argusqa-os 9.8.0 → 9.9.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/argusqa-os?color=7C3AED)](https://www.npmjs.com/package/argusqa-os)
 [![MCP Server](https://glama.ai/mcp/servers/ironclawdevs27/Argus/badges/card.svg)](https://glama.ai/mcp/servers/ironclawdevs27/Argus)
-[![Harness](https://img.shields.io/badge/harness-961%2F961-4ADE80)](test-harness/)
+[![Harness](https://img.shields.io/badge/harness-978%2F978-4ADE80)](test-harness/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 **Argus catches the bugs your test suite misses — visual regressions, API loops, CSS drift, console noise, accessibility failures, and more — and delivers rich reports to Slack (or a local HTML dashboard).**
@@ -62,7 +62,7 @@ Argus scans your app and either posts findings to Slack or opens a local `report
 
 ## What Argus Catches
 
-32 analysis engines, 140 distinct issue types, zero test-file maintenance:
+32 analysis engines, 149 distinct issue types, zero test-file maintenance:
 
 | Category | What it detects |
 |---|---|
@@ -95,6 +95,24 @@ And every finding is post-processed with:
 
 ---
 
+## Confidentiality — Aegis Egress Boundary
+
+> **Default ON.** Argus audits your app for *secrets and vulnerabilities* — so its findings are exactly the data you least want leaving your machine. **Aegis** redacts them at every external boundary before they cross.
+
+A finding sent to an external sink — an **MCP tool response** (which lands in the calling agent's context window and transits to that agent's model provider), a **Slack** message, a **GitHub** PR comment + its `::error` annotations, the **hosted/CI HTML report**, or **CI logs** — is reduced to a need-to-know projection: a **sensitive** finding crosses as its `type` + `route` + `severity` + a `🔒` marker, and **never** its raw payload (`message`, `evidence`, request/response bodies, headers, cookies, stack). URLs are projected with the query string stripped (tokens hide there). A **benign** finding keeps its message — but that message is still scrubbed for any accidentally-embedded secret or PII.
+
+| Principle | Behavior |
+|---|---|
+| **Local fidelity preserved** | The on-disk JSON report and the locally-opened HTML keep **100%** detail — redaction only removes detail on the way *out* |
+| **Fail-closed** | On any classifier error or unknown finding shape, Aegis redacts *more*, never less |
+| **Deny-by-default** | Only an explicit allowlist of safe fields ever crosses; a new field leaks nothing until deliberately allowlisted |
+| **5-layer detection** | Category rules ∪ 13 secret regexes ∪ statistical rarity (entropy / token-efficiency) ∪ 7 Luhn-validated PII rules ∪ context boosting |
+| **Opt-out** | `ARGUS_REDACT_SENSITIVE=0` → output is byte-identical to pre-Aegis |
+
+This implements the **OWASP LLM02:2025 — Sensitive Information Disclosure** mitigations (data minimization, redaction, deny-by-default egress filtering) at Argus's own boundaries. An optional, local-only re-hydration vault (`ARGUS_REDACT_VAULT=1`) can mint reversible, information-free tokens for diff-stable artifacts — re-inflate locally with `npm run report:rehydrate`. Full behavior change is documented in [CHANGELOG.md](CHANGELOG.md).
+
+---
+
 ## MCP Tools
 
 Ask Claude (or any MCP client) — no terminal required:
@@ -111,6 +129,8 @@ Ask Claude (or any MCP client) — no terminal required:
 | `argus_visual_diff` | Screenshot baseline comparison. Pass `updateBaseline: true` to reset. |
 | `argus_pr_validate` | Fetch GitHub PR diff → map changed files to affected routes → targeted audit → baseline-aware block decision (blocks on findings the PR *introduces*) + idempotent PR comment + Check Run → `{ blocked, findings, baseline, reporting }` |
 
+> Every tool response is projected through the [Aegis egress boundary](#confidentiality--aegis-egress-boundary) before it reaches the agent, and carries an optional `redaction` rider (`{ redacted, total }`) when sensitive detail was withheld.
+
 **Example prompts:**
 
 ```
@@ -217,8 +237,8 @@ npm run report:html    # Generate reports/report.html from last JSON audit
 npm run report:pdf     # Export HTML report to A4 PDF (requires: npm install puppeteer)
 npm run server         # Start Slack slash-command server (port 3001)
 npm run init           # Interactive setup wizard
-npm run test:unit          # 366 unit tests — no Chrome required
-npm run test:harness       # 166-block correctness harness — requires Chrome
+npm run test:unit          # 495 unit tests — no Chrome required
+npm run test:harness       # 168-block correctness harness — requires Chrome
 npm run test:harness:log   # same, but tees full output to harness-results.txt
 npm run test:coverage      # merged unit + harness coverage gate (requires Chrome)
 ```
@@ -295,6 +315,10 @@ The included [workflow](.github/workflows/argus.yml) runs on push to `main`, dai
 | `FIGMA_API_TOKEN` | — | Required for `argus_design_audit` |
 | `FONT_SLOW_MS` | `1000` | Slow web font load threshold (ms) |
 | `A11Y_CONTRAST_AA` | `4.5` | WCAG AA min contrast ratio for CVD simulation |
+| `ARGUS_REDACT_SENSITIVE` | `ON` | **Aegis** egress redaction. `0` disables (byte-identical pre-Aegis output) |
+| `ARGUS_REDACT_MODE` | `mask` | Matched-span style: `mask` / `label` / `hash` / `token` / `drop` |
+| `ARGUS_REDACT_HTML` | off local / ON in CI | `1` redacts the hosted HTML report too |
+| `ARGUS_REDACT_VAULT` | `OFF` | `1` (with `ARGUS_REDACT_MODE=token`) mints reversible `AEGIS_<hmac16>` tokens into a local `0600` vault; re-inflate with `npm run report:rehydrate` |
 
 </details>
 
@@ -343,7 +367,7 @@ Argus is a **complementary layer**, not a replacement for unit or E2E tests:
 
 ## Known Limitations
 
-All 961 harness assertions pass (`961/961`) — there are currently no known MCP- or Chrome-layer restrictions. Lighthouse now runs in headless (after the `lighthouse_audit` argument fix); the remaining soft assertions (perf traces, GC-dependent heap-growth) are promoted to counted hard assertions only in the weekly strict-soft lane (`harness-strict.yml`) via `ARGUS_HARNESS_STRICT_SOFT`.
+All 978 harness assertions pass (`978/978`) — there are currently no known MCP- or Chrome-layer restrictions. Lighthouse now runs in headless (after the `lighthouse_audit` argument fix); the remaining soft assertions (perf traces, GC-dependent heap-growth) are promoted to counted hard assertions only in the weekly strict-soft lane (`harness-strict.yml`) via `ARGUS_HARNESS_STRICT_SOFT`.
 
 ---
 
@@ -362,8 +386,8 @@ src/
     chrome-launcher.js  — npm run chrome / argus-chrome — launches Chrome with correct flags
     doctor.js           — npm run doctor / argus-doctor — pre-flight checks
     pr-validate.js      — headless CI entry point for GitHub Actions
-test-harness/           — 166-block correctness harness, 961 hard assertions, 63 fixture pages
-test/unit/              — 366 Vitest unit tests (no Chrome required)
+test-harness/           — 168-block correctness harness, 978 hard assertions, 64 fixture pages
+test/unit/              — 495 Vitest unit tests (no Chrome required)
 landing/                — Product landing page (React 19 + Vite + Tailwind)
 ```
 
@@ -374,7 +398,7 @@ Full source map → [CLAUDE.md](CLAUDE.md) · MCP/DSL reference → [SKILL.md](S
 ## Contributing
 
 1. Fork the repo and create a branch
-2. `npm run test:unit` — verify without Chrome (366 tests)
+2. `npm run test:unit` — verify without Chrome (495 tests)
 3. `npm run test:harness` — full integration coverage (requires Chrome on port 9222)
 4. Open a PR — Argus audits itself via the CI workflow
 

package/glama.json

@@ -1,12 +1,12 @@
 {
   "$schema": "https://glama.ai/mcp/schemas/server.json",
   "name": "argus",
-  "description": "AI-powered QA harness that audits web apps via Chrome DevTools Protocol. Catches JS errors, network failures, a11y violations, SEO issues, security headers, CSS regressions, and more — directly from Claude conversations. 9 MCP tools: argus_audit (fast 8-analyzer pass), argus_audit_full (Lighthouse + memory + responsive), argus_compare (dev vs staging diff), argus_last_report (retrieve last JSON report), argus_watch_snapshot (live tab snapshot without navigating), argus_get_context (LLM-optimized context + fix loop with snapshot_id diff), argus_design_audit (Figma design fidelity — 13 finding types), argus_visual_diff (screenshot baseline comparison, updateBaseline flag), argus_pr_validate (PR diff → affected routes → baseline-aware targeted audit + PR comment/Check Run → blocked flag). Every finding is post-processed with intelligent baseline filtering (cross-run noise classifier) and root cause linking (recent git commits mapped to new findings). 166 test blocks, 961 hard assertions, 67 detection categories.",
+  "description": "AI-powered QA harness that audits web apps via Chrome DevTools Protocol. Catches JS errors, network failures, a11y violations, SEO issues, security headers, CSS regressions, and more — directly from Claude conversations. 9 MCP tools: argus_audit (fast 8-analyzer pass), argus_audit_full (Lighthouse + memory + responsive), argus_compare (dev vs staging diff), argus_last_report (retrieve last JSON report), argus_watch_snapshot (live tab snapshot without navigating), argus_get_context (LLM-optimized context + fix loop with snapshot_id diff), argus_design_audit (Figma design fidelity — 13 finding types), argus_visual_diff (screenshot baseline comparison, updateBaseline flag), argus_pr_validate (PR diff → affected routes → baseline-aware targeted audit + PR comment/Check Run → blocked flag). Every finding is post-processed with intelligent baseline filtering (cross-run noise classifier) and root cause linking (recent git commits mapped to new findings). Every tool response passes through the Aegis confidentiality egress boundary (default-on, fail-closed): secrets, PII, and exploit detail are redacted before a finding can cross into the calling agent's context window — the local on-disk report keeps 100% fidelity, opt out with ARGUS_REDACT_SENSITIVE=0. 168 test blocks, 978 hard assertions, 67 detection categories.",
   "maintainers": ["ironclawdevs27"],
   "tools": [
     {
       "name": "argus_audit",
-      "description": "Fast QA audit — JS errors, network failures (4xx/5xx), CORS, API frequency loops, slow/blocking third-party requests, API contract violations, SEO violations, security headers, content quality, DevTools Issues panel, and HTTPS enforcement. Returns { findings, summary }. Supports cache: true to skip re-crawl on repeat calls."
+      "description": "Fast QA audit — JS errors, network failures (4xx/5xx), CORS, API frequency loops, slow/blocking third-party requests, API contract violations, SEO violations, security headers, content quality, DevTools Issues panel, and HTTPS enforcement. Returns { findings, summary } plus an optional redaction rider when the Aegis egress boundary withholds sensitive detail. Supports cache: true to skip re-crawl on repeat calls."
     },
     {
       "name": "argus_audit_full",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argusqa-os",
-  "version": "9.8.0",
+  "version": "9.9.0",
   "mcpName": "io.github.ironclawdevs27/argus",
   "description": "Argus — AI-powered automated dev-testing platform using Chrome DevTools MCP and Claude Code",
   "keywords": [
@@ -23,6 +23,7 @@
   },
   "files": [
     "src/",
+    "scripts/rehydrate-report.mjs",
     ".mcp.json",
     "glama.json"
   ],
@@ -59,6 +60,7 @@
     "test:coverage": "npm run coverage:harness && npm run coverage:unit && npm run coverage:gate",
     "report:html": "node src/utils/html-reporter.js",
     "report:pdf": "node src/utils/pdf-exporter.js",
+    "report:rehydrate": "node scripts/rehydrate-report.mjs",
     "mcp-server": "node src/mcp-server.js"
   },
   "dependencies": {
@@ -76,10 +78,10 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.9",
     "c8": "^11.0.0",
     "fast-check": "^4.8.0",
     "istanbul-lib-coverage": "^3.2.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   }
 }

package/scripts/rehydrate-report.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/**
+ * Aegis rehydrate CLI (Step 8 of REDACTION_BOUNDARY_MAX_PLAN.md).
+ *
+ * Re-inflates a token-redacted report LOCALLY by swapping every `AEGIS_` vault token
+ * back to its original from the on-disk vault. This is a LOCAL-ONLY operator tool —
+ * it requires the per-machine vault key + the mapping files under
+ * reports/.aegis-vault/ (both 0600, gitignored). The token that crossed the trust
+ * boundary is information-free; only this machine can re-hydrate.
+ *
+ *   npm run report:rehydrate -- <report.json> [--stdout]
+ *
+ * Without --stdout, writes <report>.rehydrated.json next to the input and prints the
+ * path. The original (redacted) file is never modified.
+ */
+import fs from 'fs';
+import { rehydrate, loadVault } from '../src/utils/aegis-vault.js';
+
+const args = process.argv.slice(2);
+const toStdout = args.includes('--stdout');
+const file = args.find((a) => !a.startsWith('--'));
+
+if (!file) {
+  console.error('Usage: npm run report:rehydrate -- <report.json> [--stdout]');
+  process.exit(1);
+}
+
+let raw;
+try {
+  raw = fs.readFileSync(file, 'utf8');
+} catch (err) {
+  console.error(`[Aegis] cannot read ${file}: ${err.message}`);
+  process.exit(1);
+}
+
+let obj;
+try {
+  obj = JSON.parse(raw);
+} catch (err) {
+  console.error(`[Aegis] ${file} is not valid JSON: ${err.message}`);
+  process.exit(1);
+}
+
+const vault = loadVault();
+if (vault.size === 0) {
+  console.error('[Aegis] vault is empty — nothing to rehydrate. Was ARGUS_REDACT_VAULT=1 (and ARGUS_REDACT_MODE=token) set during the run?');
+}
+
+const out = rehydrate(obj, vault);
+
+if (toStdout) {
+  process.stdout.write(JSON.stringify(out, null, 2) + '\n');
+} else {
+  const outPath = file.replace(/\.json$/i, '') + '.rehydrated.json';
+  try {
+    fs.writeFileSync(outPath, JSON.stringify(out, null, 2), 'utf8');
+    console.error(`[Aegis] rehydrated using ${vault.size} mapping(s) → ${outPath}`);
+  } catch (err) {
+    console.error(`[Aegis] could not write ${outPath}: ${err.message}`);
+    process.exit(1);
+  }
+}

package/src/cli/init.js

@@ -288,7 +288,9 @@ async function main() {
     const targetsContent = generateTargetsJs(finalRoutes, { framework, sourceDir, envFile: envFilePath });
 
     try {
-      fs.writeFileSync('.env', envContent, { flag: 'wx', encoding: 'utf8' });
+      // .env holds Slack / GitHub / Figma tokens + the auth password — create it owner-only
+      // (0600) so credentials are never world-readable on shared / POSIX / CI hosts.
+      fs.writeFileSync('.env', envContent, { flag: 'wx', encoding: 'utf8', mode: 0o600 });
       tick('Wrote .env');
     } catch (err) {
       if (err.code === 'EEXIST') {

package/src/cli/pr-validate.js

@@ -31,6 +31,8 @@ import { auditRoutesConcurrently, auditRouteWithRetry, routeResilienceFromEnv }
 import { fetchPrFiles, mapFilesToRoutesDeep, resolveAnnotationTarget } from '../utils/pr-diff-analyzer.js';
 import { resolveTargetUrl }                           from '../utils/deploy-preview.js';
 import { reportPrValidation }                         from '../utils/github-reporter.js';
+import { redactForEgress }                             from '../utils/sensitivity-classifier.js';
+import { scrubText }                                   from '../utils/secret-patterns.js';
 import { getCurrentBranch }                            from '../utils/baseline-manager.js';
 import {
   decidePrBlock, resolvePrBaselineFile, loadPrBaseline, savePrBaseline, tagFindingNovelty, severityTally,
@@ -38,6 +40,24 @@ import {
 
 // ── Exported helpers (testable without Chrome) ────────────────────────────────
 
+/**
+ * Aegis egress guard (Step 7): the $GITHUB_STEP_SUMMARY is a CI artifact readable by anyone
+ * with repo access (A4), so a finding's free-text must never cross raw. Project the finding
+ * through redactForEgress and return its egress-safe `message` + `url`: a sensitive finding's
+ * message collapses to the 🔒 marker, a benign one keeps its scrubbed message; the url is
+ * stripped of query/userinfo. ARGUS_REDACT_SENSITIVE=0 ⇒ raw (byte-identical to pre-Aegis).
+ *
+ * @param {object} f
+ * @returns {{ message: string, url: string }}
+ */
+export function safeFindingLine(f) {
+  if (process.env.ARGUS_REDACT_SENSITIVE === '0') {
+    return { message: String(f?.message ?? ''), url: String(f?.url ?? '') };
+  }
+  const [p] = redactForEgress([f]);
+  return { message: String(p?.message ?? ''), url: String(p?.url ?? '') };
+}
+
 /**
  * Build a GitHub-flavoured markdown step summary.
  *
@@ -105,8 +125,9 @@ export function buildStepSummary({ blocked, summary, affectedRoutes, perRoute, f
       const sev = f.severity === 'critical' ? '🔴 critical'
                : f.severity === 'warning'  ? '⚠️ warning'
                : 'ℹ️ info';
-      const msg = String(f.message ?? '').replace(/\|/g, '\\|').slice(0, 100);
-      const url = String(f.url     ?? '').replace(/\|/g, '\\|').slice(0, 80);
+      const safe = safeFindingLine(f);   // Aegis: scrub message + strip url query before egress
+      const msg = safe.message.replace(/\|/g, '\\|').slice(0, 100);
+      const url = safe.url.replace(/\|/g, '\\|').slice(0, 80);
       md += `| ${sev} | \`${f.type ?? ''}\` | ${msg} | ${url} |\n`;
     }
     if (findings.length > 50) {
@@ -455,11 +476,18 @@ async function main() {
       // genuine diff line (see pr-diff-analyzer.js).
       const annTarget = resolveAnnotationTarget(route.path, prFiles);
       const loc = annTarget ? ` file=${annTarget.path},line=${annTarget.line}` : '';
+      // Aegis (Step 7): a GitHub Actions ::error/::warning annotation is rendered on the PR and
+      // captured in the CI log (A4). scrubText the message so a secret/PII captured from the page
+      // never lands in an annotation; the type + audit-target url stay (structural, non-secret).
+      const annMsg = (m) => {
+        const s = String(m ?? '');
+        return (process.env.ARGUS_REDACT_SENSITIVE === '0' ? s : scrubText(s)).replace(/\n/g, ' ');
+      };
       for (const f of findings.filter(g => g.severity === 'critical')) {
-        console.log(`::error${loc}::${String(f.message ?? '').replace(/\n/g, ' ')} [${f.type}] on ${url}`);
+        console.log(`::error${loc}::${annMsg(f.message)} [${f.type}] on ${url}`);
       }
       for (const f of findings.filter(g => g.severity === 'warning')) {
-        console.log(`::warning${loc}::${String(f.message ?? '').replace(/\n/g, ' ')} [${f.type}] on ${url}`);
+        console.log(`::warning${loc}::${annMsg(f.message)} [${f.type}] on ${url}`);
       }
     }
 
@@ -546,7 +574,14 @@ async function main() {
       blockOn,
       baseline: baselineInfo,
     };
-    console.log(JSON.stringify(result, null, 2));
+    // Aegis (Step 7): the CLI prints this result to stdout, which lands in the GitHub Actions log
+    // (world-readable for public repos, A4). Project the findings through redactForEgress for the
+    // printed view (type/severity/route/scrubbed-message survive — the downstream contract holds);
+    // reportPrValidation below receives the RAW `result` and redacts independently. Opt-out ⇒ raw.
+    const printResult = process.env.ARGUS_REDACT_SENSITIVE === '0'
+      ? result
+      : { ...result, findings: redactForEgress(allFindings) };
+    console.log(JSON.stringify(printResult, null, 2));
 
     // Step 9: Post/update the Argus PR comment + Check Run (Phase A). Idempotent — updates
     // the single marker-tagged comment in place; the Check Run conclusion maps to the block

package/src/mcp-server.js

@@ -45,6 +45,9 @@ import { getCurrentBranch }                    from './utils/baseline-manager.js
 import {
   decidePrBlock, resolvePrBaselineFile, loadPrBaseline, savePrBaseline, tagFindingNovelty, severityTally,
 } from './utils/pr-baseline.js';
+import {
+  redactForEgress, buildRedactionRider, redactReport, deepScrub,
+} from './utils/sensitivity-classifier.js';
 
 const logger = childLogger('mcp-server');
 
@@ -78,6 +81,85 @@ function cacheAudit(url, result) {
   }
 }
 
+// ── Aegis egress projection (REDACTION_BOUNDARY_MAX_PLAN.md Step 4) ─────────────
+// The MCP boundary is the PRIMARY agent trust boundary: every tool response transits to
+// the calling agent's provider (OWASP LLM02). These helpers project findings to the
+// deny-by-default allowlist + attach a `redaction` rider BEFORE the response crosses, so
+// no secret / PII / exploit-detail substring ever leaves in raw form. The LOCAL on-disk
+// report keeps full fidelity (the JSON write in report-processor is untouched). FAIL
+// CLOSED: any projection error yields an empty-findings, redacted response — never the raw
+// payload. ARGUS_REDACT_SENSITIVE=0 = byte-identical passthrough (the documented opt-out).
+const redactOff = () => process.env.ARGUS_REDACT_SENSITIVE === '0';
+
+/**
+ * Project a findings-bearing result object ({ findings, ...rest }) for egress: `findings`
+ * is run through redactForEgress, every other field (summary computed PRE-redaction, urls,
+ * etc.) is preserved, and a `redaction` rider is appended. Used by the findings-array tools
+ * (argus_audit / argus_visual_diff / argus_design_audit / argus_pr_validate).
+ */
+function egressResult(obj, opts = {}) {
+  if (redactOff() || !obj || typeof obj !== 'object') return obj;
+  try {
+    const findings = Array.isArray(obj.findings) ? obj.findings : [];
+    return { ...obj, findings: redactForEgress(findings), redaction: buildRedactionRider(findings, opts) };
+  } catch (err) {
+    logger.error('[ARGUS] Aegis MCP egress failed — failing closed:', err.message);
+    const { findings: _drop, ...rest } = obj;
+    return { ...rest, findings: [],
+      redaction: { redacted: 0, total: 0, localReportPath: opts.localReportPath ?? null,
+        failClosed: true, note: 'Redaction error — findings withheld (fail closed).' } };
+  }
+}
+
+/** Project an argus_watch_snapshot result ({ findings, newConsole, newNetwork }). */
+function egressWatch(r) {
+  if (redactOff() || !r || typeof r !== 'object') return r;
+  try {
+    const findings = Array.isArray(r.findings) ? r.findings : [];
+    return {
+      findings:   redactForEgress(findings),
+      newConsole: (Array.isArray(r.newConsole) ? r.newConsole : []).map((m) => deepScrub(m)),
+      newNetwork: (Array.isArray(r.newNetwork) ? r.newNetwork : []).map((n) => deepScrub(n)),
+      redaction:  buildRedactionRider(findings),
+    };
+  } catch (err) {
+    logger.error('[ARGUS] Aegis watch egress failed — failing closed:', err.message);
+    return { findings: [], newConsole: [], newNetwork: [], redaction: { redacted: 0, total: 0, failClosed: true } };
+  }
+}
+
+/**
+ * Project an argus_get_context result: each finding array is redacted, the raw
+ * console/network arrays are deepScrub'd, open_tabs urls are sanitised, and a rider is
+ * appended. `allFindings` (the full pre-split findings list) feeds the rider count.
+ */
+function egressContext(ctx, allFindings) {
+  if (redactOff() || !ctx || typeof ctx !== 'object') return ctx;
+  try {
+    const out = { ...ctx };
+    for (const k of ['critical_issues', 'warnings', 'js_errors', 'network_failures', 'resolved', 'new_issues', 'persisting']) {
+      if (Array.isArray(ctx[k])) out[k] = redactForEgress(ctx[k]);
+    }
+    if (Array.isArray(ctx.console_errors))  out.console_errors  = ctx.console_errors.map((m) => deepScrub(m));
+    if (Array.isArray(ctx.recent_requests)) out.recent_requests = ctx.recent_requests.map((n) => deepScrub(n));
+    if (Array.isArray(ctx.open_tabs)) {
+      // open_tabs is the user's own diagnostic tab list (not a finding). deepScrub the url —
+      // masks a DETECTED secret (JWT / basic-auth / high-entropy token) while preserving benign
+      // query structure (a sanitizeUrl query-strip would destroy diagnostic context + tab identity).
+      out.open_tabs = ctx.open_tabs.map((t) =>
+        (t && typeof t === 'object' && typeof t.url === 'string') ? { ...t, url: deepScrub(t.url) } : t);
+    }
+    out.redaction = buildRedactionRider(Array.isArray(allFindings) ? allFindings : []);
+    return out;
+  } catch (err) {
+    logger.error('[ARGUS] Aegis get_context egress failed — failing closed:', err.message);
+    return { snapshot_id: ctx.snapshot_id, summary: 'redacted', url: ctx.url, timestamp: ctx.timestamp,
+      critical_issues: [], warnings: [], js_errors: [], network_failures: [],
+      console_errors: [], recent_requests: [], open_tabs: ctx.open_tabs ?? [],
+      redaction: { redacted: 0, total: 0, failClosed: true } };
+  }
+}
+
 // ── Tool definitions ─────────────────────────────────────────────────────────
 
 const TOOLS = [
@@ -200,13 +282,21 @@ async function withMcp(fn) {
 // PR-validate path (handlePrValidate) passes the depth-policy-selected expensive analyzer
 // names (D2) so the same handler runs them on the affected route. The public tool is always
 // called with no `analyzers` → [] → crawlRouteWithDepth returns the cheap pass unchanged.
-async function handleAudit({ url, critical = false, cache = false, analyzers = [] }) {
+// `ctx.internal` is set ONLY by handlePrValidate (an in-process call, NOT through the MCP
+// dispatcher) so the PR-validate block/baseline/novelty/reporting logic operates on RAW
+// findings. It is a SECOND positional argument — the dispatcher calls handleAudit(args) with
+// no ctx, so a client cannot inject internal:true via req.params.arguments to bypass redaction.
+async function handleAudit({ url, critical = false, cache = false, analyzers = [] }, ctx = {}) {
+  const internal = ctx.internal === true;
+  const finalize = (payload) =>
+    ({ content: [{ type: 'text', text: JSON.stringify(internal ? payload : egressResult(payload), null, 2) }] });
+
   if (cache && auditCache.has(url)) {
     const { result, ts } = auditCache.get(url);
     // Refresh recency on read so eviction is true LRU, not insertion-order FIFO.
     auditCache.delete(url);
     auditCache.set(url, { result, ts });
-    return { content: [{ type: 'text', text: JSON.stringify({ ...result, _cached: true, _cachedAt: new Date(ts).toISOString() }, null, 2) }] };
+    return finalize({ ...result, _cached: true, _cachedAt: new Date(ts).toISOString() });
   }
   return withMcp(async (mcp) => {
     const parsed = new URL(url);
@@ -224,8 +314,8 @@ async function handleAudit({ url, critical = false, cache = false, analyzers = [
       pageTitle:  raw.pageTitle,
       screenshot: raw.screenshot,
     };
-    if (cache) cacheAudit(url, result);
-    return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    if (cache) cacheAudit(url, result);   // cache stores RAW; redaction happens in finalize
+    return finalize(result);
   });
 }
 
@@ -237,14 +327,18 @@ async function handleAuditFull({ url, critical = false }) {
       [{ path: parsed.pathname + parsed.search + parsed.hash, name: 'audit', critical }],
       parsed.origin,
     );
-    return { content: [{ type: 'text', text: JSON.stringify(report, null, 2) }] };
+    // Report-shaped egress: redact every finding array (routes[].errors / flows[].findings /
+    // codebase[]) + attach the rider; report metadata stays so the golden schema holds.
+    return { content: [{ type: 'text', text: JSON.stringify(redactReport(report), null, 2) }] };
   });
 }
 
 async function handleCompare() {
   return withMcp(async (mcp) => {
     const report = await runComparison(mcp);
-    return { content: [{ type: 'text', text: JSON.stringify(report, null, 2) }] };
+    // Handles BOTH compare modes: css-analysis routes[].findings via redactForEgress and
+    // env-comparison routes[].diffs via deepScrub (descriptions/urls scrubbed, paths stripped).
+    return { content: [{ type: 'text', text: JSON.stringify(redactReport(report), null, 2) }] };
   });
 }
 
@@ -255,7 +349,9 @@ async function handleWatchSnapshot({ url, tabId } = {}) {
     const baseUrl = url ?? process.env.TARGET_DEV_URL ?? 'http://localhost:3000';
     const session = new WatchSession(browser, baseUrl);
     const result  = await session.poll();
-    return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    // Redact findings + scrub the RAW newConsole/newNetwork arrays (a Bearer token in a
+    // console.error or a ?token= query in a request URL would otherwise cross raw).
+    return { content: [{ type: 'text', text: JSON.stringify(egressWatch(result), null, 2) }] };
   });
 }
 
@@ -333,7 +429,10 @@ async function handleGetContext({ url, snapshot_id: prevId, tabId } = {}) {
       ...(isDiff ? { resolved, new_issues, persisting } : {}),
     };
 
-    return { content: [{ type: 'text', text: JSON.stringify(context, null, 2) }] };
+    // Egress projection at the boundary — AFTER all internal logic (diff keys, summary) ran on
+    // raw findings: redact every finding array + scrub console_errors/recent_requests + sanitise
+    // open_tabs urls + append the rider (counted over the full `findings` set).
+    return { content: [{ type: 'text', text: JSON.stringify(egressContext(context, findings), null, 2) }] };
   });
 }
 
@@ -360,7 +459,10 @@ async function handleVisualDiff({ url, updateBaseline = false, baselineDir }) {
     const baseline   = findings.find(f => f.type === 'visual_baseline_created');
     const summary    = findings.find(f => f.type === 'visual_diff_summary');
 
-    return { content: [{ type: 'text', text: JSON.stringify({
+    // The structured summary is computed from the RAW findings ABOVE, then egressResult
+    // redacts the findings array (cosmetic visual_* findings keep a scrubbed message; any
+    // accidental embedded secret is caught) and appends the rider.
+    return { content: [{ type: 'text', text: JSON.stringify(egressResult({
       findings,
       summary: {
         status:      regression ? 'regression' : baseline ? 'baseline_created' : 'no_change',
@@ -369,7 +471,7 @@ async function handleVisualDiff({ url, updateBaseline = false, baselineDir }) {
         totalPixels: summary?.totalPixels ?? 0,
         severity:    regression?.severity ?? 'info',
       },
-    }, null, 2) }] };
+    }), null, 2) }] };
   });
 }
 
@@ -379,11 +481,11 @@ async function handleDesignAudit({ url, figmaFrameUrl }) {
 
   const figmaData = await getFigmaFrame(figmaFrameUrl);
   if (!figmaData) {
-    return { content: [{ type: 'text', text: JSON.stringify({
+    return { content: [{ type: 'text', text: JSON.stringify(egressResult({
       error: 'Could not fetch Figma data. Ensure FIGMA_API_TOKEN is set and the figmaFrameUrl is valid.',
       findings: [],
       summary: { tokenMismatches: 0, missingComponents: 0, colorMismatches: 0, typographyMismatches: 0, spacingMismatches: 0, radiusMismatches: 0, boundsOverflows: 0, positionDrifts: 0, strokeMismatches: 0, shadowMismatches: 0, opacityMismatches: 0, gapMismatches: 0, textMismatches: 0 },
-    }) }] };
+    })) }] };
   }
 
   return withMcp(async (mcp) => {
@@ -405,7 +507,9 @@ async function handleDesignAudit({ url, figmaFrameUrl }) {
       gapMismatches:        count('design_gap_mismatch'),
       textMismatches:       count('design_text_mismatch'),
     };
-    return { content: [{ type: 'text', text: JSON.stringify({ findings, summary }, null, 2) }] };
+    // Summary counts are computed from the RAW findings above; egressResult then redacts the
+    // findings array (cosmetic design_* findings keep a scrubbed message) + appends the rider.
+    return { content: [{ type: 'text', text: JSON.stringify(egressResult({ findings, summary }), null, 2) }] };
   });
 }
 
@@ -481,7 +585,9 @@ async function handlePrValidate({ prUrl, targetUrl, githubToken, blockOn } = {})
     const routePath = String(route.path ?? '/').startsWith('/') ? route.path : `/${route.path}`;
     const url  = `${baseUrl}${routePath}`;
     const res  = await auditRouteWithRetry(
-      () => handleAudit({ url, critical: route.critical ?? false, analyzers: depthAnalyzers }),
+      // internal:true ⇒ handleAudit returns RAW findings so the block/baseline/novelty/
+      // reporting logic below sees full detail; the MCP RESPONSE is redacted at the return.
+      () => handleAudit({ url, critical: route.critical ?? false, analyzers: depthAnalyzers }, { internal: true }),
       { timeoutMs: routeTimeoutMs, retries: routeRetries, label: `Route audit ${routePath}` },
     );
     const data = JSON.parse(res.content[0].text);
@@ -560,7 +666,10 @@ async function handlePrValidate({ prUrl, targetUrl, githubToken, blockOn } = {})
     reporting = { posted: false, checked: false, skipped: true, reason: `reporting failed: ${err.message}` };
   }
 
-  return { content: [{ type: 'text', text: JSON.stringify({ ...result, reporting }, null, 2) }] };
+  // Egress projection of the MCP response — redacts `result.findings` + appends the rider.
+  // reportPrValidation above already ran on the RAW `result` (the GitHub sink is guarded
+  // separately in Step 6); the block decision / baseline used raw findings too.
+  return { content: [{ type: 'text', text: JSON.stringify(egressResult({ ...result, reporting }), null, 2) }] };
 }
 
 async function handleLastReport() {
@@ -575,7 +684,12 @@ async function handleLastReport() {
     .map(f => ({ f, mt: fs.statSync(path.join(REPORTS_DIR, f)).mtimeMs }))
     .sort((a, b) => b.mt - a.mt)[0].f;
   const json = fs.readFileSync(path.join(REPORTS_DIR, latest), 'utf8');
-  return { content: [{ type: 'text', text: json }] };
+  // The on-disk report keeps full fidelity (raw secrets); when it crosses the MCP boundary
+  // it MUST be redacted (this tool is a direct local-report → agent-context egress path).
+  if (redactOff()) return { content: [{ type: 'text', text: json }] };
+  let parsed;
+  try { parsed = JSON.parse(json); } catch { return { content: [{ type: 'text', text: json }] }; }
+  return { content: [{ type: 'text', text: JSON.stringify(redactReport(parsed), null, 2) }] };
 }
 
 // ── Server bootstrap ──────────────────────────────────────────────────────────

package/src/orchestration/dispatcher.js

@@ -13,6 +13,7 @@ import { postBugReport }                          from './slack-notifier.js';
 import { isSlackConfigured }                      from '../utils/slack-guard.js';
 import { isGitHubConfigured, reportToGitHub }     from '../utils/github-reporter.js';
 import { generateHtmlReport }                     from '../utils/html-reporter.js';
+import { redactForEgress, summarizeRedaction }    from '../utils/sensitivity-classifier.js';
 
 const logger = childLogger('dispatcher');
 
@@ -57,6 +58,30 @@ function errorText(e) {
  * Info       → single digest message summarising all routes
  */
 async function dispatchToSlack(report, diff) {
+  // ── Aegis egress guard (Step 5) ───────────────────────────────────────────
+  // Slack is a third-party sink outside the trust boundary (a shared channel, A2).
+  // Project EVERY finding through redactForEgress before any description / details
+  // line is built, so no secret / PII / exploit detail crosses: a sensitive finding's
+  // line collapses to the 🔒 marker (its message becomes REDACT_MARKER), a benign
+  // finding keeps its mandatory-scrubbed message. The LOCAL on-disk report is untouched
+  // (this rebinds the local `report` param to a redacted CLONE). ARGUS_REDACT_SENSITIVE=0
+  // ⇒ byte-identical passthrough (redactForEgress returns the same objects).
+  let redactedCount = 0;
+  if (process.env.ARGUS_REDACT_SENSITIVE !== '0') {
+    const rawFindings = [
+      ...report.routes.flatMap(r => r.errors ?? []),
+      ...(report.flows ?? []).flatMap(f => f.findings ?? []),
+      ...(report.codebase ?? []),
+    ];
+    redactedCount = summarizeRedaction(rawFindings).redacted;
+    report = {
+      ...report,
+      routes:   report.routes.map(r => ({ ...r, errors: redactForEgress(r.errors ?? []) })),
+      flows:    (report.flows ?? []).map(f => ({ ...f, findings: redactForEgress(f.findings ?? []) })),
+      codebase: redactForEgress(report.codebase ?? []),
+    };
+  }
+
   const { summary } = report;
 
   // ── Criticals: one message per affected route ─────────────────────────────
@@ -218,6 +243,9 @@ async function dispatchToSlack(report, diff) {
       description:
         `Summary: ${summary.total} findings across ${report.routes.length} routes\n` +
         `:red_circle: ${summary.critical} critical  :large_yellow_circle: ${summary.warning} warnings  :large_blue_circle: ${summary.info} info\n` +
+        (redactedCount > 0
+          ? `:lock: ${redactedCount} sensitive finding(s) redacted at the boundary — full detail in the local report\n`
+          : '') +
         (trendLine ? trendLine + '\n' : '') + '\n' +
         (digestLines.length > 0 ? digestLines.join('\n') : '_No info-level findings._'),
       url: report.baseUrl,