flowviant 0.115.0 → 0.117.0

package/bin/lib/update.mjs

@@ -33,11 +33,12 @@ import { execFileSync, spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { createReadStream, createWriteStream } from 'node:fs';
 import { chmod, mkdtemp, open, rename, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { platform, arch } from 'node:process';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
-import { runningViaNpx, terminalCommand } from './launchCommand.mjs';
+import { relaunchSelf, runningCompiledBinary, runningViaNpx, selfArgv, terminalCommand } from './launchCommand.mjs';
 import { VERSION } from './config.mjs';
 import { compareVersions, versionBelow } from './versionOrder.mjs';
 import { note, ok, warn } from './ui.mjs';
@@ -48,9 +49,40 @@ import { note, ok, warn } from './ui.mjs';
  * never installs, never restarts and never nags on a version it cannot read.
  */
 
-/** Bun marks compiled entrypoints with a virtual /$bunfs/ script path. */
-export function runningCompiledBinary() {
-  return Boolean(process.versions.bun && process.argv[1]?.startsWith('/$bunfs/'));
+// Channel detection lives in launchCommand.mjs; re-exported for this module's callers.
+export { runningCompiledBinary };
+
+/**
+ * NPM RUNS FROM OUTSIDE THE CHECKOUT (2026-10-10, F131). The daemon's working
+ * directory IS the repository (the person launched there, or `--dir` chdir'd
+ * to it), and npm loads a project's `.npmrc` from the nearest package root —
+ * its `registry=` and `node-options=` included — for `npm exec` and `npm view`.
+ * A change that reached base could then steer the unattended self-update to
+ * another registry or preload code into it, outside any agent posture. From
+ * the home directory npm reads only the operator's own user and global config,
+ * which is honoured as it is: no registry is forced.
+ */
+export function npmOutsideCheckout() {
+  return { cwd: homedir() };
+}
+
+/**
+ * The npx relaunch's argv: the same flags, with the checkout named explicitly
+ * and ABSOLUTELY, because the relaunch no longer starts inside it. Any `--dir`
+ * pair already there is replaced — a relative one would now resolve against
+ * the home directory. `cwd` is this process's, which cli.mjs already moved to
+ * the `--dir` it was given; a bare start honours `--dir` (commandSpecs.mjs).
+ */
+export function npxRelaunchArgs(args = process.argv.slice(2), cwd = process.cwd()) {
+  const kept = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--dir') {
+      i++; // and its value
+      continue;
+    }
+    kept.push(args[i]);
+  }
+  return ['-y', 'flowviant@latest', ...kept, '--dir', cwd];
 }
 
 const RELEASE_ORIGIN = 'https://api.flowviant.com';
@@ -115,9 +147,15 @@ export async function installBinaryUpdate({
  * `npm i -g` overwrote the global package in place, so re-running argv[1] loads
  * the NEW code. We tear down first (idle-gated, so nothing's mid-task) and keep
  * this process alive only as a thin proxy waiting on the child, so the user's
- * shell stays attached to one foreground process.
+ * shell stays attached to one foreground process — the one relaunch proxy
+ * (launchCommand.mjs `relaunchSelf`), which passes signals on and reads a
+ * successor killed by one (the OOM killer) as a failure, so `Restart=on-failure`
+ * relaunches the machine instead of leaving it dark.
+ *
+ * `deps` (spawn, exit, signals) are relaunchSelf's test seams; the daemon
+ * passes none.
  */
-function reexec(teardown, { viaNpx = false, viaBinary = false, target = null } = {}) {
+export function reexec(teardown, { viaNpx = false, target = null } = {}, deps = {}) {
   try {
     teardown?.();
   } catch {
@@ -128,12 +166,16 @@ function reexec(teardown, { viaNpx = false, viaBinary = false, target = null } =
   // to leave, and re-running it would reload the stale copy forever. Going back
   // through `npx -y flowviant@latest` is what makes npx resolve `latest` against
   // the registry and fetch the new one. `-y` because a restart must never stop
-  // on npx's install prompt — the same rule FLOWVIANT_REEXEC keeps below.
-  const [cmd, args] = viaNpx
-    ? ['npx', ['-y', 'flowviant@latest', ...process.argv.slice(2)]]
-    : [process.execPath, process.argv.slice(viaBinary ? 2 : 1)];
-  const child = spawn(cmd, args, {
-    stdio: 'inherit',
+  // on npx's install prompt — the same rule FLOWVIANT_REEXEC keeps below. It
+  // runs from outside the checkout and names it with `--dir` (npmOutsideCheckout).
+  const [cmd, argv, where] = viaNpx
+    ? ['npx', npxRelaunchArgs(), npmOutsideCheckout()]
+    : [process.execPath, selfArgv(process.argv.slice(2)), {}];
+  return relaunchSelf({
+    ...deps,
+    cmd,
+    argv,
+    ...where,
     // MARK THE CHILD AS A RESTART, not as a person typing `flowviant`.
     // stdio is inherited, so the child sees two TTYs and believes a human is
     // watching — and 0.55.0 asks a one-time binding question on exactly that
@@ -163,7 +205,6 @@ function reexec(teardown, { viaNpx = false, viaBinary = false, target = null } =
       FLOWVIANT_UPDATE_FROM: VERSION,
     },
   });
-  child.on('exit', (code) => process.exit(code ?? 0));
 }
 
 /**
@@ -184,7 +225,29 @@ export function updateRestartFailed(target) {
 
 /** Install @latest globally. Throws on failure (EACCES without sudo, offline…). */
 function installLatest() {
-  execFileSync('npm', ['install', '-g', 'flowviant@latest'], { stdio: 'inherit' });
+  execFileSync('npm', ['install', '-g', 'flowviant@latest'], { ...npmOutsideCheckout(), stdio: 'inherit' });
+}
+
+/**
+ * What npm says `flowviant@latest` is, or null when it cannot say (offline, an
+ * npm hiccup, a hung registry) — read from outside the checkout like every
+ * other npm call here. `exec` is the test seam.
+ */
+export function publishedVersion({ exec = execFileSync } = {}) {
+  try {
+    return String(
+      exec('npm', ['view', 'flowviant', 'version'], {
+        ...npmOutsideCheckout(),
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        // Synchronous, so it holds the event loop hostage for however long it
+        // runs — a hung registry must not become a hung daemon.
+        timeout: 10_000,
+      })
+    ).trim();
+  } catch {
+    return null; // offline / npm hiccup — "can't confirm", skip this poll
+  }
 }
 
 /** `flowviant update` — explicit, manual update. Does not re-exec into a daemon
@@ -289,7 +352,7 @@ export async function handleVersionSignal({ latest, min, autoUpdate, safeToUpdat
       try {
         spawn(process.execPath, ['uninstall', '--others', '--yes', '--json'], { detached: true, stdio: 'ignore' }).unref();
       } catch (e) { warn(`older-copy cleanup: ${e?.message ?? e}`); }
-      reexec(teardown, { viaBinary: true, target: installed });
+      reexec(teardown, { target: installed });
       return true;
     } catch (e) {
       lastInstallFailAt = Date.now();
@@ -339,18 +402,7 @@ export async function handleVersionSignal({ latest, min, autoUpdate, safeToUpdat
     // the source of truth — only install if npm ACTUALLY has something newer than
     // us, else `npm i -g @latest` reinstalls our own version and we'd re-exec
     // forever.
-    let published = null;
-    try {
-      published = execFileSync('npm', ['view', 'flowviant', 'version'], {
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-        // Synchronous, so it holds the event loop hostage for however long it
-        // runs — a hung registry must not become a hung daemon.
-        timeout: 10_000,
-      }).trim();
-    } catch {
-      /* offline / npm hiccup — treat as "can't confirm", skip this poll */
-    }
+    const published = publishedVersion();
     // An unreadable answer from npm is "can't confirm", like no answer at all.
     const publishedOrder = published ? compareVersions(published, cur) : null;
     if (publishedOrder === null || publishedOrder <= 0) {

package/bin/lib/uplinkScrub.mjs

@@ -10,7 +10,11 @@
  * the PRESENT values of `childEnv`'s `DEPLOY_KEEP` names out of this process's
  * own environment, which is where an operator's `CLOUDFLARE_API_TOKEN`
  * actually lives and which the deploy lane hands to a command whose stdout it
- * then streams to the server. It redacts on SHAPE, never on meaning: a value
+ * then streams to the server. (Three more feeds joined on 2026-10-10: the
+ * person's Codex provider secrets, the nested env files a deploy job copies in
+ * for that job's life, and a short list of vendor token SHAPES — see
+ * `learnSecrets`, `learnExtraSecrets` and `TOKEN_SHAPES`.) It redacts on
+ * SHAPE, never on meaning: a value
  * that looks like an ordinary word is left alone, because a relay that swaps
  * the CLI's own words for `[REDACTED:NODE_ENV]` has stopped being a relay.
  * NOTHING HERE EVER REACHES THE WIRE — it is a list of what to hide, not a
@@ -30,6 +34,9 @@
 // two drifting; `processEnvSecrets`'s docblock carries the whole argument,
 // including why none of it ever reaches the wire.
 import { processEnvSecrets } from './childEnv.mjs';
+// THE PERSON'S CODEX PROVIDER SECRETS (2026-10-10, the audit's F073), read on
+// the same beat as the process half — see `learnSecrets`.
+import { readPersonalCodexSecrets } from './codexPersonal.mjs';
 
 // ── What `scrub` will redact ───────────────────────────────────────────────
 //
@@ -76,25 +83,36 @@ const SCRUB_MIN_LENGTH = 6;
  * than meaning (nothing here classifies, guesses, or asks a model):
  *
  *  · A PLAIN IDENTIFIER — starts with a letter, runs at most sixteen
- *    characters, and is made only of letters, digits and `.` `/` `-`. That is
- *    what a word, a hostname, a short version string and an enum value all look
- *    like. `_` is deliberately NOT in the set: an underscore is rare in prose
- *    and common in key material (`sk-live_…`), so its presence is the cheapest
- *    honest signal that a string was minted rather than written.
+ *    characters, and is made only of letters, digits and `.` `_` `/` `-`, and
+ *    does not mix upper case, lower case AND digits (the case-and-digit rule
+ *    in `worthRedacting`, below). That is what a word, a hostname, a short
+ *    version string, an enum value and a snake_case name all look like. The
+ *    underscore IS in the set (`SCRUB_PLAIN_RE`) and has been since the first
+ *    public release: `db_pass_2024` and `abc_defghijk` are plain and left as
+ *    they are. (This comment said until 2026-10-10 that `_` was deliberately
+ *    left out of the set as the mark of a minted string; the code never did
+ *    that, the public pages — SECURITY.md and the app's Privacy page — follow
+ *    the code, and dropping `_` is an open owner call that needs a dated
+ *    ruling, a release and both pages changed.)
  *  · A SHORT VALUE WITH LITTLE VARIETY — under twelve characters and drawing on
  *    fewer than three of {lower, upper, digit, symbol}. A real credential short
  *    enough to be under twelve characters is mixed; `us-east-1` and `verbose`
  *    are not.
  *
+ * Anything under `SCRUB_MIN_LENGTH` (six) is left alone before either test.
+ *
  * THE ACCEPTED COST, STATED RATHER THAN HIDDEN: a genuinely secret value that
- * is short and lowercase — `hunter2secret`, a thirteen-character all-letters
- * password — is NOT redacted. Under-redaction is chosen here over making the
- * product illegible, because the alternative is a trace nobody can read and a
- * product that silently rewrites its own CLI's output. An operator whose secret
- * is a dictionary word has a problem this function cannot fix. Anything with a
- * symbol, a case mix, twelve-plus characters, or an underscore — which is every
- * token, key, URL, JWT and hex digest anybody actually pastes into a `.env` —
- * is redacted.
+ * is plain or short and unvaried — `hunter2secret`, a thirteen-character
+ * lowercase-and-digit password, or `deadbeef12345678`, a sixteen-character
+ * lowercase hex key that starts with a letter — is NOT redacted. Under-redaction is chosen here over making the product
+ * illegible, because the alternative is a trace nobody can read and a product
+ * that silently rewrites its own CLI's output. An operator whose secret is a
+ * dictionary word has a problem this function cannot fix. What IS redacted is
+ * a value of six or more characters that is not a plain identifier (longer
+ * than sixteen, a character outside the set, a leading non-letter, or an
+ * upper-lower-digit mix) and is twelve or more characters or draws on three
+ * of {lower, upper, digit, symbol} — which covers the long tokens, keys,
+ * URLs, JWTs and hex digests people actually paste into a `.env`.
  */
 const SCRUB_PLAIN_RE = /^[A-Za-z][A-Za-z0-9._/-]{0,15}$/;
 function characterClasses(value) {
@@ -112,7 +130,7 @@ function worthRedacting(value) {
   // password — `Tq8vZ2mKp4Lx9RbN`, the `pwgen -s 16` shape, or a twelve-
   // character `Hx93kPq2Lm7w` — starts with a letter, fits sixteen characters of
   // [A-Za-z0-9] and was left in plain text everywhere this daemon posts, against
-  // this block's own promise that "a case mix" is redacted. A word, a hostname,
+  // the block's promise then that "a case mix" is redacted. A word, a hostname,
   // a region or a version string does not draw on upper, lower AND digits at
   // once; a minted secret almost always does.
   if (SCRUB_PLAIN_RE.test(value) && !(/[a-z]/.test(value) && /[A-Z]/.test(value) && /[0-9]/.test(value))) {
@@ -144,7 +162,8 @@ function worthRedacting(value) {
  * ── TWO SOURCES, KEPT IN TWO VARIABLES (2026-09-21, the review) ──
  *
  * `values` is what `scrub` reads and is rebuilt on every scan as
- * `processEnvSecrets()` ++ `fileValues`. The split exists because the two halves
+ * `processEnvSecrets()` ++ `fileValues` (++ the Codex and per-job halves below,
+ * since 2026-10-10 — see `rebuild`). The split exists because the two halves
  * have opposite failure modes. The CHECKOUT half can come back empty for two
  * different reasons — the operator deleted `.env`, or this pass could not read
  * the directory — so an empty read must NOT replace it (see `learnSecrets`).
@@ -164,7 +183,46 @@ function worthRedacting(value) {
  * because the filter is about redaction and the read is about what is on disk.
  */
 let fileValues = [];
-let values = processEnvSecrets().filter((v) => worthRedacting(v.value));
+/**
+ * THE PERSON'S CODEX PROVIDER SECRETS (2026-10-10, the audit's F073) — the
+ * selected provider's `experimental_bearer_token` and literal `http_headers`
+ * out of `config.toml`, plus the present values its `env_key` and
+ * `env_http_headers` name (`readPersonalCodexSecrets`). A fenced Codex turn
+ * carries the literals in its own environment, where `env` prints them, and
+ * every posture can read `~/.codex/config.toml` itself — so they are learned
+ * WHATEVER the posture, and a turn that prints them relays a redaction.
+ *
+ * Kept apart for the file half's reason: the read is a FILE, which can blink,
+ * so only a read that found something replaces it (see `learnSecrets`). Not
+ * read at import — that would be I/O on every import of this module; the
+ * daemon's first `learnSecrets` runs before its first poll (fleet.mjs).
+ */
+let codexValues = [];
+/**
+ * PER-JOB EXTRAS (2026-10-10, the audit's F085) — `key → [{ name, value }]`,
+ * added and removed by their owner (`learnExtraSecrets` / `forgetExtraSecrets`)
+ * and never touched by the 60s rescan. The deploy lane registers the nested
+ * env files it copied into a job's worktree here for that job's life.
+ */
+const extraValues = new Map();
+let values = [];
+rebuild();
+
+/**
+ * THE ONE PLACE `values` IS BUILT, from every half above (2026-10-10).
+ *
+ * LONGEST FIRST: `scrub` replaces values one after another, so a short value
+ * that sits INSIDE a longer one (a password inside a connection URL) was
+ * replaced first whenever the scan happened to list it first, and the longer
+ * value — now holding a marker where its substring was — no longer matched,
+ * leaving the rest of it in plain text. Replacing the longer value first
+ * removes both.
+ */
+function rebuild() {
+  values = [...processEnvSecrets(), ...codexValues, ...fileValues, ...[...extraValues.values()].flat()]
+    .filter((v) => worthRedacting(v.value))
+    .sort((a, b) => b.value.length - a.value.length);
+}
 
 /**
  * HAND THE SCRUBBER A FRESH READ OF THE CHECKOUT'S `.env*` VALUES —
@@ -199,24 +257,87 @@ let values = processEnvSecrets().filter((v) => worthRedacting(v.value));
  * in this daemon takes. The REPORT half is the scan's, and is unaffected: it
  * returns the real (empty) read, so the app is told what was actually measured.
  */
-export function learnSecrets(scannedValues) {
+export function learnSecrets(scannedValues, codexSecrets = readCodexHalf()) {
   if (scannedValues.length) fileValues = scannedValues;
-  // FILTERED ONCE, HERE — see the predicate's own block above: `scrub` is a hot
-  // path and a value that can never match must not survive into its loop.
-  values = [...processEnvSecrets(), ...fileValues].filter((v) => worthRedacting(v.value));
+  // THE CODEX HALF RIDES THE SAME BEAT (2026-10-10), under the file half's
+  // rule: `config.toml` is a file, so a read that found nothing — the person
+  // removed the provider, or the read blinked — leaves what was learned.
+  if (Array.isArray(codexSecrets) && codexSecrets.length) codexValues = codexSecrets;
+  // FILTERED ONCE, IN `rebuild` — see the predicate's own block above: `scrub`
+  // is a hot path and a value that can never match must not survive into its
+  // loop.
+  rebuild();
+}
+
+/** The Codex half's read, which must never cost the file half its beat: the
+ *  read swallows its own I/O errors, and anything else it could throw reads
+ *  as "nothing new" (2026-10-10). */
+function readCodexHalf() {
+  try {
+    return readPersonalCodexSecrets();
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * A SECOND, ADDITIVE DOOR, OWNED BY WHOEVER OPENED IT (2026-10-10, the audit's
+ * F085).
+ *
+ * `learnSecrets` REPLACES the file half on every read that found something,
+ * so a value fed through it a second time would be wiped by the next 60s root
+ * scan. The deploy lane copies NESTED env files (`apps/api/.dev.vars`,
+ * `apps/web/.env.production`) into the worktree its build runs in — files the
+ * root-only scan deliberately never reads (env.mjs) — and then relays that
+ * build's output. It knows exactly which files it copied, so it teaches their
+ * values here under its job's key and forgets them when the job's checkout is
+ * gone. Filtered by `worthRedacting` like every other half; nothing here
+ * reaches the wire.
+ */
+export function learnExtraSecrets(key, list) {
+  extraValues.set(key, (Array.isArray(list) ? list : []).filter((v) => typeof v?.value === 'string'));
+  rebuild();
+}
+
+/** Drop what `learnExtraSecrets` was taught under `key`. */
+export function forgetExtraSecrets(key) {
+  if (extraValues.delete(key)) rebuild();
 }
 
 // ── Uplink scrubbing ───────────────────────────────────────────────────────
 
-/** Redact every known secret value from daemon-posted text. The list has
- *  already been through `worthRedacting`, so this makes no decisions: an
- *  ordinary word, a short flag and anything under the length floor are simply
- *  not in it. */
+/** Redact every known secret value, then every known token SHAPE, from
+ *  daemon-posted text. The value list has already been through
+ *  `worthRedacting`, so this makes no decisions: an ordinary word, a short flag
+ *  and anything under the length floor are simply not in it. */
 export function scrub(text) {
   if (typeof text !== 'string' || !text) return text;
   let out = text;
   for (const v of values) out = out.split(v.value).join(`[REDACTED:${v.name}]`);
-  return out.replace(FLOWVIANT_TOKEN_RE, `[REDACTED:${FLOWVIANT_TOKEN_NAME}]`);
+  return redactShapes(out);
+}
+
+/**
+ * SCRUB THE WHOLE VALUE, THEN CUT IT (2026-10-10, the audit's F072/F143).
+ *
+ * `scrub` matches EXACT values, so a credential that straddles a cap and is cut
+ * FIRST arrives in two halves that match nothing, and the surviving half ships.
+ * This daemon has shipped that order and recorded learning it more than once
+ * (workAgentCheck.mjs, agentPlan.mjs's `progressOf`, runtimeEvents.mjs's
+ * `toolEventOf`). These two make the right order the one that is spelled: the
+ * whole field is scrubbed, and only the result is cut — so a replacement that
+ * grows a string can never push it past `cap` either. `fn` is the scrubber,
+ * injectable for the parsers that take one as a parameter.
+ */
+export function scrubCut(text, cap, fn = scrub) {
+  return String(fn(String(text ?? ''))).slice(0, cap);
+}
+
+/** `scrubCut`'s tail form — the LAST `cap` characters of the scrubbed text,
+ *  for output whose end says why it failed. */
+export function scrubTail(text, cap, fn = scrub) {
+  const out = String(fn(String(text ?? '')));
+  return cap > 0 ? out.slice(-cap) : '';
 }
 
 /**
@@ -238,10 +359,142 @@ export function scrub(text) {
  * process never saw, with no store read and nothing to keep in sync. Twenty is
  * the floor so the 12-character prefix the app shows for identification
  * (`fva_` + 8) still reads as itself.
+ *
+ * ONE SPELLING OF THE PREFIX, HELD BY THE RELEASE GATE (2026-10-10, audit
+ * F146). The pattern and the byte probe are both built from
+ * `FLOWVIANT_TOKEN_PREFIX`, and `scripts/check-app-parity.mjs` holds it to the
+ * app's `AGENT_TOKEN_PREFIX` and the floor to the length the app mints: a
+ * renamed token family would otherwise pass through every redaction here,
+ * silently, until a credential sat in a trace.
  */
-const FLOWVIANT_TOKEN_RE = /fva_[A-Za-z0-9_-]{20,}/g;
+export const FLOWVIANT_TOKEN_PREFIX = 'fva_';
+export const FLOWVIANT_TOKEN_FLOOR = 20;
+const FLOWVIANT_TOKEN_RE = new RegExp(`${FLOWVIANT_TOKEN_PREFIX}[A-Za-z0-9_-]{${FLOWVIANT_TOKEN_FLOOR},}`, 'g');
 const FLOWVIANT_TOKEN_NAME = 'FLOWVIANT_TOKEN';
 
+/**
+ * THE VENDOR LOGINS, CAUGHT BY SHAPE TOO (2026-10-10, the audit's F014).
+ *
+ * The value lists hold what this box was TOLD about — `.env` files, a few named
+ * environment variables, the Codex config. They never held the logins the CLIs
+ * themselves keep: Claude Code's OAuth pair in `~/.claude/.credentials.json`
+ * (`sk-ant-oat…` / `sk-ant-ort…`), an Anthropic or OpenAI key a shell profile
+ * exports under a name nobody listed, Codex's `auth.json` tokens, `gh auth
+ * token`'s `gho_…`, a GitHub App's `ghs_…` installation token in a remote URL.
+ * A turn that printed one — `cat ~/.claude/.credentials.json`, `gh auth token`
+ * — relayed it verbatim into a trace every member of the project reads. So the
+ * shapes the vendors document are redacted wherever they appear, whether or
+ * not this process ever saw the value.
+ *
+ * REDACTION MASKS, IT NEVER WITHHOLDS: the line is still relayed, with the
+ * token replaced. Each floor is long enough that an ordinary word sharing the
+ * prefix (`sk-learn`, `ghost_town`, a `github_pat_` mentioned in prose) is left
+ * alone — the canaries in uplinkScrub.test.mjs pin one per shape. Order
+ * matters: `sk-ant-` is named before the wider `sk-` rule.
+ */
+const TOKEN_SHAPES = [
+  { name: FLOWVIANT_TOKEN_NAME, re: FLOWVIANT_TOKEN_RE, needle: FLOWVIANT_TOKEN_PREFIX },
+  { name: 'ANTHROPIC_TOKEN', re: /sk-ant-[A-Za-z0-9_-]{20,}/g, needle: 'sk-ant-' },
+  { name: 'OPENAI_API_KEY', re: /\bsk-[A-Za-z0-9_-]{32,}/g, needle: 'sk-' },
+  // No word boundary on GitHub's shapes, like `fva_` (2026-10-10, F056): a
+  // token after a JSON-escaped newline (`\nghs_…`) or inside URL encoding
+  // (`%3Aghs_…`) follows a word character, and a hosted box's installation
+  // token reaches gh from a file, so no learned value ever holds it.
+  { name: 'GITHUB_TOKEN', re: /gh[pousr]_[A-Za-z0-9]{30,}/g, needle: '_' },
+  { name: 'GITHUB_TOKEN', re: /github_pat_[A-Za-z0-9_]{40,}/g, needle: 'github_pat_' },
+  { name: 'AWS_ACCESS_KEY_ID', re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, needle: 'A' },
+  { name: 'SLACK_TOKEN', re: /\bxox[abpr]-[A-Za-z0-9-]{20,}/g, needle: 'xox' },
+];
+
+/**
+ * AN OAUTH TOKEN IN A JSON FIELD — Codex's `auth.json` (`access_token`,
+ * `refresh_token`, `id_token`: JWTs with no vendor prefix) and Claude's
+ * credential file (`accessToken`, `refreshToken`). The key is kept and only
+ * the value is replaced, so the line still reads as what it was. Also matched
+ * with escaped quotes, as the field reads once it is itself inside a JSON
+ * string (a tool result relayed whole). A value something above already
+ * redacted is left as it is.
+ */
+const OAUTH_FIELD_RE =
+  /(\\?"(?:access_token|refresh_token|id_token|accessToken|refreshToken|idToken)\\?"\s*:\s*\\?")(?!\[REDACTED:)[^"\\]{20,}/g;
+const OAUTH_FIELD_NAME = 'OAUTH_TOKEN';
+
+/**
+ * A PEM PRIVATE KEY — a `-----BEGIN … PRIVATE KEY-----` block (`cat
+ * ~/.ssh/id_ed25519`, a service-account JSON's `private_key`). The whole block
+ * is replaced: from BEGIN to END when everything between is key material
+ * (base64, line breaks, the legacy `Proc-Type`/`DEK-Info` headers) holding at
+ * least one 16-character base64 run; or, when no END follows (a `head` of the
+ * file), the BEGIN line and the base64 lines straight after it. A BEGIN line
+ * alone is a header named in prose, and is left alone.
+ *
+ * LINEAR, ON PURPOSE. A regex with a lazy body between BEGIN and END rescans
+ * the rest of the text from every BEGIN that has no END — quadratic on a text
+ * of nothing but BEGIN lines, the freeze `candidateObjects` was hardened
+ * against. So the three forward searches each keep a cursor that only moves
+ * forward, and the block regexes are sticky.
+ */
+const PEM_BEGIN_RE = /-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+const PEM_END_RE = /-----END [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+const PEM_NOT_BODY_RE = /[^A-Za-z0-9+/=\s\\:,.-]/g;
+const PEM_RUN_RE = /[A-Za-z0-9+/=]{16}/g;
+const PEM_LINES_RE = /(?:(?:\r?\n|\\r\\n|\\n)[ \t]*[A-Za-z0-9+/=]+)+/y;
+const PEM_MAX_BODY = 32 * 1024;
+const PEM_NAME = 'PRIVATE_KEY';
+
+function redactPem(text) {
+  if (!text.includes('PRIVATE KEY-----')) return text;
+  let out = '';
+  let at = 0;
+  // Cursors: the first END / non-key character / 16-char run at or after the
+  // position each was last searched from (-1: none in the rest of the text).
+  let end = -2;
+  let endLen = 0;
+  let bad = -2;
+  let run = -2;
+  const after = (re, cursor, from) => {
+    if (cursor === -1 || cursor >= from) return cursor;
+    re.lastIndex = from;
+    const m = re.exec(text);
+    return m ? m.index : -1;
+  };
+  PEM_BEGIN_RE.lastIndex = 0;
+  for (let m; (m = PEM_BEGIN_RE.exec(text)); ) {
+    const body = m.index + m[0].length;
+    let stop = -1;
+    if (end !== -1 && end < body) {
+      PEM_END_RE.lastIndex = body;
+      const e = PEM_END_RE.exec(text);
+      end = e ? e.index : -1;
+      endLen = e ? e[0].length : 0;
+    }
+    if (end >= 0 && end - body <= PEM_MAX_BODY) {
+      bad = after(PEM_NOT_BODY_RE, bad, body);
+      run = after(PEM_RUN_RE, run, body);
+      if ((bad === -1 || bad >= end) && run >= 0 && run + 16 <= end) stop = end + endLen;
+    }
+    if (stop < 0) {
+      PEM_LINES_RE.lastIndex = body;
+      const lines = PEM_LINES_RE.exec(text);
+      if (lines && /[A-Za-z0-9+/=]{16}/.test(lines[0])) stop = body + lines[0].length;
+    }
+    if (stop < 0) continue;
+    out += `${text.slice(at, m.index)}[REDACTED:${PEM_NAME}]`;
+    at = stop;
+    PEM_BEGIN_RE.lastIndex = stop;
+  }
+  return at === 0 ? text : out + text.slice(at);
+}
+
+function redactShapes(text) {
+  let out = text;
+  for (const s of TOKEN_SHAPES) {
+    if (out.includes(s.needle)) out = out.replace(s.re, `[REDACTED:${s.name}]`);
+  }
+  if (out.includes('oken')) out = out.replace(OAUTH_FIELD_RE, `$1[REDACTED:${OAUTH_FIELD_NAME}]`);
+  return redactPem(out);
+}
+
 /**
  * The NAME of the first known secret whose value appears in `bytes` as an
  * exact byte substring, or null. For the payloads `scrub` cannot touch: a
@@ -256,10 +509,22 @@ const FLOWVIANT_TOKEN_NAME = 'FLOWVIANT_TOKEN';
 export function secretIn(bytes) {
   if (!Buffer.isBuffer(bytes) || !bytes.length) return null;
   for (const v of values) if (bytes.includes(v.value, 0, 'utf8')) return v.name;
-  // The token SHAPE too (see `scrub`). `latin1` maps every byte to one
-  // character, so the ASCII pattern matches exactly where the bytes do.
-  if (bytes.includes('fva_') && new RegExp(FLOWVIANT_TOKEN_RE.source).test(bytes.toString('latin1'))) {
-    return FLOWVIANT_TOKEN_NAME;
+  // The token SHAPES too (see `scrub`). `latin1` maps every byte to one
+  // character, so an ASCII pattern matches exactly where the bytes do. Fresh,
+  // non-global copies: a `/g` regex's `test` keeps `lastIndex` between calls.
+  let text = null;
+  for (const s of TOKEN_SHAPES) {
+    if (!bytes.includes(s.needle)) continue;
+    text ??= bytes.toString('latin1');
+    if (new RegExp(s.re.source).test(text)) return s.name;
+  }
+  if (bytes.includes('oken')) {
+    text ??= bytes.toString('latin1');
+    if (new RegExp(OAUTH_FIELD_RE.source).test(text)) return OAUTH_FIELD_NAME;
+  }
+  if (bytes.includes('PRIVATE KEY-----')) {
+    text ??= bytes.toString('latin1');
+    if (redactPem(text) !== text) return PEM_NAME;
   }
   return null;
 }