@sema-agent/client-core 0.97.1 → 0.99.0

package/dist/displayUntrusted.js

@@ -243,6 +243,22 @@ function schemelessHostEnd(text, from) {
     const c = text.charCodeAt(k);
     return endsSchemelessHost(c) || c === 0x27 ? k : -1;
 }
+const MAX_PORT = 65535;
+function authorityIsHostPort(text, from, to) {
+    if (to <= from || schemelessHostEnd(text.slice(0, to), from) !== to)
+        return false;
+    const colon = text.charCodeAt(from) === 0x5b ? text.indexOf(']:', from) + 1 : text.indexOf(':', from);
+    if (colon <= 0 || colon >= to)
+        return true;
+    const port = text.slice(colon + 1, to);
+    return port.length <= 5 && Number(port) <= MAX_PORT;
+}
+function fragmentTerminatorFrom(s, from) {
+    for (let k = from; k < s.length; k++)
+        if (endsUrlFragmentAt(s, k))
+            return true;
+    return false;
+}
 function valueCoreForJudging(value) {
     if (value.length === 0 || isMarker(value))
         return '';
@@ -315,33 +331,63 @@ function pathCandidates(src, base, path, opaqueSegments, edits, soft) {
         pos += segment.length + 1;
     }
 }
-function urlTokenCandidatesAt(src, start, end, edits, soft, byShape = false) {
-    const token = src.slice(start, end);
-    const schemeEnd = token.indexOf('://') + '://'.length;
-    const scheme = token.slice(0, schemeEnd);
-    const rest = token.slice(schemeEnd);
+function addressCandidates(src, from, end, opaqueSegments, edits, regions, soft, byShape = false, whole = false, hostRegion = whole) {
+    const rest = src.slice(from, end);
     const authorityEnd = rest.search(/[/?#]/);
     const authority = authorityEnd === -1 ? rest : rest.slice(0, authorityEnd);
-    const tailStart = schemeEnd + authority.length;
-    const tail = token.slice(tailStart);
+    const tailStart = from + authority.length;
+    const tail = src.slice(tailStart, end);
     const at = authority.lastIndexOf('@');
     if (at !== -1 && !userinfoIsWholeMarker(authority.slice(0, at)))
-        pushEdit(edits, src, start + schemeEnd, start + schemeEnd + at, REDACTED_USERINFO);
+        pushEdit(edits, src, from, from + at, REDACTED_USERINFO);
     const hash = tail.indexOf('#');
     const beforeHash = hash === -1 ? tail : tail.slice(0, hash);
     const question = beforeHash.indexOf('?');
     const path = question === -1 ? beforeHash : beforeHash.slice(0, question);
-    pathCandidates(src, start + tailStart, path, !/^file:/i.test(scheme), edits, soft);
+    pathCandidates(src, tailStart, path, opaqueSegments, edits, soft);
+    if (whole) {
+        const cut = pathCutAfterFirstLabel(path, true);
+        if (cut !== -1 && fragmentTerminatorFrom(path, cut))
+            pushEdit(edits, src, tailStart + cut, tailStart + path.length, REDACTED_SECRET);
+    }
     if (question !== -1)
-        queryCandidates(src, start + tailStart + question + 1, beforeHash.slice(question + 1), edits, soft, byShape);
+        queryCandidates(src, tailStart + question + 1, beforeHash.slice(question + 1), edits, soft, byShape);
     if (hash !== -1) {
         const rawFragment = tail.slice(hash + 1);
-        const at = start + tailStart + hash + 1;
-        if (rawFragment.length > 0 && !slotIsWholeMarker(rawFragment, soft && ((i) => soft(at + i))))
-            pushEdit(edits, src, start + tailStart + hash + 1, end, REDACTED_FRAGMENT);
+        const fragAt = tailStart + hash + 1;
+        if (rawFragment.length > 0 && !slotIsWholeMarker(rawFragment, soft && ((i) => soft(fragAt + i))))
+            pushEdit(edits, src, fragAt, end, REDACTED_FRAGMENT);
     }
+    if (question !== -1)
+        regions.push([tailStart + question + 1, tailStart + beforeHash.length, 'query']);
+    if (hash !== -1 && hash + 1 < tail.length)
+        regions.push([tailStart + hash + 1, end, 'fragment']);
+    if (hostRegion && authority.length > 0) {
+        const hostFrom = at === -1 ? from : from + at + 1;
+        if (authorityIsHostPort(src, hostFrom, tailStart))
+            regions.push([hostFrom, tailStart, 'host']);
+    }
+}
+function relativeAddressCandidates(text, out, regions, unitPos, soft, hostRegion = true) {
+    let p0 = 0;
+    while (p0 < text.length && (isWhitespaceOrControl(text.charAt(p0)) || text.charAt(p0) === VIEW_SEPARATOR))
+        p0++;
+    const c0 = text.charAt(p0);
+    if (c0 !== '/' && c0 !== '?' && c0 !== '#')
+        return false;
+    let end = text.length;
+    while (end > p0 && (text.charAt(end - 1) === VIEW_SEPARATOR || isWhitespaceOrControl(text.charAt(end - 1)) || isUnicodeBlank(text.charCodeAt(end - 1))))
+        end--;
+    end = trailingCloserEnd(text, p0, p0 + 1, end, unitPos);
+    const from = text.startsWith('//', p0) ? p0 + 2 : p0;
+    const tokenEdits = [];
+    addressCandidates(text, from, end, true, tokenEdits, regions, soft, false, true, hostRegion);
+    editsToCandidates(tokenEdits, 'url', out, end);
+    return true;
 }
-function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape = false) {
+function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape = false, whole = false, hostRegion = whole) {
+    if (whole && relativeAddressCandidates(text, out, regions, unitPos, soft, hostRegion))
+        return;
     let mark = text.indexOf('://');
     while (mark !== -1) {
         let start = mark;
@@ -366,7 +412,9 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape
             }
             return at <= firstVisible;
         };
-        while (end < text.length) {
+        if (whole)
+            end = text.length;
+        while (!whole && end < text.length) {
             const ch = text.charAt(end);
             if (isWhitespaceOrControl(ch))
                 break;
@@ -397,7 +445,7 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape
                 seenPathSep = true;
             end++;
         }
-        while (end > mark + 3 && text.charAt(end - 1) === VIEW_SEPARATOR)
+        while (end > mark + 3 && (text.charAt(end - 1) === VIEW_SEPARATOR || (whole && (isWhitespaceOrControl(text.charAt(end - 1)) || isUnicodeBlank(text.charCodeAt(end - 1))))))
             end--;
         let runStart = end;
         while (runStart > mark + 3 && TRAILING_PUNCTUATION.has(text.charAt(runStart - 1)))
@@ -406,21 +454,8 @@ function urlCandidates(text, out, regions, unitPos = () => false, soft, byShape
             end = runStart;
         end = trailingCloserEnd(text, start, mark + 3, end, unitPos);
         const tokenEdits = [];
-        urlTokenCandidatesAt(text, start, end, tokenEdits, soft, byShape);
+        addressCandidates(text, mark + 3, end, !/^file:/i.test(text.slice(start, mark + 3)), tokenEdits, regions, soft, byShape, whole, hostRegion);
         editsToCandidates(tokenEdits, 'url', out, end);
-        const token = text.slice(start, end);
-        const schemeEnd = token.indexOf('://') + 3;
-        const rest = token.slice(schemeEnd);
-        const authorityEnd = rest.search(/[/?#]/);
-        const tailStart = schemeEnd + (authorityEnd === -1 ? rest.length : authorityEnd);
-        const tail = token.slice(tailStart);
-        const hash = tail.indexOf('#');
-        const beforeHash = hash === -1 ? tail : tail.slice(0, hash);
-        const question = beforeHash.indexOf('?');
-        if (question !== -1)
-            regions.push([start + tailStart + question + 1, start + tailStart + beforeHash.length, 'query']);
-        if (hash !== -1 && hash + 1 < tail.length)
-            regions.push([start + tailStart + hash + 1, end, 'fragment']);
         mark = text.indexOf('://', end > mark + 3 ? end : mark + 3);
     }
 }
@@ -914,7 +949,7 @@ function codeSpanClose(text, plain) {
     }
     return close;
 }
-const BRACKET_PAIRS = new Map([['(', ')'], ['[', ']']]);
+const BRACKET_PAIRS = new Map([['(', ')'], ['[', ']'], ['{', '}'], ['<', '>']]);
 class InnerWordIndex {
     text;
     tokenInner;
@@ -960,22 +995,34 @@ class InnerWordIndex {
     }
 }
 const WRAPPED_PLACEHOLDER = /^(?:[A-Z]{1,12}(?:_[A-Z]{1,12})*|[a-z]{1,12}(?:-[a-z]{1,12})*)$/;
+const TEMPLATE_PLACEHOLDER = /^[a-z]{1,12}(?:_[a-z]{1,12})+$/;
+function isWrappedPlaceholder(inner, open) {
+    return WRAPPED_PLACEHOLDER.test(inner) || ((open === '{' || open === '<') && TEMPLATE_PLACEHOLDER.test(inner));
+}
 function wrappedValueAt(text, from, idx) {
     let k = from;
     while (k < text.length && text[k] === VIEW_SEPARATOR)
         k++;
-    const close = BRACKET_PAIRS.get(text.charAt(k));
+    const open = text.charAt(k);
+    const close = BRACKET_PAIRS.get(open);
     if (close === undefined || credentialWordStartsAt(text, k + 1, idx.tokenInner))
         return null;
     const inner = scanSecretValue(text, k + 1, idx);
     if (inner === null || inner.start !== k + 1)
         return null;
-    let c = inner.end;
+    let innerEnd = inner.end;
+    let semi = innerEnd;
+    while (semi < text.length && text[semi] === VIEW_SEPARATOR)
+        semi++;
+    const cont = separatorContinuedEnd(text, semi, idx);
+    if (cont !== -1)
+        innerEnd = cont;
+    let c = innerEnd;
     while (c < text.length && text[c] === VIEW_SEPARATOR)
         c++;
     if (text.charAt(c) !== close || (close === ']' && text.charAt(c + 1) === '('))
         return null;
-    return inner;
+    return { start: inner.start, end: innerEnd, open };
 }
 function tokenSchemeValueEnd(text, start, end, idx) {
     if (withoutSeparators(text.slice(start, end)).toLowerCase() !== 'token')
@@ -1115,6 +1162,9 @@ function isDiagnosticWord(value) {
     const bare = value.replace(/^\.+/, '').replace(/[.,;:!?)\]}'"]{0,8}$/, '').toLowerCase();
     return bare === '' || DIAGNOSTIC_VALUE_WORDS.has(bare);
 }
+export function isDiagnosticValueWord(value) {
+    return typeof value === 'string' && isDiagnosticWord(value);
+}
 const TOKEN_COUNT_HEAD_WORDS = new Set([
     'max', 'min', 'num', 'n', 'input', 'output', 'total', 'prompt', 'completion', 'thinking', 'reasoning',
     'cache', 'cached', 'context', 'budget', 'used', 'remaining', 'reserved', 'new', 'effective', 'limit',
@@ -1171,7 +1221,7 @@ function isNamedNotValue(label, value) {
         return true;
     return isBacktickedCredentialName(value);
 }
-function schemeIsLabelValue(text, at) {
+function schemeIsLabelValue(text, at, outer = false) {
     let k = at;
     while (k > 0 && text[k - 1] === VIEW_SEPARATOR)
         k--;
@@ -1180,7 +1230,7 @@ function schemeIsLabelValue(text, at) {
         while (k > 0 && text.charCodeAt(k - 1) === 0x5c)
             k--;
     }
-    return k > 0 && labelEndsAt(text, k);
+    return k > 0 && labelEndsAt(text, k, false, outer);
 }
 function labelQuotedAt(text, at, sep) {
     const q = text.charAt(at - 1);
@@ -1299,10 +1349,14 @@ function percentLayers(text) {
     }
     return out;
 }
-function firstLabelCutInPath(path) {
+function firstLabelCutInPath(path, outer = false) {
     let cut = -1;
-    for (const src of [SECRET_SCHEME_WORD, SECRET_LABELLED_WORD]) {
-        const hit = new RegExp(src.source, src.flags.replace('g', '')).exec(path);
+    const sources = outer ? [[SCHEME_WORD_OUTER_SOURCE, false], [LABEL_WORD_OUTER_SOURCE, true]] : [[SECRET_SCHEME_WORD.source, false], [SECRET_LABELLED_WORD.source, false]];
+    for (const [source, countExempt] of sources) {
+        const re = new RegExp(source, 'gi');
+        let hit = re.exec(path);
+        while (hit !== null && countExempt && isTokenCountLabel(path, hit.index, hit[1] ?? ''))
+            hit = re.exec(path);
         if (hit === null)
             continue;
         const at = hit.index + hit[0].length;
@@ -1313,11 +1367,11 @@ function firstLabelCutInPath(path) {
     }
     return cut;
 }
-function pathCutAfterFirstLabel(path) {
-    let cut = firstLabelCutInPath(path);
+function pathCutAfterFirstLabel(path, outer = false) {
+    let cut = firstLabelCutInPath(path, outer);
     const { decoded, offsets } = percentDecodeForMatching(path);
     if (decoded !== path) {
-        const decodedCut = firstLabelCutInPath(decoded);
+        const decodedCut = firstLabelCutInPath(decoded, outer);
         if (decodedCut !== -1) {
             const mapped = offsets[decodedCut] ?? path.length;
             if (mapped < path.length && (cut === -1 || mapped < cut))
@@ -2130,6 +2184,62 @@ function blockSeqEntries(scan, rawFrom, rawLabel) {
     }
     return out;
 }
+function separatorContinuedEnd(text, at, idx) {
+    const isSep = (ch) => ch === ';';
+    let end = -1;
+    let p = at;
+    for (;;) {
+        if (!isSep(text.charAt(p)))
+            return end;
+        let k = p;
+        while (k < text.length && (isSep(text.charAt(k)) || text[k] === VIEW_SEPARATOR))
+            k++;
+        if (k >= text.length || isBareValueStop(text.charAt(k)))
+            return end;
+        if (credentialWordStartsAt(text, k, idx.tokenInner) || PAIR_ITEM.test(text.slice(k, k + 256)))
+            return end;
+        const v = scanSecretValue(text, k, idx);
+        if (v === null || v.end <= k)
+            return end;
+        end = v.end;
+        p = v.end;
+        while (p < text.length && text[p] === VIEW_SEPARATOR)
+            p++;
+    }
+}
+const ENV_ASSIGNED_NAME = /^[A-Z][A-Z0-9_]*$/;
+const ENV_ASSIGNMENT_AHEAD = /^[A-Z_][A-Z0-9_]*=[^=\s]/;
+function envSchemeWordReading(text, at) {
+    if (at < 2 || text.charCodeAt(at - 1) !== 0x3d)
+        return null;
+    let e = at;
+    while (e < text.length && isAlpha(text.charAt(e)))
+        e++;
+    const word = text.slice(at, e).toLowerCase();
+    if (word !== 'bearer' && word !== 'basic')
+        return null;
+    let w = at - 1;
+    while (w > 0 && isKeyWordChar(text.charCodeAt(w - 1)) && text.charCodeAt(w - 1) !== 0x2d)
+        w--;
+    if (!ENV_ASSIGNED_NAME.test(text.slice(w, at - 1)) || !labelEndsAt(text, at, false, true))
+        return null;
+    const inline = (p) => {
+        while (p < text.length && (text[p] === ' ' || text[p] === '\t' || text[p] === VIEW_SEPARATOR))
+            p++;
+        return p;
+    };
+    const k = inline(e);
+    if (k >= text.length)
+        return { end: e, beforeAssignment: false };
+    const c = text.charCodeAt(k);
+    if (c === 0x0a || c === 0x0d || c === 0x2028 || c === 0x2029) {
+        let n = k + 1;
+        if (c === 0x0d && text.charCodeAt(n) === 0x0a)
+            n++;
+        return { end: e, beforeAssignment: ENV_ASSIGNMENT_AHEAD.test(text.slice(inline(n), inline(n) + 256)) };
+    }
+    return k > e && ENV_ASSIGNMENT_AHEAD.test(text.slice(k, k + 256)) ? { end: e, beforeAssignment: true } : null;
+}
 function labelCandidates(S, pass, regions, out, blocks, outer = false) {
     const text = S.text;
     const unitAt = (k) => S.unitAt(k);
@@ -2354,8 +2464,9 @@ function labelCandidates(S, pass, regions, out, blocks, outer = false) {
     if (regionKind !== null)
         for (const r of regions)
             for (let k = r[0]; k < r[1] && k < text.length; k++)
-                regionKind[k] = r[2] === 'query' ? 1 : 2;
+                regionKind[k] = r[2] === 'query' ? 1 : r[2] === 'fragment' ? 2 : 3;
     const inQuery = (k) => regionKind !== null && k < text.length && regionKind[k] === 1;
+    const inHost = (k) => regionKind !== null && k < text.length && regionKind[k] === 3;
     const forbiddenTailAt = (p) => {
         if (!PASSWORD_FORBIDDEN.has(text.charAt(p)))
             return -1;
@@ -2388,6 +2499,10 @@ function labelCandidates(S, pass, regions, out, blocks, outer = false) {
         }
         if (hit.index >= skipFrom && hit.index < skipTo)
             continue;
+        if (inHost(hit.index))
+            continue;
+        if (schemePass && envSchemeWordReading(text, hit.index)?.beforeAssignment === true)
+            continue;
         if (schemePass && (label.toLowerCase() === 'token') !== tokenPass)
             continue;
         if (isTokenCountLabel(text, hit.index, label))
@@ -2407,6 +2522,14 @@ function labelCandidates(S, pass, regions, out, blocks, outer = false) {
             if (isQuoteChar(text.charAt(q)))
                 from = k;
         }
+        if (!schemePass) {
+            const ev = envSchemeWordReading(text, from);
+            if (ev !== null) {
+                push(from, ev.end, REDACTED_SECRET);
+                re.lastIndex = ev.end;
+                continue;
+            }
+        }
         const colonSep = isColonSeparator(hit[0].slice((hit[1] ?? '').length));
         let bulletSkipped = false;
         for (;;) {
@@ -2473,12 +2596,25 @@ function labelCandidates(S, pass, regions, out, blocks, outer = false) {
         if (v0s === null) {
             const w = wrappedValueAt(text, from, idx);
             if (w !== null) {
-                if (WRAPPED_PLACEHOLDER.test(withoutSeparators(text.slice(w.start, w.end))))
+                if (isWrappedPlaceholder(withoutSeparators(text.slice(w.start, w.end)), w.open))
                     continue;
                 v0s = w;
                 wrapEnd = w.end;
             }
         }
+        if (wrapEnd === -1) {
+            let qq = from;
+            while (text.charCodeAt(qq) === 0x5c)
+                qq++;
+            if (!isQuoteChar(text.charAt(qq))) {
+                let sepAt = v0s === null ? from : v0s.end;
+                while (sepAt < text.length && text[sepAt] === VIEW_SEPARATOR)
+                    sepAt++;
+                const cont = separatorContinuedEnd(text, sepAt, idx);
+                if (cont !== -1)
+                    v0s = { start: v0s === null ? sepAt : v0s.start, end: cont };
+            }
+        }
         if (v0s === null) {
             let k = from;
             while (k < text.length && text[k] === VIEW_SEPARATOR)
@@ -2602,7 +2738,8 @@ function labelCandidates(S, pass, regions, out, blocks, outer = false) {
             re.lastIndex = quoted ? from : v.end;
             continue;
         }
-        if (schemePass && !quoted && schemeFollowerReleased(label, value, text.charCodeAt(hit.index - 1) === 0x2f)) {
+        const labelledScheme = schemePass && label.toLowerCase() !== 'token' && schemeIsLabelValue(text, hit.index, true);
+        if (schemePass && !quoted && !labelledScheme && schemeFollowerReleased(label, value, text.charCodeAt(hit.index - 1) === 0x2f)) {
             re.lastIndex = v.end;
             continue;
         }
@@ -3672,31 +3809,48 @@ function screenSurfaces(text, o) {
 function percentSurfaces(raw, text, base, o) {
     const surfaces = [];
     const contents = [];
-    for (const layer of percentLayers(text)) {
-        const n = layer.text.length;
-        const ps = new Int32Array(n);
-        const pe = new Int32Array(n);
-        const pdot = new Uint8Array(n);
-        for (let k = 0; k < n; k++) {
-            const a = layer.ps[k] ?? 0;
-            const b = layer.pe[k] ?? 0;
-            ps[k] = base === null ? a : (base.ps[a] ?? 0);
-            pe[k] = base === null ? b : (base.pe[b - 1] ?? 0);
-            if (base !== null && b - a === 1)
-                pdot[k] = base.pdot[a] ?? 0;
-        }
-        const M = { ps, pe, pdot, rawDot: base === null ? new Uint8Array(raw.length) : base.rawDot };
-        const VD = buildScanView(layer.text, o);
-        const sep = separatedSurface(raw, VD, M);
-        surfaces.push(base === null ? { ...sep, rawDot: null } : sep);
-        const joined = joinedSurface(raw, VD, false, M);
-        if (joined !== null)
-            surfaces.push(base === null ? { ...joined, rawDot: null } : joined);
-        for (const [a, b] of VD.contents)
-            contents.push({ sub: layer.text.slice(a, b), rawAt: (k) => ps[a + k] ?? 0, rawEndAt: (k) => pe[a + k] ?? 0 });
-    }
+    for (const layer of percentLayers(text))
+        layerSurfaces(raw, layer, base, o, surfaces, contents);
     return { surfaces, contents };
 }
+function layerSurfaces(raw, layer, base, o, surfaces, contents, decoded = true) {
+    const n = layer.text.length;
+    const ps = new Int32Array(n);
+    const pe = new Int32Array(n);
+    const pdot = new Uint8Array(n);
+    for (let k = 0; k < n; k++) {
+        const a = layer.ps[k] ?? 0;
+        const b = layer.pe[k] ?? 0;
+        ps[k] = base === null ? a : (base.ps[a] ?? 0);
+        pe[k] = base === null ? b : (base.pe[b - 1] ?? 0);
+        if (base !== null && b - a === 1)
+            pdot[k] = base.pdot[a] ?? 0;
+    }
+    const M = { ps, pe, pdot, rawDot: base === null ? new Uint8Array(raw.length) : base.rawDot };
+    const VD = buildScanView(layer.text, o);
+    const sep = separatedSurface(raw, VD, M);
+    surfaces.push(base === null ? { ...sep, rawDot: null, decoded } : { ...sep, decoded });
+    const joined = joinedSurface(raw, VD, false, M);
+    if (joined !== null)
+        surfaces.push(base === null ? { ...joined, rawDot: null, decoded } : { ...joined, decoded });
+    for (const [a, b] of VD.contents)
+        contents.push({ sub: layer.text.slice(a, b), rawAt: (k) => ps[a + k] ?? 0, rawEndAt: (k) => pe[a + k] ?? 0 });
+}
+function parserViewLayer(text) {
+    if (!/[\t\n\r]/.test(text))
+        return null;
+    const chars = [];
+    const ps = [];
+    for (let k = 0; k < text.length; k++) {
+        const c = text.charCodeAt(k);
+        if (c === 0x09 || c === 0x0a || c === 0x0d)
+            continue;
+        chars.push(text.charAt(k));
+        ps.push(k);
+    }
+    const starts = Int32Array.from(ps);
+    return { text: chars.join(''), ps: starts, pe: Int32Array.from(ps, (k) => k + 1) };
+}
 function finalIsStructural(text, at) {
     if (text.charCodeAt(at) !== 0x5c)
         return false;
@@ -3968,6 +4122,11 @@ function collectCandidates(text, o, nested) {
     const decoded = percentSurfaces(text, text, null, o);
     surfaces.push(...decoded.surfaces);
     const decodedContents = decoded.contents;
+    if (o.wholeAddress === true) {
+        const pv = parserViewLayer(text);
+        if (pv !== null)
+            layerSurfaces(text, pv, null, o, surfaces, decodedContents, false);
+    }
     const raw = [];
     const blocks = { raw: text, view: V, out: raw, lines: [null, null], marks: null };
     const regionSurface = screen.surfaces[0] ?? separated;
@@ -3977,7 +4136,7 @@ function collectCandidates(text, o, nested) {
         const regions = [];
         if (o.urls) {
             const unitPos = (k) => S.dropped(k) || V.rawUnit[S.rawStart(k)] === 1;
-            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k), o.queryByShape ?? false);
+            urlCandidates(S.text, cands, regions, unitPos, (k) => unitPos(k) || S.painted(k), o.queryByShape ?? false, o.wholeAddress === true, o.wholeAddress === true && S.decoded !== true);
             userinfoCandidates(S, cands, o.words);
         }
         if (o.words) {
@@ -4450,10 +4609,11 @@ function escapeSpacesFor(o, face) {
     }
     return set.size === 0 ? null : set;
 }
-function scanOptionsOf(o, face, queryByShape = false) {
+function scanOptionsOf(o, face, queryByShape = false, wholeAddress = false) {
     return {
         urls: o.credentialUrls !== false,
         queryByShape,
+        wholeAddress,
         words: o.credentialWords !== false,
         blanks: face.keepBlanks === true,
         fold: face.fold,
@@ -4468,11 +4628,11 @@ export function credentialWashPasses(text, opts = {}) {
     scanAndMask(input, scan, false, stats);
     return { passes: stats.passes, capped: stats.capped };
 }
-function renderUntrusted(text, opts, ledger, queryByShape = false) {
+function renderUntrusted(text, opts, ledger, queryByShape = false, wholeAddress = false) {
     const input = typeof text === 'string' ? text : String(text ?? '');
     const o = opts ?? {};
     const face = publicFace(o);
-    const scan = scanOptionsOf(o, face, queryByShape);
+    const scan = scanOptionsOf(o, face, queryByShape, wholeAddress);
     const pairBackslashes = o.escapeBackslashes === true && face.mark !== 'dot' && face.mark !== 'space';
     const book = ledger ?? (pairBackslashes ? { cps: [], lens: [] } : null);
     if (book === null) {
@@ -4503,6 +4663,9 @@ export function displayUntrusted(text, opts = {}) {
     const out = renderUntrusted(text, opts, null);
     return typeof out === 'string' ? out : out.text;
 }
+export function cleanUntrustedScalar(v) {
+    return displayUntrusted(String(v ?? ''), { credentialUrls: false, credentialWords: false, foldLines: false });
+}
 const NON_SECRET_FIELD_NAMES = new Set([
     'deployment', 'deploymentname', 'deploymentid', 'name', 'tenant', 'tenantname', 'tenantid', 'region', 'location', 'zone',
     'project', 'projectname', 'projectid', 'workspace', 'workspacename', 'workspaceid', 'resource', 'resourcename', 'resourcegroup',
@@ -4661,10 +4824,23 @@ function queryPartCarriesCredential(key, value, relax) {
         if (relax && isNonSecretFieldName(key) && isReadableWordChain(value))
             return isKnownSecretSegment(value);
     }
-    return isOpaqueSecretValue(value) || carriesCredentialStructure(value);
+    if (isOpaqueSecretValue(value) || carriesCredentialStructure(value))
+        return true;
+    let from = 0;
+    for (let i = 0; i <= value.length; i++) {
+        if (i < value.length && !endsUrlFragmentAt(value, i))
+            continue;
+        if (i > from && (from > 0 || i < value.length)) {
+            const chunk = value.slice(from, i);
+            if (isOpaqueSecretValue(chunk) || carriesCredentialStructure(chunk))
+                return true;
+        }
+        from = i + 1;
+    }
+    return false;
 }
 const UPLOAD_PROBE_PREFIX = 'https://q.invalid/?';
-const UPLOAD_SCAN_OPTIONS = Object.freeze({ urls: true, queryByShape: 'strict', words: true, blanks: false, fold: false, face: null, escapeSpaces: null });
+const UPLOAD_SCAN_OPTIONS = Object.freeze({ urls: true, queryByShape: 'strict', wholeAddress: true, words: true, blanks: false, fold: false, face: null, escapeSpaces: null });
 export function queryCarriesCredential(query) {
     if (typeof query !== 'string' || query.length === 0)
         return false;
@@ -4672,11 +4848,12 @@ export function queryCarriesCredential(query) {
     return scanOnce(probe, UPLOAD_SCAN_OPTIONS, false).text !== probe;
 }
 export function displayConfiguredUrl(url, opts = {}) {
-    const out = renderUntrusted(typeof url === 'string' ? configuredUrlScannable(url) : url, opts, null, 'relaxed');
+    const out = renderUntrusted(typeof url === 'string' ? configuredUrlScannable(url) : url, opts, null, 'relaxed', true);
     return typeof out === 'string' ? out : out.text;
 }
 function configuredUrlScannable(url) {
-    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(url) || !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(url))
+    const view = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '');
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(view) || !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(view))
         return url;
     let u;
     try {

package/dist/engineAgentAbsence.d.ts

@@ -56,7 +56,7 @@ export interface EngineAgentRegistryRowView {
     readonly description?: string;
     readonly createdAt?: number;
 }
-export type EngineAgentRegistryUnavailableWhy = 'no_list_face' | 'route_absent' | 'ownership_required' | 'read_failed';
+export type EngineAgentRegistryUnavailableWhy = 'no_list_face' | 'capability_unknown' | 'route_absent' | 'ownership_required' | 'read_failed';
 export type EngineAgentRegistryListing = {
     readonly kind: 'rows';
     readonly rows: readonly EngineAgentRegistryRowView[];

package/dist/engineAgentPanelStore.d.ts

@@ -33,6 +33,10 @@ export type EngineAgentPanelEvent = {
     parentToolCallId?: string;
     wireTaskId?: string;
     taskIdOrigin?: 'wire';
+    final?: {
+        totalTokens?: true;
+        toolUses?: true;
+    };
 } | {
     kind: 'end';
     taskId: string;
@@ -42,6 +46,7 @@ export type EngineAgentPanelEvent = {
     report?: string;
     wireTaskId?: string;
     taskIdOrigin?: 'fleet-row' | 'wire';
+    sessionId?: string;
 } | {
     kind: 'sweep';
 };
@@ -49,12 +54,17 @@ export declare const PANEL_TOOLUSES_LANE_POLICY: Readonly<Record<'tick' | 'fleet
 export declare function markEnginePanelTaskResident(taskId: string): void;
 export declare function clearEnginePanelTaskResident(taskId: string): void;
 export declare function isEnginePanelTaskResident(taskId: string): boolean;
-export declare function resolveEnginePanelTaskId(wireTaskId: string, parentToolCallId?: string): EnginePanelTaskIdentity;
+export declare function resolveEnginePanelTaskId(wireTaskId: string): EnginePanelTaskIdentity;
 export declare function clearEnginePanelTaskResidentByWire(wireTaskId: string, cycle?: EngineAgentPanelCycleIdentity): void;
 export declare function __resetEngineAgentPanelIdentityForTests(): void;
 export declare function __resetEnginePanelStateForTests(): void;
 export declare function publishEngineAgentPanelEvent(ev: EngineAgentPanelEvent): void;
-export declare function subscribeEngineAgentPanel(fn: (ev: EngineAgentPanelEvent) => void): () => void;
+export interface EngineAgentPanelStart {
+    taskId: string;
+    startedAt?: number;
+    workflowRunId?: string;
+}
+export declare function publishEngineAgentPanelStart(ev: EngineAgentPanelStart): void;
 export declare function subscribeEnginePanelRows(fn: (delta: PanelDelta) => void): () => void;
 export interface EngineAgentPanelAbsence {
     taskId: string;
@@ -63,5 +73,3 @@ export interface EngineAgentPanelAbsence {
     wireTaskId?: string;
 }
 export declare function publishEngineAgentPanelAbsence(ev: EngineAgentPanelAbsence): void;
-export declare function subscribeEngineAgentPanelAbsence(fn: (ev: EngineAgentPanelAbsence) => void): () => void;
-export declare function __resetEngineAgentPanelAbsenceForTests(): void;

package/dist/engineAgentPanelStore.js

@@ -1,5 +1,6 @@
 import { isNewEngineAgentPanelCycle, isStaleEngineAgentPanelEnd, panelIsResident, panelResolveTaskId, MAX_HELD_WIRE_TICK_BEATS, } from './panelReduce.js';
-import { clearEnginePanelIdentity, panelStateNow, resetAbsenceChannel, stepEnginePanel, subscribeAbsence, subscribeLegacyEvents, subscribeRows, resetEnginePanelHolder, } from './panelStateHolder.js';
+import { guardedRead, readOwnDataFiniteNumber, readOwnDataNonEmptyString } from './ownKey.js';
+import { clearEnginePanelIdentity, panelStateNow, stepEnginePanel, subscribeRows, resetEnginePanelHolder } from './panelStateHolder.js';
 export { isNewEngineAgentPanelCycle, isStaleEngineAgentPanelEnd, MAX_HELD_WIRE_TICK_BEATS };
 const _panelToolUsesLanePins = [true, true];
 void _panelToolUsesLanePins;
@@ -16,8 +17,8 @@ export function clearEnginePanelTaskResident(taskId) {
 export function isEnginePanelTaskResident(taskId) {
     return panelIsResident(panelStateNow(), taskId);
 }
-export function resolveEnginePanelTaskId(wireTaskId, parentToolCallId) {
-    return panelResolveTaskId(panelStateNow(), wireTaskId, parentToolCallId);
+export function resolveEnginePanelTaskId(wireTaskId) {
+    return panelResolveTaskId(panelStateNow(), wireTaskId);
 }
 export function clearEnginePanelTaskResidentByWire(wireTaskId, cycle) {
     stepEnginePanel({ kind: 'resident-clear-wire', taskId: wireTaskId, ...(cycle !== undefined ? { cycle } : {}) });
@@ -31,8 +32,18 @@ export function __resetEnginePanelStateForTests() {
 export function publishEngineAgentPanelEvent(ev) {
     stepEnginePanel(ev);
 }
-export function subscribeEngineAgentPanel(fn) {
-    return subscribeLegacyEvents(fn);
+export function publishEngineAgentPanelStart(ev) {
+    const taskId = guardedRead(() => readOwnDataNonEmptyString(ev, 'taskId'));
+    if (taskId === undefined)
+        return;
+    const startedAt = guardedRead(() => readOwnDataFiniteNumber(ev, 'startedAt'));
+    const workflowRunId = guardedRead(() => readOwnDataNonEmptyString(ev, 'workflowRunId'));
+    stepEnginePanel({
+        kind: 'start',
+        taskId,
+        ...(startedAt !== undefined ? { startedAt } : {}),
+        ...(workflowRunId !== undefined ? { workflowRunId } : {}),
+    });
 }
 export function subscribeEnginePanelRows(fn) {
     return subscribeRows(fn);
@@ -40,9 +51,3 @@ export function subscribeEnginePanelRows(fn) {
 export function publishEngineAgentPanelAbsence(ev) {
     stepEnginePanel({ kind: 'absence', absence: ev });
 }
-export function subscribeEngineAgentPanelAbsence(fn) {
-    return subscribeAbsence(fn);
-}
-export function __resetEngineAgentPanelAbsenceForTests() {
-    resetAbsenceChannel();
-}