@miphamai/cli 0.12.0 → 0.14.0

package/src/core/credential-masker.ts

@@ -0,0 +1,203 @@
+import { relative, isAbsolute } from 'node:path'
+import { homedir } from 'node:os'
+import type { CredentialMaskingConfig, CredentialFileRule } from '../shared/index.ts'
+
+/** Sentinel value used to replace masked credentials. */
+export const CREDENTIAL_SENTINEL = '__MIPHAM_CREDENTIAL_MASKED__'
+
+/**
+ * Check if a file path matches any credential file rule.
+ * Returns the matching rule, or null if no match.
+ */
+export function matchCredentialFile(
+  filePath: string,
+  config: CredentialMaskingConfig,
+): CredentialFileRule | null {
+  if (!config.enabled || config.files.length === 0) return null
+
+  const expanded = expandHome(filePath)
+  for (const rule of config.files) {
+    if (matchPath(expanded, rule.path)) {
+      return rule
+    }
+  }
+  return null
+}
+
+/**
+ * Apply credential masking to file content.
+ * - 'full' mode: return sentinel value only
+ * - 'extract' mode: replace regex-matched tokens with sentinel
+ */
+export function maskContent(content: string, rule: CredentialFileRule): string {
+  if (rule.mode === 'full') {
+    return CREDENTIAL_SENTINEL
+  }
+
+  // extract mode
+  let masked = content
+  for (const extractRule of rule.extract) {
+    const replacement = extractRule.replacement || CREDENTIAL_SENTINEL
+    try {
+      const regex = new RegExp(extractRule.pattern, 'gm')
+      masked = masked.replace(regex, replacement)
+    } catch {
+      // Invalid regex — skip this rule silently
+    }
+  }
+  return masked
+}
+
+/**
+ * Scrub credential patterns from stdout/stderr output.
+ * Uses the configured output_scrubbing patterns to detect and replace
+ * credentials that may have leaked into command output.
+ */
+export function maskOutput(output: string, config: CredentialMaskingConfig): string {
+  if (!config.enabled || !config.output_scrubbing.enabled) return output
+
+  let masked = output
+  for (const pattern of config.output_scrubbing.patterns) {
+    try {
+      // Strip (?i) inline flags — JS uses the 'i' flag instead
+      const clean = pattern.replace(/^\(\?i\)/, '')
+      const regex = new RegExp(clean, 'gim')
+      masked = masked.replace(regex, (match) => {
+        // Replace everything after the separator (= or :)
+        return match.replace(/\s*[:=]\s*\S+/, `=${CREDENTIAL_SENTINEL}`)
+      })
+    } catch {
+      // Invalid regex — skip
+    }
+  }
+  return masked
+}
+
+/**
+ * Filter sensitive environment variables before spawning a subprocess.
+ * Returns a sanitized copy of process.env with matching vars removed.
+ */
+export function filterEnv(
+  env: Record<string, string | undefined>,
+  config: CredentialMaskingConfig,
+): Record<string, string | undefined> {
+  if (!config.enabled || !config.env_filter.enabled) return { ...env }
+
+  const filtered: Record<string, string | undefined> = {}
+  for (const [key, value] of Object.entries(env)) {
+    let blocked = false
+    for (const pattern of config.env_filter.patterns) {
+      try {
+        // Strip (?i) inline flags — JS uses the 'i' flag instead
+        const clean = pattern.replace(/^\(\?i\)/, '')
+        const regex = new RegExp(clean, 'i')
+        if (regex.test(key)) {
+          blocked = true
+          break
+        }
+      } catch {
+        // Invalid regex — skip
+      }
+    }
+    if (blocked) {
+      // Replace with sentinel so tools can detect they're filtered
+      filtered[key] = CREDENTIAL_SENTINEL
+    } else {
+      filtered[key] = value
+    }
+  }
+
+  return filtered
+}
+
+/**
+ * Get the file display name for a sentinel value (for model visibility).
+ * The model sees the sentinel, doesn't know the original file path.
+ */
+export function getSentinelDisplay(hint?: string): string {
+  if (hint) {
+    return `[Credential file masked: ${hint}]`
+  }
+  return CREDENTIAL_SENTINEL
+}
+
+// ── Internal helpers ──
+
+/**
+ * Expand ~ to the user's home directory.
+ */
+function expandHome(p: string): string {
+  if (p.startsWith('~')) {
+    return homedir() + p.slice(1)
+  }
+  return p
+}
+
+/**
+ * Match a file path against a glob-like pattern.
+ * Supports:
+ * - ** globstar (matches any number of path segments)
+ * - * wildcard within a single path segment
+ * - ~ home directory expansion
+ * - basename-only matching (e.g. ".env*" matches any .env file)
+ */
+function matchPath(filePath: string, pattern: string): boolean {
+  const expandedPattern = expandHome(pattern)
+  const normalizedFile = filePath.replace(/\\/g, '/')
+  const normalizedPattern = expandedPattern.replace(/\\/g, '/')
+
+  // Exact match
+  if (normalizedFile === normalizedPattern) {
+    return true
+  }
+
+  // File ends with pattern (for relative basename matching like ".env*")
+  if (normalizedFile.endsWith('/' + normalizedPattern)) {
+    return true
+  }
+
+  // Convert glob pattern to regex
+  const regex = globToRegex(normalizedPattern)
+  return regex.test(normalizedFile)
+}
+
+/**
+ * Convert a glob pattern to a RegExp.
+ * - ** → .* (matches any path segments)
+ * - *  → [^/]* (matches within a single segment)
+ * - ?  → . (single char)
+ * - All other special regex chars are escaped.
+ */
+function globToRegex(pattern: string): RegExp {
+  let regexStr = ''
+  let i = 0
+  while (i < pattern.length) {
+    const ch = pattern[i]!
+    if (ch === '*' && pattern[i + 1] === '*') {
+      // ** — match zero or more path segments
+      regexStr += '.*'
+      i += 2
+      // Skip trailing slash after **
+      if (pattern[i] === '/') i++
+      continue
+    }
+    if (ch === '*') {
+      regexStr += '[^/]*'
+      i++
+      continue
+    }
+    if (ch === '?') {
+      regexStr += '.'
+      i++
+      continue
+    }
+    // Escape regex special chars
+    if ('\\^$.|+()[]{}'.includes(ch)) {
+      regexStr += '\\' + ch
+    } else {
+      regexStr += ch
+    }
+    i++
+  }
+  return new RegExp('^' + regexStr + '$')
+}

package/src/core/instructions.ts

@@ -66,6 +66,34 @@ export class InstructionsLoader {
       parts.push(this.skillsReminder)
     }
 
+    // Inject workflow auto-generation guidance
+    parts.push(`## Workflow Auto-Generation
+
+When a task involves 3+ independent subtasks, multi-file operations,
+or unknown-size discovery, generate a workflow script and execute it
+via the Workflow tool instead of running agents sequentially. The
+orchestration itself is code (zero tokens for inter-agent coordination).
+
+Prefer workflows for: audits across many files, web research with multiple
+sources, code migrations touching many files, security scans, bug hunts
+with unknown scope, multi-dimensional code reviews.
+
+Available primitives: agent(), parallel(), pipeline(), verify(),
+judge(), loopUntilConvergence(), phase(), log(), args, budget.
+
+Key rules:
+- Default to pipeline() — only use parallel() barrier when a stage
+  genuinely needs all prior results at once
+- Edge logic (flatten, dedupe, filter) is plain JS — not agent calls
+- Use verify() on edges where confidence matters
+- Use loopUntilConvergence() for discovery tasks with unknown size
+
+When a workflow completes successfully, offer to save it:
+"Workflow complete. Save this script? /workflow save <name>"
+
+Script format: export const meta = { name, description, phases: [...] }
+// script body using primitives...`)
+
     return parts.join('\n\n---\n\n')
   }
 

package/src/core/permission.ts

@@ -20,6 +20,17 @@ export class PermissionSystem {
   private legacyDefaultFallback: PermissionLevel | null = null
   private mode: PermissionMode = 'default'
 
+  // ── Permission cache (P2) ──
+  /** Short-lived cache: toolName+input → permissionLevel. Invalidated on rule/mode change. */
+  private checkCache = new Map<string, PermissionLevel>()
+  private cacheMode: PermissionMode | null = null
+
+  /** Invalidate the permission cache (called on any rule/mode change). */
+  private invalidateCache(): void {
+    this.checkCache.clear()
+    this.cacheMode = null
+  }
+
   constructor(modeOrLevel: PermissionLevel = 'default') {
     if (VALID_MODES.has(modeOrLevel)) {
       this.mode = modeOrLevel as PermissionMode
@@ -34,6 +45,7 @@ export class PermissionSystem {
 
   setMode(mode: PermissionMode): void {
     this.mode = mode
+    this.invalidateCache()
   }
 
   getMode(): PermissionMode {
@@ -75,6 +87,8 @@ export class PermissionSystem {
     for (const rule of config.deny) {
       this.denyRules.push(compileRule(rule, 'deny'))
     }
+
+    this.invalidateCache()
   }
 
   // ── Permission check ──
@@ -91,37 +105,74 @@ export class PermissionSystem {
    * 8. System default → 'ask'
    */
   check(tool: ToolDefinition, input: Record<string, unknown>): PermissionLevel {
+    // ── Cache lookup (P2): reuse decision for same tool+mode+input ──
+    const cacheKey = tool.name + '|' + JSON.stringify(input, Object.keys(input).sort())
+    if (this.cacheMode === this.mode) {
+      const cached = this.checkCache.get(cacheKey)
+      if (cached !== undefined) return cached
+    } else {
+      // Mode changed — invalidate entire cache
+      this.checkCache.clear()
+      this.cacheMode = this.mode
+    }
+
     // 1. Check deny rules (always win)
     for (const rule of this.denyRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'ask'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'ask'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 2. Check ask rules
     for (const rule of this.askRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'ask'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'ask'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 3. Check allow rules
     for (const rule of this.allowRules) {
-      if (this.ruleMatches(rule, tool, input)) return 'bypass'
+      if (this.ruleMatches(rule, tool, input)) {
+        const result: PermissionLevel = 'bypass'
+        this.checkCache.set(cacheKey, result)
+        return result
+      }
     }
 
     // 4. Legacy exact-name rules (backward compat)
     const legacyLevel = this.legacyRules.get(tool.name)
-    if (legacyLevel !== undefined) return legacyLevel
+    if (legacyLevel !== undefined) {
+      this.checkCache.set(cacheKey, legacyLevel)
+      return legacyLevel
+    }
 
     // 5. Mode baseline
     const baseline = this.modeBaseline(tool)
-    if (baseline !== 'mode-baseline') return baseline
+    if (baseline !== 'mode-baseline') {
+      this.checkCache.set(cacheKey, baseline)
+      return baseline
+    }
 
     // 6. Tool's own permission level (backward compat fallback)
-    if (tool.permission) return tool.permission
+    if (tool.permission) {
+      this.checkCache.set(cacheKey, tool.permission)
+      return tool.permission
+    }
 
     // 7. Legacy constructor fallback
-    if (this.legacyDefaultFallback) return this.legacyDefaultFallback
+    if (this.legacyDefaultFallback) {
+      this.checkCache.set(cacheKey, this.legacyDefaultFallback)
+      return this.legacyDefaultFallback
+    }
 
     // 8. System default
-    return 'ask'
+    const result: PermissionLevel = 'ask'
+    this.checkCache.set(cacheKey, result)
+    return result
   }
 
   needsApproval(tool: ToolDefinition, input: Record<string, unknown>): boolean {
@@ -193,6 +244,7 @@ export class PermissionSystem {
     if (level === 'auto') this.mode = 'auto'
     else if (level === 'bypass') this.mode = 'bypassPermissions'
     else this.mode = 'default'
+    this.invalidateCache()
   }
 
   getDefaultLevel(): PermissionLevel {
@@ -229,11 +281,13 @@ export class PermissionSystem {
         else if (rule.level === 'ask') this.ask(rule.toolName)
       }
     }
+    this.invalidateCache()
   }
 
   removeRule(toolName: string): void {
     this.legacyRules.delete(toolName)
     this.removeRuleFromArrays(toolName)
+    this.invalidateCache()
   }
 
   private removeRuleFromArrays(toolName: string): void {

package/src/index.tsx

@@ -1,7 +1,7 @@
 import { join } from 'node:path'
 import { render } from 'ink'
 import { App } from './ui/app'
-import { loadConfig, loadInferenceHookConfig } from './config/loader'
+import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
 import { bootstrapProviders } from './providers/bootstrap'
 import { InstructionsLoader } from './core/instructions'
 import { loadSessionMemories } from './core/memory/memory-loader'
@@ -157,6 +157,13 @@ export async function runApp(options: RunOptions): Promise<void> {
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
+  // Wire credential masking configuration into tools
+  const credentialMaskingConfig = loadCredentialMaskingConfig()
+  const { setCredentialMaskingConfigForRead } = await import('./tools/file/read')
+  const { setCredentialMaskingConfigForBash } = await import('./tools/exec/bash')
+  setCredentialMaskingConfigForRead(credentialMaskingConfig)
+  setCredentialMaskingConfigForBash(credentialMaskingConfig)
+
   // Sync engine permission with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
   if (config.permission) {
     engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)

package/src/plugin/plugin-manager.ts

@@ -45,6 +45,7 @@ export class PluginManager {
     mkdirSync(destDir, { recursive: true })
     this.copyDir(sourcePath, destDir)
 
+    const similarWarning = this.findSimilarWarning(validation.manifest.name)
     this.plugins.push({
       name: validation.manifest.name,
       version: validation.manifest.version,
@@ -56,7 +57,9 @@ export class PluginManager {
     this.saveState()
     return {
       success: true,
-      message: `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed`,
+      message:
+        `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed` +
+        (similarWarning ? `\n⚠ ${similarWarning}` : ''),
     }
   }
 
@@ -120,9 +123,12 @@ export class PluginManager {
       })
 
       this.saveState()
+      const similarWarning = this.findSimilarWarning(pluginName)
       return {
         success: true,
-        message: `Plugin "${pluginName}" installed from npm`,
+        message:
+          `Plugin "${pluginName}" installed from npm` +
+          (similarWarning ? `\n⚠ ${similarWarning}` : ''),
       }
     } catch (err: unknown) {
       const msg = err instanceof Error ? err.message : String(err)
@@ -140,6 +146,37 @@ export class PluginManager {
     return [...this.plugins]
   }
 
+  /**
+   * Check if the new plugin name is similar to any existing installed plugin.
+   * Warns about potential name squatting / confusion.
+   * Returns a warning string or empty string.
+   */
+  private findSimilarWarning(newName: string): string {
+    const existing = this.plugins.map((p) => p.name)
+    const similar = existing.filter((name) => this.areNamesSimilar(newName, name))
+    if (similar.length === 0) return ''
+    return `Similar plugin${similar.length > 1 ? 's' : ''} already installed: ${similar.join(', ')}. Verify you trust this source.`
+  }
+
+  /**
+   * Two names are "similar" if:
+   * - One is a prefix of the other (e.g. "auth" vs "auth-pro")
+   * - They differ by ≤ 2 characters (Levenshtein distance)
+   */
+  private areNamesSimilar(a: string, b: string): boolean {
+    if (a === b) return false // exact match is handled by "already installed" check
+    if (a.startsWith(b) || b.startsWith(a)) return true
+
+    // Simple edit-distance approximation: count differing chars
+    const maxLen = Math.max(a.length, b.length)
+    let diffs = 0
+    for (let i = 0; i < maxLen; i++) {
+      if (a[i] !== b[i]) diffs++
+      if (diffs > 2) return false
+    }
+    return diffs <= 2
+  }
+
   /**
    * Register a cleanup callback that will be invoked when the named plugin is removed.
    * This allows the plugin loader to tear down hooks, agents, MCP connections, and tools.

package/src/shared/types.ts

@@ -335,3 +335,46 @@ export interface InferenceCheckResponse {
   verdict: 'allow' | 'deny'
   reason?: string
 }
+
+// ── Credential Masking Types ──
+
+/** Full-file masking rule: entire file content replaced with sentinel. */
+export interface CredentialFullMaskRule {
+  path: string
+  mode: 'full'
+}
+
+/** Extract-based masking rule: only regex-matched tokens are replaced. */
+export interface CredentialExtractRule {
+  path: string
+  mode: 'extract'
+  extract: Array<{
+    pattern: string
+    replacement?: string
+  }>
+}
+
+export type CredentialFileRule = CredentialFullMaskRule | CredentialExtractRule
+
+/** Configuration for credential masking, loaded from config.yml. */
+export interface CredentialMaskingConfig {
+  enabled: boolean
+  files: CredentialFileRule[]
+  output_scrubbing: {
+    enabled: boolean
+    patterns: string[]
+  }
+  env_filter: {
+    enabled: boolean
+    patterns: string[]
+  }
+}
+
+// ── Background Agent Types ──
+
+export interface BackgroundAgentConfig {
+  auto_commit: boolean
+  auto_push: boolean
+  auto_worktree: boolean
+  commit_coauthors: boolean
+}

package/src/tools/agent/workflow.ts

@@ -5,9 +5,56 @@ import type { QueryEngine } from '../../core/engine'
 export const workflowTool: ToolDefinition = {
   name: 'Workflow',
   description:
-    'Execute a multi-agent workflow script. The script uses agent(), parallel(), pipeline(), phase(), log(), args, budget primitives. ' +
-    'Pass resumeFromRunId to resume a prior run — cached agent() calls are replayed from the journal, ' +
-    'and only new/changed calls execute live.',
+    'Execute a workflow script that orchestrates multiple subagents deterministically. ' +
+    'Workflows run in the background — this tool returns immediately with a task ID, ' +
+    'and a <task-notification> arrives when the workflow completes. Use /workflows to watch live progress.\n\n' +
+    'A workflow structures work across many agents — to be comprehensive (decompose and cover in parallel), ' +
+    'to be confident (independent perspectives and adversarial checks before committing), ' +
+    'or to take on scale one context cannot hold (migrations, audits, broad sweeps). ' +
+    'The script is where you encode that structure: what fans out, what verifies, what synthesizes.\n\n' +
+    'ONLY call this tool when the task benefits from multi-agent orchestration. ' +
+    'For a simple single-agent lookup or edit, use the Agent tool or direct tools instead.\n\n' +
+    '## Primitives\n\n' +
+    '- agent(prompt: string, opts?: {label?, phase?, schema?, model?, effort?, isolation?}): Promise<any> — spawn a subagent. ' +
+    'Without schema, returns final text as string. With schema (JSON Schema), returns validated object — retries on mismatch.\n' +
+    '- parallel(thunks: Array<() => Promise<any>>): Promise<any[]> — BARRIER: runs all thunks concurrently, waits for all. ' +
+    'Failed thunks resolve to null. Use filter(Boolean) before consuming results.\n' +
+    '- pipeline(items: T[], ...stages): Promise<any[]> — NO barrier: each item flows through all stages independently. ' +
+    'Item A can be in stage 3 while item B is still in stage 1. DEFAULT choice for multi-stage work.\n' +
+    '- verify(finding, opts): Promise<VerifyResult> — adversarial/perspective/consensus quality gate. ' +
+    'Spawns skeptics or lens-based judges, applies threshold, returns {survives, votes, score}.\n' +
+    '- judge(attempts, opts): Promise<JudgeResult> — judge panel: N attempts scored by M judges across K criteria. ' +
+    'Returns winner with optional synthesis grafting runner-up ideas.\n' +
+    '- loopUntilConvergence(opts): Promise<LoopUntilConvergenceResult> — convergent discovery loop. ' +
+    'Fans out finders repeatedly, deduplicates against seen-set (NOT confirmed-set), ' +
+    'stops after N consecutive dry rounds or maxRounds. Optionally verifies each finding.\n' +
+    '- phase(title: string): void — start a new progress group\n' +
+    '- log(message: string): void — emit progress message\n' +
+    '- args: any — verbatim args passed to Workflow tool\n' +
+    '- budget: {total, spent(), remaining()} — token budget tracking\n\n' +
+    '## Topology Selection Guide\n\n' +
+    'DEFAULT TO pipeline(). Only reach for a barrier (parallel between stages) when you genuinely ' +
+    'need ALL prior-stage results together.\n\n' +
+    'A barrier is correct ONLY when stage N needs cross-item context from all of stage N-1: ' +
+    'dedup/merge across the full result set, early-exit if total count is zero, cross-finding comparison.\n\n' +
+    'A barrier is NOT justified by: flatten/map/filter (do it inside a pipeline stage), ' +
+    'conceptually separate stages, cleaner code — barrier latency is real and measurable.\n\n' +
+    '- Diamond (fan-out → reduce → synthesize): market scans, audits, research\n' +
+    '- Pipeline (no barrier): each item flows independently — DEFAULT\n' +
+    '- Loop-until-convergence: unknown-size discovery (bugs, vulnerabilities, edge cases)\n' +
+    '- Judge panel: multiple competing approaches, pick best + graft runner-ups\n' +
+    '- Verifier-on-edge: quality gates before results reach downstream\n\n' +
+    '## Critical Rules\n\n' +
+    '- EDGE LOGIC IS FREE: flatten, dedupe, filter in plain JavaScript — NOT agent calls. ' +
+    'results.flatMap(...) and a Set are deterministic, instant, zero tokens.\n' +
+    '- seen-set dedup for loops, NOT confirmed-set — rejected findings would otherwise revive every round.\n' +
+    '- Each node should have bounded input, validated output (schema), and one clear purpose.\n' +
+    '- Model tiering: use cheaper models for repetitive extraction/classification nodes, ' +
+    'expensive models for synthesis/judgment nodes.\n\n' +
+    '## Script Format\n\n' +
+    'Every script MUST begin with: export const meta = { name, description, phases: [{title, detail}] }\n' +
+    'The meta object must be a PURE LITERAL — no variables, function calls, or template interpolation.\n' +
+    'Use the SAME phase titles in meta.phases as in phase() calls.',
   category: 'agent',
   permission: 'ask',
   parameters: {
@@ -60,6 +107,23 @@ export const workflowTool: ToolDefinition = {
         resumeFromRunId,
       )
 
+      // Persist last-run state for /workflow save
+      try {
+        const { existsSync, mkdirSync, writeFileSync } = await import('node:fs')
+        const { join } = await import('node:path')
+        const workflowsDir = join(process.cwd(), '.claude', 'workflows')
+        if (!existsSync(workflowsDir)) {
+          mkdirSync(workflowsDir, { recursive: true })
+        }
+        writeFileSync(
+          join(workflowsDir, '.last-run.json'),
+          JSON.stringify({ runId, script, timestamp: new Date().toISOString() }),
+          'utf-8',
+        )
+      } catch {
+        // best-effort — don't fail the workflow if state persistence fails
+      }
+
       let content = `Workflow ${runId} completed.\n\n`
       if (resumeFromRunId) {
         content += `Cache: ${cacheHits} hits · ${cacheMisses} live\n\n`

package/src/tools/exec/bash.ts

@@ -1,4 +1,11 @@
-import type { ToolDefinition } from '../../shared/index.ts'
+import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
+
+// Injected at startup — set via index.tsx
+let credentialConfig: CredentialMaskingConfig | undefined
+
+export function setCredentialMaskingConfigForBash(config: CredentialMaskingConfig): void {
+  credentialConfig = config
+}
 
 // ── Dangerous command patterns ──
 const BLOCKED_PATTERNS = [
@@ -115,19 +122,38 @@ export const bashTool: ToolDefinition = {
     }
 
     try {
+      // ── Credential masking: filter sensitive env vars ──
+      let spawnEnv: Record<string, string | undefined> | undefined
+      if (credentialConfig?.enabled && credentialConfig.env_filter.enabled) {
+        const { filterEnv } = await import('../../core/credential-masker')
+        spawnEnv = filterEnv(process.env as Record<string, string | undefined>, credentialConfig)
+      }
+
       const proc = Bun.spawn(['bash', '-c', command], {
         cwd: ctx.cwd,
         stdout: 'pipe',
         stderr: 'pipe',
+        env: spawnEnv,
       })
 
       const timer = setTimeout(() => proc.kill(), timeout)
-      const output = await new Response(proc.stdout).text()
+      const rawOutput = await new Response(proc.stdout).text()
       const exitCode = await proc.exited
       clearTimeout(timer)
 
+      // ── Credential masking: scrub output ──
+      let output = rawOutput
+      if (credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled) {
+        const { maskOutput } = await import('../../core/credential-masker')
+        output = maskOutput(rawOutput, credentialConfig)
+      }
+
       if (exitCode !== 0) {
-        const stderr = await new Response(proc.stderr).text()
+        const rawStderr = await new Response(proc.stderr).text()
+        const stderr =
+          credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled
+            ? (await import('../../core/credential-masker')).maskOutput(rawStderr, credentialConfig)
+            : rawStderr
         return {
           success: false,
           content: output.slice(0, 5_000),