@pellux/goodvibes-tui 0.20.3 → 0.22.0

package/src/input/handler-onboarding.ts

@@ -5,11 +5,18 @@ import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
 import { OnboardingWizardController, type OnboardingWizardAction, type OnboardingWizardApplyFeedback } from './onboarding/onboarding-wizard.ts';
 import { handleCloudflareOnboardingActionForHandler, maybeProvisionCloudflareOnFinalApplyForHandler } from './handler-onboarding-cloudflare.ts';
-import { applyOnboardingRequest, collectOnboardingSnapshot, verifyOnboardingRequest } from '../runtime/onboarding/index.ts';
+import { applyOnboardingRequest, collectOnboardingSnapshot, deleteWizardProgress, verifyOnboardingRequest, writeOnboardingCheckMarker, writeWizardProgress } from '../runtime/onboarding/index.ts';
 import type { OnboardingApplyRequest, OnboardingVerificationItem } from '../runtime/onboarding/index.ts';
+import {
+  dedupeOnboardingVerificationItems,
+  extractAuthorizationCode,
+  formatOnboardingApplyCompletionMessage,
+  isLoopbackHostValue,
+} from './onboarding/onboarding-verification-helpers.ts';
+import { focusFirstOffendingField, getStepValidationErrors } from './onboarding/onboarding-wizard-validation.ts';
 import type { ModelPickerTarget } from './model-picker.ts';
 import { captureOnboardingWizardSnapshot, restoreOnboardingWizardSnapshot } from './handler-ui-state.ts';
-import type { InputHandler } from './handler.ts';
+import type { InputHandlerLike as InputHandler, OnboardingRuntimePosture } from './handler-types.ts';
 import {
   formatRuntimeActiveSuccessMessage,
   getRuntimeEndpointStatus,
@@ -20,73 +27,6 @@ import {
   type OnboardingRuntimeEndpoint,
 } from './onboarding/onboarding-runtime-status.ts';
 
-export interface OnboardingRuntimePosture {
-  readonly serviceEnabled: boolean;
-  readonly serviceAutostart: boolean;
-  readonly restartOnFailure: boolean;
-  readonly expectedDaemon: boolean;
-  readonly expectedHttpListener: boolean;
-  readonly serverBacked: boolean;
-  readonly remoteExposure: boolean;
-}
-
-function extractAuthorizationCode(input: string): string | null {
-  const trimmed = input.trim();
-  if (!trimmed) return null;
-
-  try {
-    const url = new URL(trimmed);
-    return url.searchParams.get('code');
-  } catch {
-    return trimmed;
-  }
-}
-
-function isLoopbackHostValue(value: string | null | undefined): boolean {
-  const normalized = (value ?? '').trim().toLowerCase();
-  if (normalized.length === 0) return false;
-  return normalized === 'localhost'
-    || normalized === '::1'
-    || normalized === '[::1]'
-    || normalized === '0:0:0:0:0:0:0:1'
-    || /^127(?:\.\d{1,3}){3}$/.test(normalized);
-}
-
-function onboardingVerificationStatusRank(item: OnboardingVerificationItem): number {
-  if (item.status === 'fail') return 3;
-  if (item.status === 'warn') return 2;
-  return 1;
-}
-
-function dedupeOnboardingVerificationItems(
-  items: readonly OnboardingVerificationItem[],
-): OnboardingVerificationItem[] {
-  const order: string[] = [];
-  const byId = new Map<string, OnboardingVerificationItem>();
-  for (const item of items) {
-    const existing = byId.get(item.id);
-    if (!existing) {
-      order.push(item.id);
-      byId.set(item.id, item);
-      continue;
-    }
-    if (onboardingVerificationStatusRank(item) > onboardingVerificationStatusRank(existing)) {
-      byId.set(item.id, item);
-    }
-  }
-  return order.map((id) => byId.get(id)).filter((item): item is OnboardingVerificationItem => Boolean(item));
-}
-
-function formatOnboardingApplyCompletionMessage(items: readonly OnboardingVerificationItem[]): string {
-  const warnings = items.filter((item) => item.status === 'warn');
-  if (warnings.length === 0) return `Onboarding applied and verified ${items.length} item(s).`;
-  const passed = items.filter((item) => item.status === 'pass').length;
-  return [
-    `Onboarding settings applied. ${passed} verification item(s) passed; ${warnings.length} warning(s) need attention.`,
-    ...warnings.map((warning) => `  warning ${warning.id}: ${warning.message}`),
-  ].join('\n');
-}
-
 function getRuntimeEndpointBinding(
   handler: InputHandler,
   request: OnboardingApplyRequest,
@@ -143,6 +83,23 @@ function showOnboardingApplyFeedbackForHandler(handler: InputHandler, feedback:
 
 function continueOnboardingSection(handler: InputHandler): void {
     handler.onboardingWizard.commitEdit();
+
+    const step = handler.onboardingWizard.currentStep;
+    const { errors, firstOffendingFieldId } = getStepValidationErrors(handler.onboardingWizard, step);
+    if (errors.length > 0) {
+      handler.onboardingWizard.setApplyFeedback({
+        severity: 'error',
+        title: 'Required fields missing',
+        summary: 'Fill in the required fields below before continuing.',
+        messages: errors,
+      });
+      if (firstOffendingFieldId !== null) {
+        focusFirstOffendingField(handler.onboardingWizard, firstOffendingFieldId);
+      }
+      handler.requestRender();
+      return;
+    }
+
     handler.onboardingWizard.clearApplyFeedback();
     handler.onboardingWizard.nextStep();
     handler.requestRender();
@@ -292,6 +249,18 @@ export async function handleOnboardingActionForHandler(handler: InputHandler, ac
       }
 
       if (appliedErrors.length === 0) {
+        try {
+          writeOnboardingCheckMarker(handler.uiServices.environment.shellPaths, {
+            scope: 'user',
+            source: 'wizard',
+            mode: request.mode,
+          });
+          deleteWizardProgress(handler.uiServices.environment.shellPaths);
+        } catch (markerError) {
+          handler.commandContext?.print?.(
+            `Onboarding check marker could not be written: ${markerError instanceof Error ? markerError.message : String(markerError)}`,
+          );
+        }
         const activationVerification = await handler.restartOnboardingExternalServicesIfNeeded(request);
         runtimeWarnings = dedupeOnboardingVerificationItems([...activationVerification, ...handler.verifyOnboardingRuntimePosture(request)]
           .map((item): OnboardingVerificationItem => item.status === 'fail'
@@ -540,6 +509,41 @@ export async function handleOpenAiSubscriptionFinishForHandler(handler: InputHan
     }
   }
 
+/**
+ * Persist the current wizard field state to onboarding-progress.json.
+ *
+ * Called after each step navigation so the user can resume a partially
+ * completed wizard after a restart. Masked fields (kind === 'masked') are
+ * excluded from the persisted textState to avoid writing secrets to disk.
+ *
+ * This is a best-effort write: if it fails the wizard continues normally.
+ */
+export function saveWizardProgressForHandler(handler: InputHandler): void {
+  const wizard = handler.onboardingWizard;
+  if (!wizard.active) return;
+  try {
+    // Exclude masked fields to avoid persisting secrets.
+    const maskedFieldIds = new Set<string>();
+    for (const step of wizard.steps) {
+      for (const field of step.fields) {
+        if (field.kind === 'masked') maskedFieldIds.add(field.id);
+      }
+    }
+    const safeTextState = [...wizard.textState.entries()]
+      .filter(([id]) => !maskedFieldIds.has(id)) as Array<[string, string]>;
+
+    writeWizardProgress(handler.uiServices.environment.shellPaths, {
+      mode: wizard.mode,
+      stepIndex: wizard.stepIndex,
+      toggleState: [...wizard.toggleState.entries()],
+      radioState: [...wizard.radioState.entries()],
+      textState: safeTextState,
+    });
+  } catch {
+    // Best-effort: never block wizard interaction on a progress write failure.
+  }
+}
+
 export function syncRuntimeFromOnboardingRequestForHandler(handler: InputHandler, request: ReturnType<OnboardingWizardController['buildApplyRequest']>): void {
     const runtime = handler.commandContext?.session.runtime;
     if (!runtime) return;

package/src/input/handler-types.ts

@@ -0,0 +1,163 @@
+/**
+ * handler-types.ts — Leaf interface for InputHandler.
+ *
+ * Extracted from handler.ts to break circular import chains between handler.ts
+ * and handler-interactions.ts / handler-onboarding.ts / handler-onboarding-cloudflare.ts.
+ *
+ * The interface is the union of all `handler.*` accesses in those three files.
+ * InputHandler declares `implements InputHandlerLike`; no cycle is created
+ * because this file imports only from leaf modules (no import from handler.ts).
+ */
+import { type createOAuthLocalListener } from '@pellux/goodvibes-sdk/platform/config';
+import type { OnboardingWizardController, OnboardingWizardAction } from './onboarding/onboarding-wizard.ts';
+import type { OnboardingWizardSnapshot, OpenOnboardingWizardOptions } from './handler-ui-state.ts';
+import type {
+  OnboardingApplyRequest,
+  OnboardingVerificationItem,
+} from '../runtime/onboarding/index.ts';
+import type { UiRuntimeServices } from '../runtime/ui-services.ts';
+import type { CommandContext } from './command-registry.ts';
+import type { ConversationManager } from '../core/conversation';
+import type { ModelPickerModal, ModelPickerTarget } from './model-picker.ts';
+import type { SelectionManager } from './selection.ts';
+import type { InfiniteBuffer } from '../core/history.ts';
+import type { AutocompleteEngine } from './autocomplete.ts';
+import type { BookmarkModal } from './bookmark-modal.ts';
+import type { AgentDetailModal } from '../renderer/agent-detail-modal.ts';
+import type { LiveTailModal } from '../renderer/live-tail-modal.ts';
+import type { SettingsModal } from './settings-modal.ts';
+import type { McpWorkspace } from './mcp-workspace.ts';
+import type { SessionPickerModal } from './session-picker-modal.ts';
+import type { ProfilePickerModal } from './profile-picker-modal.ts';
+import type { ContextInspectorModal } from '../renderer/context-inspector.ts';
+import type { ProcessModal } from '../renderer/process-modal.ts';
+import type { FilePickerModal } from './file-picker.ts';
+import type { BlockActionsMenu } from '../renderer/block-actions.ts';
+import type { SelectionModal } from './selection-modal.ts';
+import type { SelectionResult } from './selection-modal.ts';
+export interface OnboardingRuntimePosture {
+  readonly serviceEnabled: boolean;
+  readonly serviceAutostart: boolean;
+  readonly restartOnFailure: boolean;
+  readonly expectedDaemon: boolean;
+  readonly expectedHttpListener: boolean;
+  readonly serverBacked: boolean;
+  readonly remoteExposure: boolean;
+}
+
+type SelectionModalCallback = (result: SelectionResult | null) => void;
+
+/**
+ * Public surface of InputHandler consumed by handler-interactions.ts,
+ * handler-onboarding.ts, and handler-onboarding-cloudflare.ts.
+ */
+export interface InputHandlerLike {
+  // ── Core render / lifecycle ──────────────────────────────────────────────
+  requestRender: () => void;
+  exitApp: () => void;
+
+  // ── Services ─────────────────────────────────────────────────────────────
+  readonly uiServices: Pick<UiRuntimeServices,
+    | 'agents'
+    | 'environment'
+    | 'platform'
+    | 'providers'
+    | 'sessions'
+    | 'shell'
+  >;
+  commandContext: CommandContext | undefined;
+
+  // ── Prompt / cursor state ────────────────────────────────────────────────
+  prompt: string;
+  cursorPos: number;
+  showExitNotice: boolean;
+
+  // ── Selection / history ──────────────────────────────────────────────────
+  selection: SelectionManager;
+  getHistory: () => InfiniteBuffer;
+  getScrollTop: () => number;
+  conversationManager: ConversationManager | null;
+
+  // ── Paste / image registries ─────────────────────────────────────────────
+  pasteRegistry: Map<string, string>;
+  nextPasteId: number;
+  imageRegistry: Map<string, { data: string; mediaType: string }>;
+  nextImageId: number;
+
+  // ── Timing ───────────────────────────────────────────────────────────────
+  lastCopyTime: number;
+  lastBlockCopyTime: number;
+  lastCtrlCTime: number;
+
+  // ── Modal state ───────────────────────────────────────────────────────────
+  commandMode: boolean;
+  modalStack: string[];
+  modalReturnFocus: 'prompt' | 'panel' | 'indicator';
+  panelFocused: boolean;
+  indicatorFocused: boolean;
+  helpOverlayActive: boolean;
+  helpScrollOffset: number;
+  shortcutsOverlayActive: boolean;
+  shortcutsScrollOffset: number;
+  selectionCallback: SelectionModalCallback | null;
+  autocomplete: AutocompleteEngine | null;
+
+  // ── Modal objects ─────────────────────────────────────────────────────────
+  bookmarkModal: BookmarkModal;
+  agentDetailModal: AgentDetailModal;
+  liveTailModal: LiveTailModal;
+  settingsModal: SettingsModal;
+  mcpWorkspace: McpWorkspace;
+  sessionPickerModal: SessionPickerModal;
+  profilePickerModal: ProfilePickerModal;
+  contextInspectorModal: ContextInspectorModal;
+  processModal: ProcessModal;
+  modelPicker: ModelPickerModal;
+  filePicker: FilePickerModal;
+  blockActionsMenu: BlockActionsMenu;
+  selectionModal: SelectionModal;
+
+  // ── Onboarding ────────────────────────────────────────────────────────────
+  onboardingWizard: OnboardingWizardController;
+  onboardingModelPickerCancelSnapshot: OnboardingWizardSnapshot | null;
+  onboardingHydrationSerial: number;
+  onboardingApplyPending: boolean;
+  onboardingOpenAiListenerSerial: number;
+
+  // ── Methods: modal lifecycle ──────────────────────────────────────────────
+  modalOpened(name: string): void;
+  saveUndoState(): void;
+
+  // ── Methods: block actions (dispatched in executeBlockAction) ────────────
+  handleBlockCopy(): void;
+  handleBookmark(): void;
+  handleBlockToggle(): void;
+  handleDiffApply(): boolean;
+  handleBlockRerun(): void;
+
+  // ── Methods: onboarding ───────────────────────────────────────────────────
+  hydrateOnboardingWizardFromRuntime(hydrationSerial: number): Promise<void>;
+  clearOnboardingModelPickerCancelState(): void;
+  restoreOnboardingModelPickerCancelState(): void;
+  clearOnboardingPendingModelPickerTarget(): void;
+  refreshOnboardingHydration(options?: { readonly preserveValues?: boolean; readonly targetStepId?: string }): Promise<void>;
+  handleOpenAiSubscriptionStart(): Promise<void>;
+  handleOpenAiSubscriptionFinish(): Promise<void>;
+  syncRuntimeFromOnboardingRequest(request: ReturnType<OnboardingWizardController['buildApplyRequest']>): void;
+  getOnboardingConfigValue(request: OnboardingApplyRequest, key: string): unknown;
+  getOnboardingRuntimePosture(request: OnboardingApplyRequest): OnboardingRuntimePosture;
+  restartOnboardingExternalServicesIfNeeded(request: OnboardingApplyRequest): Promise<OnboardingVerificationItem[]>;
+  verifyOnboardingRuntimePosture(request: OnboardingApplyRequest): OnboardingVerificationItem[];
+
+  // ── Method: model picker ──────────────────────────────────────────────────
+  openModelPickerWithTarget(target: ModelPickerTarget, source?: 'settings' | 'onboarding'): boolean;
+  openProviderModelPickerWithTarget(target: ModelPickerTarget, source?: 'settings' | 'onboarding'): boolean;
+
+  // ── Method: onboarding action ─────────────────────────────────────────────
+  completeOpenAiSubscriptionFromListener(
+    listener: Awaited<ReturnType<typeof createOAuthLocalListener>>,
+    verifier: string,
+    serial: number,
+  ): Promise<void>;
+  handleOnboardingAction(action: OnboardingWizardAction): Promise<void>;
+}

package/src/input/handler.ts

@@ -3,7 +3,8 @@ import { dirname } from 'node:path';
 import { InputTokenizer } from '@pellux/goodvibes-sdk/platform/core';
 import { createOAuthLocalListener } from '@pellux/goodvibes-sdk/platform/config';
 import { clearModalStackForHandler, cleanupMarkerRegistryForHandler, executeBlockActionForHandler, expandPromptForHandler, findMarkerAtPosForHandler, getImageAttachmentsForHandler, handleBlockCopyForHandler, handleBlockRerunForHandler, handleBlockSaveForHandler, handleBlockToggleForHandler, handleBookmarkForHandler, handleCopyForHandler, handleCtrlCForHandler, handleDiffApplyForHandler, handleEscapeForHandler, hydrateOnboardingWizardFromRuntimeForHandler, modalOpenedForHandler, openOnboardingWizardForHandler, registerPasteForHandler } from './handler-interactions.ts';
-import { clearOnboardingModelPickerCancelStateForHandler, clearOnboardingPendingModelPickerTargetForHandler, completeOpenAiSubscriptionFromListenerForHandler, getOnboardingConfigValueForHandler, getOnboardingRuntimePostureForHandler, handleModelPickerCommitForHandler, handleOnboardingActionForHandler, handleOpenAiSubscriptionFinishForHandler, handleOpenAiSubscriptionStartForHandler, openModelPickerWithTargetForHandler, openProviderModelPickerWithTargetForHandler, refreshOnboardingHydrationForHandler, restartOnboardingExternalServicesIfNeededForHandler, restoreOnboardingModelPickerCancelStateForHandler, syncRuntimeFromOnboardingRequestForHandler, verifyOnboardingRuntimePostureForHandler, type OnboardingRuntimePosture } from './handler-onboarding.ts';
+import { clearOnboardingModelPickerCancelStateForHandler, clearOnboardingPendingModelPickerTargetForHandler, completeOpenAiSubscriptionFromListenerForHandler, getOnboardingConfigValueForHandler, getOnboardingRuntimePostureForHandler, handleModelPickerCommitForHandler, handleOnboardingActionForHandler, handleOpenAiSubscriptionFinishForHandler, handleOpenAiSubscriptionStartForHandler, openModelPickerWithTargetForHandler, openProviderModelPickerWithTargetForHandler, refreshOnboardingHydrationForHandler, restartOnboardingExternalServicesIfNeededForHandler, restoreOnboardingModelPickerCancelStateForHandler, saveWizardProgressForHandler, syncRuntimeFromOnboardingRequestForHandler, verifyOnboardingRuntimePostureForHandler, } from './handler-onboarding.ts';
+import type { OnboardingRuntimePosture } from './handler-types.ts';
 import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibes-sdk/platform/config';
 import { openExternalUrl } from '@pellux/goodvibes-sdk/platform/utils';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
@@ -109,6 +110,7 @@ import {
 } from './handler-picker-routes.ts';
 import { handleGlobalShortcutToken } from './handler-shortcuts.ts';
 import { feedInputTokens } from './handler-feed.ts';
+import type { InputHandlerLike } from './handler-types.ts';
 import { buildInitialFeedContext, syncFeedContextMutableFields } from './feed-context-factory.ts';
 import { handlePanelIntegrationAction as runPanelIntegrationAction } from './panel-integration-actions.ts';
 import type { Panel } from '../panels/types.ts';
@@ -123,7 +125,7 @@ type SelectionModalCallback = (result: SelectionResult | null) => void;
  * InputHandler - Owns prompt text, paste registry, and keyboard/mouse handling.
  * Extracted from main.ts and StateManager.
  */
-export class InputHandler {
+export class InputHandler implements InputHandlerLike {
   public prompt = '';
   public cursorPos = 0;
   public showExitNotice = false;
@@ -246,6 +248,7 @@ export class InputHandler {
       sessionLogPathResolver: (agentId) => uiServices.environment.shellPaths.resolveProjectPath('tui', 'sessions', `${agentId}.jsonl`),
       // SDK 0.23.0: supply wrfcController so the modal can show constraint data
       wrfcController: uiServices.agents.wrfcController,
+      cancelAgent: (agentId: string) => uiServices.agents.agentManager.cancel(agentId),
     });
     this.bookmarkModal = new BookmarkModal(uiServices.shell.bookmarkManager);
     this.sessionPickerModal = new SessionPickerModal(uiServices.sessions.sessionManager);
@@ -335,6 +338,7 @@ export class InputHandler {
           this.openProviderModelPickerWithTarget(target, source),
         onModelPickerCommit: () => this.handleModelPickerCommit(),
         onOnboardingAction: (action: OnboardingWizardAction) => { void this.handleOnboardingAction(action); },
+        onStepChange: () => { saveWizardProgressForHandler(this); },
       },
     );
   }

package/src/input/input-history.ts

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { dirname, join } from 'path';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteFileSync } from '@/config/atomic-write.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
@@ -100,11 +101,39 @@ export class HistorySearch {
   }
 }
 
+/**
+ * A redaction rule applied to command text before it is stored or saved.
+ * Any match of `pattern` in the raw text is replaced with `replacement`.
+ */
+export interface HistoryRedactionRule {
+  readonly pattern: RegExp;
+  readonly replacement: string;
+}
+
+/**
+ * Built-in redaction rules that apply regardless of caller-supplied rules.
+ * Scrubs passwords from local-auth commands before they reach disk.
+ */
+const BUILTIN_REDACTION_RULES: readonly HistoryRedactionRule[] = [
+  {
+    // /auth local add-user <user> <password> [roles]
+    pattern: /(\/auth\s+local\s+add-user\s+\S+)\s+(\S+)/i,
+    replacement: '$1 <redacted>',
+  },
+  {
+    // /auth local rotate-password <user> <password>
+    pattern: /(\/auth\s+local\s+rotate-password\s+\S+)\s+(\S+)/i,
+    replacement: '$1 <redacted>',
+  },
+];
+
 export interface InputHistoryOptions {
   readonly historyPath?: string;
   readonly userRoot?: string;
   readonly homeDirectory?: string;
   readonly persist?: boolean;
+  /** Additional redaction rules applied on top of the built-in set. */
+  readonly redactionRules?: readonly HistoryRedactionRule[];
 }
 
 type StoredInputHistoryEntry = string | {
@@ -130,25 +159,44 @@ export class InputHistory {
   private maxEntries = 500;
   private historyPath: string;
   private persist: boolean;
+  private redactionRules: readonly HistoryRedactionRule[];
 
   constructor(options: InputHistoryOptions) {
     this.persist = options.persist ?? true;
     this.historyPath = resolveHistoryPath(options);
+    this.redactionRules = [
+      ...BUILTIN_REDACTION_RULES,
+      ...(options.redactionRules ?? []),
+    ];
     if (this.persist) {
       this.load();
     }
   }
 
+  /**
+   * Apply all active redaction rules to a text string.
+   * Returns the scrubbed text (password arguments replaced with `<redacted>`).
+   */
+  private applyRedaction(text: string): string {
+    let result = text;
+    for (const rule of this.redactionRules) {
+      result = result.replace(rule.pattern, rule.replacement);
+    }
+    return result;
+  }
+
   /**
    * Add a new entry. Called on submit.
    * - Ignores empty/whitespace-only strings.
    * - Deduplicates consecutive identical entries.
+   * - Applies redaction rules to scrub sensitive arguments before persistence.
    * - Resets browsing position.
    */
   add(text: string, options: { readonly recallText?: string } = {}): void {
-    const trimmed = text.trim();
+    const trimmed = this.applyRedaction(text.trim());
     if (!trimmed) return;
-    const recallText = options.recallText?.trim();
+    const rawRecallText = options.recallText?.trim();
+    const recallText = rawRecallText ? this.applyRedaction(rawRecallText) : undefined;
     const entry: StoredInputHistoryEntry = recallText && recallText !== trimmed
       ? { text: trimmed, recallText }
       : trimmed;
@@ -240,8 +288,7 @@ export class InputHistory {
    */
   save(): void {
     try {
-      mkdirSync(dirname(this.historyPath), { recursive: true });
-      writeFileSync(this.historyPath, JSON.stringify(this.entries), 'utf-8');
+      atomicWriteFileSync(this.historyPath, JSON.stringify(this.entries), { mkdirp: true });
     } catch (err) {
       logger.debug('InputHistory save failed (non-fatal)', { error: summarizeError(err) });
     }
@@ -249,6 +296,10 @@ export class InputHistory {
 
   /**
    * Load history from disk.
+   *
+   * Redaction is applied to every loaded entry so that cleartext passwords
+   * persisted before the redaction rules were deployed are scrubbed on first
+   * load and will not be re-persisted on the next save().
    */
   load(): void {
     try {
@@ -259,6 +310,7 @@ export class InputHistory {
           this.entries = (parsed as unknown[])
             .map((entry) => this.normalizeStoredEntry(entry))
             .filter((entry): entry is StoredInputHistoryEntry => entry !== null)
+            .map((entry) => this.redactEntry(entry))
             .slice(0, this.maxEntries);
         }
       }
@@ -281,6 +333,24 @@ export class InputHistory {
       && this.getRecallText(a) === this.getRecallText(b);
   }
 
+  /**
+   * Apply redaction rules to a loaded entry, scrubbing any sensitive text that
+   * was persisted before redaction was deployed.
+   */
+  private redactEntry(entry: StoredInputHistoryEntry): StoredInputHistoryEntry {
+    if (typeof entry === 'string') {
+      return this.applyRedaction(entry);
+    }
+    const redactedText = this.applyRedaction(entry.text);
+    const redactedRecallText = entry.recallText !== undefined
+      ? this.applyRedaction(entry.recallText)
+      : undefined;
+    if (redactedRecallText !== undefined && redactedRecallText !== redactedText) {
+      return { text: redactedText, recallText: redactedRecallText };
+    }
+    return redactedText;
+  }
+
   private normalizeStoredEntry(entry: unknown): StoredInputHistoryEntry | null {
     if (typeof entry === 'string') return entry;
     if (!entry || typeof entry !== 'object') return null;