@staff0rd/assist 0.493.0 → 0.494.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.493.0",
+  version: "0.494.0",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -416,7 +416,7 @@ function resolveRepoWriteLabel(globalRaw, origin) {
 }
 
 // src/shared/types.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/shared/runConfigSchema.ts
 import { z } from "zod";
@@ -444,183 +444,194 @@ var runLinkSchema = z.strictObject({
   prefix: z.string()
 });
 
+// src/shared/secretConfigValue.ts
+import { z as z2 } from "zod";
+var SECRET_META_KEY = "assistSecret";
+function secretConfigValue(schema2) {
+  return schema2.meta({ [SECRET_META_KEY]: true });
+}
+function isSecretSchemaNode(node) {
+  const meta = z2.globalRegistry.get(node);
+  return meta?.[SECRET_META_KEY] === true;
+}
+
 // src/shared/types.ts
-var transcriptConfigSchema = z2.strictObject({
-  vttDir: z2.string(),
-  transcriptsDir: z2.string(),
-  summaryDir: z2.string()
+var transcriptConfigSchema = z3.strictObject({
+  vttDir: z3.string(),
+  transcriptsDir: z3.string(),
+  summaryDir: z3.string()
 });
 var DEFAULT_WAKE_WORDS = ["computer"];
 var DEFAULT_MODELS_DIR = "~/.assist/voice/models";
 var DEFAULT_BACKUP_DIR = "~/.assist/backups";
 var DEFAULT_CLONE_DIR = "~/git";
 var assistConfigShape = {
-  backup: z2.strictObject({
-    dir: z2.string().default(DEFAULT_BACKUP_DIR)
+  backup: z3.strictObject({
+    dir: z3.string().default(DEFAULT_BACKUP_DIR)
   }).default({ dir: DEFAULT_BACKUP_DIR }),
-  clone: z2.strictObject({
-    baseDir: z2.string().default(DEFAULT_CLONE_DIR)
+  clone: z3.strictObject({
+    baseDir: z3.string().default(DEFAULT_CLONE_DIR)
   }).default({ baseDir: DEFAULT_CLONE_DIR }),
-  commit: z2.strictObject({
-    conventional: z2.boolean().default(false),
-    pull: z2.boolean().default(false),
-    push: z2.boolean().default(false),
-    expectedBranch: z2.string().optional()
+  commit: z3.strictObject({
+    conventional: z3.boolean().default(false),
+    pull: z3.boolean().default(false),
+    push: z3.boolean().default(false),
+    expectedBranch: z3.string().optional()
   }).default({ conventional: false, pull: false, push: false }),
-  branch: z2.strictObject({
-    prefix: z2.string().optional(),
-    defaultBranch: z2.string().optional()
+  branch: z3.strictObject({
+    prefix: z3.string().optional(),
+    defaultBranch: z3.string().optional()
   }).optional(),
-  devlog: z2.strictObject({
-    name: z2.string().optional(),
-    ignore: z2.array(z2.string()).optional(),
-    skip: z2.record(z2.string(), z2.array(z2.string())).optional()
+  devlog: z3.strictObject({
+    name: z3.string().optional(),
+    ignore: z3.array(z3.string()).optional(),
+    skip: z3.record(z3.string(), z3.array(z3.string())).optional()
   }).optional(),
-  notify: z2.strictObject({
-    enabled: z2.boolean().default(true)
+  notify: z3.strictObject({
+    enabled: z3.boolean().default(true)
   }).default({ enabled: true }),
-  complexity: z2.strictObject({
-    ignore: z2.array(z2.string()).default(["**/*test.ts*"])
+  complexity: z3.strictObject({
+    ignore: z3.array(z3.string()).default(["**/*test.ts*"])
   }).default({ ignore: ["**/*test.ts*"] }),
-  hardcodedColors: z2.strictObject({
-    ignore: z2.array(z2.string()).default([])
+  hardcodedColors: z3.strictObject({
+    ignore: z3.array(z3.string()).default([])
   }).optional(),
-  blockCodeComments: z2.strictObject({
-    ignore: z2.array(z2.string()).default([])
+  blockCodeComments: z3.strictObject({
+    ignore: z3.array(z3.string()).default([])
   }).optional(),
-  restructure: z2.strictObject({
-    ignore: z2.array(z2.string()).default([])
+  restructure: z3.strictObject({
+    ignore: z3.array(z3.string()).default([])
   }).optional(),
-  jira: z2.strictObject({
-    acField: z2.string().default("customfield_11937")
+  jira: z3.strictObject({
+    acField: z3.string().default("customfield_11937")
   }).optional(),
-  roam: z2.strictObject({
-    clientId: z2.string(),
-    clientSecret: z2.string(),
-    accessToken: z2.string().optional(),
-    refreshToken: z2.string().optional(),
-    tokenExpiresAt: z2.number().optional()
+  roam: z3.strictObject({
+    clientId: secretConfigValue(z3.string()),
+    clientSecret: secretConfigValue(z3.string()),
+    accessToken: secretConfigValue(z3.string()).optional(),
+    refreshToken: secretConfigValue(z3.string()).optional(),
+    tokenExpiresAt: z3.number().optional()
   }).optional(),
-  prs: z2.strictObject({
-    slack: z2.string().optional(),
-    required: z2.boolean().default(false),
-    promptJira: z2.boolean().default(false)
+  prs: z3.strictObject({
+    slack: z3.string().optional(),
+    required: z3.boolean().default(false),
+    promptJira: z3.boolean().default(false)
   }).optional(),
-  worktree: z2.strictObject({
-    enabled: z2.boolean().default(false),
-    trunk: z2.boolean().default(false),
-    includeDrafts: z2.boolean().default(false),
-    root: z2.string().optional(),
-    install: z2.union([z2.boolean(), z2.string()]).default(true),
-    commitBeforeManualChecks: z2.boolean().default(false),
-    copy: z2.array(z2.string()).default([
+  worktree: z3.strictObject({
+    enabled: z3.boolean().default(false),
+    trunk: z3.boolean().default(false),
+    includeDrafts: z3.boolean().default(false),
+    root: z3.string().optional(),
+    install: z3.union([z3.boolean(), z3.string()]).default(true),
+    commitBeforeManualChecks: z3.boolean().default(false),
+    copy: z3.array(z3.string()).default([
       ".env",
       "settings.local.json",
       ".claude/settings.local.json"
     ])
   }).optional(),
-  run: z2.array(z2.union([runConfigSchema, runLinkSchema])).optional(),
-  subtasks: z2.array(
-    z2.strictObject({
-      title: z2.string(),
-      description: z2.string().optional()
+  run: z3.array(z3.union([runConfigSchema, runLinkSchema])).optional(),
+  subtasks: z3.array(
+    z3.strictObject({
+      title: z3.string(),
+      description: z3.string().optional()
     })
   ).optional(),
   transcript: transcriptConfigSchema.optional(),
-  cliReadVerbs: z2.record(z2.string(), z2.array(z2.string())).optional(),
-  dotnet: z2.strictObject({
-    inspect: z2.strictObject({
-      suppress: z2.array(z2.string()).default([])
+  cliReadVerbs: z3.record(z3.string(), z3.array(z3.string())).optional(),
+  dotnet: z3.strictObject({
+    inspect: z3.strictObject({
+      suppress: z3.array(z3.string()).default([])
     }).default({ suppress: [] })
   }).optional(),
-  ravendb: z2.strictObject({
-    connections: z2.array(
-      z2.strictObject({
-        name: z2.string(),
-        url: z2.string(),
-        database: z2.string(),
-        apiKeyRef: z2.string()
+  ravendb: z3.strictObject({
+    connections: z3.array(
+      z3.strictObject({
+        name: z3.string(),
+        url: z3.string(),
+        database: z3.string(),
+        apiKeyRef: z3.string()
       })
     ).default([]),
-    defaultConnection: z2.string().optional()
+    defaultConnection: z3.string().optional()
   }).optional(),
-  seq: z2.strictObject({
-    connections: z2.array(
-      z2.strictObject({
-        name: z2.string(),
-        url: z2.string(),
-        apiToken: z2.string()
+  seq: z3.strictObject({
+    connections: z3.array(
+      z3.strictObject({
+        name: z3.string(),
+        url: z3.string(),
+        apiToken: secretConfigValue(z3.string())
       })
     ).default([]),
-    defaultConnection: z2.string().optional()
+    defaultConnection: z3.string().optional()
   }).optional(),
-  sql: z2.strictObject({
-    connections: z2.array(
-      z2.strictObject({
-        name: z2.string(),
-        server: z2.string(),
-        port: z2.number(),
-        user: z2.string(),
-        password: z2.string(),
-        database: z2.string()
+  sql: z3.strictObject({
+    connections: z3.array(
+      z3.strictObject({
+        name: z3.string(),
+        server: z3.string(),
+        port: z3.number(),
+        user: z3.string(),
+        password: secretConfigValue(z3.string()),
+        database: z3.string()
       })
     ).default([]),
-    defaultConnection: z2.string().optional()
+    defaultConnection: z3.string().optional()
   }).optional(),
-  screenshot: z2.strictObject({
-    outputDir: z2.string().default("./screenshots")
+  screenshot: z3.strictObject({
+    outputDir: z3.string().default("./screenshots")
   }).default({ outputDir: "./screenshots" }),
-  sessions: z2.strictObject({
+  sessions: z3.strictObject({
     // why: Windows .claude/projects root as seen from WSL (e.g. /mnt/c/Users/<user>/.claude/projects); when set its transcripts are discovered and tagged windows-origin
-    windowsProjectsRoot: z2.string().optional(),
+    windowsProjectsRoot: z3.string().optional(),
     // why: host the WSL daemon dials to reach the native Windows daemon over TCP (WSL can't use the Windows named pipe); defaults to 127.0.0.1 (WSL2 mirrored networking). NAT-mode users set the Windows host IP.
-    windowsDaemonHost: z2.string().optional(),
+    windowsDaemonHost: z3.string().optional(),
     // why: TCP port the native Windows daemon listens on for the WSL bridge; defaults to 51764
-    windowsDaemonPort: z2.number().optional(),
-    windowsVersionCheck: z2.enum(["block", "warn", "off"]).default("block"),
-    includeCommittedChanges: z2.boolean().default(true),
-    topBar: z2.boolean().default(true),
-    floatWaiting: z2.boolean().default(true),
-    floatWaitingAfterMs: z2.number().default(5e3),
-    maxLive: z2.number().default(24)
+    windowsDaemonPort: z3.number().optional(),
+    windowsVersionCheck: z3.enum(["block", "warn", "off"]).default("block"),
+    includeCommittedChanges: z3.boolean().default(true),
+    topBar: z3.boolean().default(true),
+    floatWaiting: z3.boolean().default(true),
+    floatWaitingAfterMs: z3.number().default(5e3),
+    maxLive: z3.number().default(24)
   }).optional(),
-  database: z2.strictObject({
-    url: z2.string().optional()
+  database: z3.strictObject({
+    url: secretConfigValue(z3.string()).optional()
   }).default({}),
-  mermaid: z2.strictObject({
-    krokiUrl: z2.string().default("https://kroki.io")
+  mermaid: z3.strictObject({
+    krokiUrl: z3.string().default("https://kroki.io")
   }).default({ krokiUrl: "https://kroki.io" }),
-  deny: z2.array(
-    z2.strictObject({
-      pattern: z2.string(),
-      message: z2.string()
+  deny: z3.array(
+    z3.strictObject({
+      pattern: z3.string(),
+      message: z3.string()
     })
   ).optional(),
-  forbiddenStrings: z2.array(
-    z2.strictObject({
-      file: z2.string(),
-      paths: z2.array(z2.string()),
-      disallowed: z2.string()
+  forbiddenStrings: z3.array(
+    z3.strictObject({
+      file: z3.string(),
+      paths: z3.array(z3.string()),
+      disallowed: z3.string()
     })
   ).optional(),
-  sync: z2.strictObject({
-    autoConfirm: z2.boolean().default(false)
+  sync: z3.strictObject({
+    autoConfirm: z3.boolean().default(false)
   }).default({ autoConfirm: false }),
-  harness: z2.strictObject({
-    engine: z2.enum(["claude", "codex", "pi"]).default("claude"),
-    exposeCodexActions: z2.boolean().optional(),
-    exposePiActions: z2.boolean().optional()
+  harness: z3.strictObject({
+    engine: z3.enum(["claude", "codex", "pi"]).default("claude"),
+    exposeCodexActions: z3.boolean().optional(),
+    exposePiActions: z3.boolean().optional()
   }).default({ engine: "claude" }),
-  voice: z2.strictObject({
-    wakeWords: z2.array(z2.string()).default(DEFAULT_WAKE_WORDS),
-    mic: z2.string().optional(),
-    cwd: z2.string().optional(),
-    modelsDir: z2.string().default(DEFAULT_MODELS_DIR),
-    lockDir: z2.string().optional(),
-    submitWindows: z2.array(z2.string()).optional(),
-    models: z2.strictObject({
-      vad: z2.string().optional(),
-      smartTurn: z2.string().optional()
+  voice: z3.strictObject({
+    wakeWords: z3.array(z3.string()).default(DEFAULT_WAKE_WORDS),
+    mic: z3.string().optional(),
+    cwd: z3.string().optional(),
+    modelsDir: z3.string().default(DEFAULT_MODELS_DIR),
+    lockDir: z3.string().optional(),
+    submitWindows: z3.array(z3.string()).optional(),
+    models: z3.strictObject({
+      vad: z3.string().optional(),
+      smartTurn: z3.string().optional()
     }).default({})
   }).default({
     wakeWords: DEFAULT_WAKE_WORDS,
@@ -628,10 +639,10 @@ var assistConfigShape = {
     models: {}
   })
 };
-var repoConfigSchema = z2.strictObject(assistConfigShape).partial();
-var assistConfigSchema = z2.strictObject({
+var repoConfigSchema = z3.strictObject(assistConfigShape).partial();
+var assistConfigSchema = z3.strictObject({
   ...assistConfigShape,
-  repos: z2.record(z2.string(), repoConfigSchema).optional()
+  repos: z3.record(z3.string(), repoConfigSchema).optional()
 });
 
 // src/shared/loadConfigFrom.ts
@@ -3813,10 +3824,12 @@ function opaqueConfigNode(inner, base) {
 }
 function build(node, path71) {
   const { inner, defaultValue, optional } = unwrapSchemaNode(node);
+  const secret = isSecretSchemaNode(node) || isSecretSchemaNode(inner);
   const base = {
     path: path71,
     ...optional ? { optional: true } : {},
-    ...defaultValue === void 0 ? {} : { defaultValue }
+    ...defaultValue === void 0 ? {} : { defaultValue },
+    ...secret ? { secret: true } : {}
   };
   return scalarConfigNode(inner, base) ?? objectConfigNode(inner, base, build) ?? listConfigNode(inner, base, build) ?? recordConfigNode(inner, base, build) ?? unionOfObjectsConfigNode(inner, base, build) ?? opaqueConfigNode(inner, base);
 }
@@ -3869,6 +3882,7 @@ function toLeaf(node) {
   }
   if (node.kind === "scalarList") leaf.itemType = node.itemType;
   if (node.defaultValue !== void 0) leaf.defaultValue = node.defaultValue;
+  if (node.secret) leaf.secret = true;
   return leaf;
 }
 function flatten(node, out) {
@@ -6380,92 +6394,92 @@ async function loadAllItems(orm, origin) {
 import { readFileSync as readFileSync15 } from "fs";
 
 // src/commands/backlog/types.ts
-import { z as z3 } from "zod";
-var backlogStatusSchema = z3.enum(["todo", "in-progress", "done", "wontdo"]);
-var backlogTypeSchema = z3.enum(["story", "bug"]);
-var planTaskSchema = z3.object({
-  task: z3.string()
+import { z as z4 } from "zod";
+var backlogStatusSchema = z4.enum(["todo", "in-progress", "done", "wontdo"]);
+var backlogTypeSchema = z4.enum(["story", "bug"]);
+var planTaskSchema = z4.object({
+  task: z4.string()
 }).strip();
-var planPhaseSchema = z3.strictObject({
-  name: z3.string(),
-  tasks: z3.array(planTaskSchema),
-  manualChecks: z3.array(z3.string()).optional()
+var planPhaseSchema = z4.strictObject({
+  name: z4.string(),
+  tasks: z4.array(planTaskSchema),
+  manualChecks: z4.array(z4.string()).optional()
 });
-var phaseUsageSchema = z3.strictObject({
-  phaseIdx: z3.number(),
-  tokensUp: z3.number(),
-  tokensDown: z3.number(),
-  activeMs: z3.number(),
-  peakContextPct: z3.number()
+var phaseUsageSchema = z4.strictObject({
+  phaseIdx: z4.number(),
+  tokensUp: z4.number(),
+  tokensDown: z4.number(),
+  activeMs: z4.number(),
+  peakContextPct: z4.number()
 });
-var phaseSessionSchema = z3.strictObject({
-  phaseIdx: z3.number(),
-  claudeSessionId: z3.string(),
-  hostname: z3.string(),
-  osUser: z3.string()
+var phaseSessionSchema = z4.strictObject({
+  phaseIdx: z4.number(),
+  claudeSessionId: z4.string(),
+  hostname: z4.string(),
+  osUser: z4.string()
 });
-var phaseUsageTotalSchema = z3.strictObject({
-  tokensUp: z3.number(),
-  tokensDown: z3.number(),
-  activeMs: z3.number(),
-  peakContextPct: z3.number()
+var phaseUsageTotalSchema = z4.strictObject({
+  tokensUp: z4.number(),
+  tokensDown: z4.number(),
+  activeMs: z4.number(),
+  peakContextPct: z4.number()
 });
-var subtaskStatusSchema = z3.enum(["todo", "in-progress", "done"]);
-var subtaskSchema = z3.strictObject({
-  title: z3.string(),
-  description: z3.string().optional(),
+var subtaskStatusSchema = z4.enum(["todo", "in-progress", "done"]);
+var subtaskSchema = z4.strictObject({
+  title: z4.string(),
+  description: z4.string().optional(),
   status: subtaskStatusSchema.default("todo")
 });
-var backlogCommentTypeSchema = z3.enum(["comment", "summary"]);
-var backlogCommentSchema = z3.strictObject({
-  id: z3.number().optional(),
-  text: z3.string(),
-  phase: z3.number().optional(),
-  timestamp: z3.string(),
+var backlogCommentTypeSchema = z4.enum(["comment", "summary"]);
+var backlogCommentSchema = z4.strictObject({
+  id: z4.number().optional(),
+  text: z4.string(),
+  phase: z4.number().optional(),
+  timestamp: z4.string(),
   type: backlogCommentTypeSchema
 });
-var gitRefKindSchema = z3.enum([
+var gitRefKindSchema = z4.enum([
   "branch",
   "commit",
   "commit-parent",
   "pr",
   "slack"
 ]);
-var gitRefSchema = z3.strictObject({
+var gitRefSchema = z4.strictObject({
   kind: gitRefKindSchema,
-  ref: z3.string(),
-  title: z3.string().optional(),
-  url: z3.string().optional(),
-  state: z3.string().optional(),
-  createdAt: z3.string().optional()
+  ref: z4.string(),
+  title: z4.string().optional(),
+  url: z4.string().optional(),
+  state: z4.string().optional(),
+  createdAt: z4.string().optional()
 });
-var backlogLinkTypeSchema = z3.enum(["relates-to", "depends-on"]);
-var backlogLinkSchema = z3.strictObject({
+var backlogLinkTypeSchema = z4.enum(["relates-to", "depends-on"]);
+var backlogLinkSchema = z4.strictObject({
   type: backlogLinkTypeSchema,
-  targetId: z3.number()
+  targetId: z4.number()
 });
-var backlogItemSchema = z3.strictObject({
-  id: z3.number(),
+var backlogItemSchema = z4.strictObject({
+  id: z4.number(),
   type: backlogTypeSchema.default("story"),
-  name: z3.string(),
-  description: z3.string().optional(),
-  acceptanceCriteria: z3.array(z3.string()),
-  plan: z3.array(planPhaseSchema).optional(),
-  currentPhase: z3.number().optional(),
-  starred: z3.boolean().default(false),
+  name: z4.string(),
+  description: z4.string().optional(),
+  acceptanceCriteria: z4.array(z4.string()),
+  plan: z4.array(planPhaseSchema).optional(),
+  currentPhase: z4.number().optional(),
+  starred: z4.boolean().default(false),
   status: backlogStatusSchema,
-  comments: z3.array(backlogCommentSchema).optional(),
-  subtasks: z3.array(subtaskSchema).optional(),
-  links: z3.array(backlogLinkSchema).optional(),
-  phaseUsage: z3.array(phaseUsageSchema).optional(),
-  phaseSessions: z3.array(phaseSessionSchema).optional(),
+  comments: z4.array(backlogCommentSchema).optional(),
+  subtasks: z4.array(subtaskSchema).optional(),
+  links: z4.array(backlogLinkSchema).optional(),
+  phaseUsage: z4.array(phaseUsageSchema).optional(),
+  phaseSessions: z4.array(phaseSessionSchema).optional(),
   usageTotal: phaseUsageTotalSchema.optional(),
-  gitRefs: z3.array(gitRefSchema).optional(),
-  origin: z3.string().optional(),
-  jiraKey: z3.string().optional(),
-  githubIssue: z3.string().optional()
+  gitRefs: z4.array(gitRefSchema).optional(),
+  origin: z4.string().optional(),
+  jiraKey: z4.string().optional(),
+  githubIssue: z4.string().optional()
 });
-var backlogFileSchema = z3.array(backlogItemSchema);
+var backlogFileSchema = z4.array(backlogItemSchema);
 
 // src/commands/backlog/parseBacklogJsonl.ts
 function parseBacklogJsonl(path71) {
@@ -7517,18 +7531,18 @@ async function persistPhaseSessionId(itemId2, phaseIdx, claudeSessionId) {
 import { mkdirSync as mkdirSync9, readFileSync as readFileSync18, rmSync as rmSync2, writeFileSync as writeFileSync19 } from "fs";
 import { homedir as homedir10 } from "os";
 import { dirname as dirname17, join as join22 } from "path";
-import { z as z4 } from "zod";
-var activitySchema = z4.object({
-  kind: z4.enum(["command", "backlog"]),
-  harness: z4.enum(["claude", "codex", "pi"]).optional(),
-  name: z4.string().optional(),
-  itemId: z4.number().optional(),
-  itemName: z4.string().optional(),
-  phase: z4.number().optional(),
-  phaseName: z4.string().optional(),
-  totalPhases: z4.number().optional(),
-  claudeSessionId: z4.string().optional(),
-  startedAt: z4.number()
+import { z as z5 } from "zod";
+var activitySchema = z5.object({
+  kind: z5.enum(["command", "backlog"]),
+  harness: z5.enum(["claude", "codex", "pi"]).optional(),
+  name: z5.string().optional(),
+  itemId: z5.number().optional(),
+  itemName: z5.string().optional(),
+  phase: z5.number().optional(),
+  phaseName: z5.string().optional(),
+  totalPhases: z5.number().optional(),
+  claudeSessionId: z5.string().optional(),
+  startedAt: z5.number()
 });
 function activityPath(sessionId) {
   return join22(homedir10(), ".assist", "activity", `activity-${sessionId}.json`);
@@ -9772,6 +9786,78 @@ async function getBackups(_req, res) {
   respondJson(res, 200, await listBackups(await getDb()));
 }
 
+// src/shared/configNodeFieldName.ts
+function configNodeFieldName(node) {
+  const last = node.path.at(-1);
+  return last?.kind === "key" ? last.name : void 0;
+}
+
+// src/shared/configNodeField.ts
+function fieldsOf(node) {
+  if (node.kind === "object") return node.fields;
+  if (node.kind === "unionOfObjects")
+    return node.variants.flatMap((variant) => variant.fields);
+  return [];
+}
+function configNodeField(node, name) {
+  const matches = fieldsOf(node).filter(
+    (field) => configNodeFieldName(field) === name
+  );
+  return matches.find((field) => field.secret) ?? matches[0];
+}
+
+// src/shared/isPlainRecord.ts
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/shared/mapConfigSecrets.ts
+function mapChildren(value, path71, childNode, map) {
+  if (!isPlainRecord(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([name, child]) => [
+      name,
+      walk(child, [...path71, name], childNode(name), map)
+    ])
+  );
+}
+function mapItems(value, path71, item, map) {
+  if (!Array.isArray(value)) return value;
+  return value.map((entry, index3) => walk(entry, [...path71, index3], item, map));
+}
+function walk(value, path71, node, map) {
+  if (!node || value === void 0 || value === null) return value;
+  if (node.secret) return map(value, path71);
+  switch (node.kind) {
+    case "object":
+    case "unionOfObjects":
+      return mapChildren(
+        value,
+        path71,
+        (name) => configNodeField(node, name),
+        map
+      );
+    case "objectList":
+      return mapItems(value, path71, node.item, map);
+    case "record":
+      return mapChildren(value, path71, () => node.value, map);
+    default:
+      return value;
+  }
+}
+function mapConfigSecrets(value, node, map) {
+  return walk(value, [], node, map);
+}
+
+// src/shared/redactConfigSecrets.ts
+var REDACTED_SECRET = { assistSecret: "set" };
+function isRedactedSecret(value) {
+  return typeof value === "object" && value !== null && value.assistSecret === "set";
+}
+function redactConfigSecrets(value, node) {
+  return mapConfigSecrets(value, node, () => REDACTED_SECRET);
+}
+
 // src/commands/config/getNestedValue.ts
 function isTraversable(value) {
   return value !== null && value !== void 0 && typeof value === "object";
@@ -9820,12 +9906,6 @@ function resolveConfigSources(key, layers) {
   return sources;
 }
 
-// src/shared/configNodeFieldName.ts
-function configNodeFieldName(node) {
-  const last = node.path.at(-1);
-  return last?.kind === "key" ? last.name : void 0;
-}
-
 // src/shared/findConfigNode.ts
 function objectField(node, segment) {
   if (segment.kind !== "key") return void 0;
@@ -9915,14 +9995,16 @@ function readConfigEntries(cwd) {
   return describeConfigLeaves(assistConfigSchema).filter((leaf) => !KEYS_STRIPPED_FROM_MERGED_CONFIG.has(leaf.key)).map((leaf) => {
     const sources = resolveConfigSources(leaf.key, layers);
     const source = sources[0] ?? "default";
+    const node = configEntryNode(schema2, leaf.key);
     return {
       ...leaf,
-      value: getNestedValue(config, leaf.key),
+      ...leaf.defaultValue === void 0 ? {} : { defaultValue: redactConfigSecrets(leaf.defaultValue, node) },
+      value: redactConfigSecrets(getNestedValue(config, leaf.key), node),
       source,
       sources,
       ...layers.repoKey ? { repoKey: layers.repoKey } : {},
       globalOnly: isGlobalOnlyConfigKey(leaf.key),
-      node: configEntryNode(schema2, leaf.key)
+      node
     };
   });
 }
@@ -10809,6 +10891,38 @@ function coerceUnion(key, raw, types) {
   return { ok: false, error: `${key}: expected ${types.join(" or ")}` };
 }
 
+// src/shared/valueAtConfigPath.ts
+function valueAtConfigPath(value, path71) {
+  let current = value;
+  for (const key of path71) {
+    if (typeof key === "number") {
+      if (!Array.isArray(current)) return void 0;
+      current = current[key];
+      continue;
+    }
+    if (typeof current !== "object" || current === null) return void 0;
+    current = current[key];
+  }
+  return current;
+}
+
+// src/shared/restoreConfigSecrets.ts
+function restoreConfigSecrets(value, stored, node) {
+  return mapConfigSecrets(
+    value,
+    node,
+    (secret, path71) => isRedactedSecret(secret) ? valueAtConfigPath(stored, path71) : secret
+  );
+}
+
+// src/commands/config/restoreConfigWriteSecrets.ts
+function restoreConfigWriteSecrets(key, value, cwd) {
+  const node = configEntryNode(describeConfigNode(assistConfigSchema), key);
+  if (!node) return value;
+  const stored = loadConfigFrom(cwd);
+  return restoreConfigSecrets(value, getNestedValue(stored, key), node);
+}
+
 // src/commands/config/setNestedValue.ts
 function isPlainObject2(val) {
   return val !== null && typeof val === "object" && !Array.isArray(val);
@@ -11016,7 +11130,10 @@ async function handleConfigWrite(req, res, apply) {
 // src/commands/sessions/web/setConfig.ts
 function setConfig(req, res) {
   return handleConfigWrite(req, res, (request) => {
-    const coerced = coerceConfigValue(request.key, request.value);
+    const coerced = coerceConfigValue(
+      request.key,
+      restoreConfigWriteSecrets(request.key, request.value, request.cwd)
+    );
     if (!coerced.ok) return { ok: false, errors: [coerced.error] };
     return applyScopedConfigSet(
       request.key,
@@ -12811,18 +12928,18 @@ ${issues}`);
 }
 
 // src/commands/backlog/propose/proposedItemSchema.ts
-import { z as z5 } from "zod";
-var proposedPhaseSchema = z5.strictObject({
-  name: z5.string().trim().min(1, "phase name is required"),
-  tasks: z5.array(z5.string().trim().min(1)).min(1, "a phase needs at least one task"),
-  manualChecks: z5.array(z5.string().trim().min(1)).default([])
+import { z as z6 } from "zod";
+var proposedPhaseSchema = z6.strictObject({
+  name: z6.string().trim().min(1, "phase name is required"),
+  tasks: z6.array(z6.string().trim().min(1)).min(1, "a phase needs at least one task"),
+  manualChecks: z6.array(z6.string().trim().min(1)).default([])
 });
-var proposedItemSchema = z5.strictObject({
-  name: z5.string().trim().min(1, "name is required"),
-  type: z5.enum(["story", "bug"]),
-  description: z5.string().optional(),
-  acceptanceCriteria: z5.array(z5.string().trim().min(1)).default([]),
-  phases: z5.array(proposedPhaseSchema).default([])
+var proposedItemSchema = z6.strictObject({
+  name: z6.string().trim().min(1, "name is required"),
+  type: z6.enum(["story", "bug"]),
+  description: z6.string().optional(),
+  acceptanceCriteria: z6.array(z6.string().trim().min(1)).default([]),
+  phases: z6.array(proposedPhaseSchema).default([])
 });
 
 // src/commands/backlog/propose/readProposedItem.ts
@@ -14220,9 +14337,9 @@ async function update(id, options2) {
 import chalk115 from "chalk";
 
 // src/commands/backlog/updatePlan/planUpdateSchema.ts
-import { z as z6 } from "zod";
-var planUpdateSchema = z6.strictObject({
-  phases: z6.array(proposedPhaseSchema).min(1, "a plan needs at least one phase")
+import { z as z7 } from "zod";
+var planUpdateSchema = z7.strictObject({
+  phases: z7.array(proposedPhaseSchema).min(1, "a plan needs at least one phase")
 });
 
 // src/commands/backlog/updatePlan/readPlanUpdate.ts
@@ -15940,7 +16057,7 @@ function applyIgnoreGlobs(files, extraIgnore = []) {
   const ignore3 = [...complexity.ignore, ...extraIgnore];
   return files.filter((f) => !ignore3.some((glob) => minimatch5(f, glob)));
 }
-function walk(dir, results) {
+function walk2(dir, results) {
   if (!fs19.existsSync(dir)) {
     return;
   }
@@ -15950,7 +16067,7 @@ function walk(dir, results) {
     const fullPath = path26.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name !== "node_modules" && entry.name !== ".git") {
-        walk(fullPath, results);
+        walk2(fullPath, results);
       }
     } else if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
       results.push(fullPath);
@@ -15960,7 +16077,7 @@ function walk(dir, results) {
 function findSourceFiles2(pattern2, baseDir = ".", extraIgnore = []) {
   const results = [];
   if (pattern2.includes("*")) {
-    walk(baseDir, results);
+    walk2(baseDir, results);
     return applyIgnoreGlobs(
       results.filter((f) => minimatch5(f, pattern2)),
       extraIgnore
@@ -15970,10 +16087,10 @@ function findSourceFiles2(pattern2, baseDir = ".", extraIgnore = []) {
     return [pattern2];
   }
   if (fs19.existsSync(pattern2) && fs19.statSync(pattern2).isDirectory()) {
-    walk(pattern2, results);
+    walk2(pattern2, results);
     return applyIgnoreGlobs(results, extraIgnore);
   }
-  walk(baseDir, results);
+  walk2(baseDir, results);
   return applyIgnoreGlobs(
     results.filter((f) => minimatch5(f, pattern2)),
     extraIgnore
@@ -16554,19 +16671,34 @@ function registerComplexity(program2) {
 
 // src/commands/config/index.ts
 import { stringify as stringifyYaml2 } from "yaml";
+
+// src/shared/maskConfigSecrets.ts
+var SECRET_MASK = "<hidden>";
+function maskConfigSecrets(value, node) {
+  return mapConfigSecrets(value, node, () => SECRET_MASK);
+}
+
+// src/commands/config/index.ts
 function configList() {
-  const config = loadConfig();
+  const config = maskConfigSecrets(
+    loadConfig(),
+    describeConfigNode(assistConfigSchema)
+  );
   console.log(stringifyYaml2(config, { lineWidth: 0 }).trimEnd());
 }
 
 // src/commands/config/configGet.ts
 import chalk131 from "chalk";
-function configGet(key) {
-  console.log(
-    formatOutput(
-      requireNestedValue(loadConfig(), key)
-    )
+function configGet(key, options2 = {}) {
+  const value = requireNestedValue(
+    loadConfig(),
+    key
   );
+  console.log(formatOutput(options2.reveal ? value : maskSecretsAt(value, key)));
+}
+function maskSecretsAt(value, key) {
+  const node = configEntryNode(describeConfigNode(assistConfigSchema), key);
+  return maskConfigSecrets(value, node);
 }
 function formatOutput(value) {
   return typeof value === "object" && value !== null ? JSON.stringify(value, null, 2) : String(value);
@@ -16709,8 +16841,8 @@ function registerConfig(program2) {
     "-r, --repo [name]",
     "Requires -g: remove the key from a repo's identity block (defaults to the current repo)"
   ).action((key, options2) => configUnset(key, options2));
-  configCommand.command("get <key>").description("Get a config value").action(configGet);
-  configCommand.command("list").description("List all config values").action(configList);
+  configCommand.command("get <key>").description("Get a config value (secrets print as <hidden>)").option("--reveal", "Print the raw value of a secret, undecorated").action((key, options2) => configGet(key, options2));
+  configCommand.command("list").description("List all config values (secrets print as <hidden>)").action(configList);
 }
 
 // src/commands/db/reportMigrationStatus.ts
@@ -17577,13 +17709,13 @@ function buildTree(csprojPath, repoRoot, visited = /* @__PURE__ */ new Set()) {
 }
 function collectAllDeps(node) {
   const result = /* @__PURE__ */ new Set();
-  function walk2(n) {
+  function walk3(n) {
     for (const child of n.children) {
       result.add(child.path);
-      walk2(child);
+      walk3(child);
     }
   }
-  walk2(node);
+  walk3(node);
   return result;
 }
 
@@ -19228,30 +19360,30 @@ function stringOrUndefined(value) {
 }
 
 // src/commands/sessions/daemon/persistedSessionSchema.ts
-import { z as z7 } from "zod";
-var persistedSessionSchema = z7.object({
-  id: z7.string().optional(),
-  name: z7.string(),
-  title: z7.string().optional(),
-  generatedTitle: z7.string().optional(),
-  subtitle: z7.string().optional(),
-  commandType: z7.enum(["claude", "run", "assist"]),
-  harness: z7.enum(["claude", "codex", "pi"]).optional(),
-  status: z7.enum(["running", "waiting", "done", "error", "stopped"]).optional(),
-  cwd: z7.string(),
-  startedAt: z7.number(),
-  runningMs: z7.number().optional(),
-  claudeSessionId: z7.string().optional(),
-  initialPrompt: z7.string().optional(),
-  runName: z7.string().optional(),
-  runArgs: z7.array(z7.string()).optional(),
-  assistArgs: z7.array(z7.string()).optional(),
+import { z as z8 } from "zod";
+var persistedSessionSchema = z8.object({
+  id: z8.string().optional(),
+  name: z8.string(),
+  title: z8.string().optional(),
+  generatedTitle: z8.string().optional(),
+  subtitle: z8.string().optional(),
+  commandType: z8.enum(["claude", "run", "assist"]),
+  harness: z8.enum(["claude", "codex", "pi"]).optional(),
+  status: z8.enum(["running", "waiting", "done", "error", "stopped"]).optional(),
+  cwd: z8.string(),
+  startedAt: z8.number(),
+  runningMs: z8.number().optional(),
+  claudeSessionId: z8.string().optional(),
+  initialPrompt: z8.string().optional(),
+  runName: z8.string().optional(),
+  runArgs: z8.array(z8.string()).optional(),
+  assistArgs: z8.array(z8.string()).optional(),
   activity: activitySchema.optional(),
-  starred: z7.boolean().optional(),
-  autoRun: z7.boolean().optional(),
-  autoAdvance: z7.boolean().optional(),
-  reviewStarted: z7.boolean().optional(),
-  undurable: z7.object({ reason: z7.string(), removesTree: z7.boolean().optional() }).optional()
+  starred: z8.boolean().optional(),
+  autoRun: z8.boolean().optional(),
+  autoAdvance: z8.boolean().optional(),
+  reviewStarted: z8.boolean().optional(),
+  undurable: z8.object({ reason: z8.string(), removesTree: z8.boolean().optional() }).optional()
 });
 
 // src/commands/sessions/daemon/toPersistedSession.ts
@@ -28632,9 +28764,9 @@ function createAutoExit(exit, graceMs = DEFAULT_GRACE_MS) {
 }
 
 // src/commands/sessions/daemon/loadActiveSelection.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var ACTIVE_FILE = "active.json";
-var activeSelectionSchema = z8.record(z8.string(), z8.string());
+var activeSelectionSchema = z9.record(z9.string(), z9.string());
 function loadActiveSelection() {
   const parsed = activeSelectionSchema.safeParse(
     loadJson(ACTIVE_FILE)