agentlas 0.9.4 → 0.9.6

package/engine/agentlas-memory-import.cjs

@@ -0,0 +1,310 @@
+"use strict";
+
+// `agentlas memory import <path> [--apply]` — Phase 1b.
+//
+// Promote legacy markdown memory into the shared agentlas.sqlite the desktop
+// uses (same userData/agentlas.sqlite). Maps each substantive markdown section
+// to a durable memory_entries row owned by the right layer of a team (member
+// cell / orchestrator / shared team_memory) or a single agent. Mirrors the app's
+// electron/memory/import.ts mapping so app and terminal agree. Dry-run by
+// default (prints the preview table); --apply writes. Idempotent via a stable
+// per-section source-hash sentinel embedded in evidence. Secrets are dropped.
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { createHash, randomUUID } = require("node:crypto");
+
+const SOURCE_TOKEN_PREFIX = "mem-import:v1";
+const MAX_FILES = 400;
+const MAX_CONTENT = 4000;
+
+// ── Section extraction (parity with electron/memory/import.ts) ───────────────
+const TEMPLATE_LINE =
+  /^\s*[-*]?\s*(Add\b|Fill in\b|Example:|Record\b|Link\b|Prefer\b|Note\b|Which\b|Date:\s*$|Topic:\s*$|Decision:\s*$|Why:\s*$|Risk accepted:\s*$)/i;
+const META_HEADING =
+  /^(How To Use|사용 규칙|사용법|구조|형식|사전 참조|누가 업데이트|Entries|Read First|Memory Rules|Recent Activity|Recently Touched|CROSS-REFERENCES|LEARNINGS LOG|ANTIPATTERNS|GOTCHAS|Repeated Failures|성공 패턴|발견 사항|안티패턴|에이전트 구성)/i;
+const SHARED_HINT =
+  /(team[-_ ]?memory|team_memory|glossary|handoff|scope[-_ ]?ownership|common[-_ ]?safety|safety|tone|language|dossier|operating[-_ ]?architecture|memory[-_ ]?architecture|용어|공통|안전|인계|톤)/i;
+const RISK_HINT = /(security|attack|vuln|bug|gotcha|incident|보안|취약|버그|사고)/i;
+const ALWAYS_KEEP_HINT = /(team[-_ ]?memory|glossary|dossier|handoff|safety|scope[-_ ]?ownership|tone)/i;
+
+// Minimal secret guard (a subset of the shared secret-patterns chokepoint) so a
+// stray key in legacy notes never becomes a durable memory row.
+const { looksSecret } = require("./agentlas-secret-patterns.cjs");
+
+function substantiveBody(body) {
+  const lines = body.split("\n").map((l) => l.trim()).filter(Boolean);
+  const real = lines.filter((l) => !TEMPLATE_LINE.test(l) && l.replace(/^#+\s*/, "").length >= 12);
+  return real.join("\n");
+}
+
+function kindForHeading(heading, fallback) {
+  const m = /\[([A-Z_]+)\]/.exec(heading);
+  const tag = m ? m[1] : "";
+  if (["SUCCESS", "DISCOVERY"].includes(tag)) return "procedure";
+  if (["ANTIPATTERN", "GOTCHA", "SECURITY", "CONFIRMED", "REGRESSION", "FALSE_POSITIVE", "BLOCKED_BY_GUARD", "FAILURE"].includes(tag)) {
+    return "risk";
+  }
+  return fallback;
+}
+
+function keepSection(heading, body, alwaysKeep) {
+  if (META_HEADING.test(heading.replace(/\[[A-Z_]+\]\s*/, "").trim())) return false;
+  const hasDate = /\(20\d\d-\d\d-\d\d\)|Date:\s*20\d\d-\d\d-\d\d/.test(heading + "\n" + body);
+  const hasTag = /\[[A-Z_]+\]/.test(heading);
+  const real = substantiveBody(body);
+  if (alwaysKeep) return real.length >= 60;
+  if (hasDate || hasTag) return real.length >= 40;
+  return real.length >= 160;
+}
+
+function splitSections(md) {
+  const lines = md.split("\n");
+  const sections = [];
+  let cur = null;
+  for (const line of lines) {
+    if (/^#{2,3}\s+\S/.test(line)) {
+      if (cur) sections.push(cur);
+      cur = { heading: line.replace(/^#{2,3}\s+/, "").trim(), body: "" };
+    } else if (cur) {
+      cur.body += line + "\n";
+    }
+  }
+  if (cur) sections.push(cur);
+  return sections;
+}
+
+function splitDatedBullets(md) {
+  const idx = md.indexOf("- Date:");
+  if (idx === -1) return [];
+  return md
+    .slice(idx)
+    .split(/\n(?=- Date:)/)
+    .map((p) => p.trim())
+    .filter((p) => /Date:\s*20\d\d-\d\d-\d\d/.test(p))
+    .map((p) => {
+      const topic = /Topic:\s*(.+)/.exec(p);
+      const date = /Date:\s*(20\d\d-\d\d-\d\d)/.exec(p);
+      return { heading: `Decision ${date ? date[1] : ""}: ${topic ? topic[1].trim() : ""}`.trim(), body: p };
+    });
+}
+
+function normalizeToken(value) {
+  return String(value || "").toLowerCase().replace(/[^a-z0-9가-힣]+/g, " ").trim();
+}
+
+function resolveTarget(db, agentId) {
+  let firms = [];
+  try {
+    firms = db.prepare("SELECT id, ceo_agent_id, org_chart_json FROM firms").all();
+  } catch {
+    firms = [];
+  }
+  const firm =
+    firms.find((f) => f.id === agentId) ||
+    firms.find((f) => f.ceo_agent_id === agentId) ||
+    null;
+  if (!firm) return { agentId, kind: "agent", members: [] };
+  let chart = [];
+  try {
+    const parsed = JSON.parse(firm.org_chart_json);
+    if (Array.isArray(parsed)) chart = parsed;
+  } catch {
+    chart = [];
+  }
+  const members = chart
+    .filter((node) => node && node.agentId && node.agentId !== firm.ceo_agent_id)
+    .map((node) => ({ agentId: node.agentId, role: node.role || node.agentSlug, slug: node.agentSlug }));
+  return { agentId: firm.ceo_agent_id, kind: "team", members };
+}
+
+function matchMember(fileTokens, target) {
+  if (!target.members.length) return null;
+  let best = null;
+  for (const member of target.members) {
+    const roleTokens = normalizeToken(member.role).split(" ").filter((t) => t.length >= 3);
+    const slugTokens = normalizeToken(member.slug).split(" ").filter((t) => t.length >= 3);
+    const tokens = [...new Set([...roleTokens, ...slugTokens])];
+    let score = 0;
+    for (const token of tokens) if (fileTokens.includes(token)) score += token.length;
+    if (score > 0 && (!best || score > best.score)) best = { agentId: member.agentId, role: member.role, score };
+  }
+  return best ? { agentId: best.agentId, role: best.role } : null;
+}
+
+function decideOwner(relFile, target) {
+  const lower = relFile.toLowerCase();
+  const fileTokens = normalizeToken(relFile);
+  const alwaysKeep = ALWAYS_KEEP_HINT.test(lower);
+  if (SHARED_HINT.test(lower)) {
+    return {
+      scope: "team_memory",
+      ownerAgentId: null,
+      ownerLabel: "team_memory",
+      fallbackKind: /glossary|dossier|용어/i.test(lower) ? "fact" : "procedure",
+      alwaysKeep,
+    };
+  }
+  if (target.kind === "team") {
+    const member = matchMember(fileTokens, target);
+    if (member) {
+      return { scope: "agent_repo", ownerAgentId: member.agentId, ownerLabel: member.role, fallbackKind: RISK_HINT.test(lower) ? "risk" : "procedure", alwaysKeep };
+    }
+    return { scope: "agent_repo", ownerAgentId: target.agentId, ownerLabel: "orchestrator", fallbackKind: RISK_HINT.test(lower) ? "risk" : "decision", alwaysKeep };
+  }
+  return { scope: "agent_repo", ownerAgentId: target.agentId, ownerLabel: "agent", fallbackKind: RISK_HINT.test(lower) ? "risk" : "procedure", alwaysKeep };
+}
+
+function collectMarkdown(root) {
+  const stat = fs.statSync(root);
+  if (stat.isFile()) {
+    return /\.(md|markdown|mdx|txt)$/i.test(root) ? [{ abs: root, rel: path.basename(root) }] : [];
+  }
+  const out = [];
+  const walk = (dir) => {
+    if (out.length >= MAX_FILES) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (out.length >= MAX_FILES) return;
+      if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+      const abs = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(abs);
+      else if (entry.isFile() && /\.(md|markdown|mdx|txt)$/i.test(entry.name)) out.push({ abs, rel: path.relative(root, abs) });
+    }
+  };
+  walk(root);
+  return out.sort((a, b) => a.rel.localeCompare(b.rel));
+}
+
+function stableToken(relFile, heading) {
+  const hash = createHash("sha256").update(`${SOURCE_TOKEN_PREFIX}|${relFile}|${heading}`).digest("hex").slice(0, 16);
+  return `${SOURCE_TOKEN_PREFIX}:${hash}`;
+}
+
+function buildEntries(sourcePath, target) {
+  const built = [];
+  for (const { abs, rel } of collectMarkdown(sourcePath)) {
+    let md;
+    try {
+      md = fs.readFileSync(abs, "utf8");
+    } catch {
+      continue;
+    }
+    const owner = decideOwner(rel, target);
+    const sections = /decisions\.md$/i.test(rel) ? splitDatedBullets(md) : splitSections(md);
+    for (const sec of sections) {
+      if (!keepSection(sec.heading, sec.body, owner.alwaysKeep)) continue;
+      const bodyText = sec.body.replace(/\n{3,}/g, "\n\n").trim();
+      const content = `${sec.heading}\n${bodyText}`.trim().slice(0, MAX_CONTENT);
+      if (content.length < 40) continue;
+      built.push({
+        token: stableToken(rel, sec.heading),
+        relFile: rel,
+        heading: sec.heading,
+        content,
+        scope: owner.scope,
+        kind: kindForHeading(sec.heading, owner.fallbackKind),
+        ownerAgentId: owner.ownerAgentId,
+        ownerLabel: owner.ownerLabel,
+        redacted: looksSecret(content),
+      });
+    }
+  }
+  return built;
+}
+
+function existsByToken(db, token) {
+  try {
+    return Boolean(db.prepare("SELECT 1 FROM memory_entries WHERE evidence_json LIKE ? LIMIT 1").get(`%${token}%`));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * cmdMemory — `agentlas memory <sub> ...`. Currently: import.
+ * @param {{db:any,args:string[],out:(s:string)=>void,fail:(s:string)=>void}} ctx
+ */
+function cmdMemory(ctx) {
+  const { db, out, fail } = ctx;
+  const args = Array.isArray(ctx.args) ? ctx.args : [];
+  const sub = args[0] || "help";
+  if (sub === "help" || sub === "--help" || sub === "-h") {
+    out("usage: agentlas memory import <folder-or-file> --agent <agentId> [--apply]");
+    out("  dry-run by default (prints the preview table); --apply writes to the shared DB.");
+    return;
+  }
+  if (sub !== "import") return fail(`Unknown memory subcommand: ${sub} (import)`);
+
+  const apply = args.includes("--apply");
+  const agentIdx = args.indexOf("--agent");
+  const agentId = agentIdx >= 0 ? String(args[agentIdx + 1] || "").trim() : "";
+  const positional = args.slice(1).filter((a, i, arr) => a !== "--apply" && a !== "--agent" && arr[i - 1] !== "--agent");
+  const rawPath = positional[0];
+  if (!rawPath) return fail('usage: agentlas memory import <folder-or-file> --agent <agentId> [--apply]');
+  if (!agentId) return fail("memory import requires --agent <agentId> (the single agent or team to import into).");
+  const sourcePath = path.resolve(rawPath);
+  if (!fs.existsSync(sourcePath)) return fail(`Import source not found: ${sourcePath}`);
+
+  const target = resolveTarget(db, agentId);
+  const entries = buildEntries(sourcePath, target);
+
+  out(`== memory import (${apply ? "APPLY" : "DRY-RUN"}) ==`);
+  out(`source: ${sourcePath}`);
+  out(`target: ${agentId} (${target.kind})`);
+  out("");
+  out(pad("OWNER", 26) + pad("KIND", 10) + pad("STATUS", 8) + "SECTION");
+  const byOwner = {};
+  let newCount = 0;
+  let dupCount = 0;
+  let redacted = 0;
+  for (const e of entries) {
+    const status = e.redacted ? "skip" : existsByToken(db, e.token) ? "dup" : "new";
+    if (status === "new") {
+      newCount += 1;
+      byOwner[e.ownerLabel] = (byOwner[e.ownerLabel] || 0) + 1;
+    } else if (status === "dup") dupCount += 1;
+    else redacted += 1;
+    out(pad(e.ownerLabel, 26) + pad(e.kind, 10) + pad(status, 8) + e.heading.slice(0, 70));
+  }
+  out("");
+  out(`total ${entries.length} · new ${newCount} · duplicate ${dupCount} · redacted ${redacted}`);
+
+  if (!apply) {
+    out("");
+    out("dry-run — nothing written. Re-run with --apply to write to the shared agentlas.sqlite.");
+    return;
+  }
+
+  const now = new Date().toISOString();
+  let imported = 0;
+  const insert = db.prepare(
+    "INSERT INTO memory_entries (id,scope,kind,content,project_id,project_path,agent_id,chat_id,confidence,sensitivity,evidence_json,context_json,superseded_at,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,NULL,?)",
+  );
+  const write = db.transaction((list) => {
+    for (const e of list) {
+      if (e.redacted || existsByToken(db, e.token)) continue;
+      const confidence = /\(20\d\d-\d\d-\d\d\)|Date:\s*20\d\d/.test(e.content) ? "high" : "medium";
+      const context = JSON.stringify({ userIntent: `Imported memory: ${e.heading}`.slice(0, 200), outcome: "imported-from-existing-memory" });
+      const evidence = JSON.stringify([e.token, `source:memory-import/${e.relFile}`]);
+      insert.run(randomUUID(), e.scope, e.kind, e.content, null, null, e.ownerAgentId, null, confidence, "internal", evidence, context, now);
+      imported += 1;
+    }
+  });
+  write(entries);
+
+  out("");
+  out(`imported ${imported} memory entries into the shared DB. (Embedding runs in the desktop app on next open.)`);
+}
+
+function pad(value, width) {
+  const s = String(value == null ? "" : value);
+  return s.length >= width ? s.slice(0, width - 1) + " " : s + " ".repeat(width - s.length);
+}
+
+module.exports = { cmdMemory, buildEntries, resolveTarget, decideOwner };

package/engine/agentlas-repl.cjs

@@ -643,12 +643,26 @@ function startRepl(opts) {
     state.modelPinned = false;
     state.native = {};
   }
+  // 이미지 능력 판정 warm-cache — 동기 호출자(applyRuntimeFor/배지)가 읽기 전에 비동기
+  // 경로에서 상주 판정 서비스를 먼저 데운다. 러너 없음/실패는 어휘 폴백(라벨은 routingNote가 찍음).
+  async function warmImageJudgment(agentRow) {
+    if (!agentRow || typeof caps.resolveNeedsImage !== "function") return;
+    try {
+      await caps.resolveNeedsImage(agentRow);
+    } catch {
+      /* lexical fallback */
+    }
+  }
   // Tell the user when we routed to an image-capable runtime, or when the current one can't make images.
   function routingNote(subject) {
     if (!subject || !caps.needsImage(subject.capAgent)) return;
     const spec = caps.specOf(state.runtime);
     if (caps.capsFor(spec).image) {
-      if (spec !== caps.specOf(baseRuntime)) ui.info(ui.t("routedImage", spec));
+      if (spec !== caps.specOf(baseRuntime)) {
+        // 판정 주체 라벨 — 모델 판정인지 결정적 폴백인지 반드시 밝힌다(조용한 폴백 금지).
+        const judged = typeof caps.imageJudgmentSource === "function" && caps.imageJudgmentSource(subject.capAgent) === "llm";
+        ui.info(ui.t("routedImage", spec) + " — " + ui.t(judged ? "judge.source.llm" : "judge.source.fallback"));
+      }
     } else {
       ui.warn(ui.t("guard.imageWarn", caps.capsFor(spec).label || spec));
     }
@@ -701,10 +715,11 @@ function startRepl(opts) {
     state.routePreambleOnce = null;
     applyRuntimeFor(state.subject);
   }
-  function switchSubject(kind, query) {
+  async function switchSubject(kind, query) {
     if (kind === "agent") {
       const agent = H.resolveAgent(db, query);
       if (!agent) return ui.error(ui.t("noAgent", query));
+      await warmImageJudgment(agent); // 런타임 자동 배정 전에 모델 판정을 데운다
       setSubjectAgent(agent);
     } else {
       const firm = H.resolveFirm(db, query);
@@ -933,11 +948,11 @@ function startRepl(opts) {
       }
       case "agent":
         if (!arg) return ui.warn(ui.t("agentUsage")), true;
-        switchSubject("agent", arg);
+        await switchSubject("agent", arg);
         return true;
       case "firm":
         if (!arg) return ui.warn(ui.t("firmUsage")), true;
-        switchSubject("firm", arg);
+        await switchSubject("firm", arg);
         return true;
       case "runtime":
         setRuntime(arg);
@@ -1364,7 +1379,8 @@ function startRepl(opts) {
   }
 
   // ── interactive picker (when no agent was given) ──
-  function chooseAndStart(setter, row) {
+  async function chooseAndStart(setter, row) {
+    if (setter === setSubjectAgent) await warmImageJudgment(row); // firm은 팀 베토라 판정 대상 아님
     setter(row);
     ui.ok(ui.t("switched", state.subject.label));
     routingNote(state.subject);
@@ -1402,12 +1418,14 @@ function startRepl(opts) {
       if (a) return chooseAndStart(setSubjectAgent, a);
       const f = H.resolveFirm(db, t);
       if (f) return chooseAndStart(setSubjectFirm, f);
-      if (H.autoRouteAgent) {
-        const choice = H.autoRouteAgent(db, t, ui.lang);
+      if (H.autoRouteAgent || H.resolveAutoRoute) {
+        // 연결 모델이 라우트를 최종 판정한다(resolveAutoRoute) — 없으면 어휘 폴백.
+        const choice = H.resolveAutoRoute ? await H.resolveAutoRoute(db, t, ui.lang) : H.autoRouteAgent(db, t, ui.lang);
         if (choice) {
           if (choice.direct) {
             setSubjectDirect();
           } else {
+            await warmImageJudgment(choice.agent);
             setSubjectAgent(choice.agent);
           }
           state.routePreambleOnce = H.autoRoutePreamble ? H.autoRoutePreamble(choice, ui.lang) : null;
@@ -1442,6 +1460,7 @@ function startRepl(opts) {
         if (/^\d+$/.test(t)) {
           const n = parseInt(t, 10);
           if (n >= 1 && n <= ags.length) {
+            await warmImageJudgment(ags[n - 1]);
             setSubjectAgent(ags[n - 1]);
             ui.ok(ui.t("switched", state.subject.label));
             routingNote(state.subject);
@@ -1450,13 +1469,14 @@ function startRepl(opts) {
         }
         if (single) {
           const a = H.resolveAgent(db, t);
-          if (a) { setSubjectAgent(a); ui.ok(ui.t("switched", state.subject.label)); routingNote(state.subject); return; }
+          if (a) { await warmImageJudgment(a); setSubjectAgent(a); ui.ok(ui.t("switched", state.subject.label)); routingNote(state.subject); return; }
           const f = H.resolveFirm(db, t);
           if (f) { setSubjectFirm(f); ui.ok(ui.t("switched", state.subject.label)); routingNote(state.subject); return; }
         }
       }
-      if (H.autoRouteAgent) {
-        const choice = H.autoRouteAgent(db, t, ui.lang);
+      if (H.autoRouteAgent || H.resolveAutoRoute) {
+        // 연결 모델이 라우트를 최종 판정한다(resolveAutoRoute) — 없으면 어휘 폴백.
+        const choice = H.resolveAutoRoute ? await H.resolveAutoRoute(db, t, ui.lang) : H.autoRouteAgent(db, t, ui.lang);
         if (choice) {
           if (choice.direct) {
             setSubjectDirect();
@@ -1466,6 +1486,7 @@ function startRepl(opts) {
               ui.info(H.autoRouteNote ? H.autoRouteNote(choice, ui.lang) : `direct answer (no agent)`);
             }
           } else {
+            await warmImageJudgment(choice.agent);
             setSubjectAgent(choice.agent);
             state.routePreambleOnce = H.autoRoutePreamble ? H.autoRoutePreamble(choice, ui.lang) : null;
             ui.info(H.autoRouteNote ? H.autoRouteNote(choice, ui.lang) : `auto-routed to ${choice.agent.name}`);

package/engine/agentlas-secret-patterns.cjs

@@ -0,0 +1,71 @@
+"use strict";
+// Credential/secret detection for every terminal write boundary that must never persist
+// or transmit a live key. Three inline copies had drifted apart (memory import missed
+// JWTs, generic `key=` assignments and bearer headers; governance missed sk_live_/
+// github_pat_/glpat-; experience exchange missed Google AIza and JWTs), so the same
+// secret was caught at one boundary and stored in plain text at another. One list, one
+// behaviour: extend HERE, not at a call site. Mirrors the desktop's
+// shared/secret-patterns.ts.
+//
+// Scope rule: match *credential shapes*, not the words around them. Ordinary prose that
+// mentions "token", or a hyphenated phrase like "risk-management-notes", must not trip
+// this — a false positive silently drops a user's memory, which is its own data loss.
+
+/** Live-credential shapes across the providers this product actually touches. */
+const SECRET_SHAPES = [
+  // GitHub: classic PAT, OAuth/user/server/refresh tokens, fine-grained PAT.
+  /gh[pousr]_[A-Za-z0-9]{20,}/,
+  /github_pat_[A-Za-z0-9_]{20,}/,
+  // Slack bot/user/app tokens.
+  /xox[baprs]-[A-Za-z0-9-]{20,}/,
+  // AWS access key ids (long-lived and STS).
+  /(?:AKIA|ASIA)[0-9A-Z]{16}/,
+  // Google / Firebase API keys.
+  /AIza[0-9A-Za-z_-]{30,}/,
+  // Stripe and similar: secret/restricted/publishable, live or test.
+  /(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/,
+  // OpenAI / Anthropic, including provider-segmented forms. The \b prevents an ordinary
+  // hyphenated phrase ("ask-forgiveness-not-permission") from matching.
+  /\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{12,}/,
+  // HuggingFace, GitLab, npm.
+  /hf_[A-Za-z0-9]{20,}/,
+  /glpat-[A-Za-z0-9_-]{20,}/,
+  /npm_[A-Za-z0-9]{20,}/,
+  // JWTs (three base64url segments) — bearer tokens frequently land in pasted logs.
+  /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/,
+  // Telegram bot tokens.
+  /\b[0-9]{8,}:[A-Za-z0-9_-]{25,}\b/,
+  // Private key blocks.
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+];
+
+/** `password: hunter2` style assignments, where the value shape alone proves nothing. */
+const SECRET_ASSIGNMENT_RE =
+  /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|cookie|bearer)\b\s*[:=]\s*['"]?[^\s,;'"]{6,}/i;
+
+/** `Authorization: Bearer …` / `Basic …` headers. */
+const AUTH_HEADER_RE = /\bauthorization\b\s*[:=]\s*['"]?(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/i;
+
+/** Single source of truth. Case-insensitive: providers are inconsistent about casing. */
+const SECRET_PATTERNS = [
+  ...SECRET_SHAPES.map((re) => new RegExp(re.source, "i")),
+  SECRET_ASSIGNMENT_RE,
+  AUTH_HEADER_RE,
+];
+
+/** True when the text contains something that looks like a live credential. */
+function looksSecret(content) {
+  const text = String(content || "");
+  return SECRET_PATTERNS.some((re) => re.test(text));
+}
+
+/** Replace credential-shaped substrings with a marker, preserving surrounding text. */
+function redactSecrets(content, marker = "[redacted-secret]") {
+  let out = String(content || "");
+  for (const re of SECRET_PATTERNS) {
+    out = out.replace(new RegExp(re.source, re.flags.includes("g") ? re.flags : `${re.flags}g`), marker);
+  }
+  return out;
+}
+
+module.exports = { SECRET_PATTERNS, looksSecret, redactSecrets };