c64bridge 1.0.6 → 1.0.7

package/dist/chargen.js

@@ -184,10 +184,6 @@ export function getChargenGlyphs() {
     loadGlyphs();
     return glyphCache.glyphs;
 }
-export function findGlyphByPetscii(code) {
-    loadGlyphs();
-    return glyphCache.byPetscii.get(code);
-}
 export function findGlyphByBasicChar(char) {
     if (!char) {
         return undefined;

package/dist/config.js

@@ -2,6 +2,7 @@ import { readFileSync } from "fs";
 import { dirname, join } from "path";
 import os from "node:os";
 import { fileURLToPath } from "url";
+import { registerSecret } from "./redact.js";
 const DEFAULT_HOST = "c64u";
 const DEFAULT_PORT = 80;
 export function loadConfig() {
@@ -25,7 +26,7 @@ export function loadConfig() {
             if (error.code !== "ENOENT") {
                 // Deliberately omit file contents/credentials. Configuration mistakes
                 // should not prevent the MCP server from exposing a recoverable path.
-                console.error(`[c64bridge] ignoring configuration '${candidatePath}': ${error instanceof Error ? error.message : String(error)}`);
+                console.error(`[c64bridge] ignoring configuration '${candidatePath}': ${error instanceof Error ? error.name : "unreadable"}`);
             }
         }
     }
@@ -131,12 +132,14 @@ export function resolveUltimateEndpoint(profile, section, legacy) {
             url.port = String(explicitPort);
         baseUrl = stripTrailingSlash(url.toString());
     }
+    const networkPassword = firstDefined(nonEmptyString(envPassword), nonEmptyString(section?.networkPassword), nonEmptyString(legacy?.networkPassword));
+    registerSecret(networkPassword);
     return {
         host,
         port,
         baseUrl,
         c64_host: port === schemeDefaultPort ? hostLabel : `${hostLabel}:${port}`,
-        networkPassword: firstDefined(nonEmptyString(envPassword), nonEmptyString(section?.networkPassword), nonEmptyString(legacy?.networkPassword)),
+        networkPassword,
     };
 }
 function configuredString(value) {

package/dist/diagnostics.js

@@ -2,6 +2,7 @@ import { Buffer } from "node:buffer";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { redactValue } from "./redact.js";
 let state = null;
 let handlersInstalled = false;
 let spanCounter = 0;
@@ -21,9 +22,6 @@ export function installProcessDiagnostics(component) {
 export function getDiagnosticsSessionInfo() {
     return state?.info ?? null;
 }
-export function getDiagnosticsDirectory() {
-    return resolveDiagnosticsDirectory();
-}
 export function writeDiagnosticEvent(event, details) {
     if (!isDiagnosticsEnabled()) {
         return;
@@ -300,6 +298,9 @@ function isDiagnosticsEnabled() {
     return true;
 }
 function sanitize(value, depth = 0) {
+    return sanitizeUnredacted(redactValue(value), depth);
+}
+function sanitizeUnredacted(value, depth = 0) {
     if (value instanceof Error) {
         const extra = value;
         return {

package/dist/logger.js

@@ -1,4 +1,5 @@
 import { Buffer } from "node:buffer";
+import { redactText, redactValue } from "./redact.js";
 const LEVEL_ORDER = {
     debug: 0,
     info: 1,
@@ -24,9 +25,9 @@ function createPrefixedLogger(prefix) {
             return;
         }
         const consoleMethod = selectConsole(level);
-        const label = `[${prefix}] ${message}`;
+        const label = `[${prefix}] ${redactText(message)}`;
         if (details && Object.keys(details).length > 0) {
-            consoleMethod(label, details);
+            consoleMethod(label, redactValue(details));
         }
         else {
             consoleMethod(label);

package/dist/loggingHttpClient.js

@@ -1,4 +1,5 @@
 import { HttpClient } from "../generated/c64/index.js";
+import { registerSecret, scrubRequestError } from "./redact.js";
 import { formatErrorMessage, formatPayloadForDebug, loggerFor, payloadByteLength } from "./logger.js";
 /** Headers are useful in diagnostics, but credentials must never leave the
  * transport layer.  Axios normalises some keys and preserves others, so do a
@@ -14,6 +15,7 @@ function redactHeaders(headers) {
 }
 export function createLoggingHttpClient(config, logger = loggerFor("c64u")) {
     const http = new HttpClient(config);
+    registerSecret(readPasswordHeader(config?.headers));
     http.instance.interceptors.request.use((request) => {
         const method = (request.method ?? "get").toUpperCase();
         const path = resolvePath(request);
@@ -33,10 +35,19 @@ export function createLoggingHttpClient(config, logger = loggerFor("c64u")) {
         return response;
     }, (error) => {
         handleError(error, logger);
-        return Promise.reject(error);
+        return Promise.reject(scrubRequestError(error));
     });
     return http;
 }
+function readPasswordHeader(headers) {
+    if (!headers || typeof headers !== "object")
+        return undefined;
+    for (const [key, value] of Object.entries(headers)) {
+        if (/^x-password$/i.test(key) && typeof value === "string")
+            return value;
+    }
+    return undefined;
+}
 function handleResponse(response, logger) {
     const meta = extractMeta(response.config);
     const latency = meta ? Date.now() - meta.startedAt : 0;

package/dist/mcp-server.js

@@ -18,6 +18,7 @@ import { unknownErrorResult } from "./tools/errors.js";
 import { createPromptRegistry } from "./prompts/registry.js";
 import { describePlatformCapabilities, getPlatformStatus, setPlatform } from "./platform.js";
 import axios from "axios";
+import { redactValue, registerSecret } from "./redact.js";
 import { loggerFor, payloadByteLength, formatPayloadForDebug, formatErrorMessage } from "./logger.js";
 import { getDiagnosticsSessionInfo, installProcessDiagnostics, withDiagnosticSpan, writeDiagnosticEvent } from "./diagnostics.js";
 const __filename = fileURLToPath(import.meta.url);
@@ -558,6 +559,7 @@ async function logConnectivity(client, baseUrl, networkPassword) {
     let response = null;
     try {
         // Send the network password like every other request, or a protected device answers 403.
+        registerSecret(networkPassword);
         const probeResponse = await axios.get(infoUrl, {
             timeout: 2000,
             ...(networkPassword ? { headers: { "X-Password": networkPassword } } : {}),
@@ -606,13 +608,13 @@ async function logConnectivity(client, baseUrl, networkPassword) {
         console.error(`Zero-page probe skipped or failed (may be unsupported on current backend): ${message}`);
     }
 }
-function toCallToolResult(result) {
-    const base = { content: result.content };
+export function toCallToolResult(result) {
+    const base = { content: redactValue(result.content) };
     if (result.structuredContent !== undefined) {
-        base.structuredContent = result.structuredContent;
+        base.structuredContent = redactValue(result.structuredContent);
     }
     if (result.metadata !== undefined) {
-        base.metadata = result.metadata;
+        base.metadata = redactValue(result.metadata);
     }
     if (result.isError !== undefined) {
         base.isError = result.isError;
@@ -643,7 +645,7 @@ if (process.env.C64BRIDGE_SKIP_AUTO_START !== "1") {
             diagnosticsFile: getDiagnosticsSessionInfo()?.filePath,
             error,
         });
-        console.error("Fatal error in MCP server:", error);
+        console.error("Fatal error in MCP server:", redactValue(error));
         process.exit(1);
     });
 }

package/dist/petscii.js

@@ -137,11 +137,6 @@ const NAMED_CHARS = Object.freeze({
     "leftarrow": 95,
     "pi": 222,
 });
-export function listNamedPetscii() {
-    return Object.entries(NAMED_CHARS)
-        .sort((a, b) => a[0].localeCompare(b[0]))
-        .map(([name, code]) => ({ name, code, hex: `$${code.toString(16).toUpperCase().padStart(2, "0")}` }));
-}
 export function lookupNamedPetscii(name) {
     const key = name.trim().toLowerCase().replace(/\s+/g, "_");
     // Own keys only, so names like "constructor" don't resolve to Object.prototype members.

package/dist/redact.js

@@ -0,0 +1,166 @@
+/**
+ * Shared redaction for the Ultimate network password and other credentials.
+ *
+ * The password is meant to leave the process only as the `X-Password` request
+ * header. Every sink that can carry arbitrary values (console logging,
+ * diagnostics files, MCP tool results) passes its content through this module.
+ *
+ * Two mechanisms are combined:
+ * - values registered with `registerSecret` are replaced wherever they appear
+ *   inside a string, including error messages and stack traces;
+ * - properties whose name is a credential header are replaced regardless of value.
+ */
+const REDACTED = "***";
+const SENSITIVE_KEY = /^(x-password|authorization|proxy-authorization|cookie|set-cookie|x-api-key)$/i;
+const MIN_SECRET_LENGTH = 1;
+const secrets = new Set();
+export function registerSecret(value) {
+    if (typeof value === "string" && value.length >= MIN_SECRET_LENGTH) {
+        secrets.add(value);
+    }
+}
+/** Test hook: forget all registered secrets. */
+export function clearRegisteredSecrets() {
+    secrets.clear();
+}
+export function isSensitiveKey(key) {
+    return SENSITIVE_KEY.test(key);
+}
+export function redactText(text) {
+    let result = text;
+    // Longest first, so a secret that contains another one is replaced as a whole.
+    for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
+        if (result.includes(secret)) {
+            result = result.split(secret).join(REDACTED);
+        }
+    }
+    return result;
+}
+function isPlainObject(value) {
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Returns a copy of `value` that is safe to log, persist or return to a client.
+ * Errors (including Axios errors) are reduced to name, message, stack, code and
+ * HTTP status, so their request configuration is never copied.
+ */
+export function redactValue(value, seen = new WeakSet()) {
+    if (typeof value === "string") {
+        return redactText(value);
+    }
+    if (value === null || typeof value !== "object") {
+        return value;
+    }
+    if (seen.has(value)) {
+        return "[Circular]";
+    }
+    if (value instanceof Error) {
+        seen.add(value);
+        const extra = value;
+        return {
+            name: value.name,
+            message: redactText(value.message),
+            ...(value.stack ? { stack: redactText(value.stack) } : {}),
+            ...(extra.code !== undefined ? { code: redactValue(extra.code, seen) } : {}),
+            ...(extra.response?.status !== undefined ? { status: extra.response.status } : {}),
+            ...(extra.cause !== undefined ? { cause: redactValue(extra.cause, seen) } : {}),
+        };
+    }
+    if (Array.isArray(value)) {
+        seen.add(value);
+        return value.map((entry) => redactValue(entry, seen));
+    }
+    if (!isPlainObject(value)) {
+        return value;
+    }
+    seen.add(value);
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+        redactText(key),
+        isSensitiveKey(key) ? REDACTED : redactValue(entry, seen),
+    ]));
+}
+function scrubHeaders(headers) {
+    if (!headers || typeof headers !== "object")
+        return;
+    for (const key of Object.keys(headers)) {
+        if (isSensitiveKey(key)) {
+            headers[key] = REDACTED;
+        }
+    }
+}
+function scrubRequestHolder(holder) {
+    if (!holder || typeof holder !== "object")
+        return;
+    const target = holder;
+    scrubHeaders(target.config?.headers);
+    // The raw ClientRequest keeps the serialized header block, including X-Password.
+    if (target.request !== undefined) {
+        target.request = undefined;
+    }
+}
+/**
+ * Removes credentials from a rejected Axios error in place and returns it, so
+ * callers that inspect, log or serialize the error cannot expose them.
+ * Status, code, message and response data stay available.
+ */
+export function scrubRequestError(error) {
+    if (!error || typeof error !== "object")
+        return error;
+    scrubRequestHolder(error);
+    const response = error.response;
+    scrubRequestHolder(response);
+    // A device that echoes the rejected password in its error body.
+    if (response && typeof response.data === "string") {
+        response.data = redactText(response.data);
+    }
+    return error;
+}
+/**
+ * Firmware configuration items that hold credentials. The Ultimate config API
+ * lists items by display name (for example "Network Password" in the
+ * "Network settings" category), so matching is by item name: passwords,
+ * passphrases and pre-shared keys, plus a bare "key" item in a Wi-Fi category.
+ */
+const SENSITIVE_CONFIG_ITEM = /pass(word|wd|phrase|code)?\b|\bpsk\b|secret/i;
+const WIFI_CATEGORY = /wi-?fi|wlan|wireless/i;
+const BARE_KEY_ITEM = /^(wifi |wlan )?(key|wpa key|network key)$/i;
+export function isSensitiveConfigItem(category, item) {
+    if (!item)
+        return false;
+    if (SENSITIVE_CONFIG_ITEM.test(item))
+        return true;
+    return BARE_KEY_ITEM.test(item.trim()) && (item.toLowerCase().includes("wifi") || WIFI_CATEGORY.test(category ?? ""));
+}
+/**
+ * Returns a copy of a firmware configuration response in which the value of
+ * every credential item is replaced with `***`. Item names stay, so a client can
+ * see that the item exists. `category` and `item` describe the request: when an
+ * item was requested and the response is its bare value, the value is replaced.
+ */
+export function redactConfigValue(value, category, item) {
+    if (item && isSensitiveConfigItem(category, item)) {
+        return value !== null && typeof value === "object" ? redactConfigTree(value, category) : REDACTED;
+    }
+    return redactConfigTree(value, category);
+}
+function redactConfigTree(value, category) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactConfigTree(entry, category));
+    }
+    if (value === null || typeof value !== "object") {
+        return value;
+    }
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (isSensitiveConfigItem(category, key) && entry !== null && entry !== undefined) {
+            out[key] = REDACTED;
+        }
+        else {
+            // Keys at the top level of a response are category names.
+            out[key] = redactConfigTree(entry, entry !== null && typeof entry === "object" && !Array.isArray(entry) ? key : category);
+        }
+    }
+    return out;
+}
+export const REDACTED_PLACEHOLDER = REDACTED;

package/dist/tools/developer.js

@@ -1,6 +1,7 @@
 import { defineToolModule } from "./types.js";
-import { objectSchema, optionalSchema, stringSchema, } from "./schema.js";
+import { booleanSchema, objectSchema, optionalSchema, stringSchema, } from "./schema.js";
 import { jsonResult, textResult } from "./responses.js";
+import { redactConfigValue } from "../redact.js";
 import { ToolError, ToolExecutionError, ToolValidationError, toolErrorResult, unknownErrorResult, } from "./errors.js";
 function toRecord(details) {
     if (details === undefined || details === null) {
@@ -61,6 +62,10 @@ const configGetArgsSchema = objectSchema({
     properties: {
         category: categorySchema,
         item: itemSchema,
+        includeSecretValues: optionalSchema(booleanSchema({
+            description: "Return credential values (network password, FTP/Telnet passwords, Wi-Fi keys) in plain text. Default false: those values are replaced with ***.",
+            default: false,
+        }), false),
     },
     required: ["category"],
     additionalProperties: false,
@@ -190,7 +195,10 @@ export const developerModule = defineToolModule({
                         category: parsed.category,
                         item: parsed.item ?? null,
                     });
-                    const details = await ctx.client.configGet(parsed.category, parsed.item);
+                    const raw = await ctx.client.configGet(parsed.category, parsed.item);
+                    const details = parsed.includeSecretValues === true
+                        ? raw
+                        : redactConfigValue(raw, parsed.category, parsed.item);
                     return withStructuredJson({ value: details }, {
                         success: true,
                         category: parsed.category,

package/dist/tools/input.js

@@ -1,7 +1,7 @@
 import { createOperationDispatcher, defineToolModule, discriminatedUnionSchema, } from "./types.js";
 import { arraySchema, literalSchema, numberSchema, objectSchema, optionalSchema, stringSchema, } from "./schema.js";
 import { jsonResult, textResult } from "./responses.js";
-import { ToolValidationError, toolErrorResult, unknownErrorResult, } from "./errors.js";
+import { ToolExecutionError, ToolValidationError, toolErrorResult, unknownErrorResult, } from "./errors.js";
 function isMissingNativeInputEndpoint(error) {
     return typeof error === "object"
         && error !== null
@@ -9,7 +9,7 @@ function isMissingNativeInputEndpoint(error) {
         && error.response?.status === 404;
 }
 function nativeInputUnavailableResult(operation) {
-    return textResult(`Native physical input is unavailable on this firmware, so ${operation} was not sent. Use c64://platform/status before choosing native input; use key or write_text for ordinary C64 input.`, { success: false, code: "native_input_unavailable", fallback: "key_or_write_text" });
+    return toolErrorResult(new ToolExecutionError(`Native physical input is unavailable on this firmware, so ${operation} was not sent. Use c64://platform/status before choosing native input; use key or write_text for ordinary C64 input.`, { code: "native_input_unavailable", details: { fallback: "key_or_write_text" } }));
 }
 // ---------------------------------------------------------------------------
 // PETSCII token expansion table

package/dist/tools/machineControl.js

@@ -342,7 +342,7 @@ export const machineControlModule = defineToolModule({
                     if (error instanceof ToolError)
                         return toolErrorResult(error);
                     if (isMissingMenuScreenEndpoint(error)) {
-                        return textResult("No menu matrix is available. Open the Ultimate menu and retry; if it remains unavailable, this firmware does not provide machine:menu_screen. Use REST configuration instead of menu navigation where possible.", { success: false, code: "native_menu_screen_unavailable", fallback: "rest_configuration_or_manual_menu" });
+                        return toolErrorResult(new ToolExecutionError("No menu matrix is available. Open the Ultimate menu and retry; if it remains unavailable, this firmware does not provide machine:menu_screen. Use REST configuration instead of menu navigation where possible.", { code: "native_menu_screen_unavailable", details: { fallback: "rest_configuration_or_manual_menu" }, cause: error }));
                     }
                     return unknownErrorResult(error);
                 }

package/dist/tools/meta/config.js

@@ -4,13 +4,14 @@ import { ToolError, ToolUnsupportedPlatformError, ToolExecutionError, ToolValida
 import { getPlatformStatus } from "../../platform.js";
 import { promises as fs } from "node:fs";
 import { dirname, resolve as resolvePath } from "node:path";
-import { captureConfigSnapshot, validateSnapshotCategories } from "./configInventory.js";
+import { captureConfigSnapshot, stripRedactedSecrets, validateSnapshotCategories } from "./configInventory.js";
 import { normalizeErrorDetails } from "./util.js";
 const configSnapshotAndRestoreArgsSchema = objectSchema({
     description: "Snapshot or restore full device configuration. Snapshot writes versioned JSON.",
     properties: {
         action: stringSchema({ description: "One of: snapshot|restore|diff", enum: ["snapshot", "restore", "diff"] }),
         path: stringSchema({ description: "Snapshot file path", minLength: 1 }),
+        includeSecretValues: optionalSchema(booleanSchema({ description: "Snapshot and diff only: store credential values (network password, FTP/Telnet passwords, Wi-Fi keys) in plain text in the snapshot file. Default false: they are written as ***, and restore skips them.", default: false }), false),
         applyToFlash: optionalSchema(booleanSchema({ description: "Save configuration to flash after restore (C64U/U64 and U2 only)", default: false }), false),
     },
     required: ["action", "path"],
@@ -37,7 +38,7 @@ export const tools = [
                     const [version, info, snapshotData] = await Promise.all([
                         ctx.client.version(),
                         ctx.client.info(),
-                        captureConfigSnapshot(ctx.client),
+                        captureConfigSnapshot(ctx.client, { includeSecretValues: parsed.includeSecretValues === true }),
                     ]);
                     const snapshot = {
                         createdAt: new Date().toISOString(),
@@ -61,7 +62,7 @@ export const tools = [
                     }
                     let payload;
                     try {
-                        payload = validateSnapshotCategories(snapshot.categories);
+                        payload = stripRedactedSecrets(validateSnapshotCategories(snapshot.categories));
                     }
                     catch {
                         throw new ToolValidationError("Invalid snapshot file", { path: "$.path" });
@@ -81,7 +82,7 @@ export const tools = [
                 const text = await fs.readFile(path, "utf8");
                 const snapshot = JSON.parse(text);
                 const snapCats = validateSnapshotCategories(snapshot.categories ?? {});
-                const current = (await captureConfigSnapshot(ctx.client)).categories;
+                const current = (await captureConfigSnapshot(ctx.client, { includeSecretValues: parsed.includeSecretValues === true })).categories;
                 const diff = {};
                 for (const [cat, snapVal] of Object.entries(snapCats)) {
                     const curVal = current[cat];

package/dist/tools/meta/configInventory.js

@@ -1,3 +1,4 @@
+import { isSensitiveConfigItem, redactConfigValue, REDACTED_PLACEHOLDER } from "../../redact.js";
 export function normalizeConfigInventory(details) {
     const categories = details?.categories;
     if (!Array.isArray(categories)) {
@@ -55,12 +56,15 @@ export function normalizeConfigInventory(details) {
     }
     return inventory;
 }
-export async function captureConfigSnapshot(client) {
+export async function captureConfigSnapshot(client, options = {}) {
     const inventory = normalizeConfigInventory(await client.configsList());
     const categories = {};
     for (const entry of inventory) {
         try {
-            const value = normalizeSnapshotValue(await client.configGet(entry.category, entry.item), entry);
+            const normalized = normalizeSnapshotValue(await client.configGet(entry.category, entry.item), entry);
+            const value = options.includeSecretValues
+                ? normalized
+                : redactConfigValue(normalized, entry.category, entry.item);
             setSnapshotValue(categories, entry, value);
         }
         catch (error) {
@@ -71,6 +75,25 @@ export async function captureConfigSnapshot(client) {
     }
     return { inventory, categories };
 }
+/**
+ * Drops redacted credential placeholders from a snapshot payload before it is
+ * written back, so restoring a default snapshot never sets a password to `***`.
+ */
+export function stripRedactedSecrets(categories) {
+    const strip = (category, value) => {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return value;
+        const kept = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (entry === REDACTED_PLACEHOLDER && isSensitiveConfigItem(category, key))
+                continue;
+            // Per-item snapshot entries keep the firmware wrapper: { category: { item: value } }.
+            kept[key] = strip(entry !== null && typeof entry === "object" && !Array.isArray(entry) ? key : category, entry);
+        }
+        return kept;
+    };
+    return Object.fromEntries(Object.entries(categories).map(([category, items]) => [category, strip(category, items)]));
+}
 export function validateSnapshotCategories(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
         throw new Error("Snapshot categories payload must be an object");

package/dist/tools/meta/diagnostics.js

@@ -74,7 +74,8 @@ export const tools = [
                     version,
                     info,
                 };
-                return jsonResult(report, { success: report.isHealthy });
+                const result = jsonResult(report, { success: report.isHealthy });
+                return report.isHealthy ? result : { ...result, isError: true };
             }
             catch (error) {
                 if (error instanceof ToolError)

package/dist/tools/registry/batch.js

@@ -2,7 +2,7 @@ import { defineToolModule, } from "../types.js";
 import { getPlatformStatus } from "../../platform.js";
 import { arraySchema, booleanSchema, objectSchema, optionalSchema, stringSchema, } from "../schema.js";
 import { jsonResult } from "../responses.js";
-import { ToolValidationError, unknownErrorResult } from "../errors.js";
+import { unknownErrorResult } from "../errors.js";
 const commandSchema = objectSchema({
     description: "A single batch command.",
     properties: {
@@ -155,12 +155,6 @@ export const batchModuleGroup = defineToolModule({
                     return jsonResult(summary, { success: failed === 0, succeeded, failed, total: parsed.commands.length });
                 }
                 catch (error) {
-                    if (error instanceof ToolValidationError) {
-                        return {
-                            content: [{ type: "text", text: error.message }],
-                            isError: true,
-                        };
-                    }
                     return unknownErrorResult(error);
                 }
             },

package/doc/audit/secret-handling.md

@@ -0,0 +1,61 @@
+# Ultimate network password handling audit
+
+**Summary: yes, a leak exists.** An Ultimate request failure can leave the password in an Axios error's request configuration, which reaches stderr when a screen read fails during BASIC execution or polling. This is a source audit, supplemented by a local synthetic Axios serialization/console check; it does not establish that a real password was exposed. Diagnostics usually reduce actual `Error` objects to selected fields, and ordinary MCP error conversion usually uses only the message, but neither is a general secret boundary. Firmware-returned data and arbitrary error messages are not redacted.
+
+## Paths checked
+
+- **Password source and transport — leak (error object).** `src/config.ts:139`–`146` and `src/config.ts:201`–`205` resolve the environment or configuration password; `src/c64Client.ts:351`–`354`, `src/device.ts:221`–`230`, `src/device.ts:1550`–`1551`, and `src/mcp-server.ts:642`–`645` attach it to `X-Password`. Generated `HttpClient.request` returns the Axios request directly (`generated/c64/index.ts:299`–`334`). The HTTP interceptor rejects the original error (`src/loggingHttpClient.ts:49`–`57`), preserving `error.config.headers`. The installed Axios implementation serializes config in `AxiosError.toJSON` unless opt-in redaction is configured (`node_modules/axios/lib/core/AxiosError.js:171`–`196`); a synthetic `JSON.stringify` of an Axios error with this header printed the password. This is an in-process disclosure to error consumers, and makes downstream serialization dangerous.
+
+- **HTTP logging — safe for the configured header on the normal interceptor path.** `src/loggingHttpClient.ts:17`–`23` redacts sensitive header names case-insensitively; request metadata stores the redacted copy (`:32`–`:45`), and success/error debug records use it (`:63`–`:115`). The error summary uses only the message (`src/logger.ts:191`–`199`). Request bodies, parameters, response bodies and messages are not redacted, so a server echo or a password entered separately as data is outside this safe verdict.
+
+- **General logger and console — leak.** `src/logger.ts:37`–`47` passes details to console unchanged; `src/bootstrap/stdio-logger.ts:25`–`33` directs console output to stderr. `C64Client.readScreen` calls `readMemoryRaw` (`src/c64Client.ts:900`–`904`), which rethrows a non-unsupported facade error (`:2169`–`:2177`). After BASIC upload, `src/tools/programRunners.ts:381`–`385` logs that raw error as details (`:34`–`:41`); Node console inspection prints Axios `config.headers`, including the password. With debug logging enabled, `src/tools/pollValidator.ts:169`–`170` and `:192`–`:193` likewise log the raw error (also `:255`–`:256`, `:279`–`:280`). Other console sites were inspected by search: startup connectivity logs a message rather than the Axios object (`src/mcp-server.ts:650`–`660`), while fatal logging prints an arbitrary raw error (`:738`–`:745`), so it has the same unsafe sink if such an error reaches it. `src/config.ts:62`–`69` prints JSON parser error messages; malformed configuration can put a fragment of the file in that message, so this is another potential credential disclosure, dependent on the malformed input and Node version.
+
+- **Diagnostic event files — safe for ordinary Axios Error configuration; otherwise unclear.** `writeDiagnosticEvent` calls `sanitize` before appending NDJSON (`src/diagnostics.ts:112`–`128`); actual `Error` instances are reduced to name, message, stack, code and sanitized cause, omitting Axios config (`:444`–`:453`). This applies to the raw connectivity error (`src/mcp-server.ts:650`–`659`), span failures (`src/diagnostics.ts:198`–`211`), MCP failure events (`src/mcp-server.ts:395`–`415`), and process handlers (`src/diagnostics.ts:410`–`422`). However, plain objects are traversed without key redaction (`:483`–`:488`), and strings, messages and stacks are retained (`:445`–`:456`); call-tool arguments are recorded (`src/mcp-server.ts:350`–`357`). Thus a serialized error, echoed credential, or user-supplied password can be persisted; no automatic flow from the configured header into those plain-object events was established. Diagnostics are enabled by default outside tests unless explicitly disabled (`src/diagnostics.ts:434`–`441`).
+
+- **MCP results and errors — safe for ordinary Axios config; unclear for returned firmware data.** `C64Client.normaliseError` selects message, status and response data for Axios errors (`src/c64Client.ts:2426`–`2439`); for example `readMemory` returns those details (`:927`–`:949`). `unknownErrorResult` uses an Error's message rather than serializing the Error (`src/tools/errors.ts:104`–`121`), while `toolErrorResult` includes supplied details (`:78`–`:93`) and `toCallToolResult` passes result fields through (`src/mcp-server.ts:690`–`713`). `version`, `info` and `configGet` can propagate raw Axios errors (`src/device.ts:357`–`358`, `:418`–`:422`; `src/c64Client.ts:1145`–`1152`, `:1416`–`:1423`), but their ordinary tool catches use the message. No direct serialization of one of these raw Axios errors into a client result was established. Response data is unfiltered, however: `config_get` returns firmware values (`src/tools/developer.ts:219`–`237`); whether firmware exposes its password there or echoes it on error is not established. User-supplied config values can also be returned (`:255`–`:280`).
+
+- **MCP resources and diagnostic reports — unclear for indirect content.** Platform status constructs backend and capability text, not endpoint credentials (`src/mcp-server.ts:197`–`219`, `:543`–`:604`); resource failures log messages, record sanitized errors and rethrow (`:236`–`:249`). `performance_report` reads diagnostic records and returns a summary (`src/tools/meta/diagnostics.ts:75`–`99`; `src/diagnostics.ts:235`–`249`, `:256` onward), so any sensitive content retained in the diagnostic timeline may reach a client. No direct configured-header-to-resource leak was established.
+
+- **Thrown and rethrown errors — leak across internal error boundary.** The original Axios error is rethrown by `readMemoryRaw` (`src/c64Client.ts:2169`–`2177`), by `withDiagnosticSpan` (`src/diagnostics.ts:198`–`211`), and by stream retry and capture paths (`src/c64Client.ts:1963`–`1971`, `:1978`–`:1983`, `:1633`–`:1638`, `:1883`–`:1895`). It still contains the request config; `JSON.stringify` invokes Axios's `toJSON` and exposes the header without opt-in redaction. `ensureStreamSuccess` embeds serialized result details in a new error (`:2023`–`:2027`), but no proven route from a raw Axios config into those details was found. Raw errors reaching generic console sinks remain a concrete risk.
+
+- **Other files — unclear for firmware-returned secrets.** Config snapshot collection stores returned values (`src/tools/meta/configInventory.ts:86`–`101`) and snapshot writes them to a file (`src/tools/meta/config.ts:40`–`54`). Whether the firmware returns the network password is unverified; the bridge does not insert its configured header value into the snapshot itself.
+
+## Recommended fixes
+
+1. In `createLoggingHttpClient`, replace or sanitize rejected Axios errors before they leave the transport, removing sensitive headers from config and request objects; apply the same boundary to direct Axios calls in `logConnectivity` and `C64uBackend.ping`. Preserve useful status and message fields without retaining credential-bearing causes.
+2. In `createPrefixedLogger` and the error logging in `pollBasicOutcome`, the ASM polling function, and BASIC program execution, log safe error summaries rather than raw objects; in `loadConfig`, avoid printing parser excerpts from configuration files. Review the fatal `main().catch` console sink as well.
+3. In `sanitize` and `writeDiagnosticEvent`, redact sensitive keys recursively and handle serialized Axios errors, arguments and error strings deliberately. In `normaliseError`, `unknownErrorResult`, `toolErrorResult`, and `toCallToolResult`, enforce a safe output boundary for errors and echoed data.
+4. In `config_get`'s `execute` and `captureConfigSnapshot`, decide how sensitive firmware configuration values should be handled and redact them if returned. Add focused tests with a synthetic password covering stderr, diagnostics, serialized errors, tool responses and snapshots.
+
+## Outcome of the fix
+
+The audit findings above describe the code before this change. This change adds one shared helper, `src/redact.ts`, and applies it at each sink.
+
+- `registerSecret` records the password. It is called from `resolveUltimateEndpoint` (`src/config.ts`), from `createLoggingHttpClient` (which reads the `X-Password` header it is configured with), and before the direct connectivity probe in `src/mcp-server.ts`.
+- `scrubRequestError` is applied to every rejected request in `createLoggingHttpClient`. It replaces sensitive values in `error.config.headers` and `error.response.config.headers`, clears `error.request` and `error.response.request` (the raw client request keeps the serialised header block), and redacts the password in a string response body. The status, code, message and response data otherwise remain available to callers. This closes the "thrown and rethrown errors" and `JSON.stringify` leaks.
+- `redactValue` and `redactText` are applied in `createPrefixedLogger` (`src/logger.ts`) to the message and details, in `sanitize` (`src/diagnostics.ts`) before the existing size limiting, in `toCallToolResult` (`src/mcp-server.ts`) to `content`, `structuredContent` and `metadata`, and to the fatal error in `main().catch`. `redactValue` reduces `Error` objects to name, message, stack, code, status and cause, redacts credential header names at any depth, and replaces registered secrets in all strings.
+- `loadConfig` now logs only the error name for an unreadable configuration file, because the JSON parser message can quote part of the file.
+
+Remaining limitation: redaction replaces the exact registered password string. A transformed form of the password (for example base64-encoded) is not detected. Firmware configuration values are handled separately, see below.
+
+Regression test: `test/secretRedaction.test.mjs` configures a distinctive password through `C64U_PASSWORD`, then drives HTTP 401 (with the password echoed in the body), HTTP 403, a client timeout and a refused connection against local servers. It asserts that the password is absent from captured console output, diagnostics files and records, `util.inspect`, `JSON.stringify`, `toJSON` and `stack` of the errors, and from `toCallToolResult` output for `toolErrorResult` and `unknownErrorResult`. With `src/redact.ts` replaced by no-op functions and the other `src/` changes reverted, the test fails with "password leaked in: AxiosError: Request failed with status code 401". With the fix it passes. `npm test` passes.
+
+## Firmware-returned configuration values
+
+**Evidence in the repository.** The repository does not list individual configuration item names for the credential settings. What it records:
+
+- `doc/c64u/c64-rest-api.md:17`: firmware 3.12 has an optional "Network Password".
+- `doc/c64u/c64-rest-api.md:93`–`95` (and the captured `scripts/compare-rest/rest-compare-2025-11-01T00-25-21-830Z.json:371`–`376`): the category list contains "Network settings", "WiFi settings" and "Modem Settings". These are the categories that can hold network, Wi-Fi and service credentials (network password, FTP/Telnet passwords, Wi-Fi key).
+- `doc/c64u/c64-rest-api.md:108`–`143`: category reads return `{ "<Category>": { "<Item>": value } }`, and item reads return `{ "<Category>": { "<Item>": { current, min, max, ... } } }`.
+- `doc/c64u/c64-openapi.yaml` and `doc/u2/u2-openapi.yaml` describe `X-Password` only; they define no password item.
+
+Whether the firmware returns the password through `/v1/configs` is therefore not established by repository data. The fix assumes that it can.
+
+**Behaviour.** `config_get` and `config_snapshot_and_restore` (snapshot and diff) now replace the value of credential items with `***` and keep the item name. An item is treated as a credential when its name contains `password`, `passwd`, `passphrase`, `passcode`, `psk` or `secret`, or is a bare Wi-Fi `key`. Matching is by item name (`isSensitiveConfigItem` in `src/redact.ts`), not by category, so it also applies to items in categories not listed above. For item reads, the whole item object (including `min`/`max`/`default`) is replaced by `***`.
+
+- Opt-in: `includeSecretValues: true` on `config_get` and on `config_snapshot_and_restore` returns or stores the values in plain text. Without the flag the values are never returned or written. The configured network password is still replaced by the registered-secret redaction in `toCallToolResult`, even with the flag.
+- Restore: a default snapshot contains `***`. `stripRedactedSecrets` removes those placeholders from the restore payload, so a restore never sets a password to the literal `***`. Credentials in a default snapshot are therefore not restored. Snapshots made with `includeSecretValues: true` restore them.
+- Diff: both sides are redacted by default, so a changed password is not reported unless the flag is set when the snapshot is taken and when diffing.
+- Limitation: detection is by item name. A credential item with a name that does not match the patterns above is not redacted.
+
+**Test.** `test/configSecretRedaction.test.mjs` uses a mocked firmware with "Network Password", "FTP Password", "Telnet Password" and a Wi-Fi "Password". It asserts redaction in the `config_get` result and in the written snapshot file, that other values (Hostname, Volume, access point name) are unchanged, that restore does not write `***`, and that the opt-in flag returns plain values. With `isSensitiveConfigItem` changed to always return false, 3 of its 4 tests fail.