deel-local-cli 1.2.0 → 1.4.0

package/README.en.md

@@ -59,6 +59,8 @@ Zero dependencies · Node 20+ · Exactly one place your source can go
 - [Auto-compaction](#auto-compaction)
 - [Resuming a conversation](#resuming-a-conversation)
 - [Attaching tools from outside (MCP)](#attaching-tools-from-outside-mcp)
+- [Inside your editor (ACP)](#inside-your-editor-acp)
+- [Keeping secrets out of the conversation](#keeping-secrets-out-of-the-conversation)
 - [Safety](#safety)
 - [Corporate review package](#corporate-review-package)
 - [Configuration](#configuration)
@@ -97,6 +99,29 @@ deel audit                             # full review sheet
 
 ## Quick start
 
+### The screen speaks English too
+
+deel is written in Korean — the code, the function names, the comments. That part stays.
+What you see on screen does not have to.
+
+```bash
+DEEL_LANG=en deel        # this run only
+/lang en                 # and remember it
+/lang                    # how much is translated so far
+```
+
+Untranslated lines come through in Korean rather than as blanks, and `/lang` tells you exactly
+how many are left.
+
+What the model reads follows the same switch. Set it to English and the rules, the mode
+instructions, and the tool descriptions all go out in English — so the model answers you in
+English instead of Korean. That side is cheaper, too: the part of the window that ships on every
+single request drops from about 4,900 tokens to about 3,450 — on a 32k model, from 15% of the
+window to 10.5%.
+
+Tool names and argument names stay Korean (`목적`, `할일`, `번호`). Those are identifiers, not
+prose — rename them and the tool stops being called at all.
+
 ### Install
 
 ```bash
@@ -351,6 +376,10 @@ Names follow Claude Code / Codex conventions.
 | Command | What it does |
 |---|---|
 | `/help` | Command list |
+| `/lang [ko\|en]` | Screen language. Falls back to Korean for anything not translated yet |
+| `/bell [on\|off]` | Ring and set the window title when a turn ends, or when deel needs an answer |
+| `/consult <profile> <question>` | Ask a second model one question. Your current model stays put |
+| `/lsp [on\|off]` | Language servers — what is installed, and whether `Def`/`Refs` are available. `off` turns post-edit diagnostics off only |
 | `/context` | What is consuming the context window |
 | `/ctx [auto\|number]` | Context **length** — re-read it off the model, or set it yourself |
 | `/grade [small\|medium\|large\|auto]` | Model **grade** — how much it does on its own. A different axis from `/ctx` |
@@ -359,7 +388,10 @@ Names follow Claude Code / Codex conventions.
 | `/clear` | Clear the conversation (keeps link and rules) |
 | `/thread [new\|fork\|close\|n]` | Conversation threads — side work in its own context. Link and undo stay shared |
 | `/learned [clear]` | What deel has picked up on its own — commands that work here, this model's habits |
+| `/pin <text>` | Pin a line — folding and compaction **cannot reach it** |
+| `/evidence [file]` | Evidence — what changed, and what proves it. **What is unproven is listed too** |
 | `/model` | Switch connection / model |
+| `/model 카드` | Model card — what this model has actually done here, and what deel changed because of it |
 | `/think <level>` | Reasoning level (`off·low·medium·high·max`) |
 | `/think 배분 <profile>` | Per-stage profile (`even·save·deep`) |
 | `/think 자세히` | Stage table — which stage runs at which level and cap |
@@ -782,6 +814,8 @@ Names and arguments match Claude Code, so skills written for that convention wor
 | `Verify` | Check that what was built **actually works** |
 | `Task` | Run one chunk of a big job in a **separate context** |
 | `Jobs` | Inspect, read and stop **background commands** — the other half of `Bash`'s `background` |
+| `Def` | **Where a name is defined** — only shown when a language server is installed |
+| `Refs` | **Every place a name is used** — only shown when a language server is installed |
 
 Seven tools here are not in Claude Code — `Append`, `Recall`, `Remember`, `Outline`,
 `Verify`, `Task`, `Jobs`. Each tool costs 150-400 tokens of schema on **every request**,
@@ -789,7 +823,7 @@ so a test stops you every time the list grows (`test/loop.test.js`). The last fo
 their cost; here is why.
 
 <details>
-<summary><b>More</b> — Outline · Verify · Task · Commands that never finish and 9 more</summary>
+<summary><b>More</b> — Outline · Verify · Task · Def · Refs · Commands that never finish and 9 more</summary>
 
 ### Seeing a project's shape cheaply — `Outline`
 
@@ -1181,6 +1215,113 @@ last edit did. That original state comes from the earliest undo snapshot.
 `/diff` is **in the simple level's command list.** As long as `auto` edits without asking,
 a beginner needs a way to see what changed more than anyone.
 
+### With a language server, it sees meaning — `Def` and `Refs`
+
+`Grep` finds **text**; a language server knows **meaning**. Grep for `run` and you get the
+`run` in a comment, the `run` in a third-party library, the `run` inside a string. Which of
+those actually call that function is something a person has to open one by one. The model
+cannot afford that, so it edits based on the first few hits, and **the ones it missed only
+surface once you run the thing.**
+
+```
+⏺ Refs(add_up)
+  add_up — used in 3 places · 2 files
+
+  src/use.py (2)
+    4: return add_up(1, 2)
+    9: return add_up(x, x)
+  src/other.py (1)
+    2: value = add_up(9, 9)
+```
+
+`Grep` stays. When you rename something outright you actually need it — a language server
+does not look at comments, config or docs. These two **add to** what was here; they do not
+replace it.
+
+They take a **name**, not a position. LSP asks "this file, this line, this column", but the
+model does not know the column. Finding out means reading the file first, and that throws
+away the whole point of the tool. So it resolves the name through `workspace/symbol` first
+and asks again at that position. When a name exists in several places you get **the list** —
+it does not pick one and pretend.
+
+### It checks the file you just edited
+
+`Verify` stays too. They do different jobs.
+
+| | When | What |
+|---|---|---|
+| `Verify` | Once, before you finish | **Syntax** (`node --check`, `py_compile`) |
+| Post-edit diagnostics | Right after an edit, that file only | **Meaning** (undefined names, wrong types, missing arguments) |
+
+Some things are syntactically fine and still wrong. `node --check` passes all of them.
+
+```
+⏺ Write(pkg/bad.py)
+  3 lines
+  language server — pkg/bad.py: 2 errors
+    line 1 error: Type "Literal['x']" is not assignable to declared type "int"
+    line 2 error: "missing_name" is not defined
+```
+
+Until now that only showed up **once something was run**, and running goes through user
+approval, so it was several steps later. In between, the model treats that file as finished
+and moves to the next one. When the error finally surfaces you have to trace back, and
+tracing back costs more than the fix.
+
+When everything is fine it **says nothing.** A line of "0 errors" after every edit fills the
+window. And not receiving diagnostics is not the same as having none — when nothing came
+back, it says nothing rather than inventing an answer.
+
+### It installs nothing
+
+**deel does not install language servers.** It scans PATH; if one is there it uses it, and
+if not it falls back to `Grep` and `Outline`. This program exists for places where you cannot
+bring in unapproved software, so a tool running `npm i -g` on its own is out of the question.
+
+With no server, `Def` and `Refs` **do not appear in the model's tool list at all** — the same
+way web tools are hidden offline. Leave an unusable tool standing and the model calls it,
+gets "not available", and calls it again. That round trip costs more than the schema does.
+
+`/lsp` shows you what is there.
+
+```
+$ /lsp
+
+  ◈ 2 language server(s) on this machine
+     ✓ ts    typescript-language-server
+     ✓ py    pyright-langserver
+
+  Language of this folder: py · 12 files
+  Tools: Def · Refs
+  Diagnostics after an edit: on
+  Turn post-edit diagnostics on or off: /lsp on · /lsp off
+```
+
+It looks for `ts`, `py`, `go`, `rs`, `java`, `cs`, `cpp`, `rb`, `php` and `lua`. When one is
+missing it prints the install command **as text only.** Whether to run it is your call.
+
+<details>
+<summary>Four things a real server (pyright) taught us</summary>
+
+A stub server alone would have shown green for all of these.
+
+- **Servers spell URIs differently than we do.** We send `file:///C:/…`; pyright answers with
+  `file:///c%3A/…` — lowercase drive letter, percent-encoded colon. Compared as strings they
+  never match. Diagnostics arrive correctly, are not found in our table, and become "nothing
+  came back" — and **saying nothing means the file is sound**, so a broken file gets reported
+  as fine. We compare paths, not URIs.
+- **A server that just started answers empty.** Not because the name is missing but because
+  it has not finished indexing. Asked 0.2s after startup it said no; 0.5s later it said yes.
+  Turning that into "no such name" makes the model create something that already exists. So
+  it asks again a few times, but only while the server is young.
+- **npm installs two names on Windows.** An extension-less sh script and a `.cmd`. Find the
+  first one and the file plainly exists, so it reports "installed" — but Windows cannot run
+  it. Claiming it is there and then failing is the hardest failure to spot.
+- **`cmd /s /c` strips the outer pair of quotes.** Wrap the command once and it breaks
+  entirely, and all you see from the outside is "no language server".
+
+</details>
+
 </details>
 
 ---
@@ -1643,6 +1784,108 @@ missing?" unanswerable.
 
 ---
 
+## Inside your editor (ACP)
+
+A tool that makes you open one more terminal window stops being used after about two weeks.
+Developers live inside the IDE. So deel speaks **ACP** (Agent Client Protocol) — Zed,
+JetBrains, Neovim and Emacs attach to it **without changing a line on their side**.
+
+One command in your editor's settings:
+
+```
+deel acp
+```
+
+The editor spawns that as a child process and exchanges newline-delimited JSON-RPC 2.0 over
+stdio. It is not a command you type yourself.
+
+**What you get once it is attached:**
+
+| In the editor | From deel |
+|---|---|
+| Streaming reply pane | The model's text and its reasoning |
+| Tool list with icons and status | `Read` is a read, `Edit` is an edit, `Bash` is an execution — **the kind is sent**, not just a name |
+| Clickable file links | The **absolute path** of every file touched |
+| Approval dialog | deel's safety rails, rendered as the editor's own prompt (`allow once` · `always allow` · `reject`) |
+| Mode picker | deel's seven work modes (auto · code · plan · architect · debug · ask · orchestrator) |
+| Stop button | Reaches the turn mid-flight, even while waiting on the model |
+
+**Still zero dependencies.** Same reason as MCP — newline-delimited JSON-RPC 2.0 is the whole
+transport, so no SDK is needed.
+
+<details>
+<summary><b>Details</b> — the places this breaks silently</summary>
+
+This protocol fails quietly. The editor shows "the agent is not responding" and nothing
+anywhere explains why. So these are nailed down by tests (`test/acp.test.js` spawns a real
+process and talks over a real pipe).
+
+| The place | Why it matters |
+|---|---|
+| **Nothing but ACP on stdout** | The spec says `MUST NOT`. deel has dozens of places that print to the screen; one of them firing in this mode breaks the pipe. Rather than guarding each call site, **the pipe itself is swapped out** — so code written later is safe without knowing about this. What gets printed is not dropped, it goes to stderr |
+| **Korean split across chunk boundaries** | Pipes break on bytes, not characters. Decoding each chunk separately turns `안녕` into `안<?>하` — and **the JSON still parses**, so no error is raised. The characters are quietly mangled |
+| **A request with `id: 0`** | ACP clients count from zero. Reading `if (msg.id)` treats the very first `initialize` as a notification and never answers — it hangs the moment it connects |
+| **Cancellation reaching a running turn** | Cancellation always arrives while something is running; that is what cancellation is. Awaiting each incoming line in order means it **never arrives** |
+| **When permission cannot be asked** | It is tempting to just run the tool — otherwise nothing works against a client that has not built the approval dialog yet. But that means "if I can't ask, I do as I please". **It does not** |
+
+**What it does not do yet, stated plainly:**
+
+| | |
+|---|---|
+| `session/load` | Restoring a past conversation means replaying every message as an update. Half-built, the editor opens an empty conversation and the user assumes the history is gone. It reports **`loadSession: false`** |
+| Image / audio attachments | Most local models cannot read them. Rather than dropping them silently, deel tells the model what it could not read |
+| MCP servers passed in by the editor | Not launched. That would mean **deel spawning processes named in the editor's config**. "What does this tool launch?" is the first question in a corporate review, and "whatever the editor says" is not an acceptable answer. Only `.deel/mcp.json`, written by a person, is launched |
+
+</details>
+
+---
+
+## Keeping secrets out of the conversation
+
+People rarely paste a key. The leak is almost always **command output**.
+
+```
+env                  OPENAI_API_KEY=sk-proj-…
+git remote -v        https://user:token@github.com/…
+curl -v              > Authorization: Bearer eyJ…
+a failing test log   the whole connection string
+```
+
+That text goes to the model **and** gets written to `.deel/sessions/*.jsonl` on disk. That
+file is later re-read by `/recall` and can end up inside a `deel pack` bundle. Leak once and
+you have several copies.
+
+So it is masked at the single point where tool output enters the conversation.
+
+```
+  ⏺ Bash(env | grep API)  done
+    ⊘ 2 secret-looking values entered the conversation (openai · env var) — masked before the model
+```
+
+What it looks for: private-key blocks · OpenAI/Anthropic keys · GitHub tokens · Slack tokens ·
+AWS keys · Google keys · JWTs · credentials embedded in URLs · `Authorization`-family headers ·
+env vars named `…KEY` / `…TOKEN` / `…SECRET` / `…PASSWORD`. Plus **the configured gateway key
+regardless of its shape** — that one is not a guess, it is a known value.
+
+### File contents are deliberately not masked
+
+`.env` is exactly where masking feels most tempting, and exactly where it backfires: the model
+sees the masked text, edits it, writes it back — and `«가림»` lands where the real key was.
+**Protecting the secret would destroy it.**
+
+So on the file side it reports instead of rewriting.
+
+```
+  ⏺ Read(.env)  12 lines
+    ! 3 secret-looking values entered the conversation (env var)
+      — file contents are not masked (masking them would erase the key on write-back)
+```
+
+Saying plainly what cannot be stopped beats claiming it was stopped while corrupting the file.
+Either way it lands in the audit log.
+
+---
+
 ## Safety
 
 Instead of approval prompts, the design makes things **reversible**. The default `auto` mode
@@ -1753,25 +1996,36 @@ deel pack --out deel-import.zip
 
 ```
   ✓ deel-import.zip
-     39 files · 100.2KB
+     94 files · 509.6KB
 
   Dependencies      0
   Install scripts   none
   External imports  0
   Network calls     3 sites (configured address only)
-  Ports opened      none
+  Ports opened      1 site (/preview only)
 ```
 
-The bundled review sheet contains:
+The zip carries **one document for people and two for machines.** A corporate review is
+not a human-only process — security feeds an SBOM to a scanner, and operations reads the
+audit-log spec to write SIEM ingestion rules.
 
-- Dependency list and every external `import` in the source
-- Presence of `preinstall` / `install` / `postinstall` / `prepare`
-- **Every network and process-spawn call site found by scanning the source** (file:line)
-- The three outbound lanes, explained
-- SHA-256 per file (verify with `certutil -hashfile`)
+| File | What |
+|---|---|
+| `반입심사서.txt` | Dependencies · install scripts · **every network and process-spawn call site found by scanning the source** (file:line) · the three outbound lanes · SHA-256 per file |
+| `sbom.cdx.json` | **SBOM (CycloneDX 1.5).** Feed it straight to a scanner. One component per file with SHA-256; dependencies stated as an **explicit empty array** — "not declared" and "none" are different claims |
+| `심사명세.json` | Egress list (per lane: when, where, what, how it's stopped, and the source location) · **audit-log spec** (field names and meanings, plus what is never recorded) · file hashes |
 
-It is generated by scanning the source, not written by hand — hand-written sheets drift from reality.
-Use `deel audit` to read it without building a zip.
+```bash
+deel audit                    # the human-readable sheet only
+deel sbom                     # the two machine-readable ones, on stdout (deel sbom | jq)
+deel sbom --out review.json   # to a file
+deel sbom --only sbom         # just the SBOM
+```
+
+All three are generated by scanning the source, never written by hand — hand-written sheets
+drift, and **a review document that drifts is worse than none.** Find one wrong line and the
+reviewer stops trusting the rest. The audit-log spec is the one hand-written part, so a test
+checks it against real log records on every run.
 
 <details>
 <summary><b>More</b> — Diagnosing a corporate gateway</summary>
@@ -1985,7 +2239,7 @@ src/
   backend/scan.js        scanning for local servers
   backend/mcp.js         attaching outside tools (MCP, stdio)
 
-  tools/index.js         15 tools
+  tools/index.js         17 tools
   tools/edit-match.js    staged-relaxation edit matching
   tools/outline.js       a file's shape, cheaply
   tools/verify.js        checking what was built
@@ -1995,6 +2249,12 @@ src/
   tools/webfetch.js      reading the web (read-only)
   tools/encoding.js      writing back in the encoding it was read in
   tools/xlsx.js          Excel → CSV (written here)
+  tools/lsp.js           Def · Refs — asking the language server
+
+  lsp/rpc.js             LSP framing (Content-Length + JSON-RPC, written here)
+  lsp/servers.js         finding installed language servers (installs nothing)
+  lsp/client.js          one server: spawn, talk, time out, clean up
+  lsp/diag.js            is the file you just edited sound?
 
   preview/serve.js       serving what you built (127.0.0.1 only)
   skills/discover.js     finding skills, commands and plugins on the machine
@@ -2016,6 +2276,215 @@ test/                    tests (excluded from the published package)
 
 ## Release notes
 
+<details>
+<summary><b>▸ 1.4.0 — deel gets a face, speaks English, and sees meaning</b> · what changed in seven places</summary>
+
+<br>
+
+| | Before | After |
+|---|---|---|
+| `/undo` | rolled back files only — the conversation still believed it happened | rewinds **the conversation too** |
+| Turns that take minutes | you sat watching the screen | a bell and the window title — you can be in another window |
+| Startup · status bar | looked like any other CLI | letters that grow on start, a status bar that names the boundary |
+| English speakers | the screen was all unreadable | `/lang en` — the screen **and what the model reads** |
+| Models per session | one | a different model per chunk — routine work to a small one |
+| Finding a name | `Grep` only — comments and strings mixed in | `Def` / `Refs` — by **meaning**, when a server is installed |
+| A file you just edited | you found out by running it | checked **right after** the edit, that file only |
+
+<br>
+
+#### 1. `/undo` rewinds the conversation
+
+Roll back only the files and the conversation still holds the edit. The model believes it
+just changed that file and builds the next step on top — and nothing on screen says
+otherwise. Now the messages fold back with the files. Folding can orphan a tool call, which
+the server answers with a 400, so the same `repairToolPairs` runs over the result.
+
+#### 2. It tells you when it is done — `/bell`
+
+A local model can take minutes per turn. A bell and the window title say when it finishes.
+The bell is ``, but **not one byte reaches a pipe** — with no TTY it writes nowhere. The
+title ends with ST, not BEL; ending with BEL rings the bell on every title update.
+
+#### 3. A screen that is deel's own
+
+On start, `deel` grows into `deel-local`. The status bar names the boundary you are inside
+with one glyph (`⌂` this folder · `↗` outside · `?` unknown). The animation uses braille and
+box-drawing only — emoji and geometric shapes are East Asian Ambiguous, so their width
+varies per terminal and the line drifts by a column.
+
+#### 4·5. English on screen, and in what the model reads
+
+`/lang en` switches the screen. Untranslated strings come through in Korean rather than as
+blanks, and `/lang` counts honestly how many are left.
+
+But switching only the screen leaves the model answering in Korean — its rules say to. So
+what the model reads switches too (base rules, mode instructions, all sixteen tool
+descriptions). There is a bonus: Korean costs about one token per character and English
+about one per 3.6, so the fixed share of a 32k window dropped from **4,910 to 3,446 tokens.**
+
+Tool names and argument names are **not** translated. Those are identifiers.
+
+#### 6. Several models in one session — `Task`'s `모델`
+
+A large model and a small one, together, on 8GB of RAM. Routine work (formatting, repetitive
+edits, short summaries) goes to the small one; you keep what needs judgement. The subtask's
+endpoint opens through `allowTemporarily` and **always closes in `finally`** — afterwards
+exactly one endpoint is open again.
+
+#### 7. Language servers — `Def`, `Refs`, post-edit diagnostics
+
+See "With a language server, it sees meaning" above. **It installs nothing.**
+
+</details>
+
+<details>
+<summary><b>▸ 1.3.0 — evidence instead of claims, the editor instead of a terminal</b> · what changed in six places</summary>
+
+<br>
+
+| | Before | After |
+|---|---|---|
+| Rules that must hold | **vanished** when folded or summarised | live outside the message list, where folding cannot reach |
+| This model's habits | the prompt **asked** it to behave | the harness changes instead — no cooperation needed |
+| Finishing | "all done" | what changed, and what proves it. **Including what doesn't** |
+| Where you use it | one more terminal window | inside your editor (Zed · JetBrains · Neovim · Emacs) |
+| Review paperwork | one document, for humans | SBOM · egress list · audit spec — **straight into a scanner** |
+| Keys | one `env` and they were in the conversation and on disk | masked where output enters. Files are **deliberately** left alone |
+
+<br>
+
+#### 1. Rules that must hold were vanishing into the fold — `/pin`
+
+Long conversations fold and summarise earlier turns to make room. A 2026 measurement found
+**summarisation preserves only about 50% of safety constraints.** If "never touch this
+folder" lands in the missing half, the model is in a state where it was never told. Nothing
+appears on screen.
+
+Pinned lines are **not kept with the messages.** They are appended to the end of the system
+prompt — and since folding and compaction only touch messages, they are structurally out of
+reach. Not carefully preserved: **impossible to remove.**
+
+```
+/pin never touch src/legacy
+
+  ✓ Pinned — 2 now (78 tokens)
+```
+
+Up to 12 lines / 240 tokens. Past that it says so and carries the most recent — dropping
+them quietly would defeat the point of pinning.
+
+#### 2. Observed habits stayed as words — `/model 카드`
+
+deel already watched what the model did. But watching was all it did — it **wrote advice
+into the prompt**: "you keep truncating arguments, use Append." Small models don't follow
+that advice. That is what makes them small models.
+
+Now what it observes becomes **harness settings**. Instead of asking the model, deel changes
+its own behaviour.
+
+| Observed | What changes |
+|---|---|
+| Arguments truncate often (over 15%) | The cap is raised up front — no wasted first call |
+| It repeats itself | Three identical calls tolerated becomes two |
+| Edits miss often | More surrounding lines are shown on a near-miss |
+
+**Nothing changes before 12 steps.** Pinning down a healthy model because of one unlucky
+truncation is worse than not learning at all.
+
+#### 3. Evidence instead of "all done" — `/evidence`
+
+A 2026 survey found **96% of developers don't fully trust AI-written code, while 48% verify
+it every time.** 38% said it is harder to review than human code.
+
+Why harder? Ask a person why they wrote it that way and you get an answer. Agent-written
+code arrives with **one line: "done."** That line cannot be reviewed.
+
+```
+/evidence
+
+  Changed         3 files · +142 −38
+  Ran             5 commands (1 failed)
+  Unproven        1
+
+  ✗ src/worker.js — the last `npm test` failed — an earlier pass
+                    does not prove the current state.
+```
+
+Listing what changed is something `/diff` already does. What only this does is **say that
+the unproven is unproven.** Three things get caught —
+
+- Changed something and ran nothing? Nothing was proven
+- Counting a red test as green means **offering a failing test as evidence**
+- A check run *before* the edit proves nothing about it — "I ran it earlier" is the most
+  common form of self-deception
+
+If the build passed and the tests broke *after* it, the earlier green is not evidence. The
+last thing you ran is red; it cannot have been verified.
+
+`/evidence filename` writes it as markdown under `.deel/증거/`. The screen scrolls away, and
+the review happens later, by someone else.
+
+#### 4. It made you open one more terminal — `deel acp`
+
+Developers live inside the IDE. A tool that makes you switch windows stops being used after
+about two weeks. A build that cleared corporate review and then nobody uses is the saddest
+possible outcome.
+
+deel now speaks **ACP** (Agent Client Protocol). One line — `deel acp` — in your editor's
+settings and Zed, JetBrains, Neovim and Emacs attach **without changing a line on their side**.
+
+The work isn't connecting the pipe; it is **making the editor able to show something**.
+Kind, location and status are all optional in the spec, so a quick implementation omits all
+three — and then every tool is the same grey dot and no changed file is clickable.
+
+Approval flows through too. deel's safety rails render as the editor's own dialog, and
+"always allow" is remembered for that session. Against a client that cannot ask, it
+**does not run** — "if I can't ask, I do as I please" is not an option.
+
+**Still zero dependencies.** Newline-delimited JSON-RPC 2.0 is the whole transport, so no SDK.
+
+#### 5. Review paperwork only a human could read — `deel sbom`
+
+A Korean financial-sector rule change on 2026-04-20 opened an exemption to the network-
+separation mandate. The paperwork demanded at that door is not prose — security feeds an
+**SBOM to a scanner** for a vulnerability list, and operations reads the audit-log spec to
+write SIEM ingestion rules.
+
+`deel pack` now emits three documents.
+
+| | |
+|---|---|
+| `반입심사서.txt` | The human-readable sheet, as before |
+| `sbom.cdx.json` | CycloneDX 1.5. One component per file with SHA-256. Dependencies as an **explicit empty array** — "not declared" and "none" are different claims |
+| `심사명세.json` | Egress list (per lane: when, where, what, how it's stopped, source location) · audit-log spec · file hashes |
+
+All three are generated by scanning the source. The audit-log spec is the one hand-written
+part, so **a test compares it against real log records on every run** — a review document
+that drifts is worse than none, and one wrong line costs you the reviewer's trust in the rest.
+
+#### 6. One `env` put your keys in the conversation and on disk
+
+People rarely paste a key. The leak is almost always command output — `env`, `git remote -v`,
+`curl -v`, a failing test log. That text goes to the model **and** is written to
+`.deel/sessions/*.jsonl`. Leak once, and you have several copies.
+
+Masking now happens at the single point where tool output enters the conversation:
+private-key blocks, OpenAI, Anthropic, GitHub, Slack, AWS, Google, JWTs, credentials in URLs,
+`Authorization`-family headers, and env vars named `…KEY` / `…TOKEN` / `…SECRET` /
+`…PASSWORD`. The configured gateway key is removed regardless of shape — that one is a known
+value, not a guess.
+
+**File contents are deliberately not masked.** Mask `.env` and the model edits the masked text
+and writes it back, landing a placeholder where the real key was — protecting the secret would
+destroy it. So on the file side it reports instead of rewriting.
+
+<br>
+
+Tests 2,578 → **2,860** · 54/54 files. Earlier releases are on the [tags](https://github.com/jysvai/deel-local-cli/tags) page.
+
+</details>
+
 <details>
 <summary><b>▸ 1.2.0 — so the conversation doesn't break</b> · what changed in six places</summary>