@vibe-commit/capture 0.8.0 → 0.9.0

package/dist/redact.js

@@ -94,9 +94,105 @@ const CONTENT_KEYS = new Set([
     "old_source",
     "newSource",
     "oldSource",
+    // C39 addendum: an `ExitPlanMode` result is `{plan, isAgent, filePath}`: the plan file's own text beside its out-of-tree path (3 records in the
+    // C39 re-measure carried it through, the only same-record sibling that remained).
+    "plan",
 ]);
 /** Hunk arrays whose `lines` carry file content. */
 const PATCH_KEY = "structuredPatch";
+/** C39 (ii): Claude's record-level second copy of every tool input, keyed by tool_use id. */
+const WIRE_KEY = "wireToolInputs";
+/**
+ * C38: record types whose content duplicates the conversation records and is withheld in EVERY copy, always, with no flag (P1, 2026-11-01).
+ * `last-prompt`, `queue-operation` and `api-request-blob` repeated an out-of-tree file's text in 870 of 907 in-repo files in the first measurement;
+ * the extension adds the three other request/snapshot types. None is read by the server (its reader skips them by type or never names them).
+ * Their path-shaped KEYS stay (`trackedFileBackups`' paths): only string values are withheld, and the README says so.
+ */
+const ALWAYS_WITHHELD_TYPES = new Set([
+    "last-prompt",
+    "queue-operation",
+    "api-request-blob",
+    "api-request",
+    "api-request-shape",
+    "file-history-snapshot",
+    "file-history-delta",
+]);
+function claudeAlwaysWithheld(record) {
+    // C39 (iv): a model-written digest of the whole conversation, file text included. Strict: a data-shaped key makes the whole line go.
+    if (record.isCompactSummary === true)
+        return "strict";
+    return typeof record.type === "string" && ALWAYS_WITHHELD_TYPES.has(record.type) ? "values" : null;
+}
+/**
+ * C27: the cwd-less record types that carry NO conversation content, each bound to the key paths measured on a corpus of 346,120 cwd-less records.
+ * A string under a key a KEEP type does not have today is withheld in a multi-repo copy; every other cwd-less type (and any type Claude Code adds
+ * later) is AGGREGATE: default deny. `modelUsage`'s keys are model ids, normalised to `<datakey>`.
+ */
+const KEEP_KEYS = {
+    mode: new Set(["type", "mode", "sessionId"]),
+    "permission-mode": new Set(["type", "permissionMode", "sessionId"]),
+    "atis-latch": new Set(["type", "atis", "sessionId"]),
+    "bridge-session": new Set(["type", "bridgeSessionId", "lastSequenceNum", "ownerAccountUuid", "ownerOrganizationUuid", "sessionId"]),
+    launched: new Set(["type"]),
+    "tools-used": new Set(["type", "tools", "sessionId"]),
+    "fork-context-ref": new Set(["type", "agentId", "contextLength", "parentLastUuid", "parentSessionId"]),
+    "cost-state": new Set([
+        "type",
+        "sessionId",
+        "startTime",
+        "hasUnknownModelCost",
+        "totalCostUSD",
+        "totalAPIDuration",
+        "totalAPIDurationWithoutRetries",
+        "totalToolDuration",
+        "totalDuration",
+        "totalLinesAdded",
+        "totalLinesRemoved",
+        "modelUsage",
+        "modelUsage.<datakey>",
+        "modelUsage.<datakey>.inputTokens",
+        "modelUsage.<datakey>.outputTokens",
+        "modelUsage.<datakey>.cacheReadInputTokens",
+        "modelUsage.<datakey>.cacheCreationInputTokens",
+        "modelUsage.<datakey>.cacheCreationEphemeral5mInputTokens",
+        "modelUsage.<datakey>.cacheCreationEphemeral1hInputTokens",
+        "modelUsage.<datakey>.webSearchRequests",
+        "modelUsage.<datakey>.costUSD",
+        "modelUsage.<datakey>.thinkingTokens",
+    ]),
+};
+/** The `attachment` and `system` subtypes measured on the corpus (cwd-bearing). One not listed is a FUTURE subtype: withheld in a multi-repo copy. */
+const KNOWN_ATTACHMENT_TYPES = new Set(("hook_success total_tokens_reminder deferred_tools_record environment queued_command prompt_snapshot silent_turn_reminder date remote_session_change " +
+    "model session_context credential_org deferred_tools_delta mcp_instructions_delta instructions skill_listing auto_mode nested_memory edited_text_file " +
+    "structured_output agent_listing_delta file hook_additional_context compact_file_reference command_permissions read_truncation_notice " +
+    "hook_non_blocking_error plan_mode plan_mode_exit peer_mention thinking_drop task_status invoked_skills hook_system_message plan_file_reference " +
+    "hook_cancelled batching_reminder_sent auto_mode_exit task_reminder bash_output_audience_note ultra_effort_enter plan_mode_reentry skill_mention " +
+    "workflow_keyword_request ultra_effort_exit already_read_file dynamic_skill").split(" "));
+const KNOWN_SYSTEM_SUBTYPES = new Set("stop_hook_summary turn_duration away_summary informational local_command compact_boundary bridge_status scheduled_task_fire agents_killed".split(" "));
+/** Subtypes whose text digests other turns (P1 C38 (b)): withheld in a multi-repo copy even though they carry a cwd. */
+const AGGREGATE_ATTACHMENT_TYPES = new Set(["prompt_snapshot"]);
+const AGGREGATE_SYSTEM_SUBTYPES = new Set(["away_summary"]);
+function claudeAggregate(record) {
+    const type = typeof record.type === "string" ? record.type : "";
+    const hasCwd = typeof record.cwd === "string" && record.cwd !== "";
+    if (!hasCwd) {
+        // No folder of its own: nothing says whose it is. A KEEP type keeps only its measured keys; every other type is withheld.
+        const keep = KEEP_KEYS[type];
+        return keep === undefined ? { kind: "withhold" } : { kind: "keepKeys", paths: keep };
+    }
+    if (type === "attachment") {
+        const attachment = record.attachment;
+        const subtype = attachment !== null && typeof attachment === "object" ? attachment.type : undefined;
+        if (typeof subtype !== "string" || !KNOWN_ATTACHMENT_TYPES.has(subtype) || AGGREGATE_ATTACHMENT_TYPES.has(subtype))
+            return { kind: "withhold" };
+    }
+    else if (type === "system") {
+        const subtype = record.subtype;
+        if (typeof subtype !== "string" || !KNOWN_SYSTEM_SUBTYPES.has(subtype) || AGGREGATE_SYSTEM_SUBTYPES.has(subtype))
+            return { kind: "withhold" };
+    }
+    return null;
+}
 /**
  * `claude-code` — the rules this module shipped with, unchanged.
  *
@@ -108,6 +204,19 @@ const CLAUDE_CODE_RULES = {
     contentKeys: CONTENT_KEYS,
     nestedJsonKeys: new Set(),
     patchKeys: new Set([PATCH_KEY]),
+    // C37 (a HIGH that shipped in 0.8.0): the path rule never fired on these attachment shapes, so a global ~/.claude/CLAUDE.md, a memory
+    // file or an edited file outside the repository went out unredacted in EVERY copy, single-repo sessions included.
+    attachment: {
+        // `planFilePath` and `data.targetFile`/`data.path` (a plan file, a structured output about a file) name their subject the same way.
+        pathKeys: new Set(["path", "filename", "planFilePath", "targetFile"]),
+        // `planContent` is a plan file's text. `reason`, `summary`, `notes` and `gaps` are a structured output's prose ABOUT its `path`
+        // (measured: attachment.structured_output.data). Each is withheld only when the path beside it is out of tree.
+        contentKeys: new Set(["content", "rawContent", "snippet", "planContent", "reason", "summary", "notes", "gaps"]),
+    },
+    // C39 (iv): after a compaction Claude writes a `user` record flagged `isCompactSummary` whose text digests the conversation so far, including
+    // what it read from files outside the repository. Nothing in it names a file, so the path rule cannot judge it.
+    alwaysWithheld: claudeAlwaysWithheld,
+    aggregate: claudeAggregate,
 };
 /**
  * `codex-cli` — ⛔ **the key set is D164 §8's MEASUREMENT, not a guess.**
@@ -148,11 +257,35 @@ const CLAUDE_CODE_RULES = {
  * today, symmetric across agents.** Widening the control is a separate decision
  * about the control; reaching parity with it is this task. See the report.
  */
+/** The Codex records that are injected instructions, never the user's or the agent's own words (C40 (2), P1 ruling 2026-11-01). */
+function isCodexInstructionRecord(record) {
+    if (record.type === "world_state")
+        return true;
+    const payload = record.payload;
+    if (payload === null || typeof payload !== "object")
+        return false;
+    const p = payload;
+    if (record.type === "response_item") {
+        // The WHOLE role:user and role:developer streams, not a prefix match: it is the injected superset (`# AGENTS.md instructions for ...`,
+        // `<user_action>` synthetics), and a prefix breaks when the wording changes. The human prompt is `event_msg/user_message`.
+        if (p.type === "message")
+            return p.role === "user" || p.role === "developer";
+        return p.type === "additional_tools";
+    }
+    return record.type === "event_msg" && p.type === "entered_review_mode";
+}
 const CODEX_CLI_RULES = {
     pathKeys: new Set(["workdir", "cwd", "absolute_file_path"]),
     contentKeys: new Set(["cmd"]),
     nestedJsonKeys: new Set(["arguments"]),
     patchKeys: new Set(),
+    // C40 (2): Codex injects the user's instruction files and its own prompts into the record stream, and none of those records names a path
+    // for the path rule to judge. Measured on one machine (367 rollouts): the GLOBAL ~/.codex/AGENTS.md text is in all 161 `world_state`
+    // records (`state.agents_md.text`) and in the `response_item/message` role:user injections. Nothing reads them: the human prompt comes
+    // from `event_msg/user_message`, and the server's reader skips the model-input mirror. So they are withheld in EVERY copy, by TYPE, and
+    // the next instruction field Codex adds is not a leak. Assistant prose (`event_msg/agent_message`, role:assistant) is NOT here.
+    alwaysWithheld: (record) => (isCodexInstructionRecord(record) ? "strict" : null),
+    withheldKeys: (key) => key === "base_instructions" || key.endsWith("developer_instructions"),
 };
 /**
  * ⛔ **Every profile, keyed by its label — and the `Record` is the lock.**
@@ -266,6 +399,27 @@ const STRICTEST_RULES = {
     contentKeys: unionOf((rules) => rules.contentKeys),
     nestedJsonKeys: unionOf((rules) => rules.nestedJsonKeys),
     patchKeys: unionOf((rules) => rules.patchKeys),
+    attachment: {
+        pathKeys: unionOf((rules) => rules.attachment?.pathKeys ?? new Set()),
+        contentKeys: unionOf((rules) => rules.attachment?.contentKeys ?? new Set()),
+    },
+    alwaysWithheld: (record) => {
+        for (const rules of Object.values(RULES)) {
+            const verdict = rules.alwaysWithheld?.(record) ?? null;
+            if (verdict !== null)
+                return verdict;
+        }
+        return null;
+    },
+    aggregate: (record) => {
+        for (const rules of Object.values(RULES)) {
+            const verdict = rules.aggregate?.(record) ?? null;
+            if (verdict !== null)
+                return verdict;
+        }
+        return null;
+    },
+    withheldKeys: (key) => Object.values(RULES).some((rules) => rules.withheldKeys?.(key) === true),
 };
 function unionOf(pick) {
     return new Set(Object.values(RULES).flatMap((rules) => [...pick(rules)]));
@@ -312,6 +466,40 @@ export function rulesForTranscript(home, env, transcriptPath) {
     return matches.length === 1 ? RULES[matches[0].redaction] : STRICTEST_RULES;
 }
 const NONE = { redacted: 0, skipped: 0 };
+/**
+ * Keys that stay readable in an isolated record. Everything else that is a string is content. The list is of STRUCTURE (what a
+ * record is, who spoke, when, which tool by NAME) and not of anything a person typed or a tool printed; an unknown key is
+ * withheld, so the failure direction is a thinner record and never a leak. `cwd` stays: it is how the record's origin is told
+ * apart from the launch folder's, and it is a path, not a conversation (its residual is documented).
+ */
+const STRUCTURAL_KEYS = new Set([
+    "type",
+    "subtype",
+    "role",
+    "uuid",
+    "parentUuid",
+    "logicalParentUuid",
+    "sessionId",
+    "session_id",
+    "timestamp",
+    "version",
+    "userType",
+    "entrypoint",
+    "requestId",
+    "id",
+    "call_id",
+    "tool_use_id",
+    "toolUseID",
+    "name",
+    "model",
+    "status",
+    "stop_reason",
+    "stop_sequence",
+    "level",
+    "originator",
+    "media_type",
+    "cwd",
+]);
 /**
  * Redact one NDJSON line. **Pure, total, and length-preserving.**
  *
@@ -320,7 +508,7 @@ const NONE = { redacted: 0, skipped: 0 };
  * (DESIGN.md §13.7), and a redactor that dropped a line it could not parse would
  * be silent data loss on a path where D56 §D8 makes loss permanent.
  */
-export function redactLine(line, projectRoots, rules, resolver = containment()) {
+export function redactLine(line, projectRoots, rules, resolver = containment(), scope) {
     if (line === "")
         return { line, ...NONE };
     let parsed;
@@ -332,6 +520,8 @@ export function redactLine(line, projectRoots, rules, resolver = containment())
         // that is not JSON. Unchanged is the only honest answer.
         return { line, ...NONE };
     }
+    if (scope?.observe !== undefined && parsed !== null && typeof parsed === "object" && !Array.isArray(parsed))
+        scope.observe(parsed);
     // The round-trip gate. Padding arithmetic is only exact if everything this
     // module does NOT touch re-serialises to the same bytes.
     let baseline;
@@ -341,10 +531,57 @@ export function redactLine(line, projectRoots, rules, resolver = containment())
     catch {
         return { line, ...NONE };
     }
-    if (baseline !== line)
+    if (baseline !== line) {
+        // ⛔ A line that does not round-trip cannot be padded string by string, but it must not bypass redaction (C18 #4b, C20). It is
+        // withheld as a WHOLE line, length-preservingly, when it is another repo's record (R17), or when the structured-path rule
+        // (with a folder target's exclusion roots) would have redacted ANYTHING in it: an out-of-tree file's content, a path the target
+        // may not hold. A line with nothing to redact keeps today's answer: unchanged. (0.8.0 passed EVERY such line through; on one
+        // machine's corpus these are Codex `token_count` records whose `used_percent` is written `N.0`, and none named a path, but the
+        // next one could.)
+        if (mustWithholdWhole(parsed, projectRoots, rules, resolver, scope))
+            return { line: withheldLine(line), redacted: 1, skipped: 0 };
         return { line, ...NONE };
-    const counts = { projectRoots, resolver, rules, redacted: 0, skipped: 0, slots: null };
-    walk(parsed, counts);
+    }
+    const counts = { projectRoots, resolver, rules, scope, redacted: 0, skipped: 0, slots: null };
+    // C39 (iv) / C38 / C40 (2): a record the dialect withholds BY KIND (a digest of the conversation, a request blob, injected instructions) is
+    // withheld in every copy, by the same `isolate` a foreign record gets. Like a foreign record, a length mismatch below withholds the WHOLE
+    // line instead of sending the original. `strict` records that hold a data-shaped KEY (a skill name, a path) are withheld whole at once.
+    const isObject = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed);
+    const always = isObject ? (rules.alwaysWithheld?.(parsed) ?? null) : null;
+    let withheldWhole = always !== null;
+    if (always !== null) {
+        if (always === "strict" && hasDataKeyInToolSubtree(parsed, true))
+            return { line: withheldLine(line), redacted: 1, skipped: 0 };
+        isolate(parsed, counts, false);
+    }
+    else if (isObject &&
+        ((scope?.foreignRecord !== undefined && scope.foreignRecord(parsed)) ||
+            namesFileOutOfTree(parsed, projectRoots, resolver, scope))) {
+        withheldWhole = true;
+        // R17: the whole record is another work tree's. Nothing is left for the path rule to decide.
+        //
+        // ⛔ C26: a KEY inside a tool subtree can itself be content (a result keyed by file name or path, `{"customers/bigbank.pdf": {...}}`),
+        // and `isolate` withholds string VALUES, never keys. Such a record is withheld as a WHOLE line, the same length-preserving shape as
+        // C20's. On one machine's corpus: 827 of 1,229,349 records (716 path-like, 256 with a space), every one under `toolUseResult`.
+        if (hasDataKeyInToolSubtree(parsed))
+            return { line: withheldLine(line), redacted: 1, skipped: 0 };
+        isolate(parsed, counts, false);
+    }
+    else {
+        const aggregate = scope?.multi === true && isObject ? (rules.aggregate?.(parsed) ?? null) : null;
+        if (aggregate !== null) {
+            // C27: a record whose origin the record cannot tell, in a copy of a session that named another work tree: withheld (or, for a KEEP type,
+            // withheld outside its measured keys). A length mismatch below withholds the whole line.
+            withheldWhole = true;
+            if (aggregate.kind === "withhold")
+                isolate(parsed, counts, false);
+            else
+                withholdOutsideKeys(parsed, aggregate.paths, counts);
+        }
+        else {
+            scrubRecord(parsed, counts);
+        }
+    }
     if (counts.redacted === 0)
         return { line, redacted: 0, skipped: counts.skipped };
     let out;
@@ -358,10 +595,53 @@ export function redactLine(line, projectRoots, rules, resolver = containment())
     // not, the accounting matters more than the redaction (see the header) and
     // the caller gets the original bytes plus an honest skip count.
     if (Buffer.byteLength(out) !== Buffer.byteLength(line)) {
+        // A record that is withheld by KIND (another work tree's, or a conversation digest) is withheld whole rather than sent as written.
+        if (withheldWhole)
+            return { line: withheldLine(line), redacted: 1, skipped: 0 };
         return { line, redacted: 0, skipped: counts.redacted + counts.skipped };
     }
     return { line: out, redacted: counts.redacted, skipped: counts.skipped };
 }
+/** C48 (11): does the record's call name a file (see `RedactionScope.namedFiles`) that is outside this copy's tree or inside a hole? */
+function namesFileOutOfTree(record, projectRoots, resolver, scope) {
+    const files = scope?.namedFiles?.(record);
+    return files !== undefined && files.some((file) => !resolver(projectRoots, file) || scope?.hole?.(file) === true);
+}
+function mustWithholdWhole(parsed, projectRoots, rules, resolver, scope) {
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    if (scope?.foreignRecord?.(parsed) === true)
+        return true;
+    if (namesFileOutOfTree(parsed, projectRoots, resolver, scope))
+        return true;
+    if ((rules.alwaysWithheld?.(parsed) ?? null) !== null)
+        return true;
+    if (scope?.multi === true && (rules.aggregate?.(parsed) ?? null) !== null)
+        return true;
+    // Would the path rule (with a folder target's exclusion roots, when there is one) have redacted anything here? Walk a COPY.
+    let copy;
+    try {
+        copy = JSON.parse(JSON.stringify(parsed));
+    }
+    catch {
+        return false;
+    }
+    const probe = { projectRoots, resolver, rules, scope, redacted: 0, skipped: 0, slots: null };
+    scrubRecord(copy, probe);
+    return probe.redacted > 0 || probe.skipped > 0;
+}
+/**
+ * A line the same BYTE length as `line` that withholds all of it and is still one valid JSON object: `{"_":"****"}` for 8+ bytes,
+ * `{}` plus spaces below that (JSON allows trailing whitespace). Pure ASCII, so its length is exactly its character count.
+ */
+function withheldLine(line) {
+    const length = Buffer.byteLength(line);
+    if (length >= 8)
+        return `{"_":"${"*".repeat(length - 8)}"}`;
+    if (length >= 2)
+        return `{}${" ".repeat(length - 2)}`;
+    return "*".repeat(length);
+}
 /**
  * Redact every complete line in a raw transcript span.
  *
@@ -371,7 +651,9 @@ export function redactLine(line, projectRoots, rules, resolver = containment())
  * which is what keeps a span that bisects a multi-byte character from changing
  * length when it is re-encoded.
  */
-export function redactSpan(span, projectRoots, rules) {
+export function redactSpan(span, projectRoots, rules, scope, 
+/** The absolute offset of `span[0]` in its file (`scope.at` is told each segment's). */
+spanStart = 0) {
     const resolver = containment();
     const counts = { redacted: 0, skipped: 0 };
     const NEWLINE = 0x0a;
@@ -381,7 +663,8 @@ export function redactSpan(span, projectRoots, rules) {
         if (i !== span.length && span[i] !== NEWLINE)
             continue;
         const segment = span.subarray(start, i);
-        out.push(redactSegment(segment, projectRoots, rules, resolver, counts));
+        scope?.at?.(spanStart + start);
+        out.push(redactSegment(segment, projectRoots, rules, resolver, counts, scope));
         if (i !== span.length)
             out.push(span.subarray(i, i + 1));
         start = i + 1;
@@ -394,13 +677,13 @@ export function redactSpan(span, projectRoots, rules) {
     }
     return { bytes, ...counts };
 }
-function redactSegment(segment, projectRoots, rules, resolver, counts) {
+function redactSegment(segment, projectRoots, rules, resolver, counts, scope) {
     const text = segment.toString("utf8");
     // A lossy decode (the span bisected a character) would re-encode to a
     // different length. Pass the raw bytes through instead.
     if (Buffer.byteLength(text) !== segment.length)
         return segment;
-    const result = redactLine(text, projectRoots, rules, resolver);
+    const result = redactLine(text, projectRoots, rules, resolver, scope);
     counts.redacted += result.redacted;
     counts.skipped += result.skipped;
     if (result.line === text)
@@ -408,6 +691,178 @@ function redactSegment(segment, projectRoots, rules, resolver, counts) {
     const replaced = Buffer.from(result.line, "utf8");
     return replaced.length === segment.length ? replaced : segment;
 }
+/**
+ * C27: withhold every string in `node` whose KEY PATH is not in `allowed`. A path is the object keys from the root joined by `.`, with a key that is
+ * not an identifier (a model id under `modelUsage`) written `<datakey>`; arrays add nothing to the path. A KEEP type is bound to the paths measured
+ * for it, so a string under a key it does not have today is withheld, whatever the key is called.
+ */
+function withholdOutsideKeys(node, allowed, ctx, path = "") {
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i += 1) {
+            const item = node[i];
+            if (typeof item === "string") {
+                if (!allowed.has(path))
+                    withholdLeaf(node, i, ctx);
+            }
+            else {
+                withholdOutsideKeys(item, allowed, ctx, path);
+            }
+        }
+        return;
+    }
+    if (node === null || typeof node !== "object")
+        return;
+    const record = node;
+    for (const key of Object.keys(record)) {
+        const here = path === "" ? (SCHEMA_KEY.test(key) ? key : "<datakey>") : `${path}.${SCHEMA_KEY.test(key) ? key : "<datakey>"}`;
+        const value = record[key];
+        if (typeof value === "string") {
+            if (!allowed.has(here))
+                withholdLeaf(record, key, ctx);
+        }
+        else {
+            withholdOutsideKeys(value, allowed, ctx, here);
+        }
+    }
+}
+/**
+ * The path rule over one whole record: `walk` (the object-local rule), then C39 (i), the record-level sibling rule.
+ *
+ * ⛔ C39 (i): Claude records a Read twice in ONE record: the structured copy (`toolUseResult.file {filePath, content}`) that the path rule
+ * judges, and the text the model was shown (`message.content[{type: "tool_result", content}]`, line-numbered), which has no path beside it
+ * and was sent as written (a HIGH since 0.8.0; the same shape for Write and Edit results). When the record's `toolUseResult`, or a
+ * `tool_use` input in its `message.content`, names a file outside the tree, EVERY `tool_result` block of that record is withheld, whatever
+ * its encoding (a string, or an array of text items; an image's data too), length-preservingly. A result that names no file at all (a
+ * shell's stdout, a hook's output, a Grep over a folder, a fetch) has nothing to judge by and stays as written: a stated residual.
+ */
+function scrubRecord(node, ctx) {
+    walk(node, ctx);
+    if (node === null || typeof node !== "object" || Array.isArray(node))
+        return;
+    const record = node;
+    const message = record.message;
+    if (message === null || typeof message !== "object")
+        return;
+    const blocks = message.content;
+    if (!Array.isArray(blocks))
+        return;
+    const results = blocks.filter((b) => b !== null && typeof b === "object" && b.type === "tool_result");
+    if (results.length === 0)
+        return;
+    const named = namesOutOfTree(record.toolUseResult, ctx) ||
+        blocks.some((b) => b !== null && typeof b === "object" && b.type === "tool_use" && namesOutOfTree(b.input, ctx));
+    if (named) {
+        for (const block of results)
+            withholdResultBlock(block, ctx);
+        return;
+    }
+    // C40 (1): a result whose file is named only in the CALL (an image Read has no path in its result). The call's paths were recorded when the
+    // transcript was scanned; they are judged HERE, per copy, with this copy's roots and holes. A call that is unknown fails closed.
+    const lookup = ctx.scope?.calls;
+    if (lookup === undefined)
+        return;
+    let condemned = false;
+    for (const block of results) {
+        const id = block.tool_use_id;
+        if (typeof id !== "string")
+            continue;
+        const verdict = lookup(id);
+        const out = verdict === "unknown" || (verdict !== "none" && verdict.some((path) => !ctx.resolver(ctx.projectRoots, path) || ctx.scope?.hole?.(path) === true));
+        if (!out)
+            continue;
+        condemned = true;
+        withholdResultBlock(block, ctx);
+    }
+    // The record's structured copy of the same result (an image Read's `toolUseResult.file.base64`) goes with it; the selector paths and `type` stay.
+    if (condemned && record.toolUseResult !== null && typeof record.toolUseResult === "object")
+        withholdResultLeavesExcept(record.toolUseResult, ctx, ctx.rules.pathKeys);
+}
+/** `withholdResultLeaves`, keeping the strings under `kept` keys too (the selector paths of a result). */
+function withholdResultLeavesExcept(node, ctx, kept) {
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i += 1) {
+            const item = node[i];
+            if (typeof item === "string")
+                withholdLeaf(node, i, ctx);
+            else
+                withholdResultLeavesExcept(item, ctx, kept);
+        }
+        return;
+    }
+    if (node === null || typeof node !== "object")
+        return;
+    const record = node;
+    for (const key of Object.keys(record)) {
+        const value = record[key];
+        if (typeof value === "string") {
+            if (!RESULT_KEPT_KEYS.has(key) && !kept.has(key))
+                withholdLeaf(record, key, ctx);
+        }
+        else {
+            withholdResultLeavesExcept(value, ctx, kept);
+        }
+    }
+}
+/**
+ * Replace `container[key]` (a string leaf) with its withheld form and REGISTER A SLOT for it (C41), so a nested document's `pad` can lengthen
+ * it when the encoded form needs a few more bytes. A replacement that registers no slot is one `pad` cannot balance.
+ */
+function withholdLeaf(container, key, ctx) {
+    const original = container[key];
+    if (typeof original !== "string")
+        return;
+    const withheld = withholdString(original);
+    if (withheld === null)
+        return;
+    container[key] = withheld;
+    ctx.redacted += 1;
+    ctx.slots?.push({ record: container, key: String(key) });
+}
+/** Keys inside a `tool_result` block that stay: what KIND of block this is, never what it holds. */
+const RESULT_KEPT_KEYS = new Set(["type", "media_type"]);
+function withholdResultBlock(block, ctx) {
+    const content = block.content;
+    if (typeof content === "string") {
+        withholdLeaf(block, "content", ctx);
+        return;
+    }
+    withholdResultLeaves(content, ctx);
+}
+function withholdResultLeaves(node, ctx) {
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i += 1) {
+            const item = node[i];
+            if (typeof item === "string")
+                withholdLeaf(node, i, ctx);
+            else
+                withholdResultLeaves(item, ctx);
+        }
+        return;
+    }
+    if (node === null || typeof node !== "object")
+        return;
+    const record = node;
+    for (const key of Object.keys(record)) {
+        const value = record[key];
+        if (typeof value === "string") {
+            if (RESULT_KEPT_KEYS.has(key))
+                continue;
+            withholdLeaf(record, key, ctx);
+        }
+        else {
+            withholdResultLeaves(value, ctx);
+        }
+    }
+}
+/** Withhold every string under `record[key]` (the value itself when it is a string), length-preserving. */
+function withholdUnder(record, key, ctx) {
+    const value = record[key];
+    if (typeof value === "string") {
+        withholdLeaf(record, key, ctx);
+        return;
+    }
+    withholdResultLeaves(value, ctx);
+}
 /**
  * Walk the record, redacting content that sits beside an out-of-tree path.
  *
@@ -421,28 +876,54 @@ function redactSegment(segment, projectRoots, rules, resolver, counts) {
  */
 function walk(node, ctx, 
 /** True once an ancestor named a file outside the tree. */
-inherited = false) {
+inherited = false, 
+/** C37: True inside a record's `attachment` subtree, where `path`/`filename` and `rawContent`/`snippet` join the key sets. */
+inAttachment = false) {
     if (Array.isArray(node)) {
         for (const item of node)
-            walk(item, ctx, inherited);
+            walk(item, ctx, inherited, inAttachment);
         return;
     }
     if (node === null || typeof node !== "object")
         return;
     const record = node;
+    const extra = inAttachment ? ctx.rules.attachment : undefined;
     // A nested object that names its OWN file decides for its own subtree: an
     // in-tree read quoted inside an out-of-tree record is still the user's own
     // content, and the reverse is still somebody else's.
-    const named = namesAFile(record, ctx.rules.pathKeys);
-    const outOfTree = named === null ? inherited : !ctx.resolver(ctx.projectRoots, named);
+    const named = namesAFile(record, ctx.rules.pathKeys) ?? (extra === undefined ? null : namesAFile(record, extra.pathKeys));
+    const outOfTree = named === null ? inherited : !ctx.resolver(ctx.projectRoots, named) || ctx.scope?.hole?.(named) === true;
     for (const key of Object.keys(record)) {
         const value = record[key];
-        if (outOfTree && ctx.rules.contentKeys.has(key) && typeof value === "string") {
+        // C38 (b): a `skills[]` item with NO path of its own (nothing to judge its content by) is withheld in EVERY copy, failing closed.
+        if (inAttachment && key === "skills" && Array.isArray(value))
+            withholdPathlessSkills(value, ctx);
+        if (ctx.rules.withheldKeys?.(key) === true) {
+            // C40 (2): injected instruction text, withheld whether or not a path is in scope.
+            withholdUnder(record, key, ctx);
+        }
+        else if (outOfTree && (ctx.rules.contentKeys.has(key) || extra?.contentKeys.has(key) === true) && typeof value === "string") {
             replaceString(record, key, value, ctx);
         }
+        else if (extra?.contentKeys.has(key) === true && value !== null && typeof value === "object") {
+            // C41 (3) / C45 (1): an attachment's content key can hold ANY shape (a list of strings, a list of `{type, text}` blocks, nested lists), and an object
+            // inside it can name a file of its own. Judged RECURSIVELY by the nearest file-naming object, whatever the leaf keys are called: under an out-of-tree
+            // verdict every string leaf is withheld; under an in-tree one they are kept; an object naming a file replaces the verdict for its subtree.
+            withholdUnlessOwnFile(value, ctx, outOfTree);
+        }
         else if (outOfTree && ctx.rules.patchKeys.has(key)) {
             redactPatch(value, ctx);
         }
+        else if (key === WIRE_KEY && value !== null && typeof value === "object" && !Array.isArray(value)) {
+            // C39 (ii): `wireToolInputs` is `{<tool_use id>: {file_path, content}}`, a second copy of every tool input. An entry that is an
+            // object is reached by the object-local rule below; an entry that is a JSON STRING is opened here, like Codex's `arguments`.
+            const entries = value;
+            for (const id of Object.keys(entries)) {
+                const entry = entries[id];
+                if (typeof entry === "string")
+                    redactNested(entries, id, entry, ctx, outOfTree);
+            }
+        }
         else if (ctx.rules.nestedJsonKeys.has(key) && typeof value === "string") {
             // ⛔ NOT gated on `outOfTree`. The path key that decides a Codex exec
             // (`workdir`) lives INSIDE the nested document, so the outer object has
@@ -456,10 +937,119 @@ inherited = false) {
     // new_string}]` sit one level BELOW the object carrying `file_path`, so a rule
     // that only redacted an object's own keys walked straight past a third party's
     // file content. Verified leaking before the change and redacted after.
-    for (const value of Object.values(record)) {
-        walk(value, ctx, outOfTree);
+    // C37: every attachment record carries `rendered: [{content}]`, the text the model was shown for it, which REPEATS the attachment's file
+    // content (an `instructions` record's `rendered` holds the whole CLAUDE.md). `rendered` is a sibling of `attachment`, not inside it, so
+    // the verdict of the file(s) the attachment names must reach it explicitly.
+    const renderedOut = !inAttachment && ctx.rules.attachment !== undefined && typeof record.attachment === "object" && record.attachment !== null
+        ? attachmentNamesOutOfTree(record.attachment, ctx)
+        : false;
+    for (const [key, value] of Object.entries(record)) {
+        if (key === "rendered" && !inAttachment && ctx.rules.attachment !== undefined && typeof record.attachment === "object" && record.attachment !== null) {
+            // C41 / P2's (3b) / C45 (1): `rendered` repeats the attachment's content, whatever its shape (`[{content}]` in every real record, `[{type, text}]`
+            // possible). Under an out-of-tree attachment verdict every string leaf is withheld except `type`/`media_type`; under an in-tree one they are kept; in
+            // both, a nested object that names its own file decides for its subtree.
+            withholdValueUnlessOwnFile(record, key, ctx, renderedOut);
+            // C46: IN ADDITION to the normal walk, never instead of it. The verdict above withholds string leaves; it does not open an encoded carrier
+            // (`wireToolInputs`, `arguments`) nested inside `rendered`, which the walk decodes and redacts. Walking over markers already written is idempotent.
+            // inAttachment=true (C47): `rendered` repeats the attachment, so its objects name their files by the attachment's selectors too (path, filename, planFilePath, targetFile).
+            walk(record[key], ctx, outOfTree || renderedOut, true);
+            continue;
+        }
+        walk(value, ctx, outOfTree, inAttachment || (ctx.rules.attachment !== undefined && key === "attachment"));
+    }
+}
+/** C38 (b): the content of a `skills[]` item that names no file of its own, withheld whatever copy it is in. */
+function withholdPathlessSkills(items, ctx) {
+    const contentKeys = new Set([...ctx.rules.contentKeys, ...(ctx.rules.attachment?.contentKeys ?? [])]);
+    for (const item of items) {
+        if (item === null || typeof item !== "object" || Array.isArray(item))
+            continue;
+        const skill = item;
+        if ((namesAFile(skill, ctx.rules.pathKeys) ?? namesAFile(skill, ctx.rules.attachment?.pathKeys ?? new Set())) !== null)
+            continue;
+        for (const key of Object.keys(skill)) {
+            if (!contentKeys.has(key))
+                continue;
+            const value = skill[key];
+            if (typeof value === "string")
+                withholdLeaf(skill, key, ctx);
+            else
+                withholdResultLeaves(value, ctx);
+        }
     }
 }
+/** `withholdUnlessOwnFile` for `container[key]`, which may itself be a bare string (`rendered: "S"`): that is withheld too (C44 (1)). */
+function withholdValueUnlessOwnFile(container, key, ctx, outOfTree = true) {
+    if (typeof container[key] === "string") {
+        if (outOfTree)
+            withholdLeaf(container, key, ctx);
+    }
+    else {
+        withholdUnlessOwnFile(container[key], ctx, outOfTree);
+    }
+}
+/** Is the file an object names inside the tree, and not in a hole? Only then does the object decide for itself (C44 (1)). */
+function ownFileInTree(own, ctx) {
+    return ctx.resolver(ctx.projectRoots, own) && ctx.scope?.hole?.(own) !== true;
+}
+/**
+ * Withhold the string leaves under `node` that belong to somebody else's file, except under `type`/`media_type`. The verdict is INHERITED down the subtree
+ * (`outOfTree`, true at the call sites, which run under an out-of-tree verdict) and an object that names a file REPLACES it with its own: an object naming
+ * an IN-TREE file is the user's own (its strings stay) and an object naming an OUT-OF-TREE file has every leaf withheld, its path selectors excepted.
+ * Neither is an exemption for what is nested inside it (C45 (1)): a child object that names its own file decides for itself, so an out-of-tree file nested
+ * in an in-tree object is withheld and an in-tree one nested in an out-of-tree object is kept.
+ */
+function withholdUnlessOwnFile(node, ctx, outOfTree = true) {
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i += 1) {
+            const item = node[i];
+            if (typeof item === "string") {
+                if (outOfTree)
+                    withholdLeaf(node, i, ctx);
+            }
+            else {
+                withholdUnlessOwnFile(item, ctx, outOfTree);
+            }
+        }
+        return;
+    }
+    if (node === null || typeof node !== "object")
+        return;
+    const record = node;
+    const own = namesAFile(record, ctx.rules.pathKeys) ?? namesAFile(record, ctx.rules.attachment?.pathKeys ?? new Set());
+    const here = own === null ? outOfTree : !ownFileInTree(own, ctx);
+    const attachmentKeys = ctx.rules.attachment?.pathKeys;
+    for (const key of Object.keys(record)) {
+        const value = record[key];
+        if (typeof value === "string") {
+            const selector = own !== null && (ctx.rules.pathKeys.has(key) || attachmentKeys?.has(key) === true);
+            if (here && !RESULT_KEPT_KEYS.has(key) && !selector)
+                withholdLeaf(record, key, ctx);
+        }
+        else {
+            withholdUnlessOwnFile(value, ctx, here);
+        }
+    }
+}
+/** Does any object in this attachment subtree name a file (by `path`, `filename`, `filePath`, ...) that is out of tree? Pure: it redacts nothing. */
+function attachmentNamesOutOfTree(node, ctx) {
+    return namesOutOfTree(node, ctx, ctx.rules.attachment?.pathKeys);
+}
+/**
+ * Does any object in this subtree name a file outside the tree, by a path key of the profile (and `extraKeys`)? Pure: it redacts nothing.
+ * C27: NO depth cap (it failed OPEN-then-closed: past 12 levels it condemned a deeply nested in-tree MCP result for nothing). `walk` has none and parsed JSON is acyclic.
+ */
+function namesOutOfTree(node, ctx, extraKeys) {
+    if (Array.isArray(node))
+        return node.some((item) => namesOutOfTree(item, ctx, extraKeys));
+    if (node === null || typeof node !== "object")
+        return false;
+    const record = node;
+    const named = namesAFile(record, ctx.rules.pathKeys) ?? (extraKeys === undefined ? null : namesAFile(record, extraKeys));
+    if (named !== null && (!ctx.resolver(ctx.projectRoots, named) || ctx.scope?.hole?.(named) === true))
+        return true;
+    return Object.values(record).some((value) => namesOutOfTree(value, ctx, extraKeys));
+}
 /**
  * Descend into a key whose STRING value is itself a JSON document — `CR-185`.
  *
@@ -504,34 +1094,34 @@ function redactNested(record, key, value, ctx, inherited) {
     }
     if (inner === null || typeof inner !== "object")
         return;
-    // The INNER round-trip gate, for the reason the outer one exists: the
-    // arithmetic below is only exact if everything this function does not touch
-    // re-serialises to the same bytes.
-    let baseline;
+    // The INNER round-trip gate, for the reason the outer one exists: the arithmetic below is only exact if everything this function does not
+    // touch re-serialises to the same bytes. ⛔ C41 (1): a document that fails it is NOT left alone: it is judged first (below), and when it
+    // needs redaction the WHOLE encoded string is withheld.
+    let roundTrips = true;
     try {
-        baseline = JSON.stringify(inner);
+        roundTrips = JSON.stringify(inner) === value;
     }
     catch {
-        return;
+        roundTrips = false;
     }
-    if (baseline !== value)
-        return;
     const target = Buffer.byteLength(JSON.stringify(value));
     const slots = [];
     const nested = { ...ctx, redacted: 0, skipped: 0, slots };
     walk(inner, nested, inherited);
-    ctx.skipped += nested.skipped;
-    if (nested.redacted === 0)
+    // Nothing in it needs redaction: it ships as written (a long encoded document with no out-of-tree content is the common case).
+    if (nested.redacted === 0 && nested.skipped === 0)
         return;
-    const out = pad(inner, slots, target);
+    // ⛔ C41 (1)(2), fail closed: the document NEEDS redaction, and either it does not round-trip (whitespace, key spacing) or `pad` cannot
+    // balance it. The original is NEVER put back: the whole encoded string becomes one withheld value, which keeps the outer length and the
+    // outer JSON valid. (A record with an out-of-tree `workdir` in non-canonical arguments used to ship as written.)
+    const out = roundTrips ? pad(inner, slots, target) : null;
     if (out === null) {
-        // Everything withheld inside is put back. Counted as skipped, because the
-        // bytes are leaving unredacted and the number has to be reportable.
-        ctx.skipped += nested.redacted;
+        withholdLeaf(record, key, ctx);
         return;
     }
     record[key] = out;
     ctx.redacted += nested.redacted;
+    ctx.skipped += nested.skipped;
 }
 /**
  * Re-encode the nested document at exactly `target` outer-encoded bytes.
@@ -582,6 +1172,94 @@ function widen(marker, extra) {
         ? `${marker.slice(0, -REDACTION.tail.length)}${fill}${REDACTION.tail}`
         : `${marker}${fill}`;
 }
+/**
+ * Keys whose subtree is a TOOL's arguments or a tool's result: what a command was given and what it printed. ⛔ **No key is
+ * structural in here** (P1, A-T4 review): an MCP call from repo A such as `create_repository {name: "acme-secret-merger"}`, or a
+ * todo list's `id` and `status`, is content of the work done there even though `name` and `id` are scaffolding on the record
+ * itself. A tool_result's own `content` is the same kind of subtree.
+ */
+const TOOL_SUBTREE_KEYS = new Set(["input", "arguments", "toolUseResult", "tool_use_result"]);
+/**
+ * A schema key is an identifier: letters, digits and underscores, starting with a letter or underscore, at most 64. Anything else as a
+ * KEY inside a tool subtree (a path, a file name, a URL, an id, a flag such as `-n`, a name with a space or a hyphen) is data wearing a
+ * key's clothes (C26). Deliberately the narrow side: measured against the wider "looks like a path, file name, URL or id" test, it adds
+ * two keys in 1.2 million records (`-n`), and a thinner record is the failure direction this module chooses.
+ */
+const SCHEMA_KEY = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+/** Does any key inside a tool-arguments or tool-result subtree of this record fail `SCHEMA_KEY`? Same subtree test as `isolate`. */
+function hasDataKeyInToolSubtree(node, inTool = false) {
+    if (Array.isArray(node))
+        return node.some((item) => hasDataKeyInToolSubtree(item, inTool));
+    if (node === null || typeof node !== "object")
+        return false;
+    const record = node;
+    const isToolResult = record.type === "tool_result";
+    for (const key of Object.keys(record)) {
+        if (inTool && !SCHEMA_KEY.test(key))
+            return true;
+        const childInTool = inTool || TOOL_SUBTREE_KEYS.has(key) || (isToolResult && key === "content");
+        if (hasDataKeyInToolSubtree(record[key], childInTool))
+            return true;
+    }
+    return false;
+}
+/**
+ * R17: withhold every content-bearing string of a record that ran inside another work tree. On the record's OWN scaffolding,
+ * strings under a STRUCTURAL key stay; everything else, and EVERYTHING inside a tool-arguments or tool-result subtree, becomes a
+ * length-preserving marker; a string too short for a marker becomes a same-length run of `*` (`withholdString`), never kept.
+ */
+function isolate(node, ctx, keptKey, inTool = false) {
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i += 1) {
+            const item = node[i];
+            if (typeof item === "string") {
+                if (keptKey && !inTool)
+                    continue;
+                const withheld = withholdString(item);
+                if (withheld === null)
+                    continue;
+                node[i] = withheld;
+                ctx.redacted += 1;
+            }
+            else {
+                isolate(item, ctx, keptKey, inTool);
+            }
+        }
+        return;
+    }
+    if (node === null || typeof node !== "object")
+        return;
+    const record = node;
+    const isToolResult = record.type === "tool_result";
+    for (const key of Object.keys(record)) {
+        const value = record[key];
+        const childInTool = inTool || TOOL_SUBTREE_KEYS.has(key) || (isToolResult && key === "content");
+        if (typeof value === "string") {
+            if (inTool || !STRUCTURAL_KEYS.has(key)) {
+                const withheld = withholdString(value);
+                if (withheld !== null) {
+                    record[key] = withheld;
+                    ctx.redacted += 1;
+                }
+            }
+        }
+        else {
+            isolate(value, ctx, !childInTool && STRUCTURAL_KEYS.has(key), childInTool);
+        }
+    }
+}
+/**
+ * What an ISOLATED record's string becomes: the usual length-preserving marker, or, when the string is too short to hold even the
+ * smallest honest marker, a same-length run of `*` (C18 #4a). A foreign record is withheld, not sampled: a `"password":"secret"` too
+ * short for a marker is still another repo's content. `null` only for the empty string, which has nothing to hide.
+ */
+function withholdString(value) {
+    const marker = markerFor(value);
+    if (marker !== null)
+        return marker;
+    const target = Buffer.byteLength(JSON.stringify(value)) - 2;
+    return target > 0 ? "*".repeat(target) : null;
+}
 /** The path this object names, or null if it names none. */
 function namesAFile(record, pathKeys) {
     for (const key of Object.keys(record)) {
@@ -604,28 +1282,16 @@ function redactPatch(patch, ctx) {
         if (!Array.isArray(lines))
             continue;
         for (let i = 0; i < lines.length; i += 1) {
-            const value = lines[i];
-            if (typeof value !== "string")
-                continue;
-            const marker = markerFor(value);
-            if (marker === null) {
-                ctx.skipped += 1;
-                continue;
-            }
-            lines[i] = marker;
-            ctx.redacted += 1;
+            if (typeof lines[i] === "string")
+                withholdLeaf(lines, i, ctx);
         }
     }
 }
 function replaceString(record, key, value, ctx) {
-    const marker = markerFor(value);
-    if (marker === null) {
-        ctx.skipped += 1;
-        return;
-    }
-    record[key] = marker;
-    ctx.redacted += 1;
-    ctx.slots?.push({ record, key });
+    // C39 (b): a value too short for the 13-byte marker becomes a same-length run of `*` (`withholdString`), never kept. 0.8.0 kept it and
+    // counted it as skipped; `isolate` already withheld such a value in another repo's record, so the trade is no longer needed.
+    void value;
+    withholdLeaf(record, key, ctx);
 }
 /**
  * A marker whose JSON-ENCODED byte length is exactly the original's.