#17690: scaffolds: Phase 0 plumbing (passthrough)

## Summary Phase 0 “reasoning scaffolds” plumbing: adds the scaffolds module surface area, config wiring, and tests. **Phase 0 is intentionally passthrough / no behavior change.** It only establishes a safe choke-point for future phases. ## RFC - `docs/scaffolds-rfc.md` ## What changed (Phase 0) - Adds `src/scaffolds/**` (types + adapter surface) - Wires config parsing / validation for `config.scaffolds.*` - Adds baseline tests to ensure Phase 0 remains inert ## Behavior / passthrough truth table Phase 0 does **not** modify model calls or tool behavior. It only *post-processes* final payloads via `ScaffoldAdapter.enforceFinal(...)`, which is implemented as a passthrough. | Condition | Result | |---|---| | `config.scaffolds.enabled !== true` | Adapter not applied (no change) | | `config.scaffolds.enabled === true` | Adapter invoked but returns identical payloads (no change) | ## Verification - `pnpm test` - `pnpm lint` - `pnpm check` (includes `tsgo`) ## Notes - Untracked local logs in the branch were not committed. <!-- greptile_comment --> <h3>Greptile Summary</h3> Adds Phase 0 "reasoning scaffolds" plumbing: a new `src/scaffolds/` module with an adapter that post-processes embedded-run payloads (currently a no-op passthrough), Zod schema validation for `config.scaffolds.reasoning`, and corresponding tests. Also centralizes sensitive-key detection into `src/config/sensitive.ts` (previously duplicated across `redact-snapshot.ts`, `schema.ts`, and `schema.field-metadata.ts`), adds SSRF edge-case tests for numeric/hex hostname forms, and updates search provider help text to include "grok". - **Scaffolds adapter** (`src/scaffolds/adapter.ts`, `phase0.ts`): When `config.scaffolds.reasoning.enabled` is true, calls `applyReasoningScaffoldsPhase0` which returns payloads unchanged. When disabled, returns payloads directly. Both paths are no-ops in Phase 0. - **Config wiring**: `ScaffoldsSchema` added to `zod-schema.ts` with `phase: z.literal(0)` constraint; `ScaffoldsConfig` types added to `src/config/types.ts` and `src/scaffolds/types.ts`. - **Sensitive-key centralization**: `isSensitiveKey` + `DEFAULT_SENSITIVE_KEY_PATTERNS` extracted to `src/config/sensitive.ts`; all consumers now import from there. - **Unrelated additions**: SSRF tests for numeric/hex IPv4 hostname forms, "grok" added to search provider help text — these appear to be bundled fixes from the same branch. <h3>Confidence Score: 4/5</h3> - This PR is safe to merge — Phase 0 is a verified no-op passthrough with no behavioral changes. - Score of 4 reflects that the core scaffolds plumbing is clean and well-tested, with intentional no-op behavior verified by both unit and integration tests. Minor design issues (duplicate type definitions, double cast workaround, orphaned JSDoc) were already flagged in prior review threads and don't affect runtime behavior. The Zod schema correctly constrains phase to literal 0. No security or logic bugs found. - Previously flagged: `src/scaffolds/types.ts` (duplicate types with `src/config/types.ts`), `src/agents/pi-embedded-runner/run.ts` (double cast workaround), `src/config/redact-snapshot.ts` (orphaned JSDoc). No new files require special attention. _{Last reviewed commit: eb4547c} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->