@wenrwa/marketplace-cli 0.8.4 → 0.8.6

package/dist/bridge/relayClient.d.ts

@@ -1,21 +1,3 @@
-/**
- * ht-05 — Terminal Bridge relay mode (dial-out).
- *
- * Instead of listening on localhost for browser connections (server.ts),
- * this DIALS OUT to the platform relay over a single outbound wss
- * connection, authenticates with a per-container relay token, and serves
- * the same v1 frame protocol (see PROTOCOL.md) through the existing
- * SessionManager. Multi-session multiplexing is unchanged: every frame
- * already carries a sessionId, so one outbound socket serves every session
- * exactly like the local server serves them over N inbound sockets.
- *
- * PTYs live in the SessionManager, not the socket — a relay drop never
- * kills a session. This module owns only: dialing out, the auth frame,
- * frame routing through SessionManager, and reconnect-with-backoff. It
- * does no scrollback bookkeeping of its own (SessionManager already does
- * that) — on re-pair the pane sends `attach` again and gets a fresh
- * `replay`, exactly as it would against the local server.
- */
 import { type OpencodeLaunchInput } from './agentLaunch';
 import type { PreparedLaunch } from './opencodeBinary';
 import { SessionManager } from './sessionManager';

package/dist/bridge/relayClient.js

@@ -56,6 +56,7 @@ exports.startRelayClient = startRelayClient;
  * that) — on re-pair the pane sends `attach` again and gets a fresh
  * `replay`, exactly as it would against the local server.
  */
+const redact_1 = require("../secrets/redact");
 const agentLaunch_1 = require("./agentLaunch");
 const resumeDetector_1 = require("./resumeDetector");
 const fs = __importStar(require("fs"));
@@ -112,6 +113,7 @@ const diskPreflight_1 = require("./diskPreflight");
 // checkoutParkAndRemove.ts's doc comment for the full safety design.
 const checkoutParkAndRemove_1 = require("./checkoutParkAndRemove");
 const attachmentWriter_1 = require("./attachmentWriter");
+const envSaver_1 = require("./envSaver");
 const PROTOCOL_VERSION = 1;
 /**
  * fcct-27 — typed refusal when `resolveLaunch` names a binary this machine does
@@ -137,6 +139,8 @@ exports.SESSION_ADDRESSED_FRAMES = new Set([
     'browser-input', 'browser-frame-ack', 'browser-resize', 'browser-sleep',
     // Terminal attach writes next to a session — same consent boundary.
     'attach-file',
+    // Paste a key → .env writes into a session's folder — same boundary.
+    'save-env',
     'browser-close', 'browser-reload',
 ]);
 /** cvt-07: what this bridge advertises in its auth frame. `browser-tabs` = a
@@ -1566,6 +1570,13 @@ function startRelayClient(opts) {
                         // Terminal attach — shared verbatim with the local server.
                         send(socket, (0, attachmentWriter_1.handleAttachFrame)(frame, opts.sessions));
                         break;
+                    case 'save-env':
+                        // Paste a key → .env — shared verbatim with the local server.
+                        // Never logged: the frame carries the key itself.
+                        void (0, envSaver_1.handleSaveEnvFrame)(frame, opts.sessions)
+                            .then((reply) => send(socket, reply))
+                            .catch(() => send(socket, { t: 'save-env-result', rid: frame.rid, sessionId: frame.sessionId, ok: false, error: "Couldn't save key" }));
+                        break;
                     case 'read-transcript': {
                         // wte-10 (docs/prd/work-this-epic.md D8): read ONE Claude Code
                         // agent's session transcript, live. Server-initiated (no pane,
@@ -1591,12 +1602,16 @@ function startRelayClient(opts) {
                             break;
                         }
                         const result = opts.readTranscript({ workspaceId, agentId: frame.agentId, engine: frame.engine, opencodeSessionId: frame.opencodeSessionId });
-                        send(socket, {
-                            t: 'transcript-content',
-                            requestId,
-                            workspaceId,
-                            ...(result.ok ? { ok: true, content: result.content } : { ok: false, reason: result.reason }),
-                        });
+                        if (!result.ok) {
+                            send(socket, { t: 'transcript-content', requestId, workspaceId, ok: false, reason: result.reason });
+                            break;
+                        }
+                        // Secret masking (2026-10-17): the transcript holds every Bash
+                        // command and tool result verbatim — mask before it leaves. Sliced
+                        // so a multi-MB transcript never stalls live terminal frames.
+                        void (0, redact_1.redactInSlices)(result.content)
+                            .then((content) => send(socket, { t: 'transcript-content', requestId, workspaceId, ok: true, content }))
+                            .catch(() => send(socket, { t: 'transcript-content', requestId, workspaceId, ok: false, reason: 'transcript-unavailable' }));
                         break;
                     }
                     case 'browser-open': {

package/dist/bridge/repoEnv.d.ts

@@ -0,0 +1,34 @@
+export declare const DOTENV_FILENAME = ".env";
+/** A larger file is not a hand-kept key file; refuse to read it into env. */
+export declare const MAX_DOTENV_BYTES: number;
+/**
+ * HiveOp's own plumbing — refused on SAVE as well (a pasted key can never be
+ * filed under a name the bridge owns).
+ */
+export declare function isHiveOpOwnedEnvName(name: string): boolean;
+/**
+ * True when a `.env` entry with this name is never LOADED into a spawn env.
+ * Saving one is still allowed unless HiveOp owns it (isHiveOpOwnedEnvName):
+ * e.g. ANTHROPIC_API_KEY may live in the user's .env for their own app, but
+ * it must not reach `claude` (it would switch it off the subscription).
+ */
+export declare function isReservedEnvName(name: string): boolean;
+/** Parse dotenv text. Later lines win. Malformed lines are skipped. */
+export declare function parseDotenv(text: string): Record<string, string>;
+/** Drop reserved names (and anything with a NUL — env can't carry one). */
+export declare function filterRepoEnv(env: Record<string, string>): Record<string, string>;
+export interface RepoEnvDeps {
+    lstat: (p: string) => {
+        isFile(): boolean;
+        size: number;
+    } | null;
+    readFile: (p: string) => string;
+}
+export declare const realRepoEnvDeps: RepoEnvDeps;
+/**
+ * The usable env from `<cwd>/.env`, reserved names removed. `{}` when there is
+ * no cwd, no file, the file is a symlink/dir/too large, or it can't be read.
+ */
+export declare function loadRepoEnv(cwd: string | undefined, deps?: RepoEnvDeps): Record<string, string>;
+/** Spawn env: inherited < repo .env < session env. */
+export declare function mergeSpawnEnv(inherited: Record<string, string | undefined>, repoEnv: Record<string, string>, sessionEnv: Record<string, string> | undefined): Record<string, string | undefined>;

package/dist/bridge/repoEnv.js

@@ -0,0 +1,186 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realRepoEnvDeps = exports.MAX_DOTENV_BYTES = exports.DOTENV_FILENAME = void 0;
+exports.isHiveOpOwnedEnvName = isHiveOpOwnedEnvName;
+exports.isReservedEnvName = isReservedEnvName;
+exports.parseDotenv = parseDotenv;
+exports.filterRepoEnv = filterRepoEnv;
+exports.loadRepoEnv = loadRepoEnv;
+exports.mergeSpawnEnv = mergeSpawnEnv;
+/**
+ * Paste a key → saved to .env (2026-10-17, owner-approved) — the READ half.
+ *
+ * The repo's own `.env` is the one place a user's keys live (a June decision
+ * removed server-side workspace secrets; nothing here may add one). When the
+ * bridge spawns a PTY it loads `<session cwd>/.env` into that PTY's env, so an
+ * agent started after a key was saved can use it as an ordinary env var.
+ *
+ * Precedence, lowest first:
+ *     inherited process env  <  repo .env  <  the session's own env
+ * The session env carries HiveOp's WENRWA_* / HT_* / git credential stamps, so
+ * it always wins. On top of that, RESERVED names are never taken from `.env`
+ * at all — a repo file must not be able to steer the bridge's own plumbing
+ * (WENRWA_*), Claude Code's auth (ANTHROPIC_*, CLAUDE_* — a key saved as
+ * ANTHROPIC_API_KEY would otherwise switch `claude` off the subscription), or
+ * the process loader (PATH, NODE_OPTIONS, LD_PRELOAD, …).
+ *
+ * Deliberately a SIMPLE dotenv: `NAME=value` lines, optional `export `,
+ * single/double quotes, `#` comments. No `${VAR}` expansion, no multi-line
+ * values — what is in the file is exactly what the agent gets.
+ *
+ * Never logs a value. Never throws: any read problem means "no repo env".
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+exports.DOTENV_FILENAME = '.env';
+/** A larger file is not a hand-kept key file; refuse to read it into env. */
+exports.MAX_DOTENV_BYTES = 64 * 1024;
+const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Exact names `.env` may never set. */
+const RESERVED_NAMES = new Set([
+    'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'TERM', 'PWD', 'OLDPWD', 'SHLVL', 'TMPDIR',
+    'NODE_OPTIONS', 'NODE_PATH', 'BASH_ENV', 'ENV', 'PROMPT_COMMAND', 'ZDOTDIR', 'IFS',
+    'HT_AUTONOMOUS', 'MARKETPLACE_API_URL', 'SSH_AUTH_SOCK',
+]);
+/** Name prefixes `.env` may never set. */
+const RESERVED_PREFIXES = ['WENRWA_', 'HIVEOP_', 'ANTHROPIC_', 'CLAUDE_', 'LD_', 'DYLD_', 'GIT_', 'NPM_CONFIG_', 'XDG_'];
+/**
+ * HiveOp's own plumbing — refused on SAVE as well (a pasted key can never be
+ * filed under a name the bridge owns).
+ */
+function isHiveOpOwnedEnvName(name) {
+    const upper = name.toUpperCase();
+    return upper.startsWith('WENRWA_') || upper.startsWith('HIVEOP_') || upper === 'HT_AUTONOMOUS' || upper === 'MARKETPLACE_API_URL';
+}
+/**
+ * True when a `.env` entry with this name is never LOADED into a spawn env.
+ * Saving one is still allowed unless HiveOp owns it (isHiveOpOwnedEnvName):
+ * e.g. ANTHROPIC_API_KEY may live in the user's .env for their own app, but
+ * it must not reach `claude` (it would switch it off the subscription).
+ */
+function isReservedEnvName(name) {
+    const upper = name.toUpperCase();
+    if (RESERVED_NAMES.has(upper))
+        return true;
+    return RESERVED_PREFIXES.some((p) => upper.startsWith(p));
+}
+function unquote(raw) {
+    const v = raw.trim();
+    if (v.length >= 2 && v[0] === "'") {
+        const end = v.indexOf("'", 1);
+        return end === -1 ? v.slice(1) : v.slice(1, end);
+    }
+    if (v.length >= 2 && v[0] === '"') {
+        let out = '';
+        for (let i = 1; i < v.length; i++) {
+            const c = v[i];
+            if (c === '\\' && i + 1 < v.length) {
+                const n = v[++i];
+                out += n === 'n' ? '\n' : n === 'r' ? '\r' : n === 't' ? '\t' : n;
+                continue;
+            }
+            if (c === '"')
+                return out;
+            out += c;
+        }
+        return out;
+    }
+    // Unquoted: an inline comment starts at ` #`.
+    const hash = v.search(/\s#/);
+    return (hash === -1 ? v : v.slice(0, hash)).trim();
+}
+/** Parse dotenv text. Later lines win. Malformed lines are skipped. */
+function parseDotenv(text) {
+    const out = {};
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.replace(/^/, '').trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const body = line.startsWith('export ') ? line.slice(7).trimStart() : line;
+        const eq = body.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const name = body.slice(0, eq).trim();
+        if (!NAME_RE.test(name))
+            continue;
+        out[name] = unquote(body.slice(eq + 1));
+    }
+    return out;
+}
+/** Drop reserved names (and anything with a NUL — env can't carry one). */
+function filterRepoEnv(env) {
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (isReservedEnvName(k) || v.includes('\0'))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+exports.realRepoEnvDeps = {
+    lstat: (p) => {
+        try {
+            return fs.lstatSync(p);
+        }
+        catch {
+            return null;
+        }
+    },
+    readFile: (p) => fs.readFileSync(p, 'utf8'),
+};
+/**
+ * The usable env from `<cwd>/.env`, reserved names removed. `{}` when there is
+ * no cwd, no file, the file is a symlink/dir/too large, or it can't be read.
+ */
+function loadRepoEnv(cwd, deps = exports.realRepoEnvDeps) {
+    if (!cwd)
+        return {};
+    try {
+        const p = path.join(cwd, exports.DOTENV_FILENAME);
+        const st = deps.lstat(p);
+        // lstat: a symlinked .env is not followed.
+        if (!st || !st.isFile() || st.size > exports.MAX_DOTENV_BYTES)
+            return {};
+        return filterRepoEnv(parseDotenv(deps.readFile(p)));
+    }
+    catch {
+        return {};
+    }
+}
+/** Spawn env: inherited < repo .env < session env. */
+function mergeSpawnEnv(inherited, repoEnv, sessionEnv) {
+    return { ...inherited, ...filterRepoEnv(repoEnv), ...(sessionEnv ?? {}) };
+}

package/dist/bridge/server.js

@@ -63,7 +63,9 @@ const sessionAnchor_1 = require("./sessionAnchor");
 // the SAME activity records fcct-24's tail already parses below.
 const sessionTouchTracker_1 = require("./sessionTouchTracker");
 const attachmentWriter_1 = require("./attachmentWriter");
+const envSaver_1 = require("./envSaver");
 const screenshotAttach_1 = require("./screenshotAttach");
+const paneClient_1 = require("./paneClient");
 const PROTOCOL_VERSION = 1;
 function send(ws, frame) {
     if (ws.readyState === ws_1.WebSocket.OPEN)
@@ -393,6 +395,8 @@ function startBridgeServer(opts) {
                     ...(opts.writeLocalFile ? ['local-file-write'] : []),
                     // Terminal attach — this bridge answers `attach-file` frames.
                     'terminal-attach',
+                    // Paste a key → .env — this bridge answers `save-env` frames.
+                    'save-env',
                     // Screenshot drop — answers `attach-screenshot` (macOS only).
                     ...((opts.screenshotDeps ?? screenshotAttach_1.realScreenshotDeps).platform === 'darwin' ? ['attach-screenshot'] : []),
                 ],
@@ -586,6 +590,11 @@ function startBridgeServer(opts) {
             });
         }, opts.changesDetectIntervalMs ?? 5_000);
     }
+    // Who holds each session right now (socket + the pane's own ids). Read by
+    // the SUPERSEDED attachment's sink when SessionManager fires `takeover`
+    // at it, so the takeover can say where the new attach is — and stay
+    // silent when it is this same socket or this same pane redialing.
+    const attachOwner = new Map();
     wss.on('connection', (ws, req) => {
         if (req.headers.origin !== opts.allowedOrigin) {
             ws.close(4403, 'origin not allowed');
@@ -605,29 +614,52 @@ function startBridgeServer(opts) {
         // SessionManager#attach before its first internal await, so takeover
         // ordering is unaffected — only the point at which `replay` is
         // available moves to a .then().
-        const attachTo = (sessionId, size) => opts.sessions
-            .attach(sessionId, (frame) => {
-            if (frame.t === 'data') {
-                // lws-08 — scan this session's live output for a dev-server-ready
-                // banner BEFORE forwarding the data frame (order is cosmetic, but
-                // this keeps the dev-server frame visible even if a caller stops
-                // reading after the first message in a test).
-                if (!devServerWatchers.has(sessionId))
-                    devServerWatchers.set(sessionId, (0, devServerDetect_1.createDevServerWatcher)());
-                const matches = devServerWatchers.get(sessionId).feed(frame.data);
-                for (const m of matches) {
-                    send(ws, { t: 'dev-server', sessionId, framework: m.framework, port: m.port, url: m.url });
+        const attachTo = (sessionId, size, rawClient) => {
+            const me = { ws, client: (0, paneClient_1.parsePaneClient)(rawClient) };
+            const prevOwner = attachOwner.get(sessionId);
+            // Set BEFORE attach: SessionManager fires the previous sink's takeover
+            // synchronously inside attach(), and that sink reads the new owner here.
+            attachOwner.set(sessionId, me);
+            return opts.sessions
+                .attach(sessionId, (frame) => {
+                if (frame.t === 'data') {
+                    // lws-08 — scan this session's live output for a dev-server-ready
+                    // banner BEFORE forwarding the data frame (order is cosmetic, but
+                    // this keeps the dev-server frame visible even if a caller stops
+                    // reading after the first message in a test).
+                    if (!devServerWatchers.has(sessionId))
+                        devServerWatchers.set(sessionId, (0, devServerDetect_1.createDevServerWatcher)());
+                    const matches = devServerWatchers.get(sessionId).feed(frame.data);
+                    for (const m of matches) {
+                        send(ws, { t: 'dev-server', sessionId, framework: m.framework, port: m.port, url: m.url });
+                    }
+                    send(ws, { t: 'data', sessionId, data: frame.data });
                 }
-                send(ws, { t: 'data', sessionId, data: frame.data });
-            }
-            else if (frame.t === 'takeover') {
-                send(ws, { t: 'takeover', sessionId });
-            }
-        }, size)
-            .then((handle) => {
-            handles.set(sessionId, handle);
-            return handle;
-        });
+                else if (frame.t === 'takeover') {
+                    const next = attachOwner.get(sessionId);
+                    // The same socket re-attaching is not a takeover of itself.
+                    if (next && next !== me && next.ws === ws)
+                        return;
+                    const where = next && next !== me ? (0, paneClient_1.takeoverWhere)(me.client, next.client) : undefined;
+                    // The same pane redialing: this socket is its ghost — no notice.
+                    if (where === 'self')
+                        return;
+                    send(ws, where ? { t: 'takeover', sessionId, by: where } : { t: 'takeover', sessionId });
+                }
+            }, size)
+                .then((handle) => {
+                handles.set(sessionId, handle);
+                return handle;
+            }, (err) => {
+                if (attachOwner.get(sessionId) === me) {
+                    if (prevOwner)
+                        attachOwner.set(sessionId, prevOwner);
+                    else
+                        attachOwner.delete(sessionId);
+                }
+                throw err;
+            });
+        };
         ws.on('message', (raw) => {
             let frame;
             try {
@@ -774,7 +806,7 @@ function startBridgeServer(opts) {
                                     send(ws, { t: 'error', message });
                                     break;
                                 }
-                                attachTo(sessionId).then(() => {
+                                attachTo(sessionId, undefined, frame.client).then(() => {
                                     send(ws, { t: 'opened', sessionId, ...(cwd ? { cwd } : {}) });
                                     send(ws, {
                                         t: 'data',
@@ -821,7 +853,7 @@ function startBridgeServer(opts) {
                                     console.error('[bridge] local context pointer refresh failed (non-fatal):', err);
                                 });
                             }
-                            attachTo(sessionId).then(() => {
+                            attachTo(sessionId, undefined, frame.client).then(() => {
                                 send(ws, {
                                     t: 'opened',
                                     sessionId,
@@ -853,7 +885,7 @@ function startBridgeServer(opts) {
                                 send(ws, { t: 'error', message });
                                 return;
                             }
-                            attachTo(sessionId)
+                            attachTo(sessionId, undefined, frame.client)
                                 .then(() => {
                                 send(ws, { t: 'opened', sessionId, ...(cwd ? { cwd } : {}), ...(note ? { note } : {}) });
                             })
@@ -875,7 +907,7 @@ function startBridgeServer(opts) {
                     case 'attach': {
                         // lws-07 (ADR-0033 port): every replay this bridge produces is a
                         // serialized TermSnapshot — the flag is unconditional here.
-                        attachTo(frame.sessionId, (0, sessionManager_1.validSize)(frame.cols, frame.rows))
+                        attachTo(frame.sessionId, (0, sessionManager_1.validSize)(frame.cols, frame.rows), frame.client)
                             .then((handle) => {
                             // Carry the session's cwd on REATTACH. `opened` announces it
                             // only at creation, so a pane that reloads came back with no
@@ -915,6 +947,7 @@ function startBridgeServer(opts) {
                         // once closed, cwdOf() may no longer resolve it.
                         const closedCwd = opts.sessions.cwdOf(frame.sessionId);
                         handles.delete(frame.sessionId);
+                        attachOwner.delete(frame.sessionId);
                         opts.sessions.close(frame.sessionId);
                         devServerWatchers.delete(frame.sessionId);
                         changesWorkspaceOf.delete(frame.sessionId); // tchp-12 — no orphan polling for a closed session
@@ -966,6 +999,13 @@ function startBridgeServer(opts) {
                             .then((reply) => send(ws, reply))
                             .catch(() => send(ws, { t: 'file-attached', rid: frame.rid, sessionId: frame.sessionId, ok: false, reason: 'error' }));
                         break;
+                    case 'save-env':
+                        // Paste a key → .env — a FILE write in the session's folder, never
+                        // PTY input. Shared handler with relayClient.ts (both lanes).
+                        void (0, envSaver_1.handleSaveEnvFrame)(frame, opts.sessions)
+                            .then((reply) => send(ws, reply))
+                            .catch(() => send(ws, { t: 'save-env-result', rid: frame.rid, sessionId: frame.sessionId, ok: false, error: "Couldn't save key" }));
+                        break;
                     default:
                         send(ws, { t: 'error', message: 'unknown frame type' });
                 }
@@ -978,6 +1018,9 @@ function startBridgeServer(opts) {
             for (const handle of handles.values())
                 handle.detach();
             handles.clear();
+            for (const [sid, o] of attachOwner)
+                if (o.ws === ws)
+                    attachOwner.delete(sid);
         });
     });
     return new Promise((resolve, reject) => {

package/dist/bridge/sessionManager.d.ts

@@ -98,6 +98,9 @@ export interface SessionManagerOptions {
      *  gate. Off (laptop) → only an explicit `command: 'claude'` is gated and
      *  plain shells are never delayed. */
     everyOpenIsAgentLaunch?: boolean;
+    /** Secret masking: idle time before a held output tail is released
+     *  (redact.ts). Default 30ms; tests pass 0. */
+    redactIdleMs?: number;
 }
 /**
  * lws-07 (ADR-0033 port): validates a client-supplied size pair for the
@@ -124,6 +127,7 @@ export declare class SessionManager {
     private launchSupervisor;
     private launchGate;
     private everyOpenIsAgentLaunch;
+    private redactIdleMs;
     /** twr-16: cumulative count of attach-pipeline wedges (any stage timeout,
      *  or a serialize-wedge whose recovery retry ALSO timed out) since this
      *  SessionManager was created. Surfaced via attachFailures() into the

package/dist/bridge/sessionManager.js

@@ -23,6 +23,7 @@ const crypto_1 = __importDefault(require("crypto"));
 const termSnapshot_1 = require("./termSnapshot");
 const launchSupervisor_1 = require("./launchSupervisor");
 const launchGate_1 = require("./launchGate");
+const redact_1 = require("../secrets/redact");
 /** Default settle window (lws-07): after a resize-on-attach, how long we give
  *  the PTY's SIGWINCH-triggered repaint to land in the snapshot before
  *  serializing. Small — this only needs to cover one render tick, not a
@@ -78,6 +79,7 @@ class SessionManager {
     launchSupervisor;
     launchGate;
     everyOpenIsAgentLaunch;
+    redactIdleMs;
     /** twr-16: cumulative count of attach-pipeline wedges (any stage timeout,
      *  or a serialize-wedge whose recovery retry ALSO timed out) since this
      *  SessionManager was created. Surfaced via attachFailures() into the
@@ -97,6 +99,7 @@ class SessionManager {
         this.launchSupervisor = opts.launchSupervisor ?? {};
         this.launchGate = opts.launchGate === false ? null : new launchGate_1.LaunchGate(opts.launchGate ?? {});
         this.everyOpenIsAgentLaunch = opts.everyOpenIsAgentLaunch ?? false;
+        this.redactIdleMs = opts.redactIdleMs;
     }
     /** twr-16: see attachFailureCount. */
     attachFailures() {
@@ -140,6 +143,7 @@ class SessionManager {
         const id = opts.id ?? crypto_1.default.randomBytes(8).toString('hex');
         const prior = this.sessions.get(id);
         if (prior) {
+            prior.redactor.dispose();
             prior.pty.kill();
             prior.snapshot.dispose();
             this.sessions.delete(id);
@@ -164,7 +168,20 @@ class SessionManager {
             ? this.launchGate.launch(spawnOne, { cols: opts.cols, rows: opts.rows })
             : spawnOne({ cols: opts.cols, rows: opts.rows });
         const snapshot = this.snapshotFactory(opts.cols, opts.rows, { scrollback: this.snapshotScrollback });
-        const session = {
+        // eslint-disable-next-line prefer-const
+        let session;
+        // Masked output fans out to the snapshot and the live sink. `session` is
+        // read at emit time, so a rebuilt snapshot (twr-16) or a new sink is used.
+        const redactor = (0, redact_1.createStreamRedactor)({
+            idleMs: this.redactIdleMs,
+            emit: (data) => {
+                // Fire-and-forget: serialize() flushes the snapshot's internal write
+                // queue before reading it back, so no caller needs to await this.
+                session.snapshot.write(data).catch(() => { });
+                session.sink?.({ t: 'data', data });
+            },
+        });
+        session = {
             pty,
             snapshot,
             cols: opts.cols,
@@ -174,17 +191,19 @@ class SessionManager {
             exited: false,
             cwd: opts.cwd,
             engine: isOpencode ? 'opencode' : isClaude ? 'claude' : undefined,
+            redactor,
         };
         pty.onData((data) => {
-            // Single write path to the PTY itself is untouched (ADR-0028) — this is
-            // purely a second, read-only consumer of the same output bytes the live
-            // sink already gets. Fire-and-forget: serialize() flushes the snapshot's
-            // internal write queue before reading it back, so no caller needs to
-            // await this.
-            session.snapshot.write(data).catch(() => { });
-            session.sink?.({ t: 'data', data });
+            // Single write path to the PTY itself is untouched (ADR-0028) — output
+            // is only READ here, masked, and fanned out by the redactor above.
+            session.redactor.push(data);
         });
         pty.onExit((code) => {
+            // Release any held tail before the session stops listening.
+            try {
+                session.redactor.dispose();
+            }
+            catch { /* never break teardown */ }
             session.exited = true;
             session.sink = null;
             session.snapshot.dispose();
@@ -340,6 +359,7 @@ class SessionManager {
         const session = this.sessions.get(sessionId);
         if (!session)
             return;
+        session.redactor.dispose();
         session.pty.kill();
         session.snapshot.dispose();
         this.sessions.delete(sessionId);