@workscribe/cli 3.0.0 → 3.1.0

package/dist/index.js

@@ -378,7 +378,7 @@ var init_logger = __esm({
       success: (msg) => console.log(import_chalk.default.green("\u2713"), msg),
       warn: (msg) => console.log(import_chalk.default.yellow("\u26A0"), msg),
       error: (msg) => console.error(import_chalk.default.red("\u2717"), msg),
-      /** A warning on stderr — keeps stdout clean for JSON output (summary.format=json) and pipes. */
+      /** A warning on stderr — keeps stdout clean for JSON and plain text output, and pipes. */
       notice: (msg) => process.stderr.write(`${import_chalk.default.yellow("\u26A0")} ${msg}
 `),
       plain: (msg) => console.log(msg)
@@ -2635,6 +2635,29 @@ var init_db = __esm({
 });
 
 // src/capture/redact.ts
+function sameCommand(maxParts) {
+  const quoted = String.raw`"[^"]{0,${MAX_QUOTED_LENGTH}}"|'[^']{0,${MAX_QUOTED_LENGTH}}'`;
+  return String.raw`(?:(?:${quoted}|\\\n|[^|;&\n"']){0,${maxParts}}?|[^|;&\n]{0,${maxParts}}?)`;
+}
+function valueAfter(prefix, flags = "g") {
+  return new RegExp(`(?<=${prefix})${VALUE}`, flags);
+}
+function toolFlagValue(tools, flag) {
+  return valueAfter(String.raw`${TOOL_WORD_START}(?:${tools})${TOOL_WORD_END}${SAME_COMMAND}\s${flag}`);
+}
+function quotedValuesAfterName(prefix, name, flags = "g") {
+  return [
+    new RegExp(String.raw`(?<=${prefix}"${name})[^"\s][^"\n]*`, flags),
+    new RegExp(String.raw`(?<=${prefix}'${name})[^'\s][^'\n]*`, flags)
+  ];
+}
+function valuesAfterName(prefix, name, flags = "g") {
+  return [
+    ...quotedValuesAfterName(prefix, name, flags),
+    new RegExp(String.raw`(?<=${prefix}${name})(?:${QUOTED})`, flags),
+    new RegExp(String.raw`(?<=${prefix}${name})[^\s"'|;&]+`, flags)
+  ];
+}
 function redact(command, extraPatterns = []) {
   let result = command;
   const allPatterns = [...BUILTIN_PATTERNS];
@@ -2646,22 +2669,73 @@ function redact(command, extraPatterns = []) {
   }
   for (const pattern of allPatterns) {
     pattern.lastIndex = 0;
-    result = result.replace(pattern, "[REDACTED]");
+    result = result.replace(pattern, REDACTED_TEXT);
   }
   return result;
 }
-var BUILTIN_PATTERNS;
+var QUOTED, WORD_REST, VALUE, VALUE_OR_DASHED, MAX_COMMAND_PARTS, MAX_QUOTED_LENGTH, MAX_PARTS_BEFORE_LOGIN, MAX_PARTS_AFTER_LOGIN, SAME_COMMAND, NOT_PART_OF_A_WORD, NOT_A_NAME, NOT_IN_A_MESSAGE, TOOL_WORD_START, TOOL_WORD_END, NOT_A_PORT_MAPPING, LONG_SECRET_FLAGS, LONG_FLAG_VALUE_START, MAX_SORT_FIELD_DIGITS, SORT_FIELD, NOT_A_KEY, MAX_SLUG_WORD_LENGTH, MAX_SLUG_WORDS_AFTER_FIRST, SLUG_WORD, UUID_IN_A_KEY, SLUG_AFTER_SK, CONTAINER_LOGIN_TOOLS, EVERYDAY_HEADERS, DISTINCTIVE_HEADERS, HEADER_FLAG, SENSITIVE_VARIABLE_WORDS, QUERY_SECRET_NAME, JSON_SECRET_NAME, BUILTIN_PATTERNS, REDACTED_TEXT;
 var init_redact = __esm({
   "src/capture/redact.ts"() {
     "use strict";
+    QUOTED = String.raw`"[^"]*"|'[^']*'`;
+    WORD_REST = String.raw`(?:[^\s"');&|]|["');&|](?=[^\s;&|)]))*`;
+    VALUE = String.raw`(?:${QUOTED}|[^\s"'\-]${WORD_REST})`;
+    VALUE_OR_DASHED = String.raw`(?:${QUOTED}|[^\s"']${WORD_REST})`;
+    MAX_COMMAND_PARTS = 1e3;
+    MAX_QUOTED_LENGTH = 64e3;
+    MAX_PARTS_BEFORE_LOGIN = 200;
+    MAX_PARTS_AFTER_LOGIN = 300;
+    SAME_COMMAND = sameCommand(MAX_COMMAND_PARTS);
+    NOT_PART_OF_A_WORD = String.raw`(?<![\w.:@-])`;
+    NOT_A_NAME = String.raw`(?<!--name(?:\s+|=)|\bssh\s+)`;
+    NOT_IN_A_MESSAGE = String.raw`(?<!\s(?:-[as]*m|--message|--title|--body|--subject)[\s=]*["'][^"'\n]{0,${MAX_COMMAND_PARTS}})`;
+    TOOL_WORD_START = `${NOT_IN_A_MESSAGE}${NOT_A_NAME}${NOT_PART_OF_A_WORD}`;
+    TOOL_WORD_END = String.raw`(?:\.exe)?["'\x60)]?(?=\s)`;
+    NOT_A_PORT_MAPPING = String.raw`(?!(?:[\d.]+:)?\d+:\d+(?:\/\w+)?(?=\s|$))`;
+    LONG_SECRET_FLAGS = [
+      "password",
+      "(?!no-)[\\w-]*-password",
+      "passwd",
+      "passphrase",
+      "pass",
+      "pwd",
+      "secret(?:-key)?",
+      "client[-_]secret",
+      "token",
+      "access-token",
+      "refresh-token",
+      "auth[-_]?token",
+      "private-key",
+      "api[-_]?key"
+    ].join("|");
+    LONG_FLAG_VALUE_START = String.raw`(?:=|\s+(?!--))`;
+    MAX_SORT_FIELD_DIGITS = 2;
+    SORT_FIELD = String.raw`\d{1,${MAX_SORT_FIELD_DIGITS}}`;
+    NOT_A_KEY = String.raw`(?:${SORT_FIELD}(?:[.,]${SORT_FIELD})*|[\w./~-]*\.(?:key|pem|crt|p12|pfx|der)|[\w./~-]*\/id_\w+)(?=\s|$)`;
+    MAX_SLUG_WORD_LENGTH = 15;
+    MAX_SLUG_WORDS_AFTER_FIRST = 8;
+    SLUG_WORD = `[a-z0-9]{1,${MAX_SLUG_WORD_LENGTH}}`;
+    UUID_IN_A_KEY = String.raw`[a-z-]{0,20}[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+    SLUG_AFTER_SK = String.raw`(?!${UUID_IN_A_KEY})${SLUG_WORD}(?:-${SLUG_WORD}){0,${MAX_SLUG_WORDS_AFTER_FIRST}}(?![\w-])`;
+    CONTAINER_LOGIN_TOOLS = "docker|podman|podman-remote|nerdctl|helm";
+    EVERYDAY_HEADERS = "api-key|cookie|set-cookie";
+    DISTINCTIVE_HEADERS = "x-api-key|x-auth-token|x-access-token";
+    HEADER_FLAG = String.raw`(?<![\w-])(?:-\w*H|--(?:proxy-)?header)[\s=]*`;
+    SENSITIVE_VARIABLE_WORDS = "TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIAL|_PWD";
+    QUERY_SECRET_NAME = String.raw`key|[\w-]*(?:token|secret|password|passwd|pwd|api[-_]?key)`;
+    JSON_SECRET_NAME = String.raw`[\w-]*(?:token|secret|password|passwd|pwd|api[-_]?key)`;
     BUILTIN_PATTERNS = [
       // AWS access keys
       /AKIA[0-9A-Z]{16}/g,
       // AWS secret access keys (40 char base64-ish after common env vars)
-      /(?<=AWS_SECRET_ACCESS_KEY[=\s]+)\S+/gi,
+      new RegExp(String.raw`(?<=AWS_SECRET_ACCESS_KEY[=\s]+)${VALUE_OR_DASHED}`, "gi"),
       // GitHub tokens
-      /ghp_[a-zA-Z0-9]{36}/g,
+      /\bgh[pousr]_[a-zA-Z0-9]{36}/g,
       /github_pat_[a-zA-Z0-9_]{82}/g,
+      // AI provider, Google and npm keys
+      new RegExp(String.raw`\bsk-(?!${SLUG_AFTER_SK})[\w-]{20,}`, "g"),
+      /\bAIza[a-zA-Z0-9_-]{30,}/g,
+      /\bnpm_[a-zA-Z0-9]{30,}/g,
       // GitLab tokens
       /glpat-[a-zA-Z0-9\-]{20}/g,
       // Generic JWTs (three base64url segments)
@@ -2671,17 +2745,85 @@ var init_redact = __esm({
       /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[a-zA-Z0-9]+/g,
       // Stripe keys
       /sk_(live|test)_[a-zA-Z0-9]{24,}/g,
-      // Values after long-form secret flags (single-char flags like -t/-p/-k are too ambiguous)
-      /(?<=--(password|passwd|secret|token|key|api[-_]?key|auth[-_]?token)\s+)\S+/gi,
+      // Values after long-form secret flags, `--flag value` or `--flag=value`. `--password-stdin` isn't one: no match on its
+      // `-stdin`. A bare short flag means nothing without knowing the tool: see below
+      new RegExp(String.raw`(?<=(?<![\w-])--(?:${LONG_SECRET_FLAGS})${LONG_FLAG_VALUE_START})${VALUE_OR_DASHED}`, "gi"),
+      new RegExp(String.raw`(?<=(?<![\w-])--key${LONG_FLAG_VALUE_START})(?!${NOT_A_KEY})${VALUE_OR_DASHED}`, "gi"),
+      // A password attached to the flag: `mysql -pSECRET`. `mysql -p db` prompts, so there's no value to remove, and
+      // `psql -p 5432` is a port, so psql isn't listed
+      toolFlagValue(
+        "mysql|mysqldump|mysqladmin|mysqlimport|mysqlshow|mysqlcheck|mariadb|mariadb-dump|mariadb-admin|mariadb-import|mariadb-show|mariadb-check",
+        "-p"
+      ),
+      // Short flags that take a secret, for the tools where they do
+      toolFlagValue("sshpass", String.raw`-p\s*`),
+      toolFlagValue("mongosh|mongo|mongodump|mongorestore|mongoexport|mongoimport", String.raw`-p\s*${NOT_A_PORT_MAPPING}`),
+      toolFlagValue("redis-cli", String.raw`-a\s*`),
+      toolFlagValue("ssh-keygen", String.raw`-[NP]\s*`),
+      toolFlagValue("zip|unzip", String.raw`-P\s*`),
+      valueAfter(
+        String.raw`${TOOL_WORD_START}(?:${CONTAINER_LOGIN_TOOLS})${TOOL_WORD_END}[^|;&\n]{0,${MAX_PARTS_BEFORE_LOGIN}}?\slogin` + String.raw`${TOOL_WORD_END}${sameCommand(MAX_PARTS_AFTER_LOGIN)}\s-p\s*${NOT_A_PORT_MAPPING}`
+      ),
+      // openssl's `-pass pass:SECRET`, also -passin and -passout
+      /(?<=\s-pass(?:in|out|word)?\s+pass:)\S+/g,
+      // curl's cookies, which also covers a cookie file's name: `curl -b s=SECRET`
+      valueAfter(String.raw`\bcurl\b["']?${SAME_COMMAND}\s(?:--cookie|-\w*b)[\s=]+`),
+      // The password half of `curl -u user:password`
+      ...valuesAfterName(String.raw`\bcurl\b["']?${SAME_COMMAND}\s(?:-\w*u[\s=]*|--user[\s=]+)`, String.raw`[^:\s"']*:`),
+      // Tokens handed over on stdin: `echo SECRET | docker login --password-stdin`, `gh auth login --with-token <<< SECRET`
+      new RegExp(
+        String.raw`(?<=\b(?:echo(?:\s+-[neE]+)*|printf(?:\s+["']?%s(?:\\n)?["']?)?)\s+)${VALUE}` + String.raw`(?=\s*\|[^;&\n]{0,${MAX_COMMAND_PARTS}}?--(?:password-stdin|with-token))`,
+        "g"
+      ),
+      valueAfter(String.raw`--(?:password-stdin|with-token)\s*<<<\s*`),
+      // Headers. A scheme or a header flag is required for Authorization, so prose like "Authorization: added middleware"
+      // stays. An everyday word needs to look like a header, so `git commit -m "cookie: rotate on login"` stays: a header
+      // flag, `Cookie:value` with no space, or a quoted `"Cookie: value"` outside a message
+      /(?<=\bauthorization:\s*(?:bearer|basic|token)\s+)[^\s"']+/gi,
+      /(?<=\bbearer\s+)(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{8,}/gi,
+      ...valuesAfterName(HEADER_FLAG, String.raw`(?:${EVERYDAY_HEADERS}):\s*`, "gi"),
+      ...valuesAfterName(HEADER_FLAG, String.raw`authorization:\s*(?!(?:bearer|basic|token)\s)`, "gi"),
+      ...quotedValuesAfterName("", String.raw`${NOT_IN_A_MESSAGE}(?:${EVERYDAY_HEADERS}):\s*`, "gi"),
+      ...valuesAfterName("", String.raw`(?<![\w-])(?:${EVERYDAY_HEADERS}):`, "gi"),
+      ...valuesAfterName("", String.raw`\b(?:${DISTINCTIVE_HEADERS}):\s*`, "gi"),
+      // Private keys, whole blocks, as heredocs and `echo` can carry them
+      /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+      // password=... inside a string or query: `psql "host=x password=SECRET"`, `--set db.password=SECRET`
+      /(?<=(?:^|[\s"'?&=.])(?:password|passwd|pwd)=)[^\s"';&]+/gi,
+      // A secret in a query string or in JSON: `curl "x.io?token=SECRET"`, `curl -d '{"password":"SECRET"}'`
+      new RegExp(String.raw`(?<=[?&](?:${QUERY_SECRET_NAME})=)[^\s"'&#]+`, "gi"),
+      new RegExp(String.raw`(?<=["'](?:${JSON_SECRET_NAME})\\?["']\s*:\s*\\?")[^"\\\n]+`, "gi"),
+      // npm's auth settings, with or without `=`: `npm config set //registry/:_password SECRET`
+      /(?<=:_(?:password|auth|authToken)[=\s]+)\S+/g,
       // export VAR=VALUE where VAR looks sensitive
-      /(?<=export\s+(?:[A-Z_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIAL)[A-Z_]*)=)\S+/gi,
+      new RegExp(String.raw`(?<=export\s+(?:[A-Z_]*(?:${SENSITIVE_VARIABLE_WORDS})[A-Z_]*)=)${VALUE_OR_DASHED}`, "gi"),
       // Inline assignment: VAR_WITH_SENSITIVE_KEYWORD=value cmd  (e.g. API_KEY=secret npm start)
       // Lookbehind matches only the variable-name= prefix, so only the value is replaced
-      /(?<=[A-Z_][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIAL)[A-Z0-9_]*=)\S+/gi,
+      new RegExp(String.raw`(?<=[A-Z_][A-Z0-9_]*(?:${SENSITIVE_VARIABLE_WORDS})[A-Z0-9_]*=)${VALUE_OR_DASHED}`, "gi"),
+      // The same with nothing before the keyword: `TOKEN=SECRET npm start`. Capitals only, so `--author=me` and `key=value` stay
+      new RegExp(
+        String.raw`(?<=(?:^|[\s;&|(])(?:TOKEN|SECRET|KEY|PASSWORD|PASS|AUTH|CREDENTIALS?)=)${VALUE_OR_DASHED}`,
+        "g"
+      ),
       // Credentials embedded in connection string URLs (e.g. DATABASE_URL=postgres://user:pass@host/db)
       // Matches the password segment between :// user : password @ — preserves scheme and host
-      /(?<=[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:@\s/]+:)[^@\s]+(?=@)/g
+      /(?<=[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:@\s/]*:)[^@\s]+(?=@)/g,
+      // A token as the whole userinfo of an https URL: `git clone https://TOKEN@github.com/org/repo`
+      /(?<=https?:\/\/)[^\s:@/?#]+(?=@)/g
     ];
+    REDACTED_TEXT = "[REDACTED]";
+  }
+});
+
+// src/capture/hint.ts
+function commandHint(safeCommand) {
+  return safeCommand.trim().slice(0, HINT_LENGTH);
+}
+var HINT_LENGTH;
+var init_hint = __esm({
+  "src/capture/hint.ts"() {
+    "use strict";
+    HINT_LENGTH = 120;
   }
 });
 
@@ -2853,13 +2995,13 @@ var init_git_snapshot = __esm({
 });
 
 // src/capture/aider.ts
-function readLastAiderPrompt(cwd) {
+function readLastAiderPrompt(cwd, extraRedactions = []) {
   try {
     const histPath = import_path8.default.join(cwd, HISTORY_FILE);
     const content = import_fs10.default.readFileSync(histPath, "utf-8");
     const matches = [...content.matchAll(/^#### (.+)$/gm)];
     if (!matches.length) return null;
-    return matches[matches.length - 1][1].trim().slice(0, PROMPT_MAX_LENGTH);
+    return redact(matches[matches.length - 1][1].trim(), extraRedactions).slice(0, PROMPT_MAX_LENGTH);
   } catch {
     return null;
   }
@@ -2870,6 +3012,7 @@ var init_aider = __esm({
     "use strict";
     import_fs10 = __toESM(require("fs"));
     import_path8 = __toESM(require("path"));
+    init_redact();
     HISTORY_FILE = ".aider.chat.history.md";
     PROMPT_MAX_LENGTH = 200;
   }
@@ -3115,7 +3258,7 @@ function captureCommand(opts) {
         if (Date.now() - lastTime < TASK_RUN_DEDUP_WINDOW_MS) return;
       }
     }
-    const command2 = opts.command ?? opts.file ?? opts.type;
+    const command2 = opts.command === void 0 ? opts.file ?? opts.type : redact(opts.command, config.redact.extra);
     const context2 = getRepoContext(cwd, config);
     const { repoName: repoName2, branch: branch2 } = context2;
     const ideEvent = {
@@ -3149,17 +3292,17 @@ function captureCommand(opts) {
   if (category === "other") {
     const firstToken = safeCommand.trim().split(/\s+/)[0];
     if (firstToken) metadata.tool = firstToken;
-    metadata.hint = safeCommand.trim().slice(0, 120);
+    metadata.hint = commandHint(safeCommand);
   }
   if (category === "ai_session") {
     if (opts.gitBefore) {
       const commits = getCommitsSince(opts.gitBefore, workDirectory);
-      if (commits.length > 0) metadata.commits = commits;
+      if (commits.length > 0) metadata.commits = commits.map((subject) => redact(subject, config.redact.extra));
     }
     if (config.capture.includeAiderPrompt !== false) {
       const toolEntry = loadAIToolRegistry().find((entry) => entry.tool === metadata.tool);
       if (toolEntry?.contextSource === "history-file") {
-        const prompt = readLastAiderPrompt(cwd);
+        const prompt = readLastAiderPrompt(cwd, config.redact.extra);
         if (prompt) metadata.prompt = prompt;
       }
     }
@@ -3192,6 +3335,7 @@ var init_capture = __esm({
     import_fs14 = __toESM(require("fs"));
     init_db();
     init_redact();
+    init_hint();
     init_git();
     init_git_snapshot();
     init_aider();
@@ -3531,16 +3675,58 @@ var init_completions_block = __esm({
 });
 
 // src/capture/shell-hook.ts
+function detectShell() {
+  const shell = process.env.SHELL ?? "";
+  if (shell.includes("zsh")) return { name: "zsh", rcFile: import_path14.default.join(import_os3.default.homedir(), ".zshrc") };
+  if (shell.includes("bash")) return { name: "bash", rcFile: import_path14.default.join(import_os3.default.homedir(), ".bashrc") };
+  if (shell.includes("fish")) {
+    return { name: "fish", rcFile: import_path14.default.join(import_os3.default.homedir(), ".config", "fish", "conf.d", "workscribe.fish") };
+  }
+  return null;
+}
+function blockRegion(content, markers) {
+  const blockStart = content.indexOf(markers.start);
+  const blockEnd = content.indexOf(markers.end, blockStart);
+  if (blockStart === -1 || blockEnd === -1) return null;
+  const lines = content.slice(0, blockStart).split("\n");
+  lines.pop();
+  let headerLines = 0;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const line = lines[index];
+    if (!markers.preamble.test(line) && line.trim() !== "") break;
+    headerLines = lines.length - index;
+  }
+  while (headerLines > 0 && lines[lines.length - headerLines].trim() === "") headerLines -= 1;
+  const header = lines.slice(lines.length - headerLines);
+  const headerLength = header.reduce((length, line) => length + line.length + 1, 0);
+  return { start: blockStart - headerLength, end: blockEnd + markers.end.length };
+}
+function hookRegion(content) {
+  return blockRegion(content, { start: HOOK_START, end: HOOK_END, preamble: PREAMBLE_LINE });
+}
+function findChronicleHook(content) {
+  return blockRegion(content, { start: CHRONICLE_START, end: CHRONICLE_END, preamble: CHRONICLE_PREAMBLE_LINE });
+}
+function hookBlockOf(hookContent) {
+  const startIndex = hookContent.indexOf(HOOK_START);
+  const endIndex = hookContent.indexOf(HOOK_END);
+  if (startIndex === -1 || endIndex === -1) return hookContent.trim();
+  return hookContent.slice(startIndex, endIndex + HOOK_END.length);
+}
+function installedHookVersion(block) {
+  const match = HOOK_VERSION_LINE.exec(block);
+  return match ? Number(match[1]) : 1;
+}
 function backUp(rcFile) {
   log.info(`Backed up ${rcFile} \u2192 ${import_path14.default.basename(backUpFile(rcFile))}`);
 }
 function getInstalledHookBlock(rcFile) {
-  if (!import_fs17.default.existsSync(rcFile)) return null;
-  const content = import_fs17.default.readFileSync(rcFile, "utf-8");
-  const startIdx = content.indexOf(HOOK_START);
-  const endIdx = content.indexOf(HOOK_END);
-  if (startIdx === -1 || endIdx === -1) return null;
-  return content.slice(startIdx, endIdx + HOOK_END.length);
+  const content = import_fs17.default.existsSync(rcFile) ? readRcFile(rcFile) : null;
+  if (content === null) return null;
+  const startIndex = content.indexOf(HOOK_START);
+  const endIndex = content.indexOf(HOOK_END);
+  if (startIndex === -1 || endIndex === -1) return null;
+  return content.slice(startIndex, endIndex + HOOK_END.length);
 }
 function isHookInstalled(rcFile) {
   return getInstalledHookBlock(rcFile) !== null;
@@ -3548,7 +3734,7 @@ function isHookInstalled(rcFile) {
 function isHookOutdated(rcFile, hookContent) {
   const installed = getInstalledHookBlock(rcFile);
   if (!installed) return false;
-  return installed.trim() !== hookContent.trim();
+  return installed.trim() !== hookBlockOf(hookContent).trim();
 }
 function installHook(rcFile, hookContent) {
   backUp(rcFile);
@@ -3559,20 +3745,41 @@ ${hookContent}
 function updateHook(rcFile, hookContent) {
   backUp(rcFile);
   const content = import_fs17.default.readFileSync(rcFile, "utf-8");
-  const startIdx = content.indexOf(HOOK_START);
-  const endIdx = content.indexOf(HOOK_END) + HOOK_END.length;
-  import_fs17.default.writeFileSync(rcFile, content.slice(0, startIdx) + hookContent + content.slice(endIdx));
+  const region = hookRegion(content);
+  if (!region) return;
+  import_fs17.default.writeFileSync(rcFile, content.slice(0, region.start) + hookContent.trimEnd() + content.slice(region.end));
+}
+function withoutRegion(content, region) {
+  const before = content.slice(0, region.start).replace(/\n+$/, "\n");
+  const after = content.slice(region.end).replace(/^\n/, "");
+  return before + after;
 }
 function removeHook(rcFile) {
   backUp(rcFile);
   const content = import_fs17.default.readFileSync(rcFile, "utf-8");
-  const startIdx = content.indexOf(HOOK_START);
-  const endIdx = content.indexOf(HOOK_END) + HOOK_END.length;
-  const preambleIdx = content.lastIndexOf(HOOK_PREAMBLE, startIdx);
-  const blockStart = preambleIdx !== -1 ? preambleIdx : startIdx;
-  const before = content.slice(0, blockStart).replace(/\n+$/, "\n");
-  const after = content.slice(endIdx).replace(/^\n/, "");
-  import_fs17.default.writeFileSync(rcFile, before + after);
+  const region = hookRegion(content);
+  if (!region) return;
+  import_fs17.default.writeFileSync(rcFile, withoutRegion(content, region));
+}
+function hasChronicleHook(rcFile) {
+  const content = readRcFile(rcFile);
+  return content !== null && findChronicleHook(content) !== null;
+}
+function removeChronicleHook(rcFile) {
+  const content = readRcFile(rcFile);
+  const region = content === null ? null : findChronicleHook(content);
+  if (content === null || !region) return false;
+  backUp(rcFile);
+  import_fs17.default.writeFileSync(rcFile, withoutRegion(content, region));
+  return true;
+}
+function shellHookHealth(shell) {
+  const installed = getInstalledHookBlock(shell.rcFile);
+  const currentVersion = SHELL_HOOK_VERSIONS[shell.name] ?? 1;
+  return {
+    isOutdated: installed !== null && installedHookVersion(installed) < currentVersion,
+    hasChronicleHook: hasChronicleHook(shell.rcFile)
+  };
 }
 function resolveWorkscribeBinary() {
   try {
@@ -3651,7 +3858,7 @@ function removeFishCompletions() {
   import_fs17.default.rmSync(FISH_COMPLETIONS_FILE, { force: true });
   return true;
 }
-var import_fs17, import_path14, import_os3, import_child_process3, FISH_COMPLETIONS_DIR, HOOK_START, HOOK_END, HOOK_PREAMBLE, FISH_COMPLETIONS_FILE;
+var import_fs17, import_path14, import_os3, import_child_process3, FISH_COMPLETIONS_DIR, HOOK_START, HOOK_END, PREAMBLE_LINE, HOOK_VERSION_LINE, SHELL_HOOK_VERSIONS, CHRONICLE_START, CHRONICLE_END, CHRONICLE_PREAMBLE_LINE, FISH_COMPLETIONS_FILE;
 var init_shell_hook = __esm({
   "src/capture/shell-hook.ts"() {
     "use strict";
@@ -3668,7 +3875,12 @@ var init_shell_hook = __esm({
     FISH_COMPLETIONS_DIR = import_path14.default.join(import_os3.default.homedir(), ".config", "fish", "completions");
     HOOK_START = "# workscribe:hook:start";
     HOOK_END = "# workscribe:hook:end";
-    HOOK_PREAMBLE = "# Workscribe \u2014 developer work journal";
+    PREAMBLE_LINE = /^# (?:Workscribe — developer work journal|Do not edit this (?:block|file) manually\. Managed by `workscribe init`\.)$/;
+    HOOK_VERSION_LINE = /^# workscribe:hook-version (\d+)$/m;
+    SHELL_HOOK_VERSIONS = Object.freeze({ zsh: 2, bash: 2, fish: 1 });
+    CHRONICLE_START = "# chronicle:hook:start";
+    CHRONICLE_END = "# chronicle:hook:end";
+    CHRONICLE_PREAMBLE_LINE = /^# (?:Chronicle — developer work journal|Do not edit this block manually\. Managed by `chronicle init`\.)$/;
     FISH_COMPLETIONS_FILE = import_path14.default.join(FISH_COMPLETIONS_DIR, "workscribe.fish");
   }
 });
@@ -4305,10 +4517,10 @@ function installIntoFolder(options) {
     const outcome = installSkill({
       sourceDir: options.sourceDir,
       skillsFolder: target.skillsFolder,
-      version: "3.0.0",
+      version: "3.1.0",
       force: options.force
     });
-    return describeInstallOutcome({ ...target, outcome, version: "3.0.0" });
+    return describeInstallOutcome({ ...target, outcome, version: "3.1.0" });
   } catch (error) {
     return describeInstallFailure({ ...target, error });
   }
@@ -4327,8 +4539,8 @@ function removeSkills(agents, options) {
 }
 function formatAgentSkillLine(agent, homeDir = import_os6.default.homedir()) {
   const location = displayPath(import_path19.default.join(homeDir, agent.skillsFolder, SKILL_NAME), homeDir);
-  const installState = readInstallState(import_path19.default.join(homeDir, agent.skillsFolder), "3.0.0");
-  const status = describeSkillStatus(installState, "3.0.0");
+  const installState = readInstallState(import_path19.default.join(homeDir, agent.skillsFolder), "3.1.0");
+  const status = describeSkillStatus(installState, "3.1.0");
   return `${agent.name.padEnd(AGENT_NAME_COLUMN_WIDTH)} ${STATUS_COLOURS[status.level](status.text)}  ${import_chalk2.default.dim(location)}`;
 }
 function formatUndetectedAgentLine(agent) {
@@ -4424,16 +4636,6 @@ var init_legacy_ai_cleanup = __esm({
 });
 
 // src/cli/init.ts
-function detectShell() {
-  const shell = process.env.SHELL ?? "";
-  if (shell.includes("zsh")) return { name: "zsh", rcFile: import_path20.default.join(import_os7.default.homedir(), ".zshrc") };
-  if (shell.includes("bash")) return { name: "bash", rcFile: import_path20.default.join(import_os7.default.homedir(), ".bashrc") };
-  if (shell.includes("fish")) {
-    const confDir = import_path20.default.join(import_os7.default.homedir(), ".config", "fish", "conf.d");
-    return { name: "fish", rcFile: import_path20.default.join(confDir, "workscribe.fish") };
-  }
-  return null;
-}
 function step(current, total, label) {
   log.plain(import_chalk3.default.bold(`
   [${current}/${total}] ${label}`));
@@ -4479,6 +4681,21 @@ async function runTelemetryStep(config) {
   config.telemetry.enabled = telemetryEnabled;
   config.telemetry.installId = ensureInstallId(config);
 }
+async function offerChronicleCleanup(shell) {
+  if (!hasChronicleHook(shell.rcFile)) return;
+  const { removeChronicle } = await (0, import_prompts2.default)({
+    type: "confirm",
+    name: "removeChronicle",
+    message: `An old Chronicle hook in ${shell.rcFile} errors at every prompt. Remove it?`,
+    initial: true
+  });
+  if (!removeChronicle) {
+    log.info("Chronicle hook left in place");
+    return;
+  }
+  removeChronicleHook(shell.rcFile);
+  log.success(`Removed the old Chronicle hook from ${shell.rcFile}`);
+}
 async function runShellHookStep(program) {
   step(3, TOTAL_STEPS, "Installing shell hook");
   const shell = detectShell();
@@ -4527,6 +4744,7 @@ async function runShellHookStep(program) {
   } else {
     log.info(`Shell hook up to date in ${shell.rcFile}`);
   }
+  await offerChronicleCleanup(shell);
   if (isCompletionsInstalled(shell)) {
     await refreshCompletions(shell, program);
   } else {
@@ -4614,10 +4832,10 @@ async function runAIToolsStep() {
 }
 async function offerSkillInstall(group, sourceDir) {
   const target = describeTarget(group);
-  const state = readInstallState(target.skillsFolder, "3.0.0");
+  const state = readInstallState(target.skillsFolder, "3.1.0");
   const knownOutcome = outcomeWithoutPrompt(state);
   if (knownOutcome) {
-    printMessage(describeInstallOutcome({ ...target, outcome: knownOutcome, version: "3.0.0" }));
+    printMessage(describeInstallOutcome({ ...target, outcome: knownOutcome, version: "3.1.0" }));
     return;
   }
   const { installSkill: shouldInstall } = await (0, import_prompts2.default)({
@@ -4720,13 +4938,12 @@ function registerInit(program) {
     printNextSteps(shell);
   });
 }
-var import_fs22, import_path20, import_os7, import_prompts2, import_chalk3, TOTAL_STEPS;
+var import_fs22, import_path20, import_prompts2, import_chalk3, TOTAL_STEPS;
 var init_init = __esm({
   "src/cli/init.ts"() {
     "use strict";
     import_fs22 = __toESM(require("fs"));
     import_path20 = __toESM(require("path"));
-    import_os7 = __toESM(require("os"));
     import_prompts2 = __toESM(require("prompts"));
     import_chalk3 = __toESM(require("chalk"));
     init_paths();
@@ -4823,14 +5040,14 @@ var init_format = __esm({
 
 // src/cli/notices.ts
 function printLegacyAiNotice(config) {
-  const notice = describeLegacyAiSettings(config, displayPath(CONFIG_PATH, import_os8.default.homedir()));
+  const notice = describeLegacyAiSettings(config, displayPath(CONFIG_PATH, import_os7.default.homedir()));
   if (notice) log.notice(notice);
 }
-var import_os8;
+var import_os7;
 var init_notices = __esm({
   "src/cli/notices.ts"() {
     "use strict";
-    import_os8 = __toESM(require("os"));
+    import_os7 = __toESM(require("os"));
     init_logger();
     init_paths();
     init_legacy_ai();
@@ -5595,6 +5812,117 @@ var init_ticket_refs = __esm({
   }
 });
 
+// src/db/jobs/scrub-secrets.ts
+function scrubValue(value, command) {
+  if (command.after.includes(value)) return value;
+  const redacted = redact(value);
+  if (redacted !== value) return redacted;
+  return command.before.includes(value) ? REDACTED_TEXT : value;
+}
+function scrubStrings(value, command) {
+  if (typeof value === "string") return scrubValue(value, command);
+  if (Array.isArray(value)) return value.map((item) => scrubStrings(item, command));
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, scrubStrings(item, command)]));
+}
+function hasHint(value) {
+  return typeof value?.hint === "string";
+}
+function scrubMetadata(metadata, command) {
+  if (metadata === null) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(metadata);
+  } catch {
+    return redact(metadata);
+  }
+  const scrubbed = scrubStrings(parsed, command);
+  if (command.after !== command.before && hasHint(scrubbed)) scrubbed.hint = commandHint(command.after);
+  const rewritten = JSON.stringify(scrubbed);
+  return rewritten === JSON.stringify(parsed) ? metadata : rewritten;
+}
+function scrubEvent({ command, metadata }) {
+  const scrubbedCommand = redact(command);
+  const scrubbedMetadata = scrubMetadata(metadata, { before: command, after: scrubbedCommand });
+  if (scrubbedCommand === command && scrubbedMetadata === metadata) return null;
+  return { command: scrubbedCommand, metadata: scrubbedMetadata };
+}
+function readEvents(db, afterId, limit) {
+  return db.prepare(
+    `SELECT id, command, metadata FROM events
+       WHERE id > ? AND command IS NOT file_path
+       ORDER BY id LIMIT ?`
+  ).all(afterId, limit);
+}
+function runBatch5(db, afterId, limit) {
+  const events = readEvents(db, afterId, limit);
+  if (events.length === 0) return { lastId: null, issues: [] };
+  const update = db.prepare("UPDATE events SET command = ?, metadata = ? WHERE id = ?");
+  for (const event of events) {
+    const scrubbed = scrubEvent(event);
+    if (scrubbed) update.run(scrubbed.command, scrubbed.metadata, event.id);
+  }
+  return { lastId: events[events.length - 1].id, issues: [] };
+}
+function verify4(db) {
+  let checked = 0;
+  let unresolved = 0;
+  let afterId = 0;
+  for (; ; ) {
+    const events = readEvents(db, afterId, VERIFY_PAGE_SIZE);
+    if (events.length === 0) break;
+    checked += events.length;
+    unresolved += events.filter((event) => scrubEvent(event) !== null).length;
+    afterId = events[events.length - 1].id;
+  }
+  const notes = unresolved > 0 ? [`events that would still change: ${unresolved}`] : [];
+  return { checked, resolved: checked - unresolved, unresolved, hasPassed: true, notes };
+}
+function cleanUpFile(db) {
+  db.exec(`PRAGMA busy_timeout = ${CLEANUP_LOCK_WAIT_MS}`);
+  try {
+    if (getMetaValue(db, CLEANUP_KEY) === CLEANUP_NEEDS_VACUUM) {
+      db.exec("VACUUM");
+      setMetaValue(db, CLEANUP_KEY, CLEANUP_NEEDS_CHECKPOINT);
+    }
+    const result = db.prepare("PRAGMA wal_checkpoint(TRUNCATE)").get();
+    if (result?.busy) {
+      debugLog(`data job ${JOB_NAME}: file cleanup`, "left for later, a reader is busy");
+      return;
+    }
+    deleteMetaValue(db, CLEANUP_KEY);
+  } finally {
+    db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
+  }
+}
+var JOB_NAME, VERIFY_PAGE_SIZE, CLEANUP_KEY, CLEANUP_NEEDS_VACUUM, CLEANUP_NEEDS_CHECKPOINT, CLEANUP_LOCK_WAIT_MS, scrubSecretsJob;
+var init_scrub_secrets = __esm({
+  "src/db/jobs/scrub-secrets.ts"() {
+    "use strict";
+    init_transaction();
+    init_store2();
+    init_hint();
+    init_redact();
+    init_logger();
+    JOB_NAME = "scrub-secrets";
+    VERIFY_PAGE_SIZE = 500;
+    CLEANUP_KEY = "scrub-secrets:file-cleanup";
+    CLEANUP_NEEDS_VACUUM = "vacuum";
+    CLEANUP_NEEDS_CHECKPOINT = "checkpoint";
+    CLEANUP_LOCK_WAIT_MS = 200;
+    scrubSecretsJob = {
+      name: JOB_NAME,
+      version: 1,
+      description: "Remove secrets from stored commands and metadata",
+      // Redacting what's already redacted changes nothing, so a rerun only needs the file cleaned again
+      prepare: (db) => setMetaValue(db, CLEANUP_KEY, CLEANUP_NEEDS_VACUUM),
+      runBatch: runBatch5,
+      verify: verify4,
+      cleanup: { isPending: (db) => getMetaValue(db, CLEANUP_KEY) !== null, run: cleanUpFile }
+    };
+  }
+});
+
 // src/db/jobs/index.ts
 var JOBS;
 var init_jobs = __esm({
@@ -5605,10 +5933,12 @@ var init_jobs = __esm({
     init_summary_anchors();
     init_drop_old_sessions();
     init_ticket_refs();
+    init_scrub_secrets();
     JOBS = [
       createProjectDimensionsJob({ probeDirectory }),
       summaryAnchorsJob,
       ticketRefsJob,
+      scrubSecretsJob,
       dropOldSessionsJob
     ];
   }
@@ -5773,9 +6103,22 @@ function recordFailure(db, job, message) {
     debugLog(`data job ${job.name}: couldn't record the failure`, error);
   }
 }
+function runPendingCleanups(db, jobs) {
+  for (const job of jobs) {
+    if (!job.cleanup || !isJobDone(getJobRow(db, job.name), job)) continue;
+    try {
+      if (job.cleanup.isPending(db)) job.cleanup.run(db);
+    } catch (error) {
+      debugLog(`data job ${job.name}: cleanup`, error);
+    }
+  }
+}
 function runPendingJobs(db, jobs, options) {
   const pending = jobs.filter((job) => !isJobDone(getJobRow(db, job.name), job));
-  if (pending.length === 0) return { backup: "not-needed", jobs: [] };
+  if (pending.length === 0) {
+    runPendingCleanups(db, jobs);
+    return { backup: "not-needed", jobs: [] };
+  }
   const backup = options.ensureBackup();
   if (backup !== "ready") return { backup, jobs: [] };
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -5792,6 +6135,7 @@ function runPendingJobs(db, jobs, options) {
     results.push(result);
     if (result.outcome !== "done") break;
   }
+  runPendingCleanups(db, jobs);
   return { backup: "ready", jobs: results };
 }
 var DEFAULT_BATCH_SIZE, BATCH_LOCK_WAIT_MS, NEWER_VERSION_ERROR, SupersededError;
@@ -5935,6 +6279,23 @@ function formatDataLines(status) {
   if (status.latestBackup) lines.push(import_chalk4.default.dim(`               backup: ${status.latestBackup}`));
   return lines;
 }
+function printShellHookWarnings() {
+  const shell = detectShell();
+  if (!shell) return;
+  const health = shellHookHealth(shell);
+  if (health.isOutdated) {
+    log.plain("");
+    log.plain(
+      `  ${import_chalk4.default.yellow("\u26A0")}  Your ${shell.name} hook is from an older version and may not record terminal commands.`
+    );
+    log.plain(import_chalk4.default.dim("     Run workscribe init to update it, then open a new terminal"));
+  }
+  if (health.hasChronicleHook) {
+    log.plain("");
+    log.plain(`  ${import_chalk4.default.yellow("\u26A0")}  An old Chronicle hook in ${shell.rcFile} errors at every prompt.`);
+    log.plain(import_chalk4.default.dim("     Run workscribe init to remove it"));
+  }
+}
 function registerStatus(program) {
   program.command("status").description("Show capture status and event counts").action(() => {
     const config = readConfig();
@@ -5976,6 +6337,7 @@ function registerStatus(program) {
         `  ${import_chalk4.default.yellow("!")}  ${import_chalk4.default.yellow(String(pendingAlerts.length))} pending security alert${pendingAlerts.length === 1 ? "" : "s"}` + import_chalk4.default.dim("  (run: workscribe alerts)")
       );
     }
+    printShellHookWarnings();
     const hookHealth = checkHookHealth();
     if (hookHealth.installed && !hookHealth.pinned) {
       log.plain("");
@@ -6034,6 +6396,7 @@ var init_status = __esm({
     init_paths();
     init_alerts2();
     init_claude_code();
+    init_shell_hook();
     init_detect();
     init_actions();
     init_notices();
@@ -6455,7 +6818,7 @@ var init_heading = __esm({
 
 // src/summary/payload.ts
 function locationContextFrom(config) {
-  return { projects: config.projects ?? {}, homeDir: import_os9.default.homedir() };
+  return { projects: config.projects ?? {}, homeDir: import_os8.default.homedir() };
 }
 function gitMovesField(row) {
   if (!MENTIONS_GIT.test(row.command)) return {};
@@ -6536,11 +6899,11 @@ function threadToPayload(thread, block, options = {}) {
     alongside: block.threads.filter((other) => other.id !== thread.id).map((other) => sessionLocation(other, options.context) ?? UNKNOWN_LOCATION)
   };
 }
-var import_os9, import_path25, DEFAULT_LOCATION_CONTEXT, MENTIONS_GIT;
+var import_os8, import_path25, DEFAULT_LOCATION_CONTEXT, MENTIONS_GIT;
 var init_payload = __esm({
   "src/summary/payload.ts"() {
     "use strict";
-    import_os9 = __toESM(require("os"));
+    import_os8 = __toESM(require("os"));
     import_path25 = __toESM(require("path"));
     init_format();
     init_event_metadata();
@@ -6550,7 +6913,7 @@ var init_payload = __esm({
     init_grouper();
     init_blocks();
     init_heading();
-    DEFAULT_LOCATION_CONTEXT = { projects: {}, homeDir: import_os9.default.homedir() };
+    DEFAULT_LOCATION_CONTEXT = { projects: {}, homeDir: import_os8.default.homedir() };
     MENTIONS_GIT = /(^|[\s;&|(])git\s/;
   }
 });
@@ -7865,18 +8228,18 @@ async function postSummary({
   }
   try {
     status.info("Posting to webhook\u2026");
-    const body = isSlackWebhookUrl(webhookUrl) ? formatForSlack(summary, import_os10.default.userInfo().username) : summary;
+    const body = isSlackWebhookUrl(webhookUrl) ? formatForSlack(summary, import_os9.default.userInfo().username) : summary;
     await postToWebhook(webhookUrl, body);
     status.success("Posted.");
   } catch (error) {
     log.error(`Webhook failed: ${error.message}`);
   }
 }
-var import_os10;
+var import_os9;
 var init_webhook2 = __esm({
   "src/summary/webhook.ts"() {
     "use strict";
-    import_os10 = __toESM(require("os"));
+    import_os9 = __toESM(require("os"));
     init_logger();
     init_webhook();
     init_slack();
@@ -8028,6 +8391,28 @@ var init_day = __esm({
   }
 });
 
+// src/summary/output-format.ts
+function keepsStdoutClean(format) {
+  return format === "json" || format === "text";
+}
+var SUMMARY_FORMATS;
+var init_output_format = __esm({
+  "src/summary/output-format.ts"() {
+    "use strict";
+    SUMMARY_FORMATS = ["markdown", "json", "text"];
+  }
+});
+
+// src/summary/plain-text.ts
+function toPlainText(markdown) {
+  return markdown.replace(/^#{1,6} +/gm, "").replace(/^([ \t]*)[*•] +/gm, "$1- ").replace(/\*\*([^*\n]+)\*\*/g, "$1").replace(/`([^`\n]+)`/g, "$1").replace(/\[([^\]\n]+)\]\(([^)\s]+)\)/g, "$1 ($2)").trim();
+}
+var init_plain_text = __esm({
+  "src/summary/plain-text.ts"() {
+    "use strict";
+  }
+});
+
 // src/cli/day-notes.ts
 function printExcludedFooter(sessionPayloads, excluded) {
   const excludedCounts = countExcludedEvents(sessionPayloads, excluded);
@@ -8103,10 +8488,11 @@ async function runWeeklySummary({ options, config, provider, loadDay }) {
   }
   const payload = { weekStart, weekEnd: today, by: options.by ?? "project", days };
   const summary = await writeWeeklySummary(provider, payload);
-  const isJson = config.summary?.format === "json";
-  if (isJson) log.plain(weekJson(payload, config.summary?.includeCategories ?? []));
+  const format = options.format ?? config.summary?.format;
+  if (format === "json") log.plain(weekJson(payload, config.summary?.includeCategories ?? []));
+  else if (format === "text") log.plain(toPlainText(summary));
   else printSummary(summary);
-  await postSummary({ options, config, summary, statusToStderr: isJson });
+  await postSummary({ options, config, summary, statusToStderr: keepsStdoutClean(format) });
 }
 var WEEK_GIT_BUDGET_MS;
 var init_weekly = __esm({
@@ -8117,6 +8503,8 @@ var init_weekly = __esm({
     init_payload();
     init_webhook2();
     init_day_commits();
+    init_output_format();
+    init_plain_text();
     init_week();
     WEEK_GIT_BUDGET_MS = DAY_GIT_BUDGET_MS;
   }
@@ -8132,14 +8520,24 @@ function parseWeekLayout(value) {
   if (!layout) fail("--by must be project or day");
   return layout;
 }
+function addSummaryFormatOption(command) {
+  return command.option("--format <format>", "print as markdown, json or text, overriding summary.format");
+}
+function parseSummaryFormat(value) {
+  if (value === void 0) return void 0;
+  const format = SUMMARY_FORMATS.find((candidate) => candidate === value);
+  if (!format) fail("--format must be markdown, json or text");
+  return format;
+}
 async function runWeekCommand(options) {
   const by = parseWeekLayout(options.by);
+  const format = parseSummaryFormat(options.format);
   const config = readConfig();
   printLegacyAiNotice(config);
   requireThreadData();
   try {
     await runWeeklySummary({
-      options: { ...options, by },
+      options: { ...options, by, format },
       config,
       provider: createSummaryWriter(config),
       loadDay: loadDayThreads
@@ -8150,13 +8548,14 @@ async function runWeekCommand(options) {
 }
 function registerWeek(program) {
   const weekCommand = program.command("week").description("Summarize the current week (Mon\u2013today) \u2014 the same as summary --week").option("--fresh", "accepted for 1.x scripts \u2014 the week is always rendered fresh").option("--slack", "post to Slack webhook from config").option("--webhook <url>", "post to a custom webhook URL");
-  addWeekLayoutOption(weekCommand).action(runWeekCommand);
+  addSummaryFormatOption(addWeekLayoutOption(weekCommand)).action(runWeekCommand);
 }
 var WEEK_LAYOUTS;
 var init_week2 = __esm({
   "src/cli/week.ts"() {
     "use strict";
     init_config();
+    init_output_format();
     init_weekly();
     init_writer();
     init_notices();
@@ -8201,8 +8600,9 @@ function printCapturedEvents(sessionPayloads, excluded) {
 }
 function registerSummary(program) {
   const summaryCommand = program.command("summary").description("Generate a work summary").option("--date <YYYY-MM-DD>", "date to summarize (default: today)").option("--week", "summarize the current week").option("--fresh", "ignore saved summaries and render the template").option("--verbose", "show all captured events, including those left out of the summary").option("--slack", "post summary to Slack webhook from config").option("--webhook <url>", "post summary to a custom webhook URL");
-  addWeekLayoutOption(summaryCommand).action(async (options) => {
+  addSummaryFormatOption(addWeekLayoutOption(summaryCommand)).action(async (options) => {
     if (options.by !== void 0 && !options.week) fail("--by only applies to --week");
+    const formatOption = parseSummaryFormat(options.format);
     if (options.week) {
       await runWeekCommand(options);
       return;
@@ -8225,7 +8625,8 @@ function registerSummary(program) {
       log.plain(`No activity captured for ${date}`);
       return;
     }
-    const jsonMode = config.summary?.format === "json";
+    const format = formatOption ?? config.summary?.format;
+    const keepsStdoutToOutput = keepsStdoutClean(format);
     let day;
     try {
       day = await renderDay({ date, blocks, config, provider, fresh: options.fresh });
@@ -8236,11 +8637,13 @@ function registerSummary(program) {
     const { sessionPayloads, saved, fullSummary, needsGeneration } = day;
     const excluded = buildExcludedSet(config.summary?.includeCategories ?? []);
     if (needsGeneration && options.verbose) {
-      if (jsonMode) log.notice("--verbose is skipped when summary.format is json, to keep the JSON output clean");
+      if (keepsStdoutToOutput) log.notice(`--verbose is skipped with the ${format} format, to keep the output clean`);
       else printCapturedEvents(sessionPayloads, excluded);
     }
-    if (jsonMode) {
+    if (format === "json") {
       log.plain(toJsonOutput(day, date));
+    } else if (format === "text") {
+      log.plain(toPlainText(fullSummary));
     } else {
       log.plain("");
       log.plain(fullSummary);
@@ -8248,7 +8651,7 @@ function registerSummary(program) {
       printSavedNote(saved);
       if (needsGeneration) printExcludedFooter(sessionPayloads, excluded);
     }
-    await postSummary({ options, config, summary: fullSummary, statusToStderr: jsonMode });
+    await postSummary({ options, config, summary: fullSummary, statusToStderr: keepsStdoutToOutput });
   });
 }
 var import_chalk8;
@@ -8265,6 +8668,8 @@ var init_summary = __esm({
     init_notices();
     init_webhook2();
     init_day();
+    init_output_format();
+    init_plain_text();
     init_day_notes();
     init_thread_day();
     init_week2();
@@ -8560,12 +8965,15 @@ var init_clear = __esm({
 
 // src/cli/uninstall.ts
 function completionRcFiles() {
-  return [".zshrc", ".bashrc", ".bash_profile"].map((file) => import_path28.default.join(import_os11.default.homedir(), file));
+  return [".zshrc", ".bashrc", ".bash_profile"].map((file) => import_path28.default.join(import_os10.default.homedir(), file));
 }
 function removeCompletionsAndToolHooks() {
   for (const rcFile of completionRcFiles()) {
     if (removeCompletions(rcFile)) log.success(`Shell completions removed from ${rcFile}`);
   }
+  for (const rcFile of CHRONICLE_RC_FILES.map((file) => import_path28.default.join(import_os10.default.homedir(), file))) {
+    if (removeChronicleHook(rcFile)) log.success(`Old Chronicle hook removed from ${rcFile}`);
+  }
   if (removeFishCompletions()) log.success("Fish completions removed");
   const outcome = claudeCodeIntegration.uninstall?.();
   if (outcome === "removed") log.success("Claude Code session hook removed from ~/.claude/settings.json");
@@ -8577,10 +8985,10 @@ function removeCompletionsAndToolHooks() {
 }
 function detectShellRcFiles() {
   const candidates = [
-    { name: "zsh", rcFile: import_path28.default.join(import_os11.default.homedir(), ".zshrc") },
-    { name: "bash", rcFile: import_path28.default.join(import_os11.default.homedir(), ".bashrc") },
-    { name: "bash", rcFile: import_path28.default.join(import_os11.default.homedir(), ".bash_profile") },
-    { name: "fish", rcFile: import_path28.default.join(import_os11.default.homedir(), ".config", "fish", "conf.d", "workscribe.fish") }
+    { name: "zsh", rcFile: import_path28.default.join(import_os10.default.homedir(), ".zshrc") },
+    { name: "bash", rcFile: import_path28.default.join(import_os10.default.homedir(), ".bashrc") },
+    { name: "bash", rcFile: import_path28.default.join(import_os10.default.homedir(), ".bash_profile") },
+    { name: "fish", rcFile: import_path28.default.join(import_os10.default.homedir(), ".config", "fish", "conf.d", "workscribe.fish") }
   ];
   return candidates.filter((candidate) => import_fs28.default.existsSync(candidate.rcFile) && isHookInstalled(candidate.rcFile));
 }
@@ -8637,13 +9045,13 @@ function registerUninstall(program) {
     log.plain("");
   });
 }
-var import_fs28, import_path28, import_os11, import_prompts4, import_chalk11;
+var import_fs28, import_path28, import_os10, import_prompts4, import_chalk11, CHRONICLE_RC_FILES;
 var init_uninstall = __esm({
   "src/cli/uninstall.ts"() {
     "use strict";
     import_fs28 = __toESM(require("fs"));
     import_path28 = __toESM(require("path"));
-    import_os11 = __toESM(require("os"));
+    import_os10 = __toESM(require("os"));
     import_prompts4 = __toESM(require("prompts"));
     import_chalk11 = __toESM(require("chalk"));
     init_paths();
@@ -8652,6 +9060,7 @@ var init_uninstall = __esm({
     init_logger();
     init_agents();
     init_actions();
+    CHRONICLE_RC_FILES = [".zshrc", ".bashrc"];
   }
 });
 
@@ -8884,7 +9293,8 @@ var init_profile = __esm({
 function registerNote(program) {
   program.command("note <text>").description("Attach a free-text annotation to the current session").action((text) => {
     const directory = currentDirectory();
-    const context = getRepoContext(directory, readConfig());
+    const config = readConfig();
+    const context = getRepoContext(directory, config);
     const { repoName, branch } = context;
     insertEvent({
       captured_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8895,7 +9305,7 @@ function registerNote(program) {
       repo_name: repoName,
       branch,
       category: "note",
-      metadata: JSON.stringify({ text }),
+      metadata: JSON.stringify({ text: redact(text, config.redact.extra) }),
       source: null,
       file_path: null,
       dimensions: eventDimensions(context)
@@ -8909,6 +9319,7 @@ var init_note = __esm({
     init_db();
     init_git();
     init_dimensions3();
+    init_redact();
     init_config();
     init_working_directory();
     init_logger();
@@ -8938,11 +9349,11 @@ function registerBugReport(program) {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const reportPath = import_path30.default.join(WORKSCRIBE_DIR, `bug-report-${timestamp}.txt`);
     const systemInfo = [
-      `Workscribe version : ${"3.0.0"}`,
+      `Workscribe version : ${"3.1.0"}`,
       `Node.js version    : ${process.version}`,
       `Platform           : ${process.platform}`,
       `Architecture       : ${process.arch}`,
-      `OS release         : ${import_os12.default.release()}`,
+      `OS release         : ${import_os11.default.release()}`,
       `Config path        : ${CONFIG_PATH}`,
       `Data directory     : ${WORKSCRIBE_DIR}`
     ].join("\n");
@@ -8969,7 +9380,7 @@ function registerBugReport(program) {
       process.exit(1);
     }
     const params = new URLSearchParams({
-      title: `Bug report \u2014 workscribe ${"3.0.0"}`,
+      title: `Bug report \u2014 workscribe ${"3.1.0"}`,
       body: `<!-- Attach ${import_path30.default.basename(reportPath)} or paste the relevant sections below -->
 
 **Describe the issue:**
@@ -8987,12 +9398,12 @@ function registerBugReport(program) {
     log.plain("");
   });
 }
-var import_fs30, import_os12, import_path30, import_chalk13, GITHUB_ISSUES_URL, DEBUG_LOG_TAIL_LINES;
+var import_fs30, import_os11, import_path30, import_chalk13, GITHUB_ISSUES_URL, DEBUG_LOG_TAIL_LINES;
 var init_bug_report = __esm({
   "src/cli/bug-report.ts"() {
     "use strict";
     import_fs30 = __toESM(require("fs"));
-    import_os12 = __toESM(require("os"));
+    import_os11 = __toESM(require("os"));
     import_path30 = __toESM(require("path"));
     import_chalk13 = __toESM(require("chalk"));
     init_paths();
@@ -9060,7 +9471,7 @@ function reportRun(result) {
 function registerUpgrade(program) {
   program.command("upgrade").description("Bring your stored data up to date after updating Workscribe (backs it up first)").action(() => {
     const announced = /* @__PURE__ */ new Set();
-    const result = runDataJobs("3.0.0", {
+    const result = runDataJobs("3.1.0", {
       onProgress: ({ job }) => {
         if (announced.has(job.name)) return;
         announced.add(job.name);
@@ -9550,7 +9961,7 @@ function isNewer(latest, current) {
   return latestPatch > currentPatch;
 }
 function checkForUpdate() {
-  const current = "3.0.0";
+  const current = "3.1.0";
   const cache = readCache();
   if (cache && isNewer(cache.latestVersion, current)) {
     process.stderr.write(
@@ -9573,8 +9984,8 @@ function checkForUpdate() {
 function buildTelemetryPayload(config) {
   return {
     installId: config.telemetry.installId,
-    cliVersion: "3.0.0",
-    platform: import_os13.default.platform(),
+    cliVersion: "3.1.0",
+    platform: import_os12.default.platform(),
     nodeVersion: process.version
   };
 }
@@ -9598,12 +10009,12 @@ function pingTelemetry() {
     debugLog("pingTelemetry", error);
   });
 }
-var import_fs31, import_os13, CHECK_INTERVAL_MS;
+var import_fs31, import_os12, CHECK_INTERVAL_MS;
 var init_update_check = __esm({
   "src/utils/update-check.ts"() {
     "use strict";
     import_fs31 = __toESM(require("fs"));
-    import_os13 = __toESM(require("os"));
+    import_os12 = __toESM(require("os"));
     init_paths();
     init_config();
     init_logger();
@@ -9651,10 +10062,10 @@ var require_main = __commonJS({
       pingTelemetry();
     }
     if (shouldRunDataJobs(process.argv.slice(2))) {
-      runDataJobsBeforeCommand(invokedCommand, "3.0.0");
+      runDataJobsBeforeCommand(invokedCommand, "3.1.0");
     }
     var program = new import_commander.Command();
-    program.name("workscribe").description("Automatic developer work journal").version("3.0.0");
+    program.name("workscribe").description("Automatic developer work journal").version("3.1.0");
     registerCapture(program);
     registerHook(program);
     registerInit(program);