@lore-co/cli 0.2.14 → 0.2.16

package/dist/runtime-redaction.js

@@ -0,0 +1,69 @@
+const NON_SECRET_TOKEN_VALUES = new Set([
+    "available",
+    "configured",
+    "generated",
+    "optional",
+    "placeholder",
+    "redacted",
+    "required",
+    "undefined",
+]);
+function redactedCredential(value) {
+    // Preserve markers from earlier token rules and repeated redaction passes.
+    if (/^\[REDACTED(?::[A-Z_]+|_[A-Z_]+)?\][.,!?]*$/u.test(value)) {
+        return value;
+    }
+    const trailing = /[.,!?]+$/u.exec(value)?.[0] ?? "";
+    return `[REDACTED:CREDENTIAL]${trailing}`;
+}
+// This standalone runtime cannot import @lore-co/core after it is copied to
+// ~/.lore. Keep these rules aligned with core/redaction.ts through parity tests.
+// Match invisible characters inside tokens without changing ordinary text;
+// real whitespace still separates token bodies and adjacent lines.
+const TOKEN_GAP = "(?:\\p{Cf}|(?!\\s)\\p{Cc})*";
+const tokenPrefix = (prefix) => Array.from(prefix, (character) => character.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(TOKEN_GAP);
+const tokenBody = (characters, minimum, maximum) => `${characters}(?:${TOKEN_GAP}${characters}){${minimum - 1},${maximum === undefined ? "" : maximum - 1}}`;
+const providerToken = (prefix, characters, minimum, maximum) => tokenPrefix(prefix) + TOKEN_GAP + tokenBody(characters, minimum, maximum);
+const AUTHORIZATION_TOKEN_PATTERN = new RegExp([
+    `\\b(${tokenPrefix("Bearer")}|${tokenPrefix("Basic")})`,
+    "[\\s\\p{Cc}\\p{Cf}]+",
+    tokenBody(/[A-Za-z0-9._~+\/=-]/u.source, 8),
+].join(""), "giu");
+const JWT_TOKEN_PATTERN = new RegExp(`\\b${tokenPrefix("eyJ")}${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}(?:${TOKEN_GAP}\\.${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}){2}\\b`, "gu");
+const PROVIDER_TOKEN_PATTERN = new RegExp(`\\b(?:${[
+    ...["sk-", "glpat-", "npm_", "pypi-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_-]", 16)),
+    ...["sk_live_", "sk_test_", "rk_live_", "rk_test_", "whsec_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9]", 16)),
+    ...["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_]", 20)),
+    ...["xoxb-", "xoxa-", "xoxp-", "xoxr-", "xoxs-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9-]", 10)),
+    providerToken("AIza", "[A-Za-z0-9_-]", 20),
+    providerToken("AKIA", "[0-9A-Z]", 16, 16),
+].join("|")})\\b`, "gu");
+export function redactSecrets(text) {
+    return text
+        .replace(/-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----/gu, "[REDACTED:PRIVATE_KEY]")
+        .replace(AUTHORIZATION_TOKEN_PATTERN, (_match, scheme) => `${scheme.replace(/[\p{Cc}\p{Cf}]/gu, "")} [REDACTED:AUTHORIZATION]`)
+        .replace(/\b((?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqps?):\/\/[^:\s/@]+:)[^@\s/]+@/giu, (_match, prefix) => `${prefix}[REDACTED:PASSWORD]@`)
+        .replace(JWT_TOKEN_PATTERN, "[REDACTED:JWT]")
+        .replace(PROVIDER_TOKEN_PATTERN, "[REDACTED:API_KEY]")
+        .replace(/(["']?)\b((?:(?:[A-Za-z][A-Za-z0-9]*[_-])*(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|connection[_-]?(?:string|url)|database[_-]?url|token|secret|password|passwd|credential)|[A-Za-z][A-Za-z0-9]*(?:token|secret|password|passwd|credential|apiKey|privateKey|connectionString|databaseUrl)))\b\1(\s*[:=]\s*)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
+        .replace(/(["']?)\b(api[ _-]?key|access[ _-]?token|auth[ _-]?token|client[ _-]?secret|private[ _-]?key|verification[ _-]?token|password|passwd|secret|credential)\b\1(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
+        .replace(/\b(token|credential)\b(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{8,})\3/giu, (match, name, separator, valueQuote, value) => {
+        const normalized = value
+            .replace(/^["']|["']$/gu, "")
+            .replace(/[.,!?]+$/gu, "");
+        const knownPlaceholder = NON_SECRET_TOKEN_VALUES.has(normalized.toLowerCase());
+        const classes = [
+            /[a-z]/u,
+            /[A-Z]/u,
+            /[0-9]/u,
+            /[^A-Za-z0-9]/u,
+        ].filter((pattern) => pattern.test(normalized)).length;
+        return !knownPlaceholder &&
+            (normalized.length >= 16 ||
+                (normalized.length >= 10 && classes >= 2))
+            ? `${name}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`
+            : match;
+    })
+        .replace(/\b((?:set-)?cookie\s*:\s*)[^\r\n]+/giu, (_match, prefix) => `${prefix}[REDACTED:AUTHORIZATION]`);
+}
+//# sourceMappingURL=runtime-redaction.js.map

package/dist/runtime-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-redaction.js","sourceRoot":"","sources":["../src/runtime-redaction.ts"],"names":[],"mappings":"AAAA,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,YAAY;IACZ,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,KAAa;IACvC,2EAA2E;IAC3E,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,wBAAwB,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,iFAAiF;AACjF,2EAA2E;AAC3E,mEAAmE;AACnE,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAChD,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAC/B,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAClD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAE,OAAe,EAAE,OAAgB,EAAE,EAAE,CAC1E,GAAG,UAAU,MAAM,SAAS,GAAG,UAAU,KAAK,OAAO,GAAG,CAAC,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC;AAC3G,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,UAAkB,EAClB,OAAe,EACf,OAAgB,EAChB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE/E,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAC5C;IACE,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG;IACvD,sBAAsB;IACtB,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5C,CAAC,IAAI,CAAC,EAAE,CAAC,EACV,KAAK,CACN,CAAC;AACF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,SAAS,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,EAC3I,IAAI,CACL,CAAC;AACF,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,SAAS;IACP,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAC3C;IACD,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3E,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CACzC;IACD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxE,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAC1C;IACD,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9D,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAC1C;IACD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;IAC1C,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EACjB,IAAI,CACL,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,OAAO,CACN,4IAA4I,EAC5I,wBAAwB,CACzB;SACA,OAAO,CACN,2BAA2B,EAC3B,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CACzB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,2BAA2B,CACvE;SACA,OAAO,CACN,iGAAiG,EACjG,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,sBAAsB,CAC5D;SACA,OAAO,CACN,iBAAiB,EACjB,gBAAgB,CACjB;SACA,OAAO,CACN,sBAAsB,EACtB,oBAAoB,CACrB;SACA,OAAO,CACN,iXAAiX,EACjX,CACE,MAAM,EACN,QAAgB,EAChB,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,EAAE,CACF,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,UAAU,EAAE,CACpG;SACA,OAAO,CACN,mNAAmN,EACnN,CACE,MAAM,EACN,QAAgB,EAChB,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,EAAE,CACF,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,UAAU,EAAE,CACpG;SACA,OAAO,CACN,8EAA8E,EAC9E,CACE,KAAK,EACL,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,EAAE;QACF,MAAM,UAAU,GAAG,KAAK;aACrB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,GAAG,CAClD,UAAU,CAAC,WAAW,EAAE,CACzB,CAAC;QACF,MAAM,OAAO,GAAG;YACd,QAAQ;YACR,QAAQ;YACR,QAAQ;YACR,eAAe;SAChB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,OAAO,CAAC,gBAAgB;YACtB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE;gBACtB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,UAAU,EAAE;YAC7E,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC,CACF;SACA,OAAO,CACN,uCAAuC,EACvC,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,0BAA0B,CAChE,CAAC;AACN,CAAC"}

package/dist/runtime.d.ts

@@ -1,3 +1,4 @@
+export { redactSecrets } from "./runtime-redaction.js";
 export declare const COMMAND_HOOK_AGENT_NAMES: readonly ["codex", "claude", "copilot-cli", "copilot-vscode", "cursor", "polytoken"];
 export type CommandHookAgentName = (typeof COMMAND_HOOK_AGENT_NAMES)[number];
 /** @deprecated Use CommandHookAgentName for native command-hook integrations. */
@@ -17,6 +18,7 @@ export interface TurnRequest {
     agent: CommandHookAgentName;
     sessionId: string;
     retainedReceiptIds?: string[];
+    task?: string;
     previousAssistant: {
         content: string;
         id?: string;
@@ -115,7 +117,6 @@ export interface LineageMetadata {
  * be attributed to the machine that produced them.
  */
 export declare function readLineageMetadata(home?: string, environment?: NodeJS.ProcessEnv): Promise<LineageMetadata>;
-export declare function redactSecrets(text: string): string;
 export declare function createTurnRequest(input: HookInput, agent: CommandHookAgentName, pending: PendingAssistantMessage, now: Date, lineage?: LineageMetadata): Promise<TurnRequest | null>;
 interface GuardTrigger {
     action: "edit" | "commit" | "deploy" | "command";
@@ -133,5 +134,4 @@ export declare function handleHookEvent(value: unknown, agent: CommandHookAgentN
 export declare function getCursorContext(sessionId: string, prompt: string, options?: HookRuntimeOptions): Promise<string>;
 export declare function completeCursorResponse(sessionId: string, response: string, options?: HookRuntimeOptions): Promise<void>;
 export declare function runHook(args?: readonly string[]): Promise<void>;
-export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AA4DA,eAAO,MAAM,wBAAwB,sFAO3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7E,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAkB7C,UAAU,uBAAuB;IAC/B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,UAAU,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,aAAa,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA2BD,UAAU,SAAS;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,aAAa,EAAE,kBAAkB,GAAG,YAAY,CAAC;QACjD,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;QACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAoGD,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAwTD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+ElD;AA4QD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,IAAI,EACT,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA+D7B;AAm0CD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,YAAY,GAAG,IAAI,CAErB;AAwhBD,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CA4IjC;AA4BD,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAClE,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GACpE,OAAO,CAAC,IAAI,CAAC,CAMf;AAsZD,wBAAsB,OAAO,CAC3B,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,IAAI,CAAC,CAqCf"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAiEvD,eAAO,MAAM,wBAAwB,sFAO3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7E,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAkB7C,UAAU,uBAAuB;IAC/B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,UAAU,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,aAAa,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA2BD,UAAU,SAAS;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,aAAa,EAAE,kBAAkB,GAAG,YAAY,CAAC;QACjD,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;QACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAmFD,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAqhBD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,IAAI,EACT,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA+D7B;AA+3CD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,YAAY,GAAG,IAAI,CAErB;AA+hBD,wBAAsB,eAAe,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CA+IjC;AA+BD,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAClE,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GACpE,OAAO,CAAC,IAAI,CAAC,CAMf;AA+aD,wBAAsB,OAAO,CAC3B,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/runtime.js

@@ -1,6 +1,11 @@
+import { redactSecrets } from "./runtime-redaction.js";
+export { redactSecrets } from "./runtime-redaction.js";
 import { createHash, randomUUID } from "node:crypto";
+import { CAPTURE_CONFLICT_MESSAGES } from "@lore-co/core/capture-conflict";
 import { approachGuidance } from "./approach-guidance.js";
+import { skillGuidance } from "./skill-guidance.js";
 import { retainedContextTexts, retainedReceiptIds, rememberDeliveredContext } from "./retained-context.js";
+import { clearRetrievalTask, resolveRetrievalTask } from "./retrieval-task.js";
 import { access, chmod, mkdir, readFile, stat, } from "node:fs/promises";
 import { constants as fsConstants, realpathSync } from "node:fs";
 import { execFile as execFileCallback } from "node:child_process";
@@ -8,7 +13,7 @@ import { dirname, parse, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-import { boundedUtf8Text, repositoryScopeFromGitRoot, } from "./repository.js";
+import { boundedUtf8Text, defaultGitPushBranches, repositoryScopeFromGitRoot, } from "./repository.js";
 import { ReliabilityStore, ReliabilityStoreError, atomicWriteJson as durableAtomicWriteJson, classifyRetryFailure, createIntegrationInvocationAttempt, durableUnlink, recordLocalGuardMetric, recordLocalRetrievalMetric, } from "./reliability-store.js";
 import { writeInvocationAttemptBounded, writeInvocationCompletionBounded, } from "./invocation-health-writer.js";
 import { SignedSnapshotError, verifySignedSnapshot, } from "./signed-snapshot.js";
@@ -58,24 +63,6 @@ const RELIABILITY_REASON_CODES = new Set([
     "invalid_response",
     "integration_unsupported",
 ]);
-const NON_SECRET_TOKEN_VALUES = new Set([
-    "available",
-    "configured",
-    "generated",
-    "optional",
-    "placeholder",
-    "redacted",
-    "required",
-    "undefined",
-]);
-function redactedCredential(value) {
-    // Preserve markers from earlier token rules and repeated redaction passes.
-    if (/^\[REDACTED(?::[A-Z_]+|_[A-Z_]+)?\][.,!?]*$/u.test(value)) {
-        return value;
-    }
-    const trailing = /[.,!?]+$/u.exec(value)?.[0] ?? "";
-    return `[REDACTED:CREDENTIAL]${trailing}`;
-}
 const execFile = promisify(execFileCallback);
 function homeDirectory(override) {
     return override ?? process.env.LORE_HOME ?? process.env.HOME ?? homedir();
@@ -339,52 +326,6 @@ function deterministicUuid(value) {
         joined.slice(20, 32),
     ].join("-");
 }
-// This standalone runtime cannot import @lore-co/core after it is copied to
-// ~/.lore. Keep these rules aligned with core/redaction.ts through parity tests.
-// Match invisible characters inside tokens without changing ordinary text;
-// real whitespace still separates token bodies and adjacent lines.
-const TOKEN_GAP = "(?:\\p{Cf}|(?!\\s)\\p{Cc})*";
-const tokenPrefix = (prefix) => Array.from(prefix, (character) => character.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(TOKEN_GAP);
-const tokenBody = (characters, minimum, maximum) => `${characters}(?:${TOKEN_GAP}${characters}){${minimum - 1},${maximum === undefined ? "" : maximum - 1}}`;
-const providerToken = (prefix, characters, minimum, maximum) => tokenPrefix(prefix) + TOKEN_GAP + tokenBody(characters, minimum, maximum);
-const AUTHORIZATION_TOKEN_PATTERN = new RegExp(`\\b(${tokenPrefix("Bearer")}|${tokenPrefix("Basic")})[\\s\\p{Cc}\\p{Cf}]+${tokenBody("[A-Za-z0-9._~+/=-]", 8)}`, "giu");
-const JWT_TOKEN_PATTERN = new RegExp(`\\b${tokenPrefix("eyJ")}${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}(?:${TOKEN_GAP}\\.${TOKEN_GAP}${tokenBody("[A-Za-z0-9_-]", 8)}){2}\\b`, "gu");
-const PROVIDER_TOKEN_PATTERN = new RegExp(`\\b(?:${[
-    ...["sk-", "glpat-", "npm_", "pypi-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_-]", 16)),
-    ...["sk_live_", "sk_test_", "rk_live_", "rk_test_", "whsec_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9]", 16)),
-    ...["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"].map((prefix) => providerToken(prefix, "[A-Za-z0-9_]", 20)),
-    ...["xoxb-", "xoxa-", "xoxp-", "xoxr-", "xoxs-"].map((prefix) => providerToken(prefix, "[A-Za-z0-9-]", 10)),
-    providerToken("AIza", "[A-Za-z0-9_-]", 20),
-    providerToken("AKIA", "[0-9A-Z]", 16, 16),
-].join("|")})\\b`, "gu");
-export function redactSecrets(text) {
-    return text
-        .replace(/-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----/gu, "[REDACTED:PRIVATE_KEY]")
-        .replace(AUTHORIZATION_TOKEN_PATTERN, (_match, scheme) => `${scheme.replace(/[\p{Cc}\p{Cf}]/gu, "")} [REDACTED:AUTHORIZATION]`)
-        .replace(/\b((?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqps?):\/\/[^:\s/@]+:)[^@\s/]+@/giu, (_match, prefix) => `${prefix}[REDACTED:PASSWORD]@`)
-        .replace(JWT_TOKEN_PATTERN, "[REDACTED:JWT]")
-        .replace(PROVIDER_TOKEN_PATTERN, "[REDACTED:API_KEY]")
-        .replace(/(["']?)\b((?:(?:[A-Za-z][A-Za-z0-9]*[_-])*(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|connection[_-]?(?:string|url)|database[_-]?url|token|secret|password|passwd|credential)|[A-Za-z][A-Za-z0-9]*(?:token|secret|password|passwd|credential|apiKey|privateKey|connectionString|databaseUrl)))\b\1(\s*[:=]\s*)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
-        .replace(/(["']?)\b(api[ _-]?key|access[ _-]?token|auth[ _-]?token|client[ _-]?secret|private[ _-]?key|verification[ _-]?token|password|passwd|secret|credential)\b\1(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{4,})\4/giu, (_match, keyQuote, name, separator, valueQuote, value) => `${keyQuote}${name}${keyQuote}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`)
-        .replace(/\b(token|credential)\b(\s+(?:is|was|equals?)\s+)(["']?)([^\s,"'};]{8,})\3/giu, (match, name, separator, valueQuote, value) => {
-        const normalized = value
-            .replace(/^["']|["']$/gu, "")
-            .replace(/[.,!?]+$/gu, "");
-        const knownPlaceholder = NON_SECRET_TOKEN_VALUES.has(normalized.toLowerCase());
-        const classes = [
-            /[a-z]/u,
-            /[A-Z]/u,
-            /[0-9]/u,
-            /[^A-Za-z0-9]/u,
-        ].filter((pattern) => pattern.test(normalized)).length;
-        return !knownPlaceholder &&
-            (normalized.length >= 16 ||
-                (normalized.length >= 10 && classes >= 2))
-            ? `${name}${separator}${valueQuote}${redactedCredential(value)}${valueQuote}`
-            : match;
-    })
-        .replace(/\b((?:set-)?cookie\s*:\s*)[^\r\n]+/giu, (_match, prefix) => `${prefix}[REDACTED:AUTHORIZATION]`);
-}
 async function atomicWriteJson(path, value) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     await chmod(dirname(path), 0o700);
@@ -703,17 +644,38 @@ function contextDeliveriesUrl(apiUrl) {
 }
 class RuntimeHttpError extends Error {
     httpStatus;
-    constructor(message, httpStatus) {
+    retryable;
+    constructor(message, httpStatus, retryable) {
         super(message);
         this.name = "RuntimeHttpError";
         this.httpStatus = httpStatus;
-    }
-}
-async function boundedResponseJson(response) {
+        this.retryable = retryable;
+    }
+}
+async function captureHttpError(response, operation) {
+    // Keep only known diagnostic fields: an upstream error body may contain
+    // captured text, secrets, or HTML. A request ID lets support find server logs.
+    const body = await boundedResponseJson(response, 8_192).catch(() => null);
+    const reason = isObject(body) && typeof body.reason === "string" &&
+        Object.hasOwn(CAPTURE_CONFLICT_MESSAGES, body.reason) ? body.reason : undefined;
+    const legacyMessages = new Set([
+        "Connector event ID was reused with a different observation",
+        "Connector event ID was reused with a different request",
+        "Connector event ID is already used by another event type",
+    ]);
+    const detail = reason === undefined
+        ? isObject(body) && typeof body.message === "string" && legacyMessages.has(body.message) ? body.message : undefined
+        : `${reason}: ${CAPTURE_CONFLICT_MESSAGES[reason]}`;
+    const requestId = response.headers.get("x-request-id") ?? (isObject(body) ? body.requestId : undefined);
+    const reference = typeof requestId === "string" && /^[a-zA-Z0-9._:-]{1,128}$/u.test(requestId)
+        ? ` (request ${requestId})` : "";
+    return new RuntimeHttpError(`${operation} failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}${reference}`, response.status, response.status === 409 && isObject(body) && body.retryable === true ? true : undefined);
+}
+async function boundedResponseJson(response, maxBytes = MAX_RESPONSE_BYTES) {
     const declaredLength = response.headers.get("content-length");
     if (declaredLength !== null &&
         Number.isFinite(Number(declaredLength)) &&
-        Number(declaredLength) > MAX_RESPONSE_BYTES) {
+        Number(declaredLength) > maxBytes) {
         await response.body?.cancel();
         throw new Error("Lore response exceeds the reliability size limit");
     }
@@ -730,7 +692,7 @@ async function boundedResponseJson(response) {
                 break;
             }
             bytes += chunk.value.byteLength;
-            if (bytes > MAX_RESPONSE_BYTES) {
+            if (bytes > maxBytes) {
                 await reader.cancel();
                 throw new Error("Lore response exceeds the reliability size limit");
             }
@@ -839,6 +801,10 @@ function deliveryFromResponse(value) {
                 : memorySummaries(value.memories);
     return {
         context: boundedContext(context),
+        ...(typeof value.relatedContext === "string" ? { relatedContext: redactSecrets(value.relatedContext).slice(0, 2_500) }
+            : isObject(value.context) && typeof value.context.relatedContext === "string" ? { relatedContext: redactSecrets(value.context.relatedContext).slice(0, 2_500) } : {}),
+        ...(typeof value.skillContext === "string" && value.skillContext.length <= 72_000 ? { skillContext: redactSecrets(value.skillContext) }
+            : isObject(value.context) && typeof value.context.skillContext === "string" && value.context.skillContext.length <= 72_000 ? { skillContext: redactSecrets(value.context.skillContext) } : {}),
         completeContext: context.length <= MAX_CONTEXT_CHARS,
         ...(receiptId === undefined ? {} : { receiptId }),
         learned,
@@ -891,6 +857,8 @@ function deliveryFromSignedContext(payload, expectedRequest) {
     }
     return deliveryFromResponse({
         context: payload.context,
+        relatedContext: payload.relatedContext,
+        skillContext: payload.skillContext,
         receipt: { id: payload.receiptId },
         memories: payload.memories,
         hits: payload.hits,
@@ -1137,6 +1105,8 @@ async function postTurn(config, request, fetchImplementation, store) {
     const response = await fetchImplementation(turnsUrl(config.apiUrl), {
         method: "POST",
         headers: {
+            "x-lore-context": "related-work-v1",
+            "x-lore-skills": "skills-v1",
             accept: runtimeAccept(config),
             authorization: `Bearer ${config.token}`,
             "content-type": "application/json",
@@ -1152,7 +1122,7 @@ async function postTurn(config, request, fetchImplementation, store) {
         return postTurn(config, compatible, fetchImplementation, store);
     }
     if (!response.ok) {
-        throw new RuntimeHttpError(`Lore turn request failed with HTTP ${response.status}`, response.status);
+        throw await captureHttpError(response, "Lore turn request");
     }
     const value = await protocolResponseJson(response);
     if (config.version === 1) {
@@ -1202,7 +1172,7 @@ async function postTurn(config, request, fetchImplementation, store) {
         task: {
             agent: request.agent,
             ...(request.scope === undefined ? {} : { scope: request.scope }),
-            task: request.currentUser.content.trim(),
+            task: request.task ?? request.currentUser.content.trim(),
         },
     });
     await store
@@ -1248,7 +1218,7 @@ async function postPromptObservation(config, request, fetchImplementation, _stor
         signal: AbortSignal.timeout(config.timeoutMs ?? 2_500),
     });
     if (!response.ok) {
-        throw new RuntimeHttpError(`Lore prompt observation failed with HTTP ${response.status}`, response.status);
+        throw await captureHttpError(response, "Lore prompt observation");
     }
     const value = await protocolResponseJson(response);
     if (config.version === 1) {
@@ -1284,6 +1254,8 @@ async function getPromptContext(config, agent, sessionId, sourceEventId, prompt,
     const response = await fetchImplementation(contextDeliveriesUrl(config.apiUrl), {
         method: "POST",
         headers: {
+            "x-lore-context": "related-work-v1",
+            "x-lore-skills": "skills-v1",
             accept: runtimeAccept(config),
             authorization: `Bearer ${config.token}`,
             "content-type": "application/json",
@@ -1414,6 +1386,7 @@ async function getCachedPromptContext(config, prompt, gitContext, store, now, re
     }
     return {
         context: retained.includes(String(selected.payload.receiptId)) ? "" : selected.context,
+        skillContext: "Lore is using saved learning context. Enabled skills could not be checked and saved skill instructions have not been reapplied. Reconnect to Lore before relying on skills for this task.",
         learned: [],
         delivered: [],
         reliability: {
@@ -1501,6 +1474,35 @@ async function retrievalNotice(delivery, sessionId, store, now) {
 function queueDirectory(home) {
     return resolve(loreDirectory(home), "queue");
 }
+async function stableCapture(store, queued) {
+    // Hook retries reconstruct timestamps, diffs, and lineage. Freeze the first
+    // request so the same source event always replays identical capture bytes,
+    // including after its outbox acknowledgement or a process restart. Retain
+    // just the latest request per session/kind, not an unbounded event journal.
+    const sourceEventId = queued.request.eventId;
+    const key = `native-capture:${queued.kind}:${queued.request.agent}:${sha256(queued.request.sessionId)}`;
+    const pending = (await store.listOutbox()).find(entry => entry.idempotencyKey === sourceEventId);
+    const original = pending ? queuedRequest(pending.payload) : null;
+    const state = await store.updateState(key, current => {
+        const previous = isObject(current) && current.sourceEventId === sourceEventId ? queuedRequest(current.queued) : original;
+        if (previous && previous.kind === queued.kind) {
+            if (previous.request.idempotencyKey !== queued.request.idempotencyKey) {
+                throw new ReliabilityStoreError("IDEMPOTENCY_CONFLICT", "A captured source event changed; its original recording was retained");
+            }
+            return { sourceEventId, queued: previous };
+        }
+        // Hosts without prompt IDs can legitimately say "continue" again after a
+        // different prompt. Their content hash is only useful for consecutive retry
+        // detection; it must not be a session-wide event identity.
+        const request = queued.kind === "prompt" && queued.request.promptId === undefined
+            ? { ...queued.request, eventId: randomUUID() } : queued.request;
+        return { sourceEventId, queued: { ...queued, request } };
+    });
+    const saved = isObject(state) ? queuedRequest(state.queued) : null;
+    if (saved === null || saved.kind !== queued.kind)
+        throw new Error("Saved capture request is invalid");
+    return saved;
+}
 async function enqueueCapture(store, queued) {
     return (await store.enqueue({
         kind: queued.kind,
@@ -1904,6 +1906,7 @@ async function offlineGuard(config, store, request, now, previouslyEnforced, all
                 ...(typeof request.repo === "string" ? { repo: request.repo } : {}),
                 ...(typeof request.path === "string" ? { path: request.path } : {}),
                 ...(typeof request.command === "string" ? { command: request.command } : {}),
+                ...(Array.isArray(request.defaultPushBranches) ? { defaultPushBranches: request.defaultPushBranches.filter((branch) => typeof branch === "string") } : {}),
                 ...(Array.isArray(request.files) ? { files: request.files.filter((file) => typeof file === "string") } : {}),
             }) !== null) : [];
         return {
@@ -1976,6 +1979,12 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
     const startedAt = Date.now();
     let result;
     const guardRequest = {
+        ...await (async () => {
+            const args = isObject(input.tool_input) ? input.tool_input : {};
+            const changesContext = ["cwd", "workdir", "working_directory", "env", "environment"].some(key => args[key] !== undefined);
+            const defaultPushBranches = changesContext ? undefined : await defaultGitPushBranches(trigger.command, cwd);
+            return defaultPushBranches ? { defaultPushBranches } : {};
+        })(),
         connector: "lore-cli",
         agent,
         sessionId,
@@ -2103,6 +2112,9 @@ export async function handleHookEvent(value, agent, options = {}) {
     const access = await checkLoreAccess(stringField(input.cwd), options.home, config, options.fetch ?? globalThis.fetch);
     if (!access.allowed) {
         await clearPending(agent, sessionId, options.home, config.connectionId);
+        await runtimeStore(config, options.home).then(store => clearRetrievalTask(store, {
+            agent, sessionId, connectionKey: credentialReliabilityWorkspaceKey(config),
+        })).catch(() => undefined);
         // A policy outage must not silently bypass an already enforced Guard.
         if (eventName === "PreToolUse" && access.reason === "Workspace repository settings are unavailable") {
             const prior = await readGuardState(agent, sessionId, options.home, config.connectionId).catch(() => null);
@@ -2239,8 +2251,10 @@ async function cursorSession(sessionId, options) {
         throw new Error("Start a new Cursor conversation to register this Lore session.");
     }
     const access = await checkLoreAccess(stringField(state.cwd), options.home, config, options.fetch ?? globalThis.fetch);
-    if (!access.allowed)
+    if (!access.allowed) {
+        await clearRetrievalTask(store, { agent: "cursor", sessionId, connectionKey: credentialReliabilityWorkspaceKey(config) }).catch(() => undefined);
         throw new Error(`Lore is off: ${access.reason}.`);
+    }
     return { config, store, state, cwd: stringField(state.cwd) };
 }
 export async function getCursorContext(sessionId, prompt, options = {}) {
@@ -2292,11 +2306,17 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
             notices.push("Lore retained a capture locally, but upload is blocked by authentication. Run lore connect again.");
         }
         else if (result?.state === "dead") {
-            notices.push("Lore retained a capture as a dead letter because the server response was incompatible. Run lore doctor.");
+            notices.push("Lore retained a rejected or incompatible capture locally for diagnosis. Run lore doctor.");
         }
     };
+    const terminal = (result, eventId) => result?.idempotencyKey === eventId && (result.state === "dead" || result.state === "auth-blocked");
     try {
-        noticeForFlush(await flushOne(config, fetchImplementation, store));
+        const flushed = await flushOne(config, fetchImplementation, store);
+        noticeForFlush(flushed);
+        // A retained terminal failure still occupies capacity. Give the next item
+        // one upload attempt before enqueueing, including when the queue was full.
+        if (flushed?.state === "dead")
+            noticeForFlush(await flushOne(config, fetchImplementation, store));
     }
     catch {
         notices.push("Lore retained queued captures locally, but replay could not run. Run lore doctor.");
@@ -2327,18 +2347,30 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
     };
     const lineage = await readLineageMetadata(options.home, options.environment ?? process.env);
     let delivery = emptyDelivery();
+    const retrievalTask = (repo) => resolveRetrievalTask(store, {
+        agent, sessionId, connectionKey: credentialReliabilityWorkspaceKey(config),
+        cwd: stringField(input.cwd), repo,
+    }, prompt, now, pending?.cwd === stringField(input.cwd) && pending
+        ? { content: pending.assistantMessage, capturedAt: pending.capturedAt } : undefined);
     if (pending !== null) {
         let receivedTurnContext = false;
-        const request = await createTurnRequest(input, agent, pending, now, lineage);
+        let request = await createTurnRequest(input, agent, pending, now, lineage);
         if (request === null) {
             return undefined;
         }
+        const task = await retrievalTask(request.scope?.repo);
+        if (task !== request.currentUser.content.trim())
+            request.task = task;
         if (retained.length)
             request.retainedReceiptIds = retained;
         let enqueued = false;
         try {
-            await enqueueCapture(store, { kind: "turn", request });
-            enqueued = true;
+            request = (await stableCapture(store, { kind: "turn", request })).request;
+            const saved = await enqueueCapture(store, { kind: "turn", request });
+            enqueued = saved.state === "ready" || saved.state === "in-flight";
+            if (saved.state === "dead" || saved.state === "auth-blocked") {
+                noticeForFlush({ idempotencyKey: saved.idempotencyKey, state: saved.state });
+            }
             await rememberImages(request.eventId).catch(() => undefined);
             await clearPending(agent, sessionId, options.home, config.connectionId);
         }
@@ -2360,7 +2392,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
                     receivedTurnContext = delivery.reliability?.status !== "failed" &&
                         delivery.reliability?.source !== "none";
                 }
-                else {
+                else if (!terminal(flushed, request.eventId)) {
                     notices.push("Lore saved this capture locally; server upload is pending.");
                 }
             }
@@ -2370,7 +2402,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
         }
         if (retrieve && !receivedTurnContext) {
             try {
-                delivery = await getPromptContextWithFallback(config, agent, sessionId, request.eventId, prompt, {
+                delivery = await getPromptContextWithFallback(config, agent, sessionId, request.eventId, task, {
                     ...(request.scope === undefined ? {} : { scope: request.scope }),
                     learningScope: request.learningScope,
                     ...(request.diff === undefined ? {} : { diff: request.diff }),
@@ -2399,15 +2431,20 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
     }
     else {
         const gitContext = await collectGitContext(stringField(input.cwd));
-        const observation = createPromptObservationRequest(input, agent, sessionId, now, gitContext, lineage);
+        const task = await retrievalTask(gitContext.scope?.repo);
+        let observation = createPromptObservationRequest(input, agent, sessionId, now, gitContext, lineage);
         if (observation === null) {
             return undefined;
         }
         let enqueued = false;
         try {
             if (capture) {
-                await enqueueCapture(store, { kind: "prompt", request: observation });
-                enqueued = true;
+                observation = (await stableCapture(store, { kind: "prompt", request: observation })).request;
+                const saved = await enqueueCapture(store, { kind: "prompt", request: observation });
+                enqueued = saved.state === "ready" || saved.state === "in-flight";
+                if (saved.state === "dead" || saved.state === "auth-blocked") {
+                    noticeForFlush({ idempotencyKey: saved.idempotencyKey, state: saved.state });
+                }
                 await rememberImages(observation.eventId).catch(() => undefined);
             }
         }
@@ -2421,8 +2458,8 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
             try {
                 const flushed = await flushOne(config, fetchImplementation, store);
                 noticeForFlush(flushed);
-                if (flushed?.idempotencyKey !== observation.eventId ||
-                    flushed.state !== "acknowledged") {
+                if (!terminal(flushed, observation.eventId) &&
+                    (flushed?.idempotencyKey !== observation.eventId || flushed.state !== "acknowledged")) {
                     notices.push("Lore saved this capture locally; server upload is pending.");
                 }
             }
@@ -2432,7 +2469,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
         }
         if (retrieve) {
             try {
-                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, prompt, gitContext, fetchImplementation, store, now, retained);
+                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, task, gitContext, fetchImplementation, store, now, retained);
             }
             catch {
                 delivery = {
@@ -2480,7 +2517,10 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
     const receipt = receiptMessage(config, agent, delivery);
     if (retrieve && delivery.completeContext)
         await rememberDeliveredContext(store, contextSession, delivery).catch(() => undefined);
-    const taskContext = [delivery.context, delivery.reliability?.status === "failed" ? undefined : approachGuidance(prompt, agent, redactSecrets(sessionId), retainedContext)].filter(Boolean).join("\n\n");
+    const relatedContext = delivery.relatedContext && !retainedContext.some(text => text.includes(delivery.relatedContext))
+        ? delivery.relatedContext : undefined;
+    // Skills are fresh on every turn, even when learning context is retained.
+    const taskContext = [delivery.skillContext, delivery.context, relatedContext, delivery.reliability?.status === "failed" ? undefined : approachGuidance(prompt, agent, redactSecrets(sessionId), retainedContext), delivery.skillContext === undefined && delivery.reliability?.status !== "failed" ? skillGuidance(retainedContext) : undefined].filter(Boolean).join("\n\n");
     const systemMessage = agent === "cursor" || agent === "polytoken"
         ? undefined
         : [receipt, reliabilityNotice].filter(Boolean).join(" · ") || undefined;