agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/scrub.test.ts

@@ -1,936 +0,0 @@
-import { createHash } from 'node:crypto';
-import {
-  chmod,
-  mkdir,
-  mkdtemp,
-  readFile,
-  readdir,
-  rm,
-  stat,
-  symlink,
-  writeFile,
-} from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { TraceWriter } from '@agenticreplay/core';
-import { validateEvent, validateManifest } from '@agenticreplay/schema';
-import { parseArgs } from '../src/args.js';
-import { Output } from '../src/out.js';
-import { scrubCommand } from '../src/commands/scrub.js';
-
-/**
- * `agenticreplay scrub` is the second line of defence behind write-path redaction, and it is a promise
- * made in SECURITY.md and in the bug-report template. It has to actually remove things.
- */
-describe('scrub', () => {
-  let cwd: string;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-'));
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-  });
-
-  afterEach(async () => {
-    await rm(cwd, { recursive: true, force: true });
-  });
-
-  async function makeRun(payloads: unknown[]): Promise<string> {
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    for (const payload of payloads) {
-      await writer.append({
-        type: 'note',
-        actor: 'agenticreplay',
-        turn: 1,
-        payload: payload as never,
-      });
-    }
-    await writer.append({ type: 'run.end', actor: 'agenticreplay', turn: 1 });
-    await writer.close(0);
-    return writer.runDir;
-  }
-
-  it('removes a literal string the user names', async () => {
-    const runDir = await makeRun(['the deploy host is prod-db-7.internal.example.com']);
-    await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com']),
-      out,
-      cwd,
-    );
-
-    const raw = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-    expect(raw).not.toContain('prod-db-7.internal.example.com');
-    expect(raw).toContain('redacted');
-  });
-
-  describe('--dry-run', () => {
-    it('reports what would go and changes nothing', async () => {
-      // The one command in the tool whose effect cannot be undone, and the only one that had no
-      // way to look first. It also fires the standard detectors alongside your literal, so what it
-      // takes out is genuinely not knowable in advance — which is what makes the preview load-bearing
-      // rather than a nicety.
-      const runDir = await makeRun(['the deploy host is prod-db-7.internal.example.com']);
-      const before = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-      const manifestBefore = await readFile(join(runDir, 'manifest.json'), 'utf8');
-
-      const result = await scrubCommand(
-        parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com', '--dry-run']),
-        out,
-        cwd,
-      );
-
-      expect(result.dryRun).toBe(true);
-      expect(result.removals, 'it still counts what it found').toBeGreaterThan(0);
-      expect(result.filesChanged).toBeGreaterThan(0);
-      expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toBe(before);
-      expect(await readFile(join(runDir, 'manifest.json'), 'utf8')).toBe(manifestBefore);
-      expect(lines.join('\n')).toContain('would rewrite events.jsonl');
-    });
-
-    it('does not delete the filesystem snapshots that --drop-fs would', async () => {
-      const runDir = await makeRun(['nothing sensitive here']);
-      await mkdir(join(runDir, 'fs'), { recursive: true });
-      await writeFile(join(runDir, 'fs', 'HEAD'), 'ref: refs/heads/main\n');
-
-      await scrubCommand(parseArgs(['scrub', 'last', '--drop-fs', '--dry-run']), out, cwd);
-
-      expect(
-        await stat(join(runDir, 'fs')).then(
-          () => true,
-          () => false,
-        ),
-        'a dry run must not perform the most destructive thing the command does',
-      ).toBe(true);
-    });
-
-    it('then really removes it when the flag comes off', async () => {
-      const runDir = await makeRun(['the deploy host is prod-db-7.internal.example.com']);
-      await scrubCommand(
-        parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com', '--dry-run']),
-        out,
-        cwd,
-      );
-      await scrubCommand(
-        parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com']),
-        out,
-        cwd,
-      );
-      expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).not.toContain(
-        'prod-db-7.internal.example.com',
-      );
-    });
-  });
-
-  it('leaves no .tmp file behind when it rewrites a trace', async () => {
-    // events.jsonl used to be written with a plain writeFile, which truncates before it writes: a
-    // ^C in that window left a truncated events file and a manifest digest describing the whole
-    // one. Every rewrite now lands by rename, and the staging file must not survive the commit.
-    const runDir = await makeRun(['the deploy host is prod-db-7.internal.example.com']);
-    await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com']),
-      out,
-      cwd,
-    );
-    const entries = await readdir(runDir);
-    expect(entries.filter((e) => e.endsWith('.tmp'))).toEqual([]);
-  });
-
-  it('leaves the rest of the payload intact', async () => {
-    const runDir = await makeRun(['keep this. remove SECRETVALUE. keep this too.']);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'SECRETVALUE']), out, cwd);
-    const raw = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-    expect(raw).toContain('keep this');
-    expect(raw).toContain('keep this too');
-  });
-
-  it('re-runs the standard detectors, catching what the write path missed', async () => {
-    const runDir = await makeRun(['token AKIAIOSFODNN7EXAMPLE embedded in prose']);
-    await scrubCommand(parseArgs(['scrub', 'last']), out, cwd);
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).not.toContain(
-      'AKIAIOSFODNN7EXAMPLE',
-    );
-  });
-
-  it('keeps every event valid against the schema afterwards', async () => {
-    const runDir = await makeRun(['sk-abcdefghij0123456789abcdef', 'ordinary text']);
-    await scrubCommand(parseArgs(['scrub', 'last']), out, cwd);
-
-    const raw = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-    for (const line of raw.split('\n').filter(Boolean)) {
-      const r = validateEvent(JSON.parse(line));
-      expect(r.valid, r.errors.join(', ')).toBe(true);
-    }
-  });
-
-  it('scrubs blob contents too, not only inline payloads', async () => {
-    // Large enough to spill to a blob, so the value never appears in events.jsonl.
-    const big = `${'x'.repeat(5000)} NEEDLE-IN-A-BLOB ${'y'.repeat(200)}`;
-    const runDir = await makeRun([big]);
-
-    const before = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-    expect(before, 'fixture must actually exercise the blob path').not.toContain(
-      'NEEDLE-IN-A-BLOB',
-    );
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE-IN-A-BLOB']), out, cwd);
-
-    const { execFile } = await import('node:child_process');
-    const { promisify } = await import('node:util');
-    const grep = promisify(execFile);
-    const hit = await grep('grep', ['-r', 'NEEDLE-IN-A-BLOB', runDir]).catch(() => null);
-    expect(hit, 'the needle must be gone from every file in the run').toBeNull();
-  });
-
-  it('updates the integrity digest so the trace still verifies', async () => {
-    const runDir = await makeRun(['remove ME-PLEASE now']);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'ME-PLEASE']), out, cwd);
-
-    const { TraceReader } = await import('@agenticreplay/core');
-    const reader = await TraceReader.open(runDir);
-    const integrity = await reader.verifyIntegrity();
-    expect(integrity.ok, 'a scrubbed trace that fails its own integrity check is unusable').toBe(
-      true,
-    );
-  });
-
-  it('records what it removed, by rule, without recording the value', async () => {
-    const runDir = await makeRun(['drop TOPSECRETTOKEN here']);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'TOPSECRETTOKEN']), out, cwd);
-    const redactions = JSON.parse(await readFile(join(runDir, 'redactions.json'), 'utf8'));
-    const dumped = JSON.stringify(redactions);
-    expect(dumped).toContain('scrub');
-    expect(dumped).not.toContain('TOPSECRETTOKEN');
-  });
-
-  it('reports how much it changed', async () => {
-    await makeRun(['remove GONE1 and GONE1 again']);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'GONE1']), out, cwd);
-    expect(lines.join('')).toMatch(/scrubbed/);
-  });
-
-  it('is idempotent — scrubbing twice changes nothing the second time', async () => {
-    const runDir = await makeRun(['remove TWICE-OVER now']);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'TWICE-OVER']), out, cwd);
-    const first = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'TWICE-OVER']), out, cwd);
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toBe(first);
-  });
-
-  it('refuses a dry run that would change nothing without pretending it did', async () => {
-    const runDir = await makeRun(['nothing sensitive here at all']);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'ABSENT']), out, cwd);
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toContain('nothing sensitive');
-    expect(lines.join('')).toMatch(/removed=0/);
-  });
-});
-
-describe('scrub — binary safety', () => {
-  it('leaves a binary blob byte-identical even when it contains the literal', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-bin-'));
-    const out = new Output({ write: () => {}, isTTY: false });
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    await writer.close(0);
-
-    const { BlobStore } = await import('@agenticreplay/core');
-    const store = new BlobStore(join(writer.runDir, 'blobs'));
-    // Contains the literal AND a NUL byte. Without the binary guard the scrubber would rewrite
-    // this as UTF-8 text and silently corrupt every byte after the replacement.
-    const binary = Buffer.concat([
-      Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00]),
-      Buffer.from('NEEDLE'),
-      Buffer.from([0x00, 0xff, 0xfe]),
-    ]);
-    const ref = await store.put(binary);
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE']), out, cwd);
-
-    expect(Buffer.from(await store.get(ref))).toEqual(binary);
-    await rm(cwd, { recursive: true, force: true });
-  });
-
-  it('still scrubs a text blob containing the same literal', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-txt-'));
-    const out = new Output({ write: () => {}, isTTY: false });
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    await writer.close(0);
-
-    const { BlobStore } = await import('@agenticreplay/core');
-    const store = new BlobStore(join(writer.runDir, 'blobs'));
-    await store.put(`prose with NEEDLE inside ${'z'.repeat(100)}`);
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE']), out, cwd);
-
-    // Read back by what the scrubbed content hashes to, not by the digest it used to have: a
-    // blob's name is its contents' digest, so scrubbing one moves it. Asking for the old digest
-    // is asking for the material this command exists to destroy.
-    const files = await blobFiles(writer.runDir);
-    expect(files).toHaveLength(1);
-    expect(files[0]!.text).not.toContain('NEEDLE');
-    expect(files[0]!.text).toContain('prose with');
-    expect(Buffer.from(await store.get(files[0]!.name)).toString('utf8')).toBe(files[0]!.text);
-    await rm(cwd, { recursive: true, force: true });
-  });
-});
-
-/**
- * A blob's name *is* the sha256 of its contents (spec §2.2), and `BlobStore.put` is built on it:
- * content already held is recognised by its path existing, and the file is then not written at
- * all. Scrubbing a blob in place left a store where that no longer held, so the next `put` of the
- * original material would conclude it was already stored and hand back a reference to scrubbed
- * content. `agenticreplay scrub` says as much already about the workspace snapshots it declines to rewrite
- * -- git objects are addressed by their own contents. So are these.
- */
-describe('scrub — the blob store stays content-addressed', () => {
-  let cwd: string;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-addr-'));
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-  });
-
-  afterEach(async () => {
-    await rm(cwd, { recursive: true, force: true });
-  });
-
-  /** A payload over the 4096-byte inline limit, which is the only way to reach a blob at all. */
-  async function runWithSpilledPayload(text: string): Promise<string> {
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    await writer.append({ type: 'note', actor: 'agenticreplay', turn: 1, payload: text as never });
-    await writer.append({ type: 'run.end', actor: 'agenticreplay', turn: 1 });
-    await writer.close(0);
-    return writer.runDir;
-  }
-
-  it('moves a scrubbed blob to the digest its contents now have, and the reference with it', async () => {
-    const runDir = await runWithSpilledPayload(`NEEDLE and then ${'z'.repeat(5000)}`);
-    const before = await blobFiles(runDir);
-    expect(before).toHaveLength(1);
-    expect(before[0]!.name).toBe(before[0]!.digest);
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE']), out, cwd);
-
-    const after = await blobFiles(runDir);
-    expect(after).toHaveLength(1);
-    expect(after[0]!.text).not.toContain('NEEDLE');
-    // The invariant: a name is a claim about the contents. And the old file is gone rather than
-    // left behind holding what was removed.
-    expect(after[0]!.name).toBe(after[0]!.digest);
-    expect(after[0]!.name).not.toBe(before[0]!.name);
-
-    const events = (await readFile(join(runDir, 'events.jsonl'), 'utf8'))
-      .split('\n')
-      .filter((line) => line.trim() !== '')
-      .map((line) => JSON.parse(line) as { payload?: { $blob?: string; bytes?: number } });
-    const ref = events.find((event) => event.payload?.$blob !== undefined)?.payload;
-    expect(ref?.$blob).toBe(`sha256:${after[0]!.name}`);
-    // Scrubbing changes a body's length, so a `bytes` left at the old one is the same false claim
-    // in smaller print.
-    expect(ref?.bytes).toBe(Buffer.byteLength(after[0]!.text, 'utf8'));
-  });
-
-  it('moves every reference to a blob two events share', async () => {
-    // Content addressing means one file, two references: every model turn resends the whole
-    // conversation, so identical content arriving twice is the ordinary case rather than a corner
-    // -- and moving the file while updating one of them would leave the other pointing nowhere.
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    const shared = `NEEDLE and then ${'z'.repeat(5000)}`;
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    await writer.append({
-      type: 'note',
-      actor: 'agenticreplay',
-      turn: 1,
-      payload: shared as never,
-    });
-    await writer.append({
-      type: 'note',
-      actor: 'agenticreplay',
-      turn: 2,
-      payload: shared as never,
-    });
-    await writer.append({ type: 'run.end', actor: 'agenticreplay', turn: 2 });
-    await writer.close(0);
-    expect(await blobFiles(writer.runDir)).toHaveLength(1);
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE']), out, cwd);
-
-    const files = await blobFiles(writer.runDir);
-    expect(files).toHaveLength(1);
-    expect(files[0]!.name).toBe(files[0]!.digest);
-    const refs = (await readFile(join(writer.runDir, 'events.jsonl'), 'utf8'))
-      .split('\n')
-      .filter((line) => line.trim() !== '')
-      .map((line) => JSON.parse(line) as { payload?: { $blob?: string } })
-      .flatMap((event) => (event.payload?.$blob === undefined ? [] : [event.payload.$blob]));
-    expect(refs).toHaveLength(2);
-    expect(refs).toEqual([`sha256:${files[0]!.name}`, `sha256:${files[0]!.name}`]);
-  });
-
-  it('scrubs a partial write in place rather than minting a blob out of it', async () => {
-    const runDir = await runWithSpilledPayload(`NEEDLE and then ${'z'.repeat(5000)}`);
-    // What `BlobStore.put` leaves behind when it crashes between its write and its rename.
-    const stray = join(runDir, 'blobs', 'aa', `${'a'.repeat(64)}.deadbeef.tmp`);
-    await mkdir(join(runDir, 'blobs', 'aa'), { recursive: true });
-    await writeFile(stray, `NEEDLE in a partial write ${'y'.repeat(200)}`, 'utf8');
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE']), out, cwd);
-
-    // Still scrubbed — skipping a file that holds the material is the one failure this command
-    // must not have.
-    expect(await readFile(stray, 'utf8')).not.toContain('NEEDLE');
-    // But not moved: nothing references it, and a hex name would file it in the store proper.
-    expect(await blobFiles(runDir)).toHaveLength(1);
-    const manifest = JSON.parse(await readFile(join(runDir, 'manifest.json'), 'utf8')) as {
-      integrity?: { blob_count?: number };
-    };
-    expect(manifest.integrity?.blob_count).toBe(1);
-  });
-
-  it('leaves the manifest describing the store it now has', async () => {
-    const runDir = await runWithSpilledPayload(`NEEDLE and then ${'z'.repeat(5000)}`);
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE']), out, cwd);
-
-    const manifest = JSON.parse(await readFile(join(runDir, 'manifest.json'), 'utf8')) as {
-      integrity?: { events_sha256?: string; blob_count?: number };
-      counts?: { blobs?: number };
-    };
-    const files = await blobFiles(runDir);
-    expect(manifest.integrity?.blob_count).toBe(files.length);
-    // Read in `blob_count`'s place by any viewer opening a run sealed before that field existed,
-    // so the same run must not report two different sizes depending on which reader opens it.
-    expect(manifest.counts?.blobs).toBe(files.length);
-    // Still sealed: a scrubbed trace that failed its own integrity check would make people skip
-    // scrubbing.
-    expect(manifest.integrity?.events_sha256).toBe(
-      createHash('sha256')
-        .update(await readFile(join(runDir, 'events.jsonl'), 'utf8'), 'utf8')
-        .digest('hex'),
-    );
-  });
-
-  it('names the move in the plan, rather than a file nobody has yet', async () => {
-    await runWithSpilledPayload(`NEEDLE and then ${'z'.repeat(5000)}`);
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'NEEDLE', '--dry-run']), out, cwd);
-
-    const plan = lines.join('\n');
-    expect(plan).toContain('and move it to');
-    expect(plan).toContain('which is what its scrubbed contents hash to');
-  });
-});
-
-/**
- * Every blob in a run's store, with the digest its contents actually have.
- *
- * Digest-named files only, which is what `BlobStore` counts as a blob -- a `<digest>.<rand>.tmp`
- * in the same directory is a `put` that crashed, not an entry in the store.
- */
-async function blobFiles(
-  runDir: string,
-): Promise<{ name: string; digest: string; text: string }[]> {
-  const root = join(runDir, 'blobs');
-  const found: { name: string; digest: string; text: string }[] = [];
-  for (const shard of await readdir(root, { withFileTypes: true }).catch(() => [])) {
-    if (!shard.isDirectory()) continue;
-    for (const name of await readdir(join(root, shard.name))) {
-      if (!/^[0-9a-f]{64}$/.test(name)) continue;
-      const bytes = await readFile(join(root, shard.name, name));
-      found.push({
-        name,
-        digest: createHash('sha256').update(bytes).digest('hex'),
-        text: bytes.toString('utf8'),
-      });
-    }
-  }
-  return found;
-}
-
-/**
- * The failure mode that matters for a scrubber is not "removed too little" — it is "reported a
- * clean trace it never searched". Each of these pins one way `agenticreplay scrub` used to do exactly that.
- */
-describe('scrub — false all-clears', () => {
-  let cwd: string;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-clear-'));
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-  });
-
-  afterEach(async () => {
-    await rm(cwd, { recursive: true, force: true });
-  });
-
-  async function makeRun(payloads: unknown[]): Promise<string> {
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    for (const payload of payloads) {
-      await writer.append({
-        type: 'note',
-        actor: 'agenticreplay',
-        turn: 1,
-        payload: payload as never,
-      });
-    }
-    await writer.append({ type: 'run.end', actor: 'agenticreplay', turn: 1 });
-    await writer.close(0);
-    return writer.runDir;
-  }
-
-  /**
-   * A blob store it could not read used to lower the count and say nothing.
-   *
-   * `walk` answered `[]` for a directory it could not list, so scrub scrubbed fewer blobs and
-   * reported the smaller number as though that were all there was — under-reporting, silently,
-   * which is the half that makes it a false answer rather than a stated limit. SECURITY.md:
-   * "a scrubber that under-reports is disappointing; one that hands you a false all-clear is worse
-   * than no scrubber."
-   *
-   * The fixture makes `blobs` itself unlistable by making it a file, which every platform agrees
-   * about. The nested case needs a directory nobody can list, and that needs POSIX.
-   */
-  it('says it could not read the blob store rather than quietly scrubbing less', async () => {
-    const runDir = await makeRun(['the host is prod-db-7.internal.example.com']);
-    await rm(join(runDir, 'blobs'), { recursive: true, force: true });
-    await writeFile(join(runDir, 'blobs'), 'not a directory\n');
-
-    // A literal that is NOT in this trace, so nothing is removed and the all-clear is what would
-    // otherwise print — over a blob store nobody could open.
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'absent-from-this-run']), out, cwd);
-    const said = lines.join('\n');
-    expect(said, 'a clean bill over a blob store it could not read').not.toContain(
-      'nothing matched',
-    );
-    expect(said).toContain('blobs_not_searched');
-    expect(said).toContain('could NOT be read');
-  });
-
-  /**
-   * Most runs have no `blobs/` at all — nothing in them crossed the spill threshold — and an absent
-   * directory is not one that could not be read. Reporting it as unsearched put a warning on the
-   * ordinary case and suppressed the all-clear with it, on every small run.
-   */
-  it('says nothing about a blob store that was never written', async () => {
-    const runDir = await makeRun(['short']);
-    await rm(join(runDir, 'blobs'), { recursive: true, force: true });
-
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', 'absent-from-this-run']), out, cwd);
-    const said = lines.join('\n');
-    expect(said, 'an absent blob store was reported as unreadable').not.toContain(
-      'blobs_not_searched',
-    );
-    expect(said, 'the all-clear was withheld over a directory that never existed').toContain(
-      'nothing matched',
-    );
-  });
-
-  it.skipIf(process.platform === 'win32')(
-    'says so for a blob directory it cannot list, and does not call the run clean',
-    async () => {
-      const runDir = await makeRun(['nothing interesting here']);
-      const prefix = join(runDir, 'blobs', 'ab');
-      await mkdir(prefix, { recursive: true });
-      await writeFile(join(prefix, 'abcd'), 'prod-db-7.internal.example.com\n');
-      await chmod(prefix, 0o000);
-      try {
-        await scrubCommand(parseArgs(['scrub', 'last', '--match', 'prod-db-7']), out, cwd);
-        const said = lines.join('\n');
-        expect(said, 'a clean bill over a directory it could not list').not.toContain(
-          'nothing matched',
-        );
-        expect(said).toContain('blobs_not_searched');
-      } finally {
-        await chmod(prefix, 0o700);
-      }
-    },
-  );
-
-  /**
-   * `readdir` reports a symlink with `isDirectory() === false`, so a link whose target is gone
-   * reached an unguarded `stat` and the rejection ended the whole command — a scrub that was
-   * otherwise complete, abandoned over one stale entry.
-   */
-  it.skipIf(process.platform === 'win32')(
-    'survives a dangling entry in the blob store instead of aborting',
-    async () => {
-      const runDir = await makeRun(['the host is prod-db-7.internal.example.com']);
-      const prefix = join(runDir, 'blobs', 'cd');
-      await mkdir(prefix, { recursive: true });
-      await symlink(join(prefix, 'gone'), join(prefix, 'dangling'));
-
-      await expect(
-        scrubCommand(parseArgs(['scrub', 'last', '--match', 'prod-db-7']), out, cwd),
-      ).resolves.not.toThrow();
-      expect(lines.join('\n')).toContain('blobs_not_searched');
-    },
-  );
-
-  it('refuses --match with no value instead of scrubbing nothing', async () => {
-    const runDir = await makeRun(['the host is prod-db-7.internal.example.com']);
-    await expect(scrubCommand(parseArgs(['scrub', 'last', '--match']), out, cwd)).rejects.toThrow(
-      /--match/,
-    );
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toContain('prod-db-7');
-    expect(lines.join(''), 'it must not claim the trace is clean').not.toMatch(/nothing matched/);
-  });
-
-  it('refuses an empty --match= the same way', async () => {
-    await makeRun(['anything']);
-    await expect(scrubCommand(parseArgs(['scrub', 'last', '--match=']), out, cwd)).rejects.toThrow(
-      /--match/,
-    );
-  });
-
-  it('refuses --matches with no value too', async () => {
-    await makeRun(['anything']);
-    await expect(scrubCommand(parseArgs(['scrub', 'last', '--matches']), out, cwd)).rejects.toThrow(
-      /--matches/,
-    );
-  });
-
-  it('does not count a removal it reverted', async () => {
-    // `note` sits inside `"type":"note"`, so the scrubbed line still parses but no longer
-    // validates. The original goes back — and the count must go back with it.
-    await makeRun(['keep this text']);
-    const result = await scrubCommand(parseArgs(['scrub', 'last', '--match', 'note']), out, cwd);
-    expect(result.removals).toBe(0);
-    expect(lines.join('')).toMatch(/removed=0/);
-  });
-
-  it('warns loudly, naming the event, when it puts a line back', async () => {
-    const runDir = await makeRun(['keep this text']);
-    const result = await scrubCommand(parseArgs(['scrub', 'last', '--match', 'note']), out, cwd);
-
-    expect(result.reverted).toBe(1);
-    const printed = lines.join('');
-    expect(printed).toMatch(/warn scrub_reverted/);
-    // The note event is seq 1: run.start, note, run.end.
-    expect(printed).toMatch(/seq=1/);
-    // And it says plainly that the match survived, because it did.
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toContain('"type":"note"');
-    expect(printed.toLowerCase()).toMatch(/still/);
-  });
-
-  it('warns when the scrub would leave the line unparseable, rather than reverting in silence', async () => {
-    // `"payload"` is a key, so removing it leaves a bare token where a string had to be.
-    const runDir = await makeRun(['keep this text']);
-    const before = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-    const result = await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', '"payload"']),
-      out,
-      cwd,
-    );
-
-    expect(result.reverted).toBe(1);
-    expect(result.removals).toBe(0);
-    expect(lines.join('')).toMatch(/warn scrub_reverted/);
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toBe(before);
-  });
-});
-
-/**
- * `manifest.json` is where the operator is named: `cwd` and `argv` carry the checkout path, and
- * `env_allowlisted` carries HOME, PATH and USER verbatim. `agenticreplay scrub last --match my-hostname`
- * is the README's own example, so the manifest has to go through the same detectors as the rest.
- */
-describe('scrub — the manifest', () => {
-  const ENV_KEY = 'AGENTICREPLAY_SCRUB_TEST_HOST';
-  let cwd: string;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-manifest-'));
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-  });
-
-  afterEach(async () => {
-    delete process.env[ENV_KEY];
-    await rm(cwd, { recursive: true, force: true });
-  });
-
-  async function makeRun(host = 'prod-db-7.internal.example.com'): Promise<string> {
-    process.env[ENV_KEY] = `/home/${host}/checkout`;
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['claude', '--project', `/srv/${host}`],
-      cwd: `/srv/${host}`,
-      agenticreplayVersion: '0.1.0',
-      envAllowlist: [ENV_KEY],
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    await writer.append({ type: 'run.end', actor: 'agenticreplay', turn: 0 });
-    await writer.close(0);
-    return writer.runDir;
-  }
-
-  it('removes the literal from cwd, argv and the allowlisted environment', async () => {
-    const runDir = await makeRun();
-    const before = await readFile(join(runDir, 'manifest.json'), 'utf8');
-    expect(before, 'fixture must put the host in all three places').toContain(
-      'prod-db-7.internal.example.com',
-    );
-
-    await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com']),
-      out,
-      cwd,
-    );
-
-    const after = JSON.parse(await readFile(join(runDir, 'manifest.json'), 'utf8')) as {
-      cwd: string;
-      argv: string[];
-      env_allowlisted: Record<string, string>;
-    };
-    expect(JSON.stringify(after)).not.toContain('prod-db-7.internal.example.com');
-    expect(after.cwd).toContain('redacted');
-    expect(after.argv.join(' ')).toContain('redacted');
-    expect(after.env_allowlisted[ENV_KEY]).toContain('redacted');
-  });
-
-  it('re-runs the standard detectors over the manifest as well', async () => {
-    const runDir = await makeRun();
-    // A key that leaked into the recorded command line, which the write path never saw.
-    const raw = JSON.parse(await readFile(join(runDir, 'manifest.json'), 'utf8')) as Record<
-      string,
-      unknown
-    >;
-    raw.argv = ['claude', '--token', 'ghr_abcdefghijklmnopqrstuvwxyz0123456789'];
-    await writeFile(join(runDir, 'manifest.json'), `${JSON.stringify(raw, null, 2)}\n`, 'utf8');
-
-    await scrubCommand(parseArgs(['scrub', 'last']), out, cwd);
-
-    const after = await readFile(join(runDir, 'manifest.json'), 'utf8');
-    expect(after).not.toContain('ghr_abcdefghijklmnopqrstuvwxyz0123456789');
-  });
-
-  it('leaves a manifest that still validates and still verifies', async () => {
-    const runDir = await makeRun();
-    await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com']),
-      out,
-      cwd,
-    );
-
-    const parsed: unknown = JSON.parse(await readFile(join(runDir, 'manifest.json'), 'utf8'));
-    const result = validateManifest(parsed);
-    expect(result.valid, result.errors.join(', ')).toBe(true);
-
-    const { TraceReader } = await import('@agenticreplay/core');
-    await expect((await TraceReader.open(runDir)).verifyIntegrity()).resolves.toMatchObject({
-      ok: true,
-    });
-  });
-
-  it('counts what it removed from the manifest', async () => {
-    await makeRun();
-    const result = await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', 'prod-db-7.internal.example.com']),
-      out,
-      cwd,
-    );
-    // cwd, one argv element, and the environment value.
-    expect(result.removals).toBeGreaterThanOrEqual(3);
-  });
-
-  it('refuses, changing nothing, when the scrub would take the manifest apart', async () => {
-    const runDir = await makeRun();
-    const manifestBefore = await readFile(join(runDir, 'manifest.json'), 'utf8');
-
-    // A bare quote is not a value in the manifest, it is the JSON itself.
-    await expect(
-      scrubCommand(parseArgs(['scrub', 'last', '--match', '"']), out, cwd),
-    ).rejects.toThrow(/manifest/);
-
-    expect(await readFile(join(runDir, 'manifest.json'), 'utf8')).toBe(manifestBefore);
-  });
-
-  it('refuses, changing nothing, when the scrub would invalidate the manifest', async () => {
-    const runDir = await makeRun();
-    const manifestBefore = await readFile(join(runDir, 'manifest.json'), 'utf8');
-    const eventsBefore = await readFile(join(runDir, 'events.jsonl'), 'utf8');
-
-    // `run_` is the run id's required prefix, so removing it breaks a field the schema pins.
-    await expect(
-      scrubCommand(parseArgs(['scrub', 'last', '--match', 'run_']), out, cwd),
-    ).rejects.toThrow(/manifest/);
-
-    expect(await readFile(join(runDir, 'manifest.json'), 'utf8')).toBe(manifestBefore);
-    expect(await readFile(join(runDir, 'events.jsonl'), 'utf8')).toBe(eventsBefore);
-  });
-});
-
-/**
- * `fs/` is a bare git object store holding the whole workspace at every turn — usually the largest
- * thing in a run. Its objects are addressed by the hash of what they contain, so a secret in a
- * source file cannot be edited out of it the way a blob can. What must not happen is the scrubber
- * reporting a clean trace while every snapshot still holds the file.
- */
-describe('scrub — the shadow filesystem store', () => {
-  const NEEDLE = 'prod-db-7.internal.example.com';
-  let cwd: string;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-fs-'));
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-  });
-
-  afterEach(async () => {
-    await rm(cwd, { recursive: true, force: true });
-  });
-
-  /** A run whose shadow store holds one workspace file containing `contents`. */
-  async function makeRunWithSnapshot(contents: string): Promise<{ runDir: string; tree: string }> {
-    await writeFile(join(cwd, 'config.ts'), contents, 'utf8');
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    const { FsCapture } = await import('@agenticreplay/fs-capture');
-    const capture = await FsCapture.start({ runDir: writer.runDir, cwd });
-    const snapshot = await capture.snapshotTurn(0);
-    await writer.append({
-      type: 'fs.snapshot',
-      actor: 'agenticreplay',
-      turn: 0,
-      attrs: { tree: snapshot.tree },
-    });
-    await writer.append({ type: 'run.end', actor: 'agenticreplay', turn: 0 });
-    await writer.close(0);
-    return { runDir: writer.runDir, tree: snapshot.tree };
-  }
-
-  it('reports that the shadow store still holds the match instead of claiming a clean trace', async () => {
-    const { runDir } = await makeRunWithSnapshot(`export const host = '${NEEDLE}';\n`);
-    const result = await scrubCommand(parseArgs(['scrub', 'last', '--match', NEEDLE]), out, cwd);
-
-    expect(result.fsStoreMatches).toBeGreaterThan(0);
-    const printed = lines.join('');
-    expect(printed).toMatch(/warn fs_store_not_scrubbed/);
-    expect(printed).toMatch(/--drop-fs/);
-    expect(
-      printed,
-      'it must not call a trace clean while the store still holds the match',
-    ).not.toMatch(/nothing matched/);
-    expect(runDir).toBeTruthy();
-  });
-
-  /** The report has to be true: restoring the snapshot really does bring the match back. */
-  it('is telling the truth — the snapshot still restores the match', async () => {
-    const { runDir, tree } = await makeRunWithSnapshot(`export const host = '${NEEDLE}';\n`);
-    await scrubCommand(parseArgs(['scrub', 'last', '--match', NEEDLE]), out, cwd);
-
-    const dest = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-fs-restore-'));
-    const { ShadowIndex } = await import('@agenticreplay/fs-capture');
-    const shadow = await ShadowIndex.create({ gitDir: join(runDir, 'fs'), workTree: cwd });
-    await shadow.materialize(tree, dest);
-    expect(await readFile(join(dest, 'config.ts'), 'utf8')).toContain(NEEDLE);
-    await rm(dest, { recursive: true, force: true });
-  });
-
-  it('drops the store outright with --drop-fs, and says what that costs', async () => {
-    const { runDir } = await makeRunWithSnapshot(`export const host = '${NEEDLE}';\n`);
-    const result = await scrubCommand(
-      parseArgs(['scrub', 'last', '--match', NEEDLE, '--drop-fs']),
-      out,
-      cwd,
-    );
-
-    expect(result.fsStoreDropped).toBe(true);
-    expect(result.fsStoreMatches).toBe(0);
-    await expect(stat(join(runDir, 'fs'))).rejects.toThrow();
-    expect(lines.join('')).toMatch(/fs_store_dropped/);
-  });
-
-  it('says nothing about the store when it holds no match', async () => {
-    await makeRunWithSnapshot('export const host = "localhost";\n');
-    const result = await scrubCommand(parseArgs(['scrub', 'last', '--match', NEEDLE]), out, cwd);
-
-    expect(result.fsStoreMatches).toBe(0);
-    expect(lines.join('')).not.toMatch(/fs_store_not_scrubbed/);
-  });
-
-  it('finds a match in a captured filename, not only in file contents', async () => {
-    await writeFile(join(cwd, `${NEEDLE}.conf`), 'listen = 8080\n', 'utf8');
-    await makeRunWithSnapshot('export const host = "localhost";\n');
-    const result = await scrubCommand(parseArgs(['scrub', 'last', '--match', NEEDLE]), out, cwd);
-    expect(result.fsStoreMatches).toBeGreaterThan(0);
-  });
-});
-
-/** A store that is present but unreadable is the one case where "0 matches" proves nothing. */
-describe('scrub — an unreadable shadow store', () => {
-  it('says it could not check, rather than reporting a clean trace', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-scrub-fs-bad-'));
-    const lines: string[] = [];
-    const out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-    const writer = await TraceWriter.create(join(cwd, '.agenticreplay', 'runs'), {
-      adapter: { id: 'test' },
-      argv: ['test'],
-      cwd,
-      agenticreplayVersion: '0.1.0',
-    });
-    await writer.append({ type: 'run.start', actor: 'agenticreplay', turn: 0 });
-    await writer.close(0);
-    // Present, but not an object database git can open.
-    await mkdir(join(writer.runDir, 'fs'), { recursive: true });
-
-    const result = await scrubCommand(parseArgs(['scrub', 'last', '--match', 'ABSENT']), out, cwd);
-
-    expect(result.fsStoreMatches).toBe(0);
-    const printed = lines.join('');
-    expect(printed).toMatch(/warn fs_store_unverified/);
-    expect(printed, 'an unchecked store is not a clean one').not.toMatch(/nothing matched/);
-    await rm(cwd, { recursive: true, force: true });
-  });
-});