@kaydash9999/banker-plugins 0.15.0 → 0.15.2

package/skills/lineage/lineage.py

@@ -11,6 +11,7 @@ Auto-discovery assumes Claude Code's ~/.claude/projects/<encoded-cwd>/ layout.
 """
 import argparse
 import hashlib
+import hmac
 import html
 import json
 import math
@@ -27,13 +28,13 @@ if sys.version_info < (3, 7):
     sys.exit(2)
 
 SCHEMA_VERSION = 2          # cache dir schema (v2: redacted summaries only)
-SUMMARIZER_VERSION = 2      # bump when summarize_turn logic changes (B-3 cache key)
+SUMMARIZER_VERSION = 3      # bump when summarize_turn logic changes (B-3 cache key); 3: cut from redacted text
 USER_FOLD = 400             # collapse user messages longer than this (E-1)
 ECHO_ASK = 40               # echo-exchange: user question length ceiling (A-4)
 ECHO_REPLY = 5              # echo-exchange: assistant reply length ceiling (A-4)
 _BLOCKQUOTE_MAX_DEPTH = 32  # blockquote recursion cap (C-2)
 CACHE_BASE = pathlib.Path.home() / ".cache" / "lineage"
-REVIEW_SCHEMA = "lineage-review/1"       # --emit-review pack, read back by --apply-review
+REVIEW_SCHEMA = "lineage-review/2"       # --emit-review pack, read back by --apply-review; 2: llm_key, pages redacted (3.0.2)
 REVIEW_PART_SCHEMA = "lineage-review-part/1"
 REVIEW_PART = 40            # turns per part file: one reviewer's share
 PREVIEW_HEAD = 1500         # a long turn's preview: head + tail, where conclusions sit
@@ -41,6 +42,8 @@ PREVIEW_TAIL = 700
 SUMMARY_MAX = 120           # a reviewer's summary is cut to this, after redaction
 LLM_CACHE_VERSION = 1       # bump to drop every cached reviewer decision
 REVIEWER_TIMEOUT = 60       # --reviewer-timeout default, seconds
+DECISIONS_MAX = 1_000_000   # bytes in one decisions file (a 40-turn part answers in some 20 KB)
+DECISIONS_TRIES = 200       # places a wrapped answer's list may start, tried at most
 
 # ---------------------------------------------------------------- Noise / classify
 # NOTE: JSONL records carry RAW `<...>` tags. Every regex below uses raw `<`/`>`
@@ -219,45 +222,126 @@ def redact(text: str, extra: "str | None" = None, mode: str = "full"):
 
     if extra:
         for kw in [k.strip() for k in extra.split(",") if k.strip()]:
-            pat = re.compile(re.escape(kw), re.IGNORECASE)
-            n = len(pat.findall(out))
-            if n:
-                counts[f"custom:{kw}"] = n
-                out = pat.sub("[REDACTED]", out)
+            # a marker an earlier pass left stays whole: a keyword inside its name is no secret
+            pat = re.compile(r"\[REDACTED(?::[^\]\s]*)?\]|" + re.escape(kw), re.IGNORECASE)
+            hits = []
+            out = pat.sub(lambda m: m.group(0) if m.group(0).upper().startswith("[REDACTED")
+                          else hits.append(1) or "[REDACTED]", out)
+            if hits:
+                counts[f"custom:{kw}"] = len(hits)
     return out, counts
 
 
+# A character of curl's user before the colon: no space, : or =, and a quote, backtick or ( only
+# where no flag follows (-u, -Xu or --user, as either branch below starts) and no comma and quote
+# follow (the end of an item in an argument list written without spaces). A match starts only
+# there, so no user runs past the place where the next match may start: a long run stays linear,
+# and a user joined to a variable by a - ("$USER"-bot) is read whole.
+_CU_USER = (r"(?:[^\s:=\"'`(]|[\"'`(](?!-(?:u|[A-Za-z0-9]{1,6}u[\s\"']|-user[\s=\"'])"
+            r"|,\\{0,7}[\"']))")
+# The quotes that may open the value, bare or escaped (\" and \\\" in a quoted command, '\'' and
+# '"'"' from bash and shlex.quote, ^" in cmd, `" in PowerShell, $' in bash): up to six in a row,
+# none that closes an item of an argument list.
+_CU_LEAD = r"(?:[\\^`$]{0,7}[\"'](?!,\\{0,7}[\"'])){0,6}"
+# Values read as a whole token, past the quotes that open them, that hold no user and password: a
+# uid:gid (docker), a date format (date -u +%H:%M), two references ($UID:$GID, ${UID}:${GID},
+# %USER%:%PASS%, $(id -u):$(id -g), whose inner `-u)` is a match of its own) and a path default
+# (mktemp -u "${TMPDIR:-/tmp}/x"). A literal password, or a default that is no path or holds a
+# colon, is hidden.
+_CU_REF = r"(?:\$\{?\w+\}?|%\w+%|\$\([^\s()]*(?:\s+[^\s()]+)*\))"
+_CU_SKIP = (r"(?!" + _CU_LEAD + r"(?:\+[\"']?%[-_0^#]?[A-Za-z%]|(?:\d+:\d+|(?:" + _CU_REF
+            + r"|[^\s:=\"'`(]*\)):" + _CU_REF + r")(?![^\s\"'`;|&)\\^])"
+            r"|\$\{\w+:[-=?+]?[/~.][^\s}\"'`(:]*\}[^\s:]*(?!\S)))")
+
 # Extra patterns for text a reviewer model reads (part files) and nothing else: the page
 # and --rulebase keep the patterns above, so their output stays as it was.
+# A value a redaction already replaced: a marker ([REDACTED...]) or a value that is only a mask
+# (abcd****wxyz: up to 4 characters, a whole run of *, up to 4 characters, then the value ends; a
+# closing `, |, * or ) and then . , ; : ! ? may stand between, as in **password: ****h12** or
+# `DB_PASSWORD=****`.). The
+# reviewer patterns leave it, so a second pass over redacted text changes nothing. The check reads
+# those few characters, not the rest of the token, so a long run of keywords stays linear.
+_NOT_REDACTED = r"(?!\[REDACTED|[^\s'\"*]{0,4}\*{4,}(?!\*)[^\s'\"*]{0,4}(?=[`|*)]*[.,;:!?]*(?:[\s'\"]|$)))"
+# After a colon: not the colon of a marker an earlier pass left ([REDACTED:GitHubPAT]), which
+# splits no user from a password. A whole marker is one piece of a user: a key an earlier pattern
+# of this pass hid ([REDACTED:OpenAIKey]:pw) still has its password hidden.
+_NOT_MARKED = r"(?<!\[REDACTED:)"
+_MARKER_UNIT = r"\[REDACTED:\w+\]"
+
 REVIEW_SECRET_PATTERNS = [
     ("AnthropicKey", re.compile(r"(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,}")),
     ("OpenAIKey", re.compile(r"(?<![A-Za-z0-9-])sk-(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}")),
     ("GoogleKey", re.compile(r"(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}")),
     # bounded repeats: a long run of `key` or `a.` would otherwise take quadratic time
     ("HexKey", re.compile(r"(?i)(?:key|token|secret)[\w-]{0,100}\s*[:=]\s*['\"]?[0-9a-f]{32,}")),
+    # a value, not a path, a variable or a redaction ($PWD is a variable, PGPASSWORD a name);
+    # markdown, a table cell or a bracket that closes after the value stays outside the match
     ("PasswordBare", re.compile(
-        r"(?i)(?:password|passwd|passcode|pwd|암호|비번|비밀\s?번호|패스워드)\s*[:=]\s*[^\s'\"]{6,}")),
-    # the password runs to the last @ before the host: it may hold an @ of its own
-    ("UrlCredential", re.compile(r"(?i)[a-z][a-z0-9+.-]{0,30}://[^\s:@/]*:[^\s/]{3,}@")),
+        r"(?i)(?<!\$)(?:password|passwd|passcode|pwd|암호|비번|비밀\s?번호|패스워드)\s*[:=]\s*"
+        r"(?![/~$])" + _NOT_REDACTED + r"(?=[^\s'\"]{6})[^\s'\"]*[^\s'\"`|*)]")),
+    # the password runs to the last @ before the host: it may hold an @ of its own. A marker is
+    # no user or password, so a second pass leaves a token-only URL (https://[REDACTED:...]@host).
+    ("UrlCredential", re.compile(r"(?i)[a-z][a-z0-9+.-]{0,30}://(?:" + _MARKER_UNIT + r"|[^\s:@/])*:" + _NOT_MARKED
+                                 + r"(?!\[REDACTED)[^\s/]{3,}@")),
     ("Bearer", re.compile(r"(?i)\bbearer\s+[A-Za-z0-9._~+/=-]{16,}")),
-    ("BasicAuth", re.compile(r"(?i)\bauthorization[\"']?\s*[:=]\s*[\"']?basic\s+[A-Za-z0-9+/]{8,}={0,2}")),
-    # curl's -u and --user flags with a user and password pair after a space, an = or nothing;
-    # the separators share no character with the user name, so a long run of them stays linear.
-    # A uid:gid (docker) and a host:/path (rsync) are left.
-    ("CurlUser", re.compile(r"(?<!\S)(?:-u\s*|--user(?:\s+|=))(?!\d+:\d+\b(?![:@]))[^\s:=]+:(?!/)\S{3,}")),
+    # Authorization then `:`, `=`, `=>` or headers["Authorization"] =, a call's ("Authorization",
+    # "...") and a HAR name/value pair, or a space before a quote (nginx, Apache)
+    ("BasicAuth", re.compile(
+        r"(?i)\bauthorization"
+        r"(?:[\"']?\]?\s*(?:=>|[:=])"
+        r"|[\"']\s*,\s*(?:[\"']value[\"']\s*:\s*)?(?=[\"'])"
+        r"|\s+(?=[\"']))"
+        r"\s*[\"']?basic\s+[A-Za-z0-9+/]{8,}={0,2}")),
+    # curl's -u and --user flags, alone or last in a bundle (-su, -4u), with a user and password
+    # after a space, an = or nothing, quoted together or apart ("user":"pw"), with quotes bare,
+    # escaped or nested (_CU_LEAD) or none, in inline code or parentheses, or as two items of an
+    # argument list (quotes bare or escaped, with or without spaces; a host:/path is left). An
+    # empty user with a token, and a
+    # long key as the user with no password, count too. The separators share no character with
+    # the user name, so a long run of them stays linear. The values _CU_SKIP names and a
+    # host:/path (rsync) are left, and so is a marker an earlier pass left (-u [REDACTED:JWT]).
+    ("CurlUser", re.compile(
+        r"(?<![^\s\"'`(])(?:-u\s*|-[A-Za-z0-9]{1,6}u\s+|--user(?:\s+|=))" + _CU_SKIP + _CU_LEAD
+        + r"(?:(?:" + _MARKER_UNIT + r"|" + _CU_USER + r")*:" + _NOT_MARKED + r"(?!/|\[REDACTED)\S{3,}|" + _CU_USER
+        + r"{15,}:" + _NOT_MARKED
+        + r"(?=[\s\"'`).,;\\]|$))"
+        r"|(\\{0,7}[\"'])(?:-[A-Za-z0-9]{0,6}u|--user)\1\s*,\s*(\\{0,7}[\"'])" + _CU_SKIP
+        + r"(?:(?:" + _MARKER_UNIT + r"|" + _CU_USER + r")*:" + _NOT_MARKED + r"(?!/|\[REDACTED)[^\s\"']{3,}|"
+        + _CU_USER + r"{15,}:"
+        + _NOT_MARKED + r")\2")),
 ]
 
 
+def _reviewer_patterns(text):
+    """`text` with what the reviewer patterns find replaced whole by [REDACTED:<name>], and the
+    count by name."""
+    counts = {}
+    for name, pat in REVIEW_SECRET_PATTERNS:
+        text, k = pat.subn(f"[REDACTED:{name}]", text)
+        if k:
+            counts[name] = k
+    return text, counts
+
+
 def review_redact(text, extra=None):
     """Text as a reviewer model reads it: the reviewer-only patterns first, while the keys
     are whole (the entropy rule would otherwise cut a key and leave the rest), then fully
     redacted (never masked, whatever --redact-mode says). Returns (text, count)."""
-    n = 0
-    for name, pat in REVIEW_SECRET_PATTERNS:
-        text, k = pat.subn(f"[REDACTED:{name}]", text)
-        n += k
-    red, found = redact(text, extra=extra, mode="full")
-    return red, n + sum(found.values())
+    pre, counts = _reviewer_patterns(text)
+    red, found = redact(pre, extra=extra, mode="full")
+    return red, sum(counts.values()) + sum(found.values())
+
+
+def page_redact(text, extra=None, mode="full"):
+    """Text as every page shows it (3.0.2): the reviewer patterns first, while keys are whole,
+    each hit replaced whole whatever --redact-mode says (a mask keeps 4+4 characters, most of
+    a short password); then the page's redaction with this run's mode and keywords. Returns
+    (text, count_by_kind); a second pass over its output finds nothing."""
+    pre, counts = _reviewer_patterns(text)
+    red, found = redact(pre, extra=extra, mode=mode)
+    for k, v in found.items():
+        counts[k] = counts.get(k, 0) + v
+    return red, counts
 
 
 # ---------------------------------------------------------------- Discovery
@@ -533,9 +617,15 @@ SHORT_DETAIL = 160
 SINGLE_SPLIT_MIN = SHORT_DETAIL
 
 
+_OPEN_MARKER_RE = re.compile(r"\[REDACTED[^\]]*$")
+
+
 def _cut(s, n):
     s = s.strip()
-    return s if len(s) <= n else s[:max(1, n - 1)].rstrip() + "…"
+    if len(s) <= n:
+        return s
+    head = _OPEN_MARKER_RE.sub("", s[:max(1, n - 1)])   # a marker cut in two goes whole
+    return head.rstrip() + "…"
 
 
 def naive_summary(text: str) -> str:
@@ -596,6 +686,35 @@ def summarize_turn(turn):
 
 
 # ---------------------------------------------------------------- Summary cache
+def _stdin_id_key():
+    """The key that turns a pasted turn's text into its id: random, kept 0600 in the cache folder,
+    so ids (and the caches keyed on them) stay the same on this machine. Part files carry the id
+    to a model that never sees the key, so an id gives no way to test a guessed password. With no
+    cache folder to keep it in, the key lasts one run."""
+    path = CACHE_BASE / "stdin-id.key"
+    try:
+        key = path.read_bytes()
+        if len(key) == 32:
+            return key
+    except OSError:
+        pass
+    key = os.urandom(32)
+    tmp = path.with_name("%s.%d" % (path.name, os.getpid()))
+    try:
+        CACHE_BASE.mkdir(parents=True, exist_ok=True)
+        os.chmod(str(CACHE_BASE), 0o700)
+        fd = os.open(str(tmp), os.O_WRONLY | os.O_CREAT | os.O_TRUNC | getattr(os, "O_BINARY", 0), 0o600)
+        with os.fdopen(fd, "wb") as f:
+            f.write(key)
+        os.replace(str(tmp), str(path))           # whole or not at all
+    except OSError:
+        try:
+            os.unlink(str(tmp))
+        except OSError:
+            pass
+    return key
+
+
 def cache_dir(session_id: str):
     d = CACHE_BASE / str(SCHEMA_VERSION) / (session_id or "default")
     d.mkdir(parents=True, exist_ok=True)
@@ -607,11 +726,19 @@ def cache_dir(session_id: str):
     return d
 
 
+def _page_clean_turn(t, extra, mode):
+    """`t` with its text and parts as a page shows them, so a summary cut from it cannot cut a
+    secret in two and keep the half no pattern recognises."""
+    def clean(s):
+        return page_redact(s, extra, mode)[0]
+    return dict(t, text=clean(t["text"]), parts=[clean(p) for p in t.get("parts") or []])
+
+
 def read_or_summarize(turn: dict, session_id: str, rebuild: bool = False,
                       redact_extra=None, redact_mode: str = "full"):
     """Return (summary, cache_hit). Cache key includes the content hash AND the
     summarizer version (B-3), so changing the summarizer invalidates old entries.
-    Cached text is always redacted (secret hygiene).
+    Cached text is always redacted (secret hygiene). It is cut from the redacted text (3.0.2).
     """
     digest = hashlib.sha256(
         (turn["text"] + "\x00s" + str(SUMMARIZER_VERSION)).encode()
@@ -627,8 +754,7 @@ def read_or_summarize(turn: dict, session_id: str, rebuild: bool = False,
             return p.read_text(encoding="utf-8").strip(), True
         except (OSError, UnicodeDecodeError):
             pass
-    raw_summary = summarize_turn(turn)
-    redacted, _ = redact(raw_summary, extra=redact_extra, mode=redact_mode)
+    redacted = summarize_turn(_page_clean_turn(turn, redact_extra, redact_mode))
     if p is not None:
         try:
             fd = os.open(str(p), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
@@ -1016,7 +1142,7 @@ def render_rows(turns, session_id, redact_extra, redact_mode, rebuild,
     open_attr = " open" if open_details else ""
 
     def _red(text):
-        r, c = redact(text, extra=redact_extra, mode=redact_mode)
+        r, c = page_redact(text, extra=redact_extra, mode=redact_mode)
         for k, v in c.items():
             redact_counts[k] = redact_counts.get(k, 0) + v
         return r
@@ -1026,7 +1152,7 @@ def render_rows(turns, session_id, redact_extra, redact_mode, rebuild,
         # session-transition divider (--all-sessions)
         if all_sessions and t.get("session") != last_session:
             last_session = t.get("session")
-            name = html.escape(t.get("session_name") or last_session or "session")
+            name = html.escape(_red(t.get("session_name") or last_session or "session"))
             rows.append('<div class="day" data-mark="%s">'
                         '<span class="pill pill-session">%s</span></div>'
                         % (name, name))
@@ -1076,13 +1202,14 @@ def render_rows(turns, session_id, redact_extra, redact_mode, rebuild,
 
         tools_html = ""
         if t.get("tools"):
-            ts_list = ", ".join(f"{k}×{v}" for k, v in sorted(t["tools"].items()))
+            ts_list = ", ".join(f"{_hide_keywords(k, redact_extra)}×{v}"
+                                for k, v in sorted(t["tools"].items()))
             total = sum(t["tools"].values())
             tools_html = ('<div class="tools">🔧 도구 %d건: %s</div>'
                           % (total, html.escape(ts_list)))
 
         if role == "agent":
-            who = html.escape(t.get("agent_from") or "agent")
+            who = html.escape(_red(t.get("agent_from") or "agent"))
             avatar = "🤝"
             from_line = '<div class="from">%s</div>' % who
             row_cls = "row bot agent"
@@ -1102,6 +1229,21 @@ def render_rows(turns, session_id, redact_extra, redact_mode, rebuild,
     return rows, redact_counts, cache_hits, cache_total
 
 
+_TAG_RE = re.compile(r"<[^>]*>")
+
+
+def _residual_secrets(rows_html):
+    """What the reviewer patterns still find in a page's text (tags dropped, entities decoded),
+    by pattern name: a field the page forgot to redact."""
+    text = html.unescape(_TAG_RE.sub(" ", rows_html))
+    left = {}
+    for name, pat in REVIEW_SECRET_PATTERNS:
+        n = len(pat.findall(text))
+        if n:
+            left[name] = n
+    return left
+
+
 # ---------------------------------------------------------------- Self-verify (F-1)
 _VOID = frozenset(
     "area base br col embed hr img input link meta param source track wbr".split())
@@ -1244,18 +1386,23 @@ def _decision_context(why, keeps):
                      str(keeps.get("keep_tool_only") is True)])
 
 
-def _llm_cache_path(turn_id, session, redacted_text, context):
-    digest = hashlib.sha256((redacted_text + "\x00llm" + str(LLM_CACHE_VERSION)
-                             + "\x00" + context).encode()).hexdigest()[:12]
-    return cache_dir(_safe_name(session)) / f"{_safe_name(turn_id)}-{digest}-llm.json"
+def _llm_digest(redacted_text, context):
+    """The decision cache key: the text with the page's patterns only (as 3.0.1 keyed it, so
+    no turn is reviewed again for 3.0.2), the cache version and what the decision rests on."""
+    return hashlib.sha256((redacted_text + "\x00llm" + str(LLM_CACHE_VERSION)
+                           + "\x00" + context).encode()).hexdigest()[:12]
+
+
+def _llm_cache_path(turn_id, session, digest):
+    return cache_dir(_safe_name(session)) / f"{_safe_name(turn_id)}-{_safe_name(digest)}-llm.json"
 
 
-def read_llm_cache(turn_id, session, redacted_text, context):
+def read_llm_cache(turn_id, session, digest):
     """A reviewer's earlier {keep, summary} for this exact (redacted) text under the same
     rule call and keep flags (`context`), or None when no reviewer saw it so. Both values
     null: the reviewer left the turn to the rules."""
     try:
-        path = _llm_cache_path(turn_id, session, redacted_text, context)
+        path = _llm_cache_path(turn_id, session, digest)
     except OSError as e:                          # no cache folder (a read-only HOME, say)
         _warn_once("_no_llm_cache", f"reviewer decision cache unavailable ({e}); "
                    "every turn is reviewed")
@@ -1272,9 +1419,9 @@ def read_llm_cache(turn_id, session, redacted_text, context):
     return {"keep": keep, "summary": summary}
 
 
-def write_llm_cache(turn_id, session, redacted_text, context, keep, summary):
+def write_llm_cache(turn_id, session, digest, keep, summary):
     try:
-        _write_private(_llm_cache_path(turn_id, session, redacted_text, context),
+        _write_private(_llm_cache_path(turn_id, session, digest),
                        json.dumps({"keep": keep, "summary": summary}, ensure_ascii=False))
     except OSError as e:
         _warn_once("_no_llm_cache_write", f"reviewer decisions not cached ({e}); the next "
@@ -1336,7 +1483,7 @@ def _rule_summary(t, red, args):
     The summary cache is keyed on the text alone, so a cached one may predate a
     --redact-extra keyword or carry another --redact-mode."""
     if t["role"] in ("assistant", "agent"):
-        return redact(summarize_turn(t), extra=args.redact_extra, mode=args.redact_mode)[0]
+        return summarize_turn(_page_clean_turn(t, args.redact_extra, args.redact_mode))
     if t["role"] == "user" and len(red) > USER_FOLD:
         return user_fold_summary(red)
     return None
@@ -1365,18 +1512,22 @@ def _review_view(t, red, args):
 
 
 def _pack_turn(n, t, tid, why, session_id, args, counts):
-    """One turn of the pack under its final id `tid` (redacted text, the rules' decision,
-    the reviewer's slot), and the reviewer's view of it."""
-    red, found = redact(t["text"], extra=args.redact_extra, mode=args.redact_mode)
+    """One turn of the pack under its final id `tid` (the text as the page shows it, the rules'
+    decision, the reviewer's slot), and the reviewer's view of it. The cached decision keys on
+    the text with the page's patterns only (`llm_key`), as 3.0.1 did."""
+    red, found = page_redact(t["text"], extra=args.redact_extra, mode=args.redact_mode)
     for k, v in found.items():
         counts[k] = counts.get(k, 0) + v
+    hit = any(name in found for name, _ in REVIEW_SECRET_PATTERNS)
+    key_text = redact(t["text"], extra=args.redact_extra, mode=args.redact_mode)[0] if hit else red
     preview, clipped = _preview(review_redact(t["text"], args.redact_extra)[0])
     session = t.get("session") or session_id
     context = _decision_context(why, _keeps(args))
-    cached = None if args.rebuild_summaries else read_llm_cache(tid, session, red, context)
+    llm_key = _llm_digest(key_text, context)
+    cached = None if args.rebuild_summaries else read_llm_cache(tid, session, llm_key)
     view = _review_view(t, red, args)
     turn = {"id": tid, "n": n, "role": t["role"], "ts": t.get("ts") or "",
-            "tools": dict(t.get("tools") or {}), "text": red,
+            "tools": dict(t.get("tools") or {}), "text": red, "llm_key": llm_key,
             "redactions": _public_counts(found), "preview": preview, "clipped": clipped,
             "rule": {"keep": why is None, "why": why,
                      "summary": _rule_summary(t, red, args),
@@ -1386,7 +1537,7 @@ def _pack_turn(n, t, tid, why, session_id, args, counts):
         turn["meta"] = True
     for k in ("session", "session_name", "agent_from"):
         if t.get(k):
-            turn[k] = t[k]
+            turn[k] = t[k] if k == "session" else page_redact(t[k], args.redact_extra, args.redact_mode)[0]
     return turn, view
 
 
@@ -1416,12 +1567,14 @@ def _decisions_name(part_path):
 
 def _clear_parts(pack_path):
     """Remove the part and decisions files an earlier --emit-review left beside the
-    pack: that run's decisions must not be applied to this one. Returns the files it
-    could not remove."""
+    pack, and an earlier gate's samples: that run's decisions must not be applied to this
+    one, and its samples would stop this pack's rerun. Returns the files it could not
+    remove."""
     prefix = pack_path.stem + ".part-"
+    samples = f"{pack_path.stem}.reviewer-input.json"
     try:
         olds = [p for p in pack_path.parent.iterdir()
-                if p.name.startswith(prefix) and p.name.endswith(".json")]
+                if (p.name.startswith(prefix) and p.name.endswith(".json")) or p.name == samples]
     except OSError:
         return []
     failed = []
@@ -1450,7 +1603,7 @@ def _sheet(k, of, part_path, group, args):
     turns = []
     for x, view in group:
         y = {key: v for key, v in x.items()
-             if key not in ("text", "session", "session_name", "agent_from", "redactions")}
+             if key not in ("text", "session", "session_name", "agent_from", "redactions", "llm_key")}
         y["rule"] = {k: v for k, v in x["rule"].items() if k != "review_summary"}
         y["rule"]["summary"] = view["summary"]
         y["tools"] = {_hide_keywords(name, args.redact_extra): n for name, n in x["tools"].items()}
@@ -1490,7 +1643,13 @@ def _report_emit(pack_path, items, paths, groups):
 
 
 def emit_review(turns, drops, window, session_id, output, args):
-    """Write the pack and one part file per reviewer; print them and the next step."""
+    """Write the pack and one part file per reviewer; print them and the next step. A
+    --reviewer-output that holds something other than a verdict list stops it here, before
+    any reviewer runs: the gate would refuse it only after them."""
+    rop = pathlib.Path(args.reviewer_output) if args.reviewer_output and not args.skip_reviewer else None
+    if rop is not None and rop.exists() and not _is_verdict_file(rop):
+        _bad(f"{rop} is there and is not a verdict list; give a --reviewer-output that does not exist yet")
+        return 2
     pack_path = pathlib.Path(args.emit_review)
     counts, pairs = {}, []
     for n, (i, tid) in enumerate(zip(window, _final_ids(turns, window)), 1):
@@ -1522,7 +1681,7 @@ def emit_review(turns, drops, window, session_id, output, args):
 def _is_pack_turn(x):
     return (isinstance(x, dict) and isinstance(x.get("id"), str)
             and x.get("role") in ("user", "assistant", "agent", "mark")
-            and isinstance(x.get("text"), str)
+            and isinstance(x.get("text"), str) and isinstance(x.get("llm_key"), str)
             and isinstance(x.get("rule"), dict) and isinstance(x["rule"].get("keep"), bool)
             and _is_summary(x["rule"].get("summary"))
             and isinstance(x.get("llm"), dict) and _is_keep(x["llm"].get("keep"))
@@ -1535,7 +1694,8 @@ def _load_pack(path):
     except (OSError, ValueError, UnicodeDecodeError) as e:
         return _bad(f"cannot read review pack {path}: {e}")
     if not isinstance(pack, dict) or pack.get("schema") != REVIEW_SCHEMA:
-        return _bad(f"{path} is not a {REVIEW_SCHEMA} pack")
+        return _bad(f"{path} is not a {REVIEW_SCHEMA} pack (made by another lineage version? "
+                    "run --emit-review again)")
     if not isinstance(pack.get("turns"), list) or not all(map(_is_pack_turn, pack["turns"])):
         return _bad(f"{path}: malformed turns")
     return pack
@@ -1584,8 +1744,12 @@ def _decisions_text(text):
         pass
     lists, empty = [], False
     decoder = json.JSONDecoder()
-    # only where a list of objects or an empty list can start: a run of `[` is tried once
-    for m in re.finditer(r"\[(?=\s*[{\]])", text):
+    # only where a list of objects or an empty list can start: a run of `[` is tried once,
+    # and only so many starts (each failed try parses up to the nesting limit)
+    for k, m in enumerate(re.finditer(r"\[(?=\s*[{\]])", text)):
+        if k == DECISIONS_TRIES:
+            raise ValueError(f"more than {DECISIONS_TRIES} places a list may start; "
+                             "write the bare JSON array")
         try:
             got, _ = decoder.raw_decode(text, m.start())
         except (ValueError, RecursionError):
@@ -1618,6 +1782,8 @@ def _load_decisions(files):
     merged = {}
     for f in files:
         try:
+            if f.stat().st_size > DECISIONS_MAX:
+                raise ValueError(f"larger than {DECISIONS_MAX} bytes")
             items = _decisions_text(f.read_text(encoding="utf-8"))
         except (OSError, ValueError, UnicodeDecodeError, RecursionError) as e:
             return _bad(f"cannot read decisions {f}: {e}")
@@ -1714,10 +1880,11 @@ def _kept_by_flag(pack, x):
 
 
 def _review_result(pack, merged, args):
-    """(turns to render, their summaries, cache writes, counts, prior redactions) from the
-    pack and the decisions: a reviewer's value first, then the pack's cached one, then the
-    rules'. A keep flag outranks a reviewer's `false`; the cache still gets what was said."""
-    turns, summaries, writes, prior = [], {}, [], {}
+    """(turns to render, their summaries, cache writes, counts, prior redactions, the ids of
+    turns the user typed that the reviewers dropped) from the pack and the decisions: a
+    reviewer's value first, then the pack's cached one, then the rules'. A keep flag outranks
+    a reviewer's `false`; the cache still gets what was said."""
+    turns, summaries, writes, prior, typed = [], {}, [], {}, []
     stats = {"restored": 0, "dropped": 0, "reviewer": 0, "rule": 0, "ignored": 0,
              "hidden": 0, "flag-kept": 0}
     for x in pack["turns"]:
@@ -1726,15 +1893,17 @@ def _review_result(pack, merged, args):
         held = llm_keep is False and _kept_by_flag(pack, x)
         stats["flag-kept"] += held
         keep = bool(_first(None if held else llm_keep, x["rule"]["keep"]))
+        if not keep and x["role"] == "user" and x["rule"]["keep"] and not x.get("meta"):
+            typed.append(x["id"])               # typed by the user: the rules keep these
         llm_summary = _reviewer_summary(x, d, args, stats)
         if x["id"] in merged:                    # reviewed, even if left to the rules
-            writes.append((x["id"], x.get("session") or pack.get("source"), x["text"],
-                           _decision_context(x["rule"].get("why"), pack), llm_keep, llm_summary))
+            writes.append((x["id"], x.get("session") or pack.get("source"), x["llm_key"],
+                           llm_keep, llm_summary))
         stats["restored"] += keep and not x["rule"]["keep"]
         stats["dropped"] += x["rule"]["keep"] and not keep
         if keep:
             _show(x, llm_summary, turns, summaries, stats, prior)
-    return turns, summaries, writes, stats, prior
+    return turns, summaries, writes, stats, prior, typed
 
 
 def _gate_from_pack(args, pack):
@@ -1788,6 +1957,40 @@ def _remove_review_files(pack_path, pack):
               file=sys.stderr)
 
 
+def _samples_left_unread(pack_path, args):
+    """True, with the reason, when a gated run left its samples beside the pack and this run
+    gives neither a verdict path nor --skip-reviewer: it would pass over that run's verdict."""
+    left = pack_path.with_name(f"{pack_path.stem}.reviewer-input.json")
+    if left.exists() and not (args.reviewer_output or args.skip_reviewer):
+        _bad(f"{left} was left by a gated run; give its --reviewer-output again, or --skip-reviewer")
+        return True
+    return False
+
+
+def _review_output(args, pack):
+    """The page path: the pack's when this run gives none, else the given one with the pack's
+    stamp, so the gate's runs write one page."""
+    if args.output is None:
+        return pack.get("output") or "work/lineage-review.html"
+    return _with_pack_stamp(args.output, pack.get("output"))
+
+
+def _report_review(stats, turns, pack, typed):
+    """What the render took from the reviewers, and the turns typed by the user they dropped."""
+    print(f"[lineage] review applied: shown={len(turns)}/{len(pack['turns'])} "
+          f"restored={stats['restored']} dropped={stats['dropped']} "
+          f"summaries reviewer={stats['reviewer']} rule={stats['rule']}", file=sys.stderr)
+    if stats["ignored"]:
+        print(f"[lineage] note: {stats['ignored']} summaries for turns the page shows "
+              "in full were ignored", file=sys.stderr)
+    if stats["flag-kept"]:
+        print(f"[lineage] note: {stats['flag-kept']} turn(s) a reviewer marked keep: false "
+              "stay, as --keep-trivia or --keep-tool-only asked", file=sys.stderr)
+    if typed:
+        print(f"[lineage] WARN: reviewers dropped {len(typed)} typed user turn(s): {', '.join(typed[:10])}"
+              f"{' ...' if len(typed) > 10 else ''}; tell the user", file=sys.stderr)
+
+
 def apply_review(args):
     """Render from a review pack and its decisions; cache the reviewers' values and, after
     a good render, remove the review files."""
@@ -1799,9 +2002,10 @@ def apply_review(args):
     if merged is None:
         return 2
     _check_pack(pack, merged, args)
-    turns, summaries, writes, stats, prior = _review_result(pack, merged, args)
-    if args.output is None:
-        args.output = pack.get("output") or "work/lineage-review.html"
+    if _samples_left_unread(pack_path, args):
+        return 2
+    turns, summaries, writes, stats, prior, typed = _review_result(pack, merged, args)
+    args.output = _review_output(args, pack)
     if stats["hidden"]:
         prior["reviewer-summary"] = stats["hidden"]
     try:
@@ -1817,15 +2021,7 @@ def apply_review(args):
         for w in writes:
             write_llm_cache(*w)
         _remove_review_files(pack_path, pack)
-    print(f"[lineage] review applied: shown={len(turns)}/{len(pack['turns'])} "
-          f"restored={stats['restored']} dropped={stats['dropped']} "
-          f"summaries reviewer={stats['reviewer']} rule={stats['rule']}", file=sys.stderr)
-    if stats["ignored"]:
-        print(f"[lineage] note: {stats['ignored']} summaries for turns the page shows "
-              "in full were ignored", file=sys.stderr)
-    if stats["flag-kept"]:
-        print(f"[lineage] note: {stats['flag-kept']} turn(s) a reviewer marked keep: false "
-              "stay, as --keep-trivia or --keep-tool-only asked", file=sys.stderr)
+    _report_review(stats, turns, pack, typed)
     return rc
 
 
@@ -1858,7 +2054,8 @@ def build_arg_parser() -> argparse.ArgumentParser:
     ap.add_argument("--reviewer-output",
                     help="path to Critic response JSON; enforces the quality gate")
     ap.add_argument("--reviewer-timeout", type=int, default=None,
-                    help="seconds to wait for reviewer-output (default 60)")
+                    help="seconds to wait for reviewer-output (default 60 with --rulebase; "
+                         "the reviewed flow waits only when this is given)")
     ap.add_argument("--title", default="Session Lineage", help="HTML title")
     _add_review_args(ap)
     # Readability defaults are ON. Opt-out flags restore raw/older behavior.
@@ -2011,10 +2208,11 @@ def main(argv=None) -> int:
     except SystemExit as e:
         return int(e.code) if isinstance(e.code, int) else 2
 
-    # stdin → derive per-turn uuid from content hash so cache works
+    # stdin → derive per-turn uuid from the content so the caches work (keyed: see _stdin_id_key)
     if args.from_transcript == "-":
+        key = _stdin_id_key()
         for t in turns:
-            t["uuid"] = hashlib.sha256(str(t["text"]).encode()).hexdigest()[:16]
+            t["uuid"] = hmac.new(key, str(t["text"]).encode(), hashlib.sha256).hexdigest()[:16]
 
     # ---- Pipeline order (R6): classify → merge → echo → hide-tool-only → range ----
     turns = classify_turns(turns, drop_trivia=args.drop_trivia)
@@ -2081,10 +2279,15 @@ def select_range(turns, args):
 
 
 def default_output(args, jsonl_path, session_id):
-    """work/lineage-<session name or id>.html, or args.output when given."""
+    """work/lineage-<session name or id>.html, or args.output when given. A name that holds a
+    secret-like string gives way to the session id."""
     if args.output is not None:
         return args.output
     session_name = discover_session_name(jsonl_path) if jsonl_path else None
+    if session_name and page_redact(session_name)[0] != session_name:
+        print(f"[lineage] session name: {page_redact(session_name)[0]} "
+              "(holds a secret-like string; the file is named by the session id)", file=sys.stderr)
+        session_name = None
     slug = ("all-sessions" if args.all_sessions
             else (session_name or session_id[:8]))
     if session_name:
@@ -2103,6 +2306,13 @@ def render_and_write(turns, session_id, args, all_sessions=False, markdown=True,
         markdown=markdown, all_sessions=all_sessions, summaries=summaries)
     for k, v in (prior_redactions or {}).items():
         redact_counts[k] = redact_counts.get(k, 0) + v
+    left = _residual_secrets("\n".join(rows))
+    if left:
+        print("[lineage] WARN: the page still holds secret-like text ("
+              + ", ".join(f"{k}={v}" for k, v in sorted(left.items()))
+              + "); check the page before sharing it, or run again with the value in LINEAGE_REDACT_EXTRA"
+              " (with --rulebase, add --rebuild-summaries)",
+              file=sys.stderr)
 
     date_range = ""
     dated = [t for t in turns if t.get("ts")]
@@ -2137,6 +2347,16 @@ def render_and_write(turns, session_id, args, all_sessions=False, markdown=True,
     return 0
 
 
+def _with_pack_stamp(output, pack_output):
+    """`output` with the `_YYMMDD+HHMM` stamp of the pack's own output, so the gate's runs
+    minutes apart write one page; as given when it has a stamp or the pack's output has none."""
+    stamp = re.search(r"_\d{6}\+\d{4}$", pathlib.Path(str(pack_output or "")).stem)
+    out = pathlib.Path(output)
+    if stamp and not re.search(r"_\d{6}\+\d{4}$", out.stem):
+        return str(out.with_name(f"{out.stem}{stamp.group(0)}{out.suffix}"))
+    return output
+
+
 def _with_timestamp_suffix(path_str):
     """Append `_YYMMDD+HHMM` before the extension (idempotent)."""
     import datetime as _dt
@@ -2149,7 +2369,8 @@ def _with_timestamp_suffix(path_str):
 
 def _gate_samples(bots, summaries, session_id, args):
     """Up to 5 bot turns as the gate's critic reads them. --rulebase keeps the 2.x shape
-    (random turns, page redaction). With reviewer summaries (the default flow) the pick is
+    (random turns); a model reads the samples, so every value is hidden whole before the cut,
+    as in part files (3.0.2). With reviewer summaries (the default flow) the pick is
     seeded by the turns, so a rerun on the same turns samples the same ones, and a sample
     names its turn and shows the head and tail the reviewer saw, fully redacted."""
     import random
@@ -2158,8 +2379,8 @@ def _gate_samples(bots, summaries, session_id, args):
         for i, t in enumerate(random.sample(bots, min(5, len(bots)))):
             s, _ = _page_summary(t, summaries, session_id, False,
                                  args.redact_extra, args.redact_mode)
-            red_s, _ = redact(s, extra=args.redact_extra, mode=args.redact_mode)
-            red_d, _ = redact(t["text"][:500], extra=args.redact_extra, mode=args.redact_mode)
+            red_s = review_redact(_MASKED.sub("[REDACTED]", s), args.redact_extra)[0]
+            red_d = review_redact(t["text"], args.redact_extra)[0][:500]
             out.append({"idx": i, "original_detail": red_d, "generated_summary": red_s})
         return out
     seed = hashlib.sha256("\x00".join(t["uuid"] for t in bots).encode()).hexdigest()
@@ -2206,22 +2427,41 @@ def _refuse_non_verdict(rop):
     p = pathlib.Path(rop) if rop else None
     if p is None or not p.exists() or _is_verdict_file(p):
         return
-    print(f"[lineage] ERROR: {rop} is not a verdict list; if the session wrote it, write it "
-          "again as a bare JSON array of {idx, id, key, recoverable, reason}, else give a "
-          "--reviewer-output that does not exist yet", file=sys.stderr)
+    if _json_list(p):   # step 8: written again, the same answer fails the same way
+        why = ("it is a JSON array where no entry names idx; if the session wrote the critic's "
+               "answer, have the critic judge the samples again (a failed gate run)")
+    else:
+        why = ("if the session wrote it, write it again as a bare JSON array of "
+               "{idx, id, key, recoverable, reason}")
+    print(f"[lineage] ERROR: {rop} is not a verdict list; {why}, else give a --reviewer-output "
+          "that does not exist yet", file=sys.stderr)
     raise SystemExit(2)
 
 
-def _is_verdict_file(p):
-    """True when `p` is a file holding a critic's verdict: a non-empty JSON list of objects
-    that each name an `idx`. A list of anything else (a user's data file) is not one."""
+def _json_list(p):
+    """True when `p` is a file holding a JSON array, whatever its entries."""
+    try:
+        return p.is_file() and isinstance(json.loads(p.read_text(encoding="utf-8")), list)
+    except (OSError, ValueError, UnicodeDecodeError, RecursionError):
+        return False
+
+
+def _is_verdict_file(p, every=False):
+    """True when `p` is a file holding a critic's verdict: a JSON list with at least one
+    object that names an `idx`. A list of anything else (a user's data file) is not one; a
+    verdict with an entry short of its idx is one, and the coverage check says what it
+    misses. With `every`, each entry must be such an object: only that file may be written
+    over, so a user's list holding one such object among other data stays."""
     if not p.is_file():
         return False
     try:
         got = json.loads(p.read_text(encoding="utf-8"))
     except (OSError, ValueError, UnicodeDecodeError, RecursionError):
         return False
-    return isinstance(got, list) and bool(got) and all(isinstance(v, dict) and "idx" in v for v in got)
+    if not isinstance(got, list):
+        return False
+    named = [isinstance(v, dict) and "idx" in v for v in got]
+    return bool(named) and all(named) if every else any(named)
 
 
 def _write_gate_samples(bots, out, summaries, session_id, args):
@@ -2251,6 +2491,8 @@ def _write_gate_samples(bots, out, summaries, session_id, args):
         print("[lineage] next: invoke Skill('oh-my-claudecode:critic') with "
               "the JSON above; expected [{idx, recoverable, reason}, ...] "
               "(PASS = 5/5 recoverable)", file=sys.stderr, flush=True)
+    elif pathlib.Path(args.reviewer_output).exists():
+        print(f"[lineage] reading the verdict at {args.reviewer_output}", file=sys.stderr, flush=True)
     else:
         print(f"[lineage] next: have a critic agent judge the JSON above and write its "
               f"[{{idx, id, key, recoverable, reason}}, ...] to {args.reviewer_output} "
@@ -2259,21 +2501,25 @@ def _write_gate_samples(bots, out, summaries, session_id, args):
 
 
 def _read_verdict(rop, timeout, set_aside):
-    """The critic's verdict list from `rop`, waited for up to `timeout` seconds. With
-    `set_aside` a verdict list is renamed once read, so a rerun waits for a fresh one
-    instead of reusing it; anything else stays where it is. Exits 2 when it is missing,
-    unreadable or not a non-empty list."""
+    """The critic's verdict list from `rop`, waited for up to `timeout` seconds (None: not
+    waited for, the next run reads it). With `set_aside` a verdict list is renamed once read,
+    so a rerun waits for a fresh one instead of reusing it; anything else stays where it is.
+    Exits 2 when it is missing, unreadable or not a non-empty list."""
     import time as _time
-    deadline = _time.time() + max(1, timeout)
+    deadline = _time.time() + (0 if timeout is None else max(1, timeout))
     while not rop.exists() and _time.time() < deadline:
         _time.sleep(1)
     if not rop.exists():
-        print(f"[lineage] ERROR: reviewer-output not found within "
-              f"{timeout}s: {rop}", file=sys.stderr)
+        if timeout is None:
+            print(f"[lineage] ERROR: no verdict at {rop} yet; have a critic judge the samples, "
+                  "write its answer there and run this again", file=sys.stderr)
+        else:
+            print(f"[lineage] ERROR: reviewer-output not found within "
+                  f"{timeout}s: {rop}", file=sys.stderr)
         raise SystemExit(2)
     try:
         verdict = json.loads(rop.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError, UnicodeDecodeError) as e:
+    except (json.JSONDecodeError, OSError, UnicodeDecodeError, RecursionError) as e:
         print(f"[lineage] ERROR: reviewer-output parse failed: {e}",
               file=sys.stderr)
         raise SystemExit(2)
@@ -2296,7 +2542,7 @@ def _set_aside(rop):
         return
     dest = rop.with_name(rop.name + ".used")
     k = 0
-    while dest.exists() and not _is_verdict_file(dest):
+    while dest.exists() and not _is_verdict_file(dest, every=True):
         k += 1
         dest = rop.with_name(f"{rop.name}.used.{k}")
     try:
@@ -2384,7 +2630,10 @@ def _run_reviewer_gate(turns, out, session_id, args, summaries=None):
         return
     samples = _write_gate_samples(bots, out, summaries, session_id, args)
     if args.reviewer_output:
-        timeout = REVIEWER_TIMEOUT if args.reviewer_timeout is None else args.reviewer_timeout
+        if reviewed and args.reviewer_timeout is None:
+            timeout = None      # the run after the critic reads the verdict; this one does not wait
+        else:
+            timeout = REVIEWER_TIMEOUT if args.reviewer_timeout is None else args.reviewer_timeout
         _enforce_gate(pathlib.Path(args.reviewer_output), timeout, samples, reviewed)