@@ -69,6 +69,7 @@ export {
   isSensitiveFillText,
   readRecordedInputVariableName,
   recordedInputPlaceholder,
+  sensitiveFillPlaceholder,
   validateRecordedInputVariableName,
 } from './internal/recorded-input.ts';
 
 
@@ -32,6 +32,15 @@ export function isSensitiveFillText<TFlags extends Pick<CommandFlags, 'recordAs'
   return typeof flags?.recordAs === 'string' || flags?.textStdin === true;
 }
 
+/** What sensitive fill text reads as on any response: its `--record-as` placeholder, else `[REDACTED]`. */
+export function sensitiveFillPlaceholder(
+  flags: Pick<CommandFlags, 'recordAs'> | undefined,
+): string {
+  return typeof flags?.recordAs === 'string'
+    ? recordedInputPlaceholder(flags.recordAs)
+    : '[REDACTED]';
+}
+
 export function recordedInputPlaceholder(variableName: string): string {
   return `\${${variableName}}`;
 }
 
@@ -222,6 +222,7 @@ export function validateAndNormalizeBatchSteps(
     if (step.flags !== undefined && !isRecord(step.flags)) {
       throw new AppError('INVALID_ARGS', `Batch step ${index + 1} flags must be an object.`);
     }
+    assertNoTextStdinStep(step.flags as Record<string, unknown> | undefined, index + 1);
     if (step.input !== undefined && !isRecord(step.input)) {
       throw new AppError('INVALID_ARGS', `Batch step ${index + 1} input must be an object.`);
     }
@@ -236,6 +237,22 @@ export function validateAndNormalizeBatchSteps(
   return normalized;
 }
 
+/**
+ * A batch step has no stdin of its own, and a failed step reports its positionals. The CLI refuses
+ * `textStdin` on a step before reading stdin; this refuses it for every other daemon client.
+ */
+function assertNoTextStdinStep(
+  flags: Record<string, unknown> | undefined,
+  stepNumber: number,
+): void {
+  if (flags?.textStdin === undefined) return;
+  throw new AppError(
+    'INVALID_ARGS',
+    `Batch step ${stepNumber}: fill textStdin is not supported because batch steps have no stdin of their own.`,
+    { reason: 'fill_text_stdin_in_batch' },
+  );
+}
+
 function buildBatchStepFlags(
   parentFlags: BatchFlags | Record<string, unknown> | undefined,
   stepFlags: DaemonBatchStep['flags'] | Record<string, unknown> | undefined,
 
@@ -5,7 +5,6 @@ export {
   emitDiagnostic,
   flushDiagnosticsToSessionFile,
   getDiagnosticsMeta,
-  redactRegisteredSensitiveValues,
   registerDiagnosticSensitiveValue,
   type ResourceDiagnostic,
   updateDiagnosticsScope,
 
@@ -107,16 +107,6 @@ export function registerDiagnosticSensitiveValue(value: string): void {
   scope.sortedSensitiveValues = undefined;
 }
 
-/**
- * Replace this request's registered sensitive values in `input`, as its diagnostics already do. For
- * an error leaving the daemon: a backend message can echo a value the caller kept out of argv.
- */
-export function redactRegisteredSensitiveValues<T>(input: T): T {
-  const scope = diagnosticsStorage.getStore();
-  if (!scope || scope.sensitiveValues.size === 0) return input;
-  return replaceSensitiveValues(input, sortedScopeSensitiveValues(scope)) as T;
-}
-
 /**
  * Sum the number of diagnostic events emitted in the current scope whose phase
  * is one of `phases`. Backed by the flush-surviving `phaseCounts` tally, so it
 
@@ -0,0 +1,88 @@
+/**
+ * The router redacts an error only for a fill the caller marked sensitive. Another command can
+ * register sensitive values too (a Maestro `inputText` does), and its error, including a
+ * `logPath` that happens to contain such a value, comes back unchanged.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { expect, test, vi } from 'vitest';
+
+vi.mock('@agent-device/platform-apple/runner/operations', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@agent-device/platform-apple/runner/operations')>();
+  return { ...actual, stopIosRunnerSession: vi.fn(async () => {}) };
+});
+
+vi.mock('../device/device-ready.ts', () => ({ ensureDeviceReady: vi.fn(async () => {}) }));
+
+import { AppError } from '@agent-device/kernel/errors';
+import type { DeviceRuntimeGateway, RuntimeFacts } from '@agent-device/contracts/platform-runtime';
+import type { PlatformRuntimeOperations } from '@agent-device/contracts/platform-runtime-operations';
+import { createTestDeviceInventoryGateways } from '../../__tests__/test-utils/device-inventory-gateways.ts';
+import { makeIosAppSession } from '../../__tests__/test-utils/session-factories.ts';
+import { makeSessionStore } from '../../__tests__/test-utils/store-factory.ts';
+import { mkdtempForTestSync } from '../../__tests__/test-utils/tmp-dir.ts';
+import { LeaseRegistry } from '../lease-registry.ts';
+import {
+  createRequestHandler,
+  lifecycleDeviceRuntimeGateway,
+} from './test-device-runtime-gateway.ts';
+
+const SESSION = 'maestro-input';
+
+const typeText = vi.fn(async (_input: { text: string }) => {
+  throw new AppError('COMMAND_FAILED', 'keyboard is not ready');
+});
+
+function withTypeText(
+  facts: RuntimeFacts<PlatformRuntimeOperations>,
+): RuntimeFacts<PlatformRuntimeOperations> {
+  return { ...facts, operations: { ...facts.operations, typeText: { available: true } } };
+}
+
+const typingDeviceRuntimeGateway: DeviceRuntimeGateway<PlatformRuntimeOperations> = {
+  inspectFacts: async (device) =>
+    withTypeText(await lifecycleDeviceRuntimeGateway.inspectFacts(device)),
+  bind: async (request) => {
+    const binding = await lifecycleDeviceRuntimeGateway.bind(request);
+    return {
+      ...binding,
+      facts: withTypeText(binding.facts),
+      operations: { ...binding.operations, typeText },
+    };
+  },
+  shutdown: async () => {},
+};
+
+test('a Maestro replay error comes back unchanged after its inputText registered a short value', async () => {
+  const sessionStore = makeSessionStore('agent-device-router-error-redaction-');
+  sessionStore.publish(SESSION, makeIosAppSession(SESSION));
+  const root = mkdtempForTestSync('agent-device-router-error-redaction-');
+  const flowPath = path.join(root, 'flow.yaml');
+  fs.writeFileSync(flowPath, 'appId: com.example.app\n---\n- inputText: "1"\n');
+  const handler = createRequestHandler({
+    logPath: path.join(root, 'daemon.log'),
+    token: 'test-token',
+    sessionStore,
+    leaseRegistry: new LeaseRegistry(),
+    deviceInventoryGateways: createTestDeviceInventoryGateways(),
+    trackDownloadableArtifact: () => 'artifact-id',
+    deviceRuntimeGateway: typingDeviceRuntimeGateway,
+  });
+
+  const result = await handler({
+    token: 'test-token',
+    session: SESSION,
+    command: 'replay',
+    positionals: [flowPath],
+    flags: { replayBackend: 'maestro', platform: 'ios' },
+    meta: { requestId: 'req-maestro-input-1' },
+  });
+
+  expect(typeText).toHaveBeenCalledWith(expect.objectContaining({ text: '1' }));
+  expect(result.ok).toBe(false);
+  if (result.ok) return;
+  expect(JSON.stringify(result.error)).not.toContain('[REDACTED]');
+  expect(result.error.logPath).toContain('req-maestro-input-1');
+  expect(fs.existsSync(result.error.logPath!)).toBe(true);
+});
@@ -1,12 +1,14 @@
-import { createTestDeviceInventoryGateways } from '../../__tests__/test-utils/device-inventory-gateways.ts';
 /**
  * #3260: `fill --text-stdin` keeps the value out of argv, so it must not come back on the
  * response either. Sent through the real request handler to a web session, the narrowest
  * runtime that still runs the full fill admission, dispatch and response projection.
  */
 import { expect, test } from 'vitest';
+import fs from 'node:fs';
 import path from 'node:path';
+import { createTestDeviceInventoryGateways } from '../../__tests__/test-utils/device-inventory-gateways.ts';
 import type { WebProvider } from '@agent-device/platform-web';
+import type { DaemonRequest } from '../daemon-request.ts';
 import type { SessionState } from '../session-state.ts';
 import { createRequestHandler } from './test-device-runtime-gateway.ts';
 import { LeaseRegistry } from '../lease-registry.ts';
@@ -25,6 +27,19 @@ function fillWithStdinText(
   session: SessionState,
   flags: Record<string, unknown> = {},
   fillFails?: (text: string) => Error,
+  text = SECRET,
+) {
+  return sendToWebSession(
+    session,
+    { command: 'fill', positionals: ['10', '20', text], flags: { textStdin: true, ...flags } },
+    fillFails,
+  );
+}
+
+function sendToWebSession(
+  session: SessionState,
+  request: Pick<DaemonRequest, 'command' | 'positionals' | 'flags'>,
+  fillFails?: (text: string) => Error,
 ) {
   const sessionStore = makeSessionStore('agent-device-router-fill-text-stdin-');
   sessionStore.publish(session.name, session);
@@ -65,9 +80,7 @@ function fillWithStdinText(
   const response = handler({
     token: 'test-token',
     session: session.name,
-    command: 'fill',
-    positionals: ['10', '20', SECRET],
-    flags: { textStdin: true, ...flags },
+    ...request,
     meta: { requestId: 'req-fill-text-stdin' },
   });
   return { response, typed, sessionStore };
@@ -142,3 +155,54 @@ test('a backend error that echoes the --text-stdin value does not return it', as
   expect(JSON.stringify(result)).not.toContain(SECRET);
   if (!result.ok) expect(result.error.message).toBe('could not type "[REDACTED]" into the field');
 });
+
+test('a backend error that echoes a --record-as stdin value shows its placeholder', async () => {
+  const { response, typed } = fillWithStdinText(
+    makeAuthoringSession('web', { device: WEB_DESKTOP_DEVICE }),
+    { recordAs: 'PASSWORD' },
+    (text) => new Error(`could not type "${text}" into the field`),
+  );
+
+  const result = await response;
+  expect(result.ok).toBe(false);
+  expect(typed).toEqual([SECRET]);
+  if (!result.ok) expect(result.error.message).toBe('could not type "${PASSWORD}" into the field');
+});
+
+test('a short --text-stdin value is redacted from the error text but not from its log path', async () => {
+  // `stdin` also appears in this request's id, which names its diagnostics file.
+  const { response } = fillWithStdinText(
+    makeSession('web', { device: WEB_DESKTOP_DEVICE }),
+    {},
+    (text) => new Error(`could not type "${text}" into the field`),
+    'stdin',
+  );
+
+  const result = await response;
+  expect(result.ok).toBe(false);
+  if (result.ok) return;
+  expect(result.error.message).toBe('could not type "[REDACTED]" into the field');
+  expect(result.error.logPath).toContain('req-fill-text-stdin');
+  expect(fs.existsSync(result.error.logPath!)).toBe(true);
+  expect(result.error.diagnosticsRecord?.requestId).toBe('req-fill-text-stdin');
+});
+
+test('a batch step carrying --text-stdin is refused before typing and returns no part of the value', async () => {
+  const { response, typed } = sendToWebSession(makeSession('web', { device: WEB_DESKTOP_DEVICE }), {
+    command: 'batch',
+    positionals: [],
+    flags: {
+      batchSteps: [
+        { command: 'fill', positionals: ['10', '20', SECRET], flags: { textStdin: true } },
+      ],
+    },
+  });
+
+  const result = await response;
+  expect(result.ok).toBe(false);
+  if (result.ok) return;
+  expect(result.error.code).toBe('INVALID_ARGS');
+  expect(result.error.details?.reason).toBe('fill_text_stdin_in_batch');
+  expect(typed).toEqual([]);
+  expect(JSON.stringify(result)).not.toContain(SECRET);
+});
@@ -10,7 +10,7 @@ import type { MultiTargetAnnotationV1 } from '@agent-device/contracts/replay';
 import {
   inferFillText,
   isSensitiveFillText,
-  recordedInputPlaceholder,
+  sensitiveFillPlaceholder,
 } from '@agent-device/ad-script';
 import { parameterizeRecordedFillPayload } from '@agent-device/selectors/parameterized-recorded-fill';
 import type { InteractionFinalizationOperations } from './types.ts';
@@ -94,9 +94,6 @@ function computeMultiTargetEvidence(recordedTargets: {
   return source && destination ? { source, destination } : undefined;
 }
 
-/** What sensitive fill text reads as when no `--record-as` placeholder names it. */
-const REDACTED_FILL_TEXT = '[REDACTED]';
-
 function parameterizeFillPayloads(params: {
   command: string;
   positionals: string[];
@@ -114,10 +111,7 @@ function parameterizeFillPayloads(params: {
     flags: params.flags,
     result: params.result,
   });
-  const placeholder =
-    typeof params.flags?.recordAs === 'string'
-      ? recordedInputPlaceholder(params.flags.recordAs)
-      : REDACTED_FILL_TEXT;
+  const placeholder = sensitiveFillPlaceholder(params.flags);
   return [
     parameterizeRecordedFillPayload(params.result, literal, placeholder),
     parameterizeRecordedFillPayload(params.responseData, literal, placeholder),
 
@@ -37,7 +37,6 @@ import {
   emitDiagnostic,
   flushDiagnosticsToSessionFile,
   getDiagnosticsMeta,
-  redactRegisteredSensitiveValues,
   registerDiagnosticSensitiveValue,
   withDiagnosticsScope,
 } from '@agent-device/host-kit/diagnostics';
@@ -56,7 +55,11 @@ import {
 import { unsupportedSaveScriptFlagResponse } from './request-save-script-policy.ts';
 import { canRunReplayScopedAction } from './daemon-command-registry.ts';
 import { isWebSession } from './web-session-names.ts';
-import { inferFillText, isSensitiveFillText } from '@agent-device/ad-script';
+import {
+  inferFillText,
+  isSensitiveFillText,
+  sensitiveFillPlaceholder,
+} from '@agent-device/ad-script';
 import { createPlatformRequestScope } from './platform-request-scope.ts';
 import { createOwnerScopedDeviceClaimReconciler } from './device/device-claim-owner-recovery.ts';
 import { isConfinedToAppLease, scopeRequestSession } from './request-admission.ts';
@@ -208,7 +211,10 @@ export function createRequestHandler(deps: RequestRouterDeps): DaemonInvokeFn {
             repairExpiredIfTombstoned(req, response.error, sessionStore),
             sessionStore,
           );
-          return { ok: false, error: redactRegisteredSensitiveValues(enrichDaemonError(error)) };
+          return {
+            ok: false,
+            error: redactSensitiveFillTextInError(req, enrichDaemonError(error)),
+          };
         }
         // Phase 4 (agent-cost) grafts on the success path. Runs inside the
         // diagnostics scope so cost can read this request's runner-round-trip tally.
@@ -511,15 +517,48 @@ function customActionFlagsResponse(req: DaemonRequest): DaemonResponse | undefin
   return undefined;
 }
 
+/** The text of a fill the caller marked sensitive, or `undefined` for any other request. */
+function sensitiveFillText(req: DaemonRequest): string | undefined {
+  if (req.command !== 'fill' || !isSensitiveFillText(req.flags)) return undefined;
+  return inferFillText({
+    ts: 0,
+    command: 'fill',
+    positionals: req.positionals ?? [],
+    flags: req.flags,
+  });
+}
+
 function registerParameterizedFillDiagnosticValue(req: DaemonRequest): void {
-  if (req.command !== 'fill' || !isSensitiveFillText(req.flags)) return;
-  registerDiagnosticSensitiveValue(
-    inferFillText({
-      ts: 0,
-      command: 'fill',
-      positionals: req.positionals ?? [],
-      flags: req.flags,
-    }),
+  const text = sensitiveFillText(req);
+  if (text !== undefined) registerDiagnosticSensitiveValue(text);
+}
+
+/** Error fields that carry text a backend may have built from the value it was typing. */
+const ERROR_TEXT_FIELDS: ReadonlySet<string> = new Set(['message', 'hint', 'cause', 'details']);
+
+/**
+ * A backend error can quote the text a sensitive fill failed to type. Only that fill's own text is
+ * redacted, and only in the error's text fields: `logPath`, `diagnosticId` and the other
+ * daemon-owned fields come back as they are, and so does every other request's error.
+ */
+function redactSensitiveFillTextInError(req: DaemonRequest, error: DaemonError): DaemonError {
+  const text = sensitiveFillText(req);
+  if (!text) return error;
+  const replace = (value: string) => value.replaceAll(text, sensitiveFillPlaceholder(req.flags));
+  return Object.fromEntries(
+    Object.entries(error).map(([field, value]) => [
+      field,
+      ERROR_TEXT_FIELDS.has(field) ? mapErrorStrings(value, replace) : value,
+    ]),
+  ) as DaemonError;
+}
+
+function mapErrorStrings(value: unknown, replace: (value: string) => string): unknown {
+  if (typeof value === 'string') return replace(value);
+  if (Array.isArray(value)) return value.map((entry) => mapErrorStrings(entry, replace));
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [key, mapErrorStrings(entry, replace)]),
   );
 }