takomi 2.1.44 → 2.1.45

package/.pi/README.md

@@ -34,8 +34,8 @@ Inside Pi, use:
 - `/takomi build [prompt]` to implement while cross-checking against approved UI/design artifacts
 - `/takomi plan [title]` to create a Genesis-first orchestration session that can expand through Design and Build
 - `/takomi mode direct`, `/takomi mode orchestrate`, or `/takomi mode review` to choose the session operating mode
-- `/takomi gate auto` to continue approved plans automatically
-- `/takomi gate review` to return to the user after each task with results and verification guidance
+- `/takomi gate auto` to continue approved plans automatically and explicitly authorize project-local agents for this session
+- `/takomi gate review` (or `/takomi gate manual`) to return to the user after each task with results and verification guidance and revoke that authorization
 - `/takomi subagents on` or `/takomi subagents off` to allow or disable delegated subagents
 - `/takomi subagents list` to list available Takomi agents without exposing the raw `subagent` tool
 - `/takomi subagents status` to inspect active subagent state
@@ -109,7 +109,8 @@ So when working on packaging, agents should distinguish between:
 - Direct `takomi_subagent` calls build a `TakomiDelegationPlan` before launch. In auto mode the plan launches immediately; in manual mode the plan is returned for review until `confirmLaunch=true` is supplied.
 - The subagent tool supports `conversationId`, so reviewed work can be sent back to the same agent for continuation instead of restarting from scratch.
 - The subagent tool supports Pi-style single, parallel `tasks`, sequential `chain`, explicit `context=fork|fresh`, `async=true`, and native read/control actions such as `action=list`, `action=status`, `action=doctor`, `action=interrupt`, and `action=resume`.
-- The subagent tool supports `agentScope` values of `user`, `project`, and `both`; project-local agents require confirmation by default.
+- The subagent tool supports `agentScope` values of `user`, `project`, and `both`; project-local agents require confirmation by default. The only session authorization bypasses are `TAKOMI_TRUST_PROJECT_AGENTS` and the explicit user `/takomi gate auto` provenance marker; model mode changes plus profile, default, or generic runtime `auto` state do not authorize project agents.
+- The explicit user gate-auto marker is stored in session history so it survives resuming that same session. `/takomi gate review`, `/takomi gate manual`, review mode, and `/takomi-reset` append a revocation; it is not a cross-session or profile setting.
 - The subagent tool also supports per-run `workflow`, `skills`, `model`, `fallbackModels`, `thinking`, `checklist`, `concurrency`, and `worktree` overrides.
 - `takomi_board` records session/state/markdown artifacts only; it does not run subagents.
 - Pi's default `subagent` tool remains owned by the user-level/default subagent extension to avoid tool-name conflicts; Takomi uses `takomi_subagent` as the preferred lifecycle-aware execution interface and renders it with the native Pi-style result surface.

package/.pi/extensions/oauth-router/commands.ts

@@ -1,5 +1,6 @@
 import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import { createAccountFromUpstream } from "./oauth-flow.ts";
+import { createRouterReportLines, createRouterReportWidget, ROUTER_REPORT_DISMISS_HINT, ROUTER_REPORT_WIDGET_KEY } from "./report-ui.ts";
 import type { RouterStatusRow, RouterUsageSummary, RouterUsageWindowSummary, RoutingPolicyName, StoredRouterAccount } from "./types.ts";
 import { RouterRuntime } from "./provider.ts";
 
@@ -273,12 +274,32 @@ export function formatUsageRawReport(runtime: RouterRuntime, accountId?: string)
   return ["# oauth-router usage raw", "", ...rows].join("\n");
 }
 
-function emitReport(ctx: ExtensionCommandContext, text: string) {
-  const lines = text.split(/\r?\n/);
-  ctx.ui.setWidget("oauth-router-report", lines, { placement: "belowEditor" });
-  ctx.ui.notify(lines[0] || "oauth-router report updated", "info");
+export function emitRouterReport(ctx: ExtensionCommandContext, text: string) {
+  // A single key gives every report predictable replacement semantics. Add the
+  // dismiss affordance at this presentation boundary, not to formatter output,
+  // so model/source report text remains unchanged. Omitting options uses Pi's
+  // default above-editor placement for both TUI and RPC widgets.
+  const reportText = `${ROUTER_REPORT_DISMISS_HINT}\n\n${text}`;
+  if (ctx.mode === "tui") {
+    ctx.ui.setWidget(ROUTER_REPORT_WIDGET_KEY, createRouterReportWidget(reportText));
+    return;
+  }
+  // RPC accepts string-array widgets only; ctx.hasUI is true there, so ctx.mode
+  // is the capability signal that prevents its visible report from being ignored.
+  ctx.ui.setWidget(ROUTER_REPORT_WIDGET_KEY, createRouterReportLines(reportText));
+}
+
+export function clearRouterReport(ctx: ExtensionCommandContext) {
+  ctx.ui.setWidget(ROUTER_REPORT_WIDGET_KEY, undefined);
 }
 
+export type RouterReportEmitter = (ctx: ExtensionCommandContext, text: string) => void;
+
+export type RouterReportControls = {
+  show: RouterReportEmitter;
+  clear: (ctx: ExtensionCommandContext) => void;
+};
+
 async function pickUpstream(runtime: RouterRuntime, ctx: ExtensionCommandContext, requestedId?: string) {
   const upstreams = runtime.listUpstreams().filter((upstream) => upstream.enabled);
   if (upstreams.length === 0) throw new Error("No enabled upstreams are configured");
@@ -385,12 +406,11 @@ function setFooterStatus(ctx: ExtensionCommandContext, runtime: RouterRuntime) {
   ctx.ui.setStatus("oauth-router", `oauth-router ${healthy}/${rows.length || 0} healthy | ${runtime.getPolicy()}`);
 }
 
-function showCommandHint(ctx: ExtensionCommandContext, title: string, lines: string[]) {
-  emitReport(ctx, [`# ${title}`, "", ...lines].join("\n"));
-  ctx.ui.notify(title, "info");
+function showCommandHint(ctx: ExtensionCommandContext, title: string, lines: string[], showReport: RouterReportEmitter = emitRouterReport) {
+  showReport(ctx, [`# ${title}`, "", ...lines].join("\n"));
 }
 
-async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: ExtensionCommandContext) {
+async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: ExtensionCommandContext, showReport: RouterReportEmitter = emitRouterReport) {
   const [command = "help", first, ...rest] = parseArgs(args);
 
   switch (command) {
@@ -415,18 +435,17 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
         runtime.clearAccountHealth(duplicate.id);
         const usageMessage = await refreshUsageAfterCredentialChange(runtime, duplicate.id);
         setFooterStatus(ctx, runtime);
-        emitReport(ctx, `Updated existing account ${duplicate.id} (${duplicate.label}) with fresh credentials instead of adding a duplicate.${usageMessage}`);
+        showReport(ctx, `Updated existing account ${duplicate.id} (${duplicate.label}) with fresh credentials instead of adding a duplicate.${usageMessage}`);
         return;
       }
       runtime.addAccount(account);
       const usageMessage = await refreshUsageAfterCredentialChange(runtime, account.id);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Added account ${account.id} (${account.label}) for upstream ${upstream.id}.${usageMessage}`);
-      ctx.ui.notify(`Added ${account.id}`, "info");
+      showReport(ctx, `Added account ${account.id} (${account.label}) for upstream ${upstream.id}.${usageMessage}`);
       return;
     }
     case "list": {
-      emitReport(ctx, formatAccountsReport(runtime));
+      showReport(ctx, formatAccountsReport(runtime));
       setFooterStatus(ctx, runtime);
       return;
     }
@@ -439,7 +458,7 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
       }
       runtime.removeAccount(account.id);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Removed account ${account.id}.`);
+      showReport(ctx, `Removed account ${account.id}.`);
       return;
     }
     case "rename": {
@@ -447,7 +466,7 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
       const label = await getRequiredLabel(ctx, account.label, rest.join(" "));
       runtime.renameAccount(account.id, label);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Renamed account ${account.id} to ${label}.`);
+      showReport(ctx, `Renamed account ${account.id} to ${label}.`);
       return;
     }
     case "relogin": {
@@ -472,7 +491,7 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
       runtime.clearAccountHealth(existing.id);
       const usageMessage = await refreshUsageAfterCredentialChange(runtime, existing.id);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Re-logged account ${existing.id} (${existing.label}) and cleared auth state.${usageMessage}`);
+      showReport(ctx, `Re-logged account ${existing.id} (${existing.label}) and cleared auth state.${usageMessage}`);
       return;
     }
     case "refresh": {
@@ -480,12 +499,12 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
       const refreshed = await runtime.refreshAccount(account.id);
       const usageMessage = await refreshUsageAfterCredentialChange(runtime, refreshed.id);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Refreshed account ${refreshed.id} (${refreshed.label}).${usageMessage}`);
+      showReport(ctx, `Refreshed account ${refreshed.id} (${refreshed.label}).${usageMessage}`);
       return;
     }
     case "help":
     default: {
-      emitReport(
+      showReport(
         ctx,
         [
           "# oauth-router commands",
@@ -506,6 +525,7 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
           "- /router-disable <id>",
           "- /router-policy <round-robin|weighted-round-robin>",
           "- /router-weight <id> <n>",
+          "- /router-clear (dismiss the current report)",
         ].join("\n"),
       );
       return;
@@ -513,16 +533,27 @@ async function handleRouterLogin(runtime: RouterRuntime, args: string, ctx: Exte
   }
 }
 
-export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime) {
+export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime, reportControls?: RouterReportControls) {
+  const showReport = reportControls?.show ?? emitRouterReport;
+  const clearReport = reportControls?.clear ?? clearRouterReport;
+
   pi.registerCommand("router-login", {
     description: "Manage oauth-router accounts",
-    handler: async (args, ctx) => handleRouterLogin(runtime, args || "", ctx),
+    handler: async (args, ctx) => handleRouterLogin(runtime, args || "", ctx, showReport),
+  });
+
+  pi.registerCommand("router-clear", {
+    description: "Dismiss the current oauth-router report widget",
+    handler: async (_args, ctx) => {
+      clearReport(ctx);
+      setFooterStatus(ctx, runtime);
+    },
   });
 
   pi.registerCommand("router-status", {
     description: "Show oauth-router health and routing state",
     handler: async (_args, ctx) => {
-      emitReport(ctx, formatStatusReport(runtime));
+      showReport(ctx, formatStatusReport(runtime));
       setFooterStatus(ctx, runtime);
     },
   });
@@ -530,7 +561,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
   pi.registerCommand("router-accounts", {
     description: "Show compact oauth-router account list",
     handler: async (_args, ctx) => {
-      emitReport(ctx, formatAccountsReport(runtime));
+      showReport(ctx, formatAccountsReport(runtime));
       setFooterStatus(ctx, runtime);
     },
   });
@@ -539,7 +570,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
     description: "Show oauth-router visual provider quota and local usage",
     handler: async (args, ctx) => {
       const [id] = parseArgs(args || "");
-      emitReport(ctx, formatUsageReport(runtime, id));
+      showReport(ctx, formatUsageReport(runtime, id));
       setFooterStatus(ctx, runtime);
     },
   });
@@ -548,7 +579,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
     description: "Show raw oauth-router usage/provider quota details",
     handler: async (args, ctx) => {
       const [id] = parseArgs(args || "");
-      emitReport(ctx, formatUsageRawReport(runtime, id));
+      showReport(ctx, formatUsageRawReport(runtime, id));
       setFooterStatus(ctx, runtime);
     },
   });
@@ -557,7 +588,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
     description: "Alias for visual oauth-router usage/quota",
     handler: async (args, ctx) => {
       const [id] = parseArgs(args || "");
-      emitReport(ctx, formatUsageReport(runtime, id));
+      showReport(ctx, formatUsageReport(runtime, id));
       setFooterStatus(ctx, runtime);
     },
   });
@@ -580,7 +611,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
       }
 
       const report = formatUsageReport(runtime, target === "all" ? undefined : target);
-      emitReport(ctx, failures.length ? [report, "", "## Refresh failures", ...failures].join("\n") : report);
+      showReport(ctx, failures.length ? [report, "", "## Refresh failures", ...failures].join("\n") : report);
       if (failures.length) ctx.ui.notify(`oauth-router usage refreshed with ${failures.length} failure(s)`, "error");
       setFooterStatus(ctx, runtime);
     },
@@ -594,7 +625,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
       const label = await getRequiredLabel(ctx, account.label, labelParts.join(" "));
       runtime.renameAccount(account.id, label);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Renamed account ${account.id} to ${label}.`);
+      showReport(ctx, `Renamed account ${account.id} to ${label}.`);
     },
   });
 
@@ -609,13 +640,13 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
       }
       runtime.removeAccount(account.id);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Deleted account ${account.id}.`);
+      showReport(ctx, `Deleted account ${account.id}.`);
     },
   });
 
   pi.registerCommand("router-relogin", {
     description: "Re-login and recover an oauth-router account",
-    handler: async (args, ctx) => handleRouterLogin(runtime, `relogin ${args || ""}`, ctx),
+    handler: async (args, ctx) => handleRouterLogin(runtime, `relogin ${args || ""}`, ctx, showReport),
   });
 
   pi.registerCommand("router-enable", {
@@ -625,7 +656,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
       const account = await pickAccount(runtime, ctx, id, "Choose account to enable");
       runtime.setEnabled(account.id, true);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Enabled account ${account.id}.`);
+      showReport(ctx, `Enabled account ${account.id}.`);
     },
   });
 
@@ -636,7 +667,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
       const account = await pickAccount(runtime, ctx, id, "Choose account to disable");
       runtime.setEnabled(account.id, false);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Disabled account ${account.id}.`);
+      showReport(ctx, `Disabled account ${account.id}.`);
     },
   });
 
@@ -651,7 +682,7 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
           "",
           "Usage: /router-policy <round-robin|weighted-round-robin>",
           "Aliases: rr, wrr, weighted",
-        ]);
+        ], showReport);
         return;
       }
       if (!policy) {
@@ -660,12 +691,12 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
           "",
           `Current policy: ${runtime.getPolicy()}`,
           "Valid values: round-robin, weighted-round-robin",
-        ]);
+        ], showReport);
         return;
       }
       runtime.setPolicy(policy);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Routing policy set to ${policy}.`);
+      showReport(ctx, `Routing policy set to ${policy}.`);
     },
   });
 
@@ -680,12 +711,12 @@ export function registerRouterCommands(pi: ExtensionAPI, runtime: RouterRuntime)
         weight = Number(response);
       }
       if (!Number.isFinite(weight)) {
-        showCommandHint(ctx, "router-weight", ["Usage: /router-weight <id> <n>", "Example: /router-weight acct_ab12cd34 3"]);
+        showCommandHint(ctx, "router-weight", ["Usage: /router-weight <id> <n>", "Example: /router-weight acct_ab12cd34 3"], showReport);
         return;
       }
       runtime.setWeight(account.id, weight);
       setFooterStatus(ctx, runtime);
-      emitReport(ctx, `Updated weight for ${account.id} to ${Math.max(1, Math.floor(weight))}.`);
+      showReport(ctx, `Updated weight for ${account.id} to ${Math.max(1, Math.floor(weight))}.`);
     },
   });
 }

package/.pi/extensions/oauth-router/index.ts

@@ -1,5 +1,6 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { registerRouterCommands, formatStatusReport } from "./commands.ts";
+import { emitRouterReport, formatStatusReport, registerRouterCommands, type RouterReportControls } from "./commands.ts";
+import { ROUTER_REPORT_WIDGET_KEY } from "./report-ui.ts";
 import { registerRouterProvider, RouterRuntime } from "./provider.ts";
 import type { RouterUiEvent } from "./types.ts";
 
@@ -64,8 +65,33 @@ function notifyActivity(ctx: ExtensionContext, event: RouterUiEvent) {
   ctx.ui.notify(message, level);
 }
 
-function installRouterUiBridge(pi: ExtensionAPI, runtime: RouterRuntime, notifyOnLoad = false) {
+function installRouterUiBridge(pi: ExtensionAPI, runtime: RouterRuntime, notifyOnLoad = false): RouterReportControls {
   let activeCtx: ExtensionContext | undefined;
+  let reportGeneration = 0;
+  let activeReport: { generation: number; ctx: ExtensionContext } | undefined;
+
+  const clearReport = (fallbackCtx?: ExtensionContext, clearFallback = false) => {
+    const report = activeReport;
+    const ctx = report?.ctx ?? (clearFallback ? fallbackCtx : undefined);
+    if (!ctx) return;
+
+    try {
+      ctx.ui.setWidget(ROUTER_REPORT_WIDGET_KEY, undefined);
+    } catch {
+      // Widget lifecycle is best-effort and must not interrupt agent activity.
+    } finally {
+      // A re-entrant command can replace the report while the old widget clears.
+      // Its newer generation remains active instead of being erased by this clear.
+      if (report && activeReport?.generation === report.generation) activeReport = undefined;
+    }
+  };
+
+  const showReport: RouterReportControls["show"] = (ctx, text) => {
+    const report = { generation: ++reportGeneration, ctx };
+    activeCtx = ctx;
+    activeReport = report;
+    emitRouterReport(ctx, text);
+  };
 
   const setBaseStatus = (ctx: ExtensionContext) => {
     activeCtx = ctx;
@@ -84,14 +110,29 @@ function installRouterUiBridge(pi: ExtensionAPI, runtime: RouterRuntime, notifyO
   });
 
   pi.on("session_start", async (_event, ctx) => {
+    // A session replacement owns a fresh transport, so clear the old transport
+    // before accepting reports for the new one.
+    clearReport(activeCtx, true);
     setBaseStatus(ctx);
     if (notifyOnLoad) ctx.ui.notify("oauth-router loaded", "info");
   });
 
+  pi.on("input", async (event, ctx) => {
+    // Registered slash commands run before Pi emits input and return without an
+    // input event. Ordinary text/image input reaches this handler before its
+    // agent starts, which is the intended transient-dismissal boundary.
+    if (event.text.trim() || event.images?.length) clearReport(ctx);
+  });
+
   pi.on("agent_start", async (_event, ctx) => {
+    clearReport(ctx);
     setBaseStatus(ctx);
   });
 
+  pi.on("tool_execution_start", async (_event, ctx) => {
+    clearReport(ctx);
+  });
+
   pi.on("turn_start", async (_event, ctx) => {
     setBaseStatus(ctx);
   });
@@ -105,23 +146,26 @@ function installRouterUiBridge(pi: ExtensionAPI, runtime: RouterRuntime, notifyO
   });
 
   pi.on("session_shutdown", async () => {
+    // The old context owns the RPC transport. Clear its report before releasing
+    // it so clients do not retain a widget across a session replacement.
+    clearReport(activeCtx, true);
     activeCtx = undefined;
   });
+
+  return { show: showReport, clear: (ctx) => clearReport(ctx, true) };
 }
 
 export default function (pi: ExtensionAPI) {
   const runtime = new RouterRuntime();
 
   registerRouterProvider(pi, runtime);
-  registerRouterCommands(pi, runtime);
-  installRouterUiBridge(pi, runtime, false);
+  const reportControls = installRouterUiBridge(pi, runtime, false);
+  registerRouterCommands(pi, runtime, reportControls);
 
   pi.registerCommand("router-debug-report", {
     description: "Show a detailed oauth-router report in the UI only",
     handler: async (_args, ctx) => {
-      const report = formatStatusReport(runtime);
-      ctx.ui.setWidget("oauth-router-report", report.split(/\r?\n/), { placement: "belowEditor" });
-      ctx.ui.notify("oauth-router debug report updated", "info");
+      reportControls.show(ctx, formatStatusReport(runtime));
     },
   });
 }

package/.pi/extensions/oauth-router/report-ui.ts

@@ -0,0 +1,205 @@
+import { truncateToWidth, wrapTextWithAnsi, type Component } from "@earendil-works/pi-tui";
+
+export const ROUTER_REPORT_WIDGET_KEY = "oauth-router-report";
+export const ROUTER_REPORT_DISMISS_HINT = "Dismiss: /router-clear";
+
+type RouterTheme = {
+  fg(color: "accent" | "success" | "warning" | "error" | "muted" | "dim", text: string): string;
+  bold(text: string): string;
+};
+
+const SENSITIVE_VALUE_KEYS = new Set([
+  "access_token", "access-token", "accesstoken",
+  "refresh_token", "refresh-token", "refreshtoken",
+  "id_token", "id-token", "idtoken",
+  "auth_token", "auth-token", "authtoken",
+  "api_key", "api-key", "apikey",
+  "authorization",
+  "client_secret", "client-secret", "clientsecret",
+  "password", "secret", "code",
+]);
+const SENSITIVE_QUERY_KEYS = [...SENSITIVE_VALUE_KEYS, "token", "key"];
+const SENSITIVE_QUERY_VALUE = new RegExp(`([?&#](?:${SENSITIVE_QUERY_KEYS.join("|")})=)[^&#\\s"']*`, "gi");
+
+function isKeyCharacter(value: string | undefined): boolean {
+  return Boolean(value && /[A-Za-z0-9_-]/.test(value));
+}
+
+function skipWhitespace(text: string, start: number): number {
+  let index = start;
+  while (/\s/.test(text[index] ?? "")) index += 1;
+  return index;
+}
+
+function quotedEnd(text: string, start: number): number | undefined {
+  const quote = text[start];
+  for (let index = start + 1; index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+      continue;
+    }
+    if (text[index] === quote) return index + 1;
+  }
+  return undefined;
+}
+
+type SensitiveAssignment = { key: string; valueStart: number };
+
+/**
+ * Locate a complete assignment key rather than using a word-boundary regex.
+ * Underscores and hyphens are key characters, so `zipcode`, `account_code`,
+ * and `authorization_status` cannot be mistaken for sensitive keys.
+ */
+function sensitiveAssignmentAt(text: string, start: number): SensitiveAssignment | undefined {
+  if (isKeyCharacter(text[start - 1])) return undefined;
+
+  let key: string;
+  let afterKey: number;
+  if (text[start] === '"' || text[start] === "'") {
+    const end = quotedEnd(text, start);
+    if (!end) return undefined;
+    key = text.slice(start + 1, end - 1);
+    afterKey = end;
+  } else {
+    if (!isKeyCharacter(text[start])) return undefined;
+    afterKey = start;
+    while (isKeyCharacter(text[afterKey])) afterKey += 1;
+    key = text.slice(start, afterKey);
+  }
+
+  if (!SENSITIVE_VALUE_KEYS.has(key.toLowerCase())) return undefined;
+  const delimiter = skipWhitespace(text, afterKey);
+  if (text[delimiter] !== ":" && text[delimiter] !== "=") return undefined;
+  return { key: key.toLowerCase(), valueStart: skipWhitespace(text, delimiter + 1) };
+}
+
+function redactSensitiveAssignments(text: string): string {
+  let output = "";
+  let cursor = 0;
+
+  for (let start = 0; start < text.length; start += 1) {
+    const assignment = sensitiveAssignmentAt(text, start);
+    if (!assignment || assignment.valueStart >= text.length) continue;
+
+    const valueStart = assignment.valueStart;
+    const quote = text[valueStart];
+    if (quote === '"' || quote === "'") {
+      const valueEnd = quotedEnd(text, valueStart);
+      if (!valueEnd) continue;
+      output += `${text.slice(cursor, valueStart + 1)}[redacted]${quote}`;
+      cursor = valueEnd;
+      start = valueEnd - 1;
+      continue;
+    }
+
+    let valueEnd = valueStart;
+    if (assignment.key === "authorization") {
+      while (valueEnd < text.length && text[valueEnd] !== "|" && text[valueEnd] !== "\r" && text[valueEnd] !== "\n") valueEnd += 1;
+      while (valueEnd > valueStart && /\s/.test(text[valueEnd - 1])) valueEnd -= 1;
+    } else {
+      while (valueEnd < text.length && !/[\s|,;"'&#]/.test(text[valueEnd])) valueEnd += 1;
+    }
+    if (valueEnd === valueStart) continue;
+
+    output += `${text.slice(cursor, valueStart)}[redacted]`;
+    cursor = valueEnd;
+    start = valueEnd - 1;
+  }
+
+  return output + text.slice(cursor);
+}
+
+/**
+ * Remove terminal controls and credentials from presentation only. Router data
+ * remains untouched; this boundary exists because labels and upstream errors
+ * can originate outside the extension.
+ */
+export function sanitizeReportText(value: unknown): string {
+  let text = String(value ?? "")
+    .replace(/\x1b(?:\][^\x07]*(?:\x07|\x1b\\)|\[[0-?]*[ -/]*[@-~]|[PX^_][^\x1b]*(?:\x1b\\))/g, "")
+    .replace(/[\x00-\x1f\x7f-\x9f]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+
+  // Bearer credentials can occur outside a key/value field. Assignment
+  // parsing below handles every quoted/bare sensitive-key combination and
+  // keeps Authorization's multi-word field value intact while redacting it.
+  text = text
+    .replace(/\b(Bearer\s+)(?:"[^"]*"|'[^']*'|[^\s,;|"']+)/gi, "$1[redacted]")
+    .replace(SENSITIVE_QUERY_VALUE, "$1[redacted]");
+  text = redactSensitiveAssignments(text)
+    .replace(/\b(sk-[A-Za-z0-9_-]{8,}|(?:eyJ[A-Za-z0-9_-]+\.){2}[A-Za-z0-9_-]+)\b/gi, "[redacted]");
+
+  return text;
+}
+
+/** Return the RPC-compatible report representation without terminal controls. */
+export function createRouterReportLines(text: string): string[] {
+  return text.split(/\r?\n/).map(sanitizeReportText);
+}
+
+function fitQuotaBar(line: string, width: number): string {
+  const match = /\[([█░]+)\]/.exec(line);
+  if (!match) return line;
+  const source = match[1];
+  const targetWidth = width <= 45 ? 8 : width <= 70 ? 12 : 18;
+  if (source.length <= targetWidth) return line;
+  const filled = [...source].filter((cell) => cell === "█").length;
+  const targetFilled = Math.round((filled / source.length) * targetWidth);
+  return `${line.slice(0, match.index)}[${"█".repeat(targetFilled)}${"░".repeat(targetWidth - targetFilled)}]${line.slice(match.index + match[0].length)}`;
+}
+
+function styleLine(theme: RouterTheme, line: string): string {
+  if (line === ROUTER_REPORT_DISMISS_HINT) return theme.fg("accent", theme.bold(line));
+  if (line.startsWith("# ")) return theme.fg("accent", theme.bold(line.slice(2)));
+  if (line.startsWith("## ")) return theme.fg("accent", theme.bold(line.slice(3)));
+
+  // State words must win over incidental success counters or a prior healthy
+  // status. In particular, an explicitly disabled account is never success.
+  if (/\b(auth=invalid|auth invalid|invalid)\b/i.test(line)) return theme.fg("error", line);
+  if (/\b(degraded|cooldown|penalty)\b/i.test(line)) return theme.fg("warning", line);
+  if (/\b(enabled\s*=\s*false|disabled|inactive)\b/i.test(line)) return theme.fg("muted", line);
+  if (/^Provider:\s*/.test(line)) return theme.fg("accent", line);
+  if (/^Local:\s*/.test(line)) return theme.fg("muted", line);
+
+  const quota = /(\d+)% left/.exec(line);
+  if (quota) {
+    const remaining = Number(quota[1]);
+    return theme.fg(remaining <= 20 ? "error" : remaining <= 50 ? "warning" : "success", line);
+  }
+  if (/\b(healthy|enabled|ok)\b/i.test(line) && !/\b(unhealthy|not healthy)\b/i.test(line)) return theme.fg("success", line);
+  if (/\b(failures?|429s?|error)\b/i.test(line)) return theme.fg("warning", line);
+  if (/^(Raw:|Usage:|Aliases:|Valid values:|Compact account list|Provider bars show)/.test(line)) return theme.fg("muted", line);
+  if (/^(note:|headers:|claimKeys:|endpoint:|tokenExpires=)/.test(line)) return theme.fg("dim", line);
+  return line;
+}
+
+class RouterReportComponent implements Component {
+  constructor(private readonly lines: string[], private readonly theme: RouterTheme) {}
+
+  invalidate() {
+    // Rendering is derived solely from the report snapshot and current width.
+  }
+
+  render(width: number): string[] {
+    const usableWidth = Math.max(1, width);
+    const rendered: string[] = [];
+    for (const line of this.lines) {
+      if (!line) {
+        rendered.push("");
+        continue;
+      }
+      const styled = styleLine(this.theme, fitQuotaBar(line, usableWidth));
+      const wrapped = wrapTextWithAnsi(styled, usableWidth);
+      rendered.push(...(wrapped.length ? wrapped.map((part) => truncateToWidth(part, usableWidth)) : [""]));
+    }
+    return rendered;
+  }
+}
+
+export function createRouterReportWidget(text: string) {
+  // Snapshot and sanitize now as well as at render time so replacement has no
+  // mutable dependency and no stale report can reappear on a later lifecycle event.
+  const safeLines = createRouterReportLines(text);
+  return (_tui: unknown, theme: RouterTheme): Component => new RouterReportComponent(safeLines, theme);
+}