@newrelic/preflight 1.67.2 → 1.68.0

package/README.md

@@ -77,7 +77,7 @@ See cost breakdown, efficiency scoring, anti-patterns, and live session tracking
 npm install -g @newrelic/preflight
 ```
 
-> **Using [Smithery](https://smithery.ai)?** Installing Preflight from the Smithery MCP registry wires up the MCP server for you, but Smithery has no mechanism to write Claude Code hooks. After install, ask Claude Code to call the `nr_observe_install_hooks` MCP tool (it will offer to do this automatically once `nr_observe_health` reports `setup_required: true`), then restart Claude Code to activate monitoring.
+> **Using [Smithery](https://smithery.ai)?** Installing Preflight from the Smithery MCP registry wires up the MCP server for you, but Smithery has no mechanism to write Claude Code hooks. After install, either run `preflight install` in a terminal, or set `"allowHeadlessInstall": true` in your Preflight config (or `NEW_RELIC_AI_ALLOW_HEADLESS_INSTALL=true`) and ask Claude Code to call the `nr_observe_install_hooks` MCP tool. The tool refuses by default, because any connected MCP client can call it. With the flag on, it offers to do this automatically once `nr_observe_health` reports `setup_required: true`. Then restart Claude Code to activate monitoring.
 
 ### 2. Run setup
 
@@ -218,6 +218,7 @@ Add `--project` to `install`/`uninstall` to scope changes to the current directo
 - [**SCORECARDS.md**](docs/SCORECARDS.md) — New Relic Scorecard rules for team attribution
 - [**ARCHITECTURE.md**](docs/ARCHITECTURE.md) — Data flow, component reference, and operating modes
 - [**ADAPTERS.md**](docs/ADAPTERS.md) — Per-platform integration mechanism, setup steps, and known gaps
+- [**FLEET_DEPLOYMENT.md**](docs/FLEET_DEPLOYMENT.md) — Roll out the Claude Code plugin to many machines with managed settings and MDM
 - [**TROUBLESHOOTING.md**](docs/TROUBLESHOOTING.md) — Common setup and connection problems, and how to fix them
 - [**CONTRIBUTING.md**](CONTRIBUTING.md) — Development, testing, submitting PRs
 - [**SECURITY.md**](./SECURITY.md) — Security guidelines and best practices

package/dist/config.d.ts

@@ -4,6 +4,8 @@ import type { CliOptions } from './types.js';
 import type { UpstreamConfig } from './proxy/types.js';
 import type { PersonalAlertThresholds } from './alerts/types.js';
 import type { ResolvedTier } from './transport/tier-types.js';
+import { SecretCommandError } from './secret-command.js';
+import type { SecretSources } from './secret-command.js';
 export declare const VALID_MODES: readonly ["cloud", "local", "both"];
 export type Mode = (typeof VALID_MODES)[number];
 export type CompanionModeSource = 'env NR_AI_COMPANION_MODE' | 'config file' | 'detected Claude Code OTel export' | 'default';
@@ -43,6 +45,14 @@ export interface McpServerConfig {
      * (session_id === OTel's session.id). See docs/ADVANCED.md § Companion mode.
      */
     readonly companionMode: boolean;
+    /**
+     * Lets the `nr_observe_install_hooks` MCP tool rewrite ~/.claude/settings.json.
+     * Default false: any connected MCP client can call the tool, so it is opt-in.
+     * See docs/ADVANCED.md § allowHeadlessInstall.
+     */
+    readonly allowHeadlessInstall: boolean;
+    /** Source of the resolved companionMode value (env, config file, detected, or default). */
+    readonly companionModeSource: CompanionModeSource;
     readonly redactionPatterns: readonly RegExp[];
     readonly hookBufferPath: string;
     readonly storagePath: string;
@@ -58,6 +68,8 @@ export interface McpServerConfig {
     readonly collectorHost: string | null;
     readonly proxyUpstreams: readonly UpstreamConfig[];
     readonly nrApiKey: string | null;
+    /** Which source supplied each secret. Never the value. */
+    readonly secretSources: SecretSources;
     /** Path to a custom pricing JSON file, applied via `initPricing()`. See `NEW_RELIC_AI_CUSTOM_PRICING_FILE`. */
     readonly customPricingFile: string | null;
     /**
@@ -154,6 +166,7 @@ export interface McpServerConfig {
 }
 export declare const DEFAULT_STORAGE_PATH: string;
 export type PlatformTarget = 'native' | 'wsl-windows-cc' | 'wsl-linux-cc';
+export declare const SecretCommandSchema: z.ZodArray<z.ZodString>;
 export declare const ConfigFileSchema: z.ZodObject<{
     configVersion: z.ZodOptional<z.ZodNumber>;
     licenseKey: z.ZodOptional<z.ZodString>;
@@ -171,6 +184,7 @@ export declare const ConfigFileSchema: z.ZodObject<{
     recordContent: z.ZodOptional<z.ZodBoolean>;
     pricingRefresh: z.ZodOptional<z.ZodBoolean>;
     companionMode: z.ZodOptional<z.ZodBoolean>;
+    allowHeadlessInstall: z.ZodOptional<z.ZodBoolean>;
     storagePath: z.ZodOptional<z.ZodString>;
     hookBufferPath: z.ZodOptional<z.ZodString>;
     harvestEventsMs: z.ZodOptional<z.ZodNumber>;
@@ -189,6 +203,9 @@ export declare const ConfigFileSchema: z.ZodObject<{
     proxyUpstreams: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     tiers: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     nrApiKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    licenseKeyCommand: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    nrApiKeyCommand: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    digestWebhookUrlCommand: z.ZodOptional<z.ZodArray<z.ZodString>>;
     customPricingFile: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     costRateMultiplier: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     dataResidencyPremium: z.ZodOptional<z.ZodBoolean>;
@@ -273,7 +290,32 @@ export declare class MissingCloudCredentialError extends Error {
     readonly mode: Mode;
     constructor(missingField: 'licenseKey' | 'accountId', mode: Mode, configFilePath: string);
 }
-export declare function loadMcpConfig(cliOptions?: Partial<CliOptions>): Readonly<McpServerConfig>;
+/**
+ * A `SecretCommandError` raised while resolving a secret that cloud export
+ * needs. It keeps the helper's own message for stdio users and adds the mode
+ * the config asked for, so `--local` can tell a failing helper from a missing
+ * credential and still fall back to local mode.
+ */
+export declare class CloudSecretCommandError extends SecretCommandError {
+    readonly mode: Mode;
+    constructor(original: SecretCommandError, mode: Mode);
+}
+/**
+ * The startup-resolved digest webhook URL when a source that outranks the
+ * file's `digestWebhookUrl` (env var or digestWebhookUrlCommand) supplied it.
+ * Undefined means "read the file at send time".
+ */
+export declare function digestWebhookUrlOverride(config: Pick<McpServerConfig, 'digestWebhookUrl' | 'secretSources'>): string | undefined;
+export interface LoadMcpConfigOptions {
+    /**
+     * Run the `*Command` secret helpers. Pass false from callers that poll or
+     * only read non-secret fields (dashboard diagnostics, host/port lookup):
+     * `secretSources` still reports `command`, but the secrets resolve to
+     * undefined/null and `tiers` stays empty unless explicit.
+     */
+    readonly resolveSecrets?: boolean;
+}
+export declare function loadMcpConfig(cliOptions?: Partial<CliOptions>, loadOptions?: LoadMcpConfigOptions): Readonly<McpServerConfig>;
 export interface ConfigValidationResult {
     readonly filePath: string;
     readonly fileExists: boolean;
@@ -285,7 +327,7 @@ export interface ConfigValidationResult {
     readonly storagePath?: string;
     /** The `companionMode` field from the parsed config, if present and a boolean. */
     readonly companionMode?: boolean;
-    /** True when a non-blank licenseKey is present in the parsed config. Raw value is intentionally not exposed. */
+    /** True when a non-blank licenseKey or a licenseKeyCommand is present in the parsed config. Raw value is intentionally not exposed. */
     readonly hasLicenseKey: boolean;
     /** Fatal problems that will prevent the MCP server from starting. */
     readonly errors: readonly string[];
@@ -299,4 +341,17 @@ export interface ConfigValidationResult {
  */
 export declare function validateConfigFile(filePath: string): ConfigValidationResult;
 export declare function redactSensitive(value: string, patterns?: readonly RegExp[]): string;
+/**
+ * redactSensitive() for identifiers (project_id, repo_url, repo names), which
+ * carry a token only as a whole path segment or a segment's prefix. A match that
+ * starts right after a letter or digit is part of an ordinary name
+ * (`acme/risk-assessment-…` holds `sk-assessment-…`) and is left alone. The scan
+ * resumes one character later, so a token further into that span
+ * (`acme/risk-ghp_…`) is still caught.
+ *
+ * Free-form content keeps redactSensitive()'s plain matching: there a token
+ * routinely follows a letter or digit, after a JSON escape (`\nghp_…`), an ANSI
+ * colour code (`ESC[32m`) or `%3A`.
+ */
+export declare function redactIdentifier(value: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAMjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAI9D,eAAO,MAAM,WAAW,qCAAsC,CAAC;AAC/D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAC7B,0BAA0B,GAAG,aAAa,GAAG,kCAAkC,GAAG,SAAS,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,qBAAqB,CAkBvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,+GAA+G;IAC/G,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;QACtD,2DAA2D;QAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,4DAA4D;QAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC;;;;WAIG;QACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;QAC3C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,eAAO,MAAM,oBAAoB,QAA4C,CAAC;AAgB9E,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAE1E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Gb,CAAC;AAGjB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAuSD;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAER,YAAY,EAAE,YAAY,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM;CAYzF;AAED,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CA4xBzF;AAMD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,gHAAgH;IAChH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAyH3E;AAoCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CASnF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAMjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqC,MAAM,qBAAqB,CAAC;AAC5F,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzE,eAAO,MAAM,WAAW,qCAAsC,CAAC;AAC/D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAC7B,0BAA0B,GAAG,aAAa,GAAG,kCAAkC,GAAG,SAAS,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,qBAAqB,CAkBvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,2GAA2G;IAC3G,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,+GAA+G;IAC/G,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;QACtD,2DAA2D;QAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,4DAA4D;QAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC;;;;WAIG;QACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;QAC3C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,eAAO,MAAM,oBAAoB,QAA4C,CAAC;AAgB9E,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAI1E,eAAO,MAAM,mBAAmB,yBAAoC,CAAC;AAErE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmHb,CAAC;AAGjB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAuSD;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAER,YAAY,EAAE,YAAY,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM;CAYzF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,kBAAkB;IAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAER,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI;CAMrD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,kBAAkB,GAAG,eAAe,CAAC,GAClE,MAAM,GAAG,SAAS,CAKpB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,wBAAgB,aAAa,CAC3B,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAChC,WAAW,GAAE,oBAAyB,GACrC,QAAQ,CAAC,eAAe,CAAC,CAm1B3B;AAMD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,uIAAuI;IACvI,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CA2H3E;AAoCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CASnF;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBtD"}

package/dist/config.js

@@ -9,6 +9,7 @@ import { REDACTION_PATTERNS as DEFAULT_REDACTION_PATTERNS } from './redaction-pa
 import { resolveRecordContent } from './record-content-gate.js';
 import { projectIdFromRemote, stripRemoteCredentials } from './lib/git-remote.js';
 import { validateTiers, DEFAULT_TIER_NAME, WILDCARD_EVENT_TYPE } from './transport/tier-types.js';
+import { SecretCommandError, isSecretConfigured, resolveSecret } from './secret-command.js';
 const logger = createLogger('mcp-config');
 export const VALID_MODES = ['cloud', 'local', 'both'];
 function otlpEndpointIsNewRelic(endpoint) {
@@ -59,6 +60,9 @@ const DEFAULT_RETAIN_SESSIONS_DAYS = 90;
  * rather than a breaking rename — so this has never moved past 1.
  */
 const CURRENT_CONFIG_VERSION = 1;
+// argv array only: a single string would invite shell-style quoting that
+// Preflight never interprets, since the command runs without a shell.
+export const SecretCommandSchema = z.array(z.string().min(1)).min(1);
 export const ConfigFileSchema = z
     .object({
     configVersion: z.number().int().optional(),
@@ -77,6 +81,7 @@ export const ConfigFileSchema = z
     recordContent: z.boolean().optional(),
     pricingRefresh: z.boolean().optional(),
     companionMode: z.boolean().optional(),
+    allowHeadlessInstall: z.boolean().optional(),
     storagePath: z.string().optional(),
     hookBufferPath: z.string().optional(),
     harvestEventsMs: z.number().optional(),
@@ -94,6 +99,9 @@ export const ConfigFileSchema = z
     // generic union-mismatch issue.
     tiers: z.array(z.unknown()).optional(),
     nrApiKey: z.string().nullable().optional(),
+    licenseKeyCommand: SecretCommandSchema.optional(),
+    nrApiKeyCommand: SecretCommandSchema.optional(),
+    digestWebhookUrlCommand: SecretCommandSchema.optional(),
     customPricingFile: z.string().nullable().optional(),
     costRateMultiplier: z.number().nullable().optional(),
     dataResidencyPremium: z.boolean().optional(),
@@ -494,7 +502,34 @@ export class MissingCloudCredentialError extends Error {
         this.mode = mode;
     }
 }
-export function loadMcpConfig(cliOptions) {
+/**
+ * A `SecretCommandError` raised while resolving a secret that cloud export
+ * needs. It keeps the helper's own message for stdio users and adds the mode
+ * the config asked for, so `--local` can tell a failing helper from a missing
+ * credential and still fall back to local mode.
+ */
+export class CloudSecretCommandError extends SecretCommandError {
+    mode;
+    constructor(original, mode) {
+        super(original.field, original.failure);
+        this.message = original.message;
+        this.cause = original;
+        this.mode = mode;
+    }
+}
+/**
+ * The startup-resolved digest webhook URL when a source that outranks the
+ * file's `digestWebhookUrl` (env var or digestWebhookUrlCommand) supplied it.
+ * Undefined means "read the file at send time".
+ */
+export function digestWebhookUrlOverride(config) {
+    const source = config.secretSources.digestWebhookUrl;
+    return (source === 'env' || source === 'command') && config.digestWebhookUrl !== null
+        ? config.digestWebhookUrl
+        : undefined;
+}
+export function loadMcpConfig(cliOptions, loadOptions = {}) {
+    const skipCommand = loadOptions.resolveSecrets === false;
     const configFilePath = cliOptions?.config ?? resolve(DEFAULT_STORAGE_PATH, 'config.json');
     const file = loadConfigFile(configFilePath);
     // Warn (don't crash) when the user's config file contains keys we don't
@@ -578,11 +613,17 @@ export function loadMcpConfig(cliOptions) {
             });
         }
     }
-    // --- licenseKey: CLI has no flag for this, so env > file ---
-    // Hoisted ahead of mode resolution: an ambiguous licenseKey-without-mode
-    // config must fail closed instead of silently defaulting to 'cloud'.
-    const licenseKeyRaw = process.env.NEW_RELIC_LICENSE_KEY ??
-        (typeof file.licenseKey === 'string' ? file.licenseKey : undefined);
+    // --- licenseKey: CLI has no flag for this, so env > licenseKeyCommand > file ---
+    // Presence is checked ahead of mode resolution: an ambiguous
+    // licenseKey-without-mode config must fail closed instead of silently
+    // defaulting to 'cloud'. The command itself runs only after mode resolves,
+    // so a local-mode process never runs it.
+    const licenseKeySources = {
+        env: process.env.NEW_RELIC_LICENSE_KEY,
+        command: file.licenseKeyCommand,
+        file: typeof file.licenseKey === 'string' ? file.licenseKey : undefined,
+    };
+    const licenseKeyConfigured = isSecretConfigured(licenseKeySources);
     // --- Resolve mode early so we can gate licenseKey/accountId requirements ---
     // File mode is already validated by the zod schema in loadConfigFile.
     const isValidMode = (v) => v !== undefined && VALID_MODES.includes(v);
@@ -598,7 +639,7 @@ export function loadMcpConfig(cliOptions) {
     else if (fileMode !== undefined) {
         mode = fileMode;
     }
-    else if (licenseKeyRaw) {
+    else if (licenseKeyConfigured) {
         // Local-first default (README): telemetry export is opt-in, so a config
         // with credentials but no explicit mode must not silently export.
         throw new Error('Config has a licenseKey but no explicit mode. Telemetry export is opt-in: set "mode": "cloud" (or "both") in the config file, set NR_AI_MODE, or remove the credentials for local-only use. Previous versions implicitly defaulted to cloud.');
@@ -606,7 +647,19 @@ export function loadMcpConfig(cliOptions) {
     else {
         mode = 'local';
     }
-    if (mode !== 'local' && !licenseKeyRaw) {
+    let licenseKeySecret;
+    try {
+        licenseKeySecret = resolveSecret('licenseKey', mode === 'local' ? { ...licenseKeySources, command: undefined } : licenseKeySources, { skipCommand });
+    }
+    catch (err) {
+        if (err instanceof SecretCommandError)
+            throw new CloudSecretCommandError(err, mode);
+        throw err;
+    }
+    const licenseKeyRaw = licenseKeySecret.value;
+    if (mode !== 'local' &&
+        !licenseKeyRaw &&
+        !(skipCommand && licenseKeySecret.source === 'command')) {
         throw new MissingCloudCredentialError('licenseKey', mode, configFilePath);
     }
     // Reject the literal string "null" — it's truthy but not a valid key
@@ -617,8 +670,8 @@ export function loadMcpConfig(cliOptions) {
     }
     // In local mode, undefined if licenseKey is missing (NR transport won't be used)
     const licenseKey = licenseKeyRaw;
-    // --- accountId: env > file ---
-    const accountIdRaw = process.env.NEW_RELIC_ACCOUNT_ID ??
+    // --- accountId: env > file; a blank env var counts as unset, as for the secrets ---
+    const accountIdRaw = (process.env.NEW_RELIC_ACCOUNT_ID?.trim() ? process.env.NEW_RELIC_ACCOUNT_ID : undefined) ??
         (typeof file.accountId === 'string' ? file.accountId : undefined);
     if (mode !== 'local' && !accountIdRaw) {
         throw new MissingCloudCredentialError('accountId', mode, configFilePath);
@@ -662,8 +715,9 @@ export function loadMcpConfig(cliOptions) {
         (typeof file.storagePath === 'string' ? file.storagePath : DEFAULT_STORAGE_PATH);
     // highSecurity must be resolved before recordContent so it can override it
     const highSecurity = envBool('NEW_RELIC_AI_HIGH_SECURITY', typeof file.highSecurity === 'boolean' ? file.highSecurity : false);
-    const resolvedProjectId = sanitizeOrgField(process.env.NEW_RELIC_AI_PROJECT_ID ??
-        (typeof file.projectId === 'string' ? file.projectId : inferProjectId()));
+    const rawProjectId = process.env.NEW_RELIC_AI_PROJECT_ID ??
+        (typeof file.projectId === 'string' ? file.projectId : inferProjectId());
+    const resolvedProjectId = sanitizeOrgField(rawProjectId === null ? null : redactIdentifier(rawProjectId));
     // Dedicated opt-out, independent of projectId's — repo_url can carry an
     // internal git host that org/repo alone doesn't, so it gets its own toggle
     // rather than riding along on projectId's. Defaults on; the setup wizard
@@ -677,17 +731,32 @@ export function loadMcpConfig(cliOptions) {
     const rawRepoUrl = process.env.NEW_RELIC_AI_REPO_URL ??
         (typeof file.repoUrl === 'string' ? file.repoUrl : getGitRemoteUrl());
     // stripRemoteCredentials drops URL userinfo and query strings;
-    // redactSensitive then catches any token elsewhere in the value.
+    // redactIdentifier then catches any token elsewhere in the value.
     const strippedRepoUrl = stripRemoteCredentials(rawRepoUrl);
-    const resolvedRepoUrl = sanitizeOrgField(strippedRepoUrl === null ? null : redactSensitive(strippedRepoUrl));
+    const resolvedRepoUrl = sanitizeOrgField(strippedRepoUrl === null ? null : redactIdentifier(strippedRepoUrl));
     const resolvedCompanionMode = resolveCompanionMode(process.env, typeof file.companionMode === 'boolean' ? file.companionMode : undefined);
     logger.info('Companion mode resolved', {
         value: resolvedCompanionMode.value,
         source: resolvedCompanionMode.source,
     });
+    const nrApiKeySecret = resolveSecret('nrApiKey', {
+        env: process.env.NEW_RELIC_API_KEY,
+        command: mode === 'local' ? undefined : file.nrApiKeyCommand,
+        file: typeof file.nrApiKey === 'string' ? file.nrApiKey : undefined,
+    }, { optional: true, skipCommand });
+    const digestWebhookUrlSecret = resolveSecret('digestWebhookUrl', {
+        env: process.env.NEW_RELIC_AI_DIGEST_WEBHOOK_URL,
+        command: file.digestWebhookUrlCommand,
+        file: typeof file.digestWebhookUrl === 'string' ? file.digestWebhookUrl : undefined,
+    }, { optional: true, skipCommand });
     const config = {
         licenseKey,
         accountId,
+        secretSources: {
+            licenseKey: licenseKeySecret.source,
+            nrApiKey: nrApiKeySecret.source,
+            digestWebhookUrl: digestWebhookUrlSecret.source,
+        },
         configVersion: typeof file.configVersion === 'number' ? file.configVersion : CURRENT_CONFIG_VERSION,
         appName: process.env.NEW_RELIC_AI_MCP_APP_NAME ??
             (typeof file.appName === 'string' ? file.appName : 'preflight'),
@@ -707,6 +776,10 @@ export function loadMcpConfig(cliOptions) {
             ? false
             : envBool('NEW_RELIC_AI_PRICING_REFRESH', typeof file.pricingRefresh === 'boolean' ? file.pricingRefresh : true),
         companionMode: resolvedCompanionMode.value,
+        companionModeSource: resolvedCompanionMode.source,
+        allowHeadlessInstall: highSecurity
+            ? false
+            : envBool('NEW_RELIC_AI_ALLOW_HEADLESS_INSTALL', typeof file.allowHeadlessInstall === 'boolean' ? file.allowHeadlessInstall : false),
         redactionPatterns: DEFAULT_REDACTION_PATTERNS,
         hookBufferPath: process.env.NEW_RELIC_AI_MCP_BUFFER_PATH ??
             (typeof file.hookBufferPath === 'string'
@@ -772,7 +845,7 @@ export function loadMcpConfig(cliOptions) {
         collectorHost: resolveCollectorHost(licenseKey, process.env.NEW_RELIC_HOST ??
             (typeof file.collectorHost === 'string' ? file.collectorHost : null)),
         proxyUpstreams: parseProxyUpstreams(process.env.NEW_RELIC_AI_MCP_PROXY_UPSTREAMS, file.proxyUpstreams),
-        nrApiKey: process.env.NEW_RELIC_API_KEY ?? (typeof file.nrApiKey === 'string' ? file.nrApiKey : null),
+        nrApiKey: nrApiKeySecret.value ?? null,
         customPricingFile: process.env.NEW_RELIC_AI_CUSTOM_PRICING_FILE ??
             (typeof file.customPricingFile === 'string' ? file.customPricingFile : null),
         costRateMultiplier: (() => {
@@ -789,8 +862,7 @@ export function loadMcpConfig(cliOptions) {
                 : null;
         })(),
         dataResidencyPremium: envBool('NEW_RELIC_AI_DATA_RESIDENCY_PREMIUM', typeof file.dataResidencyPremium === 'boolean' ? file.dataResidencyPremium : false),
-        digestWebhookUrl: process.env.NEW_RELIC_AI_DIGEST_WEBHOOK_URL ??
-            (typeof file.digestWebhookUrl === 'string' ? file.digestWebhookUrl : null),
+        digestWebhookUrl: digestWebhookUrlSecret.value ?? null,
         digestSchedule: process.env.NEW_RELIC_AI_DIGEST_SCHEDULE ??
             (typeof file.digestSchedule === 'string' ? file.digestSchedule : '0 9 * * 1'),
         retainSessionsDays: (() => {
@@ -1177,7 +1249,8 @@ export function validateConfigFile(filePath) {
         mode: typeof file.mode === 'string' ? file.mode : undefined,
         storagePath: typeof file.storagePath === 'string' ? file.storagePath : undefined,
         companionMode: typeof file.companionMode === 'boolean' ? file.companionMode : undefined,
-        hasLicenseKey: typeof file.licenseKey === 'string' && file.licenseKey.trim().length > 0,
+        hasLicenseKey: (typeof file.licenseKey === 'string' && file.licenseKey.trim().length > 0) ||
+            Array.isArray(file.licenseKeyCommand),
         errors,
         warnings,
     };
@@ -1224,4 +1297,40 @@ export function redactSensitive(value, patterns) {
     }
     return result;
 }
+const WORD_CHAR_RE = /[A-Za-z0-9]/;
+/**
+ * redactSensitive() for identifiers (project_id, repo_url, repo names), which
+ * carry a token only as a whole path segment or a segment's prefix. A match that
+ * starts right after a letter or digit is part of an ordinary name
+ * (`acme/risk-assessment-…` holds `sk-assessment-…`) and is left alone. The scan
+ * resumes one character later, so a token further into that span
+ * (`acme/risk-ghp_…`) is still caught.
+ *
+ * Free-form content keeps redactSensitive()'s plain matching: there a token
+ * routinely follows a letter or digit, after a JSON escape (`\nghp_…`), an ANSI
+ * colour code (`ESC[32m`) or `%3A`.
+ */
+export function redactIdentifier(value) {
+    let result = value;
+    for (const pattern of DEFAULT_REDACTION_PATTERNS) {
+        const re = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`);
+        let out = '';
+        let last = 0;
+        let match;
+        while ((match = re.exec(result)) !== null) {
+            if (match[0] === '') {
+                re.lastIndex++;
+                continue;
+            }
+            if (match.index > 0 && WORD_CHAR_RE.test(result[match.index - 1])) {
+                re.lastIndex = match.index + 1;
+                continue;
+            }
+            out += `${result.slice(last, match.index)}[REDACTED]`;
+            last = re.lastIndex;
+        }
+        result = out + result.slice(last);
+    }
+    return result;
+}
 //# sourceMappingURL=config.js.map