wendkeep 0.66.5 → 0.67.0

package/hooks/operating-profile-runtime.mjs

@@ -3,6 +3,7 @@ import { resolve } from 'node:path';
 
 import {
   DEFAULT_OPERATING_PROFILE,
+  evaluateTaskOperatingProfileLease,
   normalizeOperatingProfile,
   operatingProfilePolicy,
   resolveOperatingProfile,
@@ -68,6 +69,22 @@ function sessionOverride(entry) {
   }
 }
 
+function nonNegativeSequence(value, fallback = null) {
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+
+function taskLeaseContext(entry, input, sessionId) {
+  return {
+    sessionId,
+    turnId: input?.turn_id || input?.turnId || entry?.last_prompt_turn_id || '',
+    turnSequence: nonNegativeSequence(
+      input?.turn_sequence ?? input?.turnSequence,
+      nonNegativeSequence(entry?.last_turn_sequence),
+    ),
+  };
+}
+
 function canonicalPath(value) {
   const path = resolve(value).replaceAll('\\', '/');
   return process.platform === 'win32' ? path.toLowerCase() : path;
@@ -105,7 +122,8 @@ function matchingProjectBinding(vaultResolution, input) {
   }
 }
 
-// Resolution precedence for hooks: explicit session override -> project binding -> GOVERN.
+// Resolution precedence for hooks: active request lease -> explicit session override
+// -> project binding -> GOVERN.
 // Binding corruption is never interpreted as OFF: an authoritative Vault keeps the Keep Core
 // alive under GOVERN and carries a visible diagnostic to each entrypoint.
 export function resolveHookOperatingProfile({
@@ -134,7 +152,20 @@ export function resolveHookOperatingProfile({
   const entry = identity.state === 'resolved'
     ? readSessionRegistry(vaultResolution.base).sessions?.[identity.canonicalConversationId] || null
     : null;
-  const selected = sessionOverride(entry) || project;
+  const base = sessionOverride(entry) || project;
+  const taskLease = evaluateTaskOperatingProfileLease(
+    entry?.operating_profile_task,
+    taskLeaseContext(entry, input, identity.canonicalConversationId || ''),
+  );
+  const selected = taskLease.state === 'active'
+    ? {
+      profile: taskLease.profile,
+      source: 'task-lease',
+      valid: true,
+      configured: true,
+      raw: taskLease.profile,
+    }
+    : base;
   return {
     ...selected,
     policy: operatingProfilePolicy(selected.profile),
@@ -142,6 +173,9 @@ export function resolveHookOperatingProfile({
     projectRoot: vaultResolution.projectRoot,
     identity,
     entry,
+    baseProfile: base.profile,
+    baseSource: base.source,
+    taskLease,
     resolution: vaultResolution,
     ...(bindingError ? { bindingError } : {}),
   };

package/hooks/operating-profile-task-store.mjs

@@ -0,0 +1,77 @@
+import { randomUUID } from 'node:crypto';
+
+import {
+  createTaskOperatingProfileLease,
+} from '../src/operating-profile.mjs';
+import { mutateSessionRegistry } from './obsidian-common.mjs';
+
+function isoTimestamp(now) {
+  if (typeof now === 'string') return now;
+  if (now instanceof Date) return now.toISOString();
+  return new Date().toISOString();
+}
+
+function missingSessionError(sessionId) {
+  const error = new Error(`sessão não encontrada: ${sessionId}`);
+  error.code = 'WENDKEEP_SESSION_NOT_FOUND';
+  return error;
+}
+
+export function setSessionTaskOperatingProfile(vaultBase, sessionId, profile, {
+  reason,
+  leaseId = randomUUID(),
+  now,
+} = {}) {
+  const issuedAt = isoTimestamp(now);
+  return mutateSessionRegistry(vaultBase, (registry) => {
+    const sessions = registry.sessions || (registry.sessions = {});
+    if (!Object.hasOwn(sessions, sessionId)) throw missingSessionError(sessionId);
+    const current = sessions[sessionId];
+    const turnId = typeof current.last_prompt_turn_id === 'string'
+      ? current.last_prompt_turn_id.trim()
+      : '';
+    const hasRegisteredTurn = Boolean(
+      turnId
+      && current.turn_sequences
+      && Object.hasOwn(current.turn_sequences, turnId)
+      && current.turn_sequences[turnId] === current.last_turn_sequence
+    );
+    const lease = createTaskOperatingProfileLease({
+      profile,
+      reason,
+      sessionId,
+      turnId,
+      turnSequence: hasRegisteredTurn ? current.last_turn_sequence : undefined,
+      leaseId,
+      issuedAt,
+    });
+    sessions[sessionId] = {
+      ...current,
+      operating_profile_task: lease,
+      updated_at: issuedAt,
+    };
+    return lease;
+  });
+}
+
+export function consumeSessionTaskOperatingProfile(vaultBase, sessionId, leaseId, {
+  now,
+} = {}) {
+  if (!sessionId || !leaseId) return false;
+  const consumedAt = isoTimestamp(now);
+  return mutateSessionRegistry(vaultBase, (registry) => {
+    const current = registry.sessions?.[sessionId];
+    const lease = current?.operating_profile_task;
+    if (!lease || lease.state !== 'active' || lease.lease_id !== leaseId) return false;
+    registry.sessions[sessionId] = {
+      ...current,
+      operating_profile_task: {
+        ...lease,
+        state: 'consumed',
+        consumed_at: consumedAt,
+      },
+      updated_at: consumedAt,
+    };
+    return true;
+  });
+}

package/hooks/session-stop.mjs

@@ -33,6 +33,7 @@ import {
   parseTranscriptContent,
   resolveTurnIdentity,
 } from '../packages/integrations/src/transcripts.mjs';
+import { sanitizeAssistantMessage } from '../packages/integrations/src/prompt-content.mjs';
 export { resolveTurnIdentity };
 import {
   ensureDir,
@@ -213,6 +214,13 @@ function escapeMarkdownBackticks(text) {
   return escaped;
 }
 
+function escapeMarkdownHtmlTags(text) {
+  return String(text || '').replace(
+    /<(\/?[\p{L}][\p{L}\p{N}_.-]*)(?=[\s/>])([^<>\n]*)>/gu,
+    '&lt;$1$2&gt;',
+  );
+}
+
 function compactText(text, max = 600) {
   const clean = redactSecrets(String(text || ''))
     .replace(/\r/g, '\n')
@@ -223,7 +231,8 @@ function compactText(text, max = 600) {
   const clipped = truncate(source, max);
   // Um corte no meio de código inline/fence pode casar com backticks da próxima
   // entrada gerada. Só snippets realmente truncados perdem a formatação incompleta.
-  return compact.length > max ? escapeMarkdownBackticks(clipped) : clipped;
+  const markdownSafe = compact.length > max ? escapeMarkdownBackticks(clipped) : clipped;
+  return escapeMarkdownHtmlTags(markdownSafe);
 }
 
 function selectTurn(tx, turnId) {
@@ -235,6 +244,11 @@ function selectTurn(tx, turnId) {
 
 function formatConversation(turn) {
   const entries = (turn.conversation || [])
+    .map((entry) => (
+      entry.role === 'Assistente'
+        ? { ...entry, text: sanitizeAssistantMessage(entry.text) }
+        : entry
+    ))
     .filter((entry) => entry.text && !shouldIgnoreUserText(entry.text));
   if (!entries.length) return '- Nenhuma mensagem útil capturada no transcript.';
 
@@ -304,7 +318,9 @@ export function buildIterationBlock(tx, input) {
   const now = Number.isFinite(parsedDate.getTime()) ? parsedDate : new Date();
   const promptText = turn.userPrompts.at(-1) || tx.latestUserPrompt || '';
   const latestAssistant = turn.assistantMessages.at(-1) || tx.latestAssistantMessage || '';
-  const heading = truncate(promptText.replace(/[\r\n#]+/g, ' ').replace(/\s+/g, ' ').trim() || 'Iteração', 80);
+  const heading = escapeMarkdownHtmlTags(
+    truncate(promptText.replace(/[\r\n#]+/g, ' ').replace(/\s+/g, ' ').trim() || 'Iteração', 80),
+  );
   const files = [...new Set([...(turn.consultedFiles || []), ...(turn.changedFiles || [])])];
   const model = turn.model || tx.model || '';
 
@@ -325,7 +341,7 @@ ${formatConversation(turn)}
 
 **Arquivos detectados no turno:** ${formatInlineList(files, 'Nenhum arquivo detectado automaticamente.')}
 
-**Estado ao final do turno:** ${compactText(latestAssistant || 'Checkpoint registrado automaticamente ao final do turno.', 900)}
+**Estado ao final do turno:** ${compactText(sanitizeAssistantMessage(latestAssistant) || 'Checkpoint registrado automaticamente ao final do turno.', 900)}
 `;
 }
 
@@ -649,6 +665,104 @@ function replaceClosingSection(content, closing) {
   return `${content.slice(0, index).trimEnd()}\n\n${closing}\n`;
 }
 
+const GENERATED_ITERATION_LINE_RULES = [
+  { pattern: /^(### \d{2}:\d{2} - )(.*)$/u, assistant: false },
+  { pattern: /^(\*\*Pedido:\*\* )(.*)$/u, assistant: false },
+  { pattern: /^(- \*\*Usuário:\*\* )(.*)$/u, assistant: false },
+  { pattern: /^(- \*\*Assistente:\*\* )(.*)$/u, assistant: true },
+  { pattern: /^(- \*\*Resumo:\*\* )(.*)$/u, assistant: true },
+  { pattern: /^(\*\*Estado ao final do turno:\*\* )(.*)$/u, assistant: true },
+];
+const GENERATED_CLOSING_LINE_RULES = [
+  { pattern: /^(- \*\*Resumo final:\*\* )(.*)$/u, assistant: true },
+];
+
+function generatedSessionLine(line, rules) {
+  for (const rule of rules) {
+    const match = rule.pattern.exec(line);
+    if (match) return { ...rule, prefix: match[1], value: match[2] };
+  }
+  return null;
+}
+
+function splitSessionMarkdownLines(source) {
+  const lines = [];
+  let cursor = 0;
+  while (cursor < source.length) {
+    const newline = source.indexOf('\n', cursor);
+    if (newline === -1) {
+      lines.push({ text: source.slice(cursor), eol: '' });
+      break;
+    }
+    const textEnd = source[newline - 1] === '\r' ? newline - 1 : newline;
+    lines.push({ text: source.slice(cursor, textEnd), eol: source.slice(textEnd, newline + 1) });
+    cursor = newline + 1;
+  }
+  return lines;
+}
+
+function generatedMetadataContinuation(line, mode = '') {
+  const clean = line.trim();
+  if (!clean) return null;
+  if (/^<\/?session\s*>/i.test(clean)) return mode;
+  if (/^<\/?(?:oai-mem-citation|citation_entries|rollout_ids)\b/i.test(clean)) {
+    const nested = [...clean.matchAll(/<(citation_entries|rollout_ids)\b[^>]*>/gi)].at(-1);
+    return nested ? nested[1].toLowerCase() : mode;
+  }
+  if (mode === 'citation_entries' && (
+    /\|note=\[[^\]]*\]\s*$/i.test(clean)
+      || /^[^\s<>]+:\d+(?:-\d+)?(?:\|[^\s].*)?$/i.test(clean)
+  )) return mode;
+  if (mode === 'rollout_ids' && /^(?:[0-9a-f]{8,}(?:-[0-9a-f-]+)*|019f-[A-Za-z0-9_-]+)$/i.test(clean)) {
+    return mode;
+  }
+  return null;
+}
+
+export function sanitizeGeneratedSessionMarkdown(content) {
+  const lines = splitSessionMarkdownLines(String(content || ''));
+  let section = '';
+  let output = '';
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (/^## /u.test(line.text)) {
+      section = line.text === '## Iterações'
+        ? 'iterations'
+        : (line.text === '## Encerramento' ? 'closing' : '');
+      output += `${line.text}${line.eol}`;
+      continue;
+    }
+
+    const rules = section === 'iterations'
+      ? GENERATED_ITERATION_LINE_RULES
+      : (section === 'closing' ? GENERATED_CLOSING_LINE_RULES : []);
+    const generated = generatedSessionLine(line.text, rules);
+    if (!generated) {
+      output += `${line.text}${line.eol}`;
+      continue;
+    }
+
+    let value = generated.value;
+    let last = index;
+    let mode = '';
+    if (generated.assistant) {
+      for (let next = index + 1; next < lines.length; next += 1) {
+        const nextMode = generatedMetadataContinuation(lines[next].text, mode);
+        if (nextMode === null) break;
+        value += `${lines[last].eol}${lines[next].text}`;
+        last = next;
+        mode = nextMode;
+      }
+      value = sanitizeAssistantMessage(value);
+    }
+
+    output += `${generated.prefix}${escapeMarkdownHtmlTags(value)}${lines[last].eol}`;
+    index = last;
+  }
+  return output;
+}
+
 export function finalizeSessionFile(sessionPath, tx, created, endedAt, vaultBase = '') {
   const pending = extractPending(tx.rawTextForDetection);
   const links = (items) => items.length ? items.map((rel) => `  - ${wikilinkFromRel(rel)}`).join('\n') : '  - Nenhuma';
@@ -673,7 +787,7 @@ ${formatPendingClosing(pending)}
     // As três seções derivadas saem do MESMO `created` que monta o Encerramento — antes
     // elas ficavam de fora deste write e a nota mentia no corpo (ver hooks/derived-sections.mjs).
     applyDerivedSections(
-      replacePendingSection(updateFrontmatter(content, endedAt), pending),
+      replacePendingSection(updateFrontmatter(sanitizeGeneratedSessionMarkdown(content), endedAt), pending),
       created,
     ),
     closing,
@@ -681,8 +795,9 @@ ${formatPendingClosing(pending)}
 }
 
 export function sessionFinalSummary(tx) {
-  return tx.latestAssistantMessage
-    ? truncate(tx.latestAssistantMessage, 500)
+  const assistantSummary = sanitizeAssistantMessage(tx.latestAssistantMessage);
+  return assistantSummary
+    ? compactText(assistantSummary, 500)
     : `Sessão encerrada com ${tx.userPrompts.length} prompts e ${tx.tools.length} ferramentas registradas.`;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.66.5",
+  "version": "0.67.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -40,7 +40,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "check": "node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
+    "check": "node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
     "release": "node scripts/release.mjs",
     "release:dry": "node scripts/release.mjs --dry-run",
@@ -70,6 +70,6 @@
   },
   "devDependencies": {
     "acorn": "^8.18.0",
-    "wendkeep": "^0.57.2"
+    "wendkeep": "^0.66.5"
   }
 }

package/packages/harness/src/operating-profile.mjs

@@ -6,8 +6,16 @@ export const OPERATING_PROFILES = Object.freeze([
   'ASSURE',
 ]);
 export const DEFAULT_OPERATING_PROFILE = 'GOVERN';
+export const ADAPTIVE_OPERATING_PROFILES = Object.freeze([
+  'FLOW',
+  'GUIDE',
+  'GOVERN',
+  'ASSURE',
+]);
 
 const PROFILE_SET = new Set(OPERATING_PROFILES);
+const ADAPTIVE_PROFILE_SET = new Set(ADAPTIVE_OPERATING_PROFILES);
+export const TASK_PROFILE_REASON_MAX_LENGTH = 500;
 
 function policy(profile, route, options) {
   return Object.freeze({
@@ -70,6 +78,125 @@ function canonicalProfile(value) {
   return value.trim().toUpperCase();
 }
 
+function taskProfileError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function taskProfile(value) {
+  const profile = canonicalProfile(value);
+  if (ADAPTIVE_PROFILE_SET.has(profile)) return profile;
+  throw taskProfileError(
+    'WENDKEEP_TASK_PROFILE_INVALID',
+    `Perfil temporário inválido: ${typeof value === 'string' ? `"${value}"` : String(value)}. `
+      + `Use ${ADAPTIVE_OPERATING_PROFILES.join(', ')}; OFF exige seleção humana persistente.`,
+  );
+}
+
+function taskReason(value) {
+  const reason = typeof value === 'string' ? value.trim() : '';
+  if (reason && reason.length <= TASK_PROFILE_REASON_MAX_LENGTH) return reason;
+  throw taskProfileError(
+    'WENDKEEP_TASK_PROFILE_REASON_INVALID',
+    `Motivo da rota temporária deve ter entre 1 e ${TASK_PROFILE_REASON_MAX_LENGTH} caracteres.`,
+  );
+}
+
+function taskSequence(value) {
+  const sequence = Number(value);
+  return Number.isSafeInteger(sequence) && sequence > 0 ? sequence : null;
+}
+
+function taskContextError() {
+  return taskProfileError(
+    'WENDKEEP_TASK_PROFILE_CONTEXT_INVALID',
+    'Rota temporária exige sessão, prompt causal, lease id e timestamp válidos.',
+  );
+}
+
+export function createTaskOperatingProfileLease({
+  profile,
+  reason,
+  sessionId,
+  turnId = '',
+  turnSequence,
+  leaseId,
+  issuedAt,
+} = {}) {
+  const selected = taskProfile(profile);
+  const auditedReason = taskReason(reason);
+  const session = typeof sessionId === 'string' ? sessionId.trim() : '';
+  const requestTurnId = typeof turnId === 'string' ? turnId.trim() : '';
+  const sequence = taskSequence(turnSequence);
+  const id = typeof leaseId === 'string' ? leaseId.trim() : '';
+  const issued = typeof issuedAt === 'string' ? issuedAt.trim() : '';
+  if (!session || !requestTurnId || sequence === null || !id || !issued || !Number.isFinite(Date.parse(issued))) {
+    throw taskContextError();
+  }
+  return {
+    lease_id: id,
+    state: 'active',
+    profile: selected,
+    requested_by: 'llm-harness',
+    reason: auditedReason,
+    session_id: session,
+    request_turn_id: requestTurnId,
+    request_turn_sequence: sequence,
+    issued_at: issued,
+    expires_on: 'request-stop',
+  };
+}
+
+export function evaluateTaskOperatingProfileLease(lease, {
+  sessionId = '',
+  turnId = '',
+  turnSequence,
+} = {}) {
+  if (lease === undefined || lease === null) return { state: 'absent' };
+  if (!lease || typeof lease !== 'object' || Array.isArray(lease)) return { state: 'invalid' };
+
+  let normalized;
+  try {
+    normalized = createTaskOperatingProfileLease({
+      profile: lease.profile,
+      reason: lease.reason,
+      sessionId: lease.session_id,
+      turnId: lease.request_turn_id,
+      turnSequence: lease.request_turn_sequence,
+      leaseId: lease.lease_id,
+      issuedAt: lease.issued_at,
+    });
+  } catch {
+    return {
+      state: 'invalid',
+      ...(typeof lease.lease_id === 'string' && lease.lease_id ? { lease_id: lease.lease_id } : {}),
+    };
+  }
+  if (lease.requested_by !== 'llm-harness' || lease.expires_on !== 'request-stop') {
+    return { state: 'invalid', lease_id: normalized.lease_id };
+  }
+  if (lease.state === 'consumed' || lease.state === 'expired') {
+    return { ...lease, ...normalized, state: lease.state };
+  }
+  if (lease.state !== 'active') return { state: 'invalid', lease_id: normalized.lease_id };
+
+  const currentSession = typeof sessionId === 'string' ? sessionId.trim() : '';
+  const currentTurnId = typeof turnId === 'string' ? turnId.trim() : '';
+  const currentSequence = taskSequence(turnSequence);
+  if (!currentSession || !currentTurnId || currentSequence === null) {
+    return { ...normalized, state: 'invalid' };
+  }
+  if (normalized.session_id !== currentSession) {
+    return { ...normalized, state: 'invalid' };
+  }
+  const turnIdMismatch = normalized.request_turn_id !== currentTurnId;
+  if (turnIdMismatch || normalized.request_turn_sequence !== currentSequence) {
+    return { ...normalized, state: 'expired' };
+  }
+  return normalized;
+}
+
 export function normalizeOperatingProfile(value, { strict = false } = {}) {
   const normalized = canonicalProfile(value);
   if (PROFILE_SET.has(normalized)) return normalized;

package/packages/harness/src/sensors-core.mjs

@@ -6,6 +6,38 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 
 export const SENSOR_VAULT_ENV = 'WENDKEEP_SENSOR_VAULT';
+const SENSOR_OUTPUT_MAX_BUFFER = 8 * 1024 * 1024;
+const SENSOR_DIAGNOSTIC_MAX_LENGTH = 2000;
+
+function sanitizeSensorDiagnostic(value) {
+  return String(value || '')
+    .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/\b(gh[pousr]_[A-Za-z0-9_]{12,})\b/g, '[REDACTED_SECRET]')
+    .replace(/\b(sk-[A-Za-z0-9_-]{12,})\b/g, '[REDACTED_SECRET]')
+    .replace(/\b(whsec_[A-Za-z0-9_/-]{8,})\b/g, '[REDACTED_SECRET]')
+    .replace(/\b(xox[baprs]-[A-Za-z0-9-]{12,})\b/g, '[REDACTED_SECRET]')
+    .replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY)[A-Z0-9_]*)\s*[:=]\s*["']?[^"'\s]+/gi, '$1=[REDACTED_SECRET]')
+    .replace(/:\/\/([^:\s/@]+):([^@\s/]+)@/g, '://[REDACTED_SECRET]@')
+    .replace(/\r/g, '')
+    .trim();
+}
+
+function sensorFailureNote(result = {}) {
+  const status = result.status ?? 'null';
+  const header = [
+    `exit=${status}`,
+    ...(result.signal ? [`signal=${result.signal}`] : []),
+  ].join(' ');
+  const detail = sanitizeSensorDiagnostic([
+    result.error?.message,
+    result.stdout,
+    result.stderr,
+  ].filter(Boolean).join('\n'));
+  if (!detail) return header;
+  const room = SENSOR_DIAGNOSTIC_MAX_LENGTH - header.length - 1;
+  const bounded = detail.length > room ? `…${detail.slice(-(room - 1))}` : detail;
+  return `${header}\n${bounded}`;
+}
 
 export function sensorProcessEnv(vaultBase, inherited = process.env) {
   return {
@@ -59,8 +91,16 @@ export function runSensors(sensors, ids, { spawn = spawnSync, cwd, env, now } =
   for (const id of ids) {
     const s = byId[id];
     if (!s) { evidence.push({ id, status: 'red', ts, severity: 'critical', note: 'sensor não definido' }); continue; }
-    const r = spawn(s.command, [], { cwd, shell: true, stdio: 'ignore', ...(env ? { env } : {}) });
+    const r = spawn(s.command, [], {
+      cwd,
+      shell: true,
+      encoding: 'utf8',
+      maxBuffer: SENSOR_OUTPUT_MAX_BUFFER,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      ...(env ? { env } : {}),
+    });
     const entry = { id, status: (r.status ?? 1) === 0 ? 'green' : 'red', ts, severity: s.severity || 'critical' };
+    if (entry.status === 'red') entry.note = sensorFailureNote(r);
     if (s.type === 'mutation' && s.report) {
       // Delegated mutation (Wave B): read the tool's mutation-testing-elements report and
       // attach surviving mutants so verify can turn them into fix tasks.