@wenrwa/marketplace-cli 0.8.5 → 0.8.7

package/dist/__tests__/bridge-server.test.js

@@ -489,13 +489,14 @@ describe('bridge WebSocket server', () => {
     });
     // ── lws-07 (ADR-0033 port): attach carries cols/rows; replay frames say snapshot:true ────
     describe('attach size + replay snapshot flag', () => {
-        // Re-attaching on the SAME connection to an already-attached session
-        // supersedes its own prior attachment (last-attach-wins), so a `takeover`
-        // frame precedes the `replay` on the same socket — pull both and match by
-        // type, same convention as the existing "second attach takes over" test.
+        // Re-attaching on the SAME connection supersedes its own prior
+        // attachment, but the bridge no longer tells a socket it was taken over
+        // by itself (phantom "attached elsewhere", 2026-10-17) — the replay is
+        // the next frame.
         const nextReplay = async (q) => {
-            const [a, b] = [await q.next(), await q.next()];
-            return [a, b].find((f) => f.t === 'replay');
+            const f = await q.next();
+            expect(f.t).toBe('replay');
+            return f;
         };
         it('attach with cols/rows resizes before replay (size differs from tracked geometry); replay marks snapshot:true', async () => {
             const { ws, q } = await openAndAuth(handle.port);
@@ -649,12 +650,9 @@ describe('bridge WebSocket server — attach deadline (twr-16)', () => {
             const opened = await q.next();
             // A size differing from the tracked geometry enters the resize→settle
             // branch the deadline stalls in. Re-attaching on the SAME connection
-            // supersedes its own prior attachment (last-attach-wins), so a
-            // `takeover` frame precedes the error on this socket — pull both and
-            // match by type (same convention as the size-handling tests above).
+            // sends no self-takeover, so the error is the next frame.
             ws.send(JSON.stringify({ t: 'attach', sessionId: opened.sessionId, cols: 120, rows: 40 }));
-            const [a, b] = [await q.next(), await q.next()];
-            const err = [a, b].find((f) => f.t === 'error');
+            const err = await q.next();
             expect(err).toMatchObject({ t: 'error', sessionId: opened.sessionId });
             expect(String(err.message)).toContain('stage=settle');
             ws.close();

package/dist/__tests__/secrets-egress.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/secrets-egress.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Secret masking at every egress of the bridge (2026-10-17): the live sink,
+ * the attach replay, peek, the bridge's console, and the agent guards
+ * (Claude Code PreToolUse hook, OpenCode plugin) plus the standing rule in
+ * the managed context. Tokens are assembled at runtime (no literal secrets).
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const ts = __importStar(require("typescript"));
+const sessionManager_1 = require("../bridge/sessionManager");
+const redact_1 = require("../secrets/redact");
+const console_1 = require("../secrets/console");
+const hiveopSettings_1 = require("../bridge/hiveopSettings");
+const workGraphPointer_1 = require("../bridge/workGraphPointer");
+const contextWriter_1 = require("../bridge/contextWriter");
+const localContextWriter_1 = require("../bridge/localContextWriter");
+const UUID = ['ef1bd6d5', '7de1', '4da2', 'b722', '4414d9461a4e'].join('-');
+const NPM = ['npm', '_', 'aB3cD4eF5gH6iJ7kL8mN9pQ2rS1tU0vWxYz'].join('');
+const ROOT = path.join(__dirname, '..', '..');
+class FakePty {
+    written = [];
+    dataCb = null;
+    exitCb = null;
+    write(d) { this.written.push(d); }
+    resize() { }
+    kill() { }
+    onData(cb) { this.dataCb = cb; }
+    onExit(cb) { this.exitCb = cb; }
+    emit(d) { this.dataCb?.(d); }
+    exit(code) { this.exitCb?.(code); }
+}
+function manager() {
+    const ptys = [];
+    const factory = { spawn: () => { const p = new FakePty(); ptys.push(p); return p; } };
+    const sm = new sessionManager_1.SessionManager(factory, { launchGate: false, settleMs: 0, delay: async () => { } });
+    return { sm, ptys };
+}
+describe('SessionManager — every output egress is masked', () => {
+    it('live frames, the attach replay and peek never carry the raw value; the PTY still gets real input', async () => {
+        const { sm, ptys } = manager();
+        const id = sm.open({ cols: 120, rows: 30 });
+        const frames = [];
+        const handle = await sm.attach(id, (f) => { if (f.t === 'data')
+            frames.push(f.data); });
+        // The owner screenshot: split mid-value across two PTY reads.
+        ptys[0].emit(`$ RAILWAY_API_TOKEN=${UUID.slice(0, 13)}`);
+        ptys[0].emit(`${UUID.slice(13)} $R up --ci\r\n`);
+        ptys[0].emit(`\x1b[32m${NPM}\x1b[0m\r\n`);
+        const live = frames.join('');
+        expect(live).not.toContain(UUID.slice(0, 8));
+        expect(live).not.toContain(UUID.slice(13));
+        expect(live).not.toContain(NPM.slice(4, 14));
+        expect(live).toContain('RAILWAY_API_TOKEN=****');
+        expect(live).toContain('$R up --ci');
+        const peek = (await sm.peek(id)) ?? '';
+        expect(peek).toContain('RAILWAY_API_TOKEN=');
+        expect(peek).not.toContain(UUID.slice(0, 8));
+        expect(peek).not.toContain(NPM.slice(4, 14));
+        const again = await sm.attach(id, () => { });
+        expect(again.replay).toContain('$R up --ci');
+        expect(again.replay).not.toContain(UUID.slice(0, 8));
+        // Input is never touched: the agent gets the real bytes.
+        again.write(`export TOKEN=${UUID}\r`);
+        expect(ptys[0].written).toContain(`export TOKEN=${UUID}\r`);
+        handle.detach();
+    });
+    it('a held tail is released (masked) when the process exits', async () => {
+        const { sm, ptys } = manager();
+        const id = sm.open({ cols: 80, rows: 24 });
+        const frames = [];
+        await sm.attach(id, (f) => { if (f.t === 'data')
+            frames.push(f.data); });
+        ptys[0].emit(`password: ${UUID}`);
+        ptys[0].exit(0);
+        expect(frames.join('')).toBe(`password: ${'*'.repeat(UUID.length)}`);
+    });
+});
+describe('console redaction (bridge.log / fly logs)', () => {
+    it('masks every console line and keeps the rest', () => {
+        const lines = [];
+        const push = (...a) => { lines.push(String(a[0])); };
+        const fake = { log: push, info: push, warn: push, error: push, debug: push };
+        (0, console_1.installConsoleRedaction)(fake);
+        (0, console_1.installConsoleRedaction)(fake); // idempotent
+        fake.error('[bridge] claude exited:', `GITHUB_TOKEN=${UUID}`, { n: 1 });
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toContain('[bridge] claude exited: GITHUB_TOKEN=****');
+        expect(lines[0]).not.toContain(UUID.slice(0, 8));
+        expect(lines[0]).toContain('{ n: 1 }');
+    });
+});
+/** Compile redact.ts to a temp CommonJS file so child processes (hook, plugin) can load it. */
+function compiledDetector() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'secrets-'));
+    const src = fs.readFileSync(path.join(ROOT, 'src', 'secrets', 'redact.ts'), 'utf8');
+    const out = ts.transpileModule(src, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 } });
+    const file = path.join(dir, 'redact.js');
+    fs.writeFileSync(file, out.outputText);
+    return file;
+}
+describe('Claude Code PreToolUse secret guard (hooks/pre-tool-use.js)', () => {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const hook = require(path.join(ROOT, 'hooks', 'pre-tool-use.js'));
+    const bash = (command) => ({ tool_name: 'Bash', tool_input: { command } });
+    it('blocks a literal secret and never repeats it in the message', () => {
+        const v = hook.decide(bash(`RAILWAY_API_TOKEN=${UUID} $R up --ci`), redact_1.containsSecret, {});
+        expect(v.block).toBe(true);
+        expect(v.message).toMatch(/environment variable|\.env/);
+        expect(v.message).not.toContain(UUID);
+    });
+    it.each([
+        'RAILWAY_API_TOKEN="$RAILWAY_TOKEN" railway up --ci',
+        'curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com',
+        'git push origin HEAD:main',
+        `echo agent ${UUID} started`,
+    ])('lets %s run', (cmd) => {
+        expect(hook.decide(bash(cmd), redact_1.containsSecret, {}).block).toBe(false);
+    });
+    it('only guards Bash, honours the opt-out, and fails open on a missing or throwing detector', () => {
+        expect(hook.decide({ tool_name: 'Edit', tool_input: { command: `TOKEN=${UUID}` } }, redact_1.containsSecret, {}).block).toBe(false);
+        expect(hook.decide(bash(`TOKEN=${UUID}`), redact_1.containsSecret, { HIVEOP_SECRET_GUARD: '0' }).block).toBe(false);
+        expect(hook.decide(bash(`TOKEN=${UUID}`), null, {}).block).toBe(false);
+        expect(hook.decide(bash(`TOKEN=${UUID}`), () => { throw new Error('x'); }, {}).block).toBe(false);
+        expect(hook.decide(null, redact_1.containsSecret, {}).block).toBe(false);
+    });
+    it('as a real process: exit 2 + message on a secret, exit 0 otherwise, exit 0 with no detector', () => {
+        const mod = compiledDetector();
+        const run = (ev, env) => (0, child_process_1.spawnSync)(process.execPath, [path.join(ROOT, 'hooks', 'pre-tool-use.js')], {
+            input: JSON.stringify(ev), env: { PATH: process.env.PATH ?? '', ...env }, encoding: 'utf8',
+        });
+        const blocked = run(bash(`export GH_TOKEN=${NPM}`), { HIVEOP_SECRETS_MODULE: mod });
+        expect(blocked.status).toBe(2);
+        expect(blocked.stderr).toContain('HiveOp blocked this command');
+        expect(blocked.stderr).not.toContain(NPM.slice(4));
+        expect(run(bash('ls -la'), { HIVEOP_SECRETS_MODULE: mod }).status).toBe(0);
+        expect(run(bash(`TOKEN=${UUID}`), { HIVEOP_SECRETS_MODULE: '/nope.js' }).status).toBe(0);
+        expect(run('not json', { HIVEOP_SECRETS_MODULE: mod }).status).toBe(0);
+    });
+    it('is registered for Bash in the local settings file, and the hosted copy is byte-identical', () => {
+        const settings = JSON.parse((0, hiveopSettings_1.buildHiveOpSettingsContent)('/h'));
+        expect(settings.hooks.PreToolUse).toEqual([
+            { matcher: 'Bash', hooks: [{ type: 'command', command: `node "${path.join('/h', 'pre-tool-use.js')}"` }] },
+        ]);
+        expect(fs.readFileSync(path.join(ROOT, 'hooks', 'pre-tool-use.js'), 'utf8'))
+            .toBe(fs.readFileSync(path.join(ROOT, '..', 'infra', 'terminal-image', 'hooks', 'pre-tool-use.js'), 'utf8'));
+    });
+});
+describe('OpenCode secret guard (hooks/opencode-plugin.mjs tool.execute.before)', () => {
+    function runBefore(command, env) {
+        const script = `
+      const { HiveOp } = await import(process.argv[1]);
+      const h = await HiveOp({});
+      try { await h['tool.execute.before']({ tool: 'bash', sessionID: 's' }, { args: { command: process.argv[2] } }); console.log(JSON.stringify({ threw: false, message: '' })); }
+      catch (e) { console.log(JSON.stringify({ threw: true, message: String(e && e.message) })); }`;
+        const out = (0, child_process_1.execFileSync)(process.execPath, ['--input-type=module', '-e', script, path.join(ROOT, 'hooks', 'opencode-plugin.mjs'), command], {
+            env: { PATH: process.env.PATH ?? '', ...env }, encoding: 'utf8',
+        });
+        return JSON.parse(out.trim().split('\n').pop());
+    }
+    it('blocks a bash call with a literal secret and lets a $VAR reference through', () => {
+        const mod = compiledDetector();
+        const blocked = runBefore(`RAILWAY_API_TOKEN=${UUID} railway up`, { HIVEOP_SECRETS_MODULE: mod });
+        expect(blocked.threw).toBe(true);
+        expect(blocked.message).toContain('HiveOp blocked this command');
+        expect(blocked.message).not.toContain(UUID);
+        expect(runBefore('RAILWAY_API_TOKEN="$RAILWAY_TOKEN" railway up', { HIVEOP_SECRETS_MODULE: mod }).threw).toBe(false);
+    });
+    it('fails open without a detector and honours the opt-out', () => {
+        expect(runBefore(`TOKEN=${UUID}`, { HIVEOP_SECRETS_MODULE: '/nope.js' }).threw).toBe(false);
+        expect(runBefore(`TOKEN=${UUID}`, { HIVEOP_SECRETS_MODULE: compiledDetector(), HIVEOP_SECRET_GUARD: '0' }).threw).toBe(false);
+    });
+});
+describe('standing rule in the managed context', () => {
+    it('rides the pointer block when there is one, and never creates one on its own', () => {
+        expect((0, workGraphPointer_1.withSecretsSection)([])).toEqual([]);
+        expect((0, workGraphPointer_1.withSecretsSection)(['## Work graph'])).toEqual(['## Work graph', workGraphPointer_1.SECRETS_POINTER]);
+        expect(workGraphPointer_1.SECRETS_POINTER.split('\n').length).toBeLessThanOrEqual(2);
+        expect(workGraphPointer_1.SECRETS_POINTER).toMatch(/Never print, echo or cat/);
+    });
+    it('both lanes carry it in the file the agent reads', () => {
+        const files = new Map();
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-7', content: '', workGraphAvailable: true }, {
+            reposBaseDir: '/data/repos',
+            exists: (p) => files.has(p),
+            readFile: (p) => files.get(p) ?? '',
+            writeFile: (p, c) => { files.set(p, c); },
+            mkdirp: () => { },
+        });
+        expect(files.get('/data/repos/ws-7/CLAUDE.md')).toContain(workGraphPointer_1.SECRETS_POINTER);
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'secrets-ctx-'));
+        (0, localContextWriter_1.writeLocalContext)({ projectRoot: root, content: '', workGraphAvailable: true }, {
+            exists: (p) => fs.existsSync(p),
+            readFile: (p) => fs.readFileSync(p, 'utf-8'),
+            mkdirp: (d) => fs.mkdirSync(d, { recursive: true }),
+            writeFileAtomic: (p, c) => fs.writeFileSync(p, c),
+            remove: (p) => fs.rmSync(p, { force: true }),
+        });
+        expect(fs.readFileSync(path.join(root, localContextWriter_1.LOCAL_CONTEXT_RELATIVE_PATH), 'utf-8')).toContain(workGraphPointer_1.SECRETS_POINTER);
+    });
+});

package/dist/__tests__/secrets-redact.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/secrets-redact.test.js

@@ -0,0 +1,318 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Secret masking (cli/src/secrets/redact.ts). Every token here is assembled at
+ * runtime from split pieces so no literal credential-shaped string sits in the
+ * repo (GitHub push protection, and our own guard hook, would both trip).
+ */
+const redact_1 = require("../secrets/redact");
+/** Deterministic alnum body with letters and digits. */
+function body(n, seed = 7) {
+    const abc = 'aB3cD4eF5gH6iJ7kL8mN9pQ2rS1tU0vWxYz';
+    let s = '';
+    let x = seed;
+    for (let i = 0; i < n; i++) {
+        x = (x * 31 + 17) % 9973;
+        s += abc[x % abc.length];
+    }
+    return s;
+}
+const j = (...p) => p.join('');
+const UUID = 'ef1bd6d5-7de1-4da2-b722-4414d9461a4e';
+/** [label, token] — each must be masked keeping its first 4 chars. */
+const PREFIXED = [
+    ['npm', j('npm', '_', body(36))],
+    ['anthropic', j('sk', '-ant-api03-', body(40))],
+    ['openrouter', j('sk', '-or-v1-', body(48, 3).toLowerCase().replace(/[^a-z0-9]/g, '1'))],
+    ['openai', j('sk', '-proj-', body(40, 11))],
+    ['github classic', j('gh', 'p_', body(36, 5))],
+    ['github oauth', j('gh', 'o_', body(36, 6))],
+    ['github server', j('gh', 's_', body(36, 8))],
+    ['github fine-grained', j('github', '_pat_', '11ABCDE', body(50, 9))],
+    ['gitlab', j('gl', 'pat-', body(20, 12))],
+    ['slack', j('xo', 'xb-', '1234567890-', body(24, 13))],
+    ['stripe secret', j('sk', '_live_', body(24, 14))],
+    ['stripe restricted', j('rk', '_live_', body(24, 15))],
+    ['aws id', j('AK', 'IA', 'Z7Q2', 'K4M9P3L8N6R1')],
+    ['google', j('AI', 'za', body(35, 16))],
+    ['jwt', j('ey', 'JhbGciOiJIUzI1NiJ9', '.', 'eyJzdWIiOiIxMjM0NTY3ODkwIn0', '.', body(30, 17))],
+    ['hiveop api key', j('wm', '_sk_', body(32, 18))],
+    ['hiveop connect token', j('wm', '_ct_', body(32, 19))],
+];
+describe('findSecrets / redact — detector', () => {
+    it('masks the owner screenshot line, keeping the name and the rest of the command', () => {
+        const line = `RAILWAY_API_TOKEN=${UUID} $R up --ci`;
+        expect((0, redact_1.redact)(line)).toBe(`RAILWAY_API_TOKEN=${'*'.repeat(UUID.length)} $R up --ci`);
+    });
+    it.each(PREFIXED)('masks a %s token, keeping its first 4 chars', (_label, tok) => {
+        const out = (0, redact_1.redact)(`token is ${tok} ok`);
+        expect(out).toBe(`token is ${tok.slice(0, 4)}${'*'.repeat(tok.length - 4)} ok`);
+    });
+    it('leaves Stripe publishable keys alone', () => {
+        const pk = j('pk', '_live_', body(24));
+        expect((0, redact_1.redact)(`key ${pk}`)).toBe(`key ${pk}`);
+        expect((0, redact_1.redact)(`STRIPE_PUBLISHABLE_KEY=${pk}`)).toBe(`STRIPE_PUBLISHABLE_KEY=${pk}`);
+    });
+    it.each([
+        [`export GITHUB_TOKEN=${body(30)}`, 'export GITHUB_TOKEN='],
+        [`DATABASE_PASSWORD="${body(16)}"`, 'DATABASE_PASSWORD="'],
+        [`api_key: ${body(20)}`, 'api_key: '],
+        [`{"apiKey": "${body(20)}"}`, '{"apiKey": "'],
+        [`{\\"client_secret\\":\\"${body(24)}\\"}`, '{\\"client_secret\\":\\"'],
+        [`aws_secret_access_key = ${body(40)}`, 'aws_secret_access_key = '],
+        [`railway login --token ${UUID}`, 'railway login --token '],
+        [`cli --api-key=${body(24)}`, 'cli --api-key='],
+        [`x-api-key: ${body(24)}`, 'x-api-key: '],
+        [`curl -H 'Authorization: Bearer ${body(32)}' https://x`, `curl -H 'Authorization: Bearer `],
+        [`Authorization: Basic dXNlcjpwYXNzd29yZA==`, 'Authorization: Basic '],
+        [`Bearer ${body(40)}`, 'Bearer '],
+        [`DB_PASS=${body(14)}`, 'DB_PASS='],
+        [`SESSION_SECRET=${UUID}`, 'SESSION_SECRET='],
+    ])('masks the value of %s', (line, keep) => {
+        const out = (0, redact_1.redact)(line);
+        expect(out.startsWith(keep)).toBe(true);
+        expect(out.length).toBe(line.length);
+        expect(out.slice(keep.length)).toMatch(/^\*{8,}/);
+    });
+    it('masks a URL password, keeping the user and host', () => {
+        const pw = body(16);
+        expect((0, redact_1.redact)(`postgres://app:${pw}@db.internal:5432/x`)).toBe(`postgres://app:${'*'.repeat(16)}@db.internal:5432/x`);
+    });
+    it('masks a private key body but keeps its BEGIN/END lines', () => {
+        const lines = [0, 1, 2].map((i) => body(64, 20 + i));
+        const pem = ['-----BEGIN RSA PRIVATE KEY-----', ...lines, '-----END RSA PRIVATE KEY-----', 'after ' + 'plain'].join('\n');
+        const out = (0, redact_1.redact)(pem);
+        for (const l of lines)
+            expect(out).not.toContain(l.slice(0, 12));
+        expect(out).toContain('-----BEGIN RSA PRIVATE KEY-----');
+        expect(out).toContain('-----END RSA PRIVATE KEY-----');
+        expect(out).toContain('after plain');
+        expect(out.length).toBe(pem.length);
+    });
+    it.each([
+        ['a git sha alone', 'commit 3f9a2b7c1d4e5f60718293a4b5c6d7e8f9012345'],
+        ['a uuid alone', `agent ${UUID} started`],
+        ['a uuid after a non-secret name', `SESSION_ID=${UUID}`],
+        ['base64 in ordinary output', `data: ${Buffer.from('hello world, this is just normal text 12345').toString('base64')}`],
+        ['an env var reference', 'RAILWAY_API_TOKEN=$RAILWAY_TOKEN railway up'],
+        ['a braced reference', 'export API_KEY=${API_KEY}'],
+        ['a command substitution', 'TOKEN=$(cat ~/.token)'],
+        ['an angle-bracket placeholder', 'GITHUB_TOKEN=<your-token-here>'],
+        ['a your-key-here placeholder', 'OPENAI_API_KEY=your-api-key-here-123'],
+        ['an x placeholder', 'API_KEY=xxxxxxxxxxxxxxxx'],
+        ['a star placeholder (already masked)', 'API_KEY=****************'],
+        ['a boolean', 'AUTH_ENABLED=true'],
+        ['a file path', 'GOOGLE_APPLICATION_CREDENTIALS=/home/me/creds-2024.json'],
+        ['a relative path', 'SSL_KEY=./certs/server-2024.key'],
+        ['a plain URL', 'AUTH_URL=https://auth.example.com/v1/callback'],
+        ['a token count', 'max_tokens=409600000000'],
+        ['usage counters', '"input_tokens": 123456789012'],
+        ['a cache key', 'cacheKey: build-2024-abcdef123456'],
+        ['a sort key in JSON', '"sortKey": "item-000123456789"'],
+        ['code reading an env var', 'const apiKey = process.env.OPENAI_API_KEY;'],
+        ['a dotted config path', 'apiKey: config.stripe.secretKey2'],
+        ['an ISO timestamp', 'TOKEN_EXPIRES_AT=2026-10-17T12:00:00Z'],
+        ['a version', 'AUTH_LIB_VERSION=12.4.1234567'],
+        ['a package-lock integrity', '"integrity": "sha512-Abc123Def456Ghi789Jkl012Mno345Pqr678=="'],
+        ['the word token in prose', 'the token 1234 was refreshed for user alice'],
+        ['a Bearer with a variable', 'curl -H "Authorization: Bearer $TOKEN" https://api'],
+        ['a URL with a variable password', 'git clone https://x-access-token:${GH_TOKEN}@github.com/o/r'],
+        ['a kebab-case word after sk-', 'sk-learn-is-a-python-machine-learning-library'],
+        ['an AWS example key', j('AK', 'IA', 'IOSFODNN7EXAMPLE')],
+        ['a key id', `--key-id ${UUID}`],
+        ['a docker digest', 'image@sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'],
+    ])('does not mask %s', (_label, line) => {
+        expect((0, redact_1.redact)(line)).toBe(line);
+        expect((0, redact_1.containsSecret)(line)).toBe(false);
+    });
+    it('names: secret-ish segments only', () => {
+        for (const n of ['RAILWAY_API_TOKEN', 'apiKey', 'x-api-key', 'DB_PASSWORD', 'client_secret', 'authToken', 'PRIVATE_KEY', 'stripeSecretKey', 'NPM_AUTH']) {
+            expect((0, redact_1.isSecretName)(n)).toBe(true);
+        }
+        for (const n of ['MONKEY', 'keyboard', 'author', 'key', 'cacheKey', 'max_tokens', 'SESSION_ID', 'PUBLIC_KEY', 'NEXT_PUBLIC_API_KEY', 'private']) {
+            expect((0, redact_1.isSecretName)(n)).toBe(false);
+        }
+    });
+    it('is idempotent — masked output has nothing left to mask', () => {
+        const line = `RAILWAY_API_TOKEN=${UUID} and ${PREFIXED[0][1]}`;
+        const once = (0, redact_1.redact)(line);
+        expect((0, redact_1.redact)(once)).toBe(once);
+        expect((0, redact_1.findSecrets)(once)).toEqual([]);
+    });
+});
+describe('redact — escape sequences', () => {
+    it('masks a token painted in several colours and keeps every escape intact', () => {
+        const tok = PREFIXED[0][1];
+        const painted = `\x1b[32m${tok.slice(0, 10)}\x1b[1;33m${tok.slice(10)}\x1b[0m`;
+        const out = (0, redact_1.redact)(painted);
+        expect(out).toBe(`\x1b[32m${tok.slice(0, 4)}${'*'.repeat(6)}\x1b[1;33m${'*'.repeat(tok.length - 10)}\x1b[0m`);
+    });
+    it('masks a secret inside an OSC window title', () => {
+        const out = (0, redact_1.redact)(`\x1b]0;RAILWAY_API_TOKEN=${UUID}\x07rest`);
+        expect(out).toBe(`\x1b]0;RAILWAY_API_TOKEN=${'*'.repeat(36)}\x07rest`);
+    });
+    it('cursor moves separate words, so a name and a value on different cells never join', () => {
+        const line = `API_TOKEN\x1b[5;1H=${UUID}`;
+        expect((0, redact_1.redact)(line)).toBe(line);
+    });
+    it('a TUI frame: box drawing and widths survive, only the value is masked', () => {
+        const frame = [
+            '\x1b[?2026h\x1b[1;1H\x1b[38;2;215;119;87m╭──────────────────────────────╮\x1b[39m',
+            `\x1b[2;1H│ \x1b[1m⏺ Bash\x1b[22m(RAILWAY_API_TOKEN=${UUID} $R up --ci) │`,
+            '\x1b[3;1H╰──────────────────────────────╯\x1b[?2026l',
+        ].join('');
+        const out = (0, redact_1.redact)(frame);
+        expect(out).not.toContain(UUID.slice(0, 8));
+        expect(out.length).toBe(frame.length);
+        expect(out).toContain('$R up --ci) │');
+        expect(out).toContain('\x1b[?2026h');
+        expect(out).toContain('\x1b[?2026l');
+    });
+});
+/** Run `chunks` through a stream redactor with NO idle flush between them. */
+function streamAll(chunks, opts = {}) {
+    let out = '';
+    const r = (0, redact_1.createStreamRedactor)({ emit: (s) => { out += s; }, setTimer: () => 1, clearTimer: () => { }, ...opts });
+    for (const c of chunks)
+        r.push(c);
+    r.flush();
+    return out;
+}
+const FIXTURES = [
+    `$ RAILWAY_API_TOKEN=${UUID} $R up --ci\r\n`,
+    `found ${PREFIXED[0][1]} in .npmrc\r\n`,
+    `\x1b[32m${PREFIXED[4][1]}\x1b[0m done\r\n`,
+    `curl -H 'Authorization: Bearer ${body(32)}' https://api.example.com\r\n`,
+    `postgres://app:${body(16)}@db:5432/x\r\n`,
+    `\x1b]0;OPENAI_API_KEY=${body(24)}\x07\x1b[2;3Hhello`,
+    ['-----BEGIN OPENSSH PRIVATE KEY-----', body(64, 1), body(64, 2), body(20, 3), '-----END OPENSSH PRIVATE KEY-----', 'ok'].join('\r\n'),
+    `{"api_key": "${body(28)}", "user": "alice"}\n`,
+    `token: ${PREFIXED[14][1]}\n`,
+    `ls -la\r\n\x1b[1;34msrc\x1b[0m  README.md  package.json\r\n`,
+];
+describe('createStreamRedactor — chunk splits', () => {
+    it.each(FIXTURES.map((f, i) => [i, f]))('fixture %i: every 2-way split matches the one-shot result', (_i, fixture) => {
+        const expected = (0, redact_1.redact)(fixture);
+        for (let i = 1; i < fixture.length; i++) {
+            expect(streamAll([fixture.slice(0, i), fixture.slice(i)], { maskTrailing: false })).toBe(expected);
+        }
+    });
+    it.each(FIXTURES.map((f, i) => [i, f]))('fixture %i: 3-way splits match the one-shot result', (_i, fixture) => {
+        const expected = (0, redact_1.redact)(fixture);
+        const step = Math.max(1, Math.floor(fixture.length / 25));
+        for (let a = 1; a < fixture.length; a += step) {
+            for (let b = a + 1; b < fixture.length; b += step) {
+                expect(streamAll([fixture.slice(0, a), fixture.slice(a, b), fixture.slice(b)], { maskTrailing: false })).toBe(expected);
+            }
+        }
+    });
+    it('byte-at-a-time delivery still masks (a paste echoed one char per read)', () => {
+        for (const fixture of FIXTURES) {
+            expect(streamAll(fixture.split(''), { maskTrailing: false })).toBe((0, redact_1.redact)(fixture));
+        }
+    });
+    it('escape sequences split at every point pass through intact', () => {
+        const s = 'a\x1b[38;2;1;2;3mb\x1b]0;title\x07c\x1b[?25ld\x1bPq#0;2;0;0;0\x1b\\e';
+        for (let i = 1; i < s.length; i++)
+            expect(streamAll([s.slice(0, i), s.slice(i)])).toBe(s);
+    });
+});
+describe('createStreamRedactor — holding and idle release', () => {
+    function harness() {
+        let out = '';
+        let fire = null;
+        const r = (0, redact_1.createStreamRedactor)({
+            emit: (s) => { out += s; },
+            setTimer: (cb) => { fire = cb; return 1; },
+            clearTimer: () => { fire = null; },
+        });
+        return { r, out: () => out, idle: () => { const f = fire; fire = null; f?.(); }, armed: () => fire !== null };
+    }
+    it('plain typing echo is never held', () => {
+        const h = harness();
+        h.r.push('l');
+        h.r.push('s');
+        expect(h.out()).toBe('ls');
+        expect(h.armed()).toBe(false);
+    });
+    it('holds a value that may still be growing, then masks it whole when the rest arrives', () => {
+        const h = harness();
+        h.r.push(`RAILWAY_API_TOKEN=${UUID.slice(0, 10)}`);
+        expect(h.out()).toBe('RAILWAY_API_TOKEN=');
+        expect(h.armed()).toBe(true);
+        h.r.push(`${UUID.slice(10)} $R up\r\n`);
+        expect(h.out()).toBe(`RAILWAY_API_TOKEN=${'*'.repeat(36)} $R up\r\n`);
+    });
+    it('releases a held tail on idle', () => {
+        const h = harness();
+        h.r.push('api_key: ab');
+        expect(h.out()).toBe('api_key: ');
+        h.idle();
+        expect(h.out()).toBe('api_key: ab');
+    });
+    it('a typed secret: after the idle release, the rest of the value is still masked', () => {
+        const h = harness();
+        h.r.push(`export GITHUB_TOKEN=${UUID.slice(0, 2)}`);
+        h.idle();
+        for (const ch of UUID.slice(2)) {
+            h.r.push(ch);
+            h.idle();
+        }
+        h.r.push('\r\n');
+        const out = h.out();
+        expect(out.startsWith(`export GITHUB_TOKEN=${UUID.slice(0, 2)}`)).toBe(true);
+        expect(out).not.toContain(UUID.slice(2, 8));
+        expect(out.length).toBe(`export GITHUB_TOKEN=${UUID}\r\n`.length);
+    });
+    it('a prefixed token split by a slow read: only the first 4 chars are ever visible', () => {
+        const tok = PREFIXED[0][1];
+        const h = harness();
+        h.r.push(tok.slice(0, 12));
+        h.idle();
+        h.r.push(tok.slice(12) + ' end');
+        expect(h.out()).toBe(`${tok.slice(0, 4)}${'*'.repeat(tok.length - 4)} end`);
+    });
+    it('flush on exit releases everything', () => {
+        const h = harness();
+        h.r.push('password: ');
+        h.r.push('hunter2hunter2');
+        h.r.flush();
+        expect(h.out()).toBe(`password: ${'*'.repeat(14)}`);
+    });
+});
+describe('performance', () => {
+    it('a 1MB TUI-like stream with no secrets passes through unchanged and fast', () => {
+        const line = '\x1b[2;1H│ \x1b[38;5;245mReading src/components/Button.tsx (42 lines)\x1b[39m │ 3f9a2b7c1d4e │\r\n';
+        const chunk = line.repeat(Math.ceil(16384 / line.length));
+        const t0 = Date.now();
+        let out = '';
+        const r = (0, redact_1.createStreamRedactor)({ emit: (s) => { out += s; }, setTimer: () => 1, clearTimer: () => { } });
+        for (let i = 0; i < 64; i++)
+            r.push(chunk);
+        r.flush();
+        const ms = Date.now() - t0;
+        expect(out).toBe(chunk.repeat(64));
+        expect(ms).toBeLessThan(1500);
+    });
+    // Each of these once took 20-45s one-shot (a pattern restarting inside a
+    // long run of its own leading class). Linear now; pinned so it stays so.
+    it.each([
+        ['base64 blob', require('crypto').randomBytes(150000).toString('base64')],
+        ['identifier run', 'a_'.repeat(100000)],
+        ['repeated NAME=', 'TOKEN='.repeat(35000)],
+        ['repeated name: ', 'api_key: '.repeat(25000)],
+        ['repeated URL', 'http://a:b'.repeat(20000)],
+        ['colour per cell', '\x1b[31mx'.repeat(40000)],
+        ['unterminated key', '-----BEGIN RSA PRIVATE KEY-----\n' + ('A'.repeat(64) + '\n').repeat(3000)],
+    ])('adversarial input stays linear: %s', (_label, text) => {
+        const t0 = Date.now();
+        expect((0, redact_1.redact)(text).length).toBe(text.length);
+        expect(streamAll(text.match(/[\s\S]{1,4096}/g)).length).toBe(text.length);
+        expect(Date.now() - t0).toBeLessThan(3000);
+    });
+    it('redactInSlices matches redact on large text', async () => {
+        const big = (`line ${'x'.repeat(50)} RAILWAY_API_TOKEN=${UUID} ok\n`).repeat(2000);
+        expect(await (0, redact_1.redactInSlices)(big, 4096)).toBe((0, redact_1.redact)(big));
+        expect(await (0, redact_1.redactInSlices)(big, 4096)).not.toContain(UUID);
+    });
+});

package/dist/bridge/changesReport.js

@@ -68,6 +68,7 @@ exports.buildChangesReport = buildChangesReport;
 const crypto_1 = require("crypto");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const redact_1 = require("../secrets/redact");
 const DEFAULT_MAX_PATCH_BYTES = 64_000;
 const GENERATED_BASENAMES = new Set([
     'package-lock.json',
@@ -96,15 +97,21 @@ class GitStepError extends Error {
         super(label);
     }
 }
-/** Cuts `patch` to the last full line that fits within `maxBytes` (UTF-8 byte length). */
+/**
+ * Cuts `patch` to the last full line that fits within `maxBytes` (UTF-8 byte
+ * length), then masks any secret in it (2026-10-17: a committed .env line is
+ * as visible in the Changes panel as in a terminal). Masking is
+ * length-preserving ASCII, so the byte budget is unchanged; `contentHash` is
+ * still taken from the unmasked full patch by the caller.
+ */
 function truncatePatch(patch, maxBytes) {
     const buf = Buffer.from(patch, 'utf8');
     if (buf.length <= maxBytes)
-        return { text: patch, truncated: false };
+        return { text: (0, redact_1.redact)(patch), truncated: false };
     const slice = buf.subarray(0, maxBytes).toString('utf8');
     const lastNewline = slice.lastIndexOf('\n');
     const text = lastNewline >= 0 ? slice.slice(0, lastNewline + 1) : '';
-    return { text, truncated: true };
+    return { text: (0, redact_1.redact)(text), truncated: true };
 }
 function parseNameStatus(stdout) {
     const entries = [];

package/dist/bridge/contextWriter.js

@@ -176,12 +176,16 @@ function writeContextFile(input, claudeMdPath, seedPath, workspaceRoot, deps) {
     const browser = (0, workGraphPointer_1.browserSection)(input);
     if (browser)
         pointers.push(browser);
+    const keys = (0, workGraphPointer_1.keysSection)(input);
+    if (keys)
+        pointers.push(keys);
+    const sections = (0, workGraphPointer_1.withSecretsSection)(pointers);
     // wmr-07: a pointers-only refresh keeps the region's existing file content
     // rather than replacing it with the (absent) `content` argument.
     const fileContent = input.pointersOnly
         ? splitRegion(existingRegion).rest
         : (input.content ?? '').trim();
-    const block = pointerBlock(pointers);
+    const block = pointerBlock(sections);
     const parts = [block, fileContent].filter((part) => part.length > 0);
     const content = parts.join('\n\n');
     const isEmpty = content.trim().length === 0;