sneakoscope 3.1.9 → 3.1.11

package/dist/core/codex-native/project-skill-dedupe.js

@@ -17,8 +17,16 @@ export async function dedupeProjectSkills(input) {
         const userEntries = group.filter((entry) => !entry.managed_by_sks);
         const managedEntries = group.filter((entry) => entry.managed_by_sks);
         if (userEntries.length > 0 && managedEntries.length > 0) {
-            for (const user of userEntries)
-                actions.push(actionRow(canonical, 'kept', user, null, 'user-authored skill preserved'));
+            const keepUser = userEntries[0];
+            if (keepUser)
+                actions.push(actionRow(canonical, 'kept', keepUser, null, 'user-authored skill preserved'));
+            const shouldMoveUserDuplicates = fix && yes && input.quarantineUserDuplicates === true;
+            for (const duplicateUser of userEntries.slice(1)) {
+                const quarantine = shouldMoveUserDuplicates ? await quarantineSkill(root, canonical, duplicateUser, 'user-authored duplicate skill') : null;
+                actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', duplicateUser, quarantine, 'user-authored duplicate skill requires --quarantine-user-duplicates --yes'));
+            }
+            if (userEntries.length > 1 && !shouldMoveUserDuplicates)
+                unresolvedUserDuplicates.push(canonical);
             for (const managed of managedEntries) {
                 const quarantine = await maybeQuarantine(root, canonical, managed, fix, 'managed collision with user-authored skill');
                 actions.push(actionRow(canonical, quarantine ? 'quarantined' : 'reported', managed, quarantine, 'managed collision with user-authored skill'));
@@ -49,7 +57,11 @@ export async function dedupeProjectSkills(input) {
         }
     }
     const duplicateNames = [...new Set(actions.filter((action) => action.action !== 'kept').map((action) => action.canonical_name))].sort();
-    const blockers = unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`);
+    const afterLedger = await buildSkillRegistryLedger({ root, reportPath: null });
+    const blockers = [
+        ...unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`),
+        ...afterLedger.duplicate_active_canonical_names.map((name) => `duplicate_active_skill_name:${name}`)
+    ];
     const report = {
         schema: 'sks.project-skill-dedupe.v1',
         generated_at: nowIso(),
@@ -58,6 +70,9 @@ export async function dedupeProjectSkills(input) {
         fix,
         yes,
         actions,
+        active_unique_by_canonical_name: afterLedger.active_unique_by_canonical_name,
+        active_entries: afterLedger.active_entries,
+        duplicate_active_canonical_names: afterLedger.duplicate_active_canonical_names,
         duplicate_canonical_names: duplicateNames,
         unresolved_user_duplicates: unresolvedUserDuplicates,
         blockers

package/dist/core/codex-native/skill-registry-ledger.js

@@ -56,13 +56,20 @@ export async function buildSkillRegistryLedger(input) {
                 entry.status = entry.status === 'user-owned' ? 'duplicate' : 'duplicate';
         });
     }
-    const blockers = duplicates.map((name) => `duplicate_skill_name:${name}`);
+    const activeEntries = entries.filter((entry) => entry.status !== 'quarantined');
+    const activeGrouped = groupByCanonical(activeEntries);
+    const duplicateActiveNames = [...activeGrouped.entries()].filter(([, group]) => group.length > 1).map(([name]) => name).sort();
+    const activeUnique = duplicateActiveNames.length === 0;
+    const blockers = duplicateActiveNames.map((name) => `duplicate_active_skill_name:${name}`);
     const ledger = {
         schema: 'sks.skill-registry-ledger.v1',
         generated_at: nowIso(),
-        ok: blockers.length === 0,
+        ok: activeUnique,
         root,
         entries,
+        active_unique_by_canonical_name: activeUnique,
+        active_entries: activeEntries,
+        duplicate_active_canonical_names: duplicateActiveNames,
         duplicate_canonical_names: duplicates,
         blockers
     };

package/dist/core/commands/basic-cli.js

@@ -185,7 +185,9 @@ export async function initCommand(args = []) {
 export async function fixPathCommand(args = []) {
     const root = await projectRoot();
     const installScope = installScopeFromArgs(args);
-    await initProject(root, { installScope, localOnly: flag(args, '--local-only'), globalCommand: 'sks', force: true });
+    await withSecretPreservationGuard(root, 'fix-path-command', async () => {
+        await initProject(root, { installScope, localOnly: flag(args, '--local-only'), globalCommand: 'sks', force: true });
+    });
     const result = {
         schema: 'sks.fix-path.v1',
         ok: true,

package/dist/core/commands/research-command.js

@@ -180,7 +180,7 @@ async function researchRun(args) {
     await runResearchCycle(dir, researchWorkGraph, { cycle: 0, status: mock ? 'mock_native_orchestrator_planned' : 'native_orchestrator_planned' });
     await setCurrent(root, { mission_id: id, mode: 'RESEARCH', phase: 'RESEARCH_RUNNING_NO_QUESTIONS', questions_allowed: false, implementation_allowed: false, research_real_run_required: !mock, research_cycle_timeout_minutes: cycleTimeoutMinutes });
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.run.started', maxCycles, mock, cycleTimeoutMinutes, real_run_required: !mock });
-    const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: flag(args, '--autoresearch') ? '$AutoResearch' : '$Research', prompt: mission.prompt || plan.prompt || 'Research run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount: effectiveDesiredWorkItemCount, minimumWorkItems: effectiveMinimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: true, profile, writeMode: writeMode, applyPatches: false, dryRunPatches, maxWriteAgents, roster: plan.native_agent_plan, routeCommand: 'sks research run', routeBlackboxKind: 'actual_research_command', narutoWorkGraph: nativeResearchWorkGraph });
+    const nativeAgentRun = await runNativeAgentOrchestrator({ root, missionId: id, route: flag(args, '--autoresearch') ? '$AutoResearch' : '$Research', prompt: mission.prompt || plan.prompt || 'Research run', backend: mock ? 'fake' : 'codex-sdk', mock, agents: requestedAgents, targetActiveSlots, desiredWorkItemCount: effectiveDesiredWorkItemCount, minimumWorkItems: effectiveMinimumWorkItems, maxQueueExpansion, concurrency: Math.min(requestedAgents, 5), readonly: true, profile, writeMode: writeMode, applyPatches: false, dryRunPatches, maxWriteAgents, roster: plan.native_agent_plan, routeCommand: 'sks research run', routeBlackboxKind: 'actual_research_command', narutoWorkGraph: researchWorkGraph });
     await writeJsonAtomic(path.join(dir, 'research-native-agent-run.json'), nativeAgentRun);
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.native_agents.completed', backend: nativeAgentRun.backend, ok: nativeAgentRun.ok, proof: nativeAgentRun.proof?.status });
     if (!nativeAgentRun.ok) {

package/dist/core/config/managed-config-merge.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { ensureDir, nowIso, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { ensureDir, nowIso, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { isProtectedSecretKey, PROTECTED_SECRET_KEYS } from './supabase-secret-preservation.js';
 export async function writeManagedJsonConfig(file, current, managed) {
     const next = safeMergeObject(current, managed);
@@ -23,13 +23,14 @@ export async function writeManagedEnvConfig(file, currentText, managedLines) {
     const next = additions.length ? `${String(currentText || '').replace(/\s*$/, '\n')}${additions.join('\n')}\n` : String(currentText || '');
     return writeMergedText(file, currentText, next, 'env', protectedKeysInText(currentText));
 }
-export function safeMergeObject(current, managed) {
+export function safeMergeObject(current, managed, prefix = '') {
     const out = { ...current };
     for (const [key, value] of Object.entries(managed)) {
-        if (isProtectedSecretKey(key) && current[key] != null)
+        const dotted = prefix ? `${prefix}.${key}` : key;
+        if (isProtectedSecretKey(dotted) && current[key] != null)
             continue;
         if (isPlainObject(value) && isPlainObject(current[key]))
-            out[key] = safeMergeObject(current[key], value);
+            out[key] = safeMergeObject(current[key], value, dotted);
         else
             out[key] = value;
     }
@@ -51,11 +52,23 @@ function upsertTomlBlockPreservingSecrets(text, block) {
             break;
         }
     }
-    const existingSecretLines = lines.slice(start + 1, end).filter((line) => {
-        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
-        return isProtectedSecretKey(`${header}.${key}`) || isProtectedSecretKey(key);
-    });
-    lines.splice(start, end - start, ...blockLines, ...existingSecretLines.filter((line) => !blockLines.includes(line)));
+    const existingBody = lines.slice(start + 1, end);
+    const nextBody = [...existingBody];
+    for (const managedLine of blockLines.slice(1)) {
+        const managedKey = managedLine.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        if (!managedKey) {
+            if (!nextBody.includes(managedLine))
+                nextBody.push(managedLine);
+            continue;
+        }
+        const existingIndex = nextBody.findIndex((line) => (line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '') === managedKey);
+        const protectedLine = isProtectedSecretKey(`${header}.${managedKey}`) || isProtectedSecretKey(managedKey);
+        if (existingIndex === -1)
+            nextBody.push(managedLine);
+        else if (!protectedLine)
+            nextBody[existingIndex] = managedLine;
+    }
+    lines.splice(start, end - start, blockLines[0] || `[${header}]`, ...nextBody);
     return lines.join('\n').replace(/\n{3,}/g, '\n\n');
 }
 async function writeMergedText(file, before, after, format, preserved) {
@@ -68,6 +81,7 @@ async function writeMergedText(file, before, after, format, preserved) {
         }
         await writeTextAtomic(file, after);
     }
+    const preservedSecretLineHashes = protectedSecretLineHashes(before);
     return {
         schema: 'sks.managed-config-merge.v1',
         generated_at: nowIso(),
@@ -77,6 +91,8 @@ async function writeMergedText(file, before, after, format, preserved) {
         changed: before !== after,
         backup_path: backupPath,
         protected_keys_preserved: preserved,
+        preserved_secret_lines_sha256: preservedSecretLineHashes,
+        idempotent: before === after || protectedSecretLineHashes(after).every((hash) => preservedSecretLineHashes.includes(hash)),
         blockers: []
     };
 }
@@ -88,7 +104,40 @@ function protectedKeysPresent(value) {
     return found;
 }
 function protectedKeysInText(text) {
-    return PROTECTED_SECRET_KEYS.filter((key) => new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text)).map(String);
+    const found = new Set();
+    for (const key of PROTECTED_SECRET_KEYS) {
+        if (new RegExp(`(^|\\n)\\s*(?:export\\s+)?${String(key).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(text))
+            found.add(String(key));
+    }
+    let section = '';
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            section = String(sectionMatch[1] || '');
+            continue;
+        }
+        const key = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        if (key && section && isProtectedSecretKey(`${section}.${key}`))
+            found.add(`${section}.${key}`);
+    }
+    return [...found].sort();
+}
+function protectedSecretLineHashes(text) {
+    const hashes = [];
+    let section = '';
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            section = String(sectionMatch[1] || '');
+            continue;
+        }
+        const key = line.match(/^\s*(?:export\s+)?([A-Za-z0-9_.-]+)\s*=/)?.[1] || '';
+        if (!key)
+            continue;
+        if (isProtectedSecretKey(key) || (section && isProtectedSecretKey(`${section}.${key}`)))
+            hashes.push(sha256(line));
+    }
+    return hashes.sort();
 }
 function lookupPath(value, dotted) {
     let current = value;

package/dist/core/config/secret-preservation.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { ensureDir, nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
 import { PROTECTED_SECRET_KEYS, PROTECTED_SUPABASE_ENV_KEYS } from './supabase-secret-preservation.js';
+const activeGuardRoots = new Set();
 export async function captureSecretPreservationSnapshot(input) {
     const root = path.resolve(input.root);
     const sources = secretSources(root);
@@ -31,56 +32,83 @@ export async function captureSecretPreservationSnapshot(input) {
 }
 export async function withSecretPreservationGuard(root, operationName, fn) {
     const resolvedRoot = path.resolve(root);
+    if (activeGuardRoots.has(resolvedRoot))
+        return fn();
+    activeGuardRoots.add(resolvedRoot);
     const reportDir = path.join(resolvedRoot, '.sneakoscope', 'reports');
     await ensureDir(reportDir);
     const beforePath = path.join(reportDir, 'secret-preservation-before.json');
     const afterPath = path.join(reportDir, 'secret-preservation-after.json');
     const guardPath = path.join(reportDir, 'secret-preservation-guard.json');
     const before = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: beforePath });
+    const backup = await backupSecretBearingSources(resolvedRoot, operationName, before);
     let result;
+    let operationError = null;
     try {
         result = await fn();
     }
     catch (err) {
-        await writeJsonAtomic(guardPath, {
-            schema: 'sks.secret-preservation-guard.v1',
-            generated_at: nowIso(),
-            ok: false,
-            operation: operationName,
-            before_path: beforePath,
-            after_path: null,
-            restored_keys_count: 0,
-            missing_after: [],
-            raw_values_recorded: false,
-            operation_error: err instanceof Error ? err.message : String(err)
-        }).catch(() => undefined);
-        throw err;
+        operationError = err;
     }
-    const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
-    const missing = missingProtectedSecrets(before, after);
-    const report = {
-        schema: 'sks.secret-preservation-guard.v1',
-        generated_at: nowIso(),
-        ok: missing.length === 0,
-        operation: operationName,
-        before_path: beforePath,
-        after_path: afterPath,
-        restored_keys_count: 0,
-        missing_after: missing,
-        raw_values_recorded: false
-    };
-    await writeJsonAtomic(guardPath, report).catch(() => undefined);
-    if (missing.length) {
-        throw new Error(`secret_preservation_failed:${missing.map((item) => `${item.source}:${item.key}`).join(',')}`);
+    try {
+        const after = await captureSecretPreservationSnapshot({ root: resolvedRoot, artifactPath: afterPath });
+        const changedOrMissing = changedOrMissingProtectedSecrets(before, after);
+        let rollbackAttempted = false;
+        let rollbackOk = false;
+        let restoredKeysCount = 0;
+        if (changedOrMissing.length) {
+            rollbackAttempted = true;
+            await restoreChangedSecretSources(changedOrMissing, backup.bySource);
+            const restored = await captureSecretPreservationSnapshot({
+                root: resolvedRoot,
+                artifactPath: path.join(reportDir, 'secret-preservation-after-restore.json')
+            });
+            const remaining = changedOrMissingProtectedSecrets(before, restored);
+            rollbackOk = remaining.length === 0;
+            restoredKeysCount = rollbackOk ? changedOrMissing.length : 0;
+            if (!rollbackOk) {
+                const failedReport = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, false, backup.paths);
+                await writeJsonAtomic(guardPath, operationError ? { ...failedReport, ok: false, operation_error: sanitizeErrorMessage(operationError) } : failedReport).catch(() => undefined);
+                throw new Error(`secret_preservation_rollback_failed:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
+            }
+        }
+        const report = guardReport(operationName, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackAttempted ? rollbackOk : true, backup.paths);
+        if (operationError) {
+            report.ok = false;
+            report.operation_error = sanitizeErrorMessage(operationError);
+        }
+        await writeJsonAtomic(guardPath, report).catch(() => undefined);
+        if (operationError)
+            throw operationError;
+        if (operationName === 'doctor-fix' && rollbackAttempted) {
+            throw new Error(`secret_preservation_restored:${changedOrMissing.map((item) => `${safeSourceForError(resolvedRoot, item.source)}:${item.key}:${item.reason}`).join(',')}`);
+        }
+        return result;
+    }
+    finally {
+        activeGuardRoots.delete(resolvedRoot);
     }
-    return result;
 }
 export function missingProtectedSecrets(before, after) {
+    return changedOrMissingProtectedSecrets(before, after)
+        .filter((item) => item.reason === 'missing')
+        .map((item) => ({ key: item.key, source: item.source }));
+}
+export function changedOrMissingProtectedSecrets(before, after) {
     const afterMap = new Map(after.fingerprints.filter((fp) => fp.present).map((fp) => [`${fp.source}\0${fp.key}`, fp]));
     return before.fingerprints
         .filter((fp) => fp.present && fp.value_sha256)
-        .filter((fp) => !afterMap.has(`${fp.source}\0${fp.key}`))
-        .map((fp) => ({ key: fp.key, source: fp.source }));
+        .map((fp) => {
+        const afterFp = afterMap.get(`${fp.source}\0${fp.key}`);
+        if (!afterFp) {
+            return { key: fp.key, source: fp.source, before_sha256: fp.value_sha256, after_sha256: null, reason: 'missing' };
+        }
+        if (afterFp.value_sha256 !== fp.value_sha256) {
+            return { key: fp.key, source: fp.source, before_sha256: fp.value_sha256, after_sha256: afterFp.value_sha256, reason: 'changed' };
+        }
+        return null;
+    })
+        .filter((item) => Boolean(item));
 }
 function secretSources(root) {
     const home = process.env.HOME || os.homedir();
@@ -90,8 +118,10 @@ function secretSources(root) {
         '.env.development',
         '.env.production',
         '.sneakoscope/config.json',
-        '.codex/config.toml'
-    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'));
+        '.codex/config.toml',
+        '.cursor/mcp.json',
+        'mcp.json'
+    ].map((rel) => path.join(root, rel)).concat(path.join(home, '.codex', 'config.toml'), path.join(home, '.config', 'sks', 'config.json'));
 }
 function fingerprintsFromText(text, source) {
     const rows = [];
@@ -101,6 +131,7 @@ function fingerprintsFromText(text, source) {
             continue;
         rows.push(fingerprint(String(key), source, value));
     }
+    rows.push(...fingerprintsFromTomlSections(text, source));
     for (const envKey of PROTECTED_SUPABASE_ENV_KEYS) {
         const value = readAssignment(text, envKey);
         if (value)
@@ -118,6 +149,25 @@ function fingerprintsFromObject(value, source) {
     }
     return rows;
 }
+function fingerprintsFromTomlSections(text, source) {
+    const rows = [];
+    let section = '';
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
+        if (sectionMatch) {
+            section = String(sectionMatch[1] || '').trim();
+            continue;
+        }
+        const kv = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+?)\s*$/);
+        if (!kv || !section)
+            continue;
+        const key = `${section}.${kv[1]}`;
+        if (!PROTECTED_SECRET_KEYS.includes(key))
+            continue;
+        rows.push(fingerprint(key, source, unquote(String(kv[2] || ''))));
+    }
+    return rows;
+}
 function fingerprint(key, source, value) {
     return {
         key,
@@ -143,9 +193,7 @@ function redactPreview(value) {
     const text = String(value || '');
     if (!text)
         return '';
-    const head = text.slice(0, Math.min(3, text.length));
-    const tail = text.length > 6 ? text.slice(-3) : '';
-    return `${head}...${tail || 'redacted'}(${text.length})`;
+    return `sha256:${sha256(text).slice(0, 12)}(${text.length})`;
 }
 function flattenObject(value, prefix = '') {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -166,4 +214,64 @@ function dedupeFingerprints(fingerprints) {
         byKey.set(`${fp.source}\0${fp.key}`, fp);
     return [...byKey.values()].sort((a, b) => a.source.localeCompare(b.source) || a.key.localeCompare(b.key));
 }
+function guardReport(operation, beforePath, afterPath, changedOrMissing, restoredKeysCount, rollbackAttempted, rollbackOk, backupPaths) {
+    return {
+        schema: 'sks.secret-preservation-guard.v1',
+        generated_at: nowIso(),
+        ok: changedOrMissing.length === 0 || rollbackOk,
+        operation,
+        before_path: beforePath,
+        after_path: afterPath,
+        restored_keys_count: restoredKeysCount,
+        changed_or_missing: changedOrMissing,
+        missing_after: changedOrMissing.filter((item) => item.reason === 'missing').map((item) => ({ key: item.key, source: item.source })),
+        rollback_attempted: rollbackAttempted,
+        rollback_ok: rollbackOk,
+        backup_paths: backupPaths,
+        raw_values_recorded: false
+    };
+}
+async function backupSecretBearingSources(root, operationName, snapshot) {
+    const bySource = new Map();
+    const sources = [...new Set(snapshot.fingerprints.filter((fp) => fp.present).map((fp) => fp.source))];
+    if (!sources.length)
+        return { bySource, paths: [] };
+    const backupRoot = path.join(root, '.sneakoscope', 'backups', 'secrets', sanitizeSegment(operationName), new Date().toISOString().replace(/[:.]/g, '-'));
+    for (const source of sources) {
+        const backupPath = path.join(backupRoot, sanitizeSourcePath(root, source));
+        await ensureDir(path.dirname(backupPath));
+        await fs.copyFile(source, backupPath);
+        bySource.set(source, backupPath);
+    }
+    return { bySource, paths: [...bySource.values()] };
+}
+async function restoreChangedSecretSources(changedOrMissing, backups) {
+    for (const source of [...new Set(changedOrMissing.map((item) => item.source))]) {
+        const backup = backups.get(source);
+        if (!backup)
+            continue;
+        await ensureDir(path.dirname(source));
+        await fs.copyFile(backup, source);
+    }
+}
+function sanitizeSegment(value) {
+    return String(value || 'operation').replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'operation';
+}
+function sanitizeSourcePath(root, source) {
+    return safeSourceForError(root, source).replace(/[^A-Za-z0-9._/-]+/g, '_').replace(/^\/+/, '');
+}
+function safeSourceForError(root, source) {
+    const rel = path.relative(root, source);
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel))
+        return rel;
+    const home = process.env.HOME || os.homedir();
+    const homeRel = path.relative(home, source);
+    if (homeRel && !homeRel.startsWith('..') && !path.isAbsolute(homeRel))
+        return `~/${homeRel}`;
+    return path.basename(source);
+}
+function sanitizeErrorMessage(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return message.replace(/([A-Za-z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD)[A-Za-z0-9_]*=)[^\s,;]+/gi, '$1<redacted>');
+}
 //# sourceMappingURL=secret-preservation.js.map