@mycadet/assistant 0.12.7-dev.202610111049.d2b52a8 → 0.12.8

package/src/runtime/routes/__tests__/migration-cadet-metadata-reconcile.test.ts

@@ -2,13 +2,12 @@
  * Tests for the post-import cadet metadata reconciliation helper.
  *
  * After every bundle import, `reconcileCadetMetadataFromCes` walks the
- * cloud-identity fields the gateway requires and, for each one that
+ * cadet credentials the gateway requires and, for each one that
  * CES already holds a value for, ensures `metadata.json` lists a
  * matching entry. This closes the race where a provisioning write to
  * CES completes successfully but its metadata upsert gets clobbered by
  * the import's in-place clear or atomic swap. The reconciled set covers
- * the Django-provisioned fields (assistant_api_key, platform_assistant_id,
- * webhook_secret).
+ * the Django-provisioned credentials (assistant_api_key, webhook_secret).
  *
  * We test the reconcile logic in isolation by mocking the secure-keys
  * and metadata-store modules — the real migration handler wires the
@@ -38,11 +37,7 @@ type MetadataRecord = {
   updatedAt: number;
 };
 
-const CADET_FIELDS = [
-  "assistant_api_key",
-  "platform_assistant_id",
-  "webhook_secret",
-] as const;
+const CADET_FIELDS = ["assistant_api_key", "webhook_secret"] as const;
 
 const upsertCalls: Array<{ service: string; field: string }> = [];
 let metadataStore: Map<string, MetadataRecord> = new Map();
@@ -171,7 +166,6 @@ describe("reconcileCadetMetadataFromCes", () => {
     const reconciled = new Set(upsertCalls.map((c) => c.field));
     // Django-provisioned trio.
     expect(reconciled).toContain("assistant_api_key");
-    expect(reconciled).toContain("platform_assistant_id");
     expect(reconciled).toContain("webhook_secret");
   });
 

package/src/runtime/routes/__tests__/migration-import-credential-filter.test.ts

@@ -110,7 +110,7 @@ describe("migration import credential filtering", () => {
   test("platform (cadet:*) credentials are excluded", () => {
     const cadetFields = [
       "assistant_api_key",
-      "platform_assistant_id",
+      "cloud_assistant_id",
       "webhook_secret",
     ] as const;
     const cadetPaths = cadetFields.map((f) =>
@@ -163,7 +163,7 @@ describe("migration import credential filtering", () => {
 
   test("mixed bundle with both platform and user credentials correctly splits", () => {
     const cadetApiKey = credentialKey("cadet", "assistant_api_key");
-    const cadetUserId = credentialKey("cadet", "platform_assistant_id");
+    const cadetUserId = credentialKey("cadet", "cloud_assistant_id");
     const openaiKey = credentialKey("openai", "api_key");
     const anthropicKey = credentialKey("anthropic", "api_key");
     const githubToken = credentialKey("github", "api_token");
@@ -203,7 +203,7 @@ describe("migration import credential filtering", () => {
 
   test("skippedCloud count is accurate with mixed credentials", () => {
     const cadetApiKey = credentialKey("cadet", "assistant_api_key");
-    const cadetAssistantId = credentialKey("cadet", "platform_assistant_id");
+    const cadetAssistantId = credentialKey("cadet", "cloud_assistant_id");
     const cadetWebhook = credentialKey("cadet", "webhook_secret");
     const userKey = credentialKey("github", "api_token");
 

package/src/runtime/routes/cloud-routes.ts

@@ -8,8 +8,8 @@
  *   - platform_connect (POST platform/connect): reports whether the stored
  *     credentials still connect, and when the stored key has been rejected,
  *     says so, so the caller can tell the user what replaces it.
- *   - platform_disconnect (POST platform/disconnect): deletes stored platform
- *     credentials and emits platform_disconnected signal.
+ *   - platform_disconnect (POST platform/disconnect): deletes stored cloud
+ *     credentials and emits cloud_disconnected signal.
  *   - platform_callback_routes_register (POST platform/callback-routes/register):
  *     registers a callback route with the cloud gateway.
  *   - platform_callback_routes_list (GET platform/callback-routes): lists
@@ -76,7 +76,6 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const CREDENTIAL_KEYS = {
   apiKey: { service: "cadet", field: "assistant_api_key" },
-  assistantId: { service: "cadet", field: "platform_assistant_id" },
 } as const;
 
 // ---------------------------------------------------------------------------
@@ -116,13 +115,11 @@ export type PlatformConnectResponse = z.infer<
   typeof PlatformConnectResponseSchema
 >;
 
-const PlatformDisconnectResponseSchema = z.object({
+const CloudDisconnectResponseSchema = z.object({
   disconnected: z.literal(true),
   previousBaseUrl: z.string().nullable(),
 });
-type PlatformDisconnectResponse = z.infer<
-  typeof PlatformDisconnectResponseSchema
->;
+type CloudDisconnectResponse = z.infer<typeof CloudDisconnectResponseSchema>;
 
 const CallbackRouteRegisterRequestSchema = z.object({
   path: z.string(),
@@ -398,9 +395,9 @@ async function handlePlatformVerifyCredential(
   return { status: await verifyStoredCredential() };
 }
 
-async function handlePlatformDisconnect(
+async function handleCloudDisconnect(
   _args: RouteHandlerArgs,
-): Promise<PlatformDisconnectResponse> {
+): Promise<CloudDisconnectResponse> {
   // Reject if running inside a cloud host
   if (isCloudRemote()) {
     throw new UnprocessableEntityError(
@@ -420,11 +417,10 @@ async function handlePlatformDisconnect(
     );
   }
 
-  // Delete all cloud credentials
-  const keysToDelete = [
-    CREDENTIAL_KEYS.apiKey,
-    CREDENTIAL_KEYS.assistantId,
-  ] as const;
+  // Delete the stored cloud credential. The cloud_*_id fields are not
+  // credentials — they resolve from the api key via validate and live only
+  // in the in-memory identity, cleared right below.
+  const keysToDelete = [CREDENTIAL_KEYS.apiKey] as const;
 
   const failedKeys: string[] = [];
   for (const key of keysToDelete) {
@@ -447,7 +443,7 @@ async function handlePlatformDisconnect(
   setCloudUserId(undefined);
 
   // Notify connected clients
-  broadcastMessage({ type: "platform_disconnected" });
+  broadcastMessage({ type: "cloud_disconnected" });
 
   return {
     disconnected: true,
@@ -945,10 +941,10 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Disconnect from Cadet Cloud",
     description:
-      "Deletes stored cloud credentials and emits platform_disconnected signal to connected clients.",
+      "Deletes stored cloud credentials and emits cloud_disconnected signal to connected clients.",
     tags: ["platform"],
-    handler: handlePlatformDisconnect,
-    responseBody: PlatformDisconnectResponseSchema,
+    handler: handleCloudDisconnect,
+    responseBody: CloudDisconnectResponseSchema,
   },
   {
     operationId: "platform_callback_routes_register",

package/src/runtime/routes/conversation-query-routes.ts

@@ -35,7 +35,6 @@ import {
   scrubNulledChatSettings,
   validateChatSettingsWrite,
 } from "../../config/chat-settings.js";
-import { DefaultProviderSelectionSchema } from "../../config/default-provider.js";
 import {
   catalogEntryFor,
   type InputModalities,
@@ -44,10 +43,9 @@ import {
 } from "../../config/input-modalities.js";
 import {
   deepMergeOverwrite,
-  fillContextDefaultsForMissingKeys,
   getConfig,
-  getDeploymentContextDefaults,
   invalidateConfigCache,
+  loadConfig,
   loadRawConfig,
   saveRawConfig,
   setNestedValue,
@@ -58,22 +56,21 @@ import {
   completeCustomProfile,
   mergePreservingUnknownKeys,
 } from "../../config/profile-materialization.js";
-import { AssistantConfigSchema } from "../../config/schema.js";
+import {
+  type AssistantConfig,
+  AssistantConfigSchema,
+} from "../../config/schema.js";
 import { getSchemaAtPath } from "../../config/schema-utils.js";
-import { AutoArchiveConfigSchema } from "../../config/schemas/conversations.js";
 import {
   collectFallbackProfileIssues,
-  isDefaultProviderChoice,
   LLMConfigBase,
   LLMConfigFragment,
-  LLMDefaultConfigSchema,
   LLMSchema,
   ProfileEntry,
   routingIdentityModelIssue,
   unknownLlmProviderIssue,
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
-import { NotificationsConfigSchema } from "../../config/schemas/notifications.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
 import { isSidebarDoneEnabled } from "../../config/sidebar-done-gate.js";
 import {
@@ -526,85 +523,6 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
   }
 }
 
-/**
- * Apply deployment-context defaults to a raw config payload before it goes
- * out over the wire from `GET /v1/config`. The in-memory `loadConfig()`
- * already layers these defaults for daemon-internal consumers; the GET
- * response needs the same treatment so external clients (macOS, web, CLI)
- * see the effective value rather than `undefined` when the daemon hasn't
- * persisted an explicit choice yet. For example, on a freshly-hatched
- * cloud assistant, `services.image-generation.provider` may be
- * absent from disk (only `llm.profiles` was written by
- * `seedInferenceProfiles`); the fill pass ensures clients receive `"cadet"`
- * rather than falling back to their own defaults.
- *
- * Guards against `loadRawConfig()` handing us a value that is technically
- * valid JSON but not a plain object (e.g. literal `null`, a number, or an
- * array). `loadRawConfig` is typed `Record<string, unknown>` but `JSON.parse`
- * itself doesn't enforce that — a malformed-but-parseable `config.json`
- * would blow up `fillContextDefaultsForMissingKeys` on its `target[key]` /
- * `fileConfig[key]` accesses, turning `GET /v1/config` into a 500 where it
- * used to succeed (returning the malformed payload as-is). When `raw` is
- * not a plain object, we return it unchanged.
- *
- * Exported for direct unit testing.
- */
-export function applyContextDefaultsToRawConfig(raw: unknown): unknown {
-  const contextDefaults = getDeploymentContextDefaults();
-  if (
-    Object.keys(contextDefaults).length === 0 ||
-    raw === null ||
-    typeof raw !== "object" ||
-    Array.isArray(raw)
-  ) {
-    return raw;
-  }
-  fillContextDefaultsForMissingKeys(
-    raw as Record<string, unknown>,
-    raw as Record<string, unknown>,
-    contextDefaults,
-  );
-  synthesizeLegacyInferenceModeForPlatform(raw as Record<string, unknown>);
-  return raw;
-}
-
-/**
- * Backwards-compat wire field for `GET /v1/config`. PR removed
- * `services.inference.mode` from the typed schema (routing is governed by
- * `provider_connections` rows + per-profile `provider_connection`), but
- * the macOS settings client (`SettingsStore.swift:loadServiceModes`) still
- * reads this field and falls back to its `@Published` default of "your-own"
- * when absent. On a cloud assistant served by a newer daemon and
- * an older macOS client, that fallback would show the wrong mode in the UI
- * until the user explicitly saved. Synthesize the value here so the wire
- * shape stays compatible during the rollout window. Remove once the macOS
- * Providers UI (the follow-up PR that retires this field on the client) has
- * shipped to the majority of installs.
- *
- * The synthesis is wire-only: it never persists to disk and never reaches
- * the typed `AssistantConfig` consumed by daemon-internal code. The on-disk
- * config is stripped of `mode` by workspace migration 076.
- *
- * Only runs when this function is reached, which is guarded by
- * `getDeploymentContextDefaults()` returning non-empty (IS_CLOUD=true).
- */
-function synthesizeLegacyInferenceModeForPlatform(
-  root: Record<string, unknown>,
-): void {
-  const services = readPlainObject(root.services);
-  if (!services) {
-    return;
-  }
-  let inference = readPlainObject(services.inference);
-  if (!inference) {
-    inference = {};
-    services.inference = inference;
-  }
-  if (inference.mode === undefined) {
-    inference.mode = "managed";
-  }
-}
-
 function readPlainObject(value: unknown): Record<string, unknown> | undefined {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return undefined;
@@ -732,13 +650,6 @@ function nestPath(path: string, value: unknown): unknown {
   return current;
 }
 
-const WireProfileEntry = ProfileEntry.extend({
-  supportsVision: z.boolean().optional(),
-  invariant: z.boolean().optional(),
-})
-  .passthrough()
-  .meta({ id: "ProfileEntry" });
-
 /**
  * Wire shape of the `memory` section in config responses. Passthrough
  * preserves fields beyond `enabled` and `v2` so the client doesn't strip
@@ -752,97 +663,6 @@ const MemoryWireConfigSchema = z
   .passthrough()
   .meta({ id: "MemoryConfig" });
 
-/**
- * Response schema for `GET /v1/config`.
- *
- * Describes the wire shape of the raw `settings.json` response after
- * context-default filling and vision-flag enrichment. Chat settings include
- * effective defaults. Fields remain optional for older assistants and sparse
- * on-disk config. Additional top-level sections are preserved via
- * passthrough. This schema types the fields that web/macOS clients consume
- * without restricting the full config surface.
- */
-const ConfigGetResponseSchema = z
-  .object({
-    // A malformed or absent stored chat-settings subtree falls back to its
-    // schema defaults so one bad leaf can't fail the whole wire parse (which
-    // would strip every derived field from the response); the chat-settings
-    // read overlay refills both from the effective config.
-    conversations: z
-      .object({
-        autoArchive: AutoArchiveConfigSchema.passthrough().catch(
-          AutoArchiveConfigSchema.parse({}),
-        ),
-      })
-      .passthrough()
-      .optional(),
-    notifications: NotificationsConfigSchema.passthrough()
-      .optional()
-      .catch(undefined),
-    llm: z
-      .object({
-        default: LLMDefaultConfigSchema.optional(),
-        // Wire-compat view of the default provider, derived from `default`
-        // by the read overlay (the key is never stored anymore).
-        defaultProvider: DefaultProviderSelectionSchema.optional(),
-        profiles: z.record(z.string(), WireProfileEntry).optional(),
-        profileOrder: z.array(z.string()).optional(),
-        activeProfile: z.string().optional(),
-        // The profile the advisor consults; excluded from chat-profile pickers.
-        advisorProfile: z.string().optional(),
-        callSites: z
-          .record(
-            z.string(),
-            LLMConfigFragment.extend({
-              profile: z.string().optional(),
-            }).nullable(),
-          )
-          .optional(),
-        profileSession: z
-          .object({
-            defaultTtlSeconds: z.number().optional(),
-            maxTtlSeconds: z.number().optional(),
-          })
-          .optional(),
-        pricingOverrides: z.array(z.unknown()).optional(),
-      })
-      .passthrough()
-      .optional(),
-    memory: MemoryWireConfigSchema.optional(),
-    services: z
-      .object({
-        "web-search": z
-          .object({
-            provider: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        "web-fetch": z
-          .object({
-            provider: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        "image-generation": z
-          .object({
-            provider: z.string().optional(),
-            model: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        inference: z
-          .object({ mode: ServiceModeSchema.optional() })
-          .passthrough()
-          .optional(),
-      })
-      .passthrough()
-      .optional(),
-  })
-  .passthrough()
-  .meta({ id: "ConfigGetResponse" });
-
-type ConfigGetResponse = z.infer<typeof ConfigGetResponseSchema>;
-
 /**
  * Given a `z.object(...)` schema, returns a new schema where every property
  * is `.nullable().optional()`. Used to express PATCH body semantics where any
@@ -880,7 +700,7 @@ const CallSiteOverrideDraftSchema = nullablePartial(
  *
  * Mirrors the response shape but every field is `.nullable().optional()`:
  * omitted keys are left unchanged by the daemon's deep-merge, `null` values
- * delete the key. Uses the same Zod enums as `ConfigGetResponseSchema` so
+ * delete the key. Uses the same Zod enums as `AssistantConfigSchema` so
  * the generated SDK produces literal-union types — no hand-written patch
  * types needed downstream.
  */
@@ -953,54 +773,37 @@ const ConfigPatchRequestSchema = z
   .passthrough()
   .meta({ id: "ConfigPatchRequest" });
 
+/**
+ * The response contract for `GET`/`PATCH /v1/config` — the five subtrees
+ * external clients actually read, picked out of the full graph. Rendering
+ * the whole `AssistantConfigSchema` into the spec blasted openapi.yaml past
+ * 12K lines; we're not ready to trim the response schema itself yet, so the
+ * runtime still returns the full config and the spec documents these.
+ */
+const ConfigGetResponseSchema = AssistantConfigSchema.pick({
+  conversations: true,
+  notifications: true,
+  llm: true,
+  memory: true,
+  services: true,
+});
+
 function handleGetConfig() {
   try {
-    const config = applyContextDefaultsToRawConfig(loadRawConfig());
-    // One zod pass shapes the response: ConfigGetResponseSchema is this
-    // route's wire contract, so the overlays stamp their derived fields on
-    // the parsed view instead of digging handles out of raw objects. A
-    // config the schema rejects gets no overlays and is served raw.
-    const parsed = ConfigGetResponseSchema.safeParse(config);
-    if (!parsed.success) {
-      return config;
-    }
-    const wire = parsed.data;
-    overlayWorkspaceMcpForConfigRead(wire);
-    sanitizeMcpTransportHeadersForSettingsRead(wire);
-    overlayEffectiveProfilesForWire(wire);
-    enrichProfilesForWire(wire);
-    overlayDefaultProviderForWire(wire);
-    overlayChatSettingsForWire(wire);
-    return wire;
+    const config = loadConfig();
+    overlayWorkspaceMcpForConfigRead(config);
+    sanitizeMcpTransportHeadersForSettingsRead(config);
+    overlayEffectiveProfilesForWire(config);
+    enrichProfilesForWire(config);
+    overlayChatSettingsForWire(config);
+    return config;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     throw new InternalError(`Failed to read config: ${message}`);
   }
 }
 
-/**
- * Surface the default-provider selection on config reads. The selection lives
- * in the `llm.default` blob; the dedicated `defaultProvider` response field is
- * a derived wire-compat view (readers of the config GET predate the blob) and
- * is never stored on disk — it is stamped here from the blob on every read.
- */
-function overlayDefaultProviderForWire(config: ConfigGetResponse): void {
-  if (!config.llm) {
-    return;
-  }
-  const blob = config.llm.default;
-  const provider = blob?.provider;
-  if (provider != null && isDefaultProviderChoice(provider)) {
-    config.llm.defaultProvider = {
-      provider,
-      connectionName: blob?.provider_connection,
-    };
-  } else {
-    delete config.llm.defaultProvider;
-  }
-}
-
-function overlayChatSettingsForWire(config: ConfigGetResponse): void {
+function overlayChatSettingsForWire(config: AssistantConfig): void {
   const effective = getConfig();
   config.conversations = {
     ...config.conversations,
@@ -1033,10 +836,7 @@ function overlayChatSettingsForWire(config: ConfigGetResponse): void {
  * shields the matrix lookup from a persisted value the matrix cannot
  * implement, which a raw read would feed straight into resolution.
  */
-function overlayEffectiveProfilesForWire(config: ConfigGetResponse): void {
-  if (!config.llm) {
-    config.llm = {};
-  }
+function overlayEffectiveProfilesForWire(config: AssistantConfig): void {
   const parsedLlm = LLMSchema.safeParse(config.llm);
   config.llm.profiles = getUserSelectableProfilesForProvider(
     parsedLlm.success ? parsedLlm.data : undefined,

package/src/runtime/routes/migration-routes.ts

@@ -119,18 +119,17 @@ import { RouteResponse } from "./types.js";
 const PLATFORM_CREDENTIAL_PREFIX = credentialKey("cadet", "");
 
 /**
- * Platform-identity fields that the cloud runtime expects to see in CES.
- * On a cloud assistant the cloud provisions these after hatch (most via
- * `POST /v1/secrets`). A signed-in client may additionally (re)assert some of
+ * Cadet credentials that the cloud runtime expects to see in CES.
+ * On a cloud assistant the cloud provisions these after hatch via
+ * `POST /v1/secrets`. A signed-in client may additionally (re)assert some of
  * them on teleport / local→managed transfer. Either set of writes can race with
  * the import — the CES write survives (separate volume), but the metadata
  * upsert may be clobbered by the in-place clear / atomic swap. After every
  * import we reconcile metadata.json against CES so any field CES already holds
  * a value for gets a matching metadata entry.
  */
-const CADET_PLATFORM_IDENTITY_FIELDS = [
+const CADET_CREDENTIAL_FIELDS = [
   "assistant_api_key",
-  "platform_assistant_id",
   "webhook_secret",
 ] as const;
 
@@ -145,7 +144,7 @@ const CADET_PLATFORM_IDENTITY_FIELDS = [
 export async function reconcileCadetMetadataFromCes(warningSink: {
   warnings: string[];
 }): Promise<void> {
-  for (const field of CADET_PLATFORM_IDENTITY_FIELDS) {
+  for (const field of CADET_CREDENTIAL_FIELDS) {
     try {
       const value = await getSecureKeyAsync(credentialKey("cadet", field));
       if (!value) {

package/src/runtime/routes/secret-routes.ts

@@ -21,10 +21,7 @@ import { getCloudAssistantId } from "../../config/env.js";
 import { getConfig } from "../../config/loader.js";
 import { getCesClient } from "../../credential-execution/ces-runtime.js";
 import type { CesClient } from "../../credential-execution/client.js";
-import {
-  isNonSecretPlatformField,
-  scrubStoredCredentialFromTranscripts,
-} from "../../daemon/credential-transcript-scrub.js";
+import { scrubStoredCredentialFromTranscripts } from "../../daemon/credential-transcript-scrub.js";
 import { syncManualTokenConnection } from "../../oauth/manual-token-connection.js";
 import { maybeReseedCapabilitiesAfterCloudCredential } from "../../plugins/defaults/memory/substrate/boot-maintenance.js";
 import { validateAnthropicApiKey } from "../../providers/anthropic/client.js";
@@ -97,20 +94,11 @@ async function persistCredential(
       `Failed to store credential in secure storage (backend: ${getActiveBackendName()})`,
     );
   }
-  if (!isNonSecretPlatformField(service, field)) {
-    try {
-      const scrubbed = await scrubStoredCredentialFromTranscripts(value);
-      log.info(
-        { service, field, ...scrubbed },
-        "Credential stored; scrubbed value from recent transcripts",
-      );
-    } catch (err) {
-      log.warn(
-        { err, service, field },
-        "Credential stored, but transcript scrub failed",
-      );
-    }
-  }
+  const scrubbed = await scrubStoredCredentialFromTranscripts(value);
+  log.info(
+    { service, field, ...scrubbed },
+    "Credential stored; scrubbed value from recent transcripts",
+  );
   upsertCredentialMetadata(service, field, {});
   await syncManualTokenConnection(service);
 }
@@ -326,19 +314,12 @@ async function handleAddSecret({ body }: RouteHandlerArgs) {
       // refresh: that side effect can throw, and a stored-but-unscrubbed key
       // must not depend on it succeeding. The key IS stored at this point;
       // the scrub is best-effort hygiene and must stay invisible to the
-      // caller. Counts only — never the value.
-      try {
-        const scrubbed = await scrubStoredCredentialFromTranscripts(value);
-        log.info(
-          { provider: name, ...scrubbed },
-          "API key stored; scrubbed value from recent transcripts",
-        );
-      } catch (err) {
-        log.warn(
-          { err, provider: name },
-          "API key stored, but transcript scrub failed",
-        );
-      }
+      // Counts only — never the value.
+      const scrubbed = await scrubStoredCredentialFromTranscripts(value);
+      log.info(
+        { provider: name, ...scrubbed },
+        "API key stored; scrubbed value from recent transcripts",
+      );
 
       await refreshProvidersAfterSecretChange();
       log.info({ provider: name }, "API key updated via HTTP");

package/src/tools/credentials/store.ts

@@ -137,22 +137,13 @@ export async function storeCredentialValue(
   // also fires on OAuth refresh rotations and MCP header writes whose values
   // never transited a transcript.
   if (!input.skipTranscriptScrub) {
-    const { isNonSecretPlatformField, scrubStoredCredentialFromTranscripts } =
+    const { scrubStoredCredentialFromTranscripts } =
       await import("../../daemon/credential-transcript-scrub.js");
-    if (!isNonSecretPlatformField(service, field)) {
-      try {
-        const scrubbed = await scrubStoredCredentialFromTranscripts(value);
-        log.info(
-          { service, field, ...scrubbed },
-          "Credential stored; scrubbed value from recent transcripts",
-        );
-      } catch (err) {
-        log.warn(
-          { err, service, field },
-          "Credential stored, but transcript scrub failed",
-        );
-      }
-    }
+    const scrubbed = await scrubStoredCredentialFromTranscripts(value);
+    log.info(
+      { service, field, ...scrubbed },
+      "Credential stored; scrubbed value from recent transcripts",
+    );
   }
 
   const metadata = upsertCredentialMetadata(service, field, {