akm-cli 0.9.0-rc.0 → 0.9.0-rc.13

package/dist/core/paths.js

@@ -10,8 +10,8 @@
  */
 import os from "node:os";
 import path from "node:path";
-import { IS_WINDOWS } from "./common.js";
 import { ConfigError } from "./errors.js";
+import { IS_WINDOWS } from "./platform.js";
 /**
  * Returns true when the current process appears to be running under
  * `bun test` (either via the BUN_TEST sentinel Bun sets on the test
@@ -30,10 +30,10 @@ function isUnderBunTest(env) {
  * Returns true when the given path is in a directory family the OS may
  * reap (or that the user has clearly designated as a sandbox by virtue
  * of placing it under `/tmp` or a macOS per-user temp dir). Used to
- * decide whether `AKM_STASH_DIR=$tmpdir` should also isolate config +
+ * decide whether `AKM_BUNDLE_DIR=$tmpdir` should also isolate config +
  * cache writes (so a test harness's `akm setup --yes --dir .` cannot
  * silently clobber the user's `~/.config/akm/config.json`). See
- * `docs/technical/incidents/2026-05-23-setup-clobbers-user-config.md`
+ * the 2026-05-23 setup-clobbers-user-config incident
  * for the incident that motivated this.
  *
  * Both `/var/folders/*` and `/private/var/folders/*` are matched because
@@ -67,7 +67,7 @@ export function getConfigDir(env = process.env, platform = process.platform) {
         return override;
     // Explicit XDG override wins next — tests and operators that pre-arrange
     // an isolated config dir via XDG_CONFIG_HOME (or %APPDATA% on Windows)
-    // must be honored as set, so the AKM_STASH_DIR transient-isolation rule
+    // must be honored as set, so the AKM_BUNDLE_DIR transient-isolation rule
     // below does not silently move config away from where they pointed it.
     if (platform === "win32") {
         const appData = env.APPDATA?.trim();
@@ -79,16 +79,16 @@ export function getConfigDir(env = process.env, platform = process.platform) {
         if (xdgConfigHome)
             return path.join(xdgConfigHome, "akm");
     }
-    // Isolation safety: when AKM_STASH_DIR points at a transient/sandbox path
+    // Isolation safety: when AKM_BUNDLE_DIR points at a transient/sandbox path
     // (/tmp, /var/tmp, /private/var/folders) AND no explicit config dir
-    // override is set, route config writes into `${AKM_STASH_DIR}/.akm`
+    // override is set, route config writes into `${AKM_BUNDLE_DIR}/.akm`
     // instead of the user's host ~/.config/akm. This prevents the documented
     // isolation pattern
-    //   AKM_DATA_DIR=/tmp/x AKM_STASH_DIR=/tmp/x akm setup --yes --dir .
+    //   AKM_DATA_DIR=/tmp/x AKM_BUNDLE_DIR=/tmp/x akm setup --yes --dir .
     // from silently clobbering the host config. See
-    // docs/technical/incidents/2026-05-23-setup-clobbers-user-config.md for the incident.
-    // Daily users with a persistent AKM_STASH_DIR=~/my-stash are unaffected.
-    const stashOverride = env.AKM_STASH_DIR?.trim();
+    // the 2026-05-23 setup-clobbers-user-config incident.
+    // Daily users with a persistent AKM_BUNDLE_DIR=~/my-stash are unaffected.
+    const stashOverride = env.AKM_BUNDLE_DIR?.trim();
     if (stashOverride && isTransientStashPath(stashOverride)) {
         return path.join(stashOverride, ".akm");
     }
@@ -122,7 +122,7 @@ export function getCacheDir(env = process.env) {
     // Explicit XDG/platform overrides win before the transient-stash isolation
     // rule below — tests and operators that pre-arrange XDG_CACHE_HOME (or
     // %LOCALAPPDATA% / %USERPROFILE% / %APPDATA% on Windows) must be honored
-    // as set, so the AKM_STASH_DIR transient rule does not silently move cache
+    // as set, so the AKM_BUNDLE_DIR transient rule does not silently move cache
     // writes away from where they pointed them.
     if (IS_WINDOWS) {
         const localAppData = env.LOCALAPPDATA?.trim();
@@ -145,12 +145,12 @@ export function getCacheDir(env = process.env) {
         if (xdgCacheHome)
             return path.join(xdgCacheHome, "akm");
     }
-    // Isolation safety (mirrors getConfigDir): when AKM_STASH_DIR points at a
+    // Isolation safety (mirrors getConfigDir): when AKM_BUNDLE_DIR points at a
     // transient path AND no explicit cache override is set, route cache writes
-    // into `${AKM_STASH_DIR}/.akm/cache` so that config backups, registry-index
+    // into `${AKM_BUNDLE_DIR}/.akm/cache` so that config backups, registry-index
     // cache, and other regenerable artifacts do not pollute the user's host
     // ~/.cache/akm directory.
-    const stashOverride = env.AKM_STASH_DIR?.trim();
+    const stashOverride = env.AKM_BUNDLE_DIR?.trim();
     if (stashOverride && isTransientStashPath(stashOverride)) {
         return path.join(stashOverride, ".akm", "cache");
     }
@@ -184,7 +184,7 @@ export function getDataDir(env = process.env, platform = process.platform) {
     // user's real $XDG_DATA_HOME / ~/.local/share/akm under any condition.
     // Any test that needs a data dir must point it at a mktemp-d directory
     // via XDG_DATA_HOME (or AKM_DATA_DIR). The previous carve-out that only
-    // fired when AKM_STASH_DIR was set was a loophole: tests calling
+    // fired when AKM_BUNDLE_DIR was set was a loophole: tests calling
     // openDatabase() or getDbPath() without overriding any env var silently
     // wrote into ~/.local/share/akm/index.db (observed: 4,183-row
     // registry-cache pollution). Item 5 of the 0.8.x critical-review plan.
@@ -218,16 +218,16 @@ export function getDbPath(env = process.env) {
 export function getIndexWriterLockPath() {
     return path.join(getDataDir(), "index.db.write.lock");
 }
-export function getWorkflowDbPath() {
-    return path.join(getDataDir(), "workflow.db");
+export function getMaintenanceBarrierPath() {
+    return path.join(getDataDir(), "maintenance.barrier.lock");
 }
 /** Path to the state.db file in $DATA. */
 export function getStateDbPathInDataDir() {
     return path.join(getDataDir(), "state.db");
 }
-/** Path for the task history directory in $DATA. */
-export function getTaskHistoryStateDir() {
-    return path.join(getDataDir(), "tasks", "history");
+/** Content-addressed scheduler runtime descriptors. */
+export function getTaskContextDir(env = process.env) {
+    return path.join(getDataDir(env), "tasks", "context");
 }
 /** Path to the akm.lock file in $DATA. */
 export function getLockfilePath() {
@@ -246,9 +246,6 @@ export function getRegistryCacheDir() {
 export function getRegistryIndexCacheDir() {
     return path.join(getCacheDir(), "registry-index");
 }
-export function getBinDir() {
-    return path.join(getCacheDir(), "bin");
-}
 // ── Scheduled-task runtime directories (logs + history) ──────────────────────
 export function getTaskLogDir() {
     return path.join(getCacheDir(), "tasks", "logs");
@@ -258,7 +255,7 @@ export function getTaskHistoryDir() {
 }
 // ── Default stash directory ──────────────────────────────────────────────────
 export function getDefaultStashDir(env = process.env) {
-    const override = env.AKM_STASH_DIR?.trim();
+    const override = env.AKM_BUNDLE_DIR?.trim();
     if (override)
         return override;
     if (IS_WINDOWS) {
@@ -269,7 +266,7 @@ export function getDefaultStashDir(env = process.env) {
     }
     const home = env.HOME?.trim();
     if (!home) {
-        throw new ConfigError("Unable to determine default stash directory. Set HOME.", "STASH_DIR_NOT_FOUND");
+        throw new ConfigError("Unable to determine default bundle directory. Set HOME.", "STASH_DIR_NOT_FOUND");
     }
     return path.join(home, "akm");
 }

package/dist/core/platform.js

@@ -0,0 +1,10 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Platform detection leaf (chunk-8 WI-8.6, DoD 11). Imports NOTHING so both
+ * `common.ts` and `paths.ts` can depend on it — extracting IS_WINDOWS here
+ * broke the `common.ts ↔ paths.ts` import cycle (paths needed only this
+ * constant from common).
+ */
+export const IS_WINDOWS = process.platform === "win32";

package/dist/core/recognition-util.js

@@ -0,0 +1,128 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The util home for recognition/grammar constants shared across the asset,
+ * indexer, and workflow layers (chunk 1, D1-4).
+ *
+ * INVARIANT (D1-5, cycle-safety): this module MUST import NOTHING from
+ * `src/` (no relative `./`/`../` imports into the tree). All four symbols
+ * below are self-contained literals/pure functions today, so this file is a
+ * pure sink — everything imports FROM it, it imports from nothing internal.
+ * The import-cycle ratchet (`scripts/lint-import-cycles.ts`) is shrink-only:
+ * a 29th cycle participant is a hard failure, so this file must never gain
+ * an internal import that could pull it into an existing knot. Enforced
+ * mechanically by `tests/core/recognition-util.test.ts`.
+ */
+/** All recognized script extensions for the script asset type. */
+export const SCRIPT_EXTENSIONS = new Set([
+    ".sh",
+    ".ts",
+    ".js",
+    ".ps1",
+    ".cmd",
+    ".bat",
+    ".py",
+    ".rb",
+    ".go",
+    ".pl",
+    ".php",
+    ".lua",
+    ".r",
+    ".swift",
+    ".kt",
+    ".kts",
+]);
+/**
+ * Recognized workflow asset extensions. One format now (workflow-format-
+ * unification): orchestration graph in frontmatter, prose in the body.
+ * `workflows/<name>` refs resolve against this list.
+ */
+export const WORKFLOW_EXTENSIONS = [".md"];
+/**
+ * Strip the recognized workflow extension (`.md`) from a workflow asset
+ * *name* so `foo` and `foo.md` collapse to one canonical identity — the same
+ * collapse `workflowSpec.toCanonicalName` performs on a resolved file path.
+ * Callers that turn a `workflows/<name>` ref into run identity (the
+ * active-run guard, list/status filters) MUST route the name through this so
+ * an aliased spelling (`workflows/foo.md`) and the canonical `workflows/foo`
+ * cannot start or hide parallel runs of the same workflow. Names without the
+ * extension pass through unchanged.
+ */
+export function canonicalizeWorkflowName(name) {
+    const lower = name.toLowerCase();
+    for (const ext of WORKFLOW_EXTENSIONS) {
+        if (lower.endsWith(ext))
+            return name.slice(0, -ext.length);
+    }
+    return name;
+}
+/** Structural marker suffix for a derived (inferred) memory's canonical name. */
+export const DERIVED_SUFFIX = ".derived";
+// ── Known-type taxonomy (chunk 1.5, D1.5-4) ─────────────────────────────────
+//
+// `KNOWN_TYPES` replaces the deleted `common.ts` closed asset-type union.
+// It is a HINT/exhaustiveness tuple, NOT a validation gate: unknown/foreign
+// `type` strings are still valid `IndexDocument`/`IndexDocument`/`AssetRef` DATA
+// (plan §2.3/§15.4) — this tuple only anchors compile-time completeness for
+// AKM's OWN presentation/ranking tables (`Record<KnownType, X>` fails to
+// compile if a key is missing). A plain `as const` literal tuple adds no
+// import, so it lives here without breaking the D1-5 import-free invariant.
+/**
+ * The AKM-owned built-in asset type keys — the deleted `common.ts` `ASSET_TYPES`
+ * set (same order) minus the retired `wiki` type (chunk 4); `instruction`
+ * (CLAUDE.md / AGENTS.md project-instruction files) is the newest, added for the
+ * format-family adapters (spec §6/§7 instruction row, maintainer resolution
+ * 2026-07). An instruction file is a read-like-knowledge markdown document, so
+ * it reuses knowledge's presentation shape (label "Instruction", `knowledge-md`
+ * renderer, a "read the project instructions" action) rather than the generic
+ * fallback. `wiki` was removed here in chunk 4 ("the wiki ASSET-TYPE dies", plan
+ * §11 Chunk 4 / §7.4): the LLM Wiki structure now lives in the first-class
+ * `llm-wiki` adapter whose page kinds are open (foreign) types, not AKM-owned.
+ */
+export const KNOWN_TYPES = [
+    "skill",
+    "command",
+    "agent",
+    "knowledge",
+    "workflow",
+    "script",
+    "memory",
+    "env",
+    "secret",
+    "lesson",
+    "task",
+    "session",
+    "fact",
+    "instruction",
+];
+/**
+ * Returns true when `type` is one of AKM's own known type keys
+ * ({@link KNOWN_TYPES}). Unlike the deleted `isAssetType`, this is NOT a
+ * validation gate — a `false` result does not mean `type` is invalid data,
+ * only that it is not AKM-owned (a foreign/adapter type is still a valid
+ * ref/entry). Used to index `Record<KnownType, X>` tables safely from an
+ * open `string` and, later, for cross-surface known-type spelling checks.
+ */
+export function isKnownType(type) {
+    return KNOWN_TYPES.includes(type);
+}
+/**
+ * Type keys deliberately REMOVED from AKM (chunk 1.5, D1.5-6 — the key
+ * correctness call in the open-token change). The open type token accepts
+ * any non-empty string as valid ref/entry DATA except this set: silently
+ * re-admitting a retired type as an ordinary "foreign" type would defeat the
+ * guard that removed it in the first place.
+ *
+ *   - `vault` — removed in 0.9.0 in favor of `env`/`secret`; carries its own
+ *     migration-hint `UsageError` in `asset-ref.ts` (checked before this
+ *     set) and interacts with the dangerous-env-key lint
+ *     (`commands/lint/env-key-rules.ts`) — vaults must never be silently
+ *     re-admitted as an ordinary indexed/ref-able type.
+ *   - `tool` — retired outright, no replacement.
+ *
+ * Consulted by the ref parser and `metadata.ts`'s
+ * `validateStashEntry` gate (and the `akm` adapter's `recognize`) so the
+ * rejection lives in one place instead of three closed-union-shaped copies.
+ */
+export const DEPRECATED_REJECTED_TYPES = new Set(["tool", "vault"]);

package/dist/core/redaction.js

@@ -0,0 +1,392 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+const ENV_PASSTHROUGH_REDACTION_POLICY = {
+    HOME: "path",
+    PATH: "path",
+    USER: "identifier",
+    LANG: "identifier",
+    LC_ALL: "identifier",
+    TERM: "identifier",
+    TMPDIR: "path",
+    SYSTEMROOT: "path",
+    COMSPEC: "path",
+    PATHEXT: "path",
+    WINDIR: "path",
+    TEMP: "path",
+    TMP: "path",
+    AKM_EVENT_SOURCE: "identifier",
+    OPENCODE_CONFIG: "path",
+    CLAUDE_CONFIG: "path",
+    CODEX_CONFIG: "path",
+    AWS_PROFILE: "identifier",
+    AWS_REGION: "identifier",
+    LLM_MODEL: "identifier",
+    LLM_BASE_URL: "url",
+};
+/** Environment names whose ordinary values identify runtime configuration rather than credentials. */
+export const ENV_PASSTHROUGH_REDACTION_ALLOWLIST = new Set(Object.keys(ENV_PASSTHROUGH_REDACTION_POLICY));
+const SIGNED_QUERY_KEYS = new Set([
+    "accesskey",
+    "accesskeyid",
+    "accesstoken",
+    "actortoken",
+    "apikey",
+    "assertion",
+    "authorization",
+    "authorizationcode",
+    "authreqid",
+    "clientassertion",
+    "clientsecret",
+    "code",
+    "codeverifier",
+    "credential",
+    "devicecode",
+    "googleaccessid",
+    "idtoken",
+    "idtokenhint",
+    "initialaccesstoken",
+    "key",
+    "loginhinttoken",
+    "logouthint",
+    "logouttoken",
+    "nonce",
+    "oauthcode",
+    "oauthtoken",
+    "oauthverifier",
+    "password",
+    "refreshtoken",
+    "registrationaccesstoken",
+    "requesturi",
+    "response",
+    "secret",
+    "sessiontoken",
+    "sharedaccesssignature",
+    "sig",
+    "signature",
+    "softwarestatement",
+    "state",
+    "subjecttoken",
+    "token",
+    "usercode",
+    "verifier",
+    "xamzcredential",
+    "xamzsecuritytoken",
+    "xamzsignature",
+    "xgoogcredential",
+    "xgoogsignature",
+]);
+function normalizedQueryKey(key) {
+    return key.toLowerCase().replaceAll(/[^a-z0-9]/g, "");
+}
+function collectCredentialParameters(params, values) {
+    let found = false;
+    for (const [key, value] of params) {
+        if (!SIGNED_QUERY_KEYS.has(normalizedQueryKey(key)))
+            continue;
+        found = true;
+        if (value)
+            values?.add(value);
+    }
+    return found;
+}
+function addEncodedCredentialVariants(rawValue, values) {
+    if (!rawValue || !values)
+        return;
+    values.add(rawValue);
+    let decoded;
+    try {
+        decoded = decodeURIComponent(rawValue.replaceAll("+", " "));
+    }
+    catch {
+        return;
+    }
+    if (!decoded)
+        return;
+    values.add(decoded);
+    const encoded = encodeURIComponent(decoded);
+    values.add(encoded);
+    values.add(encoded.replaceAll("%20", "+"));
+    values.add(encoded.replace(/%[0-9A-F]{2}/g, (sequence) => sequence.toLowerCase()));
+}
+function collectEncodedCredentialParameters(raw, values) {
+    let found = false;
+    for (const part of raw.split("&")) {
+        const separator = part.indexOf("=");
+        if (separator < 0)
+            continue;
+        const rawKey = part.slice(0, separator);
+        const rawValue = part.slice(separator + 1);
+        let key = rawKey;
+        try {
+            key = decodeURIComponent(rawKey.replaceAll("+", " "));
+        }
+        catch {
+            // Keep the raw key so malformed credential-shaped input still fails closed.
+        }
+        if (!SIGNED_QUERY_KEYS.has(normalizedQueryKey(key)))
+            continue;
+        found = true;
+        addEncodedCredentialVariants(rawValue, values);
+    }
+    return found;
+}
+function collectCredentialFragment(fragment, values) {
+    const directDecoded = fragment.includes("=") && collectCredentialParameters(new URLSearchParams(fragment), values);
+    const directEncoded = fragment.includes("=") && collectEncodedCredentialParameters(fragment, values);
+    let found = directDecoded || directEncoded;
+    const nestedQuery = fragment.indexOf("?");
+    if (nestedQuery >= 0) {
+        const query = fragment.slice(nestedQuery + 1);
+        const decoded = collectCredentialParameters(new URLSearchParams(query), values);
+        const encoded = collectEncodedCredentialParameters(query, values);
+        found = decoded || encoded || found;
+    }
+    return found;
+}
+function inspectCredentialBearingUrl(value, values) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return false;
+    try {
+        const url = new URL(trimmed);
+        let found = false;
+        for (const userInfo of [url.username, url.password]) {
+            if (!userInfo)
+                continue;
+            found = true;
+            values?.add(userInfo);
+            try {
+                values?.add(decodeURIComponent(userInfo));
+            }
+            catch {
+                values?.add(userInfo);
+            }
+        }
+        const decodedQuery = collectCredentialParameters(url.searchParams, values);
+        const encodedQuery = collectEncodedCredentialParameters(url.search.slice(1), values);
+        found = decodedQuery || encodedQuery || found;
+        return collectCredentialFragment(url.hash.slice(1), values) || found;
+    }
+    catch {
+        // Fail closed for malformed URL-like values carrying the same credential shapes.
+        let found = /^[a-z][a-z0-9+.-]*:\/\/[^/\s?#]*@/i.test(trimmed);
+        const query = trimmed.indexOf("?");
+        const fragment = trimmed.indexOf("#");
+        if (query >= 0) {
+            const queryText = trimmed.slice(query + 1, fragment >= 0 ? fragment : undefined);
+            const decodedQuery = collectCredentialParameters(new URLSearchParams(queryText), values);
+            const encodedQuery = collectEncodedCredentialParameters(queryText, values);
+            found = decodedQuery || encodedQuery || found;
+        }
+        if (fragment >= 0) {
+            const fragmentText = trimmed.slice(fragment + 1);
+            found = collectCredentialFragment(fragmentText, values) || found;
+        }
+        return found;
+    }
+}
+/** Collect exact secrets plus decoded values embedded in credential-bearing URLs. */
+export function collectSensitiveValues(rawValues) {
+    const values = new Set();
+    for (const value of rawValues) {
+        if (value === undefined || value.length === 0)
+            continue;
+        values.add(value);
+        const trimmed = value.trim();
+        if (inspectCredentialBearingUrl(value, values) && trimmed)
+            values.add(trimmed);
+    }
+    return [...values];
+}
+/**
+ * Decide whether an allowlisted passthrough value may cross an output boundary.
+ * The name allowlist never overrides value inspection: URL userinfo and signed
+ * query credentials remain secret even under ordinarily non-secret names.
+ */
+export function isEnvPassthroughValueSafeToExpose(name, value) {
+    if (value === undefined)
+        return true;
+    const policy = ENV_PASSTHROUGH_REDACTION_POLICY[name];
+    if (!policy)
+        return false;
+    const classifiedPolicy = policy;
+    switch (classifiedPolicy) {
+        case "identifier":
+        case "path":
+        case "url":
+            return !inspectCredentialBearingUrl(value);
+        default: {
+            const exhaustive = classifiedPolicy;
+            return exhaustive;
+        }
+    }
+}
+function utf8SequenceLength(firstByte) {
+    if (firstByte <= 0x7f)
+        return 1;
+    if (firstByte >= 0xc2 && firstByte <= 0xdf)
+        return 2;
+    if (firstByte >= 0xe0 && firstByte <= 0xef)
+        return 3;
+    if (firstByte >= 0xf0 && firstByte <= 0xf4)
+        return 4;
+    return 0;
+}
+function normalizeEncodedText(value, plusAsSpace) {
+    let text = "";
+    const starts = new Int32Array(value.length);
+    let mappingLength = 0;
+    const append = (decoded, start) => {
+        text += decoded;
+        for (let index = 0; index < decoded.length; index++) {
+            starts[mappingLength] = start;
+            mappingLength++;
+        }
+    };
+    for (let index = 0; index < value.length;) {
+        if (value[index] === "%" && /^[0-9a-f]{2}$/i.test(value.slice(index + 1, index + 3))) {
+            const start = index;
+            const firstByte = Number.parseInt(value.slice(index + 1, index + 3), 16);
+            const sequenceLength = utf8SequenceLength(firstByte);
+            if (sequenceLength > 0) {
+                const bytes = [firstByte];
+                let cursor = index + 3;
+                while (bytes.length < sequenceLength &&
+                    value[cursor] === "%" &&
+                    /^[0-9a-f]{2}$/i.test(value.slice(cursor + 1, cursor + 3))) {
+                    bytes.push(Number.parseInt(value.slice(cursor + 1, cursor + 3), 16));
+                    cursor += 3;
+                }
+                if (bytes.length === sequenceLength) {
+                    try {
+                        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(Uint8Array.from(bytes));
+                        index = cursor;
+                        append(decoded, start);
+                        continue;
+                    }
+                    catch {
+                        // Treat invalid UTF-8 percent sequences as literal text.
+                    }
+                }
+            }
+        }
+        const start = index;
+        const codePoint = value.codePointAt(index);
+        if (codePoint === undefined)
+            break;
+        const character = String.fromCodePoint(codePoint);
+        index += character.length;
+        append(plusAsSpace && character === "+" ? " " : character, start);
+    }
+    return { text, starts, sourceLength: value.length };
+}
+function addMappedMatches(coverageDelta, haystack, needle) {
+    if (!needle)
+        return;
+    let offset = 0;
+    while (offset <= haystack.text.length - needle.length) {
+        const match = haystack.text.indexOf(needle, offset);
+        if (match < 0)
+            break;
+        const start = haystack.starts[match];
+        const normalizedEnd = match + needle.length;
+        const end = normalizedEnd < haystack.text.length ? haystack.starts[normalizedEnd] : haystack.sourceLength;
+        coverageDelta[start] = coverageDelta[start] + 1;
+        coverageDelta[end] = coverageDelta[end] - 1;
+        offset = match + Math.max(needle.length, 1);
+    }
+}
+/**
+ * Redact credential-shaped substrings from arbitrary text by pattern alone —
+ * unlike {@link redactSensitiveText}, which requires the exact secret value
+ * up front, this catches credentials no caller ever knew to list. No
+ * truncation is applied; callers that need a length cap (e.g.
+ * {@link redactErrorBody} in src/llm/client.ts) apply it themselves.
+ *
+ * Targets:
+ *  - `Bearer <token>` headers echoed back by a provider
+ *  - `sk-…` / `sk_…` style API keys (OpenAI / Anthropic-shaped)
+ *  - `key-…` / `key_…` shorthand keys
+ *  - `"api_key": "…"` / `"apiKey": "…"` JSON fields
+ *  - Discord webhook URLs (`discord.com/api/webhooks/<id>/<token>`) — the id
+ *    is kept, only the token segment is redacted
+ *  - Slack incoming-webhook URLs (`hooks.slack.com/services/<team>/<channel>/<token>`)
+ *    — the team/channel ids are kept, only the trailing token is redacted
+ */
+export function redactCredentialPatterns(input) {
+    if (!input)
+        return "";
+    return (input
+        // Bearer tokens (case-insensitive)
+        .replace(/\bBearer\s+[A-Za-z0-9._\-+/=]+/gi, "Bearer [REDACTED]")
+        // sk-/sk_ style keys
+        .replace(/\bsk[-_][A-Za-z0-9._-]{6,}/g, "[REDACTED]")
+        // key-/key_ shorthand keys
+        .replace(/\bkey[-_][A-Za-z0-9._-]{6,}/g, "[REDACTED]")
+        // JSON-style "api_key": "...", "apiKey": "...", "api-key": "..."
+        .replace(/("(?:api[_-]?key|apiKey|authorization|token)"\s*:\s*")([^"]*)(")/gi, "$1[REDACTED]$3")
+        // Discord webhook URLs: keep the webhook id, redact the token segment.
+        .replace(/(discord(?:app)?\.com\/api\/webhooks\/\d+\/)[A-Za-z0-9_-]+/gi, "$1[REDACTED]")
+        // Slack incoming-webhook URLs: keep the team/channel ids, redact the token.
+        .replace(/(hooks\.slack\.com\/services\/[A-Za-z0-9]+\/[A-Za-z0-9]+\/)[A-Za-z0-9]+/gi, "$1[REDACTED]"));
+}
+/**
+ * Replace exact sensitive values in text. Longer values are replaced first so
+ * an overlapping prefix cannot expose the suffix of a longer credential.
+ */
+export function redactSensitiveText(text, sensitiveValues) {
+    const values = [...new Set(sensitiveValues)]
+        .filter((value) => value.length > 0)
+        .sort((a, b) => b.length - a.length || a.localeCompare(b));
+    if (values.length === 0)
+        return text;
+    if (!text.includes("%") && !text.includes("+")) {
+        let redacted = text;
+        for (const value of values)
+            redacted = redacted.replaceAll(value, "[REDACTED]");
+        return redacted;
+    }
+    const coverageDelta = new Int32Array(text.length + 1);
+    const addMatchesForMode = (plusAsSpace) => {
+        const haystack = normalizeEncodedText(text, plusAsSpace);
+        for (const value of values) {
+            addMappedMatches(coverageDelta, haystack, normalizeEncodedText(value, plusAsSpace).text);
+        }
+    };
+    addMatchesForMode(false);
+    if (text.includes("+"))
+        addMatchesForMode(true);
+    let redacted = "";
+    let coverage = 0;
+    let offset = 0;
+    let found = false;
+    for (let index = 0; index <= text.length; index++) {
+        const wasCovered = coverage > 0;
+        coverage += coverageDelta[index];
+        const isCovered = coverage > 0;
+        if (!wasCovered && isCovered) {
+            redacted += `${text.slice(offset, index)}[REDACTED]`;
+            found = true;
+        }
+        else if (wasCovered && !isCovered) {
+            offset = index;
+        }
+    }
+    return found ? redacted + text.slice(offset) : text;
+}
+/** Recursively redact string leaves before a structured value crosses a durable/output boundary. */
+export function redactSensitiveValue(value, sensitiveValues) {
+    const values = [...sensitiveValues];
+    const redact = (entry) => {
+        if (typeof entry === "string")
+            return redactSensitiveText(entry, values);
+        if (Array.isArray(entry))
+            return entry.map(redact);
+        if (entry && typeof entry === "object") {
+            return Object.fromEntries(Object.entries(entry).map(([key, child]) => [redactSensitiveText(key, values), redact(child)]));
+        }
+        return entry;
+    };
+    return redact(value);
+}