@ictechgy/context-guard 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes for the ContextGuard plugin are documented here.
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-08-24
+
+- Hardened three context-guard-kit security surfaces: `run_guarded_git()` now
+  resolves `git` through the fixed-path approved-runtime-executable resolver
+  instead of a PATH lookup, `FallbackLineSanitizer` gained PEM private-key
+  block and Cookie header redaction plus a corrected userinfo-credential
+  regex, and adjacent wrapper scripts are opened with `O_NOFOLLOW` before use
+  to reject a pre-planted symlink.
+- Corrected `sanitize_output.py`'s docstring to accurately describe that
+  `anonymize_paths_for_context()` is a deliberate no-op for `unknown_text`/
+  `source_code` contexts (behavior unchanged).
+
+## [0.7.0] - 2026-08-22
+
+- Added a zero-provider-context advisory mode for WeightClass-style routing.
+  Small tasks bypass without standing instructions, while larger tasks select
+  only locally eligible log trimming, symbol slicing, adaptive packing, or
+  cached graph expansion candidates that pass the configured gross-byte floor
+  and local-overhead budget. Those gates do not guarantee provider token or
+  cost savings. The bounded sample harness now counterbalances arm order,
+  charges preprocessing per advisory run, rejects ambiguous usage and cache
+  accounting, and keeps invalid historical measurements excluded.
+- Kept live Claude collection behind safe mode, an empty tool surface, trusted
+  executable ancestry, a minimal non-redirectable environment, exact quality
+  checks, and explicit provider-egress confirmation. Live Codex collection
+  fails closed before local or provider action until the subscription CLI has
+  a preventive no-tools mode; provider-free Codex planning remains available.
+- Hardened Homebrew formula verification through an isolated temporary tap,
+  preserved pre-existing installation state, rendered release-safe formula
+  syntax, and registered the formula template as an explicit support surface.
+
 ## [0.6.0] - 2026-08-21
 
 - Added a provider-free `context-guard-receipt evaluate phase` surface with

package/README.ko.md

@@ -230,7 +230,7 @@ plugin 배치에서는 기존 Bash trim 동작을 유지하고 setup이 referenc
 사용할 수 없다고 알립니다.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.6.0
+npm install --save-exact @ictechgy/context-guard@0.7.1
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```
@@ -422,10 +422,13 @@ context-guard-pack auto --root . --query "checkout retry 수정" --diff worktree
 ```bash
 ./plugins/context-guard/bin/context-guard route-advisor --workload workload.json --json
 ./plugins/context-guard/bin/context-guard-cost route-advisor --feature batch_api=true --feature structured_outputs=true --json < workload.json
+./plugins/context-guard/bin/context-guard cost advisory --workload advisory-workload.json --json
 ```
 
 `context-guard route-advisor`는 로컬 passive advisor입니다. caller가 제공한 workload JSON, provider feature 선언, usage telemetry, 외부·로컬 shifted cost를 읽고 total-cost accounting, batchability blocker, batch API·prompt-cache prefix 보존·structured outputs·저비용 모델 평가 같은 route 후보를 출력합니다. queue를 시작하거나 provider를 호출하거나 pricing 문서를 새로 가져오지 않으며, provider feature는 caller-supplied 또는 unknown/recheck-required로 표시합니다. 추천은 후보일 뿐입니다. hosted token/cost 절감을 주장하려면 matched successful task, 비열등 quality gate, shifted-cost evidence가 필요합니다.
 
+`context-guard cost advisory`는 WeightClass/router용 zero-persistent-context gate입니다. 닫힌 숫자·불리언 capability 신호만 받고, 모든 경로에서 provider context를 빈 값으로 유지하며, 작거나 순이익이 없는 작업을 bypass하고, cached positive replacement 근거가 있을 때만 graph를 허용합니다. 자세한 계약은 [WeightClass advisory mode](https://github.com/ictechgy/context-guard/blob/main/docs/weightclass-advisory-mode.md)를 참고하세요.
+
 ### 선택한 로컬 텍스트를 보수적으로 압축하기
 
 ```bash

package/README.md

@@ -243,7 +243,7 @@ keeps the existing Bash trim behavior and setup reports the reference route as
 unavailable.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.6.0
+npm install --save-exact @ictechgy/context-guard@0.7.1
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```
@@ -459,10 +459,13 @@ The packer uses deterministic standard-library heuristics only: no network, mode
 ```bash
 ./plugins/context-guard/bin/context-guard route-advisor --workload workload.json --json
 ./plugins/context-guard/bin/context-guard-cost route-advisor --feature batch_api=true --feature structured_outputs=true --json < workload.json
+./plugins/context-guard/bin/context-guard cost advisory --workload advisory-workload.json --json
 ```
 
 `context-guard route-advisor` is a local, passive advisor. It reads caller-supplied workload JSON, provider feature declarations, usage telemetry, and shifted external/local costs, then emits total-cost accounting, batchability blockers, and candidate routes such as batch API, prompt-cache prefix preservation, structured outputs, or cheaper-model evaluation. It does not start a queue, call providers, refresh pricing docs, or treat bundled provider feature knowledge as authoritative; unknown or caller-supplied features are marked recheck-required. Treat recommendations as candidates only. Hosted token or cost savings claims require matched successful tasks, non-inferior quality, and shifted-cost evidence.
 
+`context-guard cost advisory` is the zero-persistent-context WeightClass/router gate. It accepts only closed numeric and boolean capability signals, returns an empty provider context on every path, bypasses small or non-profitable work, and permits graph only for cached positive replacement evidence. See [WeightClass advisory mode](https://github.com/ictechgy/context-guard/blob/main/docs/weightclass-advisory-mode.md).
+
 ### Compress selected local text conservatively
 
 ```bash

package/docs/distribution.md

@@ -31,14 +31,14 @@ Project scope is the default. `context-guard doctor` and `context-guard setup --
 
 `bash_reference_v1` is a narrower distribution than the ordinary CLI/plugin.
 It accepts only an exact project-local npm topology: root
-`@ictechgy/context-guard@0.6.0` declares
+`@ictechgy/context-guard@0.7.1` declares
 `@ictechgy/context-guard-receipt: 0.2.1`, and the installed Receipt inventory
 must match the SHA-256 trust anchor embedded in the root policy. Hoisted and
 nested npm dependency layouts are supported; global npm, `npx`, Homebrew,
 source-checkout, arbitrary `PATH`, and marketplace-plugin layouts are refused.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.6.0
+npm install --save-exact @ictechgy/context-guard@0.7.1
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ictechgy/context-guard",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "ContextGuard CLI helpers for keeping AI coding agent context focused and local-first.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ictechgy/context-guard#readme",

package/packaging/homebrew/context-guard.rb.template

@@ -1,3 +1,6 @@
+# typed: strict
+# frozen_string_literal: true
+
 # Homebrew formula draft for ContextGuard.
 # Replace URL/SHA/tag during release packaging; do not publish with SHA placeholder.
 class ContextGuard < Formula
@@ -30,6 +33,7 @@ class ContextGuard < Formula
   test do
     assert_match version.to_s, shell_output("#{bin}/context-guard --version")
     mkdir testpath/"project"
-    system bin/"context-guard", "setup", "--root", testpath/"project", "--agent", "codex", "--scope", "project", "--plan"
+    system bin/"context-guard", "setup", "--root", testpath/"project",
+           "--agent", "codex", "--scope", "project", "--plan"
   end
 end

package/plugins/context-guard/.claude-plugin/plugin.json

@@ -37,5 +37,5 @@
     "gated-experiments",
     "future-roadmap"
   ],
-  "version": "0.6.0"
+  "version": "0.7.1"
 }

package/plugins/context-guard/README.ko.md

@@ -48,7 +48,7 @@ npx @ictechgy/context-guard --version
 
 짧은 `bash_reference_v1` Bash 출력 경로는 이 marketplace plugin/소스 배치에서
 의도적으로 활성화되지 않습니다. 정확한 프로젝트 로컬
-`@ictechgy/context-guard@0.6.0` npm 설치와
+`@ictechgy/context-guard@0.7.1` npm 설치와
 `@ictechgy/context-guard-receipt@0.2.1` 의존성이 필요하며, 그 뒤
 `setup --agent claude --scope project --bash-reference-v1`로 명시적으로
 활성화해야 합니다. Plugin setup은 동작하지 않는 reference flag를 설치하지 않고
@@ -84,6 +84,7 @@ context-guard-compress --json < large-output.txt
 context-guard cost preflight --request request.json --budget-krw 3000 --json
 context-guard cost observe --usage usage.json --json
 context-guard route-advisor --workload workload.json --json
+context-guard cost advisory --workload advisory-workload.json --json
 context-guard-trim-output --max-lines 120 -- npm test
 context-guard-read-symbol path/to/file.py TargetSymbol
 context-guard-sanitize-output -- rg -n "TOKEN|SECRET" .

package/plugins/context-guard/README.md

@@ -48,8 +48,8 @@ npx @ictechgy/context-guard --version
 
 The compact `bash_reference_v1` Bash-output route is intentionally not
 available from this marketplace-plugin/source layout. It requires an exact
-project-local npm installation of `@ictechgy/context-guard@0.5.0` and its
-`@ictechgy/context-guard-receipt@0.2.0` dependency, then explicit
+project-local npm installation of `@ictechgy/context-guard@0.7.1` and its
+`@ictechgy/context-guard-receipt@0.2.1` dependency, then explicit
 `setup --agent claude --scope project --bash-reference-v1`. Plugin setup keeps
 legacy trimming and warns instead of installing a no-op reference flag. See the
 repository distribution guide for activation, disablement, seven-day handle,
@@ -88,6 +88,7 @@ context-guard-compress --json --type prose --mode readable < sanitized-prose.txt
 context-guard cost preflight --request request.json --budget-krw 3000 --json
 context-guard cost observe --usage usage.json --json
 context-guard route-advisor --workload workload.json --json
+context-guard cost advisory --workload advisory-workload.json --json
 context-guard-trim-output --max-lines 120 -- npm test
 context-guard-read-symbol path/to/file.py TargetSymbol
 context-guard-sanitize-output -- rg -n "TOKEN|SECRET" .

package/plugins/context-guard/bin/context-guard-cost

@@ -91,6 +91,37 @@ ROUTE_STRUCTURED_TASK_KINDS = {
     "batch_eval",
     "eval",
 }
+ADVISORY_WORKLOAD_SCHEMA_VERSION = "contextguard.advisory-workload.v1"
+ADVISORY_DECISION_SCHEMA_VERSION = "contextguard.advisory-decision.v1"
+ADVISORY_MAX_INTEGER = 1_000_000_000
+ADVISORY_TOP_LEVEL_KEYS = {"invocation", "limits", "schema_version", "signals", "vendor"}
+ADVISORY_INVOCATION_KEYS = {
+    "explicit_wrappers_available",
+    "hooks_available",
+    "host_tool_surface_equal_to_control",
+    "rules_loaded",
+    "safe_mode",
+    "skills_loaded",
+}
+ADVISORY_SIGNAL_INTEGER_KEYS = {
+    "candidate_context_bytes",
+    "estimated_local_overhead_ms",
+    "graph_candidate_bytes",
+    "graph_candidate_count",
+    "graph_replacement_bytes",
+    "largest_file_bytes",
+    "log_bytes",
+    "selected_file_count",
+    "task_prompt_bytes",
+}
+ADVISORY_SIGNAL_KEYS = ADVISORY_SIGNAL_INTEGER_KEYS | {"repo_map_cached"}
+ADVISORY_LIMIT_KEYS = {
+    "inline_log_bytes",
+    "max_local_overhead_ms",
+    "minimum_gross_context_savings_bytes",
+    "pack_bytes",
+    "symbol_slice_bytes",
+}
 ALLOWED_FIRST_COMPONENT_SYMLINKS = {
     "tmp": Path("/private/tmp"),
     "var": Path("/private/var"),
@@ -272,6 +303,33 @@ def load_json_input(path: str, *, max_bytes: int = DEFAULT_MAX_BYTES) -> tuple[A
     return data, truncated
 
 
+def reject_duplicate_json_pairs(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            fail("duplicate JSON key is not allowed")
+        result[key] = value
+    return result
+
+
+def load_advisory_json_input(path: str, *, max_bytes: int) -> Any:
+    text, truncated = read_text_path(path, max_bytes=max_bytes)
+    if truncated:
+        fail("JSON input exceeded max bytes")
+    try:
+        return json.loads(
+            text,
+            parse_constant=reject_json_constant,
+            object_pairs_hook=reject_duplicate_json_pairs,
+        )
+    except json.JSONDecodeError as exc:
+        fail(f"invalid JSON input at line {exc.lineno}: {exc.msg}")
+    except ValueError as exc:
+        if isinstance(exc, CostGuardError):
+            raise
+        fail(f"invalid JSON input: {exc}")
+
+
 def secret_count_in_text(text: str) -> int:
     return sum(1 for _ in SECRET_RE.finditer(text))
 
@@ -2532,6 +2590,80 @@ def route_recommendations(
     return recs
 
 
+def advisory_plain_object(value: Any, label: str, expected_keys: set[str]) -> dict[str, Any]:
+    if type(value) is not dict:
+        fail(f"{label} must be a plain JSON object")
+    if set(value) != expected_keys:
+        fail(f"{label} has missing or unknown fields")
+    return value
+
+
+def advisory_bool(value: Any, label: str) -> bool:
+    if type(value) is not bool:
+        fail(f"{label} must be boolean")
+    return value
+
+
+def advisory_integer(value: Any, label: str, *, positive: bool = False) -> int:
+    if type(value) is not int:
+        fail(f"{label} must be an integer")
+    lower_bound = 1 if positive else 0
+    if value < lower_bound or value > ADVISORY_MAX_INTEGER:
+        relation = "> 0" if positive else ">= 0"
+        fail(f"{label} must be {relation} and bounded")
+    return value
+
+
+def advisory_result(
+    *,
+    activation_status: str,
+    decision: str,
+    reason: str,
+    measurement_eligible: bool,
+    capabilities: dict[str, bool],
+    selected_features: dict[str, bool],
+    actions: list[dict[str, Any]],
+    control_bytes: int,
+    treatment_bytes: int,
+    minimum_savings: int,
+    local_overhead_ms: int,
+    max_local_overhead_ms: int,
+    graph_replacement_delta_bytes: int,
+) -> dict[str, Any]:
+    gross_saved = max(0, control_bytes - treatment_bytes)
+    return {
+        "schema_version": ADVISORY_DECISION_SCHEMA_VERSION,
+        "mode": "router_advisory",
+        "activation_status": activation_status,
+        "decision": decision,
+        "reason": reason,
+        "provider_context": "",
+        "provider_context_bytes": 0,
+        "persistent_writes_allowed": False,
+        "receipts_enabled": False,
+        "measurement_eligible": measurement_eligible,
+        "capabilities": capabilities,
+        "selected_features": selected_features,
+        "actions": actions,
+        "accounting": {
+            "control_candidate_context_bytes": control_bytes,
+            "estimated_treatment_context_bytes": treatment_bytes,
+            "estimated_gross_context_saved_bytes": gross_saved,
+            "minimum_gross_context_savings_bytes": minimum_savings,
+            "estimated_local_overhead_ms": local_overhead_ms,
+            "max_local_overhead_ms": max_local_overhead_ms,
+            "graph_replacement_delta_bytes": graph_replacement_delta_bytes,
+        },
+        "claim_boundary": {
+            "provider_token_or_cost_savings_claim_allowed": False,
+            "requires_paired_provider_measurement": True,
+            "requires_non_inferior_quality": True,
+            "task_content_accepted": False,
+            "persistent_context_allowed": False,
+        },
+    }
+
+
 def route_advisor_command(args: argparse.Namespace) -> int:
     workload_raw, _truncated = load_json_input(args.workload, max_bytes=args.max_bytes)
     workload = require_json_object(workload_raw.get("workload") if isinstance(workload_raw, dict) and isinstance(workload_raw.get("workload"), dict) else workload_raw, "workload")
@@ -2599,6 +2731,182 @@ def route_advisor_command(args: argparse.Namespace) -> int:
     return 0
 
 
+def advisory_decision(raw: Any) -> dict[str, Any]:
+    workload = advisory_plain_object(raw, "advisory workload", ADVISORY_TOP_LEVEL_KEYS)
+    if workload["schema_version"] != ADVISORY_WORKLOAD_SCHEMA_VERSION:
+        fail("advisory workload schema version is unsupported")
+    vendor = workload["vendor"]
+    if type(vendor) is not str or vendor not in {"claude", "codex"}:
+        fail("advisory vendor must be claude or codex")
+    invocation = advisory_plain_object(
+        workload["invocation"], "advisory invocation", ADVISORY_INVOCATION_KEYS
+    )
+    invocation_values = {
+        key: advisory_bool(invocation[key], f"advisory invocation.{key}")
+        for key in sorted(ADVISORY_INVOCATION_KEYS)
+    }
+    if invocation_values["safe_mode"] and vendor != "claude":
+        fail("advisory safe_mode is only valid for claude")
+    signals = advisory_plain_object(
+        workload["signals"], "advisory signals", ADVISORY_SIGNAL_KEYS
+    )
+    signal_values = {
+        key: advisory_integer(signals[key], f"advisory signals.{key}")
+        for key in sorted(ADVISORY_SIGNAL_INTEGER_KEYS)
+    }
+    signal_values["repo_map_cached"] = advisory_bool(
+        signals["repo_map_cached"], "advisory signals.repo_map_cached"
+    )
+    limits = advisory_plain_object(
+        workload["limits"], "advisory limits", ADVISORY_LIMIT_KEYS
+    )
+    limit_values = {
+        key: advisory_integer(
+            limits[key],
+            f"advisory limits.{key}",
+            positive=key in {"inline_log_bytes", "pack_bytes", "symbol_slice_bytes"},
+        )
+        for key in sorted(ADVISORY_LIMIT_KEYS)
+    }
+
+    control_bytes = signal_values["candidate_context_bytes"]
+    if signal_values["largest_file_bytes"] > control_bytes:
+        fail("largest_file_bytes exceeds candidate_context_bytes")
+    if signal_values["log_bytes"] > control_bytes:
+        fail("log_bytes exceeds candidate_context_bytes")
+    if signal_values["graph_replacement_bytes"] > control_bytes:
+        fail("graph_replacement_bytes exceeds candidate_context_bytes")
+    graph_count = signal_values["graph_candidate_count"]
+    graph_candidate_bytes = signal_values["graph_candidate_bytes"]
+    graph_replacement_bytes = signal_values["graph_replacement_bytes"]
+    if graph_count == 0 and (graph_candidate_bytes or graph_replacement_bytes):
+        fail("graph bytes require at least one graph candidate")
+    if graph_count > 0 and not (graph_candidate_bytes and graph_replacement_bytes):
+        fail("graph candidates require nonzero candidate and replacement bytes")
+
+    hooks_effective = bool(
+        invocation_values["hooks_available"]
+        and not (vendor == "claude" and invocation_values["safe_mode"])
+    )
+    persistent_context_absent = not (
+        invocation_values["rules_loaded"] or invocation_values["skills_loaded"]
+    )
+    capabilities = {
+        "hooks_effective": hooks_effective,
+        "explicit_wrappers_available": invocation_values["explicit_wrappers_available"],
+        "persistent_context_absent": persistent_context_absent,
+        "host_tool_surface_equal_to_control": invocation_values[
+            "host_tool_surface_equal_to_control"
+        ],
+    }
+    no_features = {
+        "adaptive": False,
+        "graph": False,
+        "symbol": False,
+        "trim_output": False,
+    }
+    result_common = {
+        "capabilities": capabilities,
+        "control_bytes": control_bytes,
+        "minimum_savings": limit_values["minimum_gross_context_savings_bytes"],
+        "local_overhead_ms": signal_values["estimated_local_overhead_ms"],
+        "max_local_overhead_ms": limit_values["max_local_overhead_ms"],
+    }
+    if not persistent_context_absent:
+        return advisory_result(
+            activation_status="bypass", decision="bypass",
+            reason="persistent_context_loaded", measurement_eligible=False,
+            selected_features=no_features, actions=[], treatment_bytes=control_bytes,
+            graph_replacement_delta_bytes=0, **result_common,
+        )
+    if not invocation_values["host_tool_surface_equal_to_control"]:
+        return advisory_result(
+            activation_status="bypass", decision="bypass",
+            reason="host_tool_surface_mismatch", measurement_eligible=False,
+            selected_features=no_features, actions=[], treatment_bytes=control_bytes,
+            graph_replacement_delta_bytes=0, **result_common,
+        )
+
+    candidates: list[dict[str, Any]] = []
+    log_bytes = signal_values["log_bytes"]
+    inline_log_bytes = limit_values["inline_log_bytes"]
+    if log_bytes > inline_log_bytes:
+        candidates.append({
+            "decision": "trim_output", "reason": "log_savings",
+            "treatment_bytes": control_bytes - (log_bytes - inline_log_bytes),
+            "features": {**no_features, "trim_output": True},
+            "actions": [{"kind": "trim_output", "max_inline_bytes": inline_log_bytes}],
+            "graph_replacement_delta_bytes": 0,
+        })
+    largest_file_bytes = signal_values["largest_file_bytes"]
+    symbol_slice_bytes = limit_values["symbol_slice_bytes"]
+    if largest_file_bytes > symbol_slice_bytes:
+        candidates.append({
+            "decision": "symbol_slice", "reason": "symbol_slice_savings",
+            "treatment_bytes": control_bytes - (largest_file_bytes - symbol_slice_bytes),
+            "features": {**no_features, "symbol": True},
+            "actions": [{"kind": "symbol_slice", "max_bytes": symbol_slice_bytes}],
+            "graph_replacement_delta_bytes": 0,
+        })
+    if signal_values["selected_file_count"] >= 3 and control_bytes > limit_values["pack_bytes"]:
+        graph_net_saved = 0
+        graph_selected = False
+        if (
+            signal_values["repo_map_cached"] and graph_count > 0
+            and graph_replacement_bytes > graph_candidate_bytes
+        ):
+            graph_net_saved = graph_replacement_bytes - graph_candidate_bytes
+            graph_selected = True
+        pack_bytes = limit_values["pack_bytes"]
+        candidates.append({
+            "decision": "adaptive_pack", "reason": "context_pack_savings",
+            "treatment_bytes": pack_bytes,
+            "features": {**no_features, "adaptive": True, "graph": graph_selected},
+            "actions": [{
+                "kind": "context_pack", "budget_bytes": limit_values["pack_bytes"],
+                "adaptive": True, "symbol": False, "graph": graph_selected,
+            }],
+            "graph_replacement_delta_bytes": graph_net_saved,
+        })
+    candidate = min(candidates, key=lambda item: item["treatment_bytes"]) if candidates else None
+    if candidate is None or (
+        control_bytes - int(candidate["treatment_bytes"])
+        < limit_values["minimum_gross_context_savings_bytes"]
+    ):
+        return advisory_result(
+            activation_status="bypass", decision="bypass", reason="below_break_even",
+            measurement_eligible=True, selected_features=no_features, actions=[],
+            treatment_bytes=control_bytes, graph_replacement_delta_bytes=0, **result_common,
+        )
+    if signal_values["estimated_local_overhead_ms"] > limit_values["max_local_overhead_ms"]:
+        return advisory_result(
+            activation_status="bypass", decision="bypass",
+            reason="local_overhead_budget_exceeded", measurement_eligible=True,
+            selected_features=no_features, actions=[], treatment_bytes=control_bytes,
+            graph_replacement_delta_bytes=0, **result_common,
+        )
+    if not invocation_values["explicit_wrappers_available"]:
+        return advisory_result(
+            activation_status="inactive", decision="bypass",
+            reason="explicit_wrappers_unavailable", measurement_eligible=False,
+            selected_features=no_features, actions=[], treatment_bytes=control_bytes,
+            graph_replacement_delta_bytes=0, **result_common,
+        )
+    return advisory_result(
+        activation_status="active", decision=str(candidate["decision"]),
+        reason=str(candidate["reason"]), measurement_eligible=True,
+        selected_features=dict(candidate["features"]), actions=list(candidate["actions"]),
+        treatment_bytes=int(candidate["treatment_bytes"]),
+        graph_replacement_delta_bytes=int(candidate["graph_replacement_delta_bytes"]), **result_common,
+    )
+
+
+def advisory_command(args: argparse.Namespace) -> int:
+    workload = load_advisory_json_input(args.workload, max_bytes=args.max_bytes)
+    emit(advisory_decision(workload), json_mode=args.json)
+    return 0
+
+
 def usage_int(data: dict[str, Any], key: str) -> int:
     value = data.get(key, 0)
     try:
@@ -3044,6 +3352,12 @@ def emit(data: dict[str, Any], *, json_mode: bool) -> None:
             f"candidates={routing.get('candidate_count', 0)} conditional={routing.get('conditional_count', 0)} "
             f"total_with_shift=${total.get('total_cost_with_shift_usd', 0)}"
         )
+    elif mode == "router_advisory":
+        accounting = data.get("accounting", {}) if isinstance(data.get("accounting"), dict) else {}
+        print(
+            f"{TOOL_NAME}: advisory {data.get('decision', 'bypass')} "
+            f"gross_context_bytes={accounting.get('estimated_gross_context_saved_bytes', 0)}"
+        )
     else:
         summary = data.get("summary", {}) if isinstance(data.get("summary"), dict) else {}
         print(f"{TOOL_NAME}: ledger entries={summary.get('entries', 0)}")
@@ -3113,6 +3427,19 @@ def build_parser() -> argparse.ArgumentParser:
     add_common_cost_args(route)
     route.set_defaults(func=route_advisor_command)
 
+    advisory = sub.add_parser(
+        "advisory",
+        help="plan zero-persistent-context WeightClass/router advisory actions",
+        description=(
+            "select a zero-provider-instruction bypass or explicit local wrapper from "
+            "closed numeric capability signals; never reads task text or project files"
+        ),
+    )
+    advisory.add_argument("--workload", default="-", help="closed advisory workload JSON path, or '-' for stdin")
+    advisory.add_argument("--max-bytes", type=int, default=DEFAULT_MAX_BYTES, help=f"maximum advisory JSON bytes (default: {DEFAULT_MAX_BYTES})")
+    advisory.add_argument("--json", action="store_true", help="emit machine-readable JSON")
+    advisory.set_defaults(func=advisory_command)
+
     return parser
 
 

package/plugins/context-guard/bin/context-guard-rewrite-bash

@@ -13,6 +13,7 @@ import json
 import os
 import re
 import shutil
+import stat
 import subprocess
 import sys
 
@@ -174,7 +175,35 @@ def _runtime_shell_argv() -> tuple[str, ...]:
     )
 
 
+class UnsafeAdjacentWrapperError(RuntimeError):
+    """Adjacent wrapper is not a regular file opened without symlink following."""
+
+
 def _isolated_wrapper_prefix(wrapper: str) -> list[str]:
+    # O_NOFOLLOW+fstat rejects a symlink planted before this call; it cannot
+    # close the gap between this check and the later, separate process that
+    # actually execs the returned path (the shell string this hook emits is
+    # run by the harness, not by a child of this process, so the validated
+    # fd cannot be carried across that boundary). A post-check swap of the
+    # wrapper still requires write/rename authority over the install
+    # directory itself - the same authority needed to replace the CLI - so
+    # this is accepted as a residual risk outside this hook's threat model.
+    if not hasattr(os, "O_NOFOLLOW"):
+        raise UnsafeAdjacentWrapperError("O_NOFOLLOW is required for adjacent wrappers")
+    flags = os.O_RDONLY | os.O_NOFOLLOW
+    if hasattr(os, "O_CLOEXEC"):
+        flags |= os.O_CLOEXEC
+    try:
+        fd = os.open(wrapper, flags)
+    except OSError as exc:
+        raise UnsafeAdjacentWrapperError(
+            f"wrapper could not be opened without following symlinks: {exc}"
+        ) from exc
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise UnsafeAdjacentWrapperError("wrapper is not a regular file")
+    finally:
+        os.close(fd)
     return [_approved_python_runtime(), "-I", os.path.realpath(wrapper)]
 
 # kubectl/docker/podman/oc 글로벌 옵션 중 다음 토큰을 value로 소비하는 형태.
@@ -2395,6 +2424,51 @@ def _is_explicit_noop_command(argv: tuple[str, ...]) -> bool:
     )
 
 
+def _wclass_advisory_is_safe(argv: tuple[str, ...]) -> bool:
+    # 토큰 형태(known flag/value pairing)만 검증한다 — `--repo`/`--task-file`
+    # 필수 여부나 `--vendor`의 허용값 같은 CLI 자체의 필수 옵션·enum 검증은
+    # 의도적으로 위임한다(다운스트림 argparse가 이미 거부함). 이 predicate가
+    # 막는 건 "인식 못 하는 트레일링 토큰이 조용히 통과하는 것"이지 CLI
+    # 문법 전체가 아니다.
+    if len(argv) < 2:
+        return False
+    if argv[1] == "review":
+        return len(argv) == 2
+    if argv[1] != "run":
+        return False
+
+    value_flags = {"--repo", "--task-file", "--vendor", "--workflow"}
+    confirm_seen = False
+    index = 2
+    while index < len(argv):
+        token = argv[index]
+        if token == "--confirm-task-egress":
+            confirm_seen = True
+            index += 1
+            continue
+        if "=" in token:
+            flag, value = token.split("=", 1)
+            if flag not in value_flags or not value or value.startswith("-"):
+                return False
+            index += 1
+            continue
+        if token not in value_flags or index + 1 >= len(argv):
+            return False
+        value = argv[index + 1]
+        if not value or value.startswith("-"):
+            return False
+        index += 2
+    return confirm_seen
+
+
+# 심사된 정확 이름 확장 레지스트리 — 글롭/접두사 금지(R-12의 TERM*→TERMINFO
+# 실패 재현 방지). 각 값은 서브커맨드 토큰 하나만이 아니라 argv 전체 모양을
+# 검증하는 predicate여야 한다.
+CGW_EXACT_NAME_EXTENSIONS = {
+    "wclass-advisory": _wclass_advisory_is_safe,
+}
+
+
 def command_search_diff(
     argv: tuple[str, ...],
     *,
@@ -2530,6 +2604,8 @@ def command_search_diff(
             route = "trim"
         else:
             route = "noop"
+    elif first in CGW_EXACT_NAME_EXTENSIONS:
+        route = "noop" if CGW_EXACT_NAME_EXTENSIONS[first](argv) else "deny"
     elif first in {"pytest", "tox", "jest", "vitest"}:
         route = "trim"
     elif first in {"find", "tree", "fd"}:
@@ -2834,7 +2910,7 @@ def _clear_git_command_scope_config(environment: dict[str, str]) -> None:
             environment.pop(name, None)
 
 
-def _discover_git_filter_config_keys() -> tuple[str, ...]:
+def _discover_git_filter_config_keys(git_executable: str) -> tuple[str, ...]:
     discovery_env = os.environ.copy()
     _clear_git_command_scope_config(discovery_env)
     discovery_env.update(
@@ -2846,7 +2922,7 @@ def _discover_git_filter_config_keys() -> tuple[str, ...]:
     )
     result = subprocess.run(
         [
-            "git",
+            git_executable,
             "config",
             "--null",
             "--name-only",
@@ -2903,13 +2979,14 @@ def run_guarded_git(argv: tuple[str, ...]) -> int:
         print("ContextGuard denied an invalid guarded Git invocation.", file=sys.stderr)
         return 126
     try:
-        filter_keys = _discover_git_filter_config_keys()
+        git_executable = _approved_runtime_executable("git")
+        filter_keys = _discover_git_filter_config_keys(git_executable)
         environment = _guarded_git_environment(filter_keys)
-        os.execvpe(guarded_argv[0], list(guarded_argv), environment)
+        os.execve(git_executable, list(guarded_argv), environment)
     except (OSError, RuntimeError, subprocess.SubprocessError):
         print("ContextGuard could not neutralize Git execution configuration.", file=sys.stderr)
         return 126
-    raise AssertionError("os.execvpe returned unexpectedly")
+    raise AssertionError("os.execve returned unexpectedly")
 
 
 def neutralize_git_config_execution(command: str, parsed: MiniShellParse) -> str:

package/plugins/context-guard/bin/context-guard-sanitize-output

@@ -2,8 +2,13 @@
 """Sanitize grep/diff/log output before it enters Claude context.
 
 The helper can wrap a command while preserving its exit code, or sanitize stdin.
-It redacts common credential patterns, anonymizes absolute paths by default, and
-keeps only bounded head/anchor/tail context when output is too large.
+It redacts common credential patterns unconditionally and keeps only bounded
+head/anchor/tail context when output is too large. Absolute-path anonymization
+is scoped, not default: `anonymize_paths_for_context()` only rewrites paths it
+can structurally prove are private (e.g. `filesystem_listing` matches under a
+declared private root) - the `unknown_text`/`source_code` contexts used for
+ordinary command output leave paths untouched by design, to avoid redacting
+public/unrelated paths incorrectly.
 """
 from __future__ import annotations
 

package/plugins/context-guard/bin/context-guard-trim-output

@@ -109,13 +109,22 @@ FALLBACK_INLINE_PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
     (re.compile(r"(?i)\bAIza[0-9A-Za-z_\-]{20,}\b"), "[REDACTED]"),
     (re.compile(r"\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b"), "[REDACTED]"),
     (re.compile(r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b"), "[REDACTED]"),
-    (re.compile(r"([a-z][a-z0-9+.-]*://)[^/\s:@]+:[^/\s@]+@", re.IGNORECASE), r"\1[REDACTED]@"),
+    (re.compile(r"([a-z][a-z0-9+.-]*://)[^/\s:@]+(?::[^/\s@]+)?@", re.IGNORECASE), r"\1[REDACTED]@"),
     (re.compile(rf"(?i)([?&#;](?:{SECRET_KEY})=)[^\s&#;]+"), r"\1[REDACTED]"),
     (re.compile(rf"(?i)(\b(?:{SECRET_KEY})\s*[:=]\s*)[^\s]+"), r"\1[REDACTED]"),
 )
 FALLBACK_AUTH_HEADER_RE = re.compile(
     r"(?i)^(?P<prefix>\s*(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:Proxy-)?Authorization\s*:\s*).+$"
 )
+PRIVATE_KEY_BEGIN_RE = re.compile(
+    r"-----BEGIN (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----"
+)
+PRIVATE_KEY_END_RE = re.compile(
+    r"-----END (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----"
+)
+COOKIE_HEADER_RE = re.compile(
+    r"(?i)^(?P<prefix>\s*(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:Set-)?Cookie\s*:\s*).+$"
+)
 ERROR_RE = re.compile(
     r"(FAIL|FAILED|ERROR|Error:|Exception|Traceback|AssertionError|panic:|fatal:|"
     r"segmentation fault|not ok|\bE\s+assert|\[ERROR\]|✗|✖)",
@@ -171,6 +180,7 @@ class FallbackLineSanitizer:
         self.diagnostic = diagnostic
         self.diagnostic_emitted = False
         self.redactions = 0
+        self.in_private_key_block = False
 
     def sanitize(self, raw_line: str) -> tuple[str, bool]:
         if self.diagnostic and not self.diagnostic_emitted:
@@ -178,12 +188,22 @@ class FallbackLineSanitizer:
             self.diagnostic_emitted = True
         line = strip_ansi(raw_line)
         original = line
-        auth_match = FALLBACK_AUTH_HEADER_RE.match(line)
-        if auth_match:
-            line = auth_match.group("prefix") + "[REDACTED]\n"
+        if self.in_private_key_block or PRIVATE_KEY_BEGIN_RE.search(line) or PRIVATE_KEY_END_RE.search(line):
+            line = "[REDACTED PRIVATE KEY BLOCK]\n"
+            if PRIVATE_KEY_END_RE.search(original):
+                self.in_private_key_block = False
+            elif PRIVATE_KEY_BEGIN_RE.search(original):
+                self.in_private_key_block = True
         else:
-            for pattern, repl in FALLBACK_INLINE_PATTERNS:
-                line = pattern.sub(repl, line)
+            auth_match = FALLBACK_AUTH_HEADER_RE.match(line)
+            cookie_match = COOKIE_HEADER_RE.match(line)
+            if auth_match:
+                line = auth_match.group("prefix") + "[REDACTED]\n"
+            elif cookie_match:
+                line = cookie_match.group("prefix") + "[REDACTED]\n"
+            else:
+                for pattern, repl in FALLBACK_INLINE_PATTERNS:
+                    line = pattern.sub(repl, line)
         redacted = line != original
         if redacted:
             self.redactions += 1