pi-advisor-flow 0.7.0 → 0.8.1-dev.1

package/src/jev/ledger.ts

@@ -71,6 +71,53 @@ const addJevUsage = (totals: AdvisorJevUsageTotals, usage: AdvisorJevUsage) => {
   totals.outputTokens += usage.outputTokens;
 };
 
+const savingsLine = (costs: number[], skipped: number) => {
+  if (costs.length === 0) {
+    return "Estimated saving from skips: unavailable — no observed consultation cost this session";
+  }
+  const mean = costs.reduce((sum, cost) => sum + cost, 0) / costs.length;
+  return `Estimated saving from skips: ≤ $${(mean * skipped).toFixed(4)} — upper bound; assumes each skipped consultation would have cost this session's mean allowed-consultation cost ($${mean.toFixed(4)}), which the skipped calls would likely have undercut`;
+};
+
+const formatJevTokens = (usage: AdvisorJevUsageTotals) =>
+  `↑${formatTokenCount(usage.inputTokens + usage.outputTokens)}`;
+
+const markdownCosts = (invocations: readonly JevInvocationView[]): number[] =>
+  invocations
+    .filter(
+      (item): item is JevInvocationView & { cost: number } =>
+        item.kind === "markdown" && typeof item.cost === "number"
+    )
+    .map((item) => item.cost);
+
+const filterLine = (filter: AdvisorJevFilterLedger) => {
+  const head = `${filter.screened} screened (${filter.allowed} allowed, ${filter.skipped} skipped${filter.repeatSkipped > 0 ? ` [${filter.repeatSkipped} repeat]` : ""})`;
+  const parts = [head];
+  if (filter.overrides > 0) {
+    parts.push(
+      `${filter.overrides} override${filter.overrides === 1 ? "" : "s"}`
+    );
+  }
+  if (filter.failures > 0) {
+    parts.push(`${filter.failures} failure${filter.failures === 1 ? "" : "s"}`);
+  }
+  return `Jev filter: ${parts.join(", ")}`;
+};
+
+const gateLine = (
+  gate: AdvisorJevGateLedger,
+  invocations: readonly JevInvocationView[]
+) => {
+  const consultationCosts = invocations
+    .filter(
+      (item): item is JevInvocationView & { cost: number } =>
+        item.trigger === "turn-gate" && typeof item.cost === "number"
+    )
+    .map((item) => item.cost);
+  const gateSpend = consultationCosts.reduce((sum, cost) => sum + cost, 0);
+  return `Turn gate: ${gate.checks} check${gate.checks === 1 ? "" : "s"} (Jev ${formatJevTokens(gate.usage)} · $${gate.usage.cost.toFixed(4)}), ${gate.consultations} consultation${gate.consultations === 1 ? "" : "s"} ($${gateSpend.toFixed(4)})`;
+};
+
 /** One session's Jev screening and turn-gate accounting plus summary lines. */
 export class AdvisorJevLedgerState {
   #ledger = freshJevLedger();
@@ -100,10 +147,11 @@ export class AdvisorJevLedgerState {
     if (repeat) {
       this.#ledger.filter.repeatSkipped += 1;
     }
-    this.#lastSkip = {
-      ...(normalizedQuestion ? { normalizedQuestion } : {}),
-      turn,
-    };
+    const skip: JevSkipRecord = { turn };
+    if (normalizedQuestion) {
+      skip.normalizedQuestion = normalizedQuestion;
+    }
+    this.#lastSkip = skip;
   }
 
   recordFilterOverride() {
@@ -151,26 +199,24 @@ export class AdvisorJevLedgerState {
           `${filter.overrides} override${filter.overrides === 1 ? "" : "s"}`
         );
       }
-      lines.push(`Consultation dedup: ${parts.join(", ")}`);
       lines.push(
-        this.#savingsLine(this.#markdownCosts(invocations), filter.skipped)
+        `Consultation dedup: ${parts.join(", ")}`,
+        savingsLine(markdownCosts(invocations), filter.skipped)
       );
     } else if (this.#filterActive()) {
-      lines.push(this.#filterLine(filter));
+      lines.push(filterLine(filter));
       const jevTokens = usage.inputTokens + usage.outputTokens;
       if (jevTokens > 0) {
         lines.push(
-          `Jev cost: ${this.#formatJevTokens(usage)} tokens · $${usage.cost.toFixed(4)} (input only; output free)`
+          `Jev cost: ${formatJevTokens(usage)} tokens · $${usage.cost.toFixed(4)} (input only; output free)`
         );
       }
       if (filter.skipped > 0) {
-        lines.push(
-          this.#savingsLine(this.#markdownCosts(invocations), filter.skipped)
-        );
+        lines.push(savingsLine(markdownCosts(invocations), filter.skipped));
       }
     }
     if (gate.checks > 0 || gate.consultations > 0) {
-      lines.push(this.#gateLine(gate, invocations));
+      lines.push(gateLine(gate, invocations));
     }
     return lines;
   }
@@ -179,56 +225,4 @@ export class AdvisorJevLedgerState {
     const { filter } = this.#ledger;
     return filter.screened > 0 || filter.overrides > 0 || filter.failures > 0;
   }
-
-  #savingsLine(markdownCosts: number[], skipped: number) {
-    if (markdownCosts.length === 0) {
-      return "Estimated saving from skips: unavailable — no observed consultation cost this session";
-    }
-    const mean =
-      markdownCosts.reduce((sum, cost) => sum + cost, 0) / markdownCosts.length;
-    return `Estimated saving from skips: ≤ $${(mean * skipped).toFixed(4)} — upper bound; assumes each skipped consultation would have cost this session's mean allowed-consultation cost ($${mean.toFixed(4)}), which the skipped calls would likely have undercut`;
-  }
-
-  #gateLine(
-    gate: AdvisorJevGateLedger,
-    invocations: readonly JevInvocationView[]
-  ) {
-    const consultationCosts = invocations
-      .filter(
-        (item): item is JevInvocationView & { cost: number } =>
-          item.trigger === "turn-gate" && typeof item.cost === "number"
-      )
-      .map((item) => item.cost);
-    const gateSpend = consultationCosts.reduce((sum, cost) => sum + cost, 0);
-    return `Turn gate: ${gate.checks} check${gate.checks === 1 ? "" : "s"} (Jev ${this.#formatJevTokens(gate.usage)} · $${gate.usage.cost.toFixed(4)}), ${gate.consultations} consultation${gate.consultations === 1 ? "" : "s"} ($${gateSpend.toFixed(4)})`;
-  }
-
-  #formatJevTokens(usage: AdvisorJevUsageTotals) {
-    return `↑${formatTokenCount(usage.inputTokens + usage.outputTokens)}`;
-  }
-
-  #markdownCosts(invocations: readonly JevInvocationView[]): number[] {
-    return invocations
-      .filter(
-        (item): item is JevInvocationView & { cost: number } =>
-          item.kind === "markdown" && typeof item.cost === "number"
-      )
-      .map((item) => item.cost);
-  }
-
-  #filterLine(filter: AdvisorJevFilterLedger) {
-    const head = `${filter.screened} screened (${filter.allowed} allowed, ${filter.skipped} skipped${filter.repeatSkipped > 0 ? ` [${filter.repeatSkipped} repeat]` : ""})`;
-    const parts = [head];
-    if (filter.overrides > 0) {
-      parts.push(
-        `${filter.overrides} override${filter.overrides === 1 ? "" : "s"}`
-      );
-    }
-    if (filter.failures > 0) {
-      parts.push(
-        `${filter.failures} failure${filter.failures === 1 ? "" : "s"}`
-      );
-    }
-    return `Jev filter: ${parts.join(", ")}`;
-  }
 }

package/src/jev/questions.ts

@@ -1,5 +1,8 @@
 import type { Questions } from "@typesafe-ai/sdk";
 
+import { isNumber, isRecordOf } from "../content-utils.ts";
+import type { JsonValue } from "../content-utils.ts";
+
 /** Exact rubric text for the stakes Score question; level 0 is the skip level. */
 export const STAKES_RUBRIC = [
   "Negligible: routine, low-risk, mechanical, or reversible; a wrong call costs little and is easy to undo.",
@@ -37,13 +40,10 @@ export interface ScreeningCriteria {
 
 export type ScreeningVerdict = { skip: false } | { skip: true };
 
-const NUMERIC_KEY_PATTERN = /^\d+$/;
-
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  Boolean(value) && typeof value === "object" && !Array.isArray(value);
+const NUMERIC_KEY_PATTERN = /^\d+$/u;
 
-const finiteNumber = (value: unknown): number | undefined =>
-  typeof value === "number" && Number.isFinite(value) ? value : undefined;
+const finiteNumber = (value: JsonValue | undefined): number | undefined =>
+  isNumber(value) && Number.isFinite(value) ? value : undefined;
 
 /**
  * Probability mass on the lowest stakes level, resolved through the answer's
@@ -51,16 +51,16 @@ const finiteNumber = (value: unknown): number | undefined =>
  * smallest numeric index key only when no legend resolves. Shape-independent:
  * never hardcodes a level key and never uses `ceil(score)`.
  */
-export const lowestStakesProbability = (
-  answer: unknown
+export const lowestStakesProbability = <Answer>(
+  answer: Answer
 ): number | undefined => {
-  if (!isRecord(answer)) {
+  if (!isRecordOf(answer)) {
     return undefined;
   }
-  const probabilities = isRecord(answer.probabilities)
+  const probabilities = isRecordOf(answer.probabilities)
     ? answer.probabilities
     : {};
-  const legend = isRecord(answer.legend) ? answer.legend : undefined;
+  const legend = isRecordOf(answer.legend) ? answer.legend : undefined;
   if (legend) {
     const exact = Object.keys(legend).find(
       (key) => legend[key] === STAKES_RUBRIC[0]
@@ -75,23 +75,26 @@ export const lowestStakesProbability = (
   if (numericKeys.length === 0) {
     return undefined;
   }
-  const lowest = numericKeys.reduce((left, right) =>
-    Number(left) <= Number(right) ? left : right
-  );
+  let [lowest] = numericKeys;
+  for (const key of numericKeys) {
+    if (Number(key) < Number(lowest)) {
+      lowest = key;
+    }
+  }
   return finiteNumber(probabilities[lowest]);
 };
 
-const selfAnswerableNoul = (answer: unknown): number | undefined =>
-  isRecord(answer) ? finiteNumber(answer.noul) : undefined;
+const selfAnswerableNoul = <Answer>(answer: Answer): number | undefined =>
+  isRecordOf(answer) ? finiteNumber(answer.noul) : undefined;
 
 /** Pure composition: skip requires the hard conjunction of confident
  * negligible stakes AND confident self-answerability. Any missing, NaN, or
  * malformed input allows. Never a weighted sum. */
-export const composeScreeningVerdict = (
-  answers: unknown,
+export const composeScreeningVerdict = <Answers>(
+  answers: Answers,
   { noulMargin, skipConfidence }: ScreeningCriteria
 ): ScreeningVerdict => {
-  if (!isRecord(answers)) {
+  if (!isRecordOf(answers)) {
     return { skip: false };
   }
   const negligibleMass = lowestStakesProbability(answers.stakes);
@@ -106,14 +109,14 @@ export const composeScreeningVerdict = (
 };
 
 /** Confident-true only; any uncertainty means no invocation. */
-export const composeTurnGateVerdict = (
-  answers: unknown,
+export const composeTurnGateVerdict = <Answers>(
+  answers: Answers,
   threshold: number
 ): boolean => {
-  if (!isRecord(answers)) {
+  if (!isRecordOf(answers)) {
     return false;
   }
   const answer = answers.should_consult;
-  const noul = isRecord(answer) ? finiteNumber(answer.noul) : undefined;
+  const noul = isRecordOf(answer) ? finiteNumber(answer.noul) : undefined;
   return noul !== undefined && noul >= threshold;
 };

package/src/jev/state.ts

@@ -1,5 +1,6 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { JsonValue } from "@typesafe-ai/sdk";
+
 import {
   advisorJevDigestMaxCharsRef,
   advisorRedactSecretsRef,
@@ -23,25 +24,27 @@ export type JevState = Record<string, JsonValue>;
 export const buildJevState = (
   ctx: ExtensionContext,
   input: JevStateInput = {}
-): JevState => {
-  const state: JevState = { role: "executor" };
+) => {
+  const fields = new Map<string, string>([["role", "executor"]]);
   if (input.question) {
-    state.executor_question = redactAndCapText(
-      input.question,
-      JEV_TEXT_CAP_BYTES,
-      advisorRedactSecretsRef
+    fields.set(
+      "executor_question",
+      redactAndCapText(
+        input.question,
+        JEV_TEXT_CAP_BYTES,
+        advisorRedactSecretsRef
+      )
     );
   }
   if (input.draft) {
-    state.executor_draft = redactAndCapText(
-      input.draft,
-      JEV_TEXT_CAP_BYTES,
-      advisorRedactSecretsRef
+    fields.set(
+      "executor_draft",
+      redactAndCapText(input.draft, JEV_TEXT_CAP_BYTES, advisorRedactSecretsRef)
     );
   }
   const digest = recentConversation(ctx, advisorJevDigestMaxCharsRef);
   if (digest) {
-    state.recent_conversation = digest;
+    fields.set("recent_conversation", digest);
   }
-  return state;
+  return Object.fromEntries(fields);
 };

package/src/jev/transport.ts

@@ -1,6 +1,8 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
 import { advisorJevTransportRef } from "../config/state.ts";
-import { type JevKeySource, resolveTypeSafeKey } from "./key-store.ts";
+import { resolveTypeSafeKey } from "./key-store.ts";
+import type { JevKeySource } from "./key-store.ts";
 
 export type JevTransportKind = "typesafe" | "openrouter";
 
@@ -41,11 +43,14 @@ export const resolveJevTransport = async (
     const resolveTypesafe = deps.resolveTypesafe ?? resolveTypeSafeKey;
     const resolution = await resolveTypesafe();
     if (resolution.key) {
-      return {
+      const credentials: JevCredentials = {
         apiKey: resolution.key,
-        ...(resolution.source ? { source: resolution.source } : {}),
         transport: "typesafe",
       };
+      if (resolution.source) {
+        credentials.source = resolution.source;
+      }
+      return credentials;
     }
   }
   if (preference === "typesafe") {

package/src/model-stream.ts

@@ -1,11 +1,12 @@
-import {
-  type Api,
-  type AssistantMessage,
-  type Message,
-  type Model,
-  stream,
+import { stream } from "@earendil-works/pi-ai/compat";
+import type {
+  Api,
+  AssistantMessage,
+  Message,
+  Model,
 } from "@earendil-works/pi-ai/compat";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
 import { splitRef } from "./config/state.ts";
 
 export interface ResolvedConfiguredModel {
@@ -25,13 +26,14 @@ export const resolveConfiguredModel = async (
     throw new Error(`${label} model not configured`);
   }
   const [provider, modelId] = splitRef(ref);
-  const model = ctx.modelRegistry.find(provider, modelId);
+  const lookup: [string, string] = [provider, modelId];
+  const model = ctx.modelRegistry.find(...lookup);
   if (!model) {
     throw new Error(`${label} model not found: ${ref}`);
   }
   const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
   if (!auth.ok) {
-    throw new Error((auth as { error: string }).error);
+    throw new Error(auth.error);
   }
   if (!auth.apiKey) {
     throw new Error(`No API key for ${ref}`);
@@ -61,6 +63,12 @@ export interface CollectedTextStream {
 
 export const ADVISOR_STREAM_UPDATE_INTERVAL_MS = 90;
 
+const defaultScheduler: CoalescedUpdateScheduler = {
+  clearTimeout,
+  now: Date.now,
+  setTimeout: (callback, delay) => setTimeout(callback, delay),
+};
+
 interface CoalescedUpdateResult {
   error?: unknown;
   failed: boolean;
@@ -85,19 +93,14 @@ export interface CoalescedUpdateScheduler {
 export const createCoalescedUpdate = <T>(
   publish: (value: T) => void,
   intervalMs = ADVISOR_STREAM_UPDATE_INTERVAL_MS,
-  scheduler: CoalescedUpdateScheduler = {
-    clearTimeout,
-    now: Date.now,
-    setTimeout: (callback, delay) => setTimeout(callback, delay),
-  }
+  scheduler: CoalescedUpdateScheduler | undefined = defaultScheduler
 ): CoalescedUpdate<T> => {
   if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
     throw new Error("Coalesced update interval must be positive and finite.");
   }
 
   let closed = false;
-  let hasPending = false;
-  let pending: T | undefined;
+  let pending: { value: T } | undefined;
   let lastPublishedAt: number | undefined;
   let timer: ReturnType<typeof setTimeout> | undefined;
   let publishError: unknown;
@@ -112,12 +115,11 @@ export const createCoalescedUpdate = <T>(
 
   const publishPending = () => {
     timer = undefined;
-    if (!hasPending) {
+    if (!pending) {
       return;
     }
-    const value = pending as T;
+    const { value } = pending;
     pending = undefined;
-    hasPending = false;
     lastPublishedAt = scheduler.now();
     try {
       publish(value);
@@ -150,7 +152,6 @@ export const createCoalescedUpdate = <T>(
       closed = true;
       clearTimer();
       pending = undefined;
-      hasPending = false;
     },
     flush: () => {
       if (!closed) {
@@ -167,8 +168,7 @@ export const createCoalescedUpdate = <T>(
       if (publishFailed) {
         throw publishError;
       }
-      pending = value;
-      hasPending = true;
+      pending = { value };
       if (timer === undefined) {
         schedule();
       }
@@ -186,22 +186,22 @@ export const collectTextStream = async (
 ): Promise<CollectedTextStream> => {
   let thinking = "";
   let text = "";
+  const streamOptions: Parameters<typeof streamModel>[2] = {
+    apiKey: resolved.apiKey,
+    env: resolved.env,
+    headers: resolved.headers,
+    // SAFETY: stream() models the provider-facing reasoning field as never; options.reasoning is the Pi-facing effort string.
+    reasoning: options.reasoning as never,
+    signal: options.signal,
+  };
+  if (options.reasoning !== undefined) {
+    // SAFETY: reasoningEffort takes the same effort string; kept absent when reasoning is unset.
+    streamOptions.reasoningEffort = options.reasoning as never;
+  }
   const eventStream = streamModel(
     resolved.model,
     { messages: options.messages, systemPrompt: options.systemPrompt },
-    {
-      apiKey: resolved.apiKey,
-      env: resolved.env,
-      headers: resolved.headers,
-      // `stream()` uses the provider-facing name while the extension's public
-      // option keeps the Pi-facing `reasoning` name. Preserve both so the
-      // configured effort reaches providers that serialize reasoning_effort.
-      reasoning: options.reasoning as never,
-      ...(options.reasoning === undefined
-        ? {}
-        : { reasoningEffort: options.reasoning as never }),
-      signal: options.signal,
-    }
+    streamOptions
   );
 
   for await (const event of eventStream) {
@@ -242,8 +242,6 @@ export const collectTextStream = async (
   return {
     text: finalText,
     thinking,
-    usage: (
-      lastAssistant as (AssistantMessage & { usage?: unknown }) | undefined
-    )?.usage,
+    usage: lastAssistant?.usage,
   };
 };

package/src/outcomes.ts

@@ -11,6 +11,8 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 
 export type OutcomeAdoption = "followed" | "not-followed" | "unknown";
@@ -44,12 +46,15 @@ const statePath = () => join(getAgentDir(), "advisor-outcomes-salt");
 export const outcomeLogPath = () =>
   join(getAgentDir(), "advisor-outcomes.jsonl");
 
+const isErrnoException = (error: unknown): error is NodeJS.ErrnoException =>
+  error instanceof Error && "code" in error;
+
 const salt = async () => {
   const path = statePath();
   await mkdir(getAgentDir(), { mode: 0o700, recursive: true });
   for (let attempt = 0; attempt < 20; attempt += 1) {
     try {
-      // biome-ignore lint/performance/noAwaitInLoops: contenders retry sequentially until one salt is atomically published.
+      // Contenders retry sequentially until one salt is atomically published.
       const existing = await readFile(path);
       if (existing.length === 32) {
         return existing;
@@ -57,7 +62,7 @@ const salt = async () => {
       // Recover a salt file left incomplete by an interrupted older writer.
       await unlink(path);
     } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+      if (!isErrnoException(error) || error.code !== "ENOENT") {
         throw error;
       }
     }
@@ -68,7 +73,7 @@ const salt = async () => {
       await link(temporary, path);
       return value;
     } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") {
+      if (!isErrnoException(error) || error.code !== "EEXIST") {
         throw error;
       }
     } finally {
@@ -86,7 +91,7 @@ const withOutcomeLock = async <T>(run: () => Promise<T>): Promise<T> => {
   const lockPath = `${outcomeLogPath()}.lock`;
   for (let attempt = 0; attempt < 200; attempt += 1) {
     try {
-      // biome-ignore lint/performance/noAwaitInLoops: lock acquisition must retry sequentially across processes.
+      // Lock acquisition must retry sequentially across processes.
       const lock = await open(lockPath, "wx", 0o600);
       const identity = await lock.stat();
       try {
@@ -99,7 +104,7 @@ const withOutcomeLock = async <T>(run: () => Promise<T>): Promise<T> => {
         }
       }
     } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") {
+      if (!isErrnoException(error) || error.code !== "EEXIST") {
         throw error;
       }
       const observed = await stat(lockPath).catch(() => undefined);
@@ -110,7 +115,7 @@ const withOutcomeLock = async <T>(run: () => Promise<T>): Promise<T> => {
         }
         continue;
       }
-      await new Promise((resolve) => setTimeout(resolve, 5));
+      await sleep(5);
     }
   }
   throw new Error("Timed out waiting to append an Advisor outcome.");
@@ -145,11 +150,10 @@ export const appendOutcome = async (
         }
         throw error;
       });
-    if (currentBytes + Buffer.byteLength(line) > MAX_LOG_BYTES) {
-      await writeFile(path, line, { encoding: "utf8", mode: 0o600 });
-    } else {
-      await appendFile(path, line, { encoding: "utf8", mode: 0o600 });
-    }
+    const overflow = currentBytes + Buffer.byteLength(line) > MAX_LOG_BYTES;
+    await (overflow
+      ? writeFile(path, line, { encoding: "utf-8", mode: 0o600 })
+      : appendFile(path, line, { encoding: "utf-8", mode: 0o600 }));
     await chmod(path, 0o600);
     return next;
   });

package/src/pi-settings.ts

@@ -1,10 +1,9 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 
-interface PiGlobalSettings {
-  hideThinkingBlock?: boolean;
-}
+import { isRecord } from "./content-utils.ts";
 
 interface CachedSetting {
   hidden: boolean;
@@ -27,12 +26,8 @@ const settingsIdentity = (path: string): string => {
 
 const readHideThinking = (path: string): boolean => {
   try {
-    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
-    return (
-      typeof parsed === "object" &&
-      parsed !== null &&
-      (parsed as PiGlobalSettings).hideThinkingBlock === true
-    );
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf-8"));
+    return isRecord(parsed) && parsed.hideThinkingBlock === true;
   } catch {
     return false;
   }

package/src/preferences.ts

@@ -1,6 +1,8 @@
 import { lstat, open, realpath } from "node:fs/promises";
 import { join, relative } from "node:path";
+
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
 import { redactAndCapText } from "./redaction.ts";
 
 const PREFERENCES_MAX_BYTES = 8 * 1024;
@@ -40,9 +42,9 @@ export const readProjectPreferences = async (
     try {
       const buffer = Buffer.alloc(maxBytes + 1);
       const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-      const source = buffer.subarray(0, bytesRead).toString("utf8");
+      const source = buffer.subarray(0, bytesRead).toString("utf-8");
       const capped = redactAndCapText(source, maxBytes, redact);
-      return { bytes: Buffer.byteLength(capped, "utf8"), text: capped };
+      return { bytes: Buffer.byteLength(capped, "utf-8"), text: capped };
     } finally {
       await file.close();
     }

package/src/redaction.ts

@@ -1,15 +1,15 @@
-import { capUtf8Bytes } from "./content-utils.ts";
+import { capUtf8Bytes, isString } from "./content-utils.ts";
 
 const REDACTION_MARKER = "[REDACTED SECRET]";
-const PEM_BEGIN_PATTERN = /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----/gi;
-const PEM_END_PATTERN = /-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/i;
+const PEM_BEGIN_PATTERN = /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----/giu;
+const PEM_END_PATTERN = /-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/iu;
 const SECRET_PATTERNS = [
-  /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/gi,
-  /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi,
-  /\b(?:api[_-]?key|token|secret|password|passwd)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s"'&,;)}\]]+)/gi,
-  /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi,
-  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
-  /\b(?:aws_secret_access_key|aws_session_token)\s*[:=]\s*[^\s"'&,;)}\]]+/gi,
+  /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/giu,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/giu,
+  /\b(?:api[_-]?key|token|secret|password|passwd)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s"'&,;)}\]]+)/giu,
+  /(?<scheme>[a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/giu,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,
+  /\b(?:aws_secret_access_key|aws_session_token)\s*[:=]\s*[^\s"'&,;)}\]]+/giu,
 ] as const;
 
 const redactUnterminatedPem = (value: string): string => {
@@ -31,9 +31,7 @@ export const redactSecrets = (value: string): string => {
   let redacted = redactUnterminatedPem(value);
   for (const pattern of SECRET_PATTERNS) {
     redacted = redacted.replace(pattern, (_match, scheme) =>
-      typeof scheme === "string"
-        ? `${scheme}${REDACTION_MARKER}@`
-        : REDACTION_MARKER
+      isString(scheme) ? `${scheme}${REDACTION_MARKER}@` : REDACTION_MARKER
     );
   }
   return redacted;