pi-longhaul 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -8,6 +8,38 @@ entries and log event types. Rendered state text, prompt wording and section lay
 
 ## [Unreleased]
 
+## [v1.0.4] - 2026-10-22
+
+### Fixed
+
+- The summarizer copied credentials into the state it wrote: a password from a script's output into Resume, an API
+  key or Bearer value into Now, decisions and the narrative. The state is sent with every later request, so the
+  value went out again at every turn, and states on real sessions held live ones. What the summarizer writes is now
+  scrubbed before it is recorded: each credential value becomes `<redacted>` and the rest of the line stays. A value
+  is one when the span showed it as a credential (a credential key's value, symbols and all, a command's password
+  argument, a value a secret store printed, `the password is …`), wherever the summarizer put it and however it
+  wrapped it; when the text names it
+  (`password=…`, `"api_key": "…"`, `Bearer …`, a `user:pass@` login, or a random-looking value just after a
+  credential word, so `password (64-hex): <hex>` and `the gateway key (<uuid>)`); or when its shape is one wherever
+  it stands (a JWT, a Vault token, AWS, GitHub, OpenAI-style, Slack and age keys). The span's credentials include
+  what the previous summary and a switchover's earlier messages showed. A digest (`sha256:…`) is never one, and
+  neither is a path, a count, a version or a date the text gives a key, nor, among the span's credentials, a name
+  (`app-token`) under a token or secret key, an id or hash its label names (`Evaluation ID:`, `plan_hash`,
+  `commit`), the rest of a command after a key whose value it computes (`TOKEN=$(vault kv get … | python3 …)`), a test
+  name after `--- PASS:`, or a value after a credential word that is part of a file name (`~/.vault-token`): on real
+  sessions the scrub took out the credentials and left versions, hashes, ids and names alone. A state written before this shows redacted from its session's next compaction
+  on (the summary, the summarizer's prompt, `longhaul_recall`, `npm run state`), by every rule but the span's own
+  credentials, which only the pass that wrote it had. Until then pi keeps sending the summary it stored, and a
+  transcript keeps every summary and record it already holds, so a credential found in a state must be rotated. The compaction log records how many values a pass redacted
+  (`redacted`), never the values. Both summarizer prompts also tell the model never to copy a credential's value
+  and to say where it lives instead, and `longhaul_remember` refuses a decision or dead end that carries one.
+- An error line naming a credential before its value (`ops-control password (64-hex): <value>`) was recorded as an
+  open error and shown in every state; no command-style shape matched it. Such a line is now recorded with the value
+  redacted, so the failure stays open, and one already carried is redacted at the next compaction.
+- The credential rules found too little: a password key glued to its prefix (`PGPASSWORD=`, `MYSQL_PWD=`), short
+  keys (`pw=`, `pass=`), `Authorization: Basic`, a private key's body past its first line, and GitLab, Google API,
+  Stripe, npm and Hugging Face tokens, now in both the scrub and the command ledger's credential shapes.
+
 ## [v1.0.3] - 2026-10-22
 
 ### Changed

package/CONTEXT.md

@@ -76,6 +76,12 @@ Values a later turn may need again, verbatim, with where each came from: those t
 that the session used again (a hash, a version, a long number).
 _Avoid_: facts (the scorer's measure of a related but different set)
 
+**Credential scrub**:
+Taking each credential value out of the text the summarizer writes into the state (the narrative, Now,
+decisions, dead ends), leaving `<redacted>` and the words around it. The value is gone; what it was and where it
+lives can stay.
+_Avoid_: sanitize (one-line.ts: control characters and newlines), redact (the ledger's word for dropping a whole command)
+
 ## Configuration
 
 **Agent dir**:

package/README.md

@@ -349,7 +349,16 @@ compaction than one that can.
   never from a line that looks like it holds a credential. A value the summarizer names is kept only when it
   stands in the turn it cites and no part of it stood on a credential line anywhere in the span; its name is
   shown as the summarizer's label.
-  That filter works on patterns: a bare token with no key or secret marker near it can still be learned and
+- What the summarizer writes into the state (the narrative, Now, decisions and dead ends) has each credential
+  value replaced by `<redacted>` before it is recorded: a whole value the span showed as a credential (a credential
+  key's value, a command's password argument, a secret store's output, `the password is …`), however it is wrapped, a value after a credential key,
+  `Bearer` or a credential word, a `user:pass@` password, and token shapes (JWTs, Vault, AWS, GitHub, OpenAI-style,
+  Slack, age). States written before this are shown the same way from their next compaction on, by everything but
+  the span's own credentials; a stored summary and the transcript keep what they hold, so rotate a credential found
+  in a state.
+  The prompt also tells the summarizer never to copy one, and `longhaul_remember` refuses a decision or dead end
+  that carries one. Error lines are recorded with the value redacted.
+  These filters work on patterns: a bare token with no key or secret marker near it can still be learned and
   carried. Treat a session's transcript as you would its tool output.
 
 The threat model is in [docs/security.md](docs/security.md).

package/docs/security.md

@@ -217,6 +217,64 @@ the session (a web page, a README, another agent's message) could try to plant a
   replacement. A credential token anywhere in those turns refuses a value of the span as well, and so does one in
   the original words of an edited message, in a message another extension injected, or on a credential line of the
   summary, which is never a source itself.
+- What the summarizer writes into the state (the narrative, every Now item and Resume, decisions, dead ends) is
+  scrubbed before the span record is written (`credential-scrub.ts`): each credential value is replaced by
+  `<redacted>` and the words around it stay. A value counts when its shape is one wherever it stands (a JWT, a Vault
+  token, a private key's whole body, AWS, GitHub, GitLab, Google API, Stripe, npm, Hugging Face, OpenAI-style, Slack
+  and age keys); when the text names it, as a credential key's value (`DB_PASSWORD=`, `PGPASSWORD=`, `MYSQL_PWD=`,
+  `"api_key":`, escaped quotes too, symbols kept in the value up to a space or a quote; a password word may be glued
+  to its prefix, any other only after `_` or `-`, so `compass:` is no key; a value-like or opaque one of twelve
+  characters or more, never a path, and a number, count, version or date only as six digits and more under a key
+  that says password in full, so `token: missing`, `tests pass: 120/120` and `e2e_pass: 1234567` stay), a value-like
+  `Bearer` or `Basic` value, the password of a `user:pass@` URL (to the word's last `@`), or a random-looking value
+  (a UUID, hex from 20 characters, a long mixed-case run with digits) starting within 40 characters after a
+  credential word; or when it is one of the span's credentials (`span-credentials.ts`): a whole value the span
+  itself showed as a credential, found however the summarizer wrapped it (quoted, bold, between dashes or curly
+  quotes, after `=`, glued to a flag, in a login with or without a scheme: `app/x@db`, `app:x@db:5432`). The span's
+  credentials come from everything the summarizer was shown: the span, the previous summary, a switchover's earlier
+  user messages and, in warm mode, the session's last request. They are built from strong evidence only, because each
+  one is taken out everywhere: what the text rules above name; the value of a key named for one credential,
+  ending in its name or a short part after it (singular, so `tokens: 1200` and a list of `secrets` are not one, and
+  no key about one: `password_policy`, `token_env`), any shape under a password key
+  (`Summer2024.x`, `unmade-tremor-oxidize`, `48291375`), not a name under a token, secret or key key (`app-token`,
+  `APP_TOKEN`, a file or host name); a command's password argument (`mysql -pX`, `sshpass -p X`, `redis-cli -a
+  X`, `curl -u user:X`, `htpasswd -b FILE USER X`, `--db-password X`, `openssl -pass pass:X`, `keytool -storepass
+  X`); a random-looking word on another credential line; a value a secret store printed alone (or a random-looking
+  one among its other output); and `the password is …`, `the db pass is …`. Never a number (but a password's),
+  version, date or path, nor one plain lowercase word. A key holds its quoted string or its first word (after Go's
+  `:=` or a type, `db_password: str = "…"`; a YAML password's plain value runs to the line's end), never the rest of
+  a command line, and nothing when its value is computed (`TOKEN=$(vault kv get … | python3 -c "import sys,json")`
+  once made `python3` a credential); a random-looking word the word before it on its line labels as an id or a hash
+  (`Evaluation ID:`, `plan_hash`, `commit`) is that, not a secret, unless the label names a credential
+  (`secret_id`); and an upper-case `--- PASS: TestName` is a test runner's status, while `pass: 'x'` and `pass=x`
+  are keys. A credential word inside a path or file name (`/tmp/admin-bearer.txt`,
+  `~/.vault-token`) says where one lives, so the value after it is not taken for one. The broader set that refuses a named value
+  (narrative/named-values.ts, with the words after "pin", "card" or "login" and a secret store's whole output)
+  redacted versions, commit hashes and names in about a third of real fields, so the scrub does not use it. A
+  `sha256:` digest is never one, and a variable or placeholder (`$KEY`, `<from vault>`) stays. The projection applies
+  the text rules only, since only the pass that wrote a record had its span, so a record written before the scrub
+  shows redacted wherever the state is read from its session's next compaction on: the summary, the summarizer's
+  prompt (the open span's remembered items too), `longhaul_recall` (every hit, error lines and the span's narrative
+  included) and the state CLI. Nothing rewrites what is stored: pi re-sends the latest compaction's summary string
+  until the next compaction (on an older branch, whenever someone returns to it), and the transcript keeps the old
+  summaries, `details.state` checkpoints, span records, remember entries and the turns trace's model-written
+  reasons. A credential found in a state was sent with every request since; rotate it. `longhaul_remember` refuses
+  a decision or dead end that the scrub would change, with the credentials of every message still in context (the
+  kept window included). Measured on 24 real transcripts: the text rules redact 22 values over 6612 model-written
+  fields, at least one of them not a secret (an Ed25519 public key after "key"); the span's credentials, each span
+  against its own messages and the summary before it, redact 7 more over 2981 fields in 224 spans, every one a
+  credential or the visible part of one (a Wi-Fi passphrase, two admin passwords, a token's printed prefix, a rotated
+  secret's prefix). The summarizer prompts say never to
+  copy a credential's value; the scrub is what holds when a model does. An error signature with a command-style
+  shape is never recorded; any other is recorded as the scrub leaves it (`password (64-hex): <redacted>`), carried
+  ones too, so an ordinary failure that mentions a secret by id stays open. Every pattern is linear on hostile text
+  (T4); a private key without an END line is cut 16 KiB on. Not found: a credential the span never showed as one,
+  written in prose with no credential word near it; a token or secret key's value shaped as a name; without the
+  span, a value on the line after its key (`password:` then the value), a key in smart quotes or before a full-width
+  colon; a password given to `docker login -p` or piped to a `--password-stdin` command; a passphrase with spaces
+  (`correct horse battery staple`); a key about a password rather than holding one (`password_policy:`) gives no
+  value, by design; and a symbol at a value's edge (`Summer2024!` leaves `<redacted>!`). The user's own words (objective,
+  done-when and correction quotes) are verbatim by design and not scrubbed.
 - The ledger redacts commands that carry a secret, by the same patterns (a one-time-password seed passed to
   `oathtool -b` (or `-bv`, `--base32`, or a hex or base32 key of 16 or more characters), `ykman oath accounts add`,
   `ykman ... --key`, `sshpass -p`, `htpasswd -b`, `openssl -pass pass:`, `keytool -storepass`, `redis-cli -a`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-longhaul",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Keep pi sessions working all night. A compactor that carries your session forward instead of rewriting it: your rules kept in your own words, the state written by code, old reasoning left behind, and about 5x faster than pi's own compaction on a local model.",
   "type": "module",
   "license": "MIT",
@@ -32,7 +32,7 @@
     "extensions": [
       "./src/index.ts"
     ],
-    "image": "https://raw.githubusercontent.com/lobo235/pi-longhaul/v1.0.3/.github/assets/infographic.png"
+    "image": "https://raw.githubusercontent.com/lobo235/pi-longhaul/v1.0.4/.github/assets/infographic.png"
   },
   "files": [
     "src/**/*.ts",

package/src/credential-scrub.ts

@@ -0,0 +1,319 @@
+/**
+ * Credential scrub (CONTEXT.md *Credential scrub*; security.md T3): text a model wrote into the state (the narrative,
+ * Now, decisions, dead ends) and the open-error lines, with each credential value replaced by REDACTED_VALUE. The
+ * state is rendered into every later request, so a password the summarizer copied out of a tool's output was sent
+ * again at every turn. Only the value goes: the words around it stay, so a Resume line still says what to do next.
+ *
+ * A value is a credential when
+ * - its shape is one wherever it stands: a JWT, a Vault token, an AWS, GitHub, OpenAI-style, Slack or age key;
+ * - the text names it: the value of a credential key (`password=x`, `"api_key": "x"`), a Bearer value, the password
+ *   of a `user:pass@` URL, or a random-looking value within CONTEXT_REACH characters after a credential word
+ *   (`password (64-hex): <hex>`, `the gateway key (<uuid>)`);
+ * - or it is one of the span's credentials (span-credentials.ts): a whole value the span itself showed as one
+ *   (`DB_PASSWORD=Ab3$x;9Kq2`, symbols and all), wherever the model put it and however it wrapped it (quoted, bold,
+ *   between dashes, glued to a flag or a login).
+ * A digest (`sha256:<hex>`) is never one. Every pattern is linear: a summarizer's answer is untrusted (security.md T4).
+ */
+
+import type { StateEvent } from "./store/events.ts";
+
+/** What a redacted value is replaced with. Holds no token character, so a second scrub leaves it alone. */
+export const REDACTED_VALUE = "<redacted>";
+
+/** The summarizer prompts' rule (narrative/prompt.ts, narrative/turns/conversation.ts); the scrub is what holds when a model ignores it. */
+export const CREDENTIAL_RULE = 'Never copy a password, key, token or other credential\'s value into the state, in any field: say what it is and where it lives ("the gateway key from its Vault secret"), never the value itself.';
+
+/** The span's credentials: whole values, each one judged a credential where the span showed it (span-credentials.ts). */
+export type SpanCredentials = ReadonlySet<string>;
+
+export interface Scrubbed {
+  text: string;
+  /** How many values were replaced; logged as a count, never the values. */
+  redacted: number;
+}
+
+/** A token: what a value is cut on, as named-values.ts TOKEN_SPLIT cuts a credential line. */
+const TOKEN = /[^\s=:"'`,;{}[\]()<>]+/g;
+/** A word: what a whole value is cut on. Space, and the dashes and quotes prose puts around a value (`—x—`, `“x”`). */
+export const WORD = /[^\s\u2013\u2014\u2018\u2019\u201c\u201d\u00ab\u00bb]+/g;
+/** How far after a credential word a random-looking value counts as its value. */
+const CONTEXT_REACH = 40;
+
+/** Shapes that are credentials wherever they stand (ledger/handoff-commands.ts SECRET_PATTERNS, and learned-secrets.ts TOKEN_SHAPES). */
+const CREDENTIAL_SHAPES = [
+  /(?<![\w-])eyJ[\w-]{4,}\.[\w-]{4,}\.[\w-]*/g,
+  /(?<![\w-])hv[sbr]\.[\w-]{8,}/g,
+  /\bAGE-SECRET-KEY-1[0-9A-Z]{20,}/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[abprs]-[A-Za-z0-9-]{10,})/g,
+  // GitLab, Google API, Stripe, npm and Hugging Face tokens; as ledger/handoff-commands.ts SECRET_PATTERNS, kept in step.
+  /\b(?:glpat-[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{35}|[sr]k_(?:live|test)_[A-Za-z0-9]{16,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z]{30,})/g,
+];
+const PEM_BEGIN = /-----BEGIN [A-Z ]{0,64}PRIVATE KEY(?: BLOCK)?-----/g;
+const PEM_END = "-----END ";
+/** A private key's body without an END line is cut here. */
+const PEM_CHARS = 16_384;
+
+/**
+ * The key part names a credential. A password word may be glued to its prefix (`PGPASSWORD`, `MYSQL_PWD`: a lazy
+ * bounded prefix from a word start, at most 48 tries per start, linear, security.md T4); any other word only after
+ * `_` or `-` (`DB_PASS`, `client-secret`), so `compass` and `bypass` are no key. No plural `tokens` (a count). A bare
+ * `pass` is one only before `=` or a quoted value (`pass=`, `pass: 'x'`): `--- PASS: TestName` is a test runner's status.
+ */
+const CREDENTIAL_KEY = String.raw`(?<![A-Za-z0-9])(?:[A-Za-z0-9_-]{0,48}?(?:passw(?:or)?ds?|passwd|pwd)|(?:[A-Za-z0-9]{1,32}[_-]){1,3}pass|pass(?=(?:\\{0,3}["'])?[ \t]{0,8}(?:=|:[ \t]{0,8}\\{0,3}["']))|(?:[A-Za-z0-9]{1,32}[_-]){0,3}(?:pw|passphrases?|passcodes?|secrets?|token|api[_-]?keys?|access[_-]?keys?|private[_-]?keys?|credentials?))`;
+/**
+ * A key that ends in a password word in full, whose value may be all digits (`ROOT_PASSWORD=48291375`); not `pass`
+ * or `pw` (`e2e_pass: 1234567`), nor a key about passwords (`password_min_length: 123456`).
+ */
+const NUMERIC_PASSWORD_KEY = /(?:passw(?:or)?d|passwd|pwd|passphrase|passcode)s?$/i;
+/** Whether `key` (a key part, its quotes and separator included or not) says password in full at its end. */
+export const isNumericPasswordKey = (key: string) => NUMERIC_PASSWORD_KEY.test(withoutTrailing(key, "\"' \t=:\\"));
+/** `key = value`, `key: value`, quoted as JSON or not, escaped quotes included; the value is group 2, up to a space or a quote, so symbols in it stay in it. */
+const KEYED_VALUE = new RegExp(String.raw`(${CREDENTIAL_KEY}(?:\\{0,3}["'])?[ \t]{0,8}[=:][ \t]{0,8}(?:\\{0,3}["'])?)([^\s"'\x60\\]{3,})`, "gi");
+const BEARER_VALUE = /(\b(?:bearer|basic)\s+)([^\s"'`,;{}[\]()<>]{8,})/gi;
+/** A URL login's prefix, `scheme://user:` (the user may be empty); its password runs to the word's last `@` (urlPasswordSpans). */
+const URL_LOGIN = /[a-z][a-z0-9+.-]{0,30}:\/\/[^\s/:@]{0,512}:/gi;
+const URL_PASSWORD_CHARS = 512;
+/** A credential named in prose: a random-looking value after it is its value. */
+const CREDENTIAL_WORD = /(?<![A-Za-z])(?:passw(?:or)?ds?|passwd|pwd|passphrases?|passcodes?|secrets?|tokens?|api[_ -]?keys?|keys?|bearer|credentials?|auth)(?![A-Za-z])/gi;
+
+/** A value the text points at rather than holds: a variable, a placeholder, a mask. */
+const REFERENCE = /^(?:\$|%|\*|\{|<|\.\.\.)/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** As named-values.ts RANDOM_LOOKING: long hex with a digit and a letter, a long mixed-case run with digits, 13+ digits. */
+const RANDOM_LOOKING = [/^\d{13,}$/, /^(?=[0-9a-f]*\d)(?=[0-9a-f]*[a-f])[0-9a-f]{13,}$/i, /^(?=[A-Za-z0-9_+/-]*[a-z])(?=[A-Za-z0-9_+/-]*[A-Z])(?=[A-Za-z0-9_+/-]*\d)[A-Za-z0-9_+/-]{16,}={0,2}$/];
+const DIGEST_PREFIX = /sha(?:1|224|256|384|512):$/i;
+
+export const isRandomLooking = (token: string) => UUID.test(token) || RANDOM_LOOKING.some((shape) => shape.test(token));
+/** A token a credential could be: random-looking, or six characters or more with a digit. */
+export const isValueLike = (token: string) => isRandomLooking(token) || (token.length >= 6 && /\d/.test(token));
+/** A value a credential key holds: value-like, or opaque (twelve characters or more), never a path (`PWD=/home/app`); a word is a status ("token: missing"). A Bearer value must be value-like: "Bearer authentication" is prose. */
+const isHeldValue = (token: string) => (isValueLike(token) || token.length >= 12) && !/^(?:\/|~\/|\.\.?\/)/.test(token);
+/** A number, a count (`120/120`), a version, a time or a date: no credential, unless a password key holds it. */
+const NUMBERISH = /^(?:v?\d+(?:[.:_/-]\d+)*|\d{4}-\d{2}-\d{2}(?:[T ][\d:.]+Z?)?)$/i;
+export const isNumberish = (token: string) => NUMBERISH.test(token);
+/** A credential key's value (isHeldValue); a number only under a password key, so `tests pass: 120/120` stays. */
+const isKeyedHeld = (token: string, key: string) => {
+  const bare = withoutTrailing(token, ",.;:!?)]}");
+  return isHeldValue(token) && (!isNumberish(bare) || (isNumericPasswordKey(key) && /^\d{6,}$/.test(bare)));
+};
+/**
+ * A value prose names only by a nearby credential word: random-looking, hex only from LONG_HEX characters, since a
+ * plan or object id near "secret" is 16 (measured on real states: plan hashes, short ids).
+ */
+const LONG_HEX = 20;
+const isNamedByContext = (token: string) => isRandomLooking(token) && !(/^[0-9a-f]+$/i.test(token) && token.length < LONG_HEX);
+
+/** `token` without the trailing `marks`. A loop, not `/[.!?]+$/`: that regex retries from every mark of a long run (quadratic, security.md T4). */
+function withoutTrailing(token: string, marks: string): string {
+  let end = token.length;
+  while (end > 0 && marks.includes(token[end - 1])) end--;
+  return token.slice(0, end);
+}
+/** `token` without the sentence marks that end it. */
+const withoutClosingMarks = (token: string) => withoutTrailing(token, ".!?");
+
+interface Span { start: number; end: number }
+
+function shapeSpans(text: string): Span[] {
+  const spans: Span[] = [];
+  for (const shape of CREDENTIAL_SHAPES) for (const match of text.matchAll(shape)) spans.push({ start: match.index, end: match.index + match[0].length });
+  return [...spans, ...pemSpans(text)];
+}
+
+/** A private key from its BEGIN line through its END line, or PEM_CHARS on when it has none. One scan: each key starts after the last. */
+function pemSpans(text: string): Span[] {
+  const spans: Span[] = [];
+  let from = 0;
+  for (const begin of text.matchAll(PEM_BEGIN)) {
+    if (begin.index < from) continue;
+    // END is looked for inside the key's window only: the rest of the text, once per key, is quadratic (security.md T4).
+    const window = text.slice(begin.index, begin.index + PEM_CHARS);
+    const end = window.indexOf(PEM_END, begin[0].length);
+    const close = end < 0 ? -1 : window.indexOf("-----", end + PEM_END.length);
+    const stop = begin.index + (close < 0 ? window.length : close + 5);
+    spans.push({ start: begin.index, end: stop });
+    from = stop;
+  }
+  return spans;
+}
+
+/** The value group (2) of each match of `pattern`, unless it only points at a value or `holds` refuses it (given the key part, group 1). */
+function groupSpans(text: string, pattern: RegExp, holds: (value: string, key: string) => boolean = () => true): Span[] {
+  const spans: Span[] = [];
+  for (const match of text.matchAll(pattern)) {
+    if (REFERENCE.test(match[2]) || !holds(match[2], match[1])) continue;
+    const start = match.index + match[1].length;
+    spans.push({ start, end: start + match[2].length });
+  }
+  return spans;
+}
+
+/**
+ * Whether the credential word at [start, end) is part of a path or a file name (`/tmp/admin-bearer.txt`,
+ * `token.json`), which says where a credential lives, not that a value follows. Looks at most FILE_NAME_REACH back.
+ */
+const FILE_NAME_REACH = 256;
+function inFileName(text: string, start: number, end: number): boolean {
+  const before = text.slice(Math.max(0, start - FILE_NAME_REACH), start);
+  return /\/[^\s/]*$/.test(before) || /^[\w-]*\.[A-Za-z][A-Za-z0-9]{0,4}(?![\w-])/.test(text.slice(end, end + FILE_NAME_REACH));
+}
+
+/** Tokens named by context (isNamedByContext) that start within CONTEXT_REACH characters after a credential word, digests excepted. */
+function contextSpans(text: string, tokens: ReadonlyArray<{ token: string; start: number }>): Span[] {
+  const spans: Span[] = [];
+  let index = 0;
+  for (const word of text.matchAll(CREDENTIAL_WORD)) {
+    const after = word.index + word[0].length;
+    if (inFileName(text, word.index, after)) continue;
+    while (index < tokens.length && tokens[index].start < after) index++;
+    for (let next = index; next < tokens.length && tokens[next].start <= after + CONTEXT_REACH; next++) {
+      const { token, start } = tokens[next];
+      const bare = withoutClosingMarks(token);
+      if (isNamedByContext(bare) && !DIGEST_PREFIX.test(text.slice(Math.max(0, start - 7), start))) spans.push({ start, end: start + bare.length });
+    }
+  }
+  return spans;
+}
+
+/**
+ * The password of each `scheme://user:pass@host`: up to the last `@` of the word, so a password holding one is taken
+ * whole (`app:p@ss1234@db`). A port followed by a path is no login. Each login looks at most URL_PASSWORD_CHARS on.
+ */
+function urlPasswordSpans(text: string): Span[] {
+  const spans: Span[] = [];
+  for (const match of text.matchAll(URL_LOGIN)) {
+    const start = match.index + match[0].length;
+    const window = text.slice(start, start + URL_PASSWORD_CHARS + 1);
+    const space = window.search(/\s/);
+    const word = space < 0 ? window : window.slice(0, space);
+    const at = word.lastIndexOf("@");
+    if (at <= 0 || /^\d{1,5}\//.test(word) || REFERENCE.test(word)) continue;
+    spans.push({ start, end: start + at });
+  }
+  return spans;
+}
+
+const isWordChar = (char: string) => /[\p{L}\p{N}]/u.test(char);
+
+/** `word` without what wraps it (quotes, `**`, brackets, a closing mark), as offsets into `word`; empty when nothing is left. */
+export function credentialCore(word: string): { start: number; end: number } {
+  let start = 0;
+  let end = word.length;
+  while (start < end && !isWordChar(word[start])) start++;
+  while (end > start && !isWordChar(word[end - 1])) end--;
+  return { start, end };
+}
+
+/**
+ * Where a value may stand in a word, widest first: the word, after its first or last `=` or `:` (`DB_PASSWORD='x'`),
+ * after a short flag (`-px`), and each part between `/` and `@` (`app/x@db`), also after that part's first `:`
+ * (`app:x@db:5432`). Linear in the word.
+ */
+function placesIn(word: string): Array<[start: number, end: number]> {
+  const places: Array<[number, number]> = [[0, word.length]];
+  const first = word.search(/[=:]/);
+  const last = Math.max(word.lastIndexOf("="), word.lastIndexOf(":"));
+  if (first >= 0) places.push([first + 1, word.length]);
+  if (last > first) places.push([last + 1, word.length]);
+  const flag = /^-{1,2}[A-Za-z]/.exec(word);
+  if (flag) places.push([flag[0].length, word.length]);
+  // The next `:` at or after a part's start; the pointer only moves forward, so the scan stays linear.
+  let colon = -1;
+  const part = (from: number, to: number) => {
+    places.push([from, to]);
+    if (colon < from) {
+      const next = word.indexOf(":", from);
+      colon = next < 0 ? Infinity : next;
+    }
+    if (colon < to) places.push([colon + 1, to]);
+  };
+  let from = 0;
+  for (const separator of word.matchAll(/[/@]/g)) {
+    part(from, separator.index);
+    from = separator.index + 1;
+  }
+  if (from > 0) part(from, word.length);
+  return places;
+}
+
+/** Each span value in `text`, wrapping trimmed (credentialCore), at the widest place in its word that holds it. */
+function valueSpans(text: string, values: SpanCredentials): Span[] {
+  const spans: Span[] = [];
+  for (const match of text.matchAll(WORD)) {
+    const word = match[0];
+    for (const [from, to] of placesIn(word)) {
+      const core = credentialCore(word.slice(from, to));
+      if (core.end > core.start && values.has(word.slice(from + core.start, from + core.end))) {
+        spans.push({ start: match.index + from + core.start, end: match.index + from + core.end });
+        break;
+      }
+    }
+  }
+  return spans;
+}
+
+/** `text` with every span replaced, overlapping spans as one. */
+function replaceSpans(text: string, spans: Span[]): Scrubbed {
+  if (!spans.length) return { text, redacted: 0 };
+  spans.sort((a, b) => a.start - b.start);
+  let out = "";
+  let cursor = 0;
+  let redacted = 0;
+  for (const span of spans) {
+    if (span.end <= cursor) continue;
+    if (span.start >= cursor) {
+      out += text.slice(cursor, span.start) + REDACTED_VALUE;
+      redacted++;
+    }
+    cursor = span.end;
+  }
+  return { text: out + text.slice(cursor), redacted };
+}
+
+/** What the text itself names as a credential: a shape, a credential key's value, a Bearer value, a URL password, a value after a credential word. */
+function namedSpans(text: string): Span[] {
+  const tokens = [...text.matchAll(TOKEN)].map((match) => ({ token: match[0], start: match.index }));
+  return [
+    ...shapeSpans(text),
+    ...groupSpans(text, KEYED_VALUE, isKeyedHeld),
+    ...groupSpans(text, BEARER_VALUE, isValueLike),
+    ...urlPasswordSpans(text),
+    ...contextSpans(text, tokens),
+  ];
+}
+
+/** The values `text` names as credentials, wrapping trimmed: what scrubCredentials takes out of it on its own. */
+export function namedCredentialValues(text: string): string[] {
+  return namedSpans(text).map((span) => {
+    const value = text.slice(span.start, span.end);
+    const core = credentialCore(value);
+    return value.slice(core.start, core.end);
+  }).filter(Boolean);
+}
+
+/**
+ * `text` with its credential values replaced. `span` is the span's credentials; without them (text read back from a
+ * span record already written) only what the text itself names is found.
+ */
+export function scrubCredentials(text: string, span?: SpanCredentials): Scrubbed {
+  return replaceSpans(text, [...namedSpans(text), ...(span?.size ? valueSpans(text, span) : [])]);
+}
+
+/** What a pass wrote, scrubbed: the events whose text the summarizer chose, and the span's narrative. */
+export function scrubModelWritten(events: readonly StateEvent[], narrative: string | undefined, span: SpanCredentials): { events: StateEvent[]; narrative?: string; redacted: number } {
+  let redacted = 0;
+  const clean = (text: string) => {
+    const scrubbed = scrubCredentials(text, span);
+    redacted += scrubbed.redacted;
+    return scrubbed.text;
+  };
+  const scrubbedEvents = events.map((event): StateEvent => {
+    switch (event.kind) {
+      case "decision.add": case "deadEnd.add": return { ...event, text: clean(event.text) };
+      case "now.set": return { ...event, now: { inProgress: event.now.inProgress.map(clean), next: event.now.next.map(clean), blocked: event.now.blocked.map(clean), resume: clean(event.now.resume) } };
+      default: return event;
+    }
+  });
+  return { events: scrubbedEvents, ...(narrative === undefined ? {} : { narrative: clean(narrative) }), redacted };
+}

package/src/learned-secrets.ts

@@ -27,7 +27,7 @@ const KEY_CHARS = 64;
 const BLOCK_OPENER = /^(?:[|>](?:[-+]?\d?|\d[-+])|[{[])?\s*(?:#.*)?$/;
 
 /** A line read as `key = value`, `key: value` or `key    value` (aligned table), or undefined when it is not one. */
-function keyedLine(line: string): { key: string; value: string } | undefined {
+export function keyedLine(line: string): { key: string; value: string } | undefined {
   const text = line.trim();
   const separator = text.slice(0, KEY_CHARS + 1).search(/[=:]|\s{2,}|\t/);
   if (separator <= 0) return undefined;

package/src/ledger/handoff-commands.ts

@@ -74,6 +74,8 @@ const SECRET_PATTERNS: RegExp[] = [
   /\bAGE-SECRET-KEY-1[0-9A-Z]{20,}/,
   /\bAKIA[0-9A-Z]{16}\b/,
   /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[abprs]-[A-Za-z0-9-]{10,})/,
+  // As credential-scrub.ts CREDENTIAL_SHAPES: GitLab, Google API, Stripe, npm and Hugging Face tokens.
+  /\b(?:glpat-[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{35}|[sr]k_(?:live|test)_[A-Za-z0-9]{16,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z]{30,})/,
 ];
 
 /** Whether `text` (a command, or a tool result's failure signature) carries a credential shape. */

package/src/ledger/handoff-errors.ts

@@ -7,6 +7,7 @@
 import type { ErrorRecord } from "./handoff.ts";
 import { containsSecret, normalizeCommand, redactCommand } from "./handoff-commands.ts";
 import type { ObservedError, ObservedRun } from "./handoff-observe.ts";
+import { scrubCredentials } from "../credential-scrub.ts";
 
 const VOLATILE_RES: RegExp[] = [
   /\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?/g,
@@ -24,6 +25,14 @@ export function errorKey(signature: string): string {
   return line.replace(/\s+/g, " ").trim();
 }
 
+/**
+ * The signature a failure is recorded under: none when it has a command-style credential shape (dropped, as ever),
+ * else with each value the credential scrub finds redacted (`password (64-hex): <redacted>`). Redacted, not dropped:
+ * an ordinary failure ("secret db-creds version <uuid> not found") must stay open. The scrub is deterministic, so the
+ * same failure keys the same way pass after pass.
+ */
+const recordedSignature = (signature: string) => containsSecret(signature) ? undefined : scrubCredentials(signature).text;
+
 function idNumber(id: string): number {
   const match = /^E(\d+)$/.exec(id);
   return match ? Number(match[1]) : 0;
@@ -40,23 +49,28 @@ function succeededAfter(runs: ObservedRun[], command: string, after: number): bo
  * unresolved again and last seen now; a new one gets the next id. Then the mechanical rule: a
  * record whose source command exits 0 later in this pass is resolved. Records are copied. A
  * signature that carries a credential shape (a failing push or curl echoes its URL or header) is
- * never recorded, carried or new, because the exact half outlives the messages it came from; a
+ * never recorded, carried or new, because the exact half outlives the messages it came from; any
+ * other is recorded with the values the credential scrub finds redacted (recordedSignature); a
  * source command with one is stored as `<redacted>`, like its command record. Ids are never reused.
  */
 export function mergeErrors(previous: ErrorRecord[], observed: ObservedError[], runs: ObservedRun[], pass: number): ErrorRecord[] {
   let nextId = previous.reduce((max, record) => Math.max(max, idNumber(record.id)), 0) + 1;
-  const records = previous.filter((record) => !containsSecret(record.signature)).map((record) => ({ ...record, sourceCommand: redactCommand(record.sourceCommand) }));
+  const records = previous.flatMap((record) => {
+    const signature = recordedSignature(record.signature);
+    return signature === undefined ? [] : [{ ...record, signature, sourceCommand: redactCommand(record.sourceCommand) }];
+  });
   const lastSeenAt = new Map<string, number>();
   for (const error of observed) {
-    const key = errorKey(error.signature);
-    if (key === "" || containsSecret(error.signature)) continue;
+    const signature = recordedSignature(error.signature);
+    const key = signature === undefined ? "" : errorKey(signature);
+    if (signature === undefined || key === "") continue;
     let record = records.find((candidate) => errorKey(candidate.signature) === key);
     if (record) {
       record.resolved = false;
       record.lastSeenPass = pass;
       if (record.sourceCommand === undefined && error.sourceCommand !== undefined) record.sourceCommand = redactCommand(error.sourceCommand);
     } else {
-      record = { id: `E${nextId++}`, signature: error.signature, sourceCommand: redactCommand(error.sourceCommand), resolved: false, lastSeenPass: pass };
+      record = { id: `E${nextId++}`, signature, sourceCommand: redactCommand(error.sourceCommand), resolved: false, lastSeenPass: pass };
       records.push(record);
     }
     lastSeenAt.set(record.id, error.runIndex);

package/src/narrative/named-values.ts

@@ -45,7 +45,7 @@ function textsIn(message: Rec): string[] {
 }
 
 /** Everything a message carries as text, call arguments string by string (so a written file is read line by line). */
-function everyTextIn(message: Rec): string[] {
+export function everyTextIn(message: Rec): string[] {
   const out: string[] = [];
   if (typeof message.content === "string") out.push(message.content);
   if (Array.isArray(message.content)) {
@@ -89,6 +89,18 @@ export interface SpanTexts {
   holderOf?: (value: string) => string | undefined;
 }
 
+/**
+ * Every token that stood on a credential line, after a credential named in prose, in a `user:pass@` login or in a
+ * secret store's output anywhere in `messages`: what a value is refused for. Broad on purpose, since refusing a value
+ * costs little; the credential scrub uses the stricter span-credentials.ts, as it takes each one out everywhere.
+ */
+function credentialTokensIn(messages: readonly AgentMessage[]): Set<string> {
+  const tainted = new Set<string>();
+  for (const message of messages as unknown as Rec[]) for (const text of everyTextIn(message)) for (const token of credentialTokensOf(text)) tainted.add(token);
+  for (const output of secretStoreOutputs(messages as unknown as Rec[])) for (const token of tokensOf(output)) tainted.add(token);
+  return tainted;
+}
+
 /**
  * Each turn's text, by the ordinal tag prepare.ts puts on its user message (thinking was stripped before), and the
  * span's credential tokens. Those are taken from every message, sources or not: a password a web page showed is no
@@ -110,14 +122,12 @@ export function spanTextsOf(messages: AgentMessage[]): SpanTexts {
  */
 export function turnTextsOf(messages: ReadonlyArray<{ ordinal?: string; message: AgentMessage; taintOnly?: boolean }>): SpanTexts {
   const turns = new Map<string, string[]>();
-  const tainted = new Set<string>();
   let current: string[] | undefined;
   for (const { ordinal, message, taintOnly } of messages as unknown as ReadonlyArray<{ ordinal?: string; message: Rec; taintOnly?: boolean }>) {
-    for (const text of everyTextIn(message)) for (const token of credentialTokensOf(text)) tainted.add(token);
     if (ordinal) turns.set(ordinal, (current = []));
     if (!taintOnly) current?.push(...textsIn(message));
   }
-  for (const output of secretStoreOutputs(messages.map((entry) => entry.message) as unknown as Rec[])) for (const token of tokensOf(output)) tainted.add(token);
+  const tainted = credentialTokensIn(messages.map((entry) => entry.message));
   const joined = new Map([...turns].map(([ordinal, texts]) => [ordinal, texts.join("\n")]));
   // Each turn's clean text once, newest first: a value that misses is looked up again on every attempt.
   let clean: Array<[string, string]> | undefined;

package/src/narrative/prompt.ts

@@ -6,6 +6,7 @@
  */
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 
+import { CREDENTIAL_RULE, scrubCredentials } from "../credential-scrub.ts";
 import { normalizeWs } from "../intent.ts";
 import { quoteText } from "../render.ts";
 import { DEFAULT_CAPS, type Now, type Quote, type StateEvent } from "../store/events.ts";
@@ -35,7 +36,7 @@ import { LABEL_FORMS, LIFT_GUIDANCE, RULE_DEFINITION, RULE_WHOLE_CHARS } from ".
  * state-16: outside a /goal, the session's opening request is the goal line once the Request has moved from it
  *   (store/project.ts goalLine), so the project's purpose survives every compaction; never quoted as the objective.
  */
-export const NARRATIVE_PROMPT_REVISION = "state-16";
+export const NARRATIVE_PROMPT_REVISION = "state-17";
 
 export const NARRATIVE_SYSTEM_PROMPT = `You maintain the SESSION STATE of a coding session that is being compacted. You are given the state so far, the user's messages with their ordinals (u1, u2, ...), and the conversation being compacted. Answer with ONE fenced json block and nothing else:
 
@@ -52,7 +53,7 @@ export const NARRATIVE_SYSTEM_PROMPT = `You maintain the SESSION STATE of a codi
 }
 \`\`\`
 
-Rules. "objective" is the request the work is answering now. It is optional: include it only when none is set or the user moved to a different request in this span, and quote the user's own message verbatim. The goal line, when present, is the active /goal or the session's opening request: code keeps it, so never quote it as the objective; under a goal the objective is the specific ask. "labels": Label EVERY message in <user-messages> with one of ${LABEL_FORMS}. ${RULE_DEFINITION} ${LIFT_GUIDANCE} The target is R<n> from the state, or u<n> for a rule given earlier in this span. "not a rule" is a request, question, answer, approval or one-off. Code copies the user's words into the state, so a short message labeled a rule needs no quote; a message longer than ${RULE_WHOLE_CHARS} characters labeled a rule must come with the rule's exact words: {"u7": {"rule": "<exact words>"}}. "corrections" is only for a standing rule that an earlier summary records and no listed message gives; quote the user's exact words. "values": values a later turn may need again that no file will give back: a measurement, a total, a port or a count a turn reported, a hash it named, a file-name format the user chose ("<name>-YYYYMMDD.tar.gz"). Copy each exactly as it appears in the turn "ref" names (the user's message, your replies and the tool output up to the next user message); a value is a number with or without its unit ("166 ms"), a version, a short commit hash, a path or file name (with <placeholders> if the format has them), a host:port or a date; nothing else is kept. "name" is a short label (at most 40 characters, no colon) saying what it is. At most 12, never a password, key or token. "decisions" and "deadEnds" are your own one-sentence records with evidence: a command id C<n>, an error id E<n>, a message u<n>, or the words "last command" / "last error". "now" replaces the previous Now entirely. Never write "done" unless the state's Done gate line says met. Empty arrays are fine. No prose outside the fence.`;
+Rules. "objective" is the request the work is answering now. It is optional: include it only when none is set or the user moved to a different request in this span, and quote the user's own message verbatim. The goal line, when present, is the active /goal or the session's opening request: code keeps it, so never quote it as the objective; under a goal the objective is the specific ask. "labels": Label EVERY message in <user-messages> with one of ${LABEL_FORMS}. ${RULE_DEFINITION} ${LIFT_GUIDANCE} The target is R<n> from the state, or u<n> for a rule given earlier in this span. "not a rule" is a request, question, answer, approval or one-off. Code copies the user's words into the state, so a short message labeled a rule needs no quote; a message longer than ${RULE_WHOLE_CHARS} characters labeled a rule must come with the rule's exact words: {"u7": {"rule": "<exact words>"}}. "corrections" is only for a standing rule that an earlier summary records and no listed message gives; quote the user's exact words. "values": values a later turn may need again that no file will give back: a measurement, a total, a port or a count a turn reported, a hash it named, a file-name format the user chose ("<name>-YYYYMMDD.tar.gz"). Copy each exactly as it appears in the turn "ref" names (the user's message, your replies and the tool output up to the next user message); a value is a number with or without its unit ("166 ms"), a version, a short commit hash, a path or file name (with <placeholders> if the format has them), a host:port or a date; nothing else is kept. "name" is a short label (at most 40 characters, no colon) saying what it is. At most 12, never a password, key or token. "decisions" and "deadEnds" are your own one-sentence records with evidence: a command id C<n>, an error id E<n>, a message u<n>, or the words "last command" / "last error". "now" replaces the previous Now entirely. Never write "done" unless the state's Done gate line says met. ${CREDENTIAL_RULE} Empty arrays are fine. No prose outside the fence.`;
 
 export interface PromptState {
   /** The Goal line (store/project.ts goalLine), shown so the summarizer never re-picks it as the Request. */
@@ -110,8 +111,9 @@ const rememberedText = (event: StateEvent): { kind: string; text: string } | und
   switch (event.kind) {
     case "correction.add": return { kind: "correction", text: `${event.id} [${event.quote.ordinal}] ${event.quote.text}` };
     case "correction.lift": return { kind: "lift", text: `${event.target} lifted by ${event.by.ordinal}` };
-    case "decision.add": return { kind: "decision", text: `${event.id} ${event.text}` };
-    case "deadEnd.add": return { kind: "dead-end", text: `${event.id} ${event.text}` };
+    // Written by a tool call this span: the projection has not seen it, so it is scrubbed here (credential-scrub.ts).
+    case "decision.add": return { kind: "decision", text: `${event.id} ${scrubCredentials(event.text).text}` };
+    case "deadEnd.add": return { kind: "dead-end", text: `${event.id} ${scrubCredentials(event.text).text}` };
     case "objective.set": return { kind: "objective", text: `${event.quote.ordinal} ${event.quote.text}` };
     case "objective.doneWhen": return { kind: "done-when", text: `${event.quote.ordinal} ${event.quote.text}` };
     default: return undefined;

package/src/narrative/turns/conversation.ts

@@ -9,6 +9,7 @@
 import { Type } from "typebox";
 import type { AssistantMessage, Context, Message, Model, ModelThinkingLevel, Tool, ToolCall } from "@earendil-works/pi-ai";
 
+import { CREDENTIAL_RULE } from "../../credential-scrub.ts";
 import type { ModelCall } from "../call.ts";
 import { timedTransport } from "../timings.ts";
 import { completeWithTransportRetry, type TransportRetryPolicy } from "../transport-retry.ts";
@@ -16,9 +17,9 @@ import type { CallTrace } from "../types.ts";
 import { callUsageOf } from "../usage.ts";
 
 /** Recorded as the span's promptRevision in turns mode, as NARRATIVE_PROMPT_REVISION is for the single call. */
-export const TURNS_PROMPT_REVISION = "turns-8";
+export const TURNS_PROMPT_REVISION = "turns-9";
 
-export const TURNS_SYSTEM_PROMPT = `You maintain the SESSION STATE of a coding session that is being compacted. The first message holds the digest of the span: the state so far, the user's messages, the commands and errors (with ids), the files, the workspace and a condensed transcript. Code asks for one section at a time. Answer each with ONE JSON object and nothing else. Use only ids that appear in the digest. Call show(ref) to read a user message (u<n>), command (C<n>), error (E<n>) or tool output (T<n>) in full when the digest cut it.`;
+export const TURNS_SYSTEM_PROMPT = `You maintain the SESSION STATE of a coding session that is being compacted. The first message holds the digest of the span: the state so far, the user's messages, the commands and errors (with ids), the files, the workspace and a condensed transcript. Code asks for one section at a time. Answer each with ONE JSON object and nothing else. Use only ids that appear in the digest. Call show(ref) to read a user message (u<n>), command (C<n>), error (E<n>) or tool output (T<n>) in full when the digest cut it. ${CREDENTIAL_RULE}`;
 
 export const SHOW_TOOL: Tool = {
   name: "show",

package/src/pass.ts

@@ -21,12 +21,14 @@ import { shouldAttemptRoute, type RouteHealthState } from "./narrative/route-hea
 import { resolveSummarizationModel, type ModelLookup, type ResolvedSummarizationModel } from "./narrative/routing.ts";
 import { routeProvidersFor, type ResolvedSummarizationRoute } from "./narrative/route-config.ts";
 import { turnTextsOf, type SpanTexts } from "./narrative/named-values.ts";
+import { spanCredentials } from "./span-credentials.ts";
 import { runNarrativeCall, type NarrativeInput } from "./narrative/run.ts";
 import { TURNS_PROMPT_REVISION } from "./narrative/turns/conversation.ts";
 import { runSectionTurns, type TurnsContext } from "./narrative/turns/run.ts";
 import type { NarrativeOutcome } from "./narrative/types.ts";
 import type { WarmBase } from "./narrative/warm.ts";
 import { render } from "./render.ts";
+import { scrubModelWritten } from "./credential-scrub.ts";
 import type { RunningTask } from "./tasks.ts";
 import type { CapFitResult } from "./store/capfit.ts";
 import { closeSpan, type ClosedSpan } from "./store/close.ts";
@@ -123,6 +125,8 @@ interface Closed {
   ledger: { commands: CommandRecord[]; errors: ErrorRecord[] };
   files: ReturnType<typeof carryFileOps>;
   learned: LearnedValue[];
+  /** Credential values taken out of what the summarizer wrote (credential-scrub.ts); a count, never the values. */
+  redacted: number;
 }
 
 function resolveRoute(input: PassInput, config: StateConfig, deps: PassDeps): { route: ResolvedSummarizationRoute; resolved?: ResolvedSummarizationModel; routeAvailable: boolean } {
@@ -326,30 +330,44 @@ async function callNarrative(input: PassInput, fold: Fold, config: StateConfig,
   return runSectionTurns({ ...narrativeInputOf(input, fold, config, deps, at, state), turns: config.narrativeTurns, context }, narrativeDeps);
 }
 
+/**
+ * Every message the summarizer was shown, as far as credentials go: the span, the previous summary, a switchover's
+ * earlier user messages, and in warm mode the session's own last request.
+ */
+function summarizerSaw(input: PassInput, fold: Fold, config: StateConfig, spanMessages: AgentMessage[]): AgentMessage[] {
+  const texts = [input.preparation.previousSummary, ...(fold.seed.seedRules ?? []).map((rule) => rule.text), ...(fold.seed.seedContext ?? []).map((message) => message.text)];
+  const shown = texts.filter((text): text is string => Boolean(text)).map((text) => ({ role: "custom", content: text, timestamp: 0 }) as unknown as AgentMessage);
+  const warm = config.narrativeMode === "warm" ? (input.warmBase?.messages ?? []) as unknown as AgentMessage[] : [];
+  return [...spanMessages, ...shown, ...warm];
+}
+
 async function closeAndRender(input: PassInput, fold: Fold, outcome: NarrativeOutcome, config: StateConfig, at: string): Promise<Closed> {
   const { preparation, branchEntries } = input;
   const { capture, snapshot, ledger, objectiveEvents, world, files } = await fold.settled();
-  const modelEvents = [...objectiveEvents.map((event) => ({ ...event, seq: 0 })), ...outcome.events];
+  const spanMessages = [...preparation.messagesToSummarize, ...(preparation.turnPrefixMessages ?? [])];
+  // Before anything is recorded: a credential the summarizer was shown must not reach the span record, nor every later request.
+  const scrubbed = scrubModelWritten(outcome.events, outcome.narrative, spanCredentials(summarizerSaw(input, fold, config, spanMessages)));
+  const modelEvents = [...objectiveEvents.map((event) => ({ ...event, seq: 0 })), ...scrubbed.events];
   const diffEvents = [...modelEvents, ...seedRuleEvents(fold, outcome, modelEvents, config, at)];
   // Ids from the whole merged ledger, not the fitted slice: a value's source must not vanish with a low-ranked record.
   // The values the summarizer named come first: each was checked against its turn, and its name says what it is.
-  const picked = learnedValues([...preparation.messagesToSummarize, ...(preparation.turnPrefixMessages ?? [])], fold.handoff.commands);
+  const picked = learnedValues(spanMessages, fold.handoff.commands);
   const learned = carryLearnedValues(previousLearnedValues(branchEntries), [...(outcome.values ?? []), ...picked]);
   const tasks = (await fold.tasks) ?? [];
   const measure = (candidate: SessionState) => render({ state: candidate, tokensBefore: preparation.tokensBefore, ledger, snapshot, caps: config.caps, files, learned, tasks, compactedAt: at }).length;
-  const closed = closeSpan({ log: fold.log, caps: config.caps, diffEvents: renumber(diffEvents, fold.log.nextSeq), close: { fromRef: fold.spanInput.fromRef, toRef: fold.spanInput.toRef, narrative: outcome.narrative, narrativeLess: outcome.kind === "narrative-less", world, ...(outcome.missingChunks.length ? { missingChunks: outcome.missingChunks } : {}) }, at, measure });
-  return { closed, summary: render({ state: closed.state, tokensBefore: preparation.tokensBefore, ledger, snapshot, caps: config.caps, files, learned, tasks, compactedAt: at }), capture, snapshot, ledger, files, learned };
+  const closed = closeSpan({ log: fold.log, caps: config.caps, diffEvents: renumber(diffEvents, fold.log.nextSeq), close: { fromRef: fold.spanInput.fromRef, toRef: fold.spanInput.toRef, narrative: scrubbed.narrative, narrativeLess: outcome.kind === "narrative-less", world, ...(outcome.missingChunks.length ? { missingChunks: outcome.missingChunks } : {}) }, at, measure });
+  return { closed, summary: render({ state: closed.state, tokensBefore: preparation.tokensBefore, ledger, snapshot, caps: config.caps, files, learned, tasks, compactedAt: at }), capture, snapshot, ledger, files, learned, redacted: scrubbed.redacted };
 }
 
 function assembleResult(input: PassInput, config: StateConfig, fold: Fold, outcome: NarrativeOutcome, built: Closed, deps: PassDeps, startedAt: Date, at: string): PassResult {
   const { preparation } = input;
-  const { closed, summary, capture, snapshot, ledger, files, learned } = built;
+  const { closed, summary, capture, snapshot, ledger, files, learned, redacted } = built;
   const usage = { input: outcome.usage.input, output: outcome.usage.output, calls: outcome.usage.calls };
   const details: StateDetails = { compactor: "state", stateFormat: STATE_FORMAT, promptRevision: outcome.sections ? TURNS_PROMPT_REVISION : NARRATIVE_PROMPT_REVISION, state: closed.state, caps: config.caps, ledger, snapshot, narrative: narrativeTraceOf(outcome), readFiles: files.readFiles, modifiedFiles: files.modifiedFiles, learnedValues: learned };
   const pending: PendingSpan = { span: fold.span, events: closed.log.events.filter((event) => event.span === fold.span), ledger, snapshot, usage, caps: config.coldSliceCaps };
   const route = { spec: fold.route.spec, rule: fold.route.rule, model: fold.resolved ? `${fold.resolved.model.provider}/${fold.resolved.model.id}` : undefined, fallbackReason: fold.resolved?.fallbackReason, routeIgnored: fold.resolved?.routeIgnored, routeAvailable: fold.routeAvailable };
   const logOptions = logOptionsOf(input.env);
-  const log = { event: "compaction", at, reason: input.reason, span: fold.span, tokensBefore: preparation.tokensBefore, summaryChars: summary.length, narrative: logSafeNarrative(details.narrative, logOptions), rejected: logSafeRejected(outcome.rejected, logOptions), route, routeHealth: outcome.routeHealth, capFit: closed.capFit.retired, capExhausted: closed.capFit.exhausted, anomalies: fold.log.anomalies, world: { claims: closed.state.world?.claims.length ?? 0, openErrors: closed.state.world?.openErrorIds.length ?? 0, dirty: closed.state.world?.dirty }, carried: { readFiles: files.readFiles.length, modifiedFiles: files.modifiedFiles.length, removed: logSafeRemoved(files.removed, logOptions), learnedValues: learned.length }, workspace: "skipped" in capture ? { skipped: logSafeSkipped(capture.skipped, logOptions) } : { captured: true }, durationMs: deps.now().getTime() - startedAt.getTime() };
+  const log = { event: "compaction", at, reason: input.reason, span: fold.span, tokensBefore: preparation.tokensBefore, summaryChars: summary.length, narrative: logSafeNarrative(details.narrative, logOptions), rejected: logSafeRejected(outcome.rejected, logOptions), route, routeHealth: outcome.routeHealth, capFit: closed.capFit.retired, capExhausted: closed.capFit.exhausted, anomalies: fold.log.anomalies, world: { claims: closed.state.world?.claims.length ?? 0, openErrors: closed.state.world?.openErrorIds.length ?? 0, dirty: closed.state.world?.dirty }, carried: { readFiles: files.readFiles.length, modifiedFiles: files.modifiedFiles.length, removed: logSafeRemoved(files.removed, logOptions), learnedValues: learned.length }, redacted, workspace: "skipped" in capture ? { skipped: logSafeSkipped(capture.skipped, logOptions) } : { captured: true }, durationMs: deps.now().getTime() - startedAt.getTime() };
   return {
     compaction: { summary, firstKeptEntryId: preparation.firstKeptEntryId, tokensBefore: preparation.tokensBefore, usage: compactionUsageOf(outcome.usage), details },
     pending, outcome, routeHealth: outcome.routeHealth, route, capFit: closed.capFit, anomalies: fold.log.anomalies, notice: noticeOf(fold.span, outcome, summary.length), log,

package/src/remember-tool.ts

@@ -2,17 +2,21 @@
  * The `remember` tool: one verified write into the Session state, sequential so two calls in one
  * turn never race the fold. Quotes only, resolved newest-first; the store's commitRemember is the
  * whole policy. Argument repair: a quote passed as `text` (or the reverse) is swapped with a Note,
- * because a model that got the field wrong got the intent right.
+ * because a model that got the field wrong got the intent right. A decision or dead end is the
+ * model's own words, so one that carries a credential value (credential-scrub.ts, with the
+ * credentials of the messages still in context, the kept window included) is refused, never stored (security.md T3).
  */
 import { REMEMBER_TOOL } from "./tool-names.ts";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
 import { readConfigFile, resolveStateConfig, type ReadFileFn } from "./config.ts";
+import { CREDENTIAL_RULE, scrubCredentials } from "./credential-scrub.ts";
+import { spanCredentials } from "./span-credentials.ts";
 import { commitRemember } from "./store/commit.ts";
 import { EVENT_ENTRY_TYPE, type PersistedEvent } from "./store/events.ts";
 import type { Proposal } from "./store/verify.ts";
-import { buildToolContext } from "./tool-context.ts";
+import { buildToolContext, messagesInContext } from "./tool-context.ts";
 import { formatRemember } from "./tool-text.ts";
 
 export const REMEMBER_KINDS = ["correction", "lift", "decision", "dead-end", "done-when"] as const;
@@ -42,6 +46,13 @@ export function proposalOf(params: RememberParams): { proposal: Proposal; note?:
   return { proposal: { kind: "dead-end", text: words, evidence: params.evidence }, note };
 }
 
+/** Why a decision or dead end is refused, or undefined: the model's own words may not hold a credential the span showed or one shaped as one. */
+function credentialRefusal(proposal: Proposal, branch: Parameters<typeof messagesInContext>[0]): string | undefined {
+  if (proposal.kind !== "decision" && proposal.kind !== "dead-end") return undefined;
+  if (scrubCredentials(proposal.text, spanCredentials(messagesInContext(branch))).redacted === 0) return undefined;
+  return `the text carries a credential. ${CREDENTIAL_RULE}`;
+}
+
 const PARAMETERS = Type.Object({
   kind: Type.Union(REMEMBER_KINDS.map((kind) => Type.Literal(kind)), { description: "correction: a standing rule the user gave (quote). lift: the user withdrew a correction (target + quote). decision / dead-end: your own one sentence (text, evidence). done-when: the user's acceptance words (quote)." }),
   quote: Type.Optional(Type.String({ description: "The user's exact words, a substring of one user message (12+ chars). Example: \"never use mocks in these tests\"." })),
@@ -64,8 +75,11 @@ export function registerRememberTool(pi: ExtensionAPI, deps: { readConfig: ReadF
     async execute(_toolCallId, params, _signal, _onUpdate, ctx: ExtensionContext) {
       const mapped = proposalOf(params as RememberParams);
       if ("error" in mapped) return { content: [{ type: "text", text: `not remembered: ${mapped.error}` }], details: { ok: false, remaining: undefined, rejection: { code: "schema", detail: mapped.error } } };
+      const branch = ctx.sessionManager.getBranch();
+      const refusal = credentialRefusal(mapped.proposal, branch);
+      if (refusal) return { content: [{ type: "text", text: `not remembered: ${refusal}` }], details: { ok: false, remaining: undefined, rejection: { code: "credential", detail: refusal } } };
       const config = resolveStateConfig(deps.readConfig);
-      const context = buildToolContext(ctx.sessionManager.getBranch());
+      const context = buildToolContext(branch);
       const outcome = commitRemember(mapped.proposal, {
         log: context.log, resolver: context.index, caps: config.caps, nearDuplicateThreshold: config.nearDuplicateThreshold, rememberCap: config.rememberPerSpan,
         now: () => deps.now().toISOString(), appendEntry: (customType: string, data: PersistedEvent) => pi.appendEntry(customType, data),

package/src/span-credentials.ts

@@ -0,0 +1,194 @@
+/**
+ * The span's credentials (credential-scrub.ts SpanCredentials): the whole values the span itself showed as
+ * credentials, which the scrub then takes out of what the summarizer wrote wherever it put them (security.md T3).
+ * Strong evidence only, because each value is redacted everywhere it stands: the named-value taint
+ * (narrative/named-values.ts), right for refusing a value, counts the words after "pin", "card" or "login" and a
+ * secret store's whole output, and on real states it redacted versions, commit hashes and paths in about a third of
+ * the fields. A value counts when
+ * - the span's text names it as the scrub itself would (credential-scrub.ts namedCredentialValues), unless it is
+ *   shaped as a name (below);
+ * - it is the value of a key named for one credential, ending in its name or a short part after it
+ *   (`DB_PASSWORD`, `cluster_token`, `WIFI_PASSPHRASE_2400_BAUD`; not `tokens: 1200`, a test runner's `pass`, nor a key
+ *   about one, `password_policy`, `token_env`), unless a token, secret or key key holds a value shaped as a name (`app-token`,
+ *   `APP_TOKEN`, a path, a file name; a password key's value is one whatever its shape, `unmade-tremor-oxidize`);
+ * - a command gives it as a password argument (`mysql -pX`, `sshpass -p X`, `redis-cli -a X`, `curl -u user:X`,
+ *   `htpasswd -b FILE USER X`, `--db-password X`, `openssl -pass pass:X`, `keytool -storepass X`);
+ * - it is a random-looking word on another credential line (a YAML block under such a key);
+ * - a secret store printed it alone (`vault kv get -field=...`), or random-looking among other output;
+ * - but never a random-looking word its label names as an id or a hash (`Evaluation ID: <uuid>`, `plan_hash <hex>`,
+ *   `commit <sha>`), nor the words after a key whose value is computed (`TOKEN=$(vault kv get ... | python3 ...)`), nor
+ *   a test runner's `--- PASS: TestName`;
+ * - or prose gives it: `the password is ...`, `the db pass is ...`.
+ * Never a number (except six digits and more given as a password), version, date or path, nor one plain lowercase
+ * word ("token: missing"). Measured on real states, these took no version, hash or path out of a field.
+ */
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+
+import { credentialCore, isNumberish, isNumericPasswordKey, isRandomLooking, isValueLike, namedCredentialValues, WORD } from "./credential-scrub.ts";
+import { CREDENTIAL_NAME, keyedLine, secretStoreOutputs, splitCredentialLines } from "./learned-secrets.ts";
+import type { Rec } from "./message-text.ts";
+import { everyTextIn } from "./narrative/named-values.ts";
+
+/** `the password is X`: the one value prose gives a password outright. */
+const PROSE_PASSWORD = /(?<![A-Za-z])(?:passw(?:or)?d|passwd|pwd|pass|passphrase|passcode)\s+(?:is|was)\s+(\S+)/gi;
+/**
+ * A command's password argument, group 1 (as ledger/handoff-commands.ts SECRET_PATTERNS, which marks the line).
+ * Every quantifier is bounded, each lazy run stops at a newline.
+ */
+const COMMAND_PASSWORDS = [
+  /\b(?:mysql|mysqldump|mariadb)\b[^\n]{0,2000}?\s-p(?!\s)(\S+)/g,
+  /\bsshpass\s+(?:(?:-P\s+\S+|-[a-oq-zA-Z]\w*)\s+){0,3}-p\s*(\S+)/g,
+  /\bredis-cli\b[^\n]{0,200}?\s-a\s+(\S+)/g,
+  /(?:^|\s)(?:-u|--user)\s+[^\s:]+:(\S+)/g,
+  /\s-pass(?:in|out)?\s+pass:(\S+)/g,
+  /\s-(?:src|dest)?(?:store|key)?pass\s+(?!(?:env|file|fd):|stdin\b)(\S+)/g,
+  /(?:^|\s)--?(?:[a-z0-9]{1,32}[-_.]){0,3}(?:password|passwd|passphrase|pass|secret|token|api[-_]?key)(?:=|\s+)(?!-)(\S+)/gi,
+];
+/** `htpasswd -b FILE USER PASS`, or `-nb USER PASS` (no file). */
+const HTPASSWD = /\bhtpasswd\s+(?:-[a-zA-Z]{1,8}\s+){0,3}?-([a-zA-Z]{0,8}b[a-zA-Z]{0,8})\s+(\S+)\s+(\S+)(?:\s+(\S+))?/g;
+/** A test runner's status line, `--- PASS: TestName (0.01s)` or `PASS: name`, upper case: no credential (`pass: x` is one). */
+const TEST_STATUS = /^\s*(?:[-=]{3}\s*)?PASS\s*:/;
+/** A value pointed at rather than held (a variable, a placeholder), once a quote or bracket before it is dropped. */
+const REFERENCE = /^["'`([]*(?:\$|%|\*|\{|<|\.\.\.)/;
+const NOT_A_SECRET = [
+  /^v?\d+(?:[.:_-]\d+)*$/i, // a number, a version, a time
+  /^\d{4}-\d{2}-\d{2}(?:[T ][\d:.]+Z?)?$/, // a date
+  /^(?:\/|~\/|\.\.?\/)/, // a path
+  /^[a-z]+$/, // one plain lowercase word: a status
+];
+const isSpanValue = (value: string) => value.length >= 4 && (/^\d{13,}$/.test(value) || !NOT_A_SECRET.some((shape) => shape.test(value)));
+/** A password given as one: a span value, or six digits and more. */
+const isPasswordValue = (value: string) => isSpanValue(value) || /^\d{6,}$/.test(value);
+/**
+ * What may follow a credential's name at the end of its key: up to two short parts (`WIFI_PASSPHRASE_2400_BAUD`,
+ * `ADMIN_TOKEN_2`), then quotes. A part that says the key is ABOUT the credential (KEY_ABOUT) makes it no key for one.
+ */
+const KEY_TAIL = String.raw`((?:[_.-][A-Za-z0-9]{1,12}){0,2})["'\\]{0,4}$`;
+const KEY_ABOUT = /[_.-](?:policy|disabled|enabled|required|length|len|min|max|algorithm|algo|hash|hashed|salt|rounds|file|path|dir|env|var|name|id|type|kind|mode|set|present|missing|rules|reset|expiry|expires|ttl|age|count|ref|url|header|field|prompt|hint|strength|changed|updated)(?![A-Za-z0-9])/i;
+const endsInCredential = (pattern: RegExp, key: string) => {
+  const match = pattern.exec(key.trim());
+  return match !== null && !KEY_ABOUT.test(match[1]);
+};
+/** A key that ends in a password word (`DB_PASS`, `"password"`), not one about passwords (`password_policy`). */
+const PASSWORD_KEY = new RegExp(String.raw`(?:passw(?:or)?d|passwd|pwd|pass(?:phrase|code)?)s?` + KEY_TAIL, "i");
+const isPasswordKey = (key: string) => endsInCredential(PASSWORD_KEY, key);
+/** Push without spreading: a spread passes every element as an argument and overflows the stack on a huge line. */
+function pushAll(into: string[], items: Iterable<string>): void {
+  for (const item of items) into.push(item);
+}
+/**
+ * A key named for one credential, in at most three words, ending in its name (quotes aside): singular, so
+ * `tokens: 1200` and a list of `secrets` are not one, no bare `pass` (a test runner's count), and no key about one
+ * (`password_policy`, `token_env`, `PASSWORD_FILE`). Letters may precede the name (`PGPASSWORD`).
+ */
+const CREDENTIAL_KEY = new RegExp(String.raw`(?:passw(?:or)?d|passwd|passphrase|passcode|secret|token|api[_ -]?key|access[_ -]?key|private[_ -]?key|credential)` + KEY_TAIL, "i");
+/** A bare lower-case `pass` key (nodemailer's `auth.pass`, YAML), which CREDENTIAL_KEY leaves out as a test runner's count. */
+const BARE_PASS_KEY = /^["']?pass["']?$/;
+const isCredentialKey = (key: string) => BARE_PASS_KEY.test(key.trim()) || key.length <= 40 && key.trim().split(/\s+/).length <= 3 && endsInCredential(CREDENTIAL_KEY, key);
+/**
+ * A value shaped as a name of something rather than a secret: an identifier, an environment variable, a path, a file
+ * or host name, or a call that computes it (`secret = json.load(open('app.json'))`).
+ */
+const NAME_SHAPES = [/^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)+$/, /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/, /\//, /^[\w-]+(?:\.[\w-]+)+$/, /^[A-Za-z_][\w.]{0,64}\(/];
+const isNameShaped = (value: string) => !isRandomLooking(value) && NAME_SHAPES.some((shape) => shape.test(value));
+/** A credential key's value: value-like, or eight characters and more; under a token, secret or key key, not shaped as a name. */
+function isKeyedValue(value: string, key: string): boolean {
+  if (/^\d{6,}$/.test(value)) return isNumericPasswordKey(key);
+  if (isPasswordKey(key)) return isSpanValue(value) && (isValueLike(value) || value.length >= 6);
+  return (isValueLike(value) || value.length >= 8) && !isNameShaped(value) && !isNumberish(value);
+}
+/** A command's password argument: a password, value-like or six characters and more. */
+const isCommandValue = (value: string) => isPasswordValue(value) && (isValueLike(value) || value.length >= 6);
+/** A value prose gives: value-like, or a long run with a non-letter in it (a passphrase), not a long English word. */
+const isProseValue = (value: string) => isValueLike(value) || (value.length >= 12 && /[^A-Za-z]/.test(value));
+
+/** The words of `text` that hold a value, each with what wraps it trimmed. */
+function coresOf(text: string): string[] {
+  const cores: string[] = [];
+  for (const [word] of text.matchAll(WORD)) {
+    if (REFERENCE.test(word)) continue;
+    const core = credentialCore(word);
+    if (core.end > core.start) cores.push(word.slice(core.start, core.end));
+  }
+  return cores;
+}
+
+/** A word that names the value after it as an id or a hash (`Evaluation ID:`, `plan_hash`, `commit`), not a secret. */
+const ID_LABEL = /(?:^|[_.-])(?:id|ids|uuid|hash|sha|sha1|sha256|digest|commit|rev|revision|etag)$/i;
+
+/**
+ * The random-looking words of `text`, except one the word before it on its line labels as an id or a hash (ID_LABEL),
+ * unless that label or the word before it names a credential (`secret_id`, `Secret ID`).
+ */
+function randomWordsOf(text: string): string[] {
+  const values: string[] = [];
+  let label = "";
+  let previous = "";
+  let end = 0;
+  for (const match of text.matchAll(WORD)) {
+    if (text.slice(end, match.index).includes("\n")) label = previous = "";
+    const core = credentialCore(match[0]);
+    const bare = match[0].slice(core.start, core.end);
+    const idLabelled = ID_LABEL.test(label) && !CREDENTIAL_NAME.test(`${previous} ${label}`);
+    if (!REFERENCE.test(match[0]) && isRandomLooking(bare) && !idLabelled) values.push(bare);
+    previous = label;
+    label = bare;
+    end = match.index + match[0].length;
+  }
+  return values;
+}
+
+/** The password arguments of a command line. */
+function commandValuesOf(line: string): string[] {
+  const values: string[] = [];
+  for (const pattern of COMMAND_PASSWORDS) for (const match of line.matchAll(pattern)) pushAll(values, coresOf(match[1]));
+  for (const match of line.matchAll(HTPASSWD)) {
+    const value = match[1].includes("n") ? match[3] : match[4];
+    if (value) pushAll(values, coresOf(value));
+  }
+  return values.filter(isCommandValue);
+}
+
+/** A password key written as YAML (`password: my Secret#Pass 99`), whose plain value runs to the line's end or a comment. */
+const isYamlPassword = (line: string, key: string) => isPasswordKey(key) && /^\s*:\s/.test(line.trimStart().slice(key.length));
+/** What is left of an assignment once the key is cut at its first colon: Go's `:=` or a type (`: str = `, `: &str = `). */
+const ASSIGNED = /^(?:[^\s=]{1,40}[ \t]{1,8})?:?=(?!=)[ \t]{0,8}/;
+/**
+ * What a key holds: its quoted string, or else its first word; the rest of the line is the command or prose around it
+ * (`TOKEN=$(vault kv get ... | python3 -c "import sys,json"`). Nothing when the value is computed or pointed at.
+ */
+function heldBy(raw: string, toLineEnd: boolean): string {
+  const value = raw.replace(ASSIGNED, "");
+  const quoted = /^(\\{0,3}["'])((?:\\.|[^\n\\]){0,512}?)\1/.exec(value);
+  const comment = toLineEnd ? value.search(/\s#/) : -1;
+  const held = quoted ? quoted[2] : toLineEnd ? (comment < 0 ? value : value.slice(0, comment)) : (/^\S+/.exec(value)?.[0] ?? "");
+  return REFERENCE.test(held) || /^["'([]*`/.test(held) ? "" : held;
+}
+
+function valuesOf(text: string): string[] {
+  const values = namedCredentialValues(text).filter((value) => !isNameShaped(value));
+  for (const line of splitCredentialLines(text).credential) {
+    if (TEST_STATUS.test(line)) continue;
+    const keyed = keyedLine(line);
+    if (keyed && isCredentialKey(keyed.key)) pushAll(values, coresOf(heldBy(keyed.value, isYamlPassword(line, keyed.key))).filter((value) => isKeyedValue(value, keyed.key)));
+    else pushAll(values, randomWordsOf(line));
+    pushAll(values, commandValuesOf(line));
+  }
+  for (const match of text.matchAll(PROSE_PASSWORD)) pushAll(values, coresOf(match[1]).filter((value) => isProseValue(value) || /^\d{6,}$/.test(value)));
+  return values;
+}
+
+/** What a secret store printed: a value printed alone is one whatever it looks like; among other output, a random-looking one. */
+function storeValuesOf(output: string): string[] {
+  const words = coresOf(output.trim());
+  return words.length === 1 ? words : randomWordsOf(output);
+}
+
+/** The span's credentials in `messages`: every whole value one of them showed as a credential. */
+export function spanCredentials(messages: readonly AgentMessage[]): Set<string> {
+  const values = new Set<string>();
+  const add = (value: string) => { if (isPasswordValue(value)) values.add(value); };
+  for (const message of messages as unknown as Rec[]) for (const text of everyTextIn(message)) valuesOf(text).forEach(add);
+  for (const output of secretStoreOutputs(messages as unknown as Rec[])) storeValuesOf(output).forEach(add);
+  return values;
+}

package/src/store/project.ts

@@ -8,6 +8,7 @@
 import type { Caps, ForeignCompactor, Now, Quote, Source, StateEvent, StateLog, World } from "./events.ts";
 import { DEFAULT_NEAR_DUPLICATE_THRESHOLD, overlap, tokenize } from "./near-duplicate.ts";
 import { oneLine } from "../one-line.ts";
+import { scrubCredentials } from "../credential-scrub.ts";
 
 export interface CorrectionItem {
   id: string;
@@ -69,6 +70,14 @@ export function emptyState(): SessionState {
 
 const idNumber = (id: string) => Number(/^[RDX](\d+)$/.exec(id)?.[1] ?? 0);
 
+/**
+ * Model-written text as the state shows it: with its credential values redacted (credential-scrub.ts). A pass scrubs
+ * what it writes against the span's own credentials; this catches what a record written before that carries, by
+ * shape and by what the text itself names, wherever the state is read (render, prompt, recall, the state CLI).
+ */
+const clean = (text: string) => scrubCredentials(text).text;
+const cleanNow = (now: Now): Now => ({ inProgress: now.inProgress.map(clean), next: now.next.map(clean), blocked: now.blocked.map(clean), resume: clean(now.resume) });
+
 /** Retire the oldest active items of a kind past the cap; returns how many retired. */
 function retireOverCap<T extends { retired: boolean; seq: number }>(items: T[], cap: number): number {
   let excess = items.filter((item) => !item.retired).length - cap;
@@ -88,7 +97,7 @@ function workLogText(event: Extract<StateEvent, { kind: "span.close" }>): string
   if (event.foreign) return `compacted by ${event.foreign === "pi" ? "pi's own summarizer" : "another extension's compactor"}; no state diff for this span`;
   const missing = event.missingChunks?.length ? ` (chunk ${event.missingChunks.join(", ")} of this span did not verify)` : "";
   if (event.narrativeLess || !event.narrative) return `narrative unavailable for this span (narrative-less pass)${missing}`;
-  return `${event.narrative}${missing}`;
+  return `${clean(event.narrative)}${missing}`;
 }
 
 /** Fold the two oldest work-log lines into one consolidated line until the active count fits the cap. */
@@ -210,17 +219,17 @@ function applyInPlace(state: SessionState, event: StateEvent, caps: Caps): void
       break;
     }
     case "decision.add":
-      state.decisions.push({ id: event.id, text: event.text, span: event.span, source: event.source, evidence: event.evidence, seq: event.seq, retired: false });
+      state.decisions.push({ id: event.id, text: clean(event.text), span: event.span, source: event.source, evidence: event.evidence, seq: event.seq, retired: false });
       state.cursor.D = Math.max(state.cursor.D, idNumber(event.id));
       state.retired.decisions += retireOverCap(state.decisions, caps.decisions);
       break;
     case "deadEnd.add":
-      state.deadEnds.push({ id: event.id, text: event.text, span: event.span, source: event.source, evidence: event.evidence, seq: event.seq, retired: false });
+      state.deadEnds.push({ id: event.id, text: clean(event.text), span: event.span, source: event.source, evidence: event.evidence, seq: event.seq, retired: false });
       state.cursor.X = Math.max(state.cursor.X, idNumber(event.id));
       state.retired.deadEnds += retireOverCap(state.deadEnds, caps.deadEnds);
       break;
     case "now.set":
-      state.now = { ...event.now, span: event.span, carried: false };
+      state.now = { ...cleanNow(event.now), span: event.span, carried: false };
       break;
     case "span.close":
       applyClose(state, event, caps);

package/src/store/recall.ts

@@ -6,9 +6,16 @@
 import type { CommandRecord, ErrorRecord } from "../ledger/handoff.ts";
 import type { Caps, StateEvent, StateLog } from "./events.ts";
 import { orderedFiles } from "../files-render.ts";
-import { oneLine as sanitize } from "../one-line.ts";
+import { oneLine } from "../one-line.ts";
+import { scrubCredentials } from "../credential-scrub.ts";
 import { eventKey, project } from "./project.ts";
 
+/**
+ * A hit's text: one line, with its credential values redacted (credential-scrub.ts). Span records written before the
+ * scrub still carry what the summarizer copied, and an error line from such a record may carry one too.
+ */
+const sanitize = (text: string) => oneLine(scrubCredentials(text).text);
+
 export type RecallWhat = "span" | "commands" | "errors" | "decisions" | "dead-ends" | "corrections" | "message" | "files" | "all";
 
 export interface RecallQuery {

package/src/tool-context.ts

@@ -29,6 +29,22 @@ export function messagesSinceLastCompaction(branch: SessionEntry[]): AgentMessag
   return branch.slice(start).filter((entry) => entry.type === "message").map((entry) => (entry as { message: AgentMessage }).message);
 }
 
+/**
+ * The messages still in the model's context: from the latest compaction's first kept entry (the kept window), else
+ * from the start of the branch. What a remember write is checked against (remember-tool.ts).
+ */
+export function messagesInContext(branch: SessionEntry[]): AgentMessage[] {
+  let start = 0;
+  for (let index = branch.length - 1; index >= 0; index--) {
+    const entry = branch[index];
+    if (entry.type !== "compaction") continue;
+    const kept = branch.findIndex((candidate) => candidate.id === entry.firstKeptEntryId);
+    start = kept >= 0 && kept < index ? kept : index + 1;
+    break;
+  }
+  return branch.slice(start).filter((entry) => entry.type === "message").map((entry) => (entry as { message: AgentMessage }).message);
+}
+
 /** The live ledger alone, for a caller that needs no index, log or files (recall what=output). */
 export function liveLedger(branch: SessionEntry[]): ToolContext["ledger"] {
   const handoff = collectHandoff({ branchEntries: branch, messages: messagesSinceLastCompaction(branch) });