@starterculture/devkeep-actions 0.4.1 → 0.5.1

package/dist/consolidate-release.js

@@ -127,6 +127,159 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const missing = ["PROJECT_NAME", "VAULT_REPO", "DEVKEEP_GITHUB_TOKEN"].filter((name) => !env[name]);
+  if (missing.length > 0) {
+    return { missing: [...missing] };
+  }
+  const [owner, repo] = env.VAULT_REPO.split("/");
+  if (!owner || !repo) {
+    return { missing: ["VAULT_REPO (expected owner/repo)"] };
+  }
+  return { params: { owner, repo, projectName: env.PROJECT_NAME, branch: VAULT_BRANCH } };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const resolved = healthParams(deps.env);
+  const params = "params" in resolved ? resolved.params : null;
+  if (!params) {
+    deps.logError(`Health not recorded for "${source}": ${resolved.missing.join(", ")} not set.`);
+  }
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -429,14 +582,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   consolidateRelease,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -459,10 +612,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Opened consolidation PR #${result.prNumber}: ${result.prUrl}`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("consolidateRelease", main);
 }
 export {
   main,

package/dist/crypting-candidates-scan.js

@@ -24,6 +24,159 @@ async function retryOnConflict(attempt, maxAttempts = 3) {
   }
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const missing = ["PROJECT_NAME", "VAULT_REPO", "DEVKEEP_GITHUB_TOKEN"].filter((name) => !env[name]);
+  if (missing.length > 0) {
+    return { missing: [...missing] };
+  }
+  const [owner, repo] = env.VAULT_REPO.split("/");
+  if (!owner || !repo) {
+    return { missing: ["VAULT_REPO (expected owner/repo)"] };
+  }
+  return { params: { owner, repo, projectName: env.PROJECT_NAME, branch: VAULT_BRANCH } };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const resolved = healthParams(deps.env);
+  const params = "params" in resolved ? resolved.params : null;
+  if (!params) {
+    deps.logError(`Health not recorded for "${source}": ${resolved.missing.join(", ")} not set.`);
+  }
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/diff.js
 function toDiffFile(file) {
   return {
@@ -70,8 +223,8 @@ var SECRET_PREFIX_PATTERNS = [
   // JWT-shaped
 ];
 var PEM_BLOCK_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var SECRET_ASSIGNMENT_PATTERN = new RegExp(`(?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*["']([^"'\`]+)["']`, "i");
+var SECRET_KEYWORD2 = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var SECRET_ASSIGNMENT_PATTERN = new RegExp(`(?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD2}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*["']([^"'\`]+)["']`, "i");
 
 // ../../modules/devcrypt/dist/candidateScan.js
 function addedLines(patch) {
@@ -332,13 +485,13 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   scanCryptingCandidates,
   createGithubClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
   const [vaultOwner, vaultRepo] = requireEnv(env, "VAULT_REPO").split("/");
@@ -360,10 +513,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Flagged ${result.candidatesFlagged} crypting candidate(s)`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("cryptingCandidatesScan", main);
 }
 export {
   main,

package/dist/draft-log-entry.js

@@ -127,6 +127,159 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const missing = ["PROJECT_NAME", "VAULT_REPO", "DEVKEEP_GITHUB_TOKEN"].filter((name) => !env[name]);
+  if (missing.length > 0) {
+    return { missing: [...missing] };
+  }
+  const [owner, repo] = env.VAULT_REPO.split("/");
+  if (!owner || !repo) {
+    return { missing: ["VAULT_REPO (expected owner/repo)"] };
+  }
+  return { params: { owner, repo, projectName: env.PROJECT_NAME, branch: VAULT_BRANCH } };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const resolved = healthParams(deps.env);
+  const params = "params" in resolved ? resolved.params : null;
+  if (!params) {
+    deps.logError(`Health not recorded for "${source}": ${resolved.missing.join(", ")} not set.`);
+  }
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -484,19 +637,6 @@ function routeDiffByModule(files, manifest) {
 }
 
 // ../../modules/devlore/dist/redact.js
-var REDACTED = "[REDACTED]";
-var KNOWN_SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /gh[pousr]_[A-Za-z0-9]{36,}/g,
-  /github_pat_[A-Za-z0-9_]{20,}/g,
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
-  /AKIA[0-9A-Z]{16}/g,
-  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-];
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
 var SENSITIVE_FILENAME_PATTERNS = [
   /(^|\/)\.env(\..+)?$/,
   /\.pem$/,
@@ -508,14 +648,6 @@ var SENSITIVE_FILENAME_PATTERNS = [
   /credentials\.json$/,
   /secrets?\.(json|ya?ml|toml)$/
 ];
-function redactText(text) {
-  let result = text;
-  for (const pattern of KNOWN_SECRET_PATTERNS) {
-    result = result.replace(pattern, REDACTED);
-  }
-  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
-  return result;
-}
 function isSensitiveFilename(filename) {
   return SENSITIVE_FILENAME_PATTERNS.some((pattern) => pattern.test(filename));
 }
@@ -533,7 +665,7 @@ function redactProjectDiff(diff) {
 }
 
 // ../../modules/devlore/dist/actions/draftLogEntry.js
-var VAULT_BRANCH = "main";
+var VAULT_BRANCH2 = "main";
 var MODEL_TIER = "balanced";
 var MAX_TOKENS = 2048;
 function logEntryPath(projectName, commitSha, moduleId) {
@@ -567,7 +699,7 @@ async function syncProductDoc(projectOctokit, vaultOctokit, { projectOwner, proj
       path: productDocPath(projectName, moduleId),
       message: `Sync PRODUCT.md: ${projectName}@${headSha.slice(0, 7)}`,
       content: Buffer.from(redactedDoc, "utf-8").toString("base64"),
-      branch: VAULT_BRANCH,
+      branch: VAULT_BRANCH2,
       sha: existing.sha
     });
   });
@@ -600,7 +732,7 @@ ${entryBody}
     path: entryPath,
     message: `Draft log entry: ${projectName}@${shortSha}${moduleName ? ` (${moduleName})` : ""}`,
     content: Buffer.from(entryContent, "utf-8").toString("base64"),
-    branch: VAULT_BRANCH
+    branch: VAULT_BRANCH2
   }));
   let decisionPath = null;
   if (decisionEntry) {
@@ -615,7 +747,7 @@ ${decisionEntry}
       path: decisionPath,
       message: `Draft decision entry: ${projectName}@${shortSha}${moduleName ? ` (${moduleName})` : ""}`,
       content: Buffer.from(decisionContent, "utf-8").toString("base64"),
-      branch: VAULT_BRANCH
+      branch: VAULT_BRANCH2
     }));
   }
   return { moduleId, logEntryPath: entryPath, decisionEntryPath: decisionPath, usage };
@@ -668,7 +800,7 @@ async function draftLogEntry({ projectOctokit, vaultOctokit, claude, projectOwne
     });
   }
   const totalUsage = results.reduce((total, r) => addTokenUsage(total, r.usage), ZERO_USAGE);
-  await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH }, "draftLogEntry", totalUsage);
+  await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH2 }, "draftLogEntry", totalUsage);
   return results;
 }
 
@@ -680,14 +812,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   draftLogEntry,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -717,10 +849,7 @@ async function main(deps = defaultDeps) {
   }
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("draftLogEntry", main);
 }
 export {
   main,

package/dist/draft-release-notes.js

@@ -127,6 +127,159 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const missing = ["PROJECT_NAME", "VAULT_REPO", "DEVKEEP_GITHUB_TOKEN"].filter((name) => !env[name]);
+  if (missing.length > 0) {
+    return { missing: [...missing] };
+  }
+  const [owner, repo] = env.VAULT_REPO.split("/");
+  if (!owner || !repo) {
+    return { missing: ["VAULT_REPO (expected owner/repo)"] };
+  }
+  return { params: { owner, repo, projectName: env.PROJECT_NAME, branch: VAULT_BRANCH } };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const resolved = healthParams(deps.env);
+  const params = "params" in resolved ? resolved.params : null;
+  if (!params) {
+    deps.logError(`Health not recorded for "${source}": ${resolved.missing.join(", ")} not set.`);
+  }
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/prompt.js
 function buildReleaseNotesPrompt(input) {
   return [
@@ -150,29 +303,6 @@ function buildReleaseNotesPrompt(input) {
   ].join("\n");
 }
 
-// ../../modules/devlore/dist/redact.js
-var REDACTED = "[REDACTED]";
-var KNOWN_SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /gh[pousr]_[A-Za-z0-9]{36,}/g,
-  /github_pat_[A-Za-z0-9_]{20,}/g,
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
-  /AKIA[0-9A-Z]{16}/g,
-  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-];
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
-function redactText(text) {
-  let result = text;
-  for (const pattern of KNOWN_SECRET_PATTERNS) {
-    result = result.replace(pattern, REDACTED);
-  }
-  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
-  return result;
-}
-
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -354,7 +484,7 @@ function releaseNotesDir(projectName) {
 var MODEL_TIER = "balanced";
 var MAX_TOKENS = 2e4;
 var MAX_CONTINUATIONS = 8;
-var VAULT_BRANCH = "main";
+var VAULT_BRANCH2 = "main";
 async function draftReleaseNotes({ projectOctokit, vaultOctokit, claude, projectOwner, projectRepoName, vaultOwner, vaultRepoName, projectName, tag }) {
   const { logEntries, previousTag } = await selectLogEntriesSincePreviousRelease({
     vaultOctokit,
@@ -386,11 +516,11 @@ ${text.trim()}
     path,
     message: `Draft release notes: ${projectName} ${tag}`,
     content: Buffer.from(content, "utf-8").toString("base64"),
-    branch: VAULT_BRANCH,
+    branch: VAULT_BRANCH2,
     sha: await getExistingSha(vaultOctokit, vaultOwner, vaultRepoName, path)
   });
   if (usage.inputTokens > 0 || usage.outputTokens > 0) {
-    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH }, "releaseNotes", usage);
+    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH2 }, "releaseNotes", usage);
   }
   return { path, previousTag, entryCount: logEntries.length, content, usage };
 }
@@ -411,14 +541,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   draftReleaseNotes,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -440,10 +570,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Drafted release notes: ${result.path} (previous tag: ${result.previousTag ?? "none"}, ${result.entryCount} entries)`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("releaseNotes", main);
 }
 export {
   main,

package/dist/sync-onboarding.js

@@ -127,6 +127,159 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const missing = ["PROJECT_NAME", "VAULT_REPO", "DEVKEEP_GITHUB_TOKEN"].filter((name) => !env[name]);
+  if (missing.length > 0) {
+    return { missing: [...missing] };
+  }
+  const [owner, repo] = env.VAULT_REPO.split("/");
+  if (!owner || !repo) {
+    return { missing: ["VAULT_REPO (expected owner/repo)"] };
+  }
+  return { params: { owner, repo, projectName: env.PROJECT_NAME, branch: VAULT_BRANCH } };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const resolved = healthParams(deps.env);
+  const params = "params" in resolved ? resolved.params : null;
+  if (!params) {
+    deps.logError(`Health not recorded for "${source}": ${resolved.missing.join(", ")} not set.`);
+  }
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/decisionEntries.js
 function decisionEntriesDir(projectName) {
   return `projects/${projectName}/decisions`;
@@ -186,29 +339,6 @@ ${input.decisions.join("\n\n")}` : "",
   ].filter((line) => line !== "").join("\n");
 }
 
-// ../../modules/devlore/dist/redact.js
-var REDACTED = "[REDACTED]";
-var KNOWN_SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /gh[pousr]_[A-Za-z0-9]{36,}/g,
-  /github_pat_[A-Za-z0-9_]{20,}/g,
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
-  /AKIA[0-9A-Z]{16}/g,
-  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-];
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
-function redactText(text) {
-  let result = text;
-  for (const pattern of KNOWN_SECRET_PATTERNS) {
-    result = result.replace(pattern, REDACTED);
-  }
-  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
-  return result;
-}
-
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -358,7 +488,7 @@ function isNotFound4(error) {
 var MODEL_TIER = "balanced";
 var MAX_TOKENS = 2e4;
 var MAX_CONTINUATIONS = 8;
-var VAULT_BRANCH = "main";
+var VAULT_BRANCH2 = "main";
 async function readVaultFile(octokit, owner, repo, path) {
   const { data } = await octokit.rest.repos.getContent({ owner, repo, path }).catch(() => ({ data: null }));
   return data && !Array.isArray(data) && data.type === "file" ? Buffer.from(data.content, "base64").toString("utf-8") : "";
@@ -403,12 +533,12 @@ ${text.trim()}
       path: vaultPath,
       message: `Mirror onboarding guide: ${projectName}`,
       content: Buffer.from(mirrored, "utf-8").toString("base64"),
-      branch: VAULT_BRANCH,
+      branch: VAULT_BRANCH2,
       sha: existingVault.sha
     });
   }
   if (usage.inputTokens > 0 || usage.outputTokens > 0) {
-    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH }, "syncOnboarding", usage);
+    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH2 }, "syncOnboarding", usage);
   }
   return { path: ONBOARDING_PATH, vaultPath, content, usage };
 }
@@ -421,14 +551,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   syncOnboarding,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -448,10 +578,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Synced onboarding guide: ${result.path} (mirrored to ${result.vaultPath})`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("syncOnboarding", main);
 }
 export {
   main,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starterculture/devkeep-actions",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "Devkeep's GitHub Actions entrypoints, bundled for CI runners.",
   "license": "UNLICENSED",
   "type": "module",