pi-longhaul 1.0.2 → 1.0.4

package/src/narrative/named-values.ts

@@ -45,7 +45,7 @@ function textsIn(message: Rec): string[] {
 }
 
 /** Everything a message carries as text, call arguments string by string (so a written file is read line by line). */
-function everyTextIn(message: Rec): string[] {
+export function everyTextIn(message: Rec): string[] {
   const out: string[] = [];
   if (typeof message.content === "string") out.push(message.content);
   if (Array.isArray(message.content)) {
@@ -89,6 +89,18 @@ export interface SpanTexts {
   holderOf?: (value: string) => string | undefined;
 }
 
+/**
+ * Every token that stood on a credential line, after a credential named in prose, in a `user:pass@` login or in a
+ * secret store's output anywhere in `messages`: what a value is refused for. Broad on purpose, since refusing a value
+ * costs little; the credential scrub uses the stricter span-credentials.ts, as it takes each one out everywhere.
+ */
+function credentialTokensIn(messages: readonly AgentMessage[]): Set<string> {
+  const tainted = new Set<string>();
+  for (const message of messages as unknown as Rec[]) for (const text of everyTextIn(message)) for (const token of credentialTokensOf(text)) tainted.add(token);
+  for (const output of secretStoreOutputs(messages as unknown as Rec[])) for (const token of tokensOf(output)) tainted.add(token);
+  return tainted;
+}
+
 /**
  * Each turn's text, by the ordinal tag prepare.ts puts on its user message (thinking was stripped before), and the
  * span's credential tokens. Those are taken from every message, sources or not: a password a web page showed is no
@@ -110,14 +122,12 @@ export function spanTextsOf(messages: AgentMessage[]): SpanTexts {
  */
 export function turnTextsOf(messages: ReadonlyArray<{ ordinal?: string; message: AgentMessage; taintOnly?: boolean }>): SpanTexts {
   const turns = new Map<string, string[]>();
-  const tainted = new Set<string>();
   let current: string[] | undefined;
   for (const { ordinal, message, taintOnly } of messages as unknown as ReadonlyArray<{ ordinal?: string; message: Rec; taintOnly?: boolean }>) {
-    for (const text of everyTextIn(message)) for (const token of credentialTokensOf(text)) tainted.add(token);
     if (ordinal) turns.set(ordinal, (current = []));
     if (!taintOnly) current?.push(...textsIn(message));
   }
-  for (const output of secretStoreOutputs(messages.map((entry) => entry.message) as unknown as Rec[])) for (const token of tokensOf(output)) tainted.add(token);
+  const tainted = credentialTokensIn(messages.map((entry) => entry.message));
   const joined = new Map([...turns].map(([ordinal, texts]) => [ordinal, texts.join("\n")]));
   // Each turn's clean text once, newest first: a value that misses is looked up again on every attempt.
   let clean: Array<[string, string]> | undefined;

package/src/narrative/prompt.ts

@@ -6,6 +6,7 @@
  */
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 
+import { CREDENTIAL_RULE, scrubCredentials } from "../credential-scrub.ts";
 import { normalizeWs } from "../intent.ts";
 import { quoteText } from "../render.ts";
 import { DEFAULT_CAPS, type Now, type Quote, type StateEvent } from "../store/events.ts";
@@ -35,7 +36,7 @@ import { LABEL_FORMS, LIFT_GUIDANCE, RULE_DEFINITION, RULE_WHOLE_CHARS } from ".
  * state-16: outside a /goal, the session's opening request is the goal line once the Request has moved from it
  *   (store/project.ts goalLine), so the project's purpose survives every compaction; never quoted as the objective.
  */
-export const NARRATIVE_PROMPT_REVISION = "state-16";
+export const NARRATIVE_PROMPT_REVISION = "state-17";
 
 export const NARRATIVE_SYSTEM_PROMPT = `You maintain the SESSION STATE of a coding session that is being compacted. You are given the state so far, the user's messages with their ordinals (u1, u2, ...), and the conversation being compacted. Answer with ONE fenced json block and nothing else:
 
@@ -52,7 +53,7 @@ export const NARRATIVE_SYSTEM_PROMPT = `You maintain the SESSION STATE of a codi
 }
 \`\`\`
 
-Rules. "objective" is the request the work is answering now. It is optional: include it only when none is set or the user moved to a different request in this span, and quote the user's own message verbatim. The goal line, when present, is the active /goal or the session's opening request: code keeps it, so never quote it as the objective; under a goal the objective is the specific ask. "labels": Label EVERY message in <user-messages> with one of ${LABEL_FORMS}. ${RULE_DEFINITION} ${LIFT_GUIDANCE} The target is R<n> from the state, or u<n> for a rule given earlier in this span. "not a rule" is a request, question, answer, approval or one-off. Code copies the user's words into the state, so a short message labeled a rule needs no quote; a message longer than ${RULE_WHOLE_CHARS} characters labeled a rule must come with the rule's exact words: {"u7": {"rule": "<exact words>"}}. "corrections" is only for a standing rule that an earlier summary records and no listed message gives; quote the user's exact words. "values": values a later turn may need again that no file will give back: a measurement, a total, a port or a count a turn reported, a hash it named, a file-name format the user chose ("<name>-YYYYMMDD.tar.gz"). Copy each exactly as it appears in the turn "ref" names (the user's message, your replies and the tool output up to the next user message); a value is a number with or without its unit ("166 ms"), a version, a short commit hash, a path or file name (with <placeholders> if the format has them), a host:port or a date; nothing else is kept. "name" is a short label (at most 40 characters, no colon) saying what it is. At most 12, never a password, key or token. "decisions" and "deadEnds" are your own one-sentence records with evidence: a command id C<n>, an error id E<n>, a message u<n>, or the words "last command" / "last error". "now" replaces the previous Now entirely. Never write "done" unless the state's Done gate line says met. Empty arrays are fine. No prose outside the fence.`;
+Rules. "objective" is the request the work is answering now. It is optional: include it only when none is set or the user moved to a different request in this span, and quote the user's own message verbatim. The goal line, when present, is the active /goal or the session's opening request: code keeps it, so never quote it as the objective; under a goal the objective is the specific ask. "labels": Label EVERY message in <user-messages> with one of ${LABEL_FORMS}. ${RULE_DEFINITION} ${LIFT_GUIDANCE} The target is R<n> from the state, or u<n> for a rule given earlier in this span. "not a rule" is a request, question, answer, approval or one-off. Code copies the user's words into the state, so a short message labeled a rule needs no quote; a message longer than ${RULE_WHOLE_CHARS} characters labeled a rule must come with the rule's exact words: {"u7": {"rule": "<exact words>"}}. "corrections" is only for a standing rule that an earlier summary records and no listed message gives; quote the user's exact words. "values": values a later turn may need again that no file will give back: a measurement, a total, a port or a count a turn reported, a hash it named, a file-name format the user chose ("<name>-YYYYMMDD.tar.gz"). Copy each exactly as it appears in the turn "ref" names (the user's message, your replies and the tool output up to the next user message); a value is a number with or without its unit ("166 ms"), a version, a short commit hash, a path or file name (with <placeholders> if the format has them), a host:port or a date; nothing else is kept. "name" is a short label (at most 40 characters, no colon) saying what it is. At most 12, never a password, key or token. "decisions" and "deadEnds" are your own one-sentence records with evidence: a command id C<n>, an error id E<n>, a message u<n>, or the words "last command" / "last error". "now" replaces the previous Now entirely. Never write "done" unless the state's Done gate line says met. ${CREDENTIAL_RULE} Empty arrays are fine. No prose outside the fence.`;
 
 export interface PromptState {
   /** The Goal line (store/project.ts goalLine), shown so the summarizer never re-picks it as the Request. */
@@ -110,8 +111,9 @@ const rememberedText = (event: StateEvent): { kind: string; text: string } | und
   switch (event.kind) {
     case "correction.add": return { kind: "correction", text: `${event.id} [${event.quote.ordinal}] ${event.quote.text}` };
     case "correction.lift": return { kind: "lift", text: `${event.target} lifted by ${event.by.ordinal}` };
-    case "decision.add": return { kind: "decision", text: `${event.id} ${event.text}` };
-    case "deadEnd.add": return { kind: "dead-end", text: `${event.id} ${event.text}` };
+    // Written by a tool call this span: the projection has not seen it, so it is scrubbed here (credential-scrub.ts).
+    case "decision.add": return { kind: "decision", text: `${event.id} ${scrubCredentials(event.text).text}` };
+    case "deadEnd.add": return { kind: "dead-end", text: `${event.id} ${scrubCredentials(event.text).text}` };
     case "objective.set": return { kind: "objective", text: `${event.quote.ordinal} ${event.quote.text}` };
     case "objective.doneWhen": return { kind: "done-when", text: `${event.quote.ordinal} ${event.quote.text}` };
     default: return undefined;

package/src/narrative/turns/conversation.ts

@@ -9,6 +9,7 @@
 import { Type } from "typebox";
 import type { AssistantMessage, Context, Message, Model, ModelThinkingLevel, Tool, ToolCall } from "@earendil-works/pi-ai";
 
+import { CREDENTIAL_RULE } from "../../credential-scrub.ts";
 import type { ModelCall } from "../call.ts";
 import { timedTransport } from "../timings.ts";
 import { completeWithTransportRetry, type TransportRetryPolicy } from "../transport-retry.ts";
@@ -16,9 +17,9 @@ import type { CallTrace } from "../types.ts";
 import { callUsageOf } from "../usage.ts";
 
 /** Recorded as the span's promptRevision in turns mode, as NARRATIVE_PROMPT_REVISION is for the single call. */
-export const TURNS_PROMPT_REVISION = "turns-8";
+export const TURNS_PROMPT_REVISION = "turns-9";
 
-export const TURNS_SYSTEM_PROMPT = `You maintain the SESSION STATE of a coding session that is being compacted. The first message holds the digest of the span: the state so far, the user's messages, the commands and errors (with ids), the files, the workspace and a condensed transcript. Code asks for one section at a time. Answer each with ONE JSON object and nothing else. Use only ids that appear in the digest. Call show(ref) to read a user message (u<n>), command (C<n>), error (E<n>) or tool output (T<n>) in full when the digest cut it.`;
+export const TURNS_SYSTEM_PROMPT = `You maintain the SESSION STATE of a coding session that is being compacted. The first message holds the digest of the span: the state so far, the user's messages, the commands and errors (with ids), the files, the workspace and a condensed transcript. Code asks for one section at a time. Answer each with ONE JSON object and nothing else. Use only ids that appear in the digest. Call show(ref) to read a user message (u<n>), command (C<n>), error (E<n>) or tool output (T<n>) in full when the digest cut it. ${CREDENTIAL_RULE}`;
 
 export const SHOW_TOOL: Tool = {
   name: "show",

package/src/pass.ts

@@ -21,12 +21,14 @@ import { shouldAttemptRoute, type RouteHealthState } from "./narrative/route-hea
 import { resolveSummarizationModel, type ModelLookup, type ResolvedSummarizationModel } from "./narrative/routing.ts";
 import { routeProvidersFor, type ResolvedSummarizationRoute } from "./narrative/route-config.ts";
 import { turnTextsOf, type SpanTexts } from "./narrative/named-values.ts";
+import { spanCredentials } from "./span-credentials.ts";
 import { runNarrativeCall, type NarrativeInput } from "./narrative/run.ts";
 import { TURNS_PROMPT_REVISION } from "./narrative/turns/conversation.ts";
 import { runSectionTurns, type TurnsContext } from "./narrative/turns/run.ts";
 import type { NarrativeOutcome } from "./narrative/types.ts";
 import type { WarmBase } from "./narrative/warm.ts";
 import { render } from "./render.ts";
+import { scrubModelWritten } from "./credential-scrub.ts";
 import type { RunningTask } from "./tasks.ts";
 import type { CapFitResult } from "./store/capfit.ts";
 import { closeSpan, type ClosedSpan } from "./store/close.ts";
@@ -123,6 +125,8 @@ interface Closed {
   ledger: { commands: CommandRecord[]; errors: ErrorRecord[] };
   files: ReturnType<typeof carryFileOps>;
   learned: LearnedValue[];
+  /** Credential values taken out of what the summarizer wrote (credential-scrub.ts); a count, never the values. */
+  redacted: number;
 }
 
 function resolveRoute(input: PassInput, config: StateConfig, deps: PassDeps): { route: ResolvedSummarizationRoute; resolved?: ResolvedSummarizationModel; routeAvailable: boolean } {
@@ -326,30 +330,44 @@ async function callNarrative(input: PassInput, fold: Fold, config: StateConfig,
   return runSectionTurns({ ...narrativeInputOf(input, fold, config, deps, at, state), turns: config.narrativeTurns, context }, narrativeDeps);
 }
 
+/**
+ * Every message the summarizer was shown, as far as credentials go: the span, the previous summary, a switchover's
+ * earlier user messages, and in warm mode the session's own last request.
+ */
+function summarizerSaw(input: PassInput, fold: Fold, config: StateConfig, spanMessages: AgentMessage[]): AgentMessage[] {
+  const texts = [input.preparation.previousSummary, ...(fold.seed.seedRules ?? []).map((rule) => rule.text), ...(fold.seed.seedContext ?? []).map((message) => message.text)];
+  const shown = texts.filter((text): text is string => Boolean(text)).map((text) => ({ role: "custom", content: text, timestamp: 0 }) as unknown as AgentMessage);
+  const warm = config.narrativeMode === "warm" ? (input.warmBase?.messages ?? []) as unknown as AgentMessage[] : [];
+  return [...spanMessages, ...shown, ...warm];
+}
+
 async function closeAndRender(input: PassInput, fold: Fold, outcome: NarrativeOutcome, config: StateConfig, at: string): Promise<Closed> {
   const { preparation, branchEntries } = input;
   const { capture, snapshot, ledger, objectiveEvents, world, files } = await fold.settled();
-  const modelEvents = [...objectiveEvents.map((event) => ({ ...event, seq: 0 })), ...outcome.events];
+  const spanMessages = [...preparation.messagesToSummarize, ...(preparation.turnPrefixMessages ?? [])];
+  // Before anything is recorded: a credential the summarizer was shown must not reach the span record, nor every later request.
+  const scrubbed = scrubModelWritten(outcome.events, outcome.narrative, spanCredentials(summarizerSaw(input, fold, config, spanMessages)));
+  const modelEvents = [...objectiveEvents.map((event) => ({ ...event, seq: 0 })), ...scrubbed.events];
   const diffEvents = [...modelEvents, ...seedRuleEvents(fold, outcome, modelEvents, config, at)];
   // Ids from the whole merged ledger, not the fitted slice: a value's source must not vanish with a low-ranked record.
   // The values the summarizer named come first: each was checked against its turn, and its name says what it is.
-  const picked = learnedValues([...preparation.messagesToSummarize, ...(preparation.turnPrefixMessages ?? [])], fold.handoff.commands);
+  const picked = learnedValues(spanMessages, fold.handoff.commands);
   const learned = carryLearnedValues(previousLearnedValues(branchEntries), [...(outcome.values ?? []), ...picked]);
   const tasks = (await fold.tasks) ?? [];
   const measure = (candidate: SessionState) => render({ state: candidate, tokensBefore: preparation.tokensBefore, ledger, snapshot, caps: config.caps, files, learned, tasks, compactedAt: at }).length;
-  const closed = closeSpan({ log: fold.log, caps: config.caps, diffEvents: renumber(diffEvents, fold.log.nextSeq), close: { fromRef: fold.spanInput.fromRef, toRef: fold.spanInput.toRef, narrative: outcome.narrative, narrativeLess: outcome.kind === "narrative-less", world, ...(outcome.missingChunks.length ? { missingChunks: outcome.missingChunks } : {}) }, at, measure });
-  return { closed, summary: render({ state: closed.state, tokensBefore: preparation.tokensBefore, ledger, snapshot, caps: config.caps, files, learned, tasks, compactedAt: at }), capture, snapshot, ledger, files, learned };
+  const closed = closeSpan({ log: fold.log, caps: config.caps, diffEvents: renumber(diffEvents, fold.log.nextSeq), close: { fromRef: fold.spanInput.fromRef, toRef: fold.spanInput.toRef, narrative: scrubbed.narrative, narrativeLess: outcome.kind === "narrative-less", world, ...(outcome.missingChunks.length ? { missingChunks: outcome.missingChunks } : {}) }, at, measure });
+  return { closed, summary: render({ state: closed.state, tokensBefore: preparation.tokensBefore, ledger, snapshot, caps: config.caps, files, learned, tasks, compactedAt: at }), capture, snapshot, ledger, files, learned, redacted: scrubbed.redacted };
 }
 
 function assembleResult(input: PassInput, config: StateConfig, fold: Fold, outcome: NarrativeOutcome, built: Closed, deps: PassDeps, startedAt: Date, at: string): PassResult {
   const { preparation } = input;
-  const { closed, summary, capture, snapshot, ledger, files, learned } = built;
+  const { closed, summary, capture, snapshot, ledger, files, learned, redacted } = built;
   const usage = { input: outcome.usage.input, output: outcome.usage.output, calls: outcome.usage.calls };
   const details: StateDetails = { compactor: "state", stateFormat: STATE_FORMAT, promptRevision: outcome.sections ? TURNS_PROMPT_REVISION : NARRATIVE_PROMPT_REVISION, state: closed.state, caps: config.caps, ledger, snapshot, narrative: narrativeTraceOf(outcome), readFiles: files.readFiles, modifiedFiles: files.modifiedFiles, learnedValues: learned };
   const pending: PendingSpan = { span: fold.span, events: closed.log.events.filter((event) => event.span === fold.span), ledger, snapshot, usage, caps: config.coldSliceCaps };
   const route = { spec: fold.route.spec, rule: fold.route.rule, model: fold.resolved ? `${fold.resolved.model.provider}/${fold.resolved.model.id}` : undefined, fallbackReason: fold.resolved?.fallbackReason, routeIgnored: fold.resolved?.routeIgnored, routeAvailable: fold.routeAvailable };
   const logOptions = logOptionsOf(input.env);
-  const log = { event: "compaction", at, reason: input.reason, span: fold.span, tokensBefore: preparation.tokensBefore, summaryChars: summary.length, narrative: logSafeNarrative(details.narrative, logOptions), rejected: logSafeRejected(outcome.rejected, logOptions), route, routeHealth: outcome.routeHealth, capFit: closed.capFit.retired, capExhausted: closed.capFit.exhausted, anomalies: fold.log.anomalies, world: { claims: closed.state.world?.claims.length ?? 0, openErrors: closed.state.world?.openErrorIds.length ?? 0, dirty: closed.state.world?.dirty }, carried: { readFiles: files.readFiles.length, modifiedFiles: files.modifiedFiles.length, removed: logSafeRemoved(files.removed, logOptions), learnedValues: learned.length }, workspace: "skipped" in capture ? { skipped: logSafeSkipped(capture.skipped, logOptions) } : { captured: true }, durationMs: deps.now().getTime() - startedAt.getTime() };
+  const log = { event: "compaction", at, reason: input.reason, span: fold.span, tokensBefore: preparation.tokensBefore, summaryChars: summary.length, narrative: logSafeNarrative(details.narrative, logOptions), rejected: logSafeRejected(outcome.rejected, logOptions), route, routeHealth: outcome.routeHealth, capFit: closed.capFit.retired, capExhausted: closed.capFit.exhausted, anomalies: fold.log.anomalies, world: { claims: closed.state.world?.claims.length ?? 0, openErrors: closed.state.world?.openErrorIds.length ?? 0, dirty: closed.state.world?.dirty }, carried: { readFiles: files.readFiles.length, modifiedFiles: files.modifiedFiles.length, removed: logSafeRemoved(files.removed, logOptions), learnedValues: learned.length }, redacted, workspace: "skipped" in capture ? { skipped: logSafeSkipped(capture.skipped, logOptions) } : { captured: true }, durationMs: deps.now().getTime() - startedAt.getTime() };
   return {
     compaction: { summary, firstKeptEntryId: preparation.firstKeptEntryId, tokensBefore: preparation.tokensBefore, usage: compactionUsageOf(outcome.usage), details },
     pending, outcome, routeHealth: outcome.routeHealth, route, capFit: closed.capFit, anomalies: fold.log.anomalies, notice: noticeOf(fold.span, outcome, summary.length), log,

package/src/remember-tool.ts

@@ -2,17 +2,21 @@
  * The `remember` tool: one verified write into the Session state, sequential so two calls in one
  * turn never race the fold. Quotes only, resolved newest-first; the store's commitRemember is the
  * whole policy. Argument repair: a quote passed as `text` (or the reverse) is swapped with a Note,
- * because a model that got the field wrong got the intent right.
+ * because a model that got the field wrong got the intent right. A decision or dead end is the
+ * model's own words, so one that carries a credential value (credential-scrub.ts, with the
+ * credentials of the messages still in context, the kept window included) is refused, never stored (security.md T3).
  */
 import { REMEMBER_TOOL } from "./tool-names.ts";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
 import { readConfigFile, resolveStateConfig, type ReadFileFn } from "./config.ts";
+import { CREDENTIAL_RULE, scrubCredentials } from "./credential-scrub.ts";
+import { spanCredentials } from "./span-credentials.ts";
 import { commitRemember } from "./store/commit.ts";
 import { EVENT_ENTRY_TYPE, type PersistedEvent } from "./store/events.ts";
 import type { Proposal } from "./store/verify.ts";
-import { buildToolContext } from "./tool-context.ts";
+import { buildToolContext, messagesInContext } from "./tool-context.ts";
 import { formatRemember } from "./tool-text.ts";
 
 export const REMEMBER_KINDS = ["correction", "lift", "decision", "dead-end", "done-when"] as const;
@@ -42,6 +46,13 @@ export function proposalOf(params: RememberParams): { proposal: Proposal; note?:
   return { proposal: { kind: "dead-end", text: words, evidence: params.evidence }, note };
 }
 
+/** Why a decision or dead end is refused, or undefined: the model's own words may not hold a credential the span showed or one shaped as one. */
+function credentialRefusal(proposal: Proposal, branch: Parameters<typeof messagesInContext>[0]): string | undefined {
+  if (proposal.kind !== "decision" && proposal.kind !== "dead-end") return undefined;
+  if (scrubCredentials(proposal.text, spanCredentials(messagesInContext(branch))).redacted === 0) return undefined;
+  return `the text carries a credential. ${CREDENTIAL_RULE}`;
+}
+
 const PARAMETERS = Type.Object({
   kind: Type.Union(REMEMBER_KINDS.map((kind) => Type.Literal(kind)), { description: "correction: a standing rule the user gave (quote). lift: the user withdrew a correction (target + quote). decision / dead-end: your own one sentence (text, evidence). done-when: the user's acceptance words (quote)." }),
   quote: Type.Optional(Type.String({ description: "The user's exact words, a substring of one user message (12+ chars). Example: \"never use mocks in these tests\"." })),
@@ -64,8 +75,11 @@ export function registerRememberTool(pi: ExtensionAPI, deps: { readConfig: ReadF
     async execute(_toolCallId, params, _signal, _onUpdate, ctx: ExtensionContext) {
       const mapped = proposalOf(params as RememberParams);
       if ("error" in mapped) return { content: [{ type: "text", text: `not remembered: ${mapped.error}` }], details: { ok: false, remaining: undefined, rejection: { code: "schema", detail: mapped.error } } };
+      const branch = ctx.sessionManager.getBranch();
+      const refusal = credentialRefusal(mapped.proposal, branch);
+      if (refusal) return { content: [{ type: "text", text: `not remembered: ${refusal}` }], details: { ok: false, remaining: undefined, rejection: { code: "credential", detail: refusal } } };
       const config = resolveStateConfig(deps.readConfig);
-      const context = buildToolContext(ctx.sessionManager.getBranch());
+      const context = buildToolContext(branch);
       const outcome = commitRemember(mapped.proposal, {
         log: context.log, resolver: context.index, caps: config.caps, nearDuplicateThreshold: config.nearDuplicateThreshold, rememberCap: config.rememberPerSpan,
         now: () => deps.now().toISOString(), appendEntry: (customType: string, data: PersistedEvent) => pi.appendEntry(customType, data),

package/src/span-credentials.ts

@@ -0,0 +1,194 @@
+/**
+ * The span's credentials (credential-scrub.ts SpanCredentials): the whole values the span itself showed as
+ * credentials, which the scrub then takes out of what the summarizer wrote wherever it put them (security.md T3).
+ * Strong evidence only, because each value is redacted everywhere it stands: the named-value taint
+ * (narrative/named-values.ts), right for refusing a value, counts the words after "pin", "card" or "login" and a
+ * secret store's whole output, and on real states it redacted versions, commit hashes and paths in about a third of
+ * the fields. A value counts when
+ * - the span's text names it as the scrub itself would (credential-scrub.ts namedCredentialValues), unless it is
+ *   shaped as a name (below);
+ * - it is the value of a key named for one credential, ending in its name or a short part after it
+ *   (`DB_PASSWORD`, `cluster_token`, `WIFI_PASSPHRASE_2400_BAUD`; not `tokens: 1200`, a test runner's `pass`, nor a key
+ *   about one, `password_policy`, `token_env`), unless a token, secret or key key holds a value shaped as a name (`app-token`,
+ *   `APP_TOKEN`, a path, a file name; a password key's value is one whatever its shape, `unmade-tremor-oxidize`);
+ * - a command gives it as a password argument (`mysql -pX`, `sshpass -p X`, `redis-cli -a X`, `curl -u user:X`,
+ *   `htpasswd -b FILE USER X`, `--db-password X`, `openssl -pass pass:X`, `keytool -storepass X`);
+ * - it is a random-looking word on another credential line (a YAML block under such a key);
+ * - a secret store printed it alone (`vault kv get -field=...`), or random-looking among other output;
+ * - but never a random-looking word its label names as an id or a hash (`Evaluation ID: <uuid>`, `plan_hash <hex>`,
+ *   `commit <sha>`), nor the words after a key whose value is computed (`TOKEN=$(vault kv get ... | python3 ...)`), nor
+ *   a test runner's `--- PASS: TestName`;
+ * - or prose gives it: `the password is ...`, `the db pass is ...`.
+ * Never a number (except six digits and more given as a password), version, date or path, nor one plain lowercase
+ * word ("token: missing"). Measured on real states, these took no version, hash or path out of a field.
+ */
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+
+import { credentialCore, isNumberish, isNumericPasswordKey, isRandomLooking, isValueLike, namedCredentialValues, WORD } from "./credential-scrub.ts";
+import { CREDENTIAL_NAME, keyedLine, secretStoreOutputs, splitCredentialLines } from "./learned-secrets.ts";
+import type { Rec } from "./message-text.ts";
+import { everyTextIn } from "./narrative/named-values.ts";
+
+/** `the password is X`: the one value prose gives a password outright. */
+const PROSE_PASSWORD = /(?<![A-Za-z])(?:passw(?:or)?d|passwd|pwd|pass|passphrase|passcode)\s+(?:is|was)\s+(\S+)/gi;
+/**
+ * A command's password argument, group 1 (as ledger/handoff-commands.ts SECRET_PATTERNS, which marks the line).
+ * Every quantifier is bounded, each lazy run stops at a newline.
+ */
+const COMMAND_PASSWORDS = [
+  /\b(?:mysql|mysqldump|mariadb)\b[^\n]{0,2000}?\s-p(?!\s)(\S+)/g,
+  /\bsshpass\s+(?:(?:-P\s+\S+|-[a-oq-zA-Z]\w*)\s+){0,3}-p\s*(\S+)/g,
+  /\bredis-cli\b[^\n]{0,200}?\s-a\s+(\S+)/g,
+  /(?:^|\s)(?:-u|--user)\s+[^\s:]+:(\S+)/g,
+  /\s-pass(?:in|out)?\s+pass:(\S+)/g,
+  /\s-(?:src|dest)?(?:store|key)?pass\s+(?!(?:env|file|fd):|stdin\b)(\S+)/g,
+  /(?:^|\s)--?(?:[a-z0-9]{1,32}[-_.]){0,3}(?:password|passwd|passphrase|pass|secret|token|api[-_]?key)(?:=|\s+)(?!-)(\S+)/gi,
+];
+/** `htpasswd -b FILE USER PASS`, or `-nb USER PASS` (no file). */
+const HTPASSWD = /\bhtpasswd\s+(?:-[a-zA-Z]{1,8}\s+){0,3}?-([a-zA-Z]{0,8}b[a-zA-Z]{0,8})\s+(\S+)\s+(\S+)(?:\s+(\S+))?/g;
+/** A test runner's status line, `--- PASS: TestName (0.01s)` or `PASS: name`, upper case: no credential (`pass: x` is one). */
+const TEST_STATUS = /^\s*(?:[-=]{3}\s*)?PASS\s*:/;
+/** A value pointed at rather than held (a variable, a placeholder), once a quote or bracket before it is dropped. */
+const REFERENCE = /^["'`([]*(?:\$|%|\*|\{|<|\.\.\.)/;
+const NOT_A_SECRET = [
+  /^v?\d+(?:[.:_-]\d+)*$/i, // a number, a version, a time
+  /^\d{4}-\d{2}-\d{2}(?:[T ][\d:.]+Z?)?$/, // a date
+  /^(?:\/|~\/|\.\.?\/)/, // a path
+  /^[a-z]+$/, // one plain lowercase word: a status
+];
+const isSpanValue = (value: string) => value.length >= 4 && (/^\d{13,}$/.test(value) || !NOT_A_SECRET.some((shape) => shape.test(value)));
+/** A password given as one: a span value, or six digits and more. */
+const isPasswordValue = (value: string) => isSpanValue(value) || /^\d{6,}$/.test(value);
+/**
+ * What may follow a credential's name at the end of its key: up to two short parts (`WIFI_PASSPHRASE_2400_BAUD`,
+ * `ADMIN_TOKEN_2`), then quotes. A part that says the key is ABOUT the credential (KEY_ABOUT) makes it no key for one.
+ */
+const KEY_TAIL = String.raw`((?:[_.-][A-Za-z0-9]{1,12}){0,2})["'\\]{0,4}$`;
+const KEY_ABOUT = /[_.-](?:policy|disabled|enabled|required|length|len|min|max|algorithm|algo|hash|hashed|salt|rounds|file|path|dir|env|var|name|id|type|kind|mode|set|present|missing|rules|reset|expiry|expires|ttl|age|count|ref|url|header|field|prompt|hint|strength|changed|updated)(?![A-Za-z0-9])/i;
+const endsInCredential = (pattern: RegExp, key: string) => {
+  const match = pattern.exec(key.trim());
+  return match !== null && !KEY_ABOUT.test(match[1]);
+};
+/** A key that ends in a password word (`DB_PASS`, `"password"`), not one about passwords (`password_policy`). */
+const PASSWORD_KEY = new RegExp(String.raw`(?:passw(?:or)?d|passwd|pwd|pass(?:phrase|code)?)s?` + KEY_TAIL, "i");
+const isPasswordKey = (key: string) => endsInCredential(PASSWORD_KEY, key);
+/** Push without spreading: a spread passes every element as an argument and overflows the stack on a huge line. */
+function pushAll(into: string[], items: Iterable<string>): void {
+  for (const item of items) into.push(item);
+}
+/**
+ * A key named for one credential, in at most three words, ending in its name (quotes aside): singular, so
+ * `tokens: 1200` and a list of `secrets` are not one, no bare `pass` (a test runner's count), and no key about one
+ * (`password_policy`, `token_env`, `PASSWORD_FILE`). Letters may precede the name (`PGPASSWORD`).
+ */
+const CREDENTIAL_KEY = new RegExp(String.raw`(?:passw(?:or)?d|passwd|passphrase|passcode|secret|token|api[_ -]?key|access[_ -]?key|private[_ -]?key|credential)` + KEY_TAIL, "i");
+/** A bare lower-case `pass` key (nodemailer's `auth.pass`, YAML), which CREDENTIAL_KEY leaves out as a test runner's count. */
+const BARE_PASS_KEY = /^["']?pass["']?$/;
+const isCredentialKey = (key: string) => BARE_PASS_KEY.test(key.trim()) || key.length <= 40 && key.trim().split(/\s+/).length <= 3 && endsInCredential(CREDENTIAL_KEY, key);
+/**
+ * A value shaped as a name of something rather than a secret: an identifier, an environment variable, a path, a file
+ * or host name, or a call that computes it (`secret = json.load(open('app.json'))`).
+ */
+const NAME_SHAPES = [/^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)+$/, /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/, /\//, /^[\w-]+(?:\.[\w-]+)+$/, /^[A-Za-z_][\w.]{0,64}\(/];
+const isNameShaped = (value: string) => !isRandomLooking(value) && NAME_SHAPES.some((shape) => shape.test(value));
+/** A credential key's value: value-like, or eight characters and more; under a token, secret or key key, not shaped as a name. */
+function isKeyedValue(value: string, key: string): boolean {
+  if (/^\d{6,}$/.test(value)) return isNumericPasswordKey(key);
+  if (isPasswordKey(key)) return isSpanValue(value) && (isValueLike(value) || value.length >= 6);
+  return (isValueLike(value) || value.length >= 8) && !isNameShaped(value) && !isNumberish(value);
+}
+/** A command's password argument: a password, value-like or six characters and more. */
+const isCommandValue = (value: string) => isPasswordValue(value) && (isValueLike(value) || value.length >= 6);
+/** A value prose gives: value-like, or a long run with a non-letter in it (a passphrase), not a long English word. */
+const isProseValue = (value: string) => isValueLike(value) || (value.length >= 12 && /[^A-Za-z]/.test(value));
+
+/** The words of `text` that hold a value, each with what wraps it trimmed. */
+function coresOf(text: string): string[] {
+  const cores: string[] = [];
+  for (const [word] of text.matchAll(WORD)) {
+    if (REFERENCE.test(word)) continue;
+    const core = credentialCore(word);
+    if (core.end > core.start) cores.push(word.slice(core.start, core.end));
+  }
+  return cores;
+}
+
+/** A word that names the value after it as an id or a hash (`Evaluation ID:`, `plan_hash`, `commit`), not a secret. */
+const ID_LABEL = /(?:^|[_.-])(?:id|ids|uuid|hash|sha|sha1|sha256|digest|commit|rev|revision|etag)$/i;
+
+/**
+ * The random-looking words of `text`, except one the word before it on its line labels as an id or a hash (ID_LABEL),
+ * unless that label or the word before it names a credential (`secret_id`, `Secret ID`).
+ */
+function randomWordsOf(text: string): string[] {
+  const values: string[] = [];
+  let label = "";
+  let previous = "";
+  let end = 0;
+  for (const match of text.matchAll(WORD)) {
+    if (text.slice(end, match.index).includes("\n")) label = previous = "";
+    const core = credentialCore(match[0]);
+    const bare = match[0].slice(core.start, core.end);
+    const idLabelled = ID_LABEL.test(label) && !CREDENTIAL_NAME.test(`${previous} ${label}`);
+    if (!REFERENCE.test(match[0]) && isRandomLooking(bare) && !idLabelled) values.push(bare);
+    previous = label;
+    label = bare;
+    end = match.index + match[0].length;
+  }
+  return values;
+}
+
+/** The password arguments of a command line. */
+function commandValuesOf(line: string): string[] {
+  const values: string[] = [];
+  for (const pattern of COMMAND_PASSWORDS) for (const match of line.matchAll(pattern)) pushAll(values, coresOf(match[1]));
+  for (const match of line.matchAll(HTPASSWD)) {
+    const value = match[1].includes("n") ? match[3] : match[4];
+    if (value) pushAll(values, coresOf(value));
+  }
+  return values.filter(isCommandValue);
+}
+
+/** A password key written as YAML (`password: my Secret#Pass 99`), whose plain value runs to the line's end or a comment. */
+const isYamlPassword = (line: string, key: string) => isPasswordKey(key) && /^\s*:\s/.test(line.trimStart().slice(key.length));
+/** What is left of an assignment once the key is cut at its first colon: Go's `:=` or a type (`: str = `, `: &str = `). */
+const ASSIGNED = /^(?:[^\s=]{1,40}[ \t]{1,8})?:?=(?!=)[ \t]{0,8}/;
+/**
+ * What a key holds: its quoted string, or else its first word; the rest of the line is the command or prose around it
+ * (`TOKEN=$(vault kv get ... | python3 -c "import sys,json"`). Nothing when the value is computed or pointed at.
+ */
+function heldBy(raw: string, toLineEnd: boolean): string {
+  const value = raw.replace(ASSIGNED, "");
+  const quoted = /^(\\{0,3}["'])((?:\\.|[^\n\\]){0,512}?)\1/.exec(value);
+  const comment = toLineEnd ? value.search(/\s#/) : -1;
+  const held = quoted ? quoted[2] : toLineEnd ? (comment < 0 ? value : value.slice(0, comment)) : (/^\S+/.exec(value)?.[0] ?? "");
+  return REFERENCE.test(held) || /^["'([]*`/.test(held) ? "" : held;
+}
+
+function valuesOf(text: string): string[] {
+  const values = namedCredentialValues(text).filter((value) => !isNameShaped(value));
+  for (const line of splitCredentialLines(text).credential) {
+    if (TEST_STATUS.test(line)) continue;
+    const keyed = keyedLine(line);
+    if (keyed && isCredentialKey(keyed.key)) pushAll(values, coresOf(heldBy(keyed.value, isYamlPassword(line, keyed.key))).filter((value) => isKeyedValue(value, keyed.key)));
+    else pushAll(values, randomWordsOf(line));
+    pushAll(values, commandValuesOf(line));
+  }
+  for (const match of text.matchAll(PROSE_PASSWORD)) pushAll(values, coresOf(match[1]).filter((value) => isProseValue(value) || /^\d{6,}$/.test(value)));
+  return values;
+}
+
+/** What a secret store printed: a value printed alone is one whatever it looks like; among other output, a random-looking one. */
+function storeValuesOf(output: string): string[] {
+  const words = coresOf(output.trim());
+  return words.length === 1 ? words : randomWordsOf(output);
+}
+
+/** The span's credentials in `messages`: every whole value one of them showed as a credential. */
+export function spanCredentials(messages: readonly AgentMessage[]): Set<string> {
+  const values = new Set<string>();
+  const add = (value: string) => { if (isPasswordValue(value)) values.add(value); };
+  for (const message of messages as unknown as Rec[]) for (const text of everyTextIn(message)) valuesOf(text).forEach(add);
+  for (const output of secretStoreOutputs(messages as unknown as Rec[])) storeValuesOf(output).forEach(add);
+  return values;
+}

package/src/store/events.ts

@@ -229,10 +229,13 @@ function isEventBody(event: Rec): boolean {
   }
 }
 
+/** A span or seq: a whole number from 1, so a replayed `1e999` (Infinity) cannot stall the numbering after it. */
+const isCount = (value: unknown): value is number => Number.isSafeInteger(value) && (value as number) >= 1;
+
 /** Shape check for replayed entries: a malformed one is skipped and counted by the fold, never thrown. */
 export function isStateEvent(value: unknown): value is StateEvent {
   if (!isRec(value)) return false;
-  const provenanceOk = (value.source === "remember" || value.source === "diff" || value.source === "pass") && typeof value.span === "number" && typeof value.at === "string" && typeof value.seq === "number";
+  const provenanceOk = (value.source === "remember" || value.source === "diff" || value.source === "pass") && isCount(value.span) && typeof value.at === "string" && isCount(value.seq);
   return provenanceOk && isEventBody(value);
 }
 

package/src/store/log.ts

@@ -39,6 +39,7 @@ interface Fold {
   events: StateEvent[];
   spans: SpanSummary[];
   anomalies: FoldAnomaly[];
+  /** `span:seq` of every admitted event: a seq is unique within its span (see seqKey). */
   seqs: Set<string>;
   /** Loose events collected since the last compaction entry, keyed by nothing: in branch order. */
   loose: StateEvent[];
@@ -54,6 +55,15 @@ function quoteOf(event: StateEvent): Quote[] {
   }
 }
 
+/**
+ * The duplicate key of an event: its seq within its span. A pass numbers from the fold it reads, and a fold that
+ * lost span records (another extension's entry ahead of one) numbered later spans from too low a seq, so two
+ * spans' records can share seqs; each span's events are still its own.
+ */
+function seqKey(event: { span: number; seq: number }): string {
+  return `${event.span}:${event.seq}`;
+}
+
 /** Admit one event into the fold, or record why not. */
 function admit(fold: Fold, raw: unknown, span: number, entryId: string, checker: QuoteChecker, into: StateEvent[]): void {
   const newer = newerStateFormat(raw);
@@ -73,7 +83,7 @@ function admit(fold: Fold, raw: unknown, span: number, entryId: string, checker:
     fold.anomalies.push({ span, entryId, reason: `event names span ${raw.span} while folding span ${span}: ${entryId}` });
     return;
   }
-  const key = String(raw.seq);
+  const key = seqKey(raw);
   if (fold.seqs.has(key)) {
     fold.anomalies.push({ span, entryId, reason: `duplicate seq: ${raw.seq} at ${entryId}` });
     return;
@@ -131,7 +141,7 @@ function takeRecord(fold: Fold, entry: Extract<SessionEntry, { type: "custom" }>
   }
   // The record SUPERSEDES the span's loose events, so release their seqs before admitting its own
   // (otherwise the record's authoritative copy of a loose event is dropped as a duplicate seq).
-  for (const loose of fold.loose) fold.seqs.delete(String(loose.seq));
+  for (const loose of fold.loose) fold.seqs.delete(seqKey(loose));
   const events: StateEvent[] = [];
   for (const raw of record.events) admit(fold, raw, pending.span, entry.id, checker, events);
   for (const event of events) fold.events.push(event);
@@ -140,13 +150,23 @@ function takeRecord(fold: Fold, entry: Extract<SessionEntry, { type: "custom" }>
   fold.pending = undefined;
 }
 
+/**
+ * Whether `entry` proves a pending compaction's span record never landed: a message, another compaction, or one
+ * of our own event entries. Anything else another extension wrote at session_compact (pi-goal's goal-state and
+ * goal-contract land there, ahead of the record) is passed over, so the record that follows still closes the span.
+ */
+function endsPendingSpan(entry: SessionEntry): boolean {
+  if (entry.type === "message" || entry.type === "compaction") return true;
+  return entry.type === "custom" && entry.customType === EVENT_ENTRY_TYPE;
+}
+
 export function readLog(branchEntries: SessionEntry[], checker: QuoteChecker): StateLog {
   const fold: Fold = { events: [], spans: [], anomalies: [], seqs: new Set(), loose: [] };
   let compactions = 0;
   for (const entry of branchEntries) {
-    // A pending state compaction is closed by its span record, which is the NEXT entry of interest;
-    // anything else arriving first means the record never landed.
-    if (fold.pending && !(entry.type === "custom" && entry.customType === SPAN_ENTRY_TYPE)) synthesizeClose(fold, undefined, entry.timestamp);
+    // A pending state compaction is closed by its span record, the next entry of OURS after it; a message,
+    // compaction or event arriving first means the record never landed.
+    if (fold.pending && endsPendingSpan(entry)) synthesizeClose(fold, undefined, entry.timestamp);
     if (entry.type === "compaction") {
       compactions++;
       const compactor = compactorOfEntry(entry);