@diffin/cli 0.0.0-stage → 0.1.0

package/lib/scrub.mjs

@@ -0,0 +1,513 @@
+// Deterministic secret/PII scrubber — the single choke point for anything that leaves
+// the user's machine. Every rule here is something that must NEVER appear in a work
+// log; each one was added after a real leak, so the RULES table is carried verbatim
+// from the predecessor and changed only with the same care.
+//
+// Person names can't be caught by regex → alias map in ~/.diffin/redact.json:
+//   { "names": { "Tom": "협업자A", "김철수": "협업자B" } }  (case-insensitive)
+//
+// Design: identifiers keep a short prefix/suffix so records stay verifiable
+// ("0xfc25…c4e3") without being usable; credentials are replaced whole — a partial
+// key is still a leak surface.
+import { readFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { join } from 'node:path';
+
+// Order matters where noted — a rule that would eat another rule's input runs first.
+// Identifier parts are length-bounded (never nested quantifiers): an unbounded
+// `[..]*(alt)[..]*` backtracks catastrophically on long single-char runs (measured
+// 3.7s on 50k chars). Do not "simplify" a bound away.
+/**
+ * A rule that holds only on a line where a command stands before it (`curl … -u user:pass`, `redis-cli … -a pass`).
+ * Written as `command[^\n]*?flag` it rescanned the rest of the line from every occurrence of the command — quadratic
+ * on a long line of them (measured 0.9 s and 1.6 s on 100–200 KB), and this module also reads what a person uploads to
+ * the SERVER. One pass instead: a newline forgets the command, the command is remembered, the flag is rewritten only
+ * while it is.
+ */
+function onLineOf(command, flag, rewrite) {
+  const re = new RegExp(`\\n|${command.source}|${flag.source}`, 'g');
+  return (text) => {
+    let seen = false;
+    return text.replace(re, (m, ...g) => {
+      if (m === '\n') { seen = false; return m; }
+      if (g[0] === undefined) { seen = true; return m; }
+      return seen ? rewrite(m, g[0]) : m;
+    });
+  };
+}
+
+const RULES = [
+  // phone (KR mobile/landline) — PII (added after a prod-log leak 2026-07-21)
+  [/\b01[016789][-\s.]?\d{3,4}[-\s.]?\d{4}\b/g, '[전화번호]'],
+  [/\b0\d{1,2}[-\s.]\d{3,4}[-\s.]\d{4}\b/g, '[전화번호]'],
+  // credentials — replaced whole
+  [/sk-ant-[A-Za-z0-9_-]{16,}/g, '[API키]'],
+  [/sk-[A-Za-z0-9]{32,}/g, '[API키]'],
+  [/gh[pousr]_[A-Za-z0-9]{20,}/g, '[API키]'],
+  [/github_pat_[A-Za-z0-9_]{20,}/g, '[API키]'],
+  [/AKIA[0-9A-Z]{16}/g, '[API키]'],
+  [/GOCSPX-[A-Za-z0-9_-]{16,}/g, '[API키]'],
+  [/xox[abpr]-[A-Za-z0-9-]{10,}/g, '[API키]'],
+  [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[JWT]'],
+  // the body is base64 and line breaks and never holds a '-', so the scan stops at the first one: a run of BEGIN lines
+  // with no END cost a rescan of the rest of the text each (measured 1.6 s on 540 KB)
+  [/-----BEGIN [A-Z ]{0,40}PRIVATE KEY-----[^-]{0,20000}-----END [A-Z ]{0,40}PRIVATE KEY-----/g, '[개인키]'],
+  // vendor credential formats (each unmistakably a secret)
+  [/\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g, '[API키]'],       // Stripe
+  [/\bASIA[0-9A-Z]{16}\b/g, '[API키]'],                          // AWS temp
+  [/\bAIza[0-9A-Za-z_-]{30,}/g, '[API키]'],                      // Google
+  [/\bxapp-\d-[A-Za-z0-9-]{8,}/g, '[API키]'],                    // Slack app
+  [/\bnpm_[A-Za-z0-9]{30,}/g, '[API키]'],                        // npm
+  [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g, '[API키]'],  // SendGrid
+  [/\bATATT[A-Za-z0-9_-]{20,}/g, '[API키]'],                     // Atlassian
+  [/\bglpat-[A-Za-z0-9_-]{16,}/g, '[API키]'],                    // GitLab
+  [/\bdop_v1_[a-f0-9]{32,}/g, '[API키]'],                        // DigitalOcean
+  [/\bshpat_[a-fA-F0-9]{32}/g, '[API키]'],                       // Shopify
+  // OpenRouter — the provider this product's own pipeline runs on, and the one the
+  // vendor list was missing. It was only ever half-hidden, by the 64-hex rule below
+  // truncating the tail; a key one character off that length would have left whole.
+  [/\bsk-or-v1-[A-Za-z0-9]{32,}/g, '[API키]'],
+  // a credential that SAYS it is one and matches no vendor's shape: `apikey_<hex>_<hex>` (TypeSafe), `token_…`,
+  // `secret-…`. Found 2026-09-21: a test key pasted into a session passed every rule above and the key=value
+  // rules below (there is no `=`), and the next capture would have stored it in the ledger as a user turn.
+  // The tail must be long and hold a digit, so `token_usage_per_stage_breakdown` stays an identifier.
+  [/\b(?:api[_-]?key|secret|token)[_-](?=[A-Za-z0-9_-]{0,200}\d)[A-Za-z0-9_-]{24,200}/gi, '[API키]'],
+  // opaque bearer credential in an auth header
+  [/\b(Authorization\s*:\s*(?:Bearer|Basic)\s+)[A-Za-z0-9._~+/=-]{16,}/gi, '$1[비공개값]'],
+  // curl -u user:password
+  onLineOf(/\bcurl\b/, /(\s-u\s+[^\s:'"]{1,256}:)[^\s'"]{1,1024}/, (m, head) => `${head}[비공개값]`),
+  // key=value: keep the key, kill the value. Identifier may carry prefix/suffix
+  // (aws_secret_access_key, DB_PASSWORD) — the old anchored form missed those.
+  [/((?:api[_-]?key|secret|password|passwd|token|private[_-]?key|mnemonic|seed[_-]?phrase)\s*[=:]\s*["']?)[^\s"',;]{6,}/gi, '$1[비공개값]'],
+  [/([A-Za-z0-9_.-]{0,40}(?:secret|passwd|password|credential)[A-Za-z0-9_.-]{0,40}\s*[=:]\s*["']?)[^\s"',;]{6,}/gi, '$1[비공개값]'],
+  [/(\b[A-Z][A-Z0-9_]{0,60}_(?:KEY|TOKEN|SECRET)\s*[=:]\s*["']?)[^\s"',;]{6,}/g, '$1[비공개값]'],
+  // Telegram bot token (<9-10 digits>:<35-char>) — appears with no keyword. Keep bot id.
+  [/(\b\d{9,10}:)[A-Za-z0-9_-]{30,}/g, '$1[비공개값]'],
+  // Korean PII in real work logs (fixtures, customer data)
+  [/\b\d{6}[-\s]?[1-4]\d{6}\b/g, '[주민번호]'],
+  [/\b\d{3}-\d{2}-\d{5}\b/g, '[사업자번호]'],
+  // payment card: 4×4 on a known issuer prefix (conservative)
+  [/\b[3-6]\d{3}[-\s]\d{4}[-\s]\d{4}[-\s]\d{4}\b/g, '[카드번호]'],
+  // URL userinfo password — MUST run before the email rule ("pass@host.com" parses as
+  // an email). Password class excludes '/', so "http://localhost:3000/x" never reaches '@'.
+  [/([A-Za-z][A-Za-z0-9+.-]{0,32}:\/\/[^\s:@/]{0,128}:)[^\s@/]{1,256}(?=@)/g, '$1[비공개값]'],
+  // redis auth
+  [/\brequirepass[=\s]+["']?[^\s"';]+["']?/gi, 'requirepass [비공개값]'],
+  onLineOf(/\bredis-cli\b/, /(\s-a\s+)(?:'[^'\n]{0,512}'|"[^"\n]{0,512}"|[^\s'"]{1,512})/, (m, head) => `${head}[비공개값]`),
+  // 64-hex = private key OR tx hash (indistinguishable) → truncate both
+  [/\b(?:0x)?([0-9a-fA-F]{4})[0-9a-fA-F]{56}([0-9a-fA-F]{4})\b/g, '[HEX64:$1…$2]'],
+  // wallet address: keep prefix/suffix (verifiable, not usable)
+  [/\b0x([0-9a-fA-F]{4})[0-9a-fA-F]{32}([0-9a-fA-F]{4})\b/g, '0x$1…$2'],
+  // shell prompt "user@host ~ %" — user/host pair is PII. MUST run before the email
+  // rule (a hostname like "MacBook-Pro.local" parses as an email domain).
+  [/(?<![\w.-])[A-Za-z0-9._-]+@[A-Za-z0-9][A-Za-z0-9.-]*(?=\s+(?:~\S*|\/\S*|[\w.-]+)\s*[%$](?:\s|$))/g, '[user]@[host]'],
+  // email — bounded to RFC-ish lengths (unbounded form is quadratic: 1.6s on 60k chars)
+  [/[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,255}\.[a-zA-Z]{2,24}/g, '[이메일]'],
+  [/\b(?:192\.168|10\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01]))\.\d{1,3}\.\d{1,3}\b/g, '[내부IP]'],
+  // Windows: C:\Users\<name> — with either slash, and with the backslash doubled as it is inside a JSON string that was
+  // itself pasted into a turn. And the same folder as Git Bash and WSL spell it (/c/Users/<name>, /mnt/c/Users/<name>):
+  // the POSIX rule below refuses those, because its lookbehind sees the drive letter as a word character in front of
+  // "/Users". A username with a space in it cannot be delimited here; the machine's own name is matched exactly, before any of these.
+  [/(?<![A-Za-z0-9])[A-Za-z]:[\\/]{1,2}Users[\\/]{1,2}(?:\[[^\]\n]{1,64}\]|[A-Za-z0-9._-]+)/g, '~'],
+  [/(?<!\w)(?:\/mnt)?\/[A-Za-z]\/Users\/(?:\[[^\]\n]{1,64}\]|[A-Za-z0-9._-]+)/g, '~'],
+  // (the Windows rules stand first: "C:/Users/jane" would otherwise lose its tail to the rule below and keep the drive)
+  // local home paths: /Users/<name>/… → ~/… (username is PII, rest is evidence).
+  // The lookbehind keeps a URL like "example.com/Users/…" untouched — but only a
+  // domain char (word char) may precede; a '.' or '-' must not, or "../Users/name"
+  // (a relative import path) slips through with the username intact (measured leak).
+  [/(?<!\w)\/(?:Users|home)\/(?:\[[^\]\n]{1,64}\]|[A-Za-z0-9._-]+)/g, '~'],
+  // dash-encoded cwd ("/Users/x/Desktop/y" → "-Users-x-Desktop-y") in project-dir names
+  [/(?<!\w)-(Users|home)-(?:\[[^\]\n]{1,64}\]|[A-Za-z0-9._]+)/g, '-$1-[user]'],
+];
+
+// The path-shaped rules above catch a username inside /Users/<name> and -Users-<name>-,
+// but a transcript is full of it BARE: the owner column of every `ls -l`, `id`,
+// `whoami`, a git log — measured 324 times across one 3-day corpus, all in tool
+// output, none reachable by a path rule. The machine knows its own username and git
+// identity, so they are aliased automatically, the same way redact.json names are.
+// Guarded: a short or dictionary-like value ("user", "dev", "admin") would eat prose.
+const STOP = new Set(['user', 'users', 'admin', 'root', 'test', 'dev', 'guest', 'node', 'ubuntu', 'local', 'home', 'staff', 'wheel', 'name', 'main']);
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function selfRule(name, alias) {
+  if (!name || name.length < 4 || STOP.has(name.toLowerCase())) return null;
+  // word boundaries only make sense for ASCII-word names; a Korean name gets a plain match
+  const bounded = /^[\w.-]+$/.test(name);
+  return [new RegExp(bounded ? `\\b${escapeRe(name)}\\b` : escapeRe(name), 'gi'), `[${alias}]`];
+}
+function selfNames() {
+  const out = [];
+  try { out.push(selfRule(userInfo().username, 'user')); } catch { /* no account info */ }
+  try {
+    // [user] section of ~/.gitconfig only — not a `name =` from some other section
+    const cfg = readFileSync(join(homedir(), '.gitconfig'), 'utf8');
+    const sec = cfg.match(/^\s*\[user\]\s*$([\s\S]*?)(?=^\s*\[|(?![\s\S]))/m)?.[1] ?? '';
+    const m = sec.match(/^\s*name\s*=\s*(.+?)\s*$/m);
+    out.push(selfRule(m?.[1]?.replace(/^["']|["']$/g, ''), 'git-user'));
+  } catch { /* no gitconfig */ }
+  return out.filter(Boolean);
+}
+
+// The machine's own username in its two path shapes, run BEFORE the generic path
+// rules. The generic dash-encoded rule cannot include '-' in the name (it is the
+// separator), so a hyphenated username was cut: -Users-jane-doe-Desktop became
+// -Users-[user]-doe-Desktop, and by the time the bare-word alias ran, "jane-doe" no
+// longer existed to match. Knowing the exact name, these two need no guessing.
+export function selfPathRulesFor(name) {
+  if (!name || name.length < 2 || /[\\/:\n]/.test(name)) return [];
+  const n = escapeRe(name);
+  // Windows spells the home folder three ways (C:\Users\<name>, and Git Bash's and WSL's /c/Users/<name>), and its
+  // account names may hold a space or Hangul — which no generic rule can delimit, so the exact name is the only rule
+  // that covers them. Claude Code's project-dir name turns every character that is not a letter or digit into '-'.
+  const dashed = escapeRe(name.replace(/[^A-Za-z0-9]/g, '-'));
+  const rules = [
+    [new RegExp(`(?<![A-Za-z0-9])[A-Za-z]:[\\\\/]{1,2}Users[\\\\/]{1,2}${n}(?![A-Za-z0-9._-])`, 'gi'), '~'],
+    [new RegExp(`(?<!\\w)(?:\\/mnt)?\\/[A-Za-z]\\/Users\\/${n}(?![A-Za-z0-9._-])`, 'gi'), '~'],
+    [new RegExp(`(?<!\\w)-(Users|home)-${dashed}(?![A-Za-z0-9._])`, 'g'), '-$1-[user]'],
+  ];
+  if (/^[A-Za-z0-9._-]+$/.test(name)) rules.push(
+    [new RegExp(`(?<!\\w)-(Users|home)-${n}(?![A-Za-z0-9._])`, 'g'), '-$1-[user]'],
+    [new RegExp(`(?<!\\w)\\/(?:Users|home)\\/${n}(?![A-Za-z0-9._-])`, 'g'), '~'],
+  );
+  return rules;
+}
+
+/**
+ * A Windows path in the shape every reader on the server expects. The server finds a turn's folder by prefix, a file's
+ * name by its last '/', and a conversation's container by the string itself; taught a second separator, each of those
+ * would be a place to forget it. So the three fields that ARE paths — a row's `cwd`, a tool call's `file_path` and
+ * `notebook_path` — go up with '/' (after scrubbing: C:\Users\jane\proj is ~/proj, D:\work\proj is D:/work/proj).
+ * Nothing else is touched: a backslash in what a person said, or in a command, is theirs.
+ */
+export function posixPath(p) {
+  if (typeof p !== 'string' || !p.includes('\\')) return p;
+  const windows = /^[A-Za-z]:[\\/]/.test(p) || /^~\\/.test(p) || /^\\\\/.test(p) || !p.includes('/');
+  if (!windows) return p;
+  const unc = /^\\\\/.test(p);
+  return (unc ? '/' : '') + p.replace(/\\+/g, '/');
+}
+function posixRow(o) {
+  if (typeof o.cwd === 'string') o.cwd = posixPath(o.cwd);
+  const blocks = o.message?.content;
+  if (Array.isArray(blocks)) for (const b of blocks) {
+    if (b?.type !== 'tool_use' || !b.input || typeof b.input !== 'object') continue;
+    for (const k of ['file_path', 'notebook_path']) if (typeof b.input[k] === 'string') b.input[k] = posixPath(b.input[k]);
+    if (Array.isArray(b.input._wrote)) b.input._wrote = b.input._wrote.map(posixPath);
+  }
+  return o;
+}
+
+function selfPathRules() {
+  try { return selfPathRulesFor(userInfo().username); } catch { return []; }
+}
+
+let selfPath = null;
+let aliasRules = null;
+function aliases() {
+  if (aliasRules) return aliasRules;
+  aliasRules = selfNames();
+  try {
+    const cfg = JSON.parse(readFileSync(join(homedir(), '.diffin', 'redact.json'), 'utf8'));
+    for (const [name, alias] of Object.entries(cfg.names ?? {})) {
+      if (name.length < 2) continue;
+      aliasRules.push([new RegExp(escapeRe(name), 'gi'), `[${alias}]`]);
+    }
+  } catch { /* no alias map — fine */ }
+  return aliasRules;
+}
+
+export function scrub(text) {
+  if (text == null) return text;
+  let s = String(text);
+  for (const [re, rep] of (selfPath ??= selfPathRules())) s = s.replace(re, rep);
+  for (const rule of RULES) s = typeof rule === 'function' ? rule(s) : s.replace(rule[0], rule[1]);
+  for (const [re, rep] of aliases()) s = s.replace(re, rep);
+  return s;
+}
+
+// Recursively scrub every string in a parsed JSON value — the raw session rows.
+function scrubDeep(v) {
+  if (typeof v === 'string') return scrub(v);
+  if (Array.isArray(v)) return v.map(scrubDeep);
+  if (v && typeof v === 'object') {
+    for (const k of Object.keys(v)) v[k] = scrubDeep(v[k]);
+    return v;
+  }
+  return v;
+}
+
+// Upload diet, before scrub. Pasted screenshots ride the log as base64 image blocks —
+// measured ~49% of a real corpus's bytes. Extraction reads text turns only, so the
+// blob is dead weight; keep the block structure so nothing downstream breaks on shape.
+function stripBulk(v) {
+  if (Array.isArray(v)) return v.map(stripBulk);
+  if (v && typeof v === 'object') {
+    if (v.type === 'image' && v.source && typeof v.source === 'object'
+        && typeof v.source.data === 'string' && v.source.data.length > 256) {
+      return { ...v, source: { ...v.source, data: '[image omitted]' } };
+    }
+    const o = {};
+    for (const [k, val] of Object.entries(v)) o[k] = stripBulk(val);
+    return o;
+  }
+  // generic long base64 blob (screenshots inside tool results) — never real prose
+  if (typeof v === 'string' && v.length > 20000 && /^[A-Za-z0-9+/=\r\n]+$/.test(v)) return '[binary omitted]';
+  return v;
+}
+
+// What the server reads of a tool call, and nothing else of it. SCAN turns a call into a
+// one-line marker — the file an edit touched, the command a shell ran, a URL, a query,
+// what a delegated task was called — and reads which file a turn worked on. The BODY of a
+// call is the work product itself: a Write's `content`, an Edit's `old_string` /
+// `new_string`, a subagent's whole `prompt`, the message an MCP tool sent.
+const KEEP_INPUT = new Set(['file_path', 'notebook_path', 'command', 'description', 'url', 'query']);
+// The server reads at most the first 150 characters of any of these.
+const KEEP_INPUT_MAX = 4000;
+/**
+ * A shell command is where code rides along — `cat > f <<EOF …`, `node -e "…"`,
+ * `python3 -c "…"` — and it used to go up whole for one reason: SCAN searched all of it
+ * for the sign that a unit of work ended. (Cutting it at 4,000 characters was tried and
+ * lost two work boundaries on real sessions: a long `git commit -F - <<EOF … && gh pr
+ * create` carries its sign at the far end.) So the sign is read HERE, on the whole
+ * command, and what goes up is `_unitEnded` and the 130 characters SCAN prints as the
+ * `[RUN …]` marker — whitespace collapsed first, exactly as SCAN collapses it, so the
+ * marker comes out the same. The expression is SCAN's (`pipeline/src/stages/scan.ts`);
+ * `pipeline/test/upload-diet.mjs` fails if the two drift apart.
+ */
+/**
+ * The paths a shell command WRITES. `[EDIT]`/`[WRITE]` markers only exist for the dedicated
+ * file tools, so an agent that edits through the shell — `cat > f <<EOF`, `sed -i`, `tee` —
+ * leaves no file behind it. Measured over nine real sessions: Edit/Write 4,301 calls against
+ * 947 shell writes, so the file signal was seeing 82% of the file work, and for a person
+ * whose agent prefers the shell it sees almost none. What reads it: RELEVANCE's `deliverable`
+ * (`hasResult || filesTouched`) and its connectedness between goals, and STITCH's assignment.
+ *
+ * Narrow on purpose — a wrong path is a claim about someone's work:
+ * - a heredoc body is DATA, not shell (`cat > f.mjs <<'JS' … x => y …` carries a whole
+ *   program), and so is a quoted program after `-e`/`--eval`/`-c`. Both are cut before
+ *   anything is read; a redirection target always stands before them. Without the cut,
+ *   `=>` read as a redirection produced `t.type`, `console.log` and `g.id` as file names.
+ * - a token must carry a file extension and no shell metacharacter, which is what separates
+ *   a path from `2>&1` and from a `>` inside prose.
+ * - /dev, /tmp and the sandbox's own scratch are not the person's work.
+ *
+ * It can only add a path, never remove one, so its failure is a file too many.
+ */
+const WROTE_FD = /^&?\d+$/;
+const WROTE_PATH = /^[~./A-Za-z0-9_-][^\s|;&<>"'`$(){}]*\.[A-Za-z0-9]{1,8}$/;
+const WROTE_SCRATCH = /^\/(dev|tmp|private\/tmp|var\/folders)\//;
+const wroteBad = (p) => !p || WROTE_FD.test(p) || !WROTE_PATH.test(p) || WROTE_SCRATCH.test(p);
+export const WROTE_MAX = 8;
+
+export function wrotePaths(command) {
+  const whole = String(command ?? '');
+  // read the command's own words, not the program it carries
+  let end = whole.length;
+  for (const m of whole.matchAll(/<<|\s-(?:e|c)\s|--eval\b|--input-type\b/g)) { end = Math.min(end, m.index); break; }
+  const s = whole.slice(0, end);
+  const out = new Set();
+  for (const m of s.matchAll(/(^|[^0-9&>=<!\-])>>?\s*([^\s|;&<>()]+)/g)) if (!wroteBad(m[2])) out.add(m[2]);
+  for (const m of s.matchAll(/\btee\s+(?:-a\s+)?([^\s|;&<>()]+)/g)) if (!wroteBad(m[1])) out.add(m[1]);
+  for (const m of s.matchAll(/\btouch\s+([^\s|;&<>()]+)/g)) if (!wroteBad(m[1])) out.add(m[1]);
+  for (const m of s.matchAll(/\bsed\s+-i\b[^|;&]*/g)) { const last = m[0].trim().split(/\s+/).at(-1); if (!wroteBad(last)) out.add(last); }
+  for (const m of s.matchAll(/\b(?:cp|mv)\s+(?:-\S+\s+)*[^\s|;&<>()]+\s+([^\s|;&<>()]+)/g)) if (!wroteBad(m[1])) out.add(m[1]);
+  return [...out].slice(0, WROTE_MAX);
+}
+
+/**
+ * The files a SCRIPT handed to an interpreter writes — `python3 - <<'EOF' … open(p, 'w') … EOF`, `node -e "…writeFileSync('a.ts', …)"`.
+ * `wrotePaths` cuts a heredoc body and a `-e`/`-c` program as data, which is right for the shell's grammar and leaves an
+ * agent that edits through scripts with no file behind it: on the owner's four-day ledger of 2026-10-04, 87 of 370
+ * records carried a file, and a turn that fixed a dozen server files carried none. Read here by the program's own
+ * shape, never by the shell's:
+ * - a write SINK — `open(X, 'w'|'a'|'x')`, `Path(X).write_text(`, `writeFileSync(X`, `appendFileSync(X`, `File.write(X` —
+ *   whose target X is a string literal;
+ * - or a name assigned a string literal in the program (`p = 'a/b.ts'` … `open(p, 'w')`);
+ * - or the FIRST parameter of a function defined in the program, in which case the literal (or such a name) each call
+ *   passes there (`def sub(p, old, new): … open(p, 'w')` then `sub('a/b.ts', …)`).
+ * A path a program only READS is not a sink and is not taken. The path shape and the scratch folders are `wrotePaths`'.
+ * Read on this machine only, like the PowerShell rule: the server takes `_wrote` as sent. Bounded: the program is read
+ * to SCRIPT_MAX characters, a literal to 300, at most SINK_MAX sinks.
+ */
+const SCRIPT_MAX = 200_000;
+const SINK_MAX = 40;
+const S_LIT = `(?:'([^'\\n]{1,300})'|"([^"\\n]{1,300})")`;
+const S_ID = `([A-Za-z_$][\\w$]{0,40})`;
+const S_ARG = `(?:${S_LIT}|${S_ID})`;
+const SINKS = [
+  new RegExp(`\\bopen\\(\\s*${S_ARG}\\s*,\\s*['"][wax]`, 'g'),
+  new RegExp(`\\b(?:writeFileSync|appendFileSync|writeFile|appendFile)\\(\\s*${S_ARG}`, 'g'),
+  new RegExp(`\\bPath\\(\\s*${S_ARG}\\s*\\)\\s*\\.\\s*write_(?:text|bytes)\\(`, 'g'),
+  new RegExp(`\\bFile\\.write\\(\\s*${S_ARG}`, 'g'),
+];
+export function wrotePathsScript(command) {
+  const whole = String(command ?? '');
+  // the program is the one handed to an INTERPRETER (`python3 - <<EOF`, `node -e "…"`), never another command's heredoc:
+  // `node x.js && cat > f <<EOF …` carries a file's text, which is data
+  let body = '';
+  for (const m of whole.matchAll(/\b(?:python3?|node|ruby|bun|deno)\b[^\n|;&]{0,80}?(<<-?\s*['"]?(\w+)['"]?|\s-(?:e|c)\s|--eval\b)/g)) {
+    const from = m.index + m[0].length; let to = whole.length;
+    if (m[2]) { const end = whole.indexOf('\n' + m[2], from); if (end >= 0) to = end; }
+    body += whole.slice(from, Math.min(to, from + SCRIPT_MAX)) + '\n';
+    if (body.length >= SCRIPT_MAX) break;
+  }
+  if (!body) return [];
+  const out = new Set(); const add = (p) => { if (p && !wroteBad(p)) out.add(p); };
+  const esc = (v) => v.replace(/[$]/g, '\\$&');
+  const assigned = (v) => [...body.matchAll(new RegExp(`(?:^|[^\\w$.])${esc(v)}\\s*=\\s*${S_LIT}`, 'gm'))].map((m) => m[1] ?? m[2]);
+  let sinks = 0;
+  for (const re of SINKS) for (const m of body.matchAll(re)) {
+    if (++sinks > SINK_MAX) break;
+    if (m[1] ?? m[2]) { add(m[1] ?? m[2]); continue; }
+    const v = m[3]; if (!v) continue;
+    for (const p of assigned(v)) add(p);
+    // v as the first parameter of a function of the program: what each call passes there
+    for (const f of body.matchAll(new RegExp(`(?:\\bdef\\s+|\\bfunction\\s+|\\b(?:const|let|var)\\s+)${S_ID}\\s*(?:=\\s*(?:async\\s*)?)?\\(\\s*${esc(v)}\\b`, 'g'))) {
+      for (const c of body.matchAll(new RegExp(`(?:^|[^\\w$.])${esc(f[1])}\\(\\s*${S_ARG}`, 'gm'))) { if (c[1] ?? c[2]) add(c[1] ?? c[2]); else if (c[3]) for (const p of assigned(c[3])) add(p); }
+    }
+  }
+  return [...out].slice(0, WROTE_MAX);
+}
+
+/**
+ * The same reading for a POWERSHELL command. On Windows the agent's shell tool is `PowerShell` — on by default, and
+ * the primary shell when it is (Claude Code's tools reference, read 2026-10-03); the `Bash` tool is there only when
+ * Git Bash is installed. Its call carries `command`, like Bash's. Without this a Windows session left no file behind
+ * any shell write, which is the blind spot the function above was written for, on every turn.
+ *
+ * The cmdlets that write a file (and the aliases people's agents use), a redirection, a copy or a move. A here-string
+ * (@' … '@, @" … "@) is the heredoc's twin and is cut the same way; so is a program after -Command. A path may be
+ * quoted and may hold backslashes; the temp folder is not the person's work. Read on this machine only: the server
+ * takes `_wrote` as sent and has no second copy of this rule — no upload from Windows ever went without the flag.
+ */
+const PS_SCRATCH = /(^|[\\/])(te?mp|appdata[\\/]local[\\/]temp)[\\/]/i;
+// a quoted path may hold spaces (C:\Users\me\my proj\a.md), which the bare-token shape refuses
+const psBad = (p, quoted) => { const q = quoted ? String(p ?? '').replace(/ /g, '_') : p; return !q || WROTE_FD.test(q) || !WROTE_PATH.test(q) || WROTE_SCRATCH.test(q) || PS_SCRATCH.test(q) || /^nul$/i.test(q); };
+const PS_ARG = `(?:"([^"\\n]+)"|'([^'\\n]+)'|([^\\s|;&<>()"']+))`;
+export function wrotePathsPs(command) {
+  // A here-string is DATA, and in PowerShell it usually stands BEFORE the cmdlet it is piped into
+  // (@'…'@ | Set-Content a.ts), so its body is taken out rather than the command cut at it; an unclosed one, and a
+  // program handed to -Command / -e / -c, end the reading as a heredoc does.
+  const whole = String(command ?? '').replace(/@'[\s\S]*?\n'@/g, "''").replace(/@"[\s\S]*?\n"@/g, '""');
+  let end = whole.length;
+  for (const m of whole.matchAll(/@['"]|\s-(?:Command|EncodedCommand|e|c)\s|--eval\b/gi)) { end = Math.min(end, m.index); break; }
+  const s = whole.slice(0, end);
+  const out = new Set();
+  const add = (m, i) => { const quoted = m[i] ?? m[i + 1]; const p = quoted ?? m[i + 2]; if (!psBad(p, quoted !== undefined)) out.add(p); };
+  for (const m of s.matchAll(new RegExp(`(?:^|[^0-9&>=<!\\-])>>?\\s*${PS_ARG}`, 'g'))) add(m, 1);
+  // Set-Content a.ts … · Out-File -FilePath a.ts · New-Item -ItemType File -Path a.md · Tee-Object -FilePath a.log
+  for (const m of s.matchAll(new RegExp(`\\b(?:Set-Content|Add-Content|Out-File|Tee-Object|New-Item|sc|ac|ni|tee)\\b((?:\\s+-(?!Path\\b|FilePath\\b|LiteralPath\\b)\\w+(?:\\s+(?!-)[^\\s|;]+)?)*)\\s+(?:-(?:Path|FilePath|LiteralPath)\\s+)?${PS_ARG}`, 'gi'))) add(m, 2);
+  // Copy-Item src dst · Move-Item src -Destination dst
+  for (const m of s.matchAll(new RegExp(`\\b(?:Copy-Item|Move-Item|cp|mv|copy|move|cpi|mi)\\s+(?:-(?:Path|LiteralPath)\\s+)?${PS_ARG}\\s+(?:-Destination\\s+)?${PS_ARG}`, 'gi'))) add(m, 4);
+  return [...out].slice(0, WROTE_MAX);
+}
+/** the agent's shell tools: what a `[RUN]` marker, a unit's end and a written file are read from */
+export const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
+
+export const DONE_RUN = /git (commit|push)|gh pr|deploy|npm publish|pm2 (reload|restart)/;
+export const COMMAND_HEAD = 130;
+export const OMITTED = '[omitted]';
+
+function dietBlock(b) {
+  if (!b || typeof b !== 'object') return b;
+  // what the assistant thought, and its signature: no stage reads it
+  if (b.type === 'thinking' || b.type === 'redacted_thinking') return { type: b.type, thinking: OMITTED };
+  // what a tool returned — file contents, command output, search results: no stage reads it
+  if (b.type === 'tool_result') return { type: 'tool_result', tool_use_id: b.tool_use_id, ...(b.is_error ? { is_error: true } : {}), content: OMITTED };
+  if (b.type === 'tool_use' && b.input && typeof b.input === 'object' && !Array.isArray(b.input)) {
+    const input = {};
+    for (const [k, v] of Object.entries(b.input)) input[k] = KEEP_INPUT.has(k) && typeof v === 'string' ? v.slice(0, KEEP_INPUT_MAX) : OMITTED;
+    if (typeof b.input.command === 'string') {
+      // Scrub FIRST, then take the head. The server used to get the whole scrubbed command
+      // and print its first 130 characters; scrubbing shortens a command (a home path
+      // becomes `~`), so a head cut from the raw text came out short of what the server
+      // printed — 15,050 differing marker lines across nine real sessions, found only by
+      // comparing real data. `scrub` hoists, and the later pass over the row is a no-op here.
+      const whole = scrub(b.input.command);
+      input.command = whole.replace(/\s+/g, ' ').slice(0, COMMAND_HEAD);
+      if (SHELL_TOOLS.has(b.name) && DONE_RUN.test(whole)) input._unitEnded = true;
+      // The files this command wrote, read here from the WHOLE command: the head the server
+      // gets is 130 characters and measured 53% of them — `cd … && cat > server/test/x.mjs`
+      // puts the path past the cut. Same shape as `_unitEnded` above.
+      if (SHELL_TOOLS.has(b.name)) { const w = [...new Set([...(b.name === 'PowerShell' ? wrotePathsPs(whole) : wrotePaths(whole)), ...wrotePathsScript(whole)])].slice(0, WROTE_MAX); if (w.length) input._wrote = w; }
+    }
+    return { ...b, input };
+  }
+  return b;
+}
+
+// The rows a stage reads, and the keys it reads off them (pipeline/src/stages/scan.ts `Row`,
+// ship.ts `buildIndex`). Everything else a transcript carries stays on the machine.
+const READ_ROW_TYPES = new Set(['user', 'assistant']);
+const KEEP_ROW = ['type', 'uuid', 'timestamp', 'cwd', 'isMeta', 'isSidechain'];
+const KEEP_MESSAGE = ['role', 'model'];
+const KEEP_USAGE = ['input_tokens', 'output_tokens', 'cache_read_input_tokens', 'cache_creation_input_tokens'];
+
+/**
+ * The upload diet: what no stage on the server reads does not leave the machine.
+ *
+ * The capture preview has always told the person "도구 출력·이미지·사고 블록은 보내지
+ * 않습니다", and only the images were true — measured 2026-09-20 by running this module on
+ * a row: the thinking block, the body of a Write and the tool's output all came out the
+ * other side. They are where an employer's code sits, and the server skipped every one of
+ * them. What the person SAID and what the assistant SAID go up whole, as before.
+ *
+ * It is an ALLOWLIST, of row types and of keys, not a list of things to remove. The first
+ * cut removed the known bodies and measured well — and Claude Code turned out to keep a
+ * second copy of every tool input in a top-level `wireToolInputs`, so a Write's content
+ * still left. A transcript row has some fifty top-level keys and gains more with each
+ * release; a removal list is wrong again the day a new one appears. Hook output and
+ * attached files ride in `attachment` rows, which no stage reads, and go with the rest.
+ *
+ * Shape is kept where a reader looks at it — a tool_result row is still a row, a call
+ * still has its name and its input keys — because the last time scrubbing was widened
+ * without checking its readers, uploads lost their timestamps (CLAUDE.md, first table).
+ * `pipeline/test/upload-diet.mjs` runs SCAN and SHIP's index over the same session with
+ * and without this and requires identical output. A stage that starts reading a new key
+ * adds it here in the same change, and that test is what says so.
+ *
+ * Returns null for a row no stage reads.
+ */
+export function dietRow(row) {
+  if (!row || typeof row !== 'object') return row;
+  row = queuedTurn(row) ?? row;
+  if (!READ_ROW_TYPES.has(row.type)) return null;
+  const out = {};
+  for (const k of KEEP_ROW) if (row[k] !== undefined) out[k] = row[k];
+  const m = row.message;
+  if (m && typeof m === 'object') {
+    const msg = {};
+    for (const k of KEEP_MESSAGE) if (m[k] !== undefined) msg[k] = m[k];
+    if (m.usage && typeof m.usage === 'object') { msg.usage = {}; for (const k of KEEP_USAGE) if (typeof m.usage[k] === 'number') msg.usage[k] = m.usage[k]; }
+    if (m.content !== undefined) msg.content = Array.isArray(m.content) ? m.content.map(dietBlock) : m.content;
+    out.message = msg;
+  }
+  return out;
+}
+
+/**
+ * A message the person typed while the agent was still working, as a user row — or null for anything else.
+ *
+ * Claude Code does not write such a message as a `user` row: it is queued and lands in the transcript as an
+ * `attachment` of type `queued_command`, which the allowlist above drops. Measured 2026-10-06 on the owner's capture of
+ * that night: a front request pasted mid-turn never reached the server, so the work it started was filed under the
+ * turn before it and two pieces of work became one record. Over every local transcript, 131 such messages were the
+ * person's and 3 of them were also written as a user row (two typed twice on purpose, one resend that SCAN's resend
+ * rule folds). The others in the queue are not the person: a background task's notice (`commandMode:
+ * 'task-notification'`, 540) and another agent's message (`origin.kind: 'peer'`). A human one carries `origin.kind:
+ * 'human'`, or no origin at all on older rows (6, all typed by the person).
+ */
+export function queuedTurn(row) {
+  const a = row.type === 'attachment' ? row.attachment : null;
+  if (!a || a.type !== 'queued_command' || a.commandMode !== 'prompt') return null;
+  if (a.origin && a.origin.kind !== 'human') return null;
+  if (typeof a.prompt !== 'string' && !Array.isArray(a.prompt)) return null;
+  return { ...row, type: 'user', message: { role: 'user', content: a.prompt } };
+}
+
+// One parsed session row → the line that may leave the machine, or null to drop it
+// (a row no stage reads: editor snapshots, hook output, attachments, system rows).
+export function cleanRow(row) {
+  const kept = dietRow(row);
+  if (kept === null || kept === undefined) return null;
+  return JSON.stringify(posixRow(scrubDeep(stripBulk(kept))));
+}

package/lib/settings.mjs

@@ -0,0 +1,46 @@
+// What diffin writes into an agent's own settings — one entry each, for Claude Code and for Codex; Hermes and
+// Antigravity need none. Claude Code: `Bash(diffin capture:*)` on its allowlist. The send is the agent's own call,
+// made without a prompt; a permission prompt on it is the thing this design removed — in Claude Code a "no" there
+// ends the turn. Codex: see installCodexAllow.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = () => process.env.DIFFIN_HOME ?? homedir();
+export function claudeSettingsPath() { return join(HOME(), '.claude', 'settings.json'); }
+
+export const ALLOW_RULE = 'Bash(diffin capture:*)';
+export function installClaudeAllow() {
+  const p = claudeSettingsPath();
+  if (!existsSync(join(HOME(), '.claude'))) return { installed: false, reason: 'no-claude' };
+  let settings = {};
+  if (existsSync(p)) { try { settings = JSON.parse(readFileSync(p, 'utf8')); } catch { return { installed: false, reason: 'unreadable' }; } }
+  settings.permissions ??= {};
+  const allow = Array.isArray(settings.permissions.allow) ? settings.permissions.allow : [];
+  if (allow.includes(ALLOW_RULE)) return { installed: true, changed: false, path: p };
+  settings.permissions.allow = [...allow, ALLOW_RULE];
+  writeFileSync(p, JSON.stringify(settings, null, 2) + '\n');
+  return { installed: true, changed: true, path: p };
+}
+
+/**
+ * Codex: a rule that lets `diffin capture` run as the agent's own call. It is more than the missing prompt there —
+ * a command Codex runs sits in a sandbox with no network and no write outside the workspace, and a command the rules
+ * allow runs without it. Measured 2026-10-04 with a probe script: allowed by a rule, it reached the network and wrote
+ * under ~/.diffin; the same script through `sh` could do neither. The rule matches the command called DIRECTLY
+ * (`diffin capture …`), which is how the skill says to call it; wrapped in a shell it does not apply.
+ *
+ * Appended to the person's own rules file, once; the rest of the file is theirs and is not touched.
+ */
+export const CODEX_RULE = 'prefix_rule(\n    pattern = ["diffin", "capture"],\n    decision = "allow",\n)\n';
+export function codexRulesPath() { return join(HOME(), '.codex', 'rules', 'default.rules'); }
+export function installCodexAllow() {
+  if (!existsSync(join(HOME(), '.codex'))) return { installed: false, reason: 'no-codex' };
+  const p = codexRulesPath();
+  let text = '';
+  if (existsSync(p)) { try { text = readFileSync(p, 'utf8'); } catch { return { installed: false, reason: 'unreadable' }; } }
+  if (/pattern\s*=\s*\[\s*"diffin"\s*,\s*"capture"\s*\]/.test(text)) return { installed: true, changed: false, path: p };
+  mkdirSync(join(HOME(), '.codex', 'rules'), { recursive: true });
+  writeFileSync(p, text + (text && !text.endsWith('\n') ? '\n' : '') + (text ? '\n' : '') + CODEX_RULE);
+  return { installed: true, changed: true, path: p };
+}