@massa-ai/mcp-client 1.17.0 → 1.19.0

package/dist/index.js

@@ -38111,6 +38111,16 @@ var init_index_manager = __esm(() => {
   globAsync = glob;
 });
 
+// ../../packages/core/dist/services/cache/lru-evict.js
+function evictOldest(cache, maxRetained) {
+  while (cache.size > maxRetained) {
+    const oldest = cache.keys().next().value;
+    if (oldest === undefined)
+      break;
+    cache.delete(oldest);
+  }
+}
+
 // ../../packages/core/dist/services/search/file-filter-cache.js
 class FileFilterCache {
   cache = new Map;
@@ -38179,18 +38189,7 @@ class FileFilterCache {
     return parts.join("|");
   }
   evictOldest() {
-    let oldestKey = null;
-    let oldestTime = Infinity;
-    for (const [key, entry] of this.cache.entries()) {
-      if (entry.createdAt < oldestTime) {
-        oldestTime = entry.createdAt;
-        oldestKey = key;
-      }
-    }
-    if (oldestKey) {
-      this.cache.delete(oldestKey);
-      logger.debug("Evicted oldest filter cache entry", { key: oldestKey });
-    }
+    evictOldest(this.cache, this.MAX_CACHE_SIZE);
   }
   invalidateProject(projectId) {
     let removed = 0;
@@ -118540,7 +118539,7 @@ var init_memory_repository_factory = __esm(() => {
   init_memory_repository_pg();
 });
 
-// ../../packages/core/dist/services/graph/graph-store-pg.js
+// ../../packages/core/dist/services/memory-graph/graph-store-pg.js
 function metadataForEdge(edge) {
   return {
     autoExtracted: edge.autoExtracted ?? false,
@@ -118856,7 +118855,7 @@ var init_graph_store_pg = __esm(() => {
   graphStorePg = GraphStorePg.getInstance();
 });
 
-// ../../packages/core/dist/services/graph/graph-store-factory.js
+// ../../packages/core/dist/services/memory-graph/graph-store-factory.js
 function getGraphStore() {
   if (cachedStore2)
     return cachedStore2;
@@ -129055,6 +129054,133 @@ var init_pipeline = __esm(() => {
   };
 });
 
+// ../../packages/core/dist/services/indexing/execute-indexing.js
+async function executeIndexing(request) {
+  const { jobId, projectId, projectPath, forceReindex, warmCache, warmupQueries, include_tests = false, managedRunLease, warmupCache: warmupCache2 } = request;
+  const startTime = Date.now();
+  try {
+    indexJobTracker.updateStatus(jobId, "running");
+    logger.info("Starting project indexing via ETL Pipeline", {
+      jobId,
+      projectPath,
+      projectId,
+      forceReindex,
+      warmCache,
+      include_tests
+    });
+    const etlResult = await EtlPipeline.getInstance().run({
+      projectId,
+      projectPath,
+      jobId,
+      forceReindex,
+      include_tests,
+      managedRunLease
+    });
+    const duration3 = Date.now() - startTime;
+    logger.info("ETL Pipeline completed", {
+      jobId,
+      projectId,
+      duration: duration3,
+      filesIndexed: etlResult.filesIndexed,
+      filesSkipped: etlResult.filesSkipped,
+      chunksIndexed: etlResult.chunksIndexed,
+      symbolsIndexed: etlResult.symbolsIndexed,
+      errors: etlResult.errors,
+      stageTimings: etlResult.stageTimings
+    });
+    if (warmCache) {
+      logger.info("Starting cache warmup", { jobId, projectId });
+      const warmupStats = await warmupCache2(projectId, projectPath, warmupQueries);
+      logger.info("Cache warmup completed", { jobId, projectId, ...warmupStats });
+    }
+    indexJobTracker.updateProgress(jobId, etlResult.filesIndexed, etlResult.filesIndexed);
+    await indexJobTracker.setResultAndFlush(jobId, {
+      filesIndexed: etlResult.filesIndexed,
+      chunksIndexed: etlResult.chunksIndexed,
+      errors: etlResult.errors,
+      duration: duration3,
+      activatedGraphGenerationId: etlResult.activatedGraphGenerationId,
+      parserDiagnostics: etlResult.parserDiagnostics
+    });
+  } catch (error51) {
+    const duration3 = Date.now() - startTime;
+    logger.error("Project indexing failed", error51, {
+      jobId,
+      projectPath,
+      projectId,
+      duration: duration3
+    });
+    indexJobTracker.setResult(jobId, {
+      filesIndexed: 0,
+      chunksIndexed: 0,
+      errors: 1,
+      duration: duration3
+    }, error51.message);
+  }
+}
+var init_execute_indexing = __esm(() => {
+  init_dist();
+  init_index_job_tracker();
+  init_pipeline();
+});
+
+// ../../packages/core/dist/services/indexing/acquire-indexing-lease.js
+async function acquireIndexingLease(request) {
+  const { jobId, projectId } = request;
+  const eventId = `index:${jobId}`;
+  const managedRunRepo = ManagedRunRepositoryPg.getInstance();
+  try {
+    const beginOutcome = await managedRunRepo.begin({
+      projectId,
+      runKind: "indexing",
+      eventId
+    });
+    if (beginOutcome.status === "busy") {
+      indexJobTracker.setResult(jobId, { filesIndexed: 0, chunksIndexed: 0, errors: 0, duration: 0 }, `indexing_busy:${beginOutcome.activeRunId}`);
+      return {
+        status: "busy",
+        activeRunId: beginOutcome.activeRunId,
+        leaseExpiresAt: beginOutcome.leaseExpiresAt
+      };
+    }
+    return { status: "acquired", lease: beginOutcome.lease };
+  } catch (beginError) {
+    logger.error("managed_runs begin failed", beginError, {
+      jobId,
+      projectId
+    });
+    indexJobTracker.setResult(jobId, { filesIndexed: 0, chunksIndexed: 0, errors: 1, duration: 0 }, `managed_runs_begin_failed:${beginError.message}`);
+    return { status: "failed", message: beginError.message };
+  }
+}
+var init_acquire_indexing_lease = __esm(() => {
+  init_dist();
+  init_index_job_tracker();
+  init_managed_run_repository_pg();
+});
+
+// ../../packages/core/dist/services/project-identity/project-root-identity.js
+import { realpath as realpath2 } from "fs/promises";
+import path17 from "path";
+async function canonicalizeProjectRoot(projectPath, canonicalize = realpath2) {
+  return canonicalize(path17.resolve(projectPath));
+}
+async function assertProjectRootReuse(options) {
+  if (!options.storedProjectPath || options.forceReindex)
+    return;
+  const canonicalize = options.canonicalize ?? realpath2;
+  let storedCanonical;
+  try {
+    storedCanonical = await canonicalize(path17.resolve(options.storedProjectPath));
+  } catch {
+    storedCanonical = path17.resolve(options.storedProjectPath);
+  }
+  if (storedCanonical !== options.canonicalProjectPath) {
+    throw new Error(`Project ID "${options.projectId}" already indexes canonical root ` + `"${storedCanonical}", not "${options.canonicalProjectPath}"; ` + "use forceReindex only after verifying ownership of the existing project");
+  }
+}
+var init_project_root_identity = () => {};
+
 // ../../packages/core/dist/services/symbol/definition-lookup.js
 function toSymbolIdentityResolution(result) {
   switch (result.status) {
@@ -129790,16 +129916,16 @@ function detectRoutes(httpEdges, defs, opts = {}) {
   const seen = new Set;
   const out = [];
   for (const e of httpEdges) {
-    const path17 = e.route;
-    if (!path17)
+    const path18 = e.route;
+    if (!path18)
       continue;
     const method = (e.method ?? "ANY").toUpperCase();
-    const key = method + " " + path17;
+    const key = method + " " + path18;
     if (seen.has(key))
       continue;
     seen.add(key);
     out.push({
-      path: path17,
+      path: path18,
       method: e.method,
       file: e.fromFile,
       handler: e.targetFqn ?? e.symbolName
@@ -129810,12 +129936,12 @@ function detectRoutes(httpEdges, defs, opts = {}) {
       continue;
     const parsed = parseRouteName(d.name);
     const method = parsed?.method ?? "ANY";
-    const path17 = parsed?.path ?? d.name;
-    const key = method + " " + path17;
+    const path18 = parsed?.path ?? d.name;
+    const key = method + " " + path18;
     if (seen.has(key))
       continue;
     seen.add(key);
-    out.push({ path: path17, method: parsed?.method, file: d.filePath, handler: d.name });
+    out.push({ path: path18, method: parsed?.method, file: d.filePath, handler: d.name });
   }
   for (const d of defs) {
     const parsed = parseRouteName(d.name);
@@ -130036,7 +130162,7 @@ __export(exports_symbol_graph_service, {
   symbolGraphService: () => symbolGraphService,
   SymbolGraphService: () => SymbolGraphService
 });
-import path17 from "path";
+import path18 from "path";
 import fs8 from "fs/promises";
 
 class SymbolGraphService {
@@ -130390,7 +130516,7 @@ class SymbolGraphService {
   }
   async resolveToAbsolute(relativePath, projectId) {
     const root = await this.getProjectRoot(projectId);
-    return root ? path17.resolve(root, relativePath) : relativePath;
+    return root ? path18.resolve(root, relativePath) : relativePath;
   }
   async getProjectRoot(projectId) {
     const cached2 = this.projectRootCache.get(projectId);
@@ -130410,12 +130536,7 @@ class SymbolGraphService {
     return null;
   }
   evictOldestProjectRoot() {
-    while (this.projectRootCache.size >= this.PROJECT_ROOT_CACHE_MAX_ENTRIES) {
-      const oldest = this.projectRootCache.keys().next().value;
-      if (oldest === undefined)
-        break;
-      this.projectRootCache.delete(oldest);
-    }
+    evictOldest(this.projectRootCache, this.PROJECT_ROOT_CACHE_MAX_ENTRIES - 1);
   }
   clearProjectRoot(projectId) {
     this.projectRootCache.delete(projectId);
@@ -130538,25 +130659,7 @@ var init_workspace_manager = __esm(() => {
 });
 
 // ../../packages/core/dist/tools/index_project.js
-import { realpath as realpath2 } from "fs/promises";
-import path18 from "path";
-async function canonicalizeProjectRoot(projectPath, canonicalize = realpath2) {
-  return canonicalize(path18.resolve(projectPath));
-}
-async function assertProjectRootReuse(options) {
-  if (!options.storedProjectPath || options.forceReindex)
-    return;
-  const canonicalize = options.canonicalize ?? realpath2;
-  let storedCanonical;
-  try {
-    storedCanonical = await canonicalize(path18.resolve(options.storedProjectPath));
-  } catch {
-    storedCanonical = path18.resolve(options.storedProjectPath);
-  }
-  if (storedCanonical !== options.canonicalProjectPath) {
-    throw new Error(`Project ID "${options.projectId}" already indexes canonical root ` + `"${storedCanonical}", not "${options.canonicalProjectPath}"; ` + "use forceReindex only after verifying ownership of the existing project");
-  }
-}
+import path19 from "path";
 
 class IndexProjectTool {
   name = "index_project";
@@ -130604,7 +130707,7 @@ class IndexProjectTool {
     try {
       await assertParserReadyForIndexing();
       const canonicalProjectPath = await canonicalizeProjectRoot(projectPath);
-      const finalProjectId = projectId || path18.basename(canonicalProjectPath) || "default";
+      const finalProjectId = projectId || path19.basename(canonicalProjectPath) || "default";
       const existing = await workspaceManager.getWorkspace(finalProjectId);
       await assertProjectRootReuse({
         projectId: finalProjectId,
@@ -130618,40 +130721,42 @@ class IndexProjectTool {
         projectPath: canonicalProjectPath,
         projectId: finalProjectId
       });
-      const eventId = `index:${job.jobId}`;
-      const managedRunRepo = ManagedRunRepositoryPg.getInstance();
-      let lease;
-      try {
-        const beginOutcome = await managedRunRepo.begin({
-          projectId: finalProjectId,
-          runKind: "indexing",
-          eventId
-        });
-        if (beginOutcome.status === "busy") {
-          indexJobTracker.setResult(job.jobId, { filesIndexed: 0, chunksIndexed: 0, errors: 0, duration: 0 }, `indexing_busy:${beginOutcome.activeRunId}`);
-          return {
-            success: false,
-            error: `indexing_busy:${beginOutcome.activeRunId}`,
-            data: {
-              jobId: job.jobId,
-              projectId: finalProjectId,
-              status: "busy",
-              activeRunId: beginOutcome.activeRunId,
-              leaseExpiresAt: beginOutcome.leaseExpiresAt,
-              message: "Another indexing run is active for this project. Poll get_index_status(activeRunId)."
-            }
-          };
-        }
-        lease = beginOutcome.lease;
-      } catch (beginError) {
-        logger.error("managed_runs begin failed", beginError, { jobId: job.jobId, projectId: finalProjectId });
-        indexJobTracker.setResult(job.jobId, { filesIndexed: 0, chunksIndexed: 0, errors: 1, duration: 0 }, `managed_runs_begin_failed:${beginError.message}`);
+      const leaseOutcome = await acquireIndexingLease({
+        jobId: job.jobId,
+        projectId: finalProjectId
+      });
+      if (leaseOutcome.status === "busy") {
+        return {
+          success: false,
+          error: `indexing_busy:${leaseOutcome.activeRunId}`,
+          data: {
+            jobId: job.jobId,
+            projectId: finalProjectId,
+            status: "busy",
+            activeRunId: leaseOutcome.activeRunId,
+            leaseExpiresAt: leaseOutcome.leaseExpiresAt,
+            message: "Another indexing run is active for this project. Poll get_index_status(activeRunId)."
+          }
+        };
+      }
+      if (leaseOutcome.status === "failed") {
         return {
           success: false,
-          error: `Failed to acquire indexing lease: ${beginError.message}`
+          error: `Failed to acquire indexing lease: ${leaseOutcome.message}`
         };
       }
-      this.executeIndexing(job.jobId, finalProjectId, canonicalProjectPath, forceReindex, warmCache, warmupQueries, include_tests, lease).catch((error51) => {
+      const lease = leaseOutcome.lease;
+      executeIndexing({
+        jobId: job.jobId,
+        projectId: finalProjectId,
+        projectPath: canonicalProjectPath,
+        forceReindex,
+        warmCache,
+        warmupQueries,
+        include_tests,
+        managedRunLease: lease,
+        warmupCache: this.contextualSearch.warmupCache.bind(this.contextualSearch)
+      }).catch((error51) => {
         logger.error("Background indexing failed", error51, {
           jobId: job.jobId
         });
@@ -130678,77 +130783,16 @@ class IndexProjectTool {
       };
     }
   }
-  async executeIndexing(jobId, projectId, projectPath, forceReindex, warmCache, warmupQueries, include_tests = false, managedRunLease) {
-    const startTime = Date.now();
-    try {
-      indexJobTracker.updateStatus(jobId, "running");
-      logger.info("Starting project indexing via ETL Pipeline", {
-        jobId,
-        projectPath,
-        projectId,
-        forceReindex,
-        warmCache,
-        include_tests
-      });
-      const etlResult = await EtlPipeline.getInstance().run({
-        projectId,
-        projectPath,
-        jobId,
-        forceReindex,
-        include_tests,
-        managedRunLease
-      });
-      const duration3 = Date.now() - startTime;
-      logger.info("ETL Pipeline completed", {
-        jobId,
-        projectId,
-        duration: duration3,
-        filesIndexed: etlResult.filesIndexed,
-        filesSkipped: etlResult.filesSkipped,
-        chunksIndexed: etlResult.chunksIndexed,
-        symbolsIndexed: etlResult.symbolsIndexed,
-        errors: etlResult.errors,
-        stageTimings: etlResult.stageTimings
-      });
-      if (warmCache) {
-        logger.info("Starting cache warmup", { jobId, projectId });
-        const warmupStats = await this.contextualSearch.warmupCache(projectId, projectPath, warmupQueries);
-        logger.info("Cache warmup completed", { jobId, projectId, ...warmupStats });
-      }
-      indexJobTracker.updateProgress(jobId, etlResult.filesIndexed, etlResult.filesIndexed);
-      await indexJobTracker.setResultAndFlush(jobId, {
-        filesIndexed: etlResult.filesIndexed,
-        chunksIndexed: etlResult.chunksIndexed,
-        errors: etlResult.errors,
-        duration: duration3,
-        activatedGraphGenerationId: etlResult.activatedGraphGenerationId,
-        parserDiagnostics: etlResult.parserDiagnostics
-      });
-    } catch (error51) {
-      const duration3 = Date.now() - startTime;
-      logger.error("Project indexing failed", error51, {
-        jobId,
-        projectPath,
-        projectId,
-        duration: duration3
-      });
-      indexJobTracker.setResult(jobId, {
-        filesIndexed: 0,
-        chunksIndexed: 0,
-        errors: 1,
-        duration: duration3
-      }, error51.message);
-    }
-  }
 }
 var init_index_project = __esm(() => {
   init_contextual_search_rlm();
   init_dist();
   init_index_job_tracker();
-  init_pipeline();
+  init_execute_indexing();
+  init_acquire_indexing_lease();
+  init_project_root_identity();
   init_workspace_manager();
   init_parser_readiness();
-  init_managed_run_repository_pg();
 });
 
 // ../../packages/core/dist/tools/get_index_status.js
@@ -131216,17 +131260,17 @@ function applyReplacer(root, replacer) {
     return transformChildren(root, replacer, []);
   return transformChildren(normalizeValue(replacedRoot), replacer, []);
 }
-function transformChildren(value, replacer, path19) {
+function transformChildren(value, replacer, path20) {
   if (isJsonObject(value))
-    return transformObject(value, replacer, path19);
+    return transformObject(value, replacer, path20);
   if (isJsonArray(value))
-    return transformArray(value, replacer, path19);
+    return transformArray(value, replacer, path20);
   return value;
 }
-function transformObject(obj, replacer, path19) {
+function transformObject(obj, replacer, path20) {
   const result = {};
   for (const [key, value] of Object.entries(obj)) {
-    const childPath = [...path19, key];
+    const childPath = [...path20, key];
     const replacedValue = replacer(key, value, childPath);
     if (replacedValue === undefined)
       continue;
@@ -131234,11 +131278,11 @@ function transformObject(obj, replacer, path19) {
   }
   return result;
 }
-function transformArray(arr, replacer, path19) {
+function transformArray(arr, replacer, path20) {
   const result = [];
   for (let i = 0;i < arr.length; i++) {
     const value = arr[i];
-    const childPath = [...path19, i];
+    const childPath = [...path20, i];
     const replacedValue = replacer(String(i), value, childPath);
     if (replacedValue === undefined)
       continue;
@@ -131961,7 +132005,7 @@ var init_memory_service = __esm(() => {
   init_decay();
 });
 
-// ../../packages/core/dist/services/graph/relation-extractor.js
+// ../../packages/core/dist/services/memory-graph/relation-extractor.js
 class RelationExtractor {
   graphStore;
   constructor(graphStore) {
@@ -132199,7 +132243,7 @@ var init_relation_extractor = __esm(() => {
   ];
 });
 
-// ../../packages/core/dist/services/graph/graph-queries.js
+// ../../packages/core/dist/services/memory-graph/graph-queries.js
 class GraphQueries {
   graphStore;
   constructor(graphStore) {
@@ -132419,7 +132463,7 @@ var init_graph_queries = __esm(() => {
   };
 });
 
-// ../../packages/core/dist/services/graph/memory-graph.service.js
+// ../../packages/core/dist/services/memory-graph/memory-graph.service.js
 class MemoryGraphService {
   static instance = null;
   store;
@@ -136306,7 +136350,7 @@ var init_session_pin_store = __esm(() => {
 // ../../packages/core/dist/services/hooks/attribution-resolver.js
 import fs9 from "fs";
 import os3 from "os";
-import path19 from "path";
+import path20 from "path";
 
 class PgWorkspaceRootProvider {
   cache = null;
@@ -136358,7 +136402,7 @@ class AttributionResolver {
     this.pins = options.pins ?? new SessionPinStore;
     this.canonicalize = options.canonicalize ?? defaultCanonicalize;
     this.homedir = options.homedir ?? os3.homedir;
-    this.fsRoot = options.fsRoot ?? (() => path19.parse(path19.sep).root);
+    this.fsRoot = options.fsRoot ?? (() => path20.parse(path20.sep).root);
   }
   async resolve(input) {
     const caller = input.callerProjectId;
@@ -136411,7 +136455,7 @@ class AttributionResolver {
     }
     let bestPath = null;
     for (const candidate2 of byPath.keys()) {
-      if (canonicalCwd === candidate2 || canonicalCwd.startsWith(candidate2.endsWith(path19.sep) ? candidate2 : candidate2 + path19.sep)) {
+      if (canonicalCwd === candidate2 || canonicalCwd.startsWith(candidate2.endsWith(path20.sep) ? candidate2 : candidate2 + path20.sep)) {
         if (bestPath === null || candidate2.length > bestPath.length) {
           bestPath = candidate2;
         }
@@ -136434,7 +136478,7 @@ class AttributionResolver {
       return projectPath2;
     const fsRoot = this.fsRoot();
     let normalized = projectPath2;
-    while (normalized.length > fsRoot.length && normalized.endsWith(path19.sep)) {
+    while (normalized.length > fsRoot.length && normalized.endsWith(path20.sep)) {
       normalized = normalized.slice(0, -1);
     }
     return normalized;
@@ -136445,7 +136489,7 @@ function defaultCanonicalize(cwd) {
     return fs9.realpathSync(cwd);
   } catch {
     try {
-      return path19.resolve(cwd);
+      return path20.resolve(cwd);
     } catch {
       return;
     }
@@ -136464,6 +136508,72 @@ var init_attribution_resolver = __esm(() => {
   init_session_pin_store();
 });
 
+// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
+function markerFor(id) {
+  return `[REDACTED:${id}]`;
+}
+function fullMatchRule(id, pattern) {
+  const marker26 = markerFor(id);
+  return {
+    id,
+    replace(text3) {
+      let count = 0;
+      const replaced = text3.replace(pattern, () => {
+        count++;
+        return marker26;
+      });
+      return { text: replaced, count };
+    }
+  };
+}
+function scrubCredentials(payloadJson) {
+  const redactions = {};
+  for (const id of RULE_IDS)
+    redactions[id] = 0;
+  let text3 = payloadJson;
+  for (const rule of RULES) {
+    const { text: next, count } = rule.replace(text3);
+    text3 = next;
+    redactions[rule.id] += count;
+  }
+  const total = Object.values(redactions).reduce((sum, n) => sum + n, 0);
+  return {
+    sanitized: text3,
+    redactions,
+    total
+  };
+}
+var PEM_PATTERN, JWT_PATTERN, AWS_KEY_PATTERN, SK_KEY_PATTERN, GITHUB_TOKEN_PATTERN, SLACK_TOKEN_PATTERN, BEARER_PATTERN, RULES, RULE_IDS;
+var init_credential_scrub = __esm(() => {
+  PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
+  JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+  AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
+  SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+  GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
+  SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
+  BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
+  RULES = [
+    fullMatchRule("pem", PEM_PATTERN),
+    fullMatchRule("jwt", JWT_PATTERN),
+    fullMatchRule("aws-key", AWS_KEY_PATTERN),
+    fullMatchRule("sk-key", SK_KEY_PATTERN),
+    fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
+    fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
+    {
+      id: "bearer",
+      replace(text3) {
+        let count = 0;
+        const replaced = text3.replace(BEARER_PATTERN, (_m, prefix) => {
+          count++;
+          return `${prefix}${markerFor("bearer")}`;
+        });
+        return { text: replaced, count };
+      }
+    }
+  ];
+  RULE_IDS = RULES.map((r) => r.id);
+});
+
 // ../../packages/core/dist/tools/compact_snapshot.js
 class CompactSnapshotTool {
   name = "compact_snapshot";
@@ -136515,19 +136625,26 @@ class CompactSnapshotTool {
         persistedId = newObservationId();
         try {
           const attribution = await (this.resolverOverride ?? getAttributionResolver()).resolve({ callerProjectId: projectId, sessionId, cwd });
+          const scrub = scrubCredentials(JSON.stringify({
+            snapshot: snapshot.xml,
+            eventCount: snapshot.eventCount,
+            compactCount: snapshot.compactCount,
+            generatedAt: snapshot.generatedAt,
+            sectionCount: snapshot.sections.length
+          }));
+          if (scrub.total > 0) {
+            logger.debug("compact_snapshot payload redacted before persist", {
+              redactions: scrub.redactions,
+              total: scrub.total
+            });
+          }
           store4.insert({
             id: persistedId,
             projectId: attribution.projectId,
             sessionId,
             source: "pre-compact",
             category: "compaction-snapshots",
-            payloadJson: JSON.stringify({
-              snapshot: snapshot.xml,
-              eventCount: snapshot.eventCount,
-              compactCount: snapshot.compactCount,
-              generatedAt: snapshot.generatedAt,
-              sectionCount: snapshot.sections.length
-            }),
+            payloadJson: scrub.sanitized,
             importance: 0.8,
             createdAt: Date.now(),
             attributionSource: attribution.source
@@ -136579,6 +136696,7 @@ var init_compact_snapshot = __esm(() => {
   init_observation_repository();
   init_compaction_snapshot_service();
   init_attribution_resolver();
+  init_credential_scrub();
 });
 
 // ../../packages/core/dist/tools/list_projects.js
@@ -137184,31 +137302,31 @@ class TracePathService {
     const chains = [];
     const seen = new Set;
     let walks = 0;
-    const walk = (fqn, path20) => {
+    const walk = (fqn, path21) => {
       if (chains.length >= CHAIN_CAP)
         return;
       if (walks >= MAX_WALKS)
         return;
       walks++;
-      const key = path20.join("\u2192");
+      const key = path21.join("\u2192");
       if (seen.has(key))
         return;
       seen.add(key);
       const next = adj.get(fqn);
       if (!next || next.length === 0 || !whoHasChild.has(fqn)) {
-        if (path20.length > 1)
-          chains.push(path20.map((n) => this.fqnToName(n)).join(" \u2192 "));
+        if (path21.length > 1)
+          chains.push(path21.map((n) => this.fqnToName(n)).join(" \u2192 "));
         return;
       }
       for (const child of next) {
         if (chains.length >= CHAIN_CAP || walks >= MAX_WALKS)
           return;
-        if (path20.includes(child)) {
-          const cycled = [...path20, `${this.fqnToName(child)}\u21BA`];
+        if (path21.includes(child)) {
+          const cycled = [...path21, `${this.fqnToName(child)}\u21BA`];
           chains.push(cycled.map((n) => n).join(" \u2192 "));
           continue;
         }
-        walk(child, [...path20, child]);
+        walk(child, [...path21, child]);
       }
     };
     for (const seed of seeds) {
@@ -138040,216 +138158,231 @@ var init_get_architecture = __esm(() => {
   init_architecture();
 });
 
-// ../../packages/core/dist/tools/read_file.js
+// ../../packages/core/dist/services/file-read/file-content-cache.js
 import fs10 from "fs/promises";
-import path20 from "path";
 
-class ReadFileTool {
-  name = "read_file";
-  description = "Read file with automatic compression, caching, and symbol metadata. " + "Use with search results for 60% token savings.";
-  inputSchema = {
-    type: "object",
-    properties: {
-      filePath: {
-        type: "string",
-        description: "File path (absolute or relative to project root)"
-      },
-      projectId: {
-        type: "string",
-        description: "Project ID for symbol metadata (optional)"
-      },
-      offset: {
-        type: "number",
-        description: "Start line number (1-indexed)"
-      },
-      limit: {
-        type: "number",
-        description: "Number of lines to read"
-      },
-      lineStart: {
-        type: "number",
-        description: "Start line (alternative to offset)"
-      },
-      lineEnd: {
-        type: "number",
-        description: "End line (alternative to limit)"
-      },
-      compress: {
-        type: "boolean",
-        description: "Auto-compress content > 100 lines (default: true)",
-        default: true
-      },
-      targetRatio: {
-        type: "number",
-        description: "Compression target ratio (0.3 = 70% reduction)",
-        default: 0.3
-      },
-      format: {
-        type: "string",
-        enum: ["json", "toon"],
-        description: "Output format",
-        default: "json"
-      },
-      fields: {
-        type: "array",
-        items: { type: "string" },
-        description: "Projection \u2014 keep only these keys (dotted paths supported, e.g. ['nodes.symbol']). Absent/empty \u2192 full data."
-      },
-      includeSymbols: {
-        type: "boolean",
-        description: "Include symbol metadata from graph (default: true)",
-        default: true
-      },
-      includeImports: {
-        type: "boolean",
-        description: "Extract and show import statements (default: true)",
-        default: true
-      }
-    },
-    required: ["filePath"]
-  };
-  compressor;
-  symbolGraph;
+class FileContentCache {
+  extractMetadata;
   fileCache = new Map;
-  projectRootCache = new Map;
   CACHE_TTL = 60000;
-  ROOT_CACHE_TTL = 300000;
   FILE_CACHE_MAX_ENTRIES = 512;
+  constructor(extractMetadata) {
+    this.extractMetadata = extractMetadata;
+  }
+  async readFileWithCache(filePath, options) {
+    const cacheKey = JSON.stringify({
+      filePath,
+      includeSymbols: options.includeSymbols ?? false,
+      includeImports: options.includeImports ?? false,
+      projectId: options.projectId ?? null,
+      relativePath: options.relativePath ?? null
+    });
+    const cached2 = this.fileCache.get(cacheKey);
+    if (cached2 && Date.now() - cached2.timestamp < this.CACHE_TTL) {
+      logger.debug("File cache hit", { filePath });
+      this.fileCache.delete(cacheKey);
+      this.fileCache.set(cacheKey, cached2);
+      if (!cached2.metadata) {
+        const metadata2 = await this.extractMetadata(cached2.content, filePath, options);
+        this.fileCache.set(cacheKey, { ...cached2, metadata: metadata2 });
+        return { content: cached2.content, metadata: metadata2 };
+      }
+      return {
+        content: cached2.content,
+        metadata: cached2.metadata
+      };
+    }
+    const content = await fs10.readFile(filePath, "utf-8");
+    const metadata = await this.extractMetadata(content, filePath, options);
+    evictOldest(this.fileCache, this.FILE_CACHE_MAX_ENTRIES - 1);
+    this.fileCache.set(cacheKey, {
+      content,
+      timestamp: Date.now(),
+      metadata
+    });
+    logger.debug("File read and cached", { filePath });
+    return { content, metadata };
+  }
+}
+var init_file_content_cache = __esm(() => {
+  init_dist();
+});
+
+// ../../packages/core/dist/services/file-read/file-metadata.js
+import path21 from "path";
+
+class FileMetadataExtractor {
+  symbolGraph;
   constructor(symbolGraph) {
-    this.compressor = new CodeCompressor;
     this.symbolGraph = symbolGraph;
-    eventBus.subscribe("indexing:started", ({ projectId, projectPath: projectPath2 }) => {
-      this.projectRootCache.delete(projectId);
-      this.evictOldest(this.projectRootCache);
-      this.projectRootCache.set(projectId, projectPath2);
-    });
   }
-  async handle(params) {
-    const p = params;
-    const shouldCompress = p.compress !== false;
-    const targetRatio = p.targetRatio || 0.3;
-    const format = p.format || "json";
-    const { fields } = p;
-    const includeSymbols = p.includeSymbols !== false;
-    const includeImports = p.includeImports !== false;
-    try {
-      const resolved = await this.resolveFilePath(p.filePath, p.projectId);
-      if (resolved === null) {
-        return {
-          success: false,
-          error: "Relative filePath requires a projectId (to resolve against the workspace) or an absolute path."
+  async extractMetadata(content, filePath, options) {
+    const lines = content.split(`
+`);
+    const language = this.detectLanguage(filePath);
+    const metadata = {
+      totalLines: lines.length,
+      language
+    };
+    if (options.includeImports && language) {
+      metadata.imports = this.extractImports(lines, language);
+    }
+    if (options.includeSymbols && this.symbolGraph && options.projectId) {
+      try {
+        const queryPath = options.relativePath || filePath;
+        const { definitions } = await this.symbolGraph.listDefinitions(options.projectId, {
+          file: queryPath,
+          limit: 100
+        });
+        metadata.symbols = {
+          definitions: definitions.length,
+          references: 0
         };
+      } catch (error51) {
+        logger.debug("Failed to get symbol metadata", { filePath, error: error51 });
       }
-      const filePath = resolved;
-      const containment = await this.checkPathContainment(filePath, p.projectId);
-      if (!containment.allowed) {
-        return {
-          success: false,
-          error: containment.error
-        };
+    }
+    return metadata;
+  }
+  detectLanguage(filePath) {
+    const ext2 = path21.extname(filePath).toLowerCase();
+    const languageMap2 = {
+      ".ts": "TypeScript",
+      ".tsx": "TypeScript",
+      ".js": "JavaScript",
+      ".jsx": "JavaScript",
+      ".vue": "Vue",
+      ".py": "Python",
+      ".go": "Go",
+      ".rs": "Rust",
+      ".java": "Java",
+      ".cpp": "C++",
+      ".c": "C",
+      ".h": "C",
+      ".hpp": "C++",
+      ".cs": "C#",
+      ".rb": "Ruby",
+      ".php": "PHP",
+      ".swift": "Swift",
+      ".kt": "Kotlin",
+      ".kts": "Kotlin",
+      ".scala": "Scala",
+      ".md": "Markdown",
+      ".json": "JSON",
+      ".yaml": "YAML",
+      ".yml": "YAML",
+      ".xml": "XML",
+      ".html": "HTML",
+      ".css": "CSS",
+      ".scss": "SCSS",
+      ".sql": "SQL",
+      ".sh": "Shell",
+      ".bash": "Shell"
+    };
+    return languageMap2[ext2];
+  }
+  extractImports(lines, language) {
+    const imports = [];
+    const importPatterns = {
+      TypeScript: /^(import\s+.*?from\s+['"]|import\s+['"])/,
+      JavaScript: /^(import\s+.*?from\s+['"]|import\s+['"]|require\s*\(\s*['"])/,
+      Python: /^(import\s+|from\s+\S+\s+import)/,
+      Go: /^import\s+/,
+      Java: /^import\s+/,
+      Rust: /^use\s+/
+    };
+    const pattern = importPatterns[language];
+    if (!pattern)
+      return imports;
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (pattern.test(trimmed)) {
+        imports.push(trimmed);
       }
-      const relativePath = p.filePath;
-      const range = this.calculateRange(p);
-      const { content, metadata } = await this.readFileWithCache(filePath, {
-        includeSymbols,
-        includeImports,
-        projectId: p.projectId,
-        relativePath
-      });
-      const lines = content.split(`
+    }
+    return imports;
+  }
+}
+var init_file_metadata = __esm(() => {
+  init_dist();
+});
+
+// ../../packages/core/dist/services/file-read/line-range.js
+function calculateRange(params) {
+  if (params.lineStart !== undefined && params.lineEnd !== undefined) {
+    return {
+      start: Math.max(1, params.lineStart),
+      end: params.lineEnd
+    };
+  }
+  if (params.offset !== undefined) {
+    const offset = Math.max(1, params.offset);
+    const limit = params.limit || 1000;
+    return {
+      start: offset,
+      end: offset + limit - 1
+    };
+  }
+  return {
+    start: 1,
+    end: Infinity
+  };
+}
+function adjustRange(range, totalLines) {
+  const start = Math.max(1, Math.min(range.start, totalLines));
+  const end = range.end === Infinity ? totalLines : Math.min(range.end, totalLines);
+  return { start, end };
+}
+function extractLines(lines, range) {
+  const start = range.start - 1;
+  const end = range.end;
+  const selectedLines = lines.slice(start, end);
+  return selectedLines.map((line, index) => {
+    const lineNum = start + index + 1;
+    return `${lineNum.toString().padStart(6, " ")}: ${line}`;
+  }).join(`
 `);
-      const totalLines = lines.length;
-      const adjustedRange = this.adjustRange(range, totalLines);
-      let selectedContent = this.extractLines(lines, adjustedRange);
-      let selectedLineCount = selectedContent.split(`
+}
+function selectLines(lines, range) {
+  let content = extractLines(lines, range);
+  let lineCount = content.split(`
 `).length;
-      let source_clipped = false;
-      if (selectedLineCount > MASSA_AI_READ_FILE_MAX_LINES) {
-        const cappedLines = lines.slice(adjustedRange.start - 1, adjustedRange.start - 1 + MASSA_AI_READ_FILE_MAX_LINES);
-        selectedContent = cappedLines.join(`
+  let clipped = false;
+  if (lineCount > MASSA_AI_READ_FILE_MAX_LINES) {
+    const cappedLines = lines.slice(range.start - 1, range.start - 1 + MASSA_AI_READ_FILE_MAX_LINES);
+    content = cappedLines.join(`
 `);
-        selectedLineCount = selectedContent.split(`
+    lineCount = content.split(`
 `).length;
-        source_clipped = true;
-      }
-      const shouldAutoCompress = shouldCompress && selectedLineCount > 100 && targetRatio < 1;
-      const result = {
-        filePath: p.filePath,
-        absolutePath: filePath,
-        lineRange: {
-          requested: {
-            start: range.start,
-            end: range.end === Infinity ? null : range.end
-          },
-          actual: {
-            start: adjustedRange.start,
-            end: source_clipped ? adjustedRange.start + selectedLineCount - 1 : adjustedRange.end,
-            total: totalLines
-          },
-          selected: selectedLineCount
-        },
-        source_clipped,
-        metadata: {
-          totalLines,
-          language: metadata.language,
-          ...metadata.symbols && { symbols: metadata.symbols },
-          ...metadata.imports && { imports: metadata.imports }
-        },
-        compressed: shouldAutoCompress,
-        recommendations: []
-      };
-      if (shouldAutoCompress) {
-        const compressed = await this.compressor.compress(selectedContent, "code_structure");
-        const originalTokens = estimateTokens(selectedContent, "code");
-        const compressedTokens = estimateTokens(compressed.compressed, "code");
-        const actualRatio = compressedTokens / originalTokens;
-        result.content = compressed.compressed;
-        result.tokens = {
-          original: originalTokens,
-          compressed: compressedTokens,
-          saved: originalTokens - compressedTokens,
-          savingsPercent: Math.round((1 - actualRatio) * 100)
-        };
-        result.compressionRatio = actualRatio;
-        result.recommendations.push(`\u2713 Auto-compressed ${selectedLineCount} lines (${result.tokens.savingsPercent}% reduction)`);
-      } else {
-        result.content = selectedContent;
-        result.tokens = {
-          original: estimateTokens(selectedContent, "code"),
-          compressed: estimateTokens(selectedContent, "code"),
-          saved: 0,
-          savingsPercent: 0
-        };
-        if (selectedLineCount > 100) {
-          result.recommendations.push("\uD83D\uDCA1 Content > 100 lines. Consider compress=true for token savings");
-        }
-      }
-      if (range.start === 1 && range.end === Infinity) {
-        result.recommendations.push("\uD83D\uDCA1 Use lineStart/lineEnd or offset/limit to read specific sections (60% token savings)");
-      }
-      if (metadata.symbols && metadata.symbols.definitions > 0) {
-        result.recommendations.push(`\uD83D\uDCA1 Use get_references() to find usages of ${metadata.symbols.definitions} symbols in this file`);
-      }
-      return serializeToolResponse(result, { format, fields });
-    } catch (error51) {
-      logger.error("Failed to read file", error51, {
-        filePath: p.filePath
-      });
-      return {
-        success: false,
-        error: `Failed to read file: ${error51.message}`
-      };
-    }
+    clipped = true;
+  }
+  return { content, lineCount, clipped };
+}
+var MASSA_AI_READ_FILE_MAX_LINES;
+var init_line_range = __esm(() => {
+  MASSA_AI_READ_FILE_MAX_LINES = (() => {
+    const v = Number(process.env.MASSA_AI_READ_FILE_MAX_LINES);
+    return Number.isFinite(v) && v > 0 ? Math.floor(v) : 500;
+  })();
+});
+
+// ../../packages/core/dist/services/file-read/path-containment.js
+import path22 from "path";
+
+class PathContainment {
+  projectRoots;
+  constructor(projectRoots) {
+    this.projectRoots = projectRoots;
   }
   async resolveFilePath(filePath, projectId) {
-    if (path20.isAbsolute(filePath)) {
-      return path20.resolve(filePath);
+    if (path22.isAbsolute(filePath)) {
+      return path22.resolve(filePath);
     }
     if (projectId) {
-      const root = await this.getProjectRoot(projectId);
+      const root = await this.projectRoots.getProjectRoot(projectId);
       if (root) {
         const cleaned = sanitizeFilePath(filePath);
-        return path20.resolve(root, cleaned);
+        return path22.resolve(root, cleaned);
       }
       return null;
     }
@@ -138258,19 +138391,19 @@ class ReadFileTool {
   async checkPathContainment(absoluteFilePath, projectId) {
     const roots = [];
     if (projectId) {
-      const root = await this.getProjectRoot(projectId);
+      const root = await this.projectRoots.getProjectRoot(projectId);
       if (root)
-        roots.push(path20.resolve(root));
+        roots.push(path22.resolve(root));
     }
-    roots.push(path20.resolve(process.cwd()));
+    roots.push(path22.resolve(process.cwd()));
     const envRoots = (process.env.MASSA_AI_READ_FILE_ROOTS ?? "").split(":").map((s) => s.trim()).filter((s) => s.length > 0);
     for (const extra of envRoots) {
-      roots.push(path20.resolve(extra));
+      roots.push(path22.resolve(extra));
     }
-    const target = path20.resolve(absoluteFilePath);
+    const target = path22.resolve(absoluteFilePath);
     for (const root of roots) {
-      const rel = path20.relative(root, target);
-      if (rel !== "" && !rel.startsWith("..") && !path20.isAbsolute(rel)) {
+      const rel = path22.relative(root, target);
+      if (rel !== "" && !rel.startsWith("..") && !path22.isAbsolute(rel)) {
         return { allowed: true };
       }
       if (rel === "")
@@ -138286,6 +138419,23 @@ ${validRootsList}
 ` + `Provide a filePath that resolves under one of these roots.`
     };
   }
+}
+var init_path_containment = __esm(() => {
+  init_dist();
+});
+
+// ../../packages/core/dist/services/file-read/project-root-cache.js
+class ProjectRootCache {
+  projectRootCache = new Map;
+  ROOT_CACHE_TTL = 300000;
+  PROJECT_ROOT_CACHE_MAX_ENTRIES = 512;
+  constructor() {
+    eventBus.subscribe("indexing:started", ({ projectId, projectPath: projectPath2 }) => {
+      this.projectRootCache.delete(projectId);
+      evictOldest(this.projectRootCache, this.PROJECT_ROOT_CACHE_MAX_ENTRIES - 1);
+      this.projectRootCache.set(projectId, projectPath2);
+    });
+  }
   async getProjectRoot(projectId) {
     const cached2 = this.projectRootCache.get(projectId);
     if (cached2 !== undefined) {
@@ -138296,7 +138446,7 @@ ${validRootsList}
     try {
       const workspace = await workspaceManager.getWorkspace(projectId);
       if (workspace?.project_path) {
-        this.evictOldest(this.projectRootCache);
+        evictOldest(this.projectRootCache, this.PROJECT_ROOT_CACHE_MAX_ENTRIES - 1);
         this.projectRootCache.set(projectId, workspace.project_path);
         return workspace.project_path;
       }
@@ -138305,182 +138455,236 @@ ${validRootsList}
     }
     return null;
   }
-  evictOldest(cache) {
-    while (cache.size >= this.FILE_CACHE_MAX_ENTRIES) {
-      const oldest = cache.keys().next().value;
-      if (oldest === undefined)
-        break;
-      cache.delete(oldest);
-    }
-  }
-  calculateRange(params) {
-    if (params.lineStart !== undefined && params.lineEnd !== undefined) {
+}
+var init_project_root_cache = __esm(() => {
+  init_dist();
+  init_event_bus();
+  init_workspace_manager();
+});
+
+// ../../packages/core/dist/services/file-read/read-file.service.js
+function readFileOptions(p) {
+  const shouldCompress = p.compress !== false;
+  const targetRatio = p.targetRatio || 0.3;
+  const format = p.format || "json";
+  const { fields } = p;
+  const includeSymbols = p.includeSymbols !== false;
+  const includeImports = p.includeImports !== false;
+  return { shouldCompress, targetRatio, format, fields, includeSymbols, includeImports };
+}
+
+class ReadFileService {
+  compressor;
+  symbolGraph;
+  projectRoots;
+  pathContainment;
+  fileMetadata;
+  fileContent;
+  constructor(symbolGraph) {
+    this.compressor = new CodeCompressor;
+    this.symbolGraph = symbolGraph;
+    this.projectRoots = new ProjectRootCache;
+    this.pathContainment = new PathContainment(this.projectRoots);
+    this.fileMetadata = new FileMetadataExtractor(symbolGraph);
+    this.fileContent = new FileContentCache((content, filePath, options) => this.fileMetadata.extractMetadata(content, filePath, options));
+  }
+  async read(p, options) {
+    const { shouldCompress, targetRatio, includeSymbols, includeImports } = options;
+    const resolved = await this.pathContainment.resolveFilePath(p.filePath, p.projectId);
+    if (resolved === null) {
       return {
-        start: Math.max(1, params.lineStart),
-        end: params.lineEnd
+        ok: false,
+        error: "Relative filePath requires a projectId (to resolve against the workspace) or an absolute path."
       };
     }
-    if (params.offset !== undefined) {
-      const offset = Math.max(1, params.offset);
-      const limit = params.limit || 1000;
+    const filePath = resolved;
+    const containment = await this.pathContainment.checkPathContainment(filePath, p.projectId);
+    if (!containment.allowed) {
       return {
-        start: offset,
-        end: offset + limit - 1
+        ok: false,
+        error: containment.error
       };
     }
-    return {
-      start: 1,
-      end: Infinity
-    };
-  }
-  adjustRange(range, totalLines) {
-    const start = Math.max(1, Math.min(range.start, totalLines));
-    const end = range.end === Infinity ? totalLines : Math.min(range.end, totalLines);
-    return { start, end };
-  }
-  async readFileWithCache(filePath, options) {
-    const cacheKey = JSON.stringify({
-      filePath,
-      includeSymbols: options.includeSymbols ?? false,
-      includeImports: options.includeImports ?? false,
-      projectId: options.projectId ?? null,
-      relativePath: options.relativePath ?? null
-    });
-    const cached2 = this.fileCache.get(cacheKey);
-    if (cached2 && Date.now() - cached2.timestamp < this.CACHE_TTL) {
-      logger.debug("File cache hit", { filePath });
-      this.fileCache.delete(cacheKey);
-      this.fileCache.set(cacheKey, cached2);
-      if (!cached2.metadata) {
-        const metadata2 = await this.extractMetadata(cached2.content, filePath, options);
-        this.fileCache.set(cacheKey, { ...cached2, metadata: metadata2 });
-        return { content: cached2.content, metadata: metadata2 };
-      }
-      return {
-        content: cached2.content,
-        metadata: cached2.metadata
-      };
-    }
-    const content = await fs10.readFile(filePath, "utf-8");
-    const metadata = await this.extractMetadata(content, filePath, options);
-    this.evictOldest(this.fileCache);
-    this.fileCache.set(cacheKey, {
-      content,
-      timestamp: Date.now(),
-      metadata
+    const relativePath = p.filePath;
+    const range = calculateRange(p);
+    const { content, metadata } = await this.fileContent.readFileWithCache(filePath, {
+      includeSymbols,
+      includeImports,
+      projectId: p.projectId,
+      relativePath
     });
-    logger.debug("File read and cached", { filePath });
-    return { content, metadata };
-  }
-  async extractMetadata(content, filePath, options) {
     const lines = content.split(`
 `);
-    const language = this.detectLanguage(filePath);
-    const metadata = {
-      totalLines: lines.length,
-      language
+    const totalLines = lines.length;
+    const adjustedRange = adjustRange(range, totalLines);
+    const { content: selectedContent, lineCount: selectedLineCount, clipped: source_clipped } = selectLines(lines, adjustedRange);
+    const shouldAutoCompress = shouldCompress && selectedLineCount > 100 && targetRatio < 1;
+    const result = {
+      filePath: p.filePath,
+      absolutePath: filePath,
+      lineRange: {
+        requested: {
+          start: range.start,
+          end: range.end === Infinity ? null : range.end
+        },
+        actual: {
+          start: adjustedRange.start,
+          end: source_clipped ? adjustedRange.start + selectedLineCount - 1 : adjustedRange.end,
+          total: totalLines
+        },
+        selected: selectedLineCount
+      },
+      source_clipped,
+      metadata: {
+        totalLines,
+        language: metadata.language,
+        ...metadata.symbols && { symbols: metadata.symbols },
+        ...metadata.imports && { imports: metadata.imports }
+      },
+      compressed: shouldAutoCompress,
+      recommendations: []
     };
-    if (options.includeImports && language) {
-      metadata.imports = this.extractImports(lines, language);
-    }
-    if (options.includeSymbols && this.symbolGraph && options.projectId) {
-      try {
-        const queryPath = options.relativePath || filePath;
-        const { definitions } = await this.symbolGraph.listDefinitions(options.projectId, {
-          file: queryPath,
-          limit: 100
-        });
-        metadata.symbols = {
-          definitions: definitions.length,
-          references: 0
-        };
-      } catch (error51) {
-        logger.debug("Failed to get symbol metadata", { filePath, error: error51 });
+    if (shouldAutoCompress) {
+      const compressed = await this.compressor.compress(selectedContent, "code_structure");
+      const originalTokens = estimateTokens(selectedContent, "code");
+      const compressedTokens = estimateTokens(compressed.compressed, "code");
+      const actualRatio = compressedTokens / originalTokens;
+      result.content = compressed.compressed;
+      result.tokens = {
+        original: originalTokens,
+        compressed: compressedTokens,
+        saved: originalTokens - compressedTokens,
+        savingsPercent: Math.round((1 - actualRatio) * 100)
+      };
+      result.compressionRatio = actualRatio;
+      result.recommendations.push(`\u2713 Auto-compressed ${selectedLineCount} lines (${result.tokens.savingsPercent}% reduction)`);
+    } else {
+      result.content = selectedContent;
+      result.tokens = {
+        original: estimateTokens(selectedContent, "code"),
+        compressed: estimateTokens(selectedContent, "code"),
+        saved: 0,
+        savingsPercent: 0
+      };
+      if (selectedLineCount > 100) {
+        result.recommendations.push("\uD83D\uDCA1 Content > 100 lines. Consider compress=true for token savings");
       }
     }
-    return metadata;
-  }
-  extractLines(lines, range) {
-    const start = range.start - 1;
-    const end = range.end;
-    const selectedLines = lines.slice(start, end);
-    return selectedLines.map((line, index) => {
-      const lineNum = start + index + 1;
-      return `${lineNum.toString().padStart(6, " ")}: ${line}`;
-    }).join(`
-`);
+    if (range.start === 1 && range.end === Infinity) {
+      result.recommendations.push("\uD83D\uDCA1 Use lineStart/lineEnd or offset/limit to read specific sections (60% token savings)");
+    }
+    if (metadata.symbols && metadata.symbols.definitions > 0) {
+      result.recommendations.push(`\uD83D\uDCA1 Use get_references() to find usages of ${metadata.symbols.definitions} symbols in this file`);
+    }
+    return { ok: true, data: result };
   }
-  detectLanguage(filePath) {
-    const ext2 = path20.extname(filePath).toLowerCase();
-    const languageMap2 = {
-      ".ts": "TypeScript",
-      ".tsx": "TypeScript",
-      ".js": "JavaScript",
-      ".jsx": "JavaScript",
-      ".vue": "Vue",
-      ".py": "Python",
-      ".go": "Go",
-      ".rs": "Rust",
-      ".java": "Java",
-      ".cpp": "C++",
-      ".c": "C",
-      ".h": "C",
-      ".hpp": "C++",
-      ".cs": "C#",
-      ".rb": "Ruby",
-      ".php": "PHP",
-      ".swift": "Swift",
-      ".kt": "Kotlin",
-      ".kts": "Kotlin",
-      ".scala": "Scala",
-      ".md": "Markdown",
-      ".json": "JSON",
-      ".yaml": "YAML",
-      ".yml": "YAML",
-      ".xml": "XML",
-      ".html": "HTML",
-      ".css": "CSS",
-      ".scss": "SCSS",
-      ".sql": "SQL",
-      ".sh": "Shell",
-      ".bash": "Shell"
-    };
-    return languageMap2[ext2];
+}
+var init_read_file_service = __esm(() => {
+  init_dist();
+  init_code_compressor();
+  init_file_content_cache();
+  init_file_metadata();
+  init_line_range();
+  init_path_containment();
+  init_project_root_cache();
+});
+
+// ../../packages/core/dist/tools/read_file.js
+class ReadFileTool {
+  name = "read_file";
+  description = "Read file with automatic compression, caching, and symbol metadata. " + "Use with search results for 60% token savings.";
+  inputSchema = {
+    type: "object",
+    properties: {
+      filePath: {
+        type: "string",
+        description: "File path (absolute or relative to project root)"
+      },
+      projectId: {
+        type: "string",
+        description: "Project ID for symbol metadata (optional)"
+      },
+      offset: {
+        type: "number",
+        description: "Start line number (1-indexed)"
+      },
+      limit: {
+        type: "number",
+        description: "Number of lines to read"
+      },
+      lineStart: {
+        type: "number",
+        description: "Start line (alternative to offset)"
+      },
+      lineEnd: {
+        type: "number",
+        description: "End line (alternative to limit)"
+      },
+      compress: {
+        type: "boolean",
+        description: "Auto-compress content > 100 lines (default: true)",
+        default: true
+      },
+      targetRatio: {
+        type: "number",
+        description: "Compression target ratio (0.3 = 70% reduction)",
+        default: 0.3
+      },
+      format: {
+        type: "string",
+        enum: ["json", "toon"],
+        description: "Output format",
+        default: "json"
+      },
+      fields: {
+        type: "array",
+        items: { type: "string" },
+        description: "Projection \u2014 keep only these keys (dotted paths supported, e.g. ['nodes.symbol']). Absent/empty \u2192 full data."
+      },
+      includeSymbols: {
+        type: "boolean",
+        description: "Include symbol metadata from graph (default: true)",
+        default: true
+      },
+      includeImports: {
+        type: "boolean",
+        description: "Extract and show import statements (default: true)",
+        default: true
+      }
+    },
+    required: ["filePath"]
+  };
+  service;
+  constructor(symbolGraph) {
+    this.service = new ReadFileService(symbolGraph);
   }
-  extractImports(lines, language) {
-    const imports = [];
-    const importPatterns = {
-      TypeScript: /^(import\s+.*?from\s+['"]|import\s+['"])/,
-      JavaScript: /^(import\s+.*?from\s+['"]|import\s+['"]|require\s*\(\s*['"])/,
-      Python: /^(import\s+|from\s+\S+\s+import)/,
-      Go: /^import\s+/,
-      Java: /^import\s+/,
-      Rust: /^use\s+/
-    };
-    const pattern = importPatterns[language];
-    if (!pattern)
-      return imports;
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (pattern.test(trimmed)) {
-        imports.push(trimmed);
+  async handle(params) {
+    const p = params;
+    const options = readFileOptions(p);
+    try {
+      const outcome2 = await this.service.read(p, options);
+      if (!outcome2.ok) {
+        return { success: false, error: outcome2.error };
       }
+      return serializeToolResponse(outcome2.data, {
+        format: options.format,
+        fields: options.fields
+      });
+    } catch (error51) {
+      logger.error("Failed to read file", error51, {
+        filePath: p.filePath
+      });
+      return {
+        success: false,
+        error: `Failed to read file: ${error51.message}`
+      };
     }
-    return imports;
   }
 }
-var MASSA_AI_READ_FILE_MAX_LINES;
 var init_read_file = __esm(() => {
   init_dist();
-  init_dist();
-  init_code_compressor();
   init_serialize();
-  init_event_bus();
-  init_workspace_manager();
-  MASSA_AI_READ_FILE_MAX_LINES = (() => {
-    const v = Number(process.env.MASSA_AI_READ_FILE_MAX_LINES);
-    return Number.isFinite(v) && v > 0 ? Math.floor(v) : 500;
-  })();
+  init_read_file_service();
 });
 
 // ../../packages/core/dist/tools/execute.js
@@ -141415,7 +141619,7 @@ var init_l1_memory_cache = __esm(() => {
 // ../../packages/core/dist/services/health/local-health-checker.js
 import fs11 from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
-import path21 from "path";
+import path23 from "path";
 
 class LocalHealthChecker {
   ollamaBaseUrl = process.env.OLLAMA_BASE_URL || "http://localhost:11434";
@@ -141450,7 +141654,7 @@ class LocalHealthChecker {
     try {
       if (!existsSync3(this.dataDir))
         await fs11.mkdir(this.dataDir, { recursive: true });
-      const probe2 = path21.join(this.dataDir, ".health-check-test");
+      const probe2 = path23.join(this.dataDir, ".health-check-test");
       await fs11.writeFile(probe2, "ok");
       await fs11.unlink(probe2);
       return { available: true, latency: Date.now() - start, details: { path: this.dataDir, writable: true } };
@@ -143393,7 +143597,7 @@ var init_scheduler2 = __esm(() => {
 // ../../packages/core/dist/services/pricing/models-dev-client.js
 import fs12 from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
-import path22 from "path";
+import path24 from "path";
 function getModelsDevClient() {
   if (!clientInstance) {
     clientInstance = new ModelsDevClient;
@@ -143413,7 +143617,7 @@ var init_models_dev_client = __esm(() => {
     memoryCacheTimestamp = 0;
     getLocalCachePath() {
       const dataDir = config2.get("dataDir");
-      return path22.join(dataDir, ModelsDevClient.LOCAL_CACHE_FILE);
+      return path24.join(dataDir, ModelsDevClient.LOCAL_CACHE_FILE);
     }
     async loadLocalCache() {
       const cachePath = this.getLocalCachePath();
@@ -143448,7 +143652,7 @@ var init_models_dev_client = __esm(() => {
     async saveLocalCache(models) {
       const cachePath = this.getLocalCachePath();
       try {
-        const dir = path22.dirname(cachePath);
+        const dir = path24.dirname(cachePath);
         await fs12.mkdir(dir, { recursive: true });
         const data = {
           timestamp: Date.now(),
@@ -149339,33 +149543,33 @@ var require_URL = __commonJS((exports, module) => {
         else
           return basepath.substring(0, lastslash + 1) + refpath;
       }
-      function remove_dot_segments(path23) {
-        if (!path23)
-          return path23;
+      function remove_dot_segments(path25) {
+        if (!path25)
+          return path25;
         var output = "";
-        while (path23.length > 0) {
-          if (path23 === "." || path23 === "..") {
-            path23 = "";
+        while (path25.length > 0) {
+          if (path25 === "." || path25 === "..") {
+            path25 = "";
             break;
           }
-          var twochars = path23.substring(0, 2);
-          var threechars = path23.substring(0, 3);
-          var fourchars = path23.substring(0, 4);
+          var twochars = path25.substring(0, 2);
+          var threechars = path25.substring(0, 3);
+          var fourchars = path25.substring(0, 4);
           if (threechars === "../") {
-            path23 = path23.substring(3);
+            path25 = path25.substring(3);
           } else if (twochars === "./") {
-            path23 = path23.substring(2);
+            path25 = path25.substring(2);
           } else if (threechars === "/./") {
-            path23 = "/" + path23.substring(3);
-          } else if (twochars === "/." && path23.length === 2) {
-            path23 = "/";
-          } else if (fourchars === "/../" || threechars === "/.." && path23.length === 3) {
-            path23 = "/" + path23.substring(4);
+            path25 = "/" + path25.substring(3);
+          } else if (twochars === "/." && path25.length === 2) {
+            path25 = "/";
+          } else if (fourchars === "/../" || threechars === "/.." && path25.length === 3) {
+            path25 = "/" + path25.substring(4);
             output = output.replace(/\/?[^\/]*$/, "");
           } else {
-            var segment = path23.match(/(\/?([^\/]*))/)[0];
+            var segment = path25.match(/(\/?([^\/]*))/)[0];
             output += segment;
-            path23 = path23.substring(segment.length);
+            path25 = path25.substring(segment.length);
           }
         }
         return output;
@@ -161435,21 +161639,21 @@ function jsonToKeyPathChunks(value, label = "$") {
   walk(value, label, out);
   return out;
 }
-function walk(val, path23, out) {
+function walk(val, path25, out) {
   if (val === null || val === undefined)
     return;
   if (Array.isArray(val)) {
     if (val.length === 0) {
-      out.push({ path: path23, content: `**${path23}** = _[]_` });
+      out.push({ path: path25, content: `**${path25}** = _[]_` });
       return;
     }
     if (val.every((v) => v !== null && typeof v === "object")) {
-      val.forEach((v, i) => walk(v, `${path23}[${i}]`, out));
+      val.forEach((v, i) => walk(v, `${path25}[${i}]`, out));
       return;
     }
     const items = val.map((v) => `- \`${String(v)}\``).join(`
 `);
-    out.push({ path: path23, content: `**${path23}**
+    out.push({ path: path25, content: `**${path25}**
 
 ${items}` });
     return;
@@ -161457,16 +161661,16 @@ ${items}` });
   if (typeof val === "object") {
     const entries = Object.entries(val);
     if (entries.length === 0) {
-      out.push({ path: path23, content: `**${path23}** = _{}_` });
+      out.push({ path: path25, content: `**${path25}** = _{}_` });
       return;
     }
     for (const [k, v] of entries) {
       const safeKey = /^[A-Za-z_$][\w$]*$/.test(k) ? k : JSON.stringify(k);
-      walk(v, `${path23}.${safeKey}`, out);
+      walk(v, `${path25}.${safeKey}`, out);
     }
     return;
   }
-  out.push({ path: path23, content: `**${path23}** = \`${String(val)}\`` });
+  out.push({ path: path25, content: `**${path25}** = \`${String(val)}\`` });
 }
 var gfm, STRIP_SELECTORS, tdCache = null;
 var init_html_to_md = __esm(() => {
@@ -161732,12 +161936,7 @@ class WebController {
       markIndexed: (key, ts) => {
         this.cache.delete(key);
         this.cache.set(key, ts);
-        while (this.cache.size > WEB_CACHE_MAX_ENTRIES) {
-          const oldest = this.cache.keys().next().value;
-          if (oldest === undefined)
-            break;
-          this.cache.delete(oldest);
-        }
+        evictOldest(this.cache, WEB_CACHE_MAX_ENTRIES);
       }
     };
   }
@@ -162134,13 +162333,20 @@ class HookService {
     });
     const id = this.idFactory();
     this.queue.enqueue(async () => {
+      const scrub = scrubCredentials(JSON.stringify(ev.payload));
+      if (scrub.total > 0) {
+        logger.debug("hook payload redacted before persist", {
+          redactions: scrub.redactions,
+          total: scrub.total
+        });
+      }
       const obs = {
         id,
         projectId: attribution.projectId,
         sessionId: ev.sessionId,
         source: ev.event,
         category: extractCategory(ev.event, ev.payload),
-        payloadJson: JSON.stringify(ev.payload),
+        payloadJson: scrub.sanitized,
         importance: ev.importance,
         createdAt: ev.ts,
         agentId: ev.agentId,
@@ -162201,6 +162407,7 @@ var init_hook_service = __esm(() => {
   init_observation_extractor();
   init_observation_consolidation_job();
   init_attribution_resolver();
+  init_credential_scrub();
   ValidationError = class ValidationError extends Error {
     code;
     constructor(code, message) {
@@ -162225,7 +162432,7 @@ var init_hook_service = __esm(() => {
 // ../../packages/core/dist/services/bootstrap/bootstrap-service.js
 import { randomUUID as randomUUID9 } from "crypto";
 import fs13 from "fs";
-import path23 from "path";
+import path25 from "path";
 import { spawn as spawn2 } from "child_process";
 function readBootstrapConfig() {
   try {
@@ -162385,7 +162592,7 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   }
   try {
     for (const name26 of README_CANDIDATES) {
-      const p = path23.join(projectRoot, name26);
+      const p = path25.join(projectRoot, name26);
       if (fs13.existsSync(p) && fs13.statSync(p).isFile()) {
         const buf = fs13.readFileSync(p);
         signals.readme = buf.slice(0, MAX_README_BYTES).toString("utf8");
@@ -162396,14 +162603,14 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
     logger.debug("bootstrap scan: README read failed", { error: e.message });
   }
   try {
-    const docsDir = path23.join(projectRoot, "docs");
+    const docsDir = path25.join(projectRoot, "docs");
     if (fs13.existsSync(docsDir) && fs13.statSync(docsDir).isDirectory()) {
       const entries = walkMarkdown(docsDir).slice(0, MAX_DOCS);
       for (const rel of entries) {
         try {
           const buf = fs13.readFileSync(rel);
           signals.docs.push({
-            path: path23.relative(projectRoot, rel),
+            path: path25.relative(projectRoot, rel),
             snippet: buf.slice(0, MAX_DOC_BYTES).toString("utf8")
           });
         } catch {}
@@ -162414,7 +162621,7 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   }
   try {
     for (const name26 of MANIFEST_FILES) {
-      const p = path23.join(projectRoot, name26);
+      const p = path25.join(projectRoot, name26);
       if (!fs13.existsSync(p) || !fs13.statSync(p).isFile())
         continue;
       const raw2 = fs13.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
@@ -162462,7 +162669,7 @@ function walkMarkdown(dir) {
       continue;
     }
     for (const e of entries) {
-      const full = path23.join(cur, e.name);
+      const full = path25.join(cur, e.name);
       if (e.isDirectory()) {
         if (e.name === "node_modules" || e.name.startsWith("."))
           continue;
@@ -165980,7 +166187,7 @@ init_dist();
 init_dist15();
 init_dist();
 import fs14 from "fs/promises";
-import path24 from "path";
+import path26 from "path";
 var _indexProjectTool = null;
 function indexProjectTool() {
   if (!_indexProjectTool)
@@ -166250,7 +166457,7 @@ class EmbeddedApiClient {
         } else {
           end = start + 20;
         }
-        const absolutePath = path24.join(workspace.project_path, file2);
+        const absolutePath = path26.join(workspace.project_path, file2);
         const content = await fs14.readFile(absolutePath, "utf-8");
         const lines = content.split(/\r?\n/);
         const slice = lines.slice(start - 1, Math.min(lines.length, end));
@@ -166474,21 +166681,21 @@ class EmbeddedApiClient {
   async uploadAndIndex(params) {
     const rawBase = params.projectId || params.projectPath.replace(/\\/g, "/").split("/").filter(Boolean).pop() || "default";
     const finalProjectId = rawBase.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 128);
-    const uploadRoot = process.env.MASSA_AI_UPLOAD_DIR || path24.join(getGlobalDataDir(), "uploads");
-    const stagingDir = path24.resolve(uploadRoot, finalProjectId);
+    const uploadRoot = process.env.MASSA_AI_UPLOAD_DIR || path26.join(getGlobalDataDir(), "uploads");
+    const stagingDir = path26.resolve(uploadRoot, finalProjectId);
     await fs14.rm(stagingDir, { recursive: true, force: true });
     await fs14.mkdir(stagingDir, { recursive: true });
     const WRITE_BATCH = 20;
     for (let i = 0;i < params.files.length; i += WRITE_BATCH) {
       await Promise.all(params.files.slice(i, i + WRITE_BATCH).map(async (file2) => {
-        if (path24.isAbsolute(file2.relativePath) || file2.relativePath.includes("..")) {
+        if (path26.isAbsolute(file2.relativePath) || file2.relativePath.includes("..")) {
           throw new Error(`Invalid file path: ${file2.relativePath}`);
         }
-        const dest = path24.resolve(stagingDir, file2.relativePath.replace(/\//g, path24.sep));
-        if (!dest.startsWith(stagingDir + path24.sep)) {
+        const dest = path26.resolve(stagingDir, file2.relativePath.replace(/\//g, path26.sep));
+        if (!dest.startsWith(stagingDir + path26.sep)) {
           throw new Error(`Path escapes staging directory: ${file2.relativePath}`);
         }
-        await fs14.mkdir(path24.dirname(dest), { recursive: true });
+        await fs14.mkdir(path26.dirname(dest), { recursive: true });
         await fs14.writeFile(dest, file2.content, "utf-8");
       }));
     }
@@ -166822,7 +167029,7 @@ class EmbeddedApiClient {
 // src/file-collector.ts
 init_config();
 import fs15 from "fs/promises";
-import path25 from "path";
+import path27 from "path";
 var SKIP_DIRS = new Set([
   "node_modules",
   ".git",
@@ -166872,13 +167079,13 @@ async function walk2(root2, dir, files, state, allowed) {
       break;
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name) && !entry2.name.startsWith(".")) {
-        await walk2(root2, path25.join(dir, entry2.name), files, state, allowed);
+        await walk2(root2, path27.join(dir, entry2.name), files, state, allowed);
       }
     } else if (entry2.isFile()) {
-      const ext2 = path25.extname(entry2.name).toLowerCase();
+      const ext2 = path27.extname(entry2.name).toLowerCase();
       if (!allowed.has(ext2))
         continue;
-      const fullPath = path25.join(dir, entry2.name);
+      const fullPath = path27.join(dir, entry2.name);
       try {
         const stat = await fs15.stat(fullPath);
         if (stat.size > MAX_FILE_BYTES)
@@ -166887,7 +167094,7 @@ async function walk2(root2, dir, files, state, allowed) {
           continue;
         const content = await fs15.readFile(fullPath, "utf-8");
         state.totalBytes += stat.size;
-        const relativePath = path25.relative(root2, fullPath).split(path25.sep).join("/");
+        const relativePath = path27.relative(root2, fullPath).split(path27.sep).join("/");
         files.push({ relativePath, content });
       } catch {}
     }