knodin 0.10.5 → 0.10.7

package/dist/bin/cli.js

@@ -401,7 +401,13 @@ function formatStatusHuman(result) {
     const semanticNote = result.semanticReadiness && result.semanticReadiness !== "ready"
         ? ` Semantic search coverage is ${result.semanticReadiness}: \`search\` will under-return until embedding completes (\`knodin index\`).`
         : "";
-    const coverage = `${result.coverage.sourceFiles} source files, ${result.coverage.indexedFiles} indexed files, ${result.coverage.filesWithSymbols} files with symbols${formatCoverageGaps(result.coverage.skipped)}${mirrorNote}${semanticNote}`;
+    // `countsUnknown` means the graph could not be read, so these are placeholders
+    // rather than measurements. Printing "0 indexed files" makes an absent graph
+    // indistinguishable from a fully destroyed one.
+    const indexedCounts = result.coverage.countsUnknown
+        ? "indexed and symbol counts unknown; the graph could not be read"
+        : `${result.coverage.indexedFiles} indexed files, ${result.coverage.filesWithSymbols} files with symbols`;
+    const coverage = `${result.coverage.sourceFiles} source files, ${indexedCounts}${formatCoverageGaps(result.coverage.skipped)}${mirrorNote}${semanticNote}`;
     if (result.status === "indexing" && result.activity) {
         const count = result.activity.phaseTotal === undefined
             ? ""
@@ -437,8 +443,18 @@ function formatStatusHuman(result) {
         return `Graph content is intact but evidence is stale (${coverage}).${result.verification.mode === "persisted-audit"
             ? ` Cached deep-audit evidence is from ${result.verification.auditVerifiedAt ?? "an earlier run"}; freshness was probed ${result.verification.verifiedAt ?? "now"}. Run \`knodin status --deep\` for an exact current audit.`
             : ""}\n${freshnessLine}${lifecycleLine}${integrationLine}Run \`knodin wait --fresh\` or issue a graph query to reconcile bounded drift.\n`;
-    const outstanding = result.missing.files.length + result.missing.records.length;
-    const firstIssue = result.missing.files[0] ?? result.missing.records[0];
+    // When the graph could not be read, every source file lands in `missing.files`
+    // because none of them are indexed. That is ONE structural problem, not one
+    // per file: a 94-file repository with no database reported "95 issue(s)" and
+    // led with an arbitrary source filename, so an absent graph read as damage
+    // proportional to repository size. `missing.files` still carries the repair
+    // worklist — only the count and the headline shown to a human change here.
+    const outstanding = result.coverage.countsUnknown
+        ? result.missing.records.length
+        : result.missing.files.length + result.missing.records.length;
+    const firstIssue = result.coverage.countsUnknown
+        ? result.missing.records[0]
+        : (result.missing.files[0] ?? result.missing.records[0]);
     const detail = firstIssue ? ` First issue: ${firstIssue}.` : "";
     const repairCommand = result.lifecycle?.status === "degraded" &&
         result.missing.records.every((record) => result.lifecycle?.issues.includes(record))

package/dist/src/credential-patterns.js

@@ -0,0 +1,90 @@
+/**
+ * One credential-pattern set, shared by every redactor.
+ *
+ * knodin previously carried two independent lists — one in `diagnostics.ts` for
+ * recorded failures, one in `output-compression.ts` for captured command output
+ * — and they drifted apart in OPPOSITE directions. Diagnostics knew Slack and
+ * OpenAI but not AWS or JWTs; output compression knew AWS and JWTs but missed
+ * Slack, OpenAI and GitHub's fine-grained tokens. Neither list was a superset of
+ * the other, so a credential redacted on one path was disclosed on the other,
+ * and patching either one alone would only let them drift again (KNODIN-11).
+ *
+ * Callers keep their own replacement text: diagnostics collapses a match to a
+ * single marker, output compression names the provider. `preservedGroups` is
+ * what makes that possible — the leading captures a caller may echo back
+ * verbatim, so `password=` survives while its value does not.
+ *
+ * Fresh `RegExp` objects are built per call. A shared global regex carries
+ * `lastIndex` between uses, which turns a redactor into something that depends
+ * on what it scrubbed previously.
+ */
+export function credentialPatterns() {
+    return [
+        {
+            // `name=value` in any of its spellings. An optional auth scheme is
+            // consumed BEFORE the value, because `authorization: Bearer <token>`
+            // otherwise matches only the word "Bearer" — redacting the label and
+            // preserving the credential, exactly inverted (KNODIN-10).
+            label: "credential",
+            pattern: /\b(authorization|password|passwd|secret|token|api[_-]?key)(\s*[:=]\s*)(?:(?:bearer|basic|digest|token)\s+)?[^\s,;]+/gi,
+            preservedGroups: 2,
+        },
+        {
+            // GitHub issues every format with an UNDERSCORE. A hyphen-only pattern
+            // matched a shape GitHub never mints and missed every shape it does, so
+            // both separators are accepted. `github_pat` is listed explicitly: it
+            // does not fit the gh[pousr] shape.
+            label: "github-token",
+            pattern: /\b(?:gh[pousr]|github_pat)[-_]\w{20,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "slack-token",
+            pattern: /\bxox[baprse]-[A-Za-z0-9-]{10,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "openai-key",
+            pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "aws-access-key",
+            pattern: /\bAKIA[A-Z0-9]{16}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            label: "jwt",
+            pattern: /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g,
+            preservedGroups: 0,
+        },
+        {
+            // Bearer outside an `authorization:` assignment — a bare header line, or
+            // a curl command echoed into a log.
+            label: "bearer-token",
+            pattern: /\b(Bearer\s+)[-\w.~+/]{12,}=*/gi,
+            preservedGroups: 1,
+        },
+    ];
+}
+/**
+ * Apply every shared pattern, letting the caller render the replacement.
+ *
+ * `marker` receives the provider label; preserved groups are prepended to
+ * whatever it returns.
+ */
+export function redactCredentials(text, marker) {
+    let result = text;
+    let count = 0;
+    for (const { label, pattern, preservedGroups } of credentialPatterns()) {
+        result = result.replace(pattern, (...values) => {
+            count++;
+            const kept = values
+                .slice(1, 1 + preservedGroups)
+                .map((value) => (typeof value === "string" ? value : ""))
+                .join("");
+            return `${kept}${marker(label)}`;
+        });
+    }
+    return { text: result, count };
+}

package/dist/src/diagnostics.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import zlib from "node:zlib";
 import { compareBytes } from "./compare.js";
+import { redactCredentials } from "./credential-patterns.js";
 const CONFIG_PATH = ".knodin/diagnostics/config.json";
 const JOURNAL_PATH = ".knodin/diagnostics/events.jsonl";
 const JOURNAL_LOCK_PATH = ".knodin/diagnostics/events.lock";
@@ -528,8 +529,17 @@ function scrubText(raw, repo) {
     };
     for (const exact of [repo, os.homedir()].filter(Boolean).sort((a, b) => b.length - a.length))
         replace(new RegExp(exact.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`), "g"), "<path>");
-    replace(/\b(?:ghp|github_pat|sk|xox[baprs])-[-A-Za-z0-9_]{10,}\b/g, "<secret>");
-    replace(/\b(?:password|passwd|token|secret|api[_-]?key|authorization)\s*[=:]\s*[^\s,;]+/gi, "$1=<secret>");
+    // Provider credentials, from the set shared with output-compression (see
+    // credential-patterns.ts). These used to be maintained here separately, and
+    // the two lists drifted: this one knew Slack and OpenAI but not AWS keys or
+    // JWTs, while output compression knew those and missed these. A credential
+    // safe on one path was disclosed on the other (KNODIN-11).
+    //
+    // `redactCredentials` counts its own replacements, so they are added to the
+    // running total rather than counted by the local `replace` helper.
+    const credentials = redactCredentials(value, () => "<secret>");
+    value = credentials.text;
+    redactions += credentials.count;
     replace(/\b[A-Z]:\\(?:[^\s<>:"|?*]+\\)*[^\s<>:"|?*]*/g, "<path>");
     replace(/(?:^|[\s('"`])\/(?:[^\s)'"`]+\/)*[^\s)'"`]*/g, "<path>");
     replace(/\b(?:[A-Za-z0-9_.-]+\/)+(?:[A-Za-z0-9_.-]+\.[A-Za-z0-9]{1,12})\b/g, "<path>");

package/dist/src/engine/candidate-database.js

@@ -1,6 +1,8 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { isSealedDatabase } from "./seal.js";
+import { Database } from "./sqlite.js";
 import { resolveDbPath, resolveStateDir } from "./state-paths.js";
 const PROMOTION_SCHEMA_VERSION = 1;
 const CANDIDATES_DIRECTORY = "candidates";
@@ -166,6 +168,29 @@ export function recoverInterruptedPromotion(repo) {
     fsyncDirectory(path.dirname(marker));
     return outcome;
 }
+/**
+ * Whether the database currently at the active path carries embedded source.
+ *
+ * An active database that cannot be opened reports false ON PURPOSE. Replacing
+ * a damaged graph is exactly what promotion exists to do, and a graph too
+ * corrupt to open is the ordinary case for that — refusing here would break
+ * repair for the situation it is most needed in. The trade is deliberate: a
+ * sealed artifact that is ALSO unreadable can still be replaced, but such an
+ * artifact is already unrecoverable.
+ */
+function activeDatabaseIsSealed(activePath) {
+    let db = null;
+    try {
+        db = new Database(activePath, { readonly: true });
+        return isSealedDatabase(db);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        db?.close();
+    }
+}
 /** Same-filesystem, marker-backed promotion. Caller must close and audit both databases first. */
 export function promoteCandidateFile(repo, candidate) {
     assertCandidate(repo, candidate);
@@ -176,6 +201,18 @@ export function promoteCandidateFile(repo, candidate) {
     for (const suffix of ["-wal", "-shm"])
         if (fs.existsSync(`${candidate.databasePath}${suffix}`))
             throw new Error("candidate database has uncheckpointed sidecar files");
+    // Promotion REPLACES the active database. When that file is a sealed
+    // artifact, replacing it destroys the only copy of the source embedded in
+    // it. `repair` reaches here with a candidate built from the working tree,
+    // so an artifact sitting at the active path was emptied by a command whose
+    // entire purpose is to make a graph healthier (KNODIN-9).
+    //
+    // This is the chokepoint rather than a guard inside `repair`, because every
+    // promotion has the same consequence regardless of which caller arrives.
+    // An ordinary working graph is never sealed, so normal promotion and repair
+    // are unaffected.
+    if (fs.existsSync(activePath) && activeDatabaseIsSealed(activePath))
+        throw new Error("active database is a sealed artifact; promotion would replace it");
     fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
     fsyncFile(candidate.databasePath);
     const backupPath = path.join(stateDir, `db.sqlite.backup.${Date.now()}.${crypto.randomUUID().slice(0, 8)}`);

package/dist/src/engine/index.js

@@ -8779,26 +8779,28 @@ export async function getOrInitDb(repoPath, options = {}) {
             else {
                 const stateDir = resolveStateDir(normalizedPath);
                 await fs.promises.mkdir(stateDir, { recursive: true });
-                // Ensure .knodin is in .gitignore. Skipped for mirrors: their state
-                // lives outside the clone, and the clone must stay byte-identical to
-                // the remote so a refetch has nothing of ours to discard.
+                // Ensure .knodin is ignored, through `.git/info/exclude` rather than
+                // `.gitignore`.
+                //
+                // `.gitignore` is a SHARED file: it is tracked by convention, so
+                // writing it put a change into someone's working tree that they did
+                // not ask for and would carry into their next commit. That is the
+                // one thing `knodin init --scope personal` promises not to do, and
+                // this ran regardless of scope — a bare `knodin index` did it too
+                // (KNODIN-1).
+                //
+                // `.git/info/exclude` has the same effect and is repo-local: git
+                // never commits it, so nothing reaches a diff or a teammate.
+                //
+                // Skipped for mirrors: their state lives outside the clone, and the
+                // clone must stay byte-identical to the remote so a refetch has
+                // nothing of ours to discard.
                 if (mayWriteToRepository(normalizedPath)) {
                     try {
-                        const gitignorePath = path.join(normalizedPath, ".gitignore");
-                        let gitignoreContent = "";
-                        if (fs.existsSync(gitignorePath)) {
-                            gitignoreContent = await fs.promises.readFile(gitignorePath, "utf-8");
-                        }
-                        const lines = gitignoreContent.split("\n").map((l) => l.trim());
-                        if (!lines.includes(".knodin") &&
-                            !lines.includes(".knodin/") &&
-                            !lines.includes("/.knodin")) {
-                            const prefix = gitignoreContent.length > 0 && !gitignoreContent.endsWith("\n") ? "\n" : "";
-                            await fs.promises.appendFile(gitignorePath, `${prefix}\n# knodin\n.knodin\n`);
-                        }
+                        await excludeStateDirectoryLocally(normalizedPath);
                     }
                     catch (e) {
-                        console.error("Failed to update .gitignore", e);
+                        console.error("Failed to exclude .knodin from git", e);
                     }
                 }
                 dbPath = path.join(stateDir, "db.sqlite");
@@ -8860,6 +8862,16 @@ export async function getOrInitDb(repoPath, options = {}) {
             // Runs after the CREATE TABLEs below, since the table must exist.
             const needsOrphanPurge = storedVersion < KNODIN_SCHEMA_VERSION;
             const needsEmbeddingRepresentationRefresh = storedVersion >= 22 && storedVersion < 23;
+            // An artifact sealed by an older build carries that build's schema
+            // version, so a newer knodin opening it for write lands here and drops
+            // every table below — including the embedded source, which no working
+            // tree can supply again. Today's artifacts report the current version
+            // and never reach it; one from a single release ago would.
+            //
+            // Refuse rather than skip: skipping would leave the caller holding a
+            // database it believes is writable and current, and it is neither.
+            if (storedVersion < LAST_REBUILD_SCHEMA_VERSION && isSealedDatabase(db))
+                throw new Error("refusing to rebuild the schema of a sealed artifact: it would drop the embedded source, which is the only copy");
             if (storedVersion < LAST_REBUILD_SCHEMA_VERSION) {
                 db.run("DROP TRIGGER IF EXISTS after_symbol_insert;");
                 db.run("DROP TRIGGER IF EXISTS after_symbol_delete;");
@@ -10082,6 +10094,45 @@ function parseUnifiedDiff(stdout) {
     }
     return modifiedFiles;
 }
+/**
+ * Ignore `.knodin/` through `.git/info/exclude`, which git never commits.
+ *
+ * Resolved with `git rev-parse --git-path` rather than assembled by hand:
+ * inside a linked worktree `.git` is a FILE pointing elsewhere, so
+ * `<repo>/.git/info/exclude` is not a path that exists. Idempotent — a second
+ * call over an already-excluded repository writes nothing.
+ */
+async function excludeStateDirectoryLocally(repoPath) {
+    // A directory that is not a git repository has nothing to exclude, and git
+    // exits non-zero there. That is an ordinary state — knodin indexes plain
+    // directories — so it must not surface as an error. The previous
+    // `.gitignore` write never had to ask git anything, which is why this case
+    // only appears now.
+    let raw;
+    try {
+        raw = runGit(repoPath, ["rev-parse", "--git-path", "info/exclude"]).trim();
+    }
+    catch {
+        return;
+    }
+    if (!raw)
+        return;
+    const excludePath = path.isAbsolute(raw) ? raw : path.resolve(repoPath, raw);
+    let existing = "";
+    try {
+        existing = await fs.promises.readFile(excludePath, "utf-8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const entries = new Set(existing.split(/\r?\n/).map((line) => line.trim()));
+    if (entries.has(".knodin") || entries.has(".knodin/") || entries.has("/.knodin"))
+        return;
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    await fs.promises.mkdir(path.dirname(excludePath), { recursive: true });
+    await fs.promises.appendFile(excludePath, `${prefix}.knodin/\n`, "utf-8");
+}
 function runGit(repoPath, args) {
     return child_process.execFileSync("git", args, {
         cwd: repoPath,
@@ -12941,6 +12992,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                 let indexedFiles = 0;
                 let filesWithSymbols = 0;
                 let lastSuccessfulReconciliation = null;
+                // No database, or counters that threw, means the zeros below were
+                // never measured.
+                let countsUnknown = !db;
                 if (db) {
                     try {
                         schemaVersion =
@@ -12957,7 +13011,10 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                     }
                     catch {
                         // A schema migration can briefly make counters unavailable;
-                        // the live operation remains the authoritative status.
+                        // the live operation remains the authoritative status. Whatever
+                        // was read before the throw is partial, so report the counts as
+                        // unknown rather than presenting a half-filled tally as measured.
+                        countsUnknown = true;
                     }
                     if (!activeDb)
                         db.close();
@@ -12980,6 +13037,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                             ? Math.round((Math.min(indexedFiles, sourceFiles.length) / sourceFiles.length) * 10000) / 100
                             : 100,
                         skipped,
+                        ...(countsUnknown ? { countsUnknown: true } : {}),
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: { files: [], records: [] },
@@ -13011,6 +13069,8 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         filesWithSymbols: 0,
                         percent: sourceFiles.length ? 0 : 100,
                         skipped: buildCoverageSkips(collected.skippedByExtension, null),
+                        // There is no database to count, so these are placeholders.
+                        countsUnknown: true,
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: {
@@ -13183,6 +13243,9 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         filesWithSymbols: 0,
                         percent: sourceFiles.length ? 0 : 100,
                         skipped: coverageSkips,
+                        // The schema is not one this build can read, so index_state is
+                        // not counted here even though rows may well exist.
+                        countsUnknown: true,
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: { files: sourceFiles, records: schemaProblems },
@@ -13531,7 +13594,7 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         else
                             counts.indexed++;
                     }
-                    else {
+                    else if (shouldPurgeMissingFile(db)) {
                         db.run("BEGIN TRANSACTION;");
                         try {
                             deleteSymbolsForFile(db, file);
@@ -13547,6 +13610,17 @@ export function createEngine(openPolicy = DEFAULT_ENGINE_OPEN_POLICY) {
                         }
                         counts.removed++;
                     }
+                    else {
+                        // A sealed artifact's rows ARE the artifact: it has no working
+                        // tree, so "this file is missing" is its normal condition rather
+                        // than drift to clean up (KNODIN-9).
+                        //
+                        // This was the sixth purge site and the only unguarded one.
+                        // `removeIndexState` above carries its own guard, which is why
+                        // the damage looked so strange: index_state survived while the
+                        // symbols, references and dependencies around it were deleted.
+                        counts.skipped++;
+                    }
                     committedWork = true;
                     setMeta(db, "repairPostprocessingPending", "1");
                     completedFiles = fileIndex + 1;

package/dist/src/failure-diagnosis.js

@@ -26,7 +26,13 @@ const CODE_EXTENSIONS = [
     ".cpp",
     ".h",
     ".hpp",
-];
+    // Longest first. `referenceAt` takes the FIRST extension that matches at a
+    // cursor, so a shorter extension listed earlier wins and truncates the path:
+    // `src/main.cpp:3:4` parsed as `src/main.c` with no line, pointing diagnosis
+    // at a file that does not exist. `.tsx` only worked because it happened to
+    // precede `.ts`. Sorting makes longest-match the rule rather than an
+    // accident of list order.
+].sort((left, right) => right.length - left.length);
 const MAX_ANALYSIS_BYTES = 4 * 1024 * 1024;
 const MAX_SOURCE_FILE_BYTES = 1024 * 1024;
 const MAX_MANIFEST_BYTES = 256 * 1024;

package/dist/src/output-compression.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { redactCredentials } from "./credential-patterns.js";
 import { resolveStateDir } from "./engine/state-paths.js";
 const DEFAULT_LINE_BUDGET = 200;
 const DEFAULT_BYTE_BUDGET = 16_384;
@@ -90,20 +91,20 @@ function splitEvent(event) {
         lines.push({ raw: "", sourceBytes: 0 });
     return lines;
 }
+/**
+ * Redact credentials from captured output.
+ *
+ * The pattern set is shared with `diagnostics.ts` (see credential-patterns.ts).
+ * It used to be maintained here separately, and the two lists drifted: this one
+ * knew AWS keys and JWTs but missed Slack, OpenAI and GitHub's fine-grained
+ * tokens, while diagnostics missed AWS and JWTs. A credential safe on one path
+ * was disclosed on the other (KNODIN-11).
+ *
+ * The provider-named markers are kept, because a reader of compressed output
+ * benefits from knowing WHAT was removed.
+ */
 function redact(text) {
-    let count = 0;
-    const replace = (pattern, replacement) => {
-        text = text.replace(pattern, (...values) => {
-            count++;
-            return typeof replacement === "string" ? replacement : replacement(...values);
-        });
-    };
-    replace(/\b(authorization|password|passwd|secret|token|api[_-]?key)\s*([:=])\s*([^\s,;]+)/gi, (_match, name, separator) => `${name}${separator}[REDACTED:credential]`);
-    replace(/\bAKIA[A-Z0-9]{16}\b/g, "[REDACTED:aws-access-key]");
-    replace(/\bgh[pousr]_\w{20,}\b/g, "[REDACTED:github-token]");
-    replace(/\bBearer\s+[-\w.~+/]{12,}=*\b/gi, "Bearer [REDACTED:bearer-token]");
-    replace(/\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g, "[REDACTED:jwt]");
-    return { text, count };
+    return redactCredentials(text, (label) => `[REDACTED:${label}]`);
 }
 function csiSequenceEnd(text, escapeIndex) {
     for (let index = escapeIndex + 2; index < text.length; index++) {

package/docs/releases/0.10.6.md

@@ -0,0 +1,139 @@
+# knodin 0.10.6
+
+Four fixes, continuing the theme 0.10.2 through 0.10.5 have been working on: **a
+result that looks complete while quietly being wrong**. Three of the four were
+found the same way — by writing a test per case and watching which ones failed,
+rather than by reading the code and deciding it looked correct.
+
+Two of them disclose credentials, so read that section first if you have ever
+attached a diagnostics bundle to a support request.
+
+## Credentials survived redaction
+
+`knodin` scrubs secrets out of recorded failures before they can reach a
+diagnostics bundle — the artefact a user hands to someone else when asking for
+help. Two things it claimed to redact, it did not.
+
+**GitHub tokens were never redacted at all.** The pattern required a hyphen
+after the prefix:
+
+```
+\b(?:ghp|github_pat|sk|xox[baprs])-[-A-Za-z0-9_]{10,}\b
+```
+
+GitHub issues both its formats with an *underscore*. So the two GitHub
+alternatives matched a shape GitHub never mints and missed every shape it does.
+Slack and OpenAI genuinely do use a hyphen, so the separator now accepts either
+rather than being swapped.
+
+**An authorization header leaked the credential and redacted its label.** The
+value pattern stops at whitespace, so for the standard form
+
+```
+authorization: Bearer <token>
+```
+
+it matched only the word `Bearer` — replacing the part that identifies the
+header and preserving the part that authenticates. Exactly inverted. An optional
+known scheme is now consumed first, so the credential after it is what gets
+replaced.
+
+This was quiet in an unhelpful way. The journal stores only a *fingerprint* of
+the scrubbed message, never the message, so an unredacted credential is
+invisible locally and appears only in the bundle that gets shared. The tests
+assert redaction by fingerprint equivalence for that reason, and by
+value-independence — two messages differing only in the secret must fingerprint
+identically — which is how the `Bearer` case was found. An assertion written
+against expected output text would have passed, because the output *did* contain
+a redaction marker.
+
+Redaction is on by default, so this needed no unusual configuration to hit.
+
+A second redactor, in output compression, has different gaps in the opposite
+direction: it catches GitHub classic but not fine-grained, and misses Slack and
+OpenAI. Neither pattern list is a superset of the other. That one is filed
+rather than patched here, because adding three regexes to one of two diverging
+lists would only re-create the problem later.
+
+## `repair` emptied a sealed artifact
+
+Pointed at a sealed artifact, `knodin repair` deleted its symbols, references
+and dependencies. A sealed artifact's embedded source is the only copy of that
+source, so this was unrecoverable.
+
+0.10.5 audited five sites that purge rows for files missing from disk and
+guarded all five. This was a **sixth**, in repair's own removal branch, which
+never consulted the guard.
+
+It also explains a symptom that made no sense while the mechanism was unknown:
+`index_state` survived intact while everything around it was deleted.
+`removeIndexState`, called *inside* that same block, carries its own guard and
+declined correctly — so the damage was the guard working on one line and being
+absent from the four above it.
+
+Two adjacent hazards are guarded alongside it: a schema rebuild would drop every
+table of an artifact sealed by an older build, and promotion would overwrite a
+sealed artifact sitting at the active path.
+
+## `status` reported an unreadable graph as a measured zero
+
+A 94-file repository whose database was missing printed:
+
+```
+Graph or lifecycle needs repair: 95 issue(s) found
+(94 source files, 0 indexed files, 0 files with symbols)
+First issue: <an arbitrary source file>
+```
+
+`repair`, seconds later, reported 94 indexed and 53 with symbols. The two
+commands never counted differently. `status` was rendering a graph it could not
+read as a measurement of zero.
+
+The `95` was arithmetic, not a tally: the issue count is
+`missing.files + missing.records`, and the no-database branch fills
+`missing.files` with every source file. Ninety-four files plus one record. So
+the count scaled with repository size, and a graph that had simply never been
+built read as damage proportional to how much code you have.
+
+Three sites emitted zeros they had not measured, and now report the counts as
+unknown instead:
+
+```
+Graph or lifecycle needs repair: 1 issue(s) found
+(3 source files, indexed and symbol counts unknown; the graph could not be read)
+First issue: local index database is missing
+```
+
+`missing.files` is deliberately still populated. `repair` consumes it as its
+worklist and `seal` reads it as dirty paths, so emptying it — the obvious way to
+stop the count inflating — would have left repair with nothing to do.
+
+## C++ diagnostics pointed at files that do not exist
+
+Source extensions are matched first-listed rather than longest, and `.c`
+preceded `.cpp`. A C++ stack frame did not merely lose precision:
+
+```
+in    at f (src/main.cpp:3:4)
+was   { path: "src/main.c", line: null, column: null }
+now   { path: "src/main.cpp", line: 3, column: 4 }
+```
+
+A path to a file that does not exist, with the location dropped. `.tsx` worked
+only because it happened to precede `.ts`; longest-match is now the rule rather
+than an accident of list order.
+
+## Coverage measures the parse path again
+
+Not a shipped behaviour change, but worth recording because it changes what the
+project's own numbers mean.
+
+Generic source files are parsed off the main thread, and v8 coverage instruments
+only the isolate it runs in — so everything the parse path did executed inside a
+worker thread where it could not be observed, and was reported as untested. On
+an identical set of shards, with no test changed, disabling parse workers for
+the coverage run alone moved branch coverage from 74.85% to 77.16%: 414 branches
+the suite was already exercising.
+
+Sixteen functions had been sitting in the uncovered map looking like dead code.
+They were not.

package/docs/releases/0.10.7.md

@@ -0,0 +1,79 @@
+# knodin 0.10.7
+
+Two fixes, both about knodin doing something to your repository or your
+credentials that you did not ask for.
+
+## knodin no longer writes to your .gitignore
+
+Indexing appended `.knodin` to `.gitignore`. That file is **shared**: tracked by
+convention, so the edit landed in your working tree and would ride into your next
+commit — and on a narrowly-scoped branch, `git add -A` swept it in.
+
+It ran regardless of scope, so a bare `knodin index` did it too. That matters
+because `knodin init --scope personal` exists precisely to promise that nothing
+reaches git.
+
+The same protection now goes to `.git/info/exclude`, which git never commits.
+The rule is resolved through `git rev-parse --git-path` rather than assembled by
+hand, because inside a linked worktree `.git` is a file and
+`<repo>/.git/info/exclude` is not a path that exists. A directory that is not a
+git repository has nothing to exclude and is left alone silently — knodin indexes
+plain directories too.
+
+### What this changed about freshness reporting
+
+Worth knowing if you have ever read the `staleness` field.
+
+Because every repository knodin touched carried that untracked `.gitignore`, its
+working tree was permanently dirty, and a dirty tree forces the reconcile path.
+So a branch switch reported `reconciled`. With a genuinely clean tree the same
+switch reports `fresh`.
+
+Nothing about the answer changed — measured directly, the query returns the
+symbols of the branch you are on, with no trace of the one you left. `fresh` is
+accurate: the graph does match the tree. Only the label is different, and it is
+different because the tree is finally clean.
+
+Three internal assertions had been reading that side effect rather than the
+behaviour they named, and now measure the returned symbols instead.
+
+## One credential-pattern set, not two
+
+knodin had **two independent secret redactors** — one for diagnostics bundles,
+one for compressed command output — each with its own list. They had drifted in
+opposite directions:
+
+| | diagnostics | output compression |
+|---|---|---|
+| GitHub classic | yes | yes |
+| GitHub fine-grained | yes | **no** |
+| Slack | yes | **no** |
+| OpenAI | yes | **no** |
+| AWS access key | **no** | yes |
+| JWT | **no** | yes |
+
+Neither list was a superset of the other, so the same log line was scrubbed on
+one path and disclosed on the other. Redaction is on by default, so nothing
+unusual had to be configured to hit this.
+
+Both now use one shared set covering every row. Each caller keeps its own
+replacement text: compressed output still names the provider, because a reader
+benefits from knowing what was removed, while diagnostics collapses to a single
+marker. Both preserve the key name and drop only the value, so `password=`
+survives and its secret does not.
+
+Tests assert every provider on **both** paths — a property no single-module test
+could hold. What redaction must leave alone is pinned too: a 40-character hex
+git SHA passes through untouched, because redacting commit SHAs would make diffs
+and review output unreadable.
+
+## Coverage
+
+Measured across all sixteen shards: 78.22% branches, 87.77% statements, 91.20%
+functions, 90.33% lines.
+
+The 77.16% recorded in 0.10.6 came from fifteen shards, the sixteenth having
+failed to write its report. That number was described at the time as a floor. It
+was not — a missing shard shrinks the denominator faster than the numerator, so
+it flattered the result. A partial-shard measurement is unusable rather than
+conservative.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "knodin",
-	"version": "0.10.5",
+	"version": "0.10.7",
 	"knodin": {
 		"compatibility": "compatible"
 	},
@@ -23,32 +23,45 @@
 		"knodin": "dist/bin/launcher.js"
 	},
 	"files": [
+		"*.wasm",
+		"benchmarks/competitors/SYNTHESIS.md",
 		"dist",
-		"skills",
-		"docs/prompts/declare-multi-repository-system.md",
-		"docs/DEAD-CODE-AND-IMPACT.md",
-		"docs/DOCTOR-AND-UPDATES.md",
 		"docs/BACKUP-RETENTION.md",
-		"docs/DIAGNOSTICS.md",
 		"docs/BEHAVIORAL-CONTRACT.md",
-		"docs/DEMO.md",
+		"docs/CLI.md",
+		"docs/COMMAND-OUTPUT-COMPRESSION.md",
 		"docs/COMPARISON.md",
 		"docs/COMPETITIVE-LANDSCAPE-2026-08.md",
-		"docs/INDEXING-POLICY-AND-PROVENANCE.md",
+		"docs/CONTAINED-EXECUTION.md",
+		"docs/DEAD-CODE-AND-IMPACT.md",
+		"docs/DEMO.md",
+		"docs/DIAGNOSTICS.md",
+		"docs/DOCTOR-AND-UPDATES.md",
+		"docs/GIT-HISTORY-REVIEW.md",
 		"docs/HANDOFF.md",
+		"docs/INDEXING-POLICY-AND-PROVENANCE.md",
 		"docs/INSTALLATION.md",
 		"docs/MCP.md",
-		"docs/COMMAND-OUTPUT-COMPRESSION.md",
-		"docs/CONTAINED-EXECUTION.md",
 		"docs/PROGRESSIVE-EVIDENCE.md",
-		"docs/GIT-HISTORY-REVIEW.md",
-		"docs/SCIP-IMPORT.md",
-		"docs/CLI.md",
 		"docs/PT-ACCESS-RECOMMENDATION.md",
-		"docs/REPOSITORIES-AND-WORKTREES.md",
 		"docs/RELEASE-0.3-EVIDENCE.md",
-		"docs/SIGNED-UPDATES.md",
+		"docs/REPOSITORIES-AND-WORKTREES.md",
+		"docs/SCIP-IMPORT.md",
 		"docs/SHARED-INDEX-CONTRACT.md",
+		"docs/SIGNED-UPDATES.md",
+		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
+		"docs/TELEMETRY.md",
+		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
+		"docs/assets/knodin-favicon.svg",
+		"docs/prompts/declare-multi-repository-system.md",
+		"docs/releases/0.10.0.md",
+		"docs/releases/0.10.1.md",
+		"docs/releases/0.10.2.md",
+		"docs/releases/0.10.3.md",
+		"docs/releases/0.10.4.md",
+		"docs/releases/0.10.5.md",
+		"docs/releases/0.10.6.md",
+		"docs/releases/0.10.7.md",
 		"docs/releases/0.3.0.md",
 		"docs/releases/0.4.0.md",
 		"docs/releases/0.4.1.md",
@@ -71,25 +84,14 @@
 		"docs/releases/0.8.6.md",
 		"docs/releases/0.8.7.md",
 		"docs/releases/0.9.0.md",
-		"docs/releases/0.10.0.md",
-		"docs/releases/0.10.1.md",
-		"docs/releases/0.10.2.md",
-		"docs/releases/0.10.3.md",
-		"docs/releases/0.10.4.md",
-		"docs/releases/0.10.5.md",
-		"docs/assets/knodin-favicon.svg",
-		"docs/SYSTEMS-AND-RELATIONSHIPS.md",
-		"docs/TELEMETRY.md",
-		"docs/TOKEN-OPTIMIZER-SCORECARD.md",
-		"benchmarks/competitors/SYNTHESIS.md",
 		"roadmap/competitive-roadmap.md",
 		"schemas/release-attestation-v1.schema.json",
-		"schemas/support-bundle-v2.schema.json",
-		"schemas/shared-index-config-v1.schema.json",
 		"schemas/shared-index-branch-pointer-v1.schema.json",
+		"schemas/shared-index-config-v1.schema.json",
 		"schemas/shared-index-manifest-v1.schema.json",
 		"schemas/shared-index-provenance-v1.schema.json",
-		"*.wasm"
+		"schemas/support-bundle-v2.schema.json",
+		"skills"
 	],
 	"engines": {
 		"node": ">=24.0.0"