@remnic/bench 9.3.528 → 9.3.530

package/dist/index.js

@@ -3872,15 +3872,7 @@ var BENCHMARK_RESULT_SCHEMA = {
 import { execFileSync } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { createReadStream } from "fs";
-import {
-  lstat as lstat3,
-  mkdir as mkdir3,
-  readdir as readdir4,
-  readlink,
-  realpath as realpath3,
-  stat as stat2,
-  writeFile as writeFile3
-} from "fs/promises";
+import { lstat as lstat3, mkdir as mkdir3, readFile as readFile4, readdir as readdir4, readlink, realpath as realpath3, stat as stat2, writeFile as writeFile3 } from "fs/promises";
 import os2 from "os";
 import path4 from "path";
 
@@ -4573,6 +4565,94 @@ function resolveBenchmarkRunId() {
   return generatedBenchmarkRunId;
 }
 
+// src/security/url-secrets.ts
+function redactUrlSecrets(value, redactedValue, isSecretQueryKey) {
+  return redactUrlQuerySecrets(redactUrlUserinfoSecrets(value, redactedValue), redactedValue, isSecretQueryKey);
+}
+function redactUrlUserinfoSecrets(value, redactedValue) {
+  if (!value.includes("://")) return value;
+  let redacted = "";
+  let cursor = 0;
+  let changed = false;
+  for (let schemeEnd = value.indexOf("://"); schemeEnd !== -1; schemeEnd = value.indexOf("://", schemeEnd + 3)) {
+    const schemeStart = findUrlSchemeStart(value, schemeEnd);
+    if (schemeStart === -1) continue;
+    const authorityStart = schemeEnd + 3;
+    const authorityEnd = findUrlAuthorityEnd(value, authorityStart);
+    const atIndex = value.lastIndexOf("@", authorityEnd - 1);
+    if (atIndex < authorityStart) continue;
+    redacted += value.slice(cursor, authorityStart);
+    redacted += redactedValue;
+    cursor = atIndex;
+    changed = true;
+  }
+  return changed ? redacted + value.slice(cursor) : value;
+}
+function redactUrlQuerySecrets(value, redactedValue, isSecretQueryKey) {
+  if (!/[?&;]/.test(value)) return value;
+  let redacted = "";
+  let cursor = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    if (value[index] !== "?" && value[index] !== "&" && value[index] !== ";") continue;
+    const keyStart = index + 1;
+    const equalsIndex = value.indexOf("=", keyStart);
+    if (equalsIndex === -1) continue;
+    const valueEnd = findQueryValueEnd(value, equalsIndex + 1);
+    const key = value.slice(keyStart, equalsIndex);
+    if (isSecretUrlQueryKey(key, isSecretQueryKey)) {
+      if (redactedValue.length > 0 && value.startsWith(redactedValue, equalsIndex + 1)) continue;
+      redacted += value.slice(cursor, equalsIndex + 1);
+      redacted += redactedValue;
+      cursor = valueEnd;
+      index = valueEnd - 1;
+    }
+  }
+  return cursor === 0 ? value : redacted + value.slice(cursor);
+}
+function findQueryValueEnd(value, startIndex) {
+  let index = startIndex;
+  while (index < value.length && !isQueryValueTerminator(value[index])) {
+    index += 1;
+  }
+  return index;
+}
+function isQueryValueTerminator(char) {
+  return char === "&" || char === ";" || char === "#" || char === '"' || char === "'" || char === "}" || char === "]" || isWhitespace(char);
+}
+function isSecretUrlQueryKey(key, isSecretQueryKey) {
+  try {
+    return isSecretQueryKey(decodeURIComponent(key.replace(/\+/g, " ")));
+  } catch {
+    return isSecretQueryKey(key);
+  }
+}
+function findUrlSchemeStart(value, schemeEnd) {
+  let cursor = schemeEnd - 1;
+  while (cursor >= 0 && isUrlSchemeChar(value[cursor])) cursor -= 1;
+  const schemeStart = cursor + 1;
+  return schemeStart < schemeEnd && isAsciiLetter(value[schemeStart]) ? schemeStart : -1;
+}
+function isUrlSchemeChar(char) {
+  return isAsciiAlnum(char) || char === "+" || char === "-" || char === ".";
+}
+function findUrlAuthorityEnd(value, authorityStart) {
+  let cursor = authorityStart;
+  while (cursor < value.length && !isUrlAuthorityTerminator(value[cursor])) cursor += 1;
+  return cursor;
+}
+function isUrlAuthorityTerminator(char) {
+  return char === "/" || char === "?" || char === "#" || isWhitespace(char) || char === '"' || char === "'";
+}
+function isAsciiLetter(char) {
+  return char >= "A" && char <= "Z" || char >= "a" && char <= "z";
+}
+function isAsciiAlnum(char) {
+  return isAsciiLetter(char) || char >= "0" && char <= "9";
+}
+function isWhitespace(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\r";
+}
+
 // src/repro-manifest.ts
 var BENCHMARK_REPRO_MANIFEST_FILENAME = "MANIFEST.json";
 var BENCHMARK_REPRO_MANIFEST_SCHEMA_VERSION = 1;
@@ -4581,12 +4661,108 @@ var SECRET_ARG_FLAGS = /* @__PURE__ */ new Set([
   "--system-api-key",
   "--judge-api-key",
   "--token",
-  "--auth-token"
+  "--auth-token",
+  "-k",
+  "-p",
+  "-t"
+]);
+var ATTACHED_LONG_SECRET_ARG_FLAGS = [
+  "--system-api-key",
+  "--judge-api-key",
+  "--auth-token",
+  "--api-key",
+  "--token"
+];
+var NON_SECRET_ARG_FLAGS = /* @__PURE__ */ new Set([
+  "--ama-bench-cross-judge-base-url",
+  "--base-url",
+  "--config",
+  "--dataset-dir",
+  "--header",
+  "--internal-base-url",
+  "--judge-base-url",
+  "--limit",
+  "--max-tokens",
+  "--mode",
+  "--output-token-limit",
+  "--provider-config",
+  "--system-base-url"
 ]);
-var SECRET_KEY_PATTERN = /(^|[-_])(?:api[-_]?key|secret|password|authorization|credential|access[-_]?token|auth[-_]?token|refresh[-_]?token|id[-_]?token|token)$/i;
+var BENCH_OPTION_BOUNDARY_FLAGS = /* @__PURE__ */ new Set([
+  "--all",
+  "--ama-bench-cross-judge-api-key",
+  "--ama-bench-cross-judge-base-url",
+  "--ama-bench-cross-judge-codex-reasoning-effort",
+  "--ama-bench-cross-judge-model",
+  "--ama-bench-cross-judge-provider",
+  "--ama-bench-judge-protocol",
+  "--base-url",
+  "--baselines-dir",
+  "--custom",
+  "--dataset",
+  "--dataset-dir",
+  "--detail",
+  "--disable-thinking",
+  "--drain-timeout",
+  "--dry-run",
+  "--explain",
+  "--fast-gateway-agent-id",
+  "--format",
+  "--gateway-agent-id",
+  "--help",
+  "--ingest-concurrency",
+  "--internal-api-key",
+  "--internal-base-url",
+  "--internal-codex-reasoning-effort",
+  "--internal-disable-thinking",
+  "--internal-model",
+  "--internal-provider",
+  "--json",
+  "--judge-api-key",
+  "--judge-base-url",
+  "--judge-codex-reasoning-effort",
+  "--judge-model",
+  "--judge-provider",
+  "--limit",
+  "--matrix",
+  "--max-429-wait",
+  "--model",
+  "--model-source",
+  "--name",
+  "--openclaw-config",
+  "--out",
+  "--output",
+  "--provider",
+  "--quick",
+  "--remnic-config",
+  "--request-timeout",
+  "--results-dir",
+  "--resume",
+  "--retry-failed",
+  "--runtime-profile",
+  "--seed",
+  "--system-api-key",
+  "--system-base-url",
+  "--system-codex-reasoning-effort",
+  "--system-model",
+  "--system-provider",
+  "--system-responder-context-budget-chars",
+  "--system-responder-prompt-budget-chars",
+  "--target",
+  "--task-filter",
+  "--threshold",
+  "--trial-concurrency",
+  "--trial-limit",
+  "-h"
+]);
+var SECRET_KEY_PATTERN = /(^|[-_])(?:api[-_]?key|secret[-_]?access[-_]?key|secret[-_]?key|client[-_]?secret(?:[-_]?key)?|app[-_]?secret(?:[-_]?key)?|provider[-_]?secret(?:[-_]?key)?|access[-_]?key|private[-_]?key|secret|password|authorization|credential|access[-_]?token|auth[-_]?token|refresh[-_]?token|id[-_]?token|token)$/i;
+var REDACTED_ARG_VALUE = "[redacted]";
 function sha256String(value) {
   return createHash3("sha256").update(value).digest("hex");
 }
+function sha256Buffer(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
 async function sha256File(filePath) {
   const hash = createHash3("sha256");
   await new Promise((resolve, reject) => {
@@ -4611,23 +4787,485 @@ function sanitizeArgv(argv) {
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     const isOptionFlag = arg.startsWith("-");
-    const [flagName] = arg.split("=", 1);
-    if (isOptionFlag && (SECRET_ARG_FLAGS.has(flagName) || SECRET_KEY_PATTERN.test(flagName))) {
-      if (arg.includes("=")) {
-        sanitized.push(`${flagName}=[redacted]`);
+    const assignmentIndex = arg.indexOf("=");
+    const flagName = assignmentIndex === -1 ? arg : arg.slice(0, assignmentIndex);
+    const attachedShortSecretFlag = getAttachedShortSecretFlag(arg);
+    const attachedLongSecret = getAttachedLongSecretArg(arg);
+    if (attachedLongSecret) {
+      sanitized.push(`${attachedLongSecret.flag}${attachedLongSecret.delimiter}${REDACTED_ARG_VALUE}`);
+      const attachedSecretValue = arg.slice(
+        attachedLongSecret.flag.length + (attachedLongSecret.delimiter === "=" ? 1 : 0)
+      );
+      if (shouldConsumeAuthSchemePair(attachedLongSecret.flag, attachedSecretValue)) {
+        const consumedValues = countAuthSchemeContinuationTokens(attachedLongSecret.flag, argv, index + 1);
+        sanitized.push(...redactedPlaceholders(consumedValues));
+        index += consumedValues;
+      }
+      continue;
+    }
+    if (attachedShortSecretFlag) {
+      sanitized.push(`${attachedShortSecretFlag}${REDACTED_ARG_VALUE}`);
+      continue;
+    }
+    const secretDelimiterIndex = assignmentIndex === -1 ? findSecretConfigDelimiterIndex(arg) : -1;
+    if (secretDelimiterIndex !== -1) {
+      sanitized.push(sanitizeSecretDelimitedArg(arg, secretDelimiterIndex, ":"));
+      if (arg.slice(secretDelimiterIndex + 1).trim().length === 0) {
+        index += countBareSecretValueTokens(arg.slice(0, secretDelimiterIndex), argv, index + 1);
+      }
+      continue;
+    }
+    if (isOptionFlag && (SECRET_ARG_FLAGS.has(flagName) || isSecretOptionFlagName(flagName))) {
+      if (assignmentIndex !== -1) {
+        const assignedSecretValue = arg.slice(assignmentIndex + 1);
+        sanitized.push(`${flagName}=${REDACTED_ARG_VALUE}`);
+        if (shouldConsumeAuthSchemePair(flagName, assignedSecretValue)) {
+          const consumedValues = countAuthSchemeContinuationTokens(flagName, argv, index + 1);
+          sanitized.push(...redactedPlaceholders(consumedValues));
+          index += consumedValues;
+        }
       } else {
         sanitized.push(arg);
-        if (index + 1 < argv.length) {
-          sanitized.push("[redacted]");
-          index += 1;
+        if (index + 1 < argv.length && shouldConsumeSeparatedSecretFlagValue(argv[index + 1])) {
+          const consumeAllValueTokens = isAuthorizationConfigKey(flagName) || (flagName === "--auth-token" || flagName === "--token") && isAuthSchemeToken(argv[index + 1]);
+          let consumedValues = 1;
+          while (consumeAllValueTokens && index + 1 + consumedValues < argv.length && !isOptionValueBoundaryFlag(argv[index + 1 + consumedValues])) {
+            consumedValues += 1;
+          }
+          sanitized.push(...redactedPlaceholders(consumedValues));
+          index += consumedValues;
         }
       }
       continue;
     }
-    sanitized.push(arg);
+    if (assignmentIndex === -1 && isKnownNonSecretOptionFlag(arg)) {
+      sanitized.push(arg);
+      if (index + 1 < argv.length && !argv[index + 1].startsWith("-")) {
+        const optionValue = sanitizeOptionValueSpan(arg, argv, index + 1);
+        sanitized.push(...optionValue.values);
+        index += optionValue.consumed;
+      }
+      continue;
+    }
+    if (assignmentIndex !== -1 && isOptionFlag && NON_SECRET_ARG_FLAGS.has(getOptionName(arg))) {
+      const assignedValue = arg.slice(assignmentIndex + 1);
+      const assignedOptionName = getOptionName(arg);
+      if (assignedOptionName === "--header") {
+        const headerDelimiterIndex = findSensitiveHeaderDelimiterIndex(assignedValue);
+        if (headerDelimiterIndex !== -1) {
+          let consumedValues = 0;
+          while (index + 1 + consumedValues < argv.length && !isOptionValueBoundaryFlag(argv[index + 1 + consumedValues])) {
+            consumedValues += 1;
+          }
+          sanitized.push(
+            `${assignedOptionName}=${sanitizeSecretDelimitedArg(
+              assignedValue,
+              headerDelimiterIndex,
+              assignedValue[headerDelimiterIndex]
+            )}`
+          );
+          sanitized.push(...redactedPlaceholders(consumedValues));
+          index += consumedValues;
+          continue;
+        }
+      }
+      const authSchemeAssignmentIndex = findAuthSchemeAssignmentIndex(assignedValue);
+      if (authSchemeAssignmentIndex !== -1) {
+        const authSchemeKey = assignedValue.slice(0, authSchemeAssignmentIndex);
+        const consumedValues = countAuthSchemeContinuationTokens(authSchemeKey, argv, index + 1);
+        if (consumedValues > 0) {
+          sanitized.push(
+            `${assignedOptionName}=${sanitizeAssignmentArg(assignedValue, authSchemeAssignmentIndex, false)}`
+          );
+          sanitized.push(...redactedPlaceholders(consumedValues));
+          index += consumedValues;
+          continue;
+        }
+      }
+      const assignedValueIsSensitive = isSecretConfigKey(assignedValue) || assignedOptionName === "--header" && isSensitiveHeaderKey(assignedValue);
+      if (assignedValueIsSensitive && index + 1 < argv.length && !isOptionValueBoundaryFlag(argv[index + 1])) {
+        let consumedValues = 1;
+        if (shouldConsumeAuthSchemePair(assignedValue, argv[index + 1]) && index + 2 < argv.length && !isOptionValueBoundaryFlag(argv[index + 2])) {
+          consumedValues = 2;
+        } else {
+          const consumeAllValueTokens = assignedOptionName === "--header" || isAuthorizationConfigKey(assignedValue);
+          while (index + 1 + consumedValues < argv.length && !isOptionValueBoundaryFlag(argv[index + 1 + consumedValues]) && consumeAllValueTokens) {
+            consumedValues += 1;
+          }
+        }
+        sanitized.push(arg);
+        sanitized.push(...redactedPlaceholders(consumedValues));
+        index += consumedValues;
+        continue;
+      }
+    }
+    if (assignmentIndex !== -1) {
+      const authSchemeAssignmentIndex = findAuthSchemeAssignmentIndex(arg);
+      if (authSchemeAssignmentIndex !== -1) {
+        const authSchemeKey = arg.slice(0, authSchemeAssignmentIndex);
+        const consumedValues = countAuthSchemeContinuationTokens(authSchemeKey, argv, index + 1);
+        sanitized.push(sanitizeAssignmentArg(arg, assignmentIndex, isOptionFlag));
+        sanitized.push(...redactedPlaceholders(consumedValues));
+        index += consumedValues;
+        continue;
+      }
+      sanitized.push(sanitizeAssignmentArg(arg, assignmentIndex, isOptionFlag));
+      continue;
+    }
+    if (!isOptionFlag && isSecretConfigKey(arg)) {
+      sanitized.push(arg);
+      const consumedValues = countBareSecretValueTokens(arg, argv, index + 1);
+      sanitized.push(...redactedPlaceholders(consumedValues));
+      index += consumedValues;
+      continue;
+    }
+    sanitized.push(sanitizeStructuredArg(arg));
   }
   return sanitized;
 }
+function sanitizeOptionValueSpan(optionArg, argv, startIndex) {
+  const value = argv[startIndex];
+  const optionName = getOptionName(optionArg);
+  if (optionName === "--header") {
+    const headerDelimiterIndex = findSensitiveHeaderDelimiterIndex(value);
+    if (headerDelimiterIndex !== -1) {
+      let consumed = 1;
+      while (startIndex + consumed < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + consumed])) {
+        consumed += 1;
+      }
+      return {
+        values: [
+          sanitizeSecretDelimitedArg(value, headerDelimiterIndex, value[headerDelimiterIndex]),
+          ...redactedPlaceholders(consumed - 1)
+        ],
+        consumed
+      };
+    }
+    if (isSensitiveHeaderKey(value) && startIndex + 1 < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + 1])) {
+      let consumed = 2;
+      while (startIndex + consumed < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + consumed])) {
+        consumed += 1;
+      }
+      return { values: [value, ...redactedPlaceholders(consumed - 1)], consumed };
+    }
+  }
+  const secretDelimiterIndex = findSecretConfigDelimiterIndex(value);
+  if (secretDelimiterIndex !== -1 && value.slice(secretDelimiterIndex + 1).trim().length === 0) {
+    const secretKey = value.slice(0, secretDelimiterIndex);
+    let consumed = 1;
+    if (isAuthorizationConfigKey(secretKey)) {
+      while (startIndex + consumed < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + consumed])) {
+        consumed += 1;
+      }
+    } else if (startIndex + 1 < argv.length && shouldConsumeAuthSchemePair(secretKey, argv[startIndex + 1]) && startIndex + 2 < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + 2])) {
+      consumed = 3;
+    } else if (startIndex + 1 < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + 1])) {
+      consumed = 2;
+    }
+    const continuationValues = consumed > 1 && (isAuthorizationConfigKey(secretKey) || consumed > 2 && shouldConsumeAuthSchemePair(secretKey, argv[startIndex + 1])) ? redactedPlaceholders(consumed - 1) : [];
+    return { values: [sanitizeSecretDelimitedArg(value, secretDelimiterIndex, ":"), ...continuationValues], consumed };
+  }
+  if (isSecretConfigKey(value) && startIndex + 1 < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + 1])) {
+    let consumed = 2;
+    if (shouldConsumeAuthSchemePair(value, argv[startIndex + 1]) && startIndex + 2 < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + 2])) {
+      consumed = 3;
+    } else if (isAuthorizationConfigKey(value)) {
+      while (startIndex + consumed < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + consumed])) {
+        consumed += 1;
+      }
+    }
+    return { values: [value, ...redactedPlaceholders(consumed - 1)], consumed };
+  }
+  const assignmentIndex = value.indexOf("=");
+  if (assignmentIndex !== -1 && findAuthSchemeAssignmentIndex(value) !== -1) {
+    const authSchemeKey = value.slice(0, assignmentIndex);
+    const consumedContinuations = countAuthSchemeContinuationTokens(authSchemeKey, argv, startIndex + 1);
+    if (consumedContinuations > 0) {
+      return {
+        values: [sanitizeAssignmentArg(value, assignmentIndex, false), ...redactedPlaceholders(consumedContinuations)],
+        consumed: 1 + consumedContinuations
+      };
+    }
+  }
+  return { values: [sanitizeOptionValueArg(value)], consumed: 1 };
+}
+function sanitizeOptionValueArg(arg) {
+  const sanitizedStructuredValue = sanitizeStructuredArg(arg);
+  if (sanitizedStructuredValue !== arg) return sanitizedStructuredValue;
+  const sanitizedUrlValue = sanitizeUrlSecrets(arg);
+  if (sanitizedUrlValue !== arg) return sanitizedUrlValue;
+  const assignmentIndex = arg.indexOf("=");
+  if (assignmentIndex !== -1) return sanitizeAssignmentArg(arg, assignmentIndex, false);
+  const secretDelimiterIndex = findSecretConfigDelimiterIndex(arg);
+  if (secretDelimiterIndex !== -1) return sanitizeSecretDelimitedArg(arg, secretDelimiterIndex, ":");
+  return arg;
+}
+function sanitizeAssignmentArg(arg, assignmentIndex, isOptionFlag) {
+  const key = arg.slice(0, assignmentIndex);
+  const value = arg.slice(assignmentIndex + 1);
+  if (isSensitiveHeaderKey(key)) return `${key}=${REDACTED_ARG_VALUE}`;
+  const sanitizedStructuredValue = sanitizeStructuredArg(value);
+  if (sanitizedStructuredValue !== value) return `${key}=${sanitizedStructuredValue}`;
+  const sanitizedUrlValue = sanitizeUrlSecrets(value);
+  if (sanitizedUrlValue !== value) return `${key}=${sanitizedUrlValue}`;
+  const nestedHeaderDelimiterIndex = findSensitiveHeaderDelimiterIndex(value);
+  if (nestedHeaderDelimiterIndex !== -1) {
+    return `${key}=${sanitizeSecretDelimitedArg(value, nestedHeaderDelimiterIndex, value[nestedHeaderDelimiterIndex])}`;
+  }
+  const nestedSecretDelimiterIndex = findSecretConfigDelimiterIndex(value);
+  if (nestedSecretDelimiterIndex !== -1) {
+    const sanitizedValue2 = sanitizeSecretDelimitedArg(value, nestedSecretDelimiterIndex, ":");
+    return sanitizedValue2 === value ? arg : `${key}=${sanitizedValue2}`;
+  }
+  if (!isOptionFlag) return arg;
+  const nestedAssignmentIndex = value.indexOf("=");
+  if (nestedAssignmentIndex === -1) return arg;
+  const sanitizedValue = sanitizeAssignmentArg(value, nestedAssignmentIndex, false);
+  return sanitizedValue === value ? arg : `${key}=${sanitizedValue}`;
+}
+function findSecretConfigDelimiterIndex(arg) {
+  const trimmed = arg.trim();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) return -1;
+  const delimiterIndex = arg.indexOf(":");
+  if (delimiterIndex <= 0) return -1;
+  const key = arg.slice(0, delimiterIndex);
+  return isSensitiveHeaderKey(key) || isSensitiveHeaderKey(stripLeadingOptionPrefix(key)) ? delimiterIndex : -1;
+}
+function findSensitiveHeaderDelimiterIndex(arg) {
+  const colonIndex = arg.indexOf(":");
+  const equalsIndex = arg.indexOf("=");
+  const delimiterIndex = colonIndex === -1 ? equalsIndex : equalsIndex === -1 ? colonIndex : Math.min(colonIndex, equalsIndex);
+  if (delimiterIndex <= 0) return -1;
+  return isSensitiveHeaderKey(arg.slice(0, delimiterIndex)) ? delimiterIndex : -1;
+}
+function sanitizeSecretDelimitedArg(arg, delimiterIndex, delimiter) {
+  const key = arg.slice(0, delimiterIndex);
+  const valueStart = skipLooseAssignmentWhitespace(arg, delimiterIndex + 1);
+  const valueEnd = valueStart >= arg.length ? arg.length : findLooseAssignmentValueEnd(arg, valueStart, isRequestCookieHeaderKey(key));
+  return `${arg.slice(0, delimiterIndex)}${delimiter}${REDACTED_ARG_VALUE}${arg.slice(valueEnd)}`;
+}
+function redactedPlaceholders(count) {
+  return Array.from({ length: Math.max(0, count) }, () => REDACTED_ARG_VALUE);
+}
+function sanitizeStructuredArg(arg) {
+  const sanitizedUrlArg = sanitizeUrlSecrets(arg);
+  const trimmed = sanitizedUrlArg.trim();
+  if (!(trimmed.startsWith("{") || trimmed.startsWith("["))) return sanitizeLooseSecretConfigText(sanitizedUrlArg);
+  try {
+    const parsed = JSON.parse(trimmed);
+    const redacted = redactStructuredSecrets(parsed);
+    if (!redacted.changed) return sanitizedUrlArg;
+    return JSON.stringify(redacted.value);
+  } catch {
+    return sanitizeLooseSecretConfigText(sanitizedUrlArg);
+  }
+}
+function sanitizeLooseSecretConfigText(value) {
+  if (!value.includes(":") && !value.includes("=")) return value;
+  let redacted = "";
+  let cursor = 0;
+  let changed = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const delimiter = value[index];
+    if (delimiter !== ":" && delimiter !== "=") continue;
+    const keySpan = findLooseAssignmentKey(value, index);
+    if (!keySpan || !isSensitiveHeaderKey(keySpan.key)) continue;
+    const valueStart = skipLooseAssignmentWhitespace(value, index + 1);
+    if (valueStart >= value.length) continue;
+    const valueEnd = findLooseAssignmentValueEnd(value, valueStart, isRequestCookieHeaderKey(keySpan.key));
+    redacted += value.slice(cursor, valueStart);
+    redacted += REDACTED_ARG_VALUE;
+    cursor = valueEnd;
+    changed = true;
+    index = valueEnd - 1;
+  }
+  return changed ? redacted + value.slice(cursor) : value;
+}
+function findLooseAssignmentKey(value, delimiterIndex) {
+  let keyEnd = delimiterIndex;
+  while (keyEnd > 0 && isWhitespace2(value[keyEnd - 1])) keyEnd -= 1;
+  if (keyEnd <= 0) return void 0;
+  const quote = value[keyEnd - 1];
+  if (quote === '"' || quote === "'") {
+    const keyStart2 = value.lastIndexOf(quote, keyEnd - 2);
+    if (keyStart2 === -1) return void 0;
+    const key2 = value.slice(keyStart2 + 1, keyEnd - 1);
+    return key2.length > 0 ? { key: key2 } : void 0;
+  }
+  let keyStart = keyEnd;
+  while (keyStart > 0 && isLooseAssignmentKeyChar(value[keyStart - 1])) keyStart -= 1;
+  const key = value.slice(keyStart, keyEnd);
+  return key.length > 0 ? { key } : void 0;
+}
+function skipLooseAssignmentWhitespace(value, index) {
+  let cursor = index;
+  while (cursor < value.length && isWhitespace2(value[cursor])) cursor += 1;
+  return cursor;
+}
+function findLooseAssignmentValueEnd(value, startIndex, consumeSemicolonPairs = false) {
+  const quote = value[startIndex];
+  if (quote === '"' || quote === "'") {
+    let cursor2 = startIndex + 1;
+    let escaped = false;
+    while (cursor2 < value.length) {
+      const char = value[cursor2];
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === quote) {
+        return cursor2 + 1;
+      }
+      cursor2 += 1;
+    }
+    return value.length;
+  }
+  let cursor = startIndex;
+  while (cursor < value.length && !isLooseAssignmentValueTerminator(value[cursor], consumeSemicolonPairs)) cursor += 1;
+  return cursor;
+}
+function isLooseAssignmentKeyChar(char) {
+  return isAsciiAlnum2(char) || char === "_" || char === "-" || char === "." || char === "[" || char === "]";
+}
+function isLooseAssignmentValueTerminator(char, consumeSemicolonPairs) {
+  return char === "," || char === "}" || char === "&" || !consumeSemicolonPairs && char === ";";
+}
+function isWhitespace2(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\r";
+}
+function sanitizeUrlSecrets(value) {
+  return redactUrlSecrets(value, REDACTED_ARG_VALUE, isSecretConfigKey);
+}
+function redactStructuredSecrets(value) {
+  if (Array.isArray(value)) {
+    let changed = false;
+    const entries = value.map((entry) => {
+      const redactedEntry = redactStructuredSecrets(entry);
+      changed ||= redactedEntry.changed;
+      return redactedEntry.value;
+    });
+    return { value: entries, changed };
+  }
+  if (value && typeof value === "object") {
+    let changed = false;
+    const entries = {};
+    for (const [key, entry] of Object.entries(value)) {
+      if (isSensitiveHeaderKey(key)) {
+        entries[key] = REDACTED_ARG_VALUE;
+        changed = true;
+        continue;
+      }
+      const redactedEntry = redactStructuredSecrets(entry);
+      entries[key] = redactedEntry.value;
+      changed ||= redactedEntry.changed;
+    }
+    return { value: entries, changed };
+  }
+  if (typeof value === "string") {
+    let redactedValue = sanitizeUrlSecrets(value);
+    const secretDelimiterIndex = findSecretConfigDelimiterIndex(redactedValue);
+    if (secretDelimiterIndex !== -1) {
+      redactedValue = sanitizeSecretDelimitedArg(redactedValue, secretDelimiterIndex, ":");
+    }
+    redactedValue = sanitizeLooseSecretConfigText(redactedValue);
+    return { value: redactedValue, changed: redactedValue !== value };
+  }
+  return { value, changed: false };
+}
+function isSecretConfigKey(key) {
+  return SECRET_KEY_PATTERN.test(normalizeSecretKey(key));
+}
+function isSecretOptionFlagName(flagName) {
+  return isSecretConfigKey(flagName) || isSecretConfigKey(stripLeadingOptionPrefix(flagName));
+}
+function isAuthorizationConfigKey(key) {
+  return /(^|[-_])authorization$/i.test(normalizeSecretKey(key));
+}
+function isSensitiveHeaderKey(key) {
+  const normalized = normalizeSecretKey(key);
+  return isSecretConfigKey(key) || /(^|[-_])(?:cookie|set[-_]?cookie|session)$/i.test(normalized);
+}
+function isRequestCookieHeaderKey(key) {
+  const parts = normalizeSecretKey(key).toLowerCase().split(/[-_]+/).filter(Boolean);
+  const lastPart = parts.at(-1);
+  const previousPart = parts.at(-2);
+  return lastPart === "cookie" && previousPart !== "set";
+}
+function isAuthSchemeToken(value) {
+  return /^(?:bearer|basic|digest)$/i.test(value);
+}
+function isTokenConfigKey(key) {
+  return /(^|[-_])(?:auth[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|token)$/i.test(
+    normalizeSecretKey(key)
+  );
+}
+function shouldConsumeAuthSchemePair(key, firstValue) {
+  return (isTokenConfigKey(key) || isAuthorizationConfigKey(key)) && isAuthSchemeToken(firstValue);
+}
+function findAuthSchemeAssignmentIndex(arg) {
+  const assignmentIndex = arg.indexOf("=");
+  if (assignmentIndex === -1) return -1;
+  return shouldConsumeAuthSchemePair(arg.slice(0, assignmentIndex), arg.slice(assignmentIndex + 1)) ? assignmentIndex : -1;
+}
+function countAuthSchemeContinuationTokens(key, argv, startIndex) {
+  if (startIndex >= argv.length || isAuthSchemeContinuationBoundary(argv[startIndex])) return 0;
+  let consumedValues = 1;
+  while (isAuthorizationConfigKey(key) && startIndex + consumedValues < argv.length && !isAuthSchemeContinuationBoundary(argv[startIndex + consumedValues])) {
+    consumedValues += 1;
+  }
+  return consumedValues;
+}
+function isAuthSchemeContinuationBoundary(arg) {
+  return isOptionValueBoundaryFlag(arg) || findAuthSchemeAssignmentIndex(arg) !== -1;
+}
+function countBareSecretValueTokens(key, argv, startIndex) {
+  if (startIndex >= argv.length || isOptionValueBoundaryFlag(argv[startIndex])) return 0;
+  const consumeAllValueTokens = isAuthorizationConfigKey(key);
+  let consumedValues = 1;
+  if (!consumeAllValueTokens && shouldConsumeAuthSchemePair(key, argv[startIndex])) {
+    return startIndex + 1 < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + 1]) ? 2 : 1;
+  }
+  while (consumeAllValueTokens && startIndex + consumedValues < argv.length && !isOptionValueBoundaryFlag(argv[startIndex + consumedValues])) {
+    consumedValues += 1;
+  }
+  return consumedValues;
+}
+function normalizeSecretKey(key) {
+  let normalized = "";
+  for (let index = 0; index < key.length; index += 1) {
+    const char = key[index];
+    if (char === "." || char === "[" || char === "]" || char === ":") {
+      normalized += "-";
+      continue;
+    }
+    if (isUppercaseAscii(char)) {
+      const previous = key[index - 1];
+      const next = key[index + 1];
+      if (index > 0 && (previous !== void 0 && isLowercaseOrDigitAscii(previous) || previous !== void 0 && isUppercaseAscii(previous) && next !== void 0 && isLowercaseAscii(next))) {
+        normalized += "-";
+      }
+    }
+    normalized += char;
+  }
+  return normalized;
+}
+function stripLeadingOptionPrefix(key) {
+  let index = 0;
+  while (index < key.length && key[index] === "-") index += 1;
+  return key.slice(index);
+}
+function isUppercaseAscii(char) {
+  return char >= "A" && char <= "Z";
+}
+function isLowercaseAscii(char) {
+  return char >= "a" && char <= "z";
+}
+function isLowercaseOrDigitAscii(char) {
+  return isLowercaseAscii(char) || char >= "0" && char <= "9";
+}
+function isAsciiAlnum2(char) {
+  return isUppercaseAscii(char) || isLowercaseAscii(char) || char >= "0" && char <= "9";
+}
 function sanitizeEnvKeys(env, explicitKeys) {
   const sourceKeys = explicitKeys ?? Object.keys(env ?? {});
   return [...new Set(sourceKeys)].filter((key) => typeof key === "string" && key.length > 0).sort((left, right) => left.localeCompare(right));
@@ -4697,12 +5335,19 @@ async function scanDatasetFiles(root) {
       const relativePath = path4.relative(root, entryPath).split(path4.sep).join("/");
       if (entryStat.isSymbolicLink()) {
         const target = await readlink(entryPath);
+        const resolvedTarget = path4.resolve(directory, target);
+        const realTarget = await realpath3(resolvedTarget);
+        const targetRelativePath = path4.relative(root, realTarget);
+        if (targetRelativePath.length === 0 || targetRelativePath === ".." || targetRelativePath.startsWith(`..${path4.sep}`) || path4.isAbsolute(targetRelativePath)) {
+          throw new Error(`dataset symlink target must be inside ${root}: ${entryPath}`);
+        }
+        const manifestTarget = path4.isAbsolute(target) ? targetRelativePath.split(path4.sep).join("/") : target;
         files.push({
           path: relativePath,
           kind: "symlink",
-          sizeBytes: Buffer.byteLength(target, "utf8"),
-          sha256: sha256String(target),
-          target
+          sizeBytes: Buffer.byteLength(manifestTarget, "utf8"),
+          sha256: sha256String(manifestTarget),
+          target: manifestTarget
         });
         continue;
       }
@@ -4793,6 +5438,8 @@ async function buildDatasetManifest(benchmark, datasetDir) {
   };
 }
 async function buildResultManifest(resultsDir, resultPath, result) {
+  assertPathInsideRoot(resultsDir, resultPath, "result path");
+  await assertRegularFileWithoutSymlinkComponents(resultPath, "result path");
   const fileStats = await stat2(resultPath);
   return {
     path: path4.relative(resultsDir, resultPath).split(path4.sep).join("/"),
@@ -4810,11 +5457,64 @@ async function buildResultManifest(resultsDir, resultPath, result) {
 }
 async function resolveResultPaths(resultsDir, explicitPaths) {
   if (explicitPaths !== void 0) {
-    return [...new Set(explicitPaths.map((entry) => path4.resolve(entry)))].sort((left, right) => left.localeCompare(right));
+    const resolvedPaths = await Promise.all(
+      explicitPaths.map(async (entry) => {
+        const resultPath = path4.resolve(entry);
+        assertPathInsideRoot(resultsDir, resultPath, "result path");
+        await assertRegularFileWithoutSymlinkComponents(resultPath, "result path");
+        return resultPath;
+      })
+    );
+    return [...new Set(resolvedPaths)].sort((left, right) => left.localeCompare(right));
   }
   const summaries = await listBenchmarkResults(resultsDir);
   return summaries.map((summary) => path4.resolve(summary.path));
 }
+function assertPathInsideRoot(root, targetPath, label) {
+  const resolvedRoot = path4.resolve(root);
+  const resolvedTargetPath = path4.resolve(targetPath);
+  const relativePath = path4.relative(resolvedRoot, resolvedTargetPath);
+  if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path4.sep}`) || path4.isAbsolute(relativePath)) {
+    throw new Error(`${label} must be inside ${resolvedRoot}: ${resolvedTargetPath}`);
+  }
+}
+async function assertRegularFileWithoutSymlinkComponents(targetPath, label) {
+  const targetStat = await lstatPathWithoutSymlinkComponents(path4.resolve(targetPath));
+  if (!targetStat?.isFile()) {
+    throw new Error(`${label} must be a regular file without symlink components: ${path4.resolve(targetPath)}`);
+  }
+}
+function isKnownNonSecretOptionFlag(arg) {
+  if (!arg.startsWith("-")) return false;
+  return NON_SECRET_ARG_FLAGS.has(getOptionName(arg));
+}
+function isOptionValueBoundaryFlag(arg) {
+  if (!arg.startsWith("-")) return false;
+  const optionName = getOptionName(arg);
+  return BENCH_OPTION_BOUNDARY_FLAGS.has(optionName) || NON_SECRET_ARG_FLAGS.has(optionName) || SECRET_ARG_FLAGS.has(optionName) || arg.includes("=") && isSecretConfigKey(optionName);
+}
+function shouldConsumeSeparatedSecretFlagValue(arg) {
+  return !isOptionValueBoundaryFlag(arg);
+}
+function getOptionName(arg) {
+  return arg.includes("=") ? arg.slice(0, arg.indexOf("=")) : arg;
+}
+function getAttachedShortSecretFlag(arg) {
+  if (arg.includes("=")) return void 0;
+  for (const flag of ["-k", "-p", "-t"]) {
+    if (arg.startsWith(flag) && arg.length > flag.length) return flag;
+  }
+  return void 0;
+}
+function getAttachedLongSecretArg(arg) {
+  for (const flag of ATTACHED_LONG_SECRET_ARG_FLAGS) {
+    if (arg.startsWith(`${flag}=`) && arg.length > flag.length + 1) {
+      return { flag, delimiter: "=" };
+    }
+    if (arg.startsWith(flag) && arg.length > flag.length && arg[flag.length] !== ":") return { flag, delimiter: "" };
+  }
+  return void 0;
+}
 async function buildConfigFileEntries(configFiles = []) {
   const entries = [];
   for (const configFile of configFiles) {
@@ -4827,11 +5527,14 @@ async function buildConfigFileEntries(configFiles = []) {
         entries.push({ label: configFile.label, path: configFile.path, missing: true });
         continue;
       }
+      const content = await readFile4(configFile.path);
+      const sanitizedConfig = sanitizeConfigFileContent(content);
       entries.push({
         label: configFile.label,
         path: configFile.path,
         sizeBytes: fileStats.size,
-        sha256: await sha256File(configFile.path)
+        ...sanitizedConfig.sha256 !== void 0 ? { sha256: sanitizedConfig.sha256 } : {},
+        ...sanitizedConfig.redacted ? { redacted: true } : {}
       });
     } catch {
       entries.push({ label: configFile.label, path: configFile.path, missing: true });
@@ -4839,15 +5542,38 @@ async function buildConfigFileEntries(configFiles = []) {
   }
   return entries;
 }
+function sanitizeConfigFileContent(content) {
+  const text = content.toString("utf8");
+  const trimmed = text.trim();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      const redacted = redactStructuredSecrets(parsed);
+      if (redacted.changed) {
+        return { sha256: sha256String(stableStringify(redacted.value)), redacted: true };
+      }
+    } catch {
+    }
+  }
+  if (containsSecretConfigText(text)) {
+    return { redacted: true };
+  }
+  return { sha256: sha256Buffer(content), redacted: false };
+}
+function containsSecretConfigText(text) {
+  if (sanitizeUrlSecrets(text) !== text) return true;
+  const assignmentPattern = /["']?([A-Za-z0-9_.:[\]-]{3,80})["']?\s*[:=]\s*("[^"]+"|'[^']+'|[^\s,;}]+)/g;
+  for (const match of text.matchAll(assignmentPattern)) {
+    const key = match[1];
+    if (key && isSecretConfigKey(key)) return true;
+  }
+  return false;
+}
 function collectQmdCollections(explicitCollections, results) {
   const collections = new Set(explicitCollections ?? []);
   for (const result of results) {
     const config = result.config.remnicConfig ?? {};
-    for (const key of [
-      "qmdCollection",
-      "qmdColdCollection",
-      "conversationIndexQmdCollection"
-    ]) {
+    for (const key of ["qmdCollection", "qmdColdCollection", "conversationIndexQmdCollection"]) {
       const value = config[key];
       if (typeof value === "string" && value.trim().length > 0) {
         collections.add(value);
@@ -4873,9 +5599,7 @@ async function buildBenchmarkReproManifest(resultsDir, options = {}) {
   const resultPaths = await resolveResultPaths(resolvedResultsDir, options.resultPaths);
   const loadedResults = await Promise.all(resultPaths.map((resultPath) => loadBenchmarkResult(resultPath)));
   const resultEntries = await Promise.all(
-    resultPaths.map(
-      (resultPath, index) => buildResultManifest(resolvedResultsDir, resultPath, loadedResults[index])
-    )
+    resultPaths.map((resultPath, index) => buildResultManifest(resolvedResultsDir, resultPath, loadedResults[index]))
   );
   const selectedBenchmarks = options.selectedBenchmarks ?? [...new Set(loadedResults.map((result) => result.meta.benchmark))].sort();
   const selectedWorkItems = options.selectedWorkItems ?? loadedResults.map((result) => ({
@@ -4940,7 +5664,7 @@ async function writeBenchmarkReproManifest(resultsDir, options = {}) {
 
 // src/published-artifact.ts
 import { createHash as createHash4 } from "crypto";
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
 import path5 from "path";
 var BENCHMARK_ARTIFACT_SCHEMA_VERSION = 1;
 var PUBLISHED_BENCHMARK_ARTIFACT_IDS = Object.freeze([
@@ -5116,7 +5840,7 @@ function parseBenchmarkArtifact(raw) {
   return parsed;
 }
 async function loadBenchmarkArtifact(filePath) {
-  const raw = await readFile4(filePath, "utf8");
+  const raw = await readFile5(filePath, "utf8");
   const artifact = parseBenchmarkArtifact(raw);
   return {
     artifact,
@@ -5493,7 +6217,7 @@ function createAnthropicProvider(config) {
 // src/providers/codex-cli.ts
 import { spawn } from "child_process";
 import { createHash as createHash5, randomUUID } from "crypto";
-import { mkdir as mkdir5, mkdtemp as mkdtemp2, readFile as readFile5, rm as rm2, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir5, mkdtemp as mkdtemp2, readFile as readFile6, rm as rm2, writeFile as writeFile5 } from "fs/promises";
 import os3 from "os";
 import path6 from "path";
 var DEFAULT_REASONING_EFFORT = "xhigh";
@@ -6340,7 +7064,7 @@ function signalExitCode(signal) {
 }
 async function readCodexOutput(outputPath, stdout) {
   try {
-    return await readFile5(outputPath, "utf8");
+    return await readFile6(outputPath, "utf8");
   } catch {
     return stdout;
   }
@@ -6451,7 +7175,7 @@ function createCodexCliProvider(config, deps) {
 
 // src/reporter.ts
 import { execSync } from "child_process";
-import { mkdir as mkdir7, readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
+import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile7 } from "fs/promises";
 import path9 from "path";
 
 // src/filename-safety.ts
@@ -6485,10 +7209,7 @@ async function writeLeaderboardArtifactsForResult(result, outputDir) {
   const leaderboardDir = resolveContainedPath(outputRoot, "leaderboard");
   await mkdir6(leaderboardDir, { recursive: true });
   const timestamp = sanitizeFilenameSegment(result.meta.timestamp.replace(/[:.]/g, "-"));
-  const filePath = resolveContainedPath(
-    leaderboardDir,
-    `ama-bench-${timestamp}-answers.jsonl`
-  );
+  const filePath = resolveContainedPath(leaderboardDir, `ama-bench-${timestamp}-answers.jsonl`);
   await writeFile6(filePath, serializeJsonl(rows), "utf8");
   return [
     {
@@ -6525,7 +7246,8 @@ function buildAmaBenchLeaderboardRows(result) {
   }));
 }
 function serializeJsonl(rows) {
-  return rows.map((row) => JSON.stringify(row)).join("\n") + "\n";
+  return `${rows.map((row) => JSON.stringify(row)).join("\n")}
+`;
 }
 function amaBenchEpisodeIdForTask(task) {
   const raw = task.details?.episodeId ?? task.details?.episode_id;
@@ -6622,15 +7344,162 @@ function redactSecrets(value) {
   if (Array.isArray(value)) {
     return value.map((item) => redactSecrets(item));
   }
+  if (typeof value === "string") {
+    return redactFreeformStringSecrets(value);
+  }
   if (!value || typeof value !== "object") {
     return value;
   }
   const redacted = {};
   for (const [key, nestedValue] of Object.entries(value)) {
-    redacted[key] = isSecretKey(key) ? REDACTED_SECRET : redactSecrets(nestedValue);
+    redacted[key] = isSensitiveResultKey(key) ? REDACTED_SECRET : redactSecrets(nestedValue);
   }
   return redacted;
 }
+function redactFreeformStringSecrets(value) {
+  const structuredRedaction = redactStructuredStringSecrets(value);
+  if (structuredRedaction !== void 0) return structuredRedaction;
+  return redactSecretAssignments(redactAuthorizationSchemes(redactFreeformUrlSecrets(value)));
+}
+function redactStructuredStringSecrets(value) {
+  const trimmed = value.trim();
+  if (!(trimmed.startsWith("{") || trimmed.startsWith("["))) return void 0;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const redacted = redactJsonValueSecrets(parsed);
+    if (!redacted.changed) return value;
+    return JSON.stringify(redacted.value);
+  } catch {
+    return void 0;
+  }
+}
+function redactJsonValueSecrets(value) {
+  if (Array.isArray(value)) {
+    let changed2 = false;
+    const entries = value.map((item) => {
+      const redactedItem = redactJsonValueSecrets(item);
+      changed2 ||= redactedItem.changed;
+      return redactedItem.value;
+    });
+    return { value: entries, changed: changed2 };
+  }
+  if (typeof value === "string") {
+    const redactedValue = redactSecretAssignments(redactAuthorizationSchemes(redactFreeformUrlSecrets(value)));
+    return { value: redactedValue, changed: redactedValue !== value };
+  }
+  if (!value || typeof value !== "object") {
+    return { value, changed: false };
+  }
+  const redacted = {};
+  let changed = false;
+  for (const [key, nestedValue] of Object.entries(value)) {
+    if (isSensitiveResultKey(key)) {
+      redacted[key] = REDACTED_SECRET;
+      changed = true;
+      continue;
+    }
+    const redactedNestedValue = redactJsonValueSecrets(nestedValue);
+    redacted[key] = redactedNestedValue.value;
+    changed ||= redactedNestedValue.changed;
+  }
+  return { value: redacted, changed };
+}
+function redactAuthorizationSchemes(value) {
+  return value.replace(
+    /\b(authorization)\b(\s*[:=]\s*)(bearer|basic|digest)(\s+)("[^"]+"|'[^']+'|[^\s,;}]+)/gi,
+    (_match, key, separator, scheme, space, secret) => `${key}${separator}${scheme}${space}${redactSecretLiteral(secret)}`
+  );
+}
+function redactSecretAssignments(value) {
+  let redacted = "";
+  let cursor = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const parsed = parseSecretAssignment(value, index);
+    if (!parsed) continue;
+    if (!isSensitiveResultKey(parsed.key) || isAuthorizationAssignmentScheme(parsed.rawValue)) continue;
+    const valueEnd = isCookieResultKey(parsed.key) ? findCookieAssignmentValueEnd(value, parsed.valueStart, parsed.valueEnd) : parsed.valueEnd;
+    const rawValue = value.slice(parsed.valueStart, valueEnd);
+    redacted += value.slice(cursor, parsed.valueStart);
+    redacted += redactSecretLiteral(rawValue);
+    cursor = valueEnd;
+    index = valueEnd - 1;
+  }
+  return cursor === 0 ? value : redacted + value.slice(cursor);
+}
+function parseSecretAssignment(value, startIndex) {
+  if (startIndex > 0 && isAssignmentKeyChar(value[startIndex - 1])) return void 0;
+  let keyStart = startIndex;
+  let keyEnd;
+  const quote = value[startIndex];
+  if (quote === '"' || quote === "'") {
+    keyStart = startIndex + 1;
+    keyEnd = value.indexOf(quote, keyStart);
+    if (keyEnd === -1) return void 0;
+  } else {
+    if (!isAssignmentKeyChar(value[startIndex])) return void 0;
+    keyEnd = keyStart;
+    while (keyEnd < value.length && isAssignmentKeyChar(value[keyEnd]) && keyEnd - keyStart <= 80) {
+      keyEnd += 1;
+    }
+  }
+  const key = value.slice(keyStart, keyEnd);
+  if (key.length < 3 || key.length > 80) return void 0;
+  let separatorIndex = quote === '"' || quote === "'" ? keyEnd + 1 : keyEnd;
+  while (separatorIndex < value.length && /\s/.test(value[separatorIndex])) separatorIndex += 1;
+  if (value[separatorIndex] !== ":" && value[separatorIndex] !== "=") return void 0;
+  let valueStart = separatorIndex + 1;
+  while (valueStart < value.length && /\s/.test(value[valueStart])) valueStart += 1;
+  if (valueStart >= value.length) return void 0;
+  let valueEnd;
+  const valueQuote = value[valueStart];
+  if (valueQuote === '"' || valueQuote === "'") {
+    const closingQuote = value.indexOf(valueQuote, valueStart + 1);
+    if (closingQuote === -1) return void 0;
+    valueEnd = closingQuote + 1;
+  } else {
+    valueEnd = valueStart;
+    while (valueEnd < value.length && !isAssignmentValueTerminator(value[valueEnd])) valueEnd += 1;
+  }
+  return { key, valueStart, valueEnd, rawValue: value.slice(valueStart, valueEnd) };
+}
+function findCookieAssignmentValueEnd(value, valueStart, parsedValueEnd) {
+  const quote = value[valueStart];
+  if (quote === '"' || quote === "'") return parsedValueEnd;
+  let cursor = valueStart;
+  while (cursor < value.length && !isCookieAssignmentValueTerminator(value[cursor])) cursor += 1;
+  return cursor;
+}
+function isAssignmentKeyChar(char) {
+  return typeof char === "string" && /[A-Za-z0-9_.[\]-]/.test(char);
+}
+function isAssignmentValueTerminator(char) {
+  return /\s/.test(char) || char === "," || char === ";" || char === "}" || char === "&" || char === "#";
+}
+function isCookieAssignmentValueTerminator(char) {
+  return char === "\n" || char === "\r" || char === "," || char === "}" || char === "&" || char === "#";
+}
+function isAuthorizationAssignmentScheme(value) {
+  return /^(?:bearer|basic|digest)$/i.test(value.replace(/^["']|["']$/g, ""));
+}
+function redactSecretLiteral(value) {
+  const quote = value.length >= 2 && (value.startsWith('"') || value.startsWith("'")) ? value[0] : void 0;
+  return quote && value.endsWith(quote) ? `${quote}${REDACTED_SECRET}${quote}` : REDACTED_SECRET;
+}
+function redactFreeformUrlSecrets(value) {
+  return redactUrlSecrets(value, REDACTED_SECRET, isSensitiveResultKey);
+}
+function isSensitiveResultKey(key) {
+  const normalizedKey = normalizeSensitiveResultKey(key).toLowerCase();
+  if (normalizedKey === "source-session") return false;
+  return isSecretKey(key) || normalizedKey === "cookie" || normalizedKey === "set-cookie" || normalizedKey === "session";
+}
+function isCookieResultKey(key) {
+  return normalizeSensitiveResultKey(key).toLowerCase() === "cookie";
+}
+function normalizeSensitiveResultKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\[\]._:]+/g, "-");
+}
 function sanitizeForJson(value) {
   if (typeof value === "string") {
     return replaceLoneSurrogates(value);
@@ -6674,48 +7543,39 @@ async function writeBenchmarkResult(result, outputDir) {
   await mkdir7(outputRoot, { recursive: true });
   const safeBenchmark = sanitizeFilenameSegment(result.meta.benchmark);
   const safeRemnicVersion = sanitizeFilenameSegment(result.meta.remnicVersion);
-  const timestamp = sanitizeFilenameSegment(
-    result.meta.timestamp.replace(/[:.]/g, "-")
-  );
-  const filePath = resolveContainedPath(
-    outputRoot,
-    `${safeBenchmark}-v${safeRemnicVersion}-${timestamp}.json`
+  const timestamp = sanitizeFilenameSegment(result.meta.timestamp.replace(/[:.]/g, "-"));
+  const filePath = resolveContainedPath(outputRoot, `${safeBenchmark}-v${safeRemnicVersion}-${timestamp}.json`);
+  const publicBaseResult = sanitizeBenchmarkResultForJson(redactBenchmarkResultSecrets(result));
+  const leaderboardArtifacts = await writeLeaderboardArtifactsForResult(publicBaseResult, outputRoot).catch(
+    (error) => [
+      {
+        benchmark: publicBaseResult.meta.benchmark,
+        path: "",
+        format: "leaderboard-artifact-error",
+        records: 0,
+        error: error instanceof Error ? error.message : String(error)
+      }
+    ]
   );
-  const leaderboardArtifacts = await writeLeaderboardArtifactsForResult(
-    result,
-    outputRoot
-  ).catch((error) => [
-    {
-      benchmark: result.meta.benchmark,
-      path: "",
-      format: "leaderboard-artifact-error",
-      records: 0,
-      error: error instanceof Error ? error.message : String(error)
-    }
-  ]);
   const resultWithArtifacts = {
-    ...result,
+    ...publicBaseResult,
     config: {
-      ...result.config,
+      ...publicBaseResult.config,
       benchmarkOptions: {
-        ...result.config.benchmarkOptions ?? {},
+        ...publicBaseResult.config.benchmarkOptions ?? {},
         leaderboardArtifacts
       }
     }
   };
-  const publicResult = sanitizeBenchmarkResultForJson(
-    redactBenchmarkResultSecrets(resultWithArtifacts)
-  );
-  await writeFile7(filePath, JSON.stringify(publicResult, null, 2) + "\n");
+  const publicResult = sanitizeBenchmarkResultForJson(redactBenchmarkResultSecrets(resultWithArtifacts));
+  await writeFile7(filePath, `${JSON.stringify(publicResult, null, 2)}
+`);
   return filePath;
 }
 async function getRemnicVersion() {
   try {
     const packageJson = JSON.parse(
-      await readFile6(
-        path9.resolve(import.meta.dirname, "../../../package.json"),
-        "utf8"
-      )
+      await readFile7(path9.resolve(import.meta.dirname, "../../../package.json"), "utf8")
     );
     return typeof packageJson.version === "string" ? packageJson.version : "unknown";
   } catch {
@@ -7944,9 +8804,7 @@ function asStringArray(value) {
 }
 
 // src/responders.ts
-import {
-  FallbackLlmClient
-} from "@remnic/core";
+import { FallbackLlmClient } from "@remnic/core";
 var DEFAULT_RESPONDER_SYSTEM_PROMPT = [
   "You answer benchmark questions using only the supplied Remnic memory context.",
   "If the context does not contain enough information, say that the answer is unknown.",
@@ -7971,21 +8829,12 @@ var SCORE_CUE_REGEX = /\b(score|rated|rating|grade|graded|result|overall|final)\
 var CONTEXT_COMPACTION_MARKER = "[...omitted unrelated recalled context...]";
 var COMPACTED_CONTEXT_PREFIX = "[Remnic memory context compacted for the responder prompt; full recalled text is preserved in the benchmark artifact.]";
 var TRAJECTORY_ANALYSIS_HEADING = "## Trajectory analysis";
-var TRAJECTORY_LABELS = Object.freeze([
-  "action",
-  "observation",
-  "step",
-  "turn"
-]);
+var TRAJECTORY_LABELS = Object.freeze(["action", "observation", "step", "turn"]);
 function createResponderFromProvider(provider, options = {}) {
   return {
     async respond(question, recalledText, control) {
       const responderQuestion = options.promptBudgetChars === void 0 ? question : compactResponderQuestion(question, options.promptBudgetChars);
-      const responderContext = options.contextBudgetChars === void 0 ? recalledText : compactResponderContext(
-        recalledText,
-        question,
-        options.contextBudgetChars
-      );
+      const responderContext = options.contextBudgetChars === void 0 ? recalledText : compactResponderContext(recalledText, question, options.contextBudgetChars);
       const completion = await provider.complete(
         [
           `QUESTION: ${responderQuestion}`,
@@ -8036,10 +8885,7 @@ function compactResponderQuestion(question, maxChars) {
   }
   const separator = "\n\n";
   const protocolBudget = maxChars - baseQuestion.length - separator.length;
-  return `${baseQuestion}${separator}${headTailCompact(
-    conciseProtocol,
-    protocolBudget
-  )}`;
+  return `${baseQuestion}${separator}${headTailCompact(conciseProtocol, protocolBudget)}`;
 }
 function extractBenchmarkQuestionText(question) {
   const strictIndex = question.indexOf("\n\nBenchmark answer protocol:");
@@ -8097,15 +8943,15 @@ function compactResponderContext(recalledText, question, maxChars) {
     return recalledText;
   }
   const stepRefs = extractReferencedTrajectoryNumbers(question);
-  const trajectoryAnalysis = extractContextSection(
-    normalized,
-    TRAJECTORY_ANALYSIS_HEADING
-  );
-  const focusedTranscript = stepRefs.size > 0 ? buildTrajectoryFocusedContext(normalized, stepRefs) : "";
-  const body = joinCompactedContextSections(
-    trajectoryAnalysis,
-    focusedTranscript
-  );
+  const trajectoryAnalysis = extractContextSection(normalized, TRAJECTORY_ANALYSIS_HEADING);
+  const preserveTrajectorySpan = shouldPreserveTrajectorySpan(question);
+  const includeTrajectoryBoundary = shouldIncludeTrajectorySpanBoundary(question);
+  const preserveTrajectoryInterval = shouldPreserveTrajectoryInterval(question);
+  const focusedTranscript = stepRefs.size > 0 ? preserveTrajectorySpan ? buildTrajectorySpanContext(normalized, stepRefs, {
+    includeBoundary: includeTrajectoryBoundary,
+    intervalOnly: preserveTrajectoryInterval
+  }) : buildTrajectoryFocusedContext(normalized, stepRefs) : "";
+  const body = joinCompactedContextSections(trajectoryAnalysis, focusedTranscript);
   const compactedBody = body.trim().length > 0 ? body.trim() : headTailCompact(normalized, maxChars);
   const withPrefix = `${COMPACTED_CONTEXT_PREFIX}
 ${compactedBody}`;
@@ -8288,6 +9134,58 @@ function buildTrajectoryFocusedContext(recalledText, stepRefs) {
   }
   return rendered.join("\n");
 }
+function buildTrajectorySpanContext(recalledText, stepRefs, options) {
+  const lines = recalledText.split("\n");
+  const include = /* @__PURE__ */ new Set();
+  const minStep = Math.min(...stepRefs);
+  const maxStep = Math.max(...stepRefs);
+  for (let index = 0; index < lines.length; index += 1) {
+    if (isContextHeading(lines[index])) {
+      include.add(index);
+      continue;
+    }
+    const trajectoryNumber = parseTrajectoryLineNumber(lines[index]);
+    if (trajectoryNumber !== void 0 && isTrajectoryNumberInSpan(trajectoryNumber, minStep, maxStep, options)) {
+      include.add(index);
+    }
+  }
+  if (include.size === 0) {
+    return "";
+  }
+  const rendered = [];
+  let lastIncluded = -1;
+  for (let index = 0; index < lines.length; index += 1) {
+    if (!include.has(index)) {
+      continue;
+    }
+    if (lastIncluded >= 0 && index > lastIncluded + 1 && rendered.at(-1) !== CONTEXT_COMPACTION_MARKER) {
+      rendered.push(CONTEXT_COMPACTION_MARKER);
+    }
+    rendered.push(lines[index]);
+    lastIncluded = index;
+  }
+  return rendered.join("\n");
+}
+function isTrajectoryNumberInSpan(trajectoryNumber, minStep, maxStep, options) {
+  if (options.intervalOnly || minStep !== maxStep) {
+    return trajectoryNumber >= minStep && (options.includeBoundary ? trajectoryNumber <= maxStep : trajectoryNumber < maxStep);
+  }
+  return options.includeBoundary ? trajectoryNumber <= maxStep : trajectoryNumber < maxStep;
+}
+function shouldPreserveTrajectorySpan(question) {
+  const baseQuestion = extractBenchmarkQuestionText(question).toLowerCase();
+  return /\b(?:before|until|through|thru|prior to|between|history|histories|range|count|counts|list|lists)\b|up to/.test(
+    baseQuestion
+  );
+}
+function shouldIncludeTrajectorySpanBoundary(question) {
+  const baseQuestion = extractBenchmarkQuestionText(question).toLowerCase();
+  return !/\b(?:before|prior to)\b/.test(baseQuestion);
+}
+function shouldPreserveTrajectoryInterval(question) {
+  const baseQuestion = extractBenchmarkQuestionText(question).toLowerCase();
+  return /\bbetween\b/.test(baseQuestion);
+}
 function isContextHeading(line) {
   const trimmed = line.trim();
   return trimmed.startsWith("#") || trimmed === "REMNIC_MEMORY_CONTEXT:" || trimmed.startsWith("Memory context") || trimmed.startsWith("Relevant");
@@ -8326,9 +9224,9 @@ ${CONTEXT_COMPACTION_MARKER}
   return `${text.slice(0, headChars).trimEnd()}${marker}${text.slice(text.length - tailChars).trimStart()}`;
 }
 function isWordBoundary(char) {
-  return char === void 0 || !isAsciiAlnum(char);
+  return char === void 0 || !isAsciiAlnum3(char);
 }
-function isAsciiAlnum(char) {
+function isAsciiAlnum3(char) {
   const code = char.charCodeAt(0);
   return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
 }
@@ -8433,9 +9331,7 @@ function createAmaBenchRecommendedJudgeFromProvider(provider) {
 }
 function createProviderBackedAmaBenchRecommendedJudge(config, providerInstance) {
   validateProviderConfig(config, "AMA-Bench recommended judge");
-  return createAmaBenchRecommendedJudgeFromProvider(
-    providerInstance ?? createProvider(config)
-  );
+  return createAmaBenchRecommendedJudgeFromProvider(providerInstance ?? createProvider(config));
 }
 function createStructuredJudgeFromProvider(provider) {
   return {
@@ -8544,9 +9440,7 @@ function parseScalarJudgeScore(raw) {
       return clampNormalizedScore(numerator);
     }
   }
-  const fractionMatches = [
-    ...trimmed.matchAll(/(-?\d+(?:\.\d+)?)\s*\/\s*(-?\d+(?:\.\d+)?)/g)
-  ];
+  const fractionMatches = [...trimmed.matchAll(/(-?\d+(?:\.\d+)?)\s*\/\s*(-?\d+(?:\.\d+)?)/g)];
   for (const match of fractionMatches.reverse()) {
     const numerator = Number.parseFloat(match[1]);
     const denominator = Number.parseFloat(match[2]);
@@ -8561,9 +9455,7 @@ function parseScalarJudgeScore(raw) {
       return clampNormalizedScore(percent / 100);
     }
   }
-  const outOfMatches = [
-    ...trimmed.matchAll(/(-?\d+(?:\.\d+)?)\s+out\s+of\s+(-?\d+(?:\.\d+)?)/gi)
-  ];
+  const outOfMatches = [...trimmed.matchAll(/(-?\d+(?:\.\d+)?)\s+out\s+of\s+(-?\d+(?:\.\d+)?)/gi)];
   for (const match of outOfMatches.reverse()) {
     const numerator = Number.parseFloat(match[1]);
     const denominator = Number.parseFloat(match[2]);
@@ -8729,7 +9621,7 @@ function clampNormalizedScore(value) {
 
 // src/runtime-profiles.ts
 import path10 from "path";
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import {
   resolvePluginEntry,
   setCodexCliFallbackRunnerForProcess
@@ -9313,7 +10205,7 @@ function deriveOpenclawRuntimeContext(configPath) {
   };
 }
 async function loadJsonObject(filePath, label) {
-  const raw = await readFile7(filePath, "utf8");
+  const raw = await readFile8(filePath, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -9639,7 +10531,7 @@ import path31 from "path";
 
 // src/benchmarks/published/ama-bench/runner.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 import path11 from "path";
 
 // src/benchmarks/published/ama-bench/fixture.ts
@@ -9851,15 +10743,15 @@ function normalizeTextForContainment(value) {
   return trimTrailingSentencePunctuation(normalizeText(value).replace(/\s+/g, " "));
 }
 function isShortLexicalAnswer(value) {
-  return value.length <= 3 && [...value].some((character) => isAsciiLetter(character)) && [...value].every((character) => isAsciiAlphaNumeric(character));
+  return value.length <= 3 && [...value].some((character) => isAsciiLetter2(character)) && [...value].every((character) => isAsciiAlphaNumeric(character));
 }
 function containsShortLexicalAnswer(value, expected) {
   return value.split(/[^a-z0-9]+/).some((token) => token === expected);
 }
 function isAsciiAlphaNumeric(value) {
-  return isAsciiLetter(value) || value >= "0" && value <= "9";
+  return isAsciiLetter2(value) || value >= "0" && value <= "9";
 }
-function isAsciiLetter(value) {
+function isAsciiLetter2(value) {
   return value >= "a" && value <= "z";
 }
 function trimTrailingSentencePunctuation(value) {
@@ -10217,7 +11109,7 @@ async function loadDataset(mode, datasetDir, limit) {
     const filePath = path11.join(datasetDir, "open_end_qa_set.jsonl");
     let raw;
     try {
-      raw = await readFile8(filePath, "utf8");
+      raw = await readFile9(filePath, "utf8");
     } catch (error) {
       throw new Error(
         `AMA-Bench dataset not found at ${filePath}: ${error instanceof Error ? error.message : String(error)}`
@@ -10509,7 +11401,7 @@ function isValidQaPairs(value) {
 
 // src/benchmarks/published/amemgym/runner.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import path12 from "path";
 
 // src/benchmarks/published/amemgym/fixture.ts
@@ -11039,7 +11931,7 @@ async function loadDataset2(mode, datasetDir, limit) {
     const datasetErrors = [];
     for (const filename of DATASET_FILENAMES) {
       try {
-        const raw = await readFile9(path12.join(datasetDir, filename), "utf8");
+        const raw = await readFile10(path12.join(datasetDir, filename), "utf8");
         const parsed = parseDataset(raw, filename, normalizedLimit);
         return ensureDatasetProfiles(parsed);
       } catch (error) {
@@ -11213,7 +12105,7 @@ function normalizeRole(role) {
 
 // src/benchmarks/published/memory-arena/runner.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { readFile as readFile10, readdir as readdir5, stat as stat3 } from "fs/promises";
+import { readFile as readFile11, readdir as readdir5, stat as stat3 } from "fs/promises";
 import path13 from "path";
 import { expandTildePath as expandTildePath2 } from "@remnic/core";
 
@@ -11541,7 +12433,7 @@ async function loadDataset3(mode, datasetDir, limit) {
       if (remainingLimit2 === 0) {
         break;
       }
-      const raw = await readFile10(path13.join(datasetDir, filename), "utf8");
+      const raw = await readFile11(path13.join(datasetDir, filename), "utf8");
       const parsedTasks = [];
       raw.split("\n").forEach((line, lineIndex) => {
         if (line.trim().length === 0) {
@@ -11877,7 +12769,7 @@ async function loadMemoryArenaWebshopProductCatalog(datasetDir) {
       `MemoryArena WebShop product sidecar is ${sourceStat.size} bytes; provide a compact JSON/JSONL sidecar smaller than ${MEMORY_ARENA_WEBSHOP_PRODUCTS_MAX_BYTES} bytes instead of the full WebShop catalog.`
     );
   }
-  const raw = await readFile10(sourcePath, "utf8");
+  const raw = await readFile11(sourcePath, "utf8");
   const records = parseMemoryArenaWebshopSidecarRecords(raw, sourcePath);
   const byAsin = /* @__PURE__ */ new Map();
   for (const record of records) {
@@ -13326,7 +14218,7 @@ function scoreSubtaskSuccess(scores) {
 import { collectTemporalLexicalCues } from "@remnic/core";
 
 // src/benchmarks/published/dataset-loader.ts
-import { readFile as readFile11 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 import path14 from "path";
 
 // src/benchmarks/published/longmemeval/fixture.ts
@@ -13433,7 +14325,7 @@ async function loadDataset4(options) {
       const abs = path14.join(options.datasetDir, filename);
       let raw;
       try {
-        raw = await readFile11(abs, "utf8");
+        raw = await readFile12(abs, "utf8");
       } catch (error) {
         errors.push(
           `${filename}: ${error instanceof Error ? error.message : String(error)}`
@@ -16681,7 +17573,7 @@ var StructuredLiteralParser = class {
 
 // src/benchmarks/published/personamem/runner.ts
 import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
-import { readFile as readFile12, realpath as realpath4 } from "fs/promises";
+import { readFile as readFile13, realpath as realpath4 } from "fs/promises";
 import path16 from "path";
 
 // src/benchmarks/published/personamem/fixture.ts
@@ -16961,7 +17853,7 @@ async function loadDataset8(mode, datasetDir, limit) {
       const datasetPath = path16.join(datasetDir, relativePath);
       let raw;
       try {
-        raw = await readFile12(datasetPath, "utf8");
+        raw = await readFile13(datasetPath, "utf8");
       } catch (error) {
         datasetErrors.push(
           `${relativePath}: ${error instanceof Error ? error.message : String(error)}`
@@ -17019,7 +17911,7 @@ async function hydrateSample(row, datasetRoot) {
     datasetRoot,
     row.chat_history_32k_link
   );
-  const chatHistoryRaw = await readFile12(chatHistoryPath, "utf8");
+  const chatHistoryRaw = await readFile13(chatHistoryPath, "utf8");
   const chatHistory = parseChatHistory(
     chatHistoryRaw,
     row.chat_history_32k_link
@@ -17485,7 +18377,7 @@ function applyLimit6(items, limit) {
 
 // src/benchmarks/published/membench/runner.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { readFile as readFile13, readdir as readdir7 } from "fs/promises";
+import { readFile as readFile14, readdir as readdir7 } from "fs/promises";
 import path17 from "path";
 
 // src/benchmarks/published/membench/fixture.ts
@@ -17747,7 +18639,7 @@ async function loadDataset9(mode, datasetDir, limit) {
     let remainingLimit = normalizedLimit;
     for (const filename of filenames) {
       try {
-        const raw = await readFile13(path17.join(datasetDir, filename), "utf8");
+        const raw = await readFile14(path17.join(datasetDir, filename), "utf8");
         const parsed = filename.endsWith(".jsonl") ? parseJsonlDataset(raw, filename) : parseJsonDataset(raw, filename);
         const limitedCases = remainingLimit === 0 ? [] : applyLimit7(parsed, remainingLimit);
         if (limitedCases.length > 0) {
@@ -18614,7 +19506,7 @@ function isPlainObject2(value) {
 
 // src/benchmarks/published/memoryagentbench/runner.ts
 import { randomUUID as randomUUID9 } from "crypto";
-import { access, readFile as readFile14 } from "fs/promises";
+import { access, readFile as readFile15 } from "fs/promises";
 import path18 from "path";
 
 // src/benchmarks/published/memoryagentbench/fixture.ts
@@ -19637,7 +20529,7 @@ async function loadRecSysEntityMapping(datasetDir) {
     }
     let parsed;
     try {
-      parsed = JSON.parse(await readFile14(candidate, "utf8"));
+      parsed = JSON.parse(await readFile15(candidate, "utf8"));
     } catch (error) {
       console.error(
         `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} is invalid JSON; trying the next candidate: ${error instanceof Error ? error.message : String(error)}`
@@ -19800,7 +20692,7 @@ async function loadDataset10(mode, datasetDir, limit) {
   return ensureDatasetItems(applyLimit8(MEMORY_AGENT_BENCH_SMOKE_FIXTURE, normalizedLimit));
 }
 async function readDatasetFile(filePath, filename) {
-  const raw = await readFile14(filePath, "utf8");
+  const raw = await readFile15(filePath, "utf8");
   const parsed = filename.endsWith(".jsonl") ? parseJsonLines(raw, filename) : parseJsonArray(raw, filename);
   return parsed.map(
     (item, index) => parseMemoryAgentBenchItem(item, `${filename} item ${index + 1}`)
@@ -21415,7 +22307,7 @@ function parseNonNegativeInt(rawValue) {
 import os6 from "os";
 import path21 from "path";
 import { randomUUID as randomUUID14 } from "crypto";
-import { mkdtemp as mkdtemp4, mkdir as mkdir8, readFile as readFile15, rm as rm4, writeFile as writeFile8 } from "fs/promises";
+import { mkdtemp as mkdtemp4, mkdir as mkdir8, readFile as readFile16, rm as rm4, writeFile as writeFile8 } from "fs/promises";
 import {
   createVersion,
   diffVersions,
@@ -21582,7 +22474,7 @@ async function executeCase2(sample) {
         await createVersion(pagePath, "modified content", "write", config, void 0, void 0, tmpDir);
         await revertToVersion(pagePath, "1", config, void 0, tmpDir);
         const history = await listVersions(pagePath, config, tmpDir);
-        const pageContent = await readFile15(pagePath, "utf-8");
+        const pageContent = await readFile16(pagePath, "utf-8");
         const observed = await getVersion(pagePath, "3", config, tmpDir);
         return {
           versionIds: history.versions.map((version) => version.versionId),
@@ -21599,7 +22491,7 @@ async function executeCase2(sample) {
           await createVersion(pagePath, content, "write", pruningConfig, void 0, void 0, tmpDir);
         }
         const history = await listVersions(pagePath, pruningConfig, tmpDir);
-        const pageContent = await readFile15(pagePath, "utf-8");
+        const pageContent = await readFile16(pagePath, "utf-8");
         const prunedIds = [];
         for (const versionId of ["1", "2"]) {
           try {
@@ -21637,7 +22529,7 @@ async function executeCase2(sample) {
           tmpDir
         );
         const history = await listVersions(pagePath, config, tmpDir);
-        const pageContent = await readFile15(pagePath, "utf-8");
+        const pageContent = await readFile16(pagePath, "utf-8");
         const diff = await diffVersions(pagePath, "1", "2", config, tmpDir);
         const observedLines = normalizeDiffChangedLines(diff);
         return {
@@ -28679,7 +29571,7 @@ function getBenchmarkLowerIsBetter(benchmarkId) {
 }
 
 // src/integrity/sealed-qrels.ts
-import { readFile as readFile16 } from "fs/promises";
+import { readFile as readFile17 } from "fs/promises";
 function isSealedQrelsArtifact(value) {
   if (!value || typeof value !== "object") {
     return false;
@@ -28749,7 +29641,7 @@ function parseSealedQrels(raw, options = {}) {
   };
 }
 async function loadSealedQrels(filePath, options = {}) {
-  const raw = await readFile16(filePath, "utf8");
+  const raw = await readFile17(filePath, "utf8");
   return parseSealedQrels(raw, options);
 }
 function serializeSealedQrels(artifact) {
@@ -28869,7 +29761,7 @@ function selectFixtureVariant(variants, seed) {
 }
 
 // src/benchmarks/custom/loader.ts
-import { readFile as readFile17 } from "fs/promises";
+import { readFile as readFile18 } from "fs/promises";
 import { parse as parseYaml } from "yaml";
 var CUSTOM_SCORING_VALUES = /* @__PURE__ */ new Set([
   "exact_match",
@@ -28889,7 +29781,7 @@ function parseCustomBenchmark(source) {
 async function loadCustomBenchmarkFile(filePath) {
   let source;
   try {
-    source = await readFile17(filePath, "utf8");
+    source = await readFile18(filePath, "utf8");
   } catch (error) {
     throw new Error(
       `Failed to read custom benchmark file ${filePath}: ${formatError(error)}`
@@ -30036,7 +30928,7 @@ var chatFixture = {
 };
 
 // src/benchmarks/remnic/procedural-recall/ablation.ts
-import { mkdir as mkdir15, mkdtemp as mkdtemp11, rm as rm12, writeFile as writeFile14, readFile as readFile18 } from "fs/promises";
+import { mkdir as mkdir15, mkdtemp as mkdtemp11, rm as rm12, writeFile as writeFile14, readFile as readFile19 } from "fs/promises";
 import os9 from "os";
 import path33 from "path";
 import {
@@ -30159,7 +31051,7 @@ async function runProceduralAblation(options) {
   };
 }
 async function loadAblationFixture(fixturePath) {
-  const raw = await readFile18(fixturePath, "utf8");
+  const raw = await readFile19(fixturePath, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);