auto-model-router 0.20.0 → 0.21.0

package/src/server/http.ts

@@ -5,6 +5,8 @@ import { createProviders } from "./providers.ts";
 import { createBridgeFromConfig } from "../context/index.ts";
 import { createFeedbackStore, type Verdict } from "../cost/feedback.ts";
 import { createLedger } from "../cost/ledger.ts";
+import { createRetentionRunner } from "../cost/retention.ts";
+import { redactionRulesFor } from "../config/redaction.ts";
 import { createSessionOverrides } from "./overrides.ts";
 import { catalogView } from "./catalog-view.ts";
 import { buildUpstreamModels } from "../catalog/static-catalog.ts";
@@ -265,6 +267,18 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		},
 	);
 
+	// Compile the redaction rules before the listener exists: a rule that does
+	// not load is a hole in the guard, and an operator who configured redaction
+	// must not get a router that started and forwarded anyway. Programmatic
+	// overrides (an embedder's) never pass through the config schema, so this is
+	// the only place their rules are checked.
+	const redactionRules = redactionRulesFor(cfg.redaction);
+	if (redactionRules.length > 0) {
+		// Names only. The patterns describe the secrets and the matches are the
+		// secrets; neither belongs in a log line.
+		log.info("redaction enabled", { rules: redactionRules.map((r) => r.name).join(","), scanTools: cfg.redaction.scanTools });
+	}
+
 	if (context.enabled) {
 		log.info("agentdox context bridge enabled", {
 			url: cfg.context.baseUrl,
@@ -296,8 +310,24 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		log.warn("initial catalog fetch failed", { error: err instanceof Error ? err.message : String(err) });
 	});
 
-	// One housekeeping timer for both tables. `unref`'d so it never holds the
-	// process open.
+	// Ledger retention. The runner owns the once-an-hour floor, so the minute
+	// timer below, the boot run and `POST /v1/router/prune` cannot between them
+	// run a whole-ledger delete more often than that. It reads the window live,
+	// so a hot reload that lowers it applies on the next tick.
+	const retention = createRetentionRunner({ ledger, retentionDays: () => cfg.ledger.retentionDays });
+	const retain = (): void => {
+		try {
+			const result = retention.maybeRun();
+			if (result !== null && result.deleted > 0) {
+				log.info("pruned ledger rows past retention", { deleted: result.deleted, retentionDays: cfg.ledger.retentionDays });
+			}
+		} catch (err) {
+			log.warn("ledger retention prune failed", { error: err instanceof Error ? err.message : String(err) });
+		}
+	};
+
+	// One housekeeping timer for all three tables. `unref`'d so it never holds
+	// the process open.
 	const pruneTimer = setInterval(() => {
 		try {
 			const dropped = conversations.prune(cfg.ledger.conversationTtlMs);
@@ -315,21 +345,12 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		} catch (err) {
 			log.warn("context block prune failed", { error: err instanceof Error ? err.message : String(err) });
 		}
+		retain();
 	}, 60_000);
 	pruneTimer.unref();
 
-	// Ledger retention: hourly, and once at boot so a lowered setting takes
-	// effect without waiting. Reads the live config, so it hot-reloads.
-	const retain = (): void => {
-		try {
-			const dropped = ledger.prune?.(cfg.ledger.retentionDays) ?? 0;
-			if (dropped > 0) log.info("pruned ledger rows past retention", { dropped, retentionDays: cfg.ledger.retentionDays });
-		} catch (err) {
-			log.warn("ledger retention prune failed", { error: err instanceof Error ? err.message : String(err) });
-		}
-	};
-	const retentionTimer = setInterval(retain, 3_600_000);
-	retentionTimer.unref();
+	// Once shortly after boot, so a lowered window takes effect without waiting
+	// out an hour; the runner's own floor governs everything after that.
 	setTimeout(retain, 5_000).unref();
 
 	// Periodically refetch the (key-scoped) catalog in the background so
@@ -665,6 +686,15 @@ export function startServer(cfg: RouterConfig): StartedServer {
 						}),
 					);
 				}
+				if (req.method === "POST" && url.pathname === "/v1/router/prune") {
+					// A front door of the team edition holds a READ-ONLY handle on the
+					// ledger file by design, so this route is the only way it can act
+					// on its own retention policy — and the once-an-hour floor is the
+					// runner's, not the caller's, so calling it in a loop is harmless.
+					const result = retention.runNow();
+					if (result.deleted > 0) log.info("pruned ledger rows past retention", { deleted: result.deleted, retentionDays: cfg.ledger.retentionDays });
+					return json({ ...result, retentionDays: cfg.ledger.retentionDays });
+				}
 				if (req.method === "POST" && url.pathname === "/v1/router/feedback") {
 					// A user verdict on the newest routed turn of an omp session.
 					const body = (await req.json().catch(() => null)) as Record<string, unknown> | null;

package/src/server/redact.ts

@@ -0,0 +1,104 @@
+/**
+ * Redaction: strings an operator forbids from leaving the process.
+ *
+ * An operator with a compliance obligation needs two things a router can
+ * actually give: certainty that certain shapes of text never reach a provider,
+ * and evidence that the guard ran. This module is the first half; the ledger's
+ * `redactions` count is the second. Neither ever records WHAT was matched — a
+ * redaction log that quotes the secret is just a second copy of the secret.
+ *
+ * `runTurn` applies this to the rendered upstream body, which is the
+ * chat-completions shape every front end normalises to and every provider
+ * client renders from, so the guard sits between the router and ALL of them:
+ * a new upstream cannot bypass it by construction.
+ */
+
+import type { CompiledRedactionRule } from "../config/redaction.ts";
+
+/** Applies every rule to one string. Returns the text and how many matches were replaced. */
+export function redactText(text: string, rules: readonly CompiledRedactionRule[]): { text: string; count: number } {
+	let out = text;
+	let count = 0;
+	for (const rule of rules) {
+		// `replace` with a global regex resets and advances `lastIndex` itself,
+		// including over a zero-width position — which compilation refuses anyway.
+		out = out.replace(rule.regex, () => {
+			count++;
+			return rule.replacement;
+		});
+	}
+	return { text: out, count };
+}
+
+type Rec = Record<string, unknown>;
+const isRec = (v: unknown): v is Rec => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** Redacts a message's `content`, whether it is a string or an array of parts. Returns matches replaced. */
+function redactContent(message: Rec, rules: readonly CompiledRedactionRule[]): number {
+	const content = message.content;
+	if (typeof content === "string") {
+		const r = redactText(content, rules);
+		if (r.count > 0) message.content = r.text;
+		return r.count;
+	}
+	if (!Array.isArray(content)) return 0;
+	let count = 0;
+	for (const part of content) {
+		// Text parts only: an `image_url` part carries a data URI, which no
+		// redaction rule can meaningfully read and every rule would be slow over.
+		if (!isRec(part) || part.type !== "text" || typeof part.text !== "string") continue;
+		const r = redactText(part.text, rules);
+		if (r.count > 0) part.text = r.text;
+		count += r.count;
+	}
+	return count;
+}
+
+/**
+ * Redacts the rendered upstream body in place and returns how many matches
+ * were replaced.
+ *
+ * The body is the chat-completions shape: every front end (chat completions,
+ * Responses, Anthropic Messages) translates into it before parsing, and every
+ * upstream client renders its own protocol FROM it, so this one pass covers
+ * every wire in and every provider out.
+ *
+ * What is scanned:
+ *  - the text content of every message that is not a tool result — the system
+ *    prompt (including the injected agentdox block), the user's words, the
+ *    assistant's replay;
+ *  - with `scanTools`, tool-call arguments and tool-result content as well.
+ *    Off by default because tool results are where the bytes are: a turn's
+ *    prompt is mostly file content, so scanning them is most of the cost — and
+ *    also, for an operator who cares about a secret in a file the agent read,
+ *    most of the point.
+ *
+ * Tool NAMES, ids and the tool schemas are left alone: they are the harness's
+ * own vocabulary, not conversation content, and rewriting one breaks the
+ * call/result pairing the model needs.
+ */
+export function redactUpstreamBody(
+	body: Rec,
+	rules: readonly CompiledRedactionRule[],
+	opts: { scanTools: boolean },
+): number {
+	if (rules.length === 0) return 0;
+	const messages = body.messages;
+	if (!Array.isArray(messages)) return 0;
+	let count = 0;
+	for (const message of messages) {
+		if (!isRec(message)) continue;
+		const isToolResult = message.role === "tool";
+		if (!isToolResult || opts.scanTools) count += redactContent(message, rules);
+		if (!opts.scanTools || !Array.isArray(message.tool_calls)) continue;
+		for (const call of message.tool_calls) {
+			if (!isRec(call) || !isRec(call.function)) continue;
+			const args = call.function.arguments;
+			if (typeof args !== "string") continue;
+			const r = redactText(args, rules);
+			if (r.count > 0) call.function.arguments = r.text;
+			count += r.count;
+		}
+	}
+	return count;
+}

package/src/server/turn.ts

@@ -29,6 +29,8 @@ import {
 import { UpstreamError, type Dispatch, type UpstreamClient } from "../upstream/types.ts";
 import type { SessionOverrides } from "./overrides.ts";
 import { digestCompactionEdits, type CompactionDigester } from "./compaction-digest.ts";
+import { redactUpstreamBody } from "./redact.ts";
+import { redactionRulesFor } from "../config/redaction.ts";
 import { createLogger } from "../util/log.ts";
 import type { NormRequest, ResponseSink, TurnSummary, UpstreamChunk } from "../wire/types.ts";
 
@@ -165,6 +167,10 @@ export async function runTurn(
 	let pendingDecision: Decision | null = null;
 	// Digests made this turn, by edit; a retry re-plans and must not pay twice.
 	const digestMemo = new Map<string, string>();
+	// Compiled once per turn (and memoised across turns on the rules' own text),
+	// never per attempt: a retry renders the same request again and would
+	// otherwise recompile every pattern.
+	const redactionRules = redactionRulesFor(config.redaction);
 
 	for (let attempt = 0; attempt < maxAttempts; attempt++) {
 		// Client disconnected before anything was dispatched: spend nothing.
@@ -261,6 +267,18 @@ export async function runTurn(
 			...(decision.compactionPlan.length > 0 ? { compactionPlan: decision.compactionPlan } : {}),
 		});
 
+		// Redaction, immediately after the body is rendered and before ANYTHING
+		// can dispatch it. This is the only choke point that covers every path:
+		// all three front ends normalise to this shape, and every upstream client
+		// renders its own protocol from it, so a provider added later is covered
+		// without being told. The count is recorded on the ledger row below; the
+		// matched text is never logged, at any level.
+		let redactions = 0;
+		if (redactionRules.length > 0) {
+			redactions = redactUpstreamBody(body, redactionRules, { scanTools: config.redaction.scanTools });
+			if (redactions > 0) log.debug("redacted outgoing request", { matches: redactions, rules: redactionRules.length });
+		}
+
 		// Calibrate the token estimate against the bytes that actually go out —
 		// after compaction shrank the prompt and the context block was appended
 		// — not the raw request the estimate was taken from.
@@ -333,6 +351,9 @@ export async function runTurn(
 				upstreamGenerationId: generationId,
 				error: fields.error,
 				promptTokensSaved: decision.promptTokensSaved,
+				// Evidence that the guard ran, as a count and nothing more. Absent
+				// while redaction is off, so an untouched row stays NULL.
+				...(redactionRules.length === 0 ? {} : { redactions }),
 				// The ledger prices OpenRouter slugs from its own cached payload; any
 				// other provider's model exists only in the live catalog.
 				...(priceModel === undefined ? {} : { priceModel }),

package/src/util/sqlite.ts

@@ -18,7 +18,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
 /** Bump when a migration is added; guarded below so reopening never regresses it. */
-const USER_VERSION = 18;
+const USER_VERSION = 19;
 
 const MIGRATIONS = `
 CREATE TABLE IF NOT EXISTS catalog_cache (
@@ -296,6 +296,16 @@ const MIGRATE_V18 = `
 ALTER TABLE ledger ADD COLUMN scope TEXT;
 `;
 
+// v19: ledger records how many strings redaction removed from the turn's
+// outgoing request (see `redaction` in the config). A COUNT and nothing else:
+// the whole point of redaction is that the matched text does not exist outside
+// the client, so the evidence that it ran must not reintroduce it. NULL on
+// every row written before this and on every turn with redaction off; 0 means
+// the rules ran and matched nothing.
+const MIGRATE_V19 = `
+ALTER TABLE ledger ADD COLUMN redactions INTEGER;
+`;
+
 // v9: benchmark_cache holds the external benchmark feeds (Artificial Analysis,
 // BenchLM) that backfill quality scores OpenRouter leaves unpublished. It is a
 // whole new table, created idempotently by the MIGRATIONS block above, so there
@@ -320,6 +330,17 @@ export function openDb(path: string): Database {
 	// ":memory:" has no parent directory to create.
 	if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });
 	const db = new Database(path);
+	// Incremental auto-vacuum so retention can hand freed pages back to the
+	// filesystem (`PRAGMA incremental_vacuum` after a prune). SQLite only honours
+	// a change of vacuum mode on an empty database or across a full VACUUM, so
+	// this takes effect for NEW ledgers; an existing one keeps its mode and
+	// simply reuses freed pages instead of releasing them. Must precede the
+	// journal-mode change, and is best-effort: never fail an open over it.
+	try {
+		db.exec("PRAGMA auto_vacuum = INCREMENTAL");
+	} catch {
+		/* an existing database in another mode; freed pages are reused instead */
+	}
 	// WAL + NORMAL: single-writer local service; favours read latency on the turn hot path.
 	db.exec("PRAGMA journal_mode = WAL");
 	db.exec("PRAGMA synchronous = NORMAL");
@@ -338,6 +359,7 @@ export function openDb(path: string): Database {
 		if (!ledgerCols.some((c) => c.name === "hold_arm")) db.exec(MIGRATE_V8);
 		if (!ledgerCols.some((c) => c.name === "prompt_tokens_saved")) db.exec(MIGRATE_V12);
 		if (!ledgerCols.some((c) => c.name === "scope")) db.exec(MIGRATE_V18);
+		if (!ledgerCols.some((c) => c.name === "redactions")) db.exec(MIGRATE_V19);
 		const convCols = db.query("PRAGMA table_info(conversations)").all() as { name: string }[];
 		if (!convCols.some((c) => c.name === "context_version")) db.exec(MIGRATE_V11);
 		if (!convCols.some((c) => c.name === "compaction_plan")) db.exec(MIGRATE_V13);

package/test/config-wizard.test.ts

@@ -142,7 +142,7 @@ describe("validateField", () => {
 
 describe("WIZARD_SECTIONS coverage", () => {
 	/** Leaves that are edited as whole records/arrays rather than fields. */
-	const RECORD_PATHS = new Set(["ollama.prices", "ollama.twins", "digest.toolAliases", "profiles", "upstreams"]);
+	const RECORD_PATHS = new Set(["ollama.prices", "ollama.twins", "digest.toolAliases", "profiles", "upstreams", "redaction.rules"]);
 
 	function leaves(obj: unknown, prefix = ""): string[] {
 		if (typeof obj !== "object" || obj === null || Array.isArray(obj)) return [prefix];

package/test/failover.test.ts

@@ -83,6 +83,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 		digest: { enabled: false, minBytes: 12_000, maxBytes: 400_000, tools: ["read"], fromTier: "moderate", tier: "simple", model: "", maxOutputTokens: 700, maxCostUsd: 0.02, timeoutMs: 25_000, toolAliases: {} },
 		profiles: [],
 		ledger: { path: ":memory:", blendWindowDays: 7, blendMinSamples: 20, fallbackBlend: { inputPerMtok: 1, outputPerMtok: 4 }, conversationTtlMs: 86_400_000 , retentionDays: 0,},
+		redaction: { enabled: false, rules: [], scanTools: false },
 		adaptiveTierFloors: true,
 		adaptivePriceCeilings: false,
 		logLevel: "silent",

package/test/migrations.test.ts

@@ -24,7 +24,7 @@ import { openDb } from "../src/util/sqlite.ts";
 
 const FIXTURES = join(import.meta.dir, "fixtures", "migrations");
 const files = readdirSync(FIXTURES).filter((f) => /^router-v\d+\.db$/.test(f)).sort((a, b) => Number(/\d+/.exec(a)![0]) - Number(/\d+/.exec(b)![0]));
-const CURRENT_VERSION = 18;
+const CURRENT_VERSION = 19;
 
 describe("schema migrations from every shipped version", () => {
 	test("fixtures exist for the versions that shipped", () => {
@@ -44,7 +44,7 @@ describe("schema migrations from every shipped version", () => {
 				expect((db.query("PRAGMA user_version").get() as { user_version: number }).user_version).toBe(CURRENT_VERSION);
 				// Every column the current code writes exists after migration.
 				const ledgerCols = new Set((db.query("PRAGMA table_info(ledger)").all() as { name: string }[]).map((c) => c.name));
-				for (const c of ["harness_id", "error_kind", "omp_session_id", "features", "explored_from", "hold_arm", "prompt_tokens_saved", "scope"]) expect(ledgerCols.has(c)).toBe(true);
+				for (const c of ["harness_id", "error_kind", "omp_session_id", "features", "explored_from", "hold_arm", "prompt_tokens_saved", "scope", "redactions"]) expect(ledgerCols.has(c)).toBe(true);
 				const convCols = new Set((db.query("PRAGMA table_info(conversations)").all() as { name: string }[]).map((c) => c.name));
 				for (const c of ["context_version", "compaction_plan", "compaction_plan_tokens", "upgrade_deferred_tier"]) expect(convCols.has(c)).toBe(true);
 				// The fixture's ledger row survived the ALTERs with its values.
@@ -67,7 +67,10 @@ describe("schema migrations from every shipped version", () => {
 				expect(exportRows(db, 0, null).map((r) => r.scope)).toEqual([""]);
 				expect(spendUsdSince(db, 0, null, "acme.api")).toBe(0);
 				expect(spendUsdSince(db, 0, null)).toBeGreaterThanOrEqual(0);
-				expect(ledger.prune?.(0)).toBe(0);
+				expect(ledger.prune?.(0)?.deleted).toBe(0);
+				// v19: the fixture's row predates `redactions`, so nothing claims a
+				// redaction happened on it and the report totals it as zero.
+				expect(buildUsageReport(db, { windowDays: 3650 }).totals.redactions).toBe(0);
 			} finally {
 				db.close();
 				try {

package/test/redaction.test.ts

@@ -0,0 +1,300 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { loadConfig } from "../src/config/load.ts";
+import { compileRedactionRules, redactionRulesFor, validateRedactionPattern, validateRedactionRule } from "../src/config/redaction.ts";
+import { createLedger } from "../src/cost/ledger.ts";
+import { buildUsageReport, renderUsageReport } from "../src/cost/report.ts";
+import { EMPTY_USAGE, type LedgerEntry } from "../src/cost/types.ts";
+import { redactUpstreamBody } from "../src/server/redact.ts";
+import { openDb } from "../src/util/sqlite.ts";
+import { parseMessagesRequest } from "../src/wire/anthropic/messages.ts";
+import { parseChatRequest } from "../src/wire/openai/request.ts";
+import { parseResponsesRequest } from "../src/wire/openai/responses.ts";
+
+/**
+ * Redaction: what the guard refuses to run, what the walker actually removes,
+ * and the count the ledger keeps as evidence without keeping the secret.
+ */
+
+const SECRET = "sk-live-4f9a2b7c1d8e3f6a0b5c";
+
+function rules(...specs: { name: string; pattern: string; replacement?: string }[]) {
+	return compileRedactionRules(specs);
+}
+
+describe("pattern guard", () => {
+	test("the shapes a real rule uses all compile", () => {
+		for (const pattern of [
+			"sk-live-[a-z0-9]{16,}",
+			"AKIA[0-9A-Z]{16}",
+			"(?:\\d{1,3}\\.){3}\\d{1,3}", // a quantified group, but BOUNDED
+			"[\\w.+-]+@corp\\.example\\.com",
+			"-----BEGIN [A-Z ]+PRIVATE KEY-----",
+			"(?:acct|customer)-\\d{6}", // an alternation, but not under an unbounded quantifier
+		]) {
+			expect(validateRedactionPattern(pattern)).toBeNull();
+		}
+	});
+
+	test("a pattern that can backtrack catastrophically is refused, with the reason", () => {
+		const nested = validateRedactionPattern("(a+)+$");
+		expect(nested).toContain("nested unbounded quantifiers");
+		expect(nested).toContain("exponential");
+		// The same shape spelled with a brace quantifier, and with `*`.
+		expect(validateRedactionPattern("(\\d{2,})*")).toContain("nested unbounded quantifiers");
+		expect(validateRedactionPattern("([a-z]*)+x")).toContain("nested unbounded quantifiers");
+		// The other classic: branches that can match the same input many ways.
+		expect(validateRedactionPattern("(?:a|a)*b")).toContain("alternation inside an unbounded quantifier");
+		// And the shape no linear-time strategy exists for at all.
+		expect(validateRedactionPattern("(secret)\\1")).toContain("backreferences");
+		expect(validateRedactionPattern("(?<k>x)\\k<k>")).toContain("backreferences");
+	});
+
+	test("a pattern that cannot compile, is empty, matches nothing, or is enormous is refused", () => {
+		expect(validateRedactionPattern("(unclosed")).toContain("does not compile");
+		expect(validateRedactionPattern("")).toBe("pattern must not be empty");
+		expect(validateRedactionPattern("x*")).toContain("matches the empty string");
+		expect(validateRedactionPattern(`a${"b".repeat(600)}`)).toContain("the limit is 512");
+	});
+
+	test("a legacy pattern the unicode flag alone rejects still loads", () => {
+		// `\d{1,2}` is fine either way; an unescaped `{` is a syntax error under
+		// `u` and a literal brace without it. An operator's working rule must not
+		// break on an upgrade, so `u` is preferred, not required.
+		expect(validateRedactionPattern("token{[0-9]+}")).toBeNull();
+		expect(rules({ name: "brace", pattern: "token{[0-9]+}" })[0]!.regex.flags).toBe("g");
+		expect(rules({ name: "unicode", pattern: "sk-[a-z0-9]+" })[0]!.regex.flags).toBe("gu");
+	});
+
+	test("a rule name is checked too, since it is echoed into the prompt", () => {
+		expect(validateRedactionRule({ name: "api key", pattern: "sk-\\w+" })).toBeNull();
+		expect(validateRedactionRule({ name: "", pattern: "sk-\\w+" })).toContain("name must be");
+		expect(validateRedactionRule({ name: "[redacted]\ninjected", pattern: "sk-\\w+" })).toContain("name must be");
+	});
+
+	test("compiling a rule set names the offending rule and refuses the whole set", () => {
+		expect(() => rules({ name: "ok", pattern: "sk-\\w+" }, { name: "greedy", pattern: "(x+)+" })).toThrow(
+			/redaction rule "greedy": nested unbounded quantifiers/,
+		);
+	});
+
+	test("the config file rejects a backtracking rule at load, naming its path", () => {
+		const dir = mkdtempSync(join(tmpdir(), "amr-redact-"));
+		try {
+			const path = join(dir, "config.yml");
+			writeFileSync(path, `redaction:\n  enabled: true\n  rules:\n    - name: bad\n      pattern: "(a+)+b"\n`, "utf8");
+			expect(() => loadConfig({ path })).toThrow(/redaction\.rules\.0.*nested unbounded quantifiers/s);
+			writeFileSync(path, `redaction:\n  enabled: true\n  rules:\n    - name: key\n      pattern: "sk-[a-z0-9-]{8,}"\n`, "utf8");
+			const cfg = loadConfig({ path });
+			expect(cfg.redaction.enabled).toBe(true);
+			expect(cfg.redaction.rules).toEqual([{ name: "key", pattern: "sk-[a-z0-9-]{8,}" }]);
+			// Unset by the file, so the default stands: tools are not scanned.
+			expect(cfg.redaction.scanTools).toBe(false);
+		} finally {
+			rmSync(dir, { recursive: true, force: true });
+		}
+	});
+
+	test("compiled rules are memoised on the rule text, and off means none", () => {
+		const cfg = { enabled: true, rules: [{ name: "key", pattern: "sk-\\w+" }], scanTools: false };
+		expect(redactionRulesFor(cfg)).toBe(redactionRulesFor({ ...cfg, rules: [{ name: "key", pattern: "sk-\\w+" }] }));
+		expect(redactionRulesFor({ ...cfg, enabled: false })).toEqual([]);
+		expect(redactionRulesFor({ ...cfg, rules: [] })).toEqual([]);
+		// An edited pattern is a different rule set, not a cache hit.
+		expect(redactionRulesFor({ ...cfg, rules: [{ name: "key", pattern: "sk-\\d+" }] })[0]!.regex.source).toBe("sk-\\d+");
+	});
+});
+
+describe("each rule shape", () => {
+	const body = () => ({ messages: [{ role: "user", content: `token ${SECRET} and 10.1.2.3` }] });
+
+	test("a rule with no replacement redacts to [redacted:<name>]", () => {
+		const b = body();
+		expect(redactUpstreamBody(b, rules({ name: "api key", pattern: "sk-live-[a-z0-9]+" }), { scanTools: false })).toBe(1);
+		expect(b.messages[0]!.content).toBe("token [redacted:api key] and 10.1.2.3");
+	});
+
+	test("a rule with a replacement uses it", () => {
+		const b = body();
+		redactUpstreamBody(b, rules({ name: "ip", pattern: "(?:\\d{1,3}\\.){3}\\d{1,3}", replacement: "0.0.0.0" }), { scanTools: false });
+		expect(b.messages[0]!.content).toBe(`token ${SECRET} and 0.0.0.0`);
+	});
+
+	test("several rules all apply, and every match counts", () => {
+		const b = { messages: [{ role: "user", content: `${SECRET} ${SECRET} 10.1.2.3` }] };
+		const n = redactUpstreamBody(
+			b,
+			rules({ name: "key", pattern: "sk-live-[a-z0-9]+" }, { name: "ip", pattern: "(?:\\d{1,3}\\.){3}\\d{1,3}" }),
+			{ scanTools: false },
+		);
+		expect(n).toBe(3);
+		expect(b.messages[0]!.content).toBe("[redacted:key] [redacted:key] [redacted:ip]");
+	});
+
+	test("nothing to match leaves the body untouched and counts zero", () => {
+		const b = { messages: [{ role: "user", content: "nothing secret here" }] };
+		expect(redactUpstreamBody(b, rules({ name: "key", pattern: "sk-live-[a-z0-9]+" }), { scanTools: false })).toBe(0);
+		expect(b.messages[0]!.content).toBe("nothing secret here");
+	});
+});
+
+describe("what the walker reaches", () => {
+	const KEY = rules({ name: "key", pattern: "sk-live-[a-z0-9]+" });
+
+	function fullBody(): Record<string, unknown> {
+		return {
+			model: "sk-live-notreally/model", // a slug is not conversation content
+			messages: [
+				{ role: "system", content: [{ type: "text", text: `system ${SECRET}`, cache_control: { type: "ephemeral" } }] },
+				{ role: "user", content: `user ${SECRET}` },
+				{ role: "assistant", content: null, tool_calls: [{ id: "c1", type: "function", function: { name: "read", arguments: `{"path":"${SECRET}"}` } }] },
+				{ role: "tool", tool_call_id: "c1", content: `result ${SECRET}` },
+			],
+		};
+	}
+
+	test("message text is redacted; tool arguments and tool results wait for scanTools", () => {
+		const b = fullBody();
+		expect(redactUpstreamBody(b, KEY, { scanTools: false })).toBe(2);
+		const messages = b.messages as Record<string, unknown>[];
+		expect((messages[0]!.content as { text: string }[])[0]!.text).toBe("system [redacted:key]");
+		// The cache breakpoint the router planted survives the rewrite.
+		expect((messages[0]!.content as { cache_control: unknown }[])[0]!.cache_control).toEqual({ type: "ephemeral" });
+		expect(messages[1]!.content).toBe("user [redacted:key]");
+		expect(JSON.stringify(messages[2])).toContain(SECRET);
+		expect(messages[3]!.content).toBe(`result ${SECRET}`);
+		// A model slug is the router's own vocabulary, never scanned.
+		expect(b.model).toBe("sk-live-notreally/model");
+	});
+
+	test("with scanTools, arguments and results go too and nothing else changes", () => {
+		const b = fullBody();
+		expect(redactUpstreamBody(b, KEY, { scanTools: true })).toBe(4);
+		const messages = b.messages as Record<string, unknown>[];
+		expect(JSON.stringify(b)).not.toContain(SECRET);
+		const call = (messages[2]!.tool_calls as { id: string; function: { name: string; arguments: string } }[])[0]!;
+		// The call/result pairing the model needs is untouched.
+		expect(call.id).toBe("c1");
+		expect(call.function.name).toBe("read");
+		expect(call.function.arguments).toBe('{"path":"[redacted:key]"}');
+		expect(messages[3]!.tool_call_id).toBe("c1");
+	});
+
+	test("no rules is a no-op, and a body without messages is ignored", () => {
+		const b = fullBody();
+		expect(redactUpstreamBody(b, [], { scanTools: true })).toBe(0);
+		expect(JSON.stringify(b)).toContain(SECRET);
+		expect(redactUpstreamBody({ model: "x" }, KEY, { scanTools: true })).toBe(0);
+	});
+});
+
+describe("every wire renders into the shape redaction reads", () => {
+	const KEY = rules({ name: "key", pattern: "sk-live-[a-z0-9]+" });
+	const mutations = {
+		slug: "vendor/model",
+		fallbacks: [],
+		sessionId: "s",
+		cacheBreakpointMessageIndices: [],
+		reasoning: undefined,
+		maxTokens: undefined,
+		stripAssistantReasoning: false,
+	};
+
+	test("chat completions, Responses and Anthropic Messages all lose the secret", () => {
+		const chat = parseChatRequest(
+			{ model: "auto", messages: [{ role: "system", content: `rules ${SECRET}` }, { role: "user", content: `use ${SECRET}` }] },
+			new Headers(),
+		);
+		const responses = parseResponsesRequest(
+			{ model: "auto", instructions: `rules ${SECRET}`, input: [{ type: "message", role: "user", content: [{ type: "input_text", text: `use ${SECRET}` }] }] },
+			new Headers(),
+		);
+		const messages = parseMessagesRequest(
+			{ model: "claude-opus-5", max_tokens: 100, system: `rules ${SECRET}`, messages: [{ role: "user", content: [{ type: "text", text: `use ${SECRET}` }] }] },
+			new Headers(),
+		);
+		for (const req of [chat, responses, messages]) {
+			const body = req.renderUpstreamBody(mutations);
+			expect(JSON.stringify(body)).toContain(SECRET);
+			expect(redactUpstreamBody(body, KEY, { scanTools: false })).toBe(2);
+			expect(JSON.stringify(body)).not.toContain(SECRET);
+		}
+	});
+});
+
+describe("the ledger keeps the count and never the match", () => {
+	function entry(over: Partial<LedgerEntry>): LedgerEntry {
+		return {
+			id: crypto.randomUUID(),
+			createdAtMs: Date.now(),
+			conversationKey: "conv",
+			sessionId: "sess",
+			turn: 1,
+			requestedModel: "auto",
+			harnessId: "",
+			ompSessionId: "",
+			slug: "a/b",
+			servedSlug: "a/b",
+			tier: "simple",
+			classificationSource: "heuristic",
+			reasons: [],
+			features: null,
+			score: null,
+			confidence: null,
+			task: null,
+			classifierReasons: null,
+			exploredFrom: null,
+			holdArm: null,
+			predictedUsd: 0.001,
+			reportedUsd: 0.001,
+			usage: { ...EMPTY_USAGE, promptTokens: 100, completionTokens: 10 },
+			attempt: 0,
+			escalationSignal: null,
+			latencyMs: 10,
+			ttftMs: 5,
+			finishReason: "stop",
+			wasted: false,
+			upstreamGenerationId: null,
+			error: null,
+			promptTokensSaved: 0,
+			...over,
+		};
+	}
+
+	test("the column round-trips, absent stays absent, and the report totals it", () => {
+		const db = openDb(":memory:");
+		try {
+			const ledger = createLedger(db, { ...DEFAULT_CONFIG, ledger: { ...DEFAULT_CONFIG.ledger, path: ":memory:" } });
+			const now = Date.now();
+			ledger.record(entry({ createdAtMs: now - 3, redactions: 3 }));
+			ledger.record(entry({ createdAtMs: now - 2, redactions: 0 }));
+			ledger.record(entry({ createdAtMs: now - 1 })); // redaction off: NULL, which is not 0
+			const recorded = ledger.recentEntries(10);
+			expect(recorded.map((e) => e.redactions)).toEqual([undefined, 0, 3]);
+			const totals = buildUsageReport(db, { windowDays: 7 }).totals;
+			expect(totals.redactions).toBe(3);
+			expect(totals.redactedTurns).toBe(1);
+			expect(renderUsageReport(buildUsageReport(db, { windowDays: 7 }))).toContain("redaction: 1 turns had something removed (3 strings)");
+		} finally {
+			db.close();
+		}
+	});
+
+	test("a window with no redaction says nothing about it", () => {
+		const db = openDb(":memory:");
+		try {
+			const ledger = createLedger(db, { ...DEFAULT_CONFIG, ledger: { ...DEFAULT_CONFIG.ledger, path: ":memory:" } });
+			ledger.record(entry({}));
+			const report = buildUsageReport(db, { windowDays: 7 });
+			expect(report.totals.redactions).toBe(0);
+			expect(report.totals.redactedTurns).toBe(0);
+			expect(renderUsageReport(report)).not.toContain("redaction:");
+		} finally {
+			db.close();
+		}
+	});
+});

package/test/report-hub.test.ts

@@ -70,6 +70,8 @@ function report(over: Partial<UsageReport> = {}): UsageReport {
 			cacheHitRate: 0.8,
 			promptTokens: 20000,
 			completionTokens: 2000,
+			redactions: 0,
+			redactedTurns: 0,
 			escalations: 2,
 			failovers: 0,
 			errors: 0,