sandoichi 0.1.5 → 0.2.0

package/README.md

@@ -10,6 +10,20 @@ npm install sandoichi
 import { optimizeToolOutput, createProviderProxy } from 'sandoichi';
 ```
 
+Project-specific detectors can be declared in `.sando/redaction.json`:
+
+```json
+{
+  "schema": "sando-redaction/v1",
+  "rules": [
+    { "type": "assignment-key", "key": "DATABASE_URL" },
+    { "type": "token-prefix", "prefix": "acme_", "minLength": 24, "maxLength": 128 }
+  ]
+}
+```
+
+Built-ins stay enabled. Profiles are declarative and local to the current project; invalid profiles fail visibly.
+
 The library requires Node.js `>=22.22.0 <23` and has no runtime dependencies. Installing it does not install or enable the plugin.
 
 For plugin installation, see the [main project README](https://github.com/yuzushi-dev/Sando#readme).

package/index.mjs

@@ -5,6 +5,8 @@ export {
   normalizePolicy,
   optimizeToolOutput,
 } from './src/core.mjs';
+export { createRedactionProfile } from './src/redaction-profile.mjs';
+export { loadProjectRedactionProfile } from './src/redaction-config.mjs';
 export { detectProviderBody, listSemanticCandidates, transformProviderRequest } from './src/context-transform.mjs';
 export {
   buildSemanticPrompt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandoichi",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Reduce repeated tool-output context in Claude Code and Codex.",
   "license": "MIT",
   "author": "yuzushi",

package/src/core.mjs

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 
 import { planToolRoute, ROUTING_POLICY_VERSION } from './routing.mjs';
-import { redact } from './secret-redaction.mjs';
+import { loadProjectRedactionProfile } from './redaction-config.mjs';
 
 const DEFAULT_POLICY = Object.freeze({
   mode: 'apply', maxInlineBytes: 4096, maxArtifactBytes: 65536, headBytes: undefined, tailBytes: undefined,
@@ -31,6 +31,14 @@ function textOutput(output) {
   return value;
 }
 
+function resolveRedactionProfile(cwd, candidate) {
+  const profile = candidate ?? loadProjectRedactionProfile(cwd).profile;
+  if (!profile || typeof profile.redact !== 'function' || typeof profile.digest !== 'string') {
+    throw new TypeError('redactionProfile is invalid');
+  }
+  return profile;
+}
+
 function truncateUtf8(text, maxBytes) {
   if (Buffer.byteLength(text) <= maxBytes) return text;
   let bytes = 0;
@@ -140,7 +148,7 @@ export function normalizePolicy(policy = {}) {
 
 export function optimizeToolOutput({
   toolName, output, cwd, policy, selector, raw, lineCount, fileBytes, prose, summarizeProse,
-  summarizeEnabled, grepScope, outputBytes, toolInput,
+  summarizeEnabled, grepScope, outputBytes, toolInput, redactionProfile,
 } = {}) {
   if (typeof toolName !== 'string' || !toolName.trim() || toolName.length > 128) throw new Error('toolName is invalid');
   if (typeof cwd !== 'string' || !cwd) throw new Error('cwd is invalid');
@@ -154,7 +162,8 @@ export function optimizeToolOutput({
     lineCount: derivedLineCount, fileBytes: derivedFileBytes, prose, summarizeProse, summarizeEnabled, grepScope,
     outputBytes: outputBytes ?? Buffer.byteLength(input),
   });
-  const redacted = normalizedPolicy.redact ? redact(input) : { text: input, count: 0 };
+  const profile = normalizedPolicy.redact ? resolveRedactionProfile(cwd, redactionProfile) : null;
+  const redacted = profile ? profile.redact(input) : { text: input, count: 0 };
   let modelText = name === 'bash' && normalizedPolicy.maxColumns >= 32
     ? collapseRepeatedLines(redacted.text)
     : redacted.text;
@@ -214,7 +223,10 @@ export function optimizeToolOutput({
     redactions: redacted.count,
     artifactTruncated: artifact?.truncated ?? false,
   };
-  const result = { inline, route: route.route, reason: route.source, policyVersion: ROUTING_POLICY_VERSION, stats };
+  const result = {
+    inline, route: route.route, reason: route.source, policyVersion: ROUTING_POLICY_VERSION,
+    redactionProfileDigest: profile?.digest ?? null, stats,
+  };
   if (artifact) result.artifact = artifact;
   return result;
 }
@@ -252,7 +264,8 @@ export function createReceipt({ host, event, optimization, replacement } = {}) {
     sessionId: event.sessionId ?? null, inputDigest: sha256(textOutput(event.output)),
     inlineDigest: sha256(textOutput(replacement === undefined ? optimization.inline : replacement)), artifactRef: optimization.artifact?.ref ?? null,
     route: optimization.route ?? 'passthrough', reason: optimization.reason ?? 'spike-default',
-    policyVersion: optimization.policyVersion ?? ROUTING_POLICY_VERSION, stats: optimization.stats,
+    policyVersion: optimization.policyVersion ?? ROUTING_POLICY_VERSION,
+    redactionProfileDigest: optimization.redactionProfileDigest ?? null, stats: optimization.stats,
   };
   return { ...body, digest: sha256(stableJson(body)) };
 }

package/src/hook-cli.mjs

@@ -3,42 +3,54 @@ import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 
 import { createReceipt, normalizeEvent, normalizePolicy, optimizeToolOutput } from './core.mjs';
+import { loadProjectRedactionProfile } from './redaction-config.mjs';
 import { defaultMetricsPath, recordMetrics } from './metrics.mjs';
 import {
-  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, readTelemetryConfig,
+  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, isDoNotTrack, readTelemetryConfig, recordActiveDay, recordFailure,
 } from './telemetry.mjs';
-
-const PLUGIN_VERSION = '0.1';
+import { PLUGIN_VERSION } from './version.mjs';
 
 function todayUtc() { return new Date().toISOString().slice(0, 10); }
 
-/** Only counts (never content, paths, or IDs) — see docs/plans/2026-08-25-sando-telemetry-design.md.
- *  `enforce` covers both `apply` and `dry-run`: both walk the real rewrite path, only
- *  `observe` collects without deciding anything. */
+/** Only counts (never content, paths, or IDs). */
 function recordHookTelemetry({ host, env, policy, optimization }) {
-  const configPath = defaultTelemetryConfigPath(env);
-  let config;
-  try { config = readTelemetryConfig(configPath); } catch { return; }
-  if (!config.enabled) return;
   try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
     const statePaths = defaultTelemetryStatePaths(env);
+    recordActiveDay({ statePaths, day: todayUtc(), pluginVersion: PLUGIN_VERSION, host });
     incrementCounter({
       statePaths,
       day: todayUtc(),
       event: 'hook_summary',
       host,
-      mode: policy.mode === 'observe' ? 'observe' : 'enforce',
+      mode: policy.mode === 'apply' ? 'enforce' : policy.mode === 'dry-run' ? 'dry_run' : 'observe',
       deltas: {
         toolCalls: 1,
         redactions: optimization.stats.redactions,
         cappedOutputs: optimization.artifact ? 1 : 0,
         bytesSaved: Math.max(0, optimization.stats.inputBytes - optimization.stats.inlineBytes),
+        inputTokensSaved: Math.max(0, optimization.stats.estimatedInputTokens - optimization.stats.estimatedInlineTokens),
       },
     });
     closeFinishedDays({ statePaths, configPath, day: todayUtc(), pluginVersion: PLUGIN_VERSION });
   } catch { /* telemetry is best-effort and must never affect hook output */ }
 }
 
+function recordHookFailure({ host, env, failureStage }) {
+  try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
+    const statePaths = defaultTelemetryStatePaths(env);
+    const day = todayUtc();
+    recordActiveDay({ statePaths, day, pluginVersion: PLUGIN_VERSION, host });
+    recordFailure({ statePaths, day, event: 'hook_failure_summary', host, failureStage });
+    closeFinishedDays({ statePaths, configPath, day, pluginVersion: PLUGIN_VERSION });
+  } catch { /* telemetry is best-effort and must never affect hook output */ }
+}
+
 function hookPolicy(env, host) {
   const policy = env.SANDO_POLICY
     ? JSON.parse(env.SANDO_POLICY)
@@ -78,27 +90,34 @@ export function runHookCli({ host, env = process.env } = {}) {
   try {
     policy = hookPolicy(env, host);
   } catch (error) {
+    recordHookFailure({ host, env, failureStage: 'policy' });
     process.stderr.write(`sando invalid policy: ${error instanceof Error ? error.message : 'invalid input'}\n`);
     process.exitCode = 2;
     return;
   }
+  let failureStage = 'input';
   try {
     const input = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
     const eventName = input.hook_event_name ?? input.hookEventName ?? input.event_name ?? input.eventName;
     if (eventName === 'PostToolUse') {
       const event = normalizeEvent(input);
-      const optimization = optimizeToolOutput({ toolName: event.toolName, toolInput: event.toolInput, output: event.output, cwd: event.cwd, policy });
+      failureStage = 'redaction';
+      const redactionProfile = policy.redact ? loadProjectRedactionProfile(event.cwd).profile : undefined;
+      failureStage = 'optimization';
+      const optimization = optimizeToolOutput({ toolName: event.toolName, toolInput: event.toolInput, output: event.output, cwd: event.cwd, policy, redactionProfile });
       let shaped;
+      failureStage = 'artifact';
       if (host === 'claude' && policy.mode === 'apply') {
         shaped = shapeForClaude({
           original: event.output,
           optimization,
           toolName: event.toolName,
           toolInput: event.toolInput,
-          cwd: event.cwd,
+          cwd: event.cwd, redactionProfile,
           policy,
         });
       }
+      failureStage = 'output';
       const receipt = createReceipt({ host, event, optimization, replacement: shaped });
       try {
         recordMetrics({ storagePath: defaultMetricsPath(env), host, event, optimization, receipt });
@@ -117,7 +136,13 @@ export function runHookCli({ host, env = process.env } = {}) {
         }
       }
     }
-  } catch {}
+  } catch (error) {
+    recordHookFailure({ host, env, failureStage });
+    if (error?.code === 'SANDO_REDACTION_CONFIG') {
+      process.stderr.write(`sando invalid redaction config: ${error.message}\n`);
+      process.exitCode = 2;
+    }
+  }
   process.stdout.write('{}\n');
 }
 
@@ -135,19 +160,19 @@ export function buildCodexFallback({ optimization, cwd }) {
   };
 }
 
-function shapeForClaude({ original, optimization, toolName, toolInput, cwd, policy }) {
+function shapeForClaude({ original, optimization, toolName, toolInput, cwd, policy, redactionProfile }) {
   if (typeof original === 'string') return materialize(optimization, cwd);
   if (!original || typeof original !== 'object' || Array.isArray(original)
     || !Object.hasOwn(original, 'stdout') || !Object.hasOwn(original, 'stderr')
     || typeof original.stdout !== 'string' || typeof original.stderr !== 'string'
     || (Object.hasOwn(original, 'interrupted') && typeof original.interrupted !== 'boolean')
     || (Object.hasOwn(original, 'isImage') && typeof original.isImage !== 'boolean')) return undefined;
-  const result = { ...original };
+  const result = policy.redact ? redactionProfile.redactStructured(original).value : { ...original };
   if (typeof original.stdout === 'string') {
-    result.stdout = materialize(optimizeToolOutput({ toolName, toolInput, output: original.stdout, cwd, policy }), cwd);
+    result.stdout = materialize(optimizeToolOutput({ toolName, toolInput, output: original.stdout, cwd, policy, redactionProfile }), cwd);
   }
   if (typeof original.stderr === 'string') {
-    result.stderr = materialize(optimizeToolOutput({ toolName, toolInput, output: original.stderr, cwd, policy }), cwd);
+    result.stderr = materialize(optimizeToolOutput({ toolName, toolInput, output: original.stderr, cwd, policy, redactionProfile }), cwd);
   }
   return result;
 }

package/src/mcp-server.mjs

@@ -1,6 +1,7 @@
 import readline from 'node:readline';
 
 import { optimizeToolOutput } from './core.mjs';
+import { PLUGIN_VERSION } from './version.mjs';
 
 const TOOL = {
   name: 'prepare_tool_output',
@@ -19,7 +20,7 @@ function dispatch(message) {
   if (!message || message.jsonrpc !== '2.0' || typeof message.method !== 'string') return error(message?.id, -32600, 'Invalid Request');
   if (message.id === undefined) return null;
   if (message.method === 'initialize') return response(message.id, {
-    protocolVersion: message.params?.protocolVersion || '2025-06-18', capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'sando', version: '0.1.0' },
+    protocolVersion: message.params?.protocolVersion || '2025-06-18', capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'sando', version: PLUGIN_VERSION },
   });
   if (message.method === 'ping') return response(message.id, {});
   if (message.method === 'tools/list') return response(message.id, { tools: [TOOL] });

package/src/postinstall.mjs

@@ -8,7 +8,7 @@ import readline from 'node:readline/promises';
 import { pathToFileURL } from 'node:url';
 
 import {
-  CONSENT_VERSION, defaultTelemetryConfigPath, enableTelemetry, readTelemetryConfig, TELEMETRY_DETAILS_URL,
+  CONSENT_VERSION, defaultTelemetryConfigPath, enableTelemetry, isDoNotTrack, readTelemetryConfig, TELEMETRY_DETAILS_URL,
 } from './telemetry.mjs';
 
 const CONSENT_PROMPT = `Enable anonymous telemetry? Full details at: ${TELEMETRY_DETAILS_URL} [y/N] `;
@@ -19,6 +19,7 @@ export async function runPostinstall({
 } = {}) {
   try {
     if (env.SANDO_SKIP_TELEMETRY_PROMPT) return;
+    if (isDoNotTrack(env)) return;
     if (!stdin.isTTY || !stdout.isTTY) return; // CI, --ignore-scripts consumers, piped installs, etc.
 
     const configPath = defaultTelemetryConfigPath(env);

package/src/proxy.mjs

@@ -4,43 +4,56 @@ import { estimateTokens } from './core.mjs';
 import { detectProviderBody, listSemanticCandidates, transformProviderRequest } from './context-transform.mjs';
 import { recordProxyRequest } from './proxy-metrics.mjs';
 import {
-  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, readTelemetryConfig,
+  closeFinishedDays, defaultTelemetryConfigPath, defaultTelemetryStatePaths, incrementCounter, isDoNotTrack, readTelemetryConfig, recordFailure,
 } from './telemetry.mjs';
-
-const PLUGIN_VERSION = '0.1';
+import { PLUGIN_VERSION } from './version.mjs';
 
 function todayUtc() { return new Date().toISOString().slice(0, 10); }
 
-/** Only counts (never request/response content) — see docs/plans/2026-08-25-sando-telemetry-design.md.
- *  `host` here is the provider request shape (`anthropic`/`openai`), which does not map cleanly to
- *  Sando's `claude`/`codex` telemetry host enum; the proxy fronts both hosts equally, so it reports
- *  under a fixed `claude` label — this is the one place the design doc's host/provider split is
- *  approximate, flagged for the design doc rather than silently assumed. */
-function recordProxyTelemetry({ env, transformed, beforeText, afterText }) {
-  const configPath = defaultTelemetryConfigPath(env);
-  let config;
-  try { config = readTelemetryConfig(configPath); } catch { return; }
-  if (!config.enabled) return;
-  const cacheWarm = transformed.stats.cacheRewriteRatio !== null;
+function telemetryProvider(provider) {
+  if (provider === 'anthropic') return 'anthropic';
+  if (provider === 'openai-chat' || provider === 'openai-responses') return 'openai';
+  return 'unknown';
+}
+
+/** Only counts (never request/response content). */
+function recordProxyTelemetry({ env, provider, transformed, beforeText, afterText }) {
   try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
     const statePaths = defaultTelemetryStatePaths(env);
     incrementCounter({
       statePaths,
       day: todayUtc(),
       event: 'proxy_summary',
-      host: 'claude',
+      provider: telemetryProvider(provider),
+      mode: 'enforce',
       deltas: {
         rewritesApplied: transformed.changed ? 1 : 0,
         rewritesSkippedCache: transformed.stats.cacheProtectedSkips > 0 ? 1 : 0,
         inputTokensSaved: Math.max(0, estimateTokens(beforeText) - estimateTokens(afterText)),
-        cacheHitYes: cacheWarm ? 1 : 0,
-        cacheHitNo: cacheWarm ? 0 : 1,
       },
     });
     closeFinishedDays({ statePaths, configPath, day: todayUtc(), pluginVersion: PLUGIN_VERSION });
   } catch { /* telemetry is best-effort and must never affect the proxied response */ }
 }
 
+function recordProxyFailure({ env, provider, failureStage }) {
+  try {
+    const configPath = defaultTelemetryConfigPath(env);
+    const config = readTelemetryConfig(configPath);
+    if (!config.enabled || isDoNotTrack(env)) return;
+    const statePaths = defaultTelemetryStatePaths(env);
+    const day = todayUtc();
+    recordFailure({
+      statePaths, day, event: 'proxy_failure_summary',
+      provider: telemetryProvider(provider), failureStage,
+    });
+    closeFinishedDays({ statePaths, configPath, day, pluginVersion: PLUGIN_VERSION });
+  } catch { /* telemetry is best-effort and must never affect the proxied response */ }
+}
+
 const DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
 const HOP_BY_HOP_HEADERS = new Set([
   'connection', 'content-length', 'keep-alive', 'proxy-authenticate',
@@ -176,53 +189,86 @@ export async function createProviderProxy({ upstream, host = '127.0.0.1', port =
   let lastRequestAt = null;
 
   const server = http.createServer(async (request, outgoing) => {
+    let failureProvider = null;
     try {
       if (request.method === 'GET' && new URL(request.url, 'http://sando.invalid').pathname === '/health') {
         jsonResponse(outgoing, 200, { schema: 'sando-provider-proxy/v1', status: 'ok', lastStats });
         return;
       }
-      const rawBody = await readBody(request, maxBodyBytes);
+      let rawBody;
+      try {
+        rawBody = await readBody(request, maxBodyBytes);
+      } catch (error) {
+        recordProxyFailure({ env, provider: null, failureStage: 'input' });
+        if (!outgoing.headersSent) jsonResponse(outgoing, error.message === 'request body exceeds proxy limit' ? 413 : 502, { error: 'sando proxy upstream failure' });
+        else outgoing.destroy();
+        return;
+      }
       let body = rawBody;
       let recordProvider = null;
       let recordModel = null;
       let recordStats = null;
       if (rawBody.length > 0 && /application\/json/i.test(request.headers['content-type'] ?? '')) {
+        let parsed;
         try {
-          const parsed = JSON.parse(rawBody.toString('utf8'));
+          parsed = JSON.parse(rawBody.toString('utf8'));
+        } catch {
+          recordProxyFailure({ env, provider: null, failureStage: 'input' });
+        }
+        if (parsed) {
           const provider = detectProviderBody(parsed, request.headers);
-          if (provider) {
-            const now = Date.now();
-            const idleMs = lastRequestAt === null ? null : now - lastRequestAt;
-            lastRequestAt = now;
-            const transformed = transformProviderRequest({ provider, body: parsed, policy, idleMs });
-            if (transformed.changed) body = Buffer.from(JSON.stringify(transformed.body));
-            recordProxyTelemetry({
-              env, transformed,
-              beforeText: rawBody.toString('utf8'), afterText: body.toString('utf8'),
-            });
-            lastStats = { provider, ...transformed.stats, changed: transformed.changed, reasons: transformed.reasons };
-            recordProvider = provider;
-            recordModel = typeof parsed?.model === 'string' ? parsed.model : null;
-            recordStats = transformed.stats;
-            if (typeof semanticCompactor === 'function') {
-              const candidates = listSemanticCandidates({ provider, body: transformed.body });
-              const stats = createSemanticStats(candidates);
-              lastStats.semantic = stats;
-              setImmediate(() => observeSemanticCandidates({ provider, candidates, semanticCompactor, stats }));
+          failureProvider = provider;
+          try {
+            if (provider) {
+              const now = Date.now();
+              const idleMs = lastRequestAt === null ? null : now - lastRequestAt;
+              lastRequestAt = now;
+              const transformed = transformProviderRequest({ provider, body: parsed, policy, idleMs });
+              if (transformed.changed) body = Buffer.from(JSON.stringify(transformed.body));
+              recordProxyTelemetry({
+                env, provider, transformed,
+                beforeText: rawBody.toString('utf8'), afterText: body.toString('utf8'),
+              });
+              lastStats = { provider, ...transformed.stats, changed: transformed.changed, reasons: transformed.reasons };
+              recordProvider = provider;
+              recordModel = typeof parsed?.model === 'string' ? parsed.model : null;
+              recordStats = transformed.stats;
+              if (typeof semanticCompactor === 'function') {
+                const candidates = listSemanticCandidates({ provider, body: transformed.body });
+                const stats = createSemanticStats(candidates);
+                lastStats.semantic = stats;
+                setImmediate(() => observeSemanticCandidates({ provider, candidates, semanticCompactor, stats }));
+              }
             }
+          } catch {
+            recordProxyFailure({ env, provider, failureStage: 'optimization' });
+            body = rawBody;
           }
-        } catch {
-          body = rawBody;
         }
       }
-      const response = await fetch(targetUrl(upstreamUrl, request.url), {
-        method: request.method,
-        headers: forwardedHeaders(request),
-        body: ['GET', 'HEAD'].includes(request.method) ? undefined : body,
-        redirect: 'manual',
-      });
+      let response;
+      try {
+        response = await fetch(targetUrl(upstreamUrl, request.url), {
+          method: request.method,
+          headers: forwardedHeaders(request),
+          body: ['GET', 'HEAD'].includes(request.method) ? undefined : body,
+          redirect: 'manual',
+        });
+      } catch {
+        recordProxyFailure({ env, provider: failureProvider, failureStage: 'upstream' });
+        if (!outgoing.headersSent) jsonResponse(outgoing, 502, { error: 'sando proxy upstream failure' });
+        else outgoing.destroy();
+        return;
+      }
       let responseText = '';
-      await pipeResponse(response, outgoing, metricsPath ? (chunk) => { responseText += chunk; } : undefined);
+      try {
+        await pipeResponse(response, outgoing, metricsPath ? (chunk) => { responseText += chunk; } : undefined);
+      } catch {
+        recordProxyFailure({ env, provider: failureProvider, failureStage: 'response' });
+        if (!outgoing.headersSent) jsonResponse(outgoing, 502, { error: 'sando proxy upstream failure' });
+        else outgoing.destroy();
+        return;
+      }
       if (metricsPath && recordProvider) {
         try {
           recordProxyRequest({
@@ -232,6 +278,7 @@ export async function createProviderProxy({ upstream, host = '127.0.0.1', port =
         } catch { /* metrics are best-effort and must never affect the proxied response */ }
       }
     } catch (error) {
+      recordProxyFailure({ env, provider: failureProvider, failureStage: 'response' });
       if (!outgoing.headersSent) jsonResponse(outgoing, error.message === 'request body exceeds proxy limit' ? 413 : 502, { error: 'sando proxy upstream failure' });
       else outgoing.destroy();
     }

package/src/redaction-config.mjs

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { createRedactionProfile } from './redaction-profile.mjs';
+
+const MAX_CONFIG_BYTES = 64 * 1024;
+const cache = new Map();
+const builtInProfile = createRedactionProfile([]);
+
+function lstatIfPresent(target) {
+  try {
+    return fs.lstatSync(target);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function readBoundedFile(configPath, expectedStat) {
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0);
+  const descriptor = fs.openSync(configPath, flags);
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile()) throw new Error(`redaction config is not a regular file: ${configPath}`);
+    if (stat.dev !== expectedStat.dev || stat.ino !== expectedStat.ino) {
+      throw new Error(`redaction config changed while opening: ${configPath}`);
+    }
+    if (stat.size > MAX_CONFIG_BYTES) {
+      throw new Error(`redaction config exceeds 64 KiB: ${configPath}`);
+    }
+
+    const content = Buffer.alloc(MAX_CONFIG_BYTES + 1);
+    let bytesRead = 0;
+    while (bytesRead < content.length) {
+      const count = fs.readSync(descriptor, content, bytesRead, content.length - bytesRead, null);
+      if (count === 0) break;
+      bytesRead += count;
+    }
+    if (bytesRead > MAX_CONFIG_BYTES) {
+      throw new Error(`redaction config exceeds 64 KiB: ${configPath}`);
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(content.subarray(0, bytesRead));
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function parseConfig(source, configPath) {
+  let config;
+  try {
+    config = JSON.parse(source);
+  } catch (error) {
+    throw new Error(`invalid JSON in redaction config ${configPath}: ${error.message}`, { cause: error });
+  }
+
+  if (!config || typeof config !== 'object' || Array.isArray(config)) {
+    throw new Error(`invalid redaction config schema: ${configPath}`);
+  }
+  const keys = Object.keys(config).sort();
+  if (keys.length !== 2 || keys[0] !== 'rules' || keys[1] !== 'schema'
+      || config.schema !== 'sando-redaction/v1' || !Array.isArray(config.rules)) {
+    throw new Error(`invalid redaction config schema: ${configPath}`);
+  }
+  return config;
+}
+
+export function loadProjectRedactionProfile(cwd) {
+  try {
+    return loadProjectRedactionProfileUnsafe(cwd);
+  } catch (error) {
+    if (error?.code === 'SANDO_REDACTION_CONFIG') throw error;
+    const wrapped = new Error(error instanceof Error ? error.message : String(error), { cause: error });
+    wrapped.code = 'SANDO_REDACTION_CONFIG';
+    throw wrapped;
+  }
+}
+
+function loadProjectRedactionProfileUnsafe(cwd) {
+  const configDirectory = path.resolve(cwd, '.sando');
+  const directoryStat = lstatIfPresent(configDirectory);
+  if (!directoryStat) return { profile: builtInProfile, path: null };
+  if (directoryStat.isSymbolicLink()) {
+    throw new Error(`redaction config directory must not be a symlink: ${configDirectory}`);
+  }
+  if (!directoryStat.isDirectory()) {
+    throw new Error(`redaction config directory is not a directory: ${configDirectory}`);
+  }
+
+  const configPath = path.join(configDirectory, 'redaction.json');
+  const stat = lstatIfPresent(configPath);
+  if (!stat) return { profile: builtInProfile, path: null };
+  if (stat.isSymbolicLink()) throw new Error(`redaction config must not be a symlink: ${configPath}`);
+  if (!stat.isFile()) throw new Error(`redaction config is not a regular file: ${configPath}`);
+  if (stat.size > MAX_CONFIG_BYTES) throw new Error(`redaction config exceeds 64 KiB: ${configPath}`);
+
+  const cached = cache.get(configPath);
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return cached.result;
+
+  const source = readBoundedFile(configPath, stat);
+  const config = parseConfig(source, configPath);
+  const result = { profile: createRedactionProfile(config.rules), path: configPath };
+  cache.set(configPath, { mtimeMs: stat.mtimeMs, size: stat.size, result });
+  return result;
+}