feat(notices): redact notice content with flare-redact instead of hand-rolled patterns

Per maintainer direction the secret pass is an npm library, not custom code:
flare-redact@1.6.1 (MIT, zero deps, browser-safe root entry) becomes an
exact-pinned runtime dependency; the ledger runs its default detectors and
credential-shaped member names with every finding replaced whole by
[REDACTED]. The hand-rolled pattern/key sources, isSecretKey, and the
cross-package parity test are removed; credentials.ts and redactProbeText
return to main. README records the evaluated libraries.

Author: ScriptedAlchemy

.changeset/99-notice-redaction-retention.md

@@ -3,4 +3,4 @@
 "agent-bundle": minor
 ---
 
-Close out #99 acceptance item 7 with a notice redaction contract and a retention policy. `notices.publish()` accepts `sensitivity: 'public' | 'internal' | 'secret'` (default `internal`); each host's `noticeDelivery` row may name a dated `sensitivity` ceiling, and the ledger, inbox resource (`agent-bundle://notices/inbox`, which now reports `sensitivity` and `disclosure`), event admission, and `resources/updated` signaller withhold a notice above the route's ceiling, recording the refusal as `withheld[route]` on the notice; `internal` content is secret-pattern redacted on every route (`redactSecretText`, `redactNoticeDocument`, `resolveNoticeDisclosure`, `AGENT_NOTICE_ROUTE_SHAPES` from `@agent-bundle/runtime/notices`). `notices.retention: { terminalTtl, maxTerminal, maxJournalBytes }` in `agent-bundle.config.ts` (validated as `AB4833`, shown by `inspect --state` and the Workbench State panel) prunes settled terminal notices on admitted events and compacts the ledger journal past its byte bound through the new `AgentNoticeLedger.retain()` / `inspect()` and the state kernel's `AgentStateStore.compact()` / `inspect()` (a `compact` journal record and `AgentStateChange` kind; a compacted SQLite store moves to kernel format 2). Built-in hosts admit `secret` on `current-response` / `next-event` and `internal` on `mcp-inbox` / `mcp-resource-updated` (adapter revisions bumped). Breaking: `AgentStateStore` implementations must add `compact()` and `inspect()`, `AgentNoticeLedger` gains `retain()` / `inspect()`, `AgentNoticeDelivery` gains `disclosure`, and `AgentStateChange` / `AgentStateJournalRecord` gain the `compact` kind. The aliased `mcp-server-runtime.d.ts` no longer imports from `@agent-bundle/runtime/notices` (`GeneratedNoticeDeliveryBinding` is spelled locally). (#437)
+Close out #99 acceptance item 7 with a notice redaction contract and a retention policy. `notices.publish()` accepts `sensitivity: 'public' | 'internal' | 'secret'` (default `internal`); each host's `noticeDelivery` row may name a dated `sensitivity` ceiling, and the ledger, inbox resource (`agent-bundle://notices/inbox`, which now reports `sensitivity` and `disclosure`), event admission, and `resources/updated` signaller withhold a notice above the route's ceiling, recording the refusal as `withheld[route]` on the notice; `internal` content is redacted on every route by `flare-redact@1.6.1`, a new exact-pinned runtime dependency of `@agent-bundle/runtime` (default detectors — provider tokens, JWTs, PEM keys, `Bearer`/`Basic` headers, URL credentials, credential assignments, e-mail addresses, cards — plus credential-shaped member names, every finding replaced whole by `[REDACTED]`; `redactSecretText`, `redactNoticeDocument`, `containsSecretText`, `resolveNoticeDisclosure`, `AGENT_NOTICE_ROUTE_SHAPES` from `@agent-bundle/runtime/notices`). `notices.retention: { terminalTtl, maxTerminal, maxJournalBytes }` in `agent-bundle.config.ts` (validated as `AB4833`, shown by `inspect --state` and the Workbench State panel) prunes settled terminal notices on admitted events and compacts the ledger journal past its byte bound through the new `AgentNoticeLedger.retain()` / `inspect()` and the state kernel's `AgentStateStore.compact()` / `inspect()` (a `compact` journal record and `AgentStateChange` kind; a compacted SQLite store moves to kernel format 2). Built-in hosts admit `secret` on `current-response` / `next-event` and `internal` on `mcp-inbox` / `mcp-resource-updated` (adapter revisions bumped). Breaking: `AgentStateStore` implementations must add `compact()` and `inspect()`, `AgentNoticeLedger` gains `retain()` / `inspect()`, `AgentNoticeDelivery` gains `disclosure`, and `AgentStateChange` / `AgentStateJournalRecord` gain the `compact` kind. The aliased `mcp-server-runtime.d.ts` no longer imports from `@agent-bundle/runtime/notices` (`GeneratedNoticeDeliveryBinding` is spelled locally). (#437)

docs/entry-conventions.md

@@ -195,8 +195,11 @@ notice whose author-declared `sensitivity` exceeds the ceiling of the route
 about to carry it — the inbox omits it, event admission neither authorizes nor
 attempts it, the signaller never announces it — recording the refusal on the
 notice (`withheld[route]`) instead of moving its state. `internal` content
-(the default) is passed through the runtime's secret-pattern redaction on
-every route before it leaves the store; `public` travels as authored;
+(the default) is passed through the runtime's secret pass on every route
+before it leaves the store — `flare-redact`, an exact-pinned dependency of
+`@agent-bundle/runtime`, with its default detectors and every finding replaced
+whole by `[REDACTED]`; the runtime README's notices section lists the coverage
+and the libraries evaluated — `public` travels as authored;
 `secret` travels as authored only where the row admits it. The built-in hosts
 admit `secret` on `current-response` and `next-event` and `internal` on
 `mcp-inbox` and `mcp-resource-updated`; the pinned tables carry the dated

docs/framework-mode.md

@@ -334,7 +334,8 @@ defaulted.
 Redaction is not configured here: it follows the notice's author-declared
 `sensitivity` (`public | internal | secret`, default `internal`, passed to
 `notices.publish()`) and each host's dated per-route ceiling in its pinned
-`noticeDelivery` table. `internal` content is secret-pattern redacted on every
+`noticeDelivery` table. `internal` content is passed through the runtime's
+secret pass (`flare-redact`, pinned exact; see the runtime README) on every
 route, `public` travels as authored, and `secret` travels only over a route
 whose ceiling admits it — otherwise it stays in the store and the route
 records the refusal on the notice.

packages/agent-bundle/src/adapters/notice-delivery.ts

@@ -21,7 +21,7 @@ export type NoticeDeliveryRoute = (typeof NOTICE_DELIVERY_ROUTES)[number];
 /**
  * Author-declared disclosure classes of a notice, mirroring the runtime's
  * `AgentNoticeSensitivity`: `public` is delivered as authored, `internal`
- * (the default) after the secret-pattern pass, `secret` only over a route
+ * (the default) after the runtime's secret pass, `secret` only over a route
  * whose row admits it.
  */
 export const NOTICE_SENSITIVITIES = Object.freeze(['public', 'internal', 'secret'] as const);

packages/agent-bundle/src/config/notice-retention.ts

@@ -15,7 +15,7 @@ import type {
  */
 
 // Kept independent of the optional runtime peer, like the state budgets in
-// `core/state-inspection.ts`; `notice-retention-parity.test.ts` compares these
+// `core/state-inspection.ts`; `notice-retention-config.test.ts` compares these
 // with `AGENT_NOTICE_DEFAULT_RETENTION` so the two boundaries cannot drift.
 export const noticeRetentionDefaults: NormalizedNoticeRetentionPolicy = Object.freeze({
   maxJournalBytes: 16 * 1024 * 1024,

packages/agent-bundle/src/core/credentials.ts

@@ -8,31 +8,22 @@
  *   detect or irreversibly remove credential *values* in arbitrary text.
  */
 
-/**
- * Sources of the key-name classifier. The notice ledger in
- * `@agent-bundle/runtime` (`notices/redaction.ts`, `NOTICE_SECRET_KEY_SOURCES`)
- * carries the same table for structured notice content; the parity test pins
- * them equal. Edit both together.
- */
-export const CREDENTIAL_KEY_SOURCES = Object.freeze({
-  compactSuffix: String.raw`(?:apikey|apitoken|authtoken|accesstoken)$`,
-  keywords: Object.freeze(['authorization', 'credential', 'credentials', 'password', 'secret', 'token']),
-  // The segment heuristic subsumes these today (every match contains a `token`
-  // segment or an apikey/apitoken/accesstoken suffix), but they stay explicit
-  // so the union survives future keyword-list edits.
-  provider: Object.freeze([
-    String.raw`(?:^|_)(?:API_KEY|API_TOKEN|ACCESS_TOKEN)$`,
-    String.raw`^(?:ANTHROPIC|AZURE_OPENAI|CODEX|COHERE|DEEPSEEK|FIREWORKS|GEMINI|GOOGLE|GROQ|HUGGINGFACE|MISTRAL|OPENAI|PERPLEXITY|TOGETHER|XAI)_(?:API_KEY|TOKEN)$`,
-  ]),
-});
-
-const credentialKeywords = CREDENTIAL_KEY_SOURCES.keywords;
+const credentialKeywords = Object.freeze([
+  'authorization',
+  'credential',
+  'credentials',
+  'password',
+  'secret',
+  'token',
+]);
 
-const compactSuffixPattern = new RegExp(CREDENTIAL_KEY_SOURCES.compactSuffix, 'u');
-
-const providerKeyPatterns = Object.freeze(
-  CREDENTIAL_KEY_SOURCES.provider.map((source) => new RegExp(source, 'iu')),
-);
+// The segment heuristic in isCredentialKey subsumes these today (every match
+// contains a `token` segment or an apikey/apitoken/accesstoken suffix), but
+// they stay explicit so the union survives future keyword-list edits.
+const providerKeyPatterns = Object.freeze([
+  /(?:^|_)(?:API_KEY|API_TOKEN|ACCESS_TOKEN)$/iu,
+  /^(?:ANTHROPIC|AZURE_OPENAI|CODEX|COHERE|DEEPSEEK|FIREWORKS|GEMINI|GOOGLE|GROQ|HUGGINGFACE|MISTRAL|OPENAI|PERPLEXITY|TOGETHER|XAI)_(?:API_KEY|TOKEN)$/iu,
+]);
 
 /**
  * Union key-name classifier: keyword segments (authorization, credential,
@@ -49,7 +40,7 @@ export const isCredentialKey = (key: string): boolean => {
     .filter((segment) => segment.length > 0);
   const compact = segments.join('');
   return segments.some((segment) => credentialKeywords.includes(segment))
-    || compactSuffixPattern.test(compact)
+    || /(?:apikey|apitoken|authtoken|accesstoken)$/u.test(compact)
     || providerKeyPatterns.some((pattern) => pattern.test(key));
 };
 
@@ -61,35 +52,11 @@ export const isCredentialKey = (key: string): boolean => {
 export const isProviderEndpointKey = (key: string): boolean =>
   /^(?:CODEX|OPENAI)_(?:API_BASE|BASE_URL|URL)$/iu.test(key);
 
-/**
- * Pattern sources of the free-text secret pass. The notice ledger in
- * `@agent-bundle/runtime` (`notices/redaction.ts`, `NOTICE_SECRET_PATTERN_SOURCES`)
- * carries the same three sources: the runtime is an optional peer of this
- * package, so neither side can import the other's module, and
- * `notice-redaction-parity.test.ts` pins them byte-identical instead. Edit
- * both together.
- */
-export const CREDENTIAL_TEXT_PATTERN_SOURCES = Object.freeze({
-  assignment: String.raw`((?:["']?)(?:api[-_ ]?key|api[-_ ]?token|access[-_ ]?token|authorization|credential|password|secret|token)(?:["']?)\s*[:=]\s*)("[^"\r\n]*"|'[^'\r\n]*'|[^\s,;\r\n]+)`,
-  provider: Object.freeze([
-    String.raw`\bsk-(?:proj-|ant-|live-)?[a-z0-9_-]{16,}\b`,
-    String.raw`\b(?:gh[pousr]_[a-z0-9]{20,}|github_pat_[a-z0-9_]{20,}|xox[baprs]-[a-z0-9-]{16,}|akia[a-z0-9]{16})\b`,
-    String.raw`\bbearer[ \t]+[a-z0-9._~+/=-]{20,}\b`,
-  ]),
-  /**
-   * URL userinfo (`scheme://user:secret@host`): the authority runs until one
-   * of the terminators every WHATWG scheme shares (`/`, `?`, `#`) and the
-   * match is greedy through the final `@`, so a raw `@`, quote, backslash, or
-   * whitespace inside a password cannot leave part of it behind. The scheme is
-   * anchored to the start of its own character run, so a URL glued to an
-   * identifier (`_https://user:secret@…`) is masked too.
-   */
-  urlUserinfo: String.raw`(?<![a-z0-9+.-])([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@`,
-});
-
-const providerCredentialPatterns = Object.freeze(
-  CREDENTIAL_TEXT_PATTERN_SOURCES.provider.map((source) => new RegExp(source, 'iu')),
-);
+const providerCredentialPatterns = Object.freeze([
+  /\bsk-(?:proj-|ant-|live-)?[a-z0-9_-]{16,}\b/iu,
+  /\b(?:gh[pousr]_[a-z0-9]{20,}|github_pat_[a-z0-9_]{20,}|xox[baprs]-[a-z0-9-]{16,}|akia[a-z0-9]{16})\b/iu,
+  /\bbearer[ \t]+[a-z0-9._~+/=-]{20,}\b/iu,
+]);
 
 // `String.prototype.replace` resets `lastIndex` on global regexes, so sharing these is safe.
 const globalProviderCredentialPatterns = Object.freeze(
@@ -100,24 +67,16 @@ const globalProviderCredentialPatterns = Object.freeze(
 export const containsProviderCredential = (value: string): boolean =>
   providerCredentialPatterns.some((pattern) => pattern.test(value));
 
-const credentialAssignmentPattern = new RegExp(CREDENTIAL_TEXT_PATTERN_SOURCES.assignment, 'giu');
+const credentialAssignmentPattern = /((?:["']?)(?:api[-_ ]?key|api[-_ ]?token|access[-_ ]?token|authorization|credential|password|secret|token)(?:["']?)\s*[:=]\s*)("[^"\r\n]*"|'[^'\r\n]*'|[^\s,;\r\n]+)/giu;
 
-/** Masks `scheme://user:secret@host` credentials; shared by the probe and Workbench log surfaces. */
-export const urlUserinfoPattern = new RegExp(CREDENTIAL_TEXT_PATTERN_SOURCES.urlUserinfo, 'giu');
-
-/**
- * Raw process output remains useful evidence after known credential material
- * is irreversibly removed. Provider forms go first: an unquoted
- * `authorization: Bearer <token>` would otherwise lose only the word `Bearer`
- * to the assignment pass and keep the token.
- */
+/** Raw process output remains useful evidence after known credential material is irreversibly removed. */
 export const redactCredentialText = (value: string): string => {
-  let redacted = value;
-  for (const pattern of globalProviderCredentialPatterns) {
-    redacted = redacted.replace(pattern, '[REDACTED]');
-  }
-  return redacted.replace(credentialAssignmentPattern, (_match, prefix: string, assigned: string) => {
+  let redacted = value.replace(credentialAssignmentPattern, (_match, prefix: string, assigned: string) => {
     const quote = assigned[0] === '"' || assigned[0] === "'" ? assigned[0] : '';
     return `${prefix}${quote}[REDACTED]${quote}`;
   });
+  for (const pattern of globalProviderCredentialPatterns) {
+    redacted = redacted.replace(pattern, '[REDACTED]');
+  }
+  return redacted;
 };

packages/agent-bundle/src/dev/playground/mcp-probe-service.ts

@@ -22,7 +22,7 @@ import type {
   McpProbeSnapshot,
   McpProbeTool,
 } from '../../contracts/mcp-probe.ts';
-import { redactCredentialText, urlUserinfoPattern } from '../../core/credentials.ts';
+import { redactCredentialText } from '../../core/credentials.ts';
 import { parseJsonWithoutDuplicateKeys } from '../../core/strict-json.ts';
 import { resolveBundleRoot } from '../../install/doctor.ts';
 import {
@@ -190,16 +190,30 @@ const hasAbsolutePath = (value: string): boolean =>
   localUriPathPattern.test(value) ||
   /(?:file:|(?:^|[\s"'([{=,]|:(?!\/\/))\/[^\s,;{}()[\]<>"']+|(?:^|[\s"'([{=,:])[A-Za-z]:[\\/]|\\\\)/u.test(value);
 
+/**
+ * URL userinfo (`scheme://user:secret@host`) is a credential that the generic
+ * credential redaction does not recognize; because URLs are exempt from the
+ * absolute-path fail-closed rule, the userinfo is stripped before that check.
+ * The authority runs until one of the terminators every WHATWG scheme shares
+ * (`/`, `?`, `#`); within it the match is greedy through the *final* `@`, the
+ * delimiter URL parsers honour, so a raw `@`, quote, backslash, or whitespace
+ * inside a password (parsers percent-encode spaces and strip embedded tabs and
+ * newlines) cannot leave part of the credential behind. Nothing short of those
+ * three terminators ends the run on purpose — `\` is userinfo for non-special
+ * schemes and whitespace is encoded rather than rejected — so a path-less URL
+ * followed on the same text by an `@` before any `/`, `?`, or `#` is masked
+ * as well: for a browser-facing report that over-redaction is the safe side.
+ * Like the local-URI rule, the scheme is anchored to the start of its own
+ * character run rather than to a word boundary, so a URL glued to a preceding
+ * identifier (`_https://user:secret@…`) is masked too.
+ */
+const urlUserinfoPattern = /(?<![a-z0-9+.-])([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@/giu;
+
 /**
  * Probe text follows the Dev Log browser-wire precedent without coupling this
  * read-only service to log retention: credential text is removed first, URL
- * userinfo (`scheme://user:secret@host`, a credential the assignment pass
- * does not recognize; because URLs are exempt from the absolute-path
- * fail-closed rule it is stripped before that check — the shared
- * `urlUserinfoPattern` documents its greedy-through-the-final-`@` rule and
- * the deliberate over-redaction of a path-less URL followed by an `@`) is
- * masked, bundle paths become a label, and every other absolute path fails
- * closed.
+ * userinfo is masked, bundle paths become a label, and every other absolute
+ * path fails closed.
  */
 const redactProbeText = (value: string, bundleRoot: string, maximum: number): string => {
   const redacted = redactCredentialText(value).replace(urlUserinfoPattern, '$1[REDACTED]@').replace(

packages/agent-bundle/tests/notice-redaction-parity.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from '@rstest/core';
 
+import { AGENT_NOTICE_DEFAULT_RETENTION } from '@agent-bundle/runtime/notices';
+
 import {
   normalizeNoticeRetention,
   noticeRetentionDefaults,
@@ -13,6 +15,13 @@ const config = (notices: unknown): AgentBundleConfig => ({
 } as AgentBundleConfig);
 
 describe('notices.retention config (AB4833)', () => {
+  it('keeps the static defaults equal to the runtime defaults', () => {
+    // `@agent-bundle/runtime` is an optional peer, so the compiler carries its
+    // own copy of the defaults; this pin fails the build the moment it drifts
+    // (the same discipline `inspect-state.test.ts` applies to the state budgets).
+    expect(noticeRetentionDefaults).toEqual(AGENT_NOTICE_DEFAULT_RETENTION);
+  });
+
   it('parses durations as positive integers of milliseconds or unit literals', () => {
     expect(parseNoticeRetentionDuration(1)).toBe(1);
     expect(parseNoticeRetentionDuration(86_400_000)).toBe(86_400_000);