@wrongstack/core 0.309.0 → 0.309.1

package/dist/infrastructure/index.js

@@ -2378,7 +2378,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -2554,6 +2554,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs2.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes(4).toString("hex")}.tmp`;
   const fd = fs2.openSync(tmp, "w", 384);
@@ -2701,7 +2709,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -2785,7 +2793,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const key = randomBytes(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -3636,6 +3644,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path13) {

package/dist/observability/index.js

@@ -388,7 +388,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function (false positive = cosmetic noise; false negative = leak).
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/plugin/index.js

@@ -1945,18 +1945,88 @@ var DefaultPluginAPI = class {
       list: () => tr.list()
     };
     const pr = init.providerRegistry;
+    const providerTypesIOwn = /* @__PURE__ */ new Set();
+    const assertCanMutateProvider = (type, op) => {
+      if (isOfficial) return;
+      if (providerTypesIOwn.has(type)) return;
+      if (!pr.has(type)) return;
+      throw new Error(
+        `Plugin "${owner}" may not ${op} provider "${type}" \u2014 it was not registered by this plugin. Replacing an existing provider would route prompts and credentials through plugin code.`
+      );
+    };
     this.providers = {
-      register: (f) => pr.register(f),
-      unregister: (type) => pr.unregister(type),
+      register: (f) => {
+        assertCanMutateProvider(f.type, "replace");
+        pr.register(f);
+        providerTypesIOwn.add(f.type);
+      },
+      unregister: (type) => {
+        assertCanMutateProvider(type, "unregister");
+        providerTypesIOwn.delete(type);
+        return pr.unregister(type);
+      },
       create: (cfg) => pr.create(cfg),
       list: () => pr.list()
     };
-    this.mcp = init.mcpRegistry ?? noopMcp;
+    const mcpRegistry = init.mcpRegistry;
+    if (!mcpRegistry) {
+      this.mcp = noopMcp;
+    } else {
+      const mcpServersIStarted = /* @__PURE__ */ new Set();
+      const assertOwnsMcpServer = (name, op) => {
+        if (isOfficial) return;
+        if (mcpServersIStarted.has(name)) return;
+        if (!mcpRegistry.list().some((s) => s.name === name)) return;
+        throw new Error(
+          `Plugin "${owner}" may not ${op} MCP server "${name}" \u2014 it was not started by this plugin.`
+        );
+      };
+      this.mcp = {
+        start: async (cfg) => {
+          const name = cfg?.name;
+          if (typeof name === "string" && mcpRegistry.list().some((s) => s.name === name)) {
+            assertOwnsMcpServer(name, "start");
+          }
+          await mcpRegistry.start(cfg);
+          if (typeof name === "string") mcpServersIStarted.add(name);
+        },
+        stop: async (name) => {
+          assertOwnsMcpServer(name, "stop");
+          await mcpRegistry.stop(name);
+        },
+        restart: async (name) => {
+          assertOwnsMcpServer(name, "restart");
+          await mcpRegistry.restart(name);
+        },
+        list: () => mcpRegistry.list()
+      };
+    }
     const scr = init.slashCommandRegistry;
     const official = init.official === true;
+    const commandsIOwn = /* @__PURE__ */ new Set();
     this.slashCommands = scr ? {
-      register: (cmd) => scr.register(cmd, owner, { official }),
-      unregister: (name) => scr.unregister(name),
+      register: (cmd) => {
+        scr.register(cmd, owner, { official });
+        for (const key of [cmd.name, ...cmd.aliases ?? []]) {
+          commandsIOwn.add(key);
+          commandsIOwn.add(`${owner}:${key}`);
+        }
+      },
+      unregister: (name) => {
+        if (!official && !commandsIOwn.has(name) && scr.get(name) !== void 0) {
+          throw new Error(
+            `Plugin "${owner}" may not unregister slash command "${name}" \u2014 it was not registered by this plugin.`
+          );
+        }
+        for (const key of [
+          name,
+          `${owner}:${name}`,
+          name.startsWith(`${owner}:`) ? name.slice(owner.length + 1) : name
+        ]) {
+          commandsIOwn.delete(key);
+        }
+        return scr.unregister(name);
+      },
       get: (name) => scr.get(name),
       list: () => scr.list()
     } : noopSlashCommands;
@@ -5829,6 +5899,30 @@ function withSqliteExperimentalWarningSuppressed(run) {
   }
 }
 
+// src/utils/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
 // src/chronicle/sqlite-journal-schema.ts
 var CHRONICLE_SQLITE_FILE = "chronicle.sqlite";
 var LEGACY_JSONL_MIGRATION_KEY = "legacy-jsonl-v1";
@@ -11600,14 +11694,21 @@ async function openInEditor(filePath, env = process.env) {
       context: { filePath }
     });
   }
-  const child = spawn5(parts[0], [...parts.slice(1), filePath], {
+  const editorArgs = [...parts.slice(1), filePath];
+  const child = shell ? (() => {
+    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
+    return spawn5(inv.command, inv.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: inv.windowsVerbatimArguments,
+      // Suppresses the console flash the cmd.exe wrapper would otherwise
+      // show before the editor appears. Repo convention — see
+      // `core/tests/architecture/spawn-convention.test.ts`.
+      windowsHide: true
+    });
+  })() : spawn5(parts[0], editorArgs, {
     stdio: "ignore",
     detached: true,
-    shell,
-    // `shell` routes through cmd.exe on win32, which flashes a console window
-    // before the editor appears. A GUI editor is unaffected by the flag; the
-    // shell wrapper is what it suppresses. Repo convention — see
-    // `core/tests/architecture/spawn-convention.test.ts`.
     windowsHide: true
   });
   child.unref();
@@ -13789,7 +13890,7 @@ function walk2(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();

package/dist/prompts/index.js

@@ -326,6 +326,361 @@ var PromptManifestStore = class {
 // src/prompts/prompt-journal.ts
 import * as fs2 from "node:fs/promises";
 import * as path2 from "node:path";
+
+// src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
+var PATTERNS = [
+  // Anchored at the start where possible so partial matches inside larger
+  // strings don't trigger false positives.
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
+    anchor: "sk-ant-"
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
+    anchor: "sk_"
+  },
+  {
+    type: "twilio_sid",
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "AC"
+  },
+  {
+    type: "telegram_bot_token",
+    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "/bot"
+  },
+  {
+    type: "jwt",
+    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
+    anchor: "eyJ"
+  },
+  {
+    type: "private_key",
+    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
+    anchor: "-----BEGIN"
+  },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
+  // AI/ML provider keys — modern LLM services with well-known prefixes
+  {
+    type: "huggingface_token",
+    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
+    anchor: "hf_"
+  },
+  {
+    type: "replicate_token",
+    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "r8_"
+  },
+  {
+    type: "perplexity_key",
+    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "pplx-"
+  },
+  {
+    type: "groq_key",
+    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "gsk_"
+  },
+  {
+    type: "bearer_token",
+    // Anchored with alternation instead of negative lookahead — avoids V8
+    // backtracking risk on adversarial input. Bounded at 512 chars.
+    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
+    // chars). A 12-char base64 string has ~71 bits of entropy — above the
+    // threshold where random strings are unlikely to produce false matches.
+    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
+    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
+    // redacted. A consuming trailing delimiter would eat the separator the
+    // next match needs for its leading anchor, leaking the second token.
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
+    anchor: "Bearer"
+  },
+  {
+    type: "high_entropy_env",
+    // Anchored with alternation instead of lookbehind to avoid backtracking.
+    // Value bounded at 512 chars.
+    // The trailing boundary is a NON-consuming lookahead so two secrets
+    // separated by a single delimiter (one space OR one newline, e.g.
+    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
+    // redacted. A consuming trailing `\s` would swallow the separator the
+    // next match needs for its leading anchor, so every other secret would
+    // leak in plaintext.
+    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
+    // replacement so the separator between adjacent secrets is preserved
+    // rather than collapsed. Capture groups are therefore: 1=leading
+    // delimiter, 2=key name, 3=value.
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
+  },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
+  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
+  // The plugin runtime carried 37 patterns while this scrubber — the one that
+  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
+  // audit — carried 22. The plugin side already had a parity test; it just did
+  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
+  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
+    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  {
+    type: "gitlab_pat",
+    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glpat-"
+  },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glrt-"
+  },
+  {
+    type: "npm_token",
+    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    anchor: "npm_"
+  },
+  {
+    type: "slack_app_token",
+    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    anchor: "xapp-"
+  },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
+    anchor: "hooks.slack.com"
+  },
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "SG."
+  },
+  {
+    type: "digitalocean_token",
+    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
+    anchor: "dop_v1_"
+  },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "dp."
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "shp"
+  },
+  {
+    type: "docker_pat",
+    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "dckr_pat_"
+  },
+  {
+    type: "linear_key",
+    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "lin_api_"
+  },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
+    anchor: "ATATT3"
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "GOCSPX-"
+  }
+];
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
+var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
+var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
+var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
+var SCRUB_CHUNK_BYTES = 64 * 1024;
+var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
+var PATTERN_ANCHORS = [
+  ...new Set(
+    PATTERNS.flatMap(
+      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
+    )
+  )
+];
+var ALL_ANCHORS = PATTERN_ANCHORS;
+function hasCredentialAnchors(text) {
+  for (const anchor of ALL_ANCHORS) {
+    if (text.includes(anchor)) return true;
+  }
+  return false;
+}
+var DefaultSecretScrubber = class {
+  scrub(text) {
+    if (!text) return text;
+    if (!hasCredentialAnchors(text)) return text;
+    if (text.length <= SCRUB_CHUNK_BYTES) {
+      return this.scrubOne(text);
+    }
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
+      if (end < text.length) {
+        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
+        let safe = -1;
+        for (let j = end; j < limit; j++) {
+          const ch = text.charCodeAt(j);
+          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
+            safe = j;
+            break;
+          }
+        }
+        end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
+      }
+      out.push(this.scrubOne(text.slice(i, end)));
+      i = end;
+    }
+    return out.join("");
+  }
+  scrubOne(text) {
+    if (!hasCredentialAnchors(text)) return text;
+    let out = text.replace(
+      COMBINED_REGEX,
+      (match, ...groups) => {
+        const idx = groups.findIndex((g) => g !== void 0);
+        if (idx < 0) return match;
+        const replacement = COMBINED_REPLACEMENTS[idx];
+        return replacement !== void 0 ? replacement : match;
+      }
+    );
+    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
+      return `${lead}${key}=[REDACTED:high_entropy_env]`;
+    });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
+    return out;
+  }
+  /**
+   * Recursively scrub every string value in an object/array graph. Secrets can
+   * appear under any key — a URL query param, an `authorization` header, an
+   * arbitrarily-named nested field — so we don't gate recursion on key names.
+   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
+   * value without a credential anchor returns immediately without regex work.
+   */
+  scrubObject(obj) {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const visit = (v) => {
+      if (typeof v === "string") return this.scrub(v);
+      if (v === null || typeof v !== "object") return v;
+      if (seen.has(v)) return v;
+      seen.add(v);
+      if (Array.isArray(v)) return v.map(visit);
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[k] = visit(val);
+      }
+      return out;
+    };
+    return visit(obj);
+  }
+};
+
+// src/prompts/prompt-journal.ts
+var defaultScrubber = new DefaultSecretScrubber();
 var PROMPT_JOURNAL_RAW_MARKER = "promptJournal.raw";
 async function ensureGitignore(projectRoot) {
   const gitignorePath = path2.join(projectRoot, ".gitignore");
@@ -354,7 +709,9 @@ async function recordPromptJournalEntry(opts) {
   const monthStr = dateStr.slice(0, 7);
   const sessionId = opts.sessionId && opts.sessionId.trim() ? opts.sessionId.trim() : "general";
   const id = `pmt_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
-  const content = opts.content ?? "";
+  const content = defaultScrubber.scrub(opts.content ?? "");
+  const rawContent = typeof opts.rawContent === "string" && opts.rawContent.length > 0 ? defaultScrubber.scrub(opts.rawContent) : opts.rawContent;
+  const decisionReason = typeof opts.decisionReason === "string" && opts.decisionReason.length > 0 ? defaultScrubber.scrub(opts.decisionReason) : opts.decisionReason;
   const lines = content.split("\n");
   const characterCount = content.length;
   const lineCount = lines.length;
@@ -367,7 +724,7 @@ async function recordPromptJournalEntry(opts) {
     role: opts.role ?? (opts.category === "system_prompt" ? "system" : "user"),
     category: opts.category,
     content,
-    rawContent: opts.rawContent,
+    rawContent,
     metadata: {
       model: opts.model,
       provider: opts.provider,
@@ -378,7 +735,7 @@ async function recordPromptJournalEntry(opts) {
       activeTools: opts.activeTools,
       contextFiles: opts.contextFiles,
       durationMs: opts.durationMs,
-      decisionReason: opts.decisionReason,
+      decisionReason,
       tags: opts.tags
     }
   };

package/dist/security/auto-approve-policy.d.ts

@@ -26,12 +26,12 @@ export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
     private readonly allowedCapabilities;
     constructor(allowedCapabilities?: readonly string[]);
     private static isMcpTool;
-    evaluate(tool: Tool): Promise<PermissionDecision>;
+    evaluate(tool: Tool, input?: unknown): Promise<PermissionDecision>;
     trust(): Promise<void>;
     deny(): Promise<void>;
     denyOnce(): void;
     allowOnce(): void;
-    explain(tool: Tool): Promise<PermissionTrace>;
+    explain(tool: Tool, input?: unknown): Promise<PermissionTrace>;
     reload(): Promise<void>;
 }
 //# sourceMappingURL=auto-approve-policy.d.ts.map