@webpresso/agent-kit 3.3.3 → 3.3.4

package/dist/esm/hooks/pretool-guard/rtk-rewrite.js

@@ -0,0 +1,50 @@
+/**
+ * RTK rewrite inside path-stable pretool-guard (no freestanding consumer hook).
+ *
+ * v1: exact `git status` → `<managed-rtk> git status` when managed rtk is available.
+ */
+import { isManagedRtkAvailable, resolveManagedRtkExecutable } from "#tool-runtime/managed-rtk.js";
+const UNCERTAIN_SHELL_RE = /[\n\r|;&<>`$(){}[\]\\'"#*?]/u;
+/**
+ * Decide whether to rewrite a Bash command through managed rtk.
+ */
+export function decideRtkRewrite(command, isRtkPresent = isManagedRtkAvailable, resolveExecutable = resolveManagedRtkExecutable) {
+    if (command !== command.trim() || command.length === 0) {
+        return { action: "noop", reason: "uncertain-parse" };
+    }
+    if (UNCERTAIN_SHELL_RE.test(command)) {
+        return { action: "noop", reason: "uncertain-parse" };
+    }
+    // already managed absolute path or bare rtk prefix
+    if (command.startsWith("rtk ") || command.includes("/rtk ")) {
+        return { action: "noop", reason: "already-rtk" };
+    }
+    if (command !== "git status") {
+        return { action: "noop", reason: "not-eligible" };
+    }
+    if (!isRtkPresent()) {
+        return { action: "noop", reason: "rtk-missing" };
+    }
+    const executable = resolveExecutable();
+    if (!executable) {
+        return { action: "noop", reason: "rtk-missing" };
+    }
+    const bin = shellQuoteExecutable(executable);
+    if (!bin) {
+        return { action: "noop", reason: "rtk-missing" };
+    }
+    return { action: "rewrite", command: `${bin} git status` };
+}
+/**
+ * POSIX single-quote wrap for absolute managed paths.
+ * Refuse NUL/newline/single-quote — those cannot be safely embedded in `'…'`.
+ * Double-quote wrapping is intentionally avoided ($ / ` / " injection).
+ */
+export function shellQuoteExecutable(path) {
+    if (path.length === 0 || /[\0\n\r']/.test(path))
+        return null;
+    // Unquoted only for the common managed-cache shape (no shell metacharacters).
+    if (/^[A-Za-z0-9_./:@+=,-]+$/.test(path))
+        return path;
+    return `'${path}'`;
+}

package/dist/esm/hooks/pretool-guard/runner.js

@@ -11,6 +11,7 @@ import { VALIDATORS } from "./validators/index.js";
 import { isDirectEntrypoint } from "#hooks/shared/direct-entrypoint";
 import { optimizeToolInput, } from "./optimization.js";
 import { recordOptimizationEvent } from "./optimization-events.js";
+import { decideRtkRewrite } from "./rtk-rewrite.js";
 const RED = "\x1b[31m";
 const YELLOW = "\x1b[33m";
 const DIM = "\x1b[2m";
@@ -256,6 +257,11 @@ export function processValidation(inputJson, options = {}) {
         process.exit(2);
     }
     if (command) {
+        const rtkRewrite = decideRtkRewrite(command);
+        if (rtkRewrite.action === "rewrite") {
+            writeUpdatedInput(input, rtkRewrite.command);
+            process.exit(0);
+        }
         const originalAction = routeCommand(command)?.action ?? { action: "passthrough" };
         const optimization = optimizeToolInput(input, originalAction, options.optimizationRules);
         if (optimization.action === "rewrite") {

package/dist/esm/hooks/status/index.js

@@ -109,7 +109,7 @@ function hasValidCodexPluginArtifacts(repoRoot) {
     const hookMap = hooks?.hooks;
     return (plugin?.mcpServers === "./.mcp.json" &&
         plugin.hooks === "./hooks/hooks.json" &&
-        serverRecord?.command === "${PLUGIN_ROOT}/bin/wp" &&
+        serverRecord?.command === "wp" &&
         stringArrayEquals(serverRecord.args, ["mcp"]) &&
         hookMap !== null &&
         typeof hookMap === "object" &&

package/dist/esm/mcp/blueprint/_shared/lifecycle.js

@@ -94,21 +94,49 @@ export async function applyLocalBlueprintTransition(input) {
     mkdirSync(path.dirname(found.shape === "flat" ? destination.flat : destination.directory), {
         recursive: true,
     });
+    const sourcePath = found.shape === "flat" ? overviewPath : found.dir;
+    const destinationPath = found.shape === "flat" ? destination.flat : destination.directory;
     let finalOverviewPath = overviewPath;
+    let renamed = false;
     if (found.state !== to_state) {
         const { renameSync } = await import("node:fs");
-        renameSync(found.shape === "flat" ? overviewPath : found.dir, found.shape === "flat" ? destination.flat : destination.directory);
+        renameSync(sourcePath, destinationPath);
+        renamed = true;
         finalOverviewPath = found.shape === "flat" ? destination.flat : destination.folder;
     }
-    writeFileAtomic(finalOverviewPath, updated, "utf8");
-    await reIngest(projectCwd);
-    const refreshed = getCurrentProjectBlueprint(projectCwd, slug);
-    if (!refreshed.blueprint) {
-        throw new Error(`Blueprint "${slug}" did not appear in the projection after transition`);
+    // Atomicity: everything from here on can still fail (re-ingest, projection
+    // lookup). The rename above may already have happened, and the frontmatter
+    // write below always happens before those checks run. Roll BOTH back
+    // before rethrowing so a failed transition never leaves the blueprint
+    // stranded in the destination lifecycle directory, nor leaves stale
+    // frontmatter (bumped last_updated/progress/status) on an otherwise
+    // unmoved file — either the transition fully lands (moved + content
+    // updated + re-ingested + visible in the projection) or the working tree
+    // is restored to exactly what it was before this call.
+    try {
+        writeFileAtomic(finalOverviewPath, updated, "utf8");
+        await reIngest(projectCwd);
+        const refreshed = getCurrentProjectBlueprint(projectCwd, slug);
+        if (!refreshed.blueprint) {
+            throw new Error(`Blueprint "${slug}" did not appear in the projection after transition`);
+        }
+        return {
+            blueprint: refreshed.blueprint,
+            overviewPath: finalOverviewPath,
+            fromState: found.state,
+        };
+    }
+    catch (error) {
+        try {
+            if (renamed) {
+                const { renameSync } = await import("node:fs");
+                renameSync(destinationPath, sourcePath);
+            }
+            writeFileAtomic(overviewPath, markdown, "utf8");
+        }
+        catch (rollbackError) {
+            throw new Error(`Transition to "${to_state}" failed and automatic rollback also failed; the blueprint may be left ${renamed ? `moved at ${destinationPath}` : "with partially-updated frontmatter"}. Original error: ${error instanceof Error ? error.message : String(error)}. Rollback error: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+        }
+        throw error;
     }
-    return {
-        blueprint: refreshed.blueprint,
-        overviewPath: finalOverviewPath,
-        fromState: found.state,
-    };
 }

package/dist/esm/mcp/blueprint/handlers/review-log.d.ts

@@ -2,13 +2,20 @@ import type { ProjectResolver } from "#project-resolver.js";
 import type { ToolHandlerResult } from "#mcp/auto-discover.js";
 /**
  * MCP wrapper around the SAME reviews.md-ledger writer `logReviewEntry` that
- * (an unwired) `wp review log` uses, plus the matching frontmatter `approvals:`
- * entry that `collectTrackedReviewProvenance` (the promotion approval gate)
- * actually reads. This is the tracked/frontmatter provenance path — the same
- * trust model a hand-authored `approvals:` block already had (the reviewer id
- * is caller-asserted, verified only by the referenced artifact/reviews.md
- * entry being tracked in git) — this tool just makes that existing path
- * reachable from MCP instead of a raw Write/Edit or a Bash/python workaround.
+ * (an unwired) `wp review log` uses. For NON-approval verdicts it also appends
+ * the matching frontmatter `approvals:` entry, so rejection attribution stays
+ * visible where readers already look. This is the tracked/frontmatter provenance
+ * path — the same trust model a hand-authored `approvals:` block already had (the
+ * reviewer id is caller-asserted, verified only by the referenced
+ * artifact/reviews.md entry being tracked in git) — this tool just makes that
+ * existing path reachable from MCP instead of a raw Write/Edit or a Bash/python
+ * workaround.
+ *
+ * It never writes a POLICY-APPROVAL entry (approve / approve-with-nits) into
+ * frontmatter. `collectTrackedReviewProvenance` — the legacy promotion leg — only
+ * counts policy approvals and never reads or hashes the blueprint body, so such
+ * an entry would be gate authority that survives an arbitrary rewrite of the
+ * plan. See `LEGACY_APPROVAL_LEG_ANCHOR_COMMIT` in `#lifecycle/rollout-anchor.js`.
  *
  * A policy-approval verdict (approve / approve-with-nits) REQUIRES
  * reviewer==="human" — matching `logReviewEvent`'s existing v2-ledger

package/dist/esm/mcp/blueprint/handlers/review-log.js

@@ -30,13 +30,20 @@ const reviewLogSchema = z.object({
 });
 /**
  * MCP wrapper around the SAME reviews.md-ledger writer `logReviewEntry` that
- * (an unwired) `wp review log` uses, plus the matching frontmatter `approvals:`
- * entry that `collectTrackedReviewProvenance` (the promotion approval gate)
- * actually reads. This is the tracked/frontmatter provenance path — the same
- * trust model a hand-authored `approvals:` block already had (the reviewer id
- * is caller-asserted, verified only by the referenced artifact/reviews.md
- * entry being tracked in git) — this tool just makes that existing path
- * reachable from MCP instead of a raw Write/Edit or a Bash/python workaround.
+ * (an unwired) `wp review log` uses. For NON-approval verdicts it also appends
+ * the matching frontmatter `approvals:` entry, so rejection attribution stays
+ * visible where readers already look. This is the tracked/frontmatter provenance
+ * path — the same trust model a hand-authored `approvals:` block already had (the
+ * reviewer id is caller-asserted, verified only by the referenced
+ * artifact/reviews.md entry being tracked in git) — this tool just makes that
+ * existing path reachable from MCP instead of a raw Write/Edit or a Bash/python
+ * workaround.
+ *
+ * It never writes a POLICY-APPROVAL entry (approve / approve-with-nits) into
+ * frontmatter. `collectTrackedReviewProvenance` — the legacy promotion leg — only
+ * counts policy approvals and never reads or hashes the blueprint body, so such
+ * an entry would be gate authority that survives an arbitrary rewrite of the
+ * plan. See `LEGACY_APPROVAL_LEG_ANCHOR_COMMIT` in `#lifecycle/rollout-anchor.js`.
  *
  * A policy-approval verdict (approve / approve-with-nits) REQUIRES
  * reviewer==="human" — matching `logReviewEvent`'s existing v2-ledger
@@ -143,22 +150,39 @@ export async function handleReviewLog(projectResolver, cwd, raw) {
             ...(rev ? { rev } : {}),
             ...(note ? { note } : {}),
         });
-        const overviewRaw = readFileSync(found.path, "utf8");
-        const parsed = matter(overviewRaw);
-        const existingApprovals = Array.isArray(parsed.data.approvals) ? parsed.data.approvals : [];
-        const approvalEntry = {
-            reviewer: entry.reviewer,
-            verdict: entry.verdict,
-            evidence: entry.evidence ?? "reviews.md",
-            artifact: entry.artifact ?? normalizedArtifactPath,
-            ...(entry.commit ? { commit: entry.commit } : {}),
-            ...(entry.rev ? { rev: entry.rev } : {}),
-        };
-        const updatedData = { ...parsed.data, approvals: [...existingApprovals, approvalEntry] };
-        const rendered = matter.stringify(parsed.content, updatedData);
-        writeFileAtomic(found.path, rendered, { encoding: "utf8" });
+        // Policy-approval verdicts are NOT projected into frontmatter `approvals:`.
+        // That field feeds `collectTrackedReviewProvenance`, the legacy promotion leg
+        // that carries no content binding at all: it matches a reviews.md record and
+        // a tracked artifact but never reads or hashes the blueprint body, and the
+        // gate supplies no `targetHash`. Writing an approval there would mint
+        // authority that survives an arbitrary rewrite of the plan. Non-approval
+        // verdicts (reject / no-verdict) are still recorded, because the legacy leg
+        // only ever counts policy approvals -- they are attribution, never authority.
+        //
+        // Nothing is lost: the approval is fully recorded in reviews.md and in the
+        // tracked artifact. Satisfying the promotion gate still requires a converged
+        // `wp review gate` run (content-addressed v2 ledger) or `wp review override`.
+        const mintsGateAuthority = isPolicyApprovalVerdict(entry.verdict);
+        if (!mintsGateAuthority) {
+            const overviewRaw = readFileSync(found.path, "utf8");
+            const parsed = matter(overviewRaw);
+            const existingApprovals = Array.isArray(parsed.data.approvals) ? parsed.data.approvals : [];
+            const approvalEntry = {
+                reviewer: entry.reviewer,
+                verdict: entry.verdict,
+                evidence: entry.evidence ?? "reviews.md",
+                artifact: entry.artifact ?? normalizedArtifactPath,
+                ...(entry.commit ? { commit: entry.commit } : {}),
+                ...(entry.rev ? { rev: entry.rev } : {}),
+            };
+            const updatedData = { ...parsed.data, approvals: [...existingApprovals, approvalEntry] };
+            const rendered = matter.stringify(parsed.content, updatedData);
+            writeFileAtomic(found.path, rendered, { encoding: "utf8" });
+        }
         return finishPayload({
-            summary: `Logged review ${entry.id} -> ${entry.blueprintSlug} and recorded approvals frontmatter`,
+            summary: mintsGateAuthority
+                ? `Logged review ${entry.id} -> ${entry.blueprintSlug} in reviews.md (no frontmatter approval recorded: an approval verdict must bind to reviewed content via wp review gate)`
+                : `Logged review ${entry.id} -> ${entry.blueprintSlug} and recorded approvals frontmatter`,
             event_id: entry.id,
             blueprint_slug: entry.blueprintSlug,
             reviewer: entry.reviewer,

package/dist/esm/mcp/blueprint/registration.js

@@ -289,7 +289,7 @@ export async function registerBlueprintTools(registrar, cwd, projectResolver = c
             next_action: nextActionOutputSchema,
         },
     }, (r) => handleTaskVerify(projectResolver, cwd, r), { title: "Blueprint Task Verify", destructiveHint: false, openWorldHint: false });
-    registrar.registerTool("wp_blueprint_review_log", 'Record a tracked review-ledger entry for a blueprint: writes the given artifact content under blueprints/<state>/<slug>/review-artifacts/, appends the matching structured entry to reviews.md (via the same logReviewEntry writer, distinct from the CLI\'s own `wp review log` subcommand), and appends the corresponding `approvals:` frontmatter entry to _overview.md that the legacy promotion approval path (`collectTrackedReviewProvenance`) reads. A `verdict` of approve or approve-with-nits REQUIRES reviewer="human" — this tool cannot mint a claude/codex/grok/OpenCode-Go frontmatter approval; satisfying the strong-reviewer promotion gate still requires either a converged `wp review gate` run or a maintainer directly authoring that frontmatter. Use this tool for reject/no-verdict entries from any reviewer, or a human-adjudicated approve/approve-with-nits — including the audit-trail note when `wp review gate` fails to converge. Returns { event_id, blueprint_slug, reviewer, verdict, status, artifact_path }.', {
+    registrar.registerTool("wp_blueprint_review_log", 'Record a tracked review-ledger entry for a blueprint: writes the given artifact content under blueprints/<state>/<slug>/review-artifacts/ and appends the matching structured entry to reviews.md (via the same logReviewEntry writer, distinct from the CLI\'s own `wp review log` subcommand). For reject/no-verdict it ALSO appends the corresponding `approvals:` frontmatter entry to _overview.md, so rejection attribution stays visible. It NEVER writes an approve/approve-with-nits entry into `approvals:`: that field feeds the legacy promotion path (`collectTrackedReviewProvenance`), which never reads or hashes the blueprint body, so an approval recorded there would keep satisfying the gate after the plan was rewritten. A `verdict` of approve or approve-with-nits additionally REQUIRES reviewer="human". Satisfying the promotion gate requires a converged `wp review gate` run (content-addressed v2 ledger) or `wp review override`. Use this tool for reject/no-verdict entries from any reviewer, or to record a human-adjudicated approve/approve-with-nits in reviews.md — including the audit-trail note when `wp review gate` fails to converge. Returns { event_id, blueprint_slug, reviewer, verdict, status, artifact_path }.', {
         type: "object",
         properties: {
             project_id: { type: "string" },

package/dist/esm/mcp/tools/_shared/redact.d.ts

@@ -1 +1,23 @@
+/**
+ * Redaction for the shared read-only MCP path (`wp_pr_status`, `wp_pr_wait`,
+ * `wp_run_wait` error tails, `_readonly-ops`, worker tails, hook logs — 11
+ * consumers). Output reaches agent context, session memory, and committed
+ * review artifacts in a public repository, so a credential surviving here is
+ * irreversible and externally exploitable.
+ *
+ * Three properties are load-bearing; changing any of them breaks a consumer:
+ *
+ * 1. {@link mask} is **partial disclosure by design** — first and last two
+ *    characters survive above six, and the mask is deterministic.
+ *    `run-wait.ts` redacts both sides of its SHA comparison and relies on
+ *    identical input producing identical output.
+ * 2. The generic 40+-character rule masks full commit SHAs as a side effect,
+ *    compensated downstream by that same mask-aware equality. Do not "fix" it
+ *    here without updating those consumers.
+ * 3. **Every quantifier is bounded.** Callers pass unbounded log text —
+ *    `run-wait.ts` redacts the whole tail *before* clipping it to 2000 bytes —
+ *    so an unbounded `[A-Za-z0-9_]*` around a keyword alternation backtracks
+ *    quadratically and a hostile CI log can stall the MCP path for tens of
+ *    seconds. Keep the `{0,64}` bounds.
+ */
 export declare function redactText(value: string | undefined): string | undefined;

package/dist/esm/mcp/tools/_shared/redact.js

@@ -1,22 +1,128 @@
-const KEY_PATTERNS = [
-    /\b(?:GH_PACKAGES_TOKEN|GITHUB_TOKEN|GITHUB_PAT|NEON_API_KEY(?:_PLATFORM)?|CHEF_CI_TOKEN)\b\s*=\s*([^\s]+)/giu,
+/**
+ * Redaction for the shared read-only MCP path (`wp_pr_status`, `wp_pr_wait`,
+ * `wp_run_wait` error tails, `_readonly-ops`, worker tails, hook logs — 11
+ * consumers). Output reaches agent context, session memory, and committed
+ * review artifacts in a public repository, so a credential surviving here is
+ * irreversible and externally exploitable.
+ *
+ * Three properties are load-bearing; changing any of them breaks a consumer:
+ *
+ * 1. {@link mask} is **partial disclosure by design** — first and last two
+ *    characters survive above six, and the mask is deterministic.
+ *    `run-wait.ts` redacts both sides of its SHA comparison and relies on
+ *    identical input producing identical output.
+ * 2. The generic 40+-character rule masks full commit SHAs as a side effect,
+ *    compensated downstream by that same mask-aware equality. Do not "fix" it
+ *    here without updating those consumers.
+ * 3. **Every quantifier is bounded.** Callers pass unbounded log text —
+ *    `run-wait.ts` redacts the whole tail *before* clipping it to 2000 bytes —
+ *    so an unbounded `[A-Za-z0-9_]*` around a keyword alternation backtracks
+ *    quadratically and a hostile CI log can stall the MCP path for tens of
+ *    seconds. Keep the `{0,64}` bounds.
+ */
+/** Key-name fragments that advertise a secret. */
+const SECRET_WORD = "PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?";
+/**
+ * Optional opening quote OUTSIDE the capture, then the value up to the first
+ * closing delimiter.
+ *
+ * Both halves matter. Excluding quotes from the class stops a greedy capture
+ * pulling the closing quote into the mask (`sk***6"` instead of `sk***56`).
+ * Consuming an optional *opening* quote is what keeps `KEY="secret"` matching
+ * at all — omitting it makes the `+` match zero characters, the pattern fail,
+ * and the most common real-world shape (quoted shell/JSON/YAML values) sail
+ * through completely unredacted.
+ */
+// `\x60` is the backtick: a literal one cannot appear inside a String.raw
+// template, and `\`` is an invalid escape under the `u` flag.
+const QUOTED_VALUE = String.raw `["'\x60]?([^\s"'\x60,;)\]}\[]+)`;
+/** As above, with a length floor — see the `:` rule below. */
+const QUOTED_VALUE_LONG = String.raw `["'\x60]?([^\s"'\x60,;)\]}\[]{12,})`;
+/**
+ * Optional closing quote on the KEY, before the separator. JSON and quoted-key
+ * YAML put it there — `{"password":"…"}` — and without this the separator match
+ * fails on the key's own closing quote and the whole line sails through.
+ */
+const KEY_CLOSE = String.raw `["']?[ \t]*`;
+/**
+ * Credential value for the keyword rules (`Bearer`, `Basic`, `Cookie`), which
+ * carry no assignment signal at all — and whose keywords are ordinary English
+ * words. Without a floor, `Basic checks passed` becomes
+ * `Basic [REDACTED] passed`, and that reaches users: `pr-upsert.ts` pushes PR
+ * **titles** through this function, so "Add Bearer token support" would render
+ * corrupted.
+ *
+ * So the value must be ≥12 characters AND contain at least one uppercase
+ * letter, digit or base64 punctuation — enough to separate `dXNlcjpwYXNzd29yZA==`
+ * from `authentication`.
+ *
+ * The keyword rules therefore drop the `i` flag and spell each casing out.
+ * Under `i`, `[A-Z]` also matches lowercase, so this lookahead would be
+ * silently satisfied by any long lowercase word and the check would do nothing.
+ */
+const KEYWORD_CRED = String.raw `["'\x60]?((?:(?=[^\s"'\x60,;)\]}\[]*[A-Z0-9+/=_-])[^\s"'\x60,;)\]}\[]{12,}|[^\s"'\x60,;)\]}\[]{24,}))`;
+/**
+ * Patterns whose **first capture group** is the secret. Only that group is
+ * masked, so the header name, config key or URL host stays readable — a
+ * redactor that destroys the line it protects gets routed around.
+ */
+const CAPTURING_PATTERNS = [
+    // Originally-named credential env assignments.
+    new RegExp(String.raw `\b(?:GH_PACKAGES_TOKEN|GITHUB_TOKEN|GITHUB_PAT|NEON_API_KEY(?:_PLATFORM)?|CHEF_CI_TOKEN)\b` +
+        KEY_CLOSE +
+        String.raw `=[ \t]*` +
+        QUOTED_VALUE, "giu"),
+    // Generic secret-named key with `=`. Assignment is an unambiguous signal, so
+    // no length floor: `PASSWORD=x` should mask even when short.
+    new RegExp(String.raw `\b[A-Za-z0-9_]{0,64}(?:${SECRET_WORD})[A-Za-z0-9_]{0,64}` +
+        KEY_CLOSE +
+        String.raw `=[ \t]*` +
+        QUOTED_VALUE, "giu"),
+    // Generic secret-named key with `:`. Deliberately stricter than `=`, because
+    // `:` is overloaded across YAML, tables, markdown and plain prose — without a
+    // floor this masks `tokens: 512`, `secret: true`, `credentials: verified for
+    // 3 users` and `**Token:** an opaque handle`, corrupting ordinary CI output.
+    // A 12-character floor admits real secrets while excluding those.
+    new RegExp(String.raw `\b[A-Za-z0-9_]{0,64}(?:${SECRET_WORD})[A-Za-z0-9_]{0,64}` +
+        KEY_CLOSE +
+        String.raw `:[ \t]*` +
+        QUOTED_VALUE_LONG, "giu"),
+    // `Authorization: Bearer <token>` / bare `Bearer <token>`. Casings spelled
+    // out because `KEYWORD_CRED`'s lookahead is case-sensitive by necessity.
+    new RegExp(String.raw `\b(?:Bearer|bearer|BEARER)\s+` + KEYWORD_CRED, "gu"),
+    // `Authorization: Basic <base64>` — same header family, and the base64 is
+    // usually under the generic 40-character floor.
+    new RegExp(String.raw `\b(?:Basic|basic|BASIC)\s+` + KEYWORD_CRED, "gu"),
+    // Session cookies: the cookie NAME (`session`, `sid`) never matches a
+    // secret-word rule, so the value needs its own case or session tokens ride
+    // through CI and proxy logs intact. Anchoring on `name=` both avoids matching
+    // prose after a bare `Cookie:` and keeps the cookie name readable in output.
+    new RegExp(String.raw `\b(?:Set-|set-|SET-)?(?:Cookie|cookie|COOKIE)\s*:\s*[^\s=;]{1,64}=` + KEYWORD_CRED, "gu"),
+    // Credential-bearing URL userinfo: `https://user:pass@host/…`. Masking the
+    // whole userinfo keeps the host, which is what makes the log useful.
+    /:\/\/([^\s/@]+)@/gu,
 ];
-const TOKEN_PATTERNS = [
+/** Patterns where the entire match is the secret. */
+const WHOLE_MATCH_PATTERNS = [
     /\bghp_[A-Za-z0-9]{20,}\b/gu,
     /\b(?:cf|sk|tok)_[A-Za-z0-9_-]{16,}\b/gu,
+    // JWTs, whose segments routinely fall under the generic 40-character floor.
+    /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/gu,
     /\b[A-Za-z0-9+/_-]{40,}\b/gu,
 ];
 export function redactText(value) {
     if (!value)
         return value;
     let output = value;
-    for (const pattern of KEY_PATTERNS) {
-        output = output.replace(pattern, (whole, token) => {
-            const trimmed = String(token ?? "").trim();
-            return whole.includes("=") ? whole.replace(trimmed, mask(trimmed)) : mask(trimmed);
+    for (const pattern of CAPTURING_PATTERNS) {
+        output = output.replace(pattern, (whole, secret) => {
+            const trimmed = String(secret ?? "").trim();
+            if (trimmed.length === 0)
+                return whole;
+            return whole.replace(trimmed, mask(trimmed));
         });
     }
-    for (const pattern of TOKEN_PATTERNS) {
+    for (const pattern of WHOLE_MATCH_PATTERNS) {
         output = output.replace(pattern, (token) => mask(token));
     }
     return output;

package/dist/esm/mcp/tools/gain.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { resolveManagedRtkExecutable } from "#tool-runtime/managed-rtk.js";
 import { createSummaryOutputSchema, createSummaryResult } from "./_shared/result.js";
 import { readonlyOpsBaseSchema, resolveReadonlyCwd, runReadonlyCommand } from "./_readonly-ops.js";
 const inputSchema = readonlyOpsBaseSchema
@@ -19,8 +20,12 @@ const outputSchema = createSummaryOutputSchema({
     }),
 });
 function commandFor(input) {
-    if (input.source === "rtk")
-        return { command: "rtk", args: ["gain", "--format", "json"] };
+    if (input.source === "rtk") {
+        const rtkBin = resolveManagedRtkExecutable();
+        if (!rtkBin)
+            return null;
+        return { command: rtkBin, args: ["gain", "--format", "json"] };
+    }
     return { command: "./bin/wp", args: input.sessions ? ["gain", "--sessions"] : ["gain"] };
 }
 const tool = {
@@ -39,6 +44,27 @@ const tool = {
         const input = inputSchema.parse(raw ?? {});
         const cwd = resolveReadonlyCwd(input);
         const command = commandFor(input);
+        if (command === null) {
+            return createSummaryResult({
+                passed: false,
+                summary: "managed RTK not available (wp setup --with rtk or WP_RTK_BIN)",
+                exitCode: 1,
+                counts: { commandCount: 0, passedCount: 0, failedCount: 1 },
+                details: {
+                    cwd,
+                    source: input.source,
+                    format: input.format,
+                    sessions: input.sessions,
+                    command: {},
+                    result: { error: "managed_rtk_missing" },
+                },
+                rawOutput: "",
+                truncated: false,
+                timedOut: false,
+                aborted: false,
+                warnings: ["managed RTK binary missing"],
+            });
+        }
         const result = await runReadonlyCommand("gain", command.command, command.args, {
             cwd,
             timeoutMs: input.timeoutMs,

package/dist/esm/mcp/tools/worktree.js

@@ -15,6 +15,7 @@ import { gitBranchExists, listEntries, resolveNewWorktreeTarget, resolveWorktree
 import { deriveRepoNamespace, resolveKnownManagedWorktreeRoots, resolveWorktreeRoot, } from "#worktrees/location.js";
 import { readRepoOriginUrl, repoManagedRoot } from "#worktrees/manager.js";
 import { buildWorktreeInventory, canonicalizeWorktreePath, isManagedWorktreePath, resolveRepoIdentity, } from "#worktrees/identity.js";
+import { isStaleWorktreeRegistration, pruneStaleGitWorktreeMetadata, } from "#worktrees/git-metadata.js";
 import { findRegistryCandidatesByPath, pruneStaleWorktreeRegistryEntries, removeWorktreeRegistryEntries, repoScopedPathPredicate, upsertWorktreeRegistryEntry, } from "#worktrees/registry.js";
 const ACTIONS = ["list", "root", "new", "remove", "prune", "refresh"];
 const MUTATING_ACTIONS = new Set(["new", "remove", "prune", "refresh"]);
@@ -105,6 +106,53 @@ function isRegisteredManagedWorktree(resolvedPath, _context) {
     // a legacy-root worktree registered by an earlier binary authorizes removal.
     return findRegistryCandidatesByPath(canonicalizeWorktreePath(resolvedPath)).length > 0;
 }
+/**
+ * A stale registration may already have lost its registry entry to an earlier
+ * prune, so registration alone cannot gate reconciling it. Fall back to the
+ * managed-root boundary, which still keeps unmanaged worktrees protected.
+ */
+function isRemovableManagedTarget(resolved, context, stale) {
+    if (isRegisteredManagedWorktree(resolved, context))
+        return true;
+    if (!stale)
+        return false;
+    return isManagedWorktreePath(canonicalizeWorktreePath(resolved), resolveKnownManagedWorktreeRoots());
+}
+/** Reconcile git + registry for a worktree whose directory is already gone. */
+function clearStaleRegistration(input, repoRoot, resolved, entries, entry) {
+    const gitPruned = pruneStaleGitWorktreeMetadata(repoRoot, entries);
+    if (gitPruned.error) {
+        return {
+            passed: false,
+            summary: `wp_worktree remove failed: git worktree prune failed: ${gitPruned.error}`,
+            action: input.action,
+            executed: false,
+            warnings: ["git_worktree_prune_failed"],
+            nextAction: "Inspect the repository's git worktree admin records and retry.",
+        };
+    }
+    const warnings = [];
+    try {
+        removeWorktreeRegistryEntries(repoScopedPathPredicate(resolved, { authoritativeRepoKey: resolveRepoIdentity(repoRoot) }));
+    }
+    catch {
+        warnings.push("registry_cleanup_failed");
+    }
+    return {
+        passed: true,
+        summary: `Cleared stale worktree registration ${resolved} (directory already gone)`,
+        action: input.action,
+        executed: true,
+        removed: {
+            path: resolved,
+            ...(entry?.branch ? { branch: entry.branch.replace("refs/heads/", "") } : {}),
+        },
+        warnings,
+        ...(warnings.includes("registry_cleanup_failed")
+            ? { nextAction: "Run wp_worktree prune with execute:true to repair stale registry metadata." }
+            : {}),
+    };
+}
 function refreshManagedEntries(repoRoot) {
     const { originUrl, repoNamespace } = managedContext(repoRoot);
     const knownRoots = resolveKnownManagedWorktreeRoots();
@@ -234,6 +282,7 @@ function handleRemove(input, repoRoot) {
     }
     const entry = entries.find((candidate) => candidate.path === resolved);
     const context = managedContext(repoRoot);
+    const stale = isStaleWorktreeRegistration(entry, resolved, existsSync);
     if (resolved === repoRoot) {
         return {
             passed: false,
@@ -243,7 +292,7 @@ function handleRemove(input, repoRoot) {
             warnings: ["main_checkout_protected"],
         };
     }
-    if (!isRegisteredManagedWorktree(resolved, context)) {
+    if (!isRemovableManagedTarget(resolved, context, stale)) {
         return {
             passed: false,
             summary: `wp_worktree remove refused: ${resolved} is not a registered managed worktree for this repository`,
@@ -263,6 +312,10 @@ function handleRemove(input, repoRoot) {
             nextAction: "Unlock the worktree explicitly with git after confirming it is safe, then retry.",
         };
     }
+    // Checked before the dirty gate: `git status` fails in a missing directory,
+    // which would otherwise be reported as "uncommitted changes".
+    if (stale)
+        return clearStaleRegistration(input, repoRoot, resolved, entries, entry);
     if (isDirty(resolved)) {
         return {
             passed: false,
@@ -368,6 +421,10 @@ const tool = {
                     warnings: [],
                 }, false);
             }
+            // Reconcile git's own admin records FIRST: a hand-deleted worktree
+            // directory leaves a record that still claims its branch, and it would
+            // otherwise read as live below and pin its registry entry in place too.
+            const gitPruned = pruneStaleGitWorktreeMetadata(repoRoot, listEntries(repoRoot));
             // Repository-scoped, three-state prune across every known root: only THIS
             // repo's entries proven stale against a COMPLETE git-live inventory drop;
             // unknown, other-repo, and live-legacy entries are retained. `existsSync`
@@ -377,12 +434,17 @@ const tool = {
                 inventory,
                 scope: { authoritativeRepoKey: resolveRepoIdentity(repoRoot) },
             });
+            const gitSummary = gitPruned.error
+                ? ""
+                : ` and ${gitPruned.prunedPaths.length} stale git worktree registration${gitPruned.prunedPaths.length === 1 ? "" : "s"}`;
             return result({
                 passed: true,
-                summary: `Pruned ${pruned.removed.length} stale managed registry entr${pruned.removed.length === 1 ? "y" : "ies"}`,
+                summary: `Pruned ${pruned.removed.length} stale managed registry entr${pruned.removed.length === 1 ? "y" : "ies"}${gitSummary}`,
                 action: input.action,
                 executed: true,
-                warnings: pruned.warnings,
+                warnings: gitPruned.error
+                    ? [...pruned.warnings, `git_worktree_prune_failed:${gitPruned.error}`]
+                    : pruned.warnings,
             }, false);
         }
         catch (error) {