From 4ece55077450ed2a4beff4af5f2d17d6c04362dc Mon Sep 17 00:00:00 2001
From: Yash Datta <yd2590@columbia.edu>
Date: Fri, 13 Nov 2026 08:31:51 +0800
Subject: [PATCH 1/4] =?UTF-8?q?feat:=20secrets=20S1=20=E2=80=94=20what=20c?=
 =?UTF-8?q?odeoid=20stores=20never=20holds=20a=20secret's=20value:=20known?=
 =?UTF-8?q?=20values=20by=20name,=20detected=20ones=20by=20fingerprint,=20?=
 =?UTF-8?q?kept=20only=20where=20a=20workstream=20says=20so?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- secrets/: a detector after atuin's and gitleaks' patterns, exact matching of
  every value codeoid knows (credentials, accounts, endpoints, OAuth tokens,
  the daemon's keys), HMAC fingerprints, per-tool-call verdicts (a command
  that prints credentials keeps no output, a credential file's write no
  content), a streaming scrubber for replies, values found by shape matched
  exactly from then on (memory only)
- applied to every message a session stores or sends, the canonical history,
  memory, share bundles, and MCP results through the hub
- captureSecrets: "vault" keeps detected values encrypted per workstream;
  secret.list / reveal / forget (owner-only, audited); codeoid secret ls |
  reveal | forget | promote | scrub
- docs/secrets-and-memory-design.md (S1–S4), CONFIGURATION.md, an e2e journey

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                             |  16 ++
 docs/CONFIGURATION.md                 |  38 ++++
 docs/secrets-and-memory-design.md     | 287 +++++++++++++++++++++++++
 e2e/specs/secrets.spec.ts             |  75 +++++++
 packages/protocol/src/schemas.test.ts |   3 +
 packages/protocol/src/schemas.ts      |  10 +
 packages/protocol/src/types.ts        |  10 +
 packages/protocol/src/workstreams.ts  |  50 +++++
 src/cli.ts                            | 155 ++++++++++++++
 src/config.ts                         |  33 +++
 src/daemon/mcp/hub.ts                 |  14 +-
 src/daemon/memory/engine.ts           |  11 +-
 src/daemon/providers/canonical.ts     |  23 +-
 src/daemon/secrets/detect.ts          | 207 ++++++++++++++++++
 src/daemon/secrets/files.ts           |  62 ++++++
 src/daemon/secrets/fingerprint.ts     |  63 ++++++
 src/daemon/secrets/known.ts           | 165 +++++++++++++++
 src/daemon/secrets/scrub-stored.ts    | 150 +++++++++++++
 src/daemon/secrets/scrub.ts           | 198 +++++++++++++++++
 src/daemon/secrets/secrets.test.ts    | 293 ++++++++++++++++++++++++++
 src/daemon/secrets/service.ts         | 159 ++++++++++++++
 src/daemon/secrets/vault.ts           |  86 ++++++++
 src/daemon/secrets/verdict.ts         | 204 ++++++++++++++++++
 src/daemon/server.ts                  |  15 ++
 src/daemon/session-manager.ts         |  84 ++++++++
 src/daemon/session.ts                 | 165 ++++++++++++---
 src/daemon/share/pack.ts              |  16 +-
 src/daemon/store.ts                   |  95 +++++++++
 src/daemon/workstreams/effective.ts   |   5 +-
 src/daemon/workstreams/schema.ts      |   2 +
 src/tests/protocol.test.ts            |   4 +
 src/tests/secrets-session.test.ts     | 211 +++++++++++++++++++
 32 files changed, 2874 insertions(+), 35 deletions(-)
 create mode 100644 docs/secrets-and-memory-design.md
 create mode 100644 e2e/specs/secrets.spec.ts
 create mode 100644 src/daemon/secrets/detect.ts
 create mode 100644 src/daemon/secrets/files.ts
 create mode 100644 src/daemon/secrets/fingerprint.ts
 create mode 100644 src/daemon/secrets/known.ts
 create mode 100644 src/daemon/secrets/scrub-stored.ts
 create mode 100644 src/daemon/secrets/scrub.ts
 create mode 100644 src/daemon/secrets/secrets.test.ts
 create mode 100644 src/daemon/secrets/service.ts
 create mode 100644 src/daemon/secrets/vault.ts
 create mode 100644 src/daemon/secrets/verdict.ts
 create mode 100644 src/tests/secrets-session.test.ts

diff --git a/CLAUDE.md b/CLAUDE.md
index eecdb848..78eed916 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -256,6 +256,7 @@ codeoid new <n> <d> --workstream <id> [--override]  # a session's home workstrea
 codeoid mcp signin <server> --credential <id>        # a named OAuth slot: a second sign-in to one server (a workstream's own)
 codeoid new <n> <d> --ref <workstream>[:<dir>]       # another workstream it may read (its folders read-only, its memory), by that one's share policy
 codeoid workstream ref add|rm <session> <workstream>[:<dir>] | move <session> <workstream>  # references and moves (§5.3, §7)
+codeoid secret ls | reveal <ws>:<fp> | forget <ws>:<fp> | promote <ws>:<fp> --as <id> | scrub [--dry-run]  # kept secrets; scrub older data (docs/secrets-and-memory-design.md)
 ```
 
 `/mcp/control` (off by default, `mcpControl.*`) lets external agents drive
@@ -573,6 +574,21 @@ queueing, `dispatch_tasks.workstream` judged again at claim; send-class cards
 carry `targetWorkstream` (`#fleetCardWorkstream`). `workstreams/egress.ts` is
 the egress stub.
 
+Secrets (`src/daemon/secrets/`, docs/secrets-and-memory-design.md §2): what a
+session stores, shows and hands on never holds a secret's value. `SecretService`
+(made only by `codeoid start`, `DaemonConfig.secretsConfigDir`; tests and
+embedders get none) holds `KnownSecrets` (exact values from every place codeoid
+keeps one, `addDaemonKnownSources`) → `‹credential:<label>›`, and the detector
+(`detect.ts`) → `‹secret:<kind>:<hmac8>›`. Applied in Session at
+`#persistAndBuffer`/`#commitStreamed` (`#scrubMessage`), tool_start
+(`#recordedToolInput`, by `verdict.ts`'s keep / withhold-output /
+withhold-written / drop) and tool_complete (before hooks; not a `redacted`
+mark), live deltas (`StreamScrubber`), the canonical history
+(`CanonicalHistoryAccumulator.scrubTurn`), `MemoryEngine.scrubText`, share
+packs, and MCP results in the hub (`setResultScrub`, `secrets.beforeModel`).
+Detected values are dropped unless the workstream says `captureSecrets: "vault"`
+(`CapturedSecretVault`, `captured_secrets`); `secret.*` is owner-only and audited.
+
 Routines (`src/daemon/routines/`, docs/routines.md) run sessions on a schedule
 or an API call. `RoutineService` owns the scheduler and runs; it reaches
 sessions only through the `RoutineHost` seam that `SessionManager` implements,
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 09ec3220..99c768c3 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -510,6 +510,44 @@ The conductor acts only through sessions homed where the work belongs. `fleet_sp
 
 `codeoid workstream import [--root <dir>]` proposes workstreams from your repositories' remotes and lists Claude's global MCP servers to assign. It writes nothing; isolation stays off until you turn it on.
 
+## Secrets in what codeoid stores
+
+What codeoid stores never holds a secret's value: the transcript, the history a backend is seeded from, the scrollback a client replays, memory, and a shared bundle. Where one appears it is replaced by a reference:
+
+- `‹credential:gh-highflame›` for a value codeoid already knows: a declared credential, a backend account's key, an MCP sign-in, the daemon's own keys. Its value stays where it lives.
+- `‹secret:github-token:3f9a2c1b›` for one found by its shape (a token format, a private key, a URL's password, a value assigned to a name like `DB_PASSWORD`). The last part is a fingerprint: the same secret has the same reference everywhere, and the value can't be worked out from it.
+
+A command that exists to print a credential (`gh auth token`, `printenv`, `op read`, `cat .env`, …) is stored without its output, and a file tool writing a credential file (`.env`, `~/.netrc`, a private key) without what it wrote.
+
+The value of a detected secret is dropped. A workstream can keep them instead, so you can get one back later:
+
+```jsonc
+{ "workstreams": { "items": [ { "id": "acme", "captureSecrets": "vault" } ] } }
+```
+
+Kept secrets are encrypted under a key outside the database, belong to the workstream that kept them, and are forgotten after `secrets.vaultDays` (30) unless promoted:
+
+```bash
+codeoid secret ls                                  # what is kept, never the values
+codeoid secret reveal acme:3f9a2c1b                # the value (your own token only; audited)
+codeoid secret promote acme:3f9a2c1b --as acme-gh  # make it a declared credential
+codeoid secret forget acme:3f9a2c1b
+codeoid secret scrub --dry-run                     # what was stored before this, scrubbed (stop the daemon first)
+```
+
+Settings, under `secrets`:
+
+| Setting | Default | |
+| --- | --- | --- |
+| `enabled` | `true` | Turn it off only to debug. |
+| `beforeModel` | `true` | Also scrub MCP results before they go back to the model (through codeoid's hub). |
+| `captureSecrets` | `"drop"` | For sessions with no workstream; a workstream's own setting decides for its sessions. |
+| `vaultDays` | `30` | Kept secrets not seen for this long are forgotten. |
+| `dropCommands` | `[]` | Commands whose calls aren't stored at all (`"my-vault dump"`). |
+| `credentialFiles` | `[]` | More files whose contents are credentials (globs, by name or path). |
+
+Limits. The backend has already seen a value by the time codeoid stores the result, and a CLI backend keeps its own copy (Claude Code's `~/.claude/projects`, Codex's sessions), which codeoid doesn't change. A secret with no known shape, that codeoid doesn't know, in a command not on the list, still gets through. Design: [secrets-and-memory-design.md](secrets-and-memory-design.md).
+
 ## Signing a backend in, instead of pasting a key
 
 Settings → **Claude** → **Sign in with Claude** runs the backend's own login
diff --git a/docs/secrets-and-memory-design.md b/docs/secrets-and-memory-design.md
new file mode 100644
index 00000000..0f39cdfe
--- /dev/null
+++ b/docs/secrets-and-memory-design.md
@@ -0,0 +1,287 @@
+# Secrets, memory facts, saved approvals and atuin
+
+Status: agreed 2026-11-13. S1 built (§2.8). Four phases, one PR each, in order:
+S1 secret references, S2 memory facts, S3 saved approvals, S4 atuin as a source.
+The pure state machine for the turn loop is on the backlog (§7).
+
+This came out of reading atuin (`/Workspace/atuin`), which captures shell history, command output and
+every coding agent's sessions into one store. It is ahead of codeoid on keeping secrets out of what it
+stores and on the facts it keeps about each command. Codeoid is ahead on running agents safely
+(risk classifier, OS sandbox, checkpoints) and on recall. The parts below take atuin's ideas where they
+fit codeoid, not its code.
+
+## 1. The gap
+
+Codeoid stores everything a session does, verbatim:
+
+- the transcript (`<id>.jsonl`) and the canonical history (`<id>.canonical.jsonl`), which forks, backend
+  switches and stateless backends are seeded from;
+- the scrollback ring, replayed to every client that attaches, delegated watchers included;
+- memory episodes (`memory/store.ts`), which are embedded, recalled across sessions and workstreams,
+  shown to the conductor, and later sent between machines (federation);
+- share bundles (`share/pack.ts`), built from the transcript.
+
+Nothing scrubs any of them. `evidence/redact.ts` masks credentials in check output only, and
+`mcp/redact.ts` only what the settings screens show. So `gh auth token`, `cat .env`, `printenv`, a
+`curl -H "Authorization: Bearer …"`, or a token pasted into a prompt end up in every one of those
+places, in plain text, for good.
+
+Codeoid also knows less about each command than it could: episodes have no exit code, working
+directory or duration, and don't say which backend or model did the work or whether the turn was the
+user's or a delegated worker's. `get_episode` pages by characters, so an agent can't ask for the last
+80 lines, where the error is. And every medium-risk shell command asks again in guarded mode, every
+time: `npm test` forty times a day.
+
+## 2. S1 — secrets become references
+
+### 2.1 The rule
+
+What codeoid stores never holds a secret's value. Where one appears it is replaced by a reference:
+
+- `‹credential:<id>›` for a value codeoid already knows (§2.2): the reference names it, and its value
+  stays where it already lives;
+- `‹secret:<kind>:<fingerprint>›` for one the detector finds (§2.3): the kind (`github-token`,
+  `aws-key`, `jwt`, `password`, …) and a keyed hash of the value, so the same secret seen in three
+  sessions has the same reference, and nothing about the value can be learned from it.
+
+The value of a detected secret is dropped by default. A workstream can keep it instead
+(`captureSecrets: "vault"`, §2.5), so a person can still get it back later.
+
+### 2.2 Secrets codeoid already knows
+
+Most secrets that show up in a session are ones codeoid put there: a workstream's env credential the
+agent echoed, an MCP server's bearer token in an error, the backend key. Codeoid knows these values
+exactly, so they are replaced by exact match, with no guessing and no false positives. `KnownSecrets`
+(new, `secrets/known.ts`) gathers them from every source, each under a label:
+
+| Source | Label |
+| --- | --- |
+| `credentials[]` values in the secret store (W1) | `credential:<id>` |
+| MCP OAuth access and refresh tokens (`mcp/oauth.ts`) | `credential:oauth:<server>` |
+| Backend accounts' keys (`accounts.ts`, `claude-accounts.ts`, `oai:` endpoints) | `credential:account:<name>` |
+| The daemon's own keys (`CODEOID_API_KEY`, `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `TELEGRAM_BOT_TOKEN`, …) | `credential:daemon:<name>` |
+| Agent identity tokens codeoid mints (ZeroID, `agent-identity.ts`) | `credential:agent-token` |
+
+Each value is matched as written, URL-encoded, and base64 as `user:value` (Basic auth). Values shorter
+than 8 characters aren't matched (they would match ordinary text). The set is rebuilt when a source
+changes (a credential edited, an OAuth refresh) and cached by a version number; a scan is a single
+multi-pattern search over the text.
+
+### 2.3 Secrets codeoid doesn't know
+
+A detector finds the rest by shape. It starts from `evidence/redact.ts`, widened toward atuin's
+coverage (`atuin-common/src/secrets.rs`, `vendors.rs`, `structural.rs`): vendor token formats (GitHub,
+GitLab, Slack, AWS, Google, Stripe, OpenAI, Anthropic, npm, PyPI, Hugging Face, ZeroID, …), JWTs, PEM
+blocks, `scheme://user:password@host`, `Authorization:` headers, and values bound to keys that name a
+secret (`*_PASSWORD=`, `"api_key": …`). The rules follow evidence's: only known shapes and values bound
+to secret-named keys, never "looks random", so hashes and ids survive. The name or flag is kept and
+only the value replaced (`DB_PASSWORD=‹secret:password:9c2e41aa›`).
+
+The fingerprint is HMAC-SHA256 of the value under a key made once per daemon
+(`<config dir>/secret-fingerprint.key`, 0600, hidden from every sandbox), truncated to 8 hex
+characters. Without the key a fingerprint can't be checked against a guess.
+
+Scanning has a time budget (atuin's: 250 ms). Text that can't be scanned within it isn't stored; a
+placeholder says so. This keeps a pathological input from stalling the daemon or slipping through.
+
+### 2.4 Tool calls whose output is the secret
+
+Some commands exist to print a credential: `gh auth token`, `printenv`, `env`, `aws configure get`,
+`op read`, `security find-generic-password -w`, `cat .env`, `kubectl get secret -o yaml`, and any read
+of a path `secret-paths.ts` knows as a credential file. Scrubbing their output by shape would miss
+whatever has no known shape. So each tool call gets a verdict before it is stored (atuin's
+`session_capture/policy.rs`):
+
+- **keep**: stored, scrubbed (the default);
+- **withhold output**: the call is stored, its output replaced by `‹output withheld: it prints credentials›`;
+- **withhold written**: a write of a credential file (`.env`, `~/.netrc`, …) is stored without the
+  content written;
+- **drop**: the call isn't stored at all (a command the user listed in `secrets.dropCommands`).
+
+The verdict reads the command with codeoid's shell parser (`shell/parse.ts`), so `bash -c 'gh auth
+token'` and `x=$(gh auth token)` are caught as the plain form is.
+
+### 2.5 Keeping a detected secret (opt-in)
+
+`workstreams.items[].captureSecrets: "drop" | "vault"`, default `drop`; and the same at the top level
+for sessions with no workstream. With `vault`, a detected secret's value is kept in the
+`CapturedSecretVault`: a table in the database (`captured_secrets`: workstream, fingerprint, kind,
+first and last seen, session, value encrypted with AES-256-GCM under a key in a separate 0600 file), so
+a copy of the database alone doesn't hold the values. Entries expire after `secrets.vaultDays` (30)
+unless promoted.
+
+A kept secret can be:
+
+- **revealed** by the session's owner, with an undelegated token, in the web UI or
+  `codeoid secret reveal <fingerprint>`, audited;
+- **promoted** to a declared credential (it gets an id and a place in the secret store, and from then
+  on is matched exactly, §2.2);
+- **forgotten**.
+
+A reference made in one workstream resolves only there: a closed workstream's secrets are never shown
+from another.
+
+Why drop is the default: kept by default, the vault would gather every secret that ever scrolled past
+(a customer's key in a log, a colleague's token in an error, a production key printed by accident) and
+become the most valuable thing on the machine, holding values that mostly go stale when they are
+rotated.
+
+### 2.6 Where it applies
+
+One scrubber (`secrets/scrub.ts`, behind `SecretService`, made by `codeoid start` only: tests and
+embedders get none) at every place codeoid stores or sends on a conversation:
+
+| Where | How |
+| --- | --- |
+| Tool output, in the `tool_complete` seam (`session.ts`) | before the `tool_result` hooks run, so canonical history, scrollback and transcript all get the scrubbed text. Not marked `redacted` as a hook's change is: the backend saw the same, so forking its own session adds no exposure, and marking it would cost every session that ever printed a secret its native forks |
+| Tool input, at `tool_start` | the recorded copy only; the call runs as the backend made it |
+| User prompts and assistant and thinking text | at the message's commit (`#commitStreamed`, `#persistAndBuffer`) |
+| Live deltas to attached clients | a streaming scrubber holds back the trailing run of non-space characters (at most 512) until the next space or the message's end, so a token is never split across two deltas and sent unscrubbed |
+| Every message the session buffers, writes or sends (`#persistAndBuffer`, `#commitStreamed`, a fork's copy of its parent's rows, a settled approval's input) | `Session#scrubMessage`: text, parts, tool input and state, metadata |
+| The canonical history | `CanonicalHistoryAccumulator.scrubTurn` on each turn as it is committed, so no backend is seeded with a value codeoid wouldn't store |
+| `MemoryEngine.ingest` | so anything that ingests (S4's imports included) is scrubbed |
+| `share/pack.ts` | transcripts written before S1 are scrubbed as they are packed |
+| Dispatch digests, routine and loop results, push and Telegram texts | built from scrubbed messages; the push text is scrubbed again |
+
+A one-time `codeoid secret scrub [--dry-run]` rewrites what was stored before S1 (transcripts, canonical
+histories, episodes, their FTS rows) with known values and detected secrets, and reports what it changed.
+It is a command, not automatic: it rewrites history, so you run it when you choose.
+
+### 2.7 What S1 doesn't fix
+
+The backend has already seen the value by the time codeoid stores the result, and so has the model. A
+CLI backend keeps its own copy (Claude Code's `~/.claude/projects/…/*.jsonl`, Codex's rollout files).
+Codeoid can change what the model sees only where the output passes through it before the model:
+
+- the tool loops codeoid runs itself (OpenAI-compatible, Gemini, llama.cpp);
+- MCP servers reached through codeoid's hub: under `isolateGlobalServers`, every server on Claude and
+  the credentialed HTTP ones on CLI backends.
+
+S1 scrubs MCP results in the hub (`McpHub.setResultScrub`, `secrets.beforeModel`, on by default), which
+the tool loops codeoid runs reach their MCP servers through too. Claude's Bash output passes through
+codeoid only when the compressor wraps the command, in a separate process without the known values:
+not scrubbed there yet. Elsewhere the backend's own copy is the exposure left, and
+the docs say so plainly rather than implying more.
+
+A secret with no known shape that isn't a value codeoid knows, in a command not on the verdict list,
+still gets through. The detector reduces this; it can't end it.
+
+### 2.8 S1 as built
+
+- `secrets/`: `detect.ts` (the patterns), `known.ts` (`KnownSecrets`), `fingerprint.ts` (keys in
+  `<config dir>/secrets/`, registered with the secret-path gate), `scrub.ts` (`Scrubber`,
+  `StreamScrubber`), `verdict.ts` and `files.ts` (§2.4), `vault.ts` (`captured_secrets`, AES-256-GCM
+  bound to tenant, workstream and fingerprint), `service.ts` (`SecretService`,
+  `addDaemonKnownSources`), `scrub-stored.ts` (`codeoid secret scrub`).
+- Known values: declared credentials, the daemon's environment (`CODEOID_*` and secret-named
+  variables), every backend's accounts, OpenAI-compatible endpoints, MCP OAuth tokens and client
+  secrets, the conductor's key. Rebuilt on a change, and at least every minute (a token refresh).
+- Streaming: a line that may name a credential is held until it ends, a private key until its end
+  line, otherwise the trailing run of non-space characters; the committed message replaces it.
+- Protocol: `secret.list` (settings:read), `secret.reveal`, `secret.forget` (settings:write, the
+  caller's own token, audited without the value). CLI: `codeoid secret ls | reveal | forget | promote |
+  scrub [--dry-run]`; `promote` reveals, declares an env credential, sets its value and forgets the
+  kept copy. `scrub` takes the daemon's data locks, so it refuses while the daemon runs.
+- Config: `secrets.enabled`, `beforeModel`, `captureSecrets` (sessions with no workstream),
+  `vaultDays`, `dropCommands`, `credentialFiles`; `workstreams.items[].captureSecrets`.
+
+### 2.9 Using a secret without seeing it (S1b, after S4)
+
+"Recall it if required" means an agent can use a secret without seeing it. An agent writes
+`‹credential:gh-highflame›` in a command; codeoid's gate puts the value in as an environment variable
+for that one command (`CODEOID_REF_1`, the reference rewritten to `"$CODEOID_REF_1"`) where the backend
+lets the gate rewrite the call, and the output is scrubbed again on the way back. The model never gets
+the value in its context, where it would land in the transcript again. This is per backend (Claude's
+PreToolUse rewrite, the tool loops codeoid runs, opencode's shell shim), so it comes after S4.
+
+## 3. S2 — memory facts
+
+- **On shell episodes:** exit code (from the backend when it reports one: Codex, opencode, the tool
+  loops codeoid runs; else the `Exit code N` line Claude's Bash result carries; null when unknown),
+  working directory (the `shellCwd` the gate already has), and duration (`tool_start` to
+  `tool_complete`).
+- **On every episode:** backend, model, and the turn's origin (`user`, `agent`, `delegated`, from
+  `turn-origin.ts`; plus `routine`, `loop` and `dispatch` for unattended runs).
+- **Recall filters:** `only_failed`, `backend`, `origin`, `cwd` (a repo root or folder), next to the
+  existing `tool`, `filePaths`, `before`/`after`. On `recall`, `timeline` and the conductor's
+  `fleet_recall`.
+- **Tail first:** `get_episode` takes `lines: [[start, end], …]`, negative counting from the end, and
+  returns numbered lines with a `[… N lines skipped …]` marker and the total line count. The tool
+  description says to ask for `[[-80, -1]]` first.
+- **Exact first:** when a query is quoted, or looks like a command or an identifier, episodes holding
+  it exactly come first, then the hybrid ranking fills the page under a separator line. When nothing
+  matches, the reply says which filter to loosen.
+- **Instructions:** the memory system-prompt text (`MEMORY_SYSTEM_PROMPT_APPEND`) gains one line:
+  before re-running a command to find out what failed, recall it. The memory MCP server
+  (`memory/mcp.ts`, `memory/mcp-http.ts`) carries the same text as its MCP `instructions`, for backends
+  and outside agents that don't get the system prompt.
+
+Old episodes keep null for the new fields; nothing is backfilled.
+
+## 4. S3 — saved approvals
+
+In guarded mode every shell command that isn't low asks, every time. S3 lets the owner answer once for
+a scope:
+
+- **Allow once** (as today).
+- **For this session**, for `approvals.sessionGrantHours` (8).
+- **In this repository**: kept by codeoid, keyed by the repository's real top-level path, never read
+  from a file in the repository (an agent could write one).
+- **In this workstream**, or **everywhere**: from the settings screen.
+
+A rule is a program and an argument prefix, in Claude's form (`Bash(npm test:*)`, `Bash(make lint)`),
+plus MCP tools by name (`mcp__linear__list_issues`) and web fetches by domain (`WebFetch(domain:docs.rs)`).
+
+The rules that keep it safe:
+
+- Only **medium** commands can be saved, and only medium commands run on a rule. A high, not-understood
+  or credential-touching command is judged again every time and always asks, whatever rules exist.
+- A line runs on rules only when **every** simple command in it matches an allow rule
+  (`npm test && rm -rf build` needs both); one deny rule matching **any** of them refuses it.
+- The program is a literal word. No bare `Bash` or `Bash(*)`, no rule for a shell (`bash`, `sh -c`),
+  `eval`, `sudo`, or a wrapper that runs another command; the program after a wrapper is what must
+  match.
+- Saving needs the owner's own token; a delegated one can only allow once.
+- Interactive mode ignores rules (it asks about every call). Autonomous mode doesn't need them.
+- Every saved rule is listed in Settings → Approvals, shows where it applied, and can be removed. Every
+  use is audited (`session.rule_allow rule=… scope=…`).
+
+Claude's own `permissions.allow` rules keep working on Claude as today. Codeoid's rules work on every
+backend.
+
+## 5. S4 — atuin as a source
+
+Atuin already captures the user's own shell history, command output, and every coding agent's
+sessions, including ones codeoid didn't start. S4 brings that into codeoid's memory, read-only, rather
+than building a terminal proxy:
+
+- **What:** atuin's history (command, cwd, exit code, duration, author), the output it captured for
+  failed commands, and its threads (Claude Code, Codex, opencode, … sessions).
+- **How:** codeoid runs `atuin mcp` as an MCP client (its tools `atuin_history`, `atuin_output`,
+  `atuin_threads_list`, `atuin_threads_read`) on a schedule and when the conductor asks, and ingests what
+  is new as episodes (`source: "atuin"`, the thread's agent as the backend). A per-source watermark plus
+  a stable id per item (atuin's history id, a thread's message id) keeps re-reads from duplicating.
+- **Workstreams:** each item is homed by its cwd (§5 of workstreams-design.md), so a closed
+  workstream's commands are withheld from the conductor as its sessions are. An item whose folder has
+  no home stays out under isolation.
+- **Secrets:** everything goes through `MemoryEngine.ingest`, so S1 scrubs it.
+- **Off by default** (`integrations.atuin.enabled`). Codeoid works the same without atuin installed.
+
+Open before S4 starts: whether atuin's MCP output is stable enough to parse, or whether its CLI's
+`--format json` is the better interface; and whether threads are read whole or only what changed.
+
+## 6. Testing
+
+Every phase: unit tests for the pure parts (the scrubber and the verdicts against a table of real
+command lines and outputs; the rule matcher against compound lines), session tests through a mock
+backend (a secret printed by a tool never reaches the transcript, the canonical log, the scrollback, an
+episode or a bundle), an e2e journey on a real daemon, and two audit rounds before each PR.
+
+## 7. Backlog
+
+- **The turn loop as a pure state machine** (atuin's `atuin-ai/src/fsm`): events in, effects out, no
+  I/O, so cancellation, late results and timeouts are tested synchronously. Start with the approval
+  lifecycle.
+- Retention: a disk budget for episodes, with a head-and-tail cap on large tool output.
+- Capturing the native session files of agents codeoid didn't start without atuin (Claude and Codex
+  JSONL), if atuin isn't installed.
diff --git a/e2e/specs/secrets.spec.ts b/e2e/specs/secrets.spec.ts
new file mode 100644
index 00000000..a9c80a75
--- /dev/null
+++ b/e2e/specs/secrets.spec.ts
@@ -0,0 +1,75 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createSessionInUi, expect, messages, openUi, send, test, waitIdle } from "../harness";
+
+// Made-up credentials of the right shape, split so no contiguous token sits in this file.
+const GHP = `ghp_${"Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V"}`;
+const PASSWORD = `hunter${"2xyz"}`;
+
+/** Every transcript, canonical history and turn index the daemon wrote. */
+function storedText(configDir: string): string {
+  const dir = join(configDir, "codeoid", "transcripts");
+  return readdirSync(dir)
+    .filter((n) => n.endsWith(".jsonl"))
+    .map((n) => readFileSync(join(dir, n), "utf8"))
+    .join("\n");
+}
+
+// docs/secrets-and-memory-design.md §2: a secret a tool prints and a reply
+// repeats is shown and stored as a reference; a workstream that keeps them
+// lets its owner get it back; older data can be scrubbed, never while the
+// daemon runs.
+test("a leaked token is shown and stored as a reference, kept where the workstream says so, revealed to its owner", async ({ page, codeoid }) => {
+  codeoid.configure({
+    workstreams: { items: [{ id: "keep", name: "Keep", captureSecrets: "vault", match: { paths: [codeoid.workdir] } }] },
+  });
+  await codeoid.restart();
+  codeoid.setScript([
+    {
+      match: "^leak",
+      steps: [
+        { tool: "Read", input: { file_path: "notes.md" }, output: `token=${GHP}\nDB_PASSWORD=${PASSWORD}\n` },
+        { text: `The token is ${GHP}, and the password is ${PASSWORD}.` },
+      ],
+    },
+  ]);
+  await openUi(page, codeoid);
+  await createSessionInUi(page, "leaky", codeoid.workdir);
+  await send(page, "leak it");
+  const approve = page.getByRole("button", { name: "approve", exact: true });
+  if (await approve.isVisible().catch(() => false)) await approve.click();
+  await expect(messages(page).filter({ hasText: "The token is" })).toHaveCount(1);
+  await waitIdle(page);
+
+  // On screen: references, never the values.
+  const main = page.getByRole("main");
+  await expect(main).toContainText(/‹secret:github-token:[0-9a-f]{8}›/);
+  await expect(main).not.toContainText(GHP);
+  await expect(main).not.toContainText(PASSWORD);
+
+  // On disk: the same.
+  const stored = storedText(codeoid.configDir);
+  expect(stored).not.toContain(GHP);
+  expect(stored).not.toContain(PASSWORD);
+  expect(stored).toMatch(/‹secret:github-token:[0-9a-f]{8}›/);
+
+  // A new page load replays the scrollback: still references.
+  await page.reload();
+  await expect(page.getByText("live", { exact: true })).toBeVisible();
+  await expect(page.locator("body")).not.toContainText(GHP);
+
+  // The workstream keeps it: listed without the value, revealed to the owner.
+  const ls = await codeoid.cliOk("secret", "ls");
+  expect(ls).toContain("github-token");
+  expect(ls).not.toContain(GHP);
+  const ref = /keep:([0-9a-f]{8})\s+github-token/.exec(ls)?.[0].split(/\s+/)[0];
+  expect(ref).toBeTruthy();
+  expect((await codeoid.cliOk("secret", "reveal", ref!)).trim()).toBe(GHP);
+  expect(await codeoid.cliOk("secret", "forget", ref!)).toContain("Forgot");
+  expect(await codeoid.cliOk("secret", "ls")).not.toContain(ref!);
+
+  // Scrubbing older data refuses while the daemon runs.
+  const scrub = await codeoid.cli("secret", "scrub", "--dry-run");
+  expect(scrub.code).not.toBe(0);
+  expect(scrub.output).toContain("the daemon is running");
+});
diff --git a/packages/protocol/src/schemas.test.ts b/packages/protocol/src/schemas.test.ts
index 90d34e59..90e10145 100644
--- a/packages/protocol/src/schemas.test.ts
+++ b/packages/protocol/src/schemas.test.ts
@@ -175,6 +175,9 @@ const samples: { [T in ClientTypes]: Extract<ClientMessage, { type: T }> } = {
   "credential.upsert": { type: "credential.upsert", id: "c2", item: { id: "gh", kind: "env" } },
   "credential.delete": { type: "credential.delete", id: "c3", credential: "gh" },
   "credential.set_value": { type: "credential.set_value", id: "c4", credential: "gh", value: "x" },
+  "secret.list": { type: "secret.list", id: "sc1" },
+  "secret.reveal": { type: "secret.reveal", id: "sc2", workstream: "acme", fingerprint: "3f9a2c1b" },
+  "secret.forget": { type: "secret.forget", id: "sc3", workstream: "", fingerprint: "3f9a2c1b" },
   "session.turns": { type: "session.turns", id: "r94", sessionId: "s1" },
   "session.approvals": { type: "session.approvals", id: "r94a", sessionId: "s1" },
   "claude.accounts.list": { type: "claude.accounts.list", id: "ca1" },
diff --git a/packages/protocol/src/schemas.ts b/packages/protocol/src/schemas.ts
index 1be987aa..b76e1acf 100644
--- a/packages/protocol/src/schemas.ts
+++ b/packages/protocol/src/schemas.ts
@@ -1157,6 +1157,13 @@ export const credentialSetValueSchema = z.object({
   value: z.string().max(LIMITS.SETTING_VALUE_MAX).nullable(),
 });
 
+// A kept secret's fingerprint (secrets/fingerprint.ts: 8 hex characters) and its workstream ('' = none).
+const fingerprintField = z.string().regex(/^[0-9a-f]{8}$/);
+const keptWorkstreamField = z.union([z.literal(""), workstreamIdField]);
+export const secretListSchema = z.object({ ...base, type: z.literal("secret.list"), workstream: keptWorkstreamField.optional() });
+export const secretRevealSchema = z.object({ ...base, type: z.literal("secret.reveal"), workstream: keptWorkstreamField, fingerprint: fingerprintField });
+export const secretForgetSchema = z.object({ ...base, type: z.literal("secret.forget"), workstream: keptWorkstreamField, fingerprint: fingerprintField });
+
 export const skillGrantSchema = z.object({
   ...base,
   type: z.literal("skill.grant"),
@@ -1402,6 +1409,9 @@ export const clientMessageSchema = z.discriminatedUnion("type", [
   credentialUpsertSchema,
   credentialDeleteSchema,
   credentialSetValueSchema,
+  secretListSchema,
+  secretRevealSchema,
+  secretForgetSchema,
   sessionTurnsSchema,
   sessionApprovalsSchema,
   claudeAccountsListSchema,
diff --git a/packages/protocol/src/types.ts b/packages/protocol/src/types.ts
index d02e71f6..e41f6f1c 100644
--- a/packages/protocol/src/types.ts
+++ b/packages/protocol/src/types.ts
@@ -50,6 +50,11 @@ import type {
   CredentialListResultMsg,
   CredentialSetValueMsg,
   CredentialUpsertMsg,
+  SecretForgetMsg,
+  SecretListMsg,
+  SecretListResultMsg,
+  SecretRevealMsg,
+  SecretRevealResultMsg,
   SessionWorkstreamInfo,
   WorkstreamDeleteMsg,
   WorkstreamListMsg,
@@ -1384,6 +1389,9 @@ export type ClientMessage =
   | CredentialUpsertMsg
   | CredentialDeleteMsg
   | CredentialSetValueMsg
+  | SecretListMsg
+  | SecretRevealMsg
+  | SecretForgetMsg
   | SessionTurnsMsg
   | SessionApprovalsMsg
   | ClaudeAccountsListMsg
@@ -3356,6 +3364,8 @@ export type DaemonMessage =
   | WorkstreamResolveResultMsg
   | WorkstreamsChangedMsg
   | CredentialListResultMsg
+  | SecretListResultMsg
+  | SecretRevealResultMsg
   | SessionTurnsResultMsg
   | SessionApprovalsResultMsg
   | ClaudeAccountsResultMsg
diff --git a/packages/protocol/src/workstreams.ts b/packages/protocol/src/workstreams.ts
index 3ef50eca..ea37e03c 100644
--- a/packages/protocol/src/workstreams.ts
+++ b/packages/protocol/src/workstreams.ts
@@ -221,6 +221,56 @@ export interface CredentialSetValueMsg {
   value: string | null;
 }
 
+/** A detected secret a workstream keeps (`captureSecrets: "vault"`; docs/secrets-and-memory-design.md §2.5). Never its value. */
+export interface KeptSecretInfo {
+  /** '' for sessions with no workstream. */
+  workstream: string;
+  /** What `‹secret:<kind>:<fingerprint>›` names. */
+  fingerprint: string;
+  kind: string;
+  sessionId: string | null;
+  firstSeen: number;
+  lastSeen: number;
+}
+
+/** The detected secrets kept in the vault, newest first; one workstream's when given. Owner-only. */
+export interface SecretListMsg {
+  type: "secret.list";
+  id: string;
+  workstream?: string;
+}
+
+export interface SecretListResultMsg {
+  type: "secret.list.result";
+  requestId: string;
+  /** Whether secret handling is on in this daemon at all. */
+  enabled: boolean;
+  secrets: KeptSecretInfo[];
+}
+
+/** A kept secret's value: the owner's own token only, audited. Replies `secret.reveal.result`. */
+export interface SecretRevealMsg {
+  type: "secret.reveal";
+  id: string;
+  workstream: string;
+  fingerprint: string;
+}
+
+export interface SecretRevealResultMsg {
+  type: "secret.reveal.result";
+  requestId: string;
+  kind: string;
+  value: string;
+}
+
+/** Forget a kept secret. Replies `response.ok`. */
+export interface SecretForgetMsg {
+  type: "secret.forget";
+  id: string;
+  workstream: string;
+  fingerprint: string;
+}
+
 export interface CredentialListResultMsg {
   type: "credential.list.result";
   requestId: string;
diff --git a/src/cli.ts b/src/cli.ts
index d7b398cc..e4662b24 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -170,6 +170,8 @@ program
       daemon = new DaemonServer({
         dataLock,
         sandboxRegistry,
+        // What sessions store is scrubbed of secrets (docs/secrets-and-memory-design.md §2).
+        secretsConfigDir: getConfigDir(),
         port: bindPort,
         host: bindHost,
         dbPath: config.dbPath,
@@ -1686,6 +1688,159 @@ async function workstreamRequest<T extends DaemonMessage["type"]>(
   }
 }
 
+// ── Secrets (docs/secrets-and-memory-design.md §2) ──────────────────────
+
+const secretCmd = program
+  .command("secret")
+  .description("Secrets in what codeoid stores: the ones workstreams keep, and scrubbing older data (docs/secrets-and-memory-design.md)");
+
+/** `<workstream>:<fingerprint>`, or a bare fingerprint (a session with no workstream), or `‹secret:kind:fp›` as copied. */
+function keptRef(ref: string, workstream?: string): { workstream: string; fingerprint: string } | null {
+  const copied = /^‹secret:[a-z0-9-]+:([0-9a-f]{8})›$/.exec(ref.trim());
+  if (copied) return { workstream: workstream ?? "", fingerprint: copied[1]! };
+  const m = /^(?:([a-z0-9][a-z0-9-]{0,63}):)?([0-9a-f]{8})$/.exec(ref.trim());
+  return m ? { workstream: workstream ?? m[1] ?? "", fingerprint: m[2]! } : null;
+}
+
+secretCmd
+  .command("ls")
+  .description("List the detected secrets workstreams keep (captureSecrets: vault) — never their values")
+  .option("--workstream <id>", "only this workstream's")
+  .option("--json", "print the daemon's reply as JSON")
+  .action(async (o: { workstream?: string; json?: boolean }) => {
+    await workstreamRequest({ type: "secret.list", id: randomUUID(), ...(o.workstream ? { workstream: o.workstream } : {}) }, "secret.list.result", (r) => {
+      if (o.json) return void console.log(JSON.stringify(r, null, 2));
+      if (!r.enabled) console.log("Secret handling is off in this daemon (secrets.enabled).");
+      if (r.secrets.length === 0) {
+        console.log("No kept secrets. A workstream keeps detected secrets only with captureSecrets: \"vault\"; the default drops them.");
+        return;
+      }
+      for (const k of r.secrets) {
+        const ref = `${k.workstream ? `${clean(k.workstream)}:` : ""}${k.fingerprint}`;
+        console.log(`${ref.padEnd(32)} ${clean(k.kind).padEnd(20)} last seen ${new Date(k.lastSeen).toISOString()}${k.sessionId ? `  session ${clean(k.sessionId.slice(0, 8))}` : ""}`);
+      }
+    });
+  });
+
+secretCmd
+  .command("reveal <ref>")
+  .description("Print a kept secret's value (<workstream>:<fingerprint>, or as copied: ‹secret:kind:fingerprint›). Your own token only; audited")
+  .option("--workstream <id>", "the workstream that keeps it")
+  .action(async (ref: string, o: { workstream?: string }) => {
+    const k = keptRef(ref, o.workstream);
+    if (!k) {
+      console.error("Error: give <workstream>:<fingerprint>, a fingerprint, or the reference as copied");
+      process.exitCode = 1;
+      return;
+    }
+    await workstreamRequest({ type: "secret.reveal", id: randomUUID(), ...k }, "secret.reveal.result", (r) => {
+      // The value itself, unaltered: it is what was asked for.
+      console.log(r.value);
+    });
+  });
+
+secretCmd
+  .command("forget <ref>")
+  .description("Forget a kept secret")
+  .option("--workstream <id>", "the workstream that keeps it")
+  .action(async (ref: string, o: { workstream?: string }) => {
+    const k = keptRef(ref, o.workstream);
+    if (!k) {
+      console.error("Error: give <workstream>:<fingerprint>, a fingerprint, or the reference as copied");
+      process.exitCode = 1;
+      return;
+    }
+    await workstreamRequest({ type: "secret.forget", id: randomUUID(), ...k }, "response.ok", () => console.log(`Forgot ${k.workstream ? `${k.workstream}:` : ""}${k.fingerprint}.`));
+  });
+
+secretCmd
+  .command("promote <ref>")
+  .description("Make a kept secret a declared credential (an env credential), so it is matched by name from now on")
+  .requiredOption("--as <id>", "the credential's id (lowercase letters, digits, dashes)")
+  .option("--workstream <id>", "the workstream that keeps it")
+  .action(async (ref: string, o: { as: string; workstream?: string }) => {
+    const k = keptRef(ref, o.workstream);
+    if (!k) {
+      console.error("Error: give <workstream>:<fingerprint>, a fingerprint, or the reference as copied");
+      process.exitCode = 1;
+      return;
+    }
+    const client = new TerminalClient(loadConfig());
+    await client.connect();
+    try {
+      const fail = (reply: DaemonMessage): boolean => {
+        if (reply.type !== "response.error") return false;
+        console.error(`Error: ${clean(reply.error)}`);
+        process.exitCode = 1;
+        return true;
+      };
+      const revealed = await client.request({ type: "secret.reveal", id: randomUUID(), ...k });
+      if (fail(revealed) || revealed.type !== "secret.reveal.result") return;
+      if (fail(await client.request({ type: "credential.upsert", id: randomUUID(), item: { id: o.as, kind: "env", description: `promoted from ${revealed.kind} ${k.fingerprint}` } }))) return;
+      if (fail(await client.request({ type: "credential.set_value", id: randomUUID(), credential: o.as, value: revealed.value }))) return;
+      if (fail(await client.request({ type: "secret.forget", id: randomUUID(), ...k }))) return;
+      console.log(`Credential "${o.as}" now holds it; from now on it shows as ‹credential:${o.as}›. Give it to a workstream's env to use it.`);
+    } finally {
+      client.disconnect();
+    }
+  });
+
+secretCmd
+  .command("scrub")
+  .description("Rewrite what was stored before secret handling (transcripts, memory, dispatch tasks) with secrets replaced by references. Stop the daemon first")
+  .option("--dry-run", "say what would change, change nothing")
+  .action(async (o: { dryRun?: boolean }) => {
+    const config = loadConfig();
+    const { acquireDaemonLocks: acquire, daemonOwnedDirs: owned, DataDirLockError: LockError } = await import("./daemon/data-lock.js");
+    let locks: { release(): void };
+    try {
+      locks = acquire(owned(config), { log: () => {} });
+    } catch (err) {
+      if (err instanceof LockError) {
+        console.error(`Error: the daemon is running (${clean(err.message)}). Stop it first: scrubbing rewrites what it writes to.`);
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
+    }
+    try {
+      const { Store: DaemonStore } = await import("./daemon/store.js");
+      const { SecretService, addDaemonKnownSources } = await import("./daemon/secrets/service.js");
+      const { createSecretStore } = await import("./daemon/credentials/store.js");
+      const { AccountStore } = await import("./daemon/accounts.js");
+      const { EndpointStore } = await import("./daemon/openai-endpoints.js");
+      const { scrubTranscripts, scrubMemoryDb, scrubDispatchTasks } = await import("./daemon/secrets/scrub-stored.js");
+      const store = new DaemonStore(config.dbPath);
+      try {
+        // No vault: a scrub of old data keeps nothing, whatever the workstreams say.
+        const secrets = new SecretService({ ...(config.secrets ? { config: { ...config.secrets, captureSecrets: "drop" } } : {}), configDir: getConfigDir() });
+        addDaemonKnownSources(secrets, {
+          credentials: () => config.credentials ?? [],
+          secretStore: createSecretStore(config.credentialStore),
+          accounts: new AccountStore(),
+          endpoints: new EndpointStore(),
+          store,
+        });
+        const scrub = <T,>(v: T) => secrets.scrubValue(v);
+        const t = scrubTranscripts(config.transcriptDir, scrub, !!o.dryRun);
+        const episodes = config.memory?.dbPath ? scrubMemoryDb(config.memory.dbPath, scrub, !!o.dryRun) : 0;
+        store.close();
+        const tasks = scrubDispatchTasks(config.dbPath, scrub, !!o.dryRun);
+        const verb = o.dryRun ? "would change" : "changed";
+        console.log(`Transcripts: ${t.filesChanged} of ${t.files} files ${verb} (${t.linesChanged} lines).`);
+        console.log(`Memory: ${episodes} episode bodies ${verb}.`);
+        console.log(`Dispatch tasks: ${tasks} ${verb}.`);
+        if (!o.dryRun && t.filesChanged + episodes + tasks > 0) console.log("Done. A backend's own copy (Claude Code's ~/.claude/projects, Codex's sessions) is its own, and isn't changed.");
+      } finally {
+        try {
+          store.close();
+        } catch {}
+      }
+    } finally {
+      locks.release();
+    }
+  });
+
 workstreamCmd
   .command("ls")
   .description("List the configured workstreams")
diff --git a/src/config.ts b/src/config.ts
index becd5372..d0a1fc3a 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -345,6 +345,31 @@ const SandboxSchema = z
   })
   .default({ provider: "auto", network: "on", allowedHosts: [], hiddenPaths: [], homeReadable: [...DEFAULT_HOME_READABLE], worktreeRoots: [], projectRoots: [PROJECT_ROOT_PARENT], docker: { image: "node:22-bookworm-slim", socket: false } });
 
+/** Secrets in what codeoid stores (docs/secrets-and-memory-design.md §2). */
+const SecretsSchema = z
+  .object({
+    /** Scrub stored conversations: off only to debug. */
+    enabled: z.boolean().default(true),
+    /**
+     * Also scrub what goes back to the model where codeoid hands it over (MCP
+     * results through the hub, the tool loops codeoid runs): the model gets a
+     * secret as a reference. Off: only what is stored is scrubbed.
+     */
+    beforeModel: z.boolean().default(true),
+    /** For sessions with no workstream; a workstream's own `captureSecrets` decides for its sessions. */
+    captureSecrets: z.enum(["drop", "vault"]).default("drop"),
+    /** Kept secrets not seen for this many days are forgotten. */
+    vaultDays: z.number().int().min(1).max(3650).default(30),
+    /** Commands (a program, or an argv prefix) whose calls aren't stored at all. */
+    dropCommands: z.array(z.string().min(1).max(256)).max(256).default([]),
+    /** More files whose contents are credentials (globs, by name or by path; `~` is the home). */
+    credentialFiles: z.array(z.string().min(1).max(1024)).max(256).default([]),
+  })
+  .strict()
+  .default({ enabled: true, beforeModel: true, captureSecrets: "drop", vaultDays: 30, dropCommands: [], credentialFiles: [] });
+
+export type SecretsConfig = z.infer<typeof SecretsSchema>;
+
 const CompressSchema = z
   .object({
     enabled: z.boolean().default(false),
@@ -1367,6 +1392,7 @@ const RootSchema = z.object({
   memory: MemorySchema,
   workspaceIndex: WorkspaceIndexSchema,
   compress: CompressSchema,
+  secrets: SecretsSchema,
   approvals: ApprovalsSchema,
   sandbox: SandboxSchema,
   guard: GuardSchema,
@@ -1527,6 +1553,12 @@ export interface CodeoidConfig {
    * defaults (on, `auto`, network on).
    */
   sandbox?: SandboxConfig;
+  /**
+   * Secrets in what codeoid stores (docs/secrets-and-memory-design.md §2).
+   * Optional on the type so a hand-built config literal need not carry it;
+   * absent = the defaults (on, detected values dropped).
+   */
+  secrets?: SecretsConfig;
   /** Homegrown CLI output compressor (RTK-style). Disabled by default. */
   compress: {
     enabled: boolean;
@@ -2124,6 +2156,7 @@ export function loadConfig(opts: LoadOptions = {}): CodeoidConfig {
     },
     workspaceIndex: parsed.workspaceIndex,
     compress: parsed.compress,
+    secrets: parsed.secrets,
     approvals: parsed.approvals,
     sandbox: parsed.sandbox,
     guard: parsed.guard,
diff --git a/src/daemon/mcp/hub.ts b/src/daemon/mcp/hub.ts
index 9c306f80..c03455af 100644
--- a/src/daemon/mcp/hub.ts
+++ b/src/daemon/mcp/hub.ts
@@ -116,6 +116,17 @@ export class McpHub {
     this.#permit = fn;
   }
 
+  /**
+   * Applied to every tool result before it goes back to the backend
+   * (docs/secrets-and-memory-design.md §2.7): through the hub, the model gets
+   * a secret as a reference, never its value. Unset: as the server sent it.
+   */
+  #scrubResult: ((text: string) => string) | null = null;
+
+  setResultScrub(fn: (text: string) => string): void {
+    this.#scrubResult = fn;
+  }
+
   #refusal(spec: McpServerSpec, scope: McpCallScope | undefined): string | undefined {
     return scope?.sessionId && !spec.builtin ? this.#permit?.(scope.sessionId, spec) : undefined;
   }
@@ -183,7 +194,8 @@ export class McpHub {
       return { text: `mcp: ${spec.name} unavailable: ${cleanMcpError(errMsg(e))}`, isError: true };
     }
     try {
-      return await withTimeout(client.callTool(tool, args, scope), this.#timeoutMs, `${spec.name}/${tool}`);
+      const result = await withTimeout(client.callTool(tool, args, scope), this.#timeoutMs, `${spec.name}/${tool}`);
+      return this.#scrubResult && !spec.builtin ? { ...result, text: this.#scrubResult(result.text) } : result;
     } catch (e) {
       if (e instanceof McpServerWantsSignIn && spec.transport.kind === "http") {
         this.markNeedsSignIn(spec.transport.url, scope.tenant);
diff --git a/src/daemon/memory/engine.ts b/src/daemon/memory/engine.ts
index be2665d0..584ae579 100644
--- a/src/daemon/memory/engine.ts
+++ b/src/daemon/memory/engine.ts
@@ -200,7 +200,16 @@ export class MemoryEngine {
    * the full body is kept verbatim, and only a bounded view of it is
    * full-text indexed and embedded (lossless.ts explains the split).
    */
-  ingest(episode: Omit<Episode, "id">): Episode {
+  /**
+   * Applied to an episode's text before it is stored (docs/secrets-and-memory-design.md §2.6):
+   * the daemon's secret scrubbing, so nothing that ingests — a session, a raw-output spill,
+   * an import — stores a secret's value. Unset: stored as given.
+   */
+  scrubText: ((text: string, ctx: { workstream?: string; sessionId?: string }) => string) | undefined;
+
+  ingest(raw: Omit<Episode, "id">): Episode {
+    const ctx = { ...(raw.workstreamId ? { workstream: raw.workstreamId } : {}), sessionId: raw.sessionId };
+    const episode = this.scrubText ? { ...raw, summary: this.scrubText(raw.summary, ctx), content: this.scrubText(raw.content, ctx) } : raw;
     const view = indexView(episode.content);
     const saved = this.#store.insert(
       view === episode.content ? episode : { ...episode, content: view, fullContent: episode.content },
diff --git a/src/daemon/providers/canonical.ts b/src/daemon/providers/canonical.ts
index 88a90902..2bf2d1b9 100644
--- a/src/daemon/providers/canonical.ts
+++ b/src/daemon/providers/canonical.ts
@@ -392,6 +392,21 @@ export class CanonicalHistoryAccumulator {
   #currentTurnId: string | undefined;
   /** Notified after every committed change (see CanonicalHistoryChange). */
   onChange: ((change: CanonicalHistoryChange) => void) | undefined;
+  /**
+   * Applied to every turn as it is committed, before it is kept or persisted:
+   * the session's secret scrubbing (docs/secrets-and-memory-design.md §2), so
+   * no backend is ever seeded with a value codeoid wouldn't store.
+   */
+  scrubTurn: ((turn: CanonicalTurn) => CanonicalTurn) | undefined;
+
+  #scrubbed(turn: CanonicalTurn): CanonicalTurn {
+    if (!this.scrubTurn) return turn;
+    try {
+      return this.scrubTurn(turn);
+    } catch {
+      return turn;
+    }
+  }
 
   // In-progress assistant turn state — reset on each turn_done.
   #currentText = "";
@@ -422,14 +437,14 @@ export class CanonicalHistoryAccumulator {
     turnId?: string,
     extra?: { prompt?: string; at?: string; background?: boolean },
   ): void {
-    const turn: CanonicalTurn = {
+    const turn: CanonicalTurn = this.#scrubbed({
       role: "user",
       content,
       ...(turnId ? { turnId } : {}),
       ...(extra?.prompt !== undefined && extra.prompt !== content ? { prompt: extra.prompt } : {}),
       ...(extra?.at ? { at: extra.at } : {}),
       ...(extra?.background ? { background: true } : {}),
-    };
+    });
     this.#currentTurnId = turnId;
     this.#lastTextBlock = null;
     this.#history.push(turn);
@@ -503,7 +518,7 @@ export class CanonicalHistoryAccumulator {
         const produced =
           this.#currentText.length > 0 || toolCalls.length > 0 || this.#currentThinking.length > 0;
         if (produced) {
-          const turn: CanonicalTurn = {
+          const turn: CanonicalTurn = this.#scrubbed({
             role: "assistant",
             content: this.#currentText,
             ...(this.#currentTurnId ? { turnId: this.#currentTurnId } : {}),
@@ -512,7 +527,7 @@ export class CanonicalHistoryAccumulator {
             providerId: event.result.providerId,
             model: event.result.model,
             ...(event.result.nativeRef ? { native: event.result.nativeRef } : {}),
-          };
+          });
           this.#history.push(turn);
           this.#emit({ op: "append", turn });
         }
diff --git a/src/daemon/secrets/detect.ts b/src/daemon/secrets/detect.ts
new file mode 100644
index 00000000..2cf04f07
--- /dev/null
+++ b/src/daemon/secrets/detect.ts
@@ -0,0 +1,207 @@
+/**
+ * Credentials found by shape (docs/secrets-and-memory-design.md §2.3): a
+ * service's token format, a private key's armour, a URL's password, an
+ * `Authorization` header, a value assigned to a name like `DB_PASSWORD` or
+ * `"api_key"`.
+ *
+ * The tables follow atuin's (`atuin-common/src/secrets.rs`, `vendors.rs`,
+ * `structural.rs`; MIT), which follow gitleaks' (MIT) where a format has a
+ * prefix of its own. Only known shapes and values bound to secret-named keys
+ * are found, never "looks random", so hashes, ids and paths survive. Each
+ * pattern's `secret` group is the part replaced; a name or flag around it is
+ * kept (`DB_PASSWORD=‹secret:password:9c2e41aa›`).
+ *
+ * Every pattern is linear (no nested quantifiers), and each match is bounded,
+ * so a scan is proportional to the text.
+ */
+
+export interface SecretSpan {
+  start: number;
+  end: number;
+  /** A slug for the reference: `github-token`, `password`, `private-key`, … */
+  kind: string;
+}
+
+interface Pattern {
+  kind: string;
+  re: RegExp;
+  /** A structural or named value that is plainly not a credential is left as it is. */
+  check?: "placeholder" | "word";
+}
+
+/** Not inside a longer token: no letter, digit or `_` just before. */
+const B = "(?<![A-Za-z0-9_])";
+/** Nor just after. */
+const E = "(?![A-Za-z0-9_])";
+
+const vendor = (kind: string, body: string): Pattern => ({ kind, re: new RegExp(`${B}(?<secret>${body})${E}`, "g") });
+
+/** Formats with a prefix of their own: they can't be mistaken for anything else. */
+const VENDOR: Pattern[] = [
+  vendor("anthropic-key", "sk-ant-(?:api|admin|oat|ort)[0-9]{2}-[A-Za-z0-9_-]{60,300}"),
+  vendor("openai-key", "sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,300}|sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}"),
+  vendor("openrouter-key", "sk-or-v1-[a-f0-9]{64}"),
+  vendor("groq-key", "gsk_[A-Za-z0-9]{52}"),
+  vendor("xai-key", "xai-[A-Za-z0-9]{60,200}"),
+  vendor("perplexity-key", "pplx-[A-Za-z0-9]{48}"),
+  vendor("pinecone-key", "pcsk_[A-Za-z0-9_]{50,200}"),
+  vendor("langsmith-key", "lsv2_(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{10}"),
+  vendor("google-key", "AIza[0-9A-Za-z_-]{35}"),
+  vendor("huggingface-token", "hf_[A-Za-z]{34}|api_org_[A-Za-z]{34}"),
+  vendor("digitalocean-token", "do[opr]_v1_[a-f0-9]{64}"),
+  vendor("sendgrid-key", "SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}"),
+  vendor("brevo-key", "xkeysib-[a-f0-9]{64}-[A-Za-z0-9]{16}"),
+  vendor("linear-key", "lin_api_[A-Za-z0-9]{40}"),
+  vendor("doppler-token", "dp\\.(?:pt|st|ct|sa|scim|audit)\\.[A-Za-z0-9]{40,44}"),
+  vendor("shopify-token", "shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}"),
+  vendor("databricks-token", "dapi[a-f0-9]{32}(?:-[0-9])?"),
+  vendor("pypi-token", "pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,300}"),
+  vendor("rubygems-key", "rubygems_[a-f0-9]{48}"),
+  vendor("notion-token", "ntn_[0-9]{11}[A-Za-z0-9]{35}"),
+  vendor("atlassian-token", "ATATT3[A-Za-z0-9_=-]{60,300}"),
+  vendor("age-key", "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}"),
+  vendor("onepassword-token", "ops_eyJ[A-Za-z0-9+/]{60,2000}={0,3}"),
+  vendor(
+    "slack-token",
+    "xox[bpe](?:-[0-9]{10,13}){2,3}-[A-Za-z0-9-]{24,34}|xapp-[0-9]-[A-Z0-9]{1,20}-[0-9]{1,20}-[a-z0-9]{1,100}|xoxe(?:\\.xox[bp])?-[0-9]-[A-Za-z0-9]{60,300}|xox[ar]-(?:[0-9]-)?[0-9a-zA-Z]{8,48}|xox[os]-[0-9]{1,20}-[0-9]{1,20}-[0-9]{1,20}-[a-fA-F0-9]{1,100}",
+  ),
+  vendor("slack-webhook", "T[A-Za-z0-9_]{8}/B[A-Za-z0-9_]{8}/[A-Za-z0-9_]{24}"),
+  vendor(
+    "gitlab-token",
+    "glpat-[A-Za-z0-9_-]{20,100}(?:\\.[0-9a-z]{9})?|glptt-[0-9a-f]{40}|glrt-[A-Za-z0-9_-]{20,100}(?:\\.[0-9a-z]{9})?|gl(?:dt|ft|soat|ffct)-[A-Za-z0-9_-]{20}|glcbt-[A-Za-z0-9]{1,5}_[A-Za-z0-9_-]{20}|glagent-[A-Za-z0-9_-]{50}|glimt-[A-Za-z0-9_-]{25}|gloas-[A-Za-z0-9_-]{64}|GR1348941[A-Za-z0-9_-]{20}",
+  ),
+  vendor("grafana-token", "glc_[A-Za-z0-9+/]{32,400}={0,3}|glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}|eyJrIjoi[A-Za-z0-9]{60,400}={0,3}"),
+  vendor("sentry-token", "sntryu_[a-f0-9]{64}|sntrys_eyJ[A-Za-z0-9+/=_]{40,400}"),
+  vendor("vault-token", "hvs\\.[A-Za-z0-9_-]{60,300}|hvb\\.[A-Za-z0-9_-]{60,300}"),
+  vendor("terraform-token", "[A-Za-z0-9]{14}\\.atlasv1\\.[A-Za-z0-9_=-]{60,70}"),
+  vendor("planetscale-token", "pscale_(?:tkn|oauth|pw)_[A-Za-z0-9_=.-]{32,64}"),
+  vendor("postman-key", "PMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}"),
+  vendor("readme-key", "rdme_[a-z0-9]{70}"),
+  vendor("prefect-key", "pnu_[A-Za-z0-9]{36}"),
+  vendor("heroku-key", "HRKU-AA[A-Za-z0-9_-]{58}"),
+  vendor("supabase-key", "sb_secret_[A-Za-z0-9_-]{31,100}|sbp_[a-f0-9]{40}"),
+  vendor("artifactory-key", "AKCp[A-Za-z0-9]{69}"),
+  vendor("bedrock-key", "ABSK[A-Za-z0-9+/]{60,400}={0,2}"),
+  vendor("flyio-token", "fo1_[A-Za-z0-9_-]{43}|fm[12][ar]?_[A-Za-z0-9+/]{60,1000}={0,3}"),
+  vendor("dynatrace-token", "dt0c01\\.[A-Za-z0-9]{24}\\.[A-Za-z0-9]{64}"),
+  vendor("square-token", "sq0atp-[A-Za-z0-9_-]{22,60}|sq0csp-[A-Za-z0-9_-]{43}"),
+  vendor("stripe-key", "(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,200}|sk_prod_[A-Za-z0-9]{24,200}"),
+  vendor("dockerhub-token", "dckr_pat_[A-Za-z0-9_-]{27}"),
+  vendor("tailscale-key", "tskey-(?:api|auth|client|scim|webhook)-[A-Za-z0-9]{8,40}-[A-Za-z0-9]{20,100}"),
+  vendor("azure-secret", "[A-Za-z0-9_~.]{3}[0-9]Q~[A-Za-z0-9_~.-]{31,34}"),
+  vendor("telegram-token", "[0-9]{8,10}:AA[A-Za-z0-9_-]{33}"),
+  vendor("discord-webhook", "https://(?:ptb\\.|canary\\.)?discord(?:app)?\\.com/api/webhooks/[0-9]{1,30}/[A-Za-z0-9_-]{60,100}"),
+  vendor("openshift-token", "sha256~[A-Za-z0-9_-]{43}"),
+  vendor("aws-key-id", "A[KS]IA[0-9A-Z]{16}"),
+  vendor("github-token", "gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255}"),
+  vendor("netlify-token", "nf[pcoub]_[0-9a-zA-Z]{36}"),
+  vendor("npm-token", "npm_[A-Za-z0-9]{36}"),
+  vendor("pulumi-token", "pul-[0-9a-f]{40}"),
+  vendor("zeroid-key", "zid_sk_[A-Za-z0-9_-]{16,200}"),
+  vendor("highflame-key", "hf_sk_[A-Za-z0-9_-]{16,200}"),
+];
+
+/** Credentials recognised by where they sit. */
+const STRUCTURAL: Pattern[] = [
+  {
+    kind: "private-key",
+    re: /-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----(?<secret>[\s\S]{1,20000}?)(?:-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----|$)/g,
+  },
+  { kind: "jwt", re: new RegExp(`(?:${B}|(?<=\\\\[nrt]))(?<secret>eyJ[A-Za-z0-9_-]{10,4000}\\.eyJ[A-Za-z0-9_-]{10,8000}\\.[A-Za-z0-9_-]{10,2000})`, "g") },
+  { kind: "bearer-token", re: /(?<![A-Za-z0-9_])bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder" },
+  { kind: "authorization", re: /(?<![A-Za-z0-9_])authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder" },
+  { kind: "password", re: /(?<![A-Za-z0-9_])curl\b[^\n]{0,2000}?[ \t](?:-u|--user)(?:=|[ \t]+)["']?[^:\s"']{0,200}:(?<secret>[^\s"']{1,500})/g, check: "placeholder" },
+  { kind: "password", re: /(?<![A-Za-z0-9_])[a-z][a-z0-9+.-]{1,31}:\/\/[^\s/?#@"'`<>:]{0,200}:(?<secret>[^\s/?#@"'`<>]{1,500})@/gi, check: "placeholder" },
+  { kind: "password", re: /(?:^|[?&;\s-])(?:password|pwd)=(?<secret>"[^"\n]{0,500}"|'[^'\n]{0,500}'|[^&;\s"'`]{0,500}[^&;\s"'`,])/gim, check: "placeholder" },
+  { kind: "aws-secret", re: /aws_secret_access_key["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?(?<secret>[A-Za-z0-9/+]{40,100})/gi },
+  { kind: "twilio-key", re: new RegExp(`${B}(?<secret>SK[0-9a-fA-F]{32})${E}`, "g") },
+];
+
+/** The words an environment variable's name ends with when it holds a credential. */
+const ENV_NAME = "(?<![A-Za-z0-9_])[A-Z0-9_]{0,100}(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIALS?|AUTH)S?(?![A-Za-z0-9_])";
+/** The same as code, JSON and config files spell them; not `auth` alone, nor `tokens` (`max_tokens`). */
+const CODE_NAME =
+  "[\\w.-]{0,100}?(?:passw(?:or)?d|passphrase|secret|api[_-]?key|private[_-]?key|access[_-]?key|(?:auth|access|refresh|bearer|id|session)[_-]?token|token)";
+const SEPARATOR = `["'\\]]?[ \\t]*(?::=|=>|\\?=|[=:])[ \\t]*`;
+const QUOTED = `"(?:[^"\\\\\\n]|\\\\.){6,1000}"|'[^'\\n]{6,1000}'`;
+
+/** Values assigned to a name a credential is kept under. */
+const NAMED: Pattern[] = [
+  { kind: "credential", re: new RegExp(`${ENV_NAME}${SEPARATOR}(?<secret>${QUOTED}|[^\\s"'\`,;)\\]}{(<>]{6,1000})`, "g"), check: "word" },
+  { kind: "credential", re: new RegExp(`(?:^|[^A-Za-z0-9_.-])["']?${CODE_NAME}${SEPARATOR}(?<secret>${QUOTED})`, "gi"), check: "word" },
+  {
+    kind: "password",
+    re: /(?:^|[ \t])--passw(?:or)?d[ \t]+(?<secret>"(?:[^"\\\n]|\\.){1,500}"|'[^'\n]{1,500}'|(?:[^\s"'\\<>[{()|&;`-][^\s"'\\|&;<>()`]{0,500}?)?[^A-Za-z\s"'\\.,:;()[\]{}<>|&`-][^\s"'\\|&;<>()`]{0,500})(?=[\s"';&|)\\]|$)/g,
+    check: "placeholder",
+  },
+  {
+    kind: "credential",
+    re: new RegExp(`^\\+?[ \\t]*(?:-[ \\t]+)?["']?${CODE_NAME}["']?[ \\t]*[:=][ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\n#="]{0,1000}?)[ \\t]*$`, "gim"),
+    check: "word",
+  },
+];
+
+/** With indices (`d`), so the `secret` group's position is exact. */
+const PATTERNS: readonly Pattern[] = [...VENDOR, ...STRUCTURAL, ...NAMED].map((p) => ({ ...p, re: new RegExp(p.re.source, p.re.flags.includes("d") ? p.re.flags : `${p.re.flags}d`) }));
+
+/** The references codeoid writes itself: never taken for a secret again. */
+const OWN_REFERENCE = /^‹(?:credential|secret|output withheld|not stored)[:\s›]/;
+
+const STAND_INS = new Set([
+  "changeme", "change_me", "change-me", "example", "password", "passwd", "secret", "token", "your_password", "your-password",
+  "yourpassword", "your_token", "your_api_key", "redacted", "placeholder", "dummy", "undefined", "required", "optional",
+]);
+const TYPES = new Set(["str", "string", "bool", "boolean", "int", "integer", "number", "float", "any", "object", "bytes", "char", "none", "null", "nil", "true", "false"]);
+
+/** A value that plainly isn't a credential: a reference to one (`$TOKEN`, `${{ secrets.X }}`), a stand-in, a run of one character. */
+export function isPlaceholder(raw: string): boolean {
+  const value = raw.trim().replace(/^["'\\]+|["'\\]+$/g, "").trim();
+  if (value.length === 0) return true;
+  if (OWN_REFERENCE.test(value)) return true;
+  const lower = value.toLowerCase();
+  if (["$", "%", "{{", "os.environ", "process.env", "env.", "env(", "env[", "getenv"].some((r) => lower.startsWith(r))) return true;
+  if (value.length > 2 && value.startsWith("<") && value.endsWith(">") && /^[A-Za-z_\- ]+$/.test(value.slice(1, -1))) return true;
+  const first = value[0]!;
+  if (value.length >= 3 && "*x.-•".includes(first) && [...value].every((c) => c === first)) return true;
+  return STAND_INS.has(lower);
+}
+
+/** {@link isPlaceholder}, or, unquoted, a type or code: what a name's value in code is far more often than a credential. */
+function isWord(raw: string): boolean {
+  const value = raw.trim();
+  if (isPlaceholder(value)) return true;
+  if (value.startsWith('"') || value.startsWith("'") || /[0-9]/.test(value)) return false;
+  return /[<>[\]&:(){},;]/.test(value) || TYPES.has(value.toLowerCase());
+}
+
+/**
+ * Every credential found in `text`, by position, overlaps merged (the
+ * earliest start wins, and a span reaches as far as any overlapping one).
+ * `deadline` (a `performance.now()` value) is checked between patterns:
+ * past it, null — the caller must not store what couldn't be checked.
+ */
+export function findSecrets(text: string, deadline = Number.POSITIVE_INFINITY): SecretSpan[] | null {
+  const spans: SecretSpan[] = [];
+  for (const p of PATTERNS) {
+    if (performance.now() > deadline) return null;
+    p.re.lastIndex = 0;
+    for (const m of text.matchAll(p.re)) {
+      const secret = m.groups?.secret;
+      const at = m.indices?.groups?.secret;
+      if (secret === undefined || secret.length === 0 || !at) continue;
+      if (p.check === "placeholder" && isPlaceholder(secret)) continue;
+      if (p.check === "word" && isWord(secret)) continue;
+      // A quoted value keeps its quotes: `"api_key": "‹secret:…›"` still reads as JSON.
+      const quoted = secret.length >= 2 && (secret[0] === '"' || secret[0] === "'") && secret.at(-1) === secret[0];
+      spans.push({ start: at[0] + (quoted ? 1 : 0), end: at[1] - (quoted ? 1 : 0), kind: p.kind });
+    }
+  }
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const merged: SecretSpan[] = [];
+  for (const s of spans) {
+    const last = merged[merged.length - 1];
+    if (last && s.start < last.end) last.end = Math.max(last.end, s.end);
+    else merged.push({ ...s });
+  }
+  return merged;
+}
diff --git a/src/daemon/secrets/files.ts b/src/daemon/secrets/files.ts
new file mode 100644
index 00000000..7db0f56a
--- /dev/null
+++ b/src/daemon/secrets/files.ts
@@ -0,0 +1,62 @@
+/**
+ * Files whose contents are credentials (`.env`, `~/.ssh/id_ed25519`,
+ * `~/.aws/credentials`, an agent's own login), after atuin's
+ * `atuin-common/src/secrets/files.rs` (MIT). What reads one out, or writes
+ * one, isn't stored (verdict.ts): such a file holds nothing else, in
+ * whatever format, so scrubbing by shape would miss whatever it can't name.
+ */
+
+import { homedir } from "node:os";
+import { basename, isAbsolute, join, normalize, resolve } from "node:path";
+
+/** Names that say a file holds credentials, wherever it is (`*` within the name). */
+const NAMES = [
+  ".env", ".env.*", "*.env", ".envrc", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", "id_ecdsa_sk", "id_ed25519_sk",
+  "*.pem", "*.key", "*.p12", "*.pfx", "*.jks", "*.keystore", "*.tfstate", "*.tfstate.backup", "*.tfvars",
+  ".netrc", "_netrc", ".pgpass", ".git-credentials", ".npmrc", ".pypirc", ".htpasswd", ".vault-token",
+];
+
+/** Of those, templates and public halves. */
+const NOT_NAMES = ["*.example", "*.sample", "*.template", "*.dist", "*.pub"];
+
+/** Where tools keep their logins, under the home (`**` any depth below). */
+const HOME_PATHS = [
+  ".aws/credentials", ".aws/sso/cache/**", ".aws/cli/cache/**",
+  ".config/gcloud/application_default_credentials.json", ".config/gcloud/credentials.db", ".config/gcloud/access_tokens.db",
+  ".config/gcloud/legacy_credentials/**", ".azure/msal_token_cache.*", ".kube/config", ".docker/config.json",
+  ".config/gh/hosts.yml", ".config/glab-cli/config.yml", ".config/hub", ".terraform.d/credentials.tfrc.json",
+  ".cargo/credentials", ".cargo/credentials.toml", ".gem/credentials", ".gnupg/private-keys-v1.d/**", ".password-store/**",
+  ".claude/.credentials.json", ".codex/auth.json", ".local/share/opencode/auth.json", ".pi/agent/auth.json",
+  ".gemini/oauth_creds.json", ".qwen/oauth_creds.json",
+];
+
+function globToRegExp(glob: string): RegExp {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i]!;
+    if (c === "*" && glob[i + 1] === "*") {
+      re += ".*";
+      i++;
+    } else if (c === "*") re += "[^/]*";
+    else re += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+
+const NAME_RES = NAMES.map(globToRegExp);
+const NOT_NAME_RES = NOT_NAMES.map(globToRegExp);
+
+/** Whether `path` (relative ones from `cwd`) is a file that holds credentials. `extra`: the user's own globs, by name or by path. */
+export function isCredentialFile(path: string, cwd: string, extra: readonly string[] = []): boolean {
+  const home = process.env.HOME ?? homedir();
+  const expanded = path === "~" ? home : path.startsWith("~/") ? join(home, path.slice(2)) : path;
+  const abs = normalize(isAbsolute(expanded) ? expanded : resolve(cwd, expanded));
+  const name = basename(abs);
+  if (NAME_RES.some((r) => r.test(name)) && !NOT_NAME_RES.some((r) => r.test(name))) return true;
+  for (const p of HOME_PATHS) if (globToRegExp(join(home, p)).test(abs)) return true;
+  for (const g of extra) {
+    const pattern = g.startsWith("~/") ? join(home, g.slice(2)) : g;
+    if ((pattern.includes("/") ? globToRegExp(pattern).test(abs) : globToRegExp(pattern).test(name))) return true;
+  }
+  return false;
+}
diff --git a/src/daemon/secrets/fingerprint.ts b/src/daemon/secrets/fingerprint.ts
new file mode 100644
index 00000000..88b33c6e
--- /dev/null
+++ b/src/daemon/secrets/fingerprint.ts
@@ -0,0 +1,63 @@
+/**
+ * A detected secret's fingerprint (docs/secrets-and-memory-design.md §2.3):
+ * HMAC-SHA256 of the value under a key made once per daemon, truncated to 8
+ * hex characters. The same secret seen in three sessions has the same
+ * reference; without the key a fingerprint can't be checked against a guess.
+ *
+ * The key lives in `<config dir>/secrets/fingerprint.key` (0600, in a 0700
+ * dir that every sandbox hides and the gate refuses: secretMaterialDir).
+ */
+
+import { createHmac, randomBytes } from "node:crypto";
+import { closeSync, constants as fsc, fstatSync, mkdirSync, openSync, readSync, writeSync } from "node:fs";
+import { join } from "node:path";
+
+/** Where codeoid keeps the keys for secret handling. */
+export function secretMaterialDir(configDir: string): string {
+  return join(configDir, "secrets");
+}
+
+const KEY_BYTES = 32;
+
+/**
+ * Read a key file, or make it once: created with O_EXCL, never through a
+ * link, so a planted file or link is refused rather than used.
+ */
+export function loadOrCreateKey(dir: string, name: string): Buffer {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = join(dir, name);
+  try {
+    const fd = openSync(path, fsc.O_RDONLY | fsc.O_NOFOLLOW | fsc.O_NONBLOCK);
+    try {
+      const st = fstatSync(fd);
+      if (!st.isFile() || st.size !== KEY_BYTES) throw new Error(`${path} isn't a ${KEY_BYTES}-byte key file`);
+      const buf = Buffer.alloc(KEY_BYTES);
+      if (readSync(fd, buf, 0, KEY_BYTES, 0) !== KEY_BYTES) throw new Error(`${path} couldn't be read whole`);
+      return buf;
+    } finally {
+      closeSync(fd);
+    }
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+  }
+  const key = randomBytes(KEY_BYTES);
+  const fd = openSync(path, fsc.O_WRONLY | fsc.O_CREAT | fsc.O_EXCL | fsc.O_NOFOLLOW, 0o600);
+  try {
+    writeSync(fd, key);
+  } finally {
+    closeSync(fd);
+  }
+  return key;
+}
+
+export class Fingerprinter {
+  readonly #key: Buffer;
+
+  constructor(key: Buffer) {
+    this.#key = key;
+  }
+
+  of(value: string): string {
+    return createHmac("sha256", this.#key).update(value).digest("hex").slice(0, 8);
+  }
+}
diff --git a/src/daemon/secrets/known.ts b/src/daemon/secrets/known.ts
new file mode 100644
index 00000000..acf0fefe
--- /dev/null
+++ b/src/daemon/secrets/known.ts
@@ -0,0 +1,165 @@
+/**
+ * Secrets codeoid already knows (docs/secrets-and-memory-design.md §2.2):
+ * values it put there itself — a workstream's credential, an MCP server's
+ * OAuth token, a backend's key, the daemon's own — replaced by exact match
+ * wherever they show up, as `‹credential:<label>›`. No guessing, so no false
+ * positives, and nothing new is stored: the value stays where it lives.
+ *
+ * Sources register a function that lists their values; the set is rebuilt
+ * when one says it changed (`invalidate`) or after a minute, whichever comes
+ * first (an OAuth token refreshes without telling anyone).
+ */
+
+/** Shorter than this and a value would match ordinary text. */
+export const MIN_KNOWN_LENGTH = 8;
+const REBUILD_MS = 60_000;
+
+export interface KnownSecret {
+  /** What the reference names: `gh-saucam`, `oauth:linear`, `daemon:ANTHROPIC_API_KEY`. */
+  label: string;
+  value: string;
+  /** The reference written in its place; default `‹credential:<label>›`. */
+  ref?: string;
+}
+
+export type KnownSecretSource = () => Iterable<KnownSecret>;
+
+/** One form a value can be written in, longest first so a longer form wins over a shorter one inside it. */
+interface Needle {
+  text: string;
+  label: string;
+  ref: string;
+}
+
+export class KnownSecrets {
+  readonly #sources = new Map<string, KnownSecretSource>();
+  #needles: Needle[] | null = null;
+  #builtAt = 0;
+  #version = 0;
+
+  /** Add a source; returns a function that removes it. */
+  register(name: string, source: KnownSecretSource): () => void {
+    this.#sources.set(name, source);
+    this.invalidate();
+    return () => {
+      if (this.#sources.get(name) === source) {
+        this.#sources.delete(name);
+        this.invalidate();
+      }
+    };
+  }
+
+  /** A source's values changed (a credential edited, a token refreshed). */
+  invalidate(): void {
+    this.#needles = null;
+    this.#version++;
+  }
+
+  /** Bumped on every change: a cache keyed by it is never stale. */
+  get version(): number {
+    return this.#version;
+  }
+
+  #build(): Needle[] {
+    const byText = new Map<string, { label: string; ref: string }>();
+    for (const [name, source] of this.#sources) {
+      let entries: Iterable<KnownSecret>;
+      try {
+        entries = source();
+      } catch (err) {
+        console.error(`[codeoid/secrets] known-secret source ${name} failed: ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
+      for (const { label, value, ref } of entries) {
+        if (typeof value !== "string" || value.length < MIN_KNOWN_LENGTH) continue;
+        for (const form of formsOf(value)) if (!byText.has(form)) byText.set(form, { label, ref: ref ?? credentialRef(label) });
+      }
+    }
+    return [...byText].map(([text, n]) => ({ text, ...n })).sort((a, b) => b.text.length - a.text.length);
+  }
+
+  #current(): Needle[] {
+    if (!this.#needles || Date.now() - this.#builtAt > REBUILD_MS) {
+      this.#needles = this.#build();
+      this.#builtAt = Date.now();
+    }
+    return this.#needles;
+  }
+
+  /** The longest form any value is written in: how much a streaming scrubber must hold back. */
+  get longest(): number {
+    return this.#current()[0]?.text.length ?? 0;
+  }
+
+  /** `text` with every known value replaced by its reference, and the labels and references found. */
+  replace(text: string): { text: string; labels: string[]; refs: string[] } {
+    const needles = this.#current();
+    if (needles.length === 0 || text.length < MIN_KNOWN_LENGTH) return { text, labels: [], refs: [] };
+    const labels = new Set<string>();
+    const refs = new Set<string>();
+    let out = text;
+    for (const n of needles) {
+      if (!out.includes(n.text)) continue;
+      out = out.split(n.text).join(n.ref);
+      labels.add(n.label);
+      refs.add(n.ref);
+    }
+    return { text: out, labels: [...labels], refs: [...refs] };
+  }
+}
+
+/** The reference a known value is replaced by. */
+export function credentialRef(label: string): string {
+  return `‹credential:${label}›`;
+}
+
+/** How a value can be written: as it is, URL-encoded, and as Basic auth's base64 of `user:value` and `value:`. */
+function formsOf(value: string): string[] {
+  const forms = [value];
+  const encoded = encodeURIComponent(value);
+  if (encoded !== value) forms.push(encoded);
+  // Basic auth carries `user:password` base64'd: a value used as the password
+  // with an empty user, or as a token user with no password, is common enough.
+  for (const pair of [`:${value}`, `${value}:`, `x-access-token:${value}`]) {
+    const b64 = Buffer.from(pair).toString("base64");
+    forms.push(b64.replace(/=+$/, ""));
+  }
+  return forms;
+}
+
+/** Most values remembered by {@link LearnedSecrets}; the oldest are let go past it. */
+const MAX_LEARNED = 2000;
+
+/**
+ * Secrets found by shape, remembered (in memory only, never stored) so the
+ * same value is replaced wherever it shows up later, even bare: a password
+ * found as `DB_PASSWORD=…` in a tool's output, repeated in a reply.
+ */
+export class LearnedSecrets {
+  readonly #values = new Map<string, KnownSecret>();
+  #onChange: () => void = () => {};
+
+  /** Called when a new value is learned (the known set rebuilds). */
+  onChange(fn: () => void): void {
+    this.#onChange = fn;
+  }
+
+  /** Remember a value; true when it is new. */
+  learn(value: string, ref: string): boolean {
+    if (value.length < MIN_KNOWN_LENGTH || this.#values.has(value)) return false;
+    this.#values.set(value, { label: "learned", value, ref });
+    while (this.#values.size > MAX_LEARNED) this.#values.delete(this.#values.keys().next().value!);
+    this.#onChange();
+    return true;
+  }
+
+  values(): Iterable<KnownSecret> {
+    return this.#values.values();
+  }
+
+  /** The value a learned reference stands for. */
+  valueOf(ref: string): string | undefined {
+    for (const k of this.#values.values()) if (k.ref === ref) return k.value;
+    return undefined;
+  }
+}
diff --git a/src/daemon/secrets/scrub-stored.ts b/src/daemon/secrets/scrub-stored.ts
new file mode 100644
index 00000000..8c22035d
--- /dev/null
+++ b/src/daemon/secrets/scrub-stored.ts
@@ -0,0 +1,150 @@
+/**
+ * `codeoid secret scrub` (docs/secrets-and-memory-design.md §2.6): rewrite
+ * what was stored before secret handling, with values codeoid knows and
+ * secrets found by shape replaced by references. Run with the daemon
+ * stopped (the caller holds its data locks), so nothing appends meanwhile.
+ *
+ * Rewrites: every transcript, canonical-history and turn-index log
+ * (`<transcriptDir>/*.jsonl`), memory episodes and their full bodies (the
+ * FTS index follows by trigger), and dispatch tasks' prompts and result
+ * digests. Embeddings are left as they are: a vector holds no recoverable
+ * text. A file is replaced whole (written beside it, renamed over), so a
+ * crash leaves the old file or the new one, never half of each.
+ */
+
+import { Database } from "bun:sqlite";
+import { closeSync, existsSync, fsyncSync, openSync, readdirSync, readFileSync, renameSync, statSync, writeSync } from "node:fs";
+import { join } from "node:path";
+
+export interface ScrubReport {
+  files: number;
+  filesChanged: number;
+  linesChanged: number;
+  episodesChanged: number;
+  tasksChanged: number;
+}
+
+type ScrubFn = <T>(value: T) => { value: T; changed: boolean };
+
+/** Scrub one JSONL file's lines; returns how many changed. Unparseable lines are scrubbed as text. */
+export function scrubJsonlFile(path: string, scrub: ScrubFn, dryRun: boolean): number {
+  const text = readFileSync(path, "utf8");
+  const lines = text.split("\n");
+  let changed = 0;
+  const out = lines.map((line) => {
+    if (!line) return line;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      const r = scrub(line);
+      if (r.changed) changed++;
+      return r.value;
+    }
+    const r = scrub(parsed);
+    if (!r.changed) return line;
+    changed++;
+    return JSON.stringify(r.value);
+  });
+  if (changed > 0 && !dryRun) replaceFile(path, out.join("\n"));
+  return changed;
+}
+
+function replaceFile(path: string, content: string): void {
+  const tmp = `${path}.scrub-${process.pid}`;
+  const mode = statSync(path).mode & 0o777;
+  const fd = openSync(tmp, "wx", mode);
+  try {
+    writeSync(fd, content);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, path);
+}
+
+/** Every `*.jsonl` directly in the transcript dir. */
+export function scrubTranscripts(dir: string, scrub: ScrubFn, dryRun: boolean): Pick<ScrubReport, "files" | "filesChanged" | "linesChanged"> {
+  const report = { files: 0, filesChanged: 0, linesChanged: 0 };
+  if (!existsSync(dir)) return report;
+  for (const name of readdirSync(dir)) {
+    if (!name.endsWith(".jsonl")) continue;
+    const path = join(dir, name);
+    try {
+      if (!statSync(path).isFile()) continue;
+    } catch {
+      continue;
+    }
+    report.files++;
+    const n = scrubJsonlFile(path, scrub, dryRun);
+    if (n > 0) {
+      report.filesChanged++;
+      report.linesChanged += n;
+    }
+  }
+  return report;
+}
+
+/** Memory episodes: summary and content (FTS follows by trigger), and full bodies kept apart. */
+export function scrubMemoryDb(dbPath: string, scrub: ScrubFn, dryRun: boolean): number {
+  if (!existsSync(dbPath)) return 0;
+  const db = new Database(dbPath);
+  let changed = 0;
+  try {
+    const update = db.prepare("UPDATE episodes SET summary = ?, content = ? WHERE id = ?");
+    const rows = db.prepare("SELECT id, summary, content FROM episodes").all() as Array<{ id: string; summary: string; content: string }>;
+    const tx = db.transaction(() => {
+      for (const r of rows) {
+        const s = scrub(r.summary);
+        const c = scrub(r.content);
+        if (!s.changed && !c.changed) continue;
+        changed++;
+        if (!dryRun) update.run(s.value, c.value, r.id);
+      }
+      const payloads = db.prepare("SELECT episode_id, encoding, data FROM episode_payloads").all() as Array<{ episode_id: string; encoding: string; data: Uint8Array }>;
+      const updatePayload = db.prepare("UPDATE episode_payloads SET chars = ?, data = ? WHERE episode_id = ?");
+      for (const p of payloads) {
+        if (p.encoding !== "zstd") continue;
+        const body = Buffer.from(Bun.zstdDecompressSync(p.data)).toString("utf8");
+        const r = scrub(body);
+        if (!r.changed) continue;
+        changed++;
+        if (!dryRun) updatePayload.run(r.value.length, Bun.zstdCompressSync(Buffer.from(r.value, "utf8"), { level: 3 }), p.episode_id);
+      }
+    });
+    tx();
+  } finally {
+    db.close();
+  }
+  return changed;
+}
+
+/** Dispatch tasks' prompts and result digests in the daemon's database (the conductor reads them back). */
+export function scrubDispatchTasks(dbPath: string, scrub: ScrubFn, dryRun: boolean): number {
+  if (!existsSync(dbPath)) return 0;
+  const db = new Database(dbPath);
+  let changed = 0;
+  try {
+    const cols = new Set((db.prepare("PRAGMA table_info(dispatch_tasks)").all() as Array<{ name: string }>).map((c) => c.name));
+    if (!cols.has("prompt")) return 0;
+    const digest = cols.has("result_digest");
+    const rows = db.prepare(`SELECT id, prompt${digest ? ", result_digest" : ""} FROM dispatch_tasks`).all() as Array<{ id: string; prompt: string | null; result_digest?: string | null }>;
+    const update = db.prepare(`UPDATE dispatch_tasks SET prompt = ?${digest ? ", result_digest = ?" : ""} WHERE id = ?`);
+    const tx = db.transaction(() => {
+      for (const r of rows) {
+        const p = r.prompt ? scrub(r.prompt) : { value: r.prompt, changed: false };
+        const d = r.result_digest ? scrub(r.result_digest) : { value: r.result_digest ?? null, changed: false };
+        if (!p.changed && !d.changed) continue;
+        changed++;
+        if (!dryRun) {
+          if (digest) update.run(p.value, d.value, r.id);
+          else update.run(p.value, r.id);
+        }
+      }
+    });
+    tx();
+  } finally {
+    db.close();
+  }
+  return changed;
+}
diff --git a/src/daemon/secrets/scrub.ts b/src/daemon/secrets/scrub.ts
new file mode 100644
index 00000000..9480af54
--- /dev/null
+++ b/src/daemon/secrets/scrub.ts
@@ -0,0 +1,198 @@
+/**
+ * What codeoid stores never holds a secret's value
+ * (docs/secrets-and-memory-design.md §2): `scrub` replaces values codeoid
+ * knows with `‹credential:<label>›` (known.ts) and credentials found by shape
+ * with `‹secret:<kind>:<fingerprint>›` (detect.ts). A detected value is
+ * dropped, or handed to `onDetected` (the vault, where a workstream keeps
+ * them, §2.5).
+ *
+ * A text that can't be checked in time, or is too large to check, isn't
+ * stored: it becomes a `‹not stored: …›` note. Never the text unchecked.
+ */
+
+import { findSecrets } from "./detect.js";
+import type { Fingerprinter } from "./fingerprint.js";
+import type { KnownSecrets, LearnedSecrets } from "./known.js";
+
+/** atuin's budget: a text that can't be checked in this long isn't stored. */
+export const SCRUB_BUDGET_MS = 250;
+/** Larger than this and a text isn't checked, nor stored. */
+export const MAX_SCRUB_BYTES = 8 * 1024 * 1024;
+
+export const NOT_CHECKED = "‹not stored: it couldn't be checked for secrets in time›";
+export const TOO_LARGE = "‹not stored: it is too large to check for secrets›";
+
+export interface ScrubContext {
+  /** The home workstream of what is being stored (for the vault's policy and scoping). */
+  workstream?: string;
+  sessionId?: string;
+}
+
+export interface DetectedSecret {
+  kind: string;
+  fingerprint: string;
+  value: string;
+}
+
+export interface ScrubResult {
+  text: string;
+  /** Anything was replaced. */
+  changed: boolean;
+}
+
+export function secretRef(kind: string, fingerprint: string): string {
+  return `‹secret:${kind}:${fingerprint}›`;
+}
+
+export interface ScrubberOptions {
+  known: KnownSecrets;
+  /** Where a value found by shape is remembered, so it is matched exactly from then on. */
+  learned?: LearnedSecrets;
+  fingerprint: Fingerprinter;
+  /** A detected secret, with its value: the vault keeps it where the workstream says so. */
+  onDetected?: (secret: DetectedSecret, ctx: ScrubContext) => void;
+  budgetMs?: number;
+}
+
+export class Scrubber {
+  readonly #opts: ScrubberOptions;
+
+  constructor(opts: ScrubberOptions) {
+    this.#opts = opts;
+  }
+
+  get known(): KnownSecrets {
+    return this.#opts.known;
+  }
+
+  /** `text` with no secret's value in it. */
+  scrub(text: string, ctx: ScrubContext = {}): ScrubResult {
+    if (!text) return { text, changed: false };
+    if (text.length > MAX_SCRUB_BYTES) return { text: TOO_LARGE, changed: true };
+    const deadline = performance.now() + (this.#opts.budgetMs ?? SCRUB_BUDGET_MS);
+    const known = this.#opts.known.replace(text);
+    let out = known.text;
+    // A learned value matched exactly is still a detected secret: the vault keeps it where it is kept.
+    if (this.#opts.learned && this.#opts.onDetected) {
+      for (const ref of known.refs) {
+        const m = /^‹secret:([a-z0-9-]+):([0-9a-f]{8})›$/.exec(ref);
+        const value = m ? this.#opts.learned.valueOf(ref) : undefined;
+        if (m && value !== undefined) this.#detected({ kind: m[1]!, fingerprint: m[2]!, value }, ctx);
+      }
+    }
+    const spans = findSecrets(out, deadline);
+    if (spans === null) return { text: NOT_CHECKED, changed: true };
+    if (spans.length === 0) return { text: out, changed: known.labels.length > 0 };
+    let result = "";
+    let at = 0;
+    let learnedAny = false;
+    for (const s of spans) {
+      const value = out.slice(s.start, s.end);
+      const fp = this.#opts.fingerprint.of(value);
+      if (this.#opts.learned?.learn(value, secretRef(s.kind, fp))) learnedAny = true;
+      this.#detected({ kind: s.kind, fingerprint: fp, value }, ctx);
+      result += out.slice(at, s.start) + secretRef(s.kind, fp);
+      at = s.end;
+    }
+    out = result + out.slice(at);
+    // A value just learned may appear again in this text, bare: replaced too.
+    if (learnedAny) out = this.#opts.known.replace(out).text;
+    return { text: out, changed: true };
+  }
+
+  #detected(secret: DetectedSecret, ctx: ScrubContext): void {
+    if (!this.#opts.onDetected) return;
+    try {
+      this.#opts.onDetected(secret, ctx);
+    } catch (err) {
+      console.error(`[codeoid/secrets] keeping a detected secret failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  /** {@link scrub} applied to every string in a JSON-like value (a tool's input), structure kept. */
+  scrubValue<T>(value: T, ctx: ScrubContext = {}): { value: T; changed: boolean } {
+    let changed = false;
+    const walk = (v: unknown, depth: number): unknown => {
+      if (typeof v === "string") {
+        const r = this.scrub(v, ctx);
+        if (r.changed) changed = true;
+        return r.text;
+      }
+      if (depth > 32 || v === null || typeof v !== "object") return v;
+      if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
+      const out: Record<string, unknown> = {};
+      for (const [k, x] of Object.entries(v as Record<string, unknown>)) out[k] = walk(x, depth + 1);
+      return out;
+    };
+    const out = walk(value, 0) as T;
+    return { value: changed ? out : value, changed };
+  }
+}
+
+/** A line that may be naming a credential: held whole until it ends, so a pattern spanning spaces is matched whole. */
+const TRIGGER = /secret|token|passw|pwd|api[_-]?key|private|auth|bearer|credential|:\/\/|-----BEGIN|\bcurl\b|--user\b/i;
+/** The most held of one line (or one PEM block) before it is sent anyway, scrubbed as far as it has come. */
+const MAX_LINE_HOLD = 4096;
+const MAX_BLOCK_HOLD = 20_000;
+
+/**
+ * Scrubs text that arrives in pieces (an assistant's reply as it streams), so
+ * a secret split across pieces is never sent unscrubbed:
+ *
+ * - the trailing run of non-space characters is held until the next space or
+ *   the end (a token, a known value, is one run);
+ * - a line that may name a credential (`password: "two words"`, `Bearer …`,
+ *   a URL) is held until it ends, and a private key's armour until its end
+ *   line, so each is scrubbed whole.
+ *
+ * Held text past a bound is sent anyway, scrubbed as far as it has come;
+ * the committed message is scrubbed whole again, and replaces it.
+ */
+export class StreamScrubber {
+  readonly #scrubber: Scrubber;
+  readonly #ctx: ScrubContext;
+  #held = "";
+
+  constructor(scrubber: Scrubber, ctx: ScrubContext = {}) {
+    this.#scrubber = scrubber;
+    this.#ctx = ctx;
+  }
+
+  /** What may be sent of `piece` now (possibly nothing). */
+  push(piece: string): string {
+    const text = this.#held + piece;
+    const cut = this.#safeEnd(text);
+    this.#held = text.slice(cut);
+    return cut > 0 ? this.#scrubber.scrub(text.slice(0, cut), this.#ctx).text : "";
+  }
+
+  /** The rest, at the message's end. */
+  flush(): string {
+    const rest = this.#held;
+    this.#held = "";
+    return rest ? this.#scrubber.scrub(rest, this.#ctx).text : "";
+  }
+
+  /** How much of `text` can be sent now. */
+  #safeEnd(text: string): number {
+    // An open private key: hold from its armour to its end line.
+    const begin = text.lastIndexOf("-----BEGIN");
+    if (begin >= 0 && text.indexOf("-----END", begin) < 0 && text.length - begin <= MAX_BLOCK_HOLD) {
+      return this.#lineStart(text, begin);
+    }
+    // The last line, unfinished: held whole when it may name a credential.
+    const lineStart = text.lastIndexOf("\n") + 1;
+    const line = text.slice(lineStart);
+    if (TRIGGER.test(line) && line.length <= MAX_LINE_HOLD) return lineStart;
+    // Otherwise up to the last space, the run after it held (bounded by the longest known value).
+    const hold = Math.min(Math.max(512, this.#scrubber.known.longest), MAX_LINE_HOLD);
+    const lastSpace = Math.max(text.lastIndexOf(" "), text.lastIndexOf("\n"), text.lastIndexOf("\t"));
+    let cut = lastSpace + 1;
+    if (text.length - cut > hold) cut = text.length - hold;
+    return cut;
+  }
+
+  #lineStart(text: string, at: number): number {
+    return text.lastIndexOf("\n", at) + 1;
+  }
+}
diff --git a/src/daemon/secrets/secrets.test.ts b/src/daemon/secrets/secrets.test.ts
new file mode 100644
index 00000000..6be7d1b1
--- /dev/null
+++ b/src/daemon/secrets/secrets.test.ts
@@ -0,0 +1,293 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { loadShellParser } from "../shell/parse.js";
+import { findSecrets, isPlaceholder } from "./detect.js";
+import { isCredentialFile } from "./files.js";
+import { Fingerprinter } from "./fingerprint.js";
+import { KnownSecrets } from "./known.js";
+import { NOT_CHECKED, Scrubber, StreamScrubber, TOO_LARGE } from "./scrub.js";
+import { toolVerdict } from "./verdict.js";
+
+// Made-up credentials of the right shape, split so this file holds no contiguous token a push scanner takes for real.
+const GHP = "ghp_" + "Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V";
+const SLACK = "xoxb-" + "1234567890123-1234567890123-" + "abcdefghijABCDEFGHIJ1234";
+const AWS_ID = "AKIA" + "IOSFODNN7EXAMPLE";
+const JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" + ".eyJzdWIiOiIxMjM0NTY3ODkwIn0" + ".dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
+const PEM = "-----BEGIN OPENSSH PRIVATE " + "KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQ\n-----END OPENSSH PRIVATE KEY-----";
+
+const fp = new Fingerprinter(Buffer.alloc(32, 7));
+const kinds = (text: string) => (findSecrets(text) ?? []).map((s) => `${s.kind}:${text.slice(s.start, s.end)}`);
+
+describe("detect", () => {
+  test.each([
+    [`token ${GHP} done`, [`github-token:${GHP}`]],
+    [`SLACK=${SLACK}`, [`slack-token:${SLACK}`]],
+    [`key ${AWS_ID}`, [`aws-key-id:${AWS_ID}`]],
+    [`auth=${JWT}`, [`jwt:${JWT}`]],
+    ["export GITHUB_TOKEN=4f1c0e7d9b2a", ["credential:4f1c0e7d9b2a"]],
+    ["DATABASE_URL=postgres://app:s3cr3t-pw@db.internal:5432/app", ["password:s3cr3t-pw"]],
+    ['curl -H "Authorization: Bearer 8f2d0c1e9b7a4f6e8d2c" x', ["bearer-token:8f2d0c1e9b7a4f6e8d2c"]],
+    ["curl -u admin:hunter2 https://example.com", ["password:hunter2"]],
+    ["host=db user=app password=hunter22 dbname=app", ["password:hunter22"]],
+    ["docker login -u me --password hunter2xyz r.io", ["password:hunter2xyz"]],
+    ['{"client_secret": "a8f3kq0z7x1m", "client_id": "app"}', ["credential:a8f3kq0z7x1m"]],
+    ["database:\n  password: hunter2\n  host: db", ["credential:hunter2"]],
+  ])("finds %s", (text, expected) => {
+    expect(kinds(text)).toEqual(expected);
+  });
+
+  test.each([
+    "    token: String,",
+    "OPENAI_API_KEY=${OPENAI_API_KEY}",
+    "commit 3f9a2c1b4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a",
+    "max_tokens: 4096",
+    "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
+    '{"password": "<password>"}',
+    "TOKEN=‹credential:gh-saucam›",
+    "the --password flag",
+    "see https://example.com/docs?page=2",
+    "uuid 3e4f2b1a-9c8d-4e7f-a6b5-1c2d3e4f5a6b",
+  ])("leaves %s", (text) => {
+    expect(kinds(text)).toEqual([]);
+  });
+
+  test("a private key's body, its armour kept", () => {
+    const [s] = findSecrets(PEM)!;
+    expect(PEM.slice(0, s!.start)).toEndWith("PRIVATE KEY-----");
+    expect(PEM.slice(s!.end)).toStartWith("-----END");
+  });
+
+  test("placeholders", () => {
+    for (const p of ["$TOKEN", "${{ secrets.X }}", "<password>", "changeme", "xxxx", "‹secret:jwt:12345678›"]) expect(isPlaceholder(p)).toBe(true);
+    expect(isPlaceholder("hunter2xyz")).toBe(false);
+  });
+});
+
+describe("scrub", () => {
+  const known = new KnownSecrets();
+  known.register("test", () => [
+    { label: "gh-saucam", value: "s3cr3t-value-1234" },
+    { label: "short", value: "abc" },
+  ]);
+  const detected: string[] = [];
+  const scrubber = new Scrubber({ known, fingerprint: fp, onDetected: (d) => detected.push(d.kind) });
+
+  test("a known value becomes a credential reference, in every form it is written in", () => {
+    const b64 = Buffer.from(":s3cr3t-value-1234").toString("base64").replace(/=+$/, "");
+    const r = scrubber.scrub(`echo s3cr3t-value-1234; curl -H 'Authorization: Basic ${b64}'; q=${encodeURIComponent("s3cr3t-value-1234")}`);
+    expect(r.text).not.toContain("s3cr3t-value-1234");
+    expect(r.text).not.toContain(b64);
+    expect(r.text).toContain("‹credential:gh-saucam›");
+    expect(r.changed).toBe(true);
+  });
+
+  test("a value under 8 characters is never matched", () => {
+    expect(scrubber.scrub("abc is a word").text).toBe("abc is a word");
+  });
+
+  test("a detected secret becomes a fingerprinted reference, the same for the same value", () => {
+    const a = scrubber.scrub(`one ${GHP}`).text;
+    const b = scrubber.scrub(`two ${GHP}`).text;
+    const ref = a.slice(4);
+    expect(ref).toMatch(/^‹secret:github-token:[0-9a-f]{8}›$/);
+    expect(b).toBe(`two ${ref}`);
+    expect(detected).toContain("github-token");
+  });
+
+  test("scrubbing is idempotent", () => {
+    const once = scrubber.scrub(`DB_PASSWORD=hunter2xyz and ${GHP} and s3cr3t-value-1234`).text;
+    expect(scrubber.scrub(once).text).toBe(once);
+  });
+
+  test("a value inside a JSON input is scrubbed, structure kept", () => {
+    const r = scrubber.scrubValue({ command: `echo ${GHP}`, n: 3, list: ["s3cr3t-value-1234"] });
+    expect(r.changed).toBe(true);
+    expect(r.value.n).toBe(3);
+    expect(JSON.stringify(r.value)).not.toContain(GHP);
+  });
+
+  test("past its budget, a text isn't stored", () => {
+    const slow = new Scrubber({ known, fingerprint: fp, budgetMs: -1 });
+    expect(slow.scrub("anything at all").text).toBe(NOT_CHECKED);
+  });
+
+  test("too large to check isn't stored", () => {
+    expect(scrubber.scrub("x".repeat(8 * 1024 * 1024 + 1)).text).toBe(TOO_LARGE);
+  });
+});
+
+describe("stream", () => {
+  const known = new KnownSecrets();
+  known.register("test", () => [{ label: "gh-saucam", value: "s3cr3t-value-1234" }]);
+  const scrubber = new Scrubber({ known, fingerprint: fp });
+
+  /** Feed `text` in pieces of `n` characters; return what was sent. */
+  function stream(text: string, n: number): string {
+    const s = new StreamScrubber(scrubber);
+    let out = "";
+    for (let i = 0; i < text.length; i += n) out += s.push(text.slice(i, i + n));
+    return out + s.flush();
+  }
+
+  test.each([1, 2, 3, 5, 7, 13])("a secret split across pieces of %i is never sent", (n) => {
+    const text = `Here is the token ${GHP} and the key s3cr3t-value-1234, Authorization: Bearer 8f2d0c1e9b7a4f6e8d2c and password: "correct horse 9".\n${PEM}\nthe end`;
+    const out = stream(text, n);
+    for (const secret of [GHP, "s3cr3t-value-1234", "8f2d0c1e9b7a4f6e8d2c", "correct horse 9", "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQ"]) {
+      expect(out).not.toContain(secret);
+    }
+    expect(out).toContain("the end");
+  });
+
+  test("plain prose streams as it comes", () => {
+    const s = new StreamScrubber(scrubber);
+    expect(s.push("Hello there ")).toBe("Hello there ");
+    expect(s.push("wor")).toBe("");
+    expect(s.push("ld ")).toBe("world ");
+  });
+});
+
+describe("verdict", () => {
+  beforeAll(async () => {
+    await loadShellParser();
+  });
+  const v = (command: string) => toolVerdict("Bash", { command }, { cwd: "/w" });
+
+  test.each([
+    "gh auth token",
+    "x=$(gh auth token); echo $x",
+    "bash -c 'gh auth token'",
+    "sudo printenv",
+    "env",
+    "aws --profile prod configure get aws_secret_access_key",
+    "kubectl -n x get secret db -o yaml",
+    "op read op://vault/item/field",
+    "security find-generic-password -s x -w",
+    "cat .env",
+    "cat ~/.aws/credentials",
+    "grep KEY config/.env.local",
+    "head -5 < .env",
+    "terraform output -json",
+  ])("withholds the output of %s", (command) => {
+    expect(v(command)).toBe("withhold-output");
+  });
+
+  test.each(["git status", "npm test", "env FOO=1 npm test", "cat .env.example", "ls -la ~/.ssh", "echo token", "gh pr list"])("keeps %s", (command) => {
+    expect(v(command)).toBe("keep");
+  });
+
+  test("a write of a credential file", () => {
+    expect(v("echo KEY=abc > .env")).toBe("withhold-written");
+    expect(toolVerdict("Write", { file_path: "/w/.env", content: "KEY=abc" }, { cwd: "/w" })).toBe("withhold-written");
+    expect(toolVerdict("Read", { file_path: "/w/.env" }, { cwd: "/w" })).toBe("withhold-output");
+    expect(toolVerdict("Read", { file_path: "/w/src/a.ts" }, { cwd: "/w" })).toBe("keep");
+  });
+
+  test("the user's drop list", () => {
+    expect(toolVerdict("Bash", { command: "my-vault dump --all" }, { cwd: "/w", dropCommands: ["my-vault dump"] })).toBe("drop");
+  });
+
+  test("credential files", () => {
+    expect(isCredentialFile("id_ed25519", "/home/u/.ssh")).toBe(true);
+    expect(isCredentialFile("id_ed25519.pub", "/home/u/.ssh")).toBe(false);
+    expect(isCredentialFile("~/.kube/config", "/w")).toBe(true);
+    expect(isCredentialFile("src/config.ts", "/w")).toBe(false);
+  });
+});
+
+describe("stored data, scrubbed after the fact", () => {
+  test("a transcript's lines are rewritten, unchanged ones kept, and the file replaced whole", async () => {
+    const { mkdtempSync, writeFileSync, readFileSync, rmSync, statSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { scrubTranscripts } = await import("./scrub-stored.js");
+    const dir = mkdtempSync(join(tmpdir(), "codeoid-scrub-"));
+    try {
+      const path = join(dir, "s1.jsonl");
+      const clean = JSON.stringify({ seq: 0, message: { content: "hello" } });
+      writeFileSync(path, `${clean}\n${JSON.stringify({ seq: 1, message: { content: `token ${GHP}` } })}\nnot json ${GHP}\n`, { mode: 0o600 });
+      const known = new KnownSecrets();
+      const scrubber = new Scrubber({ known, fingerprint: fp });
+      const scrub = <T,>(v: T) => scrubber.scrubValue(v);
+      expect(scrubTranscripts(dir, scrub, true)).toEqual({ files: 1, filesChanged: 1, linesChanged: 2 });
+      expect(readFileSync(path, "utf8")).toContain(GHP);
+      expect(scrubTranscripts(dir, scrub, false).linesChanged).toBe(2);
+      const after = readFileSync(path, "utf8");
+      expect(after).not.toContain(GHP);
+      expect(after.split("\n")[0]).toBe(clean);
+      expect(statSync(path).mode & 0o777).toBe(0o600);
+      expect(scrubTranscripts(dir, scrub, false).linesChanged).toBe(0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("memory episodes and their full bodies", async () => {
+    const { mkdtempSync, rmSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { SqliteEpisodeStore } = await import("../memory/index.js");
+    const { scrubMemoryDb } = await import("./scrub-stored.js");
+    const dir = mkdtempSync(join(tmpdir(), "codeoid-scrubmem-"));
+    try {
+      const db = join(dir, "mem.db");
+      const store = new SqliteEpisodeStore(db);
+      const long = `${"x".repeat(70_000)} ${GHP}`;
+      const ep = store.insert({ workspaceId: "w", sessionId: "s", kind: "tool_call", summary: `ran with ${GHP}`, content: "index view", fullContent: long, filePaths: [], tokenEstimate: 1, createdAt: 1, createdBy: "u" });
+      store.close();
+      const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+      expect(scrubMemoryDb(db, <T,>(v: T) => scrubber.scrubValue(v), false)).toBe(2);
+      const reopened = new SqliteEpisodeStore(db);
+      expect(reopened.getEpisode(ep.id)?.summary).not.toContain(GHP);
+      expect(reopened.getFullContent(ep.id)).not.toContain(GHP);
+      expect(reopened.ftsSearch("w", "Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V", 5)).toEqual([]);
+      reopened.close();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("vault", () => {
+  test("a sealed value opens only where it was kept", async () => {
+    const { mkdtempSync, rmSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const { Store } = await import("../store.js");
+    const { CapturedSecretVault } = await import("./vault.js");
+    const dir = mkdtempSync(join(tmpdir(), "codeoid-vault-"));
+    try {
+      const store = new Store(join(dir, "codeoid.db"));
+      const vault = new CapturedSecretVault(store, Buffer.alloc(32, 3));
+      const scope = { accountId: "a", projectId: "p", workstream: "acme" };
+      vault.put(scope, { kind: "github-token", fingerprint: "0123abcd", value: GHP });
+      expect(vault.reveal(scope, "0123abcd")).toBe(GHP);
+      expect(vault.reveal({ ...scope, workstream: "other" }, "0123abcd")).toBeUndefined();
+      // Moved to another row by hand, it doesn't open there.
+      const row = store.capturedSecret({ ...scope, fingerprint: "0123abcd" })!;
+      store.putCapturedSecret({ ...scope, workstream: "other", fingerprint: "0123abcd", kind: row.kind, sealed: row.sealed, at: Date.now() });
+      expect(vault.reveal({ ...scope, workstream: "other" }, "0123abcd")).toBeUndefined();
+      // A different key opens nothing.
+      expect(new CapturedSecretVault(store, Buffer.alloc(32, 4)).reveal(scope, "0123abcd")).toBeUndefined();
+      expect(vault.list({ accountId: "a", projectId: "p" }).map((k) => k.workstream).sort()).toEqual(["acme", "other"]);
+      expect(vault.forget(scope, "0123abcd")).toBe(true);
+      store.close();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("learned", () => {
+  test("a value found by its name is matched bare from then on, in the same text and later ones", async () => {
+    const { LearnedSecrets } = await import("./known.js");
+    const known = new KnownSecrets();
+    const learned = new LearnedSecrets();
+    known.register("learned", () => learned.values());
+    learned.onChange(() => known.invalidate());
+    const scrubber = new Scrubber({ known, learned, fingerprint: fp });
+    const first = scrubber.scrub("DB_PASSWORD=hunter2xyz\nso the password is hunter2xyz").text;
+    expect(first).not.toContain("hunter2xyz");
+    const ref = /‹secret:credential:[0-9a-f]{8}›/.exec(first)![0];
+    expect(first.split(ref)).toHaveLength(3);
+    expect(scrubber.scrub("later: hunter2xyz again").text).toBe(`later: ${ref} again`);
+  });
+});
diff --git a/src/daemon/secrets/service.ts b/src/daemon/secrets/service.ts
new file mode 100644
index 00000000..6aeb44af
--- /dev/null
+++ b/src/daemon/secrets/service.ts
@@ -0,0 +1,159 @@
+/**
+ * The daemon's secret handling (docs/secrets-and-memory-design.md §2), one
+ * per daemon: the values codeoid knows, the fingerprint key, the vault, and
+ * the scrubber every store goes through.
+ *
+ * `scrub(text, ctx)` is what callers use; `verdict(...)` decides what of a
+ * tool call is stored at all. With `secrets.enabled: false` both are
+ * pass-throughs (for debugging only).
+ */
+
+import type { SecretsConfig } from "../../config.js";
+import type { AccountStore } from "../accounts.js";
+import type { CredentialDecl } from "../credentials/schema.js";
+import type { SecretStore } from "../credentials/store.js";
+import type { EndpointStore } from "../openai-endpoints.js";
+import type { Store } from "../store.js";
+import { Fingerprinter, loadOrCreateKey, secretMaterialDir } from "./fingerprint.js";
+import { type KnownSecret, KnownSecrets, LearnedSecrets } from "./known.js";
+import { type ScrubContext, type ScrubResult, Scrubber } from "./scrub.js";
+import { type ToolVerdict, toolVerdict } from "./verdict.js";
+import { CapturedSecretVault } from "./vault.js";
+
+export interface SecretServiceOptions {
+  config?: SecretsConfig;
+  configDir: string;
+  store?: Store;
+  /** Whether a workstream keeps detected secrets ('' = sessions with no workstream). */
+  capturePolicy?: (workstream: string | undefined) => "drop" | "vault";
+}
+
+/** Scrub context with the owner, so a kept secret lands in the right tenant. */
+export interface StoreScrubContext extends ScrubContext {
+  accountId?: string;
+  projectId?: string;
+}
+
+export const DEFAULT_SECRETS_CONFIG: SecretsConfig = { enabled: true, beforeModel: true, captureSecrets: "drop", vaultDays: 30, dropCommands: [], credentialFiles: [] };
+
+export class SecretService {
+  readonly known = new KnownSecrets();
+  /** Values found by shape this run, matched exactly from then on (memory only). */
+  readonly learned = new LearnedSecrets();
+  readonly config: SecretsConfig;
+  readonly vault: CapturedSecretVault | undefined;
+  readonly #scrubber: Scrubber;
+  #capturePolicy: (workstream: string | undefined) => "drop" | "vault";
+
+  constructor(opts: SecretServiceOptions) {
+    this.config = opts.config ?? DEFAULT_SECRETS_CONFIG;
+    const dir = secretMaterialDir(opts.configDir);
+    const fingerprint = new Fingerprinter(loadOrCreateKey(dir, "fingerprint.key"));
+    this.vault = opts.store ? new CapturedSecretVault(opts.store, loadOrCreateKey(dir, "vault.key")) : undefined;
+    this.#capturePolicy = opts.capturePolicy ?? (() => this.config.captureSecrets);
+    this.known.register("learned", () => this.learned.values());
+    this.learned.onChange(() => this.known.invalidate());
+    this.#scrubber = new Scrubber({
+      known: this.known,
+      learned: this.learned,
+      fingerprint,
+      onDetected: (secret, ctx) => {
+        const c = ctx as StoreScrubContext;
+        if (!this.vault || !c.accountId || !c.projectId) return;
+        if (this.#capturePolicy(c.workstream) !== "vault") return;
+        this.vault.put({ accountId: c.accountId, projectId: c.projectId, workstream: c.workstream ?? "" }, { ...secret, ...(c.sessionId ? { sessionId: c.sessionId } : {}) });
+      },
+    });
+  }
+
+  /** Who decides whether a workstream keeps detected secrets (the session manager, which knows the workstreams). */
+  setCapturePolicy(policy: (workstream: string | undefined) => "drop" | "vault"): void {
+    this.#capturePolicy = policy;
+  }
+
+  get enabled(): boolean {
+    return this.config.enabled;
+  }
+
+  get scrubber(): Scrubber {
+    return this.#scrubber;
+  }
+
+  /** Add a source of values codeoid knows; returns a function that removes it. */
+  addKnown(name: string, source: () => Iterable<KnownSecret>): () => void {
+    return this.known.register(name, source);
+  }
+
+  scrub(text: string, ctx: StoreScrubContext = {}): ScrubResult {
+    if (!this.config.enabled) return { text, changed: false };
+    return this.#scrubber.scrub(text, ctx);
+  }
+
+  scrubValue<T>(value: T, ctx: StoreScrubContext = {}): { value: T; changed: boolean } {
+    if (!this.config.enabled) return { value, changed: false };
+    return this.#scrubber.scrubValue(value, ctx);
+  }
+
+  verdict(toolName: string, input: unknown, cwd: string): ToolVerdict {
+    if (!this.config.enabled) return "keep";
+    return toolVerdict(toolName, input, { cwd, dropCommands: this.config.dropCommands, credentialFiles: this.config.credentialFiles });
+  }
+
+  /** Forget kept secrets past `vaultDays`. */
+  expireVault(): number {
+    return this.vault?.expire(this.config.vaultDays) ?? 0;
+  }
+}
+
+/**
+ * The daemon's own keys in its environment: `CODEOID_*` values (credentials
+ * from the env-file store among them) and anything whose name says it is a
+ * secret (`*_API_KEY`, `*_TOKEN`, …).
+ */
+export function environmentSecrets(env: Record<string, string | undefined> = process.env): KnownSecret[] {
+  const out: KnownSecret[] = [];
+  const NAME = /(?:^CODEOID_CRED_|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$|_ACCESS_KEY$|^ANTHROPIC_AUTH_TOKEN$|_KEY$)/;
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || !NAME.test(name)) continue;
+    out.push({ label: name.startsWith("CODEOID_CRED_") ? name.slice("CODEOID_CRED_".length).toLowerCase().replace(/_/g, "-") : `daemon:${name}`, value });
+  }
+  return out;
+}
+
+/**
+ * Every place codeoid holds a credential value (§2.2): declared credentials
+ * in the secret store, the daemon's environment, every backend's accounts,
+ * OpenAI-compatible endpoints, and the database's OAuth tokens and conductor
+ * key. The daemon and `codeoid secret scrub` register the same sources.
+ */
+export function addDaemonKnownSources(
+  secrets: SecretService,
+  deps: { credentials: () => readonly CredentialDecl[]; secretStore: SecretStore; accounts: AccountStore; endpoints: EndpointStore; store: Store },
+): void {
+  secrets.addKnown("credentials", () =>
+    deps.credentials().flatMap((c) => {
+      if (c.kind === "oauth") return [];
+      const value = deps.secretStore.get(c.id);
+      return value ? [{ label: c.id, value }] : [];
+    }),
+  );
+  secrets.addKnown("environment", () => environmentSecrets(process.env));
+  secrets.addKnown("accounts", () =>
+    deps.accounts.backendsWithData().flatMap((backend) =>
+      deps.accounts.list(backend).flatMap((info) => {
+        const a = deps.accounts.get(backend, info.name);
+        if (!a) return [];
+        const label = `account:${backend}:${a.name}`;
+        return [a.token, ...Object.values(a.headers ?? {}), ...Object.values(a.env ?? {})].filter((v): v is string => typeof v === "string").map((value) => ({ label, value }));
+      }),
+    ),
+  );
+  secrets.addKnown("endpoints", () =>
+    deps.endpoints.entries().flatMap((e) =>
+      [e.apiKey, ...Object.values(e.headers ?? {})].filter((v): v is string => typeof v === "string").map((value) => ({ label: `endpoint:${e.name}`, value })),
+    ),
+  );
+  secrets.addKnown("store", () => deps.store.knownSecretValues());
+  deps.accounts.onChange(() => secrets.known.invalidate());
+  deps.endpoints.onChange(() => secrets.known.invalidate());
+}
diff --git a/src/daemon/secrets/vault.ts b/src/daemon/secrets/vault.ts
new file mode 100644
index 00000000..b0a4554e
--- /dev/null
+++ b/src/daemon/secrets/vault.ts
@@ -0,0 +1,86 @@
+/**
+ * Detected secrets a workstream keeps (docs/secrets-and-memory-design.md
+ * §2.5): opt-in, `captureSecrets: "vault"`, so a person can still get one
+ * back later. Values are sealed with AES-256-GCM under `vault.key` (beside
+ * the fingerprint key, outside the database), so a copy of the database
+ * alone holds none. Read back only by the owner (`reveal`), audited by the
+ * caller; expired after `secrets.vaultDays` unless promoted to a credential.
+ *
+ * A kept secret belongs to one workstream: it is never revealed from
+ * another, so a closed workstream's secrets stay its own.
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import type { Store } from "../store.js";
+
+export interface VaultScope {
+  accountId: string;
+  projectId: string;
+  /** '' for sessions with no workstream. */
+  workstream: string;
+}
+
+export class CapturedSecretVault {
+  readonly #store: Store;
+  readonly #key: Buffer;
+
+  constructor(store: Store, key: Buffer) {
+    this.#store = store;
+    this.#key = key;
+  }
+
+  put(scope: VaultScope, secret: { kind: string; fingerprint: string; value: string; sessionId?: string }): void {
+    this.#store.putCapturedSecret({
+      ...scope,
+      fingerprint: secret.fingerprint,
+      kind: secret.kind,
+      sealed: this.#seal(secret.value, scope, secret.fingerprint),
+      ...(secret.sessionId ? { sessionId: secret.sessionId } : {}),
+      at: Date.now(),
+    });
+  }
+
+  list(scope: { accountId: string; projectId: string; workstream?: string }) {
+    return this.#store.listCapturedSecrets(scope);
+  }
+
+  /** The value, or undefined when this workstream keeps no such secret (or it can't be opened). */
+  reveal(scope: VaultScope, fingerprint: string): string | undefined {
+    const row = this.#store.capturedSecret({ ...scope, fingerprint });
+    if (!row) return undefined;
+    try {
+      return this.#open(row.sealed, scope, fingerprint);
+    } catch {
+      return undefined;
+    }
+  }
+
+  forget(scope: VaultScope, fingerprint: string): boolean {
+    return this.#store.deleteCapturedSecret({ ...scope, fingerprint });
+  }
+
+  expire(days: number): number {
+    return this.#store.expireCapturedSecrets(Date.now() - days * 86_400_000);
+  }
+
+  /** Bound to where it is kept: a sealed value moved to another row doesn't open. */
+  #aad(scope: VaultScope, fingerprint: string): Buffer {
+    return Buffer.from(`${scope.accountId}\u0000${scope.projectId}\u0000${scope.workstream}\u0000${fingerprint}`);
+  }
+
+  #seal(value: string, scope: VaultScope, fingerprint: string): Uint8Array {
+    const iv = randomBytes(12);
+    const c = createCipheriv("aes-256-gcm", this.#key, iv);
+    c.setAAD(this.#aad(scope, fingerprint));
+    const body = Buffer.concat([c.update(value, "utf8"), c.final()]);
+    return Buffer.concat([iv, c.getAuthTag(), body]);
+  }
+
+  #open(sealed: Uint8Array, scope: VaultScope, fingerprint: string): string {
+    const buf = Buffer.from(sealed);
+    const d = createDecipheriv("aes-256-gcm", this.#key, buf.subarray(0, 12));
+    d.setAAD(this.#aad(scope, fingerprint));
+    d.setAuthTag(buf.subarray(12, 28));
+    return Buffer.concat([d.update(buf.subarray(28)), d.final()]).toString("utf8");
+  }
+}
diff --git a/src/daemon/secrets/verdict.ts b/src/daemon/secrets/verdict.ts
new file mode 100644
index 00000000..da119d06
--- /dev/null
+++ b/src/daemon/secrets/verdict.ts
@@ -0,0 +1,204 @@
+/**
+ * Each tool call's verdict before it is stored
+ * (docs/secrets-and-memory-design.md §2.4, after atuin's
+ * `session_capture/policy.rs`):
+ *
+ * - `keep`: stored, scrubbed (the default);
+ * - `withhold-output`: stored, its output replaced by a note — a command that
+ *   exists to print a credential (`gh auth token`, `printenv`, `op read`, …),
+ *   or a read of a credential file (`cat .env`, a file tool reading
+ *   `~/.aws/credentials`);
+ * - `withhold-written`: a write of a credential file stored without what was
+ *   written;
+ * - `drop`: not stored at all (a command the user listed in
+ *   `secrets.dropCommands`).
+ *
+ * A shell line is read with codeoid's parser (shell/parse.ts), wrappers and
+ * `bash -c '…'` looked through, so `x=$(gh auth token)` is caught as the plain
+ * form is. A line the parser can't read is matched as text, so it fails toward
+ * withholding.
+ */
+
+import { parseShellSync, type SimpleCommand } from "../shell/parse.js";
+import { shellCallOf } from "../shell/tool-call.js";
+import { toolReadPaths } from "../secret-paths.js";
+import { isCredentialFile } from "./files.js";
+
+export type ToolVerdict = "keep" | "withhold-output" | "withhold-written" | "drop";
+
+export const OUTPUT_WITHHELD = "‹output withheld: it prints credentials›";
+export const WRITTEN_WITHHELD = "‹content withheld: a credential file›";
+
+/**
+ * Commands whose output is a credential, as argv prefixes (`*` any one word).
+ * Matched against the words after the program's own options are skipped
+ * (`aws --profile x configure get …`).
+ */
+const PRINTS_CREDENTIALS: ReadonlyArray<readonly string[]> = [
+  ["gh", "auth", "token"],
+  ["glab", "auth", "status", "--show-token"],
+  ["gcloud", "auth", "print-access-token"],
+  ["gcloud", "auth", "print-identity-token"],
+  ["gcloud", "auth", "application-default", "print-access-token"],
+  ["aws", "configure", "get"],
+  ["aws", "configure", "export-credentials"],
+  ["aws", "sts", "get-session-token"],
+  ["aws", "sts", "assume-role"],
+  ["aws", "sts", "get-federation-token"],
+  ["aws", "ecr", "get-login-password"],
+  ["aws", "ecr-public", "get-login-password"],
+  ["aws", "codeartifact", "get-authorization-token"],
+  ["az", "account", "get-access-token"],
+  ["az", "ad", "sp", "create-for-rbac"],
+  ["az", "ad", "sp", "credential", "reset"],
+  ["kubectl", "get", "secret"],
+  ["kubectl", "get", "secrets"],
+  ["kubectl", "describe", "secret"],
+  ["kubectl", "describe", "secrets"],
+  ["kubectl", "create", "token"],
+  ["vault", "read"],
+  ["vault", "login"],
+  ["vault", "print", "token"],
+  ["vault", "token", "create"],
+  ["vault", "kv", "get"],
+  ["op", "read"],
+  ["op", "inject"],
+  ["op", "item", "get"],
+  ["pass", "show"],
+  ["gopass", "show"],
+  ["gopass", "cat"],
+  ["secret-tool", "lookup"],
+  ["heroku", "auth:token"],
+  ["doppler", "secrets"],
+  ["npm", "token", "create"],
+  ["git", "credential", "fill"],
+  ["printenv"],
+  ["codeoid", "mcp", "headers"],
+  ["atuin", "key"],
+];
+
+/** Programs that print the environment when run alone (no command after them). */
+const ENV_PRINTERS = new Set(["env", "set", "export", "declare", "typeset"]);
+
+/** Programs that print a file's contents: a credential file among their operands is read out. */
+const FILE_PRINTERS = new Set(["cat", "less", "more", "head", "tail", "bat", "batcat", "nl", "tac", "strings", "xxd", "hexdump", "od", "base64", "grep", "rg", "ag", "awk", "sed", "jq", "yq", "cut", "sort", "diff", "cp", "source", "."]);
+
+const PROGRAM_OPTION_WITH_VALUE = /^--?(?:profile|region|output|namespace|context|kubeconfig|n|address|format|account|vault|project)$/;
+
+function words(c: SimpleCommand): string[] | null {
+  const out: string[] = [];
+  for (const w of c.argv) {
+    if (w.value === null) return null;
+    out.push(w.value);
+  }
+  return out;
+}
+
+function programName(word: string): string {
+  return word.slice(word.lastIndexOf("/") + 1);
+}
+
+/** The words after the program, its own options (and their values) skipped, for matching a subcommand. */
+function subcommandWords(argv: string[]): string[] {
+  const out: string[] = [];
+  for (let i = 1; i < argv.length; i++) {
+    const w = argv[i]!;
+    if (out.length === 0 && w.startsWith("-")) {
+      if (!w.includes("=") && PROGRAM_OPTION_WITH_VALUE.test(w)) i++;
+      continue;
+    }
+    out.push(w);
+  }
+  return out;
+}
+
+function printsCredentials(argv: string[]): boolean {
+  const program = programName(argv[0] ?? "");
+  const rest = subcommandWords(argv);
+  for (const sig of PRINTS_CREDENTIALS) {
+    if (sig[0] !== program) continue;
+    const tail = sig.slice(1);
+    // `glab auth status --show-token`: the flag may come anywhere after the subcommand.
+    const flag = tail.find((t) => t.startsWith("--"));
+    const sub = tail.filter((t) => !t.startsWith("--"));
+    if (sub.every((t, i) => t === "*" || rest[i] === t) && (!flag || argv.includes(flag))) return true;
+  }
+  // `gh auth status -t` / `--show-token`.
+  if (program === "gh" && rest[0] === "auth" && rest[1] === "status" && (argv.includes("-t") || argv.includes("--show-token"))) return true;
+  // `security find-generic-password -w` (macOS keychain: -w / -g print the password).
+  if (program === "security" && /^find-(?:generic|internet)-password$/.test(rest[0] ?? "") && argv.some((a) => /^-[a-zA-Z]*[wg]/.test(a))) return true;
+  // `kubectl config view --raw`, `terraform output -json|-raw`.
+  if (program === "kubectl" && rest[0] === "config" && rest[1] === "view" && argv.includes("--raw")) return true;
+  if (program === "terraform" && rest[0] === "output" && (argv.includes("-json") || argv.includes("-raw"))) return true;
+  // The environment, the shell's variables: alone, not running a command.
+  if (ENV_PRINTERS.has(program)) {
+    const opts = argv.slice(1);
+    if (program === "env" && opts.every((a) => a.startsWith("-"))) return true;
+    if (program === "set" && opts.length === 0) return true;
+    if ((program === "export" || program === "declare" || program === "typeset") && opts.length > 0 && opts.every((a) => /^-[a-zA-Z]*[px]/.test(a))) return true;
+  }
+  return false;
+}
+
+/** The same, matched as text when the line can't be parsed: fails toward withholding. */
+const PRINTS_CREDENTIALS_TEXT =
+  /(?:^|[;&|(`{!\n]|\$\()\s*(?:(?:sudo|command|exec|time|env|nohup)\s+|\w+=\S*\s+)*(?:\S*\/)?(?:gh\s+auth\s+token|printenv|gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token|aws\b[^\n;&|]*\bconfigure\s+(?:get|export-credentials)|op\s+(?:read|inject|item\s+get)|vault\s+(?:read|login|kv\s+get|print\s+token)|kubectl\b[^\n;&|]*\b(?:get|describe)\s+secrets?|git\s+credential\s+fill|pass\s+show|secret-tool\s+lookup)\b/;
+
+export interface VerdictOptions {
+  /** Where the call runs, for relative paths. */
+  cwd: string;
+  /** `secrets.dropCommands`: programs (or argv prefixes, space-separated) whose calls aren't stored at all. */
+  dropCommands?: readonly string[];
+  /** `secrets.credentialFiles`: more file globs that hold credentials. */
+  credentialFiles?: readonly string[];
+}
+
+/** Whether a tool is one that writes files (by every backend's name for it). */
+function writesFiles(toolName: string): boolean {
+  return /^(?:write|edit|multiedit|notebookedit|codex_file_change|write_file|replace|edit_file|create_file|apply_patch|str_replace_based_edit_tool|patch)$/i.test(toolName);
+}
+
+/** A tool call's verdict (see the module comment). Never throws. */
+export function toolVerdict(toolName: string, input: unknown, opts: VerdictOptions): ToolVerdict {
+  try {
+    const obj = input && typeof input === "object" ? (input as Record<string, unknown>) : {};
+    const shell = shellCallOf(toolName, obj);
+    if (shell) return shellVerdict(shell.command, shell.cwd ?? opts.cwd, opts);
+    const paths = toolReadPaths(toolName, obj);
+    if (paths.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) {
+      return writesFiles(toolName) ? "withhold-written" : "withhold-output";
+    }
+    return "keep";
+  } catch {
+    return "keep";
+  }
+}
+
+function shellVerdict(command: string, cwd: string, opts: VerdictOptions): ToolVerdict {
+  const parsed = parseShellSync(command);
+  const drops = (opts.dropCommands ?? []).map((d) => d.trim().split(/\s+/).filter(Boolean)).filter((d) => d.length > 0);
+  if (parsed.unreadable) {
+    if (drops.some((d) => command.includes(d.join(" ")))) return "drop";
+    return PRINTS_CREDENTIALS_TEXT.test(command) ? "withhold-output" : "keep";
+  }
+  let verdict: ToolVerdict = "keep";
+  for (const c of parsed.commands) {
+    const argv = words(c);
+    if (!argv || argv.length === 0) {
+      // A word only known at run time: still, a credential file it names plainly counts.
+      continue;
+    }
+    if (drops.some((d) => d.every((w, i) => (i === 0 ? programName(argv[0]!) === w : argv[i] === w)))) return "drop";
+    if (printsCredentials(argv)) verdict = "withhold-output";
+    const program = programName(argv[0]!);
+    // A credential file read out: an operand of a printer, or a redirect it reads (`< .env`).
+    const operands = FILE_PRINTERS.has(program) ? argv.slice(1).filter((a) => !a.startsWith("-")) : [];
+    const reads = c.redirects.filter((r) => r.op === "<" && r.target?.value).map((r) => r.target!.value!);
+    if ([...operands, ...reads].some((p) => isCredentialFile(p, cwd, opts.credentialFiles))) verdict = "withhold-output";
+    // A credential file written by a redirect (`echo KEY=… > .env`): the line holds the value.
+    const writes = c.redirects.filter((r) => /^(?:>|>>|&>|>\||&>>)$/.test(r.op) && r.target?.value).map((r) => r.target!.value!);
+    if (writes.some((p) => isCredentialFile(p, cwd, opts.credentialFiles)) && verdict === "keep") verdict = "withhold-written";
+  }
+  if (verdict === "keep" && parsed.problems.length > 0 && PRINTS_CREDENTIALS_TEXT.test(command)) verdict = "withhold-output";
+  return verdict;
+}
diff --git a/src/daemon/server.ts b/src/daemon/server.ts
index ec6e1d5b..1400c452 100644
--- a/src/daemon/server.ts
+++ b/src/daemon/server.ts
@@ -22,6 +22,7 @@ import {
   removeLocalTokenFile,
   writeLocalTokenFile,
 } from "./local-auth.js";
+import { SecretService } from "./secrets/service.js";
 import { SessionManager } from "./session-manager.js";
 import { Store } from "./store.js";
 import { TranscriptStore } from "./transcript.js";
@@ -214,6 +215,12 @@ export interface DaemonConfig {
    * sessions aren't sandboxed and carry no `sandbox` in their info.
    */
   sandboxRegistry?: SandboxRegistry;
+  /**
+   * Where the keys for secret handling live (docs/secrets-and-memory-design.md
+   * §2): `codeoid start` passes the config dir, so what sessions store is
+   * scrubbed. Absent (tests, embedders): stored as it came.
+   */
+  secretsConfigDir?: string;
 }
 
 interface AuthenticatedSocket {
@@ -232,6 +239,8 @@ export class DaemonServer {
   #memoryMcp: MemoryMcpHttp | null = null;
   #mcpRegistry: McpRegistry | null = null;
   #mcpHub: McpHub | null = null;
+  /** Secret handling for what sessions store and what the hub hands back (docs/secrets-and-memory-design.md §2). */
+  #secretService?: SecretService;
   #mcpProxy: McpProxy | null = null;
   #bunServer: ReturnType<typeof Bun.serve> | null = null;
   /** Boot recovery done: until then every request is answered 503 (`start`). */
@@ -354,6 +363,9 @@ export class DaemonServer {
           `${maxCreationsPerHour || "unlimited"}/hr per subject`,
       );
     }
+    if (config.secretsConfigDir) {
+      this.#secretService = new SecretService({ ...(config.fullConfig?.secrets ? { config: config.fullConfig.secrets } : {}), configDir: config.secretsConfigDir, store: this.#store });
+    }
     this.#manager = new SessionManager(
       this.#store, this.#transcriptStore, identityManager, rateLimiter,
       // Memory is wired post-construction via initMemory() — see start()
@@ -367,6 +379,7 @@ export class DaemonServer {
         // restarts so a daemon still recognises its own crashed run.
         daemonId: `${this.#config.host}:${this.#config.port}`,
         ...(config.sandboxRegistry ? { sandboxRegistry: config.sandboxRegistry } : {}),
+        ...(this.#secretService ? { secretService: this.#secretService } : {}),
       },
     );
 
@@ -626,6 +639,8 @@ export class DaemonServer {
       requestTimeoutMs: this.#config.fullConfig?.session.mcpToolTimeoutMs,
     });
     this.#mcpHub.proxy = this.#mcpProxy;
+    const secretService = this.#secretService;
+    if (secretService?.enabled && secretService.config.beforeModel) this.#mcpHub.setResultScrub((text) => secretService.scrub(text).text);
     for (const w of this.#mcpRegistry.warnings) console.warn(`[codeoid] ${w}`);
     // Goal blackboard: loopback URL regardless of bind address — the agent
     // subprocess runs on this host, and the endpoint must not become
diff --git a/src/daemon/session-manager.ts b/src/daemon/session-manager.ts
index 8e4d6c3e..81c6f0d4 100644
--- a/src/daemon/session-manager.ts
+++ b/src/daemon/session-manager.ts
@@ -16,6 +16,8 @@ import { OverrideTokens } from "./workstreams/override.js";
 import { withSlot } from "./mcp/oauth.js";
 import type { FolderReader } from "./workstreams/folder.js";
 import { createSecretStore, credentialEnvName, type SecretStore } from "./credentials/store.js";
+import { secretMaterialDir } from "./secrets/fingerprint.js";
+import { addDaemonKnownSources, type SecretService } from "./secrets/service.js";
 import { credentialsSchema } from "./credentials/schema.js";
 import { workstreamsSchema } from "./workstreams/schema.js";
 import { registerSecretPaths } from "./secret-paths.js";
@@ -546,6 +548,8 @@ export class SessionManager {
   #mcpRegistry?: McpRegistry;
   #mcpHub?: McpHub;
   #mcpOAuth?: McpOAuth;
+  /** Secret handling for what sessions store (docs/secrets-and-memory-design.md §2). */
+  #secretService?: SecretService;
   /** In-flight interactive backend sign-ins. Daemon-wide, and at most one per
    *  backend — two live logins would race to write the same credential. */
   readonly #backendLogin: BackendLoginBroker;
@@ -738,6 +742,8 @@ export class SessionManager {
       _testFolderReader?: FolderReader;
       /** Test-only: where credential values come from. */
       _testSecrets?: SecretStore;
+      /** Secret handling for what sessions store (docs/secrets-and-memory-design.md §2). Absent: stored as it came. */
+      secretService?: SecretService;
     },
   ) {
     this.#store = store;
@@ -758,6 +764,7 @@ export class SessionManager {
     // secrets are (secret-paths.ts).
     if (opts?.config?.credentialStore?.kind === "dir") registerSecretPaths({ dirs: [opts.config.credentialStore.path] });
     this.#sandboxRegistry = opts?.sandboxRegistry;
+    this.#secretService = opts?.secretService;
     if (opts?.config?.worktree?.setup) this.#worktreeSetupPolicy = opts.config.worktree.setup;
     this.#compressionRegistry = opts?.compressionRegistry;
     this.#endpoints = opts?.endpoints ?? new EndpointStore();
@@ -787,6 +794,7 @@ export class SessionManager {
       this.#pushToProviderSubscribers({ type: "accounts.changed", backend });
     });
     this.#hooks = opts?.hooks;
+    if (this.#secretService) this.#wireSecretService(this.#secretService);
     this.#testProviderFactory = opts?._testProviderFactory;
     this.#backendLogin = opts?._testBackendLogin ?? new BackendLoginBroker();
     this.#dispatcher = new Dispatcher(store, this.#makeDispatcherHost(), {
@@ -1686,6 +1694,10 @@ mcpHub: this.#mcpHub,
       case "credential.delete":
       case "credential.set_value":
         return this.#credentialEdit(msg, auth);
+      case "secret.list":
+      case "secret.reveal":
+      case "secret.forget":
+        return this.#secretHandle(msg, auth);
       case "mcp.oauth.begin":
         return this.#mcpOAuthBegin(msg, auth);
       case "mcp.oauth.complete":
@@ -1865,6 +1877,7 @@ mcpHub: this.#mcpHub,
           // Bind the exporter's tenant so the derived workspace id matches the
           // tenant-scoped ids episodes were written under.
           workspaceIdFor: (wd: string) => workspaceIdFromPath(wd, auth),
+          ...(this.#secretService ? { scrub: <T,>(v: T): T => this.#secretService!.scrubValue(v).value } : {}),
         },
       );
 
@@ -2345,6 +2358,7 @@ mcpHub: this.#mcpHub,
     workstreamEnv?: (b: WorkstreamBinding | undefined) => Readonly<Record<string, string>>;
     mcpGrant: (b: WorkstreamBinding | undefined) => McpGrant | undefined;
     workstreamFence: (b: WorkstreamBinding | undefined, own: readonly string[]) => WorkstreamFence | undefined;
+    secrets?: SecretService;
   } {
     const { missing } = this.#workstreams.envFor(binding, this.#secrets);
     if (missing.length > 0) {
@@ -2360,9 +2374,34 @@ mcpHub: this.#mcpHub,
       // The grant follows the config as it is at each listing.
       mcpGrant: (b) => this.#workstreams.grantFor(b),
       workstreamFence: (b, own) => this.#workstreamFence(b, own),
+      ...(this.#secretService ? { secrets: this.#secretService } : {}),
     };
   }
 
+  /**
+   * Tell the secret service what codeoid knows (§2.2 of
+   * secrets-and-memory-design.md): every value it holds, from every place it
+   * holds them, matched exactly wherever they show up. And whose workstream
+   * keeps detected secrets.
+   */
+  #wireSecretService(secrets: SecretService): void {
+    registerSecretPaths({ dirs: [secretMaterialDir(getConfigDir())] });
+    secrets.setCapturePolicy((ws) => (ws ? (this.#workstreams.get(ws)?.captureSecrets ?? "drop") : (this.#config?.secrets?.captureSecrets ?? "drop")));
+    addDaemonKnownSources(secrets, {
+      credentials: () => this.#config?.credentials ?? [],
+      secretStore: this.#secrets,
+      accounts: this.#accounts,
+      endpoints: this.#endpoints,
+      store: this.#store,
+    });
+    try {
+      const n = secrets.expireVault();
+      if (n > 0) console.log(`[codeoid] secrets: forgot ${n} kept secret(s) not seen in ${secrets.config.vaultDays} days`);
+    } catch (err) {
+      console.error(`[codeoid] secrets: expiring kept secrets failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
   /** Fences by binding and config revision, briefly: the gate reads one on every file tool call. */
   #fenceCache = new Map<string, { at: number; fence: WorkstreamFence | undefined }>();
 
@@ -3504,6 +3543,7 @@ mcpHub: this.#mcpHub,
     const workstreams = workstreamsSchema.parse(config.workstreams);
     const credentials = credentialsSchema.parse(config.credentials);
     if (this.#config) this.#config = { ...this.#config, workstreams, credentials };
+    this.#secretService?.known.invalidate();
     this.#workstreams.update(workstreams, credentials);
     this.#pushToProviderSubscribers({ type: "workstreams.changed", revision: this.#workstreams.revision });
   }
@@ -3538,6 +3578,47 @@ mcpHub: this.#mcpHub,
     return this.#workstreamList({ type: "workstream.list", id: msg.id }, { ...auth, scopes: [...auth.scopes, SCOPES.SETTINGS_READ] as AuthContext["scopes"] });
   }
 
+  /**
+   * The detected secrets workstreams keep (docs/secrets-and-memory-design.md
+   * §2.5): listed with settings:read, revealed and forgotten only with the
+   * caller's own token (settings:write, undelegated), each audited. A kept
+   * secret is the tenant's: the caller's account and project only.
+   */
+  #secretHandle(msg: Extract<ClientMessage, { type: "secret.list" | "secret.reveal" | "secret.forget" }>, auth: AuthContext): DaemonMessage {
+    const tenant = { accountId: auth.accountId, projectId: auth.projectId };
+    const vault = this.#secretService?.vault;
+    if (msg.type === "secret.list") {
+      if (!hasScope(auth.scopes as string[], SCOPES.SETTINGS_READ)) {
+        return { type: "response.error", requestId: msg.id, error: "Missing scope: settings:read", code: "forbidden" };
+      }
+      return {
+        type: "secret.list.result",
+        requestId: msg.id,
+        enabled: this.#secretService?.enabled ?? false,
+        secrets: vault ? vault.list({ ...tenant, ...(msg.workstream !== undefined ? { workstream: msg.workstream } : {}) }) : [],
+      };
+    }
+    if (!hasScope(auth.scopes as string[], SCOPES.SETTINGS_WRITE)) {
+      return { type: "response.error", requestId: msg.id, error: "Missing scope: settings:write", code: "forbidden" };
+    }
+    if (auth.delegationDepth > 0) {
+      return { type: "response.error", requestId: msg.id, error: "A delegated token can't reveal or forget kept secrets", code: "forbidden" };
+    }
+    if (!vault) return { type: "response.error", requestId: msg.id, error: "This daemon keeps no secrets", code: "not_found" };
+    const scope = { ...tenant, workstream: msg.workstream };
+    if (msg.type === "secret.forget") {
+      if (!vault.forget(scope, msg.fingerprint)) return { type: "response.error", requestId: msg.id, error: "No such kept secret", code: "not_found" };
+      this.#store.audit(auth.sub, "secret.forget", "", `workstream=${msg.workstream || "-"} fingerprint=${msg.fingerprint}`);
+      return { type: "response.ok", requestId: msg.id };
+    }
+    const kept = vault.list(scope).find((k) => k.fingerprint === msg.fingerprint);
+    const value = kept ? vault.reveal(scope, msg.fingerprint) : undefined;
+    if (!kept || value === undefined) return { type: "response.error", requestId: msg.id, error: "No such kept secret", code: "not_found" };
+    // The value never goes to the audit, only who saw which one.
+    this.#store.audit(auth.sub, "secret.reveal", "", `workstream=${msg.workstream || "-"} fingerprint=${msg.fingerprint} kind=${kept.kind}`);
+    return { type: "secret.reveal.result", requestId: msg.id, kind: kept.kind, value };
+  }
+
   #credentialList(msg: { id: string }, auth: AuthContext): DaemonMessage {
     if (!hasScope(auth.scopes as string[], SCOPES.SETTINGS_READ)) {
       return { type: "response.error", requestId: msg.id, error: "Missing scope: settings:read", code: "forbidden" };
@@ -3592,6 +3673,7 @@ mcpHub: this.#mcpHub,
       if (!w.ok) return err(w.error);
       // The value never goes to the audit, only that it changed.
       this.#store.audit(auth.sub, "credential.set_value", "", `id=${decl.id} ${msg.value === null ? "cleared" : "set"}`);
+      this.#secretService?.known.invalidate();
     } else {
       const id = msg.type === "credential.upsert" ? String(msg.item.id ?? "") : msg.credential;
       const existing = declared.find((c) => c.id === id);
@@ -4374,6 +4456,8 @@ mcpHub: this.#mcpHub,
   /** Inject the MemoryEngine after construction (embedder init is async). */
   setMemory(memory: MemoryEngine): void {
     this.#memory = memory;
+    const secrets = this.#secretService;
+    if (secrets) memory.scrubText = (text, ctx) => secrets.scrub(text, ctx).text;
   }
 
   /** Inject the shared memory MCP endpoint + URL (daemon-wide, built after the
diff --git a/src/daemon/session.ts b/src/daemon/session.ts
index f59fc670..5620f465 100644
--- a/src/daemon/session.ts
+++ b/src/daemon/session.ts
@@ -240,6 +240,12 @@ import { worktreeFolderNote } from "./sandbox/worktrees.js";
 import { hiddenPathsFor, protectedWriteTargets, userHiddenPaths } from "./sandbox/policy.js";
 import { addedDirProblem, addedDirReal, autonomousGrantProblem, checkoutOverlap, inAnyDir, nestedControl, normalizeSandboxDir, type OtherCheckout } from "./sandbox/project-roots.js";
 import { sandboxRootIfMade } from "./sandbox/root.js";
+import type { SecretService } from "./secrets/service.js";
+import { StreamScrubber } from "./secrets/scrub.js";
+import { OUTPUT_WITHHELD, type ToolVerdict, WRITTEN_WITHHELD } from "./secrets/verdict.js";
+
+/** What is recorded of a call the user listed in `secrets.dropCommands`. */
+const NOT_STORED = "‹not stored›";
 import { REQUEST_DIRECTORY_SHORT_WAIT_MS, REQUEST_DIRECTORY_WAIT_MS, type RequestDirectoryInput, type SandboxMcpMount } from "./sandbox/request-directory.js";
 import {
   CLAUDE_PROVIDER_ID,
@@ -662,6 +668,12 @@ export interface SessionCreateOptions {
    * or undefined: none (the handler then refuses what needed it).
    */
   fleetConfirm?: (target: FleetCardTarget, input: unknown) => string | undefined;
+  /**
+   * The daemon's secret handling (docs/secrets-and-memory-design.md §2):
+   * what the session stores, shows and hands on never holds a secret's
+   * value. Absent: stored as it came (tests, embedders).
+   */
+  secrets?: SecretService;
   /**
    * Initial execution mode + autonomous tool budget. Spawned workers start
    * "autonomous" with a bounded budget so they can work unattended; when the
@@ -1459,6 +1471,12 @@ export class Session {
   #collaborationCost?: () => CollaborationCost | undefined;
   #fleetTargetWorkstream?: (toolName: string, input: unknown) => FleetCardTarget | undefined;
   #fleetConfirm?: (target: FleetCardTarget, input: unknown) => string | undefined;
+  #secrets?: SecretService;
+  /** The reply and the reasoning streaming now, scrubbed as they arrive (a secret split across deltas is never sent). */
+  #textStream: StreamScrubber | null = null;
+  #thinkingStream: StreamScrubber | null = null;
+  /** Each running tool call's verdict (secrets/verdict.ts), by the backend's tool-use id. */
+  #toolVerdicts = new Map<string, ToolVerdict>();
   #workerShape?: "ship" | "scout";
   #turnsRemaining: number | undefined = undefined;
   /** See SessionCreateOptions.onBudgetExhausted. */
@@ -1897,6 +1915,7 @@ export class Session {
     this.#collaborationCost = opts.collaborationCost;
     this.#fleetTargetWorkstream = opts.fleetTargetWorkstream;
     this.#fleetConfirm = opts.fleetConfirm;
+    this.#secrets = opts.secrets;
     this.#maxBudgetUsd = opts.maxBudgetUsd;
     this.#onBudgetExhausted = opts.onBudgetExhausted ?? "park";
     const envOf = opts.workstreamEnv;
@@ -1957,6 +1976,7 @@ export class Session {
     // Durable canonical history (#354): every change is appended to the
     // session's log so forks, backend switches and rewinds after a restart
     // still carry the conversation.
+    if (this.#secrets) this.#historyAccumulator.scrubTurn = (turn) => this.#scrubValue(turn);
     this.#historyAccumulator.onChange = (change) => {
       if (this.#destroyed) return;
       // Never write a history that couldn't be read over the log it lost;
@@ -6529,7 +6549,8 @@ export class Session {
       out.push({
         approvalId,
         toolName: gated.toolName,
-        input: gated.input,
+        // Shown as the card shows it: scrubbed (the call still runs with what the backend made).
+        input: this.#scrubValue(gated.input),
         ...this.#cardRisk(risk, this.#heldWrite(gated.toolName, gated.input)),
         ...this.#cardSandbox(gated.toolName, gated.input, gated.shellCwd),
         ...(ws ? { targetWorkstream: { ...(ws.target.workstream ? { workstream: ws.target.workstream } : {}), ...(ws.target.warning ? { warning: ws.target.warning } : {}) } } : {}),
@@ -7257,6 +7278,8 @@ export class Session {
       const row = transcript[i]!;
       if (row.type !== "session.message") continue;
       const msg = reconcileResumedMessage({ ...row, sessionId: this.id });
+      // The parent's rows may predate secret scrubbing: the fork's copy is scrubbed as it is written.
+      this.#scrubMessage(msg);
       this.#scrollback.push(msg, sizeHints?.[i]);
       this.#transcriptStore.append(this.id, msg, this.#seq++).catch((e) => {
         console.error(
@@ -10020,9 +10043,16 @@ export class Session {
    * transcript and broadcast the state delta. Shared by the manual
    * approval/deny path and the hook-block path so the two can't drift.
    */
-  #resolveToolCallMessage(approvalId: string, resolvedState: ToolState): void {
+  #resolveToolCallMessage(approvalId: string, settled: ToolState): void {
     const msgId = this.#approvalIdToMessageId.get(approvalId);
     if (!msgId) return;
+    // What is recorded of the input the call runs with: as its tool_start was (secrets/verdict.ts).
+    const runs = (settled as { input?: unknown }).input;
+    const toolUseId = this.#messageIdToToolUseId.get(msgId);
+    const resolvedState =
+      this.#secrets && runs && typeof runs === "object"
+        ? ({ ...settled, input: this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", runs as Record<string, unknown>) } as unknown as ToolState)
+        : this.#scrubValue(settled);
     this.#scrollback.updateMessage(msgId, (m) => {
       const sm = m as SessionMessage;
       if (sm.tool) sm.tool.state = resolvedState;
@@ -10471,6 +10501,7 @@ export class Session {
       case "text_delta": {
         if (!this.#activeAssistantMsg) {
           this.#activeAssistantMsg = this.#makeMessage("assistant", "", this.#agentIdentity, []);
+          this.#textStream = this.#secrets ? new StreamScrubber(this.#secrets.scrubber, this.#scrubContext()) : null;
           // Scrollback only — no transcript row, no chunker event. The buffer
           // holds the message by reference so clients attaching mid-stream see
           // it grow; the durable row and the chunker event are emitted once,
@@ -10480,12 +10511,15 @@ export class Session {
           this.#broadcastRaw(this.#activeAssistantMsg);
           if (this.#status === "tool_running") this.#setStatus("thinking");
         }
-        this.#activeAssistantMsg.content += event.content;
+        // Scrubbed as it streams: a secret split across deltas is held until it can be scrubbed whole.
+        const piece = this.#textStream && this.#secrets?.enabled ? this.#textStream.push(event.content) : event.content;
+        if (!piece) break;
+        this.#activeAssistantMsg.content += piece;
         const delta: SessionMessageDelta = {
           type: "session.message.delta",
           sessionId: this.id,
           messageId: this.#activeAssistantMsg.messageId,
-          contentAppend: event.content,
+          contentAppend: piece,
           timestamp: new Date().toISOString(),
         };
         this.#broadcastRaw(delta);
@@ -10493,30 +10527,33 @@ export class Session {
       }
 
       case "text_done": {
-        this.#accumulator.handleEvent(event);
+        this.#textStream = null;
+        // The whole reply scrubbed again: it replaces what was streamed.
+        const done = this.#secrets ? { ...event, content: this.#scrubText(event.content) } : event;
+        this.#accumulator.handleEvent(done);
         // NOTE: do NOT call #completeActiveTools() here.
         // In the real SDK the committed assistant message (which fires text_done)
         // is emitted BEFORE the user/tool_result message (which fires tool_complete).
         // Calling completeActiveTools here cancels tools that are still executing.
         // Cleanup is handled solely by the #consumeEvents finally block.
         if (this.#activeAssistantMsg) {
-          this.#activeAssistantMsg.content = event.content;
-          this.#activeAssistantMsg.parts = [{ kind: "text", text: event.content, markdown: true }];
+          this.#activeAssistantMsg.content = done.content;
+          this.#activeAssistantMsg.parts = [{ kind: "text", text: done.content, markdown: true }];
           this.#commitStreamed(this.#activeAssistantMsg);
           this.#broadcastRaw(this.#activeAssistantMsg);
           this.#activeAssistantMsg = null;
-        } else if (event.content && this.#turnInterrupted) {
+        } else if (done.content && this.#turnInterrupted) {
           // A stopped turn's last reply, shown whole: animating it held the
           // turn's end, and so a shutdown's drain, for up to half a second.
-          const msg = this.#makeMessage("assistant", event.content, this.#agentIdentity, []);
-          msg.parts = [{ kind: "text", text: event.content, markdown: true }];
+          const msg = this.#makeMessage("assistant", done.content, this.#agentIdentity, []);
+          msg.parts = [{ kind: "text", text: done.content, markdown: true }];
           this.#commitStreamed(msg);
           this.#broadcastRaw(msg);
-        } else if (event.content) {
+        } else if (done.content) {
           // No preceding text_delta — the SDK returned the response as a batch
           // (happens for mid-turn now-priority continuations). Simulate streaming
           // so the UI shows a typing animation instead of an instant text pop-in.
-          await this.#artificiallyStreamText(event.content);
+          await this.#artificiallyStreamText(done.content);
         }
         break;
       }
@@ -10528,18 +10565,20 @@ export class Session {
           this.#finalizeActiveThinking();
           this.#activeThinkingMsg = this.#makeMessage("thinking", "", this.#agentIdentity, []);
           this.#activeThinkingIndex = event.blockIndex ?? null;
+          this.#thinkingStream = this.#secrets ? new StreamScrubber(this.#secrets.scrubber, this.#scrubContext()) : null;
           // Scrollback only — see the text_delta note; committed by
           // #finalizeActiveThinking → #commitStreamed.
           this.#scrollback.push(this.#activeThinkingMsg);
           this.#broadcastRaw(this.#activeThinkingMsg);
         }
-        if (event.content) {
-          this.#activeThinkingMsg.content += event.content;
+        const thought = event.content && this.#thinkingStream && this.#secrets?.enabled ? this.#thinkingStream.push(event.content) : event.content;
+        if (thought) {
+          this.#activeThinkingMsg.content += thought;
           const delta: SessionMessageDelta = {
             type: "session.message.delta",
             sessionId: this.id,
             messageId: this.#activeThinkingMsg.messageId,
-            contentAppend: event.content,
+            contentAppend: thought,
             timestamp: new Date().toISOString(),
           };
           this.#broadcastRaw(delta);
@@ -10553,7 +10592,12 @@ export class Session {
       }
 
       case "tool_start": {
-        this.#accumulator.handleEvent(event);
+        // What of this call is stored (docs/secrets-and-memory-design.md §2.4): judged on what it really runs.
+        // The canonical history keeps what the transcript keeps.
+        const verdict = this.#secrets ? this.#secrets.verdict(event.name, event.input, event.shellCwd ?? this.workdir) : "keep";
+        if (verdict !== "keep") this.#toolVerdicts.set(event.sdkToolUseId, verdict);
+        const recordedInput = this.#secrets ? this.#recordedToolInput(verdict, event.input) : event.input;
+        this.#accumulator.handleEvent(recordedInput === event.input ? event : { ...event, input: recordedInput });
         // NOTE: do NOT call #completeActiveTools() here. It would cancel all
         // currently in-flight tools, which is correct for sequential calls but
         // silently kills parallel tool calls from concurrent subagents.
@@ -10635,16 +10679,16 @@ export class Session {
           {
             toolId: event.toolId,
             name: event.name,
-            input: event.input,
+            input: recordedInput,
             state: budgetDenied
               ? { phase: "cancelled", reason: "denied", message: "autonomous tool budget spent" }
               : refused
               ? { phase: "cancelled", reason: "denied", message: refused.reason }
               : autoApprove
-              ? ({ phase: "executing", input: event.input } as unknown as ToolState)
+              ? ({ phase: "executing", input: recordedInput } as unknown as ToolState)
               : ({
                   phase: "waiting_confirmation",
-                  input: event.input,
+                  input: recordedInput,
                   description: `${event.name}(${Object.keys(event.input).join(", ")})`,
                   approvalId: event.approvalId,
                   ...this.#collaborationCostFor(event.name),
@@ -10705,20 +10749,31 @@ export class Session {
             );
           }
         }
-        let output = event.output;
+        // Secrets out first (docs/secrets-and-memory-design.md §2): a call whose output is a credential keeps
+        // none of it; every other is scrubbed. Not a redaction of the backend's record — the backend saw the
+        // same — so it doesn't mark the backing session the way a hook's change does.
+        const verdict = this.#toolVerdicts.get(event.sdkToolUseId) ?? "keep";
+        this.#toolVerdicts.delete(event.sdkToolUseId);
+        const stored =
+          verdict === "drop" ? NOT_STORED : verdict === "withhold-output" ? OUTPUT_WITHHELD : typeof event.output === "string" ? this.#scrubText(event.output) : event.output;
+        let output = stored;
+        let hooked = false;
         if (this.#hookBus?.hasHooks("tool_result", hookToolName)) {
           const patched = await this.#hookBus.dispatchToolResult(this.#hookContext(), {
             toolName: hookToolName ?? "",
             output,
             success: event.success,
           });
-          if (patched.updatedOutput !== undefined) output = patched.updatedOutput;
+          if (patched.updatedOutput !== undefined && patched.updatedOutput !== output) {
+            output = this.#scrubText(patched.updatedOutput);
+            hooked = true;
+          }
         }
-        if (output !== event.output) {
+        if (hooked) {
           this.#turnRedacted = true;
           this.#noteRedactedBacking(this.#provider.backingSessionId);
         }
-        this.#accumulator.handleEvent(output === event.output ? event : { ...event, output, redacted: true });
+        this.#accumulator.handleEvent(output === event.output ? event : { ...event, output, ...(hooked ? { redacted: true } : {}) });
         if (msgId) {
           const toolMsg = this.#toolCallMessages.get(msgId);
           if (toolMsg?.tool) {
@@ -11019,6 +11074,11 @@ export class Session {
     if (!this.#activeAssistantMsg) return;
     const m = this.#activeAssistantMsg;
     this.#activeAssistantMsg = null;
+    // What the stream scrubber still held of a cut-off reply.
+    if (this.#textStream) {
+      m.content += this.#textStream.flush();
+      this.#textStream = null;
+    }
     // Rebroadcast ALWAYS — even with empty content. The TUI's store
     // looks for "same messageId with content" to move a live-region
     // entry to committed; an empty rebroadcast wouldn't trigger that,
@@ -11045,7 +11105,8 @@ export class Session {
    * (#flushActiveAssistant nulled it), we return early — the partial content was
    * already committed by the flush.
    */
-  async #artificiallyStreamText(content: string): Promise<void> {
+  async #artificiallyStreamText(raw: string): Promise<void> {
+    const content = this.#scrubText(raw);
     const FRAME_MS = 16;
     const steps = Math.min(30, content.length);
     const charsPerStep = Math.ceil(content.length / steps);
@@ -11091,6 +11152,10 @@ export class Session {
     const m = this.#activeThinkingMsg;
     this.#activeThinkingMsg = null;
     this.#activeThinkingIndex = null;
+    if (this.#thinkingStream) {
+      m.content += this.#thinkingStream.flush();
+      this.#thinkingStream = null;
+    }
     if (!m.content || m.content.length === 0) {
       // Not an elision by codeoid — the backend returned no readable reasoning.
       // Claude does this whenever `thinking.display` is `"omitted"`; backends
@@ -12220,6 +12285,7 @@ export class Session {
    * of two half-episodes.
    */
   #commitStreamed(msg: SessionMessage): void {
+    this.#scrubMessage(msg);
     this.#scrollback.push(msg);
     this.#transcriptStore.append(this.id, msg, this.#seq++).catch((e) => {
       console.error(
@@ -12229,8 +12295,59 @@ export class Session {
     this.#chunker?.onMessage(msg);
   }
 
+  /** Who and where a scrub is for: a kept secret lands in this tenant and home workstream. */
+  #scrubContext() {
+    return { accountId: this.accountId, projectId: this.projectId, workstream: this.#workstream?.id, sessionId: this.id };
+  }
+
+  /** `text` with no secret's value in it (docs/secrets-and-memory-design.md §2). */
+  #scrubText(text: string): string {
+    return this.#secrets ? this.#secrets.scrub(text, this.#scrubContext()).text : text;
+  }
+
+  #scrubValue<T>(value: T): T {
+    return this.#secrets ? this.#secrets.scrubValue(value, this.#scrubContext()).value : value;
+  }
+
+  /**
+   * Scrub a message in place before it is buffered, written or sent: its
+   * text, parts, tool input and state, and meta. Scrubbing is idempotent (a
+   * reference is never taken for a secret), so a message scrubbed twice is
+   * unchanged.
+   */
+  #scrubMessage(msg: SessionMessage): void {
+    if (!this.#secrets) return;
+    if (typeof msg.content === "string" && msg.content) msg.content = this.#scrubText(msg.content);
+    if (msg.parts) msg.parts = this.#scrubValue(msg.parts);
+    if (msg.tool) {
+      msg.tool.input = this.#scrubValue(msg.tool.input);
+      msg.tool.state = this.#scrubValue(msg.tool.state);
+    }
+    if (msg.metadata) msg.metadata = this.#scrubValue(msg.metadata);
+  }
+
+  /**
+   * What is recorded of a tool call's input: scrubbed, or, for a write of a
+   * credential file, without what was written (secrets/verdict.ts).
+   */
+  #recordedToolInput(verdict: ToolVerdict, input: Record<string, unknown>): Record<string, unknown> {
+    if (verdict === "drop") {
+      // A call the user listed as never stored: nothing of what it was given is kept.
+      return Object.fromEntries(Object.entries(input).map(([k, v]) => [k, typeof v === "string" ? NOT_STORED : v]));
+    }
+    if (verdict === "withhold-written") {
+      // A file tool writing a credential file: the path stays, what it writes doesn't. A shell line
+      // writing one stays readable (it is on the approval card), scrubbed.
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(input)) out[k] = /^(?:content|new_string|old_string|edits|new_source|patch)$/.test(k) ? WRITTEN_WITHHELD : v;
+      return this.#scrubValue(out);
+    }
+    return this.#scrubValue(input);
+  }
+
   /** Persist to transcript + scrollback buffer + memory chunker */
   #persistAndBuffer(msg: SessionMessage): void {
+    this.#scrubMessage(msg);
     // A notice for a session whose history isn't loaded (a mode change, a
     // rename) doesn't load it: it is kept for the load.
     this.#buffer(msg);
diff --git a/src/daemon/share/pack.ts b/src/daemon/share/pack.ts
index b39b490f..70feeb1f 100644
--- a/src/daemon/share/pack.ts
+++ b/src/daemon/share/pack.ts
@@ -66,6 +66,12 @@ export interface PackDependencies {
   memory: MemoryEngine | null;
   /** Workspace id resolver (for memory episode lookups). */
   workspaceIdFor: (workdir: string) => string;
+  /**
+   * The daemon's secret scrubbing (docs/secrets-and-memory-design.md §2.6):
+   * a transcript or episode written before it, and a pinned file, go into a
+   * bundle scrubbed. Absent: packed as stored.
+   */
+  scrub?: <T>(value: T) => T;
 }
 
 export async function packSession(
@@ -83,7 +89,7 @@ export async function packSession(
     const msg = entry.message as unknown as SessionMessage;
     if (!msg || typeof msg !== "object") continue;
     if (!("messageId" in msg) || !msg.messageId) continue;
-    transcript.push(rewriteMessage(msg, workdir, alias));
+    transcript.push(rewriteMessage(deps.scrub ? deps.scrub(msg) : msg, workdir, alias));
   }
 
   // ---------- Memory episodes (per-session slice) ----------
@@ -95,8 +101,8 @@ export async function packSession(
         id: ep.id,
         kind: ep.kind,
         ...(ep.toolName ? { toolName: ep.toolName } : {}),
-        summary: rewriteTextPaths(ep.summary, workdir, alias),
-        content: rewriteTextPaths(ep.content, workdir, alias),
+        summary: rewriteTextPaths(deps.scrub ? deps.scrub(ep.summary) : ep.summary, workdir, alias),
+        content: rewriteTextPaths(deps.scrub ? deps.scrub(ep.content) : ep.content, workdir, alias),
         filePaths: encodePathArray(ep.filePaths, workdir, alias),
         tokenEstimate: ep.tokenEstimate,
         createdAt: ep.createdAt,
@@ -130,7 +136,9 @@ export async function packSession(
       } catch {
         continue;
       }
-      const snap = await capturePinnedFile(abs, cap);
+      const captured = await capturePinnedFile(abs, cap);
+      // Text only: a binary file's base64 isn't text a secret could be found in, and changing it would break it.
+      const snap = captured && deps.scrub && captured.encoding === "utf-8" ? { ...captured, content: deps.scrub(captured.content) } : captured;
       if (snap) {
         const key = encodePath(abs, workdir, alias);
         pinnedFiles[key] = snap;
diff --git a/src/daemon/store.ts b/src/daemon/store.ts
index ad90d51a..9cf5c436 100644
--- a/src/daemon/store.ts
+++ b/src/daemon/store.ts
@@ -440,6 +440,23 @@ export class Store {
       -- How each folder last resolved to a workstream, per tenant
       -- (docs/workstreams-design.md §5.1): a repository rule that matches
       -- differently later (an edited origin) is refused, not a silent re-home.
+      -- Detected secrets a workstream keeps (captureSecrets: "vault";
+      -- docs/secrets-and-memory-design.md §2.5): the value encrypted under a
+      -- key outside the database (secrets/vault.ts), so a copy of this file
+      -- alone holds none. Per tenant and workstream ('' = no workstream).
+      CREATE TABLE IF NOT EXISTS captured_secrets (
+        account_id   TEXT NOT NULL,
+        project_id   TEXT NOT NULL,
+        workstream   TEXT NOT NULL,
+        fingerprint  TEXT NOT NULL,
+        kind         TEXT NOT NULL,
+        sealed       BLOB NOT NULL,
+        session_id   TEXT,
+        first_seen   INTEGER NOT NULL,
+        last_seen    INTEGER NOT NULL,
+        PRIMARY KEY (account_id, project_id, workstream, fingerprint)
+      );
+
       CREATE TABLE IF NOT EXISTS workstream_folders (
         account_id  TEXT NOT NULL,
         project_id  TEXT NOT NULL,
@@ -2003,6 +2020,84 @@ export class Store {
       .run(scope.accountId, scope.projectId, scope.workdir, server, fingerprint, approvedBy);
   }
 
+  /**
+   * Every credential value the database holds (docs/secrets-and-memory-design.md
+   * §2.2): MCP OAuth tokens and client secrets, and the conductor's API key —
+   * matched exactly wherever they show up, never stored again.
+   */
+  knownSecretValues(): Array<{ label: string; value: string }> {
+    const out: Array<{ label: string; value: string }> = [];
+    const oauth = this.#db.prepare("SELECT server, credential, client_json, tokens_json FROM mcp_oauth_credentials").all() as Array<{
+      server: string;
+      credential: string;
+      client_json: string | null;
+      tokens_json: string | null;
+    }>;
+    for (const r of oauth) {
+      const label = `oauth:${r.credential || r.server}`;
+      for (const json of [r.tokens_json, r.client_json]) {
+        if (!json) continue;
+        try {
+          const obj = JSON.parse(json) as Record<string, unknown>;
+          for (const k of ["access_token", "refresh_token", "id_token", "client_secret"]) {
+            const v = obj[k];
+            if (typeof v === "string") out.push({ label, value: v });
+          }
+        } catch {
+          // Unreadable: nothing to match.
+        }
+      }
+    }
+    const conductor = this.#db.prepare("SELECT api_key FROM conductor_identity").all() as Array<{ api_key: string }>;
+    for (const r of conductor) out.push({ label: "daemon:conductor-key", value: r.api_key });
+    return out;
+  }
+
+  /** Keep a detected secret (sealed by the caller), or note it was seen again. */
+  putCapturedSecret(row: { accountId: string; projectId: string; workstream: string; fingerprint: string; kind: string; sealed: Uint8Array; sessionId?: string; at: number }): void {
+    this.#db
+      .prepare(
+        `INSERT INTO captured_secrets (account_id, project_id, workstream, fingerprint, kind, sealed, session_id, first_seen, last_seen)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (account_id, project_id, workstream, fingerprint) DO UPDATE SET last_seen = excluded.last_seen, session_id = excluded.session_id`,
+      )
+      .run(row.accountId, row.projectId, row.workstream, row.fingerprint, row.kind, row.sealed, row.sessionId ?? null, row.at, row.at);
+  }
+
+  /** A tenant's kept secrets, newest first, without their values; one workstream's when given. */
+  listCapturedSecrets(scope: { accountId: string; projectId: string; workstream?: string }): Array<{ workstream: string; fingerprint: string; kind: string; sessionId: string | null; firstSeen: number; lastSeen: number }> {
+    const rows = (
+      scope.workstream === undefined
+        ? this.#db.prepare("SELECT workstream, fingerprint, kind, session_id, first_seen, last_seen FROM captured_secrets WHERE account_id = ? AND project_id = ? ORDER BY last_seen DESC").all(scope.accountId, scope.projectId)
+        : this.#db
+            .prepare("SELECT workstream, fingerprint, kind, session_id, first_seen, last_seen FROM captured_secrets WHERE account_id = ? AND project_id = ? AND workstream = ? ORDER BY last_seen DESC")
+            .all(scope.accountId, scope.projectId, scope.workstream)
+    ) as Array<{ workstream: string; fingerprint: string; kind: string; session_id: string | null; first_seen: number; last_seen: number }>;
+    return rows.map((r) => ({ workstream: r.workstream, fingerprint: r.fingerprint, kind: r.kind, sessionId: r.session_id, firstSeen: r.first_seen, lastSeen: r.last_seen }));
+  }
+
+  /** A kept secret's sealed value, in one workstream. */
+  capturedSecret(scope: { accountId: string; projectId: string; workstream: string; fingerprint: string }): { kind: string; sealed: Uint8Array } | undefined {
+    const row = this.#db
+      .prepare("SELECT kind, sealed FROM captured_secrets WHERE account_id = ? AND project_id = ? AND workstream = ? AND fingerprint = ?")
+      .get(scope.accountId, scope.projectId, scope.workstream, scope.fingerprint) as { kind: string; sealed: Uint8Array } | null;
+    return row ?? undefined;
+  }
+
+  /** Forget a kept secret; true when there was one. */
+  deleteCapturedSecret(scope: { accountId: string; projectId: string; workstream: string; fingerprint: string }): boolean {
+    return (
+      this.#db
+        .prepare("DELETE FROM captured_secrets WHERE account_id = ? AND project_id = ? AND workstream = ? AND fingerprint = ?")
+        .run(scope.accountId, scope.projectId, scope.workstream, scope.fingerprint).changes > 0
+    );
+  }
+
+  /** Forget kept secrets not seen since `before` (ms); returns how many. */
+  expireCapturedSecrets(before: number): number {
+    return this.#db.prepare("DELETE FROM captured_secrets WHERE last_seen < ?").run(before).changes;
+  }
+
   /** The workstream a folder last resolved to, for this tenant (workstreams §5.1). */
   workstreamFolder(scope: { accountId: string; projectId: string; workdir: string }): string | undefined {
     const row = this.#db
diff --git a/src/daemon/workstreams/effective.ts b/src/daemon/workstreams/effective.ts
index 8331192e..21175d4d 100644
--- a/src/daemon/workstreams/effective.ts
+++ b/src/daemon/workstreams/effective.ts
@@ -10,7 +10,7 @@
  *  - maps (env, accounts) and scalars (defaults, git fields) are overridden by
  *    the most specific setting;
  *  - `exclude` is applied after the merge;
- *  - `match`, `claim`, `share` and `allowOverride` are never inherited: they
+ *  - `match`, `claim`, `share`, `captureSecrets` and `allowOverride` are never inherited: they
  *    describe this workstream's own folders.
  *
  * The config was validated (no cycles, every base exists) before this runs;
@@ -36,6 +36,8 @@ export interface EffectiveWorkstream {
   claim: "exclusive" | "suggest";
   allowOverride: boolean;
   share: "open" | "ask" | "closed";
+  /** Not inherited either: whether this workstream keeps detected secrets (§2.5 of secrets-and-memory-design.md). */
+  captureSecrets: "drop" | "vault";
   match: { paths: string[]; remotes: string[] };
   servers: EffectiveServer[];
   accounts: Record<string, string>;
@@ -104,6 +106,7 @@ export function effectiveWorkstreams(items: readonly WorkstreamItemConfig[]): Ma
       claim: item.claim,
       allowOverride: item.allowOverride,
       share: item.share,
+      captureSecrets: item.captureSecrets,
       match: { paths: [...item.match.paths], remotes: [...item.match.remotes] },
       servers: [...servers.values()].filter((s) => !excluded.has(s.server)),
       accounts,
diff --git a/src/daemon/workstreams/schema.ts b/src/daemon/workstreams/schema.ts
index bbc54b11..e376d6af 100644
--- a/src/daemon/workstreams/schema.ts
+++ b/src/daemon/workstreams/schema.ts
@@ -101,6 +101,8 @@ export const workstreamItemSchema = z
     allowOverride: z.boolean().default(true),
     /** Whether other workstreams may reference this one (§7.1). */
     share: z.enum(["open", "ask", "closed"]).default("ask"),
+    /** A detected secret's value: dropped, or kept in the vault for the owner (docs/secrets-and-memory-design.md §2.5). */
+    captureSecrets: z.enum(["drop", "vault"]).default("drop"),
     mcpServers: z.array(serverRefSchema).max(256).default([]),
     /** Names (from the lists above, after `extends`) taken away again. */
     exclude: z.array(z.string().min(1).max(128)).max(256).default([]),
diff --git a/src/tests/protocol.test.ts b/src/tests/protocol.test.ts
index 6acc4e37..5335e5c5 100644
--- a/src/tests/protocol.test.ts
+++ b/src/tests/protocol.test.ts
@@ -470,6 +470,10 @@ describe("DaemonMessage routing", () => {
           return `workstreams.changed:${msg.revision}`;
         case "credential.list.result":
           return `credential.list:${msg.credentials.length}`;
+        case "secret.list.result":
+          return `secrets:${msg.secrets.length}`;
+        case "secret.reveal.result":
+          return `secret:${msg.kind}`;
         case "session.turns.result":
           return `turns:${msg.turns.length}`;
         case "session.approvals.result":
diff --git a/src/tests/secrets-session.test.ts b/src/tests/secrets-session.test.ts
new file mode 100644
index 00000000..4ac28ed4
--- /dev/null
+++ b/src/tests/secrets-session.test.ts
@@ -0,0 +1,211 @@
+/**
+ * Secrets in what sessions store (docs/secrets-and-memory-design.md §2): a
+ * secret a tool prints, a reply streams or a prompt carries never reaches the
+ * transcript, the canonical history, the scrollback, memory or a share
+ * bundle; a value codeoid knows is named, a detected one fingerprinted, kept
+ * only where a workstream says so, and revealed only to its owner.
+ */
+import { afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { CodeoidConfig } from "../config.js";
+import type { Embedder } from "../daemon/memory/embedder.js";
+import { MemoryEngine, SqliteEpisodeStore } from "../daemon/memory/index.js";
+import type { ProviderEvent } from "../daemon/providers/interface.js";
+import { MockSessionProvider } from "../daemon/providers/mock/session-provider.js";
+import { SecretService } from "../daemon/secrets/service.js";
+import { SessionManager } from "../daemon/session-manager.js";
+import { loadShellParser } from "../daemon/shell/parse.js";
+import { Store } from "../daemon/store.js";
+import { TranscriptStore } from "../daemon/transcript.js";
+import { FolderReader } from "../daemon/workstreams/folder.js";
+import { workstreamsSchema } from "../daemon/workstreams/schema.js";
+import { ALL_SCOPES } from "../protocol/scopes.js";
+import type { AuthContext, SessionInfo } from "../protocol/types.js";
+
+class StubEmbedder implements Embedder {
+  readonly modelName = "stub";
+  readonly dimensions = 8;
+  async init(): Promise<void> {}
+  async embed(texts: string[]): Promise<Float32Array[]> {
+    return texts.map(() => new Float32Array(8).fill(0.35));
+  }
+  async close(): Promise<void> {}
+}
+
+const AUTH: AuthContext = { sub: "user:owner", scopes: [...ALL_SCOPES] as AuthContext["scopes"], delegationDepth: 0, accountId: "acc-s", projectId: "proj-s" };
+const CLIENT = { id: "client-s", auth: AUTH, send: () => {} };
+const done: ProviderEvent = { type: "turn_done", result: { providerId: "mock", model: "m", inputTokens: 1, outputTokens: 1, cacheReadTokens: 0, cacheCreationTokens: 0, totalCostUsd: 0, durationMs: 1 } } as ProviderEvent;
+
+// Made-up credentials of the right shape, split so no contiguous token sits in this file.
+const GHP = "ghp_" + "Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V";
+const KNOWN = "known-cred-" + "9f8e7d6c5b4a";
+
+let tmp: string;
+let home: string;
+let store: Store;
+let transcript: TranscriptStore;
+let memory: MemoryEngine;
+let manager: SessionManager;
+let secrets: SecretService;
+let script: ProviderEvent[][];
+
+beforeAll(async () => {
+  await loadShellParser();
+});
+
+beforeEach(() => {
+  tmp = realpathSync(mkdtempSync(join(tmpdir(), "codeoid-secrets-")));
+  home = join(tmp, "home");
+  for (const d of ["mine", "vaulted"]) mkdirSync(join(home, d), { recursive: true });
+  store = new Store(join(tmp, "codeoid.db"));
+  transcript = new TranscriptStore(join(tmp, "transcripts"));
+  memory = new MemoryEngine({ store: new SqliteEpisodeStore(join(tmp, "mem.db")), embedder: new StubEmbedder() });
+  const config = {
+    daemonUrl: "ws://127.0.0.1:7400",
+    dbPath: join(tmp, "codeoid.db"),
+    transcriptDir: join(tmp, "transcripts"),
+    auth: { baseUrl: "http://localhost:8899" },
+    zeroidUrl: "http://localhost:8899",
+    workspaceIndex: { enabled: false, episodeThreshold: 5, timeThresholdMs: 60_000, debounceMs: 15_000 },
+    compress: { enabled: false, excludeCommands: [], excludePatterns: [], compressPipes: false, minBytes: 1024 },
+    labeling: {},
+    telemetry: { osc8: "auto" },
+    autoRotate: { enabled: false, warnPct: 0.6, rotatePct: 0.8, hardRotatePct: 0.9, minTurnsBeforeRotate: 3, strategy: "task-anchor" },
+    session: {},
+    workstreams: workstreamsSchema.parse({
+      items: [
+        { id: "mine", match: { paths: ["~/mine"] } },
+        { id: "vaulted", captureSecrets: "vault", match: { paths: ["~/vaulted"] } },
+      ],
+    }),
+  } as unknown as CodeoidConfig;
+  secrets = new SecretService({ configDir: join(tmp, "config"), store });
+  secrets.addKnown("test", () => [{ label: "gh-test", value: KNOWN }]);
+  manager = new SessionManager(store, transcript, undefined, undefined, memory, {
+    config,
+    _testProviderFactory: () => new MockSessionProvider("mock", script),
+    _testFolderReader: new FolderReader({ home, sshConfig: "" }),
+    secretService: secrets,
+  });
+  manager.setMemory(memory);
+});
+
+afterEach(async () => {
+  try {
+    await manager.drain(3000);
+  } catch {}
+  await transcript.flush();
+  store.close();
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+async function runIn(dir: string): Promise<{ id: string }> {
+  const made = (await manager.handle({ type: "session.create", id: "c", name: "s", workdir: join(home, dir) } as never, AUTH, CLIENT)) as { data: SessionInfo };
+  const session = manager._sessionForTest(made.data.id)!;
+  let sent = false;
+  const sending = session.send(`please use ${KNOWN} for this`, AUTH).finally(() => {
+    sent = true;
+  });
+  // Approve whatever the guarded session asks (a shell command, a write) until the turn is over.
+  const end = Date.now() + 3000;
+  while (!sent || session.status !== "idle" || session.pendingToolApprovals().length > 0) {
+    for (const p of session.pendingToolApprovals()) session.approve(p.approvalId, true, AUTH);
+    if (Date.now() > end) throw new Error(`timed out (${session.status})`);
+    await Bun.sleep(5);
+  }
+  await sending;
+  await transcript.flush();
+  await memory.drain();
+  return { id: made.data.id };
+}
+
+/** Everything the session stored, as text. */
+function storedText(id: string): string {
+  const parts = [readFileSync(transcript.transcriptPath(id), "utf8"), readFileSync(transcript.canonicalPath(id), "utf8")];
+  for (const ep of memory.store.listEpisodesForSession(id)) parts.push(ep.summary, ep.content, memory.store.getFullContent(ep.id) ?? "");
+  return parts.join("\n");
+}
+
+describe("what a session stores holds no secret's value", () => {
+  test("a tool's output, a streamed reply, thinking and the prompt", async () => {
+    script = [
+      [
+        { type: "thinking_delta", content: `the token is ${GHP.slice(0, 10)}` } as ProviderEvent,
+        { type: "thinking_delta", content: `${GHP.slice(10)} hmm` } as ProviderEvent,
+        { type: "thinking_done" } as ProviderEvent,
+        { type: "tool_start", toolId: "t1", sdkToolUseId: "sdk-t1", name: "Read", input: { file_path: join(home, "mine", "notes.md") }, approvalId: "ap-1" } as ProviderEvent,
+        { type: "tool_complete", sdkToolUseId: "sdk-t1", success: true, output: `token=${GHP}\nknown ${KNOWN}\nDB_PASSWORD=hunter2xyz` } as ProviderEvent,
+        { type: "text_delta", content: `Found ${GHP.slice(0, 7)}` } as ProviderEvent,
+        { type: "text_delta", content: `${GHP.slice(7)} and ${KNOWN.slice(0, 5)}` } as ProviderEvent,
+        { type: "text_delta", content: `${KNOWN.slice(5)} done.` } as ProviderEvent,
+        { type: "text_done", content: `Found ${GHP} and ${KNOWN} done.` } as ProviderEvent,
+        done,
+      ],
+    ];
+    const sent: string[] = [];
+    const { id } = await runIn("mine");
+    const text = storedText(id);
+    for (const secret of [GHP, KNOWN, "hunter2xyz"]) expect(text).not.toContain(secret);
+    expect(text).toContain("‹credential:gh-test›");
+    expect(text).toMatch(/‹secret:github-token:[0-9a-f]{8}›/);
+    // The scrollback a client replays on attach.
+    const attached = (await manager.handle({ type: "session.attach", id: "a", sessionId: id } as never, AUTH, { ...CLIENT, send: (m: unknown) => sent.push(JSON.stringify(m)) })) as unknown;
+    const replay = JSON.stringify(attached) + sent.join("\n");
+    for (const secret of [GHP, KNOWN, "hunter2xyz"]) expect(replay).not.toContain(secret);
+  });
+
+  test("a command that prints credentials keeps no output; a credential file's write keeps no content", async () => {
+    script = [
+      [
+        { type: "tool_start", toolId: "t1", sdkToolUseId: "sdk-t1", name: "Bash", input: { command: "gh auth token" }, approvalId: "ap-1" } as ProviderEvent,
+        { type: "tool_complete", sdkToolUseId: "sdk-t1", success: true, output: "unshaped-but-secret-1234567" } as ProviderEvent,
+        { type: "tool_start", toolId: "t2", sdkToolUseId: "sdk-t2", name: "Write", input: { file_path: join(home, "mine", ".env"), content: "PLAIN=unshaped-value-987654" }, approvalId: "ap-2" } as ProviderEvent,
+        { type: "tool_complete", sdkToolUseId: "sdk-t2", success: true, output: "ok" } as ProviderEvent,
+        done,
+      ],
+    ];
+    const { id } = await runIn("mine");
+    const text = storedText(id);
+    expect(text).not.toContain("unshaped-but-secret-1234567");
+    expect(text).not.toContain("unshaped-value-987654");
+    expect(text).toContain("‹output withheld: it prints credentials›");
+    expect(text).toContain("‹content withheld: a credential file›");
+  });
+});
+
+describe("kept secrets", () => {
+  const leak = (): ProviderEvent[][] => [
+    [
+      { type: "tool_start", toolId: "t1", sdkToolUseId: "sdk-t1", name: "Read", input: { file_path: "x.md" }, approvalId: "ap-1" } as ProviderEvent,
+      { type: "tool_complete", sdkToolUseId: "sdk-t1", success: true, output: `token=${GHP}` } as ProviderEvent,
+      done,
+    ],
+  ];
+
+  test("dropped by default; kept where the workstream says vault, and revealed only to its owner's own token", async () => {
+    script = leak();
+    await runIn("mine");
+    const none = (await manager.handle({ type: "secret.list", id: "l1" } as never, AUTH, CLIENT)) as { secrets: unknown[] };
+    expect(none.secrets).toEqual([]);
+
+    script = leak();
+    await runIn("vaulted");
+    const listed = (await manager.handle({ type: "secret.list", id: "l2" } as never, AUTH, CLIENT)) as { secrets: Array<{ workstream: string; fingerprint: string; kind: string }> };
+    expect(listed.secrets).toHaveLength(1);
+    const kept = listed.secrets[0]!;
+    expect(kept).toMatchObject({ workstream: "vaulted", kind: "github-token" });
+
+    const delegated = { ...AUTH, delegationDepth: 1 };
+    expect(await manager.handle({ type: "secret.reveal", id: "r1", workstream: "vaulted", fingerprint: kept.fingerprint } as never, delegated, CLIENT)).toMatchObject({ code: "forbidden" });
+    // Another workstream doesn't have it.
+    expect(await manager.handle({ type: "secret.reveal", id: "r2", workstream: "mine", fingerprint: kept.fingerprint } as never, AUTH, CLIENT)).toMatchObject({ code: "not_found" });
+    expect(await manager.handle({ type: "secret.reveal", id: "r3", workstream: "vaulted", fingerprint: kept.fingerprint } as never, AUTH, CLIENT)).toMatchObject({ type: "secret.reveal.result", value: GHP });
+    // Another tenant doesn't either.
+    const other = { ...AUTH, accountId: "acc-other" };
+    expect(await manager.handle({ type: "secret.reveal", id: "r4", workstream: "vaulted", fingerprint: kept.fingerprint } as never, other, CLIENT)).toMatchObject({ code: "not_found" });
+    expect(await manager.handle({ type: "secret.forget", id: "f1", workstream: "vaulted", fingerprint: kept.fingerprint } as never, AUTH, CLIENT)).toMatchObject({ type: "response.ok" });
+    expect(((await manager.handle({ type: "secret.list", id: "l3" } as never, AUTH, CLIENT)) as { secrets: unknown[] }).secrets).toEqual([]);
+  });
+});

From c52c6407c8439421588ffefa8fa0b86405ddc8a5 Mon Sep 17 00:00:00 2001
From: Yash Datta <yd2590@columbia.edu>
Date: Fri, 13 Nov 2026 08:57:56 +0800
Subject: [PATCH 2/4] =?UTF-8?q?fix:=20secrets=20S1=20audit=20round=201=20?=
 =?UTF-8?q?=E2=80=94=20the=20turn's=20prompt=20reaches=20stateless=20backe?=
 =?UTF-8?q?nds=20as=20written,=20code=20isn't=20taken=20for=20a=20secret,?=
 =?UTF-8?q?=20and=20every=20write=20path=20is=20scrubbed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- a stateless backend's current prompt is the user's own (Session#historyForTurn)
- detection: identifiers, dotted paths and calls are code; env-style values stop
  at the next word; a private key only with armour's body, found linearly, as
  is curl -u; .netrc; codeoid's own token formats; the budget checked inside
  each pattern
- exact matching in one Aho-Corasick pass, never inside a reference (scrubbing
  is idempotent); only distinct formats are remembered, per tenant, as whole
  tokens, apart from the known set
- streaming holds from where a credential may start, judged with the line so
  far, never inside a spaced known value, and flushes before a tool call
- scrubbed now: a hook-rewritten input, the turn index, a fork's seeded
  history, pending approvals by verdict, a session's last error, settled
  dispatch tasks, routine run outputs, MCP results through the relay; pinned
  credential files and withheld outputs' spill files are dropped
- verdicts: source / . / cp and *.pem no longer withhold; $HOME paths, git
  show/diff, dd if= and the unparsed fallback do
- codeoid secret scrub: no budget, nothing remembered, unchecked text kept and
  counted, rotated segments, databases rebuilt so old text is gone
- key files written whole and linked into place, permissions checked; GCM tag
  length pinned; the canonical scrub fails closed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/CONFIGURATION.md              |   4 +
 docs/secrets-and-memory-design.md  |  45 +++++--
 e2e/specs/secrets.spec.ts          |   7 +-
 src/cli.ts                         |   9 +-
 src/daemon/mcp/hub.ts              |  27 ++++
 src/daemon/mcp/proxy.ts            |   8 +-
 src/daemon/providers/canonical.ts  |  16 ++-
 src/daemon/routines/store.ts       |  19 ++-
 src/daemon/secrets/detect.ts       | 115 ++++++++++++++---
 src/daemon/secrets/files.ts        |   6 +-
 src/daemon/secrets/fingerprint.ts  |  28 ++++-
 src/daemon/secrets/known.ts        | 196 ++++++++++++++++++++++-------
 src/daemon/secrets/scrub-stored.ts |  24 +++-
 src/daemon/secrets/scrub.ts        | 126 +++++++++++++++----
 src/daemon/secrets/secrets.test.ts | 112 +++++++++++++++--
 src/daemon/secrets/service.ts      |  32 ++++-
 src/daemon/secrets/vault.ts        |   4 +-
 src/daemon/secrets/verdict.ts      |  47 ++++---
 src/daemon/server.ts               |  15 +++
 src/daemon/session-manager.ts      |   7 +-
 src/daemon/session.ts              |  70 +++++++++--
 src/daemon/share/pack.ts           |  12 +-
 src/daemon/store.ts                |  27 ++++
 src/tests/secrets-session.test.ts  |  28 ++++-
 24 files changed, 818 insertions(+), 166 deletions(-)

diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 99c768c3..78bcaccc 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -546,6 +546,10 @@ Settings, under `secrets`:
 | `dropCommands` | `[]` | Commands whose calls aren't stored at all (`"my-vault dump"`). |
 | `credentialFiles` | `[]` | More files whose contents are credentials (globs, by name or path). |
 
+A value found only by the name it sits under (`DB_PASSWORD=…`) is replaced there, but not remembered: repeated bare later, it isn't recognised. A token of a distinct format (a vendor's token, a JWT, a bearer token) is, for the rest of the daemon's run.
+
+An OpenAI-compatible, Gemini or llama.cpp session is sent its earlier turns from codeoid's stored history: from the next turn on, its model sees a secret it read earlier as the reference.
+
 Limits. The backend has already seen a value by the time codeoid stores the result, and a CLI backend keeps its own copy (Claude Code's `~/.claude/projects`, Codex's sessions), which codeoid doesn't change. A secret with no known shape, that codeoid doesn't know, in a command not on the list, still gets through. Design: [secrets-and-memory-design.md](secrets-and-memory-design.md).
 
 ## Signing a backend in, instead of pasting a key
diff --git a/docs/secrets-and-memory-design.md b/docs/secrets-and-memory-design.md
index 0f39cdfe..84eb2d84 100644
--- a/docs/secrets-and-memory-design.md
+++ b/docs/secrets-and-memory-design.md
@@ -54,13 +54,17 @@ agent echoed, an MCP server's bearer token in an error, the backend key. Codeoid
 exactly, so they are replaced by exact match, with no guessing and no false positives. `KnownSecrets`
 (new, `secrets/known.ts`) gathers them from every source, each under a label:
 
-| Source | Label |
+| Source | Reference |
 | --- | --- |
-| `credentials[]` values in the secret store (W1) | `credential:<id>` |
-| MCP OAuth access and refresh tokens (`mcp/oauth.ts`) | `credential:oauth:<server>` |
-| Backend accounts' keys (`accounts.ts`, `claude-accounts.ts`, `oai:` endpoints) | `credential:account:<name>` |
-| The daemon's own keys (`CODEOID_API_KEY`, `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `TELEGRAM_BOT_TOKEN`, …) | `credential:daemon:<name>` |
-| Agent identity tokens codeoid mints (ZeroID, `agent-identity.ts`) | `credential:agent-token` |
+| `credentials[]` values in the secret store (W1) | `‹credential:<id>›` |
+| MCP OAuth access and refresh tokens, client secrets (`mcp_oauth_credentials`) | `‹credential:oauth:<credential or server>›` |
+| Backend accounts' tokens, headers and env (`accounts.ts`) | `‹credential:account:<backend>:<name>›` |
+| OpenAI-compatible endpoints' keys and headers (`openai-endpoints.ts`) | `‹credential:endpoint:<name>›` |
+| The daemon's own keys in its environment (`CODEOID_*`, `*_API_KEY`, `*_TOKEN`, `*_SECRET`, `*_PASSWORD`, …) | `‹credential:daemon:<name>›` |
+| The conductor's key (`conductor_identity`), the MCP relay's live per-session tokens | `‹credential:daemon:…›` |
+
+ZeroID tokens minted for agents are JWTs, and codeoid's own MCP tokens (`bbt_`, `mmt_`, `sbt_`,
+`rt_`) have formats of their own: both are found by shape (§2.3).
 
 Each value is matched as written, URL-encoded, and base64 as `user:value` (Basic auth). Values shorter
 than 8 characters aren't matched (they would match ordinary text). The set is rebuilt when a source
@@ -78,7 +82,7 @@ to secret-named keys, never "looks random", so hashes and ids survive. The name
 only the value replaced (`DB_PASSWORD=‹secret:password:9c2e41aa›`).
 
 The fingerprint is HMAC-SHA256 of the value under a key made once per daemon
-(`<config dir>/secret-fingerprint.key`, 0600, hidden from every sandbox), truncated to 8 hex
+(`<config dir>/secrets/fingerprint.key`, 0600, hidden from every sandbox), truncated to 8 hex
 characters. Without the key a fingerprint can't be checked against a guess.
 
 Scanning has a time budget (atuin's: 250 ms). Text that can't be scanned within it isn't stored; a
@@ -136,12 +140,15 @@ embedders get none) at every place codeoid stores or sends on a conversation:
 | Tool output, in the `tool_complete` seam (`session.ts`) | before the `tool_result` hooks run, so canonical history, scrollback and transcript all get the scrubbed text. Not marked `redacted` as a hook's change is: the backend saw the same, so forking its own session adds no exposure, and marking it would cost every session that ever printed a secret its native forks |
 | Tool input, at `tool_start` | the recorded copy only; the call runs as the backend made it |
 | User prompts and assistant and thinking text | at the message's commit (`#commitStreamed`, `#persistAndBuffer`) |
-| Live deltas to attached clients | a streaming scrubber holds back the trailing run of non-space characters (at most 512) until the next space or the message's end, so a token is never split across two deltas and sent unscrubbed |
+| Live deltas to attached clients | `StreamScrubber`: a line is held from where a credential may start (a secret-named key and its separator, `Bearer`, a URL's userinfo, a JWT, a private key's armour) to its end, judged with what was already sent of the line; otherwise the trailing run of non-space characters, and never inside a known value with spaces; everything held goes out before a tool call. The committed message is scrubbed whole and replaces what streamed |
 | Every message the session buffers, writes or sends (`#persistAndBuffer`, `#commitStreamed`, a fork's copy of its parent's rows, a settled approval's input) | `Session#scrubMessage`: text, parts, tool input and state, metadata |
 | The canonical history | `CanonicalHistoryAccumulator.scrubTurn` on each turn as it is committed, so no backend is seeded with a value codeoid wouldn't store |
 | `MemoryEngine.ingest` | so anything that ingests (S4's imports included) is scrubbed |
 | `share/pack.ts` | transcripts written before S1 are scrubbed as they are packed |
-| Dispatch digests, routine and loop results, push and Telegram texts | built from scrubbed messages; the push text is scrubbed again |
+| Dispatch digests, routine and loop results | built from scrubbed messages; a settled dispatch task's prompt, digest and error are scrubbed in the database (`Store.scrubText`; until it settles the prompt is what its worker is sent), a routine run's check output, summary and reason as they are written (not its payload, which the run reads back as its data); a session's last error is scrubbed when set |
+| The turn index (`<id>.turns.jsonl`) | the prompt's first line, scrubbed before it is cut |
+| MCP results through the relay (CLI backends' own MCP clients) | `McpHub.scrubRelayed`, as through the hub |
+| Push notifications | carry ids only, no text |
 
 A one-time `codeoid secret scrub [--dry-run]` rewrites what was stored before S1 (transcripts, canonical
 histories, episodes, their FTS rows) with known values and detected secrets, and reports what it changed.
@@ -149,6 +156,16 @@ It is a command, not automatic: it rewrites history, so you run it when you choo
 
 ### 2.7 What S1 doesn't fix
 
+A stateless backend (OpenAI-compatible, Gemini, llama.cpp) is sent its working context from the
+canonical history on every turn, and that history is scrubbed: from the next turn on, such a model
+sees a secret it read earlier as its reference. The prompt of the turn it is answering goes as the
+user wrote it (`Session#historyForTurn`).
+
+A value found only by the name it sits under (`DB_PASSWORD=…`, `password: …`) is replaced there but
+not remembered: the same word is too often ordinary text elsewhere. A value of a distinct format (a
+vendor's token, a JWT, a bearer token, a key) is remembered for the rest of the daemon's run, per
+tenant, and replaced bare wherever it shows up again.
+
 The backend has already seen the value by the time codeoid stores the result, and so has the model. A
 CLI backend keeps its own copy (Claude Code's `~/.claude/projects/…/*.jsonl`, Codex's rollout files).
 Codeoid can change what the model sees only where the output passes through it before the model:
@@ -176,8 +193,14 @@ still gets through. The detector reduces this; it can't end it.
 - Known values: declared credentials, the daemon's environment (`CODEOID_*` and secret-named
   variables), every backend's accounts, OpenAI-compatible endpoints, MCP OAuth tokens and client
   secrets, the conductor's key. Rebuilt on a change, and at least every minute (a token refresh).
-- Streaming: a line that may name a credential is held until it ends, a private key until its end
-  line, otherwise the trailing run of non-space characters; the committed message replaces it.
+- Matching: known and remembered values in one pass (Aho-Corasick), never inside a reference
+  already written; remembered ones as whole tokens. Detection is linear: private keys and curl's
+  `-u` are found in code, the time budget is checked inside each pattern's matches too.
+- Streaming: see §2.6.
+- `codeoid secret scrub` takes no time budget, remembers nothing across texts, leaves a text it
+  can't check as it is (and says how many), includes rotated transcript segments, and rebuilds
+  each database it changed (FTS optimize, WAL checkpoint, VACUUM) so replaced text is gone from
+  disk.
 - Protocol: `secret.list` (settings:read), `secret.reveal`, `secret.forget` (settings:write, the
   caller's own token, audited without the value). CLI: `codeoid secret ls | reveal | forget | promote |
   scrub [--dry-run]`; `promote` reveals, declares an env credential, sets its value and forgets the
diff --git a/e2e/specs/secrets.spec.ts b/e2e/specs/secrets.spec.ts
index a9c80a75..380e848c 100644
--- a/e2e/specs/secrets.spec.ts
+++ b/e2e/specs/secrets.spec.ts
@@ -5,6 +5,7 @@ import { createSessionInUi, expect, messages, openUi, send, test, waitIdle } fro
 // Made-up credentials of the right shape, split so no contiguous token sits in this file.
 const GHP = `ghp_${"Zx9Qw3Er5Ty7Ui1Op2As4Df6Gh8Jk0Lz3Xc5V"}`;
 const PASSWORD = `hunter${"2xyz"}`;
+const BEARER = `8f2d0c1e${"9b7a4f6e8d2c"}`;
 
 /** Every transcript, canonical history and turn index the daemon wrote. */
 function storedText(configDir: string): string {
@@ -28,8 +29,8 @@ test("a leaked token is shown and stored as a reference, kept where the workstre
     {
       match: "^leak",
       steps: [
-        { tool: "Read", input: { file_path: "notes.md" }, output: `token=${GHP}\nDB_PASSWORD=${PASSWORD}\n` },
-        { text: `The token is ${GHP}, and the password is ${PASSWORD}.` },
+        { tool: "Read", input: { file_path: "notes.md" }, output: `token=${GHP}\nDB_PASSWORD=${PASSWORD}\nAuthorization: Bearer ${BEARER}\n` },
+        { text: `The token is ${GHP}, and the session token is ${BEARER}.` },
       ],
     },
   ]);
@@ -46,11 +47,13 @@ test("a leaked token is shown and stored as a reference, kept where the workstre
   await expect(main).toContainText(/‹secret:github-token:[0-9a-f]{8}›/);
   await expect(main).not.toContainText(GHP);
   await expect(main).not.toContainText(PASSWORD);
+  await expect(main).not.toContainText(BEARER);
 
   // On disk: the same.
   const stored = storedText(codeoid.configDir);
   expect(stored).not.toContain(GHP);
   expect(stored).not.toContain(PASSWORD);
+  expect(stored).not.toContain(BEARER);
   expect(stored).toMatch(/‹secret:github-token:[0-9a-f]{8}›/);
 
   // A new page load replays the scrollback: still references.
diff --git a/src/cli.ts b/src/cli.ts
index e4662b24..47e1c703 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -1813,7 +1813,13 @@ secretCmd
       const store = new DaemonStore(config.dbPath);
       try {
         // No vault: a scrub of old data keeps nothing, whatever the workstreams say.
-        const secrets = new SecretService({ ...(config.secrets ? { config: { ...config.secrets, captureSecrets: "drop" } } : {}), configDir: getConfigDir() });
+        let unchecked = 0;
+        const secrets = new SecretService({
+          ...(config.secrets ? { config: { ...config.secrets, captureSecrets: "drop" } } : {}),
+          configDir: getConfigDir(),
+          offline: true,
+          onUnchecked: () => void unchecked++,
+        });
         addDaemonKnownSources(secrets, {
           credentials: () => config.credentials ?? [],
           secretStore: createSecretStore(config.credentialStore),
@@ -1830,6 +1836,7 @@ secretCmd
         console.log(`Transcripts: ${t.filesChanged} of ${t.files} files ${verb} (${t.linesChanged} lines).`);
         console.log(`Memory: ${episodes} episode bodies ${verb}.`);
         console.log(`Dispatch tasks: ${tasks} ${verb}.`);
+        if (unchecked > 0) console.log(`${unchecked} text(s) were too large to check and were left as they are.`);
         if (!o.dryRun && t.filesChanged + episodes + tasks > 0) console.log("Done. A backend's own copy (Claude Code's ~/.claude/projects, Codex's sessions) is its own, and isn't changed.");
       } finally {
         try {
diff --git a/src/daemon/mcp/hub.ts b/src/daemon/mcp/hub.ts
index c03455af..17246bcc 100644
--- a/src/daemon/mcp/hub.ts
+++ b/src/daemon/mcp/hub.ts
@@ -127,6 +127,33 @@ export class McpHub {
     this.#scrubResult = fn;
   }
 
+  /**
+   * A relayed result (mcp/proxy.ts: CLI backends' own MCP clients), scrubbed as
+   * a hub result is: every text part of a tool call's content, every text of a
+   * read resource. Returned as given when no scrub is set.
+   */
+  scrubRelayed<T>(method: string, result: T): T {
+    const scrub = this.#scrubResult;
+    if (!scrub || !result || typeof result !== "object") return result;
+    const r = result as { content?: unknown; contents?: unknown; structuredContent?: unknown };
+    const texts = (list: unknown) =>
+      Array.isArray(list) ? list.map((c) => (c && typeof c === "object" && typeof (c as { text?: unknown }).text === "string" ? { ...c, text: scrub((c as { text: string }).text) } : c)) : list;
+    if (method === "tools/call") {
+      const out: Record<string, unknown> = { ...(r as Record<string, unknown>), content: texts(r.content) };
+      // Structured output is text too, as JSON: scrubbed whole, kept only if it still parses.
+      if (r.structuredContent !== undefined) {
+        try {
+          out.structuredContent = JSON.parse(scrub(JSON.stringify(r.structuredContent)));
+        } catch {
+          delete out.structuredContent;
+        }
+      }
+      return out as T;
+    }
+    if (method === "resources/read") return { ...(r as Record<string, unknown>), contents: texts(r.contents) } as T;
+    return result;
+  }
+
   #refusal(spec: McpServerSpec, scope: McpCallScope | undefined): string | undefined {
     return scope?.sessionId && !spec.builtin ? this.#permit?.(scope.sessionId, spec) : undefined;
   }
diff --git a/src/daemon/mcp/proxy.ts b/src/daemon/mcp/proxy.ts
index 46cbbe7a..ddb7a2dc 100644
--- a/src/daemon/mcp/proxy.ts
+++ b/src/daemon/mcp/proxy.ts
@@ -156,10 +156,14 @@ export class McpProxy implements McpProxyMount {
     return `${this.#baseUrl().replace(/\/+$/, "")}${MCP_PROXY_PATH_PREFIX}${encodeURIComponent(server)}`;
   }
 
+  /** Told of every token minted and revoked: the daemon's secret handling matches live ones (docs/secrets-and-memory-design.md §2.2). */
+  tokenListener: { minted(token: string): void; revoked(token: string): void } | undefined;
+
   mint(binding: McpProxyBinding): { token: string; servers: string[] } {
     const servers = (binding.view ?? this.#registry).relayFor(binding.backendId).map((s) => s.name);
     const token = randomBytes(32).toString("base64url");
     this.#tokens.set(hashOf(token), { binding, servers: new Set(servers), relays: new Map(), starting: new Map(), calls: 0, initializes: [] });
+    this.tokenListener?.minted(token);
     return { token, servers };
   }
 
@@ -167,6 +171,7 @@ export class McpProxy implements McpProxyMount {
     const key = hashOf(token);
     const record = this.#tokens.get(key);
     if (!record) return;
+    this.tokenListener?.revoked(token);
     this.#tokens.delete(key);
     for (const relay of record.relays.values()) void relay.close();
   }
@@ -605,7 +610,8 @@ class Relay {
         if (request.method === "resources/unsubscribe") this.#subscriptions.delete(uri);
       }
       if (request.method === "tools/list") return this.#listed(result, params?.cursor !== undefined);
-      return result;
+      // What goes back to the model holds no secret's value, as through the hub (docs/secrets-and-memory-design.md §2.7).
+      return this.#init.hub ? this.#init.hub.scrubRelayed(request.method, result) : result;
     } catch (e) {
       if (e instanceof McpSignInRequired) {
         // Not signed in, or the credential was lost mid-session (a refused
diff --git a/src/daemon/providers/canonical.ts b/src/daemon/providers/canonical.ts
index 2bf2d1b9..4d010823 100644
--- a/src/daemon/providers/canonical.ts
+++ b/src/daemon/providers/canonical.ts
@@ -398,13 +398,19 @@ export class CanonicalHistoryAccumulator {
    * no backend is ever seeded with a value codeoid wouldn't store.
    */
   scrubTurn: ((turn: CanonicalTurn) => CanonicalTurn) | undefined;
+  /** Applied to every turn a seed brings in (a fork's parent's history, a rewind's): it may predate scrubbing. */
+  scrubSeed: ((turn: CanonicalTurn) => CanonicalTurn) | undefined;
 
-  #scrubbed(turn: CanonicalTurn): CanonicalTurn {
-    if (!this.scrubTurn) return turn;
+  /** Fails closed: a turn that can't be scrubbed keeps none of its text. */
+  #scrubbed(turn: CanonicalTurn, scrub = this.scrubTurn): CanonicalTurn {
+    if (!scrub) return turn;
     try {
-      return this.scrubTurn(turn);
+      return scrub(turn);
     } catch {
-      return turn;
+      const content = "‹not stored: it couldn't be checked for secrets›";
+      return turn.role === "user"
+        ? { ...turn, content, ...(turn.prompt !== undefined ? { prompt: content } : {}) }
+        : { ...turn, content, ...(turn.thinking ? { thinking: "" } : {}), ...(turn.toolCalls ? { toolCalls: [] } : {}) };
     }
   }
 
@@ -565,7 +571,7 @@ export class CanonicalHistoryAccumulator {
    */
   seed(turns: readonly CanonicalTurn[]): void {
     this.#clear();
-    this.#history = turns.map((t) => structuredClone(t));
+    this.#history = turns.map((t) => this.#scrubbed(structuredClone(t), this.scrubSeed));
     this.#currentTurnId = lastTurnId(this.#history);
     this.#emit({ op: "replace", turns: this.#history });
   }
diff --git a/src/daemon/routines/store.ts b/src/daemon/routines/store.ts
index e8858089..fef72f8c 100644
--- a/src/daemon/routines/store.ts
+++ b/src/daemon/routines/store.ts
@@ -77,6 +77,16 @@ export function hashToken(token: string): string {
 
 export class RoutineStore {
   readonly #db: Database;
+  /**
+   * Applied to a run's check output, summary and reason as they are written
+   * (docs/secrets-and-memory-design.md §2.6). Not the payload: the run reads it
+   * back as its data, and it is what whoever fired the routine sent.
+   */
+  scrubText: ((text: string) => string) | undefined;
+
+  #scrub(v: string | null): string | null {
+    return v && this.scrubText ? this.scrubText(v) : v;
+  }
 
   constructor(db: Database | string) {
     this.#db = typeof db === "string" ? new Database(db, { create: true }) : db;
@@ -324,9 +334,9 @@ export class RoutineStore {
         run.costUsd,
         run.inputTokens,
         run.outputTokens,
-        run.summary,
-        run.reason,
-        run.checkOutput,
+        this.#scrub(run.summary),
+        this.#scrub(run.reason),
+        this.#scrub(run.checkOutput),
         run.payload,
         run.loopRunId,
         run.loopStatus,
@@ -358,7 +368,8 @@ export class RoutineStore {
       const col = cols[k];
       if (!col || v === undefined) continue;
       sets.push(`${col} = ?`);
-      vals.push(typeof v === "boolean" ? (v ? 1 : 0) : (v as string | number | null));
+      const scrubbed = (k === "summary" || k === "reason" || k === "checkOutput") && typeof v === "string" ? this.#scrub(v) : v;
+      vals.push(typeof scrubbed === "boolean" ? (scrubbed ? 1 : 0) : (scrubbed as string | number | null));
     }
     if (sets.length === 0) return;
     this.#db.prepare(`UPDATE routine_runs SET ${sets.join(", ")} WHERE id = ?`).run(...vals, id);
diff --git a/src/daemon/secrets/detect.ts b/src/daemon/secrets/detect.ts
index 2cf04f07..d01bce58 100644
--- a/src/daemon/secrets/detect.ts
+++ b/src/daemon/secrets/detect.ts
@@ -20,6 +20,12 @@ export interface SecretSpan {
   end: number;
   /** A slug for the reference: `github-token`, `password`, `private-key`, … */
   kind: string;
+  /**
+   * A format that can't be mistaken for anything else (a vendor's token, a JWT, a key): safe to
+   * remember and match bare from then on. A value found only by the name it sits under
+   * (`password: …`) isn't: the same word is often ordinary text elsewhere.
+   */
+  distinct: boolean;
 }
 
 interface Pattern {
@@ -27,6 +33,10 @@ interface Pattern {
   re: RegExp;
   /** A structural or named value that is plainly not a credential is left as it is. */
   check?: "placeholder" | "word";
+  /** See {@link SecretSpan.distinct}. */
+  distinct?: boolean;
+  /** Only where the match's line also matches this (checked after the match, so the pattern stays linear). */
+  line?: RegExp;
 }
 
 /** Not inside a longer token: no letter, digit or `_` just before. */
@@ -34,7 +44,7 @@ const B = "(?<![A-Za-z0-9_])";
 /** Nor just after. */
 const E = "(?![A-Za-z0-9_])";
 
-const vendor = (kind: string, body: string): Pattern => ({ kind, re: new RegExp(`${B}(?<secret>${body})${E}`, "g") });
+const vendor = (kind: string, body: string): Pattern => ({ kind, re: new RegExp(`${B}(?<secret>${body})${E}`, "g"), distinct: true });
 
 /** Formats with a prefix of their own: they can't be mistaken for anything else. */
 const VENDOR: Pattern[] = [
@@ -98,27 +108,29 @@ const VENDOR: Pattern[] = [
   vendor("npm-token", "npm_[A-Za-z0-9]{36}"),
   vendor("pulumi-token", "pul-[0-9a-f]{40}"),
   vendor("zeroid-key", "zid_sk_[A-Za-z0-9_-]{16,200}"),
+  // codeoid's own: the blackboard, memory and sandbox MCP tokens, a routine's API token.
+  vendor("codeoid-token", "(?:bbt|mmt|sbt)_[0-9a-f]{32}|rt_[0-9a-f]{12}_[A-Za-z0-9_-]{32}"),
   vendor("highflame-key", "hf_sk_[A-Za-z0-9_-]{16,200}"),
 ];
 
 /** Credentials recognised by where they sit. */
 const STRUCTURAL: Pattern[] = [
-  {
-    kind: "private-key",
-    re: /-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----(?<secret>[\s\S]{1,20000}?)(?:-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----|$)/g,
-  },
-  { kind: "jwt", re: new RegExp(`(?:${B}|(?<=\\\\[nrt]))(?<secret>eyJ[A-Za-z0-9_-]{10,4000}\\.eyJ[A-Za-z0-9_-]{10,8000}\\.[A-Za-z0-9_-]{10,2000})`, "g") },
-  { kind: "bearer-token", re: /(?<![A-Za-z0-9_])bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder" },
-  { kind: "authorization", re: /(?<![A-Za-z0-9_])authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder" },
-  { kind: "password", re: /(?<![A-Za-z0-9_])curl\b[^\n]{0,2000}?[ \t](?:-u|--user)(?:=|[ \t]+)["']?[^:\s"']{0,200}:(?<secret>[^\s"']{1,500})/g, check: "placeholder" },
+  { kind: "jwt", re: new RegExp(`(?:${B}|(?<=\\\\[nrt]))(?<secret>eyJ[A-Za-z0-9_-]{10,4000}\\.eyJ[A-Za-z0-9_-]{10,8000}\\.[A-Za-z0-9_-]{10,2000})`, "g"), distinct: true },
+  { kind: "bearer-token", re: /(?<![A-Za-z0-9_])bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder", distinct: true },
+  { kind: "authorization", re: /(?<![A-Za-z0-9_])authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder", distinct: true },
+  // curl's `-u user:password`: the line must run curl (checked in findSecrets: `line: /\bcurl\b/`).
+  { kind: "password", re: /(?:^|[ \t])(?:-u|--user)(?:=|[ \t]+)["']?[^:\s"']{0,200}:(?<secret>[^\s"']{1,500})/gm, check: "placeholder", line: /\bcurl\b/ },
+  // A .netrc entry's password.
+  { kind: "password", re: /(?:^|\s)machine\s+\S{1,253}\s+(?:login\s+\S{1,200}\s+)?password\s+(?<secret>\S{1,500})/g, check: "placeholder" },
+  { kind: "password", re: /^[ \t]*password[ \t]+(?<secret>\S{1,500})[ \t]*$/gm, check: "placeholder" },
   { kind: "password", re: /(?<![A-Za-z0-9_])[a-z][a-z0-9+.-]{1,31}:\/\/[^\s/?#@"'`<>:]{0,200}:(?<secret>[^\s/?#@"'`<>]{1,500})@/gi, check: "placeholder" },
   { kind: "password", re: /(?:^|[?&;\s-])(?:password|pwd)=(?<secret>"[^"\n]{0,500}"|'[^'\n]{0,500}'|[^&;\s"'`]{0,500}[^&;\s"'`,])/gim, check: "placeholder" },
-  { kind: "aws-secret", re: /aws_secret_access_key["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?(?<secret>[A-Za-z0-9/+]{40,100})/gi },
-  { kind: "twilio-key", re: new RegExp(`${B}(?<secret>SK[0-9a-fA-F]{32})${E}`, "g") },
+  { kind: "aws-secret", re: /aws_secret_access_key["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?(?<secret>[A-Za-z0-9/+]{40,100})/gi, distinct: true },
+  { kind: "twilio-key", re: new RegExp(`${B}(?<secret>SK[0-9a-fA-F]{32})${E}`, "g"), distinct: true },
 ];
 
 /** The words an environment variable's name ends with when it holds a credential. */
-const ENV_NAME = "(?<![A-Za-z0-9_])[A-Z0-9_]{0,100}(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIALS?|AUTH)S?(?![A-Za-z0-9_])";
+const ENV_NAME = "(?<![A-Za-z0-9_])[A-Z0-9_]{0,100}(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIALS?|AUTH)(?![A-Za-z0-9_])";
 /** The same as code, JSON and config files spell them; not `auth` alone, nor `tokens` (`max_tokens`). */
 const CODE_NAME =
   "[\\w.-]{0,100}?(?:passw(?:or)?d|passphrase|secret|api[_-]?key|private[_-]?key|access[_-]?key|(?:auth|access|refresh|bearer|id|session)[_-]?token|token)";
@@ -134,9 +146,16 @@ const NAMED: Pattern[] = [
     re: /(?:^|[ \t])--passw(?:or)?d[ \t]+(?<secret>"(?:[^"\\\n]|\\.){1,500}"|'[^'\n]{1,500}'|(?:[^\s"'\\<>[{()|&;`-][^\s"'\\|&;<>()`]{0,500}?)?[^A-Za-z\s"'\\.,:;()[\]{}<>|&`-][^\s"'\\|&;<>()`]{0,500})(?=[\s"';&|)\\]|$)/g,
     check: "placeholder",
   },
+  // YAML-like `name: value`: the value runs to the end of the line (`password: correct horse`).
   {
     kind: "credential",
-    re: new RegExp(`^\\+?[ \\t]*(?:-[ \\t]+)?["']?${CODE_NAME}["']?[ \\t]*[:=][ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\n#="]{0,1000}?)[ \\t]*$`, "gim"),
+    re: new RegExp(`^\\+?[ \\t]*(?:-[ \\t]+)?["']?${CODE_NAME}["']?[ \\t]*:[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\n#="]{0,1000})$`, "gim"),
+    check: "word",
+  },
+  // `.env`/INI-like `name=value`: up to the first space (`PGPASSWORD=x psql -h db` is a command).
+  {
+    kind: "credential",
+    re: new RegExp(`^\\+?[ \\t]*["']?${CODE_NAME}["']?[ \\t]*=[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\s#="]{0,1000})`, "gim"),
     check: "word",
   },
 ];
@@ -144,12 +163,50 @@ const NAMED: Pattern[] = [
 /** With indices (`d`), so the `secret` group's position is exact. */
 const PATTERNS: readonly Pattern[] = [...VENDOR, ...STRUCTURAL, ...NAMED].map((p) => ({ ...p, re: new RegExp(p.re.source, p.re.flags.includes("d") ? p.re.flags : `${p.re.flags}d`) }));
 
+const KEY_HEADER = /-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----/y;
+const KEY_FOOTER = /^-----END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----/;
+/** What a key's armour holds: base64 lines, PEM headers (`Proc-Type: 4,ENCRYPTED`), escaped newlines in JSON. */
+const KEY_BODY = /^[A-Za-z0-9+/=\s:,.\\-]{16,64000}$/;
+const MAX_KEY_BODY = 64_000;
+
+/**
+ * Private keys, by their armour: the body between a BEGIN line and its END
+ * line (or the end of the text, for clipped output), when it is what armour
+ * holds — so a header string in source code never swallows the code after
+ * it. Found with indexOf, one forward pass: a text of repeated headers costs
+ * no more than its length.
+ */
+function privateKeySpans(text: string): SecretSpan[] {
+  const out: SecretSpan[] = [];
+  let from = 0;
+  let nextEnd = -2;
+  while (true) {
+    const begin = text.indexOf("-----BEGIN", from);
+    if (begin < 0) break;
+    from = begin + 10;
+    KEY_HEADER.lastIndex = begin;
+    const header = KEY_HEADER.exec(text);
+    if (!header) continue;
+    const bodyStart = begin + header[0].length;
+    if (nextEnd !== -1 && nextEnd < bodyStart) nextEnd = text.indexOf("-----END", bodyStart);
+    let bodyEnd: number;
+    if (nextEnd >= 0 && nextEnd - bodyStart <= MAX_KEY_BODY && KEY_FOOTER.test(text.slice(nextEnd, nextEnd + 140))) bodyEnd = nextEnd;
+    else if (text.length - bodyStart <= MAX_KEY_BODY) bodyEnd = text.length;
+    else continue;
+    if (!KEY_BODY.test(text.slice(bodyStart, bodyEnd))) continue;
+    out.push({ start: bodyStart, end: bodyEnd, kind: "private-key", distinct: true });
+    from = bodyEnd;
+  }
+  return out;
+}
+
 /** The references codeoid writes itself: never taken for a secret again. */
 const OWN_REFERENCE = /^‹(?:credential|secret|output withheld|not stored)[:\s›]/;
 
 const STAND_INS = new Set([
   "changeme", "change_me", "change-me", "example", "password", "passwd", "secret", "token", "your_password", "your-password",
   "yourpassword", "your_token", "your_api_key", "redacted", "placeholder", "dummy", "undefined", "required", "optional",
+  "enabled", "disabled", "on", "off", "yes", "no", "bearer", "basic", "auto", "none", "default", "test", "local", "localhost",
 ]);
 const TYPES = new Set(["str", "string", "bool", "boolean", "int", "integer", "number", "float", "any", "object", "bytes", "char", "none", "null", "nil", "true", "false"]);
 
@@ -170,7 +227,14 @@ export function isPlaceholder(raw: string): boolean {
 function isWord(raw: string): boolean {
   const value = raw.trim();
   if (isPlaceholder(value)) return true;
-  if (value.startsWith('"') || value.startsWith("'") || /[0-9]/.test(value)) return false;
+  if (value.startsWith('"') || value.startsWith("'")) return false;
+  // Code, not a value: another name — a dotted path or a call (`self.token`, `config.apiKey`,
+  // `getToken()`), a snake_case or camelCase identifier (`api_key`, `idToken`). A plain word
+  // (`Violetmeadow`, `postgres`) can be a password, and stays one.
+  const bare = value.replace(/[,;)]+$/, "");
+  if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+(?:\(\))?$/.test(bare) || /^[A-Za-z_$][\w$]*\(\)$/.test(bare)) return true;
+  if (/^[A-Za-z_$][\w$]*$/.test(bare) && (bare.includes("_") || /[a-z][A-Z]/.test(bare)) && !/[0-9]/.test(bare)) return true;
+  if (/[0-9]/.test(value)) return false;
   return /[<>[\]&:(){},;]/.test(value) || TYPES.has(value.toLowerCase());
 }
 
@@ -181,26 +245,39 @@ function isWord(raw: string): boolean {
  * past it, null — the caller must not store what couldn't be checked.
  */
 export function findSecrets(text: string, deadline = Number.POSITIVE_INFINITY): SecretSpan[] | null {
-  const spans: SecretSpan[] = [];
+  const spans: SecretSpan[] = privateKeySpans(text);
   for (const p of PATTERNS) {
     if (performance.now() > deadline) return null;
     p.re.lastIndex = 0;
+    let n = 0;
     for (const m of text.matchAll(p.re)) {
-      const secret = m.groups?.secret;
+      if (++n % 256 === 0 && performance.now() > deadline) return null;
+      const raw = m.groups?.secret;
       const at = m.indices?.groups?.secret;
-      if (secret === undefined || secret.length === 0 || !at) continue;
+      if (raw === undefined || raw.length === 0 || !at) continue;
+      // A value to the end of its line loses the spaces after it.
+      const secret = raw.replace(/[ \t]+$/, "");
+      if (secret.length === 0) continue;
       if (p.check === "placeholder" && isPlaceholder(secret)) continue;
       if (p.check === "word" && isWord(secret)) continue;
+      if (p.line) {
+        const lineStart = text.lastIndexOf("\n", at[0]) + 1;
+        const lineEnd = text.indexOf("\n", at[0]);
+        if (!p.line.test(text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd))) continue;
+      }
       // A quoted value keeps its quotes: `"api_key": "‹secret:…›"` still reads as JSON.
       const quoted = secret.length >= 2 && (secret[0] === '"' || secret[0] === "'") && secret.at(-1) === secret[0];
-      spans.push({ start: at[0] + (quoted ? 1 : 0), end: at[1] - (quoted ? 1 : 0), kind: p.kind });
+      spans.push({ start: at[0] + (quoted ? 1 : 0), end: at[0] + secret.length - (quoted ? 1 : 0), kind: p.kind, distinct: p.distinct === true });
     }
   }
   spans.sort((a, b) => a.start - b.start || b.end - a.end);
   const merged: SecretSpan[] = [];
   for (const s of spans) {
     const last = merged[merged.length - 1];
-    if (last && s.start < last.end) last.end = Math.max(last.end, s.end);
+    if (last && s.start < last.end) {
+      last.end = Math.max(last.end, s.end);
+      last.distinct = last.distinct && s.distinct;
+    }
     else merged.push({ ...s });
   }
   return merged;
diff --git a/src/daemon/secrets/files.ts b/src/daemon/secrets/files.ts
index 7db0f56a..9163b461 100644
--- a/src/daemon/secrets/files.ts
+++ b/src/daemon/secrets/files.ts
@@ -1,6 +1,8 @@
 /**
  * Files whose contents are credentials (`.env`, `~/.ssh/id_ed25519`,
- * `~/.aws/credentials`, an agent's own login), after atuin's
+ * `~/.aws/credentials`, an agent's own login), after atuin's (less `*.pem`:
+ * most are public certificates, and a private key in one is found by its
+ * armour when it is read out, detect.ts),
  * `atuin-common/src/secrets/files.rs` (MIT). What reads one out, or writes
  * one, isn't stored (verdict.ts): such a file holds nothing else, in
  * whatever format, so scrubbing by shape would miss whatever it can't name.
@@ -12,7 +14,7 @@ import { basename, isAbsolute, join, normalize, resolve } from "node:path";
 /** Names that say a file holds credentials, wherever it is (`*` within the name). */
 const NAMES = [
   ".env", ".env.*", "*.env", ".envrc", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", "id_ecdsa_sk", "id_ed25519_sk",
-  "*.pem", "*.key", "*.p12", "*.pfx", "*.jks", "*.keystore", "*.tfstate", "*.tfstate.backup", "*.tfvars",
+  "*.key", "*.p12", "*.pfx", "*.jks", "*.keystore", "*.tfstate", "*.tfstate.backup", "*.tfvars",
   ".netrc", "_netrc", ".pgpass", ".git-credentials", ".npmrc", ".pypirc", ".htpasswd", ".vault-token",
 ];
 
diff --git a/src/daemon/secrets/fingerprint.ts b/src/daemon/secrets/fingerprint.ts
index 88b33c6e..907338bf 100644
--- a/src/daemon/secrets/fingerprint.ts
+++ b/src/daemon/secrets/fingerprint.ts
@@ -9,7 +9,7 @@
  */
 
 import { createHmac, randomBytes } from "node:crypto";
-import { closeSync, constants as fsc, fstatSync, mkdirSync, openSync, readSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsc, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
 
 /** Where codeoid keeps the keys for secret handling. */
@@ -20,17 +20,26 @@ export function secretMaterialDir(configDir: string): string {
 const KEY_BYTES = 32;
 
 /**
- * Read a key file, or make it once: created with O_EXCL, never through a
- * link, so a planted file or link is refused rather than used.
+ * Read a key file, or make it once: written whole beside it, then linked into
+ * place (a crash leaves no half-written key, and two daemons starting at once
+ * end with the same one), never through a link, so a planted file or link is
+ * refused rather than used. The dir is 0700 and the file 0600 and the
+ * daemon's own, or it is refused.
  */
 export function loadOrCreateKey(dir: string, name: string): Buffer {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const dst = lstatSync(dir);
+  if (!dst.isDirectory()) throw new Error(`${dir} isn't a directory`);
+  if (typeof process.getuid === "function" && dst.uid !== process.getuid()) throw new Error(`${dir} isn't this user's`);
+  if ((dst.mode & 0o077) !== 0) chmodSync(dir, 0o700);
   const path = join(dir, name);
   try {
     const fd = openSync(path, fsc.O_RDONLY | fsc.O_NOFOLLOW | fsc.O_NONBLOCK);
     try {
       const st = fstatSync(fd);
       if (!st.isFile() || st.size !== KEY_BYTES) throw new Error(`${path} isn't a ${KEY_BYTES}-byte key file`);
+      if (typeof process.getuid === "function" && st.uid !== process.getuid()) throw new Error(`${path} isn't this user's`);
+      if ((st.mode & 0o077) !== 0) throw new Error(`${path} is readable by others (mode ${(st.mode & 0o777).toString(8)}): chmod 600 it`);
       const buf = Buffer.alloc(KEY_BYTES);
       if (readSync(fd, buf, 0, KEY_BYTES, 0) !== KEY_BYTES) throw new Error(`${path} couldn't be read whole`);
       return buf;
@@ -41,12 +50,23 @@ export function loadOrCreateKey(dir: string, name: string): Buffer {
     if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
   }
   const key = randomBytes(KEY_BYTES);
-  const fd = openSync(path, fsc.O_WRONLY | fsc.O_CREAT | fsc.O_EXCL | fsc.O_NOFOLLOW, 0o600);
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}`;
+  const fd = openSync(tmp, fsc.O_WRONLY | fsc.O_CREAT | fsc.O_EXCL | fsc.O_NOFOLLOW, 0o600);
   try {
     writeSync(fd, key);
+    fsyncSync(fd);
   } finally {
     closeSync(fd);
   }
+  try {
+    linkSync(tmp, path);
+  } catch (err) {
+    // Another start made it first: use theirs.
+    if ((err as NodeJS.ErrnoException).code === "EEXIST") return loadOrCreateKey(dir, name);
+    throw err;
+  } finally {
+    unlinkSync(tmp);
+  }
   return key;
 }
 
diff --git a/src/daemon/secrets/known.ts b/src/daemon/secrets/known.ts
index acf0fefe..3ad0c538 100644
--- a/src/daemon/secrets/known.ts
+++ b/src/daemon/secrets/known.ts
@@ -8,6 +8,10 @@
  * Sources register a function that lists their values; the set is rebuilt
  * when one says it changed (`invalidate`) or after a minute, whichever comes
  * first (an OAuth token refreshes without telling anyone).
+ *
+ * Matching is one pass over the text (Aho-Corasick), leftmost-longest, and
+ * never inside a reference codeoid wrote (`‹…›`): scrubbing twice changes
+ * nothing.
  */
 
 /** Shorter than this and a value would match ordinary text. */
@@ -24,16 +28,109 @@ export interface KnownSecret {
 
 export type KnownSecretSource = () => Iterable<KnownSecret>;
 
-/** One form a value can be written in, longest first so a longer form wins over a shorter one inside it. */
+/** A reference codeoid wrote: never matched inside. */
+const OWN_REF = /‹[^‹›\n]{1,300}›/g;
+/** A character a token goes on through: a bounded needle needs none on either side. */
+const TOKEN_CHAR = /[A-Za-z0-9_-]/;
+
 interface Needle {
   text: string;
   label: string;
   ref: string;
 }
 
+/** A multi-pattern matcher: every needle found in one pass. */
+class Matcher {
+  readonly #goto: Array<Map<string, number>> = [new Map()];
+  readonly #fail: number[] = [0];
+  /** Per state: the needles ending there, longest first. */
+  readonly #out: Needle[][] = [[]];
+  readonly longest: number;
+  readonly size: number;
+
+  constructor(needles: readonly Needle[]) {
+    let longest = 0;
+    for (const n of needles) {
+      let state = 0;
+      for (const ch of n.text) {
+        let next = this.#goto[state]!.get(ch);
+        if (next === undefined) {
+          next = this.#goto.length;
+          this.#goto.push(new Map());
+          this.#fail.push(0);
+          this.#out.push([]);
+          this.#goto[state]!.set(ch, next);
+        }
+        state = next;
+      }
+      this.#out[state]!.push(n);
+      longest = Math.max(longest, n.text.length);
+    }
+    this.longest = longest;
+    this.size = needles.length;
+    // Failure links, breadth first: each state's outputs include its failure state's.
+    const queue: number[] = [...this.#goto[0]!.values()];
+    for (let i = 0; i < queue.length; i++) {
+      const state = queue[i]!;
+      for (const [ch, next] of this.#goto[state]!) {
+        queue.push(next);
+        let f = this.#fail[state]!;
+        while (f !== 0 && !this.#goto[f]!.has(ch)) f = this.#fail[f]!;
+        const via = this.#goto[f]!.get(ch);
+        this.#fail[next] = via !== undefined && via !== next ? via : 0;
+        const inherited = this.#out[this.#fail[next]!]!;
+        if (inherited.length > 0) this.#out[next] = [...this.#out[next]!, ...inherited];
+      }
+    }
+  }
+
+  /** Every match, as [start, end, needle]. */
+  *matches(text: string): Generator<[number, number, Needle]> {
+    if (this.size === 0) return;
+    let state = 0;
+    let i = 0;
+    for (const ch of text) {
+      i += ch.length;
+      while (state !== 0 && !this.#goto[state]!.has(ch)) state = this.#fail[state]!;
+      state = this.#goto[state]!.get(ch) ?? 0;
+      for (const n of this.#out[state]!) yield [i - n.text.length, i, n];
+    }
+  }
+}
+
+/** `text` with matches replaced: leftmost-longest, none inside a reference, bounded ones only as whole tokens. */
+function replaceMatches(text: string, matcher: Matcher, bounded: boolean): { text: string; refs: Set<string>; labels: Set<string> } {
+  const refs = new Set<string>();
+  const labels = new Set<string>();
+  if (matcher.size === 0 || text.length < MIN_KNOWN_LENGTH) return { text, refs, labels };
+  const own: Array<[number, number]> = [];
+  for (const m of text.matchAll(OWN_REF)) own.push([m.index!, m.index! + m[0].length]);
+  const inOwn = (s: number, e: number) => own.some(([a, b]) => s < b && e > a);
+  const found: Array<[number, number, Needle]> = [];
+  for (const m of matcher.matches(text)) {
+    const [s, e] = m;
+    if (own.length > 0 && inOwn(s, e)) continue;
+    if (bounded && ((s > 0 && TOKEN_CHAR.test(text[s - 1]!)) || (e < text.length && TOKEN_CHAR.test(text[e]!)))) continue;
+    found.push(m);
+  }
+  if (found.length === 0) return { text, refs, labels };
+  found.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+  let out = "";
+  let at = 0;
+  for (const [s, e, n] of found) {
+    if (s < at) continue;
+    out += text.slice(at, s) + n.ref;
+    at = e;
+    refs.add(n.ref);
+    labels.add(n.label);
+  }
+  return { text: out + text.slice(at), refs, labels };
+}
+
 export class KnownSecrets {
   readonly #sources = new Map<string, KnownSecretSource>();
-  #needles: Needle[] | null = null;
+  #matcher: Matcher | null = null;
+  #spaced: string[] = [];
   #builtAt = 0;
   #version = 0;
 
@@ -51,7 +148,7 @@ export class KnownSecrets {
 
   /** A source's values changed (a credential edited, a token refreshed). */
   invalidate(): void {
-    this.#needles = null;
+    this.#matcher = null;
     this.#version++;
   }
 
@@ -60,8 +157,8 @@ export class KnownSecrets {
     return this.#version;
   }
 
-  #build(): Needle[] {
-    const byText = new Map<string, { label: string; ref: string }>();
+  #build(): Matcher {
+    const byText = new Map<string, Needle>();
     for (const [name, source] of this.#sources) {
       let entries: Iterable<KnownSecret>;
       try {
@@ -72,39 +169,36 @@ export class KnownSecrets {
       }
       for (const { label, value, ref } of entries) {
         if (typeof value !== "string" || value.length < MIN_KNOWN_LENGTH) continue;
-        for (const form of formsOf(value)) if (!byText.has(form)) byText.set(form, { label, ref: ref ?? credentialRef(label) });
+        for (const form of formsOf(value)) if (!byText.has(form)) byText.set(form, { text: form, label, ref: ref ?? credentialRef(label) });
       }
     }
-    return [...byText].map(([text, n]) => ({ text, ...n })).sort((a, b) => b.text.length - a.text.length);
+    this.#spaced = [...byText.keys()].filter((t) => /\s/.test(t));
+    return new Matcher([...byText.values()]);
   }
 
-  #current(): Needle[] {
-    if (!this.#needles || Date.now() - this.#builtAt > REBUILD_MS) {
-      this.#needles = this.#build();
+  #current(): Matcher {
+    if (!this.#matcher || Date.now() - this.#builtAt > REBUILD_MS) {
+      this.#matcher = this.#build();
       this.#builtAt = Date.now();
     }
-    return this.#needles;
+    return this.#matcher;
+  }
+
+  /** Values with whitespace in them: a stream must not cut at a space inside one. */
+  get spaced(): readonly string[] {
+    this.#current();
+    return this.#spaced;
   }
 
   /** The longest form any value is written in: how much a streaming scrubber must hold back. */
   get longest(): number {
-    return this.#current()[0]?.text.length ?? 0;
+    return this.#current().longest;
   }
 
   /** `text` with every known value replaced by its reference, and the labels and references found. */
   replace(text: string): { text: string; labels: string[]; refs: string[] } {
-    const needles = this.#current();
-    if (needles.length === 0 || text.length < MIN_KNOWN_LENGTH) return { text, labels: [], refs: [] };
-    const labels = new Set<string>();
-    const refs = new Set<string>();
-    let out = text;
-    for (const n of needles) {
-      if (!out.includes(n.text)) continue;
-      out = out.split(n.text).join(n.ref);
-      labels.add(n.label);
-      refs.add(n.ref);
-    }
-    return { text: out, labels: [...labels], refs: [...refs] };
+    const r = replaceMatches(text, this.#current(), false);
+    return { text: r.text, labels: [...r.labels], refs: [...r.refs] };
   }
 }
 
@@ -129,37 +223,51 @@ function formsOf(value: string): string[] {
 
 /** Most values remembered by {@link LearnedSecrets}; the oldest are let go past it. */
 const MAX_LEARNED = 2000;
+/** A remembered value is matched bare only when it is this long: shorter ones are too often ordinary words. */
+const MIN_LEARNED_LENGTH = 12;
 
 /**
- * Secrets found by shape, remembered (in memory only, never stored) so the
- * same value is replaced wherever it shows up later, even bare: a password
- * found as `DB_PASSWORD=…` in a tool's output, repeated in a reply.
+ * Secrets found by a distinct format (a vendor's token, a JWT, a key),
+ * remembered in memory only, never stored, so the same value is replaced
+ * wherever it shows up later, even bare: a token a tool printed, repeated in
+ * a reply. Matched as whole tokens only, and kept apart from the known set,
+ * so learning one costs no rebuild of the rest.
  */
 export class LearnedSecrets {
-  readonly #values = new Map<string, KnownSecret>();
-  #onChange: () => void = () => {};
-
-  /** Called when a new value is learned (the known set rebuilds). */
-  onChange(fn: () => void): void {
-    this.#onChange = fn;
-  }
+  readonly #values = new Map<string, Needle>();
+  readonly #byRef = new Map<string, string>();
+  #matcher: Matcher | null = null;
 
   /** Remember a value; true when it is new. */
   learn(value: string, ref: string): boolean {
-    if (value.length < MIN_KNOWN_LENGTH || this.#values.has(value)) return false;
-    this.#values.set(value, { label: "learned", value, ref });
-    while (this.#values.size > MAX_LEARNED) this.#values.delete(this.#values.keys().next().value!);
-    this.#onChange();
+    if (value.length < MIN_LEARNED_LENGTH || this.#values.has(value)) return false;
+    this.#values.set(value, { text: value, label: "learned", ref });
+    this.#byRef.set(ref, value);
+    while (this.#values.size > MAX_LEARNED) {
+      const [oldest, n] = this.#values.entries().next().value!;
+      this.#values.delete(oldest);
+      this.#byRef.delete(n.ref);
+    }
+    this.#matcher = null;
     return true;
   }
 
-  values(): Iterable<KnownSecret> {
-    return this.#values.values();
-  }
-
   /** The value a learned reference stands for. */
   valueOf(ref: string): string | undefined {
-    for (const k of this.#values.values()) if (k.ref === ref) return k.value;
-    return undefined;
+    return this.#byRef.get(ref);
+  }
+
+  get longest(): number {
+    return this.#current().longest;
+  }
+
+  #current(): Matcher {
+    this.#matcher ??= new Matcher([...this.#values.values()]);
+    return this.#matcher;
+  }
+
+  replace(text: string): { text: string; refs: string[] } {
+    const r = replaceMatches(text, this.#current(), true);
+    return { text: r.text, refs: [...r.refs] };
   }
 }
diff --git a/src/daemon/secrets/scrub-stored.ts b/src/daemon/secrets/scrub-stored.ts
index 8c22035d..35086e08 100644
--- a/src/daemon/secrets/scrub-stored.ts
+++ b/src/daemon/secrets/scrub-stored.ts
@@ -63,12 +63,12 @@ function replaceFile(path: string, content: string): void {
   renameSync(tmp, path);
 }
 
-/** Every `*.jsonl` directly in the transcript dir. */
+/** Every `*.jsonl` directly in the transcript dir, and their rotated segments (`<id>.jsonl.1`, …). */
 export function scrubTranscripts(dir: string, scrub: ScrubFn, dryRun: boolean): Pick<ScrubReport, "files" | "filesChanged" | "linesChanged"> {
   const report = { files: 0, filesChanged: 0, linesChanged: 0 };
   if (!existsSync(dir)) return report;
   for (const name of readdirSync(dir)) {
-    if (!name.endsWith(".jsonl")) continue;
+    if (!/\.jsonl(?:\.\d+)?$/.test(name)) continue;
     const path = join(dir, name);
     try {
       if (!statSync(path).isFile()) continue;
@@ -113,12 +113,31 @@ export function scrubMemoryDb(dbPath: string, scrub: ScrubFn, dryRun: boolean):
       }
     });
     tx();
+    if (changed > 0 && !dryRun) purgeOldCopies(db, ["episodes_fts"]);
   } finally {
     db.close();
   }
   return changed;
 }
 
+/**
+ * Rewritten rows' old text can stay in the file (free pages, the WAL, FTS
+ * segments): merge the full-text index, checkpoint the WAL and rebuild the
+ * file, so what was replaced is gone from disk too.
+ */
+function purgeOldCopies(db: Database, ftsTables: readonly string[]): void {
+  for (const t of ftsTables) {
+    try {
+      db.exec(`INSERT INTO ${t}(${t}) VALUES('optimize')`);
+    } catch {
+      // No such index here.
+    }
+  }
+  db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  db.exec("VACUUM");
+  db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+}
+
 /** Dispatch tasks' prompts and result digests in the daemon's database (the conductor reads them back). */
 export function scrubDispatchTasks(dbPath: string, scrub: ScrubFn, dryRun: boolean): number {
   if (!existsSync(dbPath)) return 0;
@@ -143,6 +162,7 @@ export function scrubDispatchTasks(dbPath: string, scrub: ScrubFn, dryRun: boole
       }
     });
     tx();
+    if (changed > 0 && !dryRun) purgeOldCopies(db, []);
   } finally {
     db.close();
   }
diff --git a/src/daemon/secrets/scrub.ts b/src/daemon/secrets/scrub.ts
index 9480af54..3fa953fb 100644
--- a/src/daemon/secrets/scrub.ts
+++ b/src/daemon/secrets/scrub.ts
@@ -46,12 +46,21 @@ export function secretRef(kind: string, fingerprint: string): string {
 
 export interface ScrubberOptions {
   known: KnownSecrets;
-  /** Where a value found by shape is remembered, so it is matched exactly from then on. */
-  learned?: LearnedSecrets;
+  /**
+   * Where a value found by a distinct format is remembered, so it is matched exactly from then
+   * on: per tenant (one tenant's text never tells another's what was seen). None: nothing kept.
+   */
+  learnedFor?: (ctx: ScrubContext) => LearnedSecrets | undefined;
   fingerprint: Fingerprinter;
   /** A detected secret, with its value: the vault keeps it where the workstream says so. */
   onDetected?: (secret: DetectedSecret, ctx: ScrubContext) => void;
   budgetMs?: number;
+  /**
+   * A text that can't be checked (too large, or over budget) is kept as it is and reported here,
+   * instead of being replaced by a "not stored" note: for a rewrite of stored data, where the
+   * note would destroy what is there for good. Unset: replaced.
+   */
+  onUnchecked?: (text: string) => void;
 }
 
 export class Scrubber {
@@ -65,41 +74,58 @@ export class Scrubber {
     return this.#opts.known;
   }
 
+  /** The longest value matched exactly (known or learned) for `ctx`: what a stream must hold back. */
+  longestKnown(ctx: ScrubContext = {}): number {
+    return Math.max(this.#opts.known.longest, this.#opts.learnedFor?.(ctx)?.longest ?? 0);
+  }
+
   /** `text` with no secret's value in it. */
   scrub(text: string, ctx: ScrubContext = {}): ScrubResult {
     if (!text) return { text, changed: false };
-    if (text.length > MAX_SCRUB_BYTES) return { text: TOO_LARGE, changed: true };
+    if (text.length > MAX_SCRUB_BYTES) return this.#unchecked(text, TOO_LARGE);
     const deadline = performance.now() + (this.#opts.budgetMs ?? SCRUB_BUDGET_MS);
+    const learned = this.#opts.learnedFor?.(ctx);
     const known = this.#opts.known.replace(text);
     let out = known.text;
-    // A learned value matched exactly is still a detected secret: the vault keeps it where it is kept.
-    if (this.#opts.learned && this.#opts.onDetected) {
-      for (const ref of known.refs) {
+    let changed = known.labels.length > 0;
+    if (learned) {
+      const r = learned.replace(out);
+      out = r.text;
+      // A learned value matched exactly is still a detected secret: the vault keeps it where it is kept.
+      for (const ref of r.refs) {
+        changed = true;
         const m = /^‹secret:([a-z0-9-]+):([0-9a-f]{8})›$/.exec(ref);
-        const value = m ? this.#opts.learned.valueOf(ref) : undefined;
+        const value = learned.valueOf(ref);
         if (m && value !== undefined) this.#detected({ kind: m[1]!, fingerprint: m[2]!, value }, ctx);
       }
     }
     const spans = findSecrets(out, deadline);
-    if (spans === null) return { text: NOT_CHECKED, changed: true };
-    if (spans.length === 0) return { text: out, changed: known.labels.length > 0 };
+    if (spans === null) return this.#unchecked(text, NOT_CHECKED);
+    if (spans.length === 0) return { text: out, changed };
     let result = "";
     let at = 0;
     let learnedAny = false;
     for (const s of spans) {
       const value = out.slice(s.start, s.end);
       const fp = this.#opts.fingerprint.of(value);
-      if (this.#opts.learned?.learn(value, secretRef(s.kind, fp))) learnedAny = true;
+      // Only a distinct format is remembered: a word found under a name (`password: …`) is often ordinary elsewhere.
+      if (s.distinct && learned?.learn(value, secretRef(s.kind, fp))) learnedAny = true;
       this.#detected({ kind: s.kind, fingerprint: fp, value }, ctx);
       result += out.slice(at, s.start) + secretRef(s.kind, fp);
       at = s.end;
     }
     out = result + out.slice(at);
     // A value just learned may appear again in this text, bare: replaced too.
-    if (learnedAny) out = this.#opts.known.replace(out).text;
+    if (learnedAny && learned) out = learned.replace(out).text;
     return { text: out, changed: true };
   }
 
+  #unchecked(text: string, note: string): ScrubResult {
+    if (!this.#opts.onUnchecked) return { text: note, changed: true };
+    this.#opts.onUnchecked(text);
+    return { text, changed: false };
+  }
+
   #detected(secret: DetectedSecret, ctx: ScrubContext): void {
     if (!this.#opts.onDetected) return;
     try {
@@ -118,7 +144,12 @@ export class Scrubber {
         if (r.changed) changed = true;
         return r.text;
       }
-      if (depth > 32 || v === null || typeof v !== "object") return v;
+      if (v === null || typeof v !== "object") return v;
+      // Too deep to walk: not stored as it is, rather than stored unchecked.
+      if (depth > 32) {
+        changed = true;
+        return NOT_CHECKED;
+      }
       if (Array.isArray(v)) return v.map((x) => walk(x, depth + 1));
       const out: Record<string, unknown> = {};
       for (const [k, x] of Object.entries(v as Record<string, unknown>)) out[k] = walk(x, depth + 1);
@@ -129,11 +160,17 @@ export class Scrubber {
   }
 }
 
-/** A line that may be naming a credential: held whole until it ends, so a pattern spanning spaces is matched whole. */
-const TRIGGER = /secret|token|passw|pwd|api[_-]?key|private|auth|bearer|credential|:\/\/|-----BEGIN|\bcurl\b|--user\b/i;
+/**
+ * Where a credential may start on a line, as the detector's own names read it: a secret-named key
+ * with its separator (`DB_PASSWORD=`, `"api_key":`, `passphrase:`), `Bearer`, `Authorization`, a
+ * URL's userinfo, a password flag, a JWT, a .netrc entry. From there to the line's end is held,
+ * so a value spanning spaces is matched whole; prose that only mentions "authentication" streams.
+ */
+const TRIGGER =
+  /[A-Za-z0-9_.-]*(?:passw|passphrase|pwd|secret|api[_-]?key|private[_-]?key|access[_-]?key|token|credential|auth)[A-Za-z0-9_.-]*["'\]]?[ \t]*(?::=|=>|\?=|[=:])|\bbearer\b|\bauthorization\b|[a-z][a-z0-9+.-]{0,31}:\/\/[^\s/@]*:|(?:^|[ \t])(?:-u|--user|--passw(?:or)?d)\b|eyJ|(?:^|\s)machine\s|^[ \t]*password[ \t]/im;
 /** The most held of one line (or one PEM block) before it is sent anyway, scrubbed as far as it has come. */
 const MAX_LINE_HOLD = 4096;
-const MAX_BLOCK_HOLD = 20_000;
+const MAX_BLOCK_HOLD = 64_000;
 
 /**
  * Scrubs text that arrives in pieces (an assistant's reply as it streams), so
@@ -152,6 +189,8 @@ export class StreamScrubber {
   readonly #scrubber: Scrubber;
   readonly #ctx: ScrubContext;
   #held = "";
+  /** What was already sent of the current line, as it came: the context a later piece is judged in. */
+  #sentLine = "";
 
   constructor(scrubber: Scrubber, ctx: ScrubContext = {}) {
     this.#scrubber = scrubber;
@@ -163,14 +202,33 @@ export class StreamScrubber {
     const text = this.#held + piece;
     const cut = this.#safeEnd(text);
     this.#held = text.slice(cut);
-    return cut > 0 ? this.#scrubber.scrub(text.slice(0, cut), this.#ctx).text : "";
+    return cut > 0 ? this.#send(text.slice(0, cut)) : "";
   }
 
   /** The rest, at the message's end. */
   flush(): string {
     const rest = this.#held;
     this.#held = "";
-    return rest ? this.#scrubber.scrub(rest, this.#ctx).text : "";
+    const out = rest ? this.#send(rest) : "";
+    this.#sentLine = "";
+    return out;
+  }
+
+  /**
+   * `chunk` scrubbed in the context of its line so far: a value whose name was sent in an
+   * earlier piece (`AWS_ACCESS_KEY ` then `= …`) is still found. When the context's own
+   * scrubbing doesn't come out the same, the chunk is scrubbed alone.
+   */
+  #send(chunk: string): string {
+    let out: string;
+    if (this.#sentLine) {
+      const prefix = this.#scrubber.scrub(this.#sentLine, this.#ctx).text;
+      const whole = this.#scrubber.scrub(this.#sentLine + chunk, this.#ctx).text;
+      out = whole.startsWith(prefix) ? whole.slice(prefix.length) : this.#scrubber.scrub(chunk, this.#ctx).text;
+    } else out = this.#scrubber.scrub(chunk, this.#ctx).text;
+    const nl = chunk.lastIndexOf("\n");
+    this.#sentLine = (nl >= 0 ? chunk.slice(nl + 1) : this.#sentLine + chunk).slice(-MAX_LINE_HOLD);
+    return out;
   }
 
   /** How much of `text` can be sent now. */
@@ -180,12 +238,36 @@ export class StreamScrubber {
     if (begin >= 0 && text.indexOf("-----END", begin) < 0 && text.length - begin <= MAX_BLOCK_HOLD) {
       return this.#lineStart(text, begin);
     }
-    // The last line, unfinished: held whole when it may name a credential.
+    // The last line, unfinished: held from where a credential may start — judged with what was
+    // already sent of it, so a name sent in an earlier piece still holds its value.
     const lineStart = text.lastIndexOf("\n") + 1;
-    const line = text.slice(lineStart);
-    if (TRIGGER.test(line) && line.length <= MAX_LINE_HOLD) return lineStart;
-    // Otherwise up to the last space, the run after it held (bounded by the longest known value).
-    const hold = Math.min(Math.max(512, this.#scrubber.known.longest), MAX_LINE_HOLD);
+    const sent = lineStart === 0 ? this.#sentLine : "";
+    const line = sent + text.slice(lineStart);
+    const trigger = TRIGGER.exec(line);
+    if (trigger && line.length - trigger.index <= MAX_LINE_HOLD) {
+      let at = lineStart + Math.max(0, trigger.index - sent.length);
+      // From the word it is in (a quote or `export ` before a name stays with what was sent).
+      while (at > lineStart && /[A-Za-z0-9_.$"'-]/.test(text[at - 1]!)) at--;
+      return at;
+    }
+    // A known value with spaces in it is never cut inside: one begun at the end is held from its
+    // start, and one already whole goes out whole.
+    let cut = this.#plainCut(text);
+    for (const v of this.#scrubber.known.spaced) {
+      for (let i = text.indexOf(v); i >= 0; i = text.indexOf(v, i + 1)) if (i < cut && cut < i + v.length) cut = i + v.length;
+      for (let k = Math.min(v.length - 1, text.length); k > 0; k--) {
+        if (text.endsWith(v.slice(0, k))) {
+          cut = Math.min(cut, text.length - k);
+          break;
+        }
+      }
+    }
+    return cut;
+  }
+
+  /** Up to the last space, the run after it held (bounded by the longest known value). */
+  #plainCut(text: string): number {
+    const hold = Math.min(Math.max(512, this.#scrubber.longestKnown(this.#ctx)), MAX_LINE_HOLD);
     const lastSpace = Math.max(text.lastIndexOf(" "), text.lastIndexOf("\n"), text.lastIndexOf("\t"));
     let cut = lastSpace + 1;
     if (text.length - cut > hold) cut = text.length - hold;
diff --git a/src/daemon/secrets/secrets.test.ts b/src/daemon/secrets/secrets.test.ts
index 6be7d1b1..d3c74d07 100644
--- a/src/daemon/secrets/secrets.test.ts
+++ b/src/daemon/secrets/secrets.test.ts
@@ -277,17 +277,111 @@ describe("vault", () => {
 });
 
 describe("learned", () => {
-  test("a value found by its name is matched bare from then on, in the same text and later ones", async () => {
+  test("a value found by a distinct format is matched bare from then on; one found only by its name isn't", async () => {
     const { LearnedSecrets } = await import("./known.js");
-    const known = new KnownSecrets();
     const learned = new LearnedSecrets();
-    known.register("learned", () => learned.values());
-    learned.onChange(() => known.invalidate());
-    const scrubber = new Scrubber({ known, learned, fingerprint: fp });
-    const first = scrubber.scrub("DB_PASSWORD=hunter2xyz\nso the password is hunter2xyz").text;
-    expect(first).not.toContain("hunter2xyz");
-    const ref = /‹secret:credential:[0-9a-f]{8}›/.exec(first)![0];
+    const scrubber = new Scrubber({ known: new KnownSecrets(), learnedFor: () => learned, fingerprint: fp });
+    const first = scrubber.scrub("Authorization: Bearer 8f2d0c1e9b7a4f6e8d2c\nthe token is 8f2d0c1e9b7a4f6e8d2c").text;
+    expect(first).not.toContain("8f2d0c1e9b7a4f6e8d2c");
+    const ref = /‹secret:bearer-token:[0-9a-f]{8}›/.exec(first)![0];
     expect(first.split(ref)).toHaveLength(3);
-    expect(scrubber.scrub("later: hunter2xyz again").text).toBe(`later: ${ref} again`);
+    expect(scrubber.scrub("later: 8f2d0c1e9b7a4f6e8d2c again").text).toBe(`later: ${ref} again`);
+    // Only as a whole token: inside a longer word it is left.
+    expect(scrubber.scrub("x8f2d0c1e9b7a4f6e8d2cx").text).toBe("x8f2d0c1e9b7a4f6e8d2cx");
+    // A password found by its name isn't remembered: the same word is often ordinary elsewhere.
+    scrubber.scrub("DB_PASSWORD=localhost-dev-pw");
+    expect(scrubber.scrub("connect to localhost-dev-pw").text).toBe("connect to localhost-dev-pw");
+  });
+
+  test("scrubbing is idempotent even when a remembered value appears inside a reference", async () => {
+    const { LearnedSecrets } = await import("./known.js");
+    const learned = new LearnedSecrets();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), learnedFor: () => learned, fingerprint: fp });
+    learned.learn("github-token-value", "‹secret:x:00000000›");
+    const once = scrubber.scrub(`a ${GHP} b`).text;
+    expect(scrubber.scrub(scrubber.scrub(once).text).text).toBe(once);
+  });
+});
+
+describe("round-1 audit", () => {
+  test.each([
+    "    token = self.token",
+    "api_key = args.api_key",
+    "self.api_key = api_key",
+    "apiKey: config.apiKey",
+    "id_token = idToken",
+    "MAX_TOKENS=100000",
+    "DISABLE_AUTH=enabled",
+    "AUTH=Bearer",
+    'const pem = "-----BEGIN PRIVATE KEY-----"; foo(); const end = "-----END PRIVATE KEY-----"',
+    "if (s.startsWith('-----BEGIN RSA PRIVATE KEY-----')) { return parse(s); }",
+  ])("code isn't a secret: %s", (text) => {
+    expect(kinds(text)).toEqual([]);
+  });
+
+  test("a value under a name stops at the command's next word", () => {
+    expect(kinds("PGPASSWORD=postgres psql -h db")).toEqual(["credential:postgres"]);
+  });
+
+  test("a .netrc entry", () => {
+    expect(kinds("machine example.com login bob password s3cr3tPassw0rd")).toEqual(["password:s3cr3tPassw0rd"]);
+  });
+
+  test("hostile input stays linear", () => {
+    for (const text of ["-----BEGIN PRIVATE KEY-----".repeat(100_000), "curl ".repeat(400_000), `token: x${" ".repeat(990)}y\n`.repeat(2000)]) {
+      const t0 = performance.now();
+      findSecrets(text, t0 + 2_000);
+      expect(performance.now() - t0).toBeLessThan(2_500);
+    }
+  });
+
+  test.each(["source .env && bun test", ". ./.env; make test", "cp .env.example .env && bun run dev", "cat certs/ca.pem"])("keeps the output of %s", async (command) => {
+    await loadShellParser();
+    expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("keep");
+  });
+
+  test.each(["cat $HOME/.aws/credentials", "git show HEAD:.env", "git diff -- .env.production", "dd if=.env"])("withholds the output of %s", async (command) => {
+    await loadShellParser();
+    expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("withhold-output");
+  });
+
+  test("a stream judges a piece with what was sent of its line, and never cuts a spaced known value", () => {
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "pp", value: "correct horse battery staple" }]);
+    const scrubber = new Scrubber({ known, fingerprint: fp });
+    const jwt = `eyJ${"a".repeat(600)}.eyJ${"b".repeat(300)}.${"c".repeat(100)}`;
+    for (const [text, secret] of [
+      ["AWS_ACCESS_KEY = Zx9qWvLk3mNp8RtY\n", "Zx9qWvLk3mNp8RtY"],
+      ["the phrase is correct horse battery staple ok\n", "battery staple"],
+      [`here ${jwt} done`, "a".repeat(100)],
+      ['MY_PASSPHRASE = "hunter2-xyz-abc"\n', "hunter2-xyz-abc"],
+    ] as const) {
+      for (const step of [1, 3, 7]) {
+        const s = new StreamScrubber(scrubber);
+        let out = "";
+        for (let i = 0; i < text.length; i += step) out += s.push(text.slice(i, i + step));
+        out += s.flush();
+        expect(out).not.toContain(secret);
+      }
+    }
+    // Prose that only mentions the words streams.
+    const s = new StreamScrubber(scrubber);
+    expect(s.push("We use token-based authentication here and ")).toBe("We use token-based authentication here and ");
+  });
+
+  test("offline, a text that can't be checked is left as it is, and said", () => {
+    let unchecked = 0;
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp, budgetMs: -1, onUnchecked: () => void unchecked++ });
+    expect(scrubber.scrub("keep me").text).toBe("keep me");
+    expect(unchecked).toBe(1);
+  });
+
+  test("a relayed MCP result is scrubbed like a hub result", async () => {
+    const { McpHub } = await import("../mcp/hub.js");
+    const hub = new McpHub();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+    hub.setResultScrub((t) => scrubber.scrub(t).text);
+    const r = hub.scrubRelayed("tools/call", { content: [{ type: "text", text: `t=${GHP}` }], structuredContent: { token: GHP } });
+    expect(JSON.stringify(r)).not.toContain(GHP);
   });
 });
diff --git a/src/daemon/secrets/service.ts b/src/daemon/secrets/service.ts
index 6aeb44af..e4f2007d 100644
--- a/src/daemon/secrets/service.ts
+++ b/src/daemon/secrets/service.ts
@@ -26,6 +26,14 @@ export interface SecretServiceOptions {
   store?: Store;
   /** Whether a workstream keeps detected secrets ('' = sessions with no workstream). */
   capturePolicy?: (workstream: string | undefined) => "drop" | "vault";
+  /**
+   * A batch rewrite of stored data (`codeoid secret scrub`): no time budget (nothing waits on it,
+   * and a text over budget would be lost for good), and nothing remembered across texts (a value
+   * learned from one file must not rewrite every other).
+   */
+  offline?: boolean;
+  /** Offline: a text that couldn't be checked, kept as it is (counted by the caller). */
+  onUnchecked?: (text: string) => void;
 }
 
 /** Scrub context with the owner, so a kept secret lands in the right tenant. */
@@ -38,8 +46,20 @@ export const DEFAULT_SECRETS_CONFIG: SecretsConfig = { enabled: true, beforeMode
 
 export class SecretService {
   readonly known = new KnownSecrets();
-  /** Values found by shape this run, matched exactly from then on (memory only). */
-  readonly learned = new LearnedSecrets();
+  /** Values found by a distinct format this run, per tenant, matched exactly from then on (memory only). */
+  readonly #learned = new Map<string, LearnedSecrets>();
+
+  /** A tenant's remembered values; none without a tenant. */
+  learnedFor(ctx: { accountId?: string; projectId?: string }): LearnedSecrets | undefined {
+    if (!ctx.accountId || !ctx.projectId) return undefined;
+    const key = `${ctx.accountId}\u0000${ctx.projectId}`;
+    let l = this.#learned.get(key);
+    if (!l) {
+      l = new LearnedSecrets();
+      this.#learned.set(key, l);
+    }
+    return l;
+  }
   readonly config: SecretsConfig;
   readonly vault: CapturedSecretVault | undefined;
   readonly #scrubber: Scrubber;
@@ -51,11 +71,11 @@ export class SecretService {
     const fingerprint = new Fingerprinter(loadOrCreateKey(dir, "fingerprint.key"));
     this.vault = opts.store ? new CapturedSecretVault(opts.store, loadOrCreateKey(dir, "vault.key")) : undefined;
     this.#capturePolicy = opts.capturePolicy ?? (() => this.config.captureSecrets);
-    this.known.register("learned", () => this.learned.values());
-    this.learned.onChange(() => this.known.invalidate());
     this.#scrubber = new Scrubber({
       known: this.known,
-      learned: this.learned,
+      ...(opts.offline
+        ? { budgetMs: 60_000, ...(opts.onUnchecked ? { onUnchecked: opts.onUnchecked } : {}) }
+        : { learnedFor: (ctx: ScrubContext) => this.learnedFor(ctx as StoreScrubContext) }),
       fingerprint,
       onDetected: (secret, ctx) => {
         const c = ctx as StoreScrubContext;
@@ -112,7 +132,7 @@ export class SecretService {
  */
 export function environmentSecrets(env: Record<string, string | undefined> = process.env): KnownSecret[] {
   const out: KnownSecret[] = [];
-  const NAME = /(?:^CODEOID_CRED_|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$|_ACCESS_KEY$|^ANTHROPIC_AUTH_TOKEN$|_KEY$)/;
+  const NAME = /(?:^CODEOID_CRED_|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$|_ACCESS_KEY$|_SECRET_KEY$|_PRIVATE_KEY$|^ANTHROPIC_AUTH_TOKEN$|^CODEOID_API_KEY$)/;
   for (const [name, value] of Object.entries(env)) {
     if (!value || !NAME.test(name)) continue;
     out.push({ label: name.startsWith("CODEOID_CRED_") ? name.slice("CODEOID_CRED_".length).toLowerCase().replace(/_/g, "-") : `daemon:${name}`, value });
diff --git a/src/daemon/secrets/vault.ts b/src/daemon/secrets/vault.ts
index b0a4554e..a0f4ff26 100644
--- a/src/daemon/secrets/vault.ts
+++ b/src/daemon/secrets/vault.ts
@@ -70,7 +70,7 @@ export class CapturedSecretVault {
 
   #seal(value: string, scope: VaultScope, fingerprint: string): Uint8Array {
     const iv = randomBytes(12);
-    const c = createCipheriv("aes-256-gcm", this.#key, iv);
+    const c = createCipheriv("aes-256-gcm", this.#key, iv, { authTagLength: 16 });
     c.setAAD(this.#aad(scope, fingerprint));
     const body = Buffer.concat([c.update(value, "utf8"), c.final()]);
     return Buffer.concat([iv, c.getAuthTag(), body]);
@@ -78,7 +78,7 @@ export class CapturedSecretVault {
 
   #open(sealed: Uint8Array, scope: VaultScope, fingerprint: string): string {
     const buf = Buffer.from(sealed);
-    const d = createDecipheriv("aes-256-gcm", this.#key, buf.subarray(0, 12));
+    const d = createDecipheriv("aes-256-gcm", this.#key, buf.subarray(0, 12), { authTagLength: 16 });
     d.setAAD(this.#aad(scope, fingerprint));
     d.setAuthTag(buf.subarray(12, 28));
     return Buffer.concat([d.update(buf.subarray(28)), d.final()]).toString("utf8");
diff --git a/src/daemon/secrets/verdict.ts b/src/daemon/secrets/verdict.ts
index da119d06..24c7669e 100644
--- a/src/daemon/secrets/verdict.ts
+++ b/src/daemon/secrets/verdict.ts
@@ -81,15 +81,27 @@ const PRINTS_CREDENTIALS: ReadonlyArray<readonly string[]> = [
 const ENV_PRINTERS = new Set(["env", "set", "export", "declare", "typeset"]);
 
 /** Programs that print a file's contents: a credential file among their operands is read out. */
-const FILE_PRINTERS = new Set(["cat", "less", "more", "head", "tail", "bat", "batcat", "nl", "tac", "strings", "xxd", "hexdump", "od", "base64", "grep", "rg", "ag", "awk", "sed", "jq", "yq", "cut", "sort", "diff", "cp", "source", "."]);
+const FILE_PRINTERS = new Set(["cat", "less", "more", "head", "tail", "bat", "batcat", "nl", "tac", "strings", "xxd", "hexdump", "od", "base64", "grep", "rg", "ag", "awk", "sed", "jq", "yq", "cut", "sort", "diff"]);
 
 const PROGRAM_OPTION_WITH_VALUE = /^--?(?:profile|region|output|namespace|context|kubeconfig|n|address|format|account|vault|project)$/;
 
-function words(c: SimpleCommand): string[] | null {
+/** argv as text: a word only known at run time is null, but one that is only `$HOME/…` reads as `~/…`. */
+function words(c: SimpleCommand): Array<string | null> {
+  return c.argv.map((w) => w.value ?? w.home ?? null);
+}
+
+/** The paths a program reads besides its plain operands: `dd if=FILE`, `git show REV:FILE`. */
+function readsOf(argv: Array<string | null>): string[] {
+  const program = programName(argv[0] ?? "");
   const out: string[] = [];
-  for (const w of c.argv) {
-    if (w.value === null) return null;
-    out.push(w.value);
+  for (const a of argv.slice(1)) {
+    if (a === null) continue;
+    if (program === "dd" && a.startsWith("if=")) out.push(a.slice(3));
+    if (program === "git" && /^[^-:][^:]*:[^:]+$/.test(a) && argv.slice(1).some((w) => w === "show" || w === "cat-file")) out.push(a.slice(a.indexOf(":") + 1));
+  }
+  // git's commands that print a file's contents or changes: their path operands are read out.
+  if (program === "git" && argv.slice(1).some((w) => w !== null && ["show", "diff", "log", "blame", "grep", "cat-file"].includes(w))) {
+    for (const a of argv.slice(1)) if (a !== null && !a.startsWith("-")) out.push(a);
   }
   return out;
 }
@@ -142,7 +154,7 @@ function printsCredentials(argv: string[]): boolean {
 
 /** The same, matched as text when the line can't be parsed: fails toward withholding. */
 const PRINTS_CREDENTIALS_TEXT =
-  /(?:^|[;&|(`{!\n]|\$\()\s*(?:(?:sudo|command|exec|time|env|nohup)\s+|\w+=\S*\s+)*(?:\S*\/)?(?:gh\s+auth\s+token|printenv|gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token|aws\b[^\n;&|]*\bconfigure\s+(?:get|export-credentials)|op\s+(?:read|inject|item\s+get)|vault\s+(?:read|login|kv\s+get|print\s+token)|kubectl\b[^\n;&|]*\b(?:get|describe)\s+secrets?|git\s+credential\s+fill|pass\s+show|secret-tool\s+lookup)\b/;
+  /(?:^|[;&|(`{!\n'"]|\$\()\s*(?:(?:sudo|command|exec|time|nohup)\s+|\w+=\S*\s+)*(?:\S*\/)?(?:(?:env|set|export\s+-p)\s*(?:$|[;&|)\n'"])|gh\s+auth\s+token|printenv|gcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token|aws\b[^\n;&|]*\bconfigure\s+(?:get|export-credentials)|op\s+(?:read|inject|item\s+get)|vault\s+(?:read|login|kv\s+get|print\s+token)|kubectl\b[^\n;&|]*\b(?:get|describe)\s+secrets?|git\s+credential\s+fill|pass\s+show|secret-tool\s+lookup)\b/;
 
 export interface VerdictOptions {
   /** Where the call runs, for relative paths. */
@@ -179,20 +191,23 @@ function shellVerdict(command: string, cwd: string, opts: VerdictOptions): ToolV
   const drops = (opts.dropCommands ?? []).map((d) => d.trim().split(/\s+/).filter(Boolean)).filter((d) => d.length > 0);
   if (parsed.unreadable) {
     if (drops.some((d) => command.includes(d.join(" ")))) return "drop";
-    return PRINTS_CREDENTIALS_TEXT.test(command) ? "withhold-output" : "keep";
+    if (PRINTS_CREDENTIALS_TEXT.test(command)) return "withhold-output";
+    // A reader and a credential file named anywhere on the line: withheld, since the line can't be read.
+    const tokens = command.split(/[\s;&|()<>]+/).map((t) => t.replace(/^["']|["']$/g, "")).filter(Boolean);
+    if (tokens.some((t) => FILE_PRINTERS.has(programName(t))) && tokens.some((t) => isCredentialFile(t, cwd, opts.credentialFiles))) return "withhold-output";
+    return "keep";
   }
   let verdict: ToolVerdict = "keep";
   for (const c of parsed.commands) {
     const argv = words(c);
-    if (!argv || argv.length === 0) {
-      // A word only known at run time: still, a credential file it names plainly counts.
-      continue;
-    }
-    if (drops.some((d) => d.every((w, i) => (i === 0 ? programName(argv[0]!) === w : argv[i] === w)))) return "drop";
-    if (printsCredentials(argv)) verdict = "withhold-output";
-    const program = programName(argv[0]!);
-    // A credential file read out: an operand of a printer, or a redirect it reads (`< .env`).
-    const operands = FILE_PRINTERS.has(program) ? argv.slice(1).filter((a) => !a.startsWith("-")) : [];
+    if (argv.length === 0 || argv[0] === null) continue;
+    const program = programName(argv[0]);
+    if (drops.some((d) => d.every((w, i) => (i === 0 ? program === w : argv[i] === w)))) return "drop";
+    // A word only known at run time can't be a subcommand that prints a credential; the rest still counts.
+    if (argv.every((a) => a !== null) && printsCredentials(argv as string[])) verdict = "withhold-output";
+    // A credential file read out: an operand of a printer, what dd or git show reads, or a redirect it reads (`< .env`).
+    const known = argv.filter((a): a is string => a !== null);
+    const operands = [...(FILE_PRINTERS.has(program) ? known.slice(1).filter((a) => !a.startsWith("-")) : []), ...readsOf(argv)];
     const reads = c.redirects.filter((r) => r.op === "<" && r.target?.value).map((r) => r.target!.value!);
     if ([...operands, ...reads].some((p) => isCredentialFile(p, cwd, opts.credentialFiles))) verdict = "withhold-output";
     // A credential file written by a redirect (`echo KEY=… > .env`): the line holds the value.
diff --git a/src/daemon/server.ts b/src/daemon/server.ts
index 1400c452..58a692f1 100644
--- a/src/daemon/server.ts
+++ b/src/daemon/server.ts
@@ -641,6 +641,21 @@ export class DaemonServer {
     this.#mcpHub.proxy = this.#mcpProxy;
     const secretService = this.#secretService;
     if (secretService?.enabled && secretService.config.beforeModel) this.#mcpHub.setResultScrub((text) => secretService.scrub(text).text);
+    if (secretService) {
+      // The relay's per-session tokens are credentials too: matched while they live.
+      const live = new Set<string>();
+      this.#mcpProxy.tokenListener = {
+        minted: (t) => {
+          live.add(t);
+          secretService.known.invalidate();
+        },
+        revoked: (t) => {
+          live.delete(t);
+          secretService.known.invalidate();
+        },
+      };
+      secretService.addKnown("mcp-proxy", () => [...live].map((value) => ({ label: "daemon:mcp-relay-token", value })));
+    }
     for (const w of this.#mcpRegistry.warnings) console.warn(`[codeoid] ${w}`);
     // Goal blackboard: loopback URL regardless of bind address — the agent
     // subprocess runs on this host, and the endpoint must not become
diff --git a/src/daemon/session-manager.ts b/src/daemon/session-manager.ts
index 81c6f0d4..42ea5a36 100644
--- a/src/daemon/session-manager.ts
+++ b/src/daemon/session-manager.ts
@@ -860,7 +860,10 @@ export class SessionManager {
     // Routines share the daemon DB. Built only when enabled, so the kill
     // switch leaves every routine in place but nothing fires.
     if (opts?.config?.routines?.enabled ?? true) {
-      this.#routines = new RoutineService(new RoutineStore(store.database), this.#makeRoutineHost(), opts?.config?.routines ?? {});
+      const routineStore = new RoutineStore(store.database);
+      const secretService = opts?.secretService;
+      if (secretService) routineStore.scrubText = (text) => secretService.scrub(text).text;
+      this.#routines = new RoutineService(routineStore, this.#makeRoutineHost(), opts?.config?.routines ?? {});
     }
     // Pack curation surface (docs/pack-loading.md) — always constructed (cheap:
     // no DB / runner). Reads the boot pack config; each mutation persists to
@@ -2386,6 +2389,8 @@ mcpHub: this.#mcpHub,
    */
   #wireSecretService(secrets: SecretService): void {
     registerSecretPaths({ dirs: [secretMaterialDir(getConfigDir())] });
+    // Settled dispatch tasks and routine runs keep no secret either (§2.6).
+    this.#store.scrubText = (text) => secrets.scrub(text).text;
     secrets.setCapturePolicy((ws) => (ws ? (this.#workstreams.get(ws)?.captureSecrets ?? "drop") : (this.#config?.secrets?.captureSecrets ?? "drop")));
     addDaemonKnownSources(secrets, {
       credentials: () => this.#config?.credentials ?? [],
diff --git a/src/daemon/session.ts b/src/daemon/session.ts
index 5620f465..8bee2b7f 100644
--- a/src/daemon/session.ts
+++ b/src/daemon/session.ts
@@ -222,7 +222,7 @@ import { resolveAttachments } from "./attachments.js";
 import { type CodeoidConfig, getConfigDir } from "../config.js";
 import { type SecretPathVerdict, secretPathVerdict } from "./secret-paths.js";
 import type { CompressionRegistry } from "./compress/index.js";
-import { defaultSpillDir } from "./compress/spill.js";
+import { defaultSpillDir, takeSpill } from "./compress/spill.js";
 import { type TurnOrigin, turnOrigin } from "./turn-origin.js";
 import { type HeldPath, heldWriteOf, heldWriteReason, writeLandings, writeTargets } from "./held-writes.js";
 import { outsideEffects } from "./risk/effects.js";
@@ -1976,7 +1976,17 @@ export class Session {
     // Durable canonical history (#354): every change is appended to the
     // session's log so forks, backend switches and rewinds after a restart
     // still carry the conversation.
-    if (this.#secrets) this.#historyAccumulator.scrubTurn = (turn) => this.#scrubValue(turn);
+    if (this.#secrets) {
+      // At commit only what wasn't scrubbed on the way in: a user turn's text, and reasoning (a
+      // reply's text, tool inputs and outputs are scrubbed as they arrive). A seed is scrubbed whole.
+      this.#historyAccumulator.scrubTurn = (turn) =>
+        turn.role === "user"
+          ? { ...turn, content: this.#scrubText(turn.content), ...(turn.prompt !== undefined ? { prompt: this.#scrubText(turn.prompt) } : {}) }
+          : turn.thinking
+            ? { ...turn, thinking: this.#scrubText(turn.thinking) }
+            : turn;
+      this.#historyAccumulator.scrubSeed = (turn) => this.#scrubValue(turn);
+    }
     this.#historyAccumulator.onChange = (change) => {
       if (this.#destroyed) return;
       // Never write a history that couldn't be read over the log it lost;
@@ -5427,7 +5437,7 @@ export class Session {
         this.#noteProjectMcpNames(); // what this backend may load (readonly trust)
         const recoveryRun = this.#provider.runTurn({
           ...(this.#maxBudgetUsd !== undefined ? { maxBudgetUsd: this.#maxBudgetUsd } : {}),
-          history: this.#accumulator.history,
+          history: this.#historyForTurn(content),
           userMessage: content,
           model: this.#model ?? undefined,
           effort: this.#turnEffort() ?? undefined,
@@ -5535,7 +5545,7 @@ export class Session {
     this.#noteProjectMcpNames(); // what this backend may load (readonly trust)
     const run = this.#provider.runTurn({
       ...(this.#maxBudgetUsd !== undefined ? { maxBudgetUsd: this.#maxBudgetUsd } : {}),
-      history: this.#accumulator.history,
+      history: this.#historyForTurn(effectivePrompt),
       userMessage: turnPrompt,
       model: this.#model ?? undefined,
       effort: this.#turnEffort() ?? undefined,
@@ -6549,8 +6559,8 @@ export class Session {
       out.push({
         approvalId,
         toolName: gated.toolName,
-        // Shown as the card shows it: scrubbed (the call still runs with what the backend made).
-        input: this.#scrubValue(gated.input),
+        // Shown as the card shows it: as recorded (the call still runs with what the backend made).
+        input: this.#approvalShown(approvalId, gated.input),
         ...this.#cardRisk(risk, this.#heldWrite(gated.toolName, gated.input)),
         ...this.#cardSandbox(gated.toolName, gated.input, gated.shellCwd),
         ...(ws ? { targetWorkstream: { ...(ws.target.workstream ? { workstream: ws.target.workstream } : {}), ...(ws.target.warning ? { warning: ws.target.warning } : {}) } } : {}),
@@ -6992,7 +7002,7 @@ export class Session {
         this.#noteProjectMcpNames(); // what this backend may load (readonly trust)
         const run = this.#provider.runTurn({
           ...(this.#maxBudgetUsd !== undefined ? { maxBudgetUsd: this.#maxBudgetUsd } : {}),
-          history: this.#accumulator.history,
+          history: this.#historyForTurn(prompt),
           userMessage: prompt,
           model: this.#model ?? undefined,
           effort: this.#turnEffort() ?? undefined,
@@ -10081,9 +10091,12 @@ export class Session {
    * broadcast the new state so an approval prompt shows what will ACTUALLY
    * run, not the pre-mutation input.
    */
-  #applyHookInputMutation(approvalId: string, input: Record<string, unknown>): void {
+  #applyHookInputMutation(approvalId: string, raw: Record<string, unknown>): void {
     const msgId = this.#approvalIdToMessageId.get(approvalId);
     if (!msgId) return;
+    // Recorded as any input is: a hook may add a credential (an Authorization header) the call needs.
+    const toolUseId = this.#messageIdToToolUseId.get(msgId);
+    const input = this.#secrets ? this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", raw) : raw;
     const updateTool = (sm: SessionMessage): void => {
       if (!sm.tool) return;
       sm.tool.input = input;
@@ -10281,7 +10294,7 @@ export class Session {
       const emsg = err instanceof Error ? err.message : String(err);
       console.error(`[codeoid/session ${this.id}] provider event consumer failed:`, err);
       // Before the status change: it wakes a pipeline phase waiter that reads it.
-      this.#lastTurnError = emsg;
+      this.#lastTurnError = this.#scrubText(emsg);
       this.#recordTurnFailure([err]);
       this.#setStatus("error");
       const errorMsg = this.#makeMessage("system", `Error: ${emsg}`, SYSTEM_IDENTITY, undefined, undefined, { event: "agent_error", errorCode: "agent_error" });
@@ -10592,6 +10605,15 @@ export class Session {
       }
 
       case "tool_start": {
+        // The reply so far is whole: what the stream scrubber held of it goes out before the call
+        // (a stateless backend's next text may come only after a long tool loop).
+        if (this.#textStream && this.#activeAssistantMsg) {
+          const rest = this.#textStream.flush();
+          if (rest) {
+            this.#activeAssistantMsg.content += rest;
+            this.#broadcastRaw({ type: "session.message.delta", sessionId: this.id, messageId: this.#activeAssistantMsg.messageId, contentAppend: rest, timestamp: new Date().toISOString() });
+          }
+        }
         // What of this call is stored (docs/secrets-and-memory-design.md §2.4): judged on what it really runs.
         // The canonical history keeps what the transcript keeps.
         const verdict = this.#secrets ? this.#secrets.verdict(event.name, event.input, event.shellCwd ?? this.workdir) : "keep";
@@ -10754,6 +10776,8 @@ export class Session {
         // same — so it doesn't mark the backing session the way a hook's change does.
         const verdict = this.#toolVerdicts.get(event.sdkToolUseId) ?? "keep";
         this.#toolVerdicts.delete(event.sdkToolUseId);
+        // A withheld output's raw copy (the compressor's spill file) goes too: nothing reads it back now.
+        if ((verdict === "withhold-output" || verdict === "drop") && typeof event.output === "string") takeSpill(event.output, defaultSpillDir());
         const stored =
           verdict === "drop" ? NOT_STORED : verdict === "withhold-output" ? OUTPUT_WITHHELD : typeof event.output === "string" ? this.#scrubText(event.output) : event.output;
         let output = stored;
@@ -10988,7 +11012,7 @@ export class Session {
             this.#seedOverflowRetry = true;
             break;
           }
-          this.#lastTurnError = errText;
+          this.#lastTurnError = this.#scrubText(errText);
           // Before the status change below, like lastTurnError: an error
           // waiter reads it. The CLI puts a limit notice in the result text
           // or the turn's own assistant text (only if THIS turn committed it,
@@ -11045,7 +11069,7 @@ export class Session {
 
       case "error": {
         console.error(`[codeoid/session ${this.id}] provider error:`, event.message);
-        this.#lastTurnError = event.message; // before the status change (see above)
+        this.#lastTurnError = this.#scrubText(event.message); // before the status change (see above)
         // The structured detail (codex's error info + reset) rides with the text.
         this.#recordTurnFailure([event.detail ? { message: event.message, error: event.detail } : event.message]);
         this.#setStatus("error");
@@ -11365,7 +11389,8 @@ export class Session {
    * context rotation (which resets that history) doesn't erase the list.
    */
   #indexTurn(turnId: string, kind: TurnIndexEntry["kind"], text: string, at: string): void {
-    const firstLine = text.trim().split("\n", 1)[0] ?? "";
+    // Scrubbed before it is cut: a cut could split a secret into two halves no rule knows.
+    const firstLine = this.#scrubText(text.trim().split("\n", 1)[0] ?? "");
     const entry: TurnIndexEntry = {
       turnId,
       kind,
@@ -12295,6 +12320,27 @@ export class Session {
     this.#chunker?.onMessage(msg);
   }
 
+  /**
+   * The history a turn runs with: the canonical history (scrubbed, as stored), its last user turn
+   * — this turn's prompt — as the user wrote it. A stateless backend sends that turn to the model,
+   * and the prompt is what the user asked: a value in it is meant for the model (§2.7 of
+   * secrets-and-memory-design.md). Earlier turns stay scrubbed.
+   */
+  #historyForTurn(prompt: string): readonly CanonicalTurn[] {
+    const history = this.#accumulator.history;
+    const last = history.at(-1);
+    if (!this.#secrets || last?.role !== "user" || last.content === prompt) return history;
+    return [...history.slice(0, -1), { ...last, content: prompt }];
+  }
+
+  /** A pending approval's input as its card records it (secrets/verdict.ts): scrubbed, a credential file's content withheld. */
+  #approvalShown(approvalId: string, input: unknown): unknown {
+    if (!this.#secrets || !input || typeof input !== "object") return this.#scrubValue(input);
+    const msgId = this.#approvalIdToMessageId.get(approvalId);
+    const toolUseId = msgId ? this.#messageIdToToolUseId.get(msgId) : undefined;
+    return this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", input as Record<string, unknown>);
+  }
+
   /** Who and where a scrub is for: a kept secret lands in this tenant and home workstream. */
   #scrubContext() {
     return { accountId: this.accountId, projectId: this.projectId, workstream: this.#workstream?.id, sessionId: this.id };
diff --git a/src/daemon/share/pack.ts b/src/daemon/share/pack.ts
index 70feeb1f..2c1bcf28 100644
--- a/src/daemon/share/pack.ts
+++ b/src/daemon/share/pack.ts
@@ -21,6 +21,7 @@ import type {
 } from "../../protocol/types.js";
 
 import { resolveSafe } from "../fs.js";
+import { isCredentialFile } from "../secrets/files.js";
 import { resolveWorkdirAlias } from "./git-alias.js";
 import {
   SHARE_FORMAT_VERSION,
@@ -137,8 +138,15 @@ export async function packSession(
         continue;
       }
       const captured = await capturePinnedFile(abs, cap);
-      // Text only: a binary file's base64 isn't text a secret could be found in, and changing it would break it.
-      const snap = captured && deps.scrub && captured.encoding === "utf-8" ? { ...captured, content: deps.scrub(captured.content) } : captured;
+      // A credential file (`.env`, a key) isn't packed at all: it holds nothing else (secrets/files.ts).
+      // Text otherwise scrubbed; a binary file's base64 isn't text a secret could be found in.
+      const snap = !captured || !deps.scrub
+        ? captured
+        : isCredentialFile(abs, workdir)
+          ? { ...captured, content: "‹content withheld: a credential file›", encoding: "utf-8" as const }
+          : captured.encoding === "utf-8"
+            ? { ...captured, content: deps.scrub(captured.content) }
+            : captured;
       if (snap) {
         const key = encodePath(abs, workdir, alias);
         pinnedFiles[key] = snap;
diff --git a/src/daemon/store.ts b/src/daemon/store.ts
index 9cf5c436..e0f4cc2c 100644
--- a/src/daemon/store.ts
+++ b/src/daemon/store.ts
@@ -1329,6 +1329,29 @@ export class Store {
    * running, finishing late — overwrote whatever its successor had recorded,
    * or resurrected a task that had already gone terminal.
    */
+  /**
+   * Applied to a dispatch task's prompt, result digest and error once it is
+   * settled (docs/secrets-and-memory-design.md §2.6): until then the prompt is
+   * what its worker is sent, as the conductor wrote it.
+   */
+  scrubText: ((text: string) => string) | undefined;
+
+  /** A settled task's texts, scrubbed in place. */
+  #scrubSettledTask(id: string): void {
+    const scrub = this.scrubText;
+    if (!scrub) return;
+    const row = this.#db.prepare("SELECT prompt, result_digest, error, status FROM dispatch_tasks WHERE id = ?").get(id) as
+      | { prompt: string; result_digest: string | null; error: string | null; status: string }
+      | null;
+    if (!row || !["done", "failed", "cancelled", "blocked"].includes(row.status)) return;
+    const prompt = scrub(row.prompt);
+    const digest = row.result_digest ? scrub(row.result_digest) : row.result_digest;
+    const error = row.error ? scrub(row.error) : row.error;
+    if (prompt !== row.prompt || digest !== row.result_digest || error !== row.error) {
+      this.#db.prepare("UPDATE dispatch_tasks SET prompt = ?, result_digest = ?, error = ? WHERE id = ?").run(prompt, digest, error, id);
+    }
+  }
+
   dispatchComplete(id: string, generation: number, digest: string, now: number): boolean {
     const res = this.#db
       .prepare(
@@ -1337,6 +1360,7 @@ export class Store {
          WHERE id = ? AND generation = ? AND status IN ('claimed', 'running')`,
       )
       .run(digest, now, id, generation);
+    if (res.changes > 0) this.#scrubSettledTask(id);
     return res.changes > 0;
   }
 
@@ -1380,6 +1404,7 @@ export class Store {
           ? [opts.notBefore ?? null, error, now, id, generation]
           : [error, now, id, generation]),
       ) as { status: "queued" | "blocked" | "failed" } | null;
+    if (row && row.status !== "queued") this.#scrubSettledTask(id);
     return row?.status ?? null;
   }
 
@@ -1466,6 +1491,7 @@ export class Store {
          RETURNING *`,
       )
       .get(error, now, id, generation, ownerDaemon ?? null) as RawDispatchRow | null;
+    if (row) this.#scrubSettledTask(id);
     return row ? rowToDispatchTask(row) : null;
   }
 
@@ -1494,6 +1520,7 @@ export class Store {
          RETURNING *`,
       )
       .get(reason, now, id, ownerDaemon ?? null) as RawDispatchRow | null;
+    if (row) this.#scrubSettledTask(id);
     return row ? rowToDispatchTask(row) : null;
   }
 
diff --git a/src/tests/secrets-session.test.ts b/src/tests/secrets-session.test.ts
index 4ac28ed4..fb660fe0 100644
--- a/src/tests/secrets-session.test.ts
+++ b/src/tests/secrets-session.test.ts
@@ -50,12 +50,14 @@ let memory: MemoryEngine;
 let manager: SessionManager;
 let secrets: SecretService;
 let script: ProviderEvent[][];
+let providers: MockSessionProvider[] = [];
 
 beforeAll(async () => {
   await loadShellParser();
 });
 
 beforeEach(() => {
+  providers = [];
   tmp = realpathSync(mkdtempSync(join(tmpdir(), "codeoid-secrets-")));
   home = join(tmp, "home");
   for (const d of ["mine", "vaulted"]) mkdirSync(join(home, d), { recursive: true });
@@ -85,7 +87,11 @@ beforeEach(() => {
   secrets.addKnown("test", () => [{ label: "gh-test", value: KNOWN }]);
   manager = new SessionManager(store, transcript, undefined, undefined, memory, {
     config,
-    _testProviderFactory: () => new MockSessionProvider("mock", script),
+    _testProviderFactory: () => {
+      const p = new MockSessionProvider("mock", script);
+      providers.push(p);
+      return p;
+    },
     _testFolderReader: new FolderReader({ home, sshConfig: "" }),
     secretService: secrets,
   });
@@ -209,3 +215,23 @@ describe("kept secrets", () => {
     expect(((await manager.handle({ type: "secret.list", id: "l3" } as never, AUTH, CLIENT)) as { secrets: unknown[] }).secrets).toEqual([]);
   });
 });
+
+describe("what the backend is given", () => {
+  test("the prompt of the turn goes as written (a stateless backend sends it); earlier turns as stored", async () => {
+    script = [[{ type: "text_done", content: "ok" } as ProviderEvent, done], [{ type: "text_done", content: "ok" } as ProviderEvent, done]];
+    const { id } = await runIn("mine");
+    const session = manager._sessionForTest(id)!;
+    await session.send("now add DB_PASSWORD=hunter2xyz to compose", AUTH);
+    const end = Date.now() + 3000;
+    while (session.status !== "idle") {
+      if (Date.now() > end) throw new Error("timed out");
+      await Bun.sleep(5);
+    }
+    const opts = providers.at(-1)!.capturedOpts.at(-1)!;
+    expect(opts.history.at(-1)?.content).toBe("now add DB_PASSWORD=hunter2xyz to compose");
+    // The first prompt, as stored: its known value a reference.
+    expect(opts.history[0]?.content).toContain("‹credential:gh-test›");
+    // And stored scrubbed.
+    expect(readFileSync(transcript.canonicalPath(id), "utf8")).not.toContain("hunter2xyz");
+  });
+});

From f7b8441b06bf5149cacdef7a4397dd17bb3abe20 Mon Sep 17 00:00:00 2001
From: Yash Datta <yd2590@columbia.edu>
Date: Fri, 13 Nov 2026 09:23:03 +0800
Subject: [PATCH 3/4] =?UTF-8?q?fix:=20secrets=20S1=20audit=20round=202=20?=
 =?UTF-8?q?=E2=80=94=20fast=20on=20Bun=201.3,=20more=20credential=20shapes?=
 =?UTF-8?q?=20found,=20every=20backend's=20credential-file=20writes=20with?=
 =?UTF-8?q?held?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- detection: boundaries checked in code instead of leading lookbehinds (a
  0.6 MB file: 726 ms to 30 ms on Bun 1.3.13), keyword-first name patterns,
  a linear YAML value
- found now: unquoted credential headers, YAML values before a comment and
  with '=', URL query tokens, mysql -p / sshpass -p / docker login -p, and
  snake_case or camelCase values of env-style assignments (spaced code
  assignments stay code); values stop at '&' and a literal \n
- remembered values indexed by prefix (no rebuild when one is learned);
  reference overlap by binary search; deadlines inside both exact passes
- known values only as whole tokens; environment values only when they look
  like a secret
- verdicts: export -p / declare -x, env with options only, echo $SECRET,
  .env globs and braces, commands run through ssh / docker exec / kubectl
  exec; Codex, pi and apply_patch writes of credential files; drop covers argv
- structured MCP output scrubbed string by string; dispatch events, audit
  details and reclaimed tasks scrubbed; offline scrub leaves live tasks alone
- the stream judges a piece with the last 512 characters of its line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/secrets-and-memory-design.md  |  22 +++++-
 src/daemon/mcp/hub.ts              |  19 ++---
 src/daemon/secrets/detect.ts       |  90 ++++++++++++++++++------
 src/daemon/secrets/known.ts        | 108 ++++++++++++++++++++++-------
 src/daemon/secrets/scrub-stored.ts |   5 +-
 src/daemon/secrets/scrub.ts        |  28 ++++++--
 src/daemon/secrets/secrets.test.ts |  75 ++++++++++++++++++++
 src/daemon/secrets/service.ts      |   9 +++
 src/daemon/secrets/verdict.ts      |  72 ++++++++++++++++++-
 src/daemon/session.ts              |  24 ++++---
 src/daemon/store.ts                |   5 +-
 11 files changed, 379 insertions(+), 78 deletions(-)

diff --git a/docs/secrets-and-memory-design.md b/docs/secrets-and-memory-design.md
index 84eb2d84..fc1cbf37 100644
--- a/docs/secrets-and-memory-design.md
+++ b/docs/secrets-and-memory-design.md
@@ -162,7 +162,19 @@ sees a secret it read earlier as its reference. The prompt of the turn it is ans
 user wrote it (`Session#historyForTurn`).
 
 A value found only by the name it sits under (`DB_PASSWORD=…`, `password: …`) is replaced there but
-not remembered: the same word is too often ordinary text elsewhere. A value of a distinct format (a
+not remembered: the same word is too often ordinary text elsewhere. In code (`name = value`, spaced)
+a value that is another name (`self.token`, `api_key`, `idToken`) is taken for code; in a `.env` or a
+shell (`NAME=value`) it is a password like any other.
+
+Known values are matched as whole tokens, and a value from the daemon's environment only when it
+looks like a secret (12 characters or more, not a plain word): a dev default (`postgres`,
+`development`) stays the ordinary word it is.
+
+Memory, the routine and dispatch stores, and the hub scrub without a tenant: values are replaced
+there as anywhere, but nothing is remembered or kept in the vault from them. A routine's output is
+cut to its limit before it is stored, so a token at the cut can lose its end. A command's raw
+output spill file (the compressor) is kept until it is taken into memory or pruned (a day), and is
+removed at once when the call's output is withheld. A value of a distinct format (a
 vendor's token, a JWT, a bearer token, a key) is remembered for the rest of the daemon's run, per
 tenant, and replaced bare wherever it shows up again.
 
@@ -196,7 +208,13 @@ still gets through. The detector reduces this; it can't end it.
 - Matching: known and remembered values in one pass (Aho-Corasick), never inside a reference
   already written; remembered ones as whole tokens. Detection is linear: private keys and curl's
   `-u` are found in code, the time budget is checked inside each pattern's matches too.
-- Streaming: see §2.6.
+- Streaming: see §2.6. A piece is judged with the last 512 characters of its line already sent.
+- Remembered values: indexed by their first characters, matched where a token starts: learning
+  one costs nothing, and 2,000 remembered values cost a scan no slower than none.
+- Verdicts also withhold: `export -p` / `declare -x` / a bare `export`, `env` with options only,
+  `echo $SOME_TOKEN`, `cat .env*`, `git show/diff/log` of a credential file, `dd if=`, and what
+  `ssh host …`, `docker exec … ` and `kubectl exec … --` run; and every backend's file tools'
+  writes of a credential file (`writeTargets`, a patch's `*** Add File:`).
 - `codeoid secret scrub` takes no time budget, remembers nothing across texts, leaves a text it
   can't check as it is (and says how many), includes rotated transcript segments, and rebuilds
   each database it changed (FTS optimize, WAL checkpoint, VACUUM) so replaced text is gone from
diff --git a/src/daemon/mcp/hub.ts b/src/daemon/mcp/hub.ts
index 17246bcc..6dab4031 100644
--- a/src/daemon/mcp/hub.ts
+++ b/src/daemon/mcp/hub.ts
@@ -50,6 +50,15 @@ export interface McpCallScope {
   tenant?: McpTenant;
 }
 
+/** Every string in a JSON-like value through `fn`, structure kept (deeper than 32 levels: dropped). */
+function deepStrings(v: unknown, fn: (s: string) => string, depth = 0): unknown {
+  if (typeof v === "string") return fn(v);
+  if (v === null || typeof v !== "object") return v;
+  if (depth > 32) return null;
+  if (Array.isArray(v)) return v.map((x) => deepStrings(x, fn, depth + 1));
+  return Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, deepStrings(x, fn, depth + 1)]));
+}
+
 export interface McpCallResult {
   text: string;
   isError: boolean;
@@ -140,14 +149,8 @@ export class McpHub {
       Array.isArray(list) ? list.map((c) => (c && typeof c === "object" && typeof (c as { text?: unknown }).text === "string" ? { ...c, text: scrub((c as { text: string }).text) } : c)) : list;
     if (method === "tools/call") {
       const out: Record<string, unknown> = { ...(r as Record<string, unknown>), content: texts(r.content) };
-      // Structured output is text too, as JSON: scrubbed whole, kept only if it still parses.
-      if (r.structuredContent !== undefined) {
-        try {
-          out.structuredContent = JSON.parse(scrub(JSON.stringify(r.structuredContent)));
-        } catch {
-          delete out.structuredContent;
-        }
-      }
+      // Structured output: every string in it, as text (a line rule sees inside it as it would the text part).
+      if (r.structuredContent !== undefined) out.structuredContent = deepStrings(r.structuredContent, scrub);
       return out as T;
     }
     if (method === "resources/read") return { ...(r as Record<string, unknown>), contents: texts(r.contents) } as T;
diff --git a/src/daemon/secrets/detect.ts b/src/daemon/secrets/detect.ts
index d01bce58..aada9aff 100644
--- a/src/daemon/secrets/detect.ts
+++ b/src/daemon/secrets/detect.ts
@@ -31,20 +31,32 @@ export interface SecretSpan {
 interface Pattern {
   kind: string;
   re: RegExp;
-  /** A structural or named value that is plainly not a credential is left as it is. */
-  check?: "placeholder" | "word";
+  /**
+   * A value that is plainly not a credential is left as it is: a placeholder; a "word" (a type,
+   * code: another name, a call); an "env" value (as a word, but a snake_case or camelCase value
+   * of an environment variable is a password like any other).
+   */
+  check?: "placeholder" | "word" | "env";
   /** See {@link SecretSpan.distinct}. */
   distinct?: boolean;
   /** Only where the match's line also matches this (checked after the match, so the pattern stays linear). */
   line?: RegExp;
+  /**
+   * What comes before the match, checked in code rather than by a leading lookbehind or class
+   * (which an engine tries at every position: twenty times slower on Bun 1.3): the match may
+   * reach back over up to `max` of `chars` (a name's start), and the character before that must
+   * match `before` (or be the text's start).
+   */
+  back?: { chars?: RegExp; max?: number; before: RegExp; escapes?: boolean };
 }
 
-/** Not inside a longer token: no letter, digit or `_` just before. */
-const B = "(?<![A-Za-z0-9_])";
+/** Not inside a longer token. */
+const WORD_BOUNDARY = { before: /[^A-Za-z0-9_]/ };
+
 /** Nor just after. */
 const E = "(?![A-Za-z0-9_])";
 
-const vendor = (kind: string, body: string): Pattern => ({ kind, re: new RegExp(`${B}(?<secret>${body})${E}`, "g"), distinct: true });
+const vendor = (kind: string, body: string): Pattern => ({ kind, re: new RegExp(`(?<secret>${body})${E}`, "g"), distinct: true, back: WORD_BOUNDARY });
 
 /** Formats with a prefix of their own: they can't be mistaken for anything else. */
 const VENDOR: Pattern[] = [
@@ -115,32 +127,56 @@ const VENDOR: Pattern[] = [
 
 /** Credentials recognised by where they sit. */
 const STRUCTURAL: Pattern[] = [
-  { kind: "jwt", re: new RegExp(`(?:${B}|(?<=\\\\[nrt]))(?<secret>eyJ[A-Za-z0-9_-]{10,4000}\\.eyJ[A-Za-z0-9_-]{10,8000}\\.[A-Za-z0-9_-]{10,2000})`, "g"), distinct: true },
-  { kind: "bearer-token", re: /(?<![A-Za-z0-9_])bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder", distinct: true },
-  { kind: "authorization", re: /(?<![A-Za-z0-9_])authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder", distinct: true },
+  // After a non-word character, or an escaped newline or tab in JSON text (`\njwt…`: `n` is a letter).
+  { kind: "jwt", re: /(?<secret>eyJ[A-Za-z0-9_-]{10,4000}\.eyJ[A-Za-z0-9_-]{10,8000}\.[A-Za-z0-9_-]{10,2000})/g, distinct: true, back: { before: /[^A-Za-z0-9_]/, escapes: true } },
+  { kind: "bearer-token", re: /bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder", distinct: true, back: WORD_BOUNDARY },
+  { kind: "authorization", re: /authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder", distinct: true, back: WORD_BOUNDARY },
   // curl's `-u user:password`: the line must run curl (checked in findSecrets: `line: /\bcurl\b/`).
   { kind: "password", re: /(?:^|[ \t])(?:-u|--user)(?:=|[ \t]+)["']?[^:\s"']{0,200}:(?<secret>[^\s"']{1,500})/gm, check: "placeholder", line: /\bcurl\b/ },
   // A .netrc entry's password.
   { kind: "password", re: /(?:^|\s)machine\s+\S{1,253}\s+(?:login\s+\S{1,200}\s+)?password\s+(?<secret>\S{1,500})/g, check: "placeholder" },
   { kind: "password", re: /^[ \t]*password[ \t]+(?<secret>\S{1,500})[ \t]*$/gm, check: "placeholder" },
-  { kind: "password", re: /(?<![A-Za-z0-9_])[a-z][a-z0-9+.-]{1,31}:\/\/[^\s/?#@"'`<>:]{0,200}:(?<secret>[^\s/?#@"'`<>]{1,500})@/gi, check: "placeholder" },
+  // A URL's userinfo password, found from its `://` (the scheme before it, whatever it is).
+  { kind: "password", re: /:\/\/[^\s/?#@"'`<>:]{0,200}:(?<secret>[^\s/?#@"'`<>]{1,500})@/g, check: "placeholder", back: { chars: /[a-z0-9+.-]/i, max: 32, before: /[^A-Za-z0-9_]/ } },
   { kind: "password", re: /(?:^|[?&;\s-])(?:password|pwd)=(?<secret>"[^"\n]{0,500}"|'[^'\n]{0,500}'|[^&;\s"'`]{0,500}[^&;\s"'`,])/gim, check: "placeholder" },
   { kind: "aws-secret", re: /aws_secret_access_key["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?(?<secret>[A-Za-z0-9/+]{40,100})/gi, distinct: true },
-  { kind: "twilio-key", re: new RegExp(`${B}(?<secret>SK[0-9a-fA-F]{32})${E}`, "g"), distinct: true },
+  { kind: "twilio-key", re: new RegExp(`(?<secret>SK[0-9a-fA-F]{32})${E}`, "g"), distinct: true, back: WORD_BOUNDARY },
 ];
 
 /** The words an environment variable's name ends with when it holds a credential. */
-const ENV_NAME = "(?<![A-Za-z0-9_])[A-Z0-9_]{0,100}(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIALS?|AUTH)(?![A-Za-z0-9_])";
+/** The word an environment variable's name ends with; its start is found in code (`ENV_BACK`). */
+const ENV_NAME = "(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIALS?|AUTH)(?![A-Za-z0-9_])";
+const ENV_BACK = { chars: /[A-Z0-9_]/, max: 100, before: /[^A-Za-z0-9_]/ };
+/** A code name's start: any word characters, dots and dashes, after something that isn't one (a quote, a space). */
+const CODE_BACK = { chars: /[A-Za-z0-9_.-]/, max: 100, before: /[^A-Za-z0-9_.-]/ };
 /** The same as code, JSON and config files spell them; not `auth` alone, nor `tokens` (`max_tokens`). */
-const CODE_NAME =
-  "[\\w.-]{0,100}?(?:passw(?:or)?d|passphrase|secret|api[_-]?key|private[_-]?key|access[_-]?key|(?:auth|access|refresh|bearer|id|session)[_-]?token|token)";
+const CODE_WORD = "(?:passw(?:or)?d|passphrase|secret|api[_-]?key|private[_-]?key|access[_-]?key|(?:auth|access|refresh|bearer|id|session)[_-]?token|token)";
+/** In a line-anchored pattern (tried only at line starts): the name's start written out. */
+const CODE_NAME = `[\\w.-]{0,100}?${CODE_WORD}`;
 const SEPARATOR = `["'\\]]?[ \\t]*(?::=|=>|\\?=|[=:])[ \\t]*`;
 const QUOTED = `"(?:[^"\\\\\\n]|\\\\.){6,1000}"|'[^'\\n]{6,1000}'`;
 
 /** Values assigned to a name a credential is kept under. */
 const NAMED: Pattern[] = [
-  { kind: "credential", re: new RegExp(`${ENV_NAME}${SEPARATOR}(?<secret>${QUOTED}|[^\\s"'\`,;)\\]}{(<>]{6,1000})`, "g"), check: "word" },
-  { kind: "credential", re: new RegExp(`(?:^|[^A-Za-z0-9_.-])["']?${CODE_NAME}${SEPARATOR}(?<secret>${QUOTED})`, "gi"), check: "word" },
+  // An environment variable's value: stops at `&` and a literal `\n` (a query string, JSON text).
+  { kind: "credential", re: new RegExp(`${ENV_NAME}${SEPARATOR}(?<secret>${QUOTED}|[^\\s"'\`,;)\\]}{(<>&\\\\]{6,1000})`, "g"), check: "env", back: ENV_BACK },
+  // An HTTP header named for a credential, unquoted (`-H "X-Api-Key: abc…"`, `api-key: …`).
+  {
+    kind: "credential",
+    re: /(?:api-?key|auth-?token|access-?token|secret|password|token)[ \t]*:[ \t]*(?<secret>[^\s"',;]{6,1000})/gi,
+    check: "word",
+    back: { chars: /[A-Za-z0-9-]/, max: 64, before: /[\s"']/ },
+  },
+  // A URL's query value named for a credential (`?api_key=…`, `&access_token=…`).
+  {
+    kind: "credential",
+    re: /[?&](?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|auth[_-]?token|token|client[_-]?secret|secret|password|pwd|key|sig|signature)=(?<secret>[^&#\s"'<>]{6,1000})/gi,
+    check: "placeholder",
+  },
+  // A client's password flag glued to its value (`mysql -pHunter2`), or apart (`sshpass -p …`, `docker login -p …`).
+  { kind: "password", re: /(?:^|[ \t])-p(?<secret>[^\s"'-][^\s"']{0,200})/gm, check: "placeholder", line: /\b(?:mysql|mysqldump|mysqladmin|mariadb)\b/ },
+  { kind: "password", re: /(?:^|[ \t])-p[ \t]+(?<secret>[^\s"'-][^\s"']{0,200})/gm, check: "placeholder", line: /\b(?:sshpass|(?:docker|podman|nerdctl|helm)\s+(?:registry\s+)?login)\b/ },
+  { kind: "credential", re: new RegExp(`${CODE_WORD}${SEPARATOR}(?<secret>${QUOTED})`, "gi"), check: "word", back: CODE_BACK },
   {
     kind: "password",
     re: /(?:^|[ \t])--passw(?:or)?d[ \t]+(?<secret>"(?:[^"\\\n]|\\.){1,500}"|'[^'\n]{1,500}'|(?:[^\s"'\\<>[{()|&;`-][^\s"'\\|&;<>()`]{0,500}?)?[^A-Za-z\s"'\\.,:;()[\]{}<>|&`-][^\s"'\\|&;<>()`]{0,500})(?=[\s"';&|)\\]|$)/g,
@@ -149,14 +185,15 @@ const NAMED: Pattern[] = [
   // YAML-like `name: value`: the value runs to the end of the line (`password: correct horse`).
   {
     kind: "credential",
-    re: new RegExp(`^\\+?[ \\t]*(?:-[ \\t]+)?["']?${CODE_NAME}["']?[ \\t]*:[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\n#="]{0,1000})$`, "gim"),
+    // A trailing comment isn't part of it; `=` inside is (base64).
+    re: new RegExp(`^\\+?[ \\t]*(?:-[ \\t]+)?["']?${CODE_NAME}["']?[ \\t]*:[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\n#"]{0,1000})(?:#[^\\n]*)?$`, "gim"),
     check: "word",
   },
   // `.env`/INI-like `name=value`: up to the first space (`PGPASSWORD=x psql -h db` is a command).
   {
     kind: "credential",
-    re: new RegExp(`^\\+?[ \\t]*["']?${CODE_NAME}["']?[ \\t]*=[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\s#="]{0,1000})`, "gim"),
-    check: "word",
+    re: new RegExp(`^\\+?[ \\t]*["']?${CODE_NAME}["']?[ \\t]*=[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\s#"&\\\\]{0,1000})`, "gim"),
+    check: "env",
   },
 ];
 
@@ -224,7 +261,7 @@ export function isPlaceholder(raw: string): boolean {
 }
 
 /** {@link isPlaceholder}, or, unquoted, a type or code: what a name's value in code is far more often than a credential. */
-function isWord(raw: string): boolean {
+function isWord(raw: string, identifiers = true): boolean {
   const value = raw.trim();
   if (isPlaceholder(value)) return true;
   if (value.startsWith('"') || value.startsWith("'")) return false;
@@ -233,7 +270,7 @@ function isWord(raw: string): boolean {
   // (`Violetmeadow`, `postgres`) can be a password, and stays one.
   const bare = value.replace(/[,;)]+$/, "");
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+(?:\(\))?$/.test(bare) || /^[A-Za-z_$][\w$]*\(\)$/.test(bare)) return true;
-  if (/^[A-Za-z_$][\w$]*$/.test(bare) && (bare.includes("_") || /[a-z][A-Z]/.test(bare)) && !/[0-9]/.test(bare)) return true;
+  if (identifiers && /^[A-Za-z_$][\w$]*$/.test(bare) && (bare.includes("_") || /[a-z][A-Z]/.test(bare)) && !/[0-9]/.test(bare)) return true;
   if (/[0-9]/.test(value)) return false;
   return /[<>[\]&:(){},;]/.test(value) || TYPES.has(value.toLowerCase());
 }
@@ -260,6 +297,19 @@ export function findSecrets(text: string, deadline = Number.POSITIVE_INFINITY):
       if (secret.length === 0) continue;
       if (p.check === "placeholder" && isPlaceholder(secret)) continue;
       if (p.check === "word" && isWord(secret)) continue;
+      // `NAME=value` (a .env file, a shell) holds a value whatever it looks like; `name = value`,
+      // spaced, is code, where another name is more likely than a password.
+      if (p.check === "env" && isWord(secret, /[ \t]/.test(text[at[0] - 1] ?? ""))) continue;
+      if (p.back) {
+        let i = m.index!;
+        for (let k = 0; p.back.chars && k < (p.back.max ?? 0) && i > 0 && p.back.chars.test(text[i - 1]!); k++) i--;
+        if (i > 0) {
+          const prev = text[i - 1]!;
+          // `escapes`: also after an escaped newline or tab in JSON text.
+          const escaped = p.back.escapes === true && i > 1 && text[i - 2] === "\\" && "nrt".includes(prev);
+          if (!escaped && !p.back.before.test(prev)) continue;
+        }
+      }
       if (p.line) {
         const lineStart = text.lastIndexOf("\n", at[0]) + 1;
         const lineEnd = text.indexOf("\n", at[0]);
diff --git a/src/daemon/secrets/known.ts b/src/daemon/secrets/known.ts
index 3ad0c538..83504f62 100644
--- a/src/daemon/secrets/known.ts
+++ b/src/daemon/secrets/known.ts
@@ -98,19 +98,34 @@ class Matcher {
   }
 }
 
-/** `text` with matches replaced: leftmost-longest, none inside a reference, bounded ones only as whole tokens. */
-function replaceMatches(text: string, matcher: Matcher, bounded: boolean): { text: string; refs: Set<string>; labels: Set<string> } {
+/**
+ * `text` with matches replaced: leftmost-longest, as whole tokens, none inside a reference. Past
+ * `deadline`, null: the caller doesn't store what it couldn't check.
+ */
+function replaceMatches(text: string, matcher: Matcher, deadline: number): { text: string; refs: Set<string>; labels: Set<string> } | null {
   const refs = new Set<string>();
   const labels = new Set<string>();
   if (matcher.size === 0 || text.length < MIN_KNOWN_LENGTH) return { text, refs, labels };
+  // References in order: a match is checked against them by binary search.
   const own: Array<[number, number]> = [];
   for (const m of text.matchAll(OWN_REF)) own.push([m.index!, m.index! + m[0].length]);
-  const inOwn = (s: number, e: number) => own.some(([a, b]) => s < b && e > a);
+  const inOwn = (s: number, e: number): boolean => {
+    let lo = 0;
+    let hi = own.length;
+    while (lo < hi) {
+      const mid = (lo + hi) >> 1;
+      if (own[mid]![1] <= s) lo = mid + 1;
+      else hi = mid;
+    }
+    return lo < own.length && own[lo]![0] < e;
+  };
   const found: Array<[number, number, Needle]> = [];
+  let n = 0;
   for (const m of matcher.matches(text)) {
+    if (++n % 4096 === 0 && performance.now() > deadline) return null;
     const [s, e] = m;
     if (own.length > 0 && inOwn(s, e)) continue;
-    if (bounded && ((s > 0 && TOKEN_CHAR.test(text[s - 1]!)) || (e < text.length && TOKEN_CHAR.test(text[e]!)))) continue;
+    if ((s > 0 && TOKEN_CHAR.test(text[s - 1]!)) || (e < text.length && TOKEN_CHAR.test(text[e]!))) continue;
     found.push(m);
   }
   if (found.length === 0) return { text, refs, labels };
@@ -195,10 +210,14 @@ export class KnownSecrets {
     return this.#current().longest;
   }
 
-  /** `text` with every known value replaced by its reference, and the labels and references found. */
-  replace(text: string): { text: string; labels: string[]; refs: string[] } {
-    const r = replaceMatches(text, this.#current(), false);
-    return { text: r.text, labels: [...r.labels], refs: [...r.refs] };
+  /**
+   * `text` with every known value replaced by its reference where it stands as a whole token (a
+   * dev default like `postgres` inside `postgresql://` is left), and the labels and references
+   * found. Null past `deadline`.
+   */
+  replace(text: string, deadline = Number.POSITIVE_INFINITY): { text: string; labels: string[]; refs: string[] } | null {
+    const r = replaceMatches(text, this.#current(), deadline);
+    return r ? { text: r.text, labels: [...r.labels], refs: [...r.refs] } : null;
   }
 }
 
@@ -236,38 +255,75 @@ const MIN_LEARNED_LENGTH = 12;
 export class LearnedSecrets {
   readonly #values = new Map<string, Needle>();
   readonly #byRef = new Map<string, string>();
-  #matcher: Matcher | null = null;
+  /** By their first characters: a value is matched where a token starts, so a lookup there finds it. */
+  readonly #byPrefix = new Map<string, Needle[]>();
+  #longest = 0;
 
-  /** Remember a value; true when it is new. */
+  /** Remember a value; true when it is new. Learning costs no rebuild. */
   learn(value: string, ref: string): boolean {
     if (value.length < MIN_LEARNED_LENGTH || this.#values.has(value)) return false;
-    this.#values.set(value, { text: value, label: "learned", ref });
+    const n: Needle = { text: value, label: "learned", ref };
+    this.#values.set(value, n);
     this.#byRef.set(ref, value);
-    while (this.#values.size > MAX_LEARNED) {
-      const [oldest, n] = this.#values.entries().next().value!;
-      this.#values.delete(oldest);
-      this.#byRef.delete(n.ref);
-    }
-    this.#matcher = null;
+    const key = value.slice(0, PREFIX);
+    const list = this.#byPrefix.get(key) ?? [];
+    list.push(n);
+    list.sort((x, y) => y.text.length - x.text.length);
+    this.#byPrefix.set(key, list);
+    this.#longest = Math.max(this.#longest, value.length);
+    while (this.#values.size > MAX_LEARNED) this.#forget(this.#values.keys().next().value!);
     return true;
   }
 
+  #forget(value: string): void {
+    const n = this.#values.get(value);
+    if (!n) return;
+    this.#values.delete(value);
+    this.#byRef.delete(n.ref);
+    const key = value.slice(0, PREFIX);
+    const list = (this.#byPrefix.get(key) ?? []).filter((x) => x !== n);
+    if (list.length > 0) this.#byPrefix.set(key, list);
+    else this.#byPrefix.delete(key);
+  }
+
   /** The value a learned reference stands for. */
   valueOf(ref: string): string | undefined {
     return this.#byRef.get(ref);
   }
 
   get longest(): number {
-    return this.#current().longest;
+    return this.#longest;
   }
 
-  #current(): Matcher {
-    this.#matcher ??= new Matcher([...this.#values.values()]);
-    return this.#matcher;
-  }
-
-  replace(text: string): { text: string; refs: string[] } {
-    const r = replaceMatches(text, this.#current(), true);
-    return { text: r.text, refs: [...r.refs] };
+  /** Each remembered value replaced where it stands as a whole token, never inside a reference. Null past `deadline`. */
+  replace(text: string, deadline = Number.POSITIVE_INFINITY): { text: string; refs: string[] } | null {
+    const refs = new Set<string>();
+    if (this.#values.size === 0 || text.length < MIN_LEARNED_LENGTH) return { text, refs: [] };
+    const own: Array<[number, number]> = [];
+    for (const m of text.matchAll(OWN_REF)) own.push([m.index!, m.index! + m[0].length]);
+    let out = "";
+    let at = 0;
+    let o = 0;
+    for (let i = 0; i + MIN_LEARNED_LENGTH <= text.length; i++) {
+      if ((i & 0xffff) === 0 && i > 0 && performance.now() > deadline) return null;
+      if (i > 0 && TOKEN_CHAR.test(text[i - 1]!)) continue;
+      while (o < own.length && own[o]![1] <= i) o++;
+      if (o < own.length && own[o]![0] <= i) {
+        i = own[o]![1] - 1;
+        continue;
+      }
+      const list = this.#byPrefix.get(text.slice(i, i + PREFIX));
+      if (!list) continue;
+      const n = list.find((c) => text.startsWith(c.text, i) && !(i + c.text.length < text.length && TOKEN_CHAR.test(text[i + c.text.length]!)));
+      if (!n) continue;
+      out += text.slice(at, i) + n.ref;
+      at = i + n.text.length;
+      refs.add(n.ref);
+      i = at - 1;
+    }
+    return at === 0 ? { text, refs: [] } : { text: out + text.slice(at), refs: [...refs] };
   }
 }
+
+/** How many leading characters index a remembered value (each is at least MIN_LEARNED_LENGTH long). */
+const PREFIX = 8;
diff --git a/src/daemon/secrets/scrub-stored.ts b/src/daemon/secrets/scrub-stored.ts
index 35086e08..058c1466 100644
--- a/src/daemon/secrets/scrub-stored.ts
+++ b/src/daemon/secrets/scrub-stored.ts
@@ -147,7 +147,10 @@ export function scrubDispatchTasks(dbPath: string, scrub: ScrubFn, dryRun: boole
     const cols = new Set((db.prepare("PRAGMA table_info(dispatch_tasks)").all() as Array<{ name: string }>).map((c) => c.name));
     if (!cols.has("prompt")) return 0;
     const digest = cols.has("result_digest");
-    const rows = db.prepare(`SELECT id, prompt${digest ? ", result_digest" : ""} FROM dispatch_tasks`).all() as Array<{ id: string; prompt: string | null; result_digest?: string | null }>;
+    // Settled tasks only: a queued or running one's prompt is what its worker is sent, as written.
+    const rows = db
+      .prepare(`SELECT id, prompt${digest ? ", result_digest" : ""} FROM dispatch_tasks WHERE status IN ('done', 'failed', 'blocked', 'cancelled')`)
+      .all() as Array<{ id: string; prompt: string | null; result_digest?: string | null }>;
     const update = db.prepare(`UPDATE dispatch_tasks SET prompt = ?${digest ? ", result_digest = ?" : ""} WHERE id = ?`);
     const tx = db.transaction(() => {
       for (const r of rows) {
diff --git a/src/daemon/secrets/scrub.ts b/src/daemon/secrets/scrub.ts
index 3fa953fb..0b6ef9dd 100644
--- a/src/daemon/secrets/scrub.ts
+++ b/src/daemon/secrets/scrub.ts
@@ -85,11 +85,13 @@ export class Scrubber {
     if (text.length > MAX_SCRUB_BYTES) return this.#unchecked(text, TOO_LARGE);
     const deadline = performance.now() + (this.#opts.budgetMs ?? SCRUB_BUDGET_MS);
     const learned = this.#opts.learnedFor?.(ctx);
-    const known = this.#opts.known.replace(text);
+    const known = this.#opts.known.replace(text, deadline);
+    if (!known) return this.#unchecked(text, NOT_CHECKED);
     let out = known.text;
     let changed = known.labels.length > 0;
     if (learned) {
-      const r = learned.replace(out);
+      const r = learned.replace(out, deadline);
+      if (!r) return this.#unchecked(text, NOT_CHECKED);
       out = r.text;
       // A learned value matched exactly is still a detected secret: the vault keeps it where it is kept.
       for (const ref of r.refs) {
@@ -116,7 +118,11 @@ export class Scrubber {
     }
     out = result + out.slice(at);
     // A value just learned may appear again in this text, bare: replaced too.
-    if (learnedAny && learned) out = learned.replace(out).text;
+    if (learnedAny && learned) {
+      const again = learned.replace(out, deadline);
+      if (!again) return this.#unchecked(text, NOT_CHECKED);
+      out = again.text;
+    }
     return { text: out, changed: true };
   }
 
@@ -145,8 +151,12 @@ export class Scrubber {
         return r.text;
       }
       if (v === null || typeof v !== "object") return v;
-      // Too deep to walk: not stored as it is, rather than stored unchecked.
+      // Too deep to walk: not stored as it is, rather than stored unchecked (offline: kept, and said).
       if (depth > 32) {
+        if (this.#opts.onUnchecked) {
+          this.#opts.onUnchecked(JSON.stringify(v));
+          return v;
+        }
         changed = true;
         return NOT_CHECKED;
       }
@@ -171,6 +181,8 @@ const TRIGGER =
 /** The most held of one line (or one PEM block) before it is sent anyway, scrubbed as far as it has come. */
 const MAX_LINE_HOLD = 4096;
 const MAX_BLOCK_HOLD = 64_000;
+/** How much of a line already sent a piece is judged with. */
+const CONTEXT = 512;
 
 /**
  * Scrubs text that arrives in pieces (an assistant's reply as it streams), so
@@ -221,13 +233,14 @@ export class StreamScrubber {
    */
   #send(chunk: string): string {
     let out: string;
-    if (this.#sentLine) {
+    // Context only where it can matter: the line so far may name a credential, the chunk included.
+    if (this.#sentLine && TRIGGER.test(this.#sentLine + chunk.split("\n", 1)[0])) {
       const prefix = this.#scrubber.scrub(this.#sentLine, this.#ctx).text;
       const whole = this.#scrubber.scrub(this.#sentLine + chunk, this.#ctx).text;
       out = whole.startsWith(prefix) ? whole.slice(prefix.length) : this.#scrubber.scrub(chunk, this.#ctx).text;
     } else out = this.#scrubber.scrub(chunk, this.#ctx).text;
     const nl = chunk.lastIndexOf("\n");
-    this.#sentLine = (nl >= 0 ? chunk.slice(nl + 1) : this.#sentLine + chunk).slice(-MAX_LINE_HOLD);
+    this.#sentLine = (nl >= 0 ? chunk.slice(nl + 1) : this.#sentLine + chunk).slice(-CONTEXT);
     return out;
   }
 
@@ -241,7 +254,8 @@ export class StreamScrubber {
     // The last line, unfinished: held from where a credential may start — judged with what was
     // already sent of it, so a name sent in an earlier piece still holds its value.
     const lineStart = text.lastIndexOf("\n") + 1;
-    const sent = lineStart === 0 ? this.#sentLine : "";
+    // The last part of what was sent is enough: a credential's name sits just before its value.
+    const sent = lineStart === 0 ? this.#sentLine.slice(-CONTEXT) : "";
     const line = sent + text.slice(lineStart);
     const trigger = TRIGGER.exec(line);
     if (trigger && line.length - trigger.index <= MAX_LINE_HOLD) {
diff --git a/src/daemon/secrets/secrets.test.ts b/src/daemon/secrets/secrets.test.ts
index d3c74d07..873462d8 100644
--- a/src/daemon/secrets/secrets.test.ts
+++ b/src/daemon/secrets/secrets.test.ts
@@ -385,3 +385,78 @@ describe("round-1 audit", () => {
     expect(JSON.stringify(r)).not.toContain(GHP);
   });
 });
+
+describe("round-2 audit", () => {
+  test.each([
+    ['curl -H "X-Api-Key: abcdef1234567890" x', "abcdef1234567890"],
+    ["password: hunter2 # prod", "hunter2"],
+    ["secret: dGVzdA==", "dGVzdA=="],
+    ["GET /x?api_key=abcdef123456&q=1", "abcdef123456"],
+    ["mysql -u root -pHunter2pw db", "Hunter2pw"],
+    ["sshpass -p s3cretpw ssh h", "s3cretpw"],
+    ["DB_PASSWORD=correct_horse_battery", "correct_horse_battery"],
+    ["DB_PASSWORD=violetMeadow", "violetMeadow"],
+  ])("finds the value in %s", (text, value) => {
+    expect((findSecrets(text) ?? []).map((s) => text.slice(s.start, s.end))).toEqual([value]);
+  });
+
+  test("a value stops at & and a literal \\n, so nothing after it is lost", () => {
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+    expect(scrubber.scrub("password=hunter2&user=x").text).toEndWith("&user=x");
+    expect(scrubber.scrub('{"env":"API_KEY=abc123xyz\\nNEXT=1"}').text).toContain("\\nNEXT=1");
+  });
+
+  test.each(["export -p", "declare -x", "env -u X", "cat .env*", "docker exec c env", "kubectl exec p -- env", "ssh host cat .env", "echo $GITHUB_TOKEN"])(
+    "withholds the output of %s",
+    async (command) => {
+      await loadShellParser();
+      expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("withhold-output");
+    },
+  );
+
+  test("writes of a credential file by any backend's file tools", () => {
+    expect(toolVerdict("codex_file_change", { changes: [{ path: "/w/.env", kind: "add" }] }, { cwd: "/w" })).toBe("withhold-written");
+    expect(toolVerdict("apply_patch", { input: "*** Begin Patch\n*** Add File: .env\n+A=1\n*** End Patch" }, { cwd: "/w" })).toBe("withhold-written");
+  });
+
+  test("remembering many values, and scrubbing already-scrubbed text, stay fast", async () => {
+    const { LearnedSecrets } = await import("./known.js");
+    const learned = new LearnedSecrets();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), learnedFor: () => learned, fingerprint: fp });
+    const jwt = (i: number) => `eyJ${"a".repeat(40)}${i}.eyJ${"b".repeat(600)}.${"c".repeat(43)}`;
+    let t0 = performance.now();
+    for (let i = 0; i < 2000; i++) scrubber.scrub(`got ${jwt(i)} ok`);
+    expect(performance.now() - t0).toBeLessThan(5_000);
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "k", value: "knownvalue123" }]);
+    const s2 = new Scrubber({ known, fingerprint: fp });
+    t0 = performance.now();
+    const r = s2.scrub("‹secret:x:00000000› knownvalue123 ".repeat(40_000));
+    expect(performance.now() - t0).toBeLessThan(2_000);
+    expect(r.text).not.toContain("knownvalue123");
+  });
+
+  test("a dev default in the environment isn't a known value; a key-like one is", async () => {
+    const { environmentSecrets } = await import("./service.js");
+    const found = environmentSecrets({ POSTGRES_PASSWORD: "postgres", SESSION_SECRET: "development", STRIPE_API_KEY: "sk_test_abcDEF123456789" });
+    expect(found.map((k) => k.value)).toEqual(["sk_test_abcDEF123456789"]);
+  });
+
+  test("known values are matched only as whole tokens", () => {
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "k", value: "postgres-pw-12" }]);
+    const s = new Scrubber({ known, fingerprint: fp });
+    expect(s.scrub("x postgres-pw-123 y").text).toBe("x postgres-pw-123 y");
+    expect(s.scrub("x postgres-pw-12 y").text).toBe("x ‹credential:k› y");
+  });
+
+  test("structured MCP output is scrubbed string by string", async () => {
+    const { McpHub } = await import("../mcp/hub.js");
+    const hub = new McpHub();
+    const scrubber = new Scrubber({ known: new KnownSecrets(), fingerprint: fp });
+    hub.setResultScrub((t) => scrubber.scrub(t).text);
+    const r = hub.scrubRelayed("tools/call", { content: [], structuredContent: { output: "db:\n  password: Violetmeadow\n", n: 3 } }) as { structuredContent: { output: string; n: number } };
+    expect(r.structuredContent.output).not.toContain("Violetmeadow");
+    expect(r.structuredContent.n).toBe(3);
+  });
+});
diff --git a/src/daemon/secrets/service.ts b/src/daemon/secrets/service.ts
index e4f2007d..6f1a472f 100644
--- a/src/daemon/secrets/service.ts
+++ b/src/daemon/secrets/service.ts
@@ -130,11 +130,20 @@ export class SecretService {
  * from the env-file store among them) and anything whose name says it is a
  * secret (`*_API_KEY`, `*_TOKEN`, …).
  */
+/** At least 12 characters, and not a plain word: a digit, a symbol, or both cases. */
+export function looksLikeSecret(value: string): boolean {
+  if (value.length < 12) return false;
+  return /[0-9]/.test(value) || /[^A-Za-z]/.test(value) || (/[a-z]/.test(value) && /[A-Z]/.test(value));
+}
+
 export function environmentSecrets(env: Record<string, string | undefined> = process.env): KnownSecret[] {
   const out: KnownSecret[] = [];
   const NAME = /(?:^CODEOID_CRED_|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$|_ACCESS_KEY$|_SECRET_KEY$|_PRIVATE_KEY$|^ANTHROPIC_AUTH_TOKEN$|^CODEOID_API_KEY$)/;
   for (const [name, value] of Object.entries(env)) {
     if (!value || !NAME.test(name)) continue;
+    // Named like a secret, but a dev default (`postgres`, `development`, `changeme`) is ordinary text
+    // everywhere else: a value from the environment is matched only when it looks like one.
+    if (!looksLikeSecret(value)) continue;
     out.push({ label: name.startsWith("CODEOID_CRED_") ? name.slice("CODEOID_CRED_".length).toLowerCase().replace(/_/g, "-") : `daemon:${name}`, value });
   }
   return out;
diff --git a/src/daemon/secrets/verdict.ts b/src/daemon/secrets/verdict.ts
index 24c7669e..c216b556 100644
--- a/src/daemon/secrets/verdict.ts
+++ b/src/daemon/secrets/verdict.ts
@@ -21,6 +21,7 @@
 
 import { parseShellSync, type SimpleCommand } from "../shell/parse.js";
 import { shellCallOf } from "../shell/tool-call.js";
+import { writeTargets } from "../held-writes.js";
 import { toolReadPaths } from "../secret-paths.js";
 import { isCredentialFile } from "./files.js";
 
@@ -145,7 +146,16 @@ function printsCredentials(argv: string[]): boolean {
   // The environment, the shell's variables: alone, not running a command.
   if (ENV_PRINTERS.has(program)) {
     const opts = argv.slice(1);
-    if (program === "env" && opts.every((a) => a.startsWith("-"))) return true;
+    if (program === "env") {
+      // Options only (`-u X` and `-C DIR` take a value): it prints the environment.
+      let printsAll = true;
+      for (let i = 0; i < opts.length; i++) {
+        const a = opts[i]!;
+        if (a === "-u" || a === "--unset" || a === "-C" || a === "--chdir") i++;
+        else if (!a.startsWith("-")) printsAll = false;
+      }
+      if (printsAll) return true;
+    }
     if (program === "set" && opts.length === 0) return true;
     if ((program === "export" || program === "declare" || program === "typeset") && opts.length > 0 && opts.every((a) => /^-[a-zA-Z]*[px]/.test(a))) return true;
   }
@@ -176,6 +186,18 @@ export function toolVerdict(toolName: string, input: unknown, opts: VerdictOptio
     const obj = input && typeof input === "object" ? (input as Record<string, unknown>) : {};
     const shell = shellCallOf(toolName, obj);
     if (shell) return shellVerdict(shell.command, shell.cwd ?? opts.cwd, opts);
+    // Every backend's file tools, as the held-write gate reads them (a Codex change's paths, pi's `edit`).
+    const writes = writeTargets(toolName, obj);
+    if (writes) {
+      const named = writes.filter((p): p is string => typeof p === "string");
+      if (named.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) return "withhold-written";
+    }
+    // A patch tool: every file it adds or changes (`*** Add File: .env`).
+    const patch = typeof obj.input === "string" ? obj.input : typeof obj.patch === "string" ? obj.patch : null;
+    if (patch && /^(?:apply_patch|patch)$/i.test(toolName)) {
+      const files = [...patch.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm)].map((m) => m[1]!.trim());
+      if (files.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) return "withhold-written";
+    }
     const paths = toolReadPaths(toolName, obj);
     if (paths.some((p) => isCredentialFile(p, opts.cwd, opts.credentialFiles))) {
       return writesFiles(toolName) ? "withhold-written" : "withhold-output";
@@ -186,7 +208,40 @@ export function toolVerdict(toolName: string, input: unknown, opts: VerdictOptio
   }
 }
 
-function shellVerdict(command: string, cwd: string, opts: VerdictOptions): ToolVerdict {
+/** A declaration builtin listing the shell's variables (`export -p`, `declare -x`, bare `export`): the parser gives no command for it. */
+const DECLARATION_PRINTS = /(?:^|[;&|(]\s*|\bthen\s+|\bdo\s+)(?:export|declare|typeset|readonly)(?:\s+-[a-zA-Z]*[pxr]?[a-zA-Z]*)*\s*(?=$|[;&|)\n])/m;
+/** A variable whose name says it holds a credential (`$GITHUB_TOKEN`, `${DB_PASSWORD}`). */
+const SECRET_VARIABLE = /\$\{?[A-Za-z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PASSPHRASE|_PWD|API_?KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY|CREDENTIALS?)\b/i;
+/** Programs that print their arguments. */
+const ECHOES = new Set(["echo", "printf", "print"]);
+/** A word as a path it may name: globs and braces dropped (`.env*`, `.env{,.local}` name `.env`). */
+function pathLike(raw: string): string {
+  return raw.replace(/^["']|["']$/g, "").replace(/\{[^}]*\}/g, "").replace(/[*?]+$/, "").replace(/\[[^\]]*\]$/, "");
+}
+
+/** The command another program runs for it: `ssh host CMD…`, `docker exec C CMD…`, `kubectl exec P -- CMD…`. */
+function innerCommand(argv: string[]): string | null {
+  const program = programName(argv[0] ?? "");
+  const rest = argv.slice(1);
+  if (program === "ssh") {
+    let i = 0;
+    while (i < rest.length && rest[i]!.startsWith("-")) i += /^-[bcDEeFIiJLlmOopQRSWw]$/.test(rest[i]!) ? 2 : 1;
+    return rest.length > i + 1 ? rest.slice(i + 1).join(" ") : null;
+  }
+  if ((program === "docker" || program === "podman") && rest[0] === "exec") {
+    let i = 1;
+    while (i < rest.length && rest[i]!.startsWith("-")) i += /^-(?:e|u|w|-env|-user|-workdir)$/.test(rest[i]!) ? 2 : 1;
+    return rest.length > i + 1 ? rest.slice(i + 1).join(" ") : null;
+  }
+  if (program === "kubectl" && rest.includes("exec")) {
+    const dash = rest.indexOf("--");
+    return dash >= 0 && dash < rest.length - 1 ? rest.slice(dash + 1).join(" ") : null;
+  }
+  return null;
+}
+
+function shellVerdict(command: string, cwd: string, opts: VerdictOptions, depth = 0): ToolVerdict {
+  if (DECLARATION_PRINTS.test(command)) return "withhold-output";
   const parsed = parseShellSync(command);
   const drops = (opts.dropCommands ?? []).map((d) => d.trim().split(/\s+/).filter(Boolean)).filter((d) => d.length > 0);
   if (parsed.unreadable) {
@@ -202,6 +257,19 @@ function shellVerdict(command: string, cwd: string, opts: VerdictOptions): ToolV
     const argv = words(c);
     if (argv.length === 0 || argv[0] === null) continue;
     const program = programName(argv[0]);
+    // Printing a variable named for a credential: its value is the output.
+    if (ECHOES.has(program) && c.argv.slice(1).some((w) => SECRET_VARIABLE.test(w.raw))) verdict = "withhold-output";
+    // What runs elsewhere for it is judged too.
+    if (depth < 2 && argv.every((a) => a !== null)) {
+      const inner = innerCommand(argv as string[]);
+      if (inner) {
+        const v = shellVerdict(inner, cwd, opts, depth + 1);
+        if (v === "drop") return v;
+        if (v !== "keep") verdict = v;
+      }
+    }
+    // A word with a glob or braces naming a credential file (`cat .env*`): judged by the name it starts with.
+    if (FILE_PRINTERS.has(program) && c.argv.slice(1).some((w) => w.glob && isCredentialFile(pathLike(w.raw), cwd, opts.credentialFiles))) verdict = "withhold-output";
     if (drops.some((d) => d.every((w, i) => (i === 0 ? program === w : argv[i] === w)))) return "drop";
     // A word only known at run time can't be a subcommand that prints a credential; the rest still counts.
     if (argv.every((a) => a !== null) && printsCredentials(argv as string[])) verdict = "withhold-output";
diff --git a/src/daemon/session.ts b/src/daemon/session.ts
index 8bee2b7f..5a0703c5 100644
--- a/src/daemon/session.ts
+++ b/src/daemon/session.ts
@@ -10061,7 +10061,7 @@ export class Session {
     const toolUseId = this.#messageIdToToolUseId.get(msgId);
     const resolvedState =
       this.#secrets && runs && typeof runs === "object"
-        ? ({ ...settled, input: this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", runs as Record<string, unknown>) } as unknown as ToolState)
+        ? ({ ...settled, input: this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", runs as Record<string, unknown>, this.#toolCallMessages.get(msgId)?.tool?.name) } as unknown as ToolState)
         : this.#scrubValue(settled);
     this.#scrollback.updateMessage(msgId, (m) => {
       const sm = m as SessionMessage;
@@ -10096,7 +10096,7 @@ export class Session {
     if (!msgId) return;
     // Recorded as any input is: a hook may add a credential (an Authorization header) the call needs.
     const toolUseId = this.#messageIdToToolUseId.get(msgId);
-    const input = this.#secrets ? this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", raw) : raw;
+    const input = this.#secrets ? this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", raw, this.#toolCallMessages.get(msgId)?.tool?.name) : raw;
     const updateTool = (sm: SessionMessage): void => {
       if (!sm.tool) return;
       sm.tool.input = input;
@@ -10618,7 +10618,7 @@ export class Session {
         // The canonical history keeps what the transcript keeps.
         const verdict = this.#secrets ? this.#secrets.verdict(event.name, event.input, event.shellCwd ?? this.workdir) : "keep";
         if (verdict !== "keep") this.#toolVerdicts.set(event.sdkToolUseId, verdict);
-        const recordedInput = this.#secrets ? this.#recordedToolInput(verdict, event.input) : event.input;
+        const recordedInput = this.#secrets ? this.#recordedToolInput(verdict, event.input, event.name) : event.input;
         this.#accumulator.handleEvent(recordedInput === event.input ? event : { ...event, input: recordedInput });
         // NOTE: do NOT call #completeActiveTools() here. It would cancel all
         // currently in-flight tools, which is correct for sequential calls but
@@ -12338,7 +12338,7 @@ export class Session {
     if (!this.#secrets || !input || typeof input !== "object") return this.#scrubValue(input);
     const msgId = this.#approvalIdToMessageId.get(approvalId);
     const toolUseId = msgId ? this.#messageIdToToolUseId.get(msgId) : undefined;
-    return this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", input as Record<string, unknown>);
+    return this.#recordedToolInput((toolUseId && this.#toolVerdicts.get(toolUseId)) || "keep", input as Record<string, unknown>, msgId ? this.#toolCallMessages.get(msgId)?.tool?.name : undefined);
   }
 
   /** Who and where a scrub is for: a kept secret lands in this tenant and home workstream. */
@@ -12376,16 +12376,20 @@ export class Session {
    * What is recorded of a tool call's input: scrubbed, or, for a write of a
    * credential file, without what was written (secrets/verdict.ts).
    */
-  #recordedToolInput(verdict: ToolVerdict, input: Record<string, unknown>): Record<string, unknown> {
+  #recordedToolInput(verdict: ToolVerdict, input: Record<string, unknown>, toolName = ""): Record<string, unknown> {
+    const isShell = shellCallOf(toolName, input) !== null || typeof input.command === "string" || Array.isArray(input.command);
     if (verdict === "drop") {
-      // A call the user listed as never stored: nothing of what it was given is kept.
-      return Object.fromEntries(Object.entries(input).map(([k, v]) => [k, typeof v === "string" ? NOT_STORED : v]));
+      // A call the user listed as never stored: nothing of what it was given is kept (an argv too).
+      return Object.fromEntries(Object.entries(input).map(([k, v]) => [k, typeof v === "string" || Array.isArray(v) ? NOT_STORED : this.#scrubValue(v)]));
     }
     if (verdict === "withhold-written") {
-      // A file tool writing a credential file: the path stays, what it writes doesn't. A shell line
-      // writing one stays readable (it is on the approval card), scrubbed.
+      // A file tool writing a credential file: the path stays, what it writes doesn't — every
+      // backend's content keys (Codex's `changes`, pi's `newText`, a patch tool's `input`). A shell
+      // line writing one stays readable (it is on the approval card), scrubbed.
       const out: Record<string, unknown> = {};
-      for (const [k, v] of Object.entries(input)) out[k] = /^(?:content|new_string|old_string|edits|new_source|patch)$/.test(k) ? WRITTEN_WITHHELD : v;
+      for (const [k, v] of Object.entries(input)) {
+        out[k] = /^(?:content|new_string|old_string|edits|new_source|patch|newText|oldText|changes|files|text|diff|input)$/.test(k) && !isShell ? WRITTEN_WITHHELD : v;
+      }
       return this.#scrubValue(out);
     }
     return this.#scrubValue(input);
diff --git a/src/daemon/store.ts b/src/daemon/store.ts
index e0f4cc2c..a93690c2 100644
--- a/src/daemon/store.ts
+++ b/src/daemon/store.ts
@@ -1602,6 +1602,7 @@ export class Store {
         ownerDaemon ?? null,
         now,
       ) as RawDispatchRow[];
+    for (const r of rows) if (r.status !== "queued") this.#scrubSettledTask(r.id);
     return rows.map(rowToDispatchTask);
   }
 
@@ -1881,7 +1882,7 @@ export class Store {
         `INSERT INTO dispatch_events (account_id, project_id, task_id, type, digest, created_at)
          VALUES (?, ?, ?, ?, ?, ?)`,
       )
-      .run(event.accountId, event.projectId, event.taskId, event.type, event.digest, event.now);
+      .run(event.accountId, event.projectId, event.taskId, event.type, this.scrubText ? this.scrubText(event.digest) : event.digest, event.now);
   }
 
   dispatchEventsPending(accountId: string, projectId: string): DispatchEventRow[] {
@@ -2312,7 +2313,7 @@ export class Store {
         .prepare(
           "INSERT INTO audit_log (subject, session_id, action, detail) VALUES (?, ?, ?, ?)",
         )
-        .run(subject, sessionId ?? null, action, detail ?? null);
+        .run(subject, sessionId ?? null, action, detail && this.scrubText ? this.scrubText(detail) : (detail ?? null));
     } catch {
       // Retry unlinked (FK can't fail) so the entry is still recorded; fold
       // the orphaned session id into the detail. Swallow anything further.

From a1a810ef17dca3db3c29b51eb0192842fc15aeb1 Mon Sep 17 00:00:00 2001
From: Yash Datta <yd2590@columbia.edu>
Date: Fri, 13 Nov 2026 09:40:27 +0800
Subject: [PATCH 4/4] =?UTF-8?q?fix:=20secrets=20S1=20verification=20?=
 =?UTF-8?q?=E2=80=94=20passwords=20keep=20their=20&=20and=20\\,=20linear?=
 =?UTF-8?q?=20on=20every=20engine,=20fewer=20false=20positives?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- a value stops at & only before another name=, at \\ only at an escape
- the env pattern finds its name and separator, then its value with a
  sticky regex: the combined one ran uncompiled on Bun 1.3 (216 ms to 1 ms
  over 2 MB); JWTs found in one linear pass (repeated eyJ: 3.2 s to 47 ms)
- known and remembered values match after a JSON escape or a %XX
- unquoted header and query values only when they look like a key; mysql's
  -p only as mysql's own; sshpass -p and login -p right after the program
- docker exec / compose exec / kubectl exec commands judged with their
  quoting; ssh host -- CMD

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/daemon/secrets/detect.ts       | 125 +++++++++++++++++++++++++----
 src/daemon/secrets/known.ts        |  13 ++-
 src/daemon/secrets/secrets.test.ts |  37 +++++++++
 src/daemon/secrets/verdict.ts      |  29 +++++--
 4 files changed, 177 insertions(+), 27 deletions(-)

diff --git a/src/daemon/secrets/detect.ts b/src/daemon/secrets/detect.ts
index aada9aff..01acc044 100644
--- a/src/daemon/secrets/detect.ts
+++ b/src/daemon/secrets/detect.ts
@@ -36,7 +36,7 @@ interface Pattern {
    * code: another name, a call); an "env" value (as a word, but a snake_case or camelCase value
    * of an environment variable is a password like any other).
    */
-  check?: "placeholder" | "word" | "env";
+  check?: "placeholder" | "word" | "env" | "opaque";
   /** See {@link SecretSpan.distinct}. */
   distinct?: boolean;
   /** Only where the match's line also matches this (checked after the match, so the pattern stays linear). */
@@ -48,6 +48,13 @@ interface Pattern {
    * match `before` (or be the text's start).
    */
   back?: { chars?: RegExp; max?: number; before: RegExp; escapes?: boolean };
+  /** The value's length, when the pattern's runs leave it unbounded: outside it, not a value this pattern finds. */
+  length?: [number, number];
+  /**
+   * The value, matched (sticky) just after `re`, which then finds only what comes before it: one
+   * regex with both runs uncompiled on Bun 1.3, two hundred times slower over the whole text.
+   */
+  value?: RegExp;
 }
 
 /** Not inside a longer token. */
@@ -127,8 +134,6 @@ const VENDOR: Pattern[] = [
 
 /** Credentials recognised by where they sit. */
 const STRUCTURAL: Pattern[] = [
-  // After a non-word character, or an escaped newline or tab in JSON text (`\njwt…`: `n` is a letter).
-  { kind: "jwt", re: /(?<secret>eyJ[A-Za-z0-9_-]{10,4000}\.eyJ[A-Za-z0-9_-]{10,8000}\.[A-Za-z0-9_-]{10,2000})/g, distinct: true, back: { before: /[^A-Za-z0-9_]/, escapes: true } },
   { kind: "bearer-token", re: /bearer[ \t]+(?<secret>[A-Za-z0-9._~+/-]{16,4000}=*)/gi, check: "placeholder", distinct: true, back: WORD_BOUNDARY },
   { kind: "authorization", re: /authorization["']?[ \t]*[:=][ \t]*["']?(?:basic|token)[ \t]+(?<secret>[A-Za-z0-9._~+/-]{8,4000}=*)/gi, check: "placeholder", distinct: true, back: WORD_BOUNDARY },
   // curl's `-u user:password`: the line must run curl (checked in findSecrets: `line: /\bcurl\b/`).
@@ -151,6 +156,11 @@ const ENV_BACK = { chars: /[A-Z0-9_]/, max: 100, before: /[^A-Za-z0-9_]/ };
 const CODE_BACK = { chars: /[A-Za-z0-9_.-]/, max: 100, before: /[^A-Za-z0-9_.-]/ };
 /** The same as code, JSON and config files spell them; not `auth` alone, nor `tokens` (`max_tokens`). */
 const CODE_WORD = "(?:passw(?:or)?d|passphrase|secret|api[_-]?key|private[_-]?key|access[_-]?key|(?:auth|access|refresh|bearer|id|session)[_-]?token|token)";
+/** One character of an unquoted value: not one that ends it, a `&` unless another `name=` follows, a `\` unless an escape does. */
+// Runs of plain characters, not one alternation per character (twenty times slower on Bun 1.3);
+// the value's length is bounded in code (`length`).
+const VALUE_RUN = `(?:[^\\s"'\`,;)\\]}{(<>&\\\\]+|&(?![A-Za-z_][\\w.-]*=)|\\\\(?![nrt"\\\\]))+`;
+const DOTENV_RUN = `(?:[^\\s#"&\\\\]+|&(?![A-Za-z_][\\w.-]*=)|\\\\(?![nrt"\\\\]))*`;
 /** In a line-anchored pattern (tried only at line starts): the name's start written out. */
 const CODE_NAME = `[\\w.-]{0,100}?${CODE_WORD}`;
 const SEPARATOR = `["'\\]]?[ \\t]*(?::=|=>|\\?=|[=:])[ \\t]*`;
@@ -158,24 +168,34 @@ const QUOTED = `"(?:[^"\\\\\\n]|\\\\.){6,1000}"|'[^'\\n]{6,1000}'`;
 
 /** Values assigned to a name a credential is kept under. */
 const NAMED: Pattern[] = [
-  // An environment variable's value: stops at `&` and a literal `\n` (a query string, JSON text).
-  { kind: "credential", re: new RegExp(`${ENV_NAME}${SEPARATOR}(?<secret>${QUOTED}|[^\\s"'\`,;)\\]}{(<>&\\\\]{6,1000})`, "g"), check: "env", back: ENV_BACK },
+  // An environment variable's value: stops at a `&` that starts another `name=` (a query string),
+  // and at an escape in JSON text (`\n`); a password may hold `&` or `\` otherwise.
+  {
+    kind: "credential",
+    re: new RegExp(`${ENV_NAME}${SEPARATOR}`, "g"),
+    value: new RegExp(`${QUOTED}|${VALUE_RUN}`, "y"),
+    check: "env",
+    back: ENV_BACK,
+    length: [6, 1000],
+  },
   // An HTTP header named for a credential, unquoted (`-H "X-Api-Key: abc…"`, `api-key: …`).
   {
     kind: "credential",
-    re: /(?:api-?key|auth-?token|access-?token|secret|password|token)[ \t]*:[ \t]*(?<secret>[^\s"',;]{6,1000})/gi,
-    check: "word",
+    re: /(?:api-?key|auth-?token|access-?token|secret|password|token)[ \t]*:[ \t]*(?<secret>[^\s"',;!][^\s"',;]{5,1000})/gi,
+    check: "opaque",
     back: { chars: /[A-Za-z0-9-]/, max: 64, before: /[\s"']/ },
   },
   // A URL's query value named for a credential (`?api_key=…`, `&access_token=…`).
   {
     kind: "credential",
-    re: /[?&](?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|auth[_-]?token|token|client[_-]?secret|secret|password|pwd|key|sig|signature)=(?<secret>[^&#\s"'<>]{6,1000})/gi,
-    check: "placeholder",
+    re: /[?&](?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|auth[_-]?token|token|client[_-]?secret|secret|password|pwd|sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature)=(?<secret>[^&#\s"'<>]{6,1000})/gi,
+    check: "opaque",
   },
   // A client's password flag glued to its value (`mysql -pHunter2`), or apart (`sshpass -p …`, `docker login -p …`).
-  { kind: "password", re: /(?:^|[ \t])-p(?<secret>[^\s"'-][^\s"']{0,200})/gm, check: "placeholder", line: /\b(?:mysql|mysqldump|mysqladmin|mariadb)\b/ },
-  { kind: "password", re: /(?:^|[ \t])-p[ \t]+(?<secret>[^\s"'-][^\s"']{0,200})/gm, check: "placeholder", line: /\b(?:sshpass|(?:docker|podman|nerdctl|helm)\s+(?:registry\s+)?login)\b/ },
+  // The client is the program run (not a word elsewhere: `mysql:8` as an image), its -p among its own options.
+  { kind: "password", re: /(?:mysql|mysqldump|mysqladmin|mariadb)[ \t](?:[^\n|;&-]|-[^p\n|;&]){0,300}?-p(?<secret>[^\s"'-][^\s"']{0,200})/g, check: "placeholder", back: { before: /[\s;&|(]/ } },
+  { kind: "password", re: /sshpass[ \t]+-p[ \t]*(?<secret>[^\s"'-][^\s"']{0,200})/g, check: "placeholder", back: { before: /[\s;&|(]/ } },
+  { kind: "password", re: /(?:docker|podman|nerdctl|helm)[ \t]+(?:registry[ \t]+)?login\b[^\n|;&]{0,300}?[ \t]-p[ \t]+(?<secret>[^\s"'-][^\s"']{0,200})/g, check: "placeholder", back: { before: /[\s;&|(]/ } },
   { kind: "credential", re: new RegExp(`${CODE_WORD}${SEPARATOR}(?<secret>${QUOTED})`, "gi"), check: "word", back: CODE_BACK },
   {
     kind: "password",
@@ -192,7 +212,8 @@ const NAMED: Pattern[] = [
   // `.env`/INI-like `name=value`: up to the first space (`PGPASSWORD=x psql -h db` is a command).
   {
     kind: "credential",
-    re: new RegExp(`^\\+?[ \\t]*["']?${CODE_NAME}["']?[ \\t]*=[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=][^\\s#"&\\\\]{0,1000})`, "gim"),
+    re: new RegExp(`^\\+?[ \\t]*["']?${CODE_NAME}["']?[ \\t]*=[ \\t]*(?<secret>[^\\s"'#|>&*!{}\\[\\],=]${DOTENV_RUN})`, "gim"),
+    length: [1, 1001],
     check: "env",
   },
 ];
@@ -237,6 +258,58 @@ function privateKeySpans(text: string): SecretSpan[] {
   return out;
 }
 
+const JWT_CHAR = /[A-Za-z0-9_-]/;
+
+/** Where the run of base64url characters starting at `i` ends. */
+function runEnd(text: string, i: number): number {
+  let q = i;
+  while (q < text.length && JWT_CHAR.test(text[q]!)) q++;
+  return q;
+}
+
+/**
+ * JSON web tokens: `eyJ…` header, `.`, `eyJ…` payload, `.`, a signature, each
+ * part its run of base64url characters and of bounded length, after a
+ * non-word character or an escaped newline or tab in JSON text. Found in one
+ * forward pass: a `eyJ` inside a run already looked at shares its end, so a
+ * text of repeated `eyJ` costs no more than its length (the regex rescanned
+ * each one: seconds on Bun 1.3).
+ */
+function jwtSpans(text: string): SecretSpan[] {
+  const out: SecretSpan[] = [];
+  let from = 0;
+  let known = -1;
+  let knownEnd = -1;
+  while (true) {
+    const i = text.indexOf("eyJ", from);
+    if (i < 0) break;
+    from = i + 3;
+    if (i > 0) {
+      const prev = text[i - 1]!;
+      const escaped = i > 1 && text[i - 2] === "\\" && "nrt".includes(prev);
+      if (!escaped && JWT_CHAR.test(prev)) continue;
+    }
+    // A start inside a run already measured ends where it ends.
+    const headEnd = i < knownEnd && i > known ? knownEnd : runEnd(text, i);
+    known = i;
+    knownEnd = headEnd;
+    if (headEnd - i < 13 || headEnd - i > 4003 || text[headEnd] !== ".") {
+      from = Math.max(from, headEnd);
+      continue;
+    }
+    const p = headEnd + 1;
+    if (!text.startsWith("eyJ", p)) continue;
+    const payloadEnd = runEnd(text, p);
+    if (payloadEnd - p < 13 || payloadEnd - p > 8003 || text[payloadEnd] !== ".") continue;
+    const sigEnd = runEnd(text, payloadEnd + 1);
+    const sig = sigEnd - payloadEnd - 1;
+    if (sig < 10 || sig > 2000) continue;
+    out.push({ start: i, end: sigEnd, kind: "jwt", distinct: true });
+    from = sigEnd;
+  }
+  return out;
+}
+
 /** The references codeoid writes itself: never taken for a secret again. */
 const OWN_REFERENCE = /^‹(?:credential|secret|output withheld|not stored)[:\s›]/;
 
@@ -282,24 +355,37 @@ function isWord(raw: string, identifiers = true): boolean {
  * past it, null — the caller must not store what couldn't be checked.
  */
 export function findSecrets(text: string, deadline = Number.POSITIVE_INFINITY): SecretSpan[] | null {
-  const spans: SecretSpan[] = privateKeySpans(text);
+  const spans: SecretSpan[] = [...privateKeySpans(text), ...jwtSpans(text)];
   for (const p of PATTERNS) {
     if (performance.now() > deadline) return null;
     p.re.lastIndex = 0;
     let n = 0;
+    /** Per pattern: each line's `line` test, once. */
+    const lineCache = new Map<number, boolean>();
     for (const m of text.matchAll(p.re)) {
       if (++n % 256 === 0 && performance.now() > deadline) return null;
-      const raw = m.groups?.secret;
-      const at = m.indices?.groups?.secret;
+      let raw = m.groups?.secret;
+      let at = m.indices?.groups?.secret;
+      if (p.value) {
+        p.value.lastIndex = m.index! + m[0].length;
+        const v = p.value.exec(text);
+        if (!v) continue;
+        raw = v[0];
+        at = [v.index, v.index + v[0].length];
+      }
       if (raw === undefined || raw.length === 0 || !at) continue;
       // A value to the end of its line loses the spaces after it.
       const secret = raw.replace(/[ \t]+$/, "");
       if (secret.length === 0) continue;
+      if (p.length && (secret.length < p.length[0] || secret.length > p.length[1])) continue;
       if (p.check === "placeholder" && isPlaceholder(secret)) continue;
       if (p.check === "word" && isWord(secret)) continue;
       // `NAME=value` (a .env file, a shell) holds a value whatever it looks like; `name = value`,
       // spaced, is code, where another name is more likely than a password.
       if (p.check === "env" && isWord(secret, /[ \t]/.test(text[at[0] - 1] ?? ""))) continue;
+      // An unquoted header or query value: only one that looks like a key (a digit, or both cases),
+      // not a status word (`token: refreshed`, `?token=nextpage`).
+      if (p.check === "opaque" && (isWord(secret) || !(/[0-9]/.test(secret) && /[A-Za-z]/.test(secret)) && !(/[a-z]/.test(secret) && /[A-Z]/.test(secret)))) continue;
       if (p.back) {
         let i = m.index!;
         for (let k = 0; p.back.chars && k < (p.back.max ?? 0) && i > 0 && p.back.chars.test(text[i - 1]!); k++) i--;
@@ -312,8 +398,13 @@ export function findSecrets(text: string, deadline = Number.POSITIVE_INFINITY):
       }
       if (p.line) {
         const lineStart = text.lastIndexOf("\n", at[0]) + 1;
-        const lineEnd = text.indexOf("\n", at[0]);
-        if (!p.line.test(text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd))) continue;
+        let ok = lineCache.get(lineStart);
+        if (ok === undefined) {
+          const lineEnd = text.indexOf("\n", at[0]);
+          ok = p.line.test(text.slice(lineStart, lineEnd < 0 ? text.length : lineEnd));
+          lineCache.set(lineStart, ok);
+        }
+        if (!ok) continue;
       }
       // A quoted value keeps its quotes: `"api_key": "‹secret:…›"` still reads as JSON.
       const quoted = secret.length >= 2 && (secret[0] === '"' || secret[0] === "'") && secret.at(-1) === secret[0];
diff --git a/src/daemon/secrets/known.ts b/src/daemon/secrets/known.ts
index 83504f62..c4ce0ec0 100644
--- a/src/daemon/secrets/known.ts
+++ b/src/daemon/secrets/known.ts
@@ -39,6 +39,15 @@ interface Needle {
   ref: string;
 }
 
+/**
+ * Whether what stands just before `at` is an escape, not part of a longer token: `\n` / `\r` /
+ * `\t` in JSON text, or a URL-encoded character (`%22`, `%3A`).
+ */
+function escapedBefore(text: string, at: number): boolean {
+  if (at > 1 && text[at - 2] === "\\" && "nrt".includes(text[at - 1]!)) return true;
+  return at > 2 && text[at - 3] === "%" && /^[0-9A-Fa-f]{2}$/.test(text.slice(at - 2, at));
+}
+
 /** A multi-pattern matcher: every needle found in one pass. */
 class Matcher {
   readonly #goto: Array<Map<string, number>> = [new Map()];
@@ -125,7 +134,7 @@ function replaceMatches(text: string, matcher: Matcher, deadline: number): { tex
     if (++n % 4096 === 0 && performance.now() > deadline) return null;
     const [s, e] = m;
     if (own.length > 0 && inOwn(s, e)) continue;
-    if ((s > 0 && TOKEN_CHAR.test(text[s - 1]!)) || (e < text.length && TOKEN_CHAR.test(text[e]!))) continue;
+    if ((s > 0 && TOKEN_CHAR.test(text[s - 1]!) && !escapedBefore(text, s)) || (e < text.length && TOKEN_CHAR.test(text[e]!))) continue;
     found.push(m);
   }
   if (found.length === 0) return { text, refs, labels };
@@ -306,7 +315,7 @@ export class LearnedSecrets {
     let o = 0;
     for (let i = 0; i + MIN_LEARNED_LENGTH <= text.length; i++) {
       if ((i & 0xffff) === 0 && i > 0 && performance.now() > deadline) return null;
-      if (i > 0 && TOKEN_CHAR.test(text[i - 1]!)) continue;
+      if (i > 0 && TOKEN_CHAR.test(text[i - 1]!) && !escapedBefore(text, i)) continue;
       while (o < own.length && own[o]![1] <= i) o++;
       if (o < own.length && own[o]![0] <= i) {
         i = own[o]![1] - 1;
diff --git a/src/daemon/secrets/secrets.test.ts b/src/daemon/secrets/secrets.test.ts
index 873462d8..28607b0f 100644
--- a/src/daemon/secrets/secrets.test.ts
+++ b/src/daemon/secrets/secrets.test.ts
@@ -460,3 +460,40 @@ describe("round-2 audit", () => {
     expect(r.structuredContent.n).toBe(3);
   });
 });
+
+describe("verification pass", () => {
+  test.each([
+    ["DB_PASSWORD=Xy7&kLm9pQ", "Xy7&kLm9pQ"],
+    ["DB_PASSWORD=ab\\cd12ef", "ab\\cd12ef"],
+    ["TOKEN=abc123&def=1", "abc123"],
+    ["sshpass -p x0secret ssh -p 2222 host", "x0secret"],
+  ])("finds exactly the value in %s", (text, value) => {
+    expect((findSecrets(text) ?? []).map((s) => text.slice(s.start, s.end))).toEqual([value]);
+  });
+
+  test.each(["INFO token: refreshed", "Error: password: incorrect", "secret: !vault |", "sshpass -f pw.txt ssh -p 22 host", "docker run -p8080:80 mysql:8", "?key=static"])(
+    "leaves %s",
+    (text) => {
+      expect(kinds(text)).toEqual([]);
+    },
+  );
+
+  test("repeated eyJ stays linear", () => {
+    const t0 = performance.now();
+    findSecrets("eyJ".repeat(660_000));
+    expect(performance.now() - t0).toBeLessThan(1_000);
+  });
+
+  test("a known value after a JSON escape or a URL-encoded character", () => {
+    const known = new KnownSecrets();
+    known.register("t", () => [{ label: "v", value: "VALUE12345678" }]);
+    expect(known.replace('"line\\nVALUE12345678"')!.text).toBe('"line\\n‹credential:v›"');
+    expect(known.replace("data=%22VALUE12345678%22")!.text).toBe("data=%22‹credential:v›%22");
+    expect(known.replace("xVALUE12345678")!.text).toBe("xVALUE12345678");
+  });
+
+  test.each(["docker exec c sh -c 'cat .env'", "kubectl exec p -- sh -c 'cat /app/.env'", "ssh host -- env", "docker compose exec web env"])("withholds what %s runs", async (command) => {
+    await loadShellParser();
+    expect(toolVerdict("Bash", { command }, { cwd: "/w" })).toBe("withhold-output");
+  });
+});
diff --git a/src/daemon/secrets/verdict.ts b/src/daemon/secrets/verdict.ts
index c216b556..3e3c77d3 100644
--- a/src/daemon/secrets/verdict.ts
+++ b/src/daemon/secrets/verdict.ts
@@ -219,23 +219,36 @@ function pathLike(raw: string): string {
   return raw.replace(/^["']|["']$/g, "").replace(/\{[^}]*\}/g, "").replace(/[*?]+$/, "").replace(/\[[^\]]*\]$/, "");
 }
 
-/** The command another program runs for it: `ssh host CMD…`, `docker exec C CMD…`, `kubectl exec P -- CMD…`. */
+/** One word as a shell reads it back. */
+function shellQuote(w: string): string {
+  return /^[A-Za-z0-9_./=:@%+,-]+$/.test(w) ? w : `'${w.replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * The command another program runs for it: `ssh host CMD…` (ssh joins its words with spaces, as
+ * a shell on the other side reads them), `docker exec C CMD…` / `docker compose exec S CMD…` /
+ * `kubectl exec P -- CMD…` (an argv, each word kept as it is).
+ */
 function innerCommand(argv: string[]): string | null {
   const program = programName(argv[0] ?? "");
   const rest = argv.slice(1);
   if (program === "ssh") {
     let i = 0;
-    while (i < rest.length && rest[i]!.startsWith("-")) i += /^-[bcDEeFIiJLlmOopQRSWw]$/.test(rest[i]!) ? 2 : 1;
-    return rest.length > i + 1 ? rest.slice(i + 1).join(" ") : null;
+    while (i < rest.length && rest[i]!.startsWith("-") && rest[i] !== "--") i += /^-[bcDEeFIiJLlmOopQRSWw]$/.test(rest[i]!) ? 2 : 1;
+    if (rest[i] === "--") i++;
+    let cmd = rest.slice(i + 1);
+    if (cmd[0] === "--") cmd = cmd.slice(1);
+    return cmd.length > 0 ? cmd.join(" ") : null;
   }
-  if ((program === "docker" || program === "podman") && rest[0] === "exec") {
-    let i = 1;
-    while (i < rest.length && rest[i]!.startsWith("-")) i += /^-(?:e|u|w|-env|-user|-workdir)$/.test(rest[i]!) ? 2 : 1;
-    return rest.length > i + 1 ? rest.slice(i + 1).join(" ") : null;
+  const execAt = (program === "docker" || program === "podman") && rest[0] === "exec" ? 1 : (program === "docker" || program === "podman") && rest[0] === "compose" && rest[1] === "exec" ? 2 : -1;
+  if (execAt > 0) {
+    let i = execAt;
+    while (i < rest.length && rest[i]!.startsWith("-")) i += /^-(?:e|u|w|-env|-env-file|-user|-workdir|-index)$/.test(rest[i]!) ? 2 : 1;
+    return rest.length > i + 1 ? rest.slice(i + 1).map(shellQuote).join(" ") : null;
   }
   if (program === "kubectl" && rest.includes("exec")) {
     const dash = rest.indexOf("--");
-    return dash >= 0 && dash < rest.length - 1 ? rest.slice(dash + 1).join(" ") : null;
+    return dash >= 0 && dash < rest.length - 1 ? rest.slice(dash + 1).map(shellQuote).join(" ") : null;
   }
   return null;
 }