severally-mcp 2.3.1 → 2.4.0

package/src/parse-result.mjs

@@ -60,14 +60,26 @@ export function extractJson(text) {
     let esc = false;
     for (let i = start; i < trimmed.length; i++) {
       const ch = trimmed[i];
-      if (esc) { esc = false; continue; }
-      if (ch === '\\') { esc = true; continue; }
-      if (ch === '"') { inStr = !inStr; continue; }
+      if (esc) {
+        esc = false;
+        continue;
+      }
+      if (ch === '\\') {
+        esc = true;
+        continue;
+      }
+      if (ch === '"') {
+        inStr = !inStr;
+        continue;
+      }
       if (inStr) continue;
       if (ch === '{') depth++;
       else if (ch === '}') {
         depth--;
-        if (depth === 0) { candidates.push(trimmed.slice(start, i + 1)); break; }
+        if (depth === 0) {
+          candidates.push(trimmed.slice(start, i + 1));
+          break;
+        }
       }
     }
   }
@@ -75,7 +87,9 @@ export function extractJson(text) {
     try {
       const parsed = JSON.parse(c);
       if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed;
-    } catch { /* try the next candidate */ }
+    } catch {
+      /* try the next candidate */
+    }
   }
   return null;
 }
@@ -101,7 +115,7 @@ function mapList(raw, fields, { requiredField, idPrefix = null }) {
 
 /**
  * @param {object|string} raw  parsed JSON object, or raw text to mine one out of
- * @returns {{result: object, quality: {structured_output: boolean, missing_sections: string[]}}}
+ * @returns {{result: object, quality: {missing_sections: string[], findings_without_grounds: number, unsourced: boolean, list_truncated?: Record<string, number>}}}
  */
 export function normalizeResult(raw) {
   const objIn = typeof raw === 'string' ? extractJson(raw) : raw;
@@ -120,37 +134,78 @@ export function normalizeResult(raw) {
     confidence: level(src.confidence),
     evidence_basis: basis(src.evidence_basis),
     stance: stance(src.stance),
-    findings: mapList(src.findings, {
-      point: 'text', grounds: 'text', impact: 'text', severity: 'level', confidence: 'level',
-    }, { requiredField: 'point', idPrefix: 'f' }),
-    alternatives: mapList(src.alternatives, {
-      option: 'text', tradeoffs: 'text', when_preferred: 'text',
-    }, { requiredField: 'option' }),
-    unknowns: mapList(src.unknowns, {
-      item: 'text', why_it_matters: 'text', how_to_obtain: 'text',
-    }, { requiredField: 'item', idPrefix: 'u' }),
-    decision_changers: mapList(src.decision_changers, {
-      condition: 'text', changes_to: 'text',
-    }, { requiredField: 'condition' }),
-    next_checks: mapList(src.next_checks, {
-      check: 'text', method: 'text', expected_signal: 'text',
-    }, { requiredField: 'check', idPrefix: 'c' }),
-    remaining_disagreements: mapList(src.remaining_disagreements, {
-      topic: 'text', your_position: 'text', why_unresolved: 'text',
-    }, { requiredField: 'topic' }),
+    findings: mapList(
+      src.findings,
+      {
+        point: 'text',
+        grounds: 'text',
+        impact: 'text',
+        severity: 'level',
+        confidence: 'level',
+      },
+      { requiredField: 'point', idPrefix: 'f' },
+    ),
+    alternatives: mapList(
+      src.alternatives,
+      {
+        option: 'text',
+        tradeoffs: 'text',
+        when_preferred: 'text',
+      },
+      { requiredField: 'option' },
+    ),
+    unknowns: mapList(
+      src.unknowns,
+      {
+        item: 'text',
+        why_it_matters: 'text',
+        how_to_obtain: 'text',
+      },
+      { requiredField: 'item', idPrefix: 'u' },
+    ),
+    decision_changers: mapList(
+      src.decision_changers,
+      {
+        condition: 'text',
+        changes_to: 'text',
+      },
+      { requiredField: 'condition' },
+    ),
+    next_checks: mapList(
+      src.next_checks,
+      {
+        check: 'text',
+        method: 'text',
+        expected_signal: 'text',
+      },
+      { requiredField: 'check', idPrefix: 'c' },
+    ),
+    remaining_disagreements: mapList(
+      src.remaining_disagreements,
+      {
+        topic: 'text',
+        your_position: 'text',
+        why_unresolved: 'text',
+      },
+      { requiredField: 'topic' },
+    ),
     references: (Array.isArray(src.references) ? src.references : [])
       .slice(0, O.referencesMax)
-      .map((r) => (r && typeof r === 'object'
-        ? { title: clampText(r.title, 300), url: clampText(r.url, 1000), relevance: clampText(r.relevance, 600) }
-        : { title: clampText(r, 300), url: null, relevance: null }))
+      .map((r) =>
+        r && typeof r === 'object'
+          ? { title: clampText(r.title, 300), url: clampText(r.url, 1000), relevance: clampText(r.relevance, 600) }
+          : { title: clampText(r, 300), url: null, relevance: null },
+      )
       .filter((r) => r.title || r.url),
   };
 
   // The lists are cut to O.listMax before anything else looks at them; say how
   // long the ones that were cut had been, so the cut is not silent.
-  const listTruncated = Object.fromEntries(['findings', 'alternatives', 'unknowns', 'decision_changers', 'next_checks', 'remaining_disagreements']
-    .filter((k) => Array.isArray(src[k]) && src[k].length > O.listMax)
-    .map((k) => [k, src[k].length]));
+  const listTruncated = Object.fromEntries(
+    ['findings', 'alternatives', 'unknowns', 'decision_changers', 'next_checks', 'remaining_disagreements']
+      .filter((k) => Array.isArray(src[k]) && src[k].length > O.listMax)
+      .map((k) => [k, src[k].length]),
+  );
 
   const missing = RESULT_KEYS.filter((k) => {
     const v = result[k];

package/src/platform.mjs

@@ -36,13 +36,9 @@ export function findCommand(command, { cwd = process.cwd(), env = process.env }
   if (typeof command !== 'string' || !command) return null;
   cwd = path.resolve(cwd);
   const windows = process.platform === 'win32';
-  const value = (name) => env[windows
-    ? Object.keys(env).find((key) => key.toUpperCase() === name) : name];
+  const value = (name) => env[windows ? Object.keys(env).find((key) => key.toUpperCase() === name) : name];
   const explicit = command.includes('/') || (windows && command.includes('\\'));
-  const dirs = explicit ? [cwd] : [
-    ...(windows ? [cwd] : []),
-    ...(value('PATH') ?? '').split(path.delimiter).filter(Boolean),
-  ];
+  const dirs = explicit ? [cwd] : [...(windows ? [cwd] : []), ...(value('PATH') ?? '').split(path.delimiter).filter(Boolean)];
   for (const dir of dirs) {
     // Absolute candidates prevent which's own cwd lookup from resolving a
     // wrapper in the server directory instead of the child's directory.
@@ -56,7 +52,9 @@ export function findCommand(command, { cwd = process.cwd(), env = process.env }
       if (!fs.statSync(candidate).isFile()) return null;
       fs.accessSync(candidate, fs.constants.X_OK);
       return candidate;
-    } catch { /* not installed */ }
+    } catch {
+      /* not installed */
+    }
   }
   return null;
 }

package/src/policy.mjs

@@ -7,7 +7,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { parseJsonc } from './jsonc.mjs';
 import { findCommand } from './platform.mjs';
-import { buildConsultants, CLI_IDS, normalizeName } from './consultants.mjs';
+import { buildConsultants, normalizeName } from './consultants.mjs';
 
 // One file, read once at start, so an operator configures a machine in a
 // single place instead of editing each client's MCP registration. Precedence
@@ -17,10 +17,10 @@ import { buildConsultants, CLI_IDS, normalizeName } from './consultants.mjs';
 const CONFIG_HOME = process.env.SEVERALLY_HOME || path.join(os.homedir(), '.severally');
 // .jsonc first, for operators whose editor treats comments in a .json file as
 // an error; both are read the same way, comments and all.
-const CONFIG_PATH = process.env.SEVERALLY_CONFIG
-  || [path.join(CONFIG_HOME, 'config.jsonc'), path.join(CONFIG_HOME, 'config.json')]
-    .find((p) => fs.existsSync(p))
-  || path.join(CONFIG_HOME, 'config.json');
+const CONFIG_PATH =
+  process.env.SEVERALLY_CONFIG ||
+  [path.join(CONFIG_HOME, 'config.jsonc'), path.join(CONFIG_HOME, 'config.json')].find((p) => fs.existsSync(p)) ||
+  path.join(CONFIG_HOME, 'config.json');
 
 let configError = null;
 const CONFIG = (() => {
@@ -75,9 +75,12 @@ const usable = configError ? {} : CONFIG;
 // A CLI whose own section has a mistake is off, whatever else the section says.
 const cfgCli = (id) => {
   if (Object.hasOwn(BUILT.brokenClis, id) && !configError) {
-    return { enabled: false, note: `turned off: the config file has a mistake in clis.${id}: ${BUILT.brokenClis[id].join('; ')}` };
+    return {
+      enabled: false,
+      note: `turned off: the config file has a mistake in clis.${id}: ${BUILT.brokenClis[id].join('; ')}`,
+    };
   }
-  return usable.clis && typeof usable.clis === 'object' ? usable.clis[id] ?? {} : {};
+  return usable.clis && typeof usable.clis === 'object' ? (usable.clis[id] ?? {}) : {};
 };
 const cfgServer = usable.server && typeof usable.server === 'object' ? usable.server : {};
 
@@ -117,12 +120,23 @@ const str = (name, dflt) => {
 // The CLI a lead runs in, by any everyday name. Only `caller` uses this:
 // which consultant a name reaches is consultants.mjs's resolveConsultant.
 // Object.create(null) so 'constructor' is an unknown name, not a function.
-export const CALLER_ALIASES = Object.freeze(Object.assign(Object.create(null), {
-  codex: 'codex', gpt: 'codex', chatgpt: 'codex', openai: 'codex',
-  'claude-code': 'claude-code', claude: 'claude-code', anthropic: 'claude-code',
-  antigravity: 'antigravity', agy: 'antigravity', gemini: 'antigravity', google: 'antigravity',
-  opencode: 'opencode', glm: 'opencode',
-}));
+export const CALLER_ALIASES = Object.freeze(
+  Object.assign(Object.create(null), {
+    codex: 'codex',
+    gpt: 'codex',
+    chatgpt: 'codex',
+    openai: 'codex',
+    'claude-code': 'claude-code',
+    claude: 'claude-code',
+    anthropic: 'claude-code',
+    antigravity: 'antigravity',
+    agy: 'antigravity',
+    gemini: 'antigravity',
+    google: 'antigravity',
+    opencode: 'opencode',
+    glm: 'opencode',
+  }),
+);
 
 export const CALLER_INPUTS = Object.freeze(Object.keys(CALLER_ALIASES));
 
@@ -205,18 +219,34 @@ export const POLICY = Object.freeze({
   // a consultant's business.
   clis: Object.freeze({
     codex: Object.freeze({
-      cli: CODEX_BIN, available: isEnabled('codex', CODEX_BIN), note: disabledNote('codex'), label: 'Codex CLI', ...extras('codex'),
+      cli: CODEX_BIN,
+      available: isEnabled('codex', CODEX_BIN),
+      note: disabledNote('codex'),
+      label: 'Codex CLI',
+      ...extras('codex'),
     }),
     'claude-code': Object.freeze({
-      cli: CLAUDE_BIN, available: isEnabled('claude-code', CLAUDE_BIN), note: disabledNote('claude-code'), label: 'Claude Code CLI', ...extras('claude-code'),
+      cli: CLAUDE_BIN,
+      available: isEnabled('claude-code', CLAUDE_BIN),
+      note: disabledNote('claude-code'),
+      label: 'Claude Code CLI',
+      ...extras('claude-code'),
     }),
     // Where the real Antigravity credentials live is credentialsHome() below,
     // not a field here: the sandbox reads it per job (see timeoutMs()).
     antigravity: Object.freeze({
-      cli: AGY_BIN, available: isEnabled('antigravity', AGY_BIN), note: disabledNote('antigravity'), label: 'Antigravity CLI', ...extras('antigravity'),
+      cli: AGY_BIN,
+      available: isEnabled('antigravity', AGY_BIN),
+      note: disabledNote('antigravity'),
+      label: 'Antigravity CLI',
+      ...extras('antigravity'),
     }),
     opencode: Object.freeze({
-      cli: OPENCODE_BIN, available: isEnabled('opencode', OPENCODE_BIN), note: disabledNote('opencode'), label: 'OpenCode CLI', ...extras('opencode'),
+      cli: OPENCODE_BIN,
+      available: isEnabled('opencode', OPENCODE_BIN),
+      note: disabledNote('opencode'),
+      label: 'OpenCode CLI',
+      ...extras('opencode'),
       // opencode.json `provider` definitions copied into the sandbox config:
       // the only way to reach a provider the sandbox's empty HOME would not
       // know, such as a local OpenAI-compatible server.
@@ -338,18 +368,53 @@ export function opencodeCredentialsHome() {
 // and never copied by expose_paths; Codex's read-only sandbox cannot express
 // path rules, which the boundary record says.
 export const PROTECTED_HOME_PATHS = Object.freeze([
-  '.ssh', '.gnupg', '.aws', '.azure', '.kube', '.docker', '.config/gcloud', '.config/gh', '.config/hub',
-  '.netrc', '.npmrc', '.pypirc', '.git-credentials', '.cargo/credentials', '.cargo/credentials.toml',
-  '.terraform.d', '.vault-token', 'Library/Keychains',
-  '.codex', '.claude', '.claude.json', '.gemini', '.config/opencode', '.local/share/opencode',
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.docker',
+  '.config/gcloud',
+  '.config/gh',
+  '.config/hub',
+  '.netrc',
+  '.npmrc',
+  '.pypirc',
+  '.git-credentials',
+  '.cargo/credentials',
+  '.cargo/credentials.toml',
+  '.terraform.d',
+  '.vault-token',
+  'Library/Keychains',
+  '.codex',
+  '.claude',
+  '.claude.json',
+  '.gemini',
+  '.config/opencode',
+  '.local/share/opencode',
 ]);
 // Under POLICY.home, wherever the operator moved it.
-const PROTECTED_SEVERALLY_PATHS = Object.freeze(['history', 'backups', 'config.json', 'config.jsonc', 'homes',
+const PROTECTED_SEVERALLY_PATHS = Object.freeze([
+  'history',
+  'backups',
+  'config.json',
+  'config.jsonc',
+  'homes',
   // Where homes lived before 1.7: one left by an interrupted run can still hold an auth.json copy.
-  'jobs/*/home']);
+  'jobs/*/home',
+]);
 // File names protected wherever they are.
 export const PROTECTED_FILE_NAMES = Object.freeze([
-  '.env', '.env.*', '.npmrc', '.netrc', '.pypirc', '.git-credentials', 'id_rsa', 'id_ed25519', 'id_ecdsa', 'id_dsa',
+  '.env',
+  '.env.*',
+  '.npmrc',
+  '.netrc',
+  '.pypirc',
+  '.git-credentials',
+  'id_rsa',
+  'id_ed25519',
+  'id_ecdsa',
+  'id_dsa',
 ]);
 
 /** Absolute protected roots, with forward slashes; `*` stands for one path segment. */
@@ -366,8 +431,9 @@ const escapeRe = (s) => s.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
 export const PATHS_CASE_INSENSITIVE = process.platform === 'win32' || process.platform === 'darwin';
 /** Regex sources: one per protected root, matching it and anything under it. */
 export function protectedRootPatterns(extraRoots = []) {
-  return [...protectedRoots(), ...extraRoots.map((r) => r.replaceAll('\\', '/'))]
-    .map((r) => `^${escapeRe(r.replace(/\/+$/, '')).replaceAll('*', '[^/]+')}(/|$)`);
+  return [...protectedRoots(), ...extraRoots.map((r) => r.replaceAll('\\', '/'))].map(
+    (r) => `^${escapeRe(r.replace(/\/+$/, '')).replaceAll('*', '[^/]+')}(/|$)`,
+  );
 }
 /** Regex sources for PROTECTED_FILE_NAMES, matched against a base name. */
 export function protectedNamePatterns() {
@@ -380,7 +446,11 @@ export function isProtectedPath(abs) {
   const roots = protectedRootPatterns().map((p) => new RegExp(p, flags));
   const names = protectedNamePatterns().map((p) => new RegExp(p, flags));
   let real = abs;
-  try { real = fs.realpathSync.native(abs); } catch { /* missing: check the name as given */ }
+  try {
+    real = fs.realpathSync.native(abs);
+  } catch {
+    /* missing: check the name as given */
+  }
   return [abs, real].some((p) => {
     const fwd = p.replaceAll('\\', '/');
     return roots.some((re) => re.test(fwd)) || names.some((re) => re.test(path.basename(fwd)));

package/src/redact.mjs

@@ -1,51 +1,75 @@
 // Credential scrubbing. Applied on the way out (brief sent to the consultant),
 // on the way in (consultant output), and to everything persisted to disk.
 
-const CODE_WORDS = new Set(['true', 'false', 'null', 'none', 'undefined', 'string', 'str', 'number', 'boolean', 'bool', 'int', 'bytes']);
+const CODE_WORDS = new Set([
+  'true',
+  'false',
+  'null',
+  'none',
+  'undefined',
+  'string',
+  'str',
+  'number',
+  'boolean',
+  'bool',
+  'int',
+  'bytes',
+]);
 
 // A password-type value that is code, not a secret: a flag or a type, a
 // variable reference (${X}, $X, process.env.X, os.environ[...]), and -- unless
 // it is a long value under a full PASSWORD/PASSWD name, which stays masked
 // whatever it looks like -- a dotted name, a call or a borrow (&str).
 function looksLikeCode(name, value) {
-  if (CODE_WORDS.has(value.toLowerCase()) || value.startsWith('${') || /^\$[A-Z_][A-Z0-9_]*$/.test(value)
-    || /^(?:process\.env\.|os\.environ\b)/.test(value)) return true;
+  if (
+    CODE_WORDS.has(value.toLowerCase()) ||
+    value.startsWith('${') ||
+    /^\$[A-Z_][A-Z0-9_]*$/.test(value) ||
+    /^(?:process\.env\.|os\.environ\b)/.test(value)
+  )
+    return true;
   if (value.length >= 8 && /^PASSW(?:OR)?D$/i.test(name.split('_').at(-1))) return false;
   return /^[A-Za-z_][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(value) || /^[A-Za-z_][\w$.]*\(/.test(value) || value.startsWith('&');
 }
 
+// A replacement is a string or a function of the match.
+/** @type {Array<[RegExp, any]>} */
 const PATTERNS = [
   // Provider API keys
-  [/\bsk-ant-[A-Za-z0-9_\-]{12,}/g, '[REDACTED:anthropic-key]'],
-  [/\bsk-proj-[A-Za-z0-9_\-]{12,}/g, '[REDACTED:openai-key]'],
-  [/\bsk-[A-Za-z0-9_\-]{20,}/g, '[REDACTED:api-key]'],
+  [/\bsk-ant-[A-Za-z0-9_-]{12,}/g, '[REDACTED:anthropic-key]'],
+  [/\bsk-proj-[A-Za-z0-9_-]{12,}/g, '[REDACTED:openai-key]'],
+  [/\bsk-[A-Za-z0-9_-]{20,}/g, '[REDACTED:api-key]'],
   [/\bgh[pousr]_[A-Za-z0-9]{16,}/g, '[REDACTED:github-token]'],
   [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, '[REDACTED:github-token]'],
   [/\bxox[baprs]-[A-Za-z0-9-]{10,}/g, '[REDACTED:slack-token]'],
   [/https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9]+\/B[A-Za-z0-9]+\/[A-Za-z0-9]+/g, '[REDACTED:slack-webhook]'],
   [/\bAKIA[0-9A-Z]{16}\b/g, '[REDACTED:aws-access-key-id]'],
   [/\bASIA[0-9A-Z]{16}\b/g, '[REDACTED:aws-access-key-id]'],
-  [/\bAIza[0-9A-Za-z_\-]{30,}/g, '[REDACTED:google-api-key]'],
+  [/\bAIza[0-9A-Za-z_-]{30,}/g, '[REDACTED:google-api-key]'],
   // Stripe secret and restricted keys (pk_ is public, left alone), npm, GitLab, Hugging Face
   [/\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g, '[REDACTED:stripe-key]'],
   [/\bnpm_[A-Za-z0-9]{30,}/g, '[REDACTED:npm-token]'],
-  [/\bglpat-[A-Za-z0-9_\-]{20,}/g, '[REDACTED:gitlab-token]'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g, '[REDACTED:gitlab-token]'],
   [/\bhf_[A-Za-z0-9]{30,}/g, '[REDACTED:huggingface-token]'],
   // JWT / OAuth access tokens (3 base64url segments)
-  [/\beyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}/g, '[REDACTED:jwt]'],
-  [/\bBearer\s+[A-Za-z0-9._\-]{20,}/gi, 'Bearer [REDACTED:token]'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, '[REDACTED:jwt]'],
+  [/\bBearer\s+[A-Za-z0-9._-]{20,}/gi, 'Bearer [REDACTED:token]'],
   // PEM private keys
   [/-----BEGIN[^-]{0,40}PRIVATE KEY-----[\s\S]*?-----END[^-]{0,40}PRIVATE KEY-----/g, '[REDACTED:private-key]'],
   // The password in a URL's userinfo, also with an empty user (redis://:pass@host)
   [/(:\/\/[^\s:/@]*:)[^\s@/]+(@)/g, '$1[REDACTED]$2'],
   // KEY=value / "token": "value" style assignments
-  [/\b((?:[A-Za-z0-9_]*_)?(?:API_KEY|APIKEY|ACCESS_KEY|PRIVATE_KEY|ACCESS_TOKEN|REFRESH_TOKEN|ID_TOKEN|SECRET_KEY|CLIENT_SECRET|AUTH_TOKEN|CREDENTIALS|ACCOUNTKEY|SHAREDACCESSKEY|SECRET|TOKEN))(["']?\s*[:=]\s*["']?)([^\s"',;)]{8,})/gi,
-    (_m, k, sep, _v) => `${k}${sep}[REDACTED]`],
+  [
+    /\b((?:[A-Za-z0-9_]*_)?(?:API_KEY|APIKEY|ACCESS_KEY|PRIVATE_KEY|ACCESS_TOKEN|REFRESH_TOKEN|ID_TOKEN|SECRET_KEY|CLIENT_SECRET|AUTH_TOKEN|CREDENTIALS|ACCOUNTKEY|SHAREDACCESSKEY|SECRET|TOKEN))(["']?\s*[:=]\s*["']?)([^\s"',;)]{8,})/gi,
+    (_m, k, sep, _v) => `${k}${sep}[REDACTED]`,
+  ],
   // Password-type names, with values from 4 characters; PASS and PWD too (PWD
   // only after `_` or a letter: bare PWD is the working directory). What reads
   // as code rather than a password is left alone (looksLikeCode).
-  [/\b((?:[A-Za-z0-9_]*_)?(?:PASSWORD|PASSWD|PASS|(?<=[A-Za-z_])PWD))(["']?\s*[:=]\s*["']?)([^\s"',;)]{4,})/gi,
-    (m, k, sep, v) => (looksLikeCode(k, v) ? m : `${k}${sep}[REDACTED]`)],
+  [
+    /\b((?:[A-Za-z0-9_]*_)?(?:PASSWORD|PASSWD|PASS|(?<=[A-Za-z_])PWD))(["']?\s*[:=]\s*["']?)([^\s"',;)]{4,})/gi,
+    (m, k, sep, v) => (looksLikeCode(k, v) ? m : `${k}${sep}[REDACTED]`),
+  ],
   // Any environment variable named *_KEY. Upper case only: in code, primary_key,
   // sort_key and idempotency_key name things, not secrets.
   [/\b([A-Z0-9_]+_KEY)(\s*=\s*["']?)([^\s"',;)]{8,})/g, (_m, k, sep, _v) => `${k}${sep}[REDACTED]`],

package/src/run.mjs

@@ -5,10 +5,7 @@ import { spawnCommand as spawn } from './platform.mjs';
 import path from 'node:path';
 import { POLICY } from './policy.mjs';
 
-const DROP_EXACT = new Set([
-  'CLAUDECODE', 'CLAUDE_PID', 'CLAUDE_EFFORT', 'AI_AGENT',
-  'ANTHROPIC_LOG', 'NODE_OPTIONS',
-]);
+const DROP_EXACT = new Set(['CLAUDECODE', 'CLAUDE_PID', 'CLAUDE_EFFORT', 'AI_AGENT', 'ANTHROPIC_LOG', 'NODE_OPTIONS']);
 const DROP_PREFIX = ['CLAUDE_CODE_', 'SEVERALLY_', 'MCP_'];
 
 // Each consultant sees only its own vendor's credentials.
@@ -179,14 +176,33 @@ export class ProcHandle {
       // before its parent exits and its descendants become unreachable. Once
       // it has exited, its pid may already be another process's: leave it.
       if (this.child.exitCode !== null || this.child.signalCode !== null) return;
-      const killer = spawn(path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'taskkill.exe'),
-        ['/pid', String(pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' });
-      const fallback = () => { try { this.child.kill('SIGKILL'); } catch { /* gone */ } };
+      const killer = spawn(
+        path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'taskkill.exe'),
+        ['/pid', String(pid), '/T', '/F'],
+        { windowsHide: true, stdio: 'ignore' },
+      );
+      const fallback = () => {
+        try {
+          this.child.kill('SIGKILL');
+        } catch {
+          /* gone */
+        }
+      };
       killer.on('error', fallback);
-      killer.on('exit', (code) => { if (code !== 0) fallback(); });
+      killer.on('exit', (code) => {
+        if (code !== 0) fallback();
+      });
       return;
     }
-    try { process.kill(-pid, signal); } catch { try { this.child.kill(signal); } catch { /* gone */ } }
+    try {
+      process.kill(-pid, signal);
+    } catch {
+      try {
+        this.child.kill(signal);
+      } catch {
+        /* gone */
+      }
+    }
     setTimeout(() => this.forceKill(), POLICY.killGraceMs).unref();
   }
 
@@ -200,7 +216,11 @@ export class ProcHandle {
   forceKill() {
     const pid = this.child?.pid;
     if (!pid || process.platform === 'win32') return;
-    try { process.kill(-pid, 'SIGKILL'); } catch { /* gone */ }
+    try {
+      process.kill(-pid, 'SIGKILL');
+    } catch {
+      /* gone */
+    }
   }
 }
 
@@ -213,8 +233,18 @@ export class ProcHandle {
  * pipes closed from this side. A descendant outside the group (setsid, or on
  * Windows once the parent is gone) may still be running.
  */
-export function runChild({ command, args, cwd, env, input, timeoutMs, onCancelSignal, compactLine = null,
-  settleAfter = null, stopSignal = 'SIGTERM' }) {
+export function runChild({
+  command,
+  args,
+  cwd,
+  env,
+  input,
+  timeoutMs,
+  onCancelSignal,
+  compactLine = null,
+  settleAfter = null,
+  stopSignal = 'SIGTERM',
+}) {
   const child = spawn(command, args, {
     cwd,
     // PWD is the parent's otherwise, and opencode takes its project root from
@@ -244,17 +274,26 @@ export function runChild({ command, args, cwd, env, input, timeoutMs, onCancelSi
     if (ms == null || Date.now() + ms >= settleAt) return;
     settleAt = Date.now() + ms;
     clearTimeout(settleTimer);
-    settleTimer = setTimeout(() => { stalled = true; handle.stop(stopSignal); }, ms);
+    settleTimer = setTimeout(() => {
+      stalled = true;
+      handle.stop(stopSignal);
+    }, ms);
   };
 
   const append = (which, chunk) => {
     const text = chunk.toString('utf8');
     if (which === 'out') {
-      if (stdout.length >= cap) { truncated = true; return; }
+      if (stdout.length >= cap) {
+        truncated = true;
+        return;
+      }
       stdout += text.slice(0, cap - stdout.length);
       if (stdout.length >= cap) truncated = true;
     } else {
-      if (stderr.length >= cap) { truncated = true; return; }
+      if (stderr.length >= cap) {
+        truncated = true;
+        return;
+      }
       stderr += text.slice(0, cap - stderr.length);
       if (stderr.length >= cap) truncated = true;
     }
@@ -273,7 +312,10 @@ export function runChild({ command, args, cwd, env, input, timeoutMs, onCancelSi
       if (settleAfter) watch(l);
       append('out', `${compact(l)}\n`);
     }
-    if (pending.length > cap) { append('out', pending); pending = ''; }
+    if (pending.length > cap) {
+      append('out', pending);
+      pending = '';
+    }
   };
   // Decode as a stream: a multibyte character split across two chunks would
   // otherwise turn into replacement characters inside the answer text.
@@ -310,7 +352,12 @@ export function runChild({ command, args, cwd, env, input, timeoutMs, onCancelSi
       clearTimeout(orphanTimer);
       resolve({ stdout, stderr, truncated, timedOut, cancelled, stalled, pipesForced, ...payload });
     };
-    const flushPending = () => { if (byLine && pending) { append('out', compact(pending)); pending = ''; } };
+    const flushPending = () => {
+      if (byLine && pending) {
+        append('out', compact(pending));
+        pending = '';
+      }
+    };
     child.on('error', (err) => finish({ code: null, signal: null, spawnError: err.message }));
     // 'close' waits for the pipes as well as the child. Once the child has
     // exited, a grace later the rest of its group is stopped, and a grace
@@ -336,7 +383,9 @@ export function runChild({ command, args, cwd, env, input, timeoutMs, onCancelSi
   });
 
   if (input !== undefined && input !== null) {
-    child.stdin.on('error', () => { /* child may exit before draining stdin */ });
+    child.stdin.on('error', () => {
+      /* child may exit before draining stdin */
+    });
     child.stdin.end(input);
   } else {
     child.stdin.end();