pi-checkup 0.1.0 → 0.1.2

package/README.md

@@ -77,9 +77,10 @@ Packages
 Binaries
   ✓ dangling links     19 links all resolve
   · shadowed names     no package command resolved on PATH
-  ! unreachable bins   6 package command(s) not on PATH: pi-web-access-mcp,
-                       pi-subagents, pi-mcp-adapter, pi-lens, pi-lens-mcp,
-                       pi-lens-analyze
+  · unreachable bins   6 package command(s) live in
+                       /root/.pi/agent/npm/node_modules/.bin, which is not on
+                       PATH: pi-web-access-mcp, pi-subagents, pi-mcp-adapter,
+                       pi-lens, pi-lens-mcp, pi-lens-analyze
 Network
   ✓ providers          2 endpoint(s) reachable
   ✓ dns                1 provider host(s) resolve normally
@@ -94,20 +95,20 @@ Config
 Runtime
   ✓ node               v22.23.3
   ✓ pi launcher        /root/.pi/agent/bin/pi
-  ✓ disk               6% used on /, 950.7 GB free
+  ✓ disk               6% used on /, 950.4 GB free
   ✓ proxy              http://127.0.0.1:10808 accepting connections
 
-19 checks: 14 ok, 1 warning, 0 failed, 4 skipped
+19 checks: 14 ok, 0 warnings, 0 failed, 5 skipped
 Run `npx pi-checkup --verbose` to show what to do about each finding.
 
-! 1 warning, 4 skipped  ·  run /checkup inside Pi for registry checks
+✓ 14 ok, 5 skipped  ·  run /checkup inside Pi for registry checks
 ```
 
 Both captures below and above come from a real machine, taken with pi-checkup 0.1.0; free space, Node versions and which packages are installed are properties of that machine, not of the tool, and the row counts grow when checks are added.
 
 ## Real output
 
-This is an actual run on a working install, copied out of the TUI at 80 columns — not a mock-up. The two `Network` rows describe the moment it ran; everything else is a property of the install. 20 of 24 checks pass, three are skipped because there is genuinely nothing to look at, and the one warning is the expected state on this machine — the package commands are installed but their directory is not on `PATH`, which the hint explains and `PI_CHECKUP_IGNORE=unreachable` silences.
+This is an actual run on a working install, copied out of the TUI at 80 columns — not a mock-up. The two `Network` rows describe the moment it ran; everything else is a property of the install. 20 of 24 checks pass and the other four are skipped because there is genuinely nothing to look at: no live registry to audit, no project-level settings, no `$VAR` credentials, and no package command on `PATH` to compare. Nothing warns, which is the point — the package commands live in a `.bin` directory Pi never adds to `PATH`, that is Pi's own layout rather than a fault, and the row says so instead of putting a permanent amber mark on a healthy install.
 
 ```text
 Registry
@@ -126,9 +127,10 @@ Packages
 Binaries
   ✓ dangling links     19 links all resolve
   · shadowed names     no package command resolved on PATH
-  ! unreachable bins   6 package command(s) not on PATH: pi-web-access-mcp,
-                       pi-subagents, pi-mcp-adapter, pi-lens, pi-lens-mcp,
-                       pi-lens-analyze
+  · unreachable bins   6 package command(s) live in
+                       /root/.pi/agent/npm/node_modules/.bin, which is not on
+                       PATH: pi-web-access-mcp, pi-subagents, pi-mcp-adapter,
+                       pi-lens, pi-lens-mcp, pi-lens-analyze
 Network
   ✓ providers          2 endpoint(s) reachable
   ✓ dns                1 provider host(s) resolve normally
@@ -143,10 +145,10 @@ Config
 Runtime
   ✓ node               v22.23.3
   ✓ pi launcher        /root/.pi/agent/bin/pi
-  ✓ disk               6% used on /, 950.7 GB free
+  ✓ disk               6% used on /, 950.4 GB free
   ✓ proxy              http://127.0.0.1:10808 accepting connections
 
-24 checks: 20 ok, 1 warning, 0 failed, 3 skipped
+24 checks: 20 ok, 0 warnings, 0 failed, 4 skipped
 Run `/checkup verbose` to show what to do about each finding.
 ```
 
@@ -164,7 +166,7 @@ The `attribution` row is the part no other tool gives you: which package owns wh
 | **Packages** | Package list | Whether `settings.json` could be read at all — a hand-edited file that does not parse is reported as unreadable, not as "no packages" |
 | | Missing directories | In `settings.json` but gone from `node_modules`. A version pin (`npm:name@1.2.3`) is resolved to the directory it installs into, not taken as part of the name |
 | | Version pins | `settings.json` pins an exact version and a different one is installed — the code that runs is not the code that was asked for. Ranges and tags are not compared, because the installer is free to satisfy them |
-| | Corrupt manifests | A `package.json` that parses as nothing — reported as a failure, because the package cannot load |
+| | Corrupt manifests | A `package.json` that does not parse, or that parses to something other than an object (`null`, `"nope"`, `[]`) — reported as a failure, because the package cannot load. An empty object still counts as readable |
 | | Missing manifests | The package directory exists but holds no `package.json` — an interrupted install, or a leftover folder. Its own row, because telling someone to check ownership of a directory that has no manifest sends them to fix the wrong thing |
 | | Unreadable manifests | A `package.json` this process could not read (permissions, or larger than the 4 MB limit). Reported as a warning: unproven, not broken |
 | | Missing entry files | The manifest points at a build output that was never shipped |
@@ -179,7 +181,7 @@ The `attribution` row is the part no other tool gives you: which package owns wh
 | | Install leftovers | `.<name>-<random>` staging links in `.bin`: an install is running right now, or was interrupted. Its own finding, not a broken package |
 | | Missing shims | The package declares a `bin` but npm never linked it into `.bin` — usually an install run with `--ignore-scripts` |
 | | Shadowed names | A package's command name resolves to an unrelated program earlier on `PATH`. Skipped when no declared command resolved at all: there is nothing to compare, and a green tick there would sit next to a row saying the commands are missing |
-| | Unreachable bins | A package ships a CLI you cannot invoke by name |
+| | Unreachable bins | A package ships a CLI that is not reachable by name. A `skip` when `.bin` itself is not on `PATH` — that is Pi's own layout and Pi calls these by full path — and a warning only when the directory *is* on `PATH` and the command still did not resolve, which points at PATH order or an unreadable link |
 | **Network** | Endpoint reachability | Probes `<baseUrl>/models` for every provider. `401`/`403` counts as alive — this never validates your key and never spends tokens. An endpoint that answers with something other than life — a refused connection, a rejected certificate, an HTTP error — is a failure, and fails the run; only a probe that was cut off locally by its own timeout stays a warning, because the deadline is this process's, not the endpoint's |
 | | Cleartext auth | A provider on `http://` to another machine with a credential configured — an `apiKey`, a password embedded in the `baseUrl`, a credential-named header value, or a query string, which cannot be inspected for secrets. The `apiKey` and `baseUrl` credentials are withheld from the probe; a query string is never sent, so that endpoint is reported unprobed. Loopback hosts are exempt |
 | | baseUrl shape | A `baseUrl` that is not a string or an object. A string that is not a URL — including the `localhost:11434/v1` paste with no scheme — is reported as an unhealthy provider, and also named in this row, because the endpoint is what would have to be probed |
@@ -197,7 +199,7 @@ The groups above are the ones that appear in a report, in that order. Independen
 
 Only reversible repairs are automated, and inside a session it normally offers only the first:
 
-1. **Restore a config file** that is no longer valid JSON, from its newest sibling backup. The broken copy is kept.
+1. **Restore a config file** that is no longer valid JSON, from its newest sibling backup that still parses — a corrupt newest backup does not block the valid one beside it, and the message says how many newer ones were skipped. The broken copy is kept.
 
 2. **Collapse duplicate `packages` entries** in `settings.json`. Only byte-identical repeats are dropped: `"npm:a"` next to `{"source": "npm:a", "enabled": false}` carries different intent and is left alone.
 3. **Prune `packages` entries whose directory is gone** — the ones a reinstall did not bring back. Sources resolved by Pi itself (`git:`, `https:`) are never touched, and a prune that would leave the list empty is refused and never even offered: that pattern means the agent directory is wrong, not that every package vanished.
@@ -208,24 +210,23 @@ Repairs 2 and 3 rewrite `settings.json`, so they need a settings file checkup ac
 npx pi-checkup --fix --yes
 ```
 
-Every write is preceded by a timestamped backup, and neither path writes on its own: `/checkup fix` asks in the TUI, and the CLI refuses to write unless you pass `--yes`. Anything that would delete a package, disable an extension, or edit your shell environment is reported with a suggestion and left alone — a diagnostic tool should not be able to break your setup in the process of describing it.
+Every write is preceded by a timestamped backup — one per file per run, taken before the first write, so `restore` hands back the file as it was before checkup ran rather than a half-repaired intermediate — and neither path writes on its own: `/checkup fix` asks in the TUI, and the CLI refuses to write unless you pass `--yes`. Anything that would delete a package, disable an extension, or edit your shell environment is reported with a suggestion and left alone — a diagnostic tool should not be able to break your setup in the process of describing it.
 
 A repair that rewrites `settings.json` re-serialises it with two-space indentation, so expect a larger diff than the change itself. Nothing is repaired unless a check found something wrong, so a healthy install writes nothing at all.
 
 ## Ignoring a finding you have decided to live with
 
-Some warnings are correct and permanent: a launcher you deliberately keep off `PATH`, an event-only package that registers no tool. A health check you have learned to ignore is worse than no health check, so rows can be suppressed by name.
+Some findings are correct and permanent: a gateway you deliberately reach over plain `http` on your own network, a package installed with `--ignore-scripts` whose links you do not want. A health check you have learned to ignore is worse than no health check, so rows can be suppressed by name.
 
 ```bash
-PI_CHECKUP_IGNORE=unreachable,Config:env npx pi-checkup
+PI_CHECKUP_IGNORE=Network:cleartext npx pi-checkup
 ```
 
-Each entry matches a row's `id`, its `Group:id` form, or its title. A suppressed row is downgraded to `skip`, keeps its original detail, and says what it replaced:
+Each entry matches a row's `id`, its `Group:id` form, or its title. A suppressed row is downgraded to `skip`, keeps its original detail, and says what it replaced — here from a scratch install with one provider deliberately configured over plain `http`:
 
 ```text
-  · unreachable bins   ignored via PI_CHECKUP_IGNORE (would be warn): 6 package
-                       command(s) not on PATH: pi-web-access-mcp, pi-subagents,
-                       pi-mcp-adapter, pi-lens, pi-lens-mcp, pi-lens-analyze
+  · cleartext auth     ignored via PI_CHECKUP_IGNORE (would be warn): gw use
+                       http:// with credentials configured
 ```
 
 Suppression is never silent, and it drops the row's repair offer so a hidden finding cannot be fixed behind your back. It applies to failures too: a suppressed `fail` no longer affects the exit code, which is the point of the variable — use it for a state you have decided to accept, not to turn a red build green. Export it from your shell profile if you want it to apply inside Pi too.
@@ -239,9 +240,9 @@ Suppression is never silent, and it drops the row's repair offer so a hidden fin
   "summary": {
     "total": 24,
     "ok": 20,
-    "warn": 1,
+    "warn": 0,
     "fail": 0,
-    "skip": 3
+    "skip": 4
   },
   "version": "0.1.0",
   "node": "22.23.3",
@@ -251,9 +252,9 @@ Suppression is never silent, and it drops the row's repair offer so a hidden fin
       "group": "Binaries",
       "id": "unreachable",
       "title": "unreachable bins",
-      "status": "warn",
-      "detail": "6 package command(s) not on PATH: pi-web-access-mcp, pi-subagents, pi-mcp-adapter, pi-lens, pi-lens-mcp, pi-lens-analyze",
-      "hint": "Pi installs package commands into /root/.pi/agent/npm/node_modules/.bin without adding it to PATH. Extensions that call them by full path still work; to use them by name, add that directory to PATH or run them with npx. If this is the state you want, silence the row with PI_CHECKUP_IGNORE=unreachable."
+      "status": "skip",
+      "detail": "6 package command(s) live in /root/.pi/agent/npm/node_modules/.bin, which is not on PATH: pi-web-access-mcp, pi-subagents, pi-mcp-adapter, pi-lens, pi-lens-mcp, pi-lens-analyze",
+      "hint": "Pi calls these by full path, so an extension that uses them still works. Add /root/.pi/agent/npm/node_modules/.bin to PATH only if you want to run them by name."
     },
     {
       "group": "Config",
@@ -268,7 +269,7 @@ Suppression is never silent, and it drops the row's repair offer so a hidden fin
 
 The `checks` array always has one entry per row of the text report, in the same order. The excerpt above omits the other 22 entries; real output is printed by `JSON.stringify(payload, null, 2)`.
 
-Exit-worthy statuses are `fail`; `warn` means something needs attention without by itself failing the run — a package command that is not on `PATH`, or an `apiKey` that no HTTP request can carry. Repair metadata is stripped from the JSON payload.
+Exit-worthy statuses are `fail`; `warn` means something needs attention without by itself failing the run — an `apiKey` that no HTTP request can carry, or a credential on a plain-`http` endpoint. Repair metadata is stripped from the JSON payload.
 
 ## Design principles
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-checkup",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Health checks for your Pi setup: tool/command conflicts, broken packages, shadowed binaries, dead endpoints.",
   "type": "module",
   "license": "MIT",

package/src/checks/binaries.js

@@ -12,6 +12,7 @@ import {
 	exists,
 	isMissing,
 	isWindows,
+	normalizePath,
 	readJson,
 	resolvePackageDir,
 	sameCommand,
@@ -334,20 +335,35 @@ export async function run({ settings, settingsLoaded = true, agentDir: root, bin
 	);
 
 	if (unreachable.length) {
+		// Is the .bin directory itself on PATH? Pi's default install does not add
+		// it, and Pi resolves package binaries by full path — so "unreachable"
+		// there is the layout, not a fault. Reporting it as a warning put a
+		// permanent amber row on every healthy install and taught the reader to
+		// skip the group that is supposed to mean something. It stays a warning
+		// only where the directory *is* on PATH and the command still did not
+		// resolve, which points at PATH order or an unreadable shim.
+		const wanted = normalizePath(binDir);
+		const binDirOnPath =
+			Boolean(wanted) &&
+			String(env.PATH ?? env.Path ?? env.path ?? "")
+				.split(path.delimiter)
+				.filter(Boolean)
+				.some((dir) => normalizePath(dir) === wanted);
+		const listed = names(unreachable, 6);
 		results.push({
 			group,
 			id: "unreachable",
 			title: "unreachable bins",
-			status: "warn",
-			detail: `${unreachable.length} package command(s) not on PATH: ${names(unreachable, 6)}`,
-			// The file exists — it is just not on PATH — so the fix is the directory,
-			// not a reinstall. Without this the row reads as "something is broken"
-			// with no way to tell what to do about it.
-			// The file exists — it is just not on PATH — so the fix is the directory,
-			// not a reinstall. Without this the row reads as "something is broken"
-			// with no way to tell what to do about it. The suppression is named here
-			// because this is the one row a healthy install carries for good.
-			hint: `Pi installs package commands into ${binDir} without adding it to PATH. Extensions that call them by full path still work; to use them by name, add that directory to PATH or run them with npx. If this is the state you want, silence the row with PI_CHECKUP_IGNORE=unreachable.`,
+			status: binDirOnPath ? "warn" : "skip",
+			detail: binDirOnPath
+				? `${unreachable.length} package command(s) did not resolve even though ${binDir} is on PATH: ${listed}`
+				: `${unreachable.length} package command(s) live in ${binDir}, which is not on PATH: ${listed}`,
+			// The file exists — it is just not reachable — so the fix is the
+			// directory, not a reinstall. Without this the row reads as "something is
+			// broken" with no way to tell what to do about it.
+			hint: binDirOnPath
+				? "The directory is on PATH, so a different program answers first or the link cannot be read. Check the order of PATH entries and the link's permissions."
+				: `Pi calls these by full path, so an extension that uses them still works. Add ${binDir} to PATH only if you want to run them by name.`,
 		});
 	}
 

package/src/checks/config.js

@@ -155,9 +155,12 @@ export async function run({
 					: `${backedUp} file(s) backed up`,
 				{
 					// The named path is the point: "copy it somewhere safe" with no `it` left
-					// the reader to work out which file the paragraph was about.
+					// the reader to work out which file the paragraph was about. The count of
+					// backups is not claimed: "both backups are older" was hardcoded and
+					// wrong as soon as one file was stale and the other was not — and a
+					// file may have any number of backups.
 					hint: stale.length
-						? `The current ${stale.join(" and ")} cannot be rolled back to, because both backups are older. Copy ${stale
+						? `The newest backup of ${stale.join(" and ")} predates the current file${stale.length > 1 ? "s" : ""}, so restoring it would discard the edits made since. Copy ${stale
 								.map((label) => files.find((f) => f.label === label)?.file ?? label)
 								.join(" and ")} somewhere you can restore from before the next edit.`
 						: undefined,
@@ -207,13 +210,16 @@ export async function run({
 		// so the check has to make the same distinction or its hint names a repair
 		// that then answers "nothing to dedupe".
 		const seen = new Map();
-		const duplicates = new Set();
+		// source -> how many byte-identical repeats beyond the first. A Set of
+		// sources counted distinct sources, so three copies of one entry reported
+		// "1 listed twice" when two entries were redundant.
+		const duplicates = new Map();
 		const mixedShapes = new Set();
 		for (const spec of settings.packages) {
 			const source = sourceOf(spec);
 			if (typeof source !== "string") continue;
 			if (seen.has(source)) {
-				if (JSON.stringify(seen.get(source)) === JSON.stringify(spec)) duplicates.add(source);
+				if (JSON.stringify(seen.get(source)) === JSON.stringify(spec)) duplicates.set(source, (duplicates.get(source) ?? 0) + 1);
 				else mixedShapes.add(source);
 			} else {
 				seen.set(source, spec);
@@ -227,8 +233,7 @@ export async function run({
 		// session's copy is authoritative, and "runtime-unreadable" means the file
 		// is a guess.
 		const canDedupe = settingsSource === "file" && Boolean(settingsFile);
-		const listed = [...duplicates, ...mixedShapes].map(redactSource);
-		if (!listed.length) {
+		if (!duplicates.size && !mixedShapes.size) {
 			// Zero entries compared is not a pass: "none" over an empty list is the
 			// same vacuous green tick the rest of this file avoids. Counted by
 			// comparable entries rather than by the list length, because
@@ -239,11 +244,12 @@ export async function run({
 					: row("duplicates", "duplicate packages", "skip", "no comparable package entries"),
 			);
 		} else {
-			const parts = [];
-			if (duplicates.size) parts.push(`${duplicates.size} listed twice`);
-			if (mixedShapes.size) parts.push(`${mixedShapes.size} listed in two different shapes`);
+			// The count is per source and says how many times the entry actually
+			// appears: "listed twice" for one redundant copy, "listed 3 times" for two.
+			const parts = [...duplicates].map(([source, extra]) => `${redactSource(source)}: listed ${extra === 1 ? "twice" : `${extra + 1} times`}`);
+			for (const source of mixedShapes) parts.push(`${redactSource(source)}: listed in two different shapes`);
 			results.push(
-				row("duplicates", "duplicate packages", "warn", `${listed.join(", ")}: ${parts.join(", ")}`, {
+				row("duplicates", "duplicate packages", "warn", parts.join(", "), {
 					hint:
 						mixedShapes.size && !duplicates.size
 							? "Dedupe leaves entries that differ alone, because they say different things. Keep the one you meant."

package/src/checks/packages.js

@@ -96,6 +96,7 @@ export async function run({ settings, settingsLoaded, agentDir: root, settingsFi
 	const unreadableDir = [];
 	const notDir = [];
 	const brokenManifest = [];
+	const nonObjectManifest = [];
 	const unreadableManifest = [];
 	// A directory with no package.json at all is not a permissions problem and the
 	// hint for one ("check ownership") sent the reader looking in the wrong place.
@@ -161,6 +162,15 @@ export async function run({ settings, settingsLoaded, agentDir: root, settingsFi
 			else unreadableManifest.push(`${redactSource(source)} (${manifest.error ?? "unreadable"})`);
 			continue;
 		}
+		// Valid JSON that is not an object — `null`, `"nope"`, `[]` — is not a
+		// manifest: nothing can read `.name`, `.version` or `.pi` off it, and the
+		// package cannot load. Counting it as "readable" put a green tick on a
+		// broken install, right next to an `entry files` row that skipped because
+		// the manifest declared nothing.
+		if (!manifest.data || typeof manifest.data !== "object" || Array.isArray(manifest.data)) {
+			nonObjectManifest.push(`${redactSource(source)} (${manifest.data === null ? "null" : Array.isArray(manifest.data) ? "an array" : typeof manifest.data})`);
+			continue;
+		}
 		manifestRead++;
 		// A pin and a different installed version is the gap between the code that
 		// was asked for and the code that runs. Only exact pins are comparable.
@@ -272,19 +282,16 @@ export async function run({ settings, settingsLoaded, agentDir: root, settingsFi
 			}),
 		);
 	}
-	if (brokenManifest.length) {
+	if (brokenManifest.length || nonObjectManifest.length) {
+		const parts = [];
+		if (brokenManifest.length) parts.push(`${brokenManifest.length} package.json not valid JSON: ${preview(brokenManifest, 3)}`);
+		if (nonObjectManifest.length) parts.push(`${nonObjectManifest.length} package.json not a JSON object: ${preview(nonObjectManifest, 3)}`);
 		results.push(
-			row(
-				"manifests",
-				"manifests",
-				"fail",
-				`${brokenManifest.length} package.json not valid JSON: ${preview(brokenManifest, 3)}`,
-				{
-					// A run that overlaps an install sees a manifest mid-rename. Saying so
-					// is the difference between "reinstall everything" and "wait 30 seconds".
-					hint: "Reinstall the affected packages. If an install or update is running right now, re-run once it finishes.",
-				},
-			),
+			row("manifests", "manifests", "fail", parts.join("; "), {
+				// A run that overlaps an install sees a manifest mid-rename. Saying so
+				// is the difference between "reinstall everything" and "wait 30 seconds".
+				hint: "Reinstall the affected packages. If an install or update is running right now, re-run once it finishes.",
+			}),
 		);
 	} else if (manifestRead) {
 		results.push(row("manifests", "manifests", "ok", `${manifestRead} readable`));

package/src/checks/registry.js

@@ -72,6 +72,12 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 		commandsByOwner.get(owner).push(command.name);
 	}
 	const toolsNamed = [...toolsByOwner.values()].reduce((n, list) => n + list.length, 0);
+	// Counted from every entry, not from `toolsByOwner`: that map only holds the
+	// named ones, so a registry whose entries carry no `name` printed
+	// "2 registered ... across 0 sources" — two tools from no source at all. A
+	// partly-named registry understated the same number.
+	const toolsSources = new Set(tools.map((tool) => ownerOf(tool?.sourceInfo?.path)));
+	const commandsSources = new Set(commands.map((command) => ownerOf(command?.sourceInfo?.path)));
 
 	// `sourceInfo.path` is a third-party field: a number here threw out of run()
 	// and replaced the whole Registry group with one crash row.
@@ -86,7 +92,7 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 					// started with tools disabled, and "0 registered across 0 sources"
 					// with a tick reads like everything is accounted for.
 					status: tools.length ? "ok" : "skip",
-					detail: `${tools.length} registered (${tools.length - builtinTools} extension, ${builtinTools} builtin) across ${toolsByOwner.size} sources`,
+					detail: `${tools.length} registered (${tools.length - builtinTools} extension, ${builtinTools} builtin) across ${toolsSources.size} sources`,
 				}
 			: {
 					group,
@@ -111,7 +117,7 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 			// pass. "0 registered across 0 sources" with a tick claims an answer
 			// the check does not have.
 			status: commands.length ? "ok" : "skip",
-			detail: `${commands.length} registered across ${commandsByOwner.size} sources, ${serverCount}`,
+			detail: `${commands.length} registered across ${commandsSources.size} sources, ${serverCount}`,
 		});
 	} else {
 		results.push({
@@ -141,7 +147,7 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 			id: "attribution",
 			title: "attribution",
 			status: "ok",
-			detail: `${toolsNamed} tool(s) from ${toolsByOwner.size} source(s): ${truncateList(ranked, 4)}`,
+			detail: `${toolsNamed} tool(s) from ${toolsByOwner.size} source(s): ${truncateList(ranked, 4)}${tools.length > toolsNamed ? ` (${tools.length - toolsNamed} entr${tools.length - toolsNamed === 1 ? "y carries" : "ies carry"} no name and cannot be attributed)` : ""}`,
 			hint: `Run with --verbose for the tool names. ${attribution}`,
 		});
 	}

package/src/checks/runtime.js

@@ -2,7 +2,7 @@
 import path from "node:path";
 import fs from "node:fs";
 import net from "node:net";
-import { bareHost, curlProbe, describeFsError, exists, humanBytes, isMissing, isWindows, proxyFromEnv, redactProxy, whichAll } from "../util.js";
+import { bareHost, curlProbe, describeFsError, humanBytes, isMissing, isWindows, proxyFromEnv, redactProxy, whichAll } from "../util.js";
 
 export const group = "Runtime";
 
@@ -127,7 +127,17 @@ export async function run({ offline = false, agentDir: root, env = process.env,
 	// --- pi binary ---------------------------------------------------------
 	const piBin = path.join(root, "bin", isWindows ? "pi.cmd" : "pi");
 	const piBinAlt = path.join(root, "bin", "pi");
-	const found = [piBin, piBinAlt].find(exists);
+	// `isFile`, not `exists`: a directory named `bin/pi` satisfied the existence
+	// check and its 0755 mode satisfied the executable check, so the row showed a
+	// green tick over something that cannot launch anything.
+	const isFile = (p) => {
+		try {
+			return fs.statSync(p).isFile();
+		} catch {
+			return false;
+		}
+	};
+	const found = [piBin, piBinAlt].find(isFile);
 	let executable = false;
 	if (found && !isWindows) {
 		try {
@@ -144,7 +154,7 @@ export async function run({ offline = false, agentDir: root, env = process.env,
 		// A pi installed by npm lives on PATH, not under the agent dir, so warning
 		// on the absence of ~/.pi/agent/bin/pi told those users their launcher was
 		// missing when `pi` was one PATH lookup away.
-		const onPath = whichAll("pi", env, { windows: isWindows }).find((c) => exists(c));
+		const onPath = whichAll("pi", env, { windows: isWindows }).find(isFile);
 		if (onPath) {
 			launcherStatus = "ok";
 			launcherDetail = `${onPath} (on PATH)`;
@@ -254,15 +264,24 @@ export { redactProxy };
 /** Does something accept connections at this proxy's own address? */
 async function checkProxy(proxy, env = process.env) {
 	const shown = redactProxy(proxy);
+	// `redactProxy` returns a parenthesised placeholder for a value that is nothing
+	// but a credential, so wrapping it again printed "configured ((configured))
+	// but not a parsable URL"; saying "value hidden" is clearer than repeating
+	// the word configured.
+	const shownInParens = shown.startsWith("(") ? "(value hidden)" : `(${shown})`;
 	const row = (status, detail, hint) => ({ group, id: "proxy", title: "proxy", status, detail, hint });
-	let parsed;
+	let parsed = null;
 	try {
 		parsed = new URL(proxy);
 	} catch {
-		return row("warn", `configured (${shown}) but not a parsable URL`, "Expected something like http://127.0.0.1:10808.");
+		// Not fatal here: `127.0.0.1:10808` and `proxy.corp:8080` are both shapes
+		// curl accepts, and only the second one parses as a URL (its "scheme" is a
+		// dotted name). Returning early on the throw judged the same env value two
+		// different ways depending on whether the host happened to start with a
+		// digit. The textual fallback below decides.
 	}
-	let hostname = parsed.hostname;
-	let port = Number(parsed.port) || DEFAULT_PROXY_PORT[parsed.protocol] || 0;
+	let hostname = parsed?.hostname ?? "";
+	let port = Number(parsed?.port) || DEFAULT_PROXY_PORT[parsed?.protocol] || 0;
 	if (!hostname || !port) {
 		// `proxy.corp:8080` with no scheme is a shape curl accepts and this check
 		// used to warn about — the same env value, judged two different ways.
@@ -281,7 +300,7 @@ async function checkProxy(proxy, env = process.env) {
 		}
 	}
 	if (!hostname || !port) {
-		return row("warn", `configured (${shown}) without a usable host and port`);
+		return row("warn", `configured ${shownInParens} but not a parsable URL`, "Expected something like http://127.0.0.1:10808.");
 	}
 
 	// Opt-in end-to-end test: an explicit probe URL means the user asked for
@@ -301,10 +320,10 @@ async function checkProxy(proxy, env = process.env) {
 		if (probe.setupFailed) {
 			// The request never left the machine, so accusing the proxy would be a
 			// finding this check did not establish.
-			return row("skip", `configured (${shown}); the probe could not be set up: ${probe.error}`);
+			return row("skip", `configured ${shownInParens}; the probe could not be set up: ${probe.error}`);
 		}
 		if (probe.missing) {
-			return row("skip", `configured (${shown}); curl is not installed so forwarding was not tested`);
+			return row("skip", `configured ${shownInParens}; curl is not installed so forwarding was not tested`);
 		}
 		const code = probe.code;
 		const numeric = Number(code);

package/src/context.js

@@ -64,10 +64,12 @@ export function buildContext({ pi, cwd, offline = false, agentDir: rootOverride,
 		settingsSource,
 		hasRuntime,
 		// Whether the agent directory came from an explicit `PI_CODING_AGENT_DIR`
-		// rather than the default location. A directory that is missing answers two
-		// different questions depending on that: on a machine that never ran Pi it is
-		// simply the first use, but a path the user typed and got wrong is a problem
-		// with this run — and the two must not both report as a warning.
+		// rather than the default location. A missing directory answers two different
+		// questions depending on that: on a machine that never ran Pi it is simply the
+		// first use, but a path the user typed and got wrong is a problem with this
+		// run. Both stay `warn` — a directory Pi has not created yet is not damage —
+		// but the row names the variable and tells the reader to check it, instead of
+		// sending them to create a default location this run never used.
 		agentDirExplicit: Boolean(agentDirExplicit),
 		// Checks read the environment through the context, not from process.env, so
 		// a test can describe a proxy or an unset variable without touching the

package/src/render.js

@@ -24,6 +24,41 @@ export function toJson(results, extra = {}) {
 	};
 }
 
+/**
+ * Columns a string occupies, not code units.
+ *
+ * A CJK path — `C:\Users\张三\.pi\agent` — is one code unit per character and
+ * two columns on every terminal, so measuring with `.length` wrapped one column
+ * short and let the line spill past the width the report promises to respect.
+ */
+function displayWidth(text) {
+	let width = 0;
+	for (const ch of String(text ?? "")) {
+		const cp = ch.codePointAt(0);
+		// Combining marks and zero-width joiners occupy no column of their own.
+		if (cp === 0x200b || cp === 0xfeff || (cp >= 0x0300 && cp <= 0x036f)) continue;
+		const wide =
+			(cp >= 0x1100 && cp <= 0x115f) ||
+			(cp >= 0x2e80 && cp <= 0x303e) ||
+			(cp >= 0x3041 && cp <= 0x33ff) ||
+			(cp >= 0x3400 && cp <= 0x4dbf) ||
+			(cp >= 0x4e00 && cp <= 0x9fff) ||
+			(cp >= 0xa000 && cp <= 0xa4cf) ||
+			(cp >= 0xa960 && cp <= 0xa97f) ||
+			(cp >= 0xac00 && cp <= 0xd7a3) ||
+			(cp >= 0xf900 && cp <= 0xfaff) ||
+			(cp >= 0xfe10 && cp <= 0xfe19) ||
+			(cp >= 0xfe30 && cp <= 0xfe6f) ||
+			(cp >= 0xff00 && cp <= 0xff60) ||
+			(cp >= 0xffe0 && cp <= 0xffe6) ||
+			(cp >= 0x1f300 && cp <= 0x1f64f) ||
+			(cp >= 0x1f900 && cp <= 0x1f9ff) ||
+			(cp >= 0x20000 && cp <= 0x3fffd);
+		width += wide ? 2 : 1;
+	}
+	return width;
+}
+
 /**
  * Greedy word wrap. `indent` is the column the text starts at, so every line has
  * the same available width and continuation lines line up under the text they
@@ -33,32 +68,59 @@ export function toJson(results, extra = {}) {
  * chunks rather than left to overflow: the terminal would wrap it anyway, and it
  * would do so with no indent, which breaks the column alignment that makes the
  * report scannable.
+ *
+ * Widths are display columns, not code units: see `displayWidth`.
  */
 function wrapText(text, width, indent) {
 	const body = String(text ?? "");
 	if (!body) return [""];
 	const avail = Math.max(8, width - indent);
-	if (body.length <= avail) return [body];
+	if (displayWidth(body) <= avail) return [body];
 
 	const lines = [];
 	let line = "";
+	let lineWidth = 0;
 	const flush = () => {
 		if (line) {
 			lines.push(line);
 			line = "";
+			lineWidth = 0;
 		}
 	};
 	for (const word of body.split(/\s+/).filter(Boolean)) {
-		if (word.length > avail) {
+		const wordWidth = displayWidth(word);
+		if (wordWidth > avail) {
 			flush();
-			for (let i = 0; i < word.length; i += avail) lines.push(word.slice(i, i + avail));
+			// Cut the long token into pieces that fit, measured in columns so a
+			// wide character cannot straddle the edge.
+			let piece = "";
+			let pieceWidth = 0;
+			for (const ch of word) {
+				const cw = displayWidth(ch);
+				if (pieceWidth + cw > avail) {
+					lines.push(piece);
+					piece = "";
+					pieceWidth = 0;
+				}
+				piece += ch;
+				pieceWidth += cw;
+			}
+			if (piece) {
+				line = piece;
+				lineWidth = pieceWidth;
+			}
 			continue;
 		}
-		if (!line) line = word;
-		else if (line.length + 1 + word.length <= avail) line += ` ${word}`;
-		else {
+		if (!line) {
+			line = word;
+			lineWidth = wordWidth;
+		} else if (lineWidth + 1 + wordWidth <= avail) {
+			line += ` ${word}`;
+			lineWidth += 1 + wordWidth;
+		} else {
 			flush();
 			line = word;
+			lineWidth = wordWidth;
 		}
 	}
 	flush();
@@ -92,7 +154,7 @@ export function renderReport(results, { verbose = false, hintCommand = "/checkup
 	// push a single row's detail out of alignment with every other row. A title
 	// longer than the cap gets its detail on its own line rather than shoving it
 	// past the column every wrapped continuation line uses.
-	const titleWidth = Math.min(22, Math.max(8, ...results.map((r) => r.title.length)));
+	const titleWidth = Math.min(22, Math.max(8, ...results.map((r) => displayWidth(r.title))));
 	// Below this width the title column plus one word of detail leaves a gutter
 	// too narrow to read ("package dirs 2 missing from" then two words a line), so
 	// the detail moves under the title instead of beside it.
@@ -105,7 +167,7 @@ export function renderReport(results, { verbose = false, hintCommand = "/checkup
 		for (const r of byGroup.get(g)) {
 			const mark = `  ${MARKS[r.status] ?? "?"} `;
 			const title = r.title.padEnd(titleWidth);
-			if (stacked || r.title.length > titleWidth) {
+			if (stacked || displayWidth(r.title) > titleWidth) {
 				// The title gets the same treatment as the detail: a name that does not
 				// fit would otherwise set the width for the whole report.
 				const titleParts = wrapText(r.title, width, mark.length);
@@ -130,12 +192,20 @@ export function renderReport(results, { verbose = false, hintCommand = "/checkup
 	const s = summarize(results);
 	lines.push("");
 	const warnWord = s.warn === 1 ? "warning" : "warnings";
-	lines.push(`${s.total} checks: ${s.ok} ok, ${s.warn} ${warnWord}, ${s.fail} failed${s.skip ? `, ${s.skip} skipped` : ""}`);
+	// Wrapped like every other line: the summary is the longest single sentence in
+	// a short report — "19 checks: 11 ok, 0 warnings, 0 failed, 8 skipped" is 51
+	// columns — and leaving it unwrapped broke the width the rest of the report
+	// respects on a narrow terminal or a split pane.
+	for (const part of wrapText(`${s.total} checks: ${s.ok} ok, ${s.warn} ${warnWord}, ${s.fail} failed${s.skip ? `, ${s.skip} skipped` : ""}`, width, 0)) {
+		lines.push(part);
+	}
 	// Any hint, on any row. Tying this to non-ok rows meant a report whose only
 	// finding carried no hint never mentioned --verbose at all, so the user had
 	// no way to learn the flag exists.
 	if (!verbose && results.some((r) => r.hint)) {
-		lines.push(`Run \`${hintCommand}\` to show what to do about each finding.`);
+		for (const part of wrapText(`Run \`${hintCommand}\` to show what to do about each finding.`, width, 0)) {
+			lines.push(part);
+		}
 	}
 	return lines.join("\n");
 }

package/src/repair.js

@@ -6,7 +6,7 @@
 // and none of them deletes a package or disables an extension.
 import fs from "node:fs";
 import path from "node:path";
-import { isMissing, newestBackup, readJson, redactSource, resolvePackageDir, scrubCredentials, sourceOf } from "./util.js";
+import { backupsNewestFirst, isMissing, readJson, redactSource, resolvePackageDir, scrubCredentials, sourceOf } from "./util.js";
 
 function stamp() {
 	// Milliseconds are kept: two repairs in the same second would otherwise
@@ -35,6 +35,26 @@ function copyBackup(target, label = "checkup-bak") {
 	throw new Error(`could not find a free backup name for ${path.basename(target)}`);
 }
 
+/**
+ * The backup for `target` in this run, made once and reused.
+ *
+ * Two repairs can hit the same file: a prune and a dedupe both rewrite
+ * `settings.json`, and each used to write its own backup a few milliseconds
+ * apart. That left the newest backup holding the *intermediate* state — after
+ * the prune, before the dedupe — and `restore` picks the newest backup, so
+ * undoing a broken config handed back a half-repaired file instead of the one
+ * the user had before checkup touched it. One backup per file per run keeps
+ * "the backup" meaning "before this run".
+ */
+function backupFor(target, backups) {
+	if (!backups) return copyBackup(target);
+	const existing = backups.get(target);
+	if (existing) return existing;
+	const made = copyBackup(target);
+	backups.set(target, made);
+	return made;
+}
+
 /** Flush a directory entry so a rename survives a power loss. Best effort. */
 function syncDir(dir) {
 	let fd;
@@ -157,12 +177,28 @@ export function applyRestoreConfig(target) {
 	// it would undo the fix.
 	const current = readJson(target);
 	if (current.ok) return { ok: false, message: `${path.basename(target)} is valid JSON again — nothing to restore` };
-	const backup = newestBackup(target);
-	if (!backup) return { ok: false, message: `no backup found for ${path.basename(target)}` };
-	const parsed = readJson(backup);
-	// `!ok` covers oversized and unreadable too, and telling the user a valid
-	// 5 MB backup "is not valid JSON" is the same false claim the checks avoid.
-	if (!parsed.ok) return { ok: false, message: `nothing to restore from: ${unreadable(backup, parsed).message}` };
+	const candidates = backupsNewestFirst(target);
+	if (!candidates.length) return { ok: false, message: `no backup found for ${path.basename(target)}` };
+	// Newest first, and the first one that parses wins. Taking only the newest
+	// meant a corrupt newest backup — a copy taken while the file was already
+	// damaged — blocked the valid one sitting next to it, which is the exact
+	// situation restore exists for.
+	let backup = null;
+	const rejected = [];
+	for (const candidate of candidates) {
+		const parsed = readJson(candidate);
+		if (parsed.ok) {
+			backup = candidate;
+			break;
+		}
+		// `!ok` covers oversized and unreadable too, and telling the user a valid
+		// 5 MB backup "is not valid JSON" is the same false claim the checks avoid.
+		rejected.push(unreadable(candidate, parsed).message);
+	}
+	if (!backup) {
+		return { ok: false, message: `nothing to restore from: ${rejected.join("; ")}` };
+	}
+	const skipped = candidates.indexOf(backup);
 	const aside = copyBackup(target, "broken");
 	// The backup is valid JSON (checked above), so restoring its bytes verbatim
 	// keeps any formatting the user had. If the write itself fails after the
@@ -183,7 +219,7 @@ export function applyRestoreConfig(target) {
 	return {
 		ok: true,
 		changed: true,
-		message: `restored ${path.basename(target)} from ${path.basename(backup)} (broken copy kept as ${path.basename(aside)})`,
+		message: `restored ${path.basename(target)} from ${path.basename(backup)}${skipped ? ` (skipped ${skipped} newer backup(s) that do not parse)` : ""} (broken copy kept as ${path.basename(aside)})`,
 	};
 }
 
@@ -196,7 +232,7 @@ export function applyRestoreConfig(target) {
  * the second one silently changed what Pi loads. The backup would have made it
  * recoverable, but a repair that needs its backup is not a repair.
  */
-export function applyDedupePackages(target) {
+export function applyDedupePackages(target, options = {}) {
 	const settings = readJson(target);
 	if (!settings.ok) return unreadable(target, settings);
 	if (!Array.isArray(settings.data?.packages)) return { ok: false, message: "no packages array to dedupe" };
@@ -213,7 +249,7 @@ export function applyDedupePackages(target) {
 	// between — a second read would prove nothing. Backing up before the plan was
 	// known left a stray `.checkup-bak-*` beside a healthy config on runs that
 	// repaired nothing.
-	const backup = copyBackup(target);
+	const backup = backupFor(target, options.backups);
 	settings.data.packages = plan.kept;
 	writeAtomic(target, `${JSON.stringify(settings.data, null, 2)}\n`);
 	return {
@@ -258,7 +294,7 @@ function dedupePlan(packages) {
  * `dirname(target)` would resolve every entry under the wrong root if this were
  * ever pointed at a project-level settings file.
  */
-export function applyPruneMissingPackages(target, root) {
+export function applyPruneMissingPackages(target, root, options = {}) {
 	// Not defaulted: a wrong root makes every entry look missing, and this repair
 	// deletes what it cannot resolve.
 	if (!root) throw new Error("applyPruneMissingPackages needs the agent directory to resolve packages against");
@@ -288,7 +324,7 @@ export function applyPruneMissingPackages(target, root) {
 
 	// Same reasoning as dedupe: the read above is post-prompt, and the rest of
 	// this function is synchronous.
-	const backup = copyBackup(target);
+	const backup = backupFor(target, options.backups);
 	settings.data.packages = plan.kept;
 	writeAtomic(target, `${JSON.stringify(settings.data, null, 2)}\n`);
 	return {
@@ -328,8 +364,8 @@ function prunePlan(packages, root) {
 /** Named repairs, keyed by the `fix` field a check emits. */
 const REPAIRS = {
 	"restore-config": (target) => applyRestoreConfig(target),
-	"dedupe-packages": (target) => applyDedupePackages(target),
-	"prune-missing-packages": applyPruneMissingPackages,
+	"dedupe-packages": (target, ctx) => applyDedupePackages(target, ctx),
+	"prune-missing-packages": (target, ctx) => applyPruneMissingPackages(target, ctx?.agentDir, ctx),
 };
 
 
@@ -344,6 +380,9 @@ const REPAIRS = {
 export async function applyRepairs(findings, { agentDir } = {}) {
 	const applied = [];
 	const seen = new Set();
+	// Shared across every repair in this run: one backup per file, taken before
+	// the first write to it, so `restore` undoes the run rather than its last step.
+	const ctx = { agentDir, backups: new Map() };
 	for (const finding of findings) {
 		const key = `${finding.fix}:${finding.fixTarget}`;
 		if (seen.has(key)) continue;
@@ -355,7 +394,7 @@ export async function applyRepairs(findings, { agentDir } = {}) {
 			continue;
 		}
 		try {
-			applied.push(repair(finding.fixTarget, agentDir));
+			applied.push(repair(finding.fixTarget, ctx));
 		} catch (e) {
 			// Scrubbed like every other error path: fs errors embed absolute paths and
 			// the prune guard's throw can quote a package source, which may carry a

package/src/util.js

@@ -285,16 +285,27 @@ export function normalizePath(p) {
  * two naming schemes do not sort chronologically against each other.
  */
 export function newestBackup(file) {
+	return backupsNewestFirst(file)[0] ?? null;
+}
+
+/**
+ * Every backup of `file`, newest first.
+ *
+ * `restore` used to take only the newest one and give up when it did not parse,
+ * which failed the one case recovery exists for: the newest backup was corrupt
+ * — a copy taken while the file was already damaged — and a valid older one sat
+ * right next to it. Callers walk this list and stop at the first that parses.
+ */
+export function backupsNewestFirst(file) {
 	const dir = path.dirname(file);
 	const base = path.basename(file);
 	let entries;
 	try {
 		entries = fs.readdirSync(dir);
 	} catch {
-		return null;
+		return [];
 	}
-	let best = null;
-	let bestTime = Number.NEGATIVE_INFINITY;
+	const found = [];
 	for (const entry of entries) {
 		if (entry === base || !entry.startsWith(base)) continue;
 		// Anchored: the marker has to start right after `settings.json`. Unanchored,
@@ -308,14 +319,12 @@ export function newestBackup(file) {
 		} catch {
 			continue; // dangling symlink or raced deletion
 		}
-		// A bulk copy can give several backups the same mtime; break the tie on
-		// the name so repeated runs always pick the same file.
-		if (mtimeMs > bestTime || (mtimeMs === bestTime && best !== null && full > best)) {
-			best = full;
-			bestTime = mtimeMs;
-		}
+		found.push({ file: full, mtimeMs });
 	}
-	return best;
+	// A bulk copy can give several backups the same mtime; break the tie on the
+	// name so repeated runs always see the same order.
+	found.sort((a, b) => b.mtimeMs - a.mtimeMs || (a.file < b.file ? 1 : a.file > b.file ? -1 : 0));
+	return found.map((entry) => entry.file);
 }
 
 /**
@@ -679,7 +688,11 @@ export function redactUrl(raw) {
 		// Printing `url.origin` would then print the string "null".
 		if (!url.hostname) return scrubCredentials(text);
 		const path = url.pathname === "/" ? "" : url.pathname;
-		return `${url.protocol}//${url.host}${path}`;
+		// Scrubbed, not returned raw: a gateway that takes its key in the path —
+		// `https://host/ghp_…/v1` — put the credential back into the report through
+		// the one function whose job is to keep it out. The host itself cannot
+		// match a token shape, so scrubbing the assembled string is safe.
+		return scrubCredentials(`${url.protocol}//${url.host}${path}`);
 	} catch {
 		return scrubCredentials(text);
 	}
@@ -803,6 +816,29 @@ export function scrubCredentials(text) {
 			// `npm:alice:pw@host` and the single slash in `https:/alice:pw@host`
 			// still start a match.
 			.replace(/(^|[\s"'=(,:/])(?!(?:npm|git|file|https?|ssh|link):)([^\s/@:'"]+):([^\s/@]*?)@/g, "$1***@")
+			// A bare token has no userinfo and no query string for the rules above to
+			// find. An error message that quoted one — "extension load failed for
+			// provider openai with apiKey sk-…" — reached the report, the TUI
+			// notification and --json verbatim, minus whatever the caller's own
+			// truncation happened to cut. These are the shapes that carry enough
+			// entropy to be a real credential and enough of a fixed prefix to be
+			// recognised without guessing.
+			.replace(/\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g, "***")
+			.replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "***")
+			.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}/g, "***")
+			.replace(/\bnpm_[A-Za-z0-9]{20,}/g, "***")
+			.replace(/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, "***")
+			.replace(/\bAKIA[0-9A-Z]{16}\b/g, "***")
+			.replace(/\bAIza[0-9A-Za-z_-]{30,}/g, "***")
+			// A JWT is three base64url segments and is what an `Authorization`
+			// header usually holds.
+			.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "***")
+			.replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 ***")
+			// The value after a credential-named key, whatever shape it has: a token
+			// with no recognisable prefix is still a token when the line says
+			// `apiKey: …`. The value stops at whitespace and at the punctuation that
+			// ends a sentence, so surrounding prose survives.
+			.replace(/\b(api[-_]?key|access[-_]?token|auth[-_]?token|token|secret|password|passwd)\s*([:=])\s*[^\s,;)"']+/gi, "$1$2***")
 			// A query string is dropped whole rather than masked: it is where a pasted
 			// `?key=sk-…` lives, and nothing in a report needs it.
 			.replace(/\?[^\s]*/g, "")