diff --git a/CLAUDE.md b/CLAUDE.md
index eecdb848..78eed916 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -256,6 +256,7 @@ codeoid new <n> <d> --workstream <id> [--override]  # a session's home workstrea
 codeoid mcp signin <server> --credential <id>        # a named OAuth slot: a second sign-in to one server (a workstream's own)
 codeoid new <n> <d> --ref <workstream>[:<dir>]       # another workstream it may read (its folders read-only, its memory), by that one's share policy
 codeoid workstream ref add|rm <session> <workstream>[:<dir>] | move <session> <workstream>  # references and moves (§5.3, §7)
+codeoid secret ls | reveal <ws>:<fp> | forget <ws>:<fp> | promote <ws>:<fp> --as <id> | scrub [--dry-run]  # kept secrets; scrub older data (docs/secrets-and-memory-design.md)
 ```
 
 `/mcp/control` (off by default, `mcpControl.*`) lets external agents drive
@@ -573,6 +574,21 @@ queueing, `dispatch_tasks.workstream` judged again at claim; send-class cards
 carry `targetWorkstream` (`#fleetCardWorkstream`). `workstreams/egress.ts` is
 the egress stub.
 
+Secrets (`src/daemon/secrets/`, docs/secrets-and-memory-design.md §2): what a
+session stores, shows and hands on never holds a secret's value. `SecretService`
+(made only by `codeoid start`, `DaemonConfig.secretsConfigDir`; tests and
+embedders get none) holds `KnownSecrets` (exact values from every place codeoid
+keeps one, `addDaemonKnownSources`) → `‹credential:<label>›`, and the detector
+(`detect.ts`) → `‹secret:<kind>:<hmac8>›`. Applied in Session at
+`#persistAndBuffer`/`#commitStreamed` (`#scrubMessage`), tool_start
+(`#recordedToolInput`, by `verdict.ts`'s keep / withhold-output /
+withhold-written / drop) and tool_complete (before hooks; not a `redacted`
+mark), live deltas (`StreamScrubber`), the canonical history
+(`CanonicalHistoryAccumulator.scrubTurn`), `MemoryEngine.scrubText`, share
+packs, and MCP results in the hub (`setResultScrub`, `secrets.beforeModel`).
+Detected values are dropped unless the workstream says `captureSecrets: "vault"`
+(`CapturedSecretVault`, `captured_secrets`); `secret.*` is owner-only and audited.
+
 Routines (`src/daemon/routines/`, docs/routines.md) run sessions on a schedule
 or an API call. `RoutineService` owns the scheduler and runs; it reaches
 sessions only through the `RoutineHost` seam that `SessionManager` implements,
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 09ec3220..78bcaccc 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -510,6 +510,48 @@ The conductor acts only through sessions homed where the work belongs. `fleet_sp
 
 `codeoid workstream import [--root <dir>]` proposes workstreams from your repositories' remotes and lists Claude's global MCP servers to assign. It writes nothing; isolation stays off until you turn it on.
 
+## Secrets in what codeoid stores
+
+What codeoid stores never holds a secret's value: the transcript, the history a backend is seeded from, the scrollback a client replays, memory, and a shared bundle. Where one appears it is replaced by a reference:
+
+- `‹credential:gh-highflame›` for a value codeoid already knows: a declared credential, a backend account's key, an MCP sign-in, the daemon's own keys. Its value stays where it lives.
+- `‹secret:github-token:3f9a2c1b›` for one found by its shape (a token format, a private key, a URL's password, a value assigned to a name like `DB_PASSWORD`). The last part is a fingerprint: the same secret has the same reference everywhere, and the value can't be worked out from it.
+
+A command that exists to print a credential (`gh auth token`, `printenv`, `op read`, `cat .env`, …) is stored without its output, and a file tool writing a credential file (`.env`, `~/.netrc`, a private key) without what it wrote.
+
+The value of a detected secret is dropped. A workstream can keep them instead, so you can get one back later:
+
+```jsonc
+{ "workstreams": { "items": [ { "id": "acme", "captureSecrets": "vault" } ] } }
+```
+
+Kept secrets are encrypted under a key outside the database, belong to the workstream that kept them, and are forgotten after `secrets.vaultDays` (30) unless promoted:
+
+```bash
+codeoid secret ls                                  # what is kept, never the values
+codeoid secret reveal acme:3f9a2c1b                # the value (your own token only; audited)
+codeoid secret promote acme:3f9a2c1b --as acme-gh  # make it a declared credential
+codeoid secret forget acme:3f9a2c1b
+codeoid secret scrub --dry-run                     # what was stored before this, scrubbed (stop the daemon first)
+```
+
+Settings, under `secrets`:
+
+| Setting | Default | |
+| --- | --- | --- |
+| `enabled` | `true` | Turn it off only to debug. |
+| `beforeModel` | `true` | Also scrub MCP results before they go back to the model (through codeoid's hub). |
+| `captureSecrets` | `"drop"` | For sessions with no workstream; a workstream's own setting decides for its sessions. |
+| `vaultDays` | `30` | Kept secrets not seen for this long are forgotten. |
+| `dropCommands` | `[]` | Commands whose calls aren't stored at all (`"my-vault dump"`). |
+| `credentialFiles` | `[]` | More files whose contents are credentials (globs, by name or path). |
+
+A value found only by the name it sits under (`DB_PASSWORD=…`) is replaced there, but not remembered: repeated bare later, it isn't recognised. A token of a distinct format (a vendor's token, a JWT, a bearer token) is, for the rest of the daemon's run.
+
+An OpenAI-compatible, Gemini or llama.cpp session is sent its earlier turns from codeoid's stored history: from the next turn on, its model sees a secret it read earlier as the reference.
+
+Limits. The backend has already seen a value by the time codeoid stores the result, and a CLI backend keeps its own copy (Claude Code's `~/.claude/projects`, Codex's sessions), which codeoid doesn't change. A secret with no known shape, that codeoid doesn't know, in a command not on the list, still gets through. Design: [secrets-and-memory-design.md](secrets-and-memory-design.md).
+
 ## Signing a backend in, instead of pasting a key
 
 Settings → **Claude** → **Sign in with Claude** runs the backend's own login
diff --git a/docs/secrets-and-memory-design.md b/docs/secrets-and-memory-design.md
new file mode 100644
index 00000000..fc1cbf37
--- /dev/null
+++ b/docs/secrets-and-memory-design.md
@@ -0,0 +1,328 @@
+# Secrets, memory facts, saved approvals and atuin
+
+Status: agreed 2026-11-13. S1 built (§2.8). Four phases, one PR each, in order:
+S1 secret references, S2 memory facts, S3 saved approvals, S4 atuin as a source.
+The pure state machine for the turn loop is on the backlog (§7).
+
+This came out of reading atuin (`/Workspace/atuin`), which captures shell history, command output and
+every coding agent's sessions into one store. It is ahead of codeoid on keeping secrets out of what it
+stores and on the facts it keeps about each command. Codeoid is ahead on running agents safely
+(risk classifier, OS sandbox, checkpoints) and on recall. The parts below take atuin's ideas where they
+fit codeoid, not its code.
+
+## 1. The gap
+
+Codeoid stores everything a session does, verbatim:
+
+- the transcript (`<id>.jsonl`) and the canonical history (`<id>.canonical.jsonl`), which forks, backend
+  switches and stateless backends are seeded from;
+- the scrollback ring, replayed to every client that attaches, delegated watchers included;
+- memory episodes (`memory/store.ts`), which are embedded, recalled across sessions and workstreams,
+  shown to the conductor, and later sent between machines (federation);
+- share bundles (`share/pack.ts`), built from the transcript.
+
+Nothing scrubs any of them. `evidence/redact.ts` masks credentials in check output only, and
+`mcp/redact.ts` only what the settings screens show. So `gh auth token`, `cat .env`, `printenv`, a
+`curl -H "Authorization: Bearer …"`, or a token pasted into a prompt end up in every one of those
+places, in plain text, for good.
+
+Codeoid also knows less about each command than it could: episodes have no exit code, working
+directory or duration, and don't say which backend or model did the work or whether the turn was the
+user's or a delegated worker's. `get_episode` pages by characters, so an agent can't ask for the last
+80 lines, where the error is. And every medium-risk shell command asks again in guarded mode, every
+time: `npm test` forty times a day.
+
+## 2. S1 — secrets become references
+
+### 2.1 The rule
+
+What codeoid stores never holds a secret's value. Where one appears it is replaced by a reference:
+
+- `‹credential:<id>›` for a value codeoid already knows (§2.2): the reference names it, and its value
+  stays where it already lives;
+- `‹secret:<kind>:<fingerprint>›` for one the detector finds (§2.3): the kind (`github-token`,
+  `aws-key`, `jwt`, `password`, …) and a keyed hash of the value, so the same secret seen in three
+  sessions has the same reference, and nothing about the value can be learned from it.
+
+The value of a detected secret is dropped by default. A workstream can keep it instead
+(`captureSecrets: "vault"`, §2.5), so a person can still get it back later.
+
+### 2.2 Secrets codeoid already knows
+
+Most secrets that show up in a session are ones codeoid put there: a workstream's env credential the
+agent echoed, an MCP server's bearer token in an error, the backend key. Codeoid knows these values
+exactly, so they are replaced by exact match, with no guessing and no false positives. `KnownSecrets`
+(new, `secrets/known.ts`) gathers them from every source, each under a label:
+
+| Source | Reference |
+| --- | --- |
+| `credentials[]` values in the secret store (W1) | `‹credential:<id>›` |
+| MCP OAuth access and refresh tokens, client secrets (`mcp_oauth_credentials`) | `‹credential:oauth:<credential or server>›` |
+| Backend accounts' tokens, headers and env (`accounts.ts`) | `‹credential:account:<backend>:<name>›` |
+| OpenAI-compatible endpoints' keys and headers (`openai-endpoints.ts`) | `‹credential:endpoint:<name>›` |
+| The daemon's own keys in its environment (`CODEOID_*`, `*_API_KEY`, `*_TOKEN`, `*_SECRET`, `*_PASSWORD`, …) | `‹credential:daemon:<name>›` |
+| The conductor's key (`conductor_identity`), the MCP relay's live per-session tokens | `‹credential:daemon:…›` |
+
+ZeroID tokens minted for agents are JWTs, and codeoid's own MCP tokens (`bbt_`, `mmt_`, `sbt_`,
+`rt_`) have formats of their own: both are found by shape (§2.3).
+
+Each value is matched as written, URL-encoded, and base64 as `user:value` (Basic auth). Values shorter
+than 8 characters aren't matched (they would match ordinary text). The set is rebuilt when a source
+changes (a credential edited, an OAuth refresh) and cached by a version number; a scan is a single
+multi-pattern search over the text.
+
+### 2.3 Secrets codeoid doesn't know
+
+A detector finds the rest by shape. It starts from `evidence/redact.ts`, widened toward atuin's
+coverage (`atuin-common/src/secrets.rs`, `vendors.rs`, `structural.rs`): vendor token formats (GitHub,
+GitLab, Slack, AWS, Google, Stripe, OpenAI, Anthropic, npm, PyPI, Hugging Face, ZeroID, …), JWTs, PEM
+blocks, `scheme://user:password@host`, `Authorization:` headers, and values bound to keys that name a
+secret (`*_PASSWORD=`, `"api_key": …`). The rules follow evidence's: only known shapes and values bound
+to secret-named keys, never "looks random", so hashes and ids survive. The name or flag is kept and
+only the value replaced (`DB_PASSWORD=‹secret:password:9c2e41aa›`).
+
+The fingerprint is HMAC-SHA256 of the value under a key made once per daemon
+(`<config dir>/secrets/fingerprint.key`, 0600, hidden from every sandbox), truncated to 8 hex
+characters. Without the key a fingerprint can't be checked against a guess.
+
+Scanning has a time budget (atuin's: 250 ms). Text that can't be scanned within it isn't stored; a
+placeholder says so. This keeps a pathological input from stalling the daemon or slipping through.
+
+### 2.4 Tool calls whose output is the secret
+
+Some commands exist to print a credential: `gh auth token`, `printenv`, `env`, `aws configure get`,
+`op read`, `security find-generic-password -w`, `cat .env`, `kubectl get secret -o yaml`, and any read
+of a path `secret-paths.ts` knows as a credential file. Scrubbing their output by shape would miss
+whatever has no known shape. So each tool call gets a verdict before it is stored (atuin's
+`session_capture/policy.rs`):
+
+- **keep**: stored, scrubbed (the default);
+- **withhold output**: the call is stored, its output replaced by `‹output withheld: it prints credentials›`;
+- **withhold written**: a write of a credential file (`.env`, `~/.netrc`, …) is stored without the
+  content written;
+- **drop**: the call isn't stored at all (a command the user listed in `secrets.dropCommands`).
+
+The verdict reads the command with codeoid's shell parser (`shell/parse.ts`), so `bash -c 'gh auth
+token'` and `x=$(gh auth token)` are caught as the plain form is.
+
+### 2.5 Keeping a detected secret (opt-in)
+
+`workstreams.items[].captureSecrets: "drop" | "vault"`, default `drop`; and the same at the top level
+for sessions with no workstream. With `vault`, a detected secret's value is kept in the
+`CapturedSecretVault`: a table in the database (`captured_secrets`: workstream, fingerprint, kind,
+first and last seen, session, value encrypted with AES-256-GCM under a key in a separate 0600 file), so
+a copy of the database alone doesn't hold the values. Entries expire after `secrets.vaultDays` (30)
+unless promoted.
+
+A kept secret can be:
+
+- **revealed** by the session's owner, with an undelegated token, in the web UI or
+  `codeoid secret reveal <fingerprint>`, audited;
+- **promoted** to a declared credential (it gets an id and a place in the secret store, and from then
+  on is matched exactly, §2.2);
+- **forgotten**.
+
+A reference made in one workstream resolves only there: a closed workstream's secrets are never shown
+from another.
+
+Why drop is the default: kept by default, the vault would gather every secret that ever scrolled past
+(a customer's key in a log, a colleague's token in an error, a production key printed by accident) and
+become the most valuable thing on the machine, holding values that mostly go stale when they are
+rotated.
+
+### 2.6 Where it applies
+
+One scrubber (`secrets/scrub.ts`, behind `SecretService`, made by `codeoid start` only: tests and
+embedders get none) at every place codeoid stores or sends on a conversation:
+
+| Where | How |
+| --- | --- |
+| Tool output, in the `tool_complete` seam (`session.ts`) | before the `tool_result` hooks run, so canonical history, scrollback and transcript all get the scrubbed text. Not marked `redacted` as a hook's change is: the backend saw the same, so forking its own session adds no exposure, and marking it would cost every session that ever printed a secret its native forks |
+| Tool input, at `tool_start` | the recorded copy only; the call runs as the backend made it |
+| User prompts and assistant and thinking text | at the message's commit (`#commitStreamed`, `#persistAndBuffer`) |
+| Live deltas to attached clients | `StreamScrubber`: a line is held from where a credential may start (a secret-named key and its separator, `Bearer`, a URL's userinfo, a JWT, a private key's armour) to its end, judged with what was already sent of the line; otherwise the trailing run of non-space characters, and never inside a known value with spaces; everything held goes out before a tool call. The committed message is scrubbed whole and replaces what streamed |
+| Every message the session buffers, writes or sends (`#persistAndBuffer`, `#commitStreamed`, a fork's copy of its parent's rows, a settled approval's input) | `Session#scrubMessage`: text, parts, tool input and state, metadata |
+| The canonical history | `CanonicalHistoryAccumulator.scrubTurn` on each turn as it is committed, so no backend is seeded with a value codeoid wouldn't store |
+| `MemoryEngine.ingest` | so anything that ingests (S4's imports included) is scrubbed |
+| `share/pack.ts` | transcripts written before S1 are scrubbed as they are packed |
+| Dispatch digests, routine and loop results | built from scrubbed messages; a settled dispatch task's prompt, digest and error are scrubbed in the database (`Store.scrubText`; until it settles the prompt is what its worker is sent), a routine run's check output, summary and reason as they are written (not its payload, which the run reads back as its data); a session's last error is scrubbed when set |
+| The turn index (`<id>.turns.jsonl`) | the prompt's first line, scrubbed before it is cut |
+| MCP results through the relay (CLI backends' own MCP clients) | `McpHub.scrubRelayed`, as through the hub |
+| Push notifications | carry ids only, no text |
+
+A one-time `codeoid secret scrub [--dry-run]` rewrites what was stored before S1 (transcripts, canonical
+histories, episodes, their FTS rows) with known values and detected secrets, and reports what it changed.
+It is a command, not automatic: it rewrites history, so you run it when you choose.
+
+### 2.7 What S1 doesn't fix
+
+A stateless backend (OpenAI-compatible, Gemini, llama.cpp) is sent its working context from the
+canonical history on every turn, and that history is scrubbed: from the next turn on, such a model
+sees a secret it read earlier as its reference. The prompt of the turn it is answering goes as the
+user wrote it (`Session#historyForTurn`).
+
+A value found only by the name it sits under (`DB_PASSWORD=…`, `password: …`) is replaced there but
+not remembered: the same word is too often ordinary text elsewhere. In code (`name = value`, spaced)
+a value that is another name (`self.token`, `api_key`, `idToken`) is taken for code; in a `.env` or a
+shell (`NAME=value`) it is a password like any other.
+
+Known values are matched as whole tokens, and a value from the daemon's environment only when it
+looks like a secret (12 characters or more, not a plain word): a dev default (`postgres`,
+`development`) stays the ordinary word it is.
+
+Memory, the routine and dispatch stores, and the hub scrub without a tenant: values are replaced
+there as anywhere, but nothing is remembered or kept in the vault from them. A routine's output is
+cut to its limit before it is stored, so a token at the cut can lose its end. A command's raw
+output spill file (the compressor) is kept until it is taken into memory or pruned (a day), and is
+removed at once when the call's output is withheld. A value of a distinct format (a
+vendor's token, a JWT, a bearer token, a key) is remembered for the rest of the daemon's run, per
+tenant, and replaced bare wherever it shows up again.
+
+The backend has already seen the value by the time codeoid stores the result, and so has the model. A
+CLI backend keeps its own copy (Claude Code's `~/.claude/projects/…/*.jsonl`, Codex's rollout files).
+Codeoid can change what the model sees only where the output passes through it before the model:
+
+- the tool loops codeoid runs itself (OpenAI-compatible, Gemini, llama.cpp);
+- MCP servers reached through codeoid's hub: under `isolateGlobalServers`, every server on Claude and
+  the credentialed HTTP ones on CLI backends.
+
+S1 scrubs MCP results in the hub (`McpHub.setResultScrub`, `secrets.beforeModel`, on by default), which
+the tool loops codeoid runs reach their MCP servers through too. Claude's Bash output passes through
+codeoid only when the compressor wraps the command, in a separate process without the known values:
+not scrubbed there yet. Elsewhere the backend's own copy is the exposure left, and
+the docs say so plainly rather than implying more.
+
+A secret with no known shape that isn't a value codeoid knows, in a command not on the verdict list,
+still gets through. The detector reduces this; it can't end it.
+
+### 2.8 S1 as built
+
+- `secrets/`: `detect.ts` (the patterns), `known.ts` (`KnownSecrets`), `fingerprint.ts` (keys in
+  `<config dir>/secrets/`, registered with the secret-path gate), `scrub.ts` (`Scrubber`,
+  `StreamScrubber`), `verdict.ts` and `files.ts` (§2.4), `vault.ts` (`captured_secrets`, AES-256-GCM
+  bound to tenant, workstream and fingerprint), `service.ts` (`SecretService`,
+  `addDaemonKnownSources`), `scrub-stored.ts` (`codeoid secret scrub`).
+- Known values: declared credentials, the daemon's environment (`CODEOID_*` and secret-named
+  variables), every backend's accounts, OpenAI-compatible endpoints, MCP OAuth tokens and client
+  secrets, the conductor's key. Rebuilt on a change, and at least every minute (a token refresh).
+- Matching: known and remembered values in one pass (Aho-Corasick), never inside a reference
+  already written; remembered ones as whole tokens. Detection is linear: private keys and curl's
+  `-u` are found in code, the time budget is checked inside each pattern's matches too.
+- Streaming: see §2.6. A piece is judged with the last 512 characters of its line already sent.
+- Remembered values: indexed by their first characters, matched where a token starts: learning
+  one costs nothing, and 2,000 remembered values cost a scan no slower than none.
+- Verdicts also withhold: `export -p` / `declare -x` / a bare `export`, `env` with options only,
+  `echo $SOME_TOKEN`, `cat .env*`, `git show/diff/log` of a credential file, `dd if=`, and what
+  `ssh host …`, `docker exec … ` and `kubectl exec … --` run; and every backend's file tools'
+  writes of a credential file (`writeTargets`, a patch's `*** Add File:`).
+- `codeoid secret scrub` takes no time budget, remembers nothing across texts, leaves a text it
+  can't check as it is (and says how many), includes rotated transcript segments, and rebuilds
+  each database it changed (FTS optimize, WAL checkpoint, VACUUM) so replaced text is gone from
+  disk.
+- Protocol: `secret.list` (settings:read), `secret.reveal`, `secret.forget` (settings:write, the
+  caller's own token, audited without the value). CLI: `codeoid secret ls | reveal | forget | promote |
+  scrub [--dry-run]`; `promote` reveals, declares an env credential, sets its value and forgets the
+  kept copy. `scrub` takes the daemon's data locks, so it refuses while the daemon runs.
+- Config: `secrets.enabled`, `beforeModel`, `captureSecrets` (sessions with no workstream),
+  `vaultDays`, `dropCommands`, `credentialFiles`; `workstreams.items[].captureSecrets`.
+
+### 2.9 Using a secret without seeing it (S1b, after S4)
+
+"Recall it if required" means an agent can use a secret without seeing it. An agent writes
+`‹credential:gh-highflame›` in a command; codeoid's gate puts the value in as an environment variable
+for that one command (`CODEOID_REF_1`, the reference rewritten to `"$CODEOID_REF_1"`) where the backend
+lets the gate rewrite the call, and the output is scrubbed again on the way back. The model never gets
+the value in its context, where it would land in the transcript again. This is per backend (Claude's
+PreToolUse rewrite, the tool loops codeoid runs, opencode's shell shim), so it comes after S4.
+
+## 3. S2 — memory facts
+
+- **On shell episodes:** exit code (from the backend when it reports one: Codex, opencode, the tool
+  loops codeoid runs; else the `Exit code N` line Claude's Bash result carries; null when unknown),
+  working directory (the `shellCwd` the gate already has), and duration (`tool_start` to
+  `tool_complete`).
+- **On every episode:** backend, model, and the turn's origin (`user`, `agent`, `delegated`, from
+  `turn-origin.ts`; plus `routine`, `loop` and `dispatch` for unattended runs).
+- **Recall filters:** `only_failed`, `backend`, `origin`, `cwd` (a repo root or folder), next to the
+  existing `tool`, `filePaths`, `before`/`after`. On `recall`, `timeline` and the conductor's
+  `fleet_recall`.
+- **Tail first:** `get_episode` takes `lines: [[start, end], …]`, negative counting from the end, and
+  returns numbered lines with a `[… N lines skipped …]` marker and the total line count. The tool
+  description says to ask for `[[-80, -1]]` first.
+- **Exact first:** when a query is quoted, or looks like a command or an identifier, episodes holding
+  it exactly come first, then the hybrid ranking fills the page under a separator line. When nothing
+  matches, the reply says which filter to loosen.
+- **Instructions:** the memory system-prompt text (`MEMORY_SYSTEM_PROMPT_APPEND`) gains one line:
+  before re-running a command to find out what failed, recall it. The memory MCP server
+  (`memory/mcp.ts`, `memory/mcp-http.ts`) carries the same text as its MCP `instructions`, for backends
+  and outside agents that don't get the system prompt.
+
+Old episodes keep null for the new fields; nothing is backfilled.
+
+## 4. S3 — saved approvals
+
+In guarded mode every shell command that isn't low asks, every time. S3 lets the owner answer once for
+a scope:
+
+- **Allow once** (as today).
+- **For this session**, for `approvals.sessionGrantHours` (8).
+- **In this repository**: kept by codeoid, keyed by the repository's real top-level path, never read
+  from a file in the repository (an agent could write one).
+- **In this workstream**, or **everywhere**: from the settings screen.
+
+A rule is a program and an argument prefix, in Claude's form (`Bash(npm test:*)`, `Bash(make lint)`),
+plus MCP tools by name (`mcp__linear__list_issues`) and web fetches by domain (`WebFetch(domain:docs.rs)`).
+
+The rules that keep it safe:
+
+- Only **medium** commands can be saved, and only medium commands run on a rule. A high, not-understood
+  or credential-touching command is judged again every time and always asks, whatever rules exist.
+- A line runs on rules only when **every** simple command in it matches an allow rule
+  (`npm test && rm -rf build` needs both); one deny rule matching **any** of them refuses it.
+- The program is a literal word. No bare `Bash` or `Bash(*)`, no rule for a shell (`bash`, `sh -c`),
+  `eval`, `sudo`, or a wrapper that runs another command; the program after a wrapper is what must
+  match.
+- Saving needs the owner's own token; a delegated one can only allow once.
+- Interactive mode ignores rules (it asks about every call). Autonomous mode doesn't need them.
+- Every saved rule is listed in Settings → Approvals, shows where it applied, and can be removed. Every
+  use is audited (`session.rule_allow rule=… scope=…`).
+
+Claude's own `permissions.allow` rules keep working on Claude as today. Codeoid's rules work on every
+backend.
+
+## 5. S4 — atuin as a source
+
+Atuin already captures the user's own shell history, command output, and every coding agent's
+sessions, including ones codeoid didn't start. S4 brings that into codeoid's memory, read-only, rather
+than building a terminal proxy:
+
+- **What:** atuin's history (command, cwd, exit code, duration, author), the output it captured for
+  failed commands, and its threads (Claude Code, Codex, opencode, … sessions).
+- **How:** codeoid runs `atuin mcp` as an MCP client (its tools `atuin_history`, `atuin_output`,
+  `atuin_threads_list`, `atuin_threads_read`) on a schedule and when the conductor asks, and ingests what
+  is new as episodes (`source: "atuin"`, the thread's agent as the backend). A per-source watermark plus
+  a stable id per item (atuin's history id, a thread's message id) keeps re-reads from duplicating.
+- **Workstreams:** each item is homed by its cwd (§5 of workstreams-design.md), so a closed
+  workstream's commands are withheld from the conductor as its sessions are. An item whose folder has
+  no home stays out under isolation.
+- **Secrets:** everything goes through `MemoryEngine.ingest`, so S1 scrubs it.
+- **Off by default** (`integrations.atuin.enabled`). Codeoid works the same without atuin installed.
+
+Open before S4 starts: whether atuin's MCP output is stable enough to parse, or whether its CLI's
+`--format json` is the better interface; and whether threads are read whole or only what changed.
+
+## 6. Testing
+
+Every phase: unit tests for the pure parts (the scrubber and the verdicts against a table of real
+command lines and outputs; the rule matcher against compound lines), session tests through a mock
+backend (a secret printed by a tool never reaches the transcript, the canonical log, the scrollback, an
+episode or a bundle), an e2e journey on a real daemon, and two audit rounds before each PR.
+
+## 7. Backlog
+
+- **The turn loop as a pure state machine** (atuin's `atuin-ai/src/fsm`): events in, effects out, no
+  I/O, so cancellation, late results and timeouts are tested synchronously. Start with the approval
+  lifecycle.
+- Retention: a disk budget for episodes, with a head-and-tail cap on large tool output.
+- Capturing the native session files of agents codeoid didn't start without atuin (Claude and Codex
+  JSONL), if atuin isn't installed.
diff --git a/e2e/specs/secrets.spec.ts b/e2e/specs/secrets.spec.ts
new file mode 100644
index 00000000..380e848c
--- /dev/null
+++ b/e2e/specs/secrets.spec.ts
@@ -0,0 +1,78 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createSessionInUi, expect, messages, openUi, send, test, waitIdle } from "../harness";
+
+// Made-up credentials of the right shape, split so no contiguous token sits in this file.
+const GHP = `ghp_${"Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V"}`;
+const PASSWORD = `hunter${"2xyz"}`;
+const BEARER = `8f2d0c1e${"9b7a4f6e8d2c"}`;
+
+/** Every transcript, canonical history and turn index the daemon wrote. */
+function storedText(configDir: string): string {
+  const dir = join(configDir, "codeoid", "transcripts");
+  return readdirSync(dir)
+    .filter((n) => n.endsWith(".jsonl"))
+    .map((n) => readFileSync(join(dir, n), "utf8"))
+    .join("\n");
+}
+
+// docs/secrets-and-memory-design.md §2: a secret a tool prints and a reply
+// repeats is shown and stored as a reference; a workstream that keeps them
+// lets its owner get it back; older data can be scrubbed, never while the
+// daemon runs.
+test("a leaked token is shown and stored as a reference, kept where the workstream says so, revealed to its owner", async ({ page, codeoid }) => {
+  codeoid.configure({
+    workstreams: { items: [{ id: "keep", name: "Keep", captureSecrets: "vault", match: { paths: [codeoid.workdir] } }] },
+  });
+  await codeoid.restart();
+  codeoid.setScript([
+    {
+      match: "^leak",
+      steps: [
+        { tool: "Read", input: { file_path: "notes.md" }, output: `token=${GHP}\nDB_PASSWORD=${PASSWORD}\nAuthorization: Bearer ${BEARER}\n` },
+        { text: `The token is ${GHP}, and the session token is ${BEARER}.` },
+      ],
+    },
+  ]);
+  await openUi(page, codeoid);
+  await createSessionInUi(page, "leaky", codeoid.workdir);
+  await send(page, "leak it");
+  const approve = page.getByRole("button", { name: "approve", exact: true });
+  if (await approve.isVisible().catch(() => false)) await approve.click();
+  await expect(messages(page).filter({ hasText: "The token is" })).toHaveCount(1);
+  await waitIdle(page);
+
+  // On screen: references, never the values.
+  const main = page.getByRole("main");
+  await expect(main).toContainText(/‹secret:github-token:[0-9a-f]{8}›/);
+  await expect(main).not.toContainText(GHP);
+  await expect(main).not.toContainText(PASSWORD);
+  await expect(main).not.toContainText(BEARER);
+
+  // On disk: the same.
+  const stored = storedText(codeoid.configDir);
+  expect(stored).not.toContain(GHP);
+  expect(stored).not.toContain(PASSWORD);
+  expect(stored).not.toContain(BEARER);
+  expect(stored).toMatch(/‹secret:github-token:[0-9a-f]{8}›/);
+
+  // A new page load replays the scrollback: still references.
+  await page.reload();
+  await expect(page.getByText("live", { exact: true })).toBeVisible();
+  await expect(page.locator("body")).not.toContainText(GHP);
+
+  // The workstream keeps it: listed without the value, revealed to the owner.
+  const ls = await codeoid.cliOk("secret", "ls");
+  expect(ls).toContain("github-token");
+  expect(ls).not.toContain(GHP);
+  const ref = /keep:([0-9a-f]{8})\s+github-token/.exec(ls)?.[0].split(/\s+/)[0];
+  expect(ref).toBeTruthy();
+  expect((await codeoid.cliOk("secret", "reveal", ref!)).trim()).toBe(GHP);
+  expect(await codeoid.cliOk("secret", "forget", ref!)).toContain("Forgot");
+  expect(await codeoid.cliOk("secret", "ls")).not.toContain(ref!);
+
+  // Scrubbing older data refuses while the daemon runs.
+  const scrub = await codeoid.cli("secret", "scrub", "--dry-run");
+  expect(scrub.code).not.toBe(0);
+  expect(scrub.output).toContain("the daemon is running");
+});
diff --git a/packages/protocol/src/schemas.test.ts b/packages/protocol/src/schemas.test.ts
index 90d34e59..90e10145 100644
--- a/packages/protocol/src/schemas.test.ts
+++ b/packages/protocol/src/schemas.test.ts
@@ -175,6 +175,9 @@ const samples: { [T in ClientTypes]: Extract<ClientMessage, { type: T }> } = {
   "credential.upsert": { type: "credential.upsert", id: "c2", item: { id: "gh", kind: "env" } },
   "credential.delete": { type: "credential.delete", id: "c3", credential: "gh" },
   "credential.set_value": { type: "credential.set_value", id: "c4", credential: "gh", value: "x" },
+  "secret.list": { type: "secret.list", id: "sc1" },
+  "secret.reveal": { type: "secret.reveal", id: "sc2", workstream: "acme", fingerprint: "3f9a2c1b" },
+  "secret.forget": { type: "secret.forget", id: "sc3", workstream: "", fingerprint: "3f9a2c1b" },
   "session.turns": { type: "session.turns", id: "r94", sessionId: "s1" },
   "session.approvals": { type: "session.approvals", id: "r94a", sessionId: "s1" },
   "claude.accounts.list": { type: "claude.accounts.list", id: "ca1" },
diff --git a/packages/protocol/src/schemas.ts b/packages/protocol/src/schemas.ts
index 1be987aa..b76e1acf 100644
--- a/packages/protocol/src/schemas.ts
+++ b/packages/protocol/src/schemas.ts
@@ -1157,6 +1157,13 @@ export const credentialSetValueSchema = z.object({
   value: z.string().max(LIMITS.SETTING_VALUE_MAX).nullable(),
 });
 
+// A kept secret's fingerprint (secrets/fingerprint.ts: 8 hex characters) and its workstream ('' = none).
+const fingerprintField = z.string().regex(/^[0-9a-f]{8}$/);
+const keptWorkstreamField = z.union([z.literal(""), workstreamIdField]);
+export const secretListSchema = z.object({ ...base, type: z.literal("secret.list"), workstream: keptWorkstreamField.optional() });
+export const secretRevealSchema = z.object({ ...base, type: z.literal("secret.reveal"), workstream: keptWorkstreamField, fingerprint: fingerprintField });
+export const secretForgetSchema = z.object({ ...base, type: z.literal("secret.forget"), workstream: keptWorkstreamField, fingerprint: fingerprintField });
+
 export const skillGrantSchema = z.object({
   ...base,
   type: z.literal("skill.grant"),
@@ -1402,6 +1409,9 @@ export const clientMessageSchema = z.discriminatedUnion("type", [
   credentialUpsertSchema,
   credentialDeleteSchema,
   credentialSetValueSchema,
+  secretListSchema,
+  secretRevealSchema,
+  secretForgetSchema,
   sessionTurnsSchema,
   sessionApprovalsSchema,
   claudeAccountsListSchema,
diff --git a/packages/protocol/src/types.ts b/packages/protocol/src/types.ts
index d02e71f6..e41f6f1c 100644
--- a/packages/protocol/src/types.ts
+++ b/packages/protocol/src/types.ts
@@ -50,6 +50,11 @@ import type {
   CredentialListResultMsg,
   CredentialSetValueMsg,
   CredentialUpsertMsg,
+  SecretForgetMsg,
+  SecretListMsg,
+  SecretListResultMsg,
+  SecretRevealMsg,
+  SecretRevealResultMsg,
   SessionWorkstreamInfo,
   WorkstreamDeleteMsg,
   WorkstreamListMsg,
@@ -1384,6 +1389,9 @@ export type ClientMessage =
   | CredentialUpsertMsg
   | CredentialDeleteMsg
   | CredentialSetValueMsg
+  | SecretListMsg
+  | SecretRevealMsg
+  | SecretForgetMsg
   | SessionTurnsMsg
   | SessionApprovalsMsg
   | ClaudeAccountsListMsg
@@ -3356,6 +3364,8 @@ export type DaemonMessage =
   | WorkstreamResolveResultMsg
   | WorkstreamsChangedMsg
   | CredentialListResultMsg
+  | SecretListResultMsg
+  | SecretRevealResultMsg
   | SessionTurnsResultMsg
   | SessionApprovalsResultMsg
   | ClaudeAccountsResultMsg
diff --git a/packages/protocol/src/workstreams.ts b/packages/protocol/src/workstreams.ts
index 3ef50eca..ea37e03c 100644
--- a/packages/protocol/src/workstreams.ts
+++ b/packages/protocol/src/workstreams.ts
@@ -221,6 +221,56 @@ export interface CredentialSetValueMsg {
   value: string | null;
 }
 
+/** A detected secret a workstream keeps (`captureSecrets: "vault"`; docs/secrets-and-memory-design.md §2.5). Never its value. */
+export interface KeptSecretInfo {
+  /** '' for sessions with no workstream. */
+  workstream: string;
+  /** What `‹secret:<kind>:<fingerprint>›` names. */
+  fingerprint: string;
+  kind: string;
+  sessionId: string | null;
+  firstSeen: number;
+  lastSeen: number;
+}
+
+/** The detected secrets kept in the vault, newest first; one workstream's when given. Owner-only. */
+export interface SecretListMsg {
+  type: "secret.list";
+  id: string;
+  workstream?: string;
+}
+
+export interface SecretListResultMsg {
+  type: "secret.list.result";
+  requestId: string;
+  /** Whether secret handling is on in this daemon at all. */
+  enabled: boolean;
+  secrets: KeptSecretInfo[];
+}
+
+/** A kept secret's value: the owner's own token only, audited. Replies `secret.reveal.result`. */
+export interface SecretRevealMsg {
+  type: "secret.reveal";
+  id: string;
+  workstream: string;
+  fingerprint: string;
+}
+
+export interface SecretRevealResultMsg {
+  type: "secret.reveal.result";
+  requestId: string;
+  kind: string;
+  value: string;
+}
+
+/** Forget a kept secret. Replies `response.ok`. */
+export interface SecretForgetMsg {
+  type: "secret.forget";
+  id: string;
+  workstream: string;
+  fingerprint: string;
+}
+
 export interface CredentialListResultMsg {
   type: "credential.list.result";
   requestId: string;
diff --git a/src/cli.ts b/src/cli.ts
index d7b398cc..47e1c703 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -170,6 +170,8 @@ program
       daemon = new DaemonServer({
         dataLock,
         sandboxRegistry,
+        // What sessions store is scrubbed of secrets (docs/secrets-and-memory-design.md §2).
+        secretsConfigDir: getConfigDir(),
         port: bindPort,
         host: bindHost,
         dbPath: config.dbPath,
@@ -1686,6 +1688,166 @@ async function workstreamRequest<T extends DaemonMessage["type"]>(
   }
 }
 
+// ── Secrets (docs/secrets-and-memory-design.md §2) ──────────────────────
+
+const secretCmd = program
+  .command("secret")
+  .description("Secrets in what codeoid stores: the ones workstreams keep, and scrubbing older data (docs/secrets-and-memory-design.md)");
+
+/** `<workstream>:<fingerprint>`, or a bare fingerprint (a session with no workstream), or `‹secret:kind:fp›` as copied. */
+function keptRef(ref: string, workstream?: string): { workstream: string; fingerprint: string } | null {
+  const copied = /^‹secret:[a-z0-9-]+:([0-9a-f]{8})›$/.exec(ref.trim());
+  if (copied) return { workstream: workstream ?? "", fingerprint: copied[1]! };
+  const m = /^(?:([a-z0-9][a-z0-9-]{0,63}):)?([0-9a-f]{8})$/.exec(ref.trim());
+  return m ? { workstream: workstream ?? m[1] ?? "", fingerprint: m[2]! } : null;
+}
+
+secretCmd
+  .command("ls")
+  .description("List the detected secrets workstreams keep (captureSecrets: vault) — never their values")
+  .option("--workstream <id>", "only this workstream's")
+  .option("--json", "print the daemon's reply as JSON")
+  .action(async (o: { workstream?: string; json?: boolean }) => {
+    await workstreamRequest({ type: "secret.list", id: randomUUID(), ...(o.workstream ? { workstream: o.workstream } : {}) }, "secret.list.result", (r) => {
+      if (o.json) return void console.log(JSON.stringify(r, null, 2));
+      if (!r.enabled) console.log("Secret handling is off in this daemon (secrets.enabled).");
+      if (r.secrets.length === 0) {
+        console.log("No kept secrets. A workstream keeps detected secrets only with captureSecrets: \"vault\"; the default drops them.");
+        return;
+      }
+      for (const k of r.secrets) {
+        const ref = `${k.workstream ? `${clean(k.workstream)}:` : ""}${k.fingerprint}`;
+        console.log(`${ref.padEnd(32)} ${clean(k.kind).padEnd(20)} last seen ${new Date(k.lastSeen).toISOString()}${k.sessionId ? `  session ${clean(k.sessionId.slice(0, 8))}` : ""}`);
+      }
+    });
+  });
+
+secretCmd
+  .command("reveal <ref>")
+  .description("Print a kept secret's value (<workstream>:<fingerprint>, or as copied: ‹secret:kind:fingerprint›). Your own token only; audited")
+  .option("--workstream <id>", "the workstream that keeps it")
+  .action(async (ref: string, o: { workstream?: string }) => {
+    const k = keptRef(ref, o.workstream);
+    if (!k) {
+      console.error("Error: give <workstream>:<fingerprint>, a fingerprint, or the reference as copied");
+      process.exitCode = 1;
+      return;
+    }
+    await workstreamRequest({ type: "secret.reveal", id: randomUUID(), ...k }, "secret.reveal.result", (r) => {
+      // The value itself, unaltered: it is what was asked for.
+      console.log(r.value);
+    });
+  });
+
+secretCmd
+  .command("forget <ref>")
+  .description("Forget a kept secret")
+  .option("--workstream <id>", "the workstream that keeps it")
+  .action(async (ref: string, o: { workstream?: string }) => {
+    const k = keptRef(ref, o.workstream);
+    if (!k) {
+      console.error("Error: give <workstream>:<fingerprint>, a fingerprint, or the reference as copied");
+      process.exitCode = 1;
+      return;
+    }
+    await workstreamRequest({ type: "secret.forget", id: randomUUID(), ...k }, "response.ok", () => console.log(`Forgot ${k.workstream ? `${k.workstream}:` : ""}${k.fingerprint}.`));
+  });
+
+secretCmd
+  .command("promote <ref>")
+  .description("Make a kept secret a declared credential (an env credential), so it is matched by name from now on")
+  .requiredOption("--as <id>", "the credential's id (lowercase letters, digits, dashes)")
+  .option("--workstream <id>", "the workstream that keeps it")
+  .action(async (ref: string, o: { as: string; workstream?: string }) => {
+    const k = keptRef(ref, o.workstream);
+    if (!k) {
+      console.error("Error: give <workstream>:<fingerprint>, a fingerprint, or the reference as copied");
+      process.exitCode = 1;
+      return;
+    }
+    const client = new TerminalClient(loadConfig());
+    await client.connect();
+    try {
+      const fail = (reply: DaemonMessage): boolean => {
+        if (reply.type !== "response.error") return false;
+        console.error(`Error: ${clean(reply.error)}`);
+        process.exitCode = 1;
+        return true;
+      };
+      const revealed = await client.request({ type: "secret.reveal", id: randomUUID(), ...k });
+      if (fail(revealed) || revealed.type !== "secret.reveal.result") return;
+      if (fail(await client.request({ type: "credential.upsert", id: randomUUID(), item: { id: o.as, kind: "env", description: `promoted from ${revealed.kind} ${k.fingerprint}` } }))) return;
+      if (fail(await client.request({ type: "credential.set_value", id: randomUUID(), credential: o.as, value: revealed.value }))) return;
+      if (fail(await client.request({ type: "secret.forget", id: randomUUID(), ...k }))) return;
+      console.log(`Credential "${o.as}" now holds it; from now on it shows as ‹credential:${o.as}›. Give it to a workstream's env to use it.`);
+    } finally {
+      client.disconnect();
+    }
+  });
+
+secretCmd
+  .command("scrub")
+  .description("Rewrite what was stored before secret handling (transcripts, memory, dispatch tasks) with secrets replaced by references. Stop the daemon first")
+  .option("--dry-run", "say what would change, change nothing")
+  .action(async (o: { dryRun?: boolean }) => {
+    const config = loadConfig();
+    const { acquireDaemonLocks: acquire, daemonOwnedDirs: owned, DataDirLockError: LockError } = await import("./daemon/data-lock.js");
+    let locks: { release(): void };
+    try {
+      locks = acquire(owned(config), { log: () => {} });
+    } catch (err) {
+      if (err instanceof LockError) {
+        console.error(`Error: the daemon is running (${clean(err.message)}). Stop it first: scrubbing rewrites what it writes to.`);
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
+    }
+    try {
+      const { Store: DaemonStore } = await import("./daemon/store.js");
+      const { SecretService, addDaemonKnownSources } = await import("./daemon/secrets/service.js");
+      const { createSecretStore } = await import("./daemon/credentials/store.js");
+      const { AccountStore } = await import("./daemon/accounts.js");
+      const { EndpointStore } = await import("./daemon/openai-endpoints.js");
+      const { scrubTranscripts, scrubMemoryDb, scrubDispatchTasks } = await import("./daemon/secrets/scrub-stored.js");
+      const store = new DaemonStore(config.dbPath);
+      try {
+        // No vault: a scrub of old data keeps nothing, whatever the workstreams say.
+        let unchecked = 0;
+        const secrets = new SecretService({
+          ...(config.secrets ? { config: { ...config.secrets, captureSecrets: "drop" } } : {}),
+          configDir: getConfigDir(),
+          offline: true,
+          onUnchecked: () => void unchecked++,
+        });
+        addDaemonKnownSources(secrets, {
+          credentials: () => config.credentials ?? [],
+          secretStore: createSecretStore(config.credentialStore),
+          accounts: new AccountStore(),
+          endpoints: new EndpointStore(),
+          store,
+        });
+        const scrub = <T,>(v: T) => secrets.scrubValue(v);
+        const t = scrubTranscripts(config.transcriptDir, scrub, !!o.dryRun);
+        const episodes = config.memory?.dbPath ? scrubMemoryDb(config.memory.dbPath, scrub, !!o.dryRun) : 0;
+        store.close();
+        const tasks = scrubDispatchTasks(config.dbPath, scrub, !!o.dryRun);
+        const verb = o.dryRun ? "would change" : "changed";
+        console.log(`Transcripts: ${t.filesChanged} of ${t.files} files ${verb} (${t.linesChanged} lines).`);
+        console.log(`Memory: ${episodes} episode bodies ${verb}.`);
+        console.log(`Dispatch tasks: ${tasks} ${verb}.`);
+        if (unchecked > 0) console.log(`${unchecked} text(s) were too large to check and were left as they are.`);
+        if (!o.dryRun && t.filesChanged + episodes + tasks > 0) console.log("Done. A backend's own copy (Claude Code's ~/.claude/projects, Codex's sessions) is its own, and isn't changed.");
+      } finally {
+        try {
+          store.close();
+        } catch {}
+      }
+    } finally {
+      locks.release();
+    }
+  });
+
 workstreamCmd
   .command("ls")
   .description("List the configured workstreams")
diff --git a/src/config.ts b/src/config.ts
index becd5372..d0a1fc3a 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -345,6 +345,31 @@ const SandboxSchema = z
   })
   .default({ provider: "auto", network: "on", allowedHosts: [], hiddenPaths: [], homeReadable: [...DEFAULT_HOME_READABLE], worktreeRoots: [], projectRoots: [PROJECT_ROOT_PARENT], docker: { image: "node:22-bookworm-slim", socket: false } });
 
+/** Secrets in what codeoid stores (docs/secrets-and-memory-design.md §2). */
+const SecretsSchema = z
+  .object({
+    /** Scrub stored conversations: off only to debug. */
+    enabled: z.boolean().default(true),
+    /**
+     * Also scrub what goes back to the model where codeoid hands it over (MCP
+     * results through the hub, the tool loops codeoid runs): the model gets a
+     * secret as a reference. Off: only what is stored is scrubbed.
+     */
+    beforeModel: z.boolean().default(true),
+    /** For sessions with no workstream; a workstream's own `captureSecrets` decides for its sessions. */
+    captureSecrets: z.enum(["drop", "vault"]).default("drop"),
+    /** Kept secrets not seen for this many days are forgotten. */
+    vaultDays: z.number().int().min(1).max(3650).default(30),
+    /** Commands (a program, or an argv prefix) whose calls aren't stored at all. */
+    dropCommands: z.array(z.string().min(1).max(256)).max(256).default([]),
+    /** More files whose contents are credentials (globs, by name or by path; `~` is the home). */
+    credentialFiles: z.array(z.string().min(1).max(1024)).max(256).default([]),
+  })
+  .strict()
+  .default({ enabled: true, beforeModel: true, captureSecrets: "drop", vaultDays: 30, dropCommands: [], credentialFiles: [] });
+
+export type SecretsConfig = z.infer<typeof SecretsSchema>;
+
 const CompressSchema = z
   .object({
     enabled: z.boolean().default(false),
@@ -1367,6 +1392,7 @@ const RootSchema = z.object({
   memory: MemorySchema,
   workspaceIndex: WorkspaceIndexSchema,
   compress: CompressSchema,
+  secrets: SecretsSchema,
   approvals: ApprovalsSchema,
   sandbox: SandboxSchema,
   guard: GuardSchema,
@@ -1527,6 +1553,12 @@ export interface CodeoidConfig {
    * defaults (on, `auto`, network on).
    */
   sandbox?: SandboxConfig;
+  /**
+   * Secrets in what codeoid stores (docs/secrets-and-memory-design.md §2).
+   * Optional on the type so a hand-built config literal need not carry it;
+   * absent = the defaults (on, detected values dropped).
+   */
+  secrets?: SecretsConfig;
   /** Homegrown CLI output compressor (RTK-style). Disabled by default. */
   compress: {
     enabled: boolean;
@@ -2124,6 +2156,7 @@ export function loadConfig(opts: LoadOptions = {}): CodeoidConfig {
     },
     workspaceIndex: parsed.workspaceIndex,
     compress: parsed.compress,
+    secrets: parsed.secrets,
     approvals: parsed.approvals,
     sandbox: parsed.sandbox,
     guard: parsed.guard,
diff --git a/src/daemon/mcp/hub.ts b/src/daemon/mcp/hub.ts
index 9c306f80..6dab4031 100644
--- a/src/daemon/mcp/hub.ts
+++ b/src/daemon/mcp/hub.ts
@@ -50,6 +50,15 @@ export interface McpCallScope {
   tenant?: McpTenant;
 }
 
+/** Every string in a JSON-like value through `fn`, structure kept (deeper than 32 levels: dropped). */
+function deepStrings(v: unknown, fn: (s: string) => string, depth = 0): unknown {
+  if (typeof v === "string") return fn(v);
+  if (v === null || typeof v !== "object") return v;
+  if (depth > 32) return null;
+  if (Array.isArray(v)) return v.map((x) => deepStrings(x, fn, depth + 1));
+  return Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, deepStrings(x, fn, depth + 1)]));
+}
+
 export interface McpCallResult {
   text: string;
   isError: boolean;
@@ -116,6 +125,38 @@ export class McpHub {
     this.#permit = fn;
   }
 
+  /**
+   * Applied to every tool result before it goes back to the backend
+   * (docs/secrets-and-memory-design.md §2.7): through the hub, the model gets
+   * a secret as a reference, never its value. Unset: as the server sent it.
+   */
+  #scrubResult: ((text: string) => string) | null = null;
+
+  setResultScrub(fn: (text: string) => string): void {
+    this.#scrubResult = fn;
+  }
+
+  /**
+   * A relayed result (mcp/proxy.ts: CLI backends' own MCP clients), scrubbed as
+   * a hub result is: every text part of a tool call's content, every text of a
+   * read resource. Returned as given when no scrub is set.
+   */
+  scrubRelayed<T>(method: string, result: T): T {
+    const scrub = this.#scrubResult;
+    if (!scrub || !result || typeof result !== "object") return result;
+    const r = result as { content?: unknown; contents?: unknown; structuredContent?: unknown };
+    const texts = (list: unknown) =>
+      Array.isArray(list) ? list.map((c) => (c && typeof c === "object" && typeof (c as { text?: unknown }).text === "string" ? { ...c, text: scrub((c as { text: string }).text) } : c)) : list;
+    if (method === "tools/call") {
+      const out: Record<string, unknown> = { ...(r as Record<string, unknown>), content: texts(r.content) };
+      // Structured output: every string in it, as text (a line rule sees inside it as it would the text part).
+      if (r.structuredContent !== undefined) out.structuredContent = deepStrings(r.structuredContent, scrub);
+      return out as T;
+    }
+    if (method === "resources/read") return { ...(r as Record<string, unknown>), contents: texts(r.contents) } as T;
+    return result;
+  }
+
   #refusal(spec: McpServerSpec, scope: McpCallScope | undefined): string | undefined {
     return scope?.sessionId && !spec.builtin ? this.#permit?.(scope.sessionId, spec) : undefined;
   }
@@ -183,7 +224,8 @@ export class McpHub {
       return { text: `mcp: ${spec.name} unavailable: ${cleanMcpError(errMsg(e))}`, isError: true };
     }
     try {
-      return await withTimeout(client.callTool(tool, args, scope), this.#timeoutMs, `${spec.name}/${tool}`);
+      const result = await withTimeout(client.callTool(tool, args, scope), this.#timeoutMs, `${spec.name}/${tool}`);
+      return this.#scrubResult && !spec.builtin ? { ...result, text: this.#scrubResult(result.text) } : result;
     } catch (e) {
       if (e instanceof McpServerWantsSignIn && spec.transport.kind === "http") {
         this.markNeedsSignIn(spec.transport.url, scope.tenant);
diff --git a/src/daemon/mcp/proxy.ts b/src/daemon/mcp/proxy.ts
index 46cbbe7a..ddb7a2dc 100644
--- a/src/daemon/mcp/proxy.ts
+++ b/src/daemon/mcp/proxy.ts
@@ -156,10 +156,14 @@ export class McpProxy implements McpProxyMount {
     return `${this.#baseUrl().replace(/\/+$/, "")}${MCP_PROXY_PATH_PREFIX}${encodeURIComponent(server)}`;
   }
 
+  /** Told of every token minted and revoked: the daemon's secret handling matches live ones (docs/secrets-and-memory-design.md §2.2). */
+  tokenListener: { minted(token: string): void; revoked(token: string): void } | undefined;
+
   mint(binding: McpProxyBinding): { token: string; servers: string[] } {
     const servers = (binding.view ?? this.#registry).relayFor(binding.backendId).map((s) => s.name);
     const token = randomBytes(32).toString("base64url");
     this.#tokens.set(hashOf(token), { binding, servers: new Set(servers), relays: new Map(), starting: new Map(), calls: 0, initializes: [] });
+    this.tokenListener?.minted(token);
     return { token, servers };
   }
 
@@ -167,6 +171,7 @@ export class McpProxy implements McpProxyMount {
     const key = hashOf(token);
     const record = this.#tokens.get(key);
     if (!record) return;
+    this.tokenListener?.revoked(token);
     this.#tokens.delete(key);
     for (const relay of record.relays.values()) void relay.close();
   }
@@ -605,7 +610,8 @@ class Relay {
         if (request.method === "resources/unsubscribe") this.#subscriptions.delete(uri);
       }
       if (request.method === "tools/list") return this.#listed(result, params?.cursor !== undefined);
-      return result;
+      // What goes back to the model holds no secret's value, as through the hub (docs/secrets-and-memory-design.md §2.7).
+      return this.#init.hub ? this.#init.hub.scrubRelayed(request.method, result) : result;
     } catch (e) {
       if (e instanceof McpSignInRequired) {
         // Not signed in, or the credential was lost mid-session (a refused
diff --git a/src/daemon/memory/engine.ts b/src/daemon/memory/engine.ts
index be2665d0..584ae579 100644
--- a/src/daemon/memory/engine.ts
+++ b/src/daemon/memory/engine.ts
@@ -200,7 +200,16 @@ export class MemoryEngine {
    * the full body is kept verbatim, and only a bounded view of it is
    * full-text indexed and embedded (lossless.ts explains the split).
    */
-  ingest(episode: Omit<Episode, "id">): Episode {
+  /**
+   * Applied to an episode's text before it is stored (docs/secrets-and-memory-design.md §2.6):
+   * the daemon's secret scrubbing, so nothing that ingests — a session, a raw-output spill,
+   * an import — stores a secret's value. Unset: stored as given.
+   */
+  scrubText: ((text: string, ctx: { workstream?: string; sessionId?: string }) => string) | undefined;
+
+  ingest(raw: Omit<Episode, "id">): Episode {
+    const ctx = { ...(raw.workstreamId ? { workstream: raw.workstreamId } : {}), sessionId: raw.sessionId };
+    const episode = this.scrubText ? { ...raw, summary: this.scrubText(raw.summary, ctx), content: this.scrubText(raw.content, ctx) } : raw;
     const view = indexView(episode.content);
     const saved = this.#store.insert(
       view === episode.content ? episode : { ...episode, content: view, fullContent: episode.content },
diff --git a/src/daemon/providers/canonical.ts b/src/daemon/providers/canonical.ts
index 88a90902..4d010823 100644
--- a/src/daemon/providers/canonical.ts
+++ b/src/daemon/providers/canonical.ts
@@ -392,6 +392,27 @@ export class CanonicalHistoryAccumulator {
   #currentTurnId: string | undefined;
   /** Notified after every committed change (see CanonicalHistoryChange). */
   onChange: ((change: CanonicalHistoryChange) => void) | undefined;
+  /**
+   * Applied to every turn as it is committed, before it is kept or persisted:
+   * the session's secret scrubbing (docs/secrets-and-memory-design.md §2), so
+   * no backend is ever seeded with a value codeoid wouldn't store.
+   */
+  scrubTurn: ((turn: CanonicalTurn) => CanonicalTurn) | undefined;
+  /** Applied to every turn a seed brings in (a fork's parent's history, a rewind's): it may predate scrubbing. */
+  scrubSeed: ((turn: CanonicalTurn) => CanonicalTurn) | undefined;
+
+  /** Fails closed: a turn that can't be scrubbed keeps none of its text. */
+  #scrubbed(turn: CanonicalTurn, scrub = this.scrubTurn): CanonicalTurn {
+    if (!scrub) return turn;
+    try {
+      return scrub(turn);
+    } catch {
+      const content = "‹not stored: it couldn't be checked for secrets›";
+      return turn.role === "user"
+        ? { ...turn, content, ...(turn.prompt !== undefined ? { prompt: content } : {}) }
+        : { ...turn, content, ...(turn.thinking ? { thinking: "" } : {}), ...(turn.toolCalls ? { toolCalls: [] } : {}) };
+    }
+  }
 
   // In-progress assistant turn state — reset on each turn_done.
   #currentText = "";
@@ -422,14 +443,14 @@ export class CanonicalHistoryAccumulator {
     turnId?: string,
     extra?: { prompt?: string; at?: string; background?: boolean },
   ): void {
-    const turn: CanonicalTurn = {
+    const turn: CanonicalTurn = this.#scrubbed({
       role: "user",
       content,
       ...(turnId ? { turnId } : {}),
       ...(extra?.prompt !== undefined && extra.prompt !== content ? { prompt: extra.prompt } : {}),
       ...(extra?.at ? { at: extra.at } : {}),
       ...(extra?.background ? { background: true } : {}),
-    };
+    });
     this.#currentTurnId = turnId;
     this.#lastTextBlock = null;
     this.#history.push(turn);
@@ -503,7 +524,7 @@ export class CanonicalHistoryAccumulator {
         const produced =
           this.#currentText.length > 0 || toolCalls.length > 0 || this.#currentThinking.length > 0;
         if (produced) {
-          const turn: CanonicalTurn = {
+          const turn: CanonicalTurn = this.#scrubbed({
             role: "assistant",
             content: this.#currentText,
             ...(this.#currentTurnId ? { turnId: this.#currentTurnId } : {}),
@@ -512,7 +533,7 @@ export class CanonicalHistoryAccumulator {
             providerId: event.result.providerId,
             model: event.result.model,
             ...(event.result.nativeRef ? { native: event.result.nativeRef } : {}),
-          };
+          });
           this.#history.push(turn);
           this.#emit({ op: "append", turn });
         }
@@ -550,7 +571,7 @@ export class CanonicalHistoryAccumulator {
    */
   seed(turns: readonly CanonicalTurn[]): void {
     this.#clear();
-    this.#history = turns.map((t) => structuredClone(t));
+    this.#history = turns.map((t) => this.#scrubbed(structuredClone(t), this.scrubSeed));
     this.#currentTurnId = lastTurnId(this.#history);
     this.#emit({ op: "replace", turns: this.#history });
   }
diff --git a/src/daemon/routines/store.ts b/src/daemon/routines/store.ts
index e8858089..fef72f8c 100644
--- a/src/daemon/routines/store.ts
+++ b/src/daemon/routines/store.ts
@@ -77,6 +77,16 @@ export function hashToken(token: string): string {
 
 export class RoutineStore {
   readonly #db: Database;
+  /**
+   * Applied to a run's check output, summary and reason as they are written
+   * (docs/secrets-and-memory-design.md §2.6). Not the payload: the run reads it
+   * back as its data, and it is what whoever fired the routine sent.
+   */
+  scrubText: ((text: string) => string) | undefined;
+
+  #scrub(v: string | null): string | null {
+    return v && this.scrubText ? this.scrubText(v) : v;
+  }
 
   constructor(db: Database | string) {
     this.#db = typeof db === "string" ? new Database(db, { create: true }) : db;
@@ -324,9 +334,9 @@ export class RoutineStore {
         run.costUsd,
         run.inputTokens,
         run.outputTokens,
-        run.summary,
-        run.reason,
-        run.checkOutput,
+        this.#scrub(run.summary),
+        this.#scrub(run.reason),
+        this.#scrub(run.checkOutput),
         run.payload,
         run.loopRunId,
         run.loopStatus,
@@ -358,7 +368,8 @@ export class RoutineStore {
       const col = cols[k];
       if (!col || v === undefined) continue;
       sets.push(`${col} = ?`);
-      vals.push(typeof v === "boolean" ? (v ? 1 : 0) : (v as string | number | null));
+      const scrubbed = (k === "summary" || k === "reason" || k === "checkOutput") && typeof v === "string" ? this.#scrub(v) : v;
+      vals.push(typeof scrubbed === "boolean" ? (scrubbed ? 1 : 0) : (scrubbed as string | number | null));
     }
     if (sets.length === 0) return;
     this.#db.prepare(`UPDATE routine_runs SET ${sets.join(", ")} WHERE id = ?`).run(...vals, id);
diff --git a/src/daemon/secrets/detect.ts b/src/daemon/secrets/detect.ts
new file mode 100644
index 00000000..01acc044
--- /dev/null
+++ b/src/daemon/secrets/detect.ts
@@ -0,0 +1,425 @@
+/**
+ * Credentials found by shape (docs/secrets-and-memory-design.md §2.3): a
+ * service's token format, a private key's armour, a URL's password, an
+ * `Authorization` header, a value assigned to a name like `DB_PASSWORD` or
+ * `"api_key"`.
+ *
+ * The tables follow atuin's (`atuin-common/src/secrets.rs`, `vendors.rs`,
+ * `structural.rs`; MIT), which follow gitleaks' (MIT) where a format has a
+ * prefix of its own. Only known shapes and values bound to secret-named keys
+ * are found, never "looks random", so hashes, ids and paths survive. Each
+ * pattern's `secret` group is the part replaced; a name or flag around it is
+ * kept (`DB_PASSWORD=‹secret:password:9c2e41aa›`).
+ *
+ * Every pattern is linear (no nested quantifiers), and each match is bounded,
+ * so a scan is proportional to the text.
+ */
+
+export interface SecretSpan {
+  start: number;
+  end: number;
+  /** A slug for the reference: `github-token`, `password`, `private-key`, … */
+  kind: string;
+  /**
+   * A format that can't be mistaken for anything else (a vendor's token, a JWT, a key): safe to
+   * remember and match bare from then on. A value found only by the name it sits under
+   * (`password: …`) isn't: the same word is often ordinary text elsewhere.
+   */
+  distinct: boolean;
+}
+
+interface Pattern {
+  kind: string;
+  re: RegExp;
+  /**
+   * A value that is plainly not a credential is left as it is: a placeholder; a "word" (a type,
+   * code: another name, a call); an "env" value (as a word, but a snake_case or camelCase value
+   * of an environment variable is a password like any other).
+   */
+  check?: "placeholder" | "word" | "env" | "opaque";
+  /** See {@link SecretSpan.distinct}. */
+  distinct?: boolean;
+  /** Only where the match's line also matches this (checked after the match, so the pattern stays linear). */
+  line?: RegExp;
+  /**
+   * What comes before the match, checked in code rather than by a leading lookbehind or class
+   * (which an engine tries at every position: twenty times slower on Bun 1.3): the match may
+   * reach back over up to `max` of `chars` (a name's start), and the character before that must
+   * match `before` (or be the text's start).
+   */
+  back?: { chars?: RegExp; max?: number; before: RegExp; escapes?: boolean };
+  /** The value's length, when the pattern's runs leave it unbounded: outside it, not a value this pattern finds. */
+  length?: [number, number];
+  /**
+   * The value, matched (sticky) just after `re`, which then finds only what comes before it: one
+   * regex with both runs uncompiled on Bun 1.3, two hundred times slower over the whole text.
+   */
+  value?: RegExp;
+}
+
+/** Not inside a longer token. */
+const WORD_BOUNDARY = { before: /[^A-Za-z0-9_]/ };
+
+/** Nor just after. */
+const E = "(?![A-Za-z0-9_])";
+
+const vendor = (kind: string, body: string): Pattern => ({ kind, re: new RegExp(`(?<secret>${body})${E}`, "g"), distinct: true, back: WORD_BOUNDARY });
+
+/** Formats with a prefix of their own: they can't be mistaken for anything else. */
+const VENDOR: Pattern[] = [
+  vendor("anthropic-key", "sk-ant-(?:api|admin|oat|ort)[0-9]{2}-[A-Za-z0-9_-]{60,300}"),
+  vendor("openai-key", "sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,300}|sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}"),
+  vendor("openrouter-key", "sk-or-v1-[a-f0-9]{64}"),
+  vendor("groq-key", "gsk_[A-Za-z0-9]{52}"),
+  vendor("xai-key", "xai-[A-Za-z0-9]{60,200}"),
+  vendor("perplexity-key", "pplx-[A-Za-z0-9]{48}"),
+  vendor("pinecone-key", "pcsk_[A-Za-z0-9_]{50,200}"),
+  vendor("langsmith-key", "lsv2_(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{10}"),
+  vendor("google-key", "AIza[0-9A-Za-z_-]{35}"),
+  vendor("huggingface-token", "hf_[A-Za-z]{34}|api_org_[A-Za-z]{34}"),
+  vendor("digitalocean-token", "do[opr]_v1_[a-f0-9]{64}"),
+  vendor("sendgrid-key", "SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}"),
+  vendor("brevo-key", "xkeysib-[a-f0-9]{64}-[A-Za-z0-9]{16}"),
+  vendor("linear-key", "lin_api_[A-Za-z0-9]{40}"),
+  vendor("doppler-token", "dp\\.(?:pt|st|ct|sa|scim|audit)\\.[A-Za-z0-9]{40,44}"),
+  vendor("shopify-token", "shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}"),
+  vendor("databricks-token", "dapi[a-f0-9]{32}(?:-[0-9])?"),
+  vendor("pypi-token", "pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,300}"),
+  vendor("rubygems-key", "rubygems_[a-f0-9]{48}"),
+  vendor("notion-token", "ntn_[0-9]{11}[A-Za-z0-9]{35}"),
+  vendor("atlassian-token", "ATATT3[A-Za-z0-9_=-]{60,300}"),
+  vendor("age-key", "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}"),
+  vendor("onepassword-token", "ops_eyJ[A-Za-z0-9+/]{60,2000}={0,3}"),
+  vendor(
+    "slack-token",
+    "xox[bpe](?:-[0-9]{10,13}){2,3}-[A-Za-z0-9-]{24,34}|xapp-[0-9]-[A-Z0-9]{1,20}-[0-9]{1,20}-[a-z0-9]{1,100}|xoxe(?:\\.xox[bp])?-[0-9]-[A-Za-z0-9]{60,300}|xox[ar]-(?:[0-9]-)?[0-9a-zA-Z]{8,48}|xox[os]-[0-9]{1,20}-[0-9]{1,20}-[0-9]{1,20}-[a-fA-F0-9]{1,100}",
+  ),
+  vendor("slack-webhook", "T[A-Za-z0-9_]{8}/B[A-Za-z0-9_]{8}/[A-Za-z0-9_]{24}"),
+  vendor(
+    "gitlab-token",
+    "glpat-[A-Za-z0-9_-]{20,100}(?:\\.[0-9a-z]{9})?|glptt-[0-9a-f]{40}|glrt-[A-Za-z0-9_-]{20,100}(?:\\.[0-9a-z]{9})?|gl(?:dt|ft|soat|ffct)-[A-Za-z0-9_-]{20}|glcbt-[A-Za-z0-9]{1,5}_[A-Za-z0-9_-]{20}|glagent-[A-Za-z0-9_-]{50}|glimt-[A-Za-z0-9_-]{25}|gloas-[A-Za-z0-9_-]{64}|GR1348941[A-Za-z0-9_-]{20}",
+  ),
+  vendor("grafana-token", "glc_[A-Za-z0-9+/]{32,400}={0,3}|glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}|eyJrIjoi[A-Za-z0-9]{60,400}={0,3}"),
+  vendor("sentry-token", "sntryu_[a-f0-9]{64}|sntrys_eyJ[A-Za-z0-9+/=_]{40,400}"),
+  vendor("vault-token", "hvs\\.[A-Za-z0-9_-]{60,300}|hvb\\.[A-Za-z0-9_-]{60,300}"),
+  vendor("terraform-token", "[A-Za-z0-9]{14}\\.atlasv1\\.[A-Za-z0-9_=-]{60,70}"),
+  vendor("planetscale-token", "pscale_(?:tkn|oauth|pw)_[A-Za-z0-9_=.-]{32,64}"),
+  vendor("postman-key", "PMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}"),
+  vendor("readme-key", "rdme_[a-z0-9]{70}"),
+  vendor("prefect-key", "pnu_[A-Za-z0-9]{36}"),
+  vendor("heroku-key", "HRKU-AA[A-Za-z0-9_-]{58}"),
+  vendor("supabase-key", "sb_secret_[A-Za-z0-9_-]{31,100}|sbp_[a-f0-9]{40}"),
+  vendor("artifactory-key", "AKCp[A-Za-z0-9]{69}"),
+  vendor("bedrock-key", "ABSK[A-Za-z0-9+/]{60,400}={0,2}"),
+  vendor("flyio-token", "fo1_[A-Za-z0-9_-]{43}|fm[12][ar]?_[A-Za-z0-9+/]{60,1000}={0,3}"),
+  vendor("dynatrace-token", "dt0c01\\.[A-Za-z0-9]{24}\\.[A-Za-z0-9]{64}"),
+  vendor("square-token", "sq0atp-[A-Za-z0-9_-]{22,60}|sq0csp-[A-Za-z0-9_-]{43}"),
+  vendor("stripe-key", "(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,200}|sk_prod_[A-Za-z0-9]{24,200}"),
+  vendor("dockerhub-token", "dckr_pat_[A-Za-z0-9_-]{27}"),
+  vendor("tailscale-key", "tskey-(?:api|auth|client|scim|webhook)-[A-Za-z0-9]{8,40}-[A-Za-z0-9]{20,100}"),
+  vendor("azure-secret", "[A-Za-z0-9_~.]{3}[0-9]Q~[A-Za-z0-9_~.-]{31,34}"),
+  vendor("telegram-token", "[0-9]{8,10}:AA[A-Za-z0-9_-]{33}"),
+  vendor("discord-webhook", "https://(?:ptb\\.|canary\\.)?discord(?:app)?\\.com/api/webhooks/[0-9]{1,30}/[A-Za-z0-9_-]{60,100}"),
+  vendor("openshift-token", "sha256~[A-Za-z0-9_-]{43}"),
+  vendor("aws-key-id", "A[KS]IA[0-9A-Z]{16}"),
+  vendor("github-token", "gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255}"),
+  vendor("netlify-token", "nf[pcoub]_[0-9a-zA-Z]{36}"),
+  vendor("npm-token", "npm_[A-Za-z0-9]{36}"),
+  vendor("pulumi-token", "pul-[0-9a-f]{40}"),
+  vendor("zeroid-key", "zid_sk_[A-Za-z0-9_-]{16,200}"),
+  // codeoid's own: the blackboard, memory and sandbox MCP tokens, a routine's API token.
+  vendor("codeoid-token", "(?:bbt|mmt|sbt)_[0-9a-f]{32}|rt_[0-9a-f]{12}_[A-Za-z0-9_-]{32}"),
+  vendor("highflame-key", "hf_sk_[A-Za-z0-9_-]{16,200}"),
+];
+
+/** Credentials recognised by where they sit. */
+const STRUCTURAL: Pattern[] = [
+  { kind: "bearer-token", re: /bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder", distinct: true, back: WORD_BOUNDARY },
+  { kind: "authorization", re: /authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder", distinct: true, back: WORD_BOUNDARY },
+  // curl's `-u user:password`: the line must run curl (checked in findSecrets: `line: /\bcurl\b/`).
+  { kind: "password", re: /(?:^|[ \t])(?:-u|--user)(?:=|[ \t]+)["']?[^:\s"']{0,200}:(?<secret>[^\s"']{1,500})/gm, check: "placeholder", line: /\bcurl\b/ },
+  // A .netrc entry's password.
+  { kind: "password", re: /(?:^|\s)machine\s+\S{1,253}\s+(?:login\s+\S{1,200}\s+)?password\s+(?<secret>\S{1,500})/g, check: "placeholder" },
+  { kind: "password", re: /^[ \t]*password[ \t]+(?<secret>\S{1,500})[ \t]*$/gm, check: "placeholder" },
+  // A URL's userinfo password, found from its `://` (the scheme before it, whatever it is).
+  { kind: "password", re: /:\/\/[^\s/?#@"'`<>:]{0,200}:(?<secret>[^\s/?#@"'`<>]{1,500})@/g, check: "placeholder", back: { chars: /[a-z0-9+.-]/i, max: 32, before: /[^A-Za-z0-9_]/ } },
+  { kind: "password", re: /(?:^|[?&;\s-])(?:password|pwd)=(?<secret>"[^"\n]{0,500}"|'[^'\n]{0,500}'|[^&;\s"'`]{0,500}[^&;\s"'`,])/gim, check: "placeholder" },
+  { kind: "aws-secret", re: /aws_secret_access_key["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?(?<secret>[A-Za-z0-9/+]{40,100})/gi, distinct: true },
+  { kind: "twilio-key", re: new RegExp(`(?<secret>SK[0-9a-fA-F]{32})${E}`, "g"), distinct: true, back: WORD_BOUNDARY },
+];
+
+/** The words an environment variable's name ends with when it holds a credential. */
+/** The word an environment variable's name ends with; its start is found in code (`ENV_BACK`). */
+const ENV_NAME = "(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIALS?|AUTH)(?![A-Za-z0-9_])";
+const ENV_BACK = { chars: /[A-Z0-9_]/, max: 100, before: /[^A-Za-z0-9_]/ };
+/** A code name's start: any word characters, dots and dashes, after something that isn't one (a quote, a space). */
+const CODE_BACK = { chars: /[A-Za-z0-9_.-]/, max: 100, before: /[^A-Za-z0-9_.-]/ };
+/** The same as code, JSON and config files spell them; not `auth` alone, nor `tokens` (`max_tokens`). */
+const CODE_WORD = "(?:passw(?:or)?d|passphrase|secret|api[_-]?key|private[_-]?key|access[_-]?key|(?:auth|access|refresh|bearer|id|session)[_-]?token|token)";
+/** One character of an unquoted value: not one that ends it, a `&` unless another `name=` follows, a `\` unless an escape does. */
+// Runs of plain characters, not one alternation per character (twenty times slower on Bun 1.3);
+// the value's length is bounded in code (`length`).
+const VALUE_RUN = `(?:[^\\s"'\`,;)\\]}{(<>&\\\\]+|&(?![A-Za-z_][\\w.-]*=)|\\\\(?![nrt"\\\\]))+`;
+const DOTENV_RUN = `(?:[^\\s#"&\\\\]+|&(?![A-Za-z_][\\w.-]*=)|\\\\(?![nrt"\\\\]))*`;
+/** In a line-anchored pattern (tried only at line starts): the name's start written out. */
+const CODE_NAME = `[\\w.-]{0,100}?${CODE_WORD}`;
+const SEPARATOR = `["'\\]]?[ \\t]*(?::=|=>|\\?=|[=:])[ \\t]*`;
+const QUOTED = `"(?:[^"\\\\\\n]|\\\\.){6,1000}"|'[^'\\n]{6,1000}'`;
+
+/** Values assigned to a name a credential is kept under. */
+const NAMED: Pattern[] = [
+  // An environment variable's value: stops at a `&` that starts another `name=` (a query string),
+  // and at an escape in JSON text (`\n`); a password may hold `&` or `\` otherwise.
+  {
+    kind: "credential",
+    re: new RegExp(`${ENV_NAME}${SEPARATOR}`, "g"),
+    value: new RegExp(`${QUOTED}|${VALUE_RUN}`, "y"),
+    check: "env",
+    back: ENV_BACK,
+    length: [6, 1000],
+  },
+  // An HTTP header named for a credential, unquoted (`-H "X-Api-Key: abc…"`, `api-key: …`).
+  {
+    kind: "credential",
+    re: /(?:api-?key|auth-?token|access-?token|secret|password|token)[ \t]*:[ \t]*(?<secret>[^\s"',;!][^\s"',;]{5,1000})/gi,
+    check: "opaque",
+    back: { chars: /[A-Za-z0-9-]/, max: 64, before: /[\s"']/ },
+  },
+  // A URL's query value named for a credential (`?api_key=…`, `&access_token=…`).
+  {
+    kind: "credential",
+    re: /[?&](?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|auth[_-]?token|token|client[_-]?secret|secret|password|pwd|sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature)=(?<secret>[^&#\s"'<>]{6,1000})/gi,
+    check: "opaque",
+  },
+  // A client's password flag glued to its value (`mysql -pHunter2`), or apart (`sshpass -p …`, `docker login -p …`).
+  // The client is the program run (not a word elsewhere: `mysql:8` as an image), its -p among its own options.
+  { kind: "password", re: /(?:mysql|mysqldump|mysqladmin|mariadb)[ \t](?:[^\n|;&-]|-[^p\n|;&]){0,300}?-p(?<secret>[^\s"'-][^\s"']{0,200})/g, check: "placeholder", back: { before: /[\s;&|(]/ } },
+  { kind: "password", re: /sshpass[ \t]+-p[ \t]*(?<secret>[^\s"'-][^\s"']{0,200})/g, check: "placeholder", back: { before: /[\s;&|(]/ } },
+  { kind: "password", re: /(?:docker|podman|nerdctl|helm)[ \t]+(?:registry[ \t]+)?login\b[^\n|;&]{0,300}?[ \t]-p[ \t]+(?<secret>[^\s"'-][^\s"']{0,200})/g, check: "placeholder", back: { before: /[\s;&|(]/ } },
+  { kind: "credential", re: new RegExp(`${CODE_WORD}${SEPARATOR}(?<secret>${QUOTED})`, "gi"), check: "word", back: CODE_BACK },
+  {
+    kind: "password",
+    re: /(?:^|[ \t])--passw(?:or)?d[ \t]+(?<secret>"(?:[^"\\\n]|\\.){1,500}"|'[^'\n]{1,500}'|(?:[^\s"'\\<>[{()|&;`-][^\s"'\\|&;<>()`]{0,500}?)?[^A-Za-z\s"'\\.,:;()[\]{}<>|&`-][^\s"'\\|&;<>()`]{0,500})(?=[\s"';&|)\\]|$)/g,
+    check: "placeholder",
+  },
+  // YAML-like `name: value`: the value runs to the end of the line (`password: correct horse`).
+  {
+    kind: "credential",
+    // A trailing comment isn't part of it; `=` inside is (base64).
+    re: new RegExp(`^\\+?[ \\t]*(?:-[ \\t]+)?["']?${CODE_NAME}["']?[ \\t]*:[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\n#"]{0,1000})(?:#[^\\n]*)?$`, "gim"),
+    check: "word",
+  },
+  // `.env`/INI-like `name=value`: up to the first space (`PGPASSWORD=x psql -h db` is a command).
+  {
+    kind: "credential",
+    re: new RegExp(`^\\+?[ \\t]*["']?${CODE_NAME}["']?[ \\t]*=[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=]${DOTENV_RUN})`, "gim"),
+    length: [1, 1001],
+    check: "env",
+  },
+];
+
+/** With indices (`d`), so the `secret` group's position is exact. */
+const PATTERNS: readonly Pattern[] = [...VENDOR, ...STRUCTURAL, ...NAMED].map((p) => ({ ...p, re: new RegExp(p.re.source, p.re.flags.includes("d") ? p.re.flags : `${p.re.flags}d`) }));
+
+const KEY_HEADER = /-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----/y;
+const KEY_FOOTER = /^-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----/;
+/** What a key's armour holds: base64 lines, PEM headers (`Proc-Type: 4,ENCRYPTED`), escaped newlines in JSON. */
+const KEY_BODY = /^[A-Za-z0-9+/=\s:,.\\-]{16,64000}$/;
+const MAX_KEY_BODY = 64_000;
+
+/**
+ * Private keys, by their armour: the body between a BEGIN line and its END
+ * line (or the end of the text, for clipped output), when it is what armour
+ * holds — so a header string in source code never swallows the code after
+ * it. Found with indexOf, one forward pass: a text of repeated headers costs
+ * no more than its length.
+ */
+function privateKeySpans(text: string): SecretSpan[] {
+  const out: SecretSpan[] = [];
+  let from = 0;
+  let nextEnd = -2;
+  while (true) {
+    const begin = text.indexOf("-----BEGIN", from);
+    if (begin < 0) break;
+    from = begin + 10;
+    KEY_HEADER.lastIndex = begin;
+    const header = KEY_HEADER.exec(text);
+    if (!header) continue;
+    const bodyStart = begin + header[0].length;
+    if (nextEnd !== -1 && nextEnd < bodyStart) nextEnd = text.indexOf("-----END", bodyStart);
+    let bodyEnd: number;
+    if (nextEnd >= 0 && nextEnd - bodyStart <= MAX_KEY_BODY && KEY_FOOTER.test(text.slice(nextEnd, nextEnd + 140))) bodyEnd = nextEnd;
+    else if (text.length - bodyStart <= MAX_KEY_BODY) bodyEnd = text.length;
+    else continue;
+    if (!KEY_BODY.test(text.slice(bodyStart, bodyEnd))) continue;
+    out.push({ start: bodyStart, end: bodyEnd, kind: "private-key", distinct: true });
+    from = bodyEnd;
+  }
+  return out;
+}
+
+const JWT_CHAR = /[A-Za-z0-9_-]/;
+
+/** Where the run of base64url characters starting at `i` ends. */
+function runEnd(text: string, i: number): number {
+  let q = i;
+  while (q < text.length && JWT_CHAR.test(text[q]!)) q++;
+  return q;
+}
+
+/**
+ * JSON web tokens: `eyJ…` header, `.`, `eyJ…` payload, `.`, a signature, each
+ * part its run of base64url characters and of bounded length, after a
+ * non-word character or an escaped newline or tab in JSON text. Found in one
+ * forward pass: a `eyJ` inside a run already looked at shares its end, so a
+ * text of repeated `eyJ` costs no more than its length (the regex rescanned
+ * each one: seconds on Bun 1.3).
+ */
+function jwtSpans(text: string): SecretSpan[] {
+  const out: SecretSpan[] = [];
+  let from = 0;
+  let known = -1;
+  let knownEnd = -1;
+  while (true) {
+    const i = text.indexOf("eyJ", from);
+    if (i < 0) break;
+    from = i + 3;
+    if (i > 0) {
+      const prev = text[i - 1]!;
+      const escaped = i > 1 && text[i - 2] === "\\" && "nrt".includes(prev);
+      if (!escaped && JWT_CHAR.test(prev)) continue;
+    }
+    // A start inside a run already measured ends where it ends.
+    const headEnd = i < knownEnd && i > known ? knownEnd : runEnd(text, i);
+    known = i;
+    knownEnd = headEnd;
+    if (headEnd - i < 13 || headEnd - i > 4003 || text[headEnd] !== ".") {
+      from = Math.max(from, headEnd);
+      continue;
+    }
+    const p = headEnd + 1;
+    if (!text.startsWith("eyJ", p)) continue;
+    const payloadEnd = runEnd(text, p);
+    if (payloadEnd - p < 13 || payloadEnd - p > 8003 || text[payloadEnd] !== ".") continue;
+    const sigEnd = runEnd(text, payloadEnd + 1);
+    const sig = sigEnd - payloadEnd - 1;
+    if (sig < 10 || sig > 2000) continue;
+    out.push({ start: i, end: sigEnd, kind: "jwt", distinct: true });
+    from = sigEnd;
+  }
+  return out;
+}
+
+/** The references codeoid writes itself: never taken for a secret again. */
+const OWN_REFERENCE = /^‹(?:credential|secret|output withheld|not stored)[:\s›]/;
+
+const STAND_INS = new Set([
+  "changeme", "change_me", "change-me", "example", "password", "passwd", "secret", "token", "your_password", "your-password",
+  "yourpassword", "your_token", "your_api_key", "redacted", "placeholder", "dummy", "undefined", "required", "optional",
+  "enabled", "disabled", "on", "off", "yes", "no", "bearer", "basic", "auto", "none", "default", "test", "local", "localhost",
+]);
+const TYPES = new Set(["str", "string", "bool", "boolean", "int", "integer", "number", "float", "any", "object", "bytes", "char", "none", "null", "nil", "true", "false"]);
+
+/** A value that plainly isn't a credential: a reference to one (`$TOKEN`, `${{ secrets.X }}`), a stand-in, a run of one character. */
+export function isPlaceholder(raw: string): boolean {
+  const value = raw.trim().replace(/^["'\\]+|["'\\]+$/g, "").trim();
+  if (value.length === 0) return true;
+  if (OWN_REFERENCE.test(value)) return true;
+  const lower = value.toLowerCase();
+  if (["$", "%", "{{", "os.environ", "process.env", "env.", "env(", "env[", "getenv"].some((r) => lower.startsWith(r))) return true;
+  if (value.length > 2 && value.startsWith("<") && value.endsWith(">") && /^[A-Za-z_\- ]+$/.test(value.slice(1, -1))) return true;
+  const first = value[0]!;
+  if (value.length >= 3 && "*x.-•".includes(first) && [...value].every((c) => c === first)) return true;
+  return STAND_INS.has(lower);
+}
+
+/** {@link isPlaceholder}, or, unquoted, a type or code: what a name's value in code is far more often than a credential. */
+function isWord(raw: string, identifiers = true): boolean {
+  const value = raw.trim();
+  if (isPlaceholder(value)) return true;
+  if (value.startsWith('"') || value.startsWith("'")) return false;
+  // Code, not a value: another name — a dotted path or a call (`self.token`, `config.apiKey`,
+  // `getToken()`), a snake_case or camelCase identifier (`api_key`, `idToken`). A plain word
+  // (`Violetmeadow`, `postgres`) can be a password, and stays one.
+  const bare = value.replace(/[,;)]+$/, "");
+  if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+(?:\(\))?$/.test(bare) || /^[A-Za-z_$][\w$]*\(\)$/.test(bare)) return true;
+  if (identifiers && /^[A-Za-z_$][\w$]*$/.test(bare) && (bare.includes("_") || /[a-z][A-Z]/.test(bare)) && !/[0-9]/.test(bare)) return true;
+  if (/[0-9]/.test(value)) return false;
+  return /[<>[\]&:(){},;]/.test(value) || TYPES.has(value.toLowerCase());
+}
+
+/**
+ * Every credential found in `text`, by position, overlaps merged (the
+ * earliest start wins, and a span reaches as far as any overlapping one).
+ * `deadline` (a `performance.now()` value) is checked between patterns:
+ * past it, null — the caller must not store what couldn't be checked.
+ */
+export function findSecrets(text: string, deadline = Number.POSITIVE_INFINITY): SecretSpan[] | null {
+  const spans: SecretSpan[] = [...privateKeySpans(text), ...jwtSpans(text)];
+  for (const p of PATTERNS) {
+    if (performance.now() > deadline) return null;
+    p.re.lastIndex = 0;
+    let n = 0;
+    /** Per pattern: each line's `line` test, once. */
+    const lineCache = new Map<number, boolean>();
+    for (const m of text.matchAll(p.re)) {
+      if (++n % 256 === 0 && performance.now() > deadline) return null;
+      let raw = m.groups?.secret;
+      let at = m.indices?.groups?.secret;
+      if (p.value) {
+        p.value.lastIndex = m.index! + m[0].length;
+        const v = p.value.exec(text);
+        if (!v) continue;
+        raw = v[0];
+        at = [v.index, v.index + v[0].length];
+      }
+      if (raw === undefined || raw.length === 0 || !at) continue;
+      // A value to the end of its line loses the spaces after it.
+      const secret = raw.replace(/[ \t]+$/, "");
+      if (secret.length === 0) continue;
+      if (p.length && (secret.length < p.length[0] || secret.length > p.length[1])) continue;
+      if (p.check === "placeholder" && isPlaceholder(secret)) continue;
+      if (p.check === "word" && isWord(secret)) continue;
+      // `NAME=value` (a .env file, a shell) holds a value whatever it looks like; `name = value`,
+      // spaced, is code, where another name is more likely than a password.
+      if (p.check === "env" && isWord(secret, /[ \t]/.test(text[at[0] - 1] ?? ""))) continue;
+      // An unquoted header or query value: only one that looks like a key (a digit, or both cases),
+      // not a status word (`token: refreshed`, `?token=nextpage`).
+      if (p.check === "opaque" && (isWord(secret) || !(/[0-9]/.test(secret) && /[A-Za-z]/.test(secret)) && !(/[a-z]/.test(secret) && /[A-Z]/.test(secret)))) continue;
+      if (p.back) {
+        let i = m.index!;
+        for (let k = 0; p.back.chars && k < (p.back.max ?? 0) && i > 0 && p.back.chars.test(text[i - 1]!); k++) i--;
+        if (i > 0) {
+          const prev = text[i - 1]!;
+          // `escapes`: also after an escaped newline or tab in JSON text.
+          const escaped = p.back.escapes === true && i > 1 && text[i - 2] === "\\" && "nrt".includes(prev);
+          if (!escaped && !p.back.before.test(prev)) continue;
+        }
+      }
+      if (p.line) {
+        const lineStart = text.lastIndexOf("\n", at[0]) + 1;
+        let ok = lineCache.get(lineStart);
+        if (ok === undefined) {
+          const lineEnd = text.indexOf("\n", at[0]);
+          ok = p.line.test(text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd));
+          lineCache.set(lineStart, ok);
+        }
+        if (!ok) continue;
+      }
+      // A quoted value keeps its quotes: `"api_key": "‹secret:…›"` still reads as JSON.
+      const quoted = secret.length >= 2 && (secret[0] === '"' || secret[0] === "'") && secret.at(-1) === secret[0];
+      spans.push({ start: at[0] + (quoted ? 1 : 0), end: at[0] + secret.length - (quoted ? 1 : 0), kind: p.kind, distinct: p.distinct === true });
+    }
+  }
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const merged: SecretSpan[] = [];
+  for (const s of spans) {
+    const last = merged[merged.length - 1];
+    if (last && s.start < last.end) {
+      last.end = Math.max(last.end, s.end);
+      last.distinct = last.distinct && s.distinct;
+    }
+    else merged.push({ ...s });
+  }
+  return merged;
+}
diff --git a/src/daemon/secrets/files.ts b/src/daemon/secrets/files.ts
new file mode 100644
index 00000000..9163b461
--- /dev/null
+++ b/src/daemon/secrets/files.ts
@@ -0,0 +1,64 @@
+/**
+ * Files whose contents are credentials (`.env`, `~/.ssh/id_ed25519`,
+ * `~/.aws/credentials`, an agent's own login), after atuin's (less `*.pem`:
+ * most are public certificates, and a private key in one is found by its
+ * armour when it is read out, detect.ts),
+ * `atuin-common/src/secrets/files.rs` (MIT). What reads one out, or writes
+ * one, isn't stored (verdict.ts): such a file holds nothing else, in
+ * whatever format, so scrubbing by shape would miss whatever it can't name.
+ */
+
+import { homedir } from "node:os";
+import { basename, isAbsolute, join, normalize, resolve } from "node:path";
+
+/** Names that say a file holds credentials, wherever it is (`*` within the name). */
+const NAMES = [
+  ".env", ".env.*", "*.env", ".envrc", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", "id_ecdsa_sk", "id_ed25519_sk",
+  "*.key", "*.p12", "*.pfx", "*.jks", "*.keystore", "*.tfstate", "*.tfstate.backup", "*.tfvars",
+  ".netrc", "_netrc", ".pgpass", ".git-credentials", ".npmrc", ".pypirc", ".htpasswd", ".vault-token",
+];
+
+/** Of those, templates and public halves. */
+const NOT_NAMES = ["*.example", "*.sample", "*.template", "*.dist", "*.pub"];
+
+/** Where tools keep their logins, under the home (`**` any depth below). */
+const HOME_PATHS = [
+  ".aws/credentials", ".aws/sso/cache/**", ".aws/cli/cache/**",
+  ".config/gcloud/application_default_credentials.json", ".config/gcloud/credentials.db", ".config/gcloud/access_tokens.db",
+  ".config/gcloud/legacy_credentials/**", ".azure/msal_token_cache.*", ".kube/config", ".docker/config.json",
+  ".config/gh/hosts.yml", ".config/glab-cli/config.yml", ".config/hub", ".terraform.d/credentials.tfrc.json",
+  ".cargo/credentials", ".cargo/credentials.toml", ".gem/credentials", ".gnupg/private-keys-v1.d/**", ".password-store/**",
+  ".claude/.credentials.json", ".codex/auth.json", ".local/share/opencode/auth.json", ".pi/agent/auth.json",
+  ".gemini/oauth_creds.json", ".qwen/oauth_creds.json",
+];
+
+function globToRegExp(glob: string): RegExp {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i]!;
+    if (c === "*" && glob[i + 1] === "*") {
+      re += ".*";
+      i++;
+    } else if (c === "*") re += "[^/]*";
+    else re += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+
+const NAME_RES = NAMES.map(globToRegExp);
+const NOT_NAME_RES = NOT_NAMES.map(globToRegExp);
+
+/** Whether `path` (relative ones from `cwd`) is a file that holds credentials. `extra`: the user's own globs, by name or by path. */
+export function isCredentialFile(path: string, cwd: string, extra: readonly string[] = []): boolean {
+  const home = process.env.HOME ?? homedir();
+  const expanded = path === "~" ? home : path.startsWith("~/") ? join(home, path.slice(2)) : path;
+  const abs = normalize(isAbsolute(expanded) ? expanded : resolve(cwd, expanded));
+  const name = basename(abs);
+  if (NAME_RES.some((r) => r.test(name)) && !NOT_NAME_RES.some((r) => r.test(name))) return true;
+  for (const p of HOME_PATHS) if (globToRegExp(join(home, p)).test(abs)) return true;
+  for (const g of extra) {
+    const pattern = g.startsWith("~/") ? join(home, g.slice(2)) : g;
+    if ((pattern.includes("/") ? globToRegExp(pattern).test(abs) : globToRegExp(pattern).test(name))) return true;
+  }
+  return false;
+}
diff --git a/src/daemon/secrets/fingerprint.ts b/src/daemon/secrets/fingerprint.ts
new file mode 100644
index 00000000..907338bf
--- /dev/null
+++ b/src/daemon/secrets/fingerprint.ts
@@ -0,0 +1,83 @@
+/**
+ * A detected secret's fingerprint (docs/secrets-and-memory-design.md §2.3):
+ * HMAC-SHA256 of the value under a key made once per daemon, truncated to 8
+ * hex characters. The same secret seen in three sessions has the same
+ * reference; without the key a fingerprint can't be checked against a guess.
+ *
+ * The key lives in `<config dir>/secrets/fingerprint.key` (0600, in a 0700
+ * dir that every sandbox hides and the gate refuses: secretMaterialDir).
+ */
+
+import { createHmac, randomBytes } from "node:crypto";
+import { chmodSync, closeSync, constants as fsc, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, unlinkSync, writeSync } from "node:fs";
+import { join } from "node:path";
+
+/** Where codeoid keeps the keys for secret handling. */
+export function secretMaterialDir(configDir: string): string {
+  return join(configDir, "secrets");
+}
+
+const KEY_BYTES = 32;
+
+/**
+ * Read a key file, or make it once: written whole beside it, then linked into
+ * place (a crash leaves no half-written key, and two daemons starting at once
+ * end with the same one), never through a link, so a planted file or link is
+ * refused rather than used. The dir is 0700 and the file 0600 and the
+ * daemon's own, or it is refused.
+ */
+export function loadOrCreateKey(dir: string, name: string): Buffer {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const dst = lstatSync(dir);
+  if (!dst.isDirectory()) throw new Error(`${dir} isn't a directory`);
+  if (typeof process.getuid === "function" && dst.uid !== process.getuid()) throw new Error(`${dir} isn't this user's`);
+  if ((dst.mode & 0o077) !== 0) chmodSync(dir, 0o700);
+  const path = join(dir, name);
+  try {
+    const fd = openSync(path, fsc.O_RDONLY | fsc.O_NOFOLLOW | fsc.O_NONBLOCK);
+    try {
+      const st = fstatSync(fd);
+      if (!st.isFile() || st.size !== KEY_BYTES) throw new Error(`${path} isn't a ${KEY_BYTES}-byte key file`);
+      if (typeof process.getuid === "function" && st.uid !== process.getuid()) throw new Error(`${path} isn't this user's`);
+      if ((st.mode & 0o077) !== 0) throw new Error(`${path} is readable by others (mode ${(st.mode & 0o777).toString(8)}): chmod 600 it`);
+      const buf = Buffer.alloc(KEY_BYTES);
+      if (readSync(fd, buf, 0, KEY_BYTES, 0) !== KEY_BYTES) throw new Error(`${path} couldn't be read whole`);
+      return buf;
+    } finally {
+      closeSync(fd);
+    }
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+  }
+  const key = randomBytes(KEY_BYTES);
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}`;
+  const fd = openSync(tmp, fsc.O_WRONLY | fsc.O_CREAT | fsc.O_EXCL | fsc.O_NOFOLLOW, 0o600);
+  try {
+    writeSync(fd, key);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  try {
+    linkSync(tmp, path);
+  } catch (err) {
+    // Another start made it first: use theirs.
+    if ((err as NodeJS.ErrnoException).code === "EEXIST") return loadOrCreateKey(dir, name);
+    throw err;
+  } finally {
+    unlinkSync(tmp);
+  }
+  return key;
+}
+
+export class Fingerprinter {
+  readonly #key: Buffer;
+
+  constructor(key: Buffer) {
+    this.#key = key;
+  }
+
+  of(value: string): string {
+    return createHmac("sha256", this.#key).update(value).digest("hex").slice(0, 8);
+  }
+}
diff --git a/src/daemon/secrets/known.ts b/src/daemon/secrets/known.ts
new file mode 100644
index 00000000..c4ce0ec0
--- /dev/null
+++ b/src/daemon/secrets/known.ts
@@ -0,0 +1,338 @@
+/**
+ * Secrets codeoid already knows (docs/secrets-and-memory-design.md §2.2):
+ * values it put there itself — a workstream's credential, an MCP server's
+ * OAuth token, a backend's key, the daemon's own — replaced by exact match
+ * wherever they show up, as `‹credential:<label>›`. No guessing, so no false
+ * positives, and nothing new is stored: the value stays where it lives.
+ *
+ * Sources register a function that lists their values; the set is rebuilt
+ * when one says it changed (`invalidate`) or after a minute, whichever comes
+ * first (an OAuth token refreshes without telling anyone).
+ *
+ * Matching is one pass over the text (Aho-Corasick), leftmost-longest, and
+ * never inside a reference codeoid wrote (`‹…›`): scrubbing twice changes
+ * nothing.
+ */
+
+/** Shorter than this and a value would match ordinary text. */
+export const MIN_KNOWN_LENGTH = 8;
+const REBUILD_MS = 60_000;
+
+export interface KnownSecret {
+  /** What the reference names: `gh-saucam`, `oauth:linear`, `daemon:ANTHROPIC_API_KEY`. */
+  label: string;
+  value: string;
+  /** The reference written in its place; default `‹credential:<label>›`. */
+  ref?: string;
+}
+
+export type KnownSecretSource = () => Iterable<KnownSecret>;
+
+/** A reference codeoid wrote: never matched inside. */
+const OWN_REF = /‹[^‹›\n]{1,300}›/g;
+/** A character a token goes on through: a bounded needle needs none on either side. */
+const TOKEN_CHAR = /[A-Za-z0-9_-]/;
+
+interface Needle {
+  text: string;
+  label: string;
+  ref: string;
+}
+
+/**
+ * Whether what stands just before `at` is an escape, not part of a longer token: `\n` / `\r` /
+ * `\t` in JSON text, or a URL-encoded character (`%22`, `%3A`).
+ */
+function escapedBefore(text: string, at: number): boolean {
+  if (at > 1 && text[at - 2] === "\\" && "nrt".includes(text[at - 1]!)) return true;
+  return at > 2 && text[at - 3] === "%" && /^[0-9A-Fa-f]{2}$/.test(text.slice(at - 2, at));
+}
+
+/** A multi-pattern matcher: every needle found in one pass. */
+class Matcher {
+  readonly #goto: Array<Map<string, number>> = [new Map()];
+  readonly #fail: number[] = [0];
+  /** Per state: the needles ending there, longest first. */
+  readonly #out: Needle[][] = [[]];
+  readonly longest: number;
+  readonly size: number;
+
+  constructor(needles: readonly Needle[]) {
+    let longest = 0;
+    for (const n of needles) {
+      let state = 0;
+      for (const ch of n.text) {
+        let next = this.#goto[state]!.get(ch);
+        if (next === undefined) {
+          next = this.#goto.length;
+          this.#goto.push(new Map());
+          this.#fail.push(0);
+          this.#out.push([]);
+          this.#goto[state]!.set(ch, next);
+        }
+        state = next;
+      }
+      this.#out[state]!.push(n);
+      longest = Math.max(longest, n.text.length);
+    }
+    this.longest = longest;
+    this.size = needles.length;
+    // Failure links, breadth first: each state's outputs include its failure state's.
+    const queue: number[] = [...this.#goto[0]!.values()];
+    for (let i = 0; i < queue.length; i++) {
+      const state = queue[i]!;
+      for (const [ch, next] of this.#goto[state]!) {
+        queue.push(next);
+        let f = this.#fail[state]!;
+        while (f !== 0 && !this.#goto[f]!.has(ch)) f = this.#fail[f]!;
+        const via = this.#goto[f]!.get(ch);
+        this.#fail[next] = via !== undefined && via !== next ? via : 0;
+        const inherited = this.#out[this.#fail[next]!]!;
+        if (inherited.length > 0) this.#out[next] = [...this.#out[next]!, ...inherited];
+      }
+    }
+  }
+
+  /** Every match, as [start, end, needle]. */
+  *matches(text: string): Generator<[number, number, Needle]> {
+    if (this.size === 0) return;
+    let state = 0;
+    let i = 0;
+    for (const ch of text) {
+      i += ch.length;
+      while (state !== 0 && !this.#goto[state]!.has(ch)) state = this.#fail[state]!;
+      state = this.#goto[state]!.get(ch) ?? 0;
+      for (const n of this.#out[state]!) yield [i - n.text.length, i, n];
+    }
+  }
+}
+
+/**
+ * `text` with matches replaced: leftmost-longest, as whole tokens, none inside a reference. Past
+ * `deadline`, null: the caller doesn't store what it couldn't check.
+ */
+function replaceMatches(text: string, matcher: Matcher, deadline: number): { text: string; refs: Set<string>; labels: Set<string> } | null {
+  const refs = new Set<string>();
+  const labels = new Set<string>();
+  if (matcher.size === 0 || text.length < MIN_KNOWN_LENGTH) return { text, refs, labels };
+  // References in order: a match is checked against them by binary search.
+  const own: Array<[number, number]> = [];
+  for (const m of text.matchAll(OWN_REF)) own.push([m.index!, m.index! + m[0].length]);
+  const inOwn = (s: number, e: number): boolean => {
+    let lo = 0;
+    let hi = own.length;
+    while (lo < hi) {
+      const mid = (lo + hi) >> 1;
+      if (own[mid]![1] <= s) lo = mid + 1;
+      else hi = mid;
+    }
+    return lo < own.length && own[lo]![0] < e;
+  };
+  const found: Array<[number, number, Needle]> = [];
+  let n = 0;
+  for (const m of matcher.matches(text)) {
+    if (++n % 4096 === 0 && performance.now() > deadline) return null;
+    const [s, e] = m;
+    if (own.length > 0 && inOwn(s, e)) continue;
+    if ((s > 0 && TOKEN_CHAR.test(text[s - 1]!) && !escapedBefore(text, s)) || (e < text.length && TOKEN_CHAR.test(text[e]!))) continue;
+    found.push(m);
+  }
+  if (found.length === 0) return { text, refs, labels };
+  found.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+  let out = "";
+  let at = 0;
+  for (const [s, e, n] of found) {
+    if (s < at) continue;
+    out += text.slice(at, s) + n.ref;
+    at = e;
+    refs.add(n.ref);
+    labels.add(n.label);
+  }
+  return { text: out + text.slice(at), refs, labels };
+}
+
+export class KnownSecrets {
+  readonly #sources = new Map<string, KnownSecretSource>();
+  #matcher: Matcher | null = null;
+  #spaced: string[] = [];
+  #builtAt = 0;
+  #version = 0;
+
+  /** Add a source; returns a function that removes it. */
+  register(name: string, source: KnownSecretSource): () => void {
+    this.#sources.set(name, source);
+    this.invalidate();
+    return () => {
+      if (this.#sources.get(name) === source) {
+        this.#sources.delete(name);
+        this.invalidate();
+      }
+    };
+  }
+
+  /** A source's values changed (a credential edited, a token refreshed). */
+  invalidate(): void {
+    this.#matcher = null;
+    this.#version++;
+  }
+
+  /** Bumped on every change: a cache keyed by it is never stale. */
+  get version(): number {
+    return this.#version;
+  }
+
+  #build(): Matcher {
+    const byText = new Map<string, Needle>();
+    for (const [name, source] of this.#sources) {
+      let entries: Iterable<KnownSecret>;
+      try {
+        entries = source();
+      } catch (err) {
+        console.error(`[codeoid/secrets] known-secret source ${name} failed: ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
+      for (const { label, value, ref } of entries) {
+        if (typeof value !== "string" || value.length < MIN_KNOWN_LENGTH) continue;
+        for (const form of formsOf(value)) if (!byText.has(form)) byText.set(form, { text: form, label, ref: ref ?? credentialRef(label) });
+      }
+    }
+    this.#spaced = [...byText.keys()].filter((t) => /\s/.test(t));
+    return new Matcher([...byText.values()]);
+  }
+
+  #current(): Matcher {
+    if (!this.#matcher || Date.now() - this.#builtAt > REBUILD_MS) {
+      this.#matcher = this.#build();
+      this.#builtAt = Date.now();
+    }
+    return this.#matcher;
+  }
+
+  /** Values with whitespace in them: a stream must not cut at a space inside one. */
+  get spaced(): readonly string[] {
+    this.#current();
+    return this.#spaced;
+  }
+
+  /** The longest form any value is written in: how much a streaming scrubber must hold back. */
+  get longest(): number {
+    return this.#current().longest;
+  }
+
+  /**
+   * `text` with every known value replaced by its reference where it stands as a whole token (a
+   * dev default like `postgres` inside `postgresql://` is left), and the labels and references
+   * found. Null past `deadline`.
+   */
+  replace(text: string, deadline = Number.POSITIVE_INFINITY): { text: string; labels: string[]; refs: string[] } | null {
+    const r = replaceMatches(text, this.#current(), deadline);
+    return r ? { text: r.text, labels: [...r.labels], refs: [...r.refs] } : null;
+  }
+}
+
+/** The reference a known value is replaced by. */
+export function credentialRef(label: string): string {
+  return `‹credential:${label}›`;
+}
+
+/** How a value can be written: as it is, URL-encoded, and as Basic auth's base64 of `user:value` and `value:`. */
+function formsOf(value: string): string[] {
+  const forms = [value];
+  const encoded = encodeURIComponent(value);
+  if (encoded !== value) forms.push(encoded);
+  // Basic auth carries `user:password` base64'd: a value used as the password
+  // with an empty user, or as a token user with no password, is common enough.
+  for (const pair of [`:${value}`, `${value}:`, `x-access-token:${value}`]) {
+    const b64 = Buffer.from(pair).toString("base64");
+    forms.push(b64.replace(/=+$/, ""));
+  }
+  return forms;
+}
+
+/** Most values remembered by {@link LearnedSecrets}; the oldest are let go past it. */
+const MAX_LEARNED = 2000;
+/** A remembered value is matched bare only when it is this long: shorter ones are too often ordinary words. */
+const MIN_LEARNED_LENGTH = 12;
+
+/**
+ * Secrets found by a distinct format (a vendor's token, a JWT, a key),
+ * remembered in memory only, never stored, so the same value is replaced
+ * wherever it shows up later, even bare: a token a tool printed, repeated in
+ * a reply. Matched as whole tokens only, and kept apart from the known set,
+ * so learning one costs no rebuild of the rest.
+ */
+export class LearnedSecrets {
+  readonly #values = new Map<string, Needle>();
+  readonly #byRef = new Map<string, string>();
+  /** By their first characters: a value is matched where a token starts, so a lookup there finds it. */
+  readonly #byPrefix = new Map<string, Needle[]>();
+  #longest = 0;
+
+  /** Remember a value; true when it is new. Learning costs no rebuild. */
+  learn(value: string, ref: string): boolean {
+    if (value.length < MIN_LEARNED_LENGTH || this.#values.has(value)) return false;
+    const n: Needle = { text: value, label: "learned", ref };
+    this.#values.set(value, n);
+    this.#byRef.set(ref, value);
+    const key = value.slice(0, PREFIX);
+    const list = this.#byPrefix.get(key) ?? [];
+    list.push(n);
+    list.sort((x, y) => y.text.length - x.text.length);
+    this.#byPrefix.set(key, list);
+    this.#longest = Math.max(this.#longest, value.length);
+    while (this.#values.size > MAX_LEARNED) this.#forget(this.#values.keys().next().value!);
+    return true;
+  }
+
+  #forget(value: string): void {
+    const n = this.#values.get(value);
+    if (!n) return;
+    this.#values.delete(value);
+    this.#byRef.delete(n.ref);
+    const key = value.slice(0, PREFIX);
+    const list = (this.#byPrefix.get(key) ?? []).filter((x) => x !== n);
+    if (list.length > 0) this.#byPrefix.set(key, list);
+    else this.#byPrefix.delete(key);
+  }
+
+  /** The value a learned reference stands for. */
+  valueOf(ref: string): string | undefined {
+    return this.#byRef.get(ref);
+  }
+
+  get longest(): number {
+    return this.#longest;
+  }
+
+  /** Each remembered value replaced where it stands as a whole token, never inside a reference. Null past `deadline`. */
+  replace(text: string, deadline = Number.POSITIVE_INFINITY): { text: string; refs: string[] } | null {
+    const refs = new Set<string>();
+    if (this.#values.size === 0 || text.length < MIN_LEARNED_LENGTH) return { text, refs: [] };
+    const own: Array<[number, number]> = [];
+    for (const m of text.matchAll(OWN_REF)) own.push([m.index!, m.index! + m[0].length]);
+    let out = "";
+    let at = 0;
+    let o = 0;
+    for (let i = 0; i + MIN_LEARNED_LENGTH <= text.length; i++) {
+      if ((i & 0xffff) === 0 && i > 0 && performance.now() > deadline) return null;
+      if (i > 0 && TOKEN_CHAR.test(text[i - 1]!) && !escapedBefore(text, i)) continue;
+      while (o < own.length && own[o]![1] <= i) o++;
+      if (o < own.length && own[o]![0] <= i) {
+        i = own[o]![1] - 1;
+        continue;
+      }
+      const list = this.#byPrefix.get(text.slice(i, i + PREFIX));
+      if (!list) continue;
+      const n = list.find((c) => text.startsWith(c.text, i) && !(i + c.text.length < text.length && TOKEN_CHAR.test(text[i + c.text.length]!)));
+      if (!n) continue;
+      out += text.slice(at, i) + n.ref;
+      at = i + n.text.length;
+      refs.add(n.ref);
+      i = at - 1;
+    }
+    return at === 0 ? { text, refs: [] } : { text: out + text.slice(at), refs: [...refs] };
+  }
+}
+
+/** How many leading characters index a remembered value (each is at least MIN_LEARNED_LENGTH long). */
+const PREFIX = 8;
diff --git a/src/daemon/secrets/scrub-stored.ts b/src/daemon/secrets/scrub-stored.ts
new file mode 100644
index 00000000..058c1466
--- /dev/null
+++ b/src/daemon/secrets/scrub-stored.ts
@@ -0,0 +1,173 @@
+/**
+ * `codeoid secret scrub` (docs/secrets-and-memory-design.md §2.6): rewrite
+ * what was stored before secret handling, with values codeoid knows and
+ * secrets found by shape replaced by references. Run with the daemon
+ * stopped (the caller holds its data locks), so nothing appends meanwhile.
+ *
+ * Rewrites: every transcript, canonical-history and turn-index log
+ * (`<transcriptDir>/*.jsonl`), memory episodes and their full bodies (the
+ * FTS index follows by trigger), and dispatch tasks' prompts and result
+ * digests. Embeddings are left as they are: a vector holds no recoverable
+ * text. A file is replaced whole (written beside it, renamed over), so a
+ * crash leaves the old file or the new one, never half of each.
+ */
+
+import { Database } from "bun:sqlite";
+import { closeSync, existsSync, fsyncSync, openSync, readdirSync, readFileSync, renameSync, statSync, writeSync } from "node:fs";
+import { join } from "node:path";
+
+export interface ScrubReport {
+  files: number;
+  filesChanged: number;
+  linesChanged: number;
+  episodesChanged: number;
+  tasksChanged: number;
+}
+
+type ScrubFn = <T>(value: T) => { value: T; changed: boolean };
+
+/** Scrub one JSONL file's lines; returns how many changed. Unparseable lines are scrubbed as text. */
+export function scrubJsonlFile(path: string, scrub: ScrubFn, dryRun: boolean): number {
+  const text = readFileSync(path, "utf8");
+  const lines = text.split("\n");
+  let changed = 0;
+  const out = lines.map((line) => {
+    if (!line) return line;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      const r = scrub(line);
+      if (r.changed) changed++;
+      return r.value;
+    }
+    const r = scrub(parsed);
+    if (!r.changed) return line;
+    changed++;
+    return JSON.stringify(r.value);
+  });
+  if (changed > 0 && !dryRun) replaceFile(path, out.join("\n"));
+  return changed;
+}
+
+function replaceFile(path: string, content: string): void {
+  const tmp = `${path}.scrub-${process.pid}`;
+  const mode = statSync(path).mode & 0o777;
+  const fd = openSync(tmp, "wx", mode);
+  try {
+    writeSync(fd, content);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, path);
+}
+
+/** Every `*.jsonl` directly in the transcript dir, and their rotated segments (`<id>.jsonl.1`, …). */
+export function scrubTranscripts(dir: string, scrub: ScrubFn, dryRun: boolean): Pick<ScrubReport, "files" | "filesChanged" | "linesChanged"> {
+  const report = { files: 0, filesChanged: 0, linesChanged: 0 };
+  if (!existsSync(dir)) return report;
+  for (const name of readdirSync(dir)) {
+    if (!/\.jsonl(?:\.\d+)?$/.test(name)) continue;
+    const path = join(dir, name);
+    try {
+      if (!statSync(path).isFile()) continue;
+    } catch {
+      continue;
+    }
+    report.files++;
+    const n = scrubJsonlFile(path, scrub, dryRun);
+    if (n > 0) {
+      report.filesChanged++;
+      report.linesChanged += n;
+    }
+  }
+  return report;
+}
+
+/** Memory episodes: summary and content (FTS follows by trigger), and full bodies kept apart. */
+export function scrubMemoryDb(dbPath: string, scrub: ScrubFn, dryRun: boolean): number {
+  if (!existsSync(dbPath)) return 0;
+  const db = new Database(dbPath);
+  let changed = 0;
+  try {
+    const update = db.prepare("UPDATE episodes SET summary = ?, content = ? WHERE id = ?");
+    const rows = db.prepare("SELECT id, summary, content FROM episodes").all() as Array<{ id: string; summary: string; content: string }>;
+    const tx = db.transaction(() => {
+      for (const r of rows) {
+        const s = scrub(r.summary);
+        const c = scrub(r.content);
+        if (!s.changed && !c.changed) continue;
+        changed++;
+        if (!dryRun) update.run(s.value, c.value, r.id);
+      }
+      const payloads = db.prepare("SELECT episode_id, encoding, data FROM episode_payloads").all() as Array<{ episode_id: string; encoding: string; data: Uint8Array }>;
+      const updatePayload = db.prepare("UPDATE episode_payloads SET chars = ?, data = ? WHERE episode_id = ?");
+      for (const p of payloads) {
+        if (p.encoding !== "zstd") continue;
+        const body = Buffer.from(Bun.zstdDecompressSync(p.data)).toString("utf8");
+        const r = scrub(body);
+        if (!r.changed) continue;
+        changed++;
+        if (!dryRun) updatePayload.run(r.value.length, Bun.zstdCompressSync(Buffer.from(r.value, "utf8"), { level: 3 }), p.episode_id);
+      }
+    });
+    tx();
+    if (changed > 0 && !dryRun) purgeOldCopies(db, ["episodes_fts"]);
+  } finally {
+    db.close();
+  }
+  return changed;
+}
+
+/**
+ * Rewritten rows' old text can stay in the file (free pages, the WAL, FTS
+ * segments): merge the full-text index, checkpoint the WAL and rebuild the
+ * file, so what was replaced is gone from disk too.
+ */
+function purgeOldCopies(db: Database, ftsTables: readonly string[]): void {
+  for (const t of ftsTables) {
+    try {
+      db.exec(`INSERT INTO ${t}(${t}) VALUES('optimize')`);
+    } catch {
+      // No such index here.
+    }
+  }
+  db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  db.exec("VACUUM");
+  db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+}
+
+/** Dispatch tasks' prompts and result digests in the daemon's database (the conductor reads them back). */
+export function scrubDispatchTasks(dbPath: string, scrub: ScrubFn, dryRun: boolean): number {
+  if (!existsSync(dbPath)) return 0;
+  const db = new Database(dbPath);
+  let changed = 0;
+  try {
+    const cols = new Set((db.prepare("PRAGMA table_info(dispatch_tasks)").all() as Array<{ name: string }>).map((c) => c.name));
+    if (!cols.has("prompt")) return 0;
+    const digest = cols.has("result_digest");
+    // Settled tasks only: a queued or running one's prompt is what its worker is sent, as written.
+    const rows = db
+      .prepare(`SELECT id, prompt${digest ? ", result_digest" : ""} FROM dispatch_tasks WHERE status IN ('done', 'failed', 'blocked', 'cancelled')`)
+      .all() as Array<{ id: string; prompt: string | null; result_digest?: string | null }>;
+    const update = db.prepare(`UPDATE dispatch_tasks SET prompt = ?${digest ? ", result_digest = ?" : ""} WHERE id = ?`);
+    const tx = db.transaction(() => {
+      for (const r of rows) {
+        const p = r.prompt ? scrub(r.prompt) : { value: r.prompt, changed: false };
+        const d = r.result_digest ? scrub(r.result_digest) : { value: r.result_digest ?? null, changed: false };
+        if (!p.changed && !d.changed) continue;
+        changed++;
+        if (!dryRun) {
+          if (digest) update.run(p.value, d.value, r.id);
+          else update.run(p.value, r.id);
+        }
+      }
+    });
+    tx();
+    if (changed > 0 && !dryRun) purgeOldCopies(db, []);
+  } finally {
+    db.close();
+  }
+  return changed;
+}
diff --git a/src/daemon/secrets/scrub.ts b/src/daemon/secrets/scrub.ts
new file mode 100644
index 00000000..0b6ef9dd
--- /dev/null
+++ b/src/daemon/secrets/scrub.ts
@@ -0,0 +1,294 @@
+/**
+ * What codeoid stores never holds a secret's value
+ * (docs/secrets-and-memory-design.md §2): `scrub` replaces values codeoid
+ * knows with `‹credential:<label>›` (known.ts) and credentials found by shape
+ * with `‹secret:<kind>:<fingerprint>›` (detect.ts). A detected value is
+ * dropped, or handed to `onDetected` (the vault, where a workstream keeps
+ * them, §2.5).
+ *
+ * A text that can't be checked in time, or is too large to check, isn't
+ * stored: it becomes a `‹not stored: …›` note. Never the text unchecked.
+ */
+
+import { findSecrets } from "./detect.js";
+import type { Fingerprinter } from "./fingerprint.js";
+import type { KnownSecrets, LearnedSecrets } from "./known.js";
+
+/** atuin's budget: a text that can't be checked in this long isn't stored. */
+export const SCRUB_BUDGET_MS = 250;
+/** Larger than this and a text isn't checked, nor stored. */
+export const MAX_SCRUB_BYTES = 8 * 1024 * 1024;
+
+export const NOT_CHECKED = "‹not stored: it couldn't be checked for secrets in time›";
+export const TOO_LARGE = "‹not stored: it is too large to check for secrets›";
+
+export interface ScrubContext {
+  /** The home workstream of what is being stored (for the vault's policy and scoping). */
+  workstream?: string;
+  sessionId?: string;
+}
+
+export interface DetectedSecret {
+  kind: string;
+  fingerprint: string;
+  value: string;
+}
+
+export interface ScrubResult {
+  text: string;
+  /** Anything was replaced. */
+  changed: boolean;
+}
+
+export function secretRef(kind: string, fingerprint: string): string {
+  return `‹secret:${kind}:${fingerprint}›`;
+}
+
+export interface ScrubberOptions {
+  known: KnownSecrets;
+  /**
+   * Where a value found by a distinct format is remembered, so it is matched exactly from then
+   * on: per tenant (one tenant's text never tells another's what was seen). None: nothing kept.
+   */
+  learnedFor?: (ctx: ScrubContext) => LearnedSecrets | undefined;
+  fingerprint: Fingerprinter;
+  /** A detected secret, with its value: the vault keeps it where the workstream says so. */
+  onDetected?: (secret: DetectedSecret, ctx: ScrubContext) => void;
+  budgetMs?: number;
+  /**
+   * A text that can't be checked (too large, or over budget) is kept as it is and reported here,
+   * instead of being replaced by a "not stored" note: for a rewrite of stored data, where the
+   * note would destroy what is there for good. Unset: replaced.
+   */
+  onUnchecked?: (text: string) => void;
+}
+
+export class Scrubber {
+  readonly #opts: ScrubberOptions;
+
+  constructor(opts: ScrubberOptions) {
+    this.#opts = opts;
+  }
+
+  get known(): KnownSecrets {
+    return this.#opts.known;
+  }
+
+  /** The longest value matched exactly (known or learned) for `ctx`: what a stream must hold back. */
+  longestKnown(ctx: ScrubContext = {}): number {
+    return Math.max(this.#opts.known.longest, this.#opts.learnedFor?.(ctx)?.longest ?? 0);
+  }
+
+  /** `text` with no secret's value in it. */
+  scrub(text: string, ctx: ScrubContext = {}): ScrubResult {
+    if (!text) return { text, changed: false };
+    if (text.length > MAX_SCRUB_BYTES) return this.#unchecked(text, TOO_LARGE);
+    const deadline = performance.now() + (this.#opts.budgetMs ?? SCRUB_BUDGET_MS);
+    const learned = this.#opts.learnedFor?.(ctx);
+    const known = this.#opts.known.replace(text, deadline);
+    if (!known) return this.#unchecked(text, NOT_CHECKED);
+    let out = known.text;
+    let changed = known.labels.length > 0;
+    if (learned) {
+      const r = learned.replace(out, deadline);
+      if (!r) return this.#unchecked(text, NOT_CHECKED);
+      out = r.text;
+      // A learned value matched exactly is still a detected secret: the vault keeps it where it is kept.
+      for (const ref of r.refs) {
+        changed = true;
+        const m = /^‹secret:([a-z0-9-]+):([0-9a-f]{8})›$/.exec(ref);
+        const value = learned.valueOf(ref);
+        if (m && value !== undefined) this.#detected({ kind: m[1]!, fingerprint: m[2]!, value }, ctx);
+      }
+    }
+    const spans = findSecrets(out, deadline);
+    if (spans === null) return this.#unchecked(text, NOT_CHECKED);
+    if (spans.length === 0) return { text: out, changed };
+    let result = "";
+    let at = 0;
+    let learnedAny = false;
+    for (const s of spans) {
+      const value = out.slice(s.start, s.end);
+      const fp = this.#opts.fingerprint.of(value);
+      // Only a distinct format is remembered: a word found under a name (`password: …`) is often ordinary elsewhere.
+      if (s.distinct && learned?.learn(value, secretRef(s.kind, fp))) learnedAny = true;
+      this.#detected({ kind: s.kind, fingerprint: fp, value }, ctx);
+      result += out.slice(at, s.start) + secretRef(s.kind, fp);
+      at = s.end;
+    }
+    out = result + out.slice(at);
+    // A value just learned may appear again in this text, bare: replaced too.
+    if (learnedAny && learned) {
+      const again = learned.replace(out, deadline);
+      if (!again) return this.#unchecked(text, NOT_CHECKED);
+      out = again.text;
+    }
+    return { text: out, changed: true };
+  }
+
+  #unchecked(text: string, note: string): ScrubResult {
+    if (!this.#opts.onUnchecked) return { text: note, changed: true };
+    this.#opts.onUnchecked(text);
+    return { text, changed: false };
+  }
+
+  #detected(secret: DetectedSecret, ctx: ScrubContext): void {
+    if (!this.#opts.onDetected) return;
+    try {
+      this.#opts.onDetected(secret, ctx);
+    } catch (err) {
+      console.error(`[codeoid/secrets] keeping a detected secret failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  /** {@link scrub} applied to every string in a JSON-like value (a tool's input), structure kept. */
+  scrubValue<T>(value: T, ctx: ScrubContext = {}): { value: T; changed: boolean } {
+    let changed = false;
+    const walk = (v: unknown, depth: number): unknown => {
+      if (typeof v === "string") {
+        const r = this.scrub(v, ctx);
+        if (r.changed) changed = true;
+        return r.text;
+      }
+      if (v === null || typeof v !== "object") return v;
+      // Too deep to walk: not stored as it is, rather than stored unchecked (offline: kept, and said).
+      if (depth > 32) {
+        if (this.#opts.onUnchecked) {
+          this.#opts.onUnchecked(JSON.stringify(v));
+          return v;
+        }
+        changed = true;
+        return NOT_CHECKED;
+      }
+      if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+      const out: Record<string, unknown> = {};
+      for (const [k, x] of Object.entries(v as Record<string, unknown>)) out[k] = walk(x, depth + 1);
+      return out;
+    };
+    const out = walk(value, 0) as T;
+    return { value: changed ? out : value, changed };
+  }
+}
+
+/**
+ * Where a credential may start on a line, as the detector's own names read it: a secret-named key
+ * with its separator (`DB_PASSWORD=`, `"api_key":`, `passphrase:`), `Bearer`, `Authorization`, a
+ * URL's userinfo, a password flag, a JWT, a .netrc entry. From there to the line's end is held,
+ * so a value spanning spaces is matched whole; prose that only mentions "authentication" streams.
+ */
+const TRIGGER =
+  /[A-Za-z0-9_.-]*(?:passw|passphrase|pwd|secret|api[_-]?key|private[_-]?key|access[_-]?key|token|credential|auth)[A-Za-z0-9_.-]*["'\]]?[ \t]*(?::=|=>|\?=|[=:])|\bbearer\b|\bauthorization\b|[a-z][a-z0-9+.-]{0,31}:\/\/[^\s/@]*:|(?:^|[ \t])(?:-u|--user|--passw(?:or)?d)\b|eyJ|(?:^|\s)machine\s|^[ \t]*password[ \t]/im;
+/** The most held of one line (or one PEM block) before it is sent anyway, scrubbed as far as it has come. */
+const MAX_LINE_HOLD = 4096;
+const MAX_BLOCK_HOLD = 64_000;
+/** How much of a line already sent a piece is judged with. */
+const CONTEXT = 512;
+
+/**
+ * Scrubs text that arrives in pieces (an assistant's reply as it streams), so
+ * a secret split across pieces is never sent unscrubbed:
+ *
+ * - the trailing run of non-space characters is held until the next space or
+ *   the end (a token, a known value, is one run);
+ * - a line that may name a credential (`password: "two words"`, `Bearer …`,
+ *   a URL) is held until it ends, and a private key's armour until its end
+ *   line, so each is scrubbed whole.
+ *
+ * Held text past a bound is sent anyway, scrubbed as far as it has come;
+ * the committed message is scrubbed whole again, and replaces it.
+ */
+export class StreamScrubber {
+  readonly #scrubber: Scrubber;
+  readonly #ctx: ScrubContext;
+  #held = "";
+  /** What was already sent of the current line, as it came: the context a later piece is judged in. */
+  #sentLine = "";
+
+  constructor(scrubber: Scrubber, ctx: ScrubContext = {}) {
+    this.#scrubber = scrubber;
+    this.#ctx = ctx;
+  }
+
+  /** What may be sent of `piece` now (possibly nothing). */
+  push(piece: string): string {
+    const text = this.#held + piece;
+    const cut = this.#safeEnd(text);
+    this.#held = text.slice(cut);
+    return cut > 0 ? this.#send(text.slice(0, cut)) : "";
+  }
+
+  /** The rest, at the message's end. */
+  flush(): string {
+    const rest = this.#held;
+    this.#held = "";
+    const out = rest ? this.#send(rest) : "";
+    this.#sentLine = "";
+    return out;
+  }
+
+  /**
+   * `chunk` scrubbed in the context of its line so far: a value whose name was sent in an
+   * earlier piece (`AWS_ACCESS_KEY ` then `= …`) is still found. When the context's own
+   * scrubbing doesn't come out the same, the chunk is scrubbed alone.
+   */
+  #send(chunk: string): string {
+    let out: string;
+    // Context only where it can matter: the line so far may name a credential, the chunk included.
+    if (this.#sentLine && TRIGGER.test(this.#sentLine + chunk.split("\n", 1)[0])) {
+      const prefix = this.#scrubber.scrub(this.#sentLine, this.#ctx).text;
+      const whole = this.#scrubber.scrub(this.#sentLine + chunk, this.#ctx).text;
+      out = whole.startsWith(prefix) ? whole.slice(prefix.length) : this.#scrubber.scrub(chunk, this.#ctx).text;
+    } else out = this.#scrubber.scrub(chunk, this.#ctx).text;
+    const nl = chunk.lastIndexOf("\n");
+    this.#sentLine = (nl >= 0 ? chunk.slice(nl + 1) : this.#sentLine + chunk).slice(-CONTEXT);
+    return out;
+  }
+
+  /** How much of `text` can be sent now. */
+  #safeEnd(text: string): number {
+    // An open private key: hold from its armour to its end line.
+    const begin = text.lastIndexOf("-----BEGIN");
+    if (begin >= 0 && text.indexOf("-----END", begin) < 0 && text.length - begin <= MAX_BLOCK_HOLD) {
+      return this.#lineStart(text, begin);
+    }
+    // The last line, unfinished: held from where a credential may start — judged with what was
+    // already sent of it, so a name sent in an earlier piece still holds its value.
+    const lineStart = text.lastIndexOf("\n") + 1;
+    // The last part of what was sent is enough: a credential's name sits just before its value.
+    const sent = lineStart === 0 ? this.#sentLine.slice(-CONTEXT) : "";
+    const line = sent + text.slice(lineStart);
+    const trigger = TRIGGER.exec(line);
+    if (trigger && line.length - trigger.index <= MAX_LINE_HOLD) {
+      let at = lineStart + Math.max(0, trigger.index - sent.length);
+      // From the word it is in (a quote or `export ` before a name stays with what was sent).
+      while (at > lineStart && /[A-Za-z0-9_.$"'-]/.test(text[at - 1]!)) at--;
+      return at;
+    }
+    // A known value with spaces in it is never cut inside: one begun at the end is held from its
+    // start, and one already whole goes out whole.
+    let cut = this.#plainCut(text);
+    for (const v of this.#scrubber.known.spaced) {
+      for (let i = text.indexOf(v); i >= 0; i = text.indexOf(v, i + 1)) if (i < cut && cut < i + v.length) cut = i + v.length;
+      for (let k = Math.min(v.length - 1, text.length); k > 0; k--) {
+        if (text.endsWith(v.slice(0, k))) {
+          cut = Math.min(cut, text.length - k);
+          break;
+        }
+      }
+    }
+    return cut;
+  }
+
+  /** Up to the last space, the run after it held (bounded by the longest known value). */
+  #plainCut(text: string): number {
+    const hold = Math.min(Math.max(512, this.#scrubber.longestKnown(this.#ctx)), MAX_LINE_HOLD);
+    const lastSpace = Math.max(text.lastIndexOf(" "), text.lastIndexOf("\n"), text.lastIndexOf("\t"));
+    let cut = lastSpace + 1;
+    if (text.length - cut > hold) cut = text.length - hold;
+    return cut;
+  }
+
+  #lineStart(text: string, at: number): number {
+    return text.lastIndexOf("\n", at) + 1;
+  }
+}
diff --git a/src/daemon/secrets/secrets.test.ts b/src/daemon/secrets/secrets.test.ts
new file mode 100644
index 00000000..28607b0f
--- /dev/null
+++ b/src/daemon/secrets/secrets.test.ts
@@ -0,0 +1,499 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { loadShellParser } from "../shell/parse.js";
+import { findSecrets, isPlaceholder } from "./detect.js";
+import { isCredentialFile } from "./files.js";
+import { Fingerprinter } from "./fingerprint.js";
+import { KnownSecrets } from "./known.js";
+import { NOT_CHECKED, Scrubber, StreamScrubber, TOO_LARGE } from "./scrub.js";
+import { toolVerdict } from "./verdict.js";
+
+// Made-up credentials of the right shape, split so this file holds no contiguous token a push scanner takes for real.
+const GHP = "ghp_" + "Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V";
+const SLACK = "xoxb-" + "1234567890123-1234567890123-" + "abcdefghijABCDEFGHIJ1234";
+const AWS_ID = "AKIA" + "IOSFODNN7EXAMPLE";
+const JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" + ".eyJzdWIiOiIxMjM0NTY3ODkwIn0" + ".dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
+const PEM = "-----BEGIN OPENSSH PRIVATE " + "KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQ\n-----END OPENSSH PRIVATE KEY-----";
+
+const fp = new Fingerprinter(Buffer.alloc(32, 7));
+const kinds = (text: string) => (findSecrets(text) ?? []).map((s) => `${s.kind}:${text.slice(s.start, s.end)}`);
+
+describe("detect", () => {
+  test.each([
+    [`token ${GHP} done`, [`github-token:${GHP}`]],
+    [`SLACK=${SLACK}`, [`slack-token:${SLACK}`]],
+    [`key ${AWS_ID}`, [`aws-key-id:${AWS_ID}`]],
+    [`auth=${JWT}`, [`jwt:${JWT}`]],
+    ["export GITHUB_TOKEN=4f1c0e7d9b2a", ["credential:4f1c0e7d9b2a"]],
+    ["DATABASE_URL=postgres://app:s3cr3t-pw@db.internal:5432/app", ["password:s3cr3t-pw"]],
+    ['curl -H "Authorization: Bearer 8f2d0c1e9b7a4f6e8d2c" x', ["bearer-token:8f2d0c1e9b7a4f6e8d2c"]],
+    ["curl -u admin:hunter2 https://example.com", ["password:hunter2"]],
+    ["host=db user=app password=hunter22 dbname=app", ["password:hunter22"]],
+    ["docker login -u me --password hunter2xyz r.io", ["password:hunter2xyz"]],
+    ['{"client_secret": "a8f3kq0z7x1m", "client_id": "app"}', ["credential:a8f3kq0z7x1m"]],
+    ["database:\n  password: hunter2\n  host: db", ["credential:hunter2"]],
+  ])("finds %s", (text, expected) => {
+    expect(kinds(text)).toEqual(expected);
+  });
+
+  test.each([
+    "    token: String,",
+    "OPENAI_API_KEY=${OPENAI_API_KEY}",
+    "commit 3f9a2c1b4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a",
+    "max_tokens: 4096",
+    "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
+    '{"password": "<password>"}',
+    "TOKEN=‹credential:gh-saucam›",
+    "the --password flag",
+    "see https://example.com/docs?page=2",
+    "uuid 3e4f2b1a-9c8d-4e7f-a6b5-1c2d3e4f5a6b",
+  ])("leaves %s", (text) => {
+    expect(kinds(text)).toEqual([]);
+  });
+
+  test("a private key's body, its armour kept", () => {
+    const [s] = findSecrets(PEM)!;
+    expect(PEM.slice(0, s!.start)).toEndWith("PRIVATE KEY-----");
+    expect(PEM.slice(s!.end)).toStartWith("-----END");
+  });
+
+  test("placeholders", () => {
+    for (const p of ["$TOKEN", "${{ secrets.X }}", "<password>", "changeme", "xxxx", "‹secret:jwt:12345678›"]) expect(isPlaceholder(p)).toBe(true);
+    expect(isPlaceholder("hunter2xyz")).toBe(false);
+  });
+});
+
+describe("scrub", () => {
+  const known = new KnownSecrets();
+  known.register("test", () => [
+    { label: "gh-saucam", value: "s3cr3t-value-1234" },
+    { label: "short", value: "abc" },
+  ]);
+  const detected: string[] = [];
+  const scrubber = new Scrubber({ known, fingerprint: fp, onDetected: (d) => detected.push(d.kind) });
+
+  test("a known value becomes a credential reference, in every form it is written in", () => {
+    const b64 = Buffer.from(":s3cr3t-value-1234").toString("base64").replace(/=+$/, "");
+    const r = scrubber.scrub(`echo s3cr3t-value-1234; curl -H 'Authorization: Basic ${b64}'; q=${encodeURIComponent("s3cr3t-value-1234")}`);
+    expect(r.text).not.toContain("s3cr3t-value-1234");
+    expect(r.text).not.toContain(b64);
+    expect(r.text).toContain("‹credential:gh-saucam›");
+    expect(r.changed).toBe(true);
+  });
+
+  test("a value under 8 characters is never matched", () => {
+    expect(scrubber.scrub("abc is a word").text).toBe("abc is a word");
+  });
+
+  test("a detected secret becomes a fingerprinted reference, the same for the same value", () => {
+    const a = scrubber.scrub(`one ${GHP}`).text;
+    const b = scrubber.scrub(`two ${GHP}`).text;
+    const ref = a.slice(4);
+    expect(ref).toMatch(/^‹secret:github-token:[0-9a-f]{8}›$/);
+    expect(b).toBe(`two ${ref}`);
+    expect(detected).toContain("github-token");
+  });
+
+  test("scrubbing is idempotent", () => {
+    const once = scrubber.scrub(`DB_PASSWORD=hunter2xyz and ${GHP} and s3cr3t-value-1234`).text;
+    expect(scrubber.scrub(once).text).toBe(once);
+  });
+
+  test("a value inside a JSON input is scrubbed, structure kept", () => {
+    const r = scrubber.scrubValue({ command: `echo ${GHP}`, n: 3, list: ["s3cr3t-value-1234"] });
+    expect(r.changed).toBe(true);
+    expect(r.value.n).toBe(3);
+    expect(JSON.stringify(r.value)).not.toContain(GHP);
+  });
+
+  test("past its budget, a text isn't stored", () => {
+    const slow = new Scrubber({ known, fingerprint: fp, budgetMs: -1 });
+    expect(slow.scrub("anything at all").text).toBe(NOT_CHECKED);
+  });
+
+  test("too large to check isn't stored", () => {
+    expect(scrubber.scrub("x".repeat(8 * 1024 * 1024 + 1)).text).toBe(TOO_LARGE);
+  });
+});
+
+describe("stream", () => {
+  const known = new KnownSecrets();
+  known.register("test", () => [{ label: "gh-saucam", value: "s3cr3t-value-1234" }]);
+  const scrubber = new Scrubber({ known, fingerprint: fp });
+
+  /** Feed `text` in pieces of `n` characters; return what was sent. */
+  function stream(text: string, n: number): string {
+    const s = new StreamScrubber(scrubber);
+    let out = "";
+    for (let i = 0; i < text.length; i += n) out += s.push(text.slice(i, i + n));
+    return out + s.flush();
+  }
+
+  test.each([1, 2, 3, 5, 7, 13])("a secret split across pieces of %i is never sent", (n) => {
+    const text = `Here is the token ${GHP} and the key s3cr3t-value-1234, Authorization: Bearer 8f2d0c1e9b7a4f6e8d2c and password: "correct horse 9".\n${PEM}\nthe end`;
+    const out = stream(text, n);
+    for (const secret of [GHP, "s3cr3t-value-1234", "8f2d0c1e9b7a4f6e8d2c", "correct horse 9", "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQ"]) {
+      expect(out).not.toContain(secret);
+    }
+    expect(out).toContain("the end");
+  });
+
+  test("plain prose streams as it comes", () => {
+    const s = new StreamScrubber(scrubber);
+    expect(s.push("Hello there ")).toBe("Hello there ");
+    expect(s.push("wor")).toBe("");
+    expect(s.push("ld ")).toBe("world ");
+  });
+});
+
+describe("verdict", () => {
+  beforeAll(async () => {
+    await loadShellParser();
+  });
+  const v = (command: string) => toolVerdict("Bash", { command }, { cwd: "/w" });
+
+  test.each([
+    "gh auth token",
+    "x=$(gh auth token); echo $x",
+    "bash -c 'gh auth token'",
+    "sudo printenv",
+    "env",
+    "aws --profile prod configure get aws_secret_access_key",
+    "kubectl -n x get secret db -o yaml",
+    "op read op://vault/item/field",
+    "security find-generic-password -s x -w",
+    "cat .env",
+    "cat ~/.aws/credentials",
+    "grep KEY config/.env.local",
+    "head -5 < .env",
+    "terraform output -json",
+  ])("withholds the output of %s", (command) => {
+    expect(v(command)).toBe("withhold-output");
+  });
+
+  test.each(["git status", "npm test", "env FOO=1 npm test", "cat .env.example", "ls -la ~/.ssh", "echo token", "gh pr list"])("keeps %s", (command) => {
+    expect(v(command)).toBe("keep");
+  });
+
+  test("a write of a credential file", () => {
+    expect(v("echo KEY=abc > .env")).toBe("withhold-written");
+    expect(toolVerdict("Write", { file_path: "/w/.env", content: "KEY=abc" }, { cwd: "/w" })).toBe("withhold-written");
+    expect(toolVerdict("Read", { file_path: "/w/.env" }, { cwd: "/w" })).toBe("withhold-output");
+    expect(toolVerdict("Read", { file_path: "/w/src/a.ts" }, { cwd: "/w" })).toBe("keep");
+  });
+
+  test("the user's drop list", () => {
+    expect(toolVerdict("Bash", { command: "my-vault dump --all" }, { cwd: "/w", dropCommands: ["my-vault dump"] })).toBe("drop");
+  });
+
+  test("credential files", () => {
+    expect(isCredentialFile("id_ed25519", "/home/u/.ssh")).toBe(true);
+    expect(isCredentialFile("id_ed25519.pub", "/home/u/.ssh")).toBe(false);
+    expect(isCredentialFile("~/.kube/config", "/w")).toBe(true);
+    expect(isCredentialFile("src/config.ts", "/w")).toBe(false);
+  });
+});
+
+describe("stored data, scrubbed after the fact", () => {
+  test("a transcript's lines are rewritten, unchanged ones kept, and the file replaced whole", async () => {
+    const { mkdtempSync, writeFileSync, readFileSync, rmSync, statSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { scrubTranscripts } = await import("./scrub-stored.js");
+    const dir = mkdtempSync(join(tmpdir(), "codeoid-scrub-"));
+    try {
+      const path = join(dir, "s1.jsonl");
+      const clean = JSON.stringify({ seq: 0, message: { content: "hello" } });
+      writeFileSync(path, `${clean}\n${JSON.stringify({ seq: 1, message: { content: `token ${GHP}` } })}\nnot json ${GHP}\n`, { mode: 0o600 });
+      const known = new KnownSecrets();
+      const scrubber = new Scrubber({ known, fingerprint: fp });
+      const scrub = <T,>(v: T) => scrubber.scrubValue(v);
+      expect(scrubTranscripts(dir, scrub, true)).toEqual({ files: 1, filesChanged: 1, linesChanged: 2 });
+      expect(readFileSync(path, "utf8")).toContain(GHP);
+      expect(scrubTranscripts(dir, scrub, false).linesChanged).toBe(2);
+      const after = readFileSync(path, "utf8");
+      expect(after).not.toContain(GHP);
+      expect(after.split("\n")[0]).toBe(clean);
+      expect(statSync(path).mode & 0o777).toBe(0o600);
+      expect(scrubTranscripts(dir, scrub, false).linesChanged).toBe(0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("memory episodes and their full bodies", async () => {
+    const { mkdtempSync, rmSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { SqliteEpisodeStore } = await import("../memory/index.js");
+    const { scrubMemoryDb } = await import("./scrub-stored.js");
+    const dir = mkdtempSync(join(tmpdir(), "codeoid-scrubmem-"));
+    try {
+      const db = join(dir, "mem.db");
+      const store = new SqliteEpisodeStore(db);
+      const long = `${"x".repeat(70_000)} ${GHP}`;
+      const ep = store.insert({ workspaceId: "w", sessionId: "s", kind: "tool_call", summary: `ran with ${GHP}`, content: "index view", fullContent: long, filePaths: [], tokenEstimate: 1, createdAt: 1, createdBy: "u" });
+      store.close();
+      const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+      expect(scrubMemoryDb(db, <T,>(v: T) => scrubber.scrubValue(v), false)).toBe(2);
+      const reopened = new SqliteEpisodeStore(db);
+      expect(reopened.getEpisode(ep.id)?.summary).not.toContain(GHP);
+      expect(reopened.getFullContent(ep.id)).not.toContain(GHP);
+      expect(reopened.ftsSearch("w", "Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V", 5)).toEqual([]);
+      reopened.close();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("vault", () => {
+  test("a sealed value opens only where it was kept", async () => {
+    const { mkdtempSync, rmSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { Store } = await import("../store.js");
+    const { CapturedSecretVault } = await import("./vault.js");
+    const dir = mkdtempSync(join(tmpdir(), "codeoid-vault-"));
+    try {
+      const store = new Store(join(dir, "codeoid.db"));
+      const vault = new CapturedSecretVault(store, Buffer.alloc(32, 3));
+      const scope = { accountId: "a", projectId: "p", workstream: "acme" };
+      vault.put(scope, { kind: "github-token", fingerprint: "0123abcd", value: GHP });
+      expect(vault.reveal(scope, "0123abcd")).toBe(GHP);
+      expect(vault.reveal({ ...scope, workstream: "other" }, "0123abcd")).toBeUndefined();
+      // Moved to another row by hand, it doesn't open there.
+      const row = store.capturedSecret({ ...scope, fingerprint: "0123abcd" })!;
+      store.putCapturedSecret({ ...scope, workstream: "other", fingerprint: "0123abcd", kind: row.kind, sealed: row.sealed, at: Date.now() });
+      expect(vault.reveal({ ...scope, workstream: "other" }, "0123abcd")).toBeUndefined();
+      // A different key opens nothing.
+      expect(new CapturedSecretVault(store, Buffer.alloc(32, 4)).reveal(scope, "0123abcd")).toBeUndefined();
+      expect(vault.list({ accountId: "a", projectId: "p" }).map((k) => k.workstream).sort()).toEqual(["acme", "other"]);
+      expect(vault.forget(scope, "0123abcd")).toBe(true);
+      store.close();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("learned", () => {
+  test("a value found by a distinct format is matched bare from then on; one found only by its name isn't", async () => {
+    const { LearnedSecrets } = await import("./known.js");
+    const learned = new LearnedSecrets();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), learnedFor: () => learned, fingerprint: fp });
+    const first = scrubber.scrub("Authorization: Bearer 8f2d0c1e9b7a4f6e8d2c\nthe token is 8f2d0c1e9b7a4f6e8d2c").text;
+    expect(first).not.toContain("8f2d0c1e9b7a4f6e8d2c");
+    const ref = /‹secret:bearer-token:[0-9a-f]{8}›/.exec(first)![0];
+    expect(first.split(ref)).toHaveLength(3);
+    expect(scrubber.scrub("later: 8f2d0c1e9b7a4f6e8d2c again").text).toBe(`later: ${ref} again`);
+    // Only as a whole token: inside a longer word it is left.
+    expect(scrubber.scrub("x8f2d0c1e9b7a4f6e8d2cx").text).toBe("x8f2d0c1e9b7a4f6e8d2cx");
+    // A password found by its name isn't remembered: the same word is often ordinary elsewhere.
+    scrubber.scrub("DB_PASSWORD=localhost-dev-pw");
+    expect(scrubber.scrub("connect to localhost-dev-pw").text).toBe("connect to localhost-dev-pw");
+  });
+
+  test("scrubbing is idempotent even when a remembered value appears inside a reference", async () => {
+    const { LearnedSecrets } = await import("./known.js");
+    const learned = new LearnedSecrets();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), learnedFor: () => learned, fingerprint: fp });
+    learned.learn("github-token-value", "‹secret:x:00000000›");
+    const once = scrubber.scrub(`a ${GHP} b`).text;
+    expect(scrubber.scrub(scrubber.scrub(once).text).text).toBe(once);
+  });
+});
+
+describe("round-1 audit", () => {
+  test.each([
+    "    token = self.token",
+    "api_key = args.api_key",
+    "self.api_key = api_key",
+    "apiKey: config.apiKey",
+    "id_token = idToken",
+    "MAX_TOKENS=100000",
+    "DISABLE_AUTH=enabled",
+    "AUTH=Bearer",
+    'const pem = "-----BEGIN PRIVATE KEY-----"; foo(); const end = "-----END PRIVATE KEY-----"',
+    "if (s.startsWith('-----BEGIN RSA PRIVATE KEY-----')) { return parse(s); }",
+  ])("code isn't a secret: %s", (text) => {
+    expect(kinds(text)).toEqual([]);
+  });
+
+  test("a value under a name stops at the command's next word", () => {
+    expect(kinds("PGPASSWORD=postgres psql -h db")).toEqual(["credential:postgres"]);
+  });
+
+  test("a .netrc entry", () => {
+    expect(kinds("machine example.com login bob password s3cr3tPassw0rd")).toEqual(["password:s3cr3tPassw0rd"]);
+  });
+
+  test("hostile input stays linear", () => {
+    for (const text of ["-----BEGIN PRIVATE KEY-----".repeat(100_000), "curl ".repeat(400_000), `token: x${" ".repeat(990)}y\n`.repeat(2000)]) {
+      const t0 = performance.now();
+      findSecrets(text, t0 + 2_000);
+      expect(performance.now() - t0).toBeLessThan(2_500);
+    }
+  });
+
+  test.each(["source .env && bun test", ". ./.env; make test", "cp .env.example .env && bun run dev", "cat certs/ca.pem"])("keeps the output of %s", async (command) => {
+    await loadShellParser();
+    expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("keep");
+  });
+
+  test.each(["cat $HOME/.aws/credentials", "git show HEAD:.env", "git diff -- .env.production", "dd if=.env"])("withholds the output of %s", async (command) => {
+    await loadShellParser();
+    expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("withhold-output");
+  });
+
+  test("a stream judges a piece with what was sent of its line, and never cuts a spaced known value", () => {
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "pp", value: "correct horse battery staple" }]);
+    const scrubber = new Scrubber({ known, fingerprint: fp });
+    const jwt = `eyJ${"a".repeat(600)}.eyJ${"b".repeat(300)}.${"c".repeat(100)}`;
+    for (const [text, secret] of [
+      ["AWS_ACCESS_KEY = Zx9qWvLk3mNp8RtY\n", "Zx9qWvLk3mNp8RtY"],
+      ["the phrase is correct horse battery staple ok\n", "battery staple"],
+      [`here ${jwt} done`, "a".repeat(100)],
+      ['MY_PASSPHRASE = "hunter2-xyz-abc"\n', "hunter2-xyz-abc"],
+    ] as const) {
+      for (const step of [1, 3, 7]) {
+        const s = new StreamScrubber(scrubber);
+        let out = "";
+        for (let i = 0; i < text.length; i += step) out += s.push(text.slice(i, i + step));
+        out += s.flush();
+        expect(out).not.toContain(secret);
+      }
+    }
+    // Prose that only mentions the words streams.
+    const s = new StreamScrubber(scrubber);
+    expect(s.push("We use token-based authentication here and ")).toBe("We use token-based authentication here and ");
+  });
+
+  test("offline, a text that can't be checked is left as it is, and said", () => {
+    let unchecked = 0;
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp, budgetMs: -1, onUnchecked: () => void unchecked++ });
+    expect(scrubber.scrub("keep me").text).toBe("keep me");
+    expect(unchecked).toBe(1);
+  });
+
+  test("a relayed MCP result is scrubbed like a hub result", async () => {
+    const { McpHub } = await import("../mcp/hub.js");
+    const hub = new McpHub();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+    hub.setResultScrub((t) => scrubber.scrub(t).text);
+    const r = hub.scrubRelayed("tools/call", { content: [{ type: "text", text: `t=${GHP}` }], structuredContent: { token: GHP } });
+    expect(JSON.stringify(r)).not.toContain(GHP);
+  });
+});
+
+describe("round-2 audit", () => {
+  test.each([
+    ['curl -H "X-Api-Key: abcdef1234567890" x', "abcdef1234567890"],
+    ["password: hunter2 # prod", "hunter2"],
+    ["secret: dGVzdA==", "dGVzdA=="],
+    ["GET /x?api_key=abcdef123456&q=1", "abcdef123456"],
+    ["mysql -u root -pHunter2pw db", "Hunter2pw"],
+    ["sshpass -p s3cretpw ssh h", "s3cretpw"],
+    ["DB_PASSWORD=correct_horse_battery", "correct_horse_battery"],
+    ["DB_PASSWORD=violetMeadow", "violetMeadow"],
+  ])("finds the value in %s", (text, value) => {
+    expect((findSecrets(text) ?? []).map((s) => text.slice(s.start, s.end))).toEqual([value]);
+  });
+
+  test("a value stops at & and a literal \\n, so nothing after it is lost", () => {
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+    expect(scrubber.scrub("password=hunter2&user=x").text).toEndWith("&user=x");
+    expect(scrubber.scrub('{"env":"API_KEY=abc123xyz\\nNEXT=1"}').text).toContain("\\nNEXT=1");
+  });
+
+  test.each(["export -p", "declare -x", "env -u X", "cat .env*", "docker exec c env", "kubectl exec p -- env", "ssh host cat .env", "echo $GITHUB_TOKEN"])(
+    "withholds the output of %s",
+    async (command) => {
+      await loadShellParser();
+      expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("withhold-output");
+    },
+  );
+
+  test("writes of a credential file by any backend's file tools", () => {
+    expect(toolVerdict("codex_file_change", { changes: [{ path: "/w/.env", kind: "add" }] }, { cwd: "/w" })).toBe("withhold-written");
+    expect(toolVerdict("apply_patch", { input: "*** Begin Patch\n*** Add File: .env\n+A=1\n*** End Patch" }, { cwd: "/w" })).toBe("withhold-written");
+  });
+
+  test("remembering many values, and scrubbing already-scrubbed text, stay fast", async () => {
+    const { LearnedSecrets } = await import("./known.js");
+    const learned = new LearnedSecrets();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), learnedFor: () => learned, fingerprint: fp });
+    const jwt = (i: number) => `eyJ${"a".repeat(40)}${i}.eyJ${"b".repeat(600)}.${"c".repeat(43)}`;
+    let t0 = performance.now();
+    for (let i = 0; i < 2000; i++) scrubber.scrub(`got ${jwt(i)} ok`);
+    expect(performance.now() - t0).toBeLessThan(5_000);
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "k", value: "knownvalue123" }]);
+    const s2 = new Scrubber({ known, fingerprint: fp });
+    t0 = performance.now();
+    const r = s2.scrub("‹secret:x:00000000› knownvalue123 ".repeat(40_000));
+    expect(performance.now() - t0).toBeLessThan(2_000);
+    expect(r.text).not.toContain("knownvalue123");
+  });
+
+  test("a dev default in the environment isn't a known value; a key-like one is", async () => {
+    const { environmentSecrets } = await import("./service.js");
+    const found = environmentSecrets({ POSTGRES_PASSWORD: "postgres", SESSION_SECRET: "development", STRIPE_API_KEY: "sk_test_abcDEF123456789" });
+    expect(found.map((k) => k.value)).toEqual(["sk_test_abcDEF123456789"]);
+  });
+
+  test("known values are matched only as whole tokens", () => {
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "k", value: "postgres-pw-12" }]);
+    const s = new Scrubber({ known, fingerprint: fp });
+    expect(s.scrub("x postgres-pw-123 y").text).toBe("x postgres-pw-123 y");
+    expect(s.scrub("x postgres-pw-12 y").text).toBe("x ‹credential:k› y");
+  });
+
+  test("structured MCP output is scrubbed string by string", async () => {
+    const { McpHub } = await import("../mcp/hub.js");
+    const hub = new McpHub();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+    hub.setResultScrub((t) => scrubber.scrub(t).text);
+    const r = hub.scrubRelayed("tools/call", { content: [], structuredContent: { output: "db:\n  password: Violetmeadow\n", n: 3 } }) as { structuredContent: { output: string; n: number } };
+    expect(r.structuredContent.output).not.toContain("Violetmeadow");
+    expect(r.structuredContent.n).toBe(3);
+  });
+});
+
+describe("verification pass", () => {
+  test.each([
+    ["DB_PASSWORD=Xy7&kLm9pQ", "Xy7&kLm9pQ"],
+    ["DB_PASSWORD=ab\\cd12ef", "ab\\cd12ef"],
+    ["TOKEN=abc123&def=1", "abc123"],
+    ["sshpass -p x0secret ssh -p 2222 host", "x0secret"],
+  ])("finds exactly the value in %s", (text, value) => {
+    expect((findSecrets(text) ?? []).map((s) => text.slice(s.start, s.end))).toEqual([value]);
+  });
+
+  test.each(["INFO token: refreshed", "Error: password: incorrect", "secret: !vault |", "sshpass -f pw.txt ssh -p 22 host", "docker run -p8080:80 mysql:8", "?key=static"])(
+    "leaves %s",
+    (text) => {
+      expect(kinds(text)).toEqual([]);
+    },
+  );
+
+  test("repeated eyJ stays linear", () => {
+    const t0 = performance.now();
+    findSecrets("eyJ".repeat(660_000));
+    expect(performance.now() - t0).toBeLessThan(1_000);
+  });
+
+  test("a known value after a JSON escape or a URL-encoded character", () => {
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "v", value: "VALUE12345678" }]);
+    expect(known.replace('"line\\nVALUE12345678"')!.text).toBe('"line\\n‹credential:v›"');
+    expect(known.replace("data=%22VALUE12345678%22")!.text).toBe("data=%22‹credential:v›%22");
+    expect(known.replace("xVALUE12345678")!.text).toBe("xVALUE12345678");
+  });
+
+  test.each(["docker exec c sh -c 'cat .env'", "kubectl exec p -- sh -c 'cat /app/.env'", "ssh host -- env", "docker compose exec web env"])("withholds what %s runs", async (command) => {
+    await loadShellParser();
+    expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("withhold-output");
+  });
+});
diff --git a/src/daemon/secrets/service.ts b/src/daemon/secrets/service.ts
new file mode 100644
index 00000000..6f1a472f
--- /dev/null
+++ b/src/daemon/secrets/service.ts
@@ -0,0 +1,188 @@
+/**
+ * The daemon's secret handling (docs/secrets-and-memory-design.md §2), one
+ * per daemon: the values codeoid knows, the fingerprint key, the vault, and
+ * the scrubber every store goes through.
+ *
+ * `scrub(text, ctx)` is what callers use; `verdict(...)` decides what of a
+ * tool call is stored at all. With `secrets.enabled: false` both are
+ * pass-throughs (for debugging only).
+ */
+
+import type { SecretsConfig } from "../../config.js";
+import type { AccountStore } from "../accounts.js";
+import type { CredentialDecl } from "../credentials/schema.js";
+import type { SecretStore } from "../credentials/store.js";
+import type { EndpointStore } from "../openai-endpoints.js";
+import type { Store } from "../store.js";
+import { Fingerprinter, loadOrCreateKey, secretMaterialDir } from "./fingerprint.js";
+import { type KnownSecret, KnownSecrets, LearnedSecrets } from "./known.js";
+import { type ScrubContext, type ScrubResult, Scrubber } from "./scrub.js";
+import { type ToolVerdict, toolVerdict } from "./verdict.js";
+import { CapturedSecretVault } from "./vault.js";
+
+export interface SecretServiceOptions {
+  config?: SecretsConfig;
+  configDir: string;
+  store?: Store;
+  /** Whether a workstream keeps detected secrets ('' = sessions with no workstream). */
+  capturePolicy?: (workstream: string | undefined) => "drop" | "vault";
+  /**
+   * A batch rewrite of stored data (`codeoid secret scrub`): no time budget (nothing waits on it,
+   * and a text over budget would be lost for good), and nothing remembered across texts (a value
+   * learned from one file must not rewrite every other).
+   */
+  offline?: boolean;
+  /** Offline: a text that couldn't be checked, kept as it is (counted by the caller). */
+  onUnchecked?: (text: string) => void;
+}
+
+/** Scrub context with the owner, so a kept secret lands in the right tenant. */
+export interface StoreScrubContext extends ScrubContext {
+  accountId?: string;
+  projectId?: string;
+}
+
+export const DEFAULT_SECRETS_CONFIG: SecretsConfig = { enabled: true, beforeModel: true, captureSecrets: "drop", vaultDays: 30, dropCommands: [], credentialFiles: [] };
+
+export class SecretService {
+  readonly known = new KnownSecrets();
+  /** Values found by a distinct format this run, per tenant, matched exactly from then on (memory only). */
+  readonly #learned = new Map<string, LearnedSecrets>();
+
+  /** A tenant's remembered values; none without a tenant. */
+  learnedFor(ctx: { accountId?: string; projectId?: string }): LearnedSecrets | undefined {
+    if (!ctx.accountId || !ctx.projectId) return undefined;
+    const key = `${ctx.accountId}\u0000${ctx.projectId}`;
+    let l = this.#learned.get(key);
+    if (!l) {
+      l = new LearnedSecrets();
+      this.#learned.set(key, l);
+    }
+    return l;
+  }
+  readonly config: SecretsConfig;
+  readonly vault: CapturedSecretVault | undefined;
+  readonly #scrubber: Scrubber;
+  #capturePolicy: (workstream: string | undefined) => "drop" | "vault";
+
+  constructor(opts: SecretServiceOptions) {
+    this.config = opts.config ?? DEFAULT_SECRETS_CONFIG;
+    const dir = secretMaterialDir(opts.configDir);
+    const fingerprint = new Fingerprinter(loadOrCreateKey(dir, "fingerprint.key"));
+    this.vault = opts.store ? new CapturedSecretVault(opts.store, loadOrCreateKey(dir, "vault.key")) : undefined;
+    this.#capturePolicy = opts.capturePolicy ?? (() => this.config.captureSecrets);
+    this.#scrubber = new Scrubber({
+      known: this.known,
+      ...(opts.offline
+        ? { budgetMs: 60_000, ...(opts.onUnchecked ? { onUnchecked: opts.onUnchecked } : {}) }
+        : { learnedFor: (ctx: ScrubContext) => this.learnedFor(ctx as StoreScrubContext) }),
+      fingerprint,
+      onDetected: (secret, ctx) => {
+        const c = ctx as StoreScrubContext;
+        if (!this.vault || !c.accountId || !c.projectId) return;
+        if (this.#capturePolicy(c.workstream) !== "vault") return;
+        this.vault.put({ accountId: c.accountId, projectId: c.projectId, workstream: c.workstream ?? "" }, { ...secret, ...(c.sessionId ? { sessionId: c.sessionId } : {}) });
+      },
+    });
+  }
+
+  /** Who decides whether a workstream keeps detected secrets (the session manager, which knows the workstreams). */
+  setCapturePolicy(policy: (workstream: string | undefined) => "drop" | "vault"): void {
+    this.#capturePolicy = policy;
+  }
+
+  get enabled(): boolean {
+    return this.config.enabled;
+  }
+
+  get scrubber(): Scrubber {
+    return this.#scrubber;
+  }
+
+  /** Add a source of values codeoid knows; returns a function that removes it. */
+  addKnown(name: string, source: () => Iterable<KnownSecret>): () => void {
+    return this.known.register(name, source);
+  }
+
+  scrub(text: string, ctx: StoreScrubContext = {}): ScrubResult {
+    if (!this.config.enabled) return { text, changed: false };
+    return this.#scrubber.scrub(text, ctx);
+  }
+
+  scrubValue<T>(value: T, ctx: StoreScrubContext = {}): { value: T; changed: boolean } {
+    if (!this.config.enabled) return { value, changed: false };
+    return this.#scrubber.scrubValue(value, ctx);
+  }
+
+  verdict(toolName: string, input: unknown, cwd: string): ToolVerdict {
+    if (!this.config.enabled) return "keep";
+    return toolVerdict(toolName, input, { cwd, dropCommands: this.config.dropCommands, credentialFiles: this.config.credentialFiles });
+  }
+
+  /** Forget kept secrets past `vaultDays`. */
+  expireVault(): number {
+    return this.vault?.expire(this.config.vaultDays) ?? 0;
+  }
+}
+
+/**
+ * The daemon's own keys in its environment: `CODEOID_*` values (credentials
+ * from the env-file store among them) and anything whose name says it is a
+ * secret (`*_API_KEY`, `*_TOKEN`, …).
+ */
+/** At least 12 characters, and not a plain word: a digit, a symbol, or both cases. */
+export function looksLikeSecret(value: string): boolean {
+  if (value.length < 12) return false;
+  return /[0-9]/.test(value) || /[^A-Za-z]/.test(value) || (/[a-z]/.test(value) && /[A-Z]/.test(value));
+}
+
+export function environmentSecrets(env: Record<string, string | undefined> = process.env): KnownSecret[] {
+  const out: KnownSecret[] = [];
+  const NAME = /(?:^CODEOID_CRED_|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$|_ACCESS_KEY$|_SECRET_KEY$|_PRIVATE_KEY$|^ANTHROPIC_AUTH_TOKEN$|^CODEOID_API_KEY$)/;
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || !NAME.test(name)) continue;
+    // Named like a secret, but a dev default (`postgres`, `development`, `changeme`) is ordinary text
+    // everywhere else: a value from the environment is matched only when it looks like one.
+    if (!looksLikeSecret(value)) continue;
+    out.push({ label: name.startsWith("CODEOID_CRED_") ? name.slice("CODEOID_CRED_".length).toLowerCase().replace(/_/g, "-") : `daemon:${name}`, value });
+  }
+  return out;
+}
+
+/**
+ * Every place codeoid holds a credential value (§2.2): declared credentials
+ * in the secret store, the daemon's environment, every backend's accounts,
+ * OpenAI-compatible endpoints, and the database's OAuth tokens and conductor
+ * key. The daemon and `codeoid secret scrub` register the same sources.
+ */
+export function addDaemonKnownSources(
+  secrets: SecretService,
+  deps: { credentials: () => readonly CredentialDecl[]; secretStore: SecretStore; accounts: AccountStore; endpoints: EndpointStore; store: Store },
+): void {
+  secrets.addKnown("credentials", () =>
+    deps.credentials().flatMap((c) => {
+      if (c.kind === "oauth") return [];
+      const value = deps.secretStore.get(c.id);
+      return value ? [{ label: c.id, value }] : [];
+    }),
+  );
+  secrets.addKnown("environment", () => environmentSecrets(process.env));
+  secrets.addKnown("accounts", () =>
+    deps.accounts.backendsWithData().flatMap((backend) =>
+      deps.accounts.list(backend).flatMap((info) => {
+        const a = deps.accounts.get(backend, info.name);
+        if (!a) return [];
+        const label = `account:${backend}:${a.name}`;
+        return [a.token, ...Object.values(a.headers ?? {}), ...Object.values(a.env ?? {})].filter((v): v is string => typeof v === "string").map((value) => ({ label, value }));
+      }),
+    ),
+  );
+  secrets.addKnown("endpoints", () =>
+    deps.endpoints.entries().flatMap((e) =>
+      [e.apiKey, ...Object.values(e.headers ?? {})].filter((v): v is string => typeof v === "string").map((value) => ({ label: `endpoint:${e.name}`, value })),
+    ),
+  );
+  secrets.addKnown("store", () => deps.store.knownSecretValues());
+  deps.accounts.onChange(() => secrets.known.invalidate());
+  deps.endpoints.onChange(() => secrets.known.invalidate());
+}
diff --git a/src/daemon/secrets/vault.ts b/src/daemon/secrets/vault.ts
new file mode 100644
index 00000000..a0f4ff26
--- /dev/null
+++ b/src/daemon/secrets/vault.ts
@@ -0,0 +1,86 @@
+/**
+ * Detected secrets a workstream keeps (docs/secrets-and-memory-design.md
+ * §2.5): opt-in, `captureSecrets: "vault"`, so a person can still get one
+ * back later. Values are sealed with AES-256-GCM under `vault.key` (beside
+ * the fingerprint key, outside the database), so a copy of the database
+ * alone holds none. Read back only by the owner (`reveal`), audited by the
+ * caller; expired after `secrets.vaultDays` unless promoted to a credential.
+ *
+ * A kept secret belongs to one workstream: it is never revealed from
+ * another, so a closed workstream's secrets stay its own.
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import type { Store } from "../store.js";
+
+export interface VaultScope {
+  accountId: string;
+  projectId: string;
+  /** '' for sessions with no workstream. */
+  workstream: string;
+}
+
+export class CapturedSecretVault {
+  readonly #store: Store;
+  readonly #key: Buffer;
+
+  constructor(store: Store, key: Buffer) {
+    this.#store = store;
+    this.#key = key;
+  }
+
+  put(scope: VaultScope, secret: { kind: string; fingerprint: string; value: string; sessionId?: string }): void {
+    this.#store.putCapturedSecret({
+      ...scope,
+      fingerprint: secret.fingerprint,
+      kind: secret.kind,
+      sealed: this.#seal(secret.value, scope, secret.fingerprint),
+      ...(secret.sessionId ? { sessionId: secret.sessionId } : {}),
+      at: Date.now(),
+    });
+  }
+
+  list(scope: { accountId: string; projectId: string; workstream?: string }) {
+    return this.#store.listCapturedSecrets(scope);
+  }
+
+  /** The value, or undefined when this workstream keeps no such secret (or it can't be opened). */
+  reveal(scope: VaultScope, fingerprint: string): string | undefined {
+    const row = this.#store.capturedSecret({ ...scope, fingerprint });
+    if (!row) return undefined;
+    try {
+      return this.#open(row.sealed, scope, fingerprint);
+    } catch {
+      return undefined;
+    }
+  }
+
+  forget(scope: VaultScope, fingerprint: string): boolean {
+    return this.#store.deleteCapturedSecret({ ...scope, fingerprint });
+  }
+
+  expire(days: number): number {
+    return this.#store.expireCapturedSecrets(Date.now() - days * 86_400_000);
+  }
+
+  /** Bound to where it is kept: a sealed value moved to another row doesn't open. */
+  #aad(scope: VaultScope, fingerprint: string): Buffer {
+    return Buffer.from(`${scope.accountId}\u0000${scope.projectId}\u0000${scope.workstream}\u0000${fingerprint}`);
+  }
+
+  #seal(value: string, scope: VaultScope, fingerprint: string): Uint8Array {
+    const iv = randomBytes(12);
+    const c = createCipheriv("aes-256-gcm", this.#key, iv, { authTagLength: 16 });
+    c.setAAD(this.#aad(scope, fingerprint));
+    const body = Buffer.concat([c.update(value, "utf8"), c.final()]);
+    return Buffer.concat([iv, c.getAuthTag(), body]);
+  }
+
+  #open(sealed: Uint8Array, scope: VaultScope, fingerprint: string): string {
+    const buf = Buffer.from(sealed);
+    const d = createDecipheriv("aes-256-gcm", this.#key, buf.subarray(0, 12), { authTagLength: 16 });
+    d.setAAD(this.#aad(scope, fingerprint));
+    d.setAuthTag(buf.subarray(12, 28));
+    return Buffer.concat([d.update(buf.subarray(28)), d.final()]).toString("utf8");
+  }
+}
diff --git a/src/daemon/secrets/verdict.ts b/src/daemon/secrets/verdict.ts
new file mode 100644
index 00000000..3e3c77d3
--- /dev/null
+++ b/src/daemon/secrets/verdict.ts
@@ -0,0 +1,300 @@
+/**
+ * Each tool call's verdict before it is stored
+ * (docs/secrets-and-memory-design.md §2.4, after atuin's
+ * `session_capture/policy.rs`):
+ *
+ * - `keep`: stored, scrubbed (the default);
+ * - `withhold-output`: stored, its output replaced by a note — a command that
+ *   exists to print a credential (`gh auth token`, `printenv`, `op read`, …),
+ *   or a read of a credential file (`cat .env`, a file tool reading
+ *   `~/.aws/credentials`);
+ * - `withhold-written`: a write of a credential file stored without what was
+ *   written;
+ * - `drop`: not stored at all (a command the user listed in
+ *   `secrets.dropCommands`).
+ *
+ * A shell line is read with codeoid's parser (shell/parse.ts), wrappers and
+ * `bash -c '…'` looked through, so `x=$(gh auth token)` is caught as the plain
+ * form is. A line the parser can't read is matched as text, so it fails toward
+ * withholding.
+ */
+
+import { parseShellSync, type SimpleCommand } from "../shell/parse.js";
+import { shellCallOf } from "../shell/tool-call.js";
+import { writeTargets } from "../held-writes.js";
+import { toolReadPaths } from "../secret-paths.js";
+import { isCredentialFile } from "./files.js";
+
+export type ToolVerdict = "keep" | "withhold-output" | "withhold-written" | "drop";
+
+export const OUTPUT_WITHHELD = "‹output withheld: it prints credentials›";
+export const WRITTEN_WITHHELD = "‹content withheld: a credential file›";
+
+/**
+ * Commands whose output is a credential, as argv prefixes (`*` any one word).
+ * Matched against the words after the program's own options are skipped
+ * (`aws --profile x configure get …`).
+ */
+const PRINTS_CREDENTIALS: ReadonlyArray<readonly string[]> = [
+  ["gh", "auth", "token"],
+  ["glab", "auth", "status", "--show-token"],
+  ["gcloud", "auth", "print-access-token"],
+  ["gcloud", "auth", "print-identity-token"],
+  ["gcloud", "auth", "application-default", "print-access-token"],
+  ["aws", "configure", "get"],
+  ["aws", "configure", "export-credentials"],
+  ["aws", "sts", "get-session-token"],
+  ["aws", "sts", "assume-role"],
+  ["aws", "sts", "get-federation-token"],
+  ["aws", "ecr", "get-login-password"],
+  ["aws", "ecr-public", "get-login-password"],
+  ["aws", "codeartifact", "get-authorization-token"],
+  ["az", "account", "get-access-token"],
+  ["az", "ad", "sp", "create-for-rbac"],
+  ["az", "ad", "sp", "credential", "reset"],
+  ["kubectl", "get", "secret"],
+  ["kubectl", "get", "secrets"],
+  ["kubectl", "describe", "secret"],
+  ["kubectl", "describe", "secrets"],
+  ["kubectl", "create", "token"],
+  ["vault", "read"],
+  ["vault", "login"],
+  ["vault", "print", "token"],
+  ["vault", "token", "create"],
+  ["vault", "kv", "get"],
+  ["op", "read"],
+  ["op", "inject"],
+  ["op", "item", "get"],
+  ["pass", "show"],
+  ["gopass", "show"],
+  ["gopass", "cat"],
+  ["secret-tool", "lookup"],
+  ["heroku", "auth:token"],
+  ["doppler", "secrets"],
+  ["npm", "token", "create"],
+  ["git", "credential", "fill"],
+  ["printenv"],
+  ["codeoid", "mcp", "headers"],
+  ["atuin", "key"],
+];
+
+/** Programs that print the environment when run alone (no command after them). */
+const ENV_PRINTERS = new Set(["env", "set", "export", "declare", "typeset"]);
+
+/** Programs that print a file's contents: a credential file among their operands is read out. */
+const FILE_PRINTERS = new Set(["cat", "less", "more", "head", "tail", "bat", "batcat", "nl", "tac", "strings", "xxd", "hexdump", "od", "base64", "grep", "rg", "ag", "awk", "sed", "jq", "yq", "cut", "sort", "diff"]);
+
+const PROGRAM_OPTION_WITH_VALUE = /^--?(?:profile|region|output|namespace|context|kubeconfig|n|address|format|account|vault|project)$/;
+
+/** argv as text: a word only known at run time is null, but one that is only `$HOME/…` reads as `~/…`. */
+function words(c: SimpleCommand): Array<string | null> {
+  return c.argv.map((w) => w.value ?? w.home ?? null);
+}
+
+/** The paths a program reads besides its plain operands: `dd if=FILE`, `git show REV:FILE`. */
+function readsOf(argv: Array<string | null>): string[] {
+  const program = programName(argv[0] ?? "");
+  const out: string[] = [];
+  for (const a of argv.slice(1)) {
+    if (a === null) continue;
+    if (program === "dd" && a.startsWith("if=")) out.push(a.slice(3));
+    if (program === "git" && /^[^-:][^:]*:[^:]+$/.test(a) && argv.slice(1).some((w) => w === "show" || w === "cat-file")) out.push(a.slice(a.indexOf(":") + 1));
+  }
+  // git's commands that print a file's contents or changes: their path operands are read out.
+  if (program === "git" && argv.slice(1).some((w) => w !== null && ["show", "diff", "log", "blame", "grep", "cat-file"].includes(w))) {
+    for (const a of argv.slice(1)) if (a !== null && !a.startsWith("-")) out.push(a);
+  }
+  return out;
+}
+
+function programName(word: string): string {
+  return word.slice(word.lastIndexOf("/") + 1);
+}
+
+/** The words after the program, its own options (and their values) skipped, for matching a subcommand. */
+function subcommandWords(argv: string[]): string[] {
+  const out: string[] = [];
+  for (let i = 1; i < argv.length; i++) {
+    const w = argv[i]!;
+    if (out.length === 0 && w.startsWith("-")) {
+      if (!w.includes("=") && PROGRAM_OPTION_WITH_VALUE.test(w)) i++;
+      continue;
+    }
+    out.push(w);
+  }
+  return out;
+}
+
+function printsCredentials(argv: string[]): boolean {
+  const program = programName(argv[0] ?? "");
+  const rest = subcommandWords(argv);
+  for (const sig of PRINTS_CREDENTIALS) {
+    if (sig[0] !== program) continue;
+    const tail = sig.slice(1);
+    // `glab auth status --show-token`: the flag may come anywhere after the subcommand.
+    const flag = tail.find((t) => t.startsWith("--"));
+    const sub = tail.filter((t) => !t.startsWith("--"));
+    if (sub.every((t, i) => t === "*" || rest[i] === t) && (!flag || argv.includes(flag))) return true;
+  }
+  // `gh auth status -t` / `--show-token`.
+  if (program === "gh" && rest[0] === "auth" && rest[1] === "status" && (argv.includes("-t") || argv.includes("--show-token"))) return true;
+  // `security find-generic-password -w` (macOS keychain: -w / -g print the password).
+  if (program === "security" && /^find-(?:generic|internet)-password$/.test(rest[0] ?? "") && argv.some((a) => /^-[a-zA-Z]*[wg]/.test(a))) return true;
+  // `kubectl config view --raw`, `terraform output -json|-raw`.
+  if (program === "kubectl" && rest[0] === "config" && rest[1] === "view" && argv.includes("--raw")) return true;
+  if (program === "terraform" && rest[0] === "output" && (argv.includes("-json") || argv.includes("-raw"))) return true;
+  // The environment, the shell's variables: alone, not running a command.
+  if (ENV_PRINTERS.has(program)) {
+    const opts = argv.slice(1);
+    if (program === "env") {
+      // Options only (`-u X` and `-C DIR` take a value): it prints the environment.
+      let printsAll = true;
+      for (let i = 0; i < opts.length; i++) {
+        const a = opts[i]!;
+        if (a === "-u" || a === "--unset" || a === "-C" || a === "--chdir") i++;
+        else if (!a.startsWith("-")) printsAll = false;
+      }
+      if (printsAll) return true;
+    }
+    if (program === "set" && opts.length === 0) return true;
+    if ((program === "export" || program === "declare" || program === "typeset") && opts.length > 0 && opts.every((a) => /^-[a-zA-Z]*[px]/.test(a))) return true;
+  }
+  return false;
+}
+
+/** The same, matched as text when the line can't be parsed: fails toward withholding. */
+const PRINTS_CREDENTIALS_TEXT =
+  /(?:^|[;&|(`{!\n'"]|\$\()\s*(?:(?:sudo|command|exec|time|nohup)\s+|\w+=\S*\s+)*(?:\S*\/)?(?:(?:env|set|export\s+-p)\s*(?:$|[;&|)\n'"])|gh\s+auth\s+token|printenv|gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token|aws\b[^\n;&|]*\bconfigure\s+(?:get|export-credentials)|op\s+(?:read|inject|item\s+get)|vault\s+(?:read|login|kv\s+get|print\s+token)|kubectl\b[^\n;&|]*\b(?:get|describe)\s+secrets?|git\s+credential\s+fill|pass\s+show|secret-tool\s+lookup)\b/;
+
+export interface VerdictOptions {
+  /** Where the call runs, for relative paths. */
+  cwd: string;
+  /** `secrets.dropCommands`: programs (or argv prefixes, space-separated) whose calls aren't stored at all. */
+  dropCommands?: readonly string[];
+  /** `secrets.credentialFiles`: more file globs that hold credentials. */
+  credentialFiles?: readonly string[];
+}
+
+/** Whether a tool is one that writes files (by every backend's name for it). */
+function writesFiles(toolName: string): boolean {
+  return /^(?:write|edit|multiedit|notebookedit|codex_file_change|write_file|replace|edit_file|create_file|apply_patch|str_replace_based_edit_tool|patch)$/i.test(toolName);
+}
+
+/** A tool call's verdict (see the module comment). Never throws. */
+export function toolVerdict(toolName: string, input: unknown, opts: VerdictOptions): ToolVerdict {
+  try {
+    const obj = input && typeof input === "object" ? (input as Record<string, unknown>) : {};
+    const shell = shellCallOf(toolName, obj);
+    if (shell) return shellVerdict(shell.command, shell.cwd ?? opts.cwd, opts);
+    // Every backend's file tools, as the held-write gate reads them (a Codex change's paths, pi's `edit`).
+    const writes = writeTargets(toolName, obj);
+    if (writes) {
+      const named = writes.filter((p): p is string => typeof p === "string");
+      if (named.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) return "withhold-written";
+    }
+    // A patch tool: every file it adds or changes (`*** Add File: .env`).
+    const patch = typeof obj.input === "string" ? obj.input : typeof obj.patch === "string" ? obj.patch : null;
+    if (patch && /^(?:apply_patch|patch)$/i.test(toolName)) {
+      const files = [...patch.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)].map((m) => m[1]!.trim());
+      if (files.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) return "withhold-written";
+    }
+    const paths = toolReadPaths(toolName, obj);
+    if (paths.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) {
+      return writesFiles(toolName) ? "withhold-written" : "withhold-output";
+    }
+    return "keep";
+  } catch {
+    return "keep";
+  }
+}
+
+/** A declaration builtin listing the shell's variables (`export -p`, `declare -x`, bare `export`): the parser gives no command for it. */
+const DECLARATION_PRINTS = /(?:^|[;&|(]\s*|\bthen\s+|\bdo\s+)(?:export|declare|typeset|readonly)(?:\s+-[a-zA-Z]*[pxr]?[a-zA-Z]*)*\s*(?=$|[;&|)\n])/m;
+/** A variable whose name says it holds a credential (`$GITHUB_TOKEN`, `${DB_PASSWORD}`). */
+const SECRET_VARIABLE = /\$\{?[A-Za-z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|CREDENTIALS?)\b/i;
+/** Programs that print their arguments. */
+const ECHOES = new Set(["echo", "printf", "print"]);
+/** A word as a path it may name: globs and braces dropped (`.env*`, `.env{,.local}` name `.env`). */
+function pathLike(raw: string): string {
+  return raw.replace(/^["']|["']$/g, "").replace(/\{[^}]*\}/g, "").replace(/[*?]+$/, "").replace(/\[[^\]]*\]$/, "");
+}
+
+/** One word as a shell reads it back. */
+function shellQuote(w: string): string {
+  return /^[A-Za-z0-9_./=:@%+,-]+$/.test(w) ? w : `'${w.replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * The command another program runs for it: `ssh host CMD…` (ssh joins its words with spaces, as
+ * a shell on the other side reads them), `docker exec C CMD…` / `docker compose exec S CMD…` /
+ * `kubectl exec P -- CMD…` (an argv, each word kept as it is).
+ */
+function innerCommand(argv: string[]): string | null {
+  const program = programName(argv[0] ?? "");
+  const rest = argv.slice(1);
+  if (program === "ssh") {
+    let i = 0;
+    while (i < rest.length && rest[i]!.startsWith("-") && rest[i] !== "--") i += /^-[bcDEeFIiJLlmOopQRSWw]$/.test(rest[i]!) ? 2 : 1;
+    if (rest[i] === "--") i++;
+    let cmd = rest.slice(i + 1);
+    if (cmd[0] === "--") cmd = cmd.slice(1);
+    return cmd.length > 0 ? cmd.join(" ") : null;
+  }
+  const execAt = (program === "docker" || program === "podman") && rest[0] === "exec" ? 1 : (program === "docker" || program === "podman") && rest[0] === "compose" && rest[1] === "exec" ? 2 : -1;
+  if (execAt > 0) {
+    let i = execAt;
+    while (i < rest.length && rest[i]!.startsWith("-")) i += /^-(?:e|u|w|-env|-env-file|-user|-workdir|-index)$/.test(rest[i]!) ? 2 : 1;
+    return rest.length > i + 1 ? rest.slice(i + 1).map(shellQuote).join(" ") : null;
+  }
+  if (program === "kubectl" && rest.includes("exec")) {
+    const dash = rest.indexOf("--");
+    return dash >= 0 && dash < rest.length - 1 ? rest.slice(dash + 1).map(shellQuote).join(" ") : null;
+  }
+  return null;
+}
+
+function shellVerdict(command: string, cwd: string, opts: VerdictOptions, depth = 0): ToolVerdict {
+  if (DECLARATION_PRINTS.test(command)) return "withhold-output";
+  const parsed = parseShellSync(command);
+  const drops = (opts.dropCommands ?? []).map((d) => d.trim().split(/\s+/).filter(Boolean)).filter((d) => d.length > 0);
+  if (parsed.unreadable) {
+    if (drops.some((d) => command.includes(d.join(" ")))) return "drop";
+    if (PRINTS_CREDENTIALS_TEXT.test(command)) return "withhold-output";
+    // A reader and a credential file named anywhere on the line: withheld, since the line can't be read.
+    const tokens = command.split(/[\s;&|()<>]+/).map((t) => t.replace(/^["']|["']$/g, "")).filter(Boolean);
+    if (tokens.some((t) => FILE_PRINTERS.has(programName(t))) && tokens.some((t) => isCredentialFile(t, cwd, opts.credentialFiles))) return "withhold-output";
+    return "keep";
+  }
+  let verdict: ToolVerdict = "keep";
+  for (const c of parsed.commands) {
+    const argv = words(c);
+    if (argv.length === 0 || argv[0] === null) continue;
+    const program = programName(argv[0]);
+    // Printing a variable named for a credential: its value is the output.
+    if (ECHOES.has(program) && c.argv.slice(1).some((w) => SECRET_VARIABLE.test(w.raw))) verdict = "withhold-output";
+    // What runs elsewhere for it is judged too.
+    if (depth < 2 && argv.every((a) => a !== null)) {
+      const inner = innerCommand(argv as string[]);
+      if (inner) {
+        const v = shellVerdict(inner, cwd, opts, depth + 1);
+        if (v === "drop") return v;
+        if (v !== "keep") verdict = v;
+      }
+    }
+    // A word with a glob or braces naming a credential file (`cat .env*`): judged by the name it starts with.
+    if (FILE_PRINTERS.has(program) && c.argv.slice(1).some((w) => w.glob && isCredentialFile(pathLike(w.raw), cwd, opts.credentialFiles))) verdict = "withhold-output";
+    if (drops.some((d) => d.every((w, i) => (i === 0 ? program === w : argv[i] === w)))) return "drop";
+    // A word only known at run time can't be a subcommand that prints a credential; the rest still counts.
+    if (argv.every((a) => a !== null) && printsCredentials(argv as string[])) verdict = "withhold-output";
+    // A credential file read out: an operand of a printer, what dd or git show reads, or a redirect it reads (`< .env`).
+    const known = argv.filter((a): a is string => a !== null);
+    const operands = [...(FILE_PRINTERS.has(program) ? known.slice(1).filter((a) => !a.startsWith("-")) : []), ...readsOf(argv)];
+    const reads = c.redirects.filter((r) => r.op === "<" && r.target?.value).map((r) => r.target!.value!);
+    if ([...operands, ...reads].some((p) => isCredentialFile(p, cwd, opts.credentialFiles))) verdict = "withhold-output";
+    // A credential file written by a redirect (`echo KEY=… > .env`): the line holds the value.
+    const writes = c.redirects.filter((r) => /^(?:>|>>|&>|>\||&>>)$/.test(r.op) && r.target?.value).map((r) => r.target!.value!);
+    if (writes.some((p) => isCredentialFile(p, cwd, opts.credentialFiles)) && verdict === "keep") verdict = "withhold-written";
+  }
+  if (verdict === "keep" && parsed.problems.length > 0 && PRINTS_CREDENTIALS_TEXT.test(command)) verdict = "withhold-output";
+  return verdict;
+}
diff --git a/src/daemon/server.ts b/src/daemon/server.ts
index ec6e1d5b..58a692f1 100644
--- a/src/daemon/server.ts
+++ b/src/daemon/server.ts
@@ -22,6 +22,7 @@ import {
   removeLocalTokenFile,
   writeLocalTokenFile,
 } from "./local-auth.js";
+import { SecretService } from "./secrets/service.js";
 import { SessionManager } from "./session-manager.js";
 import { Store } from "./store.js";
 import { TranscriptStore } from "./transcript.js";
@@ -214,6 +215,12 @@ export interface DaemonConfig {
    * sessions aren't sandboxed and carry no `sandbox` in their info.
    */
   sandboxRegistry?: SandboxRegistry;
+  /**
+   * Where the keys for secret handling live (docs/secrets-and-memory-design.md
+   * §2): `codeoid start` passes the config dir, so what sessions store is
+   * scrubbed. Absent (tests, embedders): stored as it came.
+   */
+  secretsConfigDir?: string;
 }
 
 interface AuthenticatedSocket {
@@ -232,6 +239,8 @@ export class DaemonServer {
   #memoryMcp: MemoryMcpHttp | null = null;
   #mcpRegistry: McpRegistry | null = null;
   #mcpHub: McpHub | null = null;
+  /** Secret handling for what sessions store and what the hub hands back (docs/secrets-and-memory-design.md §2). */
+  #secretService?: SecretService;
   #mcpProxy: McpProxy | null = null;
   #bunServer: ReturnType<typeof Bun.serve> | null = null;
   /** Boot recovery done: until then every request is answered 503 (`start`). */
@@ -354,6 +363,9 @@ export class DaemonServer {
           `${maxCreationsPerHour || "unlimited"}/hr per subject`,
       );
     }
+    if (config.secretsConfigDir) {
+      this.#secretService = new SecretService({ ...(config.fullConfig?.secrets ? { config: config.fullConfig.secrets } : {}), configDir: config.secretsConfigDir, store: this.#store });
+    }
     this.#manager = new SessionManager(
       this.#store, this.#transcriptStore, identityManager, rateLimiter,
       // Memory is wired post-construction via initMemory() — see start()
@@ -367,6 +379,7 @@ export class DaemonServer {
         // restarts so a daemon still recognises its own crashed run.
         daemonId: `${this.#config.host}:${this.#config.port}`,
         ...(config.sandboxRegistry ? { sandboxRegistry: config.sandboxRegistry } : {}),
+        ...(this.#secretService ? { secretService: this.#secretService } : {}),
       },
     );
 
@@ -626,6 +639,23 @@ export class DaemonServer {
       requestTimeoutMs: this.#config.fullConfig?.session.mcpToolTimeoutMs,
     });
     this.#mcpHub.proxy = this.#mcpProxy;
+    const secretService = this.#secretService;
+    if (secretService?.enabled && secretService.config.beforeModel) this.#mcpHub.setResultScrub((text) => secretService.scrub(text).text);
+    if (secretService) {
+      // The relay's per-session tokens are credentials too: matched while they live.
+      const live = new Set<string>();
+      this.#mcpProxy.tokenListener = {
+        minted: (t) => {
+          live.add(t);
+          secretService.known.invalidate();
+        },
+        revoked: (t) => {
+          live.delete(t);
+          secretService.known.invalidate();
+        },
+      };
+      secretService.addKnown("mcp-proxy", () => [...live].map((value) => ({ label: "daemon:mcp-relay-token", value })));
+    }
     for (const w of this.#mcpRegistry.warnings) console.warn(`[codeoid] ${w}`);
     // Goal blackboard: loopback URL regardless of bind address — the agent
     // subprocess runs on this host, and the endpoint must not become
diff --git a/src/daemon/session-manager.ts b/src/daemon/session-manager.ts
index 8e4d6c3e..42ea5a36 100644
--- a/src/daemon/session-manager.ts
+++ b/src/daemon/session-manager.ts
@@ -16,6 +16,8 @@ import { OverrideTokens } from "./workstreams/override.js";
 import { withSlot } from "./mcp/oauth.js";
 import type { FolderReader } from "./workstreams/folder.js";
 import { createSecretStore, credentialEnvName, type SecretStore } from "./credentials/store.js";
+import { secretMaterialDir } from "./secrets/fingerprint.js";
+import { addDaemonKnownSources, type SecretService } from "./secrets/service.js";
 import { credentialsSchema } from "./credentials/schema.js";
 import { workstreamsSchema } from "./workstreams/schema.js";
 import { registerSecretPaths } from "./secret-paths.js";
@@ -546,6 +548,8 @@ export class SessionManager {
   #mcpRegistry?: McpRegistry;
   #mcpHub?: McpHub;
   #mcpOAuth?: McpOAuth;
+  /** Secret handling for what sessions store (docs/secrets-and-memory-design.md §2). */
+  #secretService?: SecretService;
   /** In-flight interactive backend sign-ins. Daemon-wide, and at most one per
    *  backend — two live logins would race to write the same credential. */
   readonly #backendLogin: BackendLoginBroker;
@@ -738,6 +742,8 @@ export class SessionManager {
       _testFolderReader?: FolderReader;
       /** Test-only: where credential values come from. */
       _testSecrets?: SecretStore;
+      /** Secret handling for what sessions store (docs/secrets-and-memory-design.md §2). Absent: stored as it came. */
+      secretService?: SecretService;
     },
   ) {
     this.#store = store;
@@ -758,6 +764,7 @@ export class SessionManager {
     // secrets are (secret-paths.ts).
     if (opts?.config?.credentialStore?.kind === "dir") registerSecretPaths({ dirs: [opts.config.credentialStore.path] });
     this.#sandboxRegistry = opts?.sandboxRegistry;
+    this.#secretService = opts?.secretService;
     if (opts?.config?.worktree?.setup) this.#worktreeSetupPolicy = opts.config.worktree.setup;
     this.#compressionRegistry = opts?.compressionRegistry;
     this.#endpoints = opts?.endpoints ?? new EndpointStore();
@@ -787,6 +794,7 @@ export class SessionManager {
       this.#pushToProviderSubscribers({ type: "accounts.changed", backend });
     });
     this.#hooks = opts?.hooks;
+    if (this.#secretService) this.#wireSecretService(this.#secretService);
     this.#testProviderFactory = opts?._testProviderFactory;
     this.#backendLogin = opts?._testBackendLogin ?? new BackendLoginBroker();
     this.#dispatcher = new Dispatcher(store, this.#makeDispatcherHost(), {
@@ -852,7 +860,10 @@ export class SessionManager {
     // Routines share the daemon DB. Built only when enabled, so the kill
     // switch leaves every routine in place but nothing fires.
     if (opts?.config?.routines?.enabled ?? true) {
-      this.#routines = new RoutineService(new RoutineStore(store.database), this.#makeRoutineHost(), opts?.config?.routines ?? {});
+      const routineStore = new RoutineStore(store.database);
+      const secretService = opts?.secretService;
+      if (secretService) routineStore.scrubText = (text) => secretService.scrub(text).text;
+      this.#routines = new RoutineService(routineStore, this.#makeRoutineHost(), opts?.config?.routines ?? {});
     }
     // Pack curation surface (docs/pack-loading.md) — always constructed (cheap:
     // no DB / runner). Reads the boot pack config; each mutation persists to
@@ -1686,6 +1697,10 @@ mcpHub: this.#mcpHub,
       case "credential.delete":
       case "credential.set_value":
         return this.#credentialEdit(msg, auth);
+      case "secret.list":
+      case "secret.reveal":
+      case "secret.forget":
+        return this.#secretHandle(msg, auth);
       case "mcp.oauth.begin":
         return this.#mcpOAuthBegin(msg, auth);
       case "mcp.oauth.complete":
@@ -1865,6 +1880,7 @@ mcpHub: this.#mcpHub,
           // Bind the exporter's tenant so the derived workspace id matches the
           // tenant-scoped ids episodes were written under.
           workspaceIdFor: (wd: string) => workspaceIdFromPath(wd, auth),
+          ...(this.#secretService ? { scrub: <T,>(v: T): T => this.#secretService!.scrubValue(v).value } : {}),
         },
       );
 
@@ -2345,6 +2361,7 @@ mcpHub: this.#mcpHub,
     workstreamEnv?: (b: WorkstreamBinding | undefined) => Readonly<Record<string, string>>;
     mcpGrant: (b: WorkstreamBinding | undefined) => McpGrant | undefined;
     workstreamFence: (b: WorkstreamBinding | undefined, own: readonly string[]) => WorkstreamFence | undefined;
+    secrets?: SecretService;
   } {
     const { missing } = this.#workstreams.envFor(binding, this.#secrets);
     if (missing.length > 0) {
@@ -2360,9 +2377,36 @@ mcpHub: this.#mcpHub,
       // The grant follows the config as it is at each listing.
       mcpGrant: (b) => this.#workstreams.grantFor(b),
       workstreamFence: (b, own) => this.#workstreamFence(b, own),
+      ...(this.#secretService ? { secrets: this.#secretService } : {}),
     };
   }
 
+  /**
+   * Tell the secret service what codeoid knows (§2.2 of
+   * secrets-and-memory-design.md): every value it holds, from every place it
+   * holds them, matched exactly wherever they show up. And whose workstream
+   * keeps detected secrets.
+   */
+  #wireSecretService(secrets: SecretService): void {
+    registerSecretPaths({ dirs: [secretMaterialDir(getConfigDir())] });
+    // Settled dispatch tasks and routine runs keep no secret either (§2.6).
+    this.#store.scrubText = (text) => secrets.scrub(text).text;
+    secrets.setCapturePolicy((ws) => (ws ? (this.#workstreams.get(ws)?.captureSecrets ?? "drop") : (this.#config?.secrets?.captureSecrets ?? "drop")));
+    addDaemonKnownSources(secrets, {
+      credentials: () => this.#config?.credentials ?? [],
+      secretStore: this.#secrets,
+      accounts: this.#accounts,
+      endpoints: this.#endpoints,
+      store: this.#store,
+    });
+    try {
+      const n = secrets.expireVault();
+      if (n > 0) console.log(`[codeoid] secrets: forgot ${n} kept secret(s) not seen in ${secrets.config.vaultDays} days`);
+    } catch (err) {
+      console.error(`[codeoid] secrets: expiring kept secrets failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
   /** Fences by binding and config revision, briefly: the gate reads one on every file tool call. */
   #fenceCache = new Map<string, { at: number; fence: WorkstreamFence | undefined }>();
 
@@ -3504,6 +3548,7 @@ mcpHub: this.#mcpHub,
     const workstreams = workstreamsSchema.parse(config.workstreams);
     const credentials = credentialsSchema.parse(config.credentials);
     if (this.#config) this.#config = { ...this.#config, workstreams, credentials };
+    this.#secretService?.known.invalidate();
     this.#workstreams.update(workstreams, credentials);
     this.#pushToProviderSubscribers({ type: "workstreams.changed", revision: this.#workstreams.revision });
   }
@@ -3538,6 +3583,47 @@ mcpHub: this.#mcpHub,
     return this.#workstreamList({ type: "workstream.list", id: msg.id }, { ...auth, scopes: [...auth.scopes, SCOPES.SETTINGS_READ] as AuthContext["scopes"] });
   }
 
+  /**
+   * The detected secrets workstreams keep (docs/secrets-and-memory-design.md
+   * §2.5): listed with settings:read, revealed and forgotten only with the
+   * caller's own token (settings:write, undelegated), each audited. A kept
+   * secret is the tenant's: the caller's account and project only.
+   */
+  #secretHandle(msg: Extract<ClientMessage, { type: "secret.list" | "secret.reveal" | "secret.forget" }>, auth: AuthContext): DaemonMessage {
+    const tenant = { accountId: auth.accountId, projectId: auth.projectId };
+    const vault = this.#secretService?.vault;
+    if (msg.type === "secret.list") {
+      if (!hasScope(auth.scopes as string[], SCOPES.SETTINGS_READ)) {
+        return { type: "response.error", requestId: msg.id, error: "Missing scope: settings:read", code: "forbidden" };
+      }
+      return {
+        type: "secret.list.result",
+        requestId: msg.id,
+        enabled: this.#secretService?.enabled ?? false,
+        secrets: vault ? vault.list({ ...tenant, ...(msg.workstream !== undefined ? { workstream: msg.workstream } : {}) }) : [],
+      };
+    }
+    if (!hasScope(auth.scopes as string[], SCOPES.SETTINGS_WRITE)) {
+      return { type: "response.error", requestId: msg.id, error: "Missing scope: settings:write", code: "forbidden" };
+    }
+    if (auth.delegationDepth > 0) {
+      return { type: "response.error", requestId: msg.id, error: "A delegated token can't reveal or forget kept secrets", code: "forbidden" };
+    }
+    if (!vault) return { type: "response.error", requestId: msg.id, error: "This daemon keeps no secrets", code: "not_found" };
+    const scope = { ...tenant, workstream: msg.workstream };
+    if (msg.type === "secret.forget") {
+      if (!vault.forget(scope, msg.fingerprint)) return { type: "response.error", requestId: msg.id, error: "No such kept secret", code: "not_found" };
+      this.#store.audit(auth.sub, "secret.forget", "", `workstream=${msg.workstream || "-"} fingerprint=${msg.fingerprint}`);
+      return { type: "response.ok", requestId: msg.id };
+    }
+    const kept = vault.list(scope).find((k) => k.fingerprint === msg.fingerprint);
+    const value = kept ? vault.reveal(scope, msg.fingerprint) : undefined;
+    if (!kept || value === undefined) return { type: "response.error", requestId: msg.id, error: "No such kept secret", code: "not_found" };
+    // The value never goes to the audit, only who saw which one.
+    this.#store.audit(auth.sub, "secret.reveal", "", `workstream=${msg.workstream || "-"} fingerprint=${msg.fingerprint} kind=${kept.kind}`);
+    return { type: "secret.reveal.result", requestId: msg.id, kind: kept.kind, value };
+  }
+
   #credentialList(msg: { id: string }, auth: AuthContext): DaemonMessage {
     if (!hasScope(auth.scopes as string[], SCOPES.SETTINGS_READ)) {
       return { type: "response.error", requestId: msg.id, error: "Missing scope: settings:read", code: "forbidden" };
@@ -3592,6 +3678,7 @@ mcpHub: this.#mcpHub,
       if (!w.ok) return err(w.error);
       // The value never goes to the audit, only that it changed.
       this.#store.audit(auth.sub, "credential.set_value", "", `id=${decl.id} ${msg.value === null ? "cleared" : "set"}`);
+      this.#secretService?.known.invalidate();
     } else {
       const id = msg.type === "credential.upsert" ? String(msg.item.id ?? "") : msg.credential;
       const existing = declared.find((c) => c.id === id);
@@ -4374,6 +4461,8 @@ mcpHub: this.#mcpHub,
   /** Inject the MemoryEngine after construction (embedder init is async). */
   setMemory(memory: MemoryEngine): void {
     this.#memory = memory;
+    const secrets = this.#secretService;
+    if (secrets) memory.scrubText = (text, ctx) => secrets.scrub(text, ctx).text;
   }
 
   /** Inject the shared memory MCP endpoint + URL (daemon-wide, built after the
diff --git a/src/daemon/session.ts b/src/daemon/session.ts
index f59fc670..5a0703c5 100644
--- a/src/daemon/session.ts
+++ b/src/daemon/session.ts
@@ -222,7 +222,7 @@ import { resolveAttachments } from "./attachments.js";
 import { type CodeoidConfig, getConfigDir } from "../config.js";
 import { type SecretPathVerdict, secretPathVerdict } from "./secret-paths.js";
 import type { CompressionRegistry } from "./compress/index.js";
-import { defaultSpillDir } from "./compress/spill.js";
+import { defaultSpillDir, takeSpill } from "./compress/spill.js";
 import { type TurnOrigin, turnOrigin } from "./turn-origin.js";
 import { type HeldPath, heldWriteOf, heldWriteReason, writeLandings, writeTargets } from "./held-writes.js";
 import { outsideEffects } from "./risk/effects.js";
@@ -240,6 +240,12 @@ import { worktreeFolderNote } from "./sandbox/worktrees.js";
 import { hiddenPathsFor, protectedWriteTargets, userHiddenPaths } from "./sandbox/policy.js";
 import { addedDirProblem, addedDirReal, autonomousGrantProblem, checkoutOverlap, inAnyDir, nestedControl, normalizeSandboxDir, type OtherCheckout } from "./sandbox/project-roots.js";
 import { sandboxRootIfMade } from "./sandbox/root.js";
+import type { SecretService } from "./secrets/service.js";
+import { StreamScrubber } from "./secrets/scrub.js";
+import { OUTPUT_WITHHELD, type ToolVerdict, WRITTEN_WITHHELD } from "./secrets/verdict.js";
+
+/** What is recorded of a call the user listed in `secrets.dropCommands`. */
+const NOT_STORED = "‹not stored›";
 import { REQUEST_DIRECTORY_SHORT_WAIT_MS, REQUEST_DIRECTORY_WAIT_MS, type RequestDirectoryInput, type SandboxMcpMount } from "./sandbox/request-directory.js";
 import {
   CLAUDE_PROVIDER_ID,
@@ -662,6 +668,12 @@ export interface SessionCreateOptions {
    * or undefined: none (the handler then refuses what needed it).
    */
   fleetConfirm?: (target: FleetCardTarget, input: unknown) => string | undefined;
+  /**
+   * The daemon's secret handling (docs/secrets-and-memory-design.md §2):
+   * what the session stores, shows and hands on never holds a secret's
+   * value. Absent: stored as it came (tests, embedders).
+   */
+  secrets?: SecretService;
   /**
    * Initial execution mode + autonomous tool budget. Spawned workers start
    * "autonomous" with a bounded budget so they can work unattended; when the
@@ -1459,6 +1471,12 @@ export class Session {
   #collaborationCost?: () => CollaborationCost | undefined;
   #fleetTargetWorkstream?: (toolName: string, input: unknown) => FleetCardTarget | undefined;
   #fleetConfirm?: (target: FleetCardTarget, input: unknown) => string | undefined;
+  #secrets?: SecretService;
+  /** The reply and the reasoning streaming now, scrubbed as they arrive (a secret split across deltas is never sent). */
+  #textStream: StreamScrubber | null = null;
+  #thinkingStream: StreamScrubber | null = null;
+  /** Each running tool call's verdict (secrets/verdict.ts), by the backend's tool-use id. */
+  #toolVerdicts = new Map<string, ToolVerdict>();
   #workerShape?: "ship" | "scout";
   #turnsRemaining: number | undefined = undefined;
   /** See SessionCreateOptions.onBudgetExhausted. */
@@ -1897,6 +1915,7 @@ export class Session {
     this.#collaborationCost = opts.collaborationCost;
     this.#fleetTargetWorkstream = opts.fleetTargetWorkstream;
     this.#fleetConfirm = opts.fleetConfirm;
+    this.#secrets = opts.secrets;
     this.#maxBudgetUsd = opts.maxBudgetUsd;
     this.#onBudgetExhausted = opts.onBudgetExhausted ?? "park";
     const envOf = opts.workstreamEnv;
@@ -1957,6 +1976,17 @@ export class Session {
     // Durable canonical history (#354): every change is appended to the
     // session's log so forks, backend switches and rewinds after a restart
     // still carry the conversation.
+    if (this.#secrets) {
+      // At commit only what wasn't scrubbed on the way in: a user turn's text, and reasoning (a
+      // reply's text, tool inputs and outputs are scrubbed as they arrive). A seed is scrubbed whole.
+      this.#historyAccumulator.scrubTurn = (turn) =>
+        turn.role === "user"
+          ? { ...turn, content: this.#scrubText(turn.content), ...(turn.prompt !== undefined ? { prompt: this.#scrubText(turn.prompt) } : {}) }
+          : turn.thinking
+            ? { ...turn, thinking: this.#scrubText(turn.thinking) }
+            : turn;
+      this.#historyAccumulator.scrubSeed = (turn) => this.#scrubValue(turn);
+    }
     this.#historyAccumulator.onChange = (change) => {
       if (this.#destroyed) return;
       // Never write a history that couldn't be read over the log it lost;
@@ -5407,7 +5437,7 @@ export class Session {
         this.#noteProjectMcpNames(); // what this backend may load (readonly trust)
         const recoveryRun = this.#provider.runTurn({
           ...(this.#maxBudgetUsd !== undefined ? { maxBudgetUsd: this.#maxBudgetUsd } : {}),
-          history: this.#accumulator.history,
+          history: this.#historyForTurn(content),
           userMessage: content,
           model: this.#model ?? undefined,
           effort: this.#turnEffort() ?? undefined,
@@ -5515,7 +5545,7 @@ export class Session {
     this.#noteProjectMcpNames(); // what this backend may load (readonly trust)
     const run = this.#provider.runTurn({
       ...(this.#maxBudgetUsd !== undefined ? { maxBudgetUsd: this.#maxBudgetUsd } : {}),
-      history: this.#accumulator.history,
+      history: this.#historyForTurn(effectivePrompt),
       userMessage: turnPrompt,
       model: this.#model ?? undefined,
       effort: this.#turnEffort() ?? undefined,
@@ -6529,7 +6559,8 @@ export class Session {
       out.push({
         approvalId,
         toolName: gated.toolName,
-        input: gated.input,
+        // Shown as the card shows it: as recorded (the call still runs with what the backend made).
+        input: this.#approvalShown(approvalId, gated.input),
         ...this.#cardRisk(risk, this.#heldWrite(gated.toolName, gated.input)),
         ...this.#cardSandbox(gated.toolName, gated.input, gated.shellCwd),
         ...(ws ? { targetWorkstream: { ...(ws.target.workstream ? { workstream: ws.target.workstream } : {}), ...(ws.target.warning ? { warning: ws.target.warning } : {}) } } : {}),
@@ -6971,7 +7002,7 @@ export class Session {
         this.#noteProjectMcpNames(); // what this backend may load (readonly trust)
         const run = this.#provider.runTurn({
           ...(this.#maxBudgetUsd !== undefined ? { maxBudgetUsd: this.#maxBudgetUsd } : {}),
-          history: this.#accumulator.history,
+          history: this.#historyForTurn(prompt),
           userMessage: prompt,
           model: this.#model ?? undefined,
           effort: this.#turnEffort() ?? undefined,
@@ -7257,6 +7288,8 @@ export class Session {
       const row = transcript[i]!;
       if (row.type !== "session.message") continue;
       const msg = reconcileResumedMessage({ ...row, sessionId: this.id });
+      // The parent's rows may predate secret scrubbing: the fork's copy is scrubbed as it is written.
+      this.#scrubMessage(msg);
       this.#scrollback.push(msg, sizeHints?.[i]);
       this.#transcriptStore.append(this.id, msg, this.#seq++).catch((e) => {
         console.error(
@@ -10020,9 +10053,16 @@ export class Session {
    * transcript and broadcast the state delta. Shared by the manual
    * approval/deny path and the hook-block path so the two can't drift.
    */
-  #resolveToolCallMessage(approvalId: string, resolvedState: ToolState): void {
+  #resolveToolCallMessage(approvalId: string, settled: ToolState): void {
     const msgId = this.#approvalIdToMessageId.get(approvalId);
     if (!msgId) return;
+    // What is recorded of the input the call runs with: as its tool_start was (secrets/verdict.ts).
+    const runs = (settled as { input?: unknown }).input;
+    const toolUseId = this.#messageIdToToolUseId.get(msgId);
+    const resolvedState =
+      this.#secrets && runs && typeof runs === "object"
+        ? ({ ...settled, input: this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", runs as Record<string, unknown>, this.#toolCallMessages.get(msgId)?.tool?.name) } as unknown as ToolState)
+        : this.#scrubValue(settled);
     this.#scrollback.updateMessage(msgId, (m) => {
       const sm = m as SessionMessage;
       if (sm.tool) sm.tool.state = resolvedState;
@@ -10051,9 +10091,12 @@ export class Session {
    * broadcast the new state so an approval prompt shows what will ACTUALLY
    * run, not the pre-mutation input.
    */
-  #applyHookInputMutation(approvalId: string, input: Record<string, unknown>): void {
+  #applyHookInputMutation(approvalId: string, raw: Record<string, unknown>): void {
     const msgId = this.#approvalIdToMessageId.get(approvalId);
     if (!msgId) return;
+    // Recorded as any input is: a hook may add a credential (an Authorization header) the call needs.
+    const toolUseId = this.#messageIdToToolUseId.get(msgId);
+    const input = this.#secrets ? this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", raw, this.#toolCallMessages.get(msgId)?.tool?.name) : raw;
     const updateTool = (sm: SessionMessage): void => {
       if (!sm.tool) return;
       sm.tool.input = input;
@@ -10251,7 +10294,7 @@ export class Session {
       const emsg = err instanceof Error ? err.message : String(err);
       console.error(`[codeoid/session ${this.id}] provider event consumer failed:`, err);
       // Before the status change: it wakes a pipeline phase waiter that reads it.
-      this.#lastTurnError = emsg;
+      this.#lastTurnError = this.#scrubText(emsg);
       this.#recordTurnFailure([err]);
       this.#setStatus("error");
       const errorMsg = this.#makeMessage("system", `Error: ${emsg}`, SYSTEM_IDENTITY, undefined, undefined, { event: "agent_error", errorCode: "agent_error" });
@@ -10471,6 +10514,7 @@ export class Session {
       case "text_delta": {
         if (!this.#activeAssistantMsg) {
           this.#activeAssistantMsg = this.#makeMessage("assistant", "", this.#agentIdentity, []);
+          this.#textStream = this.#secrets ? new StreamScrubber(this.#secrets.scrubber, this.#scrubContext()) : null;
           // Scrollback only — no transcript row, no chunker event. The buffer
           // holds the message by reference so clients attaching mid-stream see
           // it grow; the durable row and the chunker event are emitted once,
@@ -10480,12 +10524,15 @@ export class Session {
           this.#broadcastRaw(this.#activeAssistantMsg);
           if (this.#status === "tool_running") this.#setStatus("thinking");
         }
-        this.#activeAssistantMsg.content += event.content;
+        // Scrubbed as it streams: a secret split across deltas is held until it can be scrubbed whole.
+        const piece = this.#textStream && this.#secrets?.enabled ? this.#textStream.push(event.content) : event.content;
+        if (!piece) break;
+        this.#activeAssistantMsg.content += piece;
         const delta: SessionMessageDelta = {
           type: "session.message.delta",
           sessionId: this.id,
           messageId: this.#activeAssistantMsg.messageId,
-          contentAppend: event.content,
+          contentAppend: piece,
           timestamp: new Date().toISOString(),
         };
         this.#broadcastRaw(delta);
@@ -10493,30 +10540,33 @@ export class Session {
       }
 
       case "text_done": {
-        this.#accumulator.handleEvent(event);
+        this.#textStream = null;
+        // The whole reply scrubbed again: it replaces what was streamed.
+        const done = this.#secrets ? { ...event, content: this.#scrubText(event.content) } : event;
+        this.#accumulator.handleEvent(done);
         // NOTE: do NOT call #completeActiveTools() here.
         // In the real SDK the committed assistant message (which fires text_done)
         // is emitted BEFORE the user/tool_result message (which fires tool_complete).
         // Calling completeActiveTools here cancels tools that are still executing.
         // Cleanup is handled solely by the #consumeEvents finally block.
         if (this.#activeAssistantMsg) {
-          this.#activeAssistantMsg.content = event.content;
-          this.#activeAssistantMsg.parts = [{ kind: "text", text: event.content, markdown: true }];
+          this.#activeAssistantMsg.content = done.content;
+          this.#activeAssistantMsg.parts = [{ kind: "text", text: done.content, markdown: true }];
           this.#commitStreamed(this.#activeAssistantMsg);
           this.#broadcastRaw(this.#activeAssistantMsg);
           this.#activeAssistantMsg = null;
-        } else if (event.content && this.#turnInterrupted) {
+        } else if (done.content && this.#turnInterrupted) {
           // A stopped turn's last reply, shown whole: animating it held the
           // turn's end, and so a shutdown's drain, for up to half a second.
-          const msg = this.#makeMessage("assistant", event.content, this.#agentIdentity, []);
-          msg.parts = [{ kind: "text", text: event.content, markdown: true }];
+          const msg = this.#makeMessage("assistant", done.content, this.#agentIdentity, []);
+          msg.parts = [{ kind: "text", text: done.content, markdown: true }];
           this.#commitStreamed(msg);
           this.#broadcastRaw(msg);
-        } else if (event.content) {
+        } else if (done.content) {
           // No preceding text_delta — the SDK returned the response as a batch
           // (happens for mid-turn now-priority continuations). Simulate streaming
           // so the UI shows a typing animation instead of an instant text pop-in.
-          await this.#artificiallyStreamText(event.content);
+          await this.#artificiallyStreamText(done.content);
         }
         break;
       }
@@ -10528,18 +10578,20 @@ export class Session {
           this.#finalizeActiveThinking();
           this.#activeThinkingMsg = this.#makeMessage("thinking", "", this.#agentIdentity, []);
           this.#activeThinkingIndex = event.blockIndex ?? null;
+          this.#thinkingStream = this.#secrets ? new StreamScrubber(this.#secrets.scrubber, this.#scrubContext()) : null;
           // Scrollback only — see the text_delta note; committed by
           // #finalizeActiveThinking → #commitStreamed.
           this.#scrollback.push(this.#activeThinkingMsg);
           this.#broadcastRaw(this.#activeThinkingMsg);
         }
-        if (event.content) {
-          this.#activeThinkingMsg.content += event.content;
+        const thought = event.content && this.#thinkingStream && this.#secrets?.enabled ? this.#thinkingStream.push(event.content) : event.content;
+        if (thought) {
+          this.#activeThinkingMsg.content += thought;
           const delta: SessionMessageDelta = {
             type: "session.message.delta",
             sessionId: this.id,
             messageId: this.#activeThinkingMsg.messageId,
-            contentAppend: event.content,
+            contentAppend: thought,
             timestamp: new Date().toISOString(),
           };
           this.#broadcastRaw(delta);
@@ -10553,7 +10605,21 @@ export class Session {
       }
 
       case "tool_start": {
-        this.#accumulator.handleEvent(event);
+        // The reply so far is whole: what the stream scrubber held of it goes out before the call
+        // (a stateless backend's next text may come only after a long tool loop).
+        if (this.#textStream && this.#activeAssistantMsg) {
+          const rest = this.#textStream.flush();
+          if (rest) {
+            this.#activeAssistantMsg.content += rest;
+            this.#broadcastRaw({ type: "session.message.delta", sessionId: this.id, messageId: this.#activeAssistantMsg.messageId, contentAppend: rest, timestamp: new Date().toISOString() });
+          }
+        }
+        // What of this call is stored (docs/secrets-and-memory-design.md §2.4): judged on what it really runs.
+        // The canonical history keeps what the transcript keeps.
+        const verdict = this.#secrets ? this.#secrets.verdict(event.name, event.input, event.shellCwd ?? this.workdir) : "keep";
+        if (verdict !== "keep") this.#toolVerdicts.set(event.sdkToolUseId, verdict);
+        const recordedInput = this.#secrets ? this.#recordedToolInput(verdict, event.input, event.name) : event.input;
+        this.#accumulator.handleEvent(recordedInput === event.input ? event : { ...event, input: recordedInput });
         // NOTE: do NOT call #completeActiveTools() here. It would cancel all
         // currently in-flight tools, which is correct for sequential calls but
         // silently kills parallel tool calls from concurrent subagents.
@@ -10635,16 +10701,16 @@ export class Session {
           {
             toolId: event.toolId,
             name: event.name,
-            input: event.input,
+            input: recordedInput,
             state: budgetDenied
               ? { phase: "cancelled", reason: "denied", message: "autonomous tool budget spent" }
               : refused
               ? { phase: "cancelled", reason: "denied", message: refused.reason }
               : autoApprove
-              ? ({ phase: "executing", input: event.input } as unknown as ToolState)
+              ? ({ phase: "executing", input: recordedInput } as unknown as ToolState)
               : ({
                   phase: "waiting_confirmation",
-                  input: event.input,
+                  input: recordedInput,
                   description: `${event.name}(${Object.keys(event.input).join(", ")})`,
                   approvalId: event.approvalId,
                   ...this.#collaborationCostFor(event.name),
@@ -10705,20 +10771,33 @@ export class Session {
             );
           }
         }
-        let output = event.output;
+        // Secrets out first (docs/secrets-and-memory-design.md §2): a call whose output is a credential keeps
+        // none of it; every other is scrubbed. Not a redaction of the backend's record — the backend saw the
+        // same — so it doesn't mark the backing session the way a hook's change does.
+        const verdict = this.#toolVerdicts.get(event.sdkToolUseId) ?? "keep";
+        this.#toolVerdicts.delete(event.sdkToolUseId);
+        // A withheld output's raw copy (the compressor's spill file) goes too: nothing reads it back now.
+        if ((verdict === "withhold-output" || verdict === "drop") && typeof event.output === "string") takeSpill(event.output, defaultSpillDir());
+        const stored =
+          verdict === "drop" ? NOT_STORED : verdict === "withhold-output" ? OUTPUT_WITHHELD : typeof event.output === "string" ? this.#scrubText(event.output) : event.output;
+        let output = stored;
+        let hooked = false;
         if (this.#hookBus?.hasHooks("tool_result", hookToolName)) {
           const patched = await this.#hookBus.dispatchToolResult(this.#hookContext(), {
             toolName: hookToolName ?? "",
             output,
             success: event.success,
           });
-          if (patched.updatedOutput !== undefined) output = patched.updatedOutput;
+          if (patched.updatedOutput !== undefined && patched.updatedOutput !== output) {
+            output = this.#scrubText(patched.updatedOutput);
+            hooked = true;
+          }
         }
-        if (output !== event.output) {
+        if (hooked) {
           this.#turnRedacted = true;
           this.#noteRedactedBacking(this.#provider.backingSessionId);
         }
-        this.#accumulator.handleEvent(output === event.output ? event : { ...event, output, redacted: true });
+        this.#accumulator.handleEvent(output === event.output ? event : { ...event, output, ...(hooked ? { redacted: true } : {}) });
         if (msgId) {
           const toolMsg = this.#toolCallMessages.get(msgId);
           if (toolMsg?.tool) {
@@ -10933,7 +11012,7 @@ export class Session {
             this.#seedOverflowRetry = true;
             break;
           }
-          this.#lastTurnError = errText;
+          this.#lastTurnError = this.#scrubText(errText);
           // Before the status change below, like lastTurnError: an error
           // waiter reads it. The CLI puts a limit notice in the result text
           // or the turn's own assistant text (only if THIS turn committed it,
@@ -10990,7 +11069,7 @@ export class Session {
 
       case "error": {
         console.error(`[codeoid/session ${this.id}] provider error:`, event.message);
-        this.#lastTurnError = event.message; // before the status change (see above)
+        this.#lastTurnError = this.#scrubText(event.message); // before the status change (see above)
         // The structured detail (codex's error info + reset) rides with the text.
         this.#recordTurnFailure([event.detail ? { message: event.message, error: event.detail } : event.message]);
         this.#setStatus("error");
@@ -11019,6 +11098,11 @@ export class Session {
     if (!this.#activeAssistantMsg) return;
     const m = this.#activeAssistantMsg;
     this.#activeAssistantMsg = null;
+    // What the stream scrubber still held of a cut-off reply.
+    if (this.#textStream) {
+      m.content += this.#textStream.flush();
+      this.#textStream = null;
+    }
     // Rebroadcast ALWAYS — even with empty content. The TUI's store
     // looks for "same messageId with content" to move a live-region
     // entry to committed; an empty rebroadcast wouldn't trigger that,
@@ -11045,7 +11129,8 @@ export class Session {
    * (#flushActiveAssistant nulled it), we return early — the partial content was
    * already committed by the flush.
    */
-  async #artificiallyStreamText(content: string): Promise<void> {
+  async #artificiallyStreamText(raw: string): Promise<void> {
+    const content = this.#scrubText(raw);
     const FRAME_MS = 16;
     const steps = Math.min(30, content.length);
     const charsPerStep = Math.ceil(content.length / steps);
@@ -11091,6 +11176,10 @@ export class Session {
     const m = this.#activeThinkingMsg;
     this.#activeThinkingMsg = null;
     this.#activeThinkingIndex = null;
+    if (this.#thinkingStream) {
+      m.content += this.#thinkingStream.flush();
+      this.#thinkingStream = null;
+    }
     if (!m.content || m.content.length === 0) {
       // Not an elision by codeoid — the backend returned no readable reasoning.
       // Claude does this whenever `thinking.display` is `"omitted"`; backends
@@ -11300,7 +11389,8 @@ export class Session {
    * context rotation (which resets that history) doesn't erase the list.
    */
   #indexTurn(turnId: string, kind: TurnIndexEntry["kind"], text: string, at: string): void {
-    const firstLine = text.trim().split("\n", 1)[0] ?? "";
+    // Scrubbed before it is cut: a cut could split a secret into two halves no rule knows.
+    const firstLine = this.#scrubText(text.trim().split("\n", 1)[0] ?? "");
     const entry: TurnIndexEntry = {
       turnId,
       kind,
@@ -12220,6 +12310,7 @@ export class Session {
    * of two half-episodes.
    */
   #commitStreamed(msg: SessionMessage): void {
+    this.#scrubMessage(msg);
     this.#scrollback.push(msg);
     this.#transcriptStore.append(this.id, msg, this.#seq++).catch((e) => {
       console.error(
@@ -12229,8 +12320,84 @@ export class Session {
     this.#chunker?.onMessage(msg);
   }
 
+  /**
+   * The history a turn runs with: the canonical history (scrubbed, as stored), its last user turn
+   * — this turn's prompt — as the user wrote it. A stateless backend sends that turn to the model,
+   * and the prompt is what the user asked: a value in it is meant for the model (§2.7 of
+   * secrets-and-memory-design.md). Earlier turns stay scrubbed.
+   */
+  #historyForTurn(prompt: string): readonly CanonicalTurn[] {
+    const history = this.#accumulator.history;
+    const last = history.at(-1);
+    if (!this.#secrets || last?.role !== "user" || last.content === prompt) return history;
+    return [...history.slice(0, -1), { ...last, content: prompt }];
+  }
+
+  /** A pending approval's input as its card records it (secrets/verdict.ts): scrubbed, a credential file's content withheld. */
+  #approvalShown(approvalId: string, input: unknown): unknown {
+    if (!this.#secrets || !input || typeof input !== "object") return this.#scrubValue(input);
+    const msgId = this.#approvalIdToMessageId.get(approvalId);
+    const toolUseId = msgId ? this.#messageIdToToolUseId.get(msgId) : undefined;
+    return this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", input as Record<string, unknown>, msgId ? this.#toolCallMessages.get(msgId)?.tool?.name : undefined);
+  }
+
+  /** Who and where a scrub is for: a kept secret lands in this tenant and home workstream. */
+  #scrubContext() {
+    return { accountId: this.accountId, projectId: this.projectId, workstream: this.#workstream?.id, sessionId: this.id };
+  }
+
+  /** `text` with no secret's value in it (docs/secrets-and-memory-design.md §2). */
+  #scrubText(text: string): string {
+    return this.#secrets ? this.#secrets.scrub(text, this.#scrubContext()).text : text;
+  }
+
+  #scrubValue<T>(value: T): T {
+    return this.#secrets ? this.#secrets.scrubValue(value, this.#scrubContext()).value : value;
+  }
+
+  /**
+   * Scrub a message in place before it is buffered, written or sent: its
+   * text, parts, tool input and state, and meta. Scrubbing is idempotent (a
+   * reference is never taken for a secret), so a message scrubbed twice is
+   * unchanged.
+   */
+  #scrubMessage(msg: SessionMessage): void {
+    if (!this.#secrets) return;
+    if (typeof msg.content === "string" && msg.content) msg.content = this.#scrubText(msg.content);
+    if (msg.parts) msg.parts = this.#scrubValue(msg.parts);
+    if (msg.tool) {
+      msg.tool.input = this.#scrubValue(msg.tool.input);
+      msg.tool.state = this.#scrubValue(msg.tool.state);
+    }
+    if (msg.metadata) msg.metadata = this.#scrubValue(msg.metadata);
+  }
+
+  /**
+   * What is recorded of a tool call's input: scrubbed, or, for a write of a
+   * credential file, without what was written (secrets/verdict.ts).
+   */
+  #recordedToolInput(verdict: ToolVerdict, input: Record<string, unknown>, toolName = ""): Record<string, unknown> {
+    const isShell = shellCallOf(toolName, input) !== null || typeof input.command === "string" || Array.isArray(input.command);
+    if (verdict === "drop") {
+      // A call the user listed as never stored: nothing of what it was given is kept (an argv too).
+      return Object.fromEntries(Object.entries(input).map(([k, v]) => [k, typeof v === "string" || Array.isArray(v) ? NOT_STORED : this.#scrubValue(v)]));
+    }
+    if (verdict === "withhold-written") {
+      // A file tool writing a credential file: the path stays, what it writes doesn't — every
+      // backend's content keys (Codex's `changes`, pi's `newText`, a patch tool's `input`). A shell
+      // line writing one stays readable (it is on the approval card), scrubbed.
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(input)) {
+        out[k] = /^(?:content|new_string|old_string|edits|new_source|patch|newText|oldText|changes|files|text|diff|input)$/.test(k) && !isShell ? WRITTEN_WITHHELD : v;
+      }
+      return this.#scrubValue(out);
+    }
+    return this.#scrubValue(input);
+  }
+
   /** Persist to transcript + scrollback buffer + memory chunker */
   #persistAndBuffer(msg: SessionMessage): void {
+    this.#scrubMessage(msg);
     // A notice for a session whose history isn't loaded (a mode change, a
     // rename) doesn't load it: it is kept for the load.
     this.#buffer(msg);
diff --git a/src/daemon/share/pack.ts b/src/daemon/share/pack.ts
index b39b490f..2c1bcf28 100644
--- a/src/daemon/share/pack.ts
+++ b/src/daemon/share/pack.ts
@@ -21,6 +21,7 @@ import type {
 } from "../../protocol/types.js";
 
 import { resolveSafe } from "../fs.js";
+import { isCredentialFile } from "../secrets/files.js";
 import { resolveWorkdirAlias } from "./git-alias.js";
 import {
   SHARE_FORMAT_VERSION,
@@ -66,6 +67,12 @@ export interface PackDependencies {
   memory: MemoryEngine | null;
   /** Workspace id resolver (for memory episode lookups). */
   workspaceIdFor: (workdir: string) => string;
+  /**
+   * The daemon's secret scrubbing (docs/secrets-and-memory-design.md §2.6):
+   * a transcript or episode written before it, and a pinned file, go into a
+   * bundle scrubbed. Absent: packed as stored.
+   */
+  scrub?: <T>(value: T) => T;
 }
 
 export async function packSession(
@@ -83,7 +90,7 @@ export async function packSession(
     const msg = entry.message as unknown as SessionMessage;
     if (!msg || typeof msg !== "object") continue;
     if (!("messageId" in msg) || !msg.messageId) continue;
-    transcript.push(rewriteMessage(msg, workdir, alias));
+    transcript.push(rewriteMessage(deps.scrub ? deps.scrub(msg) : msg, workdir, alias));
   }
 
   // ---------- Memory episodes (per-session slice) ----------
@@ -95,8 +102,8 @@ export async function packSession(
         id: ep.id,
         kind: ep.kind,
         ...(ep.toolName ? { toolName: ep.toolName } : {}),
-        summary: rewriteTextPaths(ep.summary, workdir, alias),
-        content: rewriteTextPaths(ep.content, workdir, alias),
+        summary: rewriteTextPaths(deps.scrub ? deps.scrub(ep.summary) : ep.summary, workdir, alias),
+        content: rewriteTextPaths(deps.scrub ? deps.scrub(ep.content) : ep.content, workdir, alias),
         filePaths: encodePathArray(ep.filePaths, workdir, alias),
         tokenEstimate: ep.tokenEstimate,
         createdAt: ep.createdAt,
@@ -130,7 +137,16 @@ export async function packSession(
       } catch {
         continue;
       }
-      const snap = await capturePinnedFile(abs, cap);
+      const captured = await capturePinnedFile(abs, cap);
+      // A credential file (`.env`, a key) isn't packed at all: it holds nothing else (secrets/files.ts).
+      // Text otherwise scrubbed; a binary file's base64 isn't text a secret could be found in.
+      const snap = !captured || !deps.scrub
+        ? captured
+        : isCredentialFile(abs, workdir)
+          ? { ...captured, content: "‹content withheld: a credential file›", encoding: "utf-8" as const }
+          : captured.encoding === "utf-8"
+            ? { ...captured, content: deps.scrub(captured.content) }
+            : captured;
       if (snap) {
         const key = encodePath(abs, workdir, alias);
         pinnedFiles[key] = snap;
diff --git a/src/daemon/store.ts b/src/daemon/store.ts
index ad90d51a..a93690c2 100644
--- a/src/daemon/store.ts
+++ b/src/daemon/store.ts
@@ -440,6 +440,23 @@ export class Store {
       -- How each folder last resolved to a workstream, per tenant
       -- (docs/workstreams-design.md §5.1): a repository rule that matches
       -- differently later (an edited origin) is refused, not a silent re-home.
+      -- Detected secrets a workstream keeps (captureSecrets: "vault";
+      -- docs/secrets-and-memory-design.md §2.5): the value encrypted under a
+      -- key outside the database (secrets/vault.ts), so a copy of this file
+      -- alone holds none. Per tenant and workstream ('' = no workstream).
+      CREATE TABLE IF NOT EXISTS captured_secrets (
+        account_id   TEXT NOT NULL,
+        project_id   TEXT NOT NULL,
+        workstream   TEXT NOT NULL,
+        fingerprint  TEXT NOT NULL,
+        kind         TEXT NOT NULL,
+        sealed       BLOB NOT NULL,
+        session_id   TEXT,
+        first_seen   INTEGER NOT NULL,
+        last_seen    INTEGER NOT NULL,
+        PRIMARY KEY (account_id, project_id, workstream, fingerprint)
+      );
+
       CREATE TABLE IF NOT EXISTS workstream_folders (
         account_id  TEXT NOT NULL,
         project_id  TEXT NOT NULL,
@@ -1312,6 +1329,29 @@ export class Store {
    * running, finishing late — overwrote whatever its successor had recorded,
    * or resurrected a task that had already gone terminal.
    */
+  /**
+   * Applied to a dispatch task's prompt, result digest and error once it is
+   * settled (docs/secrets-and-memory-design.md §2.6): until then the prompt is
+   * what its worker is sent, as the conductor wrote it.
+   */
+  scrubText: ((text: string) => string) | undefined;
+
+  /** A settled task's texts, scrubbed in place. */
+  #scrubSettledTask(id: string): void {
+    const scrub = this.scrubText;
+    if (!scrub) return;
+    const row = this.#db.prepare("SELECT prompt, result_digest, error, status FROM dispatch_tasks WHERE id = ?").get(id) as
+      | { prompt: string; result_digest: string | null; error: string | null; status: string }
+      | null;
+    if (!row || !["done", "failed", "cancelled", "blocked"].includes(row.status)) return;
+    const prompt = scrub(row.prompt);
+    const digest = row.result_digest ? scrub(row.result_digest) : row.result_digest;
+    const error = row.error ? scrub(row.error) : row.error;
+    if (prompt !== row.prompt || digest !== row.result_digest || error !== row.error) {
+      this.#db.prepare("UPDATE dispatch_tasks SET prompt = ?, result_digest = ?, error = ? WHERE id = ?").run(prompt, digest, error, id);
+    }
+  }
+
   dispatchComplete(id: string, generation: number, digest: string, now: number): boolean {
     const res = this.#db
       .prepare(
@@ -1320,6 +1360,7 @@ export class Store {
          WHERE id = ? AND generation = ? AND status IN ('claimed', 'running')`,
       )
       .run(digest, now, id, generation);
+    if (res.changes > 0) this.#scrubSettledTask(id);
     return res.changes > 0;
   }
 
@@ -1363,6 +1404,7 @@ export class Store {
           ? [opts.notBefore ?? null, error, now, id, generation]
           : [error, now, id, generation]),
       ) as { status: "queued" | "blocked" | "failed" } | null;
+    if (row && row.status !== "queued") this.#scrubSettledTask(id);
     return row?.status ?? null;
   }
 
@@ -1449,6 +1491,7 @@ export class Store {
          RETURNING *`,
       )
       .get(error, now, id, generation, ownerDaemon ?? null) as RawDispatchRow | null;
+    if (row) this.#scrubSettledTask(id);
     return row ? rowToDispatchTask(row) : null;
   }
 
@@ -1477,6 +1520,7 @@ export class Store {
          RETURNING *`,
       )
       .get(reason, now, id, ownerDaemon ?? null) as RawDispatchRow | null;
+    if (row) this.#scrubSettledTask(id);
     return row ? rowToDispatchTask(row) : null;
   }
 
@@ -1558,6 +1602,7 @@ export class Store {
         ownerDaemon ?? null,
         now,
       ) as RawDispatchRow[];
+    for (const r of rows) if (r.status !== "queued") this.#scrubSettledTask(r.id);
     return rows.map(rowToDispatchTask);
   }
 
@@ -1837,7 +1882,7 @@ export class Store {
         `INSERT INTO dispatch_events (account_id, project_id, task_id, type, digest, created_at)
          VALUES (?, ?, ?, ?, ?, ?)`,
       )
-      .run(event.accountId, event.projectId, event.taskId, event.type, event.digest, event.now);
+      .run(event.accountId, event.projectId, event.taskId, event.type, this.scrubText ? this.scrubText(event.digest) : event.digest, event.now);
   }
 
   dispatchEventsPending(accountId: string, projectId: string): DispatchEventRow[] {
@@ -2003,6 +2048,84 @@ export class Store {
       .run(scope.accountId, scope.projectId, scope.workdir, server, fingerprint, approvedBy);
   }
 
+  /**
+   * Every credential value the database holds (docs/secrets-and-memory-design.md
+   * §2.2): MCP OAuth tokens and client secrets, and the conductor's API key —
+   * matched exactly wherever they show up, never stored again.
+   */
+  knownSecretValues(): Array<{ label: string; value: string }> {
+    const out: Array<{ label: string; value: string }> = [];
+    const oauth = this.#db.prepare("SELECT server, credential, client_json, tokens_json FROM mcp_oauth_credentials").all() as Array<{
+      server: string;
+      credential: string;
+      client_json: string | null;
+      tokens_json: string | null;
+    }>;
+    for (const r of oauth) {
+      const label = `oauth:${r.credential || r.server}`;
+      for (const json of [r.tokens_json, r.client_json]) {
+        if (!json) continue;
+        try {
+          const obj = JSON.parse(json) as Record<string, unknown>;
+          for (const k of ["access_token", "refresh_token", "id_token", "client_secret"]) {
+            const v = obj[k];
+            if (typeof v === "string") out.push({ label, value: v });
+          }
+        } catch {
+          // Unreadable: nothing to match.
+        }
+      }
+    }
+    const conductor = this.#db.prepare("SELECT api_key FROM conductor_identity").all() as Array<{ api_key: string }>;
+    for (const r of conductor) out.push({ label: "daemon:conductor-key", value: r.api_key });
+    return out;
+  }
+
+  /** Keep a detected secret (sealed by the caller), or note it was seen again. */
+  putCapturedSecret(row: { accountId: string; projectId: string; workstream: string; fingerprint: string; kind: string; sealed: Uint8Array; sessionId?: string; at: number }): void {
+    this.#db
+      .prepare(
+        `INSERT INTO captured_secrets (account_id, project_id, workstream, fingerprint, kind, sealed, session_id, first_seen, last_seen)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (account_id, project_id, workstream, fingerprint) DO UPDATE SET last_seen = excluded.last_seen, session_id = excluded.session_id`,
+      )
+      .run(row.accountId, row.projectId, row.workstream, row.fingerprint, row.kind, row.sealed, row.sessionId ?? null, row.at, row.at);
+  }
+
+  /** A tenant's kept secrets, newest first, without their values; one workstream's when given. */
+  listCapturedSecrets(scope: { accountId: string; projectId: string; workstream?: string }): Array<{ workstream: string; fingerprint: string; kind: string; sessionId: string | null; firstSeen: number; lastSeen: number }> {
+    const rows = (
+      scope.workstream === undefined
+        ? this.#db.prepare("SELECT workstream, fingerprint, kind, session_id, first_seen, last_seen FROM captured_secrets WHERE account_id = ? AND project_id = ? ORDER BY last_seen DESC").all(scope.accountId, scope.projectId)
+        : this.#db
+            .prepare("SELECT workstream, fingerprint, kind, session_id, first_seen, last_seen FROM captured_secrets WHERE account_id = ? AND project_id = ? AND workstream = ? ORDER BY last_seen DESC")
+            .all(scope.accountId, scope.projectId, scope.workstream)
+    ) as Array<{ workstream: string; fingerprint: string; kind: string; session_id: string | null; first_seen: number; last_seen: number }>;
+    return rows.map((r) => ({ workstream: r.workstream, fingerprint: r.fingerprint, kind: r.kind, sessionId: r.session_id, firstSeen: r.first_seen, lastSeen: r.last_seen }));
+  }
+
+  /** A kept secret's sealed value, in one workstream. */
+  capturedSecret(scope: { accountId: string; projectId: string; workstream: string; fingerprint: string }): { kind: string; sealed: Uint8Array } | undefined {
+    const row = this.#db
+      .prepare("SELECT kind, sealed FROM captured_secrets WHERE account_id = ? AND project_id = ? AND workstream = ? AND fingerprint = ?")
+      .get(scope.accountId, scope.projectId, scope.workstream, scope.fingerprint) as { kind: string; sealed: Uint8Array } | null;
+    return row ?? undefined;
+  }
+
+  /** Forget a kept secret; true when there was one. */
+  deleteCapturedSecret(scope: { accountId: string; projectId: string; workstream: string; fingerprint: string }): boolean {
+    return (
+      this.#db
+        .prepare("DELETE FROM captured_secrets WHERE account_id = ? AND project_id = ? AND workstream = ? AND fingerprint = ?")
+        .run(scope.accountId, scope.projectId, scope.workstream, scope.fingerprint).changes > 0
+    );
+  }
+
+  /** Forget kept secrets not seen since `before` (ms); returns how many. */
+  expireCapturedSecrets(before: number): number {
+    return this.#db.prepare("DELETE FROM captured_secrets WHERE last_seen < ?").run(before).changes;
+  }
+
   /** The workstream a folder last resolved to, for this tenant (workstreams §5.1). */
   workstreamFolder(scope: { accountId: string; projectId: string; workdir: string }): string | undefined {
     const row = this.#db
@@ -2190,7 +2313,7 @@ export class Store {
         .prepare(
           "INSERT INTO audit_log (subject, session_id, action, detail) VALUES (?, ?, ?, ?)",
         )
-        .run(subject, sessionId ?? null, action, detail ?? null);
+        .run(subject, sessionId ?? null, action, detail && this.scrubText ? this.scrubText(detail) : (detail ?? null));
     } catch {
       // Retry unlinked (FK can't fail) so the entry is still recorded; fold
       // the orphaned session id into the detail. Swallow anything further.
diff --git a/src/daemon/workstreams/effective.ts b/src/daemon/workstreams/effective.ts
index 8331192e..21175d4d 100644
--- a/src/daemon/workstreams/effective.ts
+++ b/src/daemon/workstreams/effective.ts
@@ -10,7 +10,7 @@
  *  - maps (env, accounts) and scalars (defaults, git fields) are overridden by
  *    the most specific setting;
  *  - `exclude` is applied after the merge;
- *  - `match`, `claim`, `share` and `allowOverride` are never inherited: they
+ *  - `match`, `claim`, `share`, `captureSecrets` and `allowOverride` are never inherited: they
  *    describe this workstream's own folders.
  *
  * The config was validated (no cycles, every base exists) before this runs;
@@ -36,6 +36,8 @@ export interface EffectiveWorkstream {
   claim: "exclusive" | "suggest";
   allowOverride: boolean;
   share: "open" | "ask" | "closed";
+  /** Not inherited either: whether this workstream keeps detected secrets (§2.5 of secrets-and-memory-design.md). */
+  captureSecrets: "drop" | "vault";
   match: { paths: string[]; remotes: string[] };
   servers: EffectiveServer[];
   accounts: Record<string, string>;
@@ -104,6 +106,7 @@ export function effectiveWorkstreams(items: readonly WorkstreamItemConfig[]): Ma
       claim: item.claim,
       allowOverride: item.allowOverride,
       share: item.share,
+      captureSecrets: item.captureSecrets,
       match: { paths: [...item.match.paths], remotes: [...item.match.remotes] },
       servers: [...servers.values()].filter((s) => !excluded.has(s.server)),
       accounts,
diff --git a/src/daemon/workstreams/schema.ts b/src/daemon/workstreams/schema.ts
index bbc54b11..e376d6af 100644
--- a/src/daemon/workstreams/schema.ts
+++ b/src/daemon/workstreams/schema.ts
@@ -101,6 +101,8 @@ export const workstreamItemSchema = z
     allowOverride: z.boolean().default(true),
     /** Whether other workstreams may reference this one (§7.1). */
     share: z.enum(["open", "ask", "closed"]).default("ask"),
+    /** A detected secret's value: dropped, or kept in the vault for the owner (docs/secrets-and-memory-design.md §2.5). */
+    captureSecrets: z.enum(["drop", "vault"]).default("drop"),
     mcpServers: z.array(serverRefSchema).max(256).default([]),
     /** Names (from the lists above, after `extends`) taken away again. */
     exclude: z.array(z.string().min(1).max(128)).max(256).default([]),
diff --git a/src/tests/protocol.test.ts b/src/tests/protocol.test.ts
index 6acc4e37..5335e5c5 100644
--- a/src/tests/protocol.test.ts
+++ b/src/tests/protocol.test.ts
@@ -470,6 +470,10 @@ describe("DaemonMessage routing", () => {
           return `workstreams.changed:${msg.revision}`;
         case "credential.list.result":
           return `credential.list:${msg.credentials.length}`;
+        case "secret.list.result":
+          return `secrets:${msg.secrets.length}`;
+        case "secret.reveal.result":
+          return `secret:${msg.kind}`;
         case "session.turns.result":
           return `turns:${msg.turns.length}`;
         case "session.approvals.result":
diff --git a/src/tests/secrets-session.test.ts b/src/tests/secrets-session.test.ts
new file mode 100644
index 00000000..fb660fe0
--- /dev/null
+++ b/src/tests/secrets-session.test.ts
@@ -0,0 +1,237 @@
+/**
+ * Secrets in what sessions store (docs/secrets-and-memory-design.md §2): a
+ * secret a tool prints, a reply streams or a prompt carries never reaches the
+ * transcript, the canonical history, the scrollback, memory or a share
+ * bundle; a value codeoid knows is named, a detected one fingerprinted, kept
+ * only where a workstream says so, and revealed only to its owner.
+ */
+import { afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { CodeoidConfig } from "../config.js";
+import type { Embedder } from "../daemon/memory/embedder.js";
+import { MemoryEngine, SqliteEpisodeStore } from "../daemon/memory/index.js";
+import type { ProviderEvent } from "../daemon/providers/interface.js";
+import { MockSessionProvider } from "../daemon/providers/mock/session-provider.js";
+import { SecretService } from "../daemon/secrets/service.js";
+import { SessionManager } from "../daemon/session-manager.js";
+import { loadShellParser } from "../daemon/shell/parse.js";
+import { Store } from "../daemon/store.js";
+import { TranscriptStore } from "../daemon/transcript.js";
+import { FolderReader } from "../daemon/workstreams/folder.js";
+import { workstreamsSchema } from "../daemon/workstreams/schema.js";
+import { ALL_SCOPES } from "../protocol/scopes.js";
+import type { AuthContext, SessionInfo } from "../protocol/types.js";
+
+class StubEmbedder implements Embedder {
+  readonly modelName = "stub";
+  readonly dimensions = 8;
+  async init(): Promise<void> {}
+  async embed(texts: string[]): Promise<Float32Array[]> {
+    return texts.map(() => new Float32Array(8).fill(0.35));
+  }
+  async close(): Promise<void> {}
+}
+
+const AUTH: AuthContext = { sub: "user:owner", scopes: [...ALL_SCOPES] as AuthContext["scopes"], delegationDepth: 0, accountId: "acc-s", projectId: "proj-s" };
+const CLIENT = { id: "client-s", auth: AUTH, send: () => {} };
+const done: ProviderEvent = { type: "turn_done", result: { providerId: "mock", model: "m", inputTokens: 1, outputTokens: 1, cacheReadTokens: 0, cacheCreationTokens: 0, totalCostUsd: 0, durationMs: 1 } } as ProviderEvent;
+
+// Made-up credentials of the right shape, split so no contiguous token sits in this file.
+const GHP = "ghp_" + "Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V";
+const KNOWN = "known-cred-" + "9f8e7d6c5b4a";
+
+let tmp: string;
+let home: string;
+let store: Store;
+let transcript: TranscriptStore;
+let memory: MemoryEngine;
+let manager: SessionManager;
+let secrets: SecretService;
+let script: ProviderEvent[][];
+let providers: MockSessionProvider[] = [];
+
+beforeAll(async () => {
+  await loadShellParser();
+});
+
+beforeEach(() => {
+  providers = [];
+  tmp = realpathSync(mkdtempSync(join(tmpdir(), "codeoid-secrets-")));
+  home = join(tmp, "home");
+  for (const d of ["mine", "vaulted"]) mkdirSync(join(home, d), { recursive: true });
+  store = new Store(join(tmp, "codeoid.db"));
+  transcript = new TranscriptStore(join(tmp, "transcripts"));
+  memory = new MemoryEngine({ store: new SqliteEpisodeStore(join(tmp, "mem.db")), embedder: new StubEmbedder() });
+  const config = {
+    daemonUrl: "ws://127.0.0.1:7400",
+    dbPath: join(tmp, "codeoid.db"),
+    transcriptDir: join(tmp, "transcripts"),
+    auth: { baseUrl: "http://localhost:8899" },
+    zeroidUrl: "http://localhost:8899",
+    workspaceIndex: { enabled: false, episodeThreshold: 5, timeThresholdMs: 60_000, debounceMs: 15_000 },
+    compress: { enabled: false, excludeCommands: [], excludePatterns: [], compressPipes: false, minBytes: 1024 },
+    labeling: {},
+    telemetry: { osc8: "auto" },
+    autoRotate: { enabled: false, warnPct: 0.6, rotatePct: 0.8, hardRotatePct: 0.9, minTurnsBeforeRotate: 3, strategy: "task-anchor" },
+    session: {},
+    workstreams: workstreamsSchema.parse({
+      items: [
+        { id: "mine", match: { paths: ["~/mine"] } },
+        { id: "vaulted", captureSecrets: "vault", match: { paths: ["~/vaulted"] } },
+      ],
+    }),
+  } as unknown as CodeoidConfig;
+  secrets = new SecretService({ configDir: join(tmp, "config"), store });
+  secrets.addKnown("test", () => [{ label: "gh-test", value: KNOWN }]);
+  manager = new SessionManager(store, transcript, undefined, undefined, memory, {
+    config,
+    _testProviderFactory: () => {
+      const p = new MockSessionProvider("mock", script);
+      providers.push(p);
+      return p;
+    },
+    _testFolderReader: new FolderReader({ home, sshConfig: "" }),
+    secretService: secrets,
+  });
+  manager.setMemory(memory);
+});
+
+afterEach(async () => {
+  try {
+    await manager.drain(3000);
+  } catch {}
+  await transcript.flush();
+  store.close();
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+async function runIn(dir: string): Promise<{ id: string }> {
+  const made = (await manager.handle({ type: "session.create", id: "c", name: "s", workdir: join(home, dir) } as never, AUTH, CLIENT)) as { data: SessionInfo };
+  const session = manager._sessionForTest(made.data.id)!;
+  let sent = false;
+  const sending = session.send(`please use ${KNOWN} for this`, AUTH).finally(() => {
+    sent = true;
+  });
+  // Approve whatever the guarded session asks (a shell command, a write) until the turn is over.
+  const end = Date.now() + 3000;
+  while (!sent || session.status !== "idle" || session.pendingToolApprovals().length > 0) {
+    for (const p of session.pendingToolApprovals()) session.approve(p.approvalId, true, AUTH);
+    if (Date.now() > end) throw new Error(`timed out (${session.status})`);
+    await Bun.sleep(5);
+  }
+  await sending;
+  await transcript.flush();
+  await memory.drain();
+  return { id: made.data.id };
+}
+
+/** Everything the session stored, as text. */
+function storedText(id: string): string {
+  const parts = [readFileSync(transcript.transcriptPath(id), "utf8"), readFileSync(transcript.canonicalPath(id), "utf8")];
+  for (const ep of memory.store.listEpisodesForSession(id)) parts.push(ep.summary, ep.content, memory.store.getFullContent(ep.id) ?? "");
+  return parts.join("\n");
+}
+
+describe("what a session stores holds no secret's value", () => {
+  test("a tool's output, a streamed reply, thinking and the prompt", async () => {
+    script = [
+      [
+        { type: "thinking_delta", content: `the token is ${GHP.slice(0, 10)}` } as ProviderEvent,
+        { type: "thinking_delta", content: `${GHP.slice(10)} hmm` } as ProviderEvent,
+        { type: "thinking_done" } as ProviderEvent,
+        { type: "tool_start", toolId: "t1", sdkToolUseId: "sdk-t1", name: "Read", input: { file_path: join(home, "mine", "notes.md") }, approvalId: "ap-1" } as ProviderEvent,
+        { type: "tool_complete", sdkToolUseId: "sdk-t1", success: true, output: `token=${GHP}\nknown ${KNOWN}\nDB_PASSWORD=hunter2xyz` } as ProviderEvent,
+        { type: "text_delta", content: `Found ${GHP.slice(0, 7)}` } as ProviderEvent,
+        { type: "text_delta", content: `${GHP.slice(7)} and ${KNOWN.slice(0, 5)}` } as ProviderEvent,
+        { type: "text_delta", content: `${KNOWN.slice(5)} done.` } as ProviderEvent,
+        { type: "text_done", content: `Found ${GHP} and ${KNOWN} done.` } as ProviderEvent,
+        done,
+      ],
+    ];
+    const sent: string[] = [];
+    const { id } = await runIn("mine");
+    const text = storedText(id);
+    for (const secret of [GHP, KNOWN, "hunter2xyz"]) expect(text).not.toContain(secret);
+    expect(text).toContain("‹credential:gh-test›");
+    expect(text).toMatch(/‹secret:github-token:[0-9a-f]{8}›/);
+    // The scrollback a client replays on attach.
+    const attached = (await manager.handle({ type: "session.attach", id: "a", sessionId: id } as never, AUTH, { ...CLIENT, send: (m: unknown) => sent.push(JSON.stringify(m)) })) as unknown;
+    const replay = JSON.stringify(attached) + sent.join("\n");
+    for (const secret of [GHP, KNOWN, "hunter2xyz"]) expect(replay).not.toContain(secret);
+  });
+
+  test("a command that prints credentials keeps no output; a credential file's write keeps no content", async () => {
+    script = [
+      [
+        { type: "tool_start", toolId: "t1", sdkToolUseId: "sdk-t1", name: "Bash", input: { command: "gh auth token" }, approvalId: "ap-1" } as ProviderEvent,
+        { type: "tool_complete", sdkToolUseId: "sdk-t1", success: true, output: "unshaped-but-secret-1234567" } as ProviderEvent,
+        { type: "tool_start", toolId: "t2", sdkToolUseId: "sdk-t2", name: "Write", input: { file_path: join(home, "mine", ".env"), content: "PLAIN=unshaped-value-987654" }, approvalId: "ap-2" } as ProviderEvent,
+        { type: "tool_complete", sdkToolUseId: "sdk-t2", success: true, output: "ok" } as ProviderEvent,
+        done,
+      ],
+    ];
+    const { id } = await runIn("mine");
+    const text = storedText(id);
+    expect(text).not.toContain("unshaped-but-secret-1234567");
+    expect(text).not.toContain("unshaped-value-987654");
+    expect(text).toContain("‹output withheld: it prints credentials›");
+    expect(text).toContain("‹content withheld: a credential file›");
+  });
+});
+
+describe("kept secrets", () => {
+  const leak = (): ProviderEvent[][] => [
+    [
+      { type: "tool_start", toolId: "t1", sdkToolUseId: "sdk-t1", name: "Read", input: { file_path: "x.md" }, approvalId: "ap-1" } as ProviderEvent,
+      { type: "tool_complete", sdkToolUseId: "sdk-t1", success: true, output: `token=${GHP}` } as ProviderEvent,
+      done,
+    ],
+  ];
+
+  test("dropped by default; kept where the workstream says vault, and revealed only to its owner's own token", async () => {
+    script = leak();
+    await runIn("mine");
+    const none = (await manager.handle({ type: "secret.list", id: "l1" } as never, AUTH, CLIENT)) as { secrets: unknown[] };
+    expect(none.secrets).toEqual([]);
+
+    script = leak();
+    await runIn("vaulted");
+    const listed = (await manager.handle({ type: "secret.list", id: "l2" } as never, AUTH, CLIENT)) as { secrets: Array<{ workstream: string; fingerprint: string; kind: string }> };
+    expect(listed.secrets).toHaveLength(1);
+    const kept = listed.secrets[0]!;
+    expect(kept).toMatchObject({ workstream: "vaulted", kind: "github-token" });
+
+    const delegated = { ...AUTH, delegationDepth: 1 };
+    expect(await manager.handle({ type: "secret.reveal", id: "r1", workstream: "vaulted", fingerprint: kept.fingerprint } as never, delegated, CLIENT)).toMatchObject({ code: "forbidden" });
+    // Another workstream doesn't have it.
+    expect(await manager.handle({ type: "secret.reveal", id: "r2", workstream: "mine", fingerprint: kept.fingerprint } as never, AUTH, CLIENT)).toMatchObject({ code: "not_found" });
+    expect(await manager.handle({ type: "secret.reveal", id: "r3", workstream: "vaulted", fingerprint: kept.fingerprint } as never, AUTH, CLIENT)).toMatchObject({ type: "secret.reveal.result", value: GHP });
+    // Another tenant doesn't either.
+    const other = { ...AUTH, accountId: "acc-other" };
+    expect(await manager.handle({ type: "secret.reveal", id: "r4", workstream: "vaulted", fingerprint: kept.fingerprint } as never, other, CLIENT)).toMatchObject({ code: "not_found" });
+    expect(await manager.handle({ type: "secret.forget", id: "f1", workstream: "vaulted", fingerprint: kept.fingerprint } as never, AUTH, CLIENT)).toMatchObject({ type: "response.ok" });
+    expect(((await manager.handle({ type: "secret.list", id: "l3" } as never, AUTH, CLIENT)) as { secrets: unknown[] }).secrets).toEqual([]);
+  });
+});
+
+describe("what the backend is given", () => {
+  test("the prompt of the turn goes as written (a stateless backend sends it); earlier turns as stored", async () => {
+    script = [[{ type: "text_done", content: "ok" } as ProviderEvent, done], [{ type: "text_done", content: "ok" } as ProviderEvent, done]];
+    const { id } = await runIn("mine");
+    const session = manager._sessionForTest(id)!;
+    await session.send("now add DB_PASSWORD=hunter2xyz to compose", AUTH);
+    const end = Date.now() + 3000;
+    while (session.status !== "idle") {
+      if (Date.now() > end) throw new Error("timed out");
+      await Bun.sleep(5);
+    }
+    const opts = providers.at(-1)!.capturedOpts.at(-1)!;
+    expect(opts.history.at(-1)?.content).toBe("now add DB_PASSWORD=hunter2xyz to compose");
+    // The first prompt, as stored: its known value a reference.
+    expect(opts.history[0]?.content).toContain("‹credential:gh-test›");
+    // And stored scrubbed.
+    expect(readFileSync(transcript.canonicalPath(id), "utf8")).not.toContain("hunter2xyz");
+  });
+});