@lore-co/cli 0.2.14 → 0.2.15

package/dist/runtime-redaction.js

@@ -0,0 +1,69 @@
+const NON_SECRET_TOKEN_VALUES = new Set([
+    "available",
+    "configured",
+    "generated",
+    "optional",
+    "placeholder",
+    "redacted",
+    "required",
+    "undefined",
+]);
+function redactedCredential(value) {
+    // Preserve markers from earlier token rules and repeated redaction passes.
+    if (/^\[REDACTED(?::[A-Z_]+|_[A-Z_]+)?\][.,!?]*$/u.test(value)) {
+        return value;
+    }
+    const trailing = /[.,!?]+$/u.exec(value)?.[0] ?? "";
+    return `[REDACTED:CREDENTIAL]${trailing}`;
+}
+// This standalone runtime cannot import @lore-co/core after it is copied to
+// ~/.lore. Keep these rules aligned with core/redaction.ts through parity tests.
+// Match invisible characters inside tokens without changing ordinary text;
+// real whitespace still separates token bodies and adjacent lines.
+const TOKEN_GAP = "(?:\\p{Cf}|(?!\\s)\\p{Cc})*";
+const tokenPrefix = (prefix) => Array.from(prefix, (character) => character.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(TOKEN_GAP);
+const tokenBody = (characters, minimum, maximum) => `${characters}(?:${TOKEN_GAP}${characters}){${minimum - 1},${maximum === undefined ? "" : maximum - 1}}`;
+const providerToken = (prefix, characters, minimum, maximum) => tokenPrefix(prefix) + TOKEN_GAP + tokenBody(characters, minimum, maximum);
+const AUTHORIZATION_TOKEN_PATTERN = new RegExp([
+    `\\b(${tokenPrefix("Bearer")}|${tokenPrefix("Basic")})`,
+    "[\\s\\p{Cc}\\p{Cf}]+",
+    tokenBody(/[A-Za-z0-9._~+\/=-]/u.source, 8),
+].join(""), "giu");
+const JWT_TOKEN_PATTERN = new RegExp(`\\b${tokenPrefix("eyJ")}${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}(?:${TOKEN_GAP}\\.${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}){2}\\b`, "gu");
+const PROVIDER_TOKEN_PATTERN = new RegExp(`\\b(?:${[
+    ...["sk-", "glpat-", "npm_", "pypi-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_-]", 16)),
+    ...["sk_live_", "sk_test_", "rk_live_", "rk_test_", "whsec_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9]", 16)),
+    ...["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_]", 20)),
+    ...["xoxb-", "xoxa-", "xoxp-", "xoxr-", "xoxs-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9-]", 10)),
+    providerToken("AIza", "[A-Za-z0-9_-]", 20),
+    providerToken("AKIA", "[0-9A-Z]", 16, 16),
+].join("|")})\\b`, "gu");
+export function redactSecrets(text) {
+    return text
+        .replace(/-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----/gu, "[REDACTED:PRIVATE_KEY]")
+        .replace(AUTHORIZATION_TOKEN_PATTERN, (_match, scheme) => `${scheme.replace(/[\p{Cc}\p{Cf}]/gu, "")} [REDACTED:AUTHORIZATION]`)
+        .replace(/\b((?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqps?):\/\/[^:\s/@]+:)[^@\s/]+@/giu, (_match, prefix) => `${prefix}[REDACTED:PASSWORD]@`)
+        .replace(JWT_TOKEN_PATTERN, "[REDACTED:JWT]")
+        .replace(PROVIDER_TOKEN_PATTERN, "[REDACTED:API_KEY]")
+        .replace(/(["']?)\b((?:(?:[A-Za-z][A-Za-z0-9]*[_-])*(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|connection[_-]?(?:string|url)|database[_-]?url|token|secret|password|passwd|credential)|[A-Za-z][A-Za-z0-9]*(?:token|secret|password|passwd|credential|apiKey|privateKey|connectionString|databaseUrl)))\b\1(\s*[:=]\s*)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
+        .replace(/(["']?)\b(api[ _-]?key|access[ _-]?token|auth[ _-]?token|client[ _-]?secret|private[ _-]?key|verification[ _-]?token|password|passwd|secret|credential)\b\1(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
+        .replace(/\b(token|credential)\b(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{8,})\3/giu, (match, name, separator, valueQuote, value) => {
+        const normalized = value
+            .replace(/^["']|["']$/gu, "")
+            .replace(/[.,!?]+$/gu, "");
+        const knownPlaceholder = NON_SECRET_TOKEN_VALUES.has(normalized.toLowerCase());
+        const classes = [
+            /[a-z]/u,
+            /[A-Z]/u,
+            /[0-9]/u,
+            /[^A-Za-z0-9]/u,
+        ].filter((pattern) => pattern.test(normalized)).length;
+        return !knownPlaceholder &&
+            (normalized.length >= 16 ||
+                (normalized.length >= 10 && classes >= 2))
+            ? `${name}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`
+            : match;
+    })
+        .replace(/\b((?:set-)?cookie\s*:\s*)[^\r\n]+/giu, (_match, prefix) => `${prefix}[REDACTED:AUTHORIZATION]`);
+}
+//# sourceMappingURL=runtime-redaction.js.map

package/dist/runtime-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-redaction.js","sourceRoot":"","sources":["../src/runtime-redaction.ts"],"names":[],"mappings":"AAAA,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,YAAY;IACZ,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,KAAa;IACvC,2EAA2E;IAC3E,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,wBAAwB,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,iFAAiF;AACjF,2EAA2E;AAC3E,mEAAmE;AACnE,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAChD,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAC/B,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAClD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAE,OAAe,EAAE,OAAgB,EAAE,EAAE,CAC1E,GAAG,UAAU,MAAM,SAAS,GAAG,UAAU,KAAK,OAAO,GAAG,CAAC,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC;AAC3G,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,UAAkB,EAClB,OAAe,EACf,OAAgB,EAChB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE/E,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAC5C;IACE,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG;IACvD,sBAAsB;IACtB,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5C,CAAC,IAAI,CAAC,EAAE,CAAC,EACV,KAAK,CACN,CAAC;AACF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,SAAS,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,EAC3I,IAAI,CACL,CAAC;AACF,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,SAAS;IACP,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAC3C;IACD,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3E,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CACzC;IACD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxE,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAC1C;IACD,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9D,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAC1C;IACD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;IAC1C,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EACjB,IAAI,CACL,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,OAAO,CACN,4IAA4I,EAC5I,wBAAwB,CACzB;SACA,OAAO,CACN,2BAA2B,EAC3B,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CACzB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,2BAA2B,CACvE;SACA,OAAO,CACN,iGAAiG,EACjG,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,sBAAsB,CAC5D;SACA,OAAO,CACN,iBAAiB,EACjB,gBAAgB,CACjB;SACA,OAAO,CACN,sBAAsB,EACtB,oBAAoB,CACrB;SACA,OAAO,CACN,iXAAiX,EACjX,CACE,MAAM,EACN,QAAgB,EAChB,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,EAAE,CACF,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,UAAU,EAAE,CACpG;SACA,OAAO,CACN,mNAAmN,EACnN,CACE,MAAM,EACN,QAAgB,EAChB,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,EAAE,CACF,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,UAAU,EAAE,CACpG;SACA,OAAO,CACN,8EAA8E,EAC9E,CACE,KAAK,EACL,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,EAAE;QACF,MAAM,UAAU,GAAG,KAAK;aACrB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,GAAG,CAClD,UAAU,CAAC,WAAW,EAAE,CACzB,CAAC;QACF,MAAM,OAAO,GAAG;YACd,QAAQ;YACR,QAAQ;YACR,QAAQ;YACR,eAAe;SAChB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,OAAO,CAAC,gBAAgB;YACtB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE;gBACtB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,UAAU,EAAE;YAC7E,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC,CACF;SACA,OAAO,CACN,uCAAuC,EACvC,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,0BAA0B,CAChE,CAAC;AACN,CAAC"}

package/dist/runtime.d.ts

@@ -1,3 +1,4 @@
+export { redactSecrets } from "./runtime-redaction.js";
 export declare const COMMAND_HOOK_AGENT_NAMES: readonly ["codex", "claude", "copilot-cli", "copilot-vscode", "cursor", "polytoken"];
 export type CommandHookAgentName = (typeof COMMAND_HOOK_AGENT_NAMES)[number];
 /** @deprecated Use CommandHookAgentName for native command-hook integrations. */
@@ -17,6 +18,7 @@ export interface TurnRequest {
     agent: CommandHookAgentName;
     sessionId: string;
     retainedReceiptIds?: string[];
+    task?: string;
     previousAssistant: {
         content: string;
         id?: string;
@@ -115,7 +117,6 @@ export interface LineageMetadata {
  * be attributed to the machine that produced them.
  */
 export declare function readLineageMetadata(home?: string, environment?: NodeJS.ProcessEnv): Promise<LineageMetadata>;
-export declare function redactSecrets(text: string): string;
 export declare function createTurnRequest(input: HookInput, agent: CommandHookAgentName, pending: PendingAssistantMessage, now: Date, lineage?: LineageMetadata): Promise<TurnRequest | null>;
 interface GuardTrigger {
     action: "edit" | "commit" | "deploy" | "command";
@@ -133,5 +134,4 @@ export declare function handleHookEvent(value: unknown, agent: CommandHookAgentN
 export declare function getCursorContext(sessionId: string, prompt: string, options?: HookRuntimeOptions): Promise<string>;
 export declare function completeCursorResponse(sessionId: string, response: string, options?: HookRuntimeOptions): Promise<void>;
 export declare function runHook(args?: readonly string[]): Promise<void>;
-export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AA4DA,eAAO,MAAM,wBAAwB,sFAO3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7E,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAkB7C,UAAU,uBAAuB;IAC/B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,UAAU,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,aAAa,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA2BD,UAAU,SAAS;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,aAAa,EAAE,kBAAkB,GAAG,YAAY,CAAC;QACjD,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;QACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAoGD,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAwTD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+ElD;AA4QD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,IAAI,EACT,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA+D7B;AAm0CD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,YAAY,GAAG,IAAI,CAErB;AAwhBD,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CA4IjC;AA4BD,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAClE,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GACpE,OAAO,CAAC,IAAI,CAAC,CAMf;AAsZD,wBAAsB,OAAO,CAC3B,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,IAAI,CAAC,CAqCf"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAgEvD,eAAO,MAAM,wBAAwB,sFAO3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7E,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAkB7C,UAAU,uBAAuB;IAC/B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,UAAU,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,aAAa,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA2BD,UAAU,SAAS;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,aAAa,EAAE,kBAAkB,GAAG,YAAY,CAAC;QACjD,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;QACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAmFD,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAqhBD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,IAAI,EACT,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA+D7B;AA80CD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,YAAY,GAAG,IAAI,CAErB;AA+hBD,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CA+IjC;AA+BD,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAClE,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GACpE,OAAO,CAAC,IAAI,CAAC,CAMf;AAiaD,wBAAsB,OAAO,CAC3B,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/runtime.js

@@ -1,6 +1,10 @@
+import { redactSecrets } from "./runtime-redaction.js";
+export { redactSecrets } from "./runtime-redaction.js";
 import { createHash, randomUUID } from "node:crypto";
 import { approachGuidance } from "./approach-guidance.js";
+import { skillGuidance } from "./skill-guidance.js";
 import { retainedContextTexts, retainedReceiptIds, rememberDeliveredContext } from "./retained-context.js";
+import { clearRetrievalTask, resolveRetrievalTask } from "./retrieval-task.js";
 import { access, chmod, mkdir, readFile, stat, } from "node:fs/promises";
 import { constants as fsConstants, realpathSync } from "node:fs";
 import { execFile as execFileCallback } from "node:child_process";
@@ -8,7 +12,7 @@ import { dirname, parse, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-import { boundedUtf8Text, repositoryScopeFromGitRoot, } from "./repository.js";
+import { boundedUtf8Text, defaultGitPushBranches, repositoryScopeFromGitRoot, } from "./repository.js";
 import { ReliabilityStore, ReliabilityStoreError, atomicWriteJson as durableAtomicWriteJson, classifyRetryFailure, createIntegrationInvocationAttempt, durableUnlink, recordLocalGuardMetric, recordLocalRetrievalMetric, } from "./reliability-store.js";
 import { writeInvocationAttemptBounded, writeInvocationCompletionBounded, } from "./invocation-health-writer.js";
 import { SignedSnapshotError, verifySignedSnapshot, } from "./signed-snapshot.js";
@@ -58,24 +62,6 @@ const RELIABILITY_REASON_CODES = new Set([
     "invalid_response",
     "integration_unsupported",
 ]);
-const NON_SECRET_TOKEN_VALUES = new Set([
-    "available",
-    "configured",
-    "generated",
-    "optional",
-    "placeholder",
-    "redacted",
-    "required",
-    "undefined",
-]);
-function redactedCredential(value) {
-    // Preserve markers from earlier token rules and repeated redaction passes.
-    if (/^\[REDACTED(?::[A-Z_]+|_[A-Z_]+)?\][.,!?]*$/u.test(value)) {
-        return value;
-    }
-    const trailing = /[.,!?]+$/u.exec(value)?.[0] ?? "";
-    return `[REDACTED:CREDENTIAL]${trailing}`;
-}
 const execFile = promisify(execFileCallback);
 function homeDirectory(override) {
     return override ?? process.env.LORE_HOME ?? process.env.HOME ?? homedir();
@@ -339,52 +325,6 @@ function deterministicUuid(value) {
         joined.slice(20, 32),
     ].join("-");
 }
-// This standalone runtime cannot import @lore-co/core after it is copied to
-// ~/.lore. Keep these rules aligned with core/redaction.ts through parity tests.
-// Match invisible characters inside tokens without changing ordinary text;
-// real whitespace still separates token bodies and adjacent lines.
-const TOKEN_GAP = "(?:\\p{Cf}|(?!\\s)\\p{Cc})*";
-const tokenPrefix = (prefix) => Array.from(prefix, (character) => character.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(TOKEN_GAP);
-const tokenBody = (characters, minimum, maximum) => `${characters}(?:${TOKEN_GAP}${characters}){${minimum - 1},${maximum === undefined ? "" : maximum - 1}}`;
-const providerToken = (prefix, characters, minimum, maximum) => tokenPrefix(prefix) + TOKEN_GAP + tokenBody(characters, minimum, maximum);
-const AUTHORIZATION_TOKEN_PATTERN = new RegExp(`\\b(${tokenPrefix("Bearer")}|${tokenPrefix("Basic")})[\\s\\p{Cc}\\p{Cf}]+${tokenBody("[A-Za-z0-9._~+/=-]", 8)}`, "giu");
-const JWT_TOKEN_PATTERN = new RegExp(`\\b${tokenPrefix("eyJ")}${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}(?:${TOKEN_GAP}\\.${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}){2}\\b`, "gu");
-const PROVIDER_TOKEN_PATTERN = new RegExp(`\\b(?:${[
-    ...["sk-", "glpat-", "npm_", "pypi-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_-]", 16)),
-    ...["sk_live_", "sk_test_", "rk_live_", "rk_test_", "whsec_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9]", 16)),
-    ...["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_]", 20)),
-    ...["xoxb-", "xoxa-", "xoxp-", "xoxr-", "xoxs-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9-]", 10)),
-    providerToken("AIza", "[A-Za-z0-9_-]", 20),
-    providerToken("AKIA", "[0-9A-Z]", 16, 16),
-].join("|")})\\b`, "gu");
-export function redactSecrets(text) {
-    return text
-        .replace(/-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----/gu, "[REDACTED:PRIVATE_KEY]")
-        .replace(AUTHORIZATION_TOKEN_PATTERN, (_match, scheme) => `${scheme.replace(/[\p{Cc}\p{Cf}]/gu, "")} [REDACTED:AUTHORIZATION]`)
-        .replace(/\b((?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqps?):\/\/[^:\s/@]+:)[^@\s/]+@/giu, (_match, prefix) => `${prefix}[REDACTED:PASSWORD]@`)
-        .replace(JWT_TOKEN_PATTERN, "[REDACTED:JWT]")
-        .replace(PROVIDER_TOKEN_PATTERN, "[REDACTED:API_KEY]")
-        .replace(/(["']?)\b((?:(?:[A-Za-z][A-Za-z0-9]*[_-])*(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|connection[_-]?(?:string|url)|database[_-]?url|token|secret|password|passwd|credential)|[A-Za-z][A-Za-z0-9]*(?:token|secret|password|passwd|credential|apiKey|privateKey|connectionString|databaseUrl)))\b\1(\s*[:=]\s*)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
-        .replace(/(["']?)\b(api[ _-]?key|access[ _-]?token|auth[ _-]?token|client[ _-]?secret|private[ _-]?key|verification[ _-]?token|password|passwd|secret|credential)\b\1(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
-        .replace(/\b(token|credential)\b(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{8,})\3/giu, (match, name, separator, valueQuote, value) => {
-        const normalized = value
-            .replace(/^["']|["']$/gu, "")
-            .replace(/[.,!?]+$/gu, "");
-        const knownPlaceholder = NON_SECRET_TOKEN_VALUES.has(normalized.toLowerCase());
-        const classes = [
-            /[a-z]/u,
-            /[A-Z]/u,
-            /[0-9]/u,
-            /[^A-Za-z0-9]/u,
-        ].filter((pattern) => pattern.test(normalized)).length;
-        return !knownPlaceholder &&
-            (normalized.length >= 16 ||
-                (normalized.length >= 10 && classes >= 2))
-            ? `${name}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`
-            : match;
-    })
-        .replace(/\b((?:set-)?cookie\s*:\s*)[^\r\n]+/giu, (_match, prefix) => `${prefix}[REDACTED:AUTHORIZATION]`);
-}
 async function atomicWriteJson(path, value) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     await chmod(dirname(path), 0o700);
@@ -839,6 +779,10 @@ function deliveryFromResponse(value) {
                 : memorySummaries(value.memories);
     return {
         context: boundedContext(context),
+        ...(typeof value.relatedContext === "string" ? { relatedContext: redactSecrets(value.relatedContext).slice(0, 2_500) }
+            : isObject(value.context) && typeof value.context.relatedContext === "string" ? { relatedContext: redactSecrets(value.context.relatedContext).slice(0, 2_500) } : {}),
+        ...(typeof value.skillContext === "string" && value.skillContext.length <= 72_000 ? { skillContext: redactSecrets(value.skillContext) }
+            : isObject(value.context) && typeof value.context.skillContext === "string" && value.context.skillContext.length <= 72_000 ? { skillContext: redactSecrets(value.context.skillContext) } : {}),
         completeContext: context.length <= MAX_CONTEXT_CHARS,
         ...(receiptId === undefined ? {} : { receiptId }),
         learned,
@@ -891,6 +835,8 @@ function deliveryFromSignedContext(payload, expectedRequest) {
     }
     return deliveryFromResponse({
         context: payload.context,
+        relatedContext: payload.relatedContext,
+        skillContext: payload.skillContext,
         receipt: { id: payload.receiptId },
         memories: payload.memories,
         hits: payload.hits,
@@ -1137,6 +1083,8 @@ async function postTurn(config, request, fetchImplementation, store) {
     const response = await fetchImplementation(turnsUrl(config.apiUrl), {
         method: "POST",
         headers: {
+            "x-lore-context": "related-work-v1",
+            "x-lore-skills": "skills-v1",
             accept: runtimeAccept(config),
             authorization: `Bearer ${config.token}`,
             "content-type": "application/json",
@@ -1202,7 +1150,7 @@ async function postTurn(config, request, fetchImplementation, store) {
         task: {
             agent: request.agent,
             ...(request.scope === undefined ? {} : { scope: request.scope }),
-            task: request.currentUser.content.trim(),
+            task: request.task ?? request.currentUser.content.trim(),
         },
     });
     await store
@@ -1284,6 +1232,8 @@ async function getPromptContext(config, agent, sessionId, sourceEventId, prompt,
     const response = await fetchImplementation(contextDeliveriesUrl(config.apiUrl), {
         method: "POST",
         headers: {
+            "x-lore-context": "related-work-v1",
+            "x-lore-skills": "skills-v1",
             accept: runtimeAccept(config),
             authorization: `Bearer ${config.token}`,
             "content-type": "application/json",
@@ -1414,6 +1364,7 @@ async function getCachedPromptContext(config, prompt, gitContext, store, now, re
     }
     return {
         context: retained.includes(String(selected.payload.receiptId)) ? "" : selected.context,
+        skillContext: "Lore is using saved learning context. Enabled skills could not be checked and saved skill instructions have not been reapplied. Reconnect to Lore before relying on skills for this task.",
         learned: [],
         delivered: [],
         reliability: {
@@ -1904,6 +1855,7 @@ async function offlineGuard(config, store, request, now, previouslyEnforced, all
                 ...(typeof request.repo === "string" ? { repo: request.repo } : {}),
                 ...(typeof request.path === "string" ? { path: request.path } : {}),
                 ...(typeof request.command === "string" ? { command: request.command } : {}),
+                ...(Array.isArray(request.defaultPushBranches) ? { defaultPushBranches: request.defaultPushBranches.filter((branch) => typeof branch === "string") } : {}),
                 ...(Array.isArray(request.files) ? { files: request.files.filter((file) => typeof file === "string") } : {}),
             }) !== null) : [];
         return {
@@ -1976,6 +1928,12 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
     const startedAt = Date.now();
     let result;
     const guardRequest = {
+        ...await (async () => {
+            const args = isObject(input.tool_input) ? input.tool_input : {};
+            const changesContext = ["cwd", "workdir", "working_directory", "env", "environment"].some(key => args[key] !== undefined);
+            const defaultPushBranches = changesContext ? undefined : await defaultGitPushBranches(trigger.command, cwd);
+            return defaultPushBranches ? { defaultPushBranches } : {};
+        })(),
         connector: "lore-cli",
         agent,
         sessionId,
@@ -2103,6 +2061,9 @@ export async function handleHookEvent(value, agent, options = {}) {
     const access = await checkLoreAccess(stringField(input.cwd), options.home, config, options.fetch ?? globalThis.fetch);
     if (!access.allowed) {
         await clearPending(agent, sessionId, options.home, config.connectionId);
+        await runtimeStore(config, options.home).then(store => clearRetrievalTask(store, {
+            agent, sessionId, connectionKey: credentialReliabilityWorkspaceKey(config),
+        })).catch(() => undefined);
         // A policy outage must not silently bypass an already enforced Guard.
         if (eventName === "PreToolUse" && access.reason === "Workspace repository settings are unavailable") {
             const prior = await readGuardState(agent, sessionId, options.home, config.connectionId).catch(() => null);
@@ -2239,8 +2200,10 @@ async function cursorSession(sessionId, options) {
         throw new Error("Start a new Cursor conversation to register this Lore session.");
     }
     const access = await checkLoreAccess(stringField(state.cwd), options.home, config, options.fetch ?? globalThis.fetch);
-    if (!access.allowed)
+    if (!access.allowed) {
+        await clearRetrievalTask(store, { agent: "cursor", sessionId, connectionKey: credentialReliabilityWorkspaceKey(config) }).catch(() => undefined);
         throw new Error(`Lore is off: ${access.reason}.`);
+    }
     return { config, store, state, cwd: stringField(state.cwd) };
 }
 export async function getCursorContext(sessionId, prompt, options = {}) {
@@ -2327,12 +2290,20 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
     };
     const lineage = await readLineageMetadata(options.home, options.environment ?? process.env);
     let delivery = emptyDelivery();
+    const retrievalTask = (repo) => resolveRetrievalTask(store, {
+        agent, sessionId, connectionKey: credentialReliabilityWorkspaceKey(config),
+        cwd: stringField(input.cwd), repo,
+    }, prompt, now, pending?.cwd === stringField(input.cwd) && pending
+        ? { content: pending.assistantMessage, capturedAt: pending.capturedAt } : undefined);
     if (pending !== null) {
         let receivedTurnContext = false;
         const request = await createTurnRequest(input, agent, pending, now, lineage);
         if (request === null) {
             return undefined;
         }
+        const task = await retrievalTask(request.scope?.repo);
+        if (task !== request.currentUser.content.trim())
+            request.task = task;
         if (retained.length)
             request.retainedReceiptIds = retained;
         let enqueued = false;
@@ -2370,7 +2341,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
         }
         if (retrieve && !receivedTurnContext) {
             try {
-                delivery = await getPromptContextWithFallback(config, agent, sessionId, request.eventId, prompt, {
+                delivery = await getPromptContextWithFallback(config, agent, sessionId, request.eventId, task, {
                     ...(request.scope === undefined ? {} : { scope: request.scope }),
                     learningScope: request.learningScope,
                     ...(request.diff === undefined ? {} : { diff: request.diff }),
@@ -2399,6 +2370,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
     }
     else {
         const gitContext = await collectGitContext(stringField(input.cwd));
+        const task = await retrievalTask(gitContext.scope?.repo);
         const observation = createPromptObservationRequest(input, agent, sessionId, now, gitContext, lineage);
         if (observation === null) {
             return undefined;
@@ -2432,7 +2404,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
         }
         if (retrieve) {
             try {
-                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, prompt, gitContext, fetchImplementation, store, now, retained);
+                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, task, gitContext, fetchImplementation, store, now, retained);
             }
             catch {
                 delivery = {
@@ -2480,7 +2452,10 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
     const receipt = receiptMessage(config, agent, delivery);
     if (retrieve && delivery.completeContext)
         await rememberDeliveredContext(store, contextSession, delivery).catch(() => undefined);
-    const taskContext = [delivery.context, delivery.reliability?.status === "failed" ? undefined : approachGuidance(prompt, agent, redactSecrets(sessionId), retainedContext)].filter(Boolean).join("\n\n");
+    const relatedContext = delivery.relatedContext && !retainedContext.some(text => text.includes(delivery.relatedContext))
+        ? delivery.relatedContext : undefined;
+    // Skills are fresh on every turn, even when learning context is retained.
+    const taskContext = [delivery.skillContext, delivery.context, relatedContext, delivery.reliability?.status === "failed" ? undefined : approachGuidance(prompt, agent, redactSecrets(sessionId), retainedContext), delivery.skillContext === undefined && delivery.reliability?.status !== "failed" ? skillGuidance(retainedContext) : undefined].filter(Boolean).join("\n\n");
     const systemMessage = agent === "cursor" || agent === "polytoken"
         ? undefined
         : [receipt, reliabilityNotice].filter(Boolean).join(" · ") || undefined;