@piagent/platform 1.1.2 → 1.1.4

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 This file records release-facing changes for Pi Agent Platform. Copy the relevant version block into GitHub Releases when publishing a tag.
 
+## v1.1.4 - 2026-07-27
+
+### Fixed
+
+- A credential passed as a command-line option is recognised as one. `--token=abc123`, `--token abc123`, `--password`, `--api-key`, `--client-secret` and the rest went unrecognised because the assignment patterns require a key that starts with a letter, and `-` is not one. v1.1.3 made the redactor's verdict the gate that decides whether a command may serve as verify evidence, so anything it missed was stored in the clear *and* accepted as proof — the same invariant v1.1.3 was written to enforce, defeated by the syntax most command-line tools actually use. Env-style assignments were the only shape covered.
+- An `Authorization` header is redacted wherever it sits among the arguments. The value ran to the end of the line, so the same credential survived or not depending on how much text happened to follow it: `curl URL -H "Authorization: Token abc123"` left the header value one character under the length bar, while moving the header ahead of the URL swept the URL into the value and pushed it over. The value is now the single whitespace-free token that follows the scheme, and under a known authentication scheme its length is not consulted at all. Prose such as `Authorization: not required for local runs` is still left alone.
+
+## v1.1.3 - 2026-07-27
+
+Fixes for defects found reviewing v1.1.2 after it shipped, including two introduced by v1.1.2 itself. Every fix was reproduced first.
+
+### Fixed
+
+- Verify evidence identifies the command exactly again. v1.1.2 moved the digest onto the redacted text to stop it confirming guesses at a secret, and in doing so gave every secret the same identity: an observation of `DATABASE_PASSWORD=CorrectHorse42 npm test` satisfied a claim about `DATABASE_PASSWORD=DifferentHorse99 npm test`, so a run against one database could be recorded as proof for another. That contradicts the exact-match rule the gate is built on. Neither text is safe to hash, so a command with anything to redact now gets no digest at all and cannot be evidence; the gate says so instead of matching loosely. Commands with no secret in them — every legitimate verify command — are identified by their own text as before.
+- A document replaced by a named pipe is refused instead of hanging. The identity check that would have rejected it runs after the file is opened, and opening a pipe waits for a writer, so the substitution did not have to defeat the check — it only had to stop it from running. The read blocked indefinitely. The file is now opened without blocking and without following a symbolic link at the final component.
+- Short credentials are redacted. Values under a key that names a secret outright were kept in the clear below eight or twelve characters, so `TOKEN=hunter2` was stored verbatim in the evidence ledger. Length is only ambiguous after a bare `:`, where English uses the same shape — `password: short` is prose, and `Authorization: Token abc` puts a scheme name where a value would go. Under `=`, inside quotes, in a query string, or as a field in a structure, any value that is not a placeholder is now redacted at any length.
+- A redirect must land on the page being verified. `npm run site:check` compared the hostname, scheme, port and credentials of the redirect target but not its path, so `/missing` or `/?release=old` passed while the run only ever fetched `/`.
+- `piagent-install` reports a missing Node runtime as a missing Node runtime. Validating the MCP preset early, added in v1.1.2, put a Node script ahead of the Node version check, so on a machine without Node the installer failed with `node: command not found` and blamed the preset.
+
+### Changed
+
+- `docs/release-install-policy.md` named the wrong release for the code-scanning gap. A pull request last merged with a failing CodeQL check and an open high alert on `v1.1.0`; on `v1.1.2` the results gate blocked the pull request until the alerts were cleared.
+
 ## v1.1.2 - 2026-07-26
 
 Security and release-gating fixes found reviewing v1.1.1 after it shipped. Every fix in this release was reproduced as a working exploit or failure first.

package/README.md

@@ -283,7 +283,7 @@ This repository intentionally excludes:
 
 ## Maturity
 
-The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.1.2` or a reviewed commit.
+The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.1.4` or a reviewed commit.
 
 Ready for:
 

package/docs/command-reference-vietnamese.md

@@ -419,8 +419,8 @@ Các lệnh này chạy ngoài Pi.
 | Command | Dùng khi nào |
 |---|---|
 | `npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0` | Cài Pi CLI tương thích với release hiện tại. |
-| `npm install -g --ignore-scripts @piagent/platform@1.1.2` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.1.2` | Cài pinned release khi cần reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.1.4` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.1.4` | Cài pinned release khi cần reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Cài latest package platform cho máy cá nhân/sandbox. |
 | Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Full update: đồng bộ host, npm-global helper và Pi package. Mỗi release pin một Pi host chính xác; lấy đúng version của release đang cài trong [release/install policy](release-install-policy.md). |
 | Cài exact Pi host ghi trong release cũ, rồi helper `vPREVIOUS` và `piagent-install --stable` | Full rollback; đánh giá dependency risk của host cũ trước khi hạ version. |

package/docs/distribution-standard.md

@@ -14,9 +14,9 @@ Repo này phải chạy được cho nhiều project/domain khác nhau. Vì vậ
 
 | Use case | Package source |
 |---|---|
-| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.1.2` |
+| Team pinned release | `git:github.com/Vt-mmm/piagent@v1.1.4` |
 | Personal/sandbox dev | `git:github.com/Vt-mmm/piagent` |
-| Registry distribution | `npm:@piagent/platform@1.1.2` |
+| Registry distribution | `npm:@piagent/platform@1.1.4` |
 | Enterprise npm (fork under another scope) | `npm:@your-scope/platform@x.y.z` |
 | Local platform dev | `/path/to/piagent` |
 
@@ -26,7 +26,7 @@ Latest tiện cho máy cá nhân muốn nhận cập nhật nhanh. Pin tag/commi
 
 | Channel | Command | Target | Policy |
 |---|---|---|---|
-| `stable` | `bash scripts/install-global.sh --stable` | Helper release tag resolved to commit SHA, currently `v1.1.2` | Install the Pi package matching the helper. |
+| `stable` | `bash scripts/install-global.sh --stable` | Helper release tag resolved to commit SHA, currently `v1.1.4` | Install the Pi package matching the helper. |
 | `exact` | `bash scripts/install-global.sh --version vX.Y.Z --resolve-tag` | Requested tag resolved to commit SHA | Pi-package-only rollout, rollback, and incident recovery. |
 | `dev` | `bash scripts/install-global.sh --dev` | Moving Git source | Personal/sandbox only; do not commit into project settings. |
 | `local` | `bash scripts/install-global.sh --local` | Current checkout path | Platform development only. |
@@ -53,7 +53,7 @@ Root `package.json` có `pi` manifest trỏ tới:
 Do đó team có thể:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.1.2
+pi install git:github.com/Vt-mmm/piagent@v1.1.4
 ```
 
 Không cần biết internal folder `packages/piagent-core`. Source không pin chỉ dành cho personal/sandbox như bảng channel ở trên.
@@ -65,12 +65,12 @@ Team nên install global package một lần:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-`pi install git:github.com/Vt-mmm/piagent@v1.1.2` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.1.2`.
+`pi install git:github.com/Vt-mmm/piagent@v1.1.4` vẫn hợp lệ nếu chỉ cần cài Pi package. Lệnh đó không tự tạo các binary terminal `piagent-*`; muốn có helper global thì dùng `npm install -g --ignore-scripts @piagent/platform@1.1.4`.
 
 Support matrix hiện tại: macOS Apple Silicon + Bash và Linux x64 + Bash đã được verify; macOS Intel + Bash và Linux ARM64 + Bash là supported target cần chạy smoke trước rollout; native Windows chưa phải target rollout team; WSL2 experimental. Chi tiết và version runtime nằm trong [release/install policy](release-install-policy.md).
 
@@ -103,7 +103,7 @@ Nếu muốn commit sẵn `.pi/piagent-profile.json` vào repo hoặc bootstrap
 ```bash
 bash scripts/setup.sh /path/to/project \
   --profile be-readonly-fe \
-  --package-source git:github.com/Vt-mmm/piagent@v1.1.2 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.1.4 \
   --mcp-preset core \
   --subagents-preset safe
 ```

package/docs/operator-manual-vietnamese.md

@@ -18,12 +18,12 @@ Support matrix release hiện tại: macOS Apple Silicon + Bash và Linux x64 +
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
 
-Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.1.2`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
+Khi seed `.pi/settings.json` cho team/repo cần audit lặp lại, giữ package source dạng pinned tag như `git:github.com/Vt-mmm/piagent@v1.1.4`. Máy cá nhân có thể dùng `git:github.com/Vt-mmm/piagent` để theo latest.
 
 Nếu đang ở source checkout của platform, dùng helper theo channel để preview trước khi đổi:
 
@@ -99,7 +99,7 @@ install package once
 
 ```bash
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -269,7 +269,7 @@ Không phải daily default. Dùng khi muốn tạo sẵn `.pi` files cho projec
 bash /path/to/piagent/scripts/setup.sh /path/to/project \
   --project-only \
   --profile auto \
-  --package-source git:github.com/Vt-mmm/piagent@v1.1.2 \
+  --package-source git:github.com/Vt-mmm/piagent@v1.1.4 \
   --mcp-preset core \
   --subagents-preset safe
 ```
@@ -842,8 +842,8 @@ Watchdog là optional adversarial reviewer ở cuối turn, không bật mặc
 
 | Command | Dùng để |
 |---|---|
-| `npm install -g --ignore-scripts @piagent/platform@1.1.2` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
-| `pi install git:github.com/Vt-mmm/piagent@v1.1.2` | Install pinned release cho reproducible team setup. |
+| `npm install -g --ignore-scripts @piagent/platform@1.1.4` | Cài terminal helper `piagent-*` từ release tag hiện tại. |
+| `pi install git:github.com/Vt-mmm/piagent@v1.1.4` | Install pinned release cho reproducible team setup. |
 | `pi install git:github.com/Vt-mmm/piagent` | Install latest platform package cho máy cá nhân/sandbox. |
 | Cài exact Pi host của release, rồi `npm install -g --ignore-scripts @piagent/platform@X.Y.Z` và `piagent-install --stable` | Full update: đồng bộ host, terminal helper và Pi package. Mỗi release pin một Pi host chính xác; lấy đúng version của release đang cài trong [release/install policy](release-install-policy.md). |
 | Cài exact Pi host ghi trong release cũ, rồi helper `vPREVIOUS` và `piagent-install --stable` | Full rollback; đánh giá lại dependency findings của host cũ trước khi hạ version. |
@@ -940,7 +940,7 @@ Mở lại Pi session sau khi install.
 Cài lại terminal helper đúng release rồi kiểm tra `PATH`:
 
 ```bash
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 command -v piagent-install
 ```
 

package/docs/publishing-for-teams.md

@@ -45,6 +45,8 @@ pi install /path/to/piagent
 - `1.0.2`: đủ security review, MCP registry, adapter schema versioned.
 - `1.1.0`: đọc document ngoài project qua `additionalReadRoots`, MCP baseline bật mặc định ở cả hai lệnh install, pin Pi host `0.82.0`.
 - `1.1.2`: đóng TOCTOU của document reader, hash evidence tính trên text đã redact, publish chờ đủ verify matrix.
+- `1.1.3`: command mang secret không còn được dùng làm verify evidence, document reader từ chối FIFO thay vì treo, redact secret ngắn, redirect phải về đúng trang được kiểm.
+- `1.1.4`: nhận diện secret dạng CLI option (`--token`, `--password`, `--api-key`) và Authorization header ở mọi vị trí argument.
 
 ## Không publish
 

package/docs/release-install-policy.md

@@ -10,7 +10,7 @@ This file is the canonical install, update, rollback, and release checklist. Oth
 
 All supported environments require Node.js `>=22.19.0` and Pi Coding Agent `0.82.0`. The Pi host is installed as a Node CLI; Pi Agent Platform still defines its own release matrix because the terminal helpers and shell policy rely on Bash/POSIX behavior.
 
-| Surface | Status for v1.1.2 | Rollout guidance |
+| Surface | Status for v1.1.4 | Rollout guidance |
 |---|---|---|
 | macOS Apple Silicon (`darwin/arm64`) + Bash | Verified for this release. | Safe default for team rollout after normal project smoke tests. |
 | Linux x64 + Bash | Verified in GitHub Actions. | Safe default for CI/server usage after normal project smoke tests. |
@@ -33,7 +33,7 @@ These three components are versioned independently. A full install, update, or r
 
 | Channel | Source shape | Mutability | Use when |
 |---|---|---:|---|
-| `stable` | `git:github.com/Vt-mmm/piagent@<resolved-commit-sha>` from `v1.1.2` | Fixed after resolution | Default for team rollout. |
+| `stable` | `git:github.com/Vt-mmm/piagent@<resolved-commit-sha>` from `v1.1.4` | Fixed after resolution | Default for team rollout. |
 | `exact` | Tag, reviewed commit, or a tag resolved with `--resolve-tag` | Fixed when using a commit SHA | Pi-package-only roll forward, rollback, or reproduction. |
 | `dev` | `git:github.com/Vt-mmm/piagent` | Moving | Personal machine or sandbox only. |
 | `local` | `/path/to/piagent` | Local workspace | Platform development and dry-run validation. |
@@ -53,7 +53,7 @@ Use this flow when the team needs both terminal commands and the Pi package:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 piagent-install --stable --dry-run
 piagent-install --stable
 ```
@@ -61,8 +61,8 @@ piagent-install --stable
 The stable preview and apply output includes:
 
 ```text
-currentRelease: v1.1.2 (helper package version)
-tag: v1.1.2
+currentRelease: v1.1.4 (helper package version)
+tag: v1.1.4
 resolvedCommit: <40-char-sha>
 source: git:github.com/Vt-mmm/piagent@<40-char-sha>
 ```
@@ -79,7 +79,7 @@ bash scripts/install-global.sh --stable
 Use this only when terminal commands are not needed:
 
 ```bash
-pi install git:github.com/Vt-mmm/piagent@v1.1.2
+pi install git:github.com/Vt-mmm/piagent@v1.1.4
 ```
 
 Direct `pi install` does not create `piagent-*` commands on `PATH`.
@@ -192,7 +192,7 @@ Before broad team access, a repository administrator must enable these external
 3. Enable Dependency graph, Dependabot alerts, and Dependabot security updates. Keep `.github/dependabot.yml` enabled for scheduled npm and GitHub Actions update pull requests.
 4. Enable GitHub private vulnerability reporting so the form linked by `SECURITY.md` works before public rollout.
 5. Keep secret scanning and push protection enabled. Review CodeQL results after the workflow's first successful run.
-6. Add the **Code scanning results** check to the `main` branch ruleset and set its alert threshold so that a new high-severity CodeQL alert blocks the merge. The `analyze (...)` jobs required above only prove the analysis ran and uploaded its SARIF; they succeed just as well when the analysis found new high-severity alerts. Without this separate check, a pull request merges green with open high alerts, which is what happened on `v1.1.2`. Requiring the `analyze` jobs is still necessary — it catches an analysis that failed to run — but it is not the results gate and must not be mistaken for one.
+6. Add the **Code scanning results** check to the `main` branch ruleset and set its alert threshold so that a new high-severity CodeQL alert blocks the merge. The `analyze (...)` jobs required above only prove the analysis ran and uploaded its SARIF; they succeed just as well when the analysis found new high-severity alerts. Without this separate check, a pull request merges green with open high alerts, which is what happened on `v1.1.0`: its pull request carried a failing `CodeQL` check run and a high alert open since the day before, and merged anyway because the rule did not yet require the result. Requiring the `analyze` jobs is still necessary — it catches an analysis that failed to run — but it is not the results gate and must not be mistaken for one.
 
 Verify these settings in GitHub **Settings → Rules** and **Settings → Code security and analysis**. Treat any missing control as an explicit rollout blocker, not as a passing source-code gate. Repository rules also close the remaining mutability risk of bootstrap-by-tag; tag-to-SHA resolution inside `piagent-install` alone cannot protect the helper package before it starts.
 

package/docs/security-threat-model.md

@@ -21,7 +21,7 @@ This document covers the packaged guard, project profiles, capability locks, ins
 - The operator, operating-system account, Pi host, and explicitly trusted project repository are trusted to execute code.
 - Project-local Pi resources are loaded only after Pi project trust or an explicit operator override.
 - A human remains available to approve destructive and external-provider actions.
-- Supported release verification covers macOS Apple Silicon + Bash, Linux x64 + Bash, Node.js `>=22.19.0`, and the exact Pi host version declared by the release. macOS Intel + Bash and Linux ARM64 + Bash are supported targets that need local smoke verification before broad rollout. Native Windows is not a team-rollout target for v1.1.2, and WSL2 is experimental/unverified.
+- Supported release verification covers macOS Apple Silicon + Bash, Linux x64 + Bash, Node.js `>=22.19.0`, and the exact Pi host version declared by the release. macOS Intel + Bash and Linux ARM64 + Bash are supported targets that need local smoke verification before broad rollout. Native Windows is not a team-rollout target for v1.1.4, and WSL2 is experimental/unverified.
 - Registry, GitHub, model-provider, MCP-provider, and Vercel controls are external dependencies. Their account security and platform guarantees are not replaced by this repository.
 
 ## Threat actors and failure modes

package/docs/team-onboarding.md

@@ -9,7 +9,7 @@ Một thành viên mới không cần biết local path của maintainer. Luồn
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 piagent-install --stable
 cd /path/to/project
 pi
@@ -42,7 +42,7 @@ Mặc định team dùng stable helper:
 ```bash
 node --version  # >= 22.19.0
 npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.82.0
-npm install -g --ignore-scripts @piagent/platform@1.1.2
+npm install -g --ignore-scripts @piagent/platform@1.1.4
 piagent-install --stable --dry-run
 piagent-install --stable
 ```

package/docs-site/index.html

@@ -798,7 +798,7 @@
         <span>Pi Agent Platform</span>
       </a>
       <div class="top-actions">
-        <span class="pill"><span class="pill-dot"></span>v1.1.2 docs</span>
+        <span class="pill"><span class="pill-dot"></span>v1.1.4 docs</span>
         <a class="button social" href="https://github.com/Vt-mmm/piagent" target="_blank" rel="noopener noreferrer" aria-label="Mở GitHub repository">
           <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M7 17 17 7M9 7h8v8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
@@ -934,7 +934,7 @@
               <article class="step">
                 <div>
                   <h3>Cài — hai lệnh</h3>
-                  <p>Cần Node.js 22.19.0 trở lên. Không cần cài Pi Coding Agent trước: <span class="inline-code">piagent-setup</span> tự cài đúng bản <span class="inline-code">0.82.0</span> mà release <span class="inline-code">v1.1.2</span> đang pin. Chạy nó ngay trong thư mục project — nó cài Pi package, khởi tạo <span class="inline-code">.pi/</span>, cài MCP baseline cùng subagents, rồi chạy doctor. Thêm <span class="inline-code">--no-mcp</span>, <span class="inline-code">--no-subagents</span>, <span class="inline-code">--no-herdr</span> hoặc <span class="inline-code">--global-only</span> để bỏ bớt.</p>
+                  <p>Cần Node.js 22.19.0 trở lên. Không cần cài Pi Coding Agent trước: <span class="inline-code">piagent-setup</span> tự cài đúng bản <span class="inline-code">0.82.0</span> mà release <span class="inline-code">v1.1.4</span> đang pin. Chạy nó ngay trong thư mục project — nó cài Pi package, khởi tạo <span class="inline-code">.pi/</span>, cài MCP baseline cùng subagents, rồi chạy doctor. Thêm <span class="inline-code">--no-mcp</span>, <span class="inline-code">--no-subagents</span>, <span class="inline-code">--no-herdr</span> hoặc <span class="inline-code">--global-only</span> để bỏ bớt.</p>
                   <div class="table-wrap compact-table">
                     <table>
                       <thead>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/extensions/document-intake.ts

@@ -510,14 +510,24 @@ export type ResolvedDocument = Extract<DocumentResolution, { status: "ok" }>;
 
 const DOCUMENT_CHANGED = "document changed between the safety checks and the read, so nothing was read";
 
+// Opening blocks until a writer appears when the name has become a FIFO, and the
+// identity check below never runs — the read hangs instead of being refused.
+// O_NONBLOCK returns a descriptor immediately for any file type, and has no
+// effect on reads from a regular file, which is the only type that gets past the
+// check. O_NOFOLLOW refuses a symbolic link at the final component: the path was
+// already canonicalised, so a link there means the name was swapped after it was
+// checked, which is the substitution this open exists to defeat.
+const OPEN_FLAGS = fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | fs.constants.O_NOFOLLOW;
+
 function openVerifiedDocument(
   resolution: ResolvedDocument
 ): { status: "ok"; fd: number; size: number } | { status: "error"; reason: string } {
   let fd: number;
   try {
-    fd = fs.openSync(resolution.absolutePath, "r");
+    fd = fs.openSync(resolution.absolutePath, OPEN_FLAGS);
   } catch (error) {
     const code = error && typeof error === "object" && "code" in error ? String((error as { code?: unknown }).code) : "";
+    if (code === "ELOOP") return { status: "error", reason: DOCUMENT_CHANGED };
     return {
       status: "error",
       reason: code === "ENOENT"

package/packages/piagent-core/extensions/runtime-evidence.js

@@ -9,24 +9,27 @@ export function normalizeEvidenceCommand(command) {
     .trim();
 }
 
-// The digest is taken over the redacted command, never the raw one.
+// A command that carries a secret gets no digest at all, and cannot be evidence.
 //
-// The ledger stores a redacted command beside its hash. Hashing the raw text
-// meant the stored pair was `export TOKEN= [REDACTED_SECRET] && npm test`
-// alongside a SHA-256 of the real line — the redaction published the template
-// and the hash confirmed guesses against it, so the only unknown left was the
-// secret itself and SHA-256 is fast enough to walk a candidate list offline.
-// Redacting first makes the digest cover exactly what the file already shows.
+// Neither text is safe to hash. Hashing the raw command published a template:
+// the ledger stored `export TOKEN= [REDACTED_SECRET] && npm test` beside a
+// SHA-256 of the real line, so the only unknown left was the secret, and SHA-256
+// is fast enough to walk a candidate list offline. Hashing the redacted text
+// instead gives every secret the same digest, which is worse in a different
+// direction: the gate promises the observed command matches `verifyCommands`
+// exactly, and two runs differing only in a credential would satisfy each
+// other's claim. Verifying against database A and recording it as proof for
+// database B is exactly what the exact-match rule exists to prevent.
 //
-// Both sides of a lookup redact, so matching is unaffected: the verify command
-// from the task plan and the observed command normalise and redact the same way
-// before being compared.
+// So the digest covers the raw command and is withheld when there is anything to
+// redact. Withholding it costs nothing real: a verify command in a task plan has
+// no business carrying an inline credential, and a command that does gets refused
+// rather than matched loosely.
 export function hashEvidenceCommand(command) {
   const normalized = normalizeEvidenceCommand(command);
-  return crypto
-    .createHash("sha256")
-    .update(redactSensitiveText(normalized).text)
-    .digest("hex");
+  if (!normalized) return "";
+  if (redactSensitiveText(normalized).redacted) return "";
+  return crypto.createHash("sha256").update(normalized).digest("hex");
 }
 
 export function commandMatchesVerifyPlan(command, verifyCommands) {
@@ -88,8 +91,14 @@ export function observedBashResultFromToolResultEvent(event, cwd, nowMs = Date.n
 
 function canonicalObservedEntry(entry) {
   const rawNormalizedCommand = normalizeEvidenceCommand(entry?.normalizedCommand ?? entry?.command);
-  const commandHash = entry?.commandHash || (rawNormalizedCommand ? hashEvidenceCommand(rawNormalizedCommand) : "");
-  if (!commandHash) return undefined;
+  if (!rawNormalizedCommand) return undefined;
+  // `??`, not `||`: an entry read back from the ledger carries an empty digest
+  // when its command held a secret, and that emptiness has to survive. Recomputing
+  // it here would hash the stored text, which is redacted, and hand the entry the
+  // one digest this module refuses to produce.
+  const commandHash = typeof entry?.commandHash === "string"
+    ? entry.commandHash
+    : hashEvidenceCommand(rawNormalizedCommand);
   const command = typeof entry?.command === "string" ? redactSensitiveText(entry.command).text : "";
   const normalizedCommand = redactSensitiveText(rawNormalizedCommand).text;
   const recordedAtMs = parseTimeMs(entry?.recordedAtMs ?? entry?.recordedAt);
@@ -106,9 +115,11 @@ function canonicalObservedEntry(entry) {
   };
 }
 
-function observedCommandsMatch(entry, normalizedCommand, commandHash) {
-  if (entry.commandHash) return entry.commandHash === commandHash;
-  return normalizeEvidenceCommand(entry.normalizedCommand ?? entry.command) === normalizedCommand;
+// Identity is the digest and nothing else. Falling back to comparing the stored
+// text would compare redacted text, which is the collision this module refuses.
+function observedCommandsMatch(entry, commandHash) {
+  if (!commandHash || !entry.commandHash) return false;
+  return entry.commandHash === commandHash;
 }
 
 export function findMatchingObservedBashResult(entries, { cwd, command, notBefore, exitCode }) {
@@ -119,12 +130,19 @@ export function findMatchingObservedBashResult(entries, { cwd, command, notBefor
   if (!normalizedCommand) {
     return { ok: false, reason: "Verify command is empty after normalization." };
   }
+  if (!commandHash) {
+    return {
+      ok: false,
+      reason: "Verify command carries a secret, so it cannot be matched against observed evidence. "
+        + "Move the credential into the environment and keep it out of the command."
+    };
+  }
 
   for (let index = entries.length - 1; index >= 0; index -= 1) {
     const entry = canonicalObservedEntry(entries[index]);
     if (!entry) continue;
     if (entry.cwd !== normalizedCwd) continue;
-    if (!observedCommandsMatch(entry, normalizedCommand, commandHash)) continue;
+    if (!observedCommandsMatch(entry, commandHash)) continue;
     if (entry.recordedAtMs < notBeforeMs) continue;
     if (!claimedExitMatchesObserved(exitCode, entry)) {
       return {

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/security/sensitive-data.js

@@ -15,7 +15,27 @@ const TOKEN_PATTERNS = [
 const CONNECTION_URL_PATTERN = /\b((?:https?|ftp|postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/"']+:)([^@\s/"']+)(@[^\s"'<>]+)/gi;
 const BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})\b/gi;
 const BASIC_AUTH_PATTERN = /\b(Basic\s+)([A-Za-z0-9+/]{12,}={0,2})(?=$|[\s,;}])/gi;
-const AUTHORIZATION_HEADER_PATTERN = /\b(Authorization\s*:\s*)([A-Za-z][A-Za-z0-9_-]{0,31})(\s+)([^\r\n]+)/gi;
+// The value is one whitespace-free token, not the rest of the line. Taking the
+// rest of the line made the result depend on where the header sat among the
+// arguments: `curl URL -H "Authorization: Token abc123"` yielded `abc123"`, short
+// enough to keep, while moving the header before the URL swept the URL into the
+// value and pushed it past the length bar. Same header, same credential, opposite
+// outcome. Credentials carry no spaces, so stopping at the first one also keeps
+// prose like "Authorization: not required for local runs" intact.
+const AUTHORIZATION_HEADER_PATTERN = /\b(Authorization\s*:\s*)([A-Za-z][A-Za-z0-9_-]{0,31})(\s+)([^\s\r\n"'`]+)/gi;
+
+// A credential passed as a command-line option, which is how most CLIs take one.
+// The assignment patterns below require a key starting with a letter, so every
+// `--token=...` and `--token ...` walked straight past them.
+const CLI_OPTION_SECRET_PATTERN = /(^|[\s({[])(--[A-Za-z][A-Za-z0-9_.-]{0,80})(=|\s+)("[^"\r\n]*"|'[^'\r\n]*'|[^\s"'`;,)}]+)/g;
+
+// Under one of these schemes the header carries an opaque credential, so its
+// length says nothing. Anything else after `Authorization:` is more likely prose
+// — "Authorization: not required" — and keeps the ambiguous-syntax length bar.
+const AUTHORIZATION_SCHEMES = new Set([
+  "bearer", "basic", "token", "digest", "negotiate", "ntlm",
+  "oauth", "hawk", "signature", "apikey", "jwt", "aws4-hmac-sha256"
+]);
 const QUERY_SECRET_PATTERN = /([?&])([A-Za-z][A-Za-z0-9_.-]{0,80})(=)([^&#\s]+)/gi;
 const DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*"((?:\\.|[^"\\\r\n])*)"/gim;
 const SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*'((?:\\.|[^'\\\r\n])*)'/gim;
@@ -54,14 +74,6 @@ const SENSITIVE_PLURAL_KEYS = new Set([
   "signing_keys",
   "authorizations"
 ]);
-const LOWER_THRESHOLD_PLURAL_KEYS = new Set([
-  "passwords",
-  "secrets",
-  "credentials",
-  "passphrases",
-  "private_keys",
-  "signing_keys"
-]);
 
 function normalizeSecretValue(value) {
   return String(value ?? "")
@@ -97,13 +109,6 @@ function keyLooksSensitive(key) {
     || normalized.endsWith(`_${term}`));
 }
 
-function keyRequiresLowerThreshold(key) {
-  const normalized = normalizeSecretKey(key);
-  return LOWER_THRESHOLD_PLURAL_KEYS.has(normalized)
-    || ["password", "passwd", "pwd", "secret", "credential", "passphrase", "private_key", "signing_key"]
-      .some((term) => normalized === term || normalized.endsWith(`_${term}`));
-}
-
 function valueLooksPlaceholder(value) {
   const clean = normalizeSecretValue(value);
   if (!clean) return true;
@@ -115,12 +120,40 @@ function valueLooksPlaceholder(value) {
   return false;
 }
 
-function valueLooksSensitive(key, value) {
+// Length is only evidence where the syntax is ambiguous, and `=` is not.
+//
+// A short value used to be kept in the clear whatever the syntax, so `TOKEN=hunter2`
+// and `PASSWORD=short7` went into the ledger verbatim. Every name in
+// SENSITIVE_KEY_TERMS states outright what it holds — there is no `key` or `id`
+// among them — so under an `=`, or inside quotes, a non-placeholder value is the
+// secret the key says it is, at any length.
+//
+// A bare `:` is the ambiguous case, because English uses it too: `password: short`
+// and `The secret: always run tests` are prose, and `Authorization: Token abc123`
+// puts the scheme name where a value would go. Those keep a length bar.
+const SHORT_VALUE_MIN_LENGTH = 8;
+const AMBIGUOUS_VALUE_MIN_LENGTH = 12;
+
+function valueLooksSensitive(key, value, syntax = "unquoted-colon") {
   const clean = normalizeSecretValue(value);
   if (!clean || valueLooksPlaceholder(clean)) return false;
   if (looksLikeKnownSecret(clean)) return true;
-  if (keyRequiresLowerThreshold(key)) return clean.length >= 8;
-  return keyLooksSensitive(key) && clean.length >= 12;
+  if (!keyLooksSensitive(key)) return false;
+  if (syntax !== "unquoted-colon") return true;
+  return clean.length >= (keyNamesASecretOutright(key) ? SHORT_VALUE_MIN_LENGTH : AMBIGUOUS_VALUE_MIN_LENGTH);
+}
+
+// Under a bare `:`, these names carry enough intent on their own to redact a short
+// value; the broader terms wait for length before touching prose.
+function keyNamesASecretOutright(key) {
+  const normalized = normalizeSecretKey(key);
+  return ["password", "passwd", "pwd", "secret", "credential", "passphrase", "private_key", "signing_key"]
+    .some((term) => normalized === term || normalized.endsWith(`_${term}`))
+    || ["passwords", "secrets", "credentials", "passphrases", "private_keys", "signing_keys"].includes(normalized);
+}
+
+function assignmentSyntax(separator) {
+  return separator === "=" ? "assignment" : "unquoted-colon";
 }
 
 export function redactSensitiveText(input) {
@@ -131,29 +164,41 @@ export function redactSensitiveText(input) {
   text = text.replace(BEARER_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
   text = text.replace(BASIC_AUTH_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
   text = text.replace(AUTHORIZATION_HEADER_PATTERN, (match, prefix, scheme, spacing, value) => {
-    if (!valueLooksSensitive("authorization", value)) return match;
+    const syntax = AUTHORIZATION_SCHEMES.has(scheme.toLowerCase()) ? "assignment" : "unquoted-colon";
+    if (!valueLooksSensitive("authorization", value, syntax)) return match;
     return `${prefix}${scheme}${spacing}${REDACTION}`;
   });
 
+  // Over-redaction is the safe direction here: a flag whose name says "secret"
+  // and whose argument is a plain name — `docker service create --secret build` —
+  // loses that name from the record and cannot serve as verify evidence. Reading
+  // the name as the credential it is called is the cheaper mistake.
+  text = text.replace(CLI_OPTION_SECRET_PATTERN, (match, prefix, flag, separator, value) => {
+    // A following option is the next flag, not this flag's argument.
+    if (separator !== "=" && value.startsWith("-")) return match;
+    if (!keyLooksSensitive(flag) || !valueLooksSensitive(flag, value, "assignment")) return match;
+    return `${prefix}${flag}${separator === "=" ? "= " : " "}${REDACTION}`;
+  });
+
   for (const pattern of TOKEN_PATTERNS) text = text.replace(pattern, REDACTION);
 
   text = text.replace(QUERY_SECRET_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value)) return match;
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "assignment")) return match;
     return `${prefix}${key}${separator}${REDACTION}`;
   });
 
   text = text.replace(DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value)) return match;
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "quoted")) return match;
     return `${prefix}${key}${separator} "${REDACTION}"`;
   });
 
   text = text.replace(SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value)) return match;
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "quoted")) return match;
     return `${prefix}${key}${separator} '${REDACTION}'`;
   });
 
   text = text.replace(SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value)) return match;
+    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, assignmentSyntax(separator))) return match;
     return `${prefix}${key}${separator} ${REDACTION}`;
   });
 
@@ -173,7 +218,9 @@ function redactStorageValue(value, key) {
   if (typeof value === "string") {
     const redacted = redactSensitiveText(value);
     if (redacted.redacted) return redacted.text;
-    return key && keyLooksSensitive(key) && valueLooksSensitive(key, value) ? REDACTION : value;
+    // A field name in a structure is machine syntax, never prose, so length says
+    // nothing here either.
+    return key && keyLooksSensitive(key) && valueLooksSensitive(key, value, "assignment") ? REDACTION : value;
   }
   if (Array.isArray(value)) return value.map((item) => redactStorageValue(item, key));
   if (!value || typeof value !== "object") return value;

package/scripts/check-published-site.mjs

@@ -185,6 +185,12 @@ export function judge(host, hosts, expect, result, family) {
     if (target.protocol !== "https:") return `HTTP ${result.status} redirecting away from HTTPS to ${target.href}`;
     if (target.port !== "" && target.port !== "443") return `HTTP ${result.status} redirecting to a non-standard port at ${target.href}`;
     if (target.username !== "" || target.password !== "") return `HTTP ${result.status} redirecting to a URL carrying credentials`;
+    // The check that follows a redirect is the check of the other host's `/`, which
+    // is the only page this run verifies. A redirect to `/missing` or to `/?release=old`
+    // was accepted on the strength of the hostname alone, so the run reported the
+    // version served at a page it never fetched.
+    if (target.pathname !== "/") return `HTTP ${result.status} redirecting to ${target.pathname}, which is not the page being verified`;
+    if (target.search !== "" || target.hash !== "") return `HTTP ${result.status} redirecting to ${target.href}, which is not the page being verified`;
     return null;
   }
   if (result.status !== 200) return `HTTP ${result.status}`;

package/scripts/install-global.sh

@@ -15,7 +15,7 @@ Package source examples:
   # Installs the stable tag after resolving it to a commit SHA.
 
   # Pin a specific release:
-  scripts/install-global.sh --version v1.1.2 --resolve-tag
+  scripts/install-global.sh --version v1.1.4 --resolve-tag
 
   # Preview the planned install/update without changing user config:
   scripts/install-global.sh --stable --dry-run
@@ -127,7 +127,7 @@ detect_runtime_surface() {
       printf 'native-windows/%s (not release-gated; terminal helpers require Bash semantics)' "$arch_name"
       ;;
     *)
-      printf '%s/%s (outside v1.1.2 release matrix)' "$os_name" "$arch_name"
+      printf '%s/%s (outside v1.1.4 release matrix)' "$os_name" "$arch_name"
       ;;
   esac
 }
@@ -135,7 +135,7 @@ detect_runtime_surface() {
 warn_runtime_surface_if_needed() {
   local surface="$1"
   case "$surface" in
-    *"supported target"*|*"experimental"*|*"not release-gated"*|*"outside v1.1.2 release matrix"*)
+    *"supported target"*|*"experimental"*|*"not release-gated"*|*"outside v1.1.4 release matrix"*)
       echo "WARN: runtime surface is $surface." >&2
       echo "WARN: For team rollout, run piagent-doctor plus the project smoke/verify suite on this machine before relying on it." >&2
       ;;
@@ -344,11 +344,15 @@ if [[ "$WITH_MCP" == false && "$MCP_PRESET_EXPLICIT" == true ]]; then
   exit 2
 fi
 
+require_node_version
+
 # The preset is only read at the very last step, after the platform package and
 # the MCP adapter are already installed. A name with a typo therefore failed
 # after two installs had landed, leaving a half-configured machine, and the
 # dry-run still exited 0 because it never reached the check. Validating here
-# costs one process and makes a bad preset cost nothing.
+# costs one process and makes a bad preset cost nothing. It has to come after the
+# Node check, not before: the validator is a Node script, so on a machine without
+# Node it reported a missing interpreter as a bad preset.
 if [[ "$WITH_MCP" == true ]]; then
   if ! bash "$PLATFORM_ROOT/scripts/configure-mcp.sh" --scope global --preset "$MCP_PRESET" --validate-preset >/dev/null; then
     echo "Nothing was installed." >&2
@@ -356,7 +360,6 @@ if [[ "$WITH_MCP" == true ]]; then
   fi
 fi
 
-require_node_version
 CURRENT_RUNTIME_SURFACE="$(detect_runtime_surface)"
 warn_runtime_surface_if_needed "$CURRENT_RUNTIME_SURFACE"
 CURRENT_RELEASE_TAG="$(node -e 'const fs = require("node:fs"); const p = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); process.stdout.write(`v${p.version}`);' "$PLATFORM_ROOT/package.json")"

package/scripts/team-doctor.sh

@@ -137,7 +137,7 @@ function runtimeMatrixStatus() {
     surface: `${platform}/${arch}`,
     status: "outside-release-matrix",
     teamRolloutReady: false,
-    note: "This runtime is outside the documented v1.1.2 support matrix."
+    note: "This runtime is outside the documented v1.1.4 support matrix."
   };
 }