#184 fix(core): never echo JSON parser text from the account store reader

Bun 1.3.14's JSON.parse quotes an unquoted token adjacent to a syntax error verbatim:

JSON.parse('{"key":ckh_SECRET}')  →  SyntaxError: JSON Parse error: Unexpected identifier "ckh_SECRET"

(Unterminated-string and expected-brace cases stay clean; the trigger is a hand-edit that leaves a bare token.)

readJsonIfPresent in packages/core/src/accounts.ts interpolated that message into the thrown account store at <path> is corrupt or unreadable (<parser text>) error. It reads both anthropic-auth.json (may hold a Claustrum handle) and anthropic-auth-state.json (OAuth access and refresh tokens), and the plugin logs that error. So a bad hand-edit next to a token wrote the token into opencode-anthropic-auth.log. dump.ts parseBody had the same shape for request/response bodies.

Fix

parseJsonRedacted (packages/core/src/json.ts): catches SyntaxError and rethrows a fixed-message SyntaxError('invalid JSON') with no cause. Used by the account-store reader and the dump body parser. The account-store error keeps the path and the "fix or remove it" hint.

Audited the other JSON.parse sites in core (lock/owner files, sticky routing state, quota feed leases, cachekeep registry, dump metadata): none parse secret-bearing content with an interpolated message; left as is.

Proof

Regression writes a state file containing a bare sk-ant-oat…CANARY… token beside a syntax error and a config file with a bare handle-shaped value: the loader throws, the message and cause contain neither canary, and the message still names the path. Mutation (restore direct JSON.parse in readJsonIfPresent): the regression fails. Root 1368/0, typecheck, format, biome clean.

Found via the same class of bug in cortexkit/claustrum#28.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Prevents malformed account-store and dump JSON from echoing secret-like tokens from Bun’s JSON.parse errors. Previously, the account-store reader could include bare token identifiers in corruption logs; it now reports fixed invalid JSON text while retaining the file path and recovery hint.

• Adds shared parseJsonRedacted handling for account config, account state, and dump bodies.
• Adds regression coverage for OAuth token and Claustrum handle values in corrupt account stores.