@wrongstack/core 0.306.2 → 0.306.4

package/dist/infrastructure/index.js

@@ -3456,6 +3456,10 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  // The profile SELECTOR. No broader than its siblings: a repo that can write
+  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
+  // and this one can only name a profile the user already defined.
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
@@ -3503,6 +3507,10 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "git",
     reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
+  },
+  {
+    key: "fallbackMaxLastResortCandidates",
+    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -3523,11 +3531,13 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
   "fallbackAuto",
   "fallbackStickiness",
+  "fallbackMaxLastResortCandidates",
   "hooks",
   "plugins",
   "pluginManager",
@@ -3613,6 +3623,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // operator owns, not the checked-out repository.
     path: "tools.kanbanGovernance",
     reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
+  },
+  {
+    // The bridge spawn path resolves the CLI entry by walking UP from the
+    // project root, so a repo that ships its own `packages/cli/dist/index.js`
+    // gets that file spawned with `process.execPath` on WebUI boot — no
+    // prompt, no banner. Turning the feature on is therefore equivalent to
+    // arbitrary code execution for a hostile checkout, which makes this an
+    // operator-owned switch and never a repo-owned one.
+    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
+    path: "features.mailboxBridge",
+    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
   }
 ];
 function deleteNestedPath(target, path13) {

package/dist/plugin/index.js

@@ -2346,6 +2346,12 @@ function parseModelRef(ref) {
 function hasText(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
+function asRefList(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function asProfileName(value) {
+  return hasText(value) ? value : void 0;
+}
 function providerHasKey(entry) {
   if (!entry) return false;
   if (hasText(entry.apiKey)) return true;
@@ -2356,7 +2362,7 @@ function providerHasKey(entry) {
 }
 function visibleProviderModels(config, providerId, providerModels) {
   const entry = config.providers?.[providerId];
-  return entry?.models !== void 0 ? [...entry.models] : providerModels;
+  return Array.isArray(entry?.models) ? [...entry.models] : providerModels;
 }
 function buildProfiles(config) {
   const entries = /* @__PURE__ */ new Map();
@@ -2393,13 +2399,34 @@ var FallbackProfileManager = class {
   listProfiles() {
     return Object.freeze([...this.profiles.keys()]);
   }
+  /**
+   * The profile the session has selected (`config.fallbackProfile`, set by
+   * `/fallback profile use <name>`), or undefined when none is selected or the
+   * name no longer resolves to a defined profile.
+   *
+   * Consulted by every resolution entry point when the caller does not name a
+   * profile itself. Without this the leader — which passes no profile — could
+   * never use a named profile at all: `config.fallbackProfiles` was reachable
+   * only by copying a chain into `fallbackModels`.
+   */
+  activeProfileName() {
+    const name = asProfileName(this.config.fallbackProfile);
+    return name && this.profiles.has(name) ? name : void 0;
+  }
   // ── Resolution ─────────────────────────────────────────────────────────
   /**
    * Resolve a named fallback profile to a validated, provider-filtered chain.
    *
-   * Returns an empty chain when:
-   * - The profile doesn't exist.
-   * - Every entry's provider is missing, has no key, or has no matching model.
+   * Returns an empty chain when the profile doesn't exist, or when every entry
+   * is excluded, quarantined, or blacked out.
+   *
+   * Filtering is intentionally identical to {@link resolveRefs} (the explicit
+   * `fallbackModels` path): the self-exclusion, the runtime status tracker,
+   * and the availability calendar — nothing else. Anything a named profile
+   * drops, an explicit chain drops too, and vice versa. Profiles used to apply
+   * two extra filters (provider "usability" and the `providers[].models`
+   * snapshot) that the explicit path did not, which silently rerouted roles
+   * pinned to a profile onto a different model than the one configured.
    *
    * @param name - Profile name from config.fallbackProfiles.
    * @param defaultProvider - Used when an entry has no explicit provider.
@@ -2420,13 +2447,9 @@ var FallbackProfileManager = class {
       if (seen.has(key)) continue;
       seen.add(key);
       if (excludeKey && key === excludeKey) continue;
-      const health = this.checkProvider(providerId);
-      if (!health.usable) continue;
       if (this.statusTracker && !this.statusTracker.isAvailable(providerId, parsed.model)) continue;
       if (!evaluateModelCalendar(this.config.modelAvailabilitySchedule, providerId, parsed.model).allowed)
         continue;
-      const allowedModels = this.config.providers?.[providerId]?.models;
-      if (allowedModels && !allowedModels.includes(parsed.model)) continue;
       resolved.push({
         providerId,
         model: parsed.model,
@@ -2444,12 +2467,14 @@ var FallbackProfileManager = class {
   resolveEffective(opts = {}) {
     const bridge = this.resolveBridge(opts.exclude);
     let selected = FREEZER_EMPTY;
-    if (opts.fallbackModels && opts.fallbackModels.length > 0) {
-      const resolved = this.resolveRefs(opts.fallbackModels, opts.exclude);
+    const explicitRefs = asRefList(opts.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
+    if (explicitRefs && explicitRefs.length > 0) {
+      const resolved = this.resolveRefs(explicitRefs, opts.exclude);
       if (resolved.length > 0) selected = resolved;
     }
-    if (selected.length === 0 && opts.fallbackProfile) {
-      const resolved = this.resolve(opts.fallbackProfile, { exclude: opts.exclude });
+    if (selected.length === 0 && profileName) {
+      const resolved = this.resolve(profileName, { exclude: opts.exclude });
       if (resolved.length > 0) selected = resolved;
     }
     if (selected.length === 0 && opts.fallbackAuto !== false) {
@@ -2525,13 +2550,14 @@ var FallbackProfileManager = class {
     };
     const configFallbackAuto = this.config.fallbackAuto;
     const effectiveFallbackAuto = configFallbackAuto !== void 0 && configFallbackAuto !== null ? configFallbackAuto : !opts.closedWorld;
-    const explicitRefs = opts.fallbackModels ?? this.config.fallbackModels;
+    const explicitRefs = asRefList(opts.fallbackModels) ?? asRefList(this.config.fallbackModels);
+    const profileName = asProfileName(opts.fallbackProfile) ?? this.activeProfileName();
     const explicitUsable = explicitRefs !== void 0 && explicitRefs.length > 0 && this.resolveRefs(explicitRefs, current).length > 0;
-    const profileUsable = opts.fallbackProfile !== void 0 && this.hasProfile(opts.fallbackProfile) && this.resolve(opts.fallbackProfile, { exclude: current }).length > 0;
+    const profileUsable = profileName !== void 0 && this.hasProfile(profileName) && this.resolve(profileName, { exclude: current }).length > 0;
     const fromExplicitSource = explicitUsable || profileUsable;
-    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : opts.fallbackProfile ? this.resolve(opts.fallbackProfile, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
+    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : profileName ? this.resolve(profileName, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
       fallbackModels: explicitRefs,
-      fallbackProfile: opts.fallbackProfile,
+      fallbackProfile: profileName,
       fallbackAuto: effectiveFallbackAuto,
       exclude: current
     });
@@ -2548,7 +2574,7 @@ var FallbackProfileManager = class {
         });
       }
       candidates.push(...selectedChain);
-      if (!fromExplicitSource && effectiveFallbackAuto && opts.fallbackProfile !== "default") {
+      if (!fromExplicitSource && effectiveFallbackAuto && profileName !== "default") {
         candidates.push(...this.resolve("default", { exclude: current }));
       }
       if (!fromExplicitSource && effectiveFallbackAuto) {
@@ -2626,7 +2652,7 @@ var FallbackProfileManager = class {
     const leaderModel = this.config.model;
     const providers = this.config.providers ?? {};
     const favoriteSet = new Set(
-      (this.config.favoriteModels ?? []).map((ref) => {
+      (asRefList(this.config.favoriteModels) ?? []).map((ref) => {
         const p = parseModelRef(ref);
         return `${p.provider ?? leaderProvider}/${p.model}`;
       })
@@ -13703,6 +13729,156 @@ var CLOUD_SYNC_CONTRACT = {
   "extensions.plugins": EXTENSIONS_PLUGINS_TREE
 };
 var CLOUD_SYNC_NAMESPACES = Object.keys(CLOUD_SYNC_CONTRACT);
+var INBOUND_DENIED_PATHS = [
+  // ── Code execution ──────────────────────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.command",
+    reason: "Executable spawned for a stdio MCP server."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.args",
+    reason: "Argv for that executable."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.transport",
+    reason: "Switching transport to stdio selects the spawning code path."
+  },
+  {
+    namespace: "extensions.plugins",
+    path: "plugins",
+    reason: "Plugin list is resolved and `await import`ed."
+  },
+  // `extensions` is deliberately NOT denied: it is per-plugin settings read via
+  // `ConfigStore.getExtension(name)`, not a loader list, so it grants no import.
+  // Syncing it is the feature (`extensions.telegram.notifyChatId` and friends).
+  // Residual risk accepted: a plugin whose own settings include a URL can have
+  // that URL rewritten by the portal. Constrain that in the plugin's
+  // `configSchema`, which is where the loader validates it.
+  // ── Credential redirection / exfiltration ───────────────────────────────
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.baseUrl",
+    reason: "Repoints the provider endpoint; reinjectLocalSecrets keeps the local apiKey, so the real key follows the redirect."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.envVars",
+    reason: "Chooses which environment variable is read for the key."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.activeKey",
+    reason: "Selects which stored key is sent."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.url",
+    reason: "Remote MCP endpoint; receives whatever the transport carries."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.envVars",
+    reason: "Names of environment variables forwarded to the server process."
+  },
+  // ── Operator-owned safety switches ──────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.permission",
+    reason: "Approval requirement for that server\u2019s tools."
+  },
+  { namespace: "core.runtime", path: "yolo", reason: "Disables every permission prompt." },
+  {
+    namespace: "core.runtime",
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits project-root containment and the symlink realpath check."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  },
+  {
+    namespace: "core.runtime",
+    path: "features.developerMode",
+    reason: "Loosens guardrails; an operator opt-in, not a synced preference."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.disabledTools",
+    reason: "Could re-enable a tool the operator deliberately switched off."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.defaultMode",
+    reason: "Autonomy is user-owned, never remote-owned."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.mode",
+    reason: "Selects the policy/LLM/human decision ladder."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.maxAutoRisk",
+    reason: "The risk ceiling below which actions proceed without asking."
+  }
+];
+function contractHasPath(tree, segments) {
+  if (segments.length === 0) return true;
+  if (tree === true) return false;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return false;
+  const child = tree[head];
+  return child === void 0 ? false : contractHasPath(child, rest);
+}
+function pruneContractPath(tree, segments) {
+  if (tree === true || segments.length === 0) return tree;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return tree;
+  const next = { ...tree };
+  if (rest.length === 0) {
+    delete next[head];
+    return next;
+  }
+  const child = next[head];
+  if (child === void 0) return tree;
+  next[head] = pruneContractPath(child, rest);
+  return next;
+}
+function assertInboundDenyListResolves() {
+  const unresolved = INBOUND_DENIED_PATHS.filter((entry) => {
+    const tree = CLOUD_SYNC_CONTRACT[entry.namespace];
+    return tree === void 0 || !contractHasPath(tree, entry.path.split("."));
+  });
+  if (unresolved.length > 0) {
+    throw new Error(
+      "INBOUND_DENIED_PATHS entr(ies) no longer resolve against CLOUD_SYNC_CONTRACT \u2014 a rename would silently re-open them: " + unresolved.map((entry) => `${entry.namespace}:${entry.path}`).join(", ")
+    );
+  }
+}
+var INBOUND_CONTRACT = (() => {
+  assertInboundDenyListResolves();
+  const out = { ...CLOUD_SYNC_CONTRACT };
+  for (const entry of INBOUND_DENIED_PATHS) {
+    const tree = out[entry.namespace];
+    if (tree === void 0) continue;
+    out[entry.namespace] = pruneContractPath(tree, entry.path.split("."));
+  }
+  return out;
+})();
 var NAMESPACE_SCHEMA_VERSIONS = {
   "core.runtime": 1,
   "ui.preferences": 1,
@@ -13794,7 +13970,7 @@ function mergeAtContract(local, incoming, tree) {
   return base;
 }
 function applyNamespacePayload(config, namespace, payload) {
-  const tree = CLOUD_SYNC_CONTRACT[namespace];
+  const tree = INBOUND_CONTRACT[namespace];
   if (!tree || tree === true) return config;
   const next = { ...config };
   for (const [key, incoming] of Object.entries(payload)) {

package/dist/security/index.js

@@ -894,6 +894,24 @@ function validateDirectoryPolicy(value) {
 import { homedir } from "node:os";
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -996,6 +1014,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -1078,9 +1120,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -1091,20 +1136,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text) {
   for (const anchor of ALL_ANCHORS) {
     if (text.includes(anchor)) return true;
@@ -1153,6 +1185,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**
@@ -1327,7 +1362,8 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
         decision: "block",
         reason: "Active card is not implementation-ready: " + readiness.issues.map((issue) => issue.message).join(" | "),
         boardId: board.id,
-        taskId: task.id
+        taskId: task.id,
+        readinessIssues: readiness.issues
       };
     }
     if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {

package/dist/security/kanban-boundary.d.ts

@@ -1,9 +1,11 @@
-import { type KanbanBoundaryEvaluation } from '@wrongstack/kanban';
+import { type KanbanBoundaryEvaluation, type KanbanContractReadinessIssue } from '@wrongstack/kanban';
 import type { Context } from '../core/context.js';
 import type { Tool } from '../types/tool.js';
 export interface ToolKanbanBoundaryEvaluation extends KanbanBoundaryEvaluation {
     boardId?: string | undefined;
     taskId?: string | undefined;
+    /** Machine-readable readiness failures; `reason` remains the human fallback. */
+    readinessIssues?: KanbanContractReadinessIssue[] | undefined;
 }
 export interface ToolKanbanGovernanceOptions {
     /** Require every product mutation to run inside a ready, running Kanban card. */

package/dist/session-catalog/index.js

@@ -777,6 +777,24 @@ function loadDatabaseSync() {
 }
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -879,6 +897,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -961,9 +1003,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -974,20 +1019,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text) {
   for (const anchor of ALL_ANCHORS) {
     if (text.includes(anchor)) return true;
@@ -1036,6 +1068,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**

package/dist/session-catalog/project-server.js

@@ -221,6 +221,24 @@ function loadDatabaseSync() {
 }
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -323,6 +341,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -405,9 +447,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -418,20 +463,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text) {
   for (const anchor of ALL_ANCHORS) {
     if (text.includes(anchor)) return true;
@@ -480,6 +512,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**