pi-ghost-autocomplete 0.3.1 → 0.3.2

package/dist/cache.js

@@ -0,0 +1,173 @@
+import { createHash } from "node:crypto";
+import { combinedVersionFingerprint } from "./versions.js";
+import { tryWarm } from "./speculative.js";
+export const DEFAULT_CAPACITY = 256;
+export const DEFAULT_TTL_MS = 10 * 60 * 1000;
+/**
+ * Build a stable cache key. Combines prefix, context fingerprint, provider
+ * fingerprint, the global behavior fingerprint, and (optionally) the engine
+ * config fingerprint so that prompt-template, sanitizer, context-aggregator,
+ * reranker, profile-hint, AND env-knob changes all invalidate stale entries.
+ */
+export function makeKey(input) {
+    const sep = "\x00";
+    const raw = [
+        input.prefix,
+        input.contextFingerprint,
+        input.providerFingerprint,
+        combinedVersionFingerprint(),
+        input.configFingerprint ?? "",
+    ].join(sep);
+    return createHash("sha1").update(raw).digest("hex");
+}
+/**
+ * Fingerprint over the final provider-visible input. The PRD requires this
+ * to be computed over the rendered final input (after pruning/truncation)
+ * rather than a raw branch slice. Callers should pass the same messages
+ * array the provider will receive.
+ *
+ * Tool-call metadata (`toolName`) participates in the hash so distinct tool
+ * results collapse to distinct fingerprints.
+ */
+export function fingerprintRecentMessages(messages) {
+    const h = createHash("sha1");
+    for (const m of messages) {
+        h.update(m.role);
+        h.update("\x00");
+        h.update(m.text);
+        h.update("\x00");
+        h.update(m.toolName ?? "");
+        h.update("\x01");
+    }
+    return h.digest("hex");
+}
+/**
+ * Fingerprint identifying a provider configuration. Anything that, if
+ * changed, would produce a different completion belongs here.
+ */
+export function fingerprintProvider(parts) {
+    const e = parts.extras ?? {};
+    const fields = [
+        ["kind", parts.kind],
+        ["providerName", parts.providerName],
+        ["modelId", parts.modelId],
+        ["temperature", String(parts.temperature)],
+        ["maxTokens", String(parts.maxTokens)],
+        ["maxRecentMessages", String(parts.maxRecentMessages)],
+        ...Object.keys(e)
+            .sort()
+            .map((k) => [k, String(e[k] ?? "")]),
+    ];
+    const h = createHash("sha1");
+    for (const [k, v] of fields) {
+        h.update(k);
+        h.update("=");
+        h.update(v);
+        h.update("\x00");
+    }
+    return h.digest("hex");
+}
+/**
+ * Small LRU cache for ghost completions.
+ *
+ * - Capacity-bounded; oldest entry is evicted on insert overflow.
+ * - TTL-bounded; expired entries are treated as miss and removed lazily on
+ *   access.
+ * - `delete()` is exposed so callers can explicitly evict on divergent
+ *   dismiss (see PRD §6 M1a).
+ *
+ * Not thread-safe, but the ghost editor is single-threaded.
+ */
+export class CompletionCache {
+    capacity;
+    ttlMs;
+    store = new Map();
+    hits = 0;
+    misses = 0;
+    constructor(capacity = DEFAULT_CAPACITY, ttlMs = DEFAULT_TTL_MS) {
+        this.capacity = capacity;
+        this.ttlMs = ttlMs;
+    }
+    get size() {
+        return this.store.size;
+    }
+    /** PRD §M3g — exposed via `/ghost` diagnostics. */
+    get stats() {
+        const total = this.hits + this.misses;
+        return {
+            size: this.store.size,
+            hits: this.hits,
+            misses: this.misses,
+            hitRate: total > 0 ? this.hits / total : 0,
+        };
+    }
+    get(key, now = Date.now()) {
+        const v = this.store.get(key);
+        if (!v) {
+            this.misses++;
+            return null;
+        }
+        if (now - v.ts > this.ttlMs) {
+            this.store.delete(key);
+            this.misses++;
+            return null;
+        }
+        // LRU touch: re-insert to move to end.
+        this.store.delete(key);
+        this.store.set(key, v);
+        this.hits++;
+        return v;
+    }
+    set(key, value) {
+        if (this.store.has(key))
+            this.store.delete(key);
+        this.store.set(key, value);
+        while (this.store.size > this.capacity) {
+            const oldest = this.store.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.store.delete(oldest);
+        }
+    }
+    delete(key) {
+        return this.store.delete(key);
+    }
+    clear() {
+        this.store.clear();
+    }
+}
+export function decideWarmPath(input) {
+    const cacheKey = makeKey({
+        prefix: input.prefix,
+        contextFingerprint: input.contextFingerprint,
+        providerFingerprint: input.providerFingerprint,
+        ...(input.configFingerprint !== undefined ? { configFingerprint: input.configFingerprint } : {}),
+    });
+    const hit = input.cache.get(cacheKey, input.now);
+    if (hit && hit.ghost) {
+        return {
+            ghost: hit.ghost,
+            mode: "cache",
+            providerName: hit.providerName,
+            cacheKey,
+        };
+    }
+    const match = tryWarm(input.ring, {
+        prefix: input.prefix,
+        contextFingerprint: input.contextFingerprint,
+        providerFingerprint: input.providerFingerprint,
+        versionFingerprint: input.versionFingerprint,
+        ...(input.configFingerprint !== undefined ? { configFingerprint: input.configFingerprint } : {}),
+        cooldownActive: input.cooldownActive,
+    });
+    if (match) {
+        return {
+            ghost: match.ghost,
+            mode: "speculative-warm",
+            providerName: match.source.providerName,
+            cacheKey,
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,EAAkB,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAoC7C;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,KAAoB;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,MAAM,GAAG,GAAG;QACX,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,kBAAkB;QACxB,KAAK,CAAC,mBAAmB;QACzB,0BAA0B,EAAE;QAC5B,KAAK,CAAC,iBAAiB,IAAI,EAAE;KAC7B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAyB;IAClE,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAQnC;IACA,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAA4B;QACvC,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QACpC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACtD,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;aACf,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAqB,CAAC;KACzD,CAAC;IACF,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAe;IAMT;IACA;IAND,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,IAAI,GAAG,CAAC,CAAC;IACT,MAAM,GAAG,CAAC,CAAC;IAEnB,YACkB,WAAmB,gBAAgB,EACnC,QAAgB,cAAc;QAD9B,aAAQ,GAAR,QAAQ,CAA2B;QACnC,UAAK,GAAL,KAAK,CAAyB;IAC7C,CAAC;IAEJ,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,mDAAmD;IACnD,IAAI,KAAK;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;SAC1C,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACb,CAAC;QACD,uCAAuC;QACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACV,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAiB;QACjC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED,MAAM,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACD;AA6BD,MAAM,UAAU,cAAc,CAAC,KAAoB;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO;YACN,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ;SACR,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,cAAc,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACX,OAAO;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,kBAAkB;YACxB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,QAAQ;SACR,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/candidate-rerank.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Pure rerank pipeline for an LLM `CandidateSet`. Extracted from
+ * `GhostEditor.requestPrediction` as part of refactor #57 so the editor
+ * stays thin and the rerank-+-confidence-gate path is unit-testable in
+ * isolation.
+ *
+ * PRD §M3c (weighted reranker) + §M3c.1 (confidence gate) + §M4
+ * (profile-bias signal). Single-candidate sets bypass the reranker
+ * entirely — there is no reordering to do and the confidence gate is
+ * not applicable (it operates on the reranked top-vs-second margin).
+ *
+ * No `this`, no I/O, no editor state — caller supplies env strings and
+ * an optional `profileBias` function.
+ */
+export interface RerankCandidateSetInput {
+    /** Provider's raw candidate list (post-dedup). At least one entry expected. */
+    candidates: {
+        text: string;
+        avgLogprob?: number;
+    }[];
+    /** Provider name — drives the local-vs-cloud bias in the reranker. */
+    providerName: string;
+    /** Full text-before-cursor at request time. Used to slice the
+     *  last-line prefix for the lengthPrior curve. */
+    prefix: string;
+    /** Raw `PI_GHOST_RERANK_WEIGHTS` env value. */
+    weightsEnvRaw: string | undefined;
+    /** Raw `PI_GHOST_MIN_CONFIDENCE` env value. `undefined` disables
+     *  the gate entirely; an invalid string is treated as "no gate". */
+    minConfidenceEnvRaw: string | undefined;
+    /** Optional cross-session profile-bias hook (M4). */
+    profileBias?: (text: string) => number;
+    /**
+     * Enhancement #1 — optional edit-history proximity scorer. Receives raw
+     * candidate text; returns a real number (negative permitted for tokens
+     * recently deleted). Missing → all candidates score 0 in that feature.
+     */
+    editProximityScorer?: (text: string) => number;
+}
+export type RerankCandidateSetResult = {
+    gated: false;
+    candidateTexts: string[];
+    topText: string;
+    /** Top-candidate raw editProximity score (un-normalized). Populated
+     *  only when `editProximityScorer` was supplied. */
+    topEditProximityScore?: number;
+} | {
+    gated: true;
+};
+/**
+ * Rerank a candidate set + apply the optional confidence gate. Returns
+ * `{ gated: true }` when the gate rejected the result (caller should emit
+ * a `rejected` metric and skip rendering). Otherwise returns the reordered
+ * candidate texts plus the top pick.
+ */
+export declare function rerankCandidateSet(input: RerankCandidateSetInput): RerankCandidateSetResult;
+//# sourceMappingURL=candidate-rerank.d.ts.map

package/dist/candidate-rerank.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate-rerank.d.ts","sourceRoot":"","sources":["../src/candidate-rerank.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,MAAM,WAAW,uBAAuB;IACvC,+EAA+E;IAC/E,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB;sDACkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;wEACoE;IACpE,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,qDAAqD;IACrD,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACvC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/C;AAED,MAAM,MAAM,wBAAwB,GACjC;IACA,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;wDACoD;IACpD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC;AAEnB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,wBAAwB,CAsD3F"}

package/dist/candidate-rerank.js

@@ -0,0 +1,78 @@
+/**
+ * Pure rerank pipeline for an LLM `CandidateSet`. Extracted from
+ * `GhostEditor.requestPrediction` as part of refactor #57 so the editor
+ * stays thin and the rerank-+-confidence-gate path is unit-testable in
+ * isolation.
+ *
+ * PRD §M3c (weighted reranker) + §M3c.1 (confidence gate) + §M4
+ * (profile-bias signal). Single-candidate sets bypass the reranker
+ * entirely — there is no reordering to do and the confidence gate is
+ * not applicable (it operates on the reranked top-vs-second margin).
+ *
+ * No `this`, no I/O, no editor state — caller supplies env strings and
+ * an optional `profileBias` function.
+ */
+import { applyConfidenceGate, parseMinConfidenceEnv, parseWeightsEnv, rerank, } from "./reranker.js";
+/**
+ * Rerank a candidate set + apply the optional confidence gate. Returns
+ * `{ gated: true }` when the gate rejected the result (caller should emit
+ * a `rejected` metric and skip rendering). Otherwise returns the reordered
+ * candidate texts plus the top pick.
+ */
+export function rerankCandidateSet(input) {
+    // Empty set is structurally invalid for this function — the caller
+    // must guard for `!result || !set` BEFORE invoking. Treat as gated so
+    // any future re-use can't silently render an empty ghost.
+    if (input.candidates.length === 0) {
+        return { gated: true };
+    }
+    // Single-candidate path: nothing to reorder, gate doesn't apply
+    // (it needs a top-vs-second margin). Still surface editProximity raw
+    // score for metric capture when scorer was supplied.
+    if (input.candidates.length === 1) {
+        const only = input.candidates[0];
+        const ep = input.editProximityScorer ? input.editProximityScorer(only.text) : undefined;
+        return {
+            gated: false,
+            candidateTexts: [only.text],
+            topText: only.text,
+            ...(ep !== undefined ? { topEditProximityScore: ep } : {}),
+        };
+    }
+    const local = input.providerName === "ghost-local";
+    const inputs = input.candidates.map((c) => ({
+        text: c.text,
+        provider: input.providerName,
+        local,
+        ...(c.avgLogprob !== undefined ? { avgLogprob: c.avgLogprob } : {}),
+    }));
+    // PRD-adjacent (#5): pass last-line prefix length so the lengthPrior
+    // curve scales for long-prefix queries. Document-level length would
+    // over-extend the curve on multi-line buffers; the active line is
+    // what the user is currently typing.
+    const lastLinePrefix = input.prefix.split("\n").pop() ?? "";
+    const ranked = rerank(inputs, {
+        weights: parseWeightsEnv(input.weightsEnvRaw),
+        prefixLen: lastLinePrefix.length,
+        ...(input.profileBias ? { profileBias: input.profileBias } : {}),
+        ...(input.editProximityScorer ? { editProximityScorer: input.editProximityScorer } : {}),
+    });
+    if (input.minConfidenceEnvRaw !== undefined) {
+        const gated = applyConfidenceGate(ranked, {
+            minConfidence: parseMinConfidenceEnv(input.minConfidenceEnvRaw),
+        });
+        if (!gated)
+            return { gated: true };
+    }
+    const topText = ranked[0].text;
+    const topEditProximityScore = input.editProximityScorer
+        ? input.editProximityScorer(topText)
+        : undefined;
+    return {
+        gated: false,
+        candidateTexts: ranked.map((r) => r.text),
+        topText,
+        ...(topEditProximityScore !== undefined ? { topEditProximityScore } : {}),
+    };
+}
+//# sourceMappingURL=candidate-rerank.js.map

package/dist/candidate-rerank.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate-rerank.js","sourceRoot":"","sources":["../src/candidate-rerank.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACN,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,MAAM,GAEN,MAAM,eAAe,CAAC;AAoCvB;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAChE,mEAAmE;IACnE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,gEAAgE;IAChE,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,EAAE,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,KAAK,aAAa,CAAC;IACnD,MAAM,MAAM,GAAoB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,KAAK,CAAC,YAAY;QAC5B,KAAK;QACL,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC,CAAC;IACJ,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,qCAAqC;IACrC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7C,SAAS,EAAE,cAAc,CAAC,MAAM;QAChC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACzC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,mBAAmB,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;IAChC,MAAM,qBAAqB,GAAG,KAAK,CAAC,mBAAmB;QACtD,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,KAAK,EAAE,KAAK;QACZ,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,OAAO;QACP,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -10,8 +10,17 @@ export interface OpenAICompatProviderConfig {
     debounceMs: number;
     maxTokens: number;
     maxRecentMessages: number;
+    /** Sampling temperature. 0 for deterministic-ish output (best-effort). */
+    temperature: number;
     /** Optional context-window hint passed to pi-ai. Defaults to 8192. */
     contextWindow?: number;
+    /**
+     * Number of parallel candidate completions to fire when `predictMulti`
+     * is called. 1 means no parallelism. Useful only at temperature > 0
+     * (otherwise all parallel calls return the same greedy result).
+     * Default 1. Override via `PI_GHOST_MERCURY_PARALLEL_N`.
+     */
+    parallelN: number;
 }
 export interface CloudProviderConfig {
     kind: "cloud";
@@ -21,6 +30,7 @@ export interface CloudProviderConfig {
     debounceMs: number;
     maxTokens: number;
     maxRecentMessages: number;
+    temperature: number;
 }
 export interface LocalProviderConfig {
     kind: "local";
@@ -29,6 +39,7 @@ export interface LocalProviderConfig {
     debounceMs: number;
     maxTokens: number;
     maxRecentMessages: number;
+    temperature: number;
     /** Optional context-window hint passed to pi-ai. Defaults to 8192. */
     contextWindow?: number;
 }
@@ -52,4 +63,36 @@ export declare const DEFAULT_LOCAL_CONFIG: LocalProviderConfig;
 export declare const DEFAULT_MERCURY_CONFIG: OpenAICompatProviderConfig;
 export declare const DEFAULT_CONFIG: GhostConfig;
 export declare function readConfigFromEnv(): GhostConfig;
+/**
+ * Strip CR/LF and surrounding whitespace from an API key (SEC-7). Prevents
+ * HTTP header injection via `Authorization: Bearer ${apiKey}` when a
+ * malformed `.env` file or environment manipulation injects newlines.
+ * Returns undefined for empty results so callers fall back to env lookup.
+ */
+export declare function sanitizeApiKey(raw: string | undefined): string | undefined;
+/**
+ * Produce a deep copy of a config with all `apiKey` fields removed (SEC-8).
+ * Use before any logging, diagnostics dump, telemetry, or serialization.
+ * The original config remains live with its keys for actual provider use.
+ *
+ * Defensive: even fields not currently typed as containing keys are scrubbed
+ * via a recursive walk that drops any property named `apiKey` (case-sensitive).
+ *
+ * Caveats: class instances become plain objects (methods lost). Cyclic
+ * structures would recurse infinitely — caller must ensure acyclic input.
+ * Both caveats are fine for `GhostConfig` which is plain JSON-shaped.
+ */
+export declare function redactConfig<T>(cfg: T): T;
+/**
+ * Validate a provider baseUrl (SEC-1). Returns the URL on success, null
+ * on failure with a stderr warning. Rules:
+ *  - Must be a parseable absolute URL.
+ *  - `https:` always allowed.
+ *  - `http:` only allowed for `localhost` / `127.0.0.1` / `::1` — sending
+ *    API keys + prompt context in cleartext to anything else is almost
+ *    certainly a misconfiguration. Setting `PI_GHOST_ALLOW_INSECURE=1`
+ *    bypasses this check.
+ *  - Other schemes (`file:`, `data:`, etc.) rejected unconditionally.
+ */
+export declare function validateBaseUrl(raw: string, fieldName?: string): string | null;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,eAAe,GAAG,MAAM,CAAC;AAExE,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,eAAe,CAAC;IACtB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,mBAAmB,GAAG,mBAAmB,GAAG,0BAA0B,CAAC,CAAC;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GACvB,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,kBAAkB,CAAC;AAEtB,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,oBAAoB,EAAE,mBAOlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,mBAOlC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,0BAQpC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,WAK5B,CAAC;AAqBF,wBAAgB,iBAAiB,IAAI,WAAW,CAwC/C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,eAAe,GAAG,MAAM,CAAC;AAExE,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,eAAe,CAAC;IACtB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC,mBAAmB,GAAG,mBAAmB,GAAG,0BAA0B,CAAC,CAAC;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GACvB,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,kBAAkB,CAAC;AAEtB,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,oBAAoB,EAAE,mBAQlC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,mBAQlC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,0BAUpC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,WAK5B,CAAC;AAqBF,wBAAgB,iBAAiB,IAAI,WAAW,CAwD/C;AAsHD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAEzC;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,SAAsB,GAAG,MAAM,GAAG,IAAI,CAsB3F"}

package/dist/config.js

@@ -6,6 +6,7 @@ export const DEFAULT_CLOUD_CONFIG = {
     debounceMs: 150,
     maxTokens: 64,
     maxRecentMessages: 4,
+    temperature: 0,
 };
 export const DEFAULT_LOCAL_CONFIG = {
     kind: "local",
@@ -14,6 +15,7 @@ export const DEFAULT_LOCAL_CONFIG = {
     debounceMs: 400,
     maxTokens: 48,
     maxRecentMessages: 2,
+    temperature: 0,
 };
 export const DEFAULT_MERCURY_CONFIG = {
     kind: "openai-compat",
@@ -23,6 +25,8 @@ export const DEFAULT_MERCURY_CONFIG = {
     debounceMs: 150,
     maxTokens: 64,
     maxRecentMessages: 4,
+    temperature: 0,
+    parallelN: 1,
 };
 export const DEFAULT_CONFIG = {
     enabled: true,
@@ -67,35 +71,50 @@ export function readConfigFromEnv() {
             cfg.provider.provider = process.env.PI_GHOST_PROVIDER_NAME;
         if (process.env.PI_GHOST_MODEL)
             cfg.provider.modelId = process.env.PI_GHOST_MODEL;
-        if (process.env.PI_GHOST_API_KEY)
-            cfg.provider.apiKey = process.env.PI_GHOST_API_KEY;
+        const apiKey = sanitizeApiKey(process.env.PI_GHOST_API_KEY);
+        if (apiKey !== undefined)
+            cfg.provider.apiKey = apiKey;
         cfg.provider.debounceMs = numEnv("PI_GHOST_DEBOUNCE_MS", cfg.provider.debounceMs);
         cfg.provider.maxTokens = numEnv("PI_GHOST_MAX_TOKENS", cfg.provider.maxTokens);
         cfg.provider.maxRecentMessages = numEnv("PI_GHOST_RECENT", cfg.provider.maxRecentMessages);
+        cfg.provider.temperature = tempEnv(cfg.provider.temperature);
     }
     else if (cfg.provider.kind === "openai-compat") {
-        if (process.env.PI_GHOST_BASE_URL)
-            cfg.provider.baseUrl = process.env.PI_GHOST_BASE_URL;
-        else if (process.env.INCEPTION_BASE_URL)
-            cfg.provider.baseUrl = process.env.INCEPTION_BASE_URL;
+        const baseUrlRaw = process.env.PI_GHOST_BASE_URL ?? process.env.INCEPTION_BASE_URL;
+        if (baseUrlRaw) {
+            const fieldName = process.env.PI_GHOST_BASE_URL ? "PI_GHOST_BASE_URL" : "INCEPTION_BASE_URL";
+            const validated = validateBaseUrl(baseUrlRaw, fieldName);
+            if (validated)
+                cfg.provider.baseUrl = validated;
+        }
         if (process.env.PI_GHOST_MODEL)
             cfg.provider.modelId = process.env.PI_GHOST_MODEL;
-        if (process.env.PI_GHOST_API_KEY)
-            cfg.provider.apiKey = process.env.PI_GHOST_API_KEY;
-        else if (process.env.INCEPTION_API_KEY)
-            cfg.provider.apiKey = process.env.INCEPTION_API_KEY;
+        const apiKey = sanitizeApiKey(process.env.PI_GHOST_API_KEY ?? process.env.INCEPTION_API_KEY);
+        if (apiKey !== undefined)
+            cfg.provider.apiKey = apiKey;
         cfg.provider.debounceMs = numEnv("PI_GHOST_DEBOUNCE_MS", cfg.provider.debounceMs);
         cfg.provider.maxTokens = numEnv("PI_GHOST_MAX_TOKENS", cfg.provider.maxTokens);
         cfg.provider.maxRecentMessages = numEnv("PI_GHOST_RECENT", cfg.provider.maxRecentMessages);
+        cfg.provider.temperature = tempEnv(cfg.provider.temperature);
+        cfg.provider.parallelN = parallelNEnv(cfg.provider.parallelN);
     }
     else if (cfg.provider.kind === "local") {
-        if (process.env.PI_GHOST_BASE_URL)
-            cfg.provider.baseUrl = process.env.PI_GHOST_BASE_URL;
+        if (process.env.PI_GHOST_BASE_URL) {
+            const validated = validateBaseUrl(process.env.PI_GHOST_BASE_URL, "PI_GHOST_BASE_URL");
+            if (validated)
+                cfg.provider.baseUrl = validated;
+        }
         if (process.env.PI_GHOST_MODEL)
             cfg.provider.modelId = process.env.PI_GHOST_MODEL;
         cfg.provider.debounceMs = numEnv("PI_GHOST_DEBOUNCE_MS", cfg.provider.debounceMs);
         cfg.provider.maxTokens = numEnv("PI_GHOST_MAX_TOKENS", cfg.provider.maxTokens);
         cfg.provider.maxRecentMessages = numEnv("PI_GHOST_RECENT", cfg.provider.maxRecentMessages);
+        cfg.provider.temperature = tempEnv(cfg.provider.temperature);
+    }
+    else if (cfg.provider.kind === "race") {
+        for (const m of cfg.provider.members) {
+            m.temperature = tempEnv(m.temperature);
+        }
     }
     return cfg;
 }
@@ -125,18 +144,23 @@ function buildRaceFromEnv(raceList) {
 function buildRaceMember(name) {
     const upper = name.replace(/[^A-Za-z0-9]/g, "_").toUpperCase();
     if (name === "local" || name === "ollama") {
+        const rawBase = process.env[`PI_GHOST_RACE_${upper}_BASE_URL`];
+        const baseUrl = rawBase
+            ? (validateBaseUrl(rawBase, `PI_GHOST_RACE_${upper}_BASE_URL`) ?? DEFAULT_LOCAL_CONFIG.baseUrl)
+            : DEFAULT_LOCAL_CONFIG.baseUrl;
         return {
             ...DEFAULT_LOCAL_CONFIG,
-            baseUrl: process.env[`PI_GHOST_RACE_${upper}_BASE_URL`] ?? DEFAULT_LOCAL_CONFIG.baseUrl,
+            baseUrl,
             modelId: process.env[`PI_GHOST_RACE_${upper}_MODEL`] ?? DEFAULT_LOCAL_CONFIG.modelId,
         };
     }
     if (MERCURY_ALIASES.has(name)) {
-        const baseUrl = process.env[`PI_GHOST_RACE_${upper}_BASE_URL`] ??
-            process.env.INCEPTION_BASE_URL ??
-            MERCURY_DEFAULT_BASE_URL;
+        const rawBase = process.env[`PI_GHOST_RACE_${upper}_BASE_URL`] ?? process.env.INCEPTION_BASE_URL;
+        const baseUrl = rawBase
+            ? (validateBaseUrl(rawBase, `PI_GHOST_RACE_${upper}_BASE_URL`) ?? MERCURY_DEFAULT_BASE_URL)
+            : MERCURY_DEFAULT_BASE_URL;
         const modelId = process.env[`PI_GHOST_RACE_${upper}_MODEL`] ?? MERCURY_DEFAULT_MODEL;
-        const apiKey = process.env[`PI_GHOST_RACE_${upper}_API_KEY`] ?? process.env.INCEPTION_API_KEY;
+        const apiKey = sanitizeApiKey(process.env[`PI_GHOST_RACE_${upper}_API_KEY`] ?? process.env.INCEPTION_API_KEY);
         return {
             kind: "openai-compat",
             providerName: "mercury-edit",
@@ -146,6 +170,8 @@ function buildRaceMember(name) {
             debounceMs: DEFAULT_CLOUD_CONFIG.debounceMs,
             maxTokens: DEFAULT_CLOUD_CONFIG.maxTokens,
             maxRecentMessages: DEFAULT_CLOUD_CONFIG.maxRecentMessages,
+            temperature: DEFAULT_MERCURY_CONFIG.temperature,
+            parallelN: DEFAULT_MERCURY_CONFIG.parallelN,
         };
     }
     const provider = name;
@@ -155,7 +181,7 @@ function buildRaceMember(name) {
     }
     const modelEnv = process.env[`PI_GHOST_RACE_${upper}_MODEL`];
     const modelId = modelEnv ?? RACE_DEFAULT_MODELS[provider] ?? DEFAULT_CLOUD_CONFIG.modelId;
-    const apiKey = process.env[`PI_GHOST_RACE_${upper}_API_KEY`];
+    const apiKey = sanitizeApiKey(process.env[`PI_GHOST_RACE_${upper}_API_KEY`]);
     return {
         ...DEFAULT_CLOUD_CONFIG,
         provider,
@@ -184,4 +210,108 @@ function numEnv(name, fallback) {
     const v = Number(raw);
     return Number.isFinite(v) && v >= 0 ? v : fallback;
 }
+/**
+ * Parse PI_GHOST_TEMPERATURE. Returns fallback when unset or out of [0, 2].
+ * The provider implementations use 0 by default; users can opt back in to
+ * sampling for cache-miss diversity. Note: temperature=0 is best-effort
+ * across vendors and does NOT guarantee identical outputs across calls
+ * (kernel scheduling / batching cause variance). The completion cache is
+ * the real determinism guarantee.
+ */
+function tempEnv(fallback) {
+    const raw = process.env.PI_GHOST_TEMPERATURE;
+    if (raw === undefined)
+        return fallback;
+    const v = Number(raw);
+    return Number.isFinite(v) && v >= 0 && v <= 2 ? v : fallback;
+}
+/**
+ * Strip CR/LF and surrounding whitespace from an API key (SEC-7). Prevents
+ * HTTP header injection via `Authorization: Bearer ${apiKey}` when a
+ * malformed `.env` file or environment manipulation injects newlines.
+ * Returns undefined for empty results so callers fall back to env lookup.
+ */
+export function sanitizeApiKey(raw) {
+    if (raw === undefined)
+        return undefined;
+    const cleaned = raw.replace(/[\r\n]/g, "").trim();
+    return cleaned.length > 0 ? cleaned : undefined;
+}
+/**
+ * Produce a deep copy of a config with all `apiKey` fields removed (SEC-8).
+ * Use before any logging, diagnostics dump, telemetry, or serialization.
+ * The original config remains live with its keys for actual provider use.
+ *
+ * Defensive: even fields not currently typed as containing keys are scrubbed
+ * via a recursive walk that drops any property named `apiKey` (case-sensitive).
+ *
+ * Caveats: class instances become plain objects (methods lost). Cyclic
+ * structures would recurse infinitely — caller must ensure acyclic input.
+ * Both caveats are fine for `GhostConfig` which is plain JSON-shaped.
+ */
+export function redactConfig(cfg) {
+    return redactWalk(cfg);
+}
+function redactWalk(value) {
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map(redactWalk);
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (k === "apiKey")
+            continue;
+        out[k] = redactWalk(v);
+    }
+    return out;
+}
+/**
+ * Validate a provider baseUrl (SEC-1). Returns the URL on success, null
+ * on failure with a stderr warning. Rules:
+ *  - Must be a parseable absolute URL.
+ *  - `https:` always allowed.
+ *  - `http:` only allowed for `localhost` / `127.0.0.1` / `::1` — sending
+ *    API keys + prompt context in cleartext to anything else is almost
+ *    certainly a misconfiguration. Setting `PI_GHOST_ALLOW_INSECURE=1`
+ *    bypasses this check.
+ *  - Other schemes (`file:`, `data:`, etc.) rejected unconditionally.
+ */
+export function validateBaseUrl(raw, fieldName = "PI_GHOST_BASE_URL") {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        process.stderr.write(`Pi Ghost: ignoring invalid ${fieldName}=${raw}\n`);
+        return null;
+    }
+    if (url.protocol === "https:")
+        return raw;
+    if (url.protocol === "http:") {
+        const host = url.hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1")
+            return raw;
+        if (process.env.PI_GHOST_ALLOW_INSECURE === "1")
+            return raw;
+        process.stderr.write(`Pi Ghost: refusing to use insecure ${fieldName}=${raw} (set PI_GHOST_ALLOW_INSECURE=1 to override)\n`);
+        return null;
+    }
+    process.stderr.write(`Pi Ghost: rejecting ${fieldName} with unsupported scheme '${url.protocol}'\n`);
+    return null;
+}
+/**
+ * Parse PI_GHOST_MERCURY_PARALLEL_N. Returns fallback when unset, non-integer,
+ * or outside [1, 8]. The upper bound prevents accidental cost explosions —
+ * each parallel call costs the same as a normal completion.
+ */
+function parallelNEnv(fallback) {
+    const raw = process.env.PI_GHOST_MERCURY_PARALLEL_N;
+    if (raw === undefined)
+        return fallback;
+    const v = Number(raw);
+    if (!Number.isFinite(v))
+        return fallback;
+    const n = Math.floor(v);
+    return n >= 1 && n <= 8 ? n : fallback;
+}
 //# sourceMappingURL=config.js.map