tickmarkr 1.63.0 → 1.64.0

package/dist/gates/acceptance.d.ts

@@ -8,6 +8,7 @@ export interface JudgeVerdict {
         criterion: string;
         met: boolean;
         reason: string;
+        evidence: string;
     }>;
 }
 export declare function judgeCriterionId(index: number): string;

package/dist/gates/acceptance.js

@@ -4,13 +4,16 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff } from "./review.js";
-import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const JudgeVerdictRowSchema = z.object({
     criterion: z.string(),
     met: z.boolean(),
     reason: z.string(),
+    // v1.64: a verbatim quote from the judged diff grounding the ruling — required; a verdict
+    // omitting it is malformed and fails closed like any other shape violation.
+    evidence: z.string(),
 });
 const JudgeVerdictSchema = z.object({
     pass: z.boolean(),
@@ -157,6 +160,8 @@ You are a strict acceptance judge. Decide whether the diff satisfies EVERY accep
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
 Deterministic command/test oracles have already passed mechanically; judge ONLY the rubric items below.
 
+${COMPLETION_FAKING_CHECKLIST}
+
 ## Task ${task.id}: ${task.title}
 Goal: ${task.goal}
 
@@ -171,8 +176,9 @@ ${diff}
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
-{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "..."}]}
+{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": "..."}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
+Each criteria[].evidence MUST be a short verbatim quote copied from the diff above that grounds the ruling; a quote not found in the diff voids the whole verdict.
 `;
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
@@ -185,6 +191,15 @@ Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) ex
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
+    // v1.64: quoted evidence must appear verbatim in `diff` — the exact string embedded in the prompt
+    // above, never the worktree or any other artifact. A quote the diff doesn't contain is a
+    // hallucinated verdict: treated as unparseable so GATE-09 retries the judge on a failover channel.
+    const fabricated = v.criteria.filter((row) => !row.evidence.trim() || !diff.includes(row.evidence));
+    if (fabricated.length) {
+        return { gate: "acceptance", pass: false,
+            details: warn + detBlock + `judge verdict quotes evidence absent from the judged diff (${fabricated.map((row) => row.criterion).join(", ")}) — treating as unparseable, failing closed`,
+            meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    }
     const pass = v.pass === true && inconsistencies.length === 0 && v.criteria.every((row) => row.met);
     const lines = v.criteria.map((row) => `${row.met ? "✓" : "✗"} ${row.criterion}: ${row.reason}`);
     if (!v.pass)

package/dist/gates/baseline.d.ts

@@ -1,4 +1,5 @@
 import type { TickmarkrConfig } from "../config/config.js";
+import type { AcceptanceItem } from "../graph/schema.js";
 import type { GateResult } from "./types.js";
 export interface Baseline {
     commands: Record<string, {
@@ -16,4 +17,14 @@ export interface BaselineWarning {
 export declare function fingerprint(output: string): string[];
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
+export interface VacuousOracleWarning {
+    kind: "vacuous-oracle";
+    taskId: string;
+    oracles: string[];
+    reason: string;
+}
+export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
+    id: string;
+    acceptance: AcceptanceItem[];
+}>): Promise<VacuousOracleWarning[]>;
 export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;

package/dist/gates/baseline.js

@@ -83,6 +83,32 @@ export async function captureBaseline(cwd, commands) {
     }
     return base;
 }
+// Tier A #3 (2026-07-21 repo-scan reconciliation): a command oracle that already exits 0 before any
+// work exists cannot falsify the work — surface it at baseline capture. Observational only: journaled
+// warning, never a gate input, and an oracle that fails at baseline changes nothing. Judge oracles
+// (including plain-string compat judges) are never executed; test oracles stay gate-only (they need
+// the detected runner and the worker's diff to mean anything).
+export async function detectVacuousOracles(cwd, tasks) {
+    const out = [];
+    for (const t of tasks) {
+        const vacuous = [];
+        for (const a of t.acceptance) {
+            if (typeof a !== "object" || a.oracle !== "command")
+                continue;
+            if ((await sh(a.command, cwd)).code === 0)
+                vacuous.push(a.command);
+        }
+        if (vacuous.length) {
+            out.push({
+                kind: "vacuous-oracle",
+                taskId: t.id,
+                oracles: vacuous,
+                reason: `vacuous acceptance oracle on ${t.id}: already passes before any work exists — ${vacuous.map((c) => `$ ${c}`).join("; ")}`,
+            });
+        }
+    }
+    return out;
+}
 // HYG-08 (D-01): headline the runner's own failure naming; demote the fingerprint diff to a secondary
 // section. Extracts from `raw` — the SAME cwd-stripped, per-line ANSI_RE-stripped string that was
 // fingerprinted, digits UN-normalized (Pitfall 2: normalization mangles test names, and the diff set could

package/dist/gates/llm.d.ts

@@ -1,12 +1,13 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
+export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export declare function generateVerdictNonce(): string;
 export declare function verdictNonceLine(nonce: string): string;
 export declare function extractPromptNonce(prompt: string): string | null;
 export declare function gateExitTrailer(nonce: string): string;
-export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string): string;
+export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string, prompt?: string): string;
 export type GatePaneRole = "judge" | "review" | "consult";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export declare function gatePaneName(role: GatePaneRole, taskId: string, suffix?: string): string;

package/dist/gates/llm.js

@@ -6,6 +6,22 @@ import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
+// v1.64 gate-integrity (repo-scan Tier A·1): the concrete completion-faking shortcuts every
+// judge/review verdict must hunt for. Shared verbatim by the acceptance judge and review prompts.
+export const COMPLETION_FAKING_CHECKLIST = `## Completion-faking checklist
+Hunt for these concrete completion-faking shortcuts before ruling on any criterion:
+- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic
+- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green
+- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)
+- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior
+- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself
+- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be
+- error-swallowing: catch or fallback that hides failures instead of handling them
+- self-mocking: the code under test mocked or faked so the test exercises the mock
+- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green
+- rename-as-work: code moved or renamed and presented as the requested change
+- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched
+When a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.`;
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export function generateVerdictNonce() {
     return randomBytes(4).toString("hex");
@@ -19,8 +35,20 @@ export function extractPromptNonce(prompt) {
 export function gateExitTrailer(nonce) {
     return `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
 }
+// v1.64: scripted fake judge verdicts predate the required per-criterion evidence field — quote the
+// first line of the prompt's own diff block into rows lacking one so zero-token fixtures keep their
+// outcomes. Rows scripting an explicit evidence value pass through verbatim (tests exercise both paths).
+function injectFakeEvidence(obj, prompt) {
+    if (!prompt.startsWith("TICKMARKR-JUDGE") || !Array.isArray(obj.criteria))
+        return obj;
+    const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((l) => l.trim());
+    if (!line)
+        return obj;
+    const criteria = obj.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row);
+    return { ...obj, criteria };
+}
 // ponytail: fake adapter serves static verdict JSON without nonce; append a bound copy for zero-token tests.
-export function augmentFakeVerdictOutput(adapter, out, nonce) {
+export function augmentFakeVerdictOutput(adapter, out, nonce, prompt = "") {
     if (adapter.id !== "fake")
         return out;
     const obj = extractJson(out);
@@ -28,7 +56,7 @@ export function augmentFakeVerdictOutput(adapter, out, nonce) {
         return out;
     if (typeof obj.nonce === "string")
         return out;
-    return `${out}\n${JSON.stringify({ ...obj, nonce })}`;
+    return `${out}\n${JSON.stringify(injectFakeEvidence({ ...obj, nonce }, prompt))}`;
 }
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export function gatePaneName(role, taskId, suffix = "") {
@@ -61,7 +89,7 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
     const nonce = extractPromptNonce(prompt);
     let out = r.stdout + "\n" + r.stderr;
     if (nonce)
-        out = augmentFakeVerdictOutput(adapter, out, nonce);
+        out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
@@ -88,7 +116,7 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     let out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);
-    out = augmentFakeVerdictOutput(adapter, out, nonce);
+    out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
 export function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {

package/dist/gates/review.js

@@ -4,7 +4,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
-import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
@@ -82,6 +82,8 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
 
+${COMPLETION_FAKING_CHECKLIST}
+
 ## Task ${task.id}: ${task.title} (complexity ${task.complexity})
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}

package/dist/run/consult.js

@@ -4,6 +4,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { augmentFakeVerdictOutput, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { sh } from "./git.js";
+import { redactSecrets } from "./redact.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
 function guidanceParts(text) {
     return text.split(/\n+/).flatMap((line) => line.split(/(?<=[.!?])\s+/)).map((s) => s.trim()).filter(Boolean);
@@ -100,7 +101,9 @@ opts = {}) {
     const dir = join(runDir, "consults");
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
-    writeFileSync(promptFile, buildDossierPrompt(d, nonce));
+    // T3 secret redaction: the persisted dossier artifact (transcript/diff/journal tail — also what the
+    // consult model reads) is masked at this seam; the in-memory Dossier stays untouched.
+    writeFileSync(promptFile, redactSecrets(buildDossierPrompt(d, nonce)));
     // One seat = the WHOLE invoke-and-parse unit, both visibility branches (OBS-69 class: a headless-only
     // failover would leave the production pane path hard-failing on seat one). null = no parseable verdict.
     const invokeSeat = async (seatAdapter, seatModel, seatIdx) => {

package/dist/run/daemon.js

@@ -11,7 +11,7 @@ import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
-import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
+import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
@@ -259,12 +259,21 @@ export async function runDaemon(repoRoot, opts = {}) {
             prior?.append("superseded", undefined, { by: runId });
             for (const warning of baseline.warnings ?? [])
                 journal.append("baseline-warning", undefined, { ...warning });
+            // Tier A #3: run each task's command-typed acceptance oracles against the pristine baseline —
+            // one that already exits 0 verifies nothing. Warning only, taskId-stamped; never a gate input.
+            for (const w of await detectVacuousOracles(repoRoot, graph.tasks))
+                journal.append("baseline-warning", w.taskId, { ...w });
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
         // a failed-to-open or later-dead watch pane never affects the run.
+        // OBS-103: hold the returned slot — narrator() adopts an already-open watch by its owned name
+        // (a prior daemon instance's, after a stop→resume cycle), so the run-end sweep below can retire
+        // it regardless of which instance split the pane.
+        const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
+        let watchSlot;
         try {
-            await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
+            watchSlot = await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
         }
         catch {
             /* cosmetic-only — the run proceeds without a live surface */
@@ -293,7 +302,22 @@ export async function runDaemon(repoRoot, opts = {}) {
             if (keepForever)
                 return;
             try {
-                await driver.reconcile?.(desiredPanes(journal.read(), runId), runId, opts);
+                const desired = desiredPanes(journal.read(), runId);
+                // The watch pane is never the DRIVER sweep's candidate (panesToClose spares role "watch":
+                // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
+                // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
+                // decided here from the fold alone.
+                await driver.reconcile?.(new Set([...desired, watchName]), runId, opts);
+                // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
+                // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
+                // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
+                // closes exactly like one this instance opened. A narrator carrying a non-canonical name
+                // (no run identity) is never this run's to sweep.
+                if (watchSlot && watchSlot.name === watchName && !desired.has(watchName)) {
+                    const w = watchSlot;
+                    watchSlot = undefined;
+                    await driver.close(w);
+                }
             }
             catch {
                 /* cosmetic — visibility is never a gate */

package/dist/run/journal.js

@@ -5,6 +5,7 @@ import { channelKey, TokenUsageSchema } from "../adapters/types.js";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 import { TIERS } from "../graph/schema.js";
 import { buildProfile } from "../route/profile.js";
+import { redactSecrets } from "./redact.js";
 export function formatJournalNarration({ event, taskId, data }) {
     const assignment = data.assignment;
     const direct = [data.summary, data.reason, data.error, data.step, data.action, data.lint, data.branch, data.from]
@@ -311,9 +312,12 @@ export class Journal {
     }
     append(event, taskId, data = {}) {
         const row = { ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data };
-        appendFileSync(this.journalPath, JSON.stringify(row) + "\n");
+        // T3 secret redaction: only the persisted bytes are masked — the caller's data stays untouched in
+        // memory. The narrator receives the persisted (masked) row so a pane sink never shows a credential.
+        const line = redactSecrets(JSON.stringify(row));
+        appendFileSync(this.journalPath, line + "\n");
         try {
-            this.narrate?.(row);
+            this.narrate?.(JSON.parse(line));
         }
         catch {
             // narration is observational; a broken sink must not affect the journal or run
@@ -421,7 +425,8 @@ export class Journal {
         return m;
     }
     telemetry(row) {
-        appendFileSync(join(this.dir, "telemetry.jsonl"), JSON.stringify(row) + "\n");
+        // T3 secret redaction: same persistence seam as append — credential-free rows are byte-identical.
+        appendFileSync(join(this.dir, "telemetry.jsonl"), redactSecrets(JSON.stringify(row)) + "\n");
     }
     // Per-run, raw (NOT schema-validated) — report.ts reads v1.5 core fields; stays byte-compatible.
     readTelemetry() {

package/dist/run/reconcile.js

@@ -87,8 +87,10 @@ export function desiredPanes(rows, runId) {
                 clearTask(row.taskId);
                 break;
             case "run-end":
+                // OBS-103: run-end retires EVERY run-tagged pane, the watch narrator included. The fold
+                // keys on the run identity in the pane name, so a narrator a prior daemon instance opened
+                // (stop→resume cycle) retires all the same; a later run-resume re-desires it above.
                 desired.clear();
-                desired.add(formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }));
                 break;
         }
     }

package/dist/run/redact.d.ts

@@ -0,0 +1,2 @@
+export declare const MASK = "[REDACTED]";
+export declare function redactSecrets(text: string): string;

package/dist/run/redact.js

@@ -0,0 +1,53 @@
+// T3 (repo-scan Tier A #2): the shared secret-redaction pass for captured agent text at the
+// persistence seams. Every seam that persists captured agent text routes its bytes through
+// redactSecrets before hitting disk — journal event payloads and telemetry rows (journal.ts) and
+// consult dossier artifacts (consult.ts). In-memory originals are never touched: redaction applies
+// to the serialized bytes only, at the write site.
+//
+// Two shape families:
+//   - vendor keys: recognizable prefix + high-entropy body. The prefix survives masking so the
+//     credential class stays identifiable; the body never persists.
+//   - secret assignments: KEY=value / "key": "value" where the key NAME announces a secret. The key
+//     survives; the value is masked.
+// Text with no credential shapes passes through byte-identical. Masks contain no quote or backslash
+// and value charsets never cross a JSON string boundary, so redacting a serialized JSON line always
+// yields a line that still parses.
+export const MASK = "[REDACTED]";
+// Order matters: more specific prefixes (sk-ant-, sk-proj-) before the generic sk- form.
+const VENDOR_KEY_RES = [
+    /\b(sk-ant-)[A-Za-z0-9_-]{8,}/g, // Anthropic
+    /\b(sk-proj-)[A-Za-z0-9_-]{8,}/g, // OpenAI project key
+    /\b(sk-)[A-Za-z0-9_-]{16,}/g, // OpenAI classic / sk-prefixed secret keys
+    /\b(github_pat_)[A-Za-z0-9_]{8,}/g, // GitHub fine-grained PAT
+    /\b(gh[pousr]_)[A-Za-z0-9]{16,}/g, // GitHub token family (ghp_/gho_/ghu_/ghs_/ghr_)
+    /\b(glpat-)[A-Za-z0-9_-]{8,}/g, // GitLab PAT
+    /\b(xox[baprs]-)[A-Za-z0-9-]{8,}/g, // Slack token family
+    /\b(npm_)[A-Za-z0-9]{16,}/g, // npm token
+    /\b(AKIA)[0-9A-Z]{16}\b/g, // AWS access key id
+    /\b(AIza)[0-9A-Za-z_-]{35}\b/g, // Google API key
+];
+// Key names that announce a secret. The optional quote after the key closes a JSON key ("apiKey": "…").
+// The match starts AT the keyword — chars before it (MY_ in MY_API_KEY=) are simply left in place by
+// replace, so anchoring on the keyword yields identical output while keeping the scan linear (a
+// leading [A-Za-z0-9_.-]* here backtracks quadratically on long tokens — seconds on a 50K blob, and
+// journal payloads carry parked diffs up to the diff cap).
+// The value charset excludes quotes/backslash (never crosses a JSON string boundary) and square
+// brackets (an already-masked value never re-matches ⇒ idempotent, and a vendor prefix kept by the
+// pass above survives). The letter lookahead skips purely numeric values ("maxTokens":30000000 is a
+// count, not a credential — and masking a bare JSON number would break the line's parse).
+// Quotes may arrive backslash-escaped (a transcript already serialized inside a JSON string), so the
+// optional opening/closing quote around key and value accepts \" as well as ".
+const ASSIGNMENT_RE = /((?:api[_-]?key|apikey|secret|token|passwd|password|credential|access[_-]?key)[A-Za-z0-9_.-]*(?:\\?["'])?\s*[=:]\s*(?:\\?["'])?)(?=[^\s"'`\\,;[\]]*[A-Za-z])([^\s"'`\\,;[\]]{8,})/gi;
+// Authorization headers are the most common credential shape in captured transcripts.
+const BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{16,}/g;
+// Cheap literal prescan: every pattern above needs one of these substrings, and most persisted text
+// (diffs, prose, telemetry) has none — those payloads skip all 12 regex passes in one linear scan.
+const HINT_RE = /sk-|github_pat_|gh[pousr]_|glpat-|xox[baprs]-|npm_|AKIA|AIza|Bearer|api[_-]?key|apikey|secret|token|passwd|password|credential|access[_-]?key/i;
+export function redactSecrets(text) {
+    if (!HINT_RE.test(text))
+        return text;
+    let out = text;
+    for (const re of VENDOR_KEY_RES)
+        out = out.replace(re, `$1${MASK}`);
+    return out.replace(ASSIGNMENT_RE, `$1${MASK}`).replace(BEARER_RE, `$1${MASK}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.63.0",
+  "version": "1.64.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",