@sema-agent/core 7.47.0 → 7.49.0

package/dist/core/runner/tool-progress-lane.d.ts

@@ -7,19 +7,25 @@
  * opaque here — the runner knows only that it started and has not ended — so this lane runs a slow beat for
  * any in-flight call silent for {@link TOOL_HEARTBEAT_MS}.
  *
- * THE LANE OWNS TIME, the producer owns FACTS. A producer reports what it has seen (the tail, the totals),
- * never how long it has run: `elapsedTimeSeconds` is computed HERE from one origin per call, because the two
- * producers do not start their clocks together — the station registers a call when it ENTERS EXECUTION, a
- * shell command's own clock could only start at its spawn. With two origins a 30 s beat could be followed
- * moments later by a shell tick reporting 1 s, breaking the monotonicity the frame promises.
+ * THE CALLS IN FLIGHT ARE THE LEG'S OCCURRENCES (`tool-occurrence.ts`), not a set of this lane's own: the record
+ * that carries a call's start frame carries its elapsed origin, its silence clock and its wait on the person, so
+ * the beat can never describe a call the frames say ended, nor miss one they say started.
+ *
+ * ONE ORIGIN PER CALL, the producer owns FACTS. A producer reports what it has seen (the tail, the totals),
+ * never how long it has run: `elapsedTimeSeconds` is computed HERE from the occurrence's origin — its
+ * announcement — because a shell command's own clock could only start at its spawn. With two origins a 30 s
+ * beat could be followed moments later by a shell tick reporting 1 s, breaking the monotonicity the frame promises.
  *
  * THE CADENCE HAS ONE ENFORCEMENT POINT, same reason: a producer's timer is a SAMPLING clock, not the
  * contract. `emit` drops a frame landing inside {@link TOOL_PROGRESS_MIN_INTERVAL_MS} of that call's last.
  *
- * ONE RULE FOR THE BEAT: a call is beaten when nothing has been emitted FOR IT for a whole interval,
+ * ONE RULE FOR THE BEAT: a call is beaten when nothing has been heard FROM IT for a whole interval,
  * counting its own start as the first such event — covering both "it only just started" and "the tool
  * already ticks faster than this". The interval is the RUN's, so a first beat lands anywhere in
  * [TOOL_HEARTBEAT_MS, 2 × TOOL_HEARTBEAT_MS): the price of one timer per run, stated rather than hidden.
+ * And the beat reads the one activity fact: when EVERY call in flight is waiting on the person, nothing is
+ * working and nothing is beaten; a call back from the person is heard from at that moment, so its silence
+ * is counted afresh.
  *
  * THE CLOCK IS MONOTONIC: every predicate here is a DIFFERENCE of two readings (is this call due a beat, is
  * this offer inside the floor, how long has it run), and off the wall clock a backward step — NTP, a
@@ -30,6 +36,7 @@
  * every emission is fault-contained. */
 import type { TaskEvent, TaskEventIdentity } from "../types.js";
 import type { ToolProgressLane } from "./contracts.js";
+import { type ToolOccurrenceTable } from "./tool-occurrence.js";
 /** How long a tool call may stay silent before this lane beats for it, in ms. ONE SOURCE, and CC
  *  2.1.259's own per-tool heartbeat interval (`Cct`) — this engine keeps the cadence and folds the beat
  *  into the one progress frame instead of minting a second shape (registered divergence). */
@@ -38,5 +45,6 @@ export declare const TOOL_HEARTBEAT_MS = 30000;
  *  nowhere else so it holds across producers rather than inside each one. */
 export declare const TOOL_PROGRESS_MIN_INTERVAL_MS = 1000;
 /** Build the lane over the run's content pusher (`pushContent` — the ONE seat that puts a frame on this
- *  run's queue and, for a sub-agent, forwards it to the parent's sink) and its identity mint. */
-export declare function createToolProgressLane(push: (e: TaskEvent) => void, ident: () => TaskEventIdentity): ToolProgressLane;
+ *  run's queue and, for a sub-agent, forwards it to the parent's sink), its identity mint and the leg's
+ *  occurrence table (the calls in flight). */
+export declare function createToolProgressLane(push: (e: TaskEvent) => void, ident: () => TaskEventIdentity, occurrences: ToolOccurrenceTable): ToolProgressLane;

package/dist/core/runner/tool-progress-lane.js

@@ -1,8 +1,7 @@
+import { occurrenceClock } from "./tool-occurrence.js";
 export const TOOL_HEARTBEAT_MS = 30_000;
 export const TOOL_PROGRESS_MIN_INTERVAL_MS = 1_000;
-const monotonicNow = () => (typeof performance !== "undefined" ? performance.now() : Date.now());
-export function createToolProgressLane(push, ident) {
-    const inFlight = new Map();
+export function createToolProgressLane(push, ident, occurrences) {
     let timer;
     const arm = () => {
         if (timer !== undefined)
@@ -10,51 +9,43 @@ export function createToolProgressLane(push, ident) {
         timer = setInterval(beat, TOOL_HEARTBEAT_MS);
         timer.unref?.();
     };
+    const disarm = () => {
+        if (timer === undefined)
+            return;
+        clearInterval(timer);
+        timer = undefined;
+    };
+    occurrences.onOpen(arm);
     const emit = (body) => {
-        const now = monotonicNow();
-        let live = inFlight.get(body.toolCallId);
-        if (live === undefined) {
-            live = { toolName: body.toolName, startedAt: now, lastAt: now - TOOL_PROGRESS_MIN_INTERVAL_MS };
-            inFlight.set(body.toolCallId, live);
-            arm();
-        }
-        if (now - live.lastAt < TOOL_PROGRESS_MIN_INTERVAL_MS)
+        const now = occurrenceClock();
+        const unseen = occurrences.get(body.toolCallId) === undefined;
+        const occ = occurrences.ensure({ toolCallId: body.toolCallId, spelledName: body.toolName, args: undefined });
+        if (!unseen && now - occ.lastHeardAt < TOOL_PROGRESS_MIN_INTERVAL_MS)
             return;
-        live.lastAt = now;
+        occurrences.heard(occ.toolCallId);
         try {
-            push({ type: "tool_progress", ...body, elapsedTimeSeconds: Math.floor((now - live.startedAt) / 1000), ...ident() });
+            push({ type: "tool_progress", ...body, elapsedTimeSeconds: Math.floor((now - occ.startedAt) / 1000), ...ident() });
         }
         catch {
         }
     };
     function beat() {
-        const now = monotonicNow();
-        for (const [toolCallId, live] of inFlight) {
-            if (now - live.lastAt < TOOL_HEARTBEAT_MS)
+        const now = occurrenceClock();
+        const inFlight = occurrences.live().filter((o) => o.beating);
+        if (inFlight.length === 0)
+            return disarm();
+        if (inFlight.every((o) => o.awaitingUser > 0))
+            return;
+        for (const o of inFlight) {
+            if (now - o.lastHeardAt < TOOL_HEARTBEAT_MS)
                 continue;
-            emit({ toolCallId, toolName: live.toolName });
+            emit({ toolCallId: o.toolCallId, toolName: o.spelledName });
         }
     }
-    const disarm = () => {
-        if (timer === undefined)
-            return;
-        clearInterval(timer);
-        timer = undefined;
-    };
     return {
         emit,
-        noteStart(toolCallId, toolName) {
-            const startedAt = monotonicNow();
-            inFlight.set(toolCallId, { toolName, startedAt, lastAt: startedAt });
-            arm();
-        },
-        noteEnd(toolCallId) {
-            inFlight.delete(toolCallId);
-            if (inFlight.size === 0)
-                disarm();
-        },
         clear() {
-            inFlight.clear();
+            occurrences.quiesce();
             disarm();
         },
     };

package/dist/core/runner/turn-attachments.d.ts

@@ -983,7 +983,7 @@ export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
  * re-derived here. The earlier shape did re-derive it — a local `sanitizeUntrustedText` pre-pass with
  * the DEFAULT (reminder-only) tag set, measured against the cap — and that mirror silently stopped
  * matching once the fence widened its neutralization to the whole authority-envelope family: each
- * widened-family tag occurrence adds a ZWSP the pre-count never saw, so a server could land its text
+ * widened-family tag occurrence adds an entity the pre-count never saw, so a server could land its text
  * in the `(cap − N, cap]` window and get the body clipped with the honesty note withheld, N being its
  * own choice of tag count. One measurement, taken where the cut happens, is the only shape that cannot
  * drift.

package/dist/core/runner/write-protection-station.d.ts

@@ -22,20 +22,32 @@
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
+import type { TaskSpec } from "../task-spec.js";
 import type { ToolRoster } from "../tool-roster.js";
+import type { ToolPolicy } from "../tool-policy.js";
 import { type WriteProtectionMount } from "../write-protect.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
-/** The leg's mount plus the same judge over a bare ABSOLUTE target — what the shell station asks about each write target
- *  a command names (`ShellReadBoundary.writeProtectionJudge`): `true` ⇔ a row covers it. */
-export interface LegWriteProtection extends WriteProtectionMount {
-    readonly judgeTarget: NonNullable<ShellReadBoundary["writeProtectionJudge"]>;
+/** The leg's write judgment, read by its two readers: the gate's tighten over the always-on table (`mount`, absent when that
+ *  table is empty) and the shell station's ONE question about each write target a command names (`judgeWriteTarget`, over
+ *  the table and the chain's guarded write rows together; absent when neither has a row). */
+export interface LegWriteProtection {
+    readonly mount: WriteProtectionMount | undefined;
+    readonly judgeWriteTarget: ShellReadBoundary["writeTargetJudge"];
+}
+/** The leg's write-guard seats: its one exempt root (the leg's single resolution of `RunnerDeps.memoryEngineDir`, the same
+ *  list every policy adjudication of the leg is stamped with) and the chain policies' guarded write rows. */
+export interface LegWriteGuard {
+    readonly exemptRoots: readonly string[];
+    readonly rows: ToolPolicy["writeGuardRows"];
 }
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
-     *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
-     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain), the configuration root the host
-     *  declared (`agentConfigDir`) and the operator sink. */
-    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "agentConfigDir" | "onNotice">;
+     *  table, `[]` ⇒ opted out), the configuration root the host declared (`agentConfigDir`) and the operator sink. */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "agentConfigDir" | "onNotice">;
+    /** borrowed-readonly — the leg's one exempt root and the chain's guarded write rows ({@link LegWriteGuard}). */
+    guard: LegWriteGuard;
+    /** borrowed-readonly — the request's own rows (already judged at the task layer's door). */
+    spec: Pick<TaskSpec, "writeProtectedAdditions">;
     /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
      *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
     env: ExecutionEnv | undefined;
@@ -45,4 +57,4 @@ export declare function mountWriteProtection(input: {
     roster: ToolRoster;
     sessionId: string;
     runId: string;
-}): LegWriteProtection | undefined;
+}): LegWriteProtection;

package/dist/core/runner/write-protection-station.js

@@ -1,11 +1,13 @@
 import { deliverEngineNotice } from "../engine-notice.js";
+import { unionAddOnly } from "../child-clamp-seats.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
-import { compileWriteProtection, writeProtectionMountOver } from "../write-protect.js";
+import { compileLegWriteJudgment, resolveWriteProtectedTable, writeProtectionMountOver } from "../write-protect.js";
 const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
     const announced = new Set();
-    const matcher = compileWriteProtection(input.deps.writeProtectedPaths, {
-        ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
+    const judgment = compileLegWriteJudgment(unionAddOnly("writeProtectedAdditions", resolveWriteProtectedTable(input.deps.writeProtectedPaths), input.spec.writeProtectedAdditions), {
+        exemptRoots: input.guard.exemptRoots,
+        ...(input.guard.rows !== undefined ? { guardRows: input.guard.rows } : {}),
         ...(input.deps.agentConfigDir !== undefined ? { agentConfigDir: input.deps.agentConfigDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
@@ -15,22 +17,23 @@ export function mountWriteProtection(input) {
                 return;
             announced.add(reason);
             deliverEngineNotice(input.deps.onNotice, {
-                code: "config.write_protection_unresolved",
-                message: `This run's write-protection judge could not resolve a write target in its execution environment ` +
-                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused or errored on the spelling"}: ${absence.cause}). ` +
-                    `A view that cannot answer does not vote, so that write was judged by its SPELLING against the table and nothing else — ` +
-                    `a target reaching a protected path only through an alias, a bind mount or a ".." walk is cleared. Nothing about this run was ` +
-                    `refused because of it, and nothing here is a defect in the write itself: an environment that cannot answer path questions is a ` +
-                    `deployment fact. Announced once per leg per reason; later writes of the same shape are judged the same way, silently.`,
+                code: "config.path_view_unresolved",
+                message: `This run's write-protection judge did not get an answer from its execution environment for one lookup of a write's judgment ` +
+                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused, errored or did not answer in time"}: ${absence.cause}). ` +
+                    `A write whose target's real destination (or link chain) could not be determined is refused where the table has rows — the ` +
+                    `table cannot say it is not a protected path; a root whose key did not come back exempts and places nothing; guarded write rows ` +
+                    `a deployment's policy did not return are held, so the writes they could guard are not placed. Every row a source that did ` +
+                    `answer met stays met. An environment that cannot answer path questions is a deployment fact: fix the environment (or the ` +
+                    `link) and the same writes are judged again. Announced once per leg per reason; later writes of the same shape are judged ` +
+                    `the same way, silently.`,
                 detail: { reason, cause: absence.cause, sessionId: input.sessionId, runId: input.runId },
             });
         },
     });
-    if (matcher === undefined)
-        return undefined;
-    const mount = { ...writeProtectionMountOver(matcher, input.rootPath), judgeTarget: async (target, opts) => (await matcher.judge(target, { ...(opts?.signal !== undefined ? { signal: opts.signal } : {}), ...(opts?.canonical === true ? { canonical: true } : {}) })).kind === "hit" };
-    if (mount.targetView !== "spelling-only")
-        return mount;
+    const matcher = judgment.matcher;
+    const leg = { mount: matcher === undefined ? undefined : writeProtectionMountOver(matcher, input.rootPath), judgeWriteTarget: judgment.judgeWriteTarget };
+    if (leg.mount === undefined || leg.mount.targetView !== "spelling-only")
+        return leg;
     const covered = input.roster.entries
         .filter((e) => [e.name, ...e.aliases].some((name) => {
         const target = protectivePathTargetOf({ toolName: name, args: {}, face: e.pathTarget !== undefined ? { pathTarget: e.pathTarget } : {} });
@@ -39,7 +42,7 @@ export function mountWriteProtection(input) {
         .map((e) => e.name)
         .sort();
     if (covered.length === 0)
-        return mount;
+        return leg;
     deliverEngineNotice(input.deps.onNotice, {
         code: "config.write_protection_target_view_absent",
         message: `This run mounted path-confinable write tools [${covered.join(", ")}] while its write-protection judge has NO execution environment, ` +
@@ -50,5 +53,5 @@ export function mountWriteProtection(input) {
             `writeProtection.targetView.`,
         detail: { tools: covered, sessionId: input.sessionId, runId: input.runId },
     });
-    return mount;
+    return leg;
 }

package/dist/core/runner-deps.d.ts

@@ -249,8 +249,9 @@ export interface RunnerDeps {
      * approval flows the ordinary ask-resolution chain — classifier, blanket `onAsk`, durable park —
      * with no `requiresRealApproval` mandate). Absent =
      * {@link import("./write-protect.js").WRITE_PROTECTED_DEFAULT_TABLE} (the CC triple verbatim +
-     * the two argued sema rows). This key IS the whole-table escape hatch, deployment seat ONLY (no
-     * TaskSpec twin, no governed-workflow channel): `[]` = no table (explicit and legal); a non-empty
+     * the two argued sema rows). This key IS the whole-table escape hatch, deployment seat ONLY — the
+     * task layer's twin is add-only ({@link TaskSpec.writeProtectedAdditions}: its rows UNION this
+     * table and can remove none), and no governed-workflow channel reaches either: `[]` = no table (explicit and legal); a non-empty
      * list REPLACES the built-in table whole (compose additions as
      * `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`; drop rows by filtering the exported table — the
      * visible/deletable admin face). Bad values refuse loudly at prepare (#123): garbage shapes,
@@ -355,14 +356,6 @@ export interface RunnerDeps {
     memoryCaptureRecordStore?: (plane: {
         controlDir: string;
     }) => import("./memory-engine/layout.js").SessionCaptureRecordStore;
-    /** which occupant of a session id is running now (a purge may delete a session tree and the
-     *  id be handed out again; without this seat a standing opt-out or pollution record binds the NEXT
-     *  occupant too). An opaque token, STABLE for one occupant's life, DIFFERENT for the next, only
-     *  ever compared ({@link import("./memory-engine/layout.js").sessionRecordBindsIncarnation}).
-     *  ABSENT ⇒ records bind by id (the pre-incarnation bytes); an empty or throwing answer reads the same. */
-    memorySessionIncarnation?: (session: {
-        sessionId: string;
-    }) => string | undefined;
     /**
      * design/339 §6.1 — the v3 memory-consolidation switch, threaded verbatim to the engine seat
      * ({@link import("../core/memory-engine/engine.js").MemoryEngineOptions.consolidation} — same
@@ -689,7 +682,8 @@ export interface RunnerDeps {
      * denied capability that the spec explicitly requests refuses the prepare loudly
      * (`config.compliance_denied`, or `config.compliance_required` when the refusal came from the
      * resolver fault rather than an adjudicated posture). `undefined` (no resolver / no posture for
-     * the principal) = no compliance restriction — existing deployments are untouched.
+     * the principal) = no compliance restriction from the deployment — existing deployments are untouched. The run's deny
+     * set is this posture's UNION the request's own denies ({@link TaskSpec.complianceAdditionalDenies}, add-only).
      */
     compliancePostureResolver?: (principal: string | undefined) => import("./compliance.js").CompliancePosture | undefined | Promise<import("./compliance.js").CompliancePosture | undefined>;
     /**
@@ -1031,12 +1025,8 @@ export interface RunnerDeps {
     /** B5/F2 + design/140 §6 1a — the script-persistence / named-registry seam, threaded into the auto-mounted
      *  run_workflow tool: every invocation's resolved script is persisted (iterate via `{scriptPath}`), `{name}`
      *  resolves a saved workflow, and a registration's `defaultArgs` merge under the call-time args. Opt-in
-     *  (absent ⇒ inline `script` + built-in names only). */
+     *  (absent ⇒ inline `script` only — the engine ships no built-in named workflows). */
     workflowScriptStore?: import("../orchestration/workflow-script-store.js").WorkflowScriptStore;
-    /** design/140 §6 1c — `false` removes the BUILT-IN named workflows (`discussion`, …) from the
-     *  auto-mounted run_workflow tool (the `builtinAgents:false` analog; default ON). A deployment
-     *  `workflowScriptStore` registration of the same name shadows a built-in regardless. */
-    builtinWorkflows?: boolean;
     /**
      * design/97 CORE-9 (Part B) — a TRUSTED deployment sink for the steerable handle of every agent an LLM-authored
      * (`run_workflow` tool) workflow spawns. When set, the tool's `agent()` primitive runs each agent STEERABLE and
@@ -1044,12 +1034,12 @@ export interface RunnerDeps {
      * the handle — no host-context leak into the runner); the deployment registers it by `runId`+`label` to route a
      * human/cross-replica steer to `handle.steer(...)`. Unset ⇒ agents run non-steerable (no overhead). Opt-in.
      *
-     * **Interaction with {@link workflowJournalStore}**: a steerable agent runs via
-     * `agentStream`, whose results ARE RECORDED in the journal since 1.355 (complete read-face: the journal
-     * API / diagnostics coordinate show every agent) but are NEVER REPLAYED — `resumeFromRunId` on a
-     * steerable workflow still re-runs agents LIVE (steer input is not deterministic; a cache would replay
-     * a result the operator steered). Pre-1.355 the stream lane recorded NOTHING — with both deps set the
-     * journal read empty on every workflow (the zero-write case), silently.
+     * **Interaction with {@link workflowJournalStore}**: a steerable agent runs via `agentStream`, which reads the
+     * resume journal exactly as the non-steerable lane does — recorded under the same call key, replayed by the same
+     * unchanged-prefix rule. A completed agent a `resumeFromRunId` replays is emitted here as an already-settled
+     * handle: `result()` resolves at once to the journaled result, `steer()` is refused `steering.not_running`.
+     * A result the operator steered replays as what it was — the run's record of the work, like any model answer
+     * that would come out differently if asked again.
      */
     onWorkflowAgentSpawn?: (handle: import("../orchestration/workflow.js").WorkflowAgentHandle) => void;
     /** design/72 §2.2 (B): deployment default for the suspend-loop cap (see `TaskSpec.maxSuspends`).

package/dist/core/safety-axis-vocab.d.ts

@@ -2,7 +2,7 @@
  * `SAFETY_AXIS_VOCABULARY` — the PUBLISHED safety-axis vocabulary as a zero-logic, zero-runtime-dependency DATA
  * artifact (pure string / number / boolean literal constants).
  *
- * **design/99 center control-plane seam (2026-06-27).** The sema-registry control plane's per-field
+ * **design/99 center control-plane seam (2026-06-27).** The web-admin control plane's per-field
  * safety-classification table lives in `@sema-agent/registry-core` and, for every safety-critical config field, cites a
  * core axis VALUE (e.g. `effect: "write"`, `irreversibility: "always"`). That contract package **must not depend on
  * `@sema-agent/core` (the engine) at runtime** — so it dev-imports THIS const (test-only) and runs a conformance test

package/dist/core/safety-merge-corpus.d.ts

@@ -1,6 +1,6 @@
 import type { SessionPermissionRules } from "./session-policy-store.js";
 /**
- * design/99 (sema-registry center control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
+ * design/99 (web-admin control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
  * for the safety-domain MERGE predicate {@link loosenReasons}.
  *
  * THE SEAM. The center control-plane's ConfigBundle merger is a DISPATCHER: for any field it classifies

package/dist/core/secret-env.d.ts

@@ -6,18 +6,25 @@
  * deleted whole, never rewritten; `"all"` and a `string[]` allow list are the caller's explicit alternatives
  * ({@link inheritedHostEnv}). One judgment per variable ({@link classifySecretEnvEntry}), the first rule that answers:
  *   1. exempt — git's environment config and the proxy variables, handed on as written ({@link isExemptEnvName});
- *   2. `exact-name` — a known credential name ({@link CREDENTIAL_ENV_NAMES});
+ *   2. `exact-name` — a known credential name (the vocabulary's exact env names);
  *   3. `prefix-rule` — the OpenTelemetry settings ({@link OTEL_ENV_RE});
  *   4. `namespace-rule` — a credential word as any segment of a name in the engine's own `SEMA_` namespace;
- *   5. `name-rule` — a credential-shaped name ({@link nameIsCredentialShaped}) off {@link NON_SECRET_ENV_EXACT_NAMES};
- *   6. `value-rule` — a value that carries a credential ({@link valueCarriesCredential}).
- * {@link isSecretEnvKey} and {@link scrubSecretEnv} both answer with this one judgment. The exempt families, the
+ *   5. `name-rule` — a credential-shaped name ({@link nameIsCredentialShaped}) off the vocabulary's non-secret exact names;
+ *   6. `value-rule` — a value that carries a credential ({@link looksLikeCredentialValue}).
+ * {@link isSecretEnvKey} and {@link scrubSecretEnv} both answer with this one judgment; rules 2–5 are its name half
+ * ({@link isSensitiveName}), rule 6 its value half, and rule 1 the env-entry exemption read before both. The exempt families, the
  * credential names, the name shape and the value predicate follow the reference implementation's subprocess-env scrub
  * as written, three ways stricter: plural `TOKENS` is a credential word unless a count word touches it, the GitHub
  * token names are not held back from the name shape, and the name shape always runs.
  */
-import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
+import { type RedactionConfidence, type RedactionSource } from "./credential-vocabulary.js";
 import { type EngineNotice } from "./engine-notice.js";
+/** Does a value carry a credential? A URL userinfo (after every `scheme://`, and a leading `//`) with a password or a
+ *  token-like user; a scheme-less `user:password@host`; a credential assignment; a webhook URL; a Sonar login; a
+ *  private-key header; an `Authorization` header, `token …`, `Bearer …` or `Basic …` with credential-shaped content.
+ *  Reads the first {@link VALUE_SCAN_LIMIT} code units. The value half of the judgment, exported apart from the env
+ *  entry's exemptions ({@link isExemptEnvName}): a caller holding a value that is no environment variable asks this. */
+export declare function looksLikeCredentialValue(value: string): boolean;
 /** Which rule withheld an entry. */
 export type SecretEnvFindingKind = "exact-name" | "name-rule" | "namespace-rule" | "prefix-rule" | "value-rule";
 /** One env entry the `"scrub"` policy withheld (deleted): its name — never its value, so the record is loggable —, the
@@ -28,6 +35,10 @@ export interface SecretEnvFinding {
     confidence: RedactionConfidence;
     source: RedactionSource;
 }
+/** Does `key` name a credential? The name half of the judgment ({@link sensitiveNameKind}), exported apart from the env
+ *  entry's exemptions ({@link isExemptEnvName}): a caller holding a key that is no environment variable (a member of a
+ *  record) asks this, and an exempt name is no exception there. */
+export declare function isSensitiveName(key: string): boolean;
 /** Does the `"scrub"` policy withhold `key`? With `value`, exactly the answer {@link scrubSecretEnv} gives for that
  *  entry; without it, the answer for its name alone (the value rule then has nothing to read). */
 export declare function isSecretEnvKey(key: string, value?: string): boolean;

package/dist/core/secret-env.js

@@ -1,65 +1,25 @@
+import { CREDENTIAL_VOCABULARY, envNameView, splitCamelCase } from "./credential-vocabulary.js";
 import { deliverEngineNotice } from "./engine-notice.js";
 const GIT_CONFIG_ENV_RE = /^GIT_CONFIG_(?:COUNT|PARAMETERS|(?:KEY|VALUE)_[0-9]+)$/;
 const PROXY_ENV_RE = /^(?:(?:https?|ftp|all|no)_proxy|npm_config_(?:https?_)?proxy|npm_config_noproxy|yarn_proxy|(?:yarn|global_agent|docker|claude_code)_(?:https?|no)_proxy|cloudsdk_proxy_[a-z]+|electron_get_use_proxy)$/i;
 function isExemptEnvName(name) {
     return GIT_CONFIG_ENV_RE.test(name) || PROXY_ENV_RE.test(name);
 }
-const CREDENTIAL_ENV_NAMES = new Set([
-    "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_ARTIFACTS_API_TOKEN", "CLAUDE_CODE_MEMORY_API_TOKEN",
-    "CLAUDE_CODE_SLACK_TAG_TOKEN", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_FOUNDRY_AUTH_TOKEN",
-    "ANTHROPIC_AWS_API_KEY", "ANTHROPIC_CUSTOM_HEADERS", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
-    "AWS_BEARER_TOKEN_BEDROCK", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_GHA_CREDS_PATH", "AZURE_CLIENT_SECRET",
-    "IDENTITY_HEADER", "MSI_SECRET", "AZURE_CLIENT_CERTIFICATE_PATH", "AZURE_CLIENT_CERTIFICATE_PASSWORD",
-    "AZURE_PASSWORD", "AZURE_FEDERATED_TOKEN_FILE", "AWS_WEB_IDENTITY_TOKEN_FILE",
-    "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "AWS_CONTAINER_CREDENTIALS_FULL_URI",
-    "AWS_CONTAINER_AUTHORIZATION_TOKEN", "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", "CLOUDSDK_AUTH_ACCESS_TOKEN",
-    "GOOGLE_OAUTH_ACCESS_TOKEN", "CLAUDE_CODE_OAUTH_REFRESH_TOKEN", "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN",
-    "HUGGINGFACEHUB_API_TOKEN", "NODE_AUTH_TOKEN", "NUGET_AUTH_TOKEN", "CARGO_REGISTRY_TOKEN", "TWINE_PASSWORD",
-    "TWINE_USERNAME", "PYPI_TOKEN", "PYPI_API_TOKEN", "UV_PUBLISH_TOKEN", "UV_PUBLISH_PASSWORD", "UV_PUBLISH_USERNAME",
-    "FLIT_PASSWORD", "FLIT_USERNAME", "HATCH_INDEX_AUTH", "HATCH_INDEX_USER", "GEM_HOST_API_KEY", "MATURIN_PYPI_TOKEN",
-    "MATURIN_PASSWORD", "MATURIN_USERNAME", "CONAN_LOGIN_USERNAME", "CONAN_PASSWORD", "ANACONDA_API_TOKEN",
-    "BINSTAR_API_TOKEN", "VAULT_TOKEN", "VAULT_AUTH_TOKEN", "VAULT_ROLE_ID", "VAULT_SECRET_ID", "CONSUL_HTTP_TOKEN",
-    "CONSUL_HTTP_AUTH", "NOMAD_TOKEN", "NOMAD_HTTP_AUTH", "CI_REGISTRY_USER", "CI_DEPLOY_USER", "JF_USER",
-    "FASTLANE_SESSION", "MATCH_GIT_BASIC_AUTHORIZATION", "SONAR_TOKEN", "SONARQUBE_SCANNER_PARAMS",
-    "SONAR_SCANNER_JSON_PARAMS", "SLACK_WEBHOOK_URL", "SLACK_WEBHOOK", "DISCORD_WEBHOOK", "DISCORD_WEBHOOK_URL",
-    "TEAMS_WEBHOOK_URL", "MS_TEAMS_WEBHOOK_URI", "ANTHROPIC_IDENTITY_TOKEN", "ANTHROPIC_IDENTITY_TOKEN_FILE",
-    "CLOUDSDK_AUTH_ACCESS_TOKEN_FILE", "CLOUDSDK_AUTH_AUTHORIZATION_TOKEN_FILE", "AZURE_AUTH_LOCATION",
-    "ACTIONS_ID_TOKEN_REQUEST_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_URL", "ACTIONS_RUNTIME_TOKEN", "ACTIONS_RUNTIME_URL",
-    "ALL_INPUTS", "VSS_NUGET_EXTERNAL_FEED_ENDPOINTS", "ARTIFACTS_CREDENTIALPROVIDER_EXTERNAL_FEED_ENDPOINTS",
-    "VSS_NUGET_ACCESSTOKEN", "ARTIFACTS_CREDENTIALPROVIDER_ACCESSTOKEN", "COMPOSER_AUTH", "OVERRIDE_GITHUB_TOKEN",
-    "DEFAULT_WORKFLOW_TOKEN", "SSH_SIGNING_KEY"
-].flatMap((name) => [name, `INPUT_${name}`]));
+const ENV_NAMES = envNameView(CREDENTIAL_VOCABULARY);
 const OTEL_ENV_RE = /^(?:INPUT_)?OTEL_/i;
-const COUNTED_TOKENS = "(?<!(?:^|_)(?:MAX|OUTPUT|INPUT|THINKING|NUM|TOTAL)_)TOKENS";
-const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?(?:KEY|KEYS|TOKEN|${COUNTED_TOKENS}|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY)(?:_|$)`, "is");
-const LEADING_WORDS = [
-    "TOKEN", "SECRET", "PASSWORD", "PASSWD", "PASSPHRASE", "KEY", "AUTH", "COOKIE", "PAT", "DSN", "WEBHOOK", "CREDENTIAL",
-    "CREDENTIALS", "CREDS", "APIKEY", "ACCESSKEY", "SECRETKEY", "ACCOUNTKEY", "PRIVATEKEY", "AUTHKEY", "SSHKEY",
-    "SIGNINGKEY", "MASTERKEY", "DEPLOYKEY", "ENCRYPTIONKEY", "PGPASSWORD", "SSHPASS",
-];
-const PLURAL_WORDS = ["KEY", "SECRET", "PASSWORD", "CREDENTIAL"];
-const SEPARATED_WORDS = ["PWD", "PASS", "JWT"];
-const EMBEDDED_WORDS = ["TOKEN", "SECRET", "PASSWORD", "PASSWD", "PASSPHRASE"];
-const CREDENTIAL_WORD_RE = new RegExp(`((^|_)(${LEADING_WORDS.join("|")}|(${PLURAL_WORDS.join("|")})S|${COUNTED_TOKENS})|_(${SEPARATED_WORDS.join("|")})|(${EMBEDDED_WORDS.join("|")}))(?=$|[_0-9])`, "i");
-const CONNECTION_STRING_RE = /CONN(ECT(ION)?)?_?STR(ING)?S?(?=$|[_0-9])/i;
+const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?(?:KEY|KEYS|TOKEN|${ENV_NAMES.countedPlural}|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY)(?:_|$)`, "is");
 const BUNDLER_SETTINGS = ["BUILD", "LOCAL", "MIRROR", "PATH", "WITH", "WITHOUT", "CACHE", "DISABLE", "IGNORE", "ONLY"];
 const BUNDLER_HOST = "(?:[A-Za-z0-9]+(?:___[A-Za-z0-9]+)*__)+[A-Za-z]{2,}";
 const BUNDLER_CREDENTIAL_RE = new RegExp(`^(?:INPUT_)?BUNDLE_(?!(?:${BUNDLER_SETTINGS.join("|")})__(?!${BUNDLER_HOST}$))\\w*__`, "i");
-const GIT_CONFIG_KEY_NAME_RE = /^GIT_CONFIG_KEY_[0-9][A-Za-z0-9_]*$/;
 const PUBLISHER_PREFIX_RE = /^(?:INPUT_|ORG_GRADLE_PROJECT_|POETRY_PYPI_TOKEN_|POETRY_HTTP_BASIC_|CARGO_REGISTRIES_|CONAN_LOGIN_USERNAME_|CONAN_PASSWORD_)/i;
 const PUBLISHER_LOGIN_PREFIX_RE = /^(?:INPUT_)?(?:POETRY_HTTP_BASIC_|CONAN_LOGIN_USERNAME_)/i;
 const USER_NAME_TAIL_RE = /USER(?:_?NAME)?_?[0-9]*$/i;
-function splitCamelCase(name) {
-    return ["OAuth", "NextAuth"]
-        .reduce((text, word) => text.replaceAll(word, word[0] + word.slice(1).toLowerCase()), name)
-        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-        .replace(/([A-Z])([A-Z][a-z])/g, "$1_$2");
-}
 function nameShapeHolds(name) {
-    const words = name.replace(/^AUTH0_/i, "").replace(/-/g, "_");
+    const words = name.replace(ENV_NAMES.nonCredentialPrefix, "").replace(/-/g, "_");
     const split = splitCamelCase(words);
-    const shaped = CREDENTIAL_WORD_RE.test(words) || CREDENTIAL_WORD_RE.test(split) || CONNECTION_STRING_RE.test(words) || CONNECTION_STRING_RE.test(split) || BUNDLER_CREDENTIAL_RE.test(words);
-    return shaped && !GIT_CONFIG_KEY_NAME_RE.test(name);
+    const { credentialWord, connectionStringName } = ENV_NAMES;
+    const shaped = credentialWord.test(words) || credentialWord.test(split) || connectionStringName.test(words) || connectionStringName.test(split) || BUNDLER_CREDENTIAL_RE.test(words);
+    return shaped && !ENV_NAMES.nonSecretNameShape.test(name);
 }
 function nameIsCredentialShaped(name) {
     if (BUNDLER_CREDENTIAL_RE.test(name) || nameShapeHolds(name))
@@ -67,16 +27,9 @@ function nameIsCredentialShaped(name) {
     const words = name.replace(/-/g, "_");
     return PUBLISHER_PREFIX_RE.test(words) && (PUBLISHER_LOGIN_PREFIX_RE.test(words) || USER_NAME_TAIL_RE.test(words) || nameShapeHolds(words));
 }
-const NON_SECRET_ENV_EXACT_NAMES = new Set([
-    "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY", "ROUTING_KEY",
-    "DB_FOREIGN_KEYS", "JSON_SORT_KEYS",
-    "MAX_NEW_TOKENS", "MAX_COMPLETION_TOKENS", "AIDER_MAP_TOKENS", "AIDER_MAX_CHAT_HISTORY_TOKENS",
-    "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
-    "PROMPT_TOKENS", "CONTEXT_TOKENS",
-]);
 const VALUE_SCAN_LIMIT = 8192;
 function looksLikeToken(user) {
-    return /^(?:gh[opusr]_|github_pat_|glpat-|xox[abpr]-|sk-|pk-|AKIA|eyJ|ya29\.|npm_)/.test(user) || (user.length >= 20 && /[0-9]/.test(user) && /[a-z]/i.test(user));
+    return ENV_NAMES.tokenPrefix.test(user) || (user.length >= 20 && /[0-9]/.test(user) && /[a-z]/i.test(user));
 }
 const HOST_RE = /^(?:localhost|[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.(?=[a-z0-9-]*[a-z])[a-z0-9-]+|[a-z0-9_.-]+(?=:\d+(?:[/?#]|$))|\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-f:.]+\])(?::\d+)?(?:[/?#]|$)/i;
 const HOSTLIKE_RE = /^(?:(?=[a-z0-9._-]*[a-z])[a-z0-9._-]+|\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-f:.]+\])(?::\d+)?(?:[/?#]|$)/i;
@@ -119,7 +72,7 @@ const PRIVATE_KEY_HEADER_RE = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
 const AUTHORIZATION_HEADER_RE = /\bauthorization\s*[:=]\s*["']?[a-z][a-z0-9_-]*\s+[A-Za-z0-9._~+\/=-]{8,}/i;
 const TOKEN_WORD_RE = /\b(?:[Tt]oken|TOKEN)\s+(?=[A-Za-z0-9_~+=-]*[0-9])(?=[A-Za-z0-9_~+=-]*[A-Z])(?=([A-Za-z0-9_~+=-]{20,}))\1(?![\/.])/;
 const BEARER_BASIC_RE = /\b(?:Bearer|Basic)\s+(?=[A-Za-z._~+\/=-]*[0-9]|(?:[A-Za-z0-9._~+\/=-]*?[a-z][A-Z](?![a-z])){2}|[A-Za-z0-9.-]*[_~+\/=])[A-Za-z0-9._~+\/=-]{8,}/;
-function valueCarriesCredential(value) {
+export function looksLikeCredentialValue(value) {
     const text = value.length > VALUE_SCAN_LIMIT ? value.slice(0, VALUE_SCAN_LIMIT) : value;
     for (let at = text.indexOf("://"); at !== -1; at = text.indexOf("://", at + 3)) {
         if (at > 0 && /[a-z0-9+.-]/i.test(text[at - 1] ?? "") && authorityCarriesCredential(text.slice(at + 3)))
@@ -143,18 +96,25 @@ const SECRET_ENV_KIND_CONFIDENCE = {
     "name-rule": "medium",
     "namespace-rule": "medium",
 };
-function classifySecretEnvEntry(name, value) {
-    if (isExemptEnvName(name))
-        return undefined;
-    if (CREDENTIAL_ENV_NAMES.has(name.toUpperCase().replace(/-/g, "_")))
+function sensitiveNameKind(name) {
+    if (ENV_NAMES.exactNames.has(name.toUpperCase().replace(/-/g, "_")))
         return "exact-name";
     if (OTEL_ENV_RE.test(name))
         return "prefix-rule";
     if (SEMA_NAMESPACE_SECRET_RE.test(name))
         return "namespace-rule";
-    if (!NON_SECRET_ENV_EXACT_NAMES.has(name.toUpperCase()) && nameIsCredentialShaped(name))
-        return "name-rule";
-    return value !== undefined && valueCarriesCredential(typeof value === "string" ? value : String(value)) ? "value-rule" : undefined;
+    return !ENV_NAMES.nonSecretExactNames.has(name.toUpperCase()) && nameIsCredentialShaped(name) ? "name-rule" : undefined;
+}
+export function isSensitiveName(key) {
+    return sensitiveNameKind(key) !== undefined;
+}
+function classifySecretEnvEntry(name, value) {
+    if (isExemptEnvName(name))
+        return undefined;
+    const named = sensitiveNameKind(name);
+    if (named !== undefined)
+        return named;
+    return value !== undefined && looksLikeCredentialValue(typeof value === "string" ? value : String(value)) ? "value-rule" : undefined;
 }
 export function isSecretEnvKey(key, value) {
     return classifySecretEnvEntry(key, value) !== undefined;