@theglitchking/semantic-memory 1.5.2 → 1.5.3

package/dist/cli/index.js

@@ -637,7 +637,7 @@ program.command("search <query>").description("Run a vault search and print top
   }
 });
 program.command("lint").description("Lint the vault against vault.schema.yml (schema violations + missing provenance + stale)").requiredOption("--notes <path>", "Path to markdown notes directory").option("--rule <name>", "Limit output to one rule: schema_violations | missing_provenance | stale").option("--json", "Emit JSON instead of the human-readable report").option("--strict", "Exit non-zero on warnings too (default: exit non-zero only on errors)").action(async (opts) => {
-  const { lintVault, formatLintReport } = await import("../lint-XUQ7JDYX.js");
+  const { lintVault, formatLintReport } = await import("../lint-HURYGO3V.js");
   const report = await lintVault(resolve2(opts.notes));
   if (opts.json) {
     const out = opts.rule ? report.byRule[opts.rule] : report;
@@ -649,7 +649,7 @@ program.command("lint").description("Lint the vault against vault.schema.yml (sc
   process.exitCode = bad > 0 ? 1 : 0;
 });
 program.command("log-event").description("Append a structured event to the vault's log.md (used by hooks and CI scripts \u2014 same shape as mcp__semantic-vault__log_event)").requiredOption("--notes <path>", "Path to markdown notes directory").requiredOption("--kind <name>", "Event category: ingest, synthesis, error, mode_change, etc.").requiredOption("--summary <text>", "One-line human summary").option("--payload <json>", "Structured payload as JSON string").action(async (opts) => {
-  const { logEvent } = await import("../log-LQXIJXIA.js");
+  const { logEvent } = await import("../log-YIXF6CYM.js");
   let payload;
   if (opts.payload) {
     try {
@@ -673,7 +673,7 @@ program.command("log-event").description("Append a structured event to the vault
   }
 });
 program.command("log-query").description("Read structured log entries from log.md \u2014 filters by kind, date range, limit").requiredOption("--notes <path>", "Path to markdown notes directory").option("--kind <name>", "Filter by kind (ingest, synthesis, error, mode_change, etc.)").option("--after <iso>", "ISO timestamp \u2014 only entries on or after").option("--before <iso>", "ISO timestamp \u2014 only entries on or before").option("--limit <n>", "Max entries (most recent)", (v) => parseInt(v, 10)).action(async (opts) => {
-  const { logQuery } = await import("../log-LQXIJXIA.js");
+  const { logQuery } = await import("../log-YIXF6CYM.js");
   try {
     const entries = await logQuery(resolve2(opts.notes), {
       kind: opts.kind,
@@ -688,7 +688,7 @@ program.command("log-query").description("Read structured log entries from log.m
   }
 });
 program.command("install-schema").description("Bootstrap vault.schema.yml in the vault root with the default schema").requiredOption("--notes <path>", "Path to markdown notes directory").option("--force", "Overwrite existing schema file").action(async (opts) => {
-  const { installDefaultSchema } = await import("../schema-ATFCLC6Y.js");
+  const { installDefaultSchema } = await import("../schema-LY6533NJ.js");
   const r = await installDefaultSchema(resolve2(opts.notes), opts.force);
   console.log(r.written ? `Installed default schema: ${r.path}` : `Schema already exists: ${r.path} (use --force to overwrite)`);
   process.exit(0);
@@ -869,7 +869,7 @@ ${r2.stderr?.toString() || ""}`);
     }
   }
   if (smokeOk && !opts.json) console.log(`\u2713 local install starts cleanly (v${smokeVersion})`);
-  const { runHealthcheck, formatDriftBanner, filterToDrift } = await import("../healthcheck-IMB47LZE.js");
+  const { runHealthcheck, formatDriftBanner, filterToDrift } = await import("../healthcheck-A32IWPNV.js");
   const vaultCandidate = join3(cwd, ".claude", ".vault");
   const vaultPath = existsSync3(vaultCandidate) ? vaultCandidate : void 0;
   let result = await runHealthcheck({ projectRoot: cwd, vaultPath, tier: opts.fast ? "fast" : "all", force: true });
@@ -1038,49 +1038,49 @@ program.command("decay-trace <notePath>").description("Show the decay calculatio
 });
 var lexiconCmd = program.command("lexicon").description("Manage the learned human\u2192artifact lexicon (aliases).");
 lexiconCmd.command("list").description("List all aliases in the lexicon.").requiredOption("--notes <path>", "Path to markdown notes directory").action(async (opts) => {
-  const { loadLexiconCache } = await import("../lexicon-5PXQEMUF.js");
+  const { loadLexiconCache } = await import("../lexicon-IVNJTMWE.js");
   console.log(JSON.stringify(await loadLexiconCache(resolve2(opts.notes)), null, 2));
   process.exit(0);
 });
 lexiconCmd.command("compile").description("Rebuild the derived lexicon cache from the lexicon/ notes.").requiredOption("--notes <path>", "Path to markdown notes directory").action(async (opts) => {
-  const { compileLexicon } = await import("../lexicon-5PXQEMUF.js");
+  const { compileLexicon } = await import("../lexicon-IVNJTMWE.js");
   const entries = await compileLexicon(resolve2(opts.notes));
   console.log(`compiled ${entries.length} alias(es)`);
   process.exit(0);
 });
 lexiconCmd.command("add <canonical> <phrases...>").description("Upsert an alias: a canonical target and the human phrases that refer to it.").requiredOption("--notes <path>", "Path to markdown notes directory").option("--authored", "Mark as human-authored (default: learned)").action(async (canonical, phrases, opts) => {
-  const { addAlias } = await import("../lexicon-5PXQEMUF.js");
+  const { addAlias } = await import("../lexicon-IVNJTMWE.js");
   const r = await addAlias(resolve2(opts.notes), { canonical, phrases, source: opts.authored ? "authored" : "learned" });
   console.log(JSON.stringify(r, null, 2));
   process.exit(0);
 });
 var dossierCmd = program.command("dossier").description("Manage entity dossiers \u2014 per-component living notes (purpose / failure modes / knobs / incident log / current state).");
 dossierCmd.command("init <entity>").description("Scaffold a dossier for an entity (no-op if one already exists). Optionally seed aliases and provenance.").requiredOption("--notes <path>", "Path to markdown notes directory").option("--alias <phrase...>", "Human phrase(s) for this entity \u2014 fed to the lexicon compiler").option("--seeded-from <ref>", "Provenance of the scaffold (e.g. a babel-fish project-map entry)").action(async (entity, opts) => {
-  const { initDossier } = await import("../dossier-2UG724LB.js");
+  const { initDossier } = await import("../dossier-RWTIMGZN.js");
   const r = await initDossier(resolve2(opts.notes), entity, { aliases: opts.alias, seeded_from: opts.seededFrom });
   console.log(JSON.stringify(r, null, 2));
   process.exit(0);
 });
 dossierCmd.command("list").description("List all dossiers with their entity, aliases, and current state.").requiredOption("--notes <path>", "Path to markdown notes directory").action(async (opts) => {
-  const { listDossiers } = await import("../dossier-2UG724LB.js");
+  const { listDossiers } = await import("../dossier-RWTIMGZN.js");
   console.log(JSON.stringify(await listDossiers(resolve2(opts.notes)), null, 2));
   process.exit(0);
 });
 var profileCmd = program.command("profile").description("Manage the speaker profile \u2014 how THIS human communicates (severity calibration, chronic omissions, verbosity, shorthand).");
 profileCmd.command("init").description("Scaffold profile/speaker.md with the fixed sections (no-op if it exists).").requiredOption("--notes <path>", "Path to markdown notes directory").action(async (opts) => {
-  const { initSpeakerProfile } = await import("../profile-LXUEF7TX.js");
+  const { initSpeakerProfile } = await import("../profile-UE4YVTDC.js");
   const r = await initSpeakerProfile(resolve2(opts.notes));
   console.log(JSON.stringify(r, null, 2));
   process.exit(0);
 });
 profileCmd.command("show").description("Print the speaker profile's injection head (the capped, placeholder-stripped view).").requiredOption("--notes <path>", "Path to markdown notes directory").action(async (opts) => {
-  const { readSpeakerProfile } = await import("../profile-LXUEF7TX.js");
+  const { readSpeakerProfile } = await import("../profile-UE4YVTDC.js");
   const p = await readSpeakerProfile(resolve2(opts.notes));
   console.log(p ? p.head || "(profile is empty \u2014 only placeholders)" : "(no speaker profile \u2014 run `profile init`)");
   process.exit(0);
 });
 program.command("selection-stats").description("Summarize the local selection log: searches, selections, most-cited notes, and retrieved-but-never-cited notes.").requiredOption("--notes <path>", "Path to markdown notes directory").option("--json", "Emit raw JSON instead of a human summary").action(async (opts) => {
-  const { computeSelectionStats, selectionLogPath } = await import("../telemetry-GB2TEHVE.js");
+  const { computeSelectionStats, selectionLogPath } = await import("../telemetry-B4KP3UVE.js");
   const stats = await computeSelectionStats(resolve2(opts.notes));
   if (opts.json) {
     console.log(JSON.stringify(stats, null, 2));

package/dist/core/index.d.ts

@@ -1,5 +1,6 @@
 import Graph from 'graphology';
 import { EventEmitter } from 'node:events';
+export { REDACTED, RedactMode, RedactResult, redact, redactDeep } from './redact.js';
 
 interface IndexedDocument {
     path: string;
@@ -182,13 +183,18 @@ declare class TextSearch {
     search(options: SearchTextOptions): SearchResult[];
 }
 
+/** `redacted`: secrets masked in the content written (never the values). */
+interface NoteWriteResult {
+    path: string;
+    redacted: number;
+}
 declare class NoteCrud {
     private notesPath;
     constructor(notesPath: string);
-    create(relativePath: string, content: string, frontmatter?: Record<string, unknown>): Promise<string>;
+    create(relativePath: string, content: string, frontmatter?: Record<string, unknown>): Promise<NoteWriteResult>;
     read(relativePath: string): Promise<string>;
     readMultiple(paths: string[]): Promise<Map<string, string>>;
-    update(relativePath: string, content: string, options: UpdateNoteOptions): Promise<void>;
+    update(relativePath: string, content: string, options: UpdateNoteOptions): Promise<NoteWriteResult>;
     delete(relativePath: string): Promise<void>;
     move(fromPath: string, toPath: string): Promise<void>;
     private updateWikilinksAfterMove;
@@ -199,7 +205,9 @@ declare class FrontmatterManager {
     private notesPath;
     constructor(notesPath: string);
     get(relativePath: string): Promise<Record<string, unknown>>;
-    update(relativePath: string, fields: Record<string, unknown>): Promise<void>;
+    update(relativePath: string, fields: Record<string, unknown>): Promise<{
+        redacted: number;
+    }>;
 }
 declare class TagManager {
     private notesPath;
@@ -252,7 +260,7 @@ interface VaultSchema {
 type Severity$1 = "warn" | "error";
 interface LintFinding {
     path: string;
-    rule: "missing_provenance" | "stale" | "schema_violations" | "broken_links" | "code_symbols" | "decay_candidates" | "alias_conflicts" | "decoys";
+    rule: "missing_provenance" | "stale" | "schema_violations" | "broken_links" | "code_symbols" | "decay_candidates" | "alias_conflicts" | "decoys" | "secrets";
     severity: Severity$1;
     message: string;
 }
@@ -337,6 +345,8 @@ interface ApplyPatchOptions {
 interface AppliedOp {
     op: "create" | "update" | "delete" | "move";
     path: string;
+    /** secrets masked in this op's content; omitted when none */
+    redacted?: number;
 }
 interface ApplyPatchResult {
     ok: boolean;
@@ -530,6 +540,8 @@ interface LintReport {
         decay_candidates: LintFinding[];
         alias_conflicts: LintFinding[];
         decoys: LintFinding[];
+        /** only present when the opt-in secrets check ran */
+        secrets?: LintFinding[];
     };
     counts: {
         errors: number;
@@ -572,6 +584,14 @@ declare function lintVault(notesPath: string, opts?: {
      * signal (decision Q5). Opt-in; a no-op with no selection log.
      */
     checkDecoys?: boolean;
+    /**
+     * When true, run the secrets check (v1.5.3): flag notes that contain a secret
+     * (API key, token, password, private key — the redactor's precise set). Reports
+     * path, line and kind, never the value; nothing is rewritten. Opt-in, so the
+     * default report stays byte-stable. A real secret must be rotated: it is in
+     * git history if the note was ever committed.
+     */
+    checkSecrets?: boolean;
 }): Promise<LintReport>;
 declare function formatLintReport(report: LintReport, opts?: {
     rule?: keyof LintReport["byRule"];

package/dist/core/index.js

@@ -2,7 +2,7 @@ import {
   filterToDrift,
   formatDriftBanner,
   runHealthcheck
-} from "../chunk-2EELGTLX.js";
+} from "../chunk-D5QLNNA4.js";
 import {
   FrontmatterManager,
   INDEX_FILE,
@@ -18,19 +18,20 @@ import {
   regenDirectoryIndex,
   regenIndexesForPaths,
   regenerateAgentsContract
-} from "../chunk-JWPR2B2X.js";
+} from "../chunk-ROKSUJFM.js";
 import {
   formatLintReport,
   lintVault
-} from "../chunk-FM26NFTR.js";
-import "../chunk-NTYYS53O.js";
-import "../chunk-A3KYHKB5.js";
-import "../chunk-WSU4QIPB.js";
+} from "../chunk-OFXQXVG5.js";
+import "../chunk-5ZKNO6ZD.js";
+import "../chunk-NBY4TRP7.js";
+import "../chunk-FTRXH2WC.js";
+import "../chunk-XAXK7NM4.js";
 import {
   SessionManager,
   deriveProjectRoot,
   deriveSessionDir
-} from "../chunk-S4KW7VH4.js";
+} from "../chunk-LGQPP5FQ.js";
 import {
   Embedder,
   GraphBuilder,
@@ -43,13 +44,17 @@ import {
 import {
   logEvent,
   logQuery
-} from "../chunk-JPQHNG3R.js";
+} from "../chunk-SX427M2R.js";
+import {
+  REDACTED,
+  redact,
+  redactDeep
+} from "../chunk-OEF5U5GV.js";
 import {
   installDefaultSchema,
   loadSchema,
   validateNote
-} from "../chunk-OWZWMB4P.js";
-import "../chunk-5ZKNO6ZD.js";
+} from "../chunk-FURCIJBO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   Embedder,
@@ -59,6 +64,7 @@ export {
   INDEX_OVERFLOW_THRESHOLD,
   Indexer,
   NoteCrud,
+  REDACTED,
   SessionManager,
   TagManager,
   TextSearch,
@@ -79,6 +85,8 @@ export {
   loadSchema,
   logEvent,
   logQuery,
+  redact,
+  redactDeep,
   regenDirectoryIndex,
   regenIndexesForPaths,
   regenerateAgentsContract,

package/dist/core/redact.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Secret redaction for everything semantic-memory writes to disk. Ported from jev-loop's
+ * redact.py: (1) exact values of secret-named env vars on this machine, (2) patterns.
+ *
+ * Two pattern sets:
+ * - "precise" (notes, frontmatter, dossiers, profile, lexicon): only shapes that are almost
+ *   never ordinary content, because a false positive in a note is data loss.
+ * - "broad" (search log, log.md events, session state, capture-pending): precise plus long
+ *   base64 / letter-and-digit tokens; over-redaction is fine in logs.
+ *
+ * Cannot catch a secret written in plain prose ("the password is hunter2"). Never logs values.
+ */
+declare const REDACTED = "[REDACTED]";
+type RedactMode = "precise" | "broad";
+interface RedactResult {
+    text: string;
+    count: number;
+}
+/** Test seam: re-read env and settings on the next call. */
+declare function resetRedactCache(): void;
+declare function redact(text: string, mode?: RedactMode): RedactResult;
+interface SecretLocation {
+    line: number;
+    kind: string;
+}
+/** Where precise-set secrets sit in a text (for lint_vault): 1-based line and kind, never the value. */
+declare function findSecrets(text: string): SecretLocation[];
+/** Redact every string inside a JSON-like value (for log payloads and state files). */
+declare function redactDeep<T>(value: T, mode?: RedactMode): {
+    value: T;
+    count: number;
+};
+/** Suffix for a tool result: says how many secrets were masked, never which. "" when none. */
+declare function redactedNote(count: number): string;
+
+export { REDACTED, type RedactMode, type RedactResult, type SecretLocation, findSecrets, redact, redactDeep, redactedNote, resetRedactCache };

package/dist/core/redact.js

@@ -0,0 +1,18 @@
+import {
+  REDACTED,
+  findSecrets,
+  redact,
+  redactDeep,
+  redactedNote,
+  resetRedactCache
+} from "../chunk-OEF5U5GV.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  REDACTED,
+  findSecrets,
+  redact,
+  redactDeep,
+  redactedNote,
+  resetRedactCache
+};
+//# sourceMappingURL=redact.js.map

package/dist/{dossier-2UG724LB.js → dossier-RWTIMGZN.js}

@@ -15,8 +15,9 @@ import {
   resolveDossierPath,
   setCurrentState,
   slugifyEntity
-} from "./chunk-WSU4QIPB.js";
-import "./chunk-S4KW7VH4.js";
+} from "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DOSSIER_DIR,
@@ -36,4 +37,4 @@ export {
   setCurrentState,
   slugifyEntity
 };
-//# sourceMappingURL=dossier-2UG724LB.js.map
+//# sourceMappingURL=dossier-RWTIMGZN.js.map

package/dist/healthcheck-A32IWPNV.js

@@ -0,0 +1,20 @@
+import {
+  filterToDrift,
+  formatDriftBanner,
+  runHealthcheck
+} from "./chunk-D5QLNNA4.js";
+import "./chunk-OFXQXVG5.js";
+import "./chunk-5ZKNO6ZD.js";
+import "./chunk-NBY4TRP7.js";
+import "./chunk-FTRXH2WC.js";
+import "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
+import "./chunk-FURCIJBO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  filterToDrift,
+  formatDriftBanner,
+  runHealthcheck
+};
+//# sourceMappingURL=healthcheck-A32IWPNV.js.map

package/dist/{lexicon-5PXQEMUF.js → lexicon-IVNJTMWE.js}

@@ -8,9 +8,10 @@ import {
   normalizePhrase,
   removeAlias,
   slugify
-} from "./chunk-A3KYHKB5.js";
-import "./chunk-WSU4QIPB.js";
-import "./chunk-S4KW7VH4.js";
+} from "./chunk-FTRXH2WC.js";
+import "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
 import "./chunk-PZ5AY32C.js";
 export {
   addAlias,
@@ -23,4 +24,4 @@ export {
   removeAlias,
   slugify
 };
-//# sourceMappingURL=lexicon-5PXQEMUF.js.map
+//# sourceMappingURL=lexicon-IVNJTMWE.js.map

package/dist/lint-HURYGO3V.js

@@ -0,0 +1,17 @@
+import {
+  formatLintReport,
+  lintVault
+} from "./chunk-OFXQXVG5.js";
+import "./chunk-5ZKNO6ZD.js";
+import "./chunk-NBY4TRP7.js";
+import "./chunk-FTRXH2WC.js";
+import "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
+import "./chunk-FURCIJBO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  formatLintReport,
+  lintVault
+};
+//# sourceMappingURL=lint-HURYGO3V.js.map

package/dist/log-YIXF6CYM.js

@@ -0,0 +1,11 @@
+import {
+  logEvent,
+  logQuery
+} from "./chunk-SX427M2R.js";
+import "./chunk-OEF5U5GV.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  logEvent,
+  logQuery
+};
+//# sourceMappingURL=log-YIXF6CYM.js.map

package/dist/mcp/server.js

@@ -3,7 +3,7 @@ import {
   initSpeakerProfile,
   readSpeakerProfile,
   updateProfileSection
-} from "../chunk-7M3JZOYH.js";
+} from "../chunk-WZEKIUYG.js";
 import {
   FrontmatterManager,
   NoteCrud,
@@ -17,23 +17,28 @@ import {
   regenDirectoryIndex,
   regenIndexesForPaths,
   regenerateAgentsContract
-} from "../chunk-JWPR2B2X.js";
+} from "../chunk-ROKSUJFM.js";
 import {
   lintVault
-} from "../chunk-FM26NFTR.js";
+} from "../chunk-OFXQXVG5.js";
+import {
+  computeDecay,
+  loadDecayConfig,
+  normalizeVerifiedDate
+} from "../chunk-5ZKNO6ZD.js";
 import {
   appendEvent,
   readSelectionLog,
   recordSearchForCorrelation,
   wasRecentlySearched
-} from "../chunk-NTYYS53O.js";
+} from "../chunk-NBY4TRP7.js";
 import {
   addAlias,
   compileLexicon,
   expandQuery,
   loadLexiconCache,
   removeAlias
-} from "../chunk-A3KYHKB5.js";
+} from "../chunk-FTRXH2WC.js";
 import {
   appendIncident,
   compileDossiers,
@@ -42,12 +47,12 @@ import {
   listDossiers,
   resolveDossierPath,
   setCurrentState
-} from "../chunk-WSU4QIPB.js";
+} from "../chunk-XAXK7NM4.js";
 import {
   SessionManager,
   deriveProjectRoot,
   deriveSessionDir
-} from "../chunk-S4KW7VH4.js";
+} from "../chunk-LGQPP5FQ.js";
 import {
   Embedder,
   GraphBuilder,
@@ -60,15 +65,13 @@ import {
 import {
   logEvent,
   logQuery
-} from "../chunk-JPQHNG3R.js";
+} from "../chunk-SX427M2R.js";
 import {
-  installDefaultSchema
-} from "../chunk-OWZWMB4P.js";
+  redactedNote
+} from "../chunk-OEF5U5GV.js";
 import {
-  computeDecay,
-  loadDecayConfig,
-  normalizeVerifiedDate
-} from "../chunk-5ZKNO6ZD.js";
+  installDefaultSchema
+} from "../chunk-FURCIJBO.js";
 import {
   __export
 } from "../chunk-PZ5AY32C.js";
@@ -4692,8 +4695,8 @@ function registerWriteTools(server, ctx) {
       frontmatter: external_exports.record(external_exports.unknown()).optional()
     },
     async ({ path, content, frontmatter }) => {
-      await ctx.crud.create(path, content, frontmatter);
-      return ctx.textResponse(`Created: ${path}`);
+      const { redacted } = await ctx.crud.create(path, content, frontmatter);
+      return ctx.textResponse(`Created: ${path}${redactedNote(redacted)}`);
     }
   );
   server.tool(
@@ -4706,8 +4709,8 @@ function registerWriteTools(server, ctx) {
       heading: external_exports.string().optional()
     },
     async ({ path, content, mode, heading }) => {
-      await ctx.crud.update(path, content, { mode, heading });
-      return ctx.textResponse(`Updated: ${path} (${mode})`);
+      const { redacted } = await ctx.crud.update(path, content, { mode, heading });
+      return ctx.textResponse(`Updated: ${path} (${mode})${redactedNote(redacted)}`);
     }
   );
   server.tool(
@@ -5198,7 +5201,8 @@ var RULE_KEY_FOR_CHECK = {
   code_symbols: "code_symbols",
   decay_candidates: "decay_candidates",
   alias_conflicts: "alias_conflicts",
-  decoys: "decoys"
+  decoys: "decoys",
+  secrets: "secrets"
 };
 function registerLintTools(server, ctx) {
   server.tool(
@@ -5239,10 +5243,10 @@ function registerLintTools(server, ctx) {
   );
   server.tool(
     "lint_vault",
-    "Run lint rules across the vault. Default returns the full LintReport with all findings grouped by rule. Pass `checks` to filter to specific rules (schema, provenance, stale, broken_links, code_symbols, decay_candidates) \u2014 when filtered, byRule contains only the requested rules. Two checks are opt-in only (never in the default report): `code_symbols` flags inline-code file-path references that no longer exist under the project root (no-op outside a code repo); `decay_candidates` cross-references the selection log against current decay to surface frequently-retrieved-but-decayed notes (no-op with no selection log). `decoys` flags notes retrieved 3+ times but never cited - surfaced for review, never auto-down-ranked (v1.5 Q5).",
+    "Run lint rules across the vault. Default returns the full LintReport with all findings grouped by rule. Pass `checks` to filter to specific rules (schema, provenance, stale, broken_links, code_symbols, decay_candidates) \u2014 when filtered, byRule contains only the requested rules. Two checks are opt-in only (never in the default report): `code_symbols` flags inline-code file-path references that no longer exist under the project root (no-op outside a code repo); `decay_candidates` cross-references the selection log against current decay to surface frequently-retrieved-but-decayed notes (no-op with no selection log). `decoys` flags notes retrieved 3+ times but never cited - surfaced for review, never auto-down-ranked (v1.5 Q5). `secrets` flags notes containing an API key, token, password or private key (path, line, kind \u2014 never the value; nothing is rewritten): rotate the secret, then remove it.",
     {
       pathGlob: external_exports.string().optional(),
-      checks: external_exports.array(external_exports.enum(["schema", "provenance", "stale", "broken_links", "code_symbols", "decay_candidates", "alias_conflicts", "decoys"])).optional().describe("Filter to specific lint rules. Omit for full report (excludes the opt-in code_symbols / decay_candidates / alias_conflicts / decoys).")
+      checks: external_exports.array(external_exports.enum(["schema", "provenance", "stale", "broken_links", "code_symbols", "decay_candidates", "alias_conflicts", "decoys", "secrets"])).optional().describe("Filter to specific lint rules. Omit for full report (excludes the opt-in code_symbols / decay_candidates / alias_conflicts / decoys / secrets).")
     },
     async ({ pathGlob, checks }) => {
       const report = await lintVault(ctx.notesPath, {
@@ -5250,7 +5254,8 @@ function registerLintTools(server, ctx) {
         checkCodeSymbols: !!checks?.includes("code_symbols"),
         checkDecayCandidates: !!checks?.includes("decay_candidates"),
         checkAliasConflicts: !!checks?.includes("alias_conflicts"),
-        checkDecoys: !!checks?.includes("decoys")
+        checkDecoys: !!checks?.includes("decoys"),
+        checkSecrets: !!checks?.includes("secrets")
       });
       if (!checks || checks.length === 0) {
         return ctx.textResponse(JSON.stringify(report, null, 2));
@@ -5349,8 +5354,8 @@ function registerMetadataTools(server, ctx) {
     "Set or delete YAML frontmatter keys \u2014 pass null to delete a key",
     { path: external_exports.string(), fields: external_exports.record(external_exports.unknown()) },
     async ({ path, fields }) => {
-      await ctx.frontmatterManager.update(path, fields);
-      return ctx.textResponse(`Frontmatter updated: ${path}`);
+      const { redacted } = await ctx.frontmatterManager.update(path, fields);
+      return ctx.textResponse(`Frontmatter updated: ${path}${redactedNote(redacted)}`);
     }
   );
   server.tool(