@gotgenes/pi-permission-system 32.0.1 → 32.0.3

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [32.0.3](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.2...pi-permission-system-v32.0.3) (2026-09-15)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** mask a value bound to a bare or suffixed key name ([f23b8b9](https://github.com/gotgenes/pi-packages/commit/f23b8b93ceafa732ffe9d5484e4a935094d06754)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+* **pi-permission-system:** stop writing a named secret into the permission logs ([cf4f370](https://github.com/gotgenes/pi-packages/commit/cf4f370d192d778e600a253331bbf6e42b3cd758)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+
+### Documentation
+
+* **pi-permission-system:** restate the log-redaction boundary as name-structural ([958cba1](https://github.com/gotgenes/pi-packages/commit/958cba124a1b799a7e6af959440a26d7cf722934)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+* **pi-permission-system:** correct the review-log knob's unredacted claim ([0664a6c](https://github.com/gotgenes/pi-packages/commit/0664a6cf6fbf3e75c4a6864cc582716dd6d15a26)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+
+## [32.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.1...pi-permission-system-v32.0.2) (2026-09-11)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** keep a forwarded write when a file lock blocks the atomic rename ([d901116](https://github.com/gotgenes/pi-packages/commit/d9011165203b130675a3affd20a2792f7abd7105)), closes [#914](https://github.com/gotgenes/pi-packages/issues/914)
+* **pi-permission-system:** create a forwarding directory blocked by a transient file lock ([245683c](https://github.com/gotgenes/pi-packages/commit/245683c9153712d8991ceb21ece7884b2fb12f2a)), closes [#914](https://github.com/gotgenes/pi-packages/issues/914)
+
+### Documentation
+
+* **pi-permission-system:** record the transient filesystem retry ([eb7ab58](https://github.com/gotgenes/pi-packages/commit/eb7ab58cfd79d15de77bafa6afe8813e9dff7b72)), closes [#914](https://github.com/gotgenes/pi-packages/issues/914)
+
 ## [32.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.0...pi-permission-system-v32.0.1) (2026-09-11)
 
 

package/README.md

@@ -177,7 +177,8 @@ Hardening the gates against bypass, fail-closed corrections (breaking ones inclu
 - _Permissive defaults, trust profiles, or workflow presets._
   Your risk profile is not knowable from here, so defaults are least-privilege and common policies ship as documented recipes rather than preset keywords.
 - _Guessing what is sensitive._
-  No built-in secret denylist, and log redaction is key-name-structural rather than predictive — a redactor that silently misses a key invites treating the log as safe to share.
+  No built-in secret denylist, and log redaction is name-structural rather than predictive: a value is masked because of the name that binds it — a log key, a shell variable, a request header field — never because of what it looks like.
+  A redactor that guesses invites treating the log as safe to share.
 - _Model judgment in the core._
   This package makes no LLM call and holds no model config; model-assisted judging attaches as a chain link over the authorizer seam instead.
   A link decides nothing until you name it in `authorizerChain`, and its `allow` on an excluded surface is downgraded to `defer`.

package/docs/configuration.md

@@ -100,7 +100,7 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
 | Key                         | Default  | Description                                                                                                                                                                                                                                  |
 | --------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `debugLog`                  | `false`  | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                                                                                                                |
-| `permissionReviewLog`       | `true`   | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`. Records bash command strings unredacted — see [Log file sensitivity](#log-file-sensitivity)                                         |
+| `permissionReviewLog`       | `true`   | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`. Records bash command strings, masked only where a name binds the secret — see [Log file sensitivity](#log-file-sensitivity)         |
 | `yoloMode`                  | `false`  | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                                                                                                                   |
 | `doublePressToConfirm`      | `true`   | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.                                                                                            |
 | `forwardingTimeoutMs`       | `600000` | How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds. A child whose parent is not draining its inbox gives up in ~2 s regardless, whether that parent runs in this process or its own. |
@@ -1197,19 +1197,30 @@ Both logs are created **owner-only** (`0600`, in a `0700` directory), and a log
 The permission-forwarding request and response files are written the same way.
 This closes the shared-host case: another user on the same machine cannot read them.
 
-Values bound to a **sensitive key name** — `authorization`, `token`, `secret`, `password`, `credential`, `cookie`, `api_key`, `private_key`, matched case-insensitively — are masked as `[redacted]` before anything is written.
+Values bound to a **sensitive name** — `authorization`, `token`, `secret`, `password`, `credential`, `cookie`, and a bare or suffixed `key` (`api_key`, `private_key`, `OPENROUTER_KEY`, `apiKey`), matched case-insensitively — are masked as `[redacted]` before anything is written.
 So a tool called with `{"authorization": "Bearer …"}` records `{"authorization": "[redacted]"}`.
 
+A bash command binds values to names too, and the same predicate answers for those.
+The command is parsed, and a value is masked when it is bound to a sensitive name by a shell assignment or a request header field:
+
+```text
+KEY="sk-or-v1-…" curl https://x        →  KEY=[redacted] curl https://x
+env MY_KEY=… deploy                    →  env MY_KEY=[redacted] deploy
+curl -H "Authorization: Bearer sk-…"   →  curl -H "Authorization:[redacted]"
+```
+
 The boundary is worth stating exactly, because it is easy to over-read:
 
-> A value bound to a sensitive key name is masked; a secret embedded in a bash command string is not.
+> A value bound to a sensitive name is masked — whether the name is a log key, a shell variable, or a request header field.
+> A secret with no name bound to it, such as one typed as a `grep` pattern, is not.
 
-A command string has no keys, so `deploy --token abc123` is logged unredacted.
+So `grep -r "sk-ant-…" .` and `deploy --token abc123` are both logged unredacted: the first binds the secret to nothing, and the second binds it to a flag rather than a name.
 The extension deliberately does not try to guess which parts of a command look secret-shaped — see [ADR 0010] for the measured reasoning.
+A command the parser could not fully resolve, and a secret inside an inline-shell payload (`bash -c '…'`) or a heredoc body, are masked only as far as the parse reached.
 
 Every value the **review** log writes is narrowed to `reviewLogFieldMaxWidth` (1000 characters by default) and marked with an ellipsis, so a single pathological command cannot put tens of kilobytes in one entry.
 This is a length bound, not redaction: it never inspects a value to decide what to hide, and it applies to every field alike.
-The two compose — a sensitive-keyed value is masked whole however long it was.
+The two compose, and masking runs first — a sensitively-named value is masked whole however long it was, and the cap never shortens one.
 The debug log is left unbounded, since it is opt-in and exists to be read in full.
 
 Practical guidance:

package/docs/troubleshooting.md

@@ -2,15 +2,16 @@
 
 ## Common Issues
 
-| Problem                                                           | Cause                                                             | Solution                                                                                                                                          |
-| ----------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Config not applied (everything asks)                              | File not found or parse error                                     | Verify the global config at `~/.pi/agent/extensions/pi-permission-system/config.json` (respects `PI_CODING_AGENT_DIR`); check for trailing commas |
-| Per-agent override not applied                                    | Frontmatter parsing issue                                         | Ensure `---` delimiters at file top; keep YAML simple; restart session                                                                            |
-| Tool blocked as unregistered                                      | Unknown tool name                                                 | Use a registered `mcp` tool for server tools: `{ "tool": "server:tool" }`                                                                         |
-| `/skill:<name>` blocked                                           | Deny policy or confirmation unavailable                           | Check merged `skill` policy (global/project/agent layers). `ask` still requires UI or forwarded confirmation.                                     |
-| External file path blocked                                        | `external_directory` is `ask` without UI or `deny`                | Allow/ask the permission or keep file tools inside the active working directory.                                                                  |
-| Spurious external-path prompt for `cd <subdir> && grep … ../path` | Relative path was resolved against cwd instead of the `cd` target | Fixed in current version — paths after a leading `cd <subdir> &&` are resolved against the cd target, matching actual shell behavior.             |
-| Permission prompt is too verbose                                  | Generic extension tool input is large                             | Built-in file tools are summarized automatically; third-party tools are capped to a bounded one-line JSON preview.                                |
+| Problem                                                                                                 | Cause                                                                                   | Solution                                                                                                                                                                                                                                                                    |
+| ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Config not applied (everything asks)                                                                    | File not found or parse error                                                           | Verify the global config at `~/.pi/agent/extensions/pi-permission-system/config.json` (respects `PI_CODING_AGENT_DIR`); check for trailing commas                                                                                                                           |
+| Per-agent override not applied                                                                          | Frontmatter parsing issue                                                               | Ensure `---` delimiters at file top; keep YAML simple; restart session                                                                                                                                                                                                      |
+| Tool blocked as unregistered                                                                            | Unknown tool name                                                                       | Use a registered `mcp` tool for server tools: `{ "tool": "server:tool" }`                                                                                                                                                                                                   |
+| `/skill:<name>` blocked                                                                                 | Deny policy or confirmation unavailable                                                 | Check merged `skill` policy (global/project/agent layers). `ask` still requires UI or forwarded confirmation.                                                                                                                                                               |
+| External file path blocked                                                                              | `external_directory` is `ask` without UI or `deny`                                      | Allow/ask the permission or keep file tools inside the active working directory.                                                                                                                                                                                            |
+| Spurious external-path prompt for `cd <subdir> && grep … ../path`                                       | Relative path was resolved against cwd instead of the `cd` target                       | Fixed in current version — paths after a leading `cd <subdir> &&` are resolved against the cd target, matching actual shell behavior.                                                                                                                                       |
+| Permission prompt is too verbose                                                                        | Generic extension tool input is large                                                   | Built-in file tools are summarized automatically; third-party tools are capped to a bounded one-line JSON preview.                                                                                                                                                          |
+| Windows: `permission_forwarding.error — EPERM … rename` in the logs, and a subagent's tool call refused | An antivirus scanner or the search indexer held a transient handle on a forwarding file | The write is retried automatically for a short window. If it still fails, enable `debugLog` and look for `permission_forwarding.fs_retried` entries — their `attempts` and `code` say whether retrying is helping — then exclude the forwarding directory from the scanner. |
 
 ## Diagnostic Logging
 
@@ -53,8 +54,9 @@ This makes it easy to verify which files the extension actually loaded:
 - This is a permission decision layer, not a sandbox — for true isolation see [Agent Sandboxes](https://engine.build/lab/agent-sandboxes).
   The two are complementary rather than alternatives: a sandbox enforces which paths are in scope and in which direction, while this package decides whether a particular action on an in-scope path may proceed.
   [ADR 0013] §8 records that division and the seam that exports this package's scope decisions to a sandbox launcher.
-- The review log records bash command strings unredacted.
-  Log files are created owner-only (`0600`), and values bound to a sensitive key name (`authorization`, `token`, `password`, …) are masked — but a secret embedded in a command string is not.
+- The review log records bash command strings, masked only where a name binds the secret.
+  Log files are created owner-only (`0600`), and a value bound to a sensitive name (`authorization`, `token`, `password`, a bare or suffixed `key`, …) is masked — whether the name is a log key, a shell variable, or a request header field.
+  A secret with no name bound to it, such as one typed as a `grep` pattern, is not.
   Review-log values are shortened at `reviewLogFieldMaxWidth` (1000 characters by default), which bounds the file's growth but is a length cap, not redaction.
   See [Log file sensitivity](configuration.md#log-file-sensitivity) and [ADR 0010].
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "32.0.1",
+  "version": "32.0.3",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/parser.ts

@@ -15,6 +15,8 @@ export interface TSNode {
   readonly text: string;
   /** Absolute byte offset of this node's start in the parsed source. */
   readonly startIndex: number;
+  /** Absolute byte offset one past this node's end in the parsed source. */
+  readonly endIndex: number;
   readonly childCount: number;
   /** False for anonymous tokens (operators, delimiters); true for named nodes. */
   readonly isNamed: boolean;

package/src/authority/forwarding-io.ts

@@ -29,6 +29,10 @@ import {
   type ForwardedSessionApproval,
   type PermissionForwardingLocation,
 } from "./permission-forwarding";
+import {
+  retryOnTransientFsError,
+  type TransientFsRetryRecord,
+} from "./transient-fs-retry";
 
 /** Valid `permissions:ui_prompt` source values, for tolerant request reads. */
 const UI_PROMPT_SOURCES = [
@@ -217,7 +221,14 @@ export function ensureDirectoryExists(
   description: string,
 ): boolean {
   try {
-    mkdirSync(path, { recursive: true, mode: OWNER_ONLY_DIRECTORY_MODE });
+    recordFsRetry(
+      logger,
+      "mkdir",
+      path,
+      retryOnTransientFsError(() => {
+        mkdirSync(path, { recursive: true, mode: OWNER_ONLY_DIRECTORY_MODE });
+      }),
+    );
     return true;
   } catch (error) {
     logPermissionForwardingError(
@@ -399,17 +410,51 @@ export function writeJsonFileAtomic(
   try {
     // `rename` preserves the temp file's mode, so setting it here is enough —
     // a response overwriting an existing file also comes through a fresh temp.
+    // The temp write is deliberately outside the retry: its failure shape is a
+    // write-denied directory, which no number of attempts resolves.
     writeFileSync(tempPath, JSON.stringify(value), {
       encoding: "utf-8",
       mode: OWNER_ONLY_FILE_MODE,
     });
-    renameSync(tempPath, filePath);
+    recordFsRetry(
+      logger,
+      "rename",
+      filePath,
+      retryOnTransientFsError(() => {
+        renameSync(tempPath, filePath);
+      }),
+    );
   } catch (error) {
     safeDeleteFile(logger, tempPath, "temporary permission-forwarding");
     throw error;
   }
 }
 
+/**
+ * Record a filesystem operation that only succeeded after retrying.
+ *
+ * Debug-only: a recovered write decided nothing, so it does not belong in the
+ * permission-decision record — but `attempts` and `code` are the whole
+ * diagnosis when a host keeps losing writes, and `debugLog` is exactly the
+ * switch a user reaching for that diagnosis turns on.
+ */
+function recordFsRetry(
+  logger: DebugReviewLogger | null,
+  operation: "rename" | "mkdir",
+  path: string,
+  record: TransientFsRetryRecord,
+): void {
+  if (record.attempts === 1) {
+    return;
+  }
+  logger?.debug("permission_forwarding.fs_retried", {
+    operation,
+    path,
+    attempts: record.attempts,
+    code: record.code,
+  });
+}
+
 export function readForwardedPermissionRequest(
   logger: DebugReviewLogger | null,
   filePath: string,

package/src/authority/transient-fs-retry.ts

@@ -0,0 +1,118 @@
+/**
+ * transient-fs-retry.ts — Survive a file lock that is about to clear.
+ *
+ * On Windows a `rename` or `mkdir` is not the POSIX operation of the same
+ * name: an antivirus scanner, the search indexer, or any other process holding
+ * a transient handle on a path fails the call with `EPERM`/`EBUSY`/`EACCES`.
+ * The forwarded-permission writes that ride on those calls are then simply
+ * lost — a child's request write becomes a refused tool call, and a serving
+ * heartbeat goes unpublished (#914).
+ *
+ * A few attempts a few milliseconds apart is enough for the common case. The
+ * decision lives here rather than at either call site so both inherit one
+ * errno set and one budget, and so it can be tested without a filesystem.
+ */
+
+/** Tuning seams, injected so a unit test asserts the backoff without sleeping. */
+export interface TransientFsRetryOptions {
+  delaysMs?: readonly number[];
+  sleep?: (ms: number) => void;
+}
+
+/** How an operation that eventually succeeded got there. */
+export interface TransientFsRetryRecord {
+  /** Attempts made, counting the first — `1` when it succeeded outright. */
+  attempts: number;
+  /** The transient errno that forced the retries, or `null` when there were none. */
+  code: string | null;
+}
+
+/**
+ * Run `operation`, retrying while a transient filesystem lock rejects it.
+ *
+ * Returns how it went, so the caller can record a recovery without this module
+ * having to know anything about logging. An error outside the transient set is
+ * rethrown immediately with no sleep, keeping a permanent `ENOTDIR`/`ENOENT`
+ * exactly as fast as it is today; an exhausted budget rethrows the last error,
+ * so every caller's existing `catch` keeps working unchanged.
+ */
+export function retryOnTransientFsError(
+  operation: () => void,
+  options?: TransientFsRetryOptions,
+): TransientFsRetryRecord {
+  const delaysMs = options?.delaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+  const sleep = options?.sleep ?? sleepBlocking;
+
+  let attempts = 0;
+  let code: string | null = null;
+
+  for (;;) {
+    try {
+      operation();
+      return { attempts: attempts + 1, code };
+    } catch (error) {
+      const transientCode = transientErrorCode(error);
+      if (transientCode === null || attempts >= delaysMs.length) {
+        throw error;
+      }
+      code = transientCode;
+      sleep(delaysMs[attempts] ?? 0);
+      attempts += 1;
+    }
+  }
+}
+
+// ── Module-private ─────────────────────────────────────────────────────────
+
+/**
+ * Three retries, 60 ms of blocking at worst.
+ *
+ * Sized against the two windows it has to fit inside: well under one
+ * `PERMISSION_FORWARDING_POLL_INTERVAL_MS` tick, so a retrying heartbeat write
+ * cannot push the serving node's timer into the next tick, and far under the
+ * grace a forwarding child waits out, so a parent retrying its own writes can
+ * never be the reason a child gives up on it.
+ */
+const DEFAULT_RETRY_DELAYS_MS: readonly number[] = [10, 20, 30];
+
+/**
+ * The errno values a transient lock produces on an otherwise-valid operation.
+ *
+ * This set is the platform gate: `process.platform` is unreadable in `src/`,
+ * and a POSIX host that produces one of these on a rename is in the same
+ * situation a Windows host is — worth one more attempt, and no worse off for
+ * it.
+ */
+const TRANSIENT_FS_ERROR_CODES: ReadonlySet<string> = new Set([
+  "EPERM",
+  "EBUSY",
+  "EACCES",
+]);
+
+/** The transient errno `error` carries, or `null` when retrying cannot help. */
+function transientErrorCode(error: unknown): string | null {
+  if (typeof error !== "object" || error === null || !("code" in error)) {
+    return null;
+  }
+  const { code } = error as { code?: unknown };
+  return typeof code === "string" && TRANSIENT_FS_ERROR_CODES.has(code)
+    ? code
+    : null;
+}
+
+/**
+ * Block the calling thread for `ms`.
+ *
+ * Synchronous because every caller is: the heartbeat publish satisfies a
+ * `void` seam a timer drives. `Atomics.wait` on a never-notified buffer is the
+ * standard blocking sleep and is permitted on Node's main thread.
+ *
+ * The buffer is module-scoped — which persists across same-cwd session
+ * switches — and that is safe here precisely because nothing ever writes to
+ * it: every wait sees the initial zero and times out.
+ */
+const SLEEP_BUFFER = new Int32Array(new SharedArrayBuffer(4));
+
+function sleepBlocking(ms: number): void {
+  Atomics.wait(SLEEP_BUFFER, 0, 0, ms);
+}

package/src/logging/command-redaction.ts

@@ -0,0 +1,241 @@
+import {
+  ARG_NODE_TYPES,
+  resolveNodeText,
+} from "#src/access-intent/bash/node-text";
+import { getWarmBashParser, type TSNode } from "#src/access-intent/bash/parser";
+import { isPlainRecord } from "#src/value-guards";
+import { isSensitiveName, REDACTED_PLACEHOLDER } from "./log-redaction";
+
+/**
+ * Grammar-anchored masking of a secret bound to a sensitive name *inside* a
+ * bash command string.
+ *
+ * Key-name redaction (`log-redaction.ts`) masks a value because of the key it
+ * is bound to, and a command string is one opaque value under the key
+ * `command`. This module asks the same question of the names a command binds
+ * values to — a shell variable and an HTTP header field — so one predicate
+ * answers for all three binding forms.
+ *
+ * Every rule matches a **parse node**, never a substring of the command text.
+ * That is what keeps it usable: measured against a 12 MB review log (7146
+ * unique commands), a raw-string scan for a sensitively-named assignment
+ * matched ten commands and every one was embedded Python (`key=lambda x: x[1]`)
+ * or a `sed` pattern; the same rule anchored to a `variable_assignment` node
+ * matched none. See `docs/decisions/0010-permission-log-secret-exposure.md`.
+ *
+ * A value with no name bound to it — a secret typed as a `grep` pattern — is
+ * out of reach of a structural rule and stays unmasked.
+ */
+
+/** The log keys whose value is a bash command string. */
+export const COMMAND_BEARING_LOG_KEYS: ReadonlySet<string> = new Set([
+  "command",
+  "executedUnit",
+]);
+
+/** A range of the command to replace, and what to put in its place. */
+interface MaskSpan {
+  readonly start: number;
+  readonly end: number;
+  readonly replacement: string;
+}
+
+/**
+ * Mask every sensitively-named value in a bash command string.
+ *
+ * Best-effort by design: a cold parser, a parse that throws, and a parse that
+ * recovered from a syntax error all yield whatever the walk did resolve rather
+ * than blanking the field, because the command text is the main reason the
+ * review log is read. It never throws — the writer sits under the fail-closed
+ * `tool_call` boundary, where a raised mask would cost the whole log line.
+ */
+export function redactCommandSecrets(command: string): string {
+  if (!command) return command;
+
+  try {
+    const parser = getWarmBashParser();
+    if (!parser) return command;
+    const tree = parser.parse(command);
+    if (!tree) return command;
+    try {
+      const spans: MaskSpan[] = [];
+      collectMaskSpans(tree.rootNode, spans);
+      return applyMaskSpans(command, spans);
+    } finally {
+      tree.delete();
+    }
+  } catch {
+    return command;
+  }
+}
+
+/**
+ * Apply {@link redactCommandSecrets} to every command-bearing key in a log
+ * record.
+ *
+ * Recurses through plain objects and arrays, like the width cap beside it: all
+ * of today's producers write `command` and `executedUnit` at the top level, but
+ * a writer stage that only looks at the top level is one a later nested
+ * producer escapes without anyone noticing.
+ */
+export function maskCommandFields<T>(details: T): T {
+  return maskValue(details, false) as T;
+}
+
+function maskValue(value: unknown, bindsCommand: boolean): unknown {
+  if (typeof value === "string") {
+    return bindsCommand ? redactCommandSecrets(value) : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => maskValue(entry, bindsCommand));
+  }
+  if (isPlainRecord(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        key,
+        maskValue(entry, COMMAND_BEARING_LOG_KEYS.has(key)),
+      ]),
+    );
+  }
+  return value;
+}
+
+function collectMaskSpans(node: TSNode, spans: MaskSpan[]): void {
+  const span = maskSpanOf(node);
+  if (span) spans.push(span);
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (child) collectMaskSpans(child, spans);
+  }
+}
+
+function maskSpanOf(node: TSNode): MaskSpan | null {
+  return (
+    assignmentValueSpan(node) ??
+    wordAssignmentSpan(node) ??
+    headerValueSpan(node)
+  );
+}
+
+/**
+ * `KEY="sk-…" curl …`, `KEY=sk-…`, `export OPENROUTER_KEY="sk-…"`.
+ *
+ * The span runs to the assignment node's own end rather than the value node's,
+ * so a value the grammar splits across several children is covered whole.
+ */
+function assignmentValueSpan(node: TSNode): MaskSpan | null {
+  if (node.type !== "variable_assignment") return null;
+  const name = node.child(0);
+  if (!name || !isSensitiveName(name.text)) return null;
+  const value = node.child(2);
+  if (!value) return null;
+  return maskSpan(value.startIndex, node.endIndex, REDACTED_PLACEHOLDER);
+}
+
+/**
+ * `env MY_KEY=abc deploy`, which tree-sitter classifies as a plain `word`
+ * rather than an assignment because it follows a command name.
+ *
+ * The name must open with a letter or underscore, so a long option
+ * (`--my-key=abc`) cannot match: an option binds its value to a flag, and the
+ * flag forms are deliberately out of scope.
+ */
+const WORD_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=/;
+
+function wordAssignmentSpan(node: TSNode): MaskSpan | null {
+  if (node.type !== "word") return null;
+  const match = WORD_ASSIGNMENT.exec(node.text);
+  if (!match || !isSensitiveName(match[1])) return null;
+  return maskSpan(
+    node.startIndex + match[0].length,
+    node.endIndex,
+    REDACTED_PLACEHOLDER,
+  );
+}
+
+/** `curl -H "Authorization: Bearer sk-…"`, in any of its quoting forms. */
+const HEADER_FIELD = /^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:[ \t]*\S/;
+
+function headerValueSpan(node: TSNode): MaskSpan | null {
+  if (!ARG_NODE_TYPES.has(node.type)) return null;
+  const match = HEADER_FIELD.exec(resolveNodeText(node));
+  const field = match?.[1];
+  if (!field || !isSensitiveName(field) || isCamelCased(field)) return null;
+  const colon = node.text.indexOf(":");
+  if (colon < 0) return null;
+  // The span swallows a closing quote, so the replacement puts one back and
+  // the masked argument stays quoted the way it was written.
+  return maskSpan(
+    node.startIndex + colon + 1,
+    node.endIndex,
+    REDACTED_PLACEHOLDER + openQuoteAt(node.text, colon),
+  );
+}
+
+/**
+ * An HTTP field name is hyphenated (`X-Api-Key`), never camel-cased.
+ *
+ * Without this the only false positives in the measured corpus were two
+ * records of `grep "legalDirectionalKeys: readonly"` — a search pattern over
+ * TypeScript source, which names a field of nothing.
+ */
+function isCamelCased(field: string): boolean {
+  return /[a-z][A-Z]/.test(field);
+}
+
+/**
+ * The quote character still open at `index`, or the empty string.
+ *
+ * Read at the mask's own position rather than off the argument's first
+ * character: a field name can straddle a quote boundary (`Auth"orization: "$T`),
+ * and the quote the mask swallowed is the one open where it begins.
+ */
+function openQuoteAt(text: string, index: number): string {
+  let quote = "";
+  for (let i = 0; i < index; i++) {
+    const char = text[i];
+    if (quote === "") {
+      if (char === '"' || char === "'") quote = char;
+    } else if (quote === '"' && char === "\\") {
+      i += 1;
+    } else if (char === quote) {
+      quote = "";
+    }
+  }
+  return quote;
+}
+
+function maskSpan(
+  start: number,
+  end: number,
+  replacement: string,
+): MaskSpan | null {
+  return start < end ? { start, end, replacement } : null;
+}
+
+/**
+ * Replace each span, outermost-wins and right to left.
+ *
+ * A sensitive assignment whose value is itself a header argument yields two
+ * spans, one inside the other; masking both would nest a placeholder inside a
+ * region already replaced. Working right to left keeps the earlier offsets
+ * valid as the string shortens.
+ */
+function applyMaskSpans(command: string, spans: MaskSpan[]): string {
+  if (spans.length === 0) return command;
+
+  const ordered = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+  const disjoint: MaskSpan[] = [];
+  for (const span of ordered) {
+    const previous = disjoint.at(-1);
+    if (previous && span.start < previous.end) continue;
+    disjoint.push(span);
+  }
+
+  let masked = command;
+  for (const span of disjoint.toReversed()) {
+    masked =
+      masked.slice(0, span.start) + span.replacement + masked.slice(span.end);
+  }
+  return masked;
+}

package/src/logging/log-field-cap.ts

@@ -1,3 +1,5 @@
+import { isPlainRecord } from "#src/value-guards";
+
 /**
  * The permission review log's width bound (ADR 0011 §6).
  *
@@ -57,7 +59,7 @@ function capValue(value: unknown, maxWidth: number): unknown {
   if (Array.isArray(value)) {
     return value.map((entry) => capValue(entry, maxWidth));
   }
-  if (isPlainObject(value)) {
+  if (isPlainRecord(value)) {
     return Object.fromEntries(
       Object.entries(value).map(([key, entry]) => [
         key,
@@ -67,16 +69,3 @@ function capValue(value: unknown, maxWidth: number): unknown {
   }
   return value;
 }
-
-/**
- * Whether a value is a record this cap should descend into.
- *
- * A class instance (a `Date`, an `Error`) is left alone: rebuilding it as a
- * plain object would change what the writer serializes, and the cap's job is
- * to shorten strings, not to reshape a value.
- */
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  if (typeof value !== "object" || value === null) return false;
-  const prototype: unknown = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}

package/src/logging/log-redaction.ts

@@ -1,7 +1,7 @@
 import { createJsonSafeReplacer } from "./json-safe-stringify";
 
 /**
- * Key-name redaction for the permission logs.
+ * Name-based redaction for the permission logs.
  *
  * The technique is deliberately structural rather than predictive: a value is
  * masked because of the *name* it is bound to, never because of what it looks
@@ -9,19 +9,41 @@ import { createJsonSafeReplacer } from "./json-safe-stringify";
  * was measured against a real 6.7 MB review log and declined — see
  * `docs/decisions/0010-permission-log-secret-exposure.md`.
  *
- * The boundary that follows from this, stated once: a value bound to a
- * sensitive key name is masked; a secret embedded in a bash command string is
- * not, because a command string has no keys.
+ * This module owns the predicate and the log-key binding form.
+ * `command-redaction.ts` asks the same predicate about the names a bash
+ * command binds values to.
+ *
+ * The boundary that follows, stated once: a value bound to a sensitive name is
+ * masked — whether the name is a log key, a shell variable, or a request
+ * header field. A secret with no name bound to it, such as one typed as a
+ * `grep` pattern, is not.
  */
 
 export const REDACTED_PLACEHOLDER = "[redacted]";
 
-const SENSITIVE_KEY_PATTERN =
-  /authorization|api[-_]?key|secret|token|password|passwd|credential|cookie|private[-_]?key/i;
+/**
+ * Names that bind a credential, matched case-insensitively.
+ *
+ * `api[-_]?keys?` and `private[-_]?keys?` are kept alongside the general
+ * name-boundary `key` rule rather than subsumed by it, so the whole predicate
+ * is a union with the pattern it replaced and can add a name but never drop
+ * one — the separator-less `apikey` matches only via the specific alternative.
+ */
+const SENSITIVE_NAME_PATTERN =
+  /authorization|api[-_]?keys?|private[-_]?keys?|secret|token|password|passwd|credential|cookie|(?:^|[-_])keys?(?:$|[-_])/i;
+
+/**
+ * A `key` bound as the tail of a camel-cased name (`apiKey`, `sortKeys`).
+ *
+ * Deliberately case-sensitive and separate from the pattern above: under `/i`
+ * the leading `[a-z0-9]` would match an uppercase letter and `Key` would match
+ * `key`, so `monkey` would read as sensitive.
+ */
+const CAMEL_KEY_PATTERN = /[a-z0-9](?:Key|Keys)(?:$|[A-Z_-])/;
 
-/** True when a log key names a credential-bearing value. */
-export function isSensitiveLogKey(key: string): boolean {
-  return SENSITIVE_KEY_PATTERN.test(key);
+/** True when a name binds a credential-bearing value. */
+export function isSensitiveName(name: string): boolean {
+  return SENSITIVE_NAME_PATTERN.test(name) || CAMEL_KEY_PATTERN.test(name);
 }
 
 /**
@@ -36,7 +58,7 @@ export function redactedJsonStringify(value: unknown): string | undefined {
   return JSON.stringify(
     value,
     createJsonSafeReplacer((key, currentValue) =>
-      currentValue != null && isSensitiveLogKey(key)
+      currentValue != null && isSensitiveName(key)
         ? REDACTED_PLACEHOLDER
         : currentValue,
     ),

package/src/logging/logging.ts

@@ -4,6 +4,7 @@ import {
   EXTENSION_ID,
   type PermissionSystemExtensionConfig,
 } from "#src/config/extension-config";
+import { maskCommandFields } from "./command-redaction";
 import { capLogFieldWidths, resolveReviewLogFieldWidth } from "./log-field-cap";
 import {
   OWNER_ONLY_FILE_MODE,
@@ -39,13 +40,41 @@ export function createPermissionSystemLogger(
   const hardened = new Set<string>();
 
   /**
-   * The only place a log line is produced.
+   * The transform stages every log line passes through, in the order they must
+   * run.
+   *
+   * Command masking runs first, and it runs for both streams. Capping a command
+   * before masking it would hand the masker a truncated command — a parse of
+   * something the agent never ran — and the debug stream carries the same
+   * payload as the review stream, so a mask that skipped it would only move the
+   * exposure rather than close it.
    *
    * `maxFieldWidth` bounds every string the line carries; it is supplied for
    * the review stream and withheld for the debug stream, which is opt-in and
-   * exists to be read in full. Capping happens before redaction, which masks
-   * by key name and so still masks a sensitive value whole.
+   * exists to be read in full. Capping happens before key-name redaction, which
+   * masks by name and so still masks a sensitive value whole.
    */
+  const prepareLogLine = (
+    stream: "debug" | "review",
+    event: string,
+    details: Record<string, unknown>,
+    maxFieldWidth?: number,
+  ): string | undefined => {
+    const masked = maskCommandFields(details);
+    const bounded =
+      maxFieldWidth === undefined
+        ? masked
+        : capLogFieldWidths(masked, maxFieldWidth);
+    return redactedJsonStringify({
+      timestamp: new Date().toISOString(),
+      extension: EXTENSION_ID,
+      stream,
+      event,
+      ...bounded,
+    });
+  };
+
+  /** The only place a log line is produced. */
   const writeLine = (
     stream: "debug" | "review",
     path: string,
@@ -59,17 +88,7 @@ export function createPermissionSystemLogger(
     }
 
     try {
-      const bounded =
-        maxFieldWidth === undefined
-          ? details
-          : capLogFieldWidths(details, maxFieldWidth);
-      const line = redactedJsonStringify({
-        timestamp: new Date().toISOString(),
-        extension: EXTENSION_ID,
-        stream,
-        event,
-        ...bounded,
-      });
+      const line = prepareLogLine(stream, event, details, maxFieldWidth);
       if (!line) {
         return `Failed to write permission-system ${stream} log '${path}': event could not be serialized.`;
       }

package/src/value-guards.ts

@@ -6,6 +6,22 @@ export function toRecord(value: unknown): Record<string, unknown> {
   return value as Record<string, unknown>;
 }
 
+/**
+ * Whether a value is a record a structural walk should descend into.
+ *
+ * A class instance (a `Date`, an `Error`) is not: rebuilding one as a plain
+ * object would change what a serializer downstream writes. Distinct from
+ * {@link toRecord}, which reads a value as a record without asking how it was
+ * built.
+ */
+export function isPlainRecord(
+  value: unknown,
+): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null) return false;
+  const prototype: unknown = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
 export function getNonEmptyString(value: unknown): string | null {
   if (typeof value !== "string") {
     return null;