flowviant 0.102.2 → 0.104.0

package/bin/lib/env.mjs

@@ -1,39 +1,41 @@
 /**
- * THREE THINGS THIS BOX KNOWS ABOUT ITSELF — and nothing it holds for anybody.
- *
- *  1. THE BOX KEYPAIR. A persistent X25519 keypair at
- *     `~/.flowviant/env-keypair.json` (0600). Its public half rides EVERY roster
- *     poll as `envpub`, and that is what tells two computers apart when the
- *     server decides which of them is this project's machine (holdership,
- *     2026-09-14) and which rows belong to which box in the registry
- *     (`machine_box`, 0.91.0). It is an identity LABEL for arbitration, never
- *     an authorization: nothing is GRANTED by it — the credential grants, the
- *     pubkey only disambiguates boxes.
- *  2. THE UPLINK SCRUBBER. `scrub()` redacts secret values out of every piece
- *     of text this daemon posts — turn streams, tool events, the trace,
- *     process command lines, wiki progress, deploy logs. It is fed from TWO
- *     places (2026-09-21, the review): the checkout's `.env*` files, and the
- *     PRESENT values of `childEnv`'s `DEPLOY_KEEP` names out of this process's
- *     own environment, which is where an operator's `CLOUDFLARE_API_TOKEN`
- *     actually lives and which the deploy lane hands to a command whose stdout
- *     it then streams to the server. It redacts on SHAPE, never on meaning: a
- *     value that looks like an ordinary word is left alone, because a relay
- *     that swaps the CLI's own words for `[REDACTED:NODE_ENV]` has stopped
- *     being a relay.
- *  3. THE ENV COMPARISON SCAN. `scanEnvFiles()` reads the checkout's own
- *     `.env*` files and reports variable NAMES plus a short VALUE FINGERPRINT
- *     SALTED WITH THE PROJECT ID, so the app can answer "why does it work on
- *     that box and not this one?" without an eight-character hash over
- *     `production` becoming a dictionary lookup. THE VALUE NEVER LEAVES THE
- *     BOX, and neither does anything from (2) — a report is a statement about
- *     the CHECKOUT'S FILES, and this process's environment is not one.
+ * THE ENV COMPARISON SCAN — and nothing this box holds for anybody.
+ *
+ * `scanEnvFiles()` reads the checkout's own `.env*` files and reports variable
+ * NAMES plus a short VALUE FINGERPRINT SALTED WITH THE PROJECT ID, so the app
+ * can answer "why does it work on that box and not this one?" without an
+ * eight-character hash over `production` becoming a dictionary lookup. THE
+ * VALUE NEVER LEAVES THE BOX. The values it read are handed to the uplink
+ * scrubber (`uplinkScrub.mjs`, through `learnSecrets`) and go no further — a
+ * report is a statement about the CHECKOUT'S FILES, and neither the values nor
+ * this process's environment are part of one.
+ *
+ * ── ONE OF THREE (2026-09-26, the SOLID pass) ──
+ *
+ * This file used to hold three things: the BOX KEYPAIR (now `boxIdentity.mjs`
+ * — `envpub`, holdership, the registry row), the UPLINK SCRUBBER (now
+ * `uplinkScrub.mjs` — what every posted line is redacted against), and this
+ * scan. They shared a file because all three were what the vault below left
+ * standing, not because they change together: an identity rule, a redaction
+ * policy and a dotenv parser have three different reasons to be edited. The
+ * scan keeps the file's name because it is the one that is about the env.
+ *
+ * WHERE THE SCRUBBER IS FED — settled, not a leftover: `scanEnvForScrub` calls
+ * `learnSecrets` itself instead of each poll site doing it. There are two such
+ * sites (the 60s report beat in `fleetReports.mjs`, the pre-first-poll feed in
+ * `fleet.mjs`), and a scan whose values a caller forgets to hand over is a
+ * secret that stops being redacted — the same "no call site has to remember" argument that put the
+ * process-env join inside `learnSecrets`. The dependency runs one way (this
+ * file knows the scrubber's one door; the scrubber knows nothing of `.env`),
+ * and `scanEnvFiles` stays the pure half every parser test drives.
  *
  * ── THE VAULT IS DELETED (2026-09-21) ──
  *
  * This module used to be the CRYPTO ANCHOR of an end-to-end-encrypted team
  * secrets vault: the project's private key reached this box sealed to the
- * keypair above, the daemon opened every value, cached them encrypted on disk,
- * MATERIALIZED `.env` files into every session worktree, executed wrap jobs for
+ * box keypair (`boxIdentity.mjs` now), the daemon opened every value, cached
+ * them encrypted on disk, MATERIALIZED `.env` files into every session
+ * worktree, executed wrap jobs for
  * newly registered boxes, executed rotations when a machine was revoked, and
  * minted a one-time RECOVERY PASSPHRASE parked beside the private key. About
  * 700 lines, a `libsodium-wrappers-sumo` Argon2 dependency, four `/fleet/env/*`
@@ -59,378 +61,25 @@
  * `envv` / `envskip` poll params the materializer reported through.
  *
  * WHAT DID NOT GO, AND MUST NOT: the keypair file, its path, and its 2026-09-14
- * correctness rule (only ENOENT mints; every other read failure RETHROWS).
- * Rotating this box's identity would make the same physical machine arrive at
- * the roster as a stranger — a new row in the registry, and a standby of
- * itself for the whole holder-claim window.
+ * correctness rule — all of it in `boxIdentity.mjs` now, which carries the
+ * argument.
  *
  * `excludeInWorktree` moved to `git.mjs`: it is a generic `git info/exclude`
  * helper that only ever lived here because the materializer was its first
  * caller.
  */
 
-import {
-  readdirSync,
-  readFileSync,
-  mkdirSync,
-  lstatSync,
-  openSync,
-  writeSync,
-  fsyncSync,
-  closeSync,
-  linkSync,
-  unlinkSync,
-} from 'node:fs';
-import { createHash, randomBytes } from 'node:crypto';
-import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-// STILL SUMO, and deliberately not narrowed to the standard build in the same
-// pass that deleted the vault. `crypto_box_keypair` exists in both, but the
-// sumo package is what is installed, what every other daemon on npm resolves,
-// and swapping the dependency is a separate change with its own install-time
-// failure modes. Nothing here needs Argon2 any more; nothing here forbids the
-// narrowing either.
-import sodium from 'libsodium-wrappers-sumo';
+import { readdirSync, readFileSync, lstatSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
 // THE PROJECT ID, as a live binding. It salts every fingerprint (see
-// `fingerprint`), and it is a `let` in config.mjs because cli.mjs's ambiguity
+// `fingerprint`), and it is a `let` in config.mjs because startProject.mjs's ambiguity
 // picker chooses a project AFTER import — reading a frozen copy here would salt
 // a picked project's report with `null` and report nothing at all.
 import { PROJECT_ID } from './config.mjs';
-// THE DEPLOY LANE'S OWN ALLOWLIST, borrowed for REDACTION ONLY. Deriving the
-// scrub list from the set a deploy command is actually handed is what stops the
-// two drifting; `processEnvSecrets`'s docblock carries the whole argument,
-// including why none of it ever reaches the wire.
-import { processEnvSecrets } from './childEnv.mjs';
-
-const B64 = () => sodium.base64_variants.ORIGINAL;
-const KEYPAIR_PATH = join(homedir(), '.flowviant', 'env-keypair.json');
-
-// ── What `scrub` will redact ───────────────────────────────────────────────
-//
-// THE PREDICATE LIVES ABOVE THE LIST ON PURPOSE (2026-09-21): the list is
-// FILTERED THROUGH IT ONCE, when a scan rebuilds it, rather than tested per
-// call. `scrub` runs on every posted line of every turn stream, tool event and
-// deploy log, and it does a whole-string `split`/`join` per value — so a value
-// that will never match must not survive into the loop at all. Pre-filtering
-// also makes the list smaller than it was before this pass on a typical
-// checkout, because half of a real `.env` is ordinary configuration.
-
-/**
- * THE LENGTH FLOOR. A value of one or two characters — `1`, `ab`, `on` — occurs
- * in ordinary prose constantly, so redacting one replaces half of every stream
- * this daemon posts with `[REDACTED:NAME]` and the trace stops being readable
- * at all. Six is the point below which a value is far likelier to be a flag
- * than a secret, and nothing this short is worth making the product illegible
- * for.
- *
- * (It used to carry the comment "mirrors shared ENV_SCRUB_MIN_LENGTH". That
- * constant does not exist anywhere in the monorepo any more — it went with the
- * vault's server half on 2026-09-21 — and a cross-reference to a deleted
- * identifier reads as "do not change this, the other end depends on it", which
- * is a claim about a coupling nobody can check. The floor's own argument is
- * above and it stands on its own.)
- */
-const SCRUB_MIN_LENGTH = 6;
-
-/**
- * A VALUE THAT LOOKS LIKE AN ORDINARY WORD IS NOT REDACTED (2026-09-21, the
- * review) — and this is a correctness fix, not a tuning knob.
- *
- * `scrub` now reads the CHECKOUT'S `.env*` files, and a real `.env` is full of
- * configuration that is not secret at all: `NODE_ENV=development`,
- * `HOST=localhost`, `APP_NAME=flowviant`, `LOG_LEVEL=verbose`,
- * `AWS_REGION=us-east-1`. With those in the list, every occurrence of the word
- * "development" in the CLI's own narration came back as
- * `[REDACTED:NODE_ENV]` — so a turn trace, which exists to relay what the CLI
- * said, was relaying something else. A relay does not swap the words it
- * carries. That is a worse failure than under-redaction, because it is silent,
- * universal, and destroys the readout the trace was built for.
- *
- * TWO SHAPE TESTS, applied per value, both cheap and both about SHAPE rather
- * than meaning (nothing here classifies, guesses, or asks a model):
- *
- *  · A PLAIN IDENTIFIER — starts with a letter, runs at most sixteen
- *    characters, and is made only of letters, digits and `.` `/` `-`. That is
- *    what a word, a hostname, a short version string and an enum value all look
- *    like. `_` is deliberately NOT in the set: an underscore is rare in prose
- *    and common in key material (`sk-live_…`), so its presence is the cheapest
- *    honest signal that a string was minted rather than written.
- *  · A SHORT VALUE WITH LITTLE VARIETY — under twelve characters and drawing on
- *    fewer than three of {lower, upper, digit, symbol}. A real credential short
- *    enough to be under twelve characters is mixed; `us-east-1` and `verbose`
- *    are not.
- *
- * THE ACCEPTED COST, STATED RATHER THAN HIDDEN: a genuinely secret value that
- * is short and lowercase — `hunter2secret`, a thirteen-character all-letters
- * password — is NOT redacted. Under-redaction is chosen here over making the
- * product illegible, because the alternative is a trace nobody can read and a
- * product that silently rewrites its own CLI's output. An operator whose secret
- * is a dictionary word has a problem this function cannot fix. Anything with a
- * symbol, a case mix, twelve-plus characters, or an underscore — which is every
- * token, key, URL, JWT and hex digest anybody actually pastes into a `.env` —
- * is redacted.
- */
-const SCRUB_PLAIN_RE = /^[A-Za-z][A-Za-z0-9._/-]{0,15}$/;
-function characterClasses(value) {
-  let n = 0;
-  if (/[a-z]/.test(value)) n += 1;
-  if (/[A-Z]/.test(value)) n += 1;
-  if (/[0-9]/.test(value)) n += 1;
-  if (/[^A-Za-z0-9]/.test(value)) n += 1;
-  return n;
-}
-function worthRedacting(value) {
-  if (typeof value !== 'string' || value.length < SCRUB_MIN_LENGTH) return false;
-  // THE PLAIN-IDENTIFIER EXEMPTION DOES NOT COVER A CASE-AND-DIGIT MIX
-  // (2026-09-24, the audit). It was checked first and alone, so a generated
-  // password — `Tq8vZ2mKp4Lx9RbN`, the `pwgen -s 16` shape, or a twelve-
-  // character `Hx93kPq2Lm7w` — starts with a letter, fits sixteen characters of
-  // [A-Za-z0-9] and was left in plain text everywhere this daemon posts, against
-  // this block's own promise that "a case mix" is redacted. A word, a hostname,
-  // a region or a version string does not draw on upper, lower AND digits at
-  // once; a minted secret almost always does.
-  if (SCRUB_PLAIN_RE.test(value) && !(/[a-z]/.test(value) && /[A-Z]/.test(value) && /[0-9]/.test(value))) {
-    return false;
-  }
-  if (value.length < 12 && characterClasses(value) < 3) return false;
-  return true;
-}
-
-// ── Module state ───────────────────────────────────────────────────────────
-let keypair = null; // { publicKey: Uint8Array, privateKey: Uint8Array }
-
-/**
- * WHAT `scrub` REDACTS — `[{ name, value }]`, refilled by every env scan.
- *
- * THIS ARRAY CHANGED HANDS (2026-09-21), and the change is an IMPROVEMENT
- * rather than a salvage. It used to hold the vault's decrypted bundle: only
- * the values Flowviant itself had delivered to this box. With the vault gone
- * that array would be permanently empty and `scrub` would become a silent
- * no-op in roughly ten call sites — the worst possible way for a redactor to
- * stop working, because every one of those sites keeps calling it and nothing
- * looks different until a secret is already in the server's database.
- *
- * So it is filled from the CHECKOUT'S OWN `.env*` FILES, which are the box's
- * REAL secrets: the ones the operator pasted in from their providers, the ones
- * a dev server actually loads, and the ones a CLI turn is overwhelmingly
- * likeliest to echo into a log. The vault could only ever redact what it had
- * delivered; this redacts what is there.
- *
- * ── TWO SOURCES, KEPT IN TWO VARIABLES (2026-09-21, the review) ──
- *
- * `values` is what `scrub` reads and is rebuilt on every scan as
- * `processEnvSecrets()` ++ `fileValues`. The split exists because the two halves
- * have opposite failure modes. The CHECKOUT half can come back empty for two
- * different reasons — the operator deleted `.env`, or this pass could not read
- * the directory — so an empty read must NOT replace it (see `scanEnvForScrub`).
- * The PROCESS half cannot blink: `process.env` is in memory and reading it is
- * infallible, so it is replaced unconditionally, and folding it into one array
- * with the file half would make a single unreadable-directory blip drop the
- * operator's deploy credential out of the redactor too.
- *
- * SEEDED AT IMPORT, deliberately. `scrub` is reachable from the deploy lane and
- * from a turn before the first scan has run, and the process half needs no
- * checkout, no credential and no I/O to be correct — so there is no moment at
- * which this module knows a deploy token and is not hiding it.
- *
- * AND IT IS ALREADY FILTERED. Every entry in `values` has passed
- * `worthRedacting` — see that predicate's block above — so `scrub` itself makes
- * no decisions and simply replaces. `fileValues` keeps the UNFILTERED read,
- * because the filter is about redaction and the read is about what is on disk.
- */
-let fileValues = [];
-let values = processEnvSecrets().filter((v) => worthRedacting(v.value));
-
-export async function sodiumReady() {
-  await sodium.ready;
-}
-
-/*
- * `pubkeyEmoji` IS DELETED (2026-09-20), and so is its byte-identical twin in
- * the web app.
- *
- * It existed for exactly one gesture: the terminal printed eight glyphs, the
- * browser's approve card printed the same eight, and a human compared them
- * before pressing Approve. Registering became enrolling, and then the whole
- * enrolment went with the vault — so there is no approve card, no comparison,
- * and nobody to make it. A fingerprint kept byte-identical across two repos
- * for nobody to look at is worse than none: it reads like a live MITM defence
- * and defends nothing.
- */
-
-/** This machine's persistent keypair (created on first use, 0600). */
-export async function ensureKeypair() {
-  await sodium.ready;
-  if (keypair) return keypair;
-  let raw = null;
-  try {
-    raw = readFileSync(KEYPAIR_PATH, 'utf8');
-  } catch (e) {
-    /**
-     * ONLY "THERE IS NO FILE" IS A FIRST RUN, and the bare catch that used to
-     * stand here said every failure was one.
-     *
-     * This keypair is the box's DURABLE IDENTITY — since 2026-09-14 it is what
-     * tells two computers apart when the server decides which of them is this
-     * project's machine, and since 0.91.0 it is the key of this box's row in
-     * the machine registry. Regenerating it on a truncated file or an
-     * unreadable one OVERWRITES that identity: the box arrives at the roster as
-     * a stranger and stands itself down as a standby of itself.
-     *
-     * (It was ALSO what the project's secret vault was sealed to, until the
-     * vault was deleted 2026-09-21. That was the loudest consequence and it is
-     * gone; the identity consequence is the one that survives, and it is on its
-     * own sufficient.)
-     *
-     * A file we cannot read is not a file we may replace. Rethrown, the caller
-     * that can survive it does: `envQueryParams` is wrapped, so the poll simply
-     * carries no `envpub`, and a poll with no envpub is EXEMPT from arbitration
-     * — the documented fail-open arm, reached honestly instead of by minting a
-     * new box every restart.
-     */
-    if (e?.code !== 'ENOENT') throw e;
-  }
-  if (raw !== null) {
-    const stored = JSON.parse(raw);
-    keypair = {
-      publicKey: sodium.from_base64(stored.pub, B64()),
-      privateKey: sodium.from_base64(stored.priv, B64()),
-    };
-    return keypair;
-  }
-  const minted = sodium.crypto_box_keypair();
-  const winner = mintKeypairFile(
-    KEYPAIR_PATH,
-    JSON.stringify({
-      pub: sodium.to_base64(minted.publicKey, B64()),
-      priv: sodium.to_base64(minted.privateKey, B64()),
-    })
-  );
-  keypair = {
-    publicKey: sodium.from_base64(winner.pub, B64()),
-    privateKey: sodium.from_base64(winner.priv, B64()),
-  };
-  return keypair;
-}
-
-/**
- * WRITE THE BOX'S IDENTITY ONCE, ATOMICALLY, AND LET THE FIRST WRITER WIN
- * (2026-09-24, the audit). Returns the `{ pub, priv }` that is ON DISK after
- * the call — ours, or the one a concurrent first start got there with.
- *
- * It was a plain `writeFileSync` reached by every process that saw ENOENT, so
- * two daemons starting together on a fresh box (two projects, two units at
- * boot) each minted a key and the LAST writer won: the first kept a key in
- * memory the disk no longer held and arrived, after its next re-exec, as a
- * different box. And a crash inside the write left a torn file that every later
- * start refuses to read — the only-ENOENT-mints rule doing its job over a file
- * nothing can fix.
- *
- * So the key goes to a private temp file, is fsync'd, and is LINKED into place:
- * `link` fails with EEXIST instead of replacing, so exactly one identity is ever
- * published and every loser reads the winner's. The file at the real path is
- * either absent or complete — never half of one.
- */
-export function mintKeypairFile(path, body) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
-  try {
-    const fd = openSync(tmp, 'wx', 0o600);
-    try {
-      writeSync(fd, body);
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-    try {
-      linkSync(tmp, path);
-      return JSON.parse(body);
-    } catch (e) {
-      if (e?.code === 'EEXIST') {
-        // Somebody else published first. Theirs is the identity; ours is dropped.
-        return JSON.parse(readFileSync(path, 'utf8'));
-      }
-      // A filesystem with no hard links (some network and FUSE mounts answer
-      // EPERM/ENOTSUP) must not cost the box its identity — the plain write
-      // this replaced worked there. Fall back to an EXCLUSIVE create: still
-      // first-writer-wins, only without the torn-write guarantee.
-      if (!['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV'].includes(e?.code)) throw e;
-      let fd2;
-      try {
-        fd2 = openSync(path, 'wx', 0o600);
-      } catch (e2) {
-        if (e2?.code !== 'EEXIST') throw e2;
-        return JSON.parse(readFileSync(path, 'utf8'));
-      }
-      try {
-        writeSync(fd2, body);
-        fsyncSync(fd2);
-      } finally {
-        closeSync(fd2);
-      }
-      return JSON.parse(body);
-    }
-  } finally {
-    try {
-      unlinkSync(tmp);
-    } catch {
-      /* already gone */
-    }
-  }
-}
-
-export function myPubB64() {
-  return keypair ? sodium.to_base64(keypair.publicKey, B64()) : null;
-}
-
-/**
- * THIS BOX'S PUBLIC KEY, READ AND NEVER WRITTEN (2026-09-19, the review).
- *
- * `flowviant machines` is a VIEW-ONLY command — that narrowness is the whole
- * reason a third terminal command was allowed to exist at all — and it was
- * calling `ensureKeypair`, which on a box with no keypair CREATES ONE: a
- * filesystem write, 0600, minting this machine's durable identity, from a
- * command whose entire job is to print a list. Listing must not enrol.
- *
- * It reads the stored file and nothing else. No sodium, no parse of the private
- * half, no creation. NULL for every failure — absent, unreadable, malformed —
- * and null simply means no row gets the "← this box" mark, which is honest: a
- * box that has never run a daemon has never polled, so it is not in the listing
- * to be marked. Claiming a row is you on a guess would be worse than the mark
- * being absent.
- */
-export function readStoredPubB64() {
-  try {
-    const stored = JSON.parse(readFileSync(KEYPAIR_PATH, 'utf8'));
-    return typeof stored?.pub === 'string' && stored.pub ? stored.pub : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * THE IDENTITY PARAMS THE ROSTER POLL CARRIES — one key, and it is the box.
- *
- * It used to carry two more: `envv` (the materialized bundle version, which fed
- * the Settings "env vN" chip) and `envskip` (the target files the materializer
- * REFUSED to write, with the empty string as a real "measured, refused nothing"
- * report). Both were facts about the vault and both died with it; the server
- * stopped reading them in the same change.
- *
- * WHAT DID NOT CHANGE IS `envpub`: the same base64 of the same public key out
- * of the same file. Holdership arbitration, the displaced signal and the box
- * registry all key on it, so a box that upgrades to this release must be the
- * SAME box to the server it was before — no new row, no re-claim, no standby
- * of itself. That continuity is the point of this function still existing at
- * all.
- *
- * Absence keeps its reserved meaning: a poll with no `envpub` is EXEMPT from
- * arbitration rather than treated as an unknown box.
- */
-export async function envQueryParams() {
-  await ensureKeypair();
-  return { envpub: myPubB64() };
-}
+// THE SCRUBBER'S ONE DOOR. The scan reads the checkout; `uplinkScrub.mjs`
+// decides what of it to hide. They meet at this call and nowhere else.
+import { learnSecrets } from './uplinkScrub.mjs';
 
 // ── The env comparison scan ────────────────────────────────────────────────
 
@@ -756,106 +405,22 @@ export function scanEnvFiles(repoRoot, salt) {
  * `{ files, filesTotal, varsTotal }`, the body `/fleet/env-report` posts.
  *
  * Separated from `scanEnvFiles` so the scan itself stays pure and testable: the
- * only impure things about this whole lane are one module-level assignment and
- * one read of `process.env`, and both live here where they can be read in four
- * lines.
+ * only impure things about this whole lane are the scrubber's rebuild and one
+ * read of `process.env`, and both live behind `learnSecrets`
+ * (`uplinkScrub.mjs`), which carries why the process environment is merged in
+ * and why an empty read does not clear what the scrubber already knows.
  *
  * THE SCRUBBER IS FED WHETHER OR NOT THE REPORT IS SENT. The report is deduped
  * against its own hash and posted at most once per change; redaction has no
  * such economy and must reflect the newest read every time, because a secret
  * added to `.env` five minutes ago is exactly the one a turn is about to echo.
  *
- * THE PROCESS ENVIRONMENT'S INFRA CREDENTIALS ARE MERGED IN HERE, and here is
- * the point: this is the one function every caller already goes through, so the
- * two lists cannot drift and nobody has to remember. They are derived from
- * `childEnv`'s own `DEPLOY_KEEP`, which is the set a deploy command is actually
- * handed — see `processEnvSecrets` for why they are redacted and never
- * reported. They are re-read on every scan rather than frozen at import,
- * because that costs nothing and an environment read once is a list that can
- * only be wrong.
- *
- * AN EMPTY READ DOES NOT CLEAR WHAT WE ALREADY KNOW, and this is the one place
- * the two halves deliberately disagree. A scan that comes back with nothing is
- * two different facts wearing one shape — the operator deleted `.env`, or this
- * pass could not read the directory (EACCES, a mid-sweep rename, a network
- * mount that blinked) — and `scanEnvFiles` swallows per-file errors by design
- * so the poll cannot throw. Replacing the list on an empty read means a blip
- * silently turns the redactor OFF, which is the exact failure mode the whole
- * repoint above exists to avoid, and it is invisible until a secret is already
- * in the server's database. Hence the separate `fileValues`: the process half
- * is refreshed unconditionally (process.env does not blink) while the file half
- * is only ever replaced by a read that found something.
- *
- * So an empty read leaves the previous list standing. The cost is
- * OVER-redaction — a value the operator has since removed or rotated keeps
- * being replaced with `[REDACTED:NAME]` for the life of this process — and
- * over-redacting is the safe direction, the same one every three-state readout
- * in this daemon takes. The REPORT half is unaffected: it returns the real
- * (empty) read, so the app is told what was actually measured.
+ * THE REPORT HALF IS THE REAL READ: an empty scan returns an empty report even
+ * while the scrubber keeps what it knew, so the app is told what was actually
+ * measured.
  */
 export function scanEnvForScrub(repoRoot, salt = PROJECT_ID) {
   const scanned = scanEnvFiles(repoRoot, salt);
-  if (scanned.values.length) fileValues = scanned.values;
-  // FILTERED ONCE, HERE — see the predicate's own block above: `scrub` is a hot
-  // path and a value that can never match must not survive into its loop.
-  values = [...processEnvSecrets(), ...fileValues].filter((v) => worthRedacting(v.value));
+  learnSecrets(scanned.values);
   return { files: scanned.files, filesTotal: scanned.filesTotal, varsTotal: scanned.varsTotal };
 }
-
-// ── Uplink scrubbing ───────────────────────────────────────────────────────
-
-/** Redact every known secret value from daemon-posted text. The list has
- *  already been through `worthRedacting`, so this makes no decisions: an
- *  ordinary word, a short flag and anything under the length floor are simply
- *  not in it. */
-export function scrub(text) {
-  if (typeof text !== 'string' || !text) return text;
-  let out = text;
-  for (const v of values) out = out.split(v.value).join(`[REDACTED:${v.name}]`);
-  return out.replace(FLOWVIANT_TOKEN_RE, `[REDACTED:${FLOWVIANT_TOKEN_NAME}]`);
-}
-
-/**
- * EVERY FLOWVIANT CREDENTIAL, CAUGHT BY SHAPE (2026-09-24, the audit).
- *
- * The value lists above are the CHECKOUT'S secrets and the process
- * environment's, and neither holds the one secret that costs the project
- * itself: the MACHINE CREDENTIAL. It sits in `~/.flowviant/credentials.json` —
- * for EVERY project connected on this box, 0600 and readable by every turn,
- * since a turn runs as this uid — and the server mints more of the same shape
- * per turn (the work and capture tokens a tab's MCP server carries). A turn
- * that read the store and wrote it into an artifact, a trace or an answer
- * shipped it verbatim, because `scrub` had no value to match; and a design
- * artifact runs scripts in a frame that may navigate itself, so the page that
- * held it could carry it anywhere.
- *
- * Every one of them is `fva_` + 40 characters of nanoid (the server's
- * `AGENT_TOKEN_PREFIX`), so a SHAPE catches them all, including ones this
- * process never saw, with no store read and nothing to keep in sync. Twenty is
- * the floor so the 12-character prefix the app shows for identification
- * (`fva_` + 8) still reads as itself.
- */
-const FLOWVIANT_TOKEN_RE = /fva_[A-Za-z0-9_-]{20,}/g;
-const FLOWVIANT_TOKEN_NAME = 'FLOWVIANT_TOKEN';
-
-/**
- * The NAME of the first known secret whose value appears in `bytes` as an
- * exact byte substring, or null. For the payloads `scrub` cannot touch: a
- * binary artifact (a PNG's text chunk, a PDF's uncompressed stream, a zip's
- * stored entry) is not text to rewrite — replacing bytes inside one corrupts
- * it — so the caller WITHHOLDS a hit rather than redacting it. The same list,
- * already filtered by `worthRedacting`, so the two can never disagree about
- * what counts as a secret. It sees only what is stored plainly: a value inside
- * a deflated stream is not a substring of the file, and that is stated where
- * it is used (artifacts.mjs).
- */
-export function secretIn(bytes) {
-  if (!Buffer.isBuffer(bytes) || !bytes.length) return null;
-  for (const v of values) if (bytes.includes(v.value, 0, 'utf8')) return v.name;
-  // The token SHAPE too (see `scrub`). `latin1` maps every byte to one
-  // character, so the ASCII pattern matches exactly where the bytes do.
-  if (bytes.includes('fva_') && new RegExp(FLOWVIANT_TOKEN_RE.source).test(bytes.toString('latin1'))) {
-    return FLOWVIANT_TOKEN_NAME;
-  }
-  return null;
-}