nexusmem 0.10.4 → 0.10.5

package/dist/cli/index.js

@@ -2,7 +2,7 @@
 
 // src/cli/index.ts
 import { Command, Option } from "commander";
-import pc22 from "picocolors";
+import pc23 from "picocolors";
 
 // src/config/workspace.ts
 import { existsSync } from "fs";
@@ -514,16 +514,27 @@ function resolveZshProfilePath() {
   return join3(homedir2(), ".zshrc");
 }
 
+// src/hooks/recorder-command.ts
+import { fileURLToPath as fileURLToPath2 } from "url";
+function defaultRecorderCommand() {
+  return { node: process.execPath, script: fileURLToPath2(new URL("../../dist/cli/recorder.js", import.meta.url)) };
+}
+function forPosixShell(path) {
+  return /^[A-Za-z]:\\/.test(path) ? path.replace(/\\/g, "/") : path;
+}
+
 // src/hooks/bash.ts
 var MARK_START = "# >>> nexusmem shell hook >>>";
 var MARK_END = "# <<< nexusmem shell hook <<<";
 function toBashLiteral(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function renderHookSnippet(logPath) {
+function renderHookSnippet(logPath, recorder = defaultRecorderCommand()) {
   return [
     MARK_START,
     `__nxm_log_path=${toBashLiteral(logPath)}`,
+    `__nxm_node=${toBashLiteral(forPosixShell(recorder.node))}`,
+    `__nxm_recorder=${toBashLiteral(forPosixShell(recorder.script))}`,
     '__nxm_cmd_start=""',
     '__nxm_last_cmd=""',
     '__nxm_debug_trap_owned=""',
@@ -534,6 +545,7 @@ function renderHookSnippet(logPath) {
     '  s=${s//\\"/\\\\\\"}',
     "  s=${s//$'\\n'/\\\\n}",
     "  s=${s//$'\\t'/\\\\t}",
+    "  s=${s//$'\\r'/\\\\r}",
     `  printf '%s' "$s"`,
     "}",
     "",
@@ -569,12 +581,12 @@ function renderHookSnippet(logPath) {
     "    __nxm_dur=$(( __nxm_ms - __nxm_cmd_start ))",
     "  fi",
     "",
-    "  local __nxm_dir",
-    '  __nxm_dir=$(dirname -- "$__nxm_log_path" 2>/dev/null)',
-    '  [ -d "$__nxm_dir" ] || mkdir -p "$__nxm_dir" 2>/dev/null',
-    `  printf '{"ts":"%s","cwd":"%s","exitCode":%s,"durationMs":%s,"command":"%s","shell":"bash-hook"}\\n' \\`,
+    "  local __nxm_event",
+    `  __nxm_event=$(printf '{"ts":"%s","cwd":"%s","exitCode":%s,"durationMs":%s,"command":"%s"}' \\`,
     '    "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" "$(__nxm_json_escape "$PWD")" "$__nxm_exit" "$__nxm_dur" \\',
-    '    "$(__nxm_json_escape "$__nxm_last_cmd")" >> "$__nxm_log_path" 2>/dev/null',
+    '    "$(__nxm_json_escape "$__nxm_last_cmd")")',
+    // Only the recorder's stdin (a pipe, never a file) sees the raw command; it hashes, redacts, then appends.
+    `  ( printf '%s' "$__nxm_event" | "$__nxm_node" "$__nxm_recorder" --log "$__nxm_log_path" --shell bash-hook >/dev/null 2>&1 & )`,
     "",
     '  __nxm_cmd_start=""',
     '  __nxm_last_cmd=""',
@@ -612,12 +624,12 @@ function stripHookSnippet(profileContent) {
   const afterBlock = profileContent.slice(endIdx + MARK_END.length).replace(/^\r?\n/, "");
   return profileContent.slice(0, startIdx) + afterBlock;
 }
-function upsertHookSnippet(profileContent, logPath) {
+function upsertHookSnippet(profileContent, logPath, recorder) {
   const stripped = stripHookSnippet(profileContent).replace(/\s+$/, "");
   const prefix = stripped.length > 0 ? `${stripped}
 
 ` : "";
-  return `${prefix}${renderHookSnippet(logPath)}`;
+  return `${prefix}${renderHookSnippet(logPath, recorder)}`;
 }
 
 // src/hooks/powershell.ts
@@ -626,12 +638,14 @@ var MARK_END2 = "# <<< nexusmem shell hook <<<";
 function toPowerShellLiteral(s) {
   return `'${s.replace(/'/g, "''")}'`;
 }
-function renderHookSnippet2(logPath) {
+function renderHookSnippet2(logPath, recorder = defaultRecorderCommand()) {
   return [
     MARK_START2,
     "if (Test-Path Function:\\prompt) { $function:__ssd_original_prompt = $function:prompt }",
     "$global:__ssd_last_history_id = -1",
     `$global:__ssd_log_path = ${toPowerShellLiteral(logPath)}`,
+    `$global:__ssd_node = ${toPowerShellLiteral(recorder.node)}`,
+    `$global:__ssd_recorder = ${toPowerShellLiteral(recorder.script)}`,
     "function global:prompt {",
     // Must be first: Get-History (or anything else) below would overwrite $?.
     "  $__ssd_ok = $?",
@@ -648,9 +662,19 @@ function renderHookSnippet2(logPath) {
     "        durationMs = [int](($__ssd_h.EndExecutionTime - $__ssd_h.StartExecutionTime).TotalMilliseconds)",
     "        command = $__ssd_h.CommandLine",
     "      }",
-    "      $__ssd_dir = Split-Path -Parent $global:__ssd_log_path",
-    "      if (-not (Test-Path $__ssd_dir)) { New-Item -ItemType Directory -Force -Path $__ssd_dir | Out-Null }",
-    "      Add-Content -LiteralPath $global:__ssd_log_path -Value ($__ssd_entry | ConvertTo-Json -Compress) -Encoding utf8",
+    // The raw command only ever reaches the recorder's stdin (a pipe, never a file); it hashes and redacts before writing.
+    "      $__ssd_psi = New-Object System.Diagnostics.ProcessStartInfo",
+    "      $__ssd_psi.FileName = $global:__ssd_node",
+    `      $__ssd_psi.Arguments = '"{0}" --log "{1}" --shell pwsh-hook' -f $global:__ssd_recorder, $global:__ssd_log_path`,
+    "      $__ssd_psi.UseShellExecute = $false",
+    "      $__ssd_psi.CreateNoWindow = $true",
+    "      $__ssd_psi.RedirectStandardInput = $true",
+    "      $__ssd_p = [System.Diagnostics.Process]::Start($__ssd_psi)",
+    // Bytes, not StandardInput.Write: Windows PowerShell would encode text in the console code page.
+    "      $__ssd_bytes = [System.Text.Encoding]::UTF8.GetBytes(($__ssd_entry | ConvertTo-Json -Compress))",
+    "      $__ssd_p.StandardInput.BaseStream.Write($__ssd_bytes, 0, $__ssd_bytes.Length)",
+    "      $__ssd_p.StandardInput.Close()",
+    "      $__ssd_p.Dispose()",
     "    } catch {}",
     "  }",
     "  if (Test-Path Function:\\__ssd_original_prompt) { & $function:__ssd_original_prompt }",
@@ -670,12 +694,12 @@ function stripHookSnippet2(profileContent) {
   const afterBlock = profileContent.slice(endIdx + MARK_END2.length).replace(/^\r?\n/, "");
   return profileContent.slice(0, startIdx) + afterBlock;
 }
-function upsertHookSnippet2(profileContent, logPath) {
+function upsertHookSnippet2(profileContent, logPath, recorder) {
   const stripped = stripHookSnippet2(profileContent).replace(/\s+$/, "");
   const prefix = stripped.length > 0 ? `${stripped}
 
 ` : "";
-  return `${prefix}${renderHookSnippet2(logPath)}`;
+  return `${prefix}${renderHookSnippet2(logPath, recorder)}`;
 }
 
 // src/hooks/zsh.ts
@@ -684,10 +708,12 @@ var MARK_END3 = "# <<< nexusmem shell hook <<<";
 function toZshLiteral(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function renderHookSnippet3(logPath) {
+function renderHookSnippet3(logPath, recorder = defaultRecorderCommand()) {
   return [
     MARK_START3,
     `__nxm_log_path=${toZshLiteral(logPath)}`,
+    `__nxm_node=${toZshLiteral(forPosixShell(recorder.node))}`,
+    `__nxm_recorder=${toZshLiteral(forPosixShell(recorder.script))}`,
     '__nxm_cmd_start=""',
     '__nxm_last_cmd=""',
     "zmodload zsh/datetime 2>/dev/null",
@@ -698,6 +724,7 @@ function renderHookSnippet3(logPath) {
     '  s=${s//\\"/\\\\\\"}',
     "  s=${s//$'\\n'/\\\\n}",
     "  s=${s//$'\\t'/\\\\t}",
+    "  s=${s//$'\\r'/\\\\r}",
     `  printf '%s' "$s"`,
     "}",
     "",
@@ -726,12 +753,12 @@ function renderHookSnippet3(logPath) {
     "    __nxm_dur=$(( __nxm_now - __nxm_cmd_start ))",
     "  fi",
     "",
-    "  local __nxm_dir",
-    '  __nxm_dir=$(dirname -- "$__nxm_log_path" 2>/dev/null)',
-    '  [ -d "$__nxm_dir" ] || mkdir -p "$__nxm_dir" 2>/dev/null',
-    `  printf '{"ts":"%s","cwd":"%s","exitCode":%s,"durationMs":%s,"command":"%s","shell":"zsh-hook"}\\n' \\`,
+    "  local __nxm_event",
+    `  __nxm_event=$(printf '{"ts":"%s","cwd":"%s","exitCode":%s,"durationMs":%s,"command":"%s"}' \\`,
     '    "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" "$(__nxm_json_escape "$PWD")" "$__nxm_exit" "$__nxm_dur" \\',
-    '    "$(__nxm_json_escape "$__nxm_last_cmd")" >> "$__nxm_log_path" 2>/dev/null',
+    '    "$(__nxm_json_escape "$__nxm_last_cmd")")',
+    // Only the recorder's stdin (a pipe, never a file) sees the raw command; it hashes, redacts, then appends.
+    `  ( printf '%s' "$__nxm_event" | "$__nxm_node" "$__nxm_recorder" --log "$__nxm_log_path" --shell zsh-hook >/dev/null 2>&1 & )`,
     "",
     '  __nxm_cmd_start=""',
     '  __nxm_last_cmd=""',
@@ -755,29 +782,32 @@ function stripHookSnippet3(profileContent) {
   const afterBlock = profileContent.slice(endIdx + MARK_END3.length).replace(/^\r?\n/, "");
   return profileContent.slice(0, startIdx) + afterBlock;
 }
-function upsertHookSnippet3(profileContent, logPath) {
+function upsertHookSnippet3(profileContent, logPath, recorder) {
   const stripped = stripHookSnippet3(profileContent).replace(/\s+$/, "");
   const prefix = stripped.length > 0 ? `${stripped}
 
 ` : "";
-  return `${prefix}${renderHookSnippet3(logPath)}`;
+  return `${prefix}${renderHookSnippet3(logPath, recorder)}`;
 }
 
 // src/hooks/install.ts
 var SHELL_MODULES = {
   pwsh: {
+    renderHookSnippet: (logPath) => renderHookSnippet2(logPath),
     isHookInstalled: isHookInstalled2,
     stripHookSnippet: stripHookSnippet2,
     upsertHookSnippet: upsertHookSnippet2,
     resolveProfilePath: async (override) => override ?? await resolvePowerShellProfilePath()
   },
   bash: {
+    renderHookSnippet: (logPath) => renderHookSnippet(logPath),
     isHookInstalled,
     stripHookSnippet,
     upsertHookSnippet,
     resolveProfilePath: async (override) => override ?? resolveBashProfilePath()
   },
   zsh: {
+    renderHookSnippet: (logPath) => renderHookSnippet3(logPath),
     isHookInstalled: isHookInstalled3,
     stripHookSnippet: stripHookSnippet3,
     upsertHookSnippet: upsertHookSnippet3,
@@ -830,8 +860,14 @@ async function removeHook(target) {
 }
 async function hookStatus(target) {
   const mod = SHELL_MODULES[target.shell];
-  const current = await readProfile(target.profilePath);
-  return { installed: mod.isHookInstalled(current) };
+  const current = (await readProfile(target.profilePath)).replace(/\r\n/g, "\n");
+  const installed = mod.isHookInstalled(current);
+  const expected = mod.renderHookSnippet(target.logPath).trimEnd();
+  const endMarker = expected.slice(expected.lastIndexOf("\n") + 1);
+  const start = current.indexOf(expected.slice(0, expected.indexOf("\n")));
+  const end = current.indexOf(endMarker, start);
+  const upToDate = installed && start !== -1 && end !== -1 && current.slice(start, end + endMarker.length) === expected;
+  return { installed, upToDate };
 }
 
 // src/hooks/install-git-precommit.ts
@@ -2626,7 +2662,7 @@ async function runHookStatus(opts) {
       `${pc3.dim("shell  ")} ${target.shell}`,
       `${pc3.dim("profile")} ${target.profilePath}`,
       `${pc3.dim("log    ")} ${target.logPath}`,
-      `${pc3.dim("status ")} ${result.installed ? pc3.green("installed") : pc3.yellow("not installed")}`,
+      `${pc3.dim("status ")} ${!result.installed ? pc3.yellow("not installed") : result.upToDate ? pc3.green("installed") : pc3.yellow("installed, OUTDATED -- run `nexusmem hook install` again (hooks before 0.10.5 write commands to disk unredacted)")}`,
       ""
     ].join("\n")
   );
@@ -3467,6 +3503,7 @@ var OllamaEmbeddingProvider = class {
 };
 
 // src/cli/commands/sync.ts
+import { existsSync as existsSync5 } from "fs";
 import pc7 from "picocolors";
 
 // src/conversation/chunk.ts
@@ -3506,6 +3543,16 @@ function chunkAssistantText(text, maxChars) {
 }
 
 // src/conversation/redact.ts
+var MARK = "[redacted]";
+var NOT_MARK = String.raw`(?!\[redacted\])`;
+var keepPrefix = (groups) => `${groups[0]}${MARK}`;
+var SECRET_KEYWORD = String.raw`(?:(?:pass(?:word|wd|phrase)|secret|credential|api[_-]?key|(?:access|private|secret|client|signing|encryption|master)[_-]?key)s?|token)`;
+var SECRET_KEY = String.raw`(?:[A-Za-z0-9_.-]{0,100}?${SECRET_KEYWORD}|(?:-{1,2}|(?:[A-Za-z0-9]{1,40}[_.-]){1,8})pass)(?:[_.-][A-Za-z0-9]{1,40}){0,8}`;
+var TYPE_WORD = String.raw`(?:string|number|boolean|bool|int|str|null|undefined|none|nil|true|false|any|unknown|object)(?=[\s;,)|\]}>]|$)`;
+var SECRET_VALUE = String.raw`(?:"[^"\r\n]+"|'[^'\r\n]+'|\x60[^\x60\r\n]+\x60|[^\s'"\x60]+)`;
+var SAME_COMMAND = String.raw`[^\n|;&]{0,500}?`;
+var NOT_FLAG_OR_REDIRECT = String.raw`(?![-<>|&;])`;
+var AUTH_SCHEME = String.raw`(?:bearer|basic|token|digest|negotiate|ntlm)`;
 var RULES = [
   {
     name: "private-key-block",
@@ -3520,11 +3567,101 @@ var RULES = [
     pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
     highConfidence: true
   },
-  // key/token/secret/password = "value" or : value, in code, JSON, env-file or prose form.
+  // scheme://user:password@host -- the password may itself contain `@`, so the host starts after the last one.
+  {
+    name: "uri-credentials",
+    pattern: new RegExp(
+      String.raw`(\b[a-z][a-z0-9+.-]{1,30}://[^\s/?#'"@:]*:)${NOT_MARK}[^\s/?#'"]+(?=@[^\s/?#'"@]*(?:[/?#\s'"]|$))`,
+      "gi"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // A bearer token outside a header (`--oauth2-bearer x`); it must contain a digit so "bearer authentication" is left alone.
+  {
+    name: "bearer-token",
+    pattern: new RegExp(String.raw`(\bbearer[ \t]+)${NOT_MARK}(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{16,}=*`, "gi"),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Tool-anchored password arguments: `-p` means port or parents almost everywhere else. Case-sensitive (`-P` is mysql's port).
+  // mysql takes only the compact `-psecret` form; `-p secret` means "prompt, then use database secret".
+  {
+    name: "mysql-password-arg",
+    pattern: new RegExp(
+      String.raw`(\b(?:mysql|mysqldump|mysqladmin|mysqlimport|mysqlsh|mariadb|mariadb-dump)(?=[ \t])${SAME_COMMAND}[ \t]-p)${NOT_MARK}(?=\S)${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Only sshpass's own options may precede -p, so a wrapped `ssh -p 22` is never read as the password.
+  {
+    name: "sshpass-password-arg",
+    pattern: new RegExp(String.raw`(\bsshpass(?:[ \t]+-[^p\s]\S*)*[ \t]+-p[ \t]*)${NOT_MARK}(?=\S)${SECRET_VALUE}`, "g"),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "mongo-password-arg",
+    pattern: new RegExp(
+      String.raw`(\bmongo(?:sh|dump|restore|export|import|stat|top|files)?(?=[ \t])${SAME_COMMAND}[ \t]-p[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "redis-cli-password-arg",
+    pattern: new RegExp(
+      String.raw`(\bredis-cli(?=[ \t])${SAME_COMMAND}[ \t]-a[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  {
+    name: "curl-user-password",
+    pattern: new RegExp(
+      String.raw`(\bcurl(?=[ \t])${SAME_COMMAND}[ \t](?:-u|--user)(?:[ \t]+|=)?["']?[^\s:'"]*:)${NOT_MARK}[^\s'"]+`,
+      "g"
+    ),
+    highConfidence: true,
+    render: keepPrefix
+  },
+  // Authorization: Bearer x / Basic x / token x. The scheme word is kept; it must not be mistaken for the value.
+  {
+    name: "authorization-header",
+    pattern: new RegExp(
+      String.raw`(\b(?:proxy-)?authorization["']?[ \t]*[:=][ \t]*["'\x60]?(?:${AUTH_SCHEME}[ \t]+)?)(?!${AUTH_SCHEME}[ \t])${NOT_MARK}[^\s'"\x60]+`,
+      "gi"
+    ),
+    highConfidence: false,
+    render: keepPrefix
+  },
+  // `--password secret`: a secret-named option whose value is the next argument. The flag must start a
+  // command-line word, so prose like "the `id`-token heuristic" is not read as a `-token` option.
+  {
+    name: "secret-option-arg",
+    pattern: new RegExp(
+      String.raw`(?<=^|[\s'"(])(-{1,2}${SECRET_KEY}[ \t]+)${NOT_FLAG_OR_REDIRECT}${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: false,
+    render: keepPrefix
+  },
+  // key/token/secret/password = "value" or : value, in code, JSON, env-file, shell or prose form.
+  // The key start is an explicit non-identifier lookbehind, not `\b`: `_` is a word character, so
+  // `\b` never fired inside DB_PASSWORD and the value leaked. Found live via `scan-shell`.
   {
     name: "key-value-secret",
-    pattern: /\b((?:api[_-]?key|secret|password|passwd|token|access[_-]?key)s?)\s*[:=]\s*['"]?[A-Za-z0-9_\-./+=]{8,}['"]?/gi,
-    highConfidence: false
+    pattern: new RegExp(
+      String.raw`(?<![A-Za-z0-9_.-])(${SECRET_KEY})["']?[ \t]*[:=](?![=>])[ \t]*(?!${TYPE_WORD})${NOT_MARK}${SECRET_VALUE}`,
+      "gi"
+    ),
+    highConfidence: false,
+    // Keep the key name so the redaction is legible ("apiKey: [redacted]").
+    render: (groups) => `${groups[0]}: ${MARK}`
   }
 ];
 function redact(text, profile = "all") {
@@ -3532,10 +3669,11 @@ function redact(text, profile = "all") {
   let out = text;
   for (const rule of RULES) {
     if (profile === "high-confidence" && !rule.highConfidence) continue;
-    out = out.replace(rule.pattern, (_match, ...rest) => {
+    out = out.replace(rule.pattern, (...args) => {
       redactedCount += 1;
-      const key = typeof rest[0] === "string" ? rest[0] : null;
-      return key ? `${key}: [redacted]` : "[redacted]";
+      const end = args.findIndex((arg, i) => i > 0 && typeof arg === "number");
+      const groups = args.slice(1, end).map((g) => typeof g === "string" ? g : "");
+      return rule.render ? rule.render(groups) : MARK;
     });
   }
   return { text: out, redactedCount };
@@ -4512,7 +4650,8 @@ function toMemoryNode3(entry, projectId, opts = {}) {
     signal: scoreShellCommand(entry),
     provenance: "observed",
     meta: {
-      command: entry.command,
+      command: redactedCommand,
+      commandHash: entry.commandHash ?? sha256Hex(entry.command).slice(0, 12),
       cwd: entry.cwd,
       exitCode: entry.exitCode,
       durationMs: entry.durationMs,
@@ -4864,10 +5003,10 @@ ${full.body}`);
 
 // src/shell/detect.ts
 import { existsSync as existsSync4 } from "fs";
-import { readFile as readFile9, stat as stat2 } from "fs/promises";
+import { readFile as readFile9, stat as stat3 } from "fs/promises";
 
 // src/shell/hook-log.ts
-import { appendFile, mkdir as mkdir5, readFile as readFile8 } from "fs/promises";
+import { appendFile, mkdir as mkdir5, open, readFile as readFile8, rename as rename2, stat as stat2, unlink as unlink2, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname4 } from "path";
 var HOOK_SHELL_KINDS = /* @__PURE__ */ new Set(["pwsh-hook", "bash-hook", "zsh-hook"]);
 function parseHookLogLine(line) {
@@ -4882,7 +5021,9 @@ function parseHookLogLine(line) {
   if (typeof obj !== "object" || obj === null) return null;
   const o = obj;
   if (typeof o.ts !== "string" || typeof o.cwd !== "string" || typeof o.command !== "string") return null;
+  const commandHash = typeof o.commandHash === "string" && /^[0-9a-f]{12}$/.test(o.commandHash) ? o.commandHash : void 0;
   return {
+    ...commandHash ? { commandHash } : {},
     ts: o.ts,
     cwd: o.cwd,
     exitCode: typeof o.exitCode === "number" ? o.exitCode : null,
@@ -4906,6 +5047,87 @@ async function readHookLog(path, fromLine) {
   const entries = allParsed.slice(sliceStart).filter((e) => e !== null);
   return { entries, totalLines: lines.length, shellsSeen };
 }
+function sanitizeLine(line) {
+  if (line.trim().length === 0) return { line, legacy: false };
+  let obj;
+  try {
+    obj = JSON.parse(line);
+  } catch {
+    return { line: redact(line).text, legacy: false };
+  }
+  const o = obj;
+  if (typeof o !== "object" || o === null || typeof o.command !== "string") return { line: redact(line).text, legacy: false };
+  const legacy = typeof o.commandHash !== "string";
+  const raw = o.command;
+  const { text } = redact(raw);
+  if (!legacy && text === raw) return { line, legacy };
+  const commandHash = legacy ? sha256Hex(raw).slice(0, 12) : o.commandHash;
+  return { line: JSON.stringify({ ...o, command: text, commandHash }), legacy };
+}
+function sanitizeText(raw) {
+  const parts = raw.split(/(\r?\n)/);
+  let changed = 0;
+  let legacy = 0;
+  for (let i = 0; i < parts.length; i += 2) {
+    const next = sanitizeLine(parts[i]);
+    if (next.legacy) legacy += 1;
+    if (next.line !== parts[i]) {
+      parts[i] = next.line;
+      changed += 1;
+    }
+  }
+  return { text: parts.join(""), changed, legacy };
+}
+async function readRange(path, start, end) {
+  const fh = await open(path, "r");
+  try {
+    const buf = Buffer.alloc(end - start);
+    await fh.read(buf, 0, buf.length, start);
+    return buf;
+  } finally {
+    await fh.close();
+  }
+}
+var RENAME_BUSY = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
+async function sanitizeHookLog(path, opts = {}) {
+  let raw;
+  try {
+    raw = await readFile8(path);
+  } catch {
+    return { linesChanged: 0, legacyLines: 0 };
+  }
+  const first = sanitizeText(raw.toString("utf8"));
+  if (first.changed === 0 || opts.dryRun) return { linesChanged: first.changed, legacyLines: first.legacy };
+  const tmp = `${path}.${process.pid}.scrub.tmp`;
+  let linesChanged = first.changed;
+  let legacyLines = first.legacy;
+  try {
+    await writeFile6(tmp, first.text, { encoding: "utf8", mode: 384 });
+    let consumed = raw.length;
+    for (let attempt = 0; ; attempt += 1) {
+      const size = (await stat2(path)).size;
+      if (size > consumed) {
+        const extra = sanitizeText((await readRange(path, consumed, size)).toString("utf8"));
+        await appendFile(tmp, extra.text, "utf8");
+        linesChanged += extra.changed;
+        legacyLines += extra.legacy;
+        consumed = size;
+      }
+      try {
+        await rename2(tmp, path);
+        break;
+      } catch (err) {
+        if (attempt >= 20 || !RENAME_BUSY.has(err.code ?? "")) throw err;
+        await new Promise((r) => setTimeout(r, 50));
+      }
+    }
+  } catch (err) {
+    await unlink2(tmp).catch(() => {
+    });
+    throw err;
+  }
+  return { linesChanged, legacyLines };
+}
 
 // src/shell/parse-bash.ts
 var EPOCH_COMMENT = /^#(\d{9,10})$/;
@@ -5016,8 +5238,10 @@ function isUnderRoot(cwd, root) {
 }
 function hookEntryToRaw(e) {
   const shell = e.shell ?? "pwsh-hook";
+  const commandHash = e.commandHash ?? sha256Hex(e.command).slice(0, 12);
   return {
-    naturalKey: `${shell}:${e.ts}:${sha256Hex(e.command).slice(0, 12)}`,
+    naturalKey: `${shell}:${e.ts}:${commandHash}`,
+    commandHash,
     command: e.command,
     ts: e.ts,
     tsApprox: false,
@@ -5029,7 +5253,7 @@ function hookEntryToRaw(e) {
 }
 async function tryReadScrapeSource(path, parse, tailLines) {
   if (!existsSync4(path)) return null;
-  const [raw, stats2] = await Promise.all([readFile9(path, "utf8"), stat2(path)]);
+  const [raw, stats2] = await Promise.all([readFile9(path, "utf8"), stat3(path)]);
   return parse(raw, stats2.mtimeMs, { tailLines });
 }
 async function collectAvailableShellHistory(opts = {}) {
@@ -5163,7 +5387,10 @@ function reconcileProjectId(db, oldProjectId, newProjectId) {
         newProjectId,
         "shell_command",
         source,
-        (row, meta) => typeof meta.command === "string" ? `${prefix}:${row.ts}:${sha256Hex(meta.command).slice(0, 12)}` : null,
+        (row, meta) => {
+          const hash = typeof meta.commandHash === "string" ? meta.commandHash : typeof meta.command === "string" ? sha256Hex(meta.command).slice(0, 12) : null;
+          return hash ? `${prefix}:${row.ts}:${hash}` : null;
+        },
         denyEntries
       );
       hookShell.migrated += r.migrated;
@@ -5900,6 +6127,19 @@ async function syncShell(store, projectId, opts, repoRoot, config, log) {
     repoRoot,
     hookCursor: store.getSyncCursor(projectId, "shell:pwsh-hook")
   });
+  if (existsSync5(hookLogPath())) {
+    try {
+      const { linesChanged, legacyLines } = await sanitizeHookLog(hookLogPath());
+      if (linesChanged > 0) log(`  ${pc7.dim(`shell hook log: redacted ${linesChanged} line(s)`)}`);
+      if (legacyLines > 0) {
+        log(
+          `${pc7.yellow("shell")} ${legacyLines} hook-log line(s) were written by an outdated NexusMem shell hook that stores commands unredacted until a sync -- run \`nexusmem hook install\` again in each shell`
+        );
+      }
+    } catch (err) {
+      log(`${pc7.yellow("shell")} could not redact the hook log (${err.message}) -- run \`nexusmem scrub-secrets --yes\``);
+    }
+  }
   if (results.length === 0) {
     log(`${pc7.dim("shell")} no history source found on this machine`);
     return { totals, seen: 0 };
@@ -6093,10 +6333,10 @@ async function runAutoContradictionCheck(store, config, projectId, providers) {
     maxJudgments: config.contradictions.maxPerSync,
     model: config.contradictions.model
   });
-  const open = store.countContradictionSuggestions(projectId);
-  if (fresh.length === 0 && open === 0) return "";
+  const open2 = store.countContradictionSuggestions(projectId);
+  if (fresh.length === 0 && open2 === 0) return "";
   const freshPart = fresh.length > 0 ? pc7.yellow(`${fresh.length} new`) : `${fresh.length} new`;
-  return `  ${pc7.dim("contradictions:")} ${freshPart}${pc7.dim(`, ${open} open suggestion(s) -- run`)} ${pc7.bold("nexusmem stale")} ${pc7.dim("for detail")}
+  return `  ${pc7.dim("contradictions:")} ${freshPart}${pc7.dim(`, ${open2} open suggestion(s) -- run`)} ${pc7.bold("nexusmem stale")} ${pc7.dim("for detail")}
 `;
 }
 async function runSync(opts) {
@@ -7154,8 +7394,286 @@ ${pc19.bold(String(edges.length))} edge(s) from ${filesScanned} tracked ${TRACKE
   return 0;
 }
 
-// src/cli/commands/stale.ts
+// src/cli/commands/scrub-secrets.ts
+import { existsSync as existsSync6 } from "fs";
+import { dirname as dirname6 } from "path";
 import pc20 from "picocolors";
+
+// src/store/scrub.ts
+import { chmod as chmod2, readdir as readdir2 } from "fs/promises";
+import { basename as basename4, dirname as dirname5, join as join12 } from "path";
+import Database2 from "better-sqlite3";
+var KIND_PROFILES = {
+  shell_command: "all",
+  conversation_turn: "all",
+  session_summary: "all",
+  code_diff: "high-confidence"
+};
+var SCRUB_KINDS = Object.keys(KIND_PROFILES);
+var ScrubRaceError = class extends Error {
+};
+function scrubMeta(kind, raw) {
+  let meta;
+  try {
+    meta = JSON.parse(raw);
+  } catch {
+    return redact(raw, KIND_PROFILES[kind]).text;
+  }
+  if (typeof meta !== "object" || meta === null) return raw;
+  const m = meta;
+  let changed = false;
+  if (kind === "shell_command" && typeof m.command === "string") {
+    const command = redact(m.command).text;
+    if (command !== m.command) {
+      if (typeof m.commandHash !== "string") m.commandHash = sha256Hex(m.command).slice(0, 12);
+      m.command = command;
+      changed = true;
+    }
+  }
+  if (kind === "conversation_turn" && typeof m.heading === "string") {
+    const heading = redact(m.heading).text;
+    if (heading !== m.heading) {
+      m.heading = heading;
+      changed = true;
+    }
+  }
+  return changed ? JSON.stringify(m) : raw;
+}
+function hasTable(db, name) {
+  return db.prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`).get(name) !== void 0;
+}
+function plan(db) {
+  const byKind = Object.fromEntries(SCRUB_KINDS.map((k) => [k, { scanned: 0, changed: 0 }]));
+  const rows = [];
+  const select = db.prepare(
+    `SELECT rowid, kind, title, body, meta FROM nodes WHERE kind IN (${SCRUB_KINDS.map(() => "?").join(", ")})`
+  );
+  for (const row of select.iterate(...SCRUB_KINDS)) {
+    const profile = KIND_PROFILES[row.kind];
+    const title = redact(row.title, profile).text;
+    const body = redact(row.body, profile).text;
+    const meta = scrubMeta(row.kind, row.meta);
+    byKind[row.kind].scanned += 1;
+    if (title === row.title && body === row.body && meta === row.meta) continue;
+    byKind[row.kind].changed += 1;
+    rows.push({ rowid: row.rowid, title, body, meta, textChanged: title !== row.title || body !== row.body });
+  }
+  const reasons = [];
+  if (hasTable(db, "contradiction_checks")) {
+    const select2 = db.prepare("SELECT rowid, reason FROM contradiction_checks WHERE reason IS NOT NULL");
+    for (const r of select2.iterate()) {
+      const reason = redact(r.reason).text;
+      if (reason !== r.reason) reasons.push({ rowid: r.rowid, reason });
+    }
+  }
+  return { byKind, rows, reasons };
+}
+async function listBackups(dbPath) {
+  const prefix = `${basename4(dbPath)}.backup-`;
+  try {
+    return (await readdir2(dirname5(dbPath))).filter((name) => name.startsWith(prefix)).sort().map((name) => join12(dirname5(dbPath), name));
+  } catch {
+    return [];
+  }
+}
+function purgeRemnants(db) {
+  db.exec(`INSERT INTO nodes_fts (nodes_fts) VALUES ('rebuild')`);
+  try {
+    db.exec("VACUUM");
+  } catch (err) {
+    if (String(err.code ?? "").startsWith("SQLITE_BUSY")) return false;
+    throw err;
+  }
+  const [checkpoint] = db.pragma("wal_checkpoint(TRUNCATE)");
+  return checkpoint?.busy === 0;
+}
+async function scrubDatabase(dbPath, opts) {
+  const existingBackups = await listBackups(dbPath);
+  const base = { dbPath, existingBackups, embeddingsDropped: 0, reembedded: 0, embeddingsPending: 0 };
+  if (!opts.apply) {
+    const db2 = new Database2(dbPath, { readonly: true, fileMustExist: true });
+    try {
+      const p = plan(db2);
+      return {
+        ...base,
+        applied: false,
+        byKind: p.byKind,
+        rowsChanged: p.rows.length,
+        contradictionReasonsChanged: p.reasons.length,
+        backupPath: null,
+        remnantsPurged: null
+      };
+    } finally {
+      db2.close();
+    }
+  }
+  const store = MemoryStore.open(dbPath);
+  const db = store.raw;
+  try {
+    let backupPath = null;
+    const first = plan(db);
+    if (first.rows.length + first.reasons.length > 0) {
+      const stamp = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      backupPath = `${dbPath}.backup-${stamp}-pre-scrub-secrets`;
+      await db.backup(backupPath);
+      await chmod2(backupPath, 384).catch(() => {
+      });
+    }
+    const updateNode = db.prepare("UPDATE nodes SET title = ?, body = ?, meta = ? WHERE rowid = ?");
+    const dropVector = db.prepare("DELETE FROM nodes_vec WHERE rowid = ?");
+    const updateReason = db.prepare("UPDATE contradiction_checks SET reason = ? WHERE rowid = ?");
+    const { applied, dropped } = db.transaction(() => {
+      const p = plan(db);
+      if (!backupPath && p.rows.length + p.reasons.length > 0) {
+        throw new ScrubRaceError("the database changed while it was being scrubbed -- nothing was modified; re-run");
+      }
+      let dropped2 = 0;
+      for (const c of p.rows) {
+        updateNode.run(c.title, c.body, c.meta, c.rowid);
+        if (c.textChanged) dropped2 += dropVector.run(BigInt(c.rowid)).changes;
+      }
+      for (const r of p.reasons) updateReason.run(r.reason, r.rowid);
+      return { applied: p, dropped: dropped2 };
+    })();
+    let reembedded = 0;
+    let pending = dropped;
+    if (opts.embeddingProvider && dropped > 0) {
+      const changedRowids = applied.rows.filter((c) => c.textChanged).map((c) => c.rowid);
+      const projects = db.prepare(`SELECT DISTINCT project_id AS p FROM nodes WHERE rowid IN (${changedRowids.map(() => "?").join(", ")})`).all(...changedRowids);
+      pending = 0;
+      for (const { p } of projects) {
+        const r = await embedPendingNodes(store, opts.embeddingProvider, p);
+        reembedded += r.embedded;
+        pending += r.remaining;
+      }
+    }
+    const remnantsPurged = purgeRemnants(db);
+    return {
+      ...base,
+      applied: true,
+      byKind: applied.byKind,
+      rowsChanged: applied.rows.length,
+      contradictionReasonsChanged: applied.reasons.length,
+      embeddingsDropped: dropped,
+      reembedded,
+      embeddingsPending: Math.min(pending, dropped),
+      backupPath,
+      remnantsPurged
+    };
+  } finally {
+    store.close();
+  }
+}
+
+// src/cli/commands/scrub-secrets.ts
+async function runScrubSecrets(opts) {
+  const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
+  let incomplete = false;
+  const logPath = hookLogPath();
+  out(`${pc20.bold("shell hook log")} ${logPath}
+`);
+  if (!existsSync6(logPath)) {
+    out(`  ${pc20.dim("not present on this machine")}
+`);
+  } else {
+    try {
+      const { linesChanged, legacyLines } = await sanitizeHookLog(logPath, { dryRun: !opts.yes });
+      out(`  ${linesChanged} line(s) ${opts.yes ? "redacted" : "to redact"}
+`);
+      if (legacyLines > 0) {
+        out(
+          `  ${pc20.yellow(`${legacyLines} line(s) came from an outdated shell hook`)} that writes commands unredacted -- run \`nexusmem hook install\` again in each shell (see \`nexusmem hook status\`)
+`
+        );
+      }
+    } catch (err) {
+      incomplete = true;
+      out(`  ${pc20.red("could not redact the hook log")}: ${err.message}
+`);
+    }
+  }
+  const dbPaths = opts.allProjects ? [...new Set((await readLiveRegistry()).entries.map((e) => e.dbPath))] : [resolveWorkspace((await readRepoInfo(opts.cwd)).root).dbPath];
+  for (const dbPath of dbPaths) {
+    out(`
+${pc20.bold(dbPath)}
+`);
+    if (!existsSync6(dbPath)) {
+      out(`  ${pc20.dim("no database -- nothing to scrub")}
+`);
+      continue;
+    }
+    const lock = opts.yes ? acquireSyncLock(dirname6(dbPath)) : null;
+    if (opts.yes && !lock) {
+      incomplete = true;
+      out(`  ${pc20.yellow("a background sync is using this database -- re-run when it finishes")}
+`);
+      continue;
+    }
+    try {
+      const report = await scrubDatabase(dbPath, {
+        apply: opts.yes,
+        embeddingProvider: opts.yes && opts.embed ? new OllamaEmbeddingProvider() : null
+      });
+      printReport(report, out);
+      if (report.remnantsPurged === false) incomplete = true;
+    } catch (err) {
+      incomplete = true;
+      out(`  ${pc20.red("scrub failed")}: ${err.message}
+`);
+    } finally {
+      lock?.release();
+    }
+  }
+  if (!opts.yes) {
+    out(
+      `
+${pc20.bold("Dry run")}: nothing was changed. Re-run with --yes to back up each database, redact it in place, drop and re-embed stale vectors, rebuild the FTS index, VACUUM, and truncate the WAL.
+`
+    );
+  }
+  return incomplete ? 1 : 0;
+}
+function printReport(r, out) {
+  for (const kind of SCRUB_KINDS) {
+    const { scanned, changed } = r.byKind[kind];
+    out(`  ${kind.padEnd(22)} ${String(scanned).padStart(6)} scanned  ${changed} ${r.applied ? "redacted" : "to redact"}
+`);
+  }
+  out(`  ${"contradiction reasons".padEnd(22)} ${" ".repeat(14)}${r.contradictionReasonsChanged} ${r.applied ? "redacted" : "to redact"}
+`);
+  if (r.applied) {
+    if (r.backupPath) {
+      out(`  ${pc20.bold("backup")}  ${r.backupPath}
+`);
+      out(
+        `  ${pc20.yellow("WARNING")} that backup was taken BEFORE redaction and still contains every secret removed here. Verify this database, then delete the backup yourself -- NexusMem never deletes backups.
+`
+      );
+    } else {
+      out(`  ${pc20.dim("no row needed redaction -- no backup taken")}
+`);
+    }
+    if (r.embeddingsDropped > 0) {
+      out(
+        `  dropped ${r.embeddingsDropped} stale embedding(s), re-embedded ${r.reembedded}` + (r.embeddingsPending > 0 ? `; ${r.embeddingsPending} still pending (the next \`nexusmem sync\` embeds them)` : "") + "\n"
+      );
+    }
+    out(
+      r.remnantsPurged ? `  FTS index rebuilt, database VACUUMed, WAL truncated
+` : `  ${pc20.yellow("on-disk remnants NOT purged")}: the rows are redacted, but another process (MCP server, VS Code extension, a running sync) has this database open, which blocks VACUUM / WAL truncation. Close it and re-run \`nexusmem scrub-secrets --yes\`.
+`
+    );
+  }
+  if (r.existingBackups.length > 0) {
+    out(`  ${pc20.yellow("older backups")} (may hold unredacted secrets; NexusMem never deletes them):
+`);
+    for (const path of r.existingBackups) out(`    ${path}
+`);
+  }
+}
+
+// src/cli/commands/stale.ts
+import pc21 from "picocolors";
 var STALE_DEFAULT_MODEL = DEFAULT_SLM_MODEL;
 async function runStale(opts) {
   const { projectId, ws } = await loadContext(opts.cwd);
@@ -7165,15 +7683,15 @@ async function runStale(opts) {
     if (opts.dismiss) {
       const dismissed = store.dismissContradictionSuggestion(projectId, opts.dismiss);
       out(
-        dismissed > 0 ? `${pc20.green("dismissed")} the contradiction suggestion for ${opts.dismiss} -- it will not resurface
-` : `${pc20.dim("no open contradiction suggestion")} for ${opts.dismiss} -- nothing to dismiss
+        dismissed > 0 ? `${pc21.green("dismissed")} the contradiction suggestion for ${opts.dismiss} -- it will not resurface
+` : `${pc21.dim("no open contradiction suggestion")} for ${opts.dismiss} -- nothing to dismiss
 `
       );
       return 0;
     }
     const candidates = store.listStaleCandidates(projectId, { minAgeDays: opts.minAgeDays, limit: opts.limit });
     if (candidates.length === 0) {
-      out(`${pc20.dim("no stale candidates")} -- no unconfirmed node older than the threshold lacks a successor
+      out(`${pc21.dim("no stale candidates")} -- no unconfirmed node older than the threshold lacks a successor
 `);
       return 0;
     }
@@ -7195,15 +7713,15 @@ async function runStale(opts) {
     for (const s of suggestions) byCandidateId.set(s.candidateId, s);
     out(
       [
-        `${pc20.bold(String(candidates.length))} stale candidate(s) -- oldest first, none of these were changed:`,
+        `${pc21.bold(String(candidates.length))} stale candidate(s) -- oldest first, none of these were changed:`,
         ...candidates.map((c) => {
-          const line = `  ${pc20.dim(c.id)} ${pc20.yellow(`${c.ageDays}d old`)} [${c.kind}] ${c.title}`;
+          const line = `  ${pc21.dim(c.id)} ${pc21.yellow(`${c.ageDays}d old`)} [${c.kind}] ${c.title}`;
           const hit = byCandidateId.get(c.id);
           return hit ? `${line}
-    ${pc20.red("likely superseded by")} ${pc20.dim(hit.againstId)} ${hit.againstTitle} -- ${hit.reason}` : line;
+    ${pc21.red("likely superseded by")} ${pc21.dim(hit.againstId)} ${hit.againstTitle} -- ${hit.reason}` : line;
         }),
         "",
-        `run ${pc20.bold("nexusmem mark-stale <id> --supersedes <newId>")} on any that are actually wrong`
+        `run ${pc21.bold("nexusmem mark-stale <id> --supersedes <newId>")} on any that are actually wrong`
       ].join("\n").concat("\n")
     );
     return 0;
@@ -7213,10 +7731,10 @@ async function runStale(opts) {
 }
 
 // src/cli/commands/status.ts
-import { basename as basename4, join as join12 } from "path";
+import { basename as basename5, join as join13 } from "path";
 import { statSync } from "fs";
 import { readFile as readFile11 } from "fs/promises";
-import pc21 from "picocolors";
+import pc22 from "picocolors";
 function daySpan(oldest, newest) {
   const oldestDay = Date.parse(oldest.slice(0, 10));
   const newestDay = Date.parse(newest.slice(0, 10));
@@ -7234,7 +7752,7 @@ function buildShareText(repo, stats2, chains) {
     (p) => !p.startsWith("0 ")
   );
   const lines = [
-    `NexusMem has been watching ${basename4(repo.root)} for ${days} day(s):`,
+    `NexusMem has been watching ${basename5(repo.root)} for ${days} day(s):`,
     `  ${stats2.total} memories${parts.length ? ` (${parts.join(", ")})` : ""}`
   ];
   if (chains.failuresTotal) {
@@ -7275,7 +7793,7 @@ async function getShellHookStatus(injected) {
 }
 async function readLastAutoSync(repoRoot) {
   try {
-    const raw = await readFile11(join12(repoRoot, STATE_PATH), "utf8");
+    const raw = await readFile11(join13(repoRoot, STATE_PATH), "utf8");
     return parsePostCommitSyncState(raw);
   } catch {
     return null;
@@ -7311,46 +7829,46 @@ async function runStatus(opts) {
       postCommitGitHookStatus(postCommitTarget)
     ]);
     const now = (opts.now ?? Date.now)();
-    const hooksPathNote2 = (target) => target.hooksPathConfig ? pc21.dim(` (core.hooksPath=${target.hooksPathConfig})`) : "";
-    const installedLabel = (installed) => installed ? pc21.green("installed") : pc21.yellow("not installed");
-    const lastAutoSyncLabel = lastAutoSync ? `${lastAutoSync.ok ? pc21.green("ok") : pc21.red(`FAILED (exit ${lastAutoSync.exitCode})`)} ${pc21.dim(relativeTime(Date.parse(lastAutoSync.ts), now))}` : postCommitStatus.installed ? pc21.dim("never (or hook predates this field -- reinstall with `nexusmem hook git-post install`)") : pc21.dim("n/a -- hook not installed");
+    const hooksPathNote2 = (target) => target.hooksPathConfig ? pc22.dim(` (core.hooksPath=${target.hooksPathConfig})`) : "";
+    const installedLabel = (installed) => installed ? pc22.green("installed") : pc22.yellow("not installed");
+    const lastAutoSyncLabel = lastAutoSync ? `${lastAutoSync.ok ? pc22.green("ok") : pc22.red(`FAILED (exit ${lastAutoSync.exitCode})`)} ${pc22.dim(relativeTime(Date.parse(lastAutoSync.ts), now))}` : postCommitStatus.installed ? pc22.dim("never (or hook predates this field -- reinstall with `nexusmem hook git-post install`)") : pc22.dim("n/a -- hook not installed");
     const hooksLines = [
-      pc21.dim("hooks"),
-      `    ${pc21.dim(`shell (${shellHook?.shell ?? "?"})`.padEnd(23))} ${shellHook ? installedLabel(shellHook.installed) : pc21.dim("unknown -- could not detect this machine\u2019s shell profile")}`,
-      `    ${pc21.dim("git pre-commit".padEnd(23))} ${installedLabel(preCommitStatus.installed)}${hooksPathNote2(preCommitTarget)}`,
-      `    ${pc21.dim("git post-commit".padEnd(23))} ${installedLabel(postCommitStatus.installed)}${hooksPathNote2(postCommitTarget)}`,
-      `    ${pc21.dim("last auto-sync".padEnd(23))} ${lastAutoSyncLabel}`
+      pc22.dim("hooks"),
+      `    ${pc22.dim(`shell (${shellHook?.shell ?? "?"})`.padEnd(23))} ${shellHook ? installedLabel(shellHook.installed) : pc22.dim("unknown -- could not detect this machine\u2019s shell profile")}`,
+      `    ${pc22.dim("git pre-commit".padEnd(23))} ${installedLabel(preCommitStatus.installed)}${hooksPathNote2(preCommitTarget)}`,
+      `    ${pc22.dim("git post-commit".padEnd(23))} ${installedLabel(postCommitStatus.installed)}${hooksPathNote2(postCommitTarget)}`,
+      `    ${pc22.dim("last auto-sync".padEnd(23))} ${lastAutoSyncLabel}`
     ];
     const dbBytes = fileSize(ws.dbPath) + fileSize(`${ws.dbPath}-wal`);
     const kinds = Object.entries(stats2.byKind).sort((a, b) => b[1] - a[1]).map(([kind, n]) => `    ${String(n).padStart(6)}  ${kind}`);
-    const staleProjectWarning = otherProjectIds.length ? `${pc21.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc21.bold(
+    const staleProjectWarning = otherProjectIds.length ? `${pc22.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc22.bold(
       "nexusmem sync --prune-source <name>"
     )} to remove stale source data` : "";
     out(
       [
-        `${pc21.dim("repo    ")} ${repo.root}`,
-        `${pc21.dim("branch  ")} ${repo.branch ?? pc21.yellow("(detached)")}`,
-        `${pc21.dim("project ")} ${pc21.cyan(projectId)}`,
-        `${pc21.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc21.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
-        `${pc21.dim("database")} ${ws.dbPath} ${pc21.dim(`(${humanBytes(dbBytes)})`)}`,
+        `${pc22.dim("repo    ")} ${repo.root}`,
+        `${pc22.dim("branch  ")} ${repo.branch ?? pc22.yellow("(detached)")}`,
+        `${pc22.dim("project ")} ${pc22.cyan(projectId)}`,
+        `${pc22.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc22.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
+        `${pc22.dim("database")} ${ws.dbPath} ${pc22.dim(`(${humanBytes(dbBytes)})`)}`,
         staleProjectWarning,
         "",
-        `${pc21.bold(String(stats2.total))} node(s)${stats2.total ? ` ${pc21.dim(`${stats2.oldest?.slice(0, 10)} .. ${stats2.newest?.slice(0, 10)}`)}` : ""}`,
+        `${pc22.bold(String(stats2.total))} node(s)${stats2.total ? ` ${pc22.dim(`${stats2.oldest?.slice(0, 10)} .. ${stats2.newest?.slice(0, 10)}`)}` : ""}`,
         ...kinds,
-        stats2.total ? `    ${pc21.dim(`${stats2.distinctFiles} distinct file path(s)`)}` : "",
+        stats2.total ? `    ${pc22.dim(`${stats2.distinctFiles} distinct file path(s)`)}` : "",
         "",
-        sources.length ? pc21.dim("sources") : pc21.yellow("no sources synced yet"),
+        sources.length ? pc22.dim("sources") : pc22.yellow("no sources synced yet"),
         ...sources.map((s) => {
           const when = s.lastRunAt ? new Date(s.lastRunAt).toISOString().slice(0, 16).replace("T", " ") : "never";
           const cursorLabel = s.source === "git" ? s.cursor?.slice(0, 7) ?? "-" : s.cursor ?? "-";
-          return `    ${s.source.padEnd(14)} ${pc21.dim(`last run ${when}`)}  ${pc21.dim(`cursor ${cursorLabel}`)}`;
+          return `    ${s.source.padEnd(14)} ${pc22.dim(`last run ${when}`)}  ${pc22.dim(`cursor ${cursorLabel}`)}`;
         }),
         "",
-        gitCursor && gitCursor !== repo.head ? `${pc21.yellow("git behind HEAD")} \u2014 run ${pc21.bold("nexusmem sync")}` : "",
-        chains.failuresTotal ? `${pc21.dim("chains  ")} ${pc21.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc21.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc21.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
-        structure.edges ? `${pc21.dim("structure")} ${pc21.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : "",
-        staleCount ? `${pc21.dim("aging   ")} ${pc21.bold(String(staleCount))} unconfirmed node(s) worth a look \u2014 run ${pc21.bold("nexusmem stale")}` : "",
-        flaggedCount ? `${pc21.dim("flagged ")} ${pc21.bold(String(flaggedCount))} likely-superseded node(s) awaiting review \u2014 run ${pc21.bold("nexusmem stale")} for detail` : "",
+        gitCursor && gitCursor !== repo.head ? `${pc22.yellow("git behind HEAD")} \u2014 run ${pc22.bold("nexusmem sync")}` : "",
+        chains.failuresTotal ? `${pc22.dim("chains  ")} ${pc22.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc22.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc22.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
+        structure.edges ? `${pc22.dim("structure")} ${pc22.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : "",
+        staleCount ? `${pc22.dim("aging   ")} ${pc22.bold(String(staleCount))} unconfirmed node(s) worth a look \u2014 run ${pc22.bold("nexusmem stale")}` : "",
+        flaggedCount ? `${pc22.dim("flagged ")} ${pc22.bold(String(flaggedCount))} likely-superseded node(s) awaiting review \u2014 run ${pc22.bold("nexusmem stale")} for detail` : "",
         "",
         ...hooksLines
       ].filter((line) => line !== "").join("\n").concat("\n")
@@ -7375,7 +7893,7 @@ function guard(run) {
       process.exitCode = await run();
     } catch (err) {
       if (isExpected(err)) {
-        process.stderr.write(`${pc22.red("error")} ${err.message}
+        process.stderr.write(`${pc23.red("error")} ${err.message}
 `);
         process.exitCode = 1;
         return;
@@ -7488,6 +8006,13 @@ program.command("forget").description(
     })
   )()
 );
+program.command("scrub-secrets").description(
+  "Redact secrets that older versions already stored (database rows, FTS index, embeddings, shell hook log) -- dry-run unless --yes"
+).option("-C, --cwd <path>", "repository path", process.cwd()).option("-a, --all-projects", "every repository in the NexusMem registry, not just this one", false).option("--no-embed", "leave re-embedding the redacted nodes to the next sync").option("--yes", "back up each database, then redact it in place", false).action(
+  (options) => guard(
+    () => runScrubSecrets({ cwd: options.cwd, allProjects: options.allProjects, yes: options.yes, embed: options.embed })
+  )()
+);
 program.command("mark-stale").description(
   "Mark a node as superseded by another -- the ranker down-weights it (never deletes it) so its replacement usually outranks it"
 ).argument("<nodeId>", "id of the node to mark stale").requiredOption("--supersedes <newNodeId>", "id of the node that supersedes it").option("-C, --cwd <path>", "repository path", process.cwd()).action(
@@ -7577,7 +8102,7 @@ program.command("scan-structure").description("Preview the JS/TS/Python/Go/Rust/
 program.command("mcp").description("Start the MCP server (stdio transport) for Claude Desktop, Cursor, Windsurf, etc.").action(() => guard(() => runMcpServer().then(() => 0))());
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`${pc22.red("error")} ${message}
+  process.stderr.write(`${pc23.red("error")} ${message}
 `);
   process.exitCode = 1;
 });