@massa-ai/tools-api 1.36.0 → 1.38.0

package/dist/index.js

@@ -1263,7 +1263,8 @@ var init_config = __esm(() => {
     },
     logging: {
       level: process.env.LOG_LEVEL || fileConfig.logging?.level || "info",
-      enableMetrics: process.env.ENABLE_METRICS === "true" || process.env.ENABLE_METRICS === undefined && !!fileConfig.logging?.enableMetrics
+      enableMetrics: process.env.ENABLE_METRICS === "true" || process.env.ENABLE_METRICS === undefined && !!fileConfig.logging?.enableMetrics,
+      file: process.env.MASSA_AI_LOG_FILE || fileConfig.logging?.file || undefined
     },
     synapse: {
       enabled: process.env.SYNAPSE_ENABLED !== "false",
@@ -6602,20 +6603,25 @@ var init_types = __esm(() => {
 var init_interfaces = () => {};
 
 // ../../packages/shared/dist/utils/logger.js
+import fs3 from "fs";
+
 class Logger {
   _level;
   _enableMetrics;
+  _logFilePath;
   _initialized = false;
   constructor() {}
   ensureInitialized() {
     if (!this._initialized) {
       try {
-        const configLevel = config.get("logging").level;
-        this._level = this.parseLogLevel(configLevel);
-        this._enableMetrics = config.get("logging").enableMetrics;
+        const loggingConfig = config.get("logging");
+        this._level = this.parseLogLevel(loggingConfig.level);
+        this._enableMetrics = loggingConfig.enableMetrics;
+        this._logFilePath = loggingConfig.file;
       } catch {
         this._level = LogLevel.INFO;
         this._enableMetrics = false;
+        this._logFilePath = undefined;
       }
       this._initialized = true;
     }
@@ -6628,6 +6634,10 @@ class Logger {
     this.ensureInitialized();
     return this._enableMetrics;
   }
+  get logFilePath() {
+    this.ensureInitialized();
+    return this._logFilePath;
+  }
   parseLogLevel(level) {
     const levels = {
       debug: LogLevel.DEBUG,
@@ -6647,6 +6657,13 @@ class Logger {
   }
   write(message, _level) {
     console.error(message);
+    const filePath = this.logFilePath;
+    if (filePath) {
+      try {
+        fs3.appendFileSync(filePath, message + `
+`);
+      } catch {}
+    }
   }
   debug(message, meta) {
     if (this.shouldLog(LogLevel.DEBUG)) {
@@ -7056,7 +7073,7 @@ var init_hosts = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/state.js
-import fs3 from "fs";
+import fs4 from "fs";
 import path7 from "path";
 function namedError(name, message) {
   const err = new InstallStateError(message);
@@ -7083,7 +7100,7 @@ function validateShape(raw2, filePath) {
 function readInstallState(filePath) {
   let text;
   try {
-    text = fs3.readFileSync(filePath, "utf-8");
+    text = fs4.readFileSync(filePath, "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT")
@@ -7103,8 +7120,8 @@ function writeInstallState(filePath, state) {
   const text = `${JSON.stringify(validated, null, 2)}
 `;
   try {
-    fs3.mkdirSync(path7.dirname(filePath), { recursive: true });
-    fs3.writeFileSync(filePath, text);
+    fs4.mkdirSync(path7.dirname(filePath), { recursive: true });
+    fs4.writeFileSync(filePath, text);
   } catch (err) {
     throw UnwritableInstallStateError(filePath, err.message);
   }
@@ -7131,7 +7148,7 @@ var init_state = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/lock.js
-import fs4 from "fs";
+import fs5 from "fs";
 import path8 from "path";
 import os4 from "os";
 import crypto4 from "crypto";
@@ -7144,7 +7161,7 @@ function namedError2(name, message) {
 function readOwner(ownerPath) {
   let raw2;
   try {
-    raw2 = JSON.parse(fs4.readFileSync(ownerPath, "utf-8"));
+    raw2 = JSON.parse(fs5.readFileSync(ownerPath, "utf-8"));
   } catch {
     return null;
   }
@@ -7160,7 +7177,7 @@ function releaseIfOwned(lockDir, ownerPath, token) {
   const owner = readOwner(ownerPath);
   if (owner === null || owner.token !== token)
     return;
-  fs4.rmSync(lockDir, { recursive: true, force: true });
+  fs5.rmSync(lockDir, { recursive: true, force: true });
 }
 function acquireLock(stateFilePath, options = {}) {
   const lockDir = `${stateFilePath}.switch.lock`;
@@ -7169,11 +7186,11 @@ function acquireLock(stateFilePath, options = {}) {
   const identity = options.identity ?? DEFAULT_IDENTITY;
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
   const createFresh = () => {
-    fs4.mkdirSync(lockDir);
+    fs5.mkdirSync(lockDir);
     const pid = identity.pid();
     const startedAt = identity.processStart(pid);
     if (startedAt == null) {
-      fs4.rmSync(lockDir, { recursive: true, force: true });
+      fs5.rmSync(lockDir, { recursive: true, force: true });
       throw LockAcquireError(lockDir, "could not determine this process's start-time identity");
     }
     const token = crypto4.randomUUID();
@@ -7184,8 +7201,8 @@ function acquireLock(stateFilePath, options = {}) {
       token,
       timestamp: clock.now()
     };
-    fs4.mkdirSync(path8.dirname(ownerPath), { recursive: true });
-    fs4.writeFileSync(ownerPath, JSON.stringify(record));
+    fs5.mkdirSync(path8.dirname(ownerPath), { recursive: true });
+    fs5.writeFileSync(ownerPath, JSON.stringify(record));
     return { lockDir, release: () => releaseIfOwned(lockDir, ownerPath, token) };
   };
   try {
@@ -7200,11 +7217,11 @@ function acquireLock(stateFilePath, options = {}) {
     throw LockHeldError(lockDir);
   const reclaimDir = `${lockDir}.reclaim.${owner.token}`;
   try {
-    fs4.renameSync(lockDir, reclaimDir);
+    fs5.renameSync(lockDir, reclaimDir);
   } catch {
     throw LockHeldError(lockDir);
   }
-  fs4.rmSync(reclaimDir, { recursive: true, force: true });
+  fs5.rmSync(reclaimDir, { recursive: true, force: true });
   try {
     return createFresh();
   } catch {
@@ -7238,7 +7255,7 @@ var init_lock = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/engine.js
-import fs5 from "fs";
+import fs6 from "fs";
 import path9 from "path";
 import os5 from "os";
 import crypto5 from "crypto";
@@ -7272,7 +7289,7 @@ function listProfiles(opts = {}) {
         availableProfiles: []
       };
     }
-    const installed = fs5.existsSync(layout.activeDir);
+    const installed = fs6.existsSync(layout.activeDir);
     const availableProfiles = listVariantProfiles(layout);
     const platform = state.platforms[host];
     return {
@@ -7288,9 +7305,9 @@ function listProfiles(opts = {}) {
   return { hosts };
 }
 function listVariantProfiles(layout) {
-  if (!fs5.existsSync(layout.variantsRoot))
+  if (!fs6.existsSync(layout.variantsRoot))
     return [];
-  return fs5.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  return fs6.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
 }
 function matchesGlob(filename, glob) {
   const starIdx = glob.indexOf("*");
@@ -7303,32 +7320,32 @@ function matchesGlob(filename, glob) {
 function assertStateWritable(stateFilePath) {
   const dir = path9.dirname(stateFilePath);
   try {
-    fs5.mkdirSync(dir, { recursive: true });
+    fs6.mkdirSync(dir, { recursive: true });
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
-  const checkPath = fs5.existsSync(stateFilePath) ? stateFilePath : dir;
+  const checkPath = fs6.existsSync(stateFilePath) ? stateFilePath : dir;
   try {
-    fs5.accessSync(checkPath, fs5.constants.W_OK);
+    fs6.accessSync(checkPath, fs6.constants.W_OK);
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
 }
 function copyFileRouteVariant(layout, variantDir) {
-  fs5.mkdirSync(layout.activeDir, { recursive: true });
+  fs6.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs5.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs6.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
-    fs5.copyFileSync(path9.join(variantDir, entry.name), path9.join(layout.activeDir, entry.name));
+    fs6.copyFileSync(path9.join(variantDir, entry.name), path9.join(layout.activeDir, entry.name));
     changed++;
   }
   return changed;
 }
 function repointOpencodeVariant(layout, variantDir) {
-  fs5.mkdirSync(layout.activeDir, { recursive: true });
+  fs6.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs5.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs6.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
     const dest = path9.join(layout.activeDir, entry.name);
@@ -7336,15 +7353,15 @@ function repointOpencodeVariant(layout, variantDir) {
     let destExists = true;
     let destIsSymlink = false;
     try {
-      destIsSymlink = fs5.lstatSync(dest).isSymbolicLink();
+      destIsSymlink = fs6.lstatSync(dest).isSymbolicLink();
     } catch {
       destExists = false;
     }
     if (destExists && !destIsSymlink)
       continue;
     const tmp = `${dest}.massa-ai-switch.${crypto5.randomUUID()}`;
-    fs5.symlinkSync(target, tmp);
-    fs5.renameSync(tmp, dest);
+    fs6.symlinkSync(target, tmp);
+    fs6.renameSync(tmp, dest);
     changed++;
   }
   return changed;
@@ -7366,13 +7383,13 @@ function switchProfile(opts) {
   if (fileHosts.length === 0) {
     return { profile: opts.profile, dryRun, hosts: orderRows(universe, skipRows), restartRequired: false };
   }
-  const installedFileHosts = fileHosts.filter((h) => fs5.existsSync(h.layout.activeDir));
+  const installedFileHosts = fileHosts.filter((h) => fs6.existsSync(h.layout.activeDir));
   if (installedFileHosts.length === 0)
     throw NoHostsDetectedError();
   const withAvailability = fileHosts.map((h) => {
-    const variantsRootExists = fs5.existsSync(h.layout.variantsRoot);
+    const variantsRootExists = fs6.existsSync(h.layout.variantsRoot);
     const variantDir = h.layout.variantDir(opts.profile);
-    const available = variantsRootExists && fs5.existsSync(variantDir) && fs5.statSync(variantDir).isDirectory();
+    const available = variantsRootExists && fs6.existsSync(variantDir) && fs6.statSync(variantDir).isDirectory();
     return { ...h, variantsRootExists, variantDir, available };
   });
   if (!withAvailability.some((h) => h.available)) {
@@ -11580,8 +11597,8 @@ var init_esm4 = __esm(() => {
     #children;
     nocase;
     #fs;
-    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs6 = defaultFS } = {}) {
-      this.#fs = fsFromOption(fs6);
+    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs7 = defaultFS } = {}) {
+      this.#fs = fsFromOption(fs7);
       if (cwd instanceof URL || cwd.startsWith("file://")) {
         cwd = fileURLToPath(cwd);
       }
@@ -12056,8 +12073,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(dir) {
       return win32.parse(dir).root.toUpperCase();
     }
-    newRoot(fs6) {
-      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs6 });
+    newRoot(fs7) {
+      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs7 });
     }
     isAbsolute(p) {
       return p.startsWith("/") || p.startsWith("\\") || /^[a-z]:(\/|\\)/i.test(p);
@@ -12073,8 +12090,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(_dir) {
       return "/";
     }
-    newRoot(fs6) {
-      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs6 });
+    newRoot(fs7) {
+      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs7 });
     }
     isAbsolute(p) {
       return p.startsWith("/");
@@ -13480,7 +13497,7 @@ var init_capture_policy = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/ignore-patterns.js
-import fs6 from "fs/promises";
+import fs7 from "fs/promises";
 import path11 from "path";
 function buildExtensionGlob(extensions2) {
   return extensions2.map((ext2) => `**/*${ext2}`);
@@ -13505,7 +13522,7 @@ async function loadProjectIgnore(projectPath) {
   ig.add(DEFAULT_IGNORES);
   try {
     const gitignorePath = path11.join(projectPath, ".gitignore");
-    const gitignoreContent = await fs6.readFile(gitignorePath, "utf8");
+    const gitignoreContent = await fs7.readFile(gitignorePath, "utf8");
     const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
     ig.add(rules);
@@ -13587,6 +13604,89 @@ var init_db_connection = __esm(() => {
   init_config();
 });
 
+// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
+function markerFor(id) {
+  return `[REDACTED:${id}]`;
+}
+function fullMatchRule(id, pattern) {
+  const marker = markerFor(id);
+  return {
+    id,
+    replace(text) {
+      let count = 0;
+      const replaced = text.replace(pattern, () => {
+        count++;
+        return marker;
+      });
+      return { text: replaced, count };
+    }
+  };
+}
+function scrubCredentials(payloadJson) {
+  const redactions = {};
+  for (const id of RULE_IDS)
+    redactions[id] = 0;
+  let text = payloadJson;
+  for (const rule of RULES) {
+    const { text: next, count } = rule.replace(text);
+    text = next;
+    redactions[rule.id] += count;
+  }
+  const total = Object.values(redactions).reduce((sum, n2) => sum + n2, 0);
+  return {
+    sanitized: text,
+    redactions,
+    total
+  };
+}
+var PEM_PATTERN, JWT_PATTERN, AWS_KEY_PATTERN, SK_KEY_PATTERN, GITHUB_TOKEN_PATTERN, SLACK_TOKEN_PATTERN, BEARER_PATTERN, RULES, RULE_IDS;
+var init_credential_scrub = __esm(() => {
+  PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
+  JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+  AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
+  SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+  GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
+  SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
+  BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
+  RULES = [
+    fullMatchRule("pem", PEM_PATTERN),
+    fullMatchRule("jwt", JWT_PATTERN),
+    fullMatchRule("aws-key", AWS_KEY_PATTERN),
+    fullMatchRule("sk-key", SK_KEY_PATTERN),
+    fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
+    fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
+    {
+      id: "bearer",
+      replace(text) {
+        let count = 0;
+        const replaced = text.replace(BEARER_PATTERN, (_m, prefix) => {
+          count++;
+          return `${prefix}${markerFor("bearer")}`;
+        });
+        return { text: replaced, count };
+      }
+    }
+  ];
+  RULE_IDS = RULES.map((r2) => r2.id);
+});
+
+// ../../packages/core/dist/kernel/sanitize/safe-error-summary.js
+function safeErrorSummary(error) {
+  if (error instanceof Error) {
+    return {
+      name: error.name,
+      message: scrubCredentials(error.message).sanitized
+    };
+  }
+  return {
+    name: "UnknownError",
+    message: scrubCredentials(String(error)).sanitized
+  };
+}
+var init_safe_error_summary = __esm(() => {
+  init_credential_scrub();
+});
+
 // ../../packages/core/dist/kernel/alias-resolver.js
 class ProjectIdentityAliasResolver {
   ttlMs;
@@ -13612,9 +13712,7 @@ class ProjectIdentityAliasResolver {
       this.cache.set(projectId, { canonical, expiresAt: this.now() + this.ttlMs });
       return canonical;
     } catch (error) {
-      logger.warn("[project-identity] alias resolution failed; using original id (sanitized)", {
-        name: error instanceof Error ? error.name : "unknown"
-      });
+      logger.warn("[project-identity] alias resolution failed; using original id", safeErrorSummary(error));
       return projectId;
     }
   }
@@ -13671,10 +13769,11 @@ var DEFAULT_TTL_MS = 30000, DEFAULT_RESOLVE_TIMEOUT_MS = 250, sharedResolver = n
 var init_alias_resolver = __esm(() => {
   init_dist();
   init_db_connection();
+  init_safe_error_summary();
 });
 
 // ../../packages/core/dist/services/search/index-manager.js
-import fs7 from "fs";
+import fs8 from "fs";
 import path12 from "path";
 
 class IndexManager {
@@ -13770,7 +13869,7 @@ class IndexManager {
       for (const filePath of indexedFiles) {
         const fullPath = path12.join(projectPath, filePath);
         try {
-          const stat2 = await fs7.promises.stat(fullPath);
+          const stat2 = await fs8.promises.stat(fullPath);
           fileMetadata[filePath] = {
             path: filePath,
             mtime: stat2.mtimeMs,
@@ -13823,7 +13922,7 @@ class IndexManager {
         }
         const fullPath = path12.join(projectPath, match2);
         try {
-          const stat2 = await fs7.promises.stat(fullPath);
+          const stat2 = await fs8.promises.stat(fullPath);
           files.set(match2, {
             path: match2,
             mtime: stat2.mtimeMs,
@@ -35514,7 +35613,7 @@ var require_auth_config = __commonJS((exports, module) => {
     writeAuthConfig: () => writeAuthConfig
   });
   module.exports = __toCommonJS2(auth_config_exports);
-  var fs8 = __toESM2(__require("fs"));
+  var fs9 = __toESM2(__require("fs"));
   var path13 = __toESM2(__require("path"));
   var import_token_util = require_token_util();
   function getAuthConfigPath() {
@@ -35527,10 +35626,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function readAuthConfig() {
     try {
       const authPath = getAuthConfigPath();
-      if (!fs8.existsSync(authPath)) {
+      if (!fs9.existsSync(authPath)) {
         return null;
       }
-      const content = fs8.readFileSync(authPath, "utf8");
+      const content = fs9.readFileSync(authPath, "utf8");
       if (!content) {
         return null;
       }
@@ -35542,10 +35641,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function writeAuthConfig(config3) {
     const authPath = getAuthConfigPath();
     const authDir = path13.dirname(authPath);
-    if (!fs8.existsSync(authDir)) {
-      fs8.mkdirSync(authDir, { mode: 504, recursive: true });
+    if (!fs9.existsSync(authDir)) {
+      fs9.mkdirSync(authDir, { mode: 504, recursive: true });
     }
-    fs8.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
+    fs9.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
   }
   function isValidAccessToken(authConfig, expirationBufferMs = 0) {
     if (!authConfig.token)
@@ -35721,7 +35820,7 @@ var require_token_util = __commonJS((exports, module) => {
   });
   module.exports = __toCommonJS2(token_util_exports);
   var path13 = __toESM2(__require("path"));
-  var fs8 = __toESM2(__require("fs"));
+  var fs9 = __toESM2(__require("fs"));
   var import_token_error = require_token_error();
   var import_token_io = require_token_io();
   var import_auth_config = require_auth_config();
@@ -35802,10 +35901,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");
     }
     const prjPath = path13.join(dir, ".vercel", "project.json");
-    if (!fs8.existsSync(prjPath)) {
+    if (!fs9.existsSync(prjPath)) {
       throw new import_token_error.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");
     }
-    const prj = JSON.parse(fs8.readFileSync(prjPath, "utf8"));
+    const prj = JSON.parse(fs9.readFileSync(prjPath, "utf8"));
     if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
       throw new TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");
     }
@@ -35818,9 +35917,9 @@ var require_token_util = __commonJS((exports, module) => {
     }
     const tokenPath = path13.join(dir, "com.vercel.token", `${projectId}.json`);
     const tokenJson = JSON.stringify(token);
-    fs8.mkdirSync(path13.dirname(tokenPath), { mode: 504, recursive: true });
-    fs8.writeFileSync(tokenPath, tokenJson);
-    fs8.chmodSync(tokenPath, 432);
+    fs9.mkdirSync(path13.dirname(tokenPath), { mode: 504, recursive: true });
+    fs9.writeFileSync(tokenPath, tokenJson);
+    fs9.chmodSync(tokenPath, 432);
     return;
   }
   function loadToken(projectId) {
@@ -35829,10 +35928,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");
     }
     const tokenPath = path13.join(dir, "com.vercel.token", `${projectId}.json`);
-    if (!fs8.existsSync(tokenPath)) {
+    if (!fs9.existsSync(tokenPath)) {
       return null;
     }
-    const token = JSON.parse(fs8.readFileSync(tokenPath, "utf8"));
+    const token = JSON.parse(fs9.readFileSync(tokenPath, "utf8"));
     assertVercelOidcTokenResponse(token);
     return token;
   }
@@ -63262,26 +63361,26 @@ var require_process = __commonJS((exports, module) => {
 
 // ../../node_modules/detect-libc/lib/filesystem.js
 var require_filesystem = __commonJS((exports, module) => {
-  var fs8 = __require("fs");
+  var fs9 = __require("fs");
   var LDD_PATH = "/usr/bin/ldd";
   var SELF_PATH = "/proc/self/exe";
   var MAX_LENGTH = 2048;
   var readFileSync2 = (path13) => {
-    const fd = fs8.openSync(path13, "r");
+    const fd = fs9.openSync(path13, "r");
     const buffer = Buffer.alloc(MAX_LENGTH);
-    const bytesRead = fs8.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-    fs8.close(fd, () => {});
+    const bytesRead = fs9.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+    fs9.close(fd, () => {});
     return buffer.subarray(0, bytesRead);
   };
   var readFile = (path13) => new Promise((resolve4, reject) => {
-    fs8.open(path13, "r", (err, fd) => {
+    fs9.open(path13, "r", (err, fd) => {
       if (err) {
         reject(err);
       } else {
         const buffer = Buffer.alloc(MAX_LENGTH);
-        fs8.read(fd, buffer, 0, MAX_LENGTH, 0, (_2, bytesRead) => {
+        fs9.read(fd, buffer, 0, MAX_LENGTH, 0, (_2, bytesRead) => {
           resolve4(buffer.subarray(0, bytesRead));
-          fs8.close(fd, () => {});
+          fs9.close(fd, () => {});
         });
       }
     });
@@ -99944,10 +100043,10 @@ Note that ${s.bold("include")} statements only accept relation fields.`, a12;
       super(t2, "P2023", r2);
     }
   };
-  var fs8 = new WeakMap;
+  var fs9 = new WeakMap;
   function Ep(e) {
-    let t2 = fs8.get(e);
-    return t2 || (t2 = Object.entries(e), fs8.set(e, t2)), t2;
+    let t2 = fs9.get(e);
+    return t2 || (t2 = Object.entries(e), fs9.set(e, t2)), t2;
   }
   function hs(e, t2, r2) {
     switch (t2.type) {
@@ -107114,6 +107213,7 @@ var init_registry = __esm(() => {
     search_analytics: { storeId: "search_analytics", identityColumn: "project_id", mutable: true },
     search_events: { storeId: "search_events", identityColumn: "project_id", mutable: true },
     synapse_sessions: { storeId: "synapse_sessions", identityColumn: "workspace_id", mutable: true },
+    managed_runs: { storeId: "managed_runs", identityColumn: "project_id", mutable: true },
     operation_log: { storeId: "operation_log", identityColumn: "project_id", mutable: false },
     project_identity_operations: {
       storeId: "project_identity_operations",
@@ -113391,6 +113491,89 @@ var init_reranker = __esm(() => {
   });
 });
 
+// ../../packages/core/dist/kernel/search-diagnostics.js
+function searchBackendUnavailable(component, cause) {
+  return cause instanceof SearchServiceError ? cause : new SearchServiceError("SEARCH_BACKEND_UNAVAILABLE", component, { cause });
+}
+function storeCorruption(component, cause) {
+  return cause instanceof SearchServiceError ? cause : new SearchServiceError("STORE_CORRUPTION", component, {
+    cause,
+    statusCode: 500
+  });
+}
+function projectNotIndexed(projectId, message) {
+  return new SearchServiceError("PROJECT_NOT_INDEXED", projectId, {
+    message,
+    statusCode: 404
+  });
+}
+function recordSearchDegradation(code, component, projectId) {
+  const degradation = {
+    code,
+    component,
+    message: DEGRADATION_MESSAGES[code]
+  };
+  diagnostics.push({
+    kind: "degradation",
+    ...degradation,
+    projectId,
+    timestamp: new Date().toISOString()
+  });
+  if (diagnostics.length > MAX_DIAGNOSTICS) {
+    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
+  }
+  return degradation;
+}
+function recordSearchFailure(error51, projectId) {
+  if (recordedFailures.has(error51))
+    return;
+  recordedFailures.add(error51);
+  diagnostics.push({
+    kind: "failure",
+    code: error51.code,
+    component: error51.component,
+    message: error51.message,
+    projectId,
+    timestamp: new Date().toISOString()
+  });
+  if (diagnostics.length > MAX_DIAGNOSTICS) {
+    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
+  }
+}
+function getSearchDiagnostics() {
+  return diagnostics.map((diagnostic) => ({ ...diagnostic }));
+}
+function resetSearchDiagnosticsForTests() {
+  diagnostics.length = 0;
+}
+var MAX_DIAGNOSTICS = 100, diagnostics, recordedFailures, DEGRADATION_MESSAGES, SearchServiceError;
+var init_search_diagnostics = __esm(() => {
+  diagnostics = [];
+  recordedFailures = new WeakSet;
+  DEGRADATION_MESSAGES = {
+    QUERY_UNDERSTANDING_UNAVAILABLE: "Query understanding was unavailable; original query used",
+    TRIGRAM_UNAVAILABLE: "Trigram enrichment was unavailable",
+    FUZZY_SEARCH_UNAVAILABLE: "Fuzzy enrichment was unavailable",
+    PROXIMITY_RERANK_UNAVAILABLE: "Proximity reranking was unavailable; fused order preserved",
+    GRAPH_AUGMENTATION_UNAVAILABLE: "Graph augmentation was unavailable",
+    SYNAPSE_UNAVAILABLE: "Synapse enrichment was unavailable; stateless results used",
+    SEARCH_AUDIT_UNAVAILABLE: "Search event auditing was unavailable",
+    SEARCH_ANALYTICS_UNAVAILABLE: "Search analytics were unavailable"
+  };
+  SearchServiceError = class SearchServiceError extends Error {
+    code;
+    component;
+    statusCode;
+    constructor(code, component, options) {
+      super(options?.message ?? (code === "STORE_CORRUPTION" ? "Stored data is invalid" : "A required search backend is unavailable"), options?.cause === undefined ? undefined : { cause: options.cause });
+      this.code = code;
+      this.component = component;
+      this.name = "SearchServiceError";
+      this.statusCode = options?.statusCode ?? 503;
+    }
+  };
+});
+
 // ../../packages/core/dist/kernel/enum-validation.js
 function validateEnum(paramName, value, validValues) {
   if (typeof value !== "string" || !validValues.includes(value)) {
@@ -113499,7 +113682,7 @@ class SearchController {
     });
     const admission = await this.contextualSearch.checkSearchAdmission(projectId, projectPath);
     if (!admission.admitted) {
-      throw new Error(admission.error ?? `Project '${projectId}' is not indexed`);
+      throw projectNotIndexed(projectId, admission.error ?? `Project '${projectId}' is not indexed`);
     }
     const staleWarning = admission.stale ?? null;
     let reindexInfo = null;
@@ -113723,6 +113906,7 @@ var init_search_controller = __esm(() => {
   init_contextual_search_rlm();
   init_event_bus();
   init_reranker();
+  init_search_diagnostics();
   init_esm();
   init_filter_validation();
 });
@@ -114208,83 +114392,6 @@ var init_session_bias = __esm(() => {
   init_synapse();
 });
 
-// ../../packages/core/dist/kernel/search-diagnostics.js
-function searchBackendUnavailable(component, cause) {
-  return cause instanceof SearchServiceError ? cause : new SearchServiceError("SEARCH_BACKEND_UNAVAILABLE", component, { cause });
-}
-function storeCorruption(component, cause) {
-  return cause instanceof SearchServiceError ? cause : new SearchServiceError("STORE_CORRUPTION", component, {
-    cause,
-    statusCode: 500
-  });
-}
-function recordSearchDegradation(code, component, projectId) {
-  const degradation = {
-    code,
-    component,
-    message: DEGRADATION_MESSAGES[code]
-  };
-  diagnostics.push({
-    kind: "degradation",
-    ...degradation,
-    projectId,
-    timestamp: new Date().toISOString()
-  });
-  if (diagnostics.length > MAX_DIAGNOSTICS) {
-    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
-  }
-  return degradation;
-}
-function recordSearchFailure(error51, projectId) {
-  if (recordedFailures.has(error51))
-    return;
-  recordedFailures.add(error51);
-  diagnostics.push({
-    kind: "failure",
-    code: error51.code,
-    component: error51.component,
-    message: error51.message,
-    projectId,
-    timestamp: new Date().toISOString()
-  });
-  if (diagnostics.length > MAX_DIAGNOSTICS) {
-    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
-  }
-}
-function getSearchDiagnostics() {
-  return diagnostics.map((diagnostic) => ({ ...diagnostic }));
-}
-function resetSearchDiagnosticsForTests() {
-  diagnostics.length = 0;
-}
-var MAX_DIAGNOSTICS = 100, diagnostics, recordedFailures, DEGRADATION_MESSAGES, SearchServiceError;
-var init_search_diagnostics = __esm(() => {
-  diagnostics = [];
-  recordedFailures = new WeakSet;
-  DEGRADATION_MESSAGES = {
-    QUERY_UNDERSTANDING_UNAVAILABLE: "Query understanding was unavailable; original query used",
-    TRIGRAM_UNAVAILABLE: "Trigram enrichment was unavailable",
-    FUZZY_SEARCH_UNAVAILABLE: "Fuzzy enrichment was unavailable",
-    PROXIMITY_RERANK_UNAVAILABLE: "Proximity reranking was unavailable; fused order preserved",
-    GRAPH_AUGMENTATION_UNAVAILABLE: "Graph augmentation was unavailable",
-    SYNAPSE_UNAVAILABLE: "Synapse enrichment was unavailable; stateless results used",
-    SEARCH_AUDIT_UNAVAILABLE: "Search event auditing was unavailable",
-    SEARCH_ANALYTICS_UNAVAILABLE: "Search analytics were unavailable"
-  };
-  SearchServiceError = class SearchServiceError extends Error {
-    code;
-    component;
-    statusCode;
-    constructor(code, component, options) {
-      super(code === "STORE_CORRUPTION" ? "Stored data is invalid" : "A required search backend is unavailable", options?.cause === undefined ? undefined : { cause: options.cause });
-      this.code = code;
-      this.component = component;
-      this.name = "SearchServiceError";
-      this.statusCode = options?.statusCode ?? 503;
-    }
-  };
-});
-
 // ../../packages/core/dist/services/search/hybrid-search.js
 async function search(deps, query, projectId, options = {}) {
   const maxResults = options.maxResults ?? 10;
@@ -115641,7 +115748,7 @@ var init_managed_run_repository_pg = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/project-indexer.js
-import fs8 from "fs/promises";
+import fs9 from "fs/promises";
 import path14 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function runWithIndexLock(lockMap, projectId, work) {
@@ -115901,7 +116008,7 @@ async function checkSearchAdmission(deps, projectId, projectPath) {
 }
 async function indexFile(deps, filePath, projectId, projectRoot, centralityMap) {
   projectId = await getProjectIdentityAliasResolver().resolve(projectId);
-  const content = await fs8.readFile(filePath, "utf-8");
+  const content = await fs9.readFile(filePath, "utf-8");
   const relativePath = path14.relative(projectRoot, filePath);
   const maxFileSize = config.get("security").maxFileSize || 1024 * 1024;
   if (content.length > maxFileSize) {
@@ -116767,7 +116874,7 @@ function stripNul(content) {
 }
 
 // ../../packages/core/dist/services/etl/stages/discover.js
-import fs9 from "fs/promises";
+import fs10 from "fs/promises";
 import path15 from "path";
 import { createHash as createHash5 } from "crypto";
 
@@ -116855,8 +116962,8 @@ class DiscoverStage {
   async processFile(ctx, relativePath, forceReindex) {
     const absolutePath = path15.join(ctx.projectPath, relativePath);
     try {
-      const stat2 = await fs9.stat(absolutePath);
-      const content = stripNul(await fs9.readFile(absolutePath, "utf-8"));
+      const stat2 = await fs10.stat(absolutePath);
+      const content = stripNul(await fs10.readFile(absolutePath, "utf-8"));
       const contentHash = createHash5("sha256").update(content).digest("hex");
       let needsReparse = forceReindex;
       if (!forceReindex) {
@@ -116900,7 +117007,7 @@ class DiscoverStage {
     }
     try {
       const gitignorePath = path15.join(projectPath, ".gitignore");
-      const gitignoreContent = await fs9.readFile(gitignorePath, "utf8");
+      const gitignoreContent = await fs10.readFile(gitignorePath, "utf8");
       const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
       ig.add(rules);
@@ -119229,7 +119336,7 @@ var init_structural_runtime = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/parse.js
 import path16 from "path";
-import fs10 from "fs/promises";
+import fs11 from "fs/promises";
 function resolveChunkerMaxChars() {
   const global2 = Number(process.env.EMBEDDING_MAX_CHARS);
   if (Number.isFinite(global2) && global2 > 0)
@@ -119321,7 +119428,7 @@ class ParseStage {
     if (!file3.needsReparse) {
       const extension = path16.extname(file3.relativePath).toLowerCase();
       if ([".c", ".cpp", ".hpp"].includes(extension)) {
-        const content = file3.snapshotContent ?? await fs10.readFile(file3.absolutePath, "utf8");
+        const content = file3.snapshotContent ?? await fs11.readFile(file3.absolutePath, "utf8");
         const outcome = await this.runtime.parse({ extension, source: Buffer.from(content) });
         if (outcome.status === "failed")
           throw new StructuralEtlParseError(file3.relativePath, outcome.failureKind, `Structural evidence parse failed (${outcome.failureKind})`, outcome.diagnosticCount, outcome.diagnostics.slice(0, 10));
@@ -119333,7 +119440,7 @@ class ParseStage {
       return { file: file3, chunks: [], symbols: [], rawImports: [], rawEdges: [] };
     }
     try {
-      const content = file3.snapshotContent ?? await fs10.readFile(file3.absolutePath, "utf-8");
+      const content = file3.snapshotContent ?? await fs11.readFile(file3.absolutePath, "utf-8");
       const ext2 = path16.extname(file3.relativePath).toLowerCase();
       const chunkerMaxChars = resolveChunkerMaxChars();
       const chunks = smartChunk(content, file3.relativePath, chunkerMaxChars ? { maxChunkChars: chunkerMaxChars } : {});
@@ -120374,7 +120481,7 @@ var init_data_document2 = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/resolve.js
 import path19 from "path";
-import fs11 from "fs";
+import fs12 from "fs";
 
 class ResolveStage {
   symbolRepository;
@@ -120691,7 +120798,7 @@ class ResolveStage {
     const aliases = [];
     const tsconfigPath = path19.join(projectPath, "tsconfig.json");
     try {
-      const raw2 = fs11.readFileSync(tsconfigPath, "utf-8");
+      const raw2 = fs12.readFileSync(tsconfigPath, "utf-8");
       const stripped = raw2.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
       const tsconfig = JSON.parse(stripped);
       const paths = tsconfig?.compilerOptions?.paths ?? {};
@@ -122987,7 +123094,7 @@ __export(exports_symbol_graph_service, {
   SymbolGraphService: () => SymbolGraphService
 });
 import path23 from "path";
-import fs12 from "fs/promises";
+import fs13 from "fs/promises";
 
 class SymbolGraphService {
   identityLookup;
@@ -123315,7 +123422,7 @@ class SymbolGraphService {
   async readSnippet(relativePath, lineStart, lineEnd, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs12.readFile(absolutePath, "utf-8");
+      const content = await fs13.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       return lines.slice(Math.max(0, lineStart - 1), Math.min(lines.length, lineEnd)).join(`
@@ -123327,7 +123434,7 @@ class SymbolGraphService {
   async readContext(relativePath, lineNumber, contextLines, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs12.readFile(absolutePath, "utf-8");
+      const content = await fs13.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       const start = Math.max(0, lineNumber - contextLines - 1);
@@ -126372,6 +126479,10 @@ var init_checkpoint_store_pg = __esm(() => {
 });
 
 // ../../packages/core/dist/services/checkpoint/checkpoint-manager.js
+var exports_checkpoint_manager = {};
+__export(exports_checkpoint_manager, {
+  CheckpointManager: () => CheckpointManager
+});
 var CheckpointManager;
 var init_checkpoint_manager = __esm(() => {
   init_config();
@@ -130496,7 +130607,7 @@ var init_l1_memory_cache = __esm(() => {
 });
 
 // ../../packages/core/dist/services/health/local-health-checker.js
-import fs15 from "fs/promises";
+import fs16 from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path28 from "path";
 
@@ -130532,10 +130643,10 @@ class LocalHealthChecker {
     const start = Date.now();
     try {
       if (!existsSync3(this.dataDir))
-        await fs15.mkdir(this.dataDir, { recursive: true });
+        await fs16.mkdir(this.dataDir, { recursive: true });
       const probe2 = path28.join(this.dataDir, ".health-check-test");
-      await fs15.writeFile(probe2, "ok");
-      await fs15.unlink(probe2);
+      await fs16.writeFile(probe2, "ok");
+      await fs16.unlink(probe2);
       return { available: true, latency: Date.now() - start, details: { path: this.dataDir, writable: true } };
     } catch (error51) {
       return { available: false, latency: Date.now() - start, error: `Data directory error: ${error51.message}` };
@@ -132370,6 +132481,11 @@ function registerDefaultJobs(scheduler) {
     const projectId = job.payload?.projectId ?? "default";
     await observationConsolidationJob2.runOnce(projectId);
   });
+  scheduler.registerHandler("checkpoint-purge", async () => {
+    const { CheckpointManager: CheckpointManager2 } = await Promise.resolve().then(() => (init_checkpoint_manager(), exports_checkpoint_manager));
+    const count = CheckpointManager2.getInstance().purgeExpired();
+    logger.info("Scheduled checkpoint purge completed", { count });
+  });
   for (const rawDef of DEFAULT_SCHEDULED_JOBS) {
     const def = applySafeDefaults(rawDef);
     const enabled2 = envBool2(def.enableEnvVar, def.defaultEnabled);
@@ -132431,6 +132547,15 @@ var init_scheduler_defaults = __esm(() => {
       defaultEnabled: false,
       enableEnvVar: "MASSA_AI_SCHEDULER_OBSERVATION_BRIDGE_ENABLED",
       intervalEnvVar: "MASSA_AI_SCHEDULER_OBSERVATION_BRIDGE_INTERVAL_MS"
+    },
+    {
+      id: "scheduled-checkpoint-purge",
+      name: "Checkpoint Purge (clock)",
+      jobKind: "checkpoint-purge",
+      schedule: { type: "interval", intervalMs: ONE_HOUR },
+      defaultEnabled: false,
+      enableEnvVar: "MASSA_AI_SCHEDULER_CHECKPOINT_PURGE_ENABLED",
+      intervalEnvVar: "MASSA_AI_SCHEDULER_CHECKPOINT_PURGE_INTERVAL_MS"
     }
   ];
 });
@@ -132445,7 +132570,7 @@ var init_scheduler2 = __esm(() => {
 });
 
 // ../../packages/core/dist/services/pricing/models-dev-client.js
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path29 from "path";
 function getModelsDevClient() {
@@ -132475,7 +132600,7 @@ var init_models_dev_client = __esm(() => {
         if (!existsSync4(cachePath)) {
           return null;
         }
-        const content = await fs16.readFile(cachePath, "utf-8");
+        const content = await fs17.readFile(cachePath, "utf-8");
         const data = JSON.parse(content);
         const age = Date.now() - data.timestamp;
         if (age > ModelsDevClient.LOCAL_CACHE_TTL) {
@@ -132503,13 +132628,13 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         const dir = path29.dirname(cachePath);
-        await fs16.mkdir(dir, { recursive: true });
+        await fs17.mkdir(dir, { recursive: true });
         const data = {
           timestamp: Date.now(),
           version: "1.0.0",
           models: Object.fromEntries(models)
         };
-        await fs16.writeFile(cachePath, JSON.stringify(data), "utf-8");
+        await fs17.writeFile(cachePath, JSON.stringify(data), "utf-8");
         logger.debug("Saved pricing to local cache", {
           models: models.size,
           path: cachePath
@@ -132838,7 +132963,7 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         if (existsSync4(cachePath)) {
-          await fs16.unlink(cachePath);
+          await fs17.unlink(cachePath);
           logger.debug("Local pricing cache file deleted");
         }
       } catch (error51) {
@@ -150856,6 +150981,7 @@ __export(exports_services, {
   selectCompressionCandidates: () => selectCompressionCandidates,
   searchSessionHook: () => searchSessionHook,
   searchBackendUnavailable: () => searchBackendUnavailable,
+  safeErrorSummary: () => safeErrorSummary,
   runPool: () => runPool,
   resolveStructuralParseLanguage: () => resolveStructuralParseLanguage,
   resetSynapseManager: () => resetSynapseManager,
@@ -150870,6 +150996,7 @@ __export(exports_services, {
   recordSearchFailure: () => recordSearchFailure,
   recordSearchDegradation: () => recordSearchDegradation,
   quoteDiscoveredIdentifier: () => quoteDiscoveredIdentifier,
+  projectNotIndexed: () => projectNotIndexed,
   payloadStorePolicies: () => payloadStorePolicies,
   parseStructuralFqn: () => parseStructuralFqn,
   parseProjectIdentityPreviewRequest: () => parseProjectIdentityPreviewRequest,
@@ -151087,6 +151214,7 @@ var init_services = __esm(() => {
   init_search_analytics_pg();
   init_index_manager();
   init_search_diagnostics();
+  init_safe_error_summary();
   init_memory_controller();
   init_llm_client();
   init_search_controller();
@@ -175534,7 +175662,8 @@ init_compaction_snapshot_service();
 init_dist();
 init_db_connection();
 init_alias_resolver();
-import fs13 from "fs";
+init_safe_error_summary();
+import fs14 from "fs";
 import os6 from "os";
 import path25 from "path";
 
@@ -175611,9 +175740,7 @@ class PgWorkspaceRootProvider {
       this.cache = { roots, expiresAt: this.now() + PROVIDER_TTL_MS };
       return roots;
     } catch (error51) {
-      logger.warn("[hook-attribution] workspace roots lookup failed; containment disabled (sanitized)", {
-        name: error51 instanceof Error ? error51.name : "unknown"
-      });
+      logger.warn("[hook-attribution] workspace roots lookup failed; containment disabled", safeErrorSummary(error51));
       return [];
     } finally {
       if (timer)
@@ -175722,7 +175849,7 @@ class AttributionResolver {
 }
 function defaultCanonicalize(cwd) {
   try {
-    return fs13.realpathSync(cwd);
+    return fs14.realpathSync(cwd);
   } catch {
     try {
       return path25.resolve(cwd);
@@ -175738,70 +175865,9 @@ function getAttributionResolver() {
   return sharedResolver2;
 }
 
-// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
-function markerFor(id) {
-  return `[REDACTED:${id}]`;
-}
-function fullMatchRule(id, pattern) {
-  const marker26 = markerFor(id);
-  return {
-    id,
-    replace(text3) {
-      let count = 0;
-      const replaced = text3.replace(pattern, () => {
-        count++;
-        return marker26;
-      });
-      return { text: replaced, count };
-    }
-  };
-}
-var PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
-var JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
-var AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
-var SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
-var GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
-var SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
-var BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
-var RULES = [
-  fullMatchRule("pem", PEM_PATTERN),
-  fullMatchRule("jwt", JWT_PATTERN),
-  fullMatchRule("aws-key", AWS_KEY_PATTERN),
-  fullMatchRule("sk-key", SK_KEY_PATTERN),
-  fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
-  fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
-  {
-    id: "bearer",
-    replace(text3) {
-      let count = 0;
-      const replaced = text3.replace(BEARER_PATTERN, (_m, prefix) => {
-        count++;
-        return `${prefix}${markerFor("bearer")}`;
-      });
-      return { text: replaced, count };
-    }
-  }
-];
-var RULE_IDS = RULES.map((r2) => r2.id);
-function scrubCredentials(payloadJson) {
-  const redactions = {};
-  for (const id of RULE_IDS)
-    redactions[id] = 0;
-  let text3 = payloadJson;
-  for (const rule of RULES) {
-    const { text: next, count } = rule.replace(text3);
-    text3 = next;
-    redactions[rule.id] += count;
-  }
-  const total = Object.values(redactions).reduce((sum, n2) => sum + n2, 0);
-  return {
-    sanitized: text3,
-    redactions,
-    total
-  };
-}
-
 // ../../packages/core/dist/tools/compact_snapshot.js
+init_credential_scrub();
+
 class CompactSnapshotTool {
   name = "compact_snapshot";
   storeOverride;
@@ -176323,7 +176389,7 @@ init_code_compressor();
 
 // ../../packages/core/dist/services/file-read/file-content-cache.js
 init_dist();
-import fs14 from "fs/promises";
+import fs15 from "fs/promises";
 
 class FileContentCache {
   extractMetadata;
@@ -176356,7 +176422,7 @@ class FileContentCache {
         metadata: cached2.metadata
       };
     }
-    const content = await fs14.readFile(filePath, "utf-8");
+    const content = await fs15.readFile(filePath, "utf-8");
     const metadata = await this.extractMetadata(content, filePath, options);
     evictOldest(this.fileCache, this.FILE_CACHE_MAX_ENTRIES - 1);
     this.fileCache.set(cacheKey, {
@@ -177191,6 +177257,8 @@ class WriterQueue {
 // ../../packages/core/dist/services/hooks/hook-service.js
 init_observation_extractor();
 init_observation_consolidation_job();
+init_credential_scrub();
+
 class NoopBridge {
   maybeRun() {}
 }
@@ -177395,7 +177463,7 @@ init_event_bus();
 init_llm_client();
 init_symbol_graph_service();
 import { randomUUID as randomUUID9 } from "crypto";
-import fs17 from "fs";
+import fs18 from "fs";
 import path30 from "path";
 import { spawn as spawn2 } from "child_process";
 var FALLBACK_BOOTSTRAP = {
@@ -177581,8 +177649,8 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   try {
     for (const name26 of README_CANDIDATES) {
       const p = path30.join(projectRoot, name26);
-      if (fs17.existsSync(p) && fs17.statSync(p).isFile()) {
-        const buf = fs17.readFileSync(p);
+      if (fs18.existsSync(p) && fs18.statSync(p).isFile()) {
+        const buf = fs18.readFileSync(p);
         signals.readme = buf.slice(0, MAX_README_BYTES).toString("utf8");
         break;
       }
@@ -177592,11 +177660,11 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   }
   try {
     const docsDir = path30.join(projectRoot, "docs");
-    if (fs17.existsSync(docsDir) && fs17.statSync(docsDir).isDirectory()) {
+    if (fs18.existsSync(docsDir) && fs18.statSync(docsDir).isDirectory()) {
       const entries = walkMarkdown(docsDir).slice(0, MAX_DOCS);
       for (const rel of entries) {
         try {
-          const buf = fs17.readFileSync(rel);
+          const buf = fs18.readFileSync(rel);
           signals.docs.push({
             path: path30.relative(projectRoot, rel),
             snippet: buf.slice(0, MAX_DOC_BYTES).toString("utf8")
@@ -177610,9 +177678,9 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   try {
     for (const name26 of MANIFEST_FILES) {
       const p = path30.join(projectRoot, name26);
-      if (!fs17.existsSync(p) || !fs17.statSync(p).isFile())
+      if (!fs18.existsSync(p) || !fs18.statSync(p).isFile())
         continue;
-      const raw2 = fs17.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
+      const raw2 = fs18.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
       const kind = name26;
       if (name26 === "package.json") {
         try {
@@ -177652,7 +177720,7 @@ function walkMarkdown(dir) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs17.readdirSync(cur, { withFileTypes: true });
+      entries = fs18.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -178690,7 +178758,7 @@ var checkpointRoutes = new Elysia({ prefix: "/api/v1/checkpoints" }).post("/list
 
 // src/routes/project.ts
 init_dist();
-import fs18 from "fs/promises";
+import fs19 from "fs/promises";
 import path31 from "path";
 var indexProjectTool = null;
 var indexStatusTool = null;
@@ -178902,8 +178970,8 @@ var projectRoutes = new Elysia({ prefix: "/api/v1/project" }).get("/list", async
   const finalProjectId = rawBase.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 128);
   const uploadRoot = process.env.MASSA_AI_UPLOAD_DIR || path31.join(getGlobalDataDir(), "uploads");
   const stagingDir = path31.resolve(uploadRoot, finalProjectId);
-  await fs18.rm(stagingDir, { recursive: true, force: true });
-  await fs18.mkdir(stagingDir, { recursive: true });
+  await fs19.rm(stagingDir, { recursive: true, force: true });
+  await fs19.mkdir(stagingDir, { recursive: true });
   const WRITE_BATCH = 20;
   for (let i = 0;i < body.files.length; i += WRITE_BATCH) {
     await Promise.all(body.files.slice(i, i + WRITE_BATCH).map(async (file3) => {
@@ -178914,8 +178982,8 @@ var projectRoutes = new Elysia({ prefix: "/api/v1/project" }).get("/list", async
       if (!dest.startsWith(stagingDir + path31.sep)) {
         throw new Error(`Path escapes staging directory: ${file3.relativePath}`);
       }
-      await fs18.mkdir(path31.dirname(dest), { recursive: true });
-      await fs18.writeFile(dest, file3.content, "utf-8");
+      await fs19.mkdir(path31.dirname(dest), { recursive: true });
+      await fs19.writeFile(dest, file3.content, "utf-8");
     }));
   }
   return await getIndexProjectTool().handle({
@@ -179070,7 +179138,7 @@ var analyticsRoutes = new Elysia({ prefix: "/api/v1/analytics" }).post("/", asyn
 // src/routes/system.ts
 init_dist();
 import path32 from "path";
-import fs19 from "fs";
+import fs20 from "fs";
 import os7 from "os";
 function databaseUrlParts() {
   const url2 = new URL(process.env.DATABASE_URL);
@@ -179146,9 +179214,9 @@ var systemRoutes = new Elysia({ prefix: "/api/v1/system" }).get("/info", async (
 }).get("/metrics", async () => {
   const metricsPath = path32.join(process.cwd(), "data", "metrics.json");
   let metrics2 = {};
-  if (fs19.existsSync(metricsPath)) {
+  if (fs20.existsSync(metricsPath)) {
     try {
-      metrics2 = JSON.parse(fs19.readFileSync(metricsPath, "utf-8"));
+      metrics2 = JSON.parse(fs20.readFileSync(metricsPath, "utf-8"));
     } catch {}
   }
   const database = await getDatabaseInfo();
@@ -179298,7 +179366,7 @@ var eventsRoutes = new Elysia({ prefix: "/api/v1" }).get("/events", async ({ que
 });
 
 // src/routes/workspace.ts
-import fs20 from "fs/promises";
+import fs21 from "fs/promises";
 import path33 from "path";
 import { realpathSync as realpathSync4 } from "fs";
 var indexProjectTool2 = null;
@@ -179824,7 +179892,7 @@ var workspaceRoutes = new Elysia({ prefix: "/api/v1" }).get("/workspace/list", a
       end = start + 20;
     }
     const absolutePath = path33.join(workspace.project_path, file3);
-    const content = await fs20.readFile(absolutePath, "utf-8");
+    const content = await fs21.readFile(absolutePath, "utf-8");
     const lines = content.split(/\r?\n/);
     const slice = lines.slice(start - 1, Math.min(lines.length, end));
     const formatted = slice.map((text3, idx) => ({
@@ -179862,8 +179930,18 @@ function getReadFileTool() {
   }
   return readFileTool;
 }
-var fileRoutes = new Elysia({ prefix: "/api/v1/file" }).post("/read", async ({ body }) => {
-  return await getReadFileTool().handle(body);
+function classifyReadFileFailureStatus(message) {
+  if (message && /ENOENT|no such file/i.test(message)) {
+    return 404;
+  }
+  return 400;
+}
+var fileRoutes = new Elysia({ prefix: "/api/v1/file" }).post("/read", async ({ body, set: set3 }) => {
+  const result = await getReadFileTool().handle(body);
+  if (result.success === false) {
+    set3.status = classifyReadFileFailureStatus(result.error);
+  }
+  return result;
 }, {
   body: t.Object({
     filePath: t.String({
@@ -180739,7 +180817,7 @@ var webRoutes = new Elysia({ prefix: "/api/v1/web" }).post("/fetch_and_index", a
 });
 
 // src/routes/web-ui.ts
-import fs21 from "fs/promises";
+import fs22 from "fs/promises";
 import path34 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -180798,7 +180876,7 @@ var STATIC_DIR_CANDIDATES = buildStaticDirCandidates(path34.dirname(fileURLToPat
 async function resolveStaticDir() {
   for (const dir of STATIC_DIR_CANDIDATES) {
     try {
-      const st = await fs21.stat(dir);
+      const st = await fs22.stat(dir);
       if (st.isDirectory())
         return dir;
     } catch {}
@@ -180836,7 +180914,7 @@ async function resolveSafePath(staticDir, sub) {
     return null;
   }
   try {
-    await fs21.stat(abs);
+    await fs22.stat(abs);
     return { abs, exists: true };
   } catch {
     return { abs, exists: false };
@@ -180859,7 +180937,7 @@ function injectAccessMarkup(html, apiKey, trusted) {
   return out;
 }
 async function readShell(indexPath, remoteAddress) {
-  const raw2 = await fs21.readFile(indexPath, "utf-8");
+  const raw2 = await fs22.readFile(indexPath, "utf-8");
   const trusted = isTrustedWebUiCaller(remoteAddress);
   return Buffer.from(injectAccessMarkup(raw2, getConfiguredApiKey(), trusted), "utf-8");
 }
@@ -180909,7 +180987,7 @@ var webUiRoutes = new Elysia().get("/ui", async ({ set: set3, request }) => {
   }
   if (resolved.exists) {
     try {
-      const body = await fs21.readFile(resolved.abs);
+      const body = await fs22.readFile(resolved.abs);
       set3.headers["content-type"] = contentTypeFor(resolved.abs);
       return body;
     } catch {
@@ -181145,10 +181223,13 @@ var profileRoutes = new Elysia({ prefix: "/api/v1/profiles" }).get("/", ({ query
 });
 
 // src/middleware/error.ts
-var errorHandler = new Elysia({ name: "error-handler" }).onError(({ code, error: error51, set: set3 }) => {
-  console.error("[massa-ai-api] Request failed", {
-    name: error51 instanceof Error ? error51.name : "UnknownError",
-    code
+init_dist();
+var errorHandler = new Elysia({ name: "error-handler" }).onError(({ code, error: error51, set: set3, path: path35, request }) => {
+  logger.error("[massa-ai-api] Request failed", undefined, {
+    ...safeErrorSummary(error51),
+    code,
+    path: path35,
+    method: request.method
   });
   if (error51 instanceof SearchServiceError) {
     set3.status = error51.statusCode;
@@ -181171,6 +181252,16 @@ var errorHandler = new Elysia({ name: "error-handler" }).onError(({ code, error:
       }
     };
   }
+  if (code === "NOT_FOUND") {
+    set3.status = 404;
+    return {
+      success: false,
+      error: {
+        code: "NOT_FOUND",
+        message: "Route not found"
+      }
+    };
+  }
   if (!set3.status || set3.status === 200) {
     set3.status = 500;
   }