@visual-z/xeno 0.8.2 → 0.8.4

package/src/core/history.ts

@@ -1,7 +1,7 @@
 /** D20: bounded carried state, with deterministic pages rebuilt from the log. */
-import { emitHandoff, type Handoff } from "./handoff.ts";
+import { emitHandoff, type Handoff, type UserTurnRecord } from "./handoff.ts";
 import { estimateTokens } from "./tokens.ts";
-import { recoveryWorkingSet } from "./working-set.ts";
+import { recoveryWorkingSet, recoveryWorkingSetV3 } from "./working-set.ts";
 import { recoveryInstructions } from "./prompt-policy.ts";
 import type { RecoveryNodes } from "./recovery-sources.ts";
 
@@ -65,20 +65,19 @@ function suffixes(h: Handoff, offsets: Record<HistorySection, number>): Handoff
   };
 }
 
-export function boundHandoff(full: Handoff, budget = DEFAULT_HANDOFF_TOKENS): Handoff {
-  if (!Number.isFinite(budget) || budget <= 0) throw new RangeError("handoff budget must be positive");
-  const size = (h: Handoff): number => estimateTokens.count([], emitHandoff(h));
-  if (size(full) <= budget) return full;
-  if (full.predecessor === null) throw new Error("history requires an immutable source");
-  // An absent new section must not change legacy projections or frozen replay.
-  const sections = HISTORY_SECTIONS.filter(section => (section !== "state.work_items" || full.state.work_items !== undefined) &&
+/** Sections a handoff actually has; an absent new section must not change legacy projections or frozen replay. */
+function pageableSections(full: Handoff): HistorySection[] {
+  return HISTORY_SECTIONS.filter(section => (section !== "state.work_items" || full.state.work_items !== undefined) &&
     (section !== "evidence_links" || full.evidence_links !== undefined) &&
     (section !== "acceptance.criteria" || full.acceptance !== undefined) &&
     (section !== "acceptance.targets" || full.acceptance?.targets !== undefined) &&
     (section !== "loaded_skills" || full.loaded_skills !== undefined) &&
     (section !== "processes" || full.processes !== undefined));
-  const offsets = Object.fromEntries(sections.map((s) => [s, historyItems(full, s).length])) as Record<HistorySection, number>;
-  const build = (): Handoff => ({
+}
+
+/** The v2 shape carrying `items.length - offset` newest items of every pageable section. */
+function carriedAt(full: Handoff, sections: readonly HistorySection[], offsets: Record<HistorySection, number>): Handoff {
+  return {
     ...suffixes(full, offsets),
     handoff_version: 2,
     history: {
@@ -87,22 +86,42 @@ export function boundHandoff(full: Handoff, budget = DEFAULT_HANDOFF_TOKENS): Ha
         total: historyItems(full, s).length, offset: offsets[s],
       }])),
     },
-  });
+  };
+}
+
+const handoffSize = (h: Handoff): number => estimateTokens.count([], emitHandoff(h));
+
+/**
+ * `priority` sections grow to completion, newest first, before any other
+ * section gets an item; the rest then share what is left round-robin. The
+ * default (none) is the original D20 order, which recorded cuts replay.
+ */
+export function boundHandoff(full: Handoff, budget = DEFAULT_HANDOFF_TOKENS, priority: readonly HistorySection[] = []): Handoff {
+  if (!Number.isFinite(budget) || budget <= 0) throw new RangeError("handoff budget must be positive");
+  const size = handoffSize;
+  if (size(full) <= budget) return full;
+  if (full.predecessor === null) throw new Error("history requires an immutable source");
+  const sections = pageableSections(full);
+  const offsets = Object.fromEntries(sections.map((s) => [s, historyItems(full, s).length])) as Record<HistorySection, number>;
+  const build = (): Handoff => carriedAt(full, sections, offsets);
   let carried = build();
   // The objective stays verbatim (D2). An oversized objective is an explicit
   // input problem; repeatedly cutting it would create an infinite cut loop.
   if (size(carried) > budget) throw new RangeError("handoff scalar fields exceed budget; shorten the objective or frozen input");
-  const active = new Set<HistorySection>(sections);
+  const grow = (section: HistorySection): boolean => {
+    if (offsets[section] === 0) return false;
+    offsets[section]--;
+    const candidate = build();
+    if (size(candidate) <= budget) { carried = candidate; return true; }
+    offsets[section]++;
+    return false;
+  };
+  for (const section of priority) if (sections.includes(section)) while (grow(section)) { /* newest first until full or out of room */ }
+  const active = new Set<HistorySection>(sections.filter(section => !priority.includes(section)));
   // Round-robin suffix growth prevents one long section starving every other
   // category. Each retained range is contiguous and independently pageable.
   while (active.size > 0) {
-    for (const section of active) {
-      if (offsets[section] === 0) { active.delete(section); continue; }
-      offsets[section]--;
-      const candidate = build();
-      if (size(candidate) <= budget) carried = candidate;
-      else { offsets[section]++; active.delete(section); }
-    }
+    for (const section of active) if (!grow(section)) active.delete(section);
   }
   return carried;
 }
@@ -131,3 +150,88 @@ export function boundRecoveryHandoff(full: Handoff, nodes: RecoveryNodes, budget
   const inline = tools?.includes("history") && carried.user_turns_truncated === undefined && (carried.history?.sections["user_turns"]?.offset ?? 0) === 0;
   return inline && carried.working_set ? { ...carried, working_set: { ...carried.working_set, recovery: recoveryInstructions(tools!, true) } } : carried;
 }
+
+/**
+ * D8: join carried turns to their original user events to name attached images
+ * by digest. Turns and events are both the active ancestry in log order; any
+ * disagreement leaves the turns undecorated rather than guessing a pairing.
+ */
+export function userTurnImages(turns: readonly UserTurnRecord[], nodes: RecoveryNodes): readonly UserTurnRecord[] {
+  const users = nodes.flatMap(part => part.events.flatMap(event => event.t === "user" ? [event] : []));
+  if (users.length !== turns.length || users.some((event, i) => event.at !== turns[i]!.at || event.text !== turns[i]!.text)) return turns;
+  return turns.map((turn, i) => {
+    const event = users[i]!;
+    return event.images?.length ? { ...turn, event: event.id,
+      images: event.images.map(({ sha256, name, width, height }) => ({ sha256, name, width, height })) } : turn;
+  });
+}
+
+/**
+ * v3 carries one copy of each work item's prose. `state.in_flight` and
+ * `state.blocked` are compatible projections of identified work (O.2), so a
+ * leading run of items the carried `state.work_items` or working set already
+ * hold moves into the existing page range, which `validateHandoff` accepts for
+ * continuation; D20 arrays stay contiguous suffixes. A working-set entry whose
+ * prose the carried `state.work_items` holds keeps only its id and status, since
+ * `state.work_items` is the canonical identified work. Every change only
+ * removes bytes, so the budget still holds.
+ */
+function oneCopyOfWork(h: Handoff): Handoff {
+  const items = new Map((h.state.work_items ?? []).map(item => [item.id, item]));
+  const viewed = new Map((h.working_set?.work ?? []).map(entry => [entry.id, entry]));
+  const history = h.history && { ...h.history, sections: { ...h.history.sections } };
+  type Prose = { status: string; what?: string; next_action?: string; reason?: string };
+  const holders = (id: string | undefined): Prose[] => {
+    const found: Prose[] = [], item = id === undefined ? undefined : items.get(id), entry = id === undefined ? undefined : viewed.get(id);
+    if (item) found.push(item);
+    if (entry) found.push(entry);
+    return found;
+  };
+  const page = <T extends { work_id?: string }>(section: "state.in_flight" | "state.blocked", list: readonly T[], same: (item: T, holder: Prose) => boolean): readonly T[] => {
+    const range = history?.sections[section];
+    let skip = 0;
+    while (range && skip < list.length && holders(list[skip]!.work_id).some(holder => same(list[skip]!, holder))) skip++;
+    if (skip === 0) return list;
+    history!.sections[section] = { total: range!.total, offset: range!.offset + skip };
+    return list.slice(skip);
+  };
+  const in_flight = page("state.in_flight", h.state.in_flight, (item, holder) => holder.status === "active" && holder.what === item.what && holder.next_action === item.next_action);
+  const blocked = page("state.blocked", h.state.blocked, (item, holder) => holder.status === "blocked" && holder.what === item.what && holder.reason === item.reason);
+  const view = h.working_set && { ...h.working_set, work: h.working_set.work.map(entry => {
+    const item = items.get(entry.id);
+    if (!item || item.what !== entry.what || item.next_action !== entry.next_action || item.reason !== entry.reason) return entry;
+    const { what: _what, next_action: _next, reason: _reason, ...rest } = entry;
+    return rest;
+  }) };
+  return { ...h, ...(view ? { working_set: view } : {}), ...(history ? { history } : {}), state: { ...h.state, in_flight, blocked } };
+}
+
+const USERS_FIRST: readonly HistorySection[] = ["user_turns"];
+
+/**
+ * Working set v3. User turns are the smallest, highest-value carried content
+ * (Codex compaction likewise keeps user messages newest first, verbatim, under
+ * its own cap), so they are reserved before the working set and before every
+ * other page; only turns that alone exceed the budget are cut, newest kept.
+ * While every turn is inline, user references would only point at text already
+ * present, so the view leaves them out. The view keeps v2's 40% allocation
+ * assumption, measured inside the handoff it is carried in.
+ */
+export function boundRecoveryHandoffV3(full: Handoff, nodes: RecoveryNodes, budget = DEFAULT_HANDOFF_TOKENS, tools?: readonly string[]): Handoff {
+  if (!Number.isFinite(budget) || budget <= 0) throw new RangeError("handoff budget must be positive");
+  const base: Handoff = { ...full, user_turns: userTurnImages(full.user_turns, nodes) };
+  const plain = (): Handoff => oneCopyOfWork(boundHandoff(base, budget, USERS_FIRST));
+  if (base.predecessor === null) return plain();
+  const sections = pageableSections(base);
+  const empty = Object.fromEntries(sections.map((s) => [s, historyItems(base, s).length])) as Record<HistorySection, number>;
+  const withUsers = carriedAt(base, sections, { ...empty, user_turns: 0 });
+  const usersInline = base.user_turns_truncated === undefined && handoffSize(withUsers) <= budget;
+  const skeleton = usersInline ? withUsers : carriedAt(base, sections, empty);
+  const cap = Math.min(budget, handoffSize(skeleton) + budget * .4);
+  const recovery = recoveryInstructions(tools ?? ["history"], usersInline, base.user_turns.some(turn => turn.images !== undefined));
+  const view = recoveryWorkingSetV3(base, nodes, { users: !usersInline, recovery,
+    fits: candidate => handoffSize({ ...skeleton, working_set: candidate }) <= cap });
+  if (!view) return plain();
+  try { return oneCopyOfWork(boundHandoff({ ...base, working_set: view }, budget, USERS_FIRST)); }
+  catch (error) { if (error instanceof RangeError) return plain(); throw error; }
+}

package/src/core/observation-view.ts

@@ -85,6 +85,30 @@ export function headTailSelection(
     visible: [...(headEnd ? [[0, headEnd] as [number, number]] : []), ...(kept ? [[total - kept, total] as [number, number]] : [])] };
 }
 
+/**
+ * The text a terminal would finally show for output that redraws lines with
+ * `\r` (progress bars). Within each `\n`-separated line, a carriage return
+ * moves back to column 0 and the following characters overwrite, one code
+ * point each; characters not overwritten stay. `\r\n` is thus a plain line
+ * break. Other control sequences (`ESC[K` and the like) are left as they are.
+ *
+ * A view only: the archived bytes keep every frame (D8). Without this a 6.3KB
+ * brew download of 48 frames reached the model whole (carriage-return-view
+ * card), though a terminal showed one line.
+ */
+export function foldCarriageReturns(text: string): string {
+  if (!text.includes("\r")) return text;
+  return text.split("\n").map(line => {
+    if (!line.includes("\r")) return line;
+    let screen: string[] = [];
+    for (const frame of line.split("\r")) {
+      const chars = Array.from(frame);
+      screen = chars.concat(screen.slice(chars.length));
+    }
+    return screen.join("");
+  }).join("\n");
+}
+
 /** Signals a shell reports as 128+n; the common ones a model can act on. */
 const SIGNALS: Readonly<Record<number, string>> = {
   1: "SIGHUP", 2: "SIGINT", 6: "SIGABRT", 9: "SIGKILL", 11: "SIGSEGV", 13: "SIGPIPE", 15: "SIGTERM",

package/src/core/path-suggestions.ts

@@ -0,0 +1,59 @@
+/**
+ * Existing paths that a missing one probably meant.
+ *
+ * Models guess paths, and most guesses in a reviewed session (flotil: 11 of
+ * 11 ENOENT) had the right file name in the wrong directory or a near
+ * spelling. OpenCode's read tool suggests up to three entries of the same
+ * directory whose name contains, or is contained in, the requested one
+ * (`packages/opencode/src/tool/read.ts`); that misses a wrong directory, so
+ * this ranks the whole workspace listing, file name first.
+ *
+ * Pure and deterministic: the result depends on the set of candidates, never
+ * their order, so the same failure always names the same paths.
+ */
+import { editDistance } from "./text-normalize.ts";
+
+/** OpenCode's count: enough to cover a wrong directory, short enough to read at a glance. */
+export const PATH_SUGGESTION_LIMIT = 3;
+
+/** Containment of a shorter name is too weak a signal below this length (assumed: "a" is in everything). */
+const MIN_CONTAINED = 3;
+
+const baseName = (path: string) => path.slice(path.lastIndexOf("/") + 1);
+const stem = (name: string) => { const dot = name.lastIndexOf("."); return dot > 0 ? name.slice(0, dot) : name; };
+
+/**
+ * Rank tier of `name` against the wanted file name, or null when unrelated.
+ * 0: same name; 1: same name without extension; 2: one name contains the
+ * other; 3: a near spelling (edit distance within a quarter of the length).
+ */
+function tier(name: string, wanted: string, distance: number): number | null {
+  if (name === wanted) return 0;
+  if (stem(name) === stem(wanted) && stem(name).length > 0) return 1;
+  const shorter = name.length < wanted.length ? name : wanted, longer = shorter === name ? wanted : name;
+  if (shorter.length >= MIN_CONTAINED && longer.includes(shorter)) return 2;
+  if (distance <= Math.max(1, Math.floor(wanted.length / 4))) return 3;
+  return null;
+}
+
+/**
+ * Up to `limit` workspace-relative paths from `candidates` closest to the
+ * missing `target`, best first. Paths use "/" separators; comparison ignores
+ * case. The target itself is never suggested.
+ */
+export function nearestPaths(target: string, candidates: readonly string[], limit = PATH_SUGGESTION_LIMIT): string[] {
+  const wantedPath = target.replace(/^\.\//, "").toLowerCase();
+  const wanted = baseName(wantedPath);
+  if (wanted.length === 0 || limit <= 0) return [];
+  const ranked: { path: string; tier: number; name: number; whole: number }[] = [];
+  for (const path of new Set(candidates)) {
+    const lower = path.toLowerCase();
+    if (lower === wantedPath) continue;
+    const name = baseName(lower), distance = editDistance(name, wanted);
+    const rank = tier(name, wanted, distance);
+    if (rank === null) continue;
+    ranked.push({ path, tier: rank, name: distance, whole: editDistance(lower, wantedPath) });
+  }
+  ranked.sort((a, b) => a.tier - b.tier || a.name - b.name || a.whole - b.whole || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  return ranked.slice(0, limit).map(item => item.path);
+}

package/src/core/permissions.ts

@@ -162,6 +162,66 @@ export function decideWithSessionRules(
   return decide([...remembered, ...configured], request);
 }
 
+/**
+ * Where a gate outcome came from, for the durable approval record
+ * (feat-approval-events). `auto` is an allow by a rule with no selector --
+ * what `--yolo` compiles to -- so "no approval was required" is derived from
+ * the rule list itself rather than from a side flag. `none` means no rule
+ * matched and the empty-list default allowed: no policy was consulted.
+ */
+export type DecisionSource = "session_rule" | "config" | "auto" | "none";
+export interface DecisionExplanation {
+  readonly action: PermissionAction;
+  readonly source: DecisionSource;
+  readonly rule?: PermissionRule;
+}
+
+/** Mirrors decide() exactly, but keeps the index of the rule that produced the action. */
+function explainList(rules: readonly PermissionRule[], request: PermissionRequest): { action: PermissionAction; index?: number } {
+  if (request.paths && request.paths.length > 1) {
+    const each = request.paths.map(path => explainList(rules, { ...request, paths: [path] }));
+    const actions = each.map(item => item.action);
+    const action: PermissionAction = actions.includes("deny") ? "deny" : actions.includes("ask") ? "ask" : "allow";
+    return each.find(item => item.action === action)!;
+  }
+  const index = rules.findIndex(rule => ruleMatches(rule, request));
+  return index < 0 ? { action: "allow" } : { action: rules[index]!.action, index };
+}
+
+/** decideWithSessionRules plus the rule that decided; the action is always identical (property-tested). */
+export function explainDecision(
+  configured: readonly PermissionRule[], remembered: readonly PermissionRule[], request: PermissionRequest,
+): DecisionExplanation {
+  const ceiling = explainList(configured, request);
+  if (ceiling.action === "deny") return { action: "deny", source: "config", rule: configured[ceiling.index!]! };
+  const combined = [...remembered, ...configured];
+  const found = explainList(combined, request);
+  if (found.index === undefined) return { action: found.action, source: "none" };
+  const rule = combined[found.index]!;
+  const unconditional = rule.tool === undefined && rule.command === undefined && rule.commandPrefix === undefined &&
+    rule.path === undefined && rule.pathGlob === undefined;
+  return { action: found.action, rule,
+    source: found.index < remembered.length ? "session_rule" : unconditional && rule.action === "allow" ? "auto" : "config" };
+}
+
+/**
+ * A call needs a decision when the product default would not silently allow
+ * it, or when the effective policy did not. Calls outside both -- confined
+ * reads and edits under the default -- had nobody's judgement to record.
+ */
+export function approvalNeeded(request: PermissionRequest, effective: PermissionAction): boolean {
+  return effective !== "allow" || decide(defaultRules(), request) !== "allow";
+}
+
+/** Stable one-line rule text for the log and the export; field order is fixed. */
+export function describeRule(rule: PermissionRule): string {
+  return [rule.action, rule.tool ?? "*",
+    ...(rule.command !== undefined ? [`command=${JSON.stringify(rule.command)}`] : []),
+    ...(rule.commandPrefix !== undefined ? [`commandPrefix=${JSON.stringify(rule.commandPrefix.join(" "))}`] : []),
+    ...(rule.path !== undefined ? [`path=${JSON.stringify(rule.path)}`] : []),
+    ...(rule.pathGlob !== undefined ? [`pathGlob=${JSON.stringify(rule.pathGlob)}`] : [])].join(" ");
+}
+
 /** Lexical normalization is pure; the store adds canonical symlink resources. */
 export function normalizePermissionPath(path: string): string {
   const absolute = path.startsWith("/");

package/src/core/prompt-policy.ts

@@ -29,10 +29,12 @@ export function toolDescription(description: string, guidance: readonly ToolGuid
  * that returns what it already has -- or an empty page after a model switch
  * on a fresh session (Horizyn mv3nsske-x50u, fix-recovery-inline-users).
  */
-export function recoveryInstructions(tools: readonly string[], usersInline = false): string {
+export function recoveryInstructions(tools: readonly string[], usersInline = false, images = false): string {
   return (tools.includes("history")
     ? (usersInline ? "User messages are verbatim in user_turns. Other history(node=source.node,recovery=...) pages: failures, environment, next_actions; " : "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; ") +
-      "event=ID reads one original. history(work_id=ID) recovers work. "
+      "event=ID reads one original. history(work_id=ID) recovers work. " +
+      // Working set v3: the turn's image references are carried, the pixels are not.
+      (images ? "A user turn's images are not attached here; history(event=ID) with its event reattaches them. " : "")
     : "Original user messages and evidence remain at the source references. The original-source recovery capability is unavailable; state any resulting evidence gap instead of guessing. ") +
     "Abandoned messages are cancelled; annotations are not user instructions. Observations are historical: recheck resource, host and current permissions before acting.";
 }

package/src/core/secrets.ts

@@ -0,0 +1,188 @@
+/**
+ * Credential redaction at the log boundary (S.9).
+ *
+ * The log is the only truth and every model request is a projection of it, so
+ * a credential that reaches the log is resent on every later request and
+ * survives every cut through `objective` and `user_turns` (D2). Masking at
+ * projection time would leave the original in an append-only file forever.
+ * Redaction therefore happens before an event is written: the secret is
+ * replaced by a placeholder, and the value lives in a separate per-session
+ * vault that no projection reads.
+ *
+ * The placeholder is an exact inverse: tools expand it back to the value when
+ * they run (OpenHands' SecretRegistry does the same with secret names), and
+ * any output that echoes a known value is masked again. A false positive
+ * therefore costs readability, never correctness -- an edit whose old_string
+ * holds a placeholder still matches the file.
+ *
+ * Only high-confidence shapes are detected (gitleaks prefix rules plus
+ * "secret-named key = value"); entropy detection is deliberately absent because
+ * its false positives on hashes and code are irreversible in a live view.
+ * A bare password has no shape, so it is recognised only by context: a short
+ * token the user sends right after the assistant asked for a credential.
+ */
+
+export interface SecretEntry {
+  /** The placeholder's number: `[[xeno-secret-<n>]]`. */
+  n: number;
+  value: string;
+  /** Which rule found it, for the audit trail; never the value. */
+  rule: string;
+}
+
+export type Vault = readonly SecretEntry[];
+
+export const placeholder = (n: number): string => `[[xeno-secret-${n}]]`;
+const PLACEHOLDER = /\[\[xeno-secret-(\d+)\]\]/g;
+
+/**
+ * A known value shorter than this is too likely to occur by accident ("admin",
+ * "123456") to mask everywhere it appears. Assumed, not measured; Codex's
+ * key-assignment rule uses the same 8.
+ */
+export const MIN_SECRET_LENGTH = 8;
+
+interface Rule { id: string; pattern: RegExp; /** Capture group holding the secret; 0 is the whole match. */ group: number }
+
+// Prefix rules follow gitleaks' default config (b58d3f10) and Gemini CLI's
+// environmentSanitization.ts; tskey- is added for Tailscale, which gitleaks lacks.
+const RULES: readonly Rule[] = [
+  { id: "pem-private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g, group: 0 },
+  { id: "anthropic-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g, group: 0 },
+  { id: "openai-key", pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}/g, group: 0 },
+  { id: "github-token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{22,})/g, group: 0 },
+  { id: "gitlab-token", pattern: /\bglpat-[A-Za-z0-9_-]{20,}/g, group: 0 },
+  { id: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}/g, group: 0 },
+  { id: "aws-access-key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, group: 0 },
+  { id: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}/g, group: 0 },
+  { id: "stripe-key", pattern: /\b[sr]k_live_[0-9A-Za-z]{24,}/g, group: 0 },
+  // tskey-<kind>-<id with a digit>-<secret>; documentation like "tskey-auth-reusable-" has no digit in the id.
+  { id: "tailscale-key", pattern: /\btskey-[a-z]+-[A-Za-z0-9]*\d[A-Za-z0-9]*-[A-Za-z0-9]{10,}/g, group: 0 },
+  { id: "npm-token", pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, group: 0 },
+  { id: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, group: 0 },
+  { id: "bearer-token", pattern: /\bBearer\s+([A-Za-z0-9._~+/=-]{20,})/g, group: 1 },
+  { id: "url-password", pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:([^\s/@]{3,})@/gi, group: 1 },
+  // A secret-named key assigned a literal. The value class excludes quotes,
+  // brackets and parentheses so `token = getToken()` and `password: string`
+  // stay code; requiring a digit or 16+ characters keeps `secret: undefined`.
+  { id: "secret-assignment", group: 1,
+    // Up to three prefix words, so access_token, HUILIANYI_REFRESH_TOKEN and db-password count.
+    pattern: /\b(?:[a-z0-9]+[_-]){0,3}(?:api[_-]?key|access[_-]?key|secret(?:[_-]?key)?|client[_-]?secret|token|password|passwd|pwd)["']?\s*[:=]\s*["']?([^\s"'`(){}[\]<>;,]{8,})/gi },
+  { id: "secret-assignment-zh", group: 1, pattern: /(?:密码|口令|密钥|令牌)\s*(?:是|为|[:：=])\s*["'“]?([^\s"'”，。,;；]{4,})/g },
+];
+
+const plausibleAssigned = (value: string): boolean =>
+  !/^(?:\$|process\.|os\.|env\.|self\.|this\.)/.test(value) && !value.startsWith("[[xeno-secret-") &&
+  // A pure number after a token-named key is a count (input_tokens=12000000), not a credential.
+  !/^\d+$/.test(value) &&
+  // Credentials carry digits; a digit-free value is a path, a member access or a placeholder word
+  // (replayed 2026-10-12 sessions: "internal/server/…", "auth.AccessToken"). A long mixed-case
+  // value without separators is the one digit-free exception.
+  (/\d/.test(value) && /[A-Za-z]/.test(value) || value.length >= 20 && /[A-Z]/.test(value) && /[a-z]/.test(value) && !/[./]/.test(value));
+
+/** Every secret-shaped span in `text`, with the rule that found it. Overlaps resolve to the earliest, longest. */
+export function findSecrets(text: string): { start: number; end: number; rule: string }[] {
+  const spans: { start: number; end: number; rule: string }[] = [];
+  for (const rule of RULES) {
+    for (const match of text.matchAll(rule.pattern)) {
+      const value = match[rule.group];
+      if (value === undefined || match.index === undefined) continue;
+      if (rule.id === "secret-assignment" && !plausibleAssigned(value)) continue;
+      const start = match.index + match[0].lastIndexOf(value);
+      spans.push({ start, end: start + value.length, rule: rule.id });
+    }
+  }
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const kept: typeof spans = [];
+  for (const span of spans) if (kept.length === 0 || span.start >= kept.at(-1)!.end) kept.push(span);
+  return kept;
+}
+
+/**
+ * Replaces known values and newly found secrets with placeholders. Returns the
+ * vault entries it had to add; the caller persists them before the text is
+ * written anywhere, so a placeholder in the log always has a value to expand to.
+ */
+export function redactText(text: string, vault: Vault, candidates: readonly { value: string; rule: string }[] = []): { text: string; added: SecretEntry[] } {
+  if (text.length === 0) return { text, added: [] };
+  const added: SecretEntry[] = [];
+  let next = vault.reduce((max, entry) => Math.max(max, entry.n), 0) + 1;
+  // Candidates (secret-named environment values) join the vault only when they
+  // actually appear, so a placeholder number is never spent on a value no event holds.
+  const known: SecretEntry[] = [...vault];
+  for (const candidate of candidates) {
+    if (candidate.value.length < MIN_SECRET_LENGTH || !text.includes(candidate.value) || known.some(entry => entry.value === candidate.value)) continue;
+    const entry = { n: next++, value: candidate.value, rule: candidate.rule };
+    known.push(entry); added.push(entry);
+  }
+  let out = maskKnown(text, known);
+  const spans = findSecrets(out);
+  if (spans.length === 0) return { text: out, added };
+  let result = "", at = 0;
+  for (const span of spans) {
+    const value = out.slice(span.start, span.end);
+    const existing = known.find(entry => entry.value === value);
+    const entry = existing ?? { n: next++, value, rule: span.rule };
+    if (!existing) { known.push(entry); added.push(entry); }
+    result += out.slice(at, span.start) + placeholder(entry.n);
+    at = span.end;
+  }
+  // Values found in this pass may occur again where a neighbouring match split
+  // them (two tokens with no delimiter); a second known-value pass closes that.
+  return { text: maskKnown(result + out.slice(at), known), added };
+}
+
+/** Longest first, so a value containing another is masked whole. A short value is masked only where a rule found it. */
+function maskKnown(text: string, known: readonly SecretEntry[]): string {
+  let out = text;
+  for (const entry of known.filter(entry => entry.value.length >= MIN_SECRET_LENGTH).sort((a, b) => b.value.length - a.value.length)) {
+    if (out.includes(entry.value)) out = out.split(entry.value).join(placeholder(entry.n));
+  }
+  return out;
+}
+
+/** The inverse of redactText for tool inputs. An unknown placeholder is left as written. */
+export function expandText(text: string, vault: Vault): string {
+  if (!text.includes("[[xeno-secret-")) return text;
+  return text.replace(PLACEHOLDER, (whole, n: string) => vault.find(entry => entry.n === Number(n))?.value ?? whole);
+}
+
+const ASKED_FOR_CREDENTIAL = /password|passcode|passphrase|credential|api[ _-]?key|access[ _-]?token|\btoken\b|密码|口令|密钥|凭据|凭证|令牌|验证码/i;
+
+/**
+ * A bare password has no shape; what identifies it is the exchange. A message
+ * that is a single token with mixed character classes, sent right after the
+ * assistant asked for a credential, is that credential (the 2026-10-12 ticket
+ * session: the assistant asked for a login password, the user replied with it).
+ */
+export function isSolicitedSecret(userText: string, previousAssistantText: string | undefined): boolean {
+  const value = userText.trim();
+  if (previousAssistantText === undefined || !ASKED_FOR_CREDENTIAL.test(previousAssistantText)) return false;
+  if (!/^\S{6,128}$/.test(value) || value.startsWith("[[xeno-secret-")) return false;
+  // Letters with digits, or three character classes: "dsm612566" and "Pa$$word"
+  // qualify, an identifier like "OPENAI_API_KEY" or a branch name does not.
+  const classes = [/[a-z]/, /[A-Z]/, /\d/, /[^A-Za-z0-9]/].filter(pattern => pattern.test(value)).length;
+  const lettersAndDigits = /[A-Za-z]/.test(value) && /\d/.test(value);
+  return (lettersAndDigits || classes >= 3) && !/^[a-z]+:\/\//i.test(value) && !/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(value);
+}
+
+/** Applies `redact` to every string in a JSON value, preserving its shape. */
+export function mapStrings(value: unknown, redact: (text: string) => string, skip: (key: string) => boolean = () => false): unknown {
+  if (typeof value === "string") return redact(value);
+  if (Array.isArray(value)) return value.map(item => mapStrings(item, redact, skip));
+  if (value !== null && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(value)) out[key] = skip(key) ? item : mapStrings(item, redact, skip);
+    return out;
+  }
+  return value;
+}
+
+/** Environment variables whose names say they hold a secret; their values are masked wherever they appear. */
+export function secretEnvironmentValues(env: Readonly<Record<string, string | undefined>>): { value: string; rule: string }[] {
+  return Object.entries(env).flatMap(([name, value]) =>
+    value !== undefined && value.length >= MIN_SECRET_LENGTH && !value.startsWith("/") &&
+      /(?:^|_)(?:API_?KEY|KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIALS?|AUTH)(?:_|$)/i.test(name) &&
+      !/(?:^|_)(?:PATH|DIR|FILE|URL|HOST|PORT|USER|NAME|ID|MODE|TYPE)$/i.test(name)
+      ? [{ value, rule: `env:${name}` }] : []).sort((a, b) => a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0);
+}

package/src/core/stop-report.ts

@@ -8,7 +8,11 @@ export function stopReport(events: readonly LogEvent[], requests: number, limit:
   const scoped = currentRequestEvents(events);
   const current = scoped.length > 0 ? scoped : events;
   const results = current.filter(event => event.t === "tool_result");
-  const failures = results.filter(event => !event.ok);
+  // Q.22 keeps ok:false on a recorded-but-unverified claim so the model does
+  // not read "recorded" as "done"; to a person reading why work stopped it is
+  // an unproven statement, not a broken tool.
+  const unverified = results.filter(unverifiedClaim);
+  const failures = results.filter(event => !event.ok && !unverifiedClaim(event));
   const exits = results.filter(event => event.effect?.kind === "command" && event.effect.exit === 0).length;
   const ids = new Set<number>();
   for (const event of current) {
@@ -17,8 +21,8 @@ export function stopReport(events: readonly LogEvent[], requests: number, limit:
   }
   const running = [...ids].filter(id => latestProcessReceipt([{ node: 0, events: current }], id)?.receipt.running === true);
   return [
-    `Stopped: ${exitLine(cause)} (${limit === Infinity ? requests : `${requests}/${limit}`} model requests).`,
-    `Recorded evidence: ${results.length} tool receipts; ${exits} successful command exits; ${failures.length} failed tool receipts. Task completion is not verified by this stop.`,
+    requestLine(exitLine(cause), requests, limit),
+    `Recorded evidence: ${results.length} tool receipts; ${exits} successful command exits; ${failures.length} failed tool receipts${unverified.length ? `; ${unverified.length} unverified claims` : ""}. Task completion is not verified by this stop.`,
     ...(failures.length ? [`Failed tools: ${failedTools(current, failures)}.`] : []),
     ...(finalReplyGiven(current) ? ["A final reply was given before this stop; read it above — this stop does not mark it wrong."] : []),
     ...(running.length ? [`Last observed running: ${running.slice(0, 3).join(", ")}${running.length > 3 ? ` (+${running.length - 3})` : ""}; inspect the process receipt before replaying a command.`] : []),
@@ -26,6 +30,16 @@ export function stopReport(events: readonly LogEvent[], requests: number, limit:
   ].join("\n");
 }
 
+/**
+ * S.6 removed the default cap. A bare "(80 model requests)" in the same
+ * brackets as "(3/7 model requests)" read as a ceiling that was hit
+ * (fix-stop-report-request-count), so an uncapped run says it is a count.
+ */
+function requestLine(cause: string, requests: number, limit: number): string {
+  if (limit !== Infinity) return `Stopped: ${cause} (${requests}/${limit} model requests).`;
+  return `Stopped: ${cause}. This request sent ${requests} model request${requests === 1 ? "" : "s"}; no request cap is set.`;
+}
+
 /**
  * The user reads this line; no command looks a receipt up by id, so ids told
  * them nothing (fix-stop-report-readable). Tool names say where it went wrong.
@@ -39,6 +53,14 @@ function failedTools(events: readonly LogEvent[], failures: readonly Extract<Log
   return ranked.slice(0, 3).map(([name, count]) => `${name} ×${count}`).join(", ") + (ranked.length > 3 ? ` (+${ranked.length - 3} more)` : "");
 }
 
+function unverifiedClaim(event: Extract<LogEvent, { t: "tool_result" }>): boolean {
+  if (event.ok || !event.content.startsWith("{")) return false;
+  try {
+    const body = JSON.parse(event.content) as { recorded?: unknown; verification?: unknown };
+    return body.recorded === true && body.verification === "unverified";
+  } catch { return false; }
+}
+
 /** A stop after the model already answered must not read as "the task failed". */
 function finalReplyGiven(events: readonly LogEvent[]): boolean {
   return events.some(event => event.t === "assistant" && !event.blocks.some(block => block.type === "tool_use") &&

package/src/core/tool-failure.ts

@@ -27,10 +27,18 @@ const guidance: Record<ToolDiagnostic["code"], string> = {
  * policy change is required") would send the model to ask for a setting that
  * does not exist -- which is what a real session did before this text.
  */
-export const STATE_PATH_GUIDANCE = "This path is repository or xeno session state, which edit tools never change; no setting changes this. " +
+/*
+ * The diagnostic code stays permission_denied because codes are a closed set
+ * validated on every logged tool_result (event-validation.ts); a new code
+ * would change the session format. A model still read that code as "wait for
+ * approval" and stopped (Horizyn mv3nsske), so the text has to say outright
+ * that approval is neither needed nor able to help.
+ */
+const STATE_PATH_RULE = "This path is repository or xeno session state, which edit tools never change. " +
+  "This is not a permission problem and no setting changes this: no user approval allows it, so do not wait for one. ";
+export const STATE_PATH_GUIDANCE = STATE_PATH_RULE +
   "To work in an isolated checkout, use the worktree tool instead of creating one under .git or .xeno.";
-const STATE_PATH_GUIDANCE_WITHOUT_WORKTREE = "This path is repository or xeno session state, which edit tools never change; no setting changes this. " +
-  "Edit files outside .git and .xeno.";
+const STATE_PATH_GUIDANCE_WITHOUT_WORKTREE = STATE_PATH_RULE + "Edit files in a directory outside .git and .xeno.";
 
 export function failureDiagnostic(code: ToolDiagnostic["code"], message: string, facts: FailureFacts,
   extra: Pick<ToolDiagnostic, "recover" | "example" | "next"> = {}): ToolDiagnostic {

package/src/core/transcript.ts

@@ -81,6 +81,9 @@ export function projectTranscript(events: readonly LogEvent[], entryTypes: Reado
       case "goal": items.push({ ...identity, kind: "notice", text: event.action === "set"
         ? `Goal set · ${event.accepted.length} accepted${event.rejected.length ? `, ${event.rejected.length} rejected` : ""} · ${event.objective}`
         : event.reason === "met" ? "Goal met · every accepted criterion has current evidence" : "Goal cleared" }); break;
+      // Approvals answer "why was this allowed" in /export and history; the person
+      // already saw the prompt, and a notice per auto-allowed command would bury the chat.
+      case "approval":
       case "checkpoint": case "workspace_observation":
       case "guidance": case "claim": case "decision": case "pitfall": case "blocked": case "question": case "next_action": case "work_status": case "work_owner": case "work_dependencies": case "evidence_link":
         // These remain inspectable via /state and /export; they are not chat messages.