@miphamai/cli 0.38.0 → 0.39.0

package/src/core/session-store.ts

@@ -11,6 +11,7 @@ import {
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 import type { Message } from '../shared/types'
+import { sanitizeSessionName, SessionLog, deriveMessages, messageToEvents } from './session-log'
 
 export interface SessionMetadata {
   name: string
@@ -46,21 +47,11 @@ export interface SessionIndexEntry {
 }
 
 function ensureDir(): void {
-  mkdirSync(SESSIONS_DIR, { recursive: true })
+  mkdirSync(SESSIONS_DIR, { recursive: true, mode: 0o700 })
 }
 
 function filePath(name: string): string {
-  // Sanitize name for filesystem
-  const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_')
-
-  // For very long names (>100 chars), use SHA-256 hash suffix to prevent collision
-  if (safe.length > 100) {
-    const hash = createHash('sha256').update(safe).digest('hex').slice(0, 16)
-    const truncated = safe.slice(0, 80)
-    return join(SESSIONS_DIR, `${truncated}-${hash}.jsonl`)
-  }
-
-  return join(SESSIONS_DIR, `${safe}.jsonl`)
+  return join(SESSIONS_DIR, `${sanitizeSessionName(name)}.jsonl`)
 }
 
 export class SessionStore {
@@ -90,7 +81,7 @@ export class SessionStore {
 
     // Atomic write: write to temp file, then rename (same-fs rename is atomic)
     const tmp = path + '.tmp'
-    writeFileSync(tmp, JSON.stringify(session) + '\n', 'utf-8')
+    writeFileSync(tmp, JSON.stringify(session) + '\n', { encoding: 'utf-8', mode: 0o600 })
     renameSync(tmp, path)
 
     // Incremental index update — only touch this session's entry
@@ -101,6 +92,69 @@ export class SessionStore {
     }
   }
 
+  /** 追加持久化一个 SessionLog（幂等：只写新事件）。缺失 session/start 时补一个。 */
+  static saveLog(
+    name: string,
+    log: SessionLog,
+    meta?: { provider?: string; model?: string; cwd?: string },
+  ): void {
+    ensureDir()
+    const events = log.events()
+    if (!events.some((e) => e.type === 'session/start')) {
+      log.append({ type: 'session/start', at: Date.now(), sessionId: name, ...meta })
+    }
+    log.save()
+    try {
+      const messages = deriveMessages(log.events())
+      SessionStore.updateIndexEntry(name, {
+        name,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        provider: meta?.provider || 'unknown',
+        model: meta?.model || 'unknown',
+        messageCount: messages.length,
+        cwd: meta?.cwd,
+      })
+    } catch {
+      // index 更新 best-effort
+    }
+  }
+
+  /** 从磁盘重开一个 SessionLog（不存在返回空 log）。旧格式快照自动迁移为事件日志。 */
+  static loadLog(name: string): SessionLog {
+    const path = filePath(name)
+    if (!existsSync(path)) return SessionLog.open(name)
+    try {
+      const raw = readFileSync(path, 'utf-8')
+      const parsed = JSON.parse(raw) as unknown
+      if (
+        parsed &&
+        typeof parsed === 'object' &&
+        'metadata' in parsed &&
+        Array.isArray((parsed as { messages?: unknown }).messages)
+      ) {
+        // 旧格式快照 → 迁移为事件日志（重写文件，避免后续 append 混格式）
+        const old = parsed as StoredSession
+        const log = new SessionLog(name)
+        log.append({
+          type: 'session/start',
+          at: Date.parse(old.metadata.createdAt) || Date.now(),
+          sessionId: name,
+          provider: old.metadata.provider,
+          model: old.metadata.model,
+          cwd: old.metadata.cwd,
+        })
+        for (const m of old.messages) for (const e of messageToEvents(m)) log.append(e)
+        unlinkSync(path)
+        log.save()
+        return log
+      }
+    } catch {
+      // 非旧格式（多行 JSONL 或单事件）→ 走 open
+    }
+    return SessionLog.open(name)
+  }
+
   /**
    * Load a saved session. Returns null if not found or unparseable.
    */
@@ -110,14 +164,48 @@ export class SessionStore {
 
     try {
       const raw = readFileSync(path, 'utf-8')
-      const session = JSON.parse(raw) as StoredSession
-      // Validate structure
-      if (!session.metadata || !Array.isArray(session.messages)) {
-        return null
+      // 旧格式：单 JSON 对象 {metadata, messages}
+      const parsed = JSON.parse(raw) as unknown
+      if (
+        parsed &&
+        typeof parsed === 'object' &&
+        'metadata' in parsed &&
+        Array.isArray((parsed as { messages?: unknown }).messages)
+      ) {
+        return parsed as StoredSession
       }
-      return session
     } catch {
-      return null
+      // 多行 JSONL → 新格式，走事件解析
+    }
+    return SessionStore.logToStoredSession(name, SessionLog.open(name))
+  }
+
+  private static logToStoredSession(name: string, log: SessionLog): StoredSession | null {
+    const events = log.events()
+    if (events.length === 0) return null
+    const start = events.find((e) => e.type === 'session/start') as
+      | {
+          type: 'session/start'
+          at: number
+          sessionId: string
+          provider?: string
+          model?: string
+          cwd?: string
+        }
+      | undefined
+    const messages = deriveMessages(events)
+    const stat = statSync(filePath(name))
+    return {
+      metadata: {
+        name,
+        createdAt: start?.at ? new Date(start.at).toISOString() : stat.mtime.toISOString(),
+        updatedAt: stat.mtime.toISOString(),
+        provider: start?.provider || 'unknown',
+        model: start?.model || 'unknown',
+        messageCount: messages.length,
+        cwd: start?.cwd,
+      },
+      messages,
     }
   }
 
@@ -128,20 +216,14 @@ export class SessionStore {
     ensureDir()
     try {
       const files = readdirSync(SESSIONS_DIR).filter((f) => f.endsWith('.jsonl'))
-
       const sessions: SessionMetadata[] = []
       for (const file of files) {
-        try {
-          const raw = readFileSync(join(SESSIONS_DIR, file), 'utf-8')
-          const session = JSON.parse(raw) as StoredSession
-          if (session.metadata) {
-            sessions.push(session.metadata)
-          }
-        } catch {
-          // Skip corrupt files
+        const name = file.replace('.jsonl', '')
+        const session = SessionStore.load(name)
+        if (session?.metadata) {
+          sessions.push(session.metadata)
         }
       }
-
       sessions.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime())
       return sessions
     } catch {
@@ -203,7 +285,7 @@ export class SessionStore {
       }
     }
 
-    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), 'utf-8')
+    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { encoding: 'utf-8', mode: 0o600 })
   }
 
   /**
@@ -231,7 +313,7 @@ export class SessionStore {
     } else {
       index.push(entry)
     }
-    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), 'utf-8')
+    writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { encoding: 'utf-8', mode: 0o600 })
   }
 
   /**
@@ -240,7 +322,7 @@ export class SessionStore {
    */
   static saveSummary(name: string, summary: string, tags: string[]): void {
     ensureDir()
-    mkdirSync(SUMMARIES_DIR, { recursive: true })
+    mkdirSync(SUMMARIES_DIR, { recursive: true, mode: 0o700 })
 
     const safeRaw = name.replace(/[^a-zA-Z0-9_-]/g, '_')
     const safe =
@@ -248,7 +330,10 @@ export class SessionStore {
         ? `${safeRaw.slice(0, 80)}-${createHash('sha256').update(safeRaw).digest('hex').slice(0, 16)}`
         : safeRaw
     const summaryPath = join(SUMMARIES_DIR, `${safe}.md`)
-    writeFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, 'utf-8')
+    writeFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, {
+      encoding: 'utf-8',
+      mode: 0o600,
+    })
 
     // Update index entry — create minimal one if not present
     try {
@@ -270,7 +355,7 @@ export class SessionStore {
           tags,
         })
       }
-      writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), 'utf-8')
+      writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2), { encoding: 'utf-8', mode: 0o600 })
     } catch {
       // Index write is best-effort
     }

package/src/daemon/auth.ts

@@ -73,16 +73,19 @@ export function listTokens(tokenPath: string): string[] {
  * trusted and auth is bypassed. Auth enforcement activates when
  * MIPHAM_BIND=0.0.0.0 for remote access.
  */
-export function authMiddleware(request: Request, validToken: string): Response | null {
+export function authMiddleware(
+  request: Request,
+  validToken: string,
+  peerAddress: string | undefined,
+): Response | null {
   // Allow health endpoint without auth
   const url = new URL(request.url)
   if (url.pathname === '/api/v1/health') return null
 
-  // localhost requests skip auth
-  const host = request.headers.get('host') || ''
-  if (host.startsWith('127.0.0.1') || host.startsWith('localhost') || host.startsWith('[::1]')) {
-    return null
-  }
+  // Trust only actual loopback connections (socket IP), never the spoofable Host header.
+  const isLoopback =
+    peerAddress === '127.0.0.1' || peerAddress === '::1' || peerAddress === '::ffff:127.0.0.1'
+  if (isLoopback) return null
 
   const auth = request.headers.get('authorization')
   if (!auth || !auth.startsWith('Bearer ')) {

package/src/daemon/cors.ts

@@ -1,10 +1,11 @@
 // apps/cli/src/daemon/cors.ts
 //
 // CORS middleware for the daemon HTTP API.
-// Handles preflight OPTIONS requests and provides helpers for
-// adding CORS headers to responses from external origins.
+// Only origins explicitly listed in MIPHAM_CORS_ORIGINS (comma-separated) are
+// allowed cross-origin access. By default (empty) no external origin is allowed,
+// so a malicious web page cannot read daemon responses cross-origin.
 
-const ALLOWED_HEADERS = 'Authorization, Content-Type'
+const ALLOWED_HEADERS = 'Content-Type'
 const ALLOWED_METHODS = 'GET, POST, PATCH, DELETE, OPTIONS'
 
 /**
@@ -14,24 +15,31 @@ export function isLocalhostOrigin(origin: string): boolean {
   return origin.includes('localhost') || origin.includes('127.0.0.1') || origin.includes('[::1]')
 }
 
+function getAllowedOrigins(): string[] {
+  const raw = process.env.MIPHAM_CORS_ORIGINS || ''
+  return raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean)
+}
+
+function isAllowedOrigin(origin: string): boolean {
+  return getAllowedOrigins().includes(origin)
+}
+
 /**
  * Handle CORS preflight (OPTIONS) requests.
  *
- * Returns a Response with appropriate CORS headers for preflight,
- * or null if the request does not need CORS handling (not a preflight,
- * or origin is localhost).
- *
- * For non-preflight requests with an external Origin, the caller should
- * use `addCorsHeaders` to attach CORS headers to the response.
+ * Returns a Response with CORS headers only for explicitly allow-listed external
+ * origins. Localhost origins need no CORS; unlisted external origins get no CORS
+ * headers (the browser blocks the cross-origin read).
  */
 export function corsMiddleware(request: Request): Response | null {
   const origin = request.headers.get('origin')
   if (!origin) return null
 
-  // Skip localhost origins — no CORS needed
-  if (isLocalhostOrigin(origin)) return null
+  if (isLocalhostOrigin(origin) || !isAllowedOrigin(origin)) return null
 
-  // Handle preflight
   if (request.method === 'OPTIONS') {
     return new Response(null, {
       status: 204,
@@ -39,7 +47,7 @@ export function corsMiddleware(request: Request): Response | null {
         'Access-Control-Allow-Origin': origin,
         'Access-Control-Allow-Methods': ALLOWED_METHODS,
         'Access-Control-Allow-Headers': ALLOWED_HEADERS,
-        'Access-Control-Max-Age': '86400',
+        'Access-Control-Max-Age': '3600',
       },
     })
   }
@@ -48,12 +56,12 @@ export function corsMiddleware(request: Request): Response | null {
 }
 
 /**
- * Add CORS headers to a response when the request has an external origin.
- * If the origin is localhost or absent, the response is returned unchanged.
+ * Add CORS headers to a response only for explicitly allow-listed external origins.
+ * Localhost / absent / unlisted origins return the response unchanged.
  */
 export function addCorsHeaders(response: Response, request: Request): Response {
   const origin = request.headers.get('origin')
-  if (!origin || isLocalhostOrigin(origin)) return response
+  if (!origin || isLocalhostOrigin(origin) || !isAllowedOrigin(origin)) return response
 
   const headers = new Headers(response.headers)
   headers.set('Access-Control-Allow-Origin', origin)

package/src/daemon/rate-limiter.ts

@@ -30,6 +30,10 @@ export class RateLimiter {
    */
   check(key: string): { allowed: boolean; remaining: number; resetAt: number } {
     const now = Date.now()
+    // Bound the map size to prevent unbounded growth under a flood of distinct keys.
+    if (this.windows.size >= 100_000 && !this.windows.has(key)) {
+      this.cleanup()
+    }
     let entry = this.windows.get(key)
 
     if (!entry || now >= entry.resetAt) {

package/src/daemon/server.ts

@@ -21,7 +21,7 @@ import { bootstrapProviders } from '../providers/bootstrap'
 import { createToolRegistry } from '../tools'
 import { PermissionSystem } from '../core/permission'
 import type { ProviderRegistry } from '../providers/registry'
-import type { ToolDefinition } from '../shared/types'
+import type { ToolDefinition, PermissionMode } from '../shared/types'
 
 interface ServerConfig {
   db: DaemonDatabase
@@ -42,6 +42,27 @@ interface WsData {
   sessionId: string
 }
 
+const DAEMON_PERMISSION_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>([
+  'default',
+  'acceptEdits',
+  'plan',
+  'auto',
+  'dontAsk',
+  'bypassPermissions',
+])
+
+/**
+ * Resolve the daemon's permission mode from env, defaulting to least-privilege
+ * 'default'. Headless daemon sessions can never prompt, so 'ask'-level tools
+ * (Bash/Write/Edit) are blocked rather than auto-approved.
+ */
+function resolveDaemonPermission(): PermissionMode {
+  const fromEnv = process.env.MIPHAM_DAEMON_PERMISSION
+  return fromEnv && DAEMON_PERMISSION_MODES.has(fromEnv as PermissionMode)
+    ? (fromEnv as PermissionMode)
+    : 'default'
+}
+
 export function createServer(config: ServerConfig): Server<WsData> {
   const {
     db,
@@ -142,7 +163,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
       }
     }
 
-    const permission = new PermissionSystem('bypassPermissions')
+    const permission = new PermissionSystem(resolveDaemonPermission())
     const engine = new QueryEngine(sharedRegistry, context, sharedTools, permission)
     engine.setSessionId(sessionId)
     engineCache.set(sessionId, engine)
@@ -201,7 +222,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
       }
 
       // ── Auth check ──────────────────────────────────
-      const authError = authMiddleware(req, token)
+      const authError = authMiddleware(req, token, server.requestIP(req)?.address)
       if (authError) return addCorsHeaders(authError, req)
 
       // Helper: create JSON response with CORS headers for external origins

package/src/index.tsx

@@ -26,12 +26,16 @@ import { ContextManager } from './core/context'
 import { PrefixCacheTracker } from './core/context-token'
 import { QueryEngine } from './core/engine'
 import { ExperienceRuleEngine } from './core/rule-engine.js'
+import { SessionLog } from './core/session-log'
 import { SessionStore } from './core/session-store'
 import type { PermissionLevel, MiphamConfig } from './shared/types'
 import { SkillsLoader } from './skills/loader'
 import { PluginManager } from './plugin/plugin-manager'
 import { loadPlugins } from './plugin/plugin-loader'
 import { createToolRegistry } from './tools'
+import { Context } from './vajra'
+import { mountSkills, SKILLS_KEY } from './skills/seam'
+import { mountLlm, LLM_KEY } from './providers/llm'
 import { McpClient } from './mcp/client'
 import { registerMcpServerTools } from './mcp/registry'
 import { AgentRegistry } from './agent/agent-registry'
@@ -328,6 +332,16 @@ export async function runApp(options: RunOptions): Promise<void> {
     compactionThreshold: 0.9,
     contextWindow: adaptiveThresholds ? modelContextWindow : undefined,
   })
+  const sessionLog = new SessionLog(sessionName)
+  sessionLog.append({
+    type: 'session/start',
+    at: Date.now(),
+    sessionId: sessionName,
+    provider: defaultProvider,
+    model: defaultModel,
+    cwd: process.cwd(),
+  })
+  context.setLog(sessionLog)
   // Cache-aware microcompaction: track the provider's prompt-cache prefix.
   context.setCacheTracker(new PrefixCacheTracker())
 
@@ -335,19 +349,19 @@ export async function runApp(options: RunOptions): Promise<void> {
   getMemoryManager().setContextWindow(modelContextWindow)
 
   if (options.resume) {
-    const saved = SessionStore.load(options.resume)
-    if (saved) {
-      // Restore working directory if saved
-      if (saved.metadata.cwd && existsSync(saved.metadata.cwd)) {
+    const log = SessionStore.loadLog(options.resume)
+    const events = log.events()
+    if (events.length > 0) {
+      const start = events.find((e) => e.type === 'session/start') as
+        { type: 'session/start'; cwd?: string } | undefined
+      if (start?.cwd && existsSync(start.cwd)) {
         try {
-          process.chdir(saved.metadata.cwd)
+          process.chdir(start.cwd)
         } catch {
-          // cwd may no longer exist; silently continue
+          // cwd 可能已不存在
         }
       }
-      for (const msg of saved.messages) {
-        context.addMessage(msg)
-      }
+      context.restoreLog(log)
       context.setSystemPrompt(instructions.buildSystemPrompt(config.permission as string))
     }
   }
@@ -423,8 +437,21 @@ export async function runApp(options: RunOptions): Promise<void> {
     context.setSystemPrompt(prompt)
   }
 
-  // Create tool registry with all built-in tools
-  const tools = createToolRegistry()
+  // Initialize credential masking pipeline (strategies: Full, Extract, JWT)
+  const { initializePipeline } = await import('./core/credential-masker/index')
+  initializePipeline()
+
+  // Load credential masking config and inject it into the tool seam
+  const credentialMaskingConfig = loadCredentialMaskingConfig()
+  const vajraContext = new Context()
+  vajraContext.provide('credentials', credentialMaskingConfig)
+
+  // Create tool registry with all built-in tools (mounted as Vajra services)
+  const tools = createToolRegistry(vajraContext)
+
+  // 绞杀收官：skills + llm 也挂载到同一 Vajra Context（tools 已接）
+  mountSkills(vajraContext, skillsLoader)
+  mountLlm(vajraContext, registry)
 
   // Connect MCP servers and register their tools into the tool registry.
   // Uses Promise.allSettled for parallel connection — failures are non-fatal.
@@ -471,23 +498,13 @@ export async function runApp(options: RunOptions): Promise<void> {
   engine.setHookEngine(hookEngine)
   engine.setArtifactServer(artifactServer)
   engine.setAgentViewManager(agentViewManager)
-  engine.setSkillsLoader(skillsLoader)
+  engine.setSkills(vajraContext.get(SKILLS_KEY)!)
+  engine.setLlm(vajraContext.get(LLM_KEY)!)
 
   // Wire inference hooks (DLP) configuration
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
-  // Initialize credential masking pipeline (strategies: Full, Extract, JWT)
-  const { initializePipeline } = await import('./core/credential-masker/index')
-  initializePipeline()
-
-  // Wire credential masking configuration into tools
-  const credentialMaskingConfig = loadCredentialMaskingConfig()
-  const { setCredentialMaskingConfigForRead } = await import('./tools/file/read')
-  const { setCredentialMaskingConfigForBash } = await import('./tools/exec/bash')
-  setCredentialMaskingConfigForRead(credentialMaskingConfig)
-  setCredentialMaskingConfigForBash(credentialMaskingConfig)
-
   // Sync engine permission with config (fix: UI shows "auto" but engine defaulted to bypass-legacy)
   if (config.permission) {
     engine.getPermission().setDefaultLevel(config.permission as PermissionLevel)
@@ -559,11 +576,20 @@ export async function runApp(options: RunOptions): Promise<void> {
     hookEngine.executeSessionEnd(sessionName).catch(() => {})
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
-      SessionStore.save(sessionName, context.getMessages(), {
-        provider: defaultProvider,
-        model: defaultModel,
-        cwd: process.cwd(),
-      })
+      const log = context.getLog()
+      if (log) {
+        SessionStore.saveLog(sessionName, log, {
+          provider: defaultProvider,
+          model: defaultModel,
+          cwd: process.cwd(),
+        })
+      } else {
+        SessionStore.save(sessionName, context.getMessages(), {
+          provider: defaultProvider,
+          model: defaultModel,
+          cwd: process.cwd(),
+        })
+      }
     }
     process.exit(0)
   }

package/src/mcp/http-transport.ts

@@ -119,6 +119,7 @@ export class HttpTransport implements Transport {
         },
         body: JSON.stringify(request),
         signal: controller.signal,
+        redirect: 'manual',
       })
 
       if (!response.ok) {
@@ -164,6 +165,7 @@ export class HttpTransport implements Transport {
         ...this.headers,
       },
       body: JSON.stringify(notification),
+      redirect: 'manual',
     }).catch(() => {
       /* notifications are best-effort */
     })

package/src/mcp/oauth.ts

@@ -68,7 +68,7 @@ export class OAuthClient {
           resolve(receivedCode)
         }
       })
-      server.listen(port, () => {
+      server.listen(port, '127.0.0.1', () => {
         const authUrl = new URL(auth.authorizationUrl)
         authUrl.searchParams.set('response_type', 'code')
         authUrl.searchParams.set('client_id', auth.clientId)

package/src/providers/llm-replay.ts

@@ -0,0 +1,36 @@
+import type { Llm } from './llm'
+import type { ChatRequest } from './registry'
+import type { StreamChunk } from '../shared'
+
+export interface RecordedTurn {
+  req: ChatRequest
+  chunks: StreamChunk[]
+}
+
+/** 包装一个 Llm：委托的同时记录每轮 (req, chunks)。 */
+export function recordLlm(inner: Llm): { llm: Llm; turns: RecordedTurn[] } {
+  const turns: RecordedTurn[] = []
+  const llm: Llm = {
+    async *chat(req) {
+      const chunks: StreamChunk[] = []
+      for await (const chunk of inner.chat(req)) {
+        chunks.push(chunk)
+        yield chunk
+      }
+      turns.push({ req, chunks })
+    },
+  }
+  return { llm, turns }
+}
+
+/** 回放已记录的 turns（确定性、无网络）。按顺序消费，超出则静默结束。 */
+export function replayLlm(turns: RecordedTurn[]): Llm {
+  let cursor = 0
+  return {
+    async *chat() {
+      const turn = turns[cursor++]
+      if (!turn) return
+      for (const chunk of turn.chunks) yield chunk
+    },
+  }
+}

package/src/providers/llm.ts

@@ -0,0 +1,16 @@
+import type { Context, Disposer } from '../vajra'
+import type { ChatRequest } from './registry'
+import type { StreamChunk } from '../shared'
+
+/** LLM 适配缝的 capability —— chat 能力。换 provider = 换 chat 实现，engine 零 fork 跟随。 */
+export interface Llm {
+  chat(req: ChatRequest): AsyncGenerator<StreamChunk>
+}
+
+/** 缝键：ctx.llm。 */
+export const LLM_KEY = 'llm'
+
+/** 把一个 Llm（如 ProviderRegistry 或 llm-replay）挂载为 ctx.llm。 */
+export function mountLlm(ctx: Context, llm: Llm): Disposer {
+  return ctx.provide(LLM_KEY, llm)
+}

package/src/providers/registry.ts

@@ -1,4 +1,5 @@
 import type { ProviderConfig, ModelInfo, Message, StreamChunk } from '../shared/index.ts'
+import type { Llm } from './llm'
 
 export interface ProviderInstance {
   config: ProviderConfig
@@ -17,7 +18,7 @@ export interface ChatRequest {
   signal?: AbortSignal
 }
 
-export class ProviderRegistry {
+export class ProviderRegistry implements Llm {
   private providers = new Map<string, ProviderInstance>()
   private activeProviderId: string
   private activeModelId: string

package/src/security/gate.ts

@@ -90,4 +90,14 @@ export class SecurityGate {
     }
     return { blocked: false }
   }
+
+  /** Redact known API-key-shaped tokens from output (defense-in-depth beyond config patterns). */
+  static redactCredentialLeak(output: string): string {
+    if (!this.checkCredentialLeak(output).blocked) return output
+    let out = output
+    for (const { regex } of API_KEY_PATTERNS) {
+      out = out.replace(new RegExp(regex.source, 'gi'), '[REDACTED]')
+    }
+    return out
+  }
 }