=`/`?x-auth=`.
+ */
+const SECRET_WORDS = new Set([
+    'key',
+    'auth',
+    'authorization',
+    'jwt',
+    'code',
+    'sig',
+    'pwd',
+    'pass',
+    'session',
+    'sid',
+    'bearer',
+    'otp',
+    // The `headers` half of the `nx.json` redaction contract. Relevant to
+    // `redactDeep` (a headers object logged to console) as much as to a query
+    // string.
+    'cookie',
+    'set-cookie',
+]);
+/** Is this query-parameter name carrying a credential? */
+export function isSecretParam(name) {
+    const n = name.toLowerCase();
+    if (SECRET_SUBSTRINGS.some((s) => n.includes(s)))
+        return true;
+    for (const word of n.split(/[-_.]+/)) {
+        if (word && SECRET_WORDS.has(word))
+            return true;
+    }
+    return false;
+}
+/**
+ * `scheme://user:pass@host` — credentials in the authority component.
+ * Anchored at the scheme so it cannot match a `@` inside a path or query.
+ */
+const USERINFO_RE = /^([a-z][a-z0-9+.-]*:\/\/)[^/?#@\s]*@/i;
+/**
+ * One `?name=value` / `&name=value` / `#name=value` pair. Values are matched
+ * lazily up to the next delimiter, so the walk is linear and cannot backtrack
+ * catastrophically on a long URL.
+ */
+const PARAM_RE = /([?&#])([^=&#\s]+)=([^&#\s]*)/g;
+/**
+ * Strip credentials from a URL, preserving every other byte.
+ *
+ * Implemented as a regex rewrite rather than `new URL(...)` on purpose:
+ * `URL` re-encodes as it round-trips (`+` vs `%20`, dropped default ports,
+ * sorted-looking output), which would mean the URL an agent reads is not the
+ * URL the app requested. It also throws on relative inputs, which is most of
+ * what a SPA fetches. This keeps the string byte-identical apart from the
+ * redacted values, and never throws.
+ *
+ * Redacts, in order: userinfo, then any query OR fragment parameter whose name
+ * looks like a credential. The fragment matters — an OAuth implicit-flow
+ * callback puts the access token there (`#access_token=…`).
+ */
+export function redactUrl(url) {
+    if (!url)
+        return url;
+    const withoutUserinfo = url.replace(USERINFO_RE, `$1${REDACTED}@`);
+    const withoutSecrets = withoutUserinfo.replace(PARAM_RE, (match, delim, name) => isSecretParam(name) ? `${delim}${name}=${REDACTED}` : match);
+    return clip(withoutSecrets, MAX_URL_CHARS);
+}
+/** A JSON Web Token: three base64url segments, the first starting `eyJ` (`{"`). */
+const JWT_RE = /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]*/g;
+/** `Bearer <token>` / `Basic <creds>`, however it was quoted or spaced. */
+const SCHEME_CREDENTIAL_RE = /\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+/**
+ * A credential-bearing header quoted into free text — `authorization: xyz`,
+ * `"x-api-key": "xyz"`, `cookie=xyz`. Only the VALUE is replaced so the reader
+ * still learns which header was involved.
+ */
+const HEADER_CREDENTIAL_RE = /\b(authorization|x-api-key|api-key|cookie|set-cookie|proxy-authorization)\b(\s*[:=]\s*)(["']?)([^\s"',;]{4,})\3/gi;
+/**
+ * Scrub credential SHAPES out of free text (an error message, a stack, a
+ * console line). Cheap, linear, and tuned for precision over recall — a false
+ * positive destroys the diagnostic value this whole change is adding.
+ */
+export function redactText(text) {
+    return text
+        .replace(HEADER_CREDENTIAL_RE, (_m, header, sep, quote) => `${header}${sep}${quote}${REDACTED}${quote}`)
+        .replace(JWT_RE, REDACTED)
+        .replace(SCHEME_CREDENTIAL_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
+}
+/**
+ * Bound a string, marking what was removed. Marker text matches
+ * `@lensmcp/storage`'s `clampEventRaw` so the two truncations read the same in
+ * a transcript.
+ */
+export function clip(value, max) {
+    if (value.length <= max)
+        return value;
+    return `${value.slice(0, max)}…[lensmcp truncated: ${value.length - max} more chars]`;
+}
+/** Redact then bound — the standard treatment for any captured free text. */
+export function safeText(value, max = MAX_MESSAGE_CHARS) {
+    if (value === undefined)
+        return undefined;
+    return clip(redactText(value), max);
+}
+/** Redact then bound — the standard treatment for a captured title. */
+export function safeTitle(value) {
+    return clip(redactText(value), MAX_TITLE_CHARS);
+}
+/** Depth ceiling for {@link redactDeep}; doubles as an allocation-free cycle guard. */
+const MAX_REDACT_DEPTH = 6;
+/** Array ceiling for {@link redactDeep}. Beyond this the tail is left as-is for the raw clamp to shed. */
+const MAX_REDACT_ITEMS = 64;
+/**
+ * Scrub credential shapes out of every string leaf of an arbitrary value.
+ *
+ * Needed for `console` arguments, which are the one captured payload that is
+ * genuinely unstructured — `console.log('auth', { token })` is ordinary
+ * debugging code, and the whole point of this change is that those payloads
+ * now reach a transcript. Bounded on depth and array length so a pathological
+ * object cannot make the bridge the slow part of a page's logging.
+ *
+ * Values are returned by reference when nothing changed, so the common case
+ * (no credential anywhere) allocates nothing.
+ */
+export function redactDeep(value, depth = 0) {
+    if (typeof value === 'string') {
+        return redactText(value);
+    }
+    if (value === null || typeof value !== 'object' || depth >= MAX_REDACT_DEPTH) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        let changed = false;
+        const out = value.map((item, i) => {
+            if (i >= MAX_REDACT_ITEMS)
+                return item;
+            const next = redactDeep(item, depth + 1);
+            if (next !== item)
+                changed = true;
+            return next;
+        });
+        return changed ? out : value;
+    }
+    let changed = false;
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+        // A key named like a credential is redacted whatever its value's shape —
+        // this is the `paths` half of the `nx.json` redaction contract.
+        const next = isSecretParam(key) && item !== undefined && item !== null ? REDACTED : redactDeep(item, depth + 1);
+        if (next !== item)
+            changed = true;
+        out[key] = next;
+    }
+    return changed ? out : value;
+}

package/lib/server.d.ts

@@ -53,4 +53,3 @@ export declare function handleClientEnvelope(raw: string, publish: (event: BaseE
 export declare function createBridgeServer(options?: BridgeServerOptions): Promise<BridgeServer>;
 /** Allocate an ephemeral free port (used when `port: 0` is requested). */
 export declare function findFreePort(): Promise<number>;
-//# sourceMappingURL=server.d.ts.map

package/lib/types.d.ts

@@ -8,18 +8,52 @@
  * no-build) shares one definition. The Vite plugin re-exports it for
  * backwards compatibility.
  */
-export type ClientEnvelope = ({
+export type ClientEnvelope = (
+/**
+ * An uncaught JS error (`window.onerror`). `message` is OPTIONAL because it
+ * genuinely can be absent: a synthesised or cross-origin `ErrorEvent`
+ * carries none, and 3 of the 7 real browser errors captured on foodguard
+ * (2026-07-30) had no message at all. `name` is the constructor name of the
+ * thrown value, which survives when a cross-origin policy strips the rest.
+ */
+{
     kind: 'error';
     at: number;
-    message: string;
+    message?: string;
+    name?: string;
     stack?: string;
     source?: string;
     lineno?: number;
     colno?: number;
-} | {
+}
+/**
+ * A SUBRESOURCE that failed to load — `<img>`, `<script>`, `<link>`,
+ * `<video>`. The browser delivers these through the SAME `error` listener as
+ * an uncaught exception, but as a plain `Event`, not an `ErrorEvent`: no
+ * message, no filename, no line. Its only identity is the target element and
+ * its `src`/`href`, which the tap previously never read — so every one of
+ * them serialised to a bare `{ kind: 'error', at, tabId }` and arrived
+ * completely anonymous. Splitting the kind is what makes that identity
+ * representable.
+ */
+ | {
+    kind: 'resource-error';
+    at: number;
+    tagName: string;
+    url?: string;
+}
+/**
+ * An unhandled promise rejection. The reason is decomposed rather than
+ * pre-stringified: a rejected non-Error object (`{ status: 401 }`, a
+ * `Response`) used to be flattened by `String(reason)` into the useless
+ * `"[object Object]"`.
+ */
+ | {
     kind: 'unhandledrejection';
     at: number;
     reason: string;
+    name?: string;
+    stack?: string;
 } | {
     kind: 'console';
     at: number;
@@ -31,6 +65,7 @@ export type ClientEnvelope = ({
     method: string;
     url: string;
     status?: number;
+    statusText?: string;
     durationMs?: number;
     ok?: boolean;
     error?: string;
@@ -61,4 +96,3 @@ export type ClientEnvelope = ({
 };
 /** A cross-process event sink: takes one normalised event and forwards it onward. */
 export type EnvSink = (event: import('@lensmcp/protocol-types').BaseEvent) => void;
-//# sourceMappingURL=types.d.ts.map

package/main.d.ts

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=main.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/bridge",
-  "version": "1.18.2",
+  "version": "1.18.4",
   "type": "module",
   "main": "./index.js",
   "module": "./index.js",
@@ -19,8 +19,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/core": "1.18.2",
-    "@lensmcp/protocol-types": "1.18.2",
+    "@lensmcp/core": "1.18.4",
+    "@lensmcp/protocol-types": "1.18.4",
     "tslib": "^2.3.0",
     "ws": "^8.21.0"
   },

package/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,4FAA4F;AAC5F,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAC7C,oFAAoF;AACpF,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAC7C,yEAAyE;AACzE,eAAO,MAAM,cAAc,uBAAuB,CAAC"}

package/lib/env-sink.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-sink.d.ts","sourceRoot":"","sources":["../../src/lib/env-sink.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAwF1C,wBAAgB,cAAc,IAAI,OAAO,GAAG,IAAI,CA6C/C;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgDhD"}

package/lib/event-mappers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-mappers.d.ts","sourceRoot":"","sources":["../../src/lib/event-mappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,SAAyB,GAAG,SAAS,CAuIlG"}

package/lib/server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/lib/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C,OAAO,KAAK,EAAkB,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAsB1E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,EACnC,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CASN;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmCjG;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgB9C"}

package/lib/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,CACzB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChH;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,EAAE,CAAA;CAAE,GACpG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9H;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAK7D;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CACJ,GAAG;IACF,0GAA0G;IAC1G,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,yBAAyB,EAAE,SAAS,KAAK,IAAI,CAAC"}

package/main.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}