codeep 3.4.0 → 3.4.1

package/dist/acp/commands.d.ts

@@ -28,6 +28,21 @@ export interface AcpSession {
 export type AcpAgentRunOptions = Pick<AgentSessionOptions, 'onRequestPermission' | 'extraDangerousTools' | 'onExecuteCommand' | 'fs'> & {
     /** Ask the user a yes/no question. Unset: the mode runs without asking. */
     confirm?: (message: string) => Promise<boolean>;
+    /**
+     * Auto mode's answer to the agent's permission gate: yes to everything
+     * except a write to a file that decides what runs later, which is asked
+     * about in every mode. A command that runs the agent passes it in place of
+     * the missing `onRequestPermission`, because the agent refuses those writes
+     * outright when it has nobody to ask — so without this, /go and a skill's
+     * agent step could not touch `.git/config` at all in auto mode, while a
+     * plain prompt could after a confirmation.
+     *
+     * Kept under its own key rather than set on `onRequestPermission`, which
+     * this file reads as "this session asks the user" when it decides whether
+     * to gate a skill's shell lines. Auto mode runs those without asking, as
+     * that mode promises.
+     */
+    onAutoModePermission?: AgentSessionOptions['onRequestPermission'];
 };
 export interface CommandResult {
     /** true if the input was a slash command (even if it failed) */

package/dist/acp/commands.js

@@ -15,6 +15,8 @@ import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { chat } from '../api/index.js';
 import { runAgent, classifyPermissionOutcome, buildDangerousTools } from '../utils/agent.js';
+import { forgetHooksDirectory } from '../utils/toolExecution.js';
+import { shellCommandEnv } from '../utils/shell.js';
 import { beginTurn } from './turns.js';
 /** Pending plans a /go is executing right now. */
 const plansRunning = new Set();
@@ -1535,12 +1537,35 @@ Anything else the agent should know — edge cases, gotchas, things to double-ch
                             stopIfCancelled();
                         }
                     }
+                    // A raw process.env here handed the repository's own `.git/config`
+                    // back to git: `/commit` runs `git commit`, and a repo-scope
+                    // `gpg.program` that Codeep's own commit path neutralises executed
+                    // through this spawn instead.
+                    //
+                    // Built before the spawn, and caught: shellCommandEnv() refuses a
+                    // git line in a repository whose config names a program no override
+                    // switches off, and a refusal that escaped here would abort the
+                    // whole skill from inside executeSkill's callback. Failing the step
+                    // with the refusal's own wording is what a step that cannot run
+                    // looks like everywhere else in this handler.
+                    let env;
+                    try {
+                        env = shellCommandEnv(shellCmd, session.workspaceRoot);
+                    }
+                    catch (error) {
+                        throw new Error(`\`${shellCmd}\` was not run: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    // A command line is the one thing in a skill that can move this
+                    // repository's hooks (`git config core.hooksPath .evil`), and the
+                    // write gate caches where they are for the run.
+                    forgetHooksDirectory();
                     const proc = spawnSync(shellCmd, {
                         cwd: session.workspaceRoot,
                         encoding: 'utf-8',
                         timeout: 60_000,
                         shell: true,
                         stdio: ['pipe', 'pipe', 'pipe'],
+                        env,
                     });
                     const out = ((proc.stdout || '') + (proc.stderr || '')).trim();
                     const block = `\`${shellCmd}\`\n\`\`\`\n${out || '(no output)'}\n\`\`\`\n`;
@@ -1603,7 +1628,11 @@ async function runCommandAgent(task, session, onChunk, abortSignal, agentRun) {
         abortSignal,
         onIteration: (_i, msg) => { onChunk(msg + '\n'); },
         onThinking: (text) => { onChunk(text); },
-        onRequestPermission: agentRun?.onRequestPermission,
+        // Manual mode's dialog, or — in auto mode, where there is none — the
+        // answer that mode gives. Passing nothing would leave the run with no way
+        // to confirm a write to a file that decides what runs later, and the agent
+        // refuses those rather than doing them unasked.
+        onRequestPermission: agentRun?.onRequestPermission ?? agentRun?.onAutoModePermission,
         extraDangerousTools: agentRun?.extraDangerousTools,
         onExecuteCommand: agentRun?.onExecuteCommand,
         fs: agentRun?.fs,

package/dist/acp/server.js

@@ -10,9 +10,10 @@ import { loadCustomCommands } from '../utils/customCommands.js';
 import { registerSessionServers, disposeAllSessions as disposeAllMcpSessions } from '../utils/mcpRegistry.js';
 import { selectSessionMcpServers } from '../utils/mcpConfig.js';
 import { handleMcpSamplingRequest } from '../utils/mcpSamplingBridge.js';
-import { executeCommandAsync, validateCommandAsync } from '../utils/shell.js';
+import { executeCommandAsync, validateCommandAsync, commandEnv } from '../utils/shell.js';
 import { checkCommandRateLimit } from '../utils/ratelimit.js';
 import { recordCommand } from '../utils/history.js';
+import { trustBearingWrite } from '../utils/toolExecution.js';
 import { initWorkspace, loadWorkspace, handleCommand } from './commands.js';
 import { beginTurn } from './turns.js';
 import { handleSetMode as handleSetModeExternal, handleSetConfigOption as handleSetConfigOptionExternal, handleSessionList as handleSessionListExternal, handleSessionDelete as handleSessionDeleteExternal, handleListProviders as handleListProvidersExternal, } from './serverHandlers.js';
@@ -421,6 +422,158 @@ export function exitCodeFromWaitResult(result) {
         return 1;
     return null;
 }
+/**
+ * `GIT_CONFIG_COUNT` and the `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>`
+ * pairs it counts — the numbered half of what hardenedGitEnv() produces.
+ */
+const GIT_CONFIG_ENV_NAME = /^GIT_CONFIG_(?:COUNT|KEY_\d+|VALUE_\d+)$/;
+/**
+ * The rest of what the terminal has to be given by name — see acpEnvList().
+ *
+ * `GIT_PAGER` and `GIT_TERMINAL_PROMPT` are hardenedGitEnv()'s two
+ * non-numbered outputs. `GIT_CONFIG_GLOBAL` / `GIT_CONFIG_SYSTEM` /
+ * `GIT_CONFIG_NOSYSTEM` are the variables the SCAN itself read the config
+ * through: leaving them behind would let the terminal's git resolve a
+ * different global config than the one Codeep just decided was safe.
+ *
+ * Everything after them is there for a client that REPLACES its environment
+ * with this list rather than extending it, and it is the half the first cut
+ * of this hotfix got wrong: the list was `PATH` and `HOME` — enough for the
+ * hardened `git status` it was written for — while acpEnvList() is applied
+ * to EVERY command handed to terminal/create. Against a replacing client
+ * that cost an ordinary command things that are not secrets and that it had
+ * in the user's own shell: `git push` over SSH had no agent socket to sign
+ * with and fell back to asking for a password on a terminal whose
+ * GIT_TERMINAL_PROMPT is `0`, which fails it outright; a test that sorts
+ * strings or formats a date ran under the C locale instead of the user's; a
+ * build had nowhere but the default /tmp to put its temporaries; anything
+ * behind a corporate proxy could not reach the network at all; and a
+ * toolchain installed under a version manager lost the variable its shim
+ * reads to pick a version.
+ *
+ * It stays an ALLOWLIST rather than becoming "process.env minus the names
+ * that look like credentials", because what made the change necessary is
+ * that `env` is not a private channel (see acpEnvList) and a name-shaped
+ * denylist does not recognise `DATABASE_URL`, a company's own `ACME_CREDS`,
+ * or anything else whose name does not say what it holds. A name gets in
+ * here only when it is known not to hold one.
+ *
+ * The one value below that CAN carry a credential is a proxy URL
+ * (`https_proxy=http://user:pass@proxy`), which is why redactCredentials()
+ * in src/acp/transport.ts has a rule for that exact shape. A command behind
+ * a proxy cannot reach the network without it.
+ */
+const ACP_TERMINAL_ENV_NAMES = new Set([
+    // hardenedGitEnv()'s own, and what the scan read the config through.
+    'GIT_PAGER',
+    'GIT_TERMINAL_PROMPT',
+    'GIT_CONFIG_GLOBAL',
+    'GIT_CONFIG_SYSTEM',
+    'GIT_CONFIG_NOSYSTEM',
+    // Where programs are found, and whose account runs them. No `PWD`: the
+    // terminal's working directory is the `cwd` of the terminal/create, and
+    // this process's would tell a shell script it is somewhere it is not.
+    'PATH',
+    'HOME',
+    'SHELL',
+    'USER',
+    'LOGNAME',
+    // The agent socket `git push` and `git fetch` over SSH sign with.
+    'SSH_AUTH_SOCK',
+    // Where a build puts its temporaries.
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    // The locale a test that sorts strings or formats a date asserts against.
+    'LANG',
+    'LANGUAGE',
+    // What the command may draw with, and what it thinks the time is.
+    'TERM',
+    'COLORTERM',
+    'TERM_PROGRAM',
+    'TZ',
+    // Toolchains under a version manager: the shim is on PATH, but the shim
+    // reads one of these to find the version to run.
+    'ASDF_DIR',
+    'ASDF_DATA_DIR',
+    'NVM_DIR',
+    'NVM_BIN',
+    'PYENV_ROOT',
+    'RBENV_ROOT',
+    'SDKMAN_DIR',
+    'VOLTA_HOME',
+    'PNPM_HOME',
+    'BUN_INSTALL',
+    'VIRTUAL_ENV',
+    'CONDA_PREFIX',
+    'CARGO_HOME',
+    'RUSTUP_HOME',
+    'GOPATH',
+    'GOROOT',
+    'JAVA_HOME',
+]);
+/**
+ * The same allowlist for the two families whose members cannot be listed:
+ * the locale categories (`LC_ALL`, `LC_TIME`, `LC_COLLATE`, …), and the
+ * proxy variables, which every tool spells in whichever case it was written
+ * in — curl and most of Unix read the lowercase ones, Windows-born tools the
+ * uppercase, and a machine behind a proxy usually sets both.
+ */
+const ACP_TERMINAL_ENV_FAMILY = /^(?:LC_[A-Z]+|(?:HTTP|HTTPS|FTP|ALL|NO)_PROXY|(?:http|https|ftp|all|no)_proxy)$/;
+/**
+ * An environment in the shape `terminal/create` takes it: ACP spells it as a
+ * list of `{ name, value }`, not as the map Node keeps in `process.env`.
+ *
+ * An allowlist goes in it — the hardening's own variables and the shell
+ * essentials above — and not the WHOLE of `process.env`, which is what this
+ * used to serialise. `env` is not a private channel: src/acp/transport.ts
+ * mirrors every outbound frame verbatim into ~/.cache/codeep/acp-debug.log
+ * when CODEEP_ACP_DEBUG is set, so every `ANTHROPIC_API_KEY`,
+ * `GITHUB_TOKEN`, `AWS_SECRET_ACCESS_KEY` and session cookie in the user's
+ * shell was written to a plaintext file on disk — and handed to the editor,
+ * which is free to log the protocol traffic itself. None of them makes the
+ * hardening work; the numbered GIT_CONFIG_* pairs do.
+ *
+ * What else the terminal inherits is the CLIENT's decision, not ours: ACP
+ * does not say whether `env` extends the client's environment or replaces it.
+ * A client that extends gives the command the user's shell environment
+ * anyway; a client that replaces gives it only this list — which is why the
+ * list has to cover what an ORDINARY command needs to run at all and not
+ * only what a hardened git spawn does. A terminal that got `GIT_CONFIG_COUNT`
+ * and nothing else would be running without a PATH.
+ *
+ * Unset variables are dropped rather than sent as `value: undefined` — that
+ * is what `process.env` holds for a variable that is not set, and JSON has no
+ * way to carry it.
+ *
+ * `hardened` says whether commandEnv() actually hardened this spawn, which it
+ * does for `git` and for nothing else. It only decides the last entry below:
+ * a command that cannot reach git is left with the environment it would have
+ * had, which is the same line the refusal path draws.
+ */
+function acpEnvList(env, hardened) {
+    const list = Object.entries(env)
+        .filter((entry) => typeof entry[1] === 'string')
+        .filter(([name]) => ACP_TERMINAL_ENV_NAMES.has(name)
+        || ACP_TERMINAL_ENV_FAMILY.test(name)
+        || GIT_CONFIG_ENV_NAME.test(name))
+        .map(([name, value]) => ({ name, value }));
+    // The one thing this list cannot express is a REMOVAL — an absent name is
+    // not a request to unset one — and hardenedGitEnv() removes exactly one
+    // variable, so it is sent EMPTY instead.
+    //
+    // `GIT_CONFIG_PARAMETERS` is read after the numbered `GIT_CONFIG_*` pairs
+    // and beats them: with `GIT_CONFIG_KEY_0=core.fsmonitor` and an empty value
+    // right there, a `GIT_CONFIG_PARAMETERS='core.fsmonitor=<program>'` still
+    // ran the program on `git status` (verified, git 2.54). So against a client
+    // that EXTENDS its own environment rather than replacing it, one variable
+    // the editor happened to inherit switched this whole hardening off. Git
+    // parses an empty value as no parameters at all (verified, same version),
+    // which is the unset this list has no other way to ask for.
+    if (hardened)
+        list.push({ name: 'GIT_CONFIG_PARAMETERS', value: '' });
+    return list;
+}
 /**
  * Run an execute_command tool call for an ACP session, in the client's
  * terminal when it offers one, otherwise locally.
@@ -461,6 +614,33 @@ export async function executeAcpCommand(command, args, cwd, ctx) {
     // capability in initialize. Otherwise execute locally.
     if (!ctx.clientSupportsTerminal)
         return runLocally();
+    // The client's terminal is a spawn like any other, and it inherits none of
+    // the hardening executeCommandAsync puts on the local one — so over ACP,
+    // which is how Zed runs Codeep, a `git status` in a hostile repository ran
+    // that repository's `core.fsmonitor` and `filter.<d>.clean` exactly as it
+    // did before this hotfix. The validation above stops the argv forms that
+    // redirect git, but nothing was stopping its config.
+    //
+    // Same helper as the local runner, so there is one answer to "what does a
+    // spawn that may reach git run with" — see commandEnv(). A refusal fails
+    // the command with git's own wording rather than handing it to a terminal
+    // this process cannot harden.
+    //
+    // commandEnv() and NOT shellCommandEnv(): this call site has the argv, and
+    // shellCommandEnv() can only scan the spawn's `cwd`. That made one argument
+    // the whole difference between the two runners — `git -C vendor/lib status`
+    // over ACP got the outer project scanned, so the nested checkout was left
+    // with only the always-on GIT_EXECUTING_CONFIG pairs behind it and its
+    // `filter.<driver>.clean` still ran (proven, git 2.54), while the same
+    // command locally reads `-C` out of the argv and scans where git will
+    // actually run.
+    let env;
+    try {
+        env = commandEnv(command, args, cwd);
+    }
+    catch (error) {
+        return fail(error instanceof Error ? error.message : String(error));
+    }
     const { transport, sessionId, signal } = ctx;
     let terminalId;
     try {
@@ -469,6 +649,7 @@ export async function executeAcpCommand(command, args, cwd, ctx) {
             command,
             args,
             cwd,
+            env: acpEnvList(env, command === 'git'),
             outputByteLimit: 1_000_000,
         });
         if (!created || typeof created.terminalId !== 'string') {
@@ -1205,6 +1386,55 @@ export function startAcpServer(transport = new StdioTransport()) {
         // run the agent (/go, custom commands, skill agent steps) run it exactly
         // like a plain prompt.
         const manualMode = session.currentModeId === 'manual';
+        // The one permission dialog this session puts in front of the user.
+        const askAboutToolCall = async (toolCall, 
+        // What the agent gate already worked out about this call. Passed rather
+        // than worked out again: trustBearingWrite() stats the path, resolves a
+        // symlinked ancestor and may ask git where this repository keeps its
+        // hooks. `null` is an answer ("writes no such file"); undefined means
+        // the question came from somewhere that has not looked, which is the
+        // only case that pays for the lookup here.
+        known) => {
+            // A write to a file that decides what runs later says so in the
+            // dialog — the editor shows `toolInput`, and "this file controls what
+            // commands git runs" is the part that makes the answer an informed one.
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, session.workspaceRoot);
+            const result = await askUser({
+                toolCallId: `perm_${randomUUID()}`,
+                toolName: toolCall.tool,
+                toolInput: {
+                    ...formatToolInputForPermission(toolCall.tool, toolCall.parameters),
+                    ...(trustBearing ? { warning: trustBearing.reason } : {}),
+                },
+                status: 'pending',
+                content: [],
+            }, [
+                { optionId: 'allow_once', name: 'Allow once', kind: 'allow_once' },
+                // No "always" for one of those files: the agent answers about this
+                // file only and would not remember the answer anyway.
+                ...(trustBearing ? [] : [{ optionId: 'allow_always', name: 'Allow always', kind: 'allow_always' }]),
+                { optionId: 'reject_once', name: 'Reject once', kind: 'reject_once' },
+                { optionId: 'reject_always', name: 'Reject always', kind: 'reject_always' },
+            ]);
+            // Map ACP outcome back to PermissionOutcome. No answer
+            // (error, cancelled prompt) denies.
+            if (!result || result.outcome.type === 'cancelled')
+                return 'reject_once';
+            return result.outcome.optionId;
+        };
+        // Auto mode's answer to the agent's permission gate: yes to everything
+        // except a write to a file that decides what runs later, which is asked
+        // about in every mode. Without it the agent would have to refuse those
+        // writes outright, having nobody to ask. It travels under its own key on
+        // `agentRun` and never as `onRequestPermission`: a slash command reads
+        // that key being set as "this session asks the user" (see
+        // acp/commands.ts), and auto mode still runs a skill's shell lines
+        // without asking, as it promises.
+        const autoModeAnswer = async (toolCall, known) => {
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, session.workspaceRoot);
+            // Handed on, so the dialog does not look the same file up a third time.
+            return trustBearing ? askAboutToolCall(toolCall, trustBearing) : 'allow_once';
+        };
         const agentRun = {
             // Manual mode gates write_file/edit_file for this run only, per call —
             // NOT by mutating the global `agentConfirmWriteFile` config, which
@@ -1212,27 +1442,11 @@ export function startAcpServer(transport = new StdioTransport()) {
             // a non-atomic restore.
             extraDangerousTools: manualMode ? ['write_file', 'edit_file'] : undefined,
             // Only request permission in Manual mode
-            onRequestPermission: manualMode
-                ? async (toolCall) => {
-                    const result = await askUser({
-                        toolCallId: `perm_${randomUUID()}`,
-                        toolName: toolCall.tool,
-                        toolInput: formatToolInputForPermission(toolCall.tool, toolCall.parameters),
-                        status: 'pending',
-                        content: [],
-                    }, [
-                        { optionId: 'allow_once', name: 'Allow once', kind: 'allow_once' },
-                        { optionId: 'allow_always', name: 'Allow always', kind: 'allow_always' },
-                        { optionId: 'reject_once', name: 'Reject once', kind: 'reject_once' },
-                        { optionId: 'reject_always', name: 'Reject always', kind: 'reject_always' },
-                    ]);
-                    // Map ACP outcome back to PermissionOutcome. No answer
-                    // (error, cancelled prompt) denies.
-                    if (!result || result.outcome.type === 'cancelled')
-                        return 'reject_once';
-                    return result.outcome.optionId;
-                }
-                : undefined,
+            onRequestPermission: manualMode ? askAboutToolCall : undefined,
+            // …and in auto mode, the answer a command that runs the agent uses in
+            // its place, so /go and a skill's agent step get the same one prompt a
+            // plain prompt gets instead of a refusal.
+            onAutoModePermission: manualMode ? undefined : autoModeAnswer,
             // A skill's confirm step ("Deploy to production?") — a one-off
             // question, so no "always" answers.
             confirm: manualMode
@@ -1395,7 +1609,7 @@ export function startAcpServer(transport = new StdioTransport()) {
                             }
                         }
                     },
-                    onRequestPermission: agentRun.onRequestPermission,
+                    onRequestPermission: agentRun.onRequestPermission ?? agentRun.onAutoModePermission,
                     extraDangerousTools: agentRun.extraDangerousTools,
                     fs: agentRun.fs,
                     onExecuteCommand: agentRun.onExecuteCommand,

package/dist/acp/session.d.ts

@@ -1,7 +1,7 @@
 import { PermissionOutcome } from '../utils/agent.js';
 import { ProjectContext } from '../utils/project.js';
 import { ToolCall } from '../utils/tools.js';
-import type { FsCallbacks } from '../utils/toolExecution.js';
+import type { FsCallbacks, TrustBearingWrite } from '../utils/toolExecution.js';
 import type { Message } from '../config/index.js';
 export interface AgentSessionOptions {
     prompt: string;
@@ -11,7 +11,18 @@ export interface AgentSessionOptions {
     onChunk: (text: string) => void;
     onThought?: (text: string) => void;
     onToolCall?: (toolCallId: string, toolName: string, kind: string, title: string, status: 'pending' | 'running' | 'finished' | 'error', locations?: string[], rawOutput?: string) => void;
-    onRequestPermission?: (toolCall: ToolCall) => Promise<PermissionOutcome>;
+    /**
+     * Ask the user about one tool call. Handed straight to runAgent, so the
+     * signature is runAgent's: `trustBearing` is what the agent's own gate
+     * already worked out about the call — the file it would write that decides
+     * what runs later, or null when it writes no such file — and the dialog
+     * words itself from that instead of resolving the path a second time.
+     *
+     * Declared with one parameter, this type said the second argument did not
+     * exist while runAgent passed it on every call, so the one caller that
+     * needs it had to cast its way back to the truth.
+     */
+    onRequestPermission?: (toolCall: ToolCall, trustBearing?: TrustBearingWrite | null) => Promise<PermissionOutcome>;
     /** Tools to force into the per-run dangerous set (ACP manual mode). */
     extraDangerousTools?: string[];
     onExecuteCommand?: (command: string, args: string[], cwd: string) => Promise<{

package/dist/acp/transport.d.ts

@@ -1,4 +1,10 @@
 import { JsonRpcRequest, JsonRpcResponse, JsonRpcNotification } from './protocol.js';
+/**
+ * A frame with its obvious credentials blanked.
+ *
+ * Exported for unit testing (see transport.test.ts).
+ */
+export declare function redactCredentials(frame: string): string;
 type MessageHandler = (msg: JsonRpcRequest | JsonRpcNotification) => void | Promise<unknown>;
 export interface RequestOptions {
     /**

package/dist/acp/transport.js

@@ -1,29 +1,124 @@
 // acp/transport.ts
 // Newline-delimited JSON-RPC over stdio
-import { appendFileSync, mkdirSync } from 'node:fs';
+import { appendFileSync, chmodSync, mkdirSync, renameSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 // Debug log destination — when CODEEP_ACP_DEBUG is set we mirror every
 // inbound and outbound JSON-RPC frame here. Using a file (not stderr) because
 // most ACP clients (Zed included) do not pipe agent stderr to anywhere the
 // user can easily read; a known on-disk path is reliable everywhere.
+//
+// WHAT IS IN IT, because a user asked for it in a bug report will attach the
+// whole file: every frame of the session. That is the prompts, the model's
+// replies, the contents of every file read or written through fs/*, the
+// commands run in the client's terminal and their output, and the `env` of
+// every terminal/create. redactCredentials() blanks the obvious credential
+// shapes on the way in, but it is a filter over text and not a guarantee — a
+// secret that does not look like one survives it. So: session-private, 0600
+// in a 0700 directory, and not something to paste anywhere unread.
 const ACP_DEBUG_PATH = process.env.CODEEP_ACP_DEBUG_FILE
     || join(homedir(), '.cache', 'codeep', 'acp-debug.log');
 const ACP_DEBUG = !!process.env.CODEEP_ACP_DEBUG;
+/**
+ * Roll the log over at 8MB, keeping one previous file.
+ *
+ * It had no limit at all: every frame was appended and nothing ever truncated
+ * or removed the file, and a frame carries whole file contents and whole
+ * command outputs — so a user who left CODEEP_ACP_DEBUG set grew it until the
+ * disk stopped them. One previous file rather than a truncate because the
+ * frames that explain a broken session are usually the handshake at the top,
+ * which is exactly what a truncate throws away. Bounded at twice this, then.
+ */
+const ACP_DEBUG_MAX_BYTES = 8 * 1024 * 1024;
 if (ACP_DEBUG) {
+    // 0700: the directory holds a file with the whole session in it.
     try {
-        mkdirSync(dirname(ACP_DEBUG_PATH), { recursive: true });
+        mkdirSync(dirname(ACP_DEBUG_PATH), { recursive: true, mode: 0o700 });
     }
     catch { /* ignore */ }
 }
+/** Bytes written so far, so the size check costs no syscall per frame. Null
+ *  until the first write reads what an earlier run left on disk. */
+let acpDebugBytes = null;
 function debugLog(direction, payload) {
     if (!ACP_DEBUG)
         return;
+    const line = `${new Date().toISOString()} [ACP${direction}client] ${redactCredentials(payload)}\n`;
+    const bytes = Buffer.byteLength(line);
     try {
-        appendFileSync(ACP_DEBUG_PATH, `${new Date().toISOString()} [ACP${direction}client] ${payload}\n`);
+        if (acpDebugBytes === null)
+            acpDebugBytes = adoptExistingLog();
+        if (acpDebugBytes > 0 && acpDebugBytes + bytes > ACP_DEBUG_MAX_BYTES) {
+            renameSync(ACP_DEBUG_PATH, `${ACP_DEBUG_PATH}.1`);
+            acpDebugBytes = 0;
+        }
+        // `mode` applies only when the file is created, which after the rename
+        // above is every rollover as well as the first frame of the first run.
+        appendFileSync(ACP_DEBUG_PATH, line, { mode: 0o600 });
+        acpDebugBytes += bytes;
     }
     catch { /* swallow — never break the protocol over a logging failure */ }
 }
+/** The size of the log already on disk, 0 when there is none. */
+function adoptExistingLog() {
+    try {
+        const stat = statSync(ACP_DEBUG_PATH);
+        // A log this build did not create is one an older Codeep created 0644 —
+        // world-readable, with everything listed above in it. Tighten it, but
+        // only at our own path: CODEEP_ACP_DEBUG_FILE may name something whose
+        // mode is not ours to change (a fifo, a tty, a shared file).
+        if (!process.env.CODEEP_ACP_DEBUG_FILE && (stat.mode & 0o077) !== 0) {
+            chmodSync(ACP_DEBUG_PATH, 0o600);
+        }
+        return stat.size;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Credential shapes blanked before a frame is mirrored to the debug log.
+ *
+ * The log exists to debug the protocol, so this is deliberately narrow: it
+ * blanks what is unmistakably a secret and leaves everything else readable.
+ * Matched on the frame TEXT rather than on a parsed object because an inbound
+ * frame is logged before it is parsed and may not be JSON at all.
+ *
+ * Nothing here changes the frame on the wire — only the copy on disk.
+ */
+const ACP_DEBUG_REDACTIONS = [
+    // `"apiKey": "…"`, `"authorization": "…"` — the MEMBER NAME says it is a
+    // secret, whatever the value looks like.
+    [/("[A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?key|secret|token|password|passwd|credential|authorization|cookie|private[_-]?key)[A-Za-z0-9_.-]*"\s*:\s*)"(?:[^"\\]|\\.)*"/gi, '$1"[redacted]"'],
+    // ACP spells an environment as `{"name":…,"value":…}`, so the secret-looking
+    // string is the VALUE of `name` and the rule above cannot see it. This is
+    // the shape terminal/create used to leak the whole of process.env in.
+    [/("name"\s*:\s*"[A-Za-z0-9_.-]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|COOKIE)[A-Za-z0-9_.-]*"\s*,\s*"value"\s*:\s*)"(?:[^"\\]|\\.)*"/gi, '$1"[redacted]"'],
+    // And the shapes that are a credential wherever they turn up — a command
+    // line the agent ran, a terminal's own output, a file it read.
+    [/\bsk-[A-Za-z0-9_-]{16,}/g, '[redacted]'], // OpenAI / Anthropic
+    [/\bgh[pousr]_[A-Za-z0-9]{20,}/g, '[redacted]'], // GitHub
+    [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, '[redacted]'],
+    [/\bglpat-[A-Za-z0-9_-]{16,}/g, '[redacted]'], // GitLab
+    [/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, '[redacted]'], // Slack
+    [/\bAKIA[0-9A-Z]{16}\b/g, '[redacted]'], // AWS access key id
+    [/\bAIza[0-9A-Za-z_-]{20,}/g, '[redacted]'], // Google
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, '[redacted]'], // JWT
+    [/\bBearer\s+[A-Za-z0-9._~+/-]{16,}={0,2}/gi, 'Bearer [redacted]'],
+    // `https://user:password@host` — keep the structure, drop the password.
+    [/((?:https?|ssh|git):\/\/[^\s"'/@]+:)[^\s"'/@]+@/g, '$1[redacted]@'],
+];
+/**
+ * A frame with its obvious credentials blanked.
+ *
+ * Exported for unit testing (see transport.test.ts).
+ */
+export function redactCredentials(frame) {
+    let out = frame;
+    for (const [pattern, replacement] of ACP_DEBUG_REDACTIONS)
+        out = out.replace(pattern, replacement);
+    return out;
+}
 const MAX_BUFFER_SIZE = 10 * 1024 * 1024; // 10MB
 const REQUEST_TIMEOUT_MS = 30_000; // 30s
 /** The client answered one of our requests with a JSON-RPC error. */