@swestash/agent-lens 0.7.0 → 0.8.0

package/dist/agent-lens.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname6, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -947,6 +947,245 @@ var SECURITY_CATEGORIES = [
   }
 ];
 
+// ../core/dist/secrets.js
+var LEAK_PATTERNS = [
+  { name: "email", re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
+  { name: "home-path-with-user", re: /\/(?:home|Users)\/(?!user\b)[A-Za-z0-9._-]+/ },
+  { name: "ipv4", re: /\b\d{1,3}(?:\.\d{1,3}){3}\b/ },
+  { name: "url", re: /https?:\/\/[^\s"']+/ },
+  { name: "aws-key", re: /AKIA[0-9A-Z]{16}/ },
+  { name: "bearer/token", re: /\b(?:sk|pk|ghp|gho|xox[abp])[-_][A-Za-z0-9]{8,}/ }
+];
+var SECRET_PATTERNS = [
+  { re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g, label: "PRIVATE-KEY" },
+  { re: /\bAKIA[0-9A-Z]{16}\b/g, label: "AWS-KEY" },
+  { re: /\bASIA[0-9A-Z]{16}\b/g, label: "AWS-KEY" },
+  { re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, label: "GITHUB-TOKEN" },
+  { re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g, label: "GITHUB-TOKEN" },
+  { re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, label: "SLACK-TOKEN" },
+  { re: /\bxapp-[0-9A-Za-z-]{10,}/g, label: "SLACK-TOKEN" },
+  { re: /\bnpm_[A-Za-z0-9]{30,}/g, label: "NPM-TOKEN" },
+  { re: /\bAIza[0-9A-Za-z_-]{35}\b/g, label: "GOOGLE-API-KEY" },
+  { re: /\b[rsp]k_(?:live|test)_[A-Za-z0-9]{10,}\b/g, label: "STRIPE-KEY" },
+  { re: /\bsk-(?:proj|ant|or|svcacct)-[A-Za-z0-9_-]{20,}/g, label: "API-KEY" },
+  { re: /\bsk-[A-Za-z0-9]{20,}\b/g, label: "API-KEY" },
+  { re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{6,}/g, label: "JWT" }
+];
+function maskUrlCredentials(text) {
+  return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/\s:@"'`]+:[^/\s@"'`]+@/gi, "$1[REDACTED-AUTH]@").replace(/([?&](?:access_?token|api[_-]?key|apikey|token|secret|password|pwd|client[_-]?secret|auth|signature|sig)=)[^&\s"'`<>]+/gi, "$1[REDACTED]");
+}
+var ENV_ASSIGN = /\b([A-Za-z][A-Za-z0-9_]*_(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PWD|PW|CREDENTIALS?)|PASSWORD|PASSWD|SECRET|TOKEN)=(["']?)(?!\$)[^\s"'`&;|<>()]+/gi;
+function maskEnvAssignments(text) {
+  return text.replace(ENV_ASSIGN, (_m, name, q) => `${name}=${q}[REDACTED]`);
+}
+var PII_PATTERNS = [
+  { re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, label: "EMAIL" },
+  { re: /\b\d{1,3}(?:\.\d{1,3}){3}\b/g, label: "IP" }
+];
+var HOME_USER = /\/(home|Users)\/[^/\s"'`]+/g;
+var ENCODED_HOME_USER = /(?<![A-Za-z0-9])(-(?:home|Users)-)[A-Za-z0-9._]+(?=-)/g;
+var WINDOWS_USER = /([A-Za-z]:\\Users\\)[^\\/\s"'`]+/gi;
+function maskSecrets(text) {
+  let out = maskUrlCredentials(text);
+  out = maskEnvAssignments(out);
+  for (const { re, label } of SECRET_PATTERNS)
+    out = out.replace(re, `[${label}]`);
+  for (const { re, label } of PII_PATTERNS)
+    out = out.replace(re, `[${label}]`);
+  out = out.replace(HOME_USER, (_m, root) => `/${root}/user`);
+  out = out.replace(ENCODED_HOME_USER, (_m, root) => `${root}user`);
+  out = out.replace(WINDOWS_USER, (_m, root) => `${root}user`);
+  return out;
+}
+var SHARE_LEAK = [
+  ...SECRET_PATTERNS.map(({ re, label }) => ({ name: label, re: new RegExp(re.source) })),
+  { name: "email", re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
+  { name: "home-path-with-user", re: /\/(?:home|Users)\/(?!user\b)[A-Za-z0-9._-]+/ },
+  { name: "encoded-home-with-user", re: /(?<![A-Za-z0-9])-(?:home|Users)-(?!user-)[A-Za-z0-9._]+-/ },
+  { name: "url-credentials", re: /:\/\/[^/\s:@"'`]+:[^/\s@"'`]+@/ }
+];
+var USER_STOPLIST = /* @__PURE__ */ new Set([
+  "user",
+  "users",
+  "home",
+  "root",
+  "admin",
+  "ubuntu",
+  "runner",
+  "node",
+  "app",
+  "apps",
+  "data",
+  "tmp",
+  "shared",
+  "public",
+  "guest",
+  "vagrant",
+  "ec2-user",
+  "docker"
+]);
+var HOME_OWNER = /(?:\/(?:home|Users)\/|-(?:home|Users)-|[A-Za-z]:\\Users\\)([A-Za-z0-9._]{3,})/g;
+function deriveHomeUsers(texts) {
+  const found = /* @__PURE__ */ new Set();
+  for (const t of texts) {
+    if (!t)
+      continue;
+    const re = new RegExp(HOME_OWNER.source, "g");
+    let m;
+    while (m = re.exec(t)) {
+      const u = m[1];
+      if (u.length >= 3 && !USER_STOPLIST.has(u.toLowerCase()))
+        found.add(u);
+    }
+  }
+  return [...found];
+}
+function scrubUsernames(text, users) {
+  let out = text;
+  for (const u of users) {
+    const esc = u.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+    out = out.replace(new RegExp(`(?<![A-Za-z0-9])${esc}(?![A-Za-z0-9])`, "g"), "[USER]");
+  }
+  return out;
+}
+
+// ../core/dist/redact-export.js
+import { createHash } from "crypto";
+
+// ../core/dist/markdown.js
+function fence(s) {
+  return s.length > 2e3 ? s.slice(0, 2e3) + "\n\u2026 (truncated)" : s;
+}
+function sessionToMarkdown(s, events) {
+  const out = [];
+  out.push(`# ${s.title || "Session " + s.id.slice(0, 8)}`);
+  out.push("");
+  const meta = [
+    ["Session", s.id],
+    ["Source", s.source],
+    ["Project", s.project],
+    ["Model", s.model],
+    ["Started", s.started_at],
+    ["Ended", s.ended_at]
+  ].filter(([, v]) => v);
+  for (const [k, v] of meta)
+    out.push(`- **${k}:** ${v}`);
+  out.push("");
+  out.push("---");
+  out.push("");
+  for (const e of events) {
+    const who = e.role || e.type;
+    const ts = e.timestamp ? ` _(${e.timestamp})_` : "";
+    if (e.thinking) {
+      out.push(`### \u{1F9E0} thinking${ts}`);
+      out.push("");
+      out.push(fence(e.thinking));
+      out.push("");
+    }
+    if (e.text) {
+      const icon = who === "user" ? "\u{1F464}" : who === "assistant" ? "\u{1F916}" : "\u2699\uFE0F";
+      out.push(`### ${icon} ${who}${ts}`);
+      out.push("");
+      out.push(fence(e.text));
+      out.push("");
+    }
+    for (const tc of e.toolCalls) {
+      const label = tc.skill_name ? `Skill: ${tc.skill_name}` : tc.agent_type ? `${tc.tool_name} \u2192 ${tc.agent_type}` : tc.tool_name;
+      const status = tc.status ? ` _(${tc.status})_` : "";
+      out.push(`> \u{1F527} **${label}**${status}`);
+      if (tc.input_json && tc.input_json !== "{}") {
+        out.push("```json");
+        out.push(fence(tc.input_json));
+        out.push("```");
+      }
+      out.push("");
+    }
+  }
+  return out.join("\n");
+}
+
+// ../core/dist/redact-export.js
+function hash(s) {
+  return createHash("sha256").update(s).digest("hex").slice(0, 4);
+}
+function structurePath(p) {
+  if (!p)
+    return p;
+  const abs = p.startsWith("/");
+  const segs = p.split("/").filter(Boolean);
+  const out = segs.map((seg, i) => {
+    if (segs[i - 1] === "home" || segs[i - 1] === "Users")
+      return "user";
+    if (seg === "home" || seg === "Users")
+      return seg;
+    const last = i === segs.length - 1;
+    const dot = last ? seg.lastIndexOf(".") : -1;
+    return dot > 0 ? `file-${hash(seg)}${seg.slice(dot)}` : `dir-${hash(seg)}`;
+  });
+  return (abs ? "/" : "") + out.join("/");
+}
+function scrub(s) {
+  return s && s.length > 0 ? "[redacted]" : s;
+}
+function redactSession(session, events, level) {
+  const users = deriveHomeUsers([
+    session.title,
+    session.project,
+    session.source,
+    ...events.flatMap((e) => [e.text, e.thinking, ...e.toolCalls.map((t) => t.input_json)])
+  ]);
+  const unuser = (s) => s == null ? s : scrubUsernames(s, users);
+  if (level === "structure") {
+    return {
+      session: { ...session, title: session.title ? "Redacted session" : session.title, project: structurePath(session.project), source: unuser(session.source) },
+      events: events.map((e) => ({
+        ...e,
+        text: scrub(e.text),
+        thinking: scrub(e.thinking),
+        toolCalls: e.toolCalls.map((t) => ({ ...t, input_json: t.input_json ? "{}" : t.input_json }))
+      }))
+    };
+  }
+  const mask = (s) => s == null ? s : scrubUsernames(maskSecrets(s), users);
+  return {
+    session: { ...session, title: mask(session.title), project: mask(session.project), source: mask(session.source) },
+    events: events.map((e) => ({
+      ...e,
+      text: mask(e.text),
+      thinking: mask(e.thinking),
+      toolCalls: e.toolCalls.map((t) => ({ ...t, input_json: mask(t.input_json) }))
+    }))
+  };
+}
+function sweep(md, patterns) {
+  let out = md;
+  let caught = false;
+  for (const { re } of patterns) {
+    const g = new RegExp(re.source, re.flags.includes("g") ? re.flags : re.flags + "g");
+    if (g.test(out)) {
+      caught = true;
+      out = out.replace(g, "[REDACTED]");
+    }
+  }
+  return { md: out, caught };
+}
+function disclaimer(level) {
+  return `> \u{1F512} **Redacted export** (level: ${level}) \u2014 best-effort automatic masking of secrets, tokens, emails, IPs, and usernames. Not a guarantee; review before sharing. Generated locally by Agent Lens \u2014 never uploaded.`;
+}
+function exportMarkdown(session, events, opts = {}) {
+  const level = opts.level ?? "secrets";
+  if (level === "off") {
+    return { markdown: sessionToMarkdown(session, events), residualLeak: false, level: "off" };
+  }
+  const redacted = redactSession(session, events, level);
+  const rendered = sessionToMarkdown(redacted.session, redacted.events);
+  const scanSet = level === "structure" ? LEAK_PATTERNS : SHARE_LEAK;
+  const { md, caught } = sweep(rendered, scanSet);
+  return { markdown: `${disclaimer(level)}
+
+${md}`, residualLeak: caught, level };
+}
+
 // ../core/dist/errors.js
 var ERROR_CLASSIFIER_VERSION = 1;
 var REJECTION_TYPES = /* @__PURE__ */ new Set(["user-rejected", "guardrail-blocked"]);
@@ -1010,58 +1249,6 @@ function costForUsage(model, u) {
   return (u.input_tokens * r.input + u.output_tokens * r.output + u.cache_creation_input_tokens * r.cacheWrite + u.cache_read_input_tokens * r.cacheRead) / M;
 }
 
-// ../core/dist/markdown.js
-function fence(s) {
-  return s.length > 2e3 ? s.slice(0, 2e3) + "\n\u2026 (truncated)" : s;
-}
-function sessionToMarkdown(s, events) {
-  const out = [];
-  out.push(`# ${s.title || "Session " + s.id.slice(0, 8)}`);
-  out.push("");
-  const meta = [
-    ["Session", s.id],
-    ["Source", s.source],
-    ["Project", s.project],
-    ["Model", s.model],
-    ["Started", s.started_at],
-    ["Ended", s.ended_at]
-  ].filter(([, v]) => v);
-  for (const [k, v] of meta)
-    out.push(`- **${k}:** ${v}`);
-  out.push("");
-  out.push("---");
-  out.push("");
-  for (const e of events) {
-    const who = e.role || e.type;
-    const ts = e.timestamp ? ` _(${e.timestamp})_` : "";
-    if (e.thinking) {
-      out.push(`### \u{1F9E0} thinking${ts}`);
-      out.push("");
-      out.push(fence(e.thinking));
-      out.push("");
-    }
-    if (e.text) {
-      const icon = who === "user" ? "\u{1F464}" : who === "assistant" ? "\u{1F916}" : "\u2699\uFE0F";
-      out.push(`### ${icon} ${who}${ts}`);
-      out.push("");
-      out.push(fence(e.text));
-      out.push("");
-    }
-    for (const tc of e.toolCalls) {
-      const label = tc.skill_name ? `Skill: ${tc.skill_name}` : tc.agent_type ? `${tc.tool_name} \u2192 ${tc.agent_type}` : tc.tool_name;
-      const status = tc.status ? ` _(${tc.status})_` : "";
-      out.push(`> \u{1F527} **${label}**${status}`);
-      if (tc.input_json && tc.input_json !== "{}") {
-        out.push("```json");
-        out.push(fence(tc.input_json));
-        out.push("```");
-      }
-      out.push("");
-    }
-  }
-  return out.join("\n");
-}
-
 // ../core/dist/rawjson.js
 import { gzipSync, gunzipSync } from "zlib";
 function packRaw(json) {
@@ -1550,8 +1737,11 @@ After=network.target
 Type=simple
 # Absolute node + CLI paths: systemd user services don't inherit the interactive PATH.
 ExecStart=${node} ${cli2} serve
-${envLines}# Long-running: restart if it crashes.
-Restart=on-failure
+${envLines}# Long-running: always come back, including after a bare SIGTERM. systemd counts SIGTERM as a
+# clean exit, so Restart=on-failure would leave the server dead after a stray "pkill -f ... serve"
+# aimed at an ad-hoc test server \u2014 the unit's ExecStart matches that pattern too. Matches the
+# launchd KeepAlive=true behaviour. An explicit "systemctl --user stop" still stops it for good.
+Restart=always
 RestartSec=5
 Nice=10
 
@@ -1913,13 +2103,13 @@ function asString(v) {
 function asInt(v) {
   return typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : 0;
 }
-function parentSessionFromPath(path) {
-  const parts = path.split("/");
+function parentSessionFromPath(path2) {
+  const parts = path2.split("/");
   const i = parts.indexOf("subagents");
   return i > 0 ? parts[i - 1] : null;
 }
-function workflowRunFromPath(path) {
-  const parts = path.split("/");
+function workflowRunFromPath(path2) {
+  const parts = path2.split("/");
   const i = parts.indexOf("workflows");
   return i >= 0 && i + 1 < parts.length ? parts[i + 1] : null;
 }
@@ -1947,18 +2137,18 @@ var ClaudeCodeAdapter = class {
     const addFrom = (projectsDir, isVersion) => {
       const found = [];
       recurseJsonl(projectsDir, found);
-      for (const path of found) {
-        const parts = path.split("/");
-        const sessionId = basename2(path, ".jsonl");
+      for (const path2 of found) {
+        const parts = path2.split("/");
+        const sessionId = basename2(path2, ".jsonl");
         const encodedDir = parts[parts.length - 2] ?? "";
         files.push({
-          path,
+          path: path2,
           sessionId,
           encodedDir,
           isVersion,
           sourceId,
-          parentSessionId: parentSessionFromPath(path),
-          workflowRunId: workflowRunFromPath(path)
+          parentSessionId: parentSessionFromPath(path2),
+          workflowRunId: workflowRunFromPath(path2)
         });
       }
     };
@@ -2354,14 +2544,15 @@ function classify(db, dirty) {
 }
 
 // ../ingest/dist/detect.js
-import { createHash } from "crypto";
-var DETECTOR_VERSION = 7;
+import { createHash as createHash2 } from "crypto";
+import { posix as path } from "path";
+var DETECTOR_VERSION = 8;
 function evidence(s, max = 200) {
   const one = s.replace(/\s+/g, " ").trim();
   return one.length > max ? one.slice(0, max - 1) + "\u2026" : one;
 }
 function findingId(toolCallId, ruleId) {
-  return createHash("sha1").update(toolCallId).update("\0").update(ruleId).digest("hex").slice(0, 16);
+  return createHash2("sha1").update(toolCallId).update("\0").update(ruleId).digest("hex").slice(0, 16);
 }
 var SYSTEM_PATH = /(^|\s)(\/etc\/|\/usr\/|\/bin\/|\/sbin\/|\/boot\/|\/var\/|\/root\/|~\/\.ssh\/|~\/\.aws\/)/;
 var HOME_OR_ROOT_TARGET = /(\s|^)(~\/?|\/|\/\*|\$HOME\/?|\*)(\s|$)/;
@@ -2395,8 +2586,8 @@ function execGeneratedScript(cmd) {
     const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const interp = new RegExp(`\\b(?:sh|bash|zsh|ksh|dash|source)\\s+["']?${e}\\b|(?:^|[\\n;|&(])\\s*\\.\\s+["']?${e}\\b`);
     const hasPath = /^(\.\/|\/|~\/)/.test(t);
-    const path = hasPath ? new RegExp(`(?:^|[\\n;|&(])\\s*${e}(?:\\s|$|[;&|<>])`) : new RegExp(`(?:^|[\\n;|&(])\\s*\\.\\/${e}\\b`);
-    if (interp.test(cmd) || path.test(cmd))
+    const path2 = hasPath ? new RegExp(`(?:^|[\\n;|&(])\\s*${e}(?:\\s|$|[;&|<>])`) : new RegExp(`(?:^|[\\n;|&(])\\s*\\.\\/${e}\\b`);
+    if (interp.test(cmd) || path2.test(cmd))
       return t;
   }
   return null;
@@ -2410,14 +2601,21 @@ function isAgentOwnedPath(p, configDirs) {
   const tmp = process.env.TMPDIR;
   return !!tmp && p.startsWith(tmp.replace(/\/$/, "") + "/");
 }
-function outsideProject(filePath, projectPath, configDirs) {
-  if (!filePath || !filePath.startsWith("/"))
-    return false;
-  if (isAgentOwnedPath(filePath, configDirs))
-    return false;
+function outsideProjectPath(filePath, projectPath, configDirs) {
+  if (!filePath)
+    return null;
+  let abs = filePath;
+  if (!filePath.startsWith("/")) {
+    if (!projectPath || !filePath.includes("../"))
+      return null;
+    abs = path.normalize(projectPath.replace(/\/$/, "") + "/" + filePath);
+  }
+  if (isAgentOwnedPath(abs, configDirs))
+    return null;
   if (!projectPath)
-    return false;
-  return filePath !== projectPath && !filePath.startsWith(projectPath.replace(/\/$/, "") + "/");
+    return null;
+  const root = projectPath.replace(/\/$/, "");
+  return abs !== root && !abs.startsWith(root + "/") ? abs : null;
 }
 var SCOPE_RANK = { unknown: 0, loopback: 1, internal: 2, external: 3 };
 function netTargetScope(rawCommand) {
@@ -2697,6 +2895,34 @@ var RULES = [
       return { evidence: evidence(ctx.command) };
     }
   },
+  {
+    id: "obfuscated.decode_exec",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Decodes and executes obfuscated content (base64 -d | sh)",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c)
+        return null;
+      const decoder = /\b(base64\s+(?:-d|-D|--decode)|xxd\s+-r|openssl\s+(?:base64\s+-d|enc\b[^|]*\s-d\b)|uudecode)\b/i.exec(c);
+      if (!decoder)
+        return null;
+      const downstream = c.slice(decoder.index + decoder[0].length);
+      const piped = /\|\s*(?:sudo\s+)?(sh|bash|zsh|dash|ksh|python\d?|node|perl|ruby)\b([^|;&\n]*)/i.exec(downstream);
+      if (!piped)
+        return null;
+      const interp = piped[1].toLowerCase();
+      const args = piped[2] || "";
+      if (/^(?:node|python|perl|ruby)/.test(interp) && /(?:^|\s)-(?:e|c|m|p)\b|(?:^|\s)--(?:eval|command|module|print)\b/.test(args))
+        return null;
+      const sudo = /\|\s*sudo\b/i.test(downstream);
+      const d = decoder[0].toLowerCase();
+      const decoderName = d.startsWith("base64") ? "base64" : d.startsWith("xxd") ? "xxd" : d.startsWith("openssl") ? "openssl" : "uudecode";
+      return { evidence: evidence(ctx.command), severity: sudo ? "critical" : "high", mods: { decoder: decoderName, interpreter: interp } };
+    }
+  },
   {
     id: "privilege.sudo",
     category: "privilege-bypass",
@@ -2770,10 +2996,16 @@ var RULES = [
     // writing to /tmp, scratch dirs, adjacent repos is routine; only a system path (below) is high
     test(ctx) {
       const f = ctx.filePath;
-      if (!outsideProject(f, ctx.projectPath, ctx.ownedConfigDirs))
+      const abs = outsideProjectPath(f, ctx.projectPath, ctx.ownedConfigDirs);
+      if (!abs)
         return null;
-      const system = !!f && SYSTEM_PATH.test(f);
-      return { evidence: evidence(f), severity: system ? "high" : "low", mods: { project: ctx.projectPath, system_path: system } };
+      const system = SYSTEM_PATH.test(abs);
+      const traversal = !!f && !f.startsWith("/") && f.includes("../");
+      return {
+        evidence: evidence(f),
+        severity: system ? "high" : "low",
+        mods: { project: ctx.projectPath, system_path: system, ...traversal ? { traversal: true } : {} }
+      };
     }
   }
 ];
@@ -2896,7 +3128,7 @@ function classifyErrors(db, dirty) {
 }
 
 // ../ingest/dist/pipeline.js
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function newStats() {
   return { files: 0, skipped: 0, malformed: 0, newEvents: 0 };
 }
@@ -2934,7 +3166,7 @@ function skillSummary(body) {
   return null;
 }
 function skillVersionId(name, body) {
-  return createHash2("sha1").update(name).update("\0").update(body).digest("hex").slice(0, 16);
+  return createHash3("sha1").update(name).update("\0").update(body).digest("hex").slice(0, 16);
 }
 function pruneExcluded(db, excludedPaths) {
   if (!excludedPaths.length)
@@ -3316,7 +3548,7 @@ function ingestFile(db, stmts, adapter, file, lines, meta, now2, stats) {
     }
     let projectId = null;
     if (sessionMeta.cwd) {
-      projectId = createHash2("sha1").update(`${adapter.agentId}\0${sessionMeta.cwd}`).digest("hex").slice(0, 16);
+      projectId = createHash3("sha1").update(`${adapter.agentId}\0${sessionMeta.cwd}`).digest("hex").slice(0, 16);
       stmts.upsertProject.run({
         id: projectId,
         agent_id: adapter.agentId,
@@ -3355,7 +3587,7 @@ import { readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as
 import { basename as basename3, join as join5 } from "path";
 
 // ../ingest/dist/redact.js
-import { createHash as createHash3, randomBytes } from "crypto";
+import { createHash as createHash4, randomBytes } from "crypto";
 function parseExcludes(csv) {
   return (csv ?? "").split(",").map((s) => s.trim()).filter(Boolean).map(encodeProjectPath);
 }
@@ -3364,17 +3596,17 @@ function isExcludedArchivePath(filePath, excluded) {
 }
 
 // ../ingest/dist/fileread.js
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
 import { StringDecoder } from "string_decoder";
 var STREAM_THRESHOLD = 8 * 1024 * 1024;
 var CHUNK2 = 64 * 1024;
 function sha256(buf) {
-  return createHash4("sha256").update(buf).digest("hex");
+  return createHash5("sha256").update(buf).digest("hex");
 }
-function sha256File(path) {
-  const fd = openSync2(path, "r");
-  const h = createHash4("sha256");
+function sha256File(path2) {
+  const fd = openSync2(path2, "r");
+  const h = createHash5("sha256");
   const buf = Buffer.allocUnsafe(CHUNK2);
   try {
     let n;
@@ -3385,8 +3617,8 @@ function sha256File(path) {
   }
   return h.digest("hex");
 }
-function* streamLines(path) {
-  const fd = openSync2(path, "r");
+function* streamLines(path2) {
+  const fd = openSync2(path2, "r");
   const decoder = new StringDecoder("utf8");
   const buf = Buffer.allocUnsafe(CHUNK2);
   let leftover = "";
@@ -3438,8 +3670,8 @@ function discoverSidecars(sourceArchiveDir) {
   }
   return out;
 }
-function sessionFromPath(path) {
-  const parts = path.split("/");
+function sessionFromPath(path2) {
+  const parts = path2.split("/");
   const i = parts.indexOf("workflows");
   return i > 0 ? parts[i - 1] : null;
 }
@@ -3486,25 +3718,25 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
        total_tokens=excluded.total_tokens, total_tool_calls=excluded.total_tool_calls,
        duration_ms=excluded.duration_ms, started_at=excluded.started_at, ended_at=excluded.ended_at,
        ingested_at=excluded.ingested_at`);
-  for (const path of paths) {
+  for (const path2 of paths) {
     stats.files++;
-    const st = statSync2(path);
+    const st = statSync2(path2);
     const mtimeMs = Math.trunc(st.mtimeMs);
-    const prev = full ? void 0 : getState.get(path);
+    const prev = full ? void 0 : getState.get(path2);
     if (prev && prev.size === st.size && prev.mtime_ms === mtimeMs) {
       stats.skipped++;
       continue;
     }
     let buf;
     try {
-      buf = readFileSync4(path);
+      buf = readFileSync4(path2);
     } catch {
       stats.malformed++;
       continue;
     }
-    const hash = sha256(buf);
-    if (prev && prev.sha256 === hash) {
-      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
+    const hash2 = sha256(buf);
+    if (prev && prev.sha256 === hash2) {
+      setState.run({ file_path: path2, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
       stats.skipped++;
       continue;
     }
@@ -3519,14 +3751,14 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
       stats.malformed++;
       continue;
     }
-    const runId = strOrNull(d.runId) ?? basename3(path, ".json");
+    const runId = strOrNull(d.runId) ?? basename3(path2, ".json");
     const startedAt = toIso(d.startTime) ?? toIso(d.timestamp);
     const durationMs2 = intOrNull(d.durationMs);
     const endedAt = startedAt && durationMs2 != null ? new Date(Date.parse(startedAt) + durationMs2).toISOString() : null;
     upsert.run({
       run_id: runId,
       source_id: sourceId,
-      session_id: sessionFromPath(path),
+      session_id: sessionFromPath(path2),
       task_id: strOrNull(d.taskId),
       workflow_name: strOrNull(d.workflowName),
       status: strOrNull(d.status),
@@ -3544,7 +3776,7 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
       ended_at: endedAt,
       ingested_at: now2
     });
-    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
+    setState.run({ file_path: path2, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
     stats.upserted++;
   }
 }
@@ -3600,25 +3832,25 @@ function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2,
        source_id=excluded.source_id, agent_type=excluded.agent_type,
        agent_description=excluded.agent_description, spawn_depth=excluded.spawn_depth,
        tool_use_id=excluded.tool_use_id, ingested_at=excluded.ingested_at`);
-  for (const path of paths) {
+  for (const path2 of paths) {
     stats.files++;
-    const st = statSync3(path);
+    const st = statSync3(path2);
     const mtimeMs = Math.trunc(st.mtimeMs);
-    const prev = full ? void 0 : getState.get(path);
+    const prev = full ? void 0 : getState.get(path2);
     if (prev && prev.size === st.size && prev.mtime_ms === mtimeMs) {
       stats.skipped++;
       continue;
     }
     let buf;
     try {
-      buf = readFileSync5(path);
+      buf = readFileSync5(path2);
     } catch {
       stats.malformed++;
       continue;
     }
-    const hash = sha256(buf);
-    if (prev && prev.sha256 === hash) {
-      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
+    const hash2 = sha256(buf);
+    if (prev && prev.sha256 === hash2) {
+      setState.run({ file_path: path2, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
       stats.skipped++;
       continue;
     }
@@ -3633,7 +3865,7 @@ function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2,
       stats.malformed++;
       continue;
     }
-    const sessionId = basename4(path, ".meta.json");
+    const sessionId = basename4(path2, ".meta.json");
     upsert.run({
       session_id: sessionId,
       source_id: sourceId,
@@ -3643,7 +3875,7 @@ function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2,
       tool_use_id: strOrNull2(d.toolUseId),
       ingested_at: now2
     });
-    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
+    setState.run({ file_path: path2, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
     stats.upserted++;
   }
 }
@@ -3680,8 +3912,8 @@ function discoverResults(sourceArchiveDir) {
   }
   return out;
 }
-function sessionFromPath2(path) {
-  const parts = path.split("/");
+function sessionFromPath2(path2) {
+  const parts = path2.split("/");
   const i = parts.indexOf("tool-results");
   return i > 0 ? parts[i - 1] : null;
 }
@@ -3698,40 +3930,40 @@ function ingestToolResults(db, sourceArchiveDir, excludedDirs, now2, stats, full
      VALUES (@session_id, @name, @path, @bytes, @text, @ingested_at)
      ON CONFLICT(session_id, name) DO UPDATE SET
        path=excluded.path, bytes=excluded.bytes, text=excluded.text, ingested_at=excluded.ingested_at`);
-  for (const path of paths) {
-    const sessionId = sessionFromPath2(path);
+  for (const path2 of paths) {
+    const sessionId = sessionFromPath2(path2);
     if (!sessionId)
       continue;
     stats.files++;
-    const st = statSync4(path);
+    const st = statSync4(path2);
     const mtimeMs = Math.trunc(st.mtimeMs);
-    const prev = full ? void 0 : getState.get(path);
+    const prev = full ? void 0 : getState.get(path2);
     if (prev && prev.size === st.size && prev.mtime_ms === mtimeMs) {
       stats.skipped++;
       continue;
     }
     let buf;
     try {
-      buf = readFileSync6(path);
+      buf = readFileSync6(path2);
     } catch {
       stats.malformed++;
       continue;
     }
-    const hash = sha256(buf);
-    if (prev && prev.sha256 === hash) {
-      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
+    const hash2 = sha256(buf);
+    if (prev && prev.sha256 === hash2) {
+      setState.run({ file_path: path2, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
       stats.skipped++;
       continue;
     }
     upsert.run({
       session_id: sessionId,
-      name: basename5(path, ".txt"),
-      path,
+      name: basename5(path2, ".txt"),
+      path: path2,
       bytes: st.size,
       text: buf.toString("utf8"),
       ingested_at: now2
     });
-    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
+    setState.run({ file_path: path2, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
     stats.upserted++;
   }
 }
@@ -3806,13 +4038,13 @@ function runIngest(argv = process.argv.slice(2)) {
       }
       const small = st.size <= STREAM_THRESHOLD;
       const buf = small ? readFileSync7(file.path) : null;
-      const hash = small ? sha256(buf) : sha256File(file.path);
-      if (prev && prev.sha256 === hash) {
+      const hash2 = small ? sha256(buf) : sha256File(file.path);
+      if (prev && prev.sha256 === hash2) {
         stmts.setState.run({
           file_path: file.path,
           size: st.size,
           mtime_ms: mtimeMs,
-          sha256: hash,
+          sha256: hash2,
           events_ingested: prev.events_ingested,
           ingested_at: now2
         });
@@ -3820,7 +4052,7 @@ function runIngest(argv = process.argv.slice(2)) {
         continue;
       }
       const lines = small ? buf.toString("utf8").split("\n") : streamLines(file.path);
-      ingestFile(db, stmts, adapter, file, lines, { size: st.size, mtimeMs, hash }, now2, stats);
+      ingestFile(db, stmts, adapter, file, lines, { size: st.size, mtimeMs, hash: hash2 }, now2, stats);
       dirty.add(file.sessionId);
     }
     ingestWorkflowResults(db, join8(archiveRoot, source.label), source.label, excludedDirs, now2, wfStats, args.full);
@@ -4462,6 +4694,34 @@ import { existsSync as existsSync6 } from "fs";
 import Fastify from "fastify";
 import fastifyStatic from "@fastify/static";
 
+// ../server/dist/export.js
+function parseRedactionLevel(raw) {
+  return raw === "off" ? "off" : raw === "structure" ? "structure" : "secrets";
+}
+function renderSessionExport(db, id, level) {
+  const result = getSession(db, id);
+  if (!result)
+    return null;
+  const s = result.session;
+  const events = result.events.map((e) => ({
+    type: e.type,
+    role: e.role,
+    timestamp: e.timestamp,
+    text: e.text,
+    thinking: e.thinking,
+    toolCalls: e.toolCalls.map((t) => ({
+      tool_name: t.tool_name,
+      skill_name: t.skill_name,
+      agent_type: t.agent_type,
+      input_json: t.input_json,
+      status: t.status
+    }))
+  }));
+  const { markdown } = exportMarkdown({ id: s.id, title: s.title, source: s.source_id, project: s.project_path, model: null, started_at: s.started_at, ended_at: s.ended_at }, events, { level });
+  const suffix = level === "off" ? "" : ".redacted";
+  return { markdown, filename: `session-${id.slice(0, 8)}${suffix}.md` };
+}
+
 // ../server/dist/dashboard.js
 function sessionWhere(f) {
   const where = [];
@@ -4718,6 +4978,14 @@ function originAllowed(origin) {
     return false;
   }
 }
+function writeBlocked(headers) {
+  const site = headers["sec-fetch-site"];
+  const s = Array.isArray(site) ? site[0] : site;
+  if (typeof s === "string" && s !== "same-origin" && s !== "none")
+    return true;
+  const origin = headers["origin"];
+  return !originAllowed(Array.isArray(origin) ? origin[0] : origin);
+}
 function runRefresh() {
   const dataDir = resolveDataDir(findRepoRoot());
   const lock = acquireLock(join9(dataDir, ".agent-lens.lock"));
@@ -4823,8 +5091,24 @@ function setPref(db, key, value) {
 }
 
 // ../server/dist/app.js
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
 async function createApp(db, opts = {}) {
   const app = Fastify({ logger: false });
+  if (opts.enforceLoopbackHost !== false) {
+    app.addHook("onRequest", async (req, reply) => {
+      const host = (req.headers.host ?? "").replace(/:\d+$/, "");
+      if (!LOOPBACK_HOSTS.has(host)) {
+        return reply.code(403).send({ error: { code: "FORBIDDEN_HOST", message: "non-loopback Host rejected" } });
+      }
+    });
+  }
+  app.addHook("onSend", async (_req, reply, payload) => {
+    reply.header("X-Frame-Options", "DENY");
+    reply.header("X-Content-Type-Options", "nosniff");
+    reply.header("Referrer-Policy", "no-referrer");
+    reply.header("Content-Security-Policy", "frame-ancestors 'none'");
+    return payload;
+  });
   let triageDb = null;
   if (opts.triageDbPath) {
     triageDb = openTriage(opts.triageDbPath);
@@ -4833,7 +5117,7 @@ async function createApp(db, opts = {}) {
     app.addHook("onClose", async () => triageDb?.close());
   }
   const guardWrite = (req, reply) => {
-    if (!originAllowed(req.headers.origin)) {
+    if (writeBlocked(req.headers)) {
       reply.code(403).send({ error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin write blocked" } });
       return false;
     }
@@ -4848,14 +5132,15 @@ async function createApp(db, opts = {}) {
     return { ok: true, last_ingested: lastIngested(db), schema_version: s.db_version, schema_stale: s.stale };
   });
   app.post("/api/refresh", async (req, reply) => {
-    if (!originAllowed(req.headers.origin)) {
+    if (writeBlocked(req.headers)) {
       return reply.code(403).send({ error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin refresh blocked" } });
     }
     let result;
     try {
       result = runRefresh();
     } catch (e) {
-      return reply.code(500).send({ error: { code: "REFRESH_FAILED", message: String(e?.message ?? e) } });
+      console.error("agent-lens-server: refresh failed:", e);
+      return reply.code(500).send({ error: { code: "REFRESH_FAILED", message: "refresh failed; see server logs" } });
     }
     if (!result) {
       return reply.code(409).send({ error: { code: "REFRESH_IN_PROGRESS", message: "a collect/ingest run is already in progress" } });
@@ -5006,34 +5291,11 @@ async function createApp(db, opts = {}) {
   });
   app.get("/api/sessions/:id/export.md", async (req, reply) => {
     const { id } = req.params;
-    const result = getSession(db, id);
-    if (!result)
+    const level = parseRedactionLevel(req.query.redact);
+    const out = renderSessionExport(db, id, level);
+    if (!out)
       return reply.code(404).send({ error: "not found" });
-    const s = result.session;
-    const events = result.events.map((e) => ({
-      type: e.type,
-      role: e.role,
-      timestamp: e.timestamp,
-      text: e.text,
-      thinking: e.thinking,
-      toolCalls: e.toolCalls.map((t) => ({
-        tool_name: t.tool_name,
-        skill_name: t.skill_name,
-        agent_type: t.agent_type,
-        input_json: t.input_json,
-        status: t.status
-      }))
-    }));
-    const md = sessionToMarkdown({
-      id: s.id,
-      title: s.title,
-      source: s.source_id,
-      project: s.project_path,
-      model: null,
-      started_at: s.started_at,
-      ended_at: s.ended_at
-    }, events);
-    reply.header("content-type", "text/markdown; charset=utf-8").header("content-disposition", `attachment; filename="session-${id.slice(0, 8)}.md"`).send(md);
+    reply.header("content-type", "text/markdown; charset=utf-8").header("content-disposition", `attachment; filename="${out.filename}"`).send(out.markdown);
   });
   if (opts.webDist && existsSync6(opts.webDist)) {
     await app.register(fastifyStatic, { root: opts.webDist });
@@ -5064,7 +5326,8 @@ async function startServer() {
   }
   const triageDbPath = process.env.AGENT_LENS_TRIAGE_DB || join10(dirname5(dbPath), "triage.db");
   const db = openReadonly(dbPath);
-  const app = await createApp(db, { webDist, triageDbPath });
+  const enforceLoopbackHost = host === "127.0.0.1" || host === "localhost";
+  const app = await createApp(db, { webDist, triageDbPath, enforceLoopbackHost });
   try {
     await app.listen({ host, port });
     console.log(`agent-lens-server: http://${host}:${port}  (db: ${dbPath})`);
@@ -5188,6 +5451,25 @@ cli.command("watch", "Watch sources and collect + ingest on change (resident pro
 cli.command("metrics", "Re-run classification over an already-ingested DB").option("--db <path>", "SQLite DB path").action((opts) => {
   runMetrics(opts.db ? ["--db", opts.db] : []);
 });
+cli.command("export <sessionId>", "Write a session to a shareable Markdown file (redacted by default)").option("--out <file>", "Write to this file (default: stdout)").option("--level <level>", "Redaction level: secrets (default) | structure").option("--no-redact", "Verbatim, UNREDACTED output (opt-out)").option("--db <path>", "SQLite DB path").action((sessionId, opts) => {
+  const dbPath = opts.db || process.env.AGENT_LENS_DB || join12(resolveDataDir(findRepoRoot()), "agent-lens.db");
+  if (!existsSync9(dbPath)) {
+    console.error(`agent-lens: db not found: ${dbPath} (run ingest first)`);
+    process.exit(1);
+  }
+  const level = opts.redact === false ? "off" : parseRedactionLevel(opts.level);
+  const out = renderSessionExport(openReadonly(dbPath), sessionId, level);
+  if (!out) {
+    console.error(`agent-lens: session not found: ${sessionId}`);
+    process.exit(1);
+  }
+  if (opts.out) {
+    writeFileSync3(opts.out, out.markdown);
+    console.error(`agent-lens: wrote ${out.filename} \u2192 ${opts.out} (redaction: ${level})`);
+  } else {
+    process.stdout.write(out.markdown);
+  }
+});
 cli.command(
   "service <action> [target]",
   "Install/uninstall/status OS services \u2014 action: install|uninstall|status; target: collector|server|all (default all)"