pi-verdict 0.14.0 → 0.15.0

package/README.md

@@ -110,6 +110,7 @@ pi-verdict 0.13+ requires **pi ≥ 0.99** and runs on pi only (native classifier
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
   "audit": false,
+  "auditRedactSecrets": true,
   "notifyAllows": false,
   "classifierMinConfidence": null,
   "classifierFallbackModel": null,
@@ -123,7 +124,7 @@ pi-verdict 0.13+ requires **pi ≥ 0.99** and runs on pi only (native classifier
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
 - `classifierModel: "typesafe/jev-latest"` opts into the **native jev classifier** — one structured `classify()` call per gray-zone verdict via pi's built-in classifier catalog (TypeSafe direct, or Jev on OpenRouter/OpenCode/Cloudflare/Vercel); see [ADR-0005](docs/adr/0005-native-classifier-migration.md)
-- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
+- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); secret-shaped text is redacted on append (`<redacted:type#fingerprint>`, deterministic so cross-record tracing survives — `auditRedactSecrets: false` opts out; [ADR-0007](docs/adr/0007-audit-secret-redaction.md)); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
 - `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; with both switches on the notification appears once
 - `classifierMinConfidence` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) sets the **confidence floor**: a native-classifier verdict below it is demoted — cascaded to `classifierFallbackModel` if set (`enforce`, the default = the second layer adjudicates; a demoted **deny or ask** can never be auto-relaxed to an allow; a fail-closed layer emitted no verdict, so its rescue stands; `shadow` = records its opinion only and you are asked — `/automode` hints the activation switch), otherwise asked of you directly. At/above the floor the first layer is autonomous. The floor applies to native classifier models only (protocol-native confidence) — with a chat/LLM classifier it is inert, and a one-time warning says so. A natural pairing: jev first + a haiku/flash-class fallback
 
@@ -201,7 +202,13 @@ tool_call
   │     ├─ denyPaths (ADR-0002): protected paths → terminal ask,
   │     │   before user allow; classifier sees an existence hint only
   │     ├─ ignoreTools: your declared uncovered tools → allow, zero model calls
-  │     └─ no built-in allowlist — every "always allow" claim is yours to make
+  │     ├─ headless subagent-artifacts writes (ADR-0008): a no-UI session's
+  │     │   write/edit under <agentDir>/sessions/**/subagent-artifacts/ →
+  │     │   deterministic allow (interactive sessions keep the ask); your
+  │     │   deny rules and denyPaths still outrank it
+  │     └─ no built-in allowlist on your surfaces — every "always allow"
+  │       claim is yours to make (the one built-in allow is pi's own
+  │       subagent-artifacts subtree, headless-only, ADR-0008)
   │
   ├─ 2. Gray zone → nested-call policy, then model classifier
   │     ├─ nested call (codemode) + codemodeNestedCalls=rules-only → pass;
@@ -234,7 +241,7 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 
 ## Status & limitations
 
-- no built-in allowlist by design (see the [bypass writeup](research/rule-layer-security-audit.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
+- no built-in allowlist on user surfaces by design (see the [bypass writeup](research/rule-layer-security-audit.md); the one built-in allow is pi's own subagent-artifacts subtree, headless-only, [ADR-0008](docs/adr/0008-agentdir-sessions-write-exemption.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
 - the path sensitivity floor applies to file tools only: bash command strings are matched by the danger regexes alone, so e.g. `cat ~/.ssh/id_rsa` goes to the classifier rather than the deterministic S0 deny (the file-tool spelling `read ~/.ssh/id_rsa` does deny)
 - on Windows the built-in floor covers bash-shaped patterns only — PowerShell-native dangerous commands (`Remove-Item -Recurse -Force`, `Invoke-Expression`, `Set-ExecutionPolicy`, …) rely on the classifier (fail-closed)
 - on macOS the per-user temp tree (`$TMPDIR`, the `/var/folders/…/T` confstr dir) is exempt from the system-directory floor: reads allow at zero cost, writes adjudicate as ordinary outside-project writes (classifier). The exemption anchors to the runtime-resolved confstr family — a hand-set `TMPDIR` lifts nothing — and `/var/tmp` (POSIX shared temp) stays denied; symlink spellings whose real form escapes the temp tree still hit S1

package/README.zh-CN.md

@@ -110,6 +110,7 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
   "audit": false,
+  "auditRedactSecrets": true,
   "notifyAllows": false,
   "classifierMinConfidence": null,
   "classifierFallbackModel": null,
@@ -123,7 +124,7 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担；下方自保护层永远开启)
 - `classifierModel` 指定分类器模型，如 `"zai/glm-5.3-flash:low"`(支持思考后缀；缺省 = 会话模型且显式关思考)
 - `classifierModel: "typesafe/jev-latest"` 启用**原生 jev 分类器**——每次灰区裁决经 pi 内置分类器目录发一次结构化 `classify()` 调用(TypeSafe 直连,或 OpenRouter/OpenCode/Cloudflare/Vercel 上的 Jev);详见 [ADR-0005](docs/adr/0005-native-classifier-migration.md)
-- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件，保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth，确认结束后落盘)，protected-path ask 也入审计(#62)；规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机；[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注)；agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
+- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件，保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth，确认结束后落盘)，protected-path ask 也入审计(#62)；规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机；[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注)；凭证明文在落盘前脱敏(`<redacted:类型#指纹>`，指纹具确定性、跨记录可追踪——`auditRedactSecrets: false` 可显式关闭；[ADR-0007](docs/adr/0007-audit-secret-redaction.md))；agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
 - `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解)；默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知；两开关同开时通知只出现一次
 - `classifierMinConfidence`(可选，[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))设定**置信地板**：低于它的原生分类器裁决被降级——配置了 `classifierFallbackModel` 则级联(`enforce`，默认 = 第二层全权裁决；例外：降级的 **deny 与 ask** 永不被自动放宽为 allow；fail-closed 未产生裁决，其获救裁决照常生效；`shadow` = 只记录意见、由你裁决——`/automode` 会提示激活开关)，否则直接问你。不低于地板时第一层自主。地板仅作用于原生分类器模型(协议原生置信度)——chat/LLM 分类器下不生效，会有一次中性警告提示。天然搭配：jev 在前 + haiku/flash 级回退
 
@@ -201,7 +202,13 @@ tool_call
   │     ├─ denyPaths(ADR-0002):受保护路径 → 终局 ask,先于用户 allow;
   │     │   分类器只见存在性话术
   │     ├─ ignoreTools:用户声明的未覆盖工具 → 直接放行,零模型调用
-  │     └─ 无内置白名单 —— 「永远放行」的声明由你自己做
+  │     ├─ headless subagent-artifacts 写入(ADR-0008):无 UI 会话对
+  │     │   <agentDir>/sessions/**/subagent-artifacts/ 的 write/edit →
+  │     │   确定性放行(交互会话仍可 ask);用户 deny 规则与 denyPaths
+  │     │   声明仍然优先
+  │     └─ 你的操作面上无内置白名单 —— 「永远放行」的声明由你自己做
+  │       (唯一的内置放行是 pi 自身的 subagent-artifacts 子树,仅限
+  │       headless,ADR-0008)
   │
   ├─ 2. 灰区 → 嵌套策略,再进模型分类器
   │     ├─ 嵌套调用(codemode)+ codemodeNestedCalls=rules-only → 放行;
@@ -234,7 +241,7 @@ tool_call
 
 ## 状态与限制
 
-- 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
+- 设计上在你的操作面无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson)；唯一内置放行是 pi 自身的 subagent-artifacts 子树、仅限 headless,[ADR-0008](docs/adr/0008-agentdir-sessions-write-exemption.md))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
 - 路径敏感度 floor 只作用于文件类工具：bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
 - Windows 下内置 floor 仅覆盖 bash 形态模式——PowerShell 原生危险命令(`Remove-Item -Recurse -Force`、`Invoke-Expression`、`Set-ExecutionPolicy` 等)依赖分类器兜底(fail-closed)
 - macOS 下 per-user 临时目录(`$TMPDIR`,`/var/folders/…/T` confstr 目录)豁免于系统目录 floor:读零成本放行,写按普通项目外写交分类器裁决。豁免锚定运行时解析的 confstr 族——手工设置 `TMPDIR` 不会解除任何保护;`/var/tmp`(POSIX 共享临时目录)维持拦截;真实形态逃逸临时树的符号链接拼写仍命中 S1

package/extensions/pi-verdict.ts

@@ -81,6 +81,7 @@
  *               research/pi-model-call-and-ref-implementations.md
  */
 
+import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -284,9 +285,12 @@ interface UserRules {
 	 *  ~350ms/call). Opt-in: rule-passing actions the classifier would have caught
 	 *  pass under rules-only (coverage is denyPaths-declaration-dependent). */
 	codemodeNestedCalls: "gate" | "rules-only";
+	/** ADR-0007: redact secret-shaped text from audit records before append.
+	 *  Default true; false is the explicit keep-raw escape hatch. */
+	auditRedactSecrets: boolean;
 }
 
-const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce", codemodeNestedCalls: "gate" };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce", codemodeNestedCalls: "gate", auditRedactSecrets: true };
 
 /** This module's own file location (import.meta.url resolved; null = unresolvable). */
 const OWN_FILE_PATH: string | null = (() => {
@@ -355,6 +359,7 @@ const USER_CONFIG_TEMPLATE = `${JSON.stringify({
 	classifierModel: null,
 	toggleShortcut: DEFAULT_TOGGLE_SHORTCUT,
 	audit: false,
+	auditRedactSecrets: true,
 	notifyAllows: false,
 	classifierMinConfidence: null,
 	classifierFallbackModel: null,
@@ -379,7 +384,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown; codemodeNestedCalls?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown; codemodeNestedCalls?: unknown; auditRedactSecrets?: unknown };
 		try {
 			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
 		} catch (err) {
@@ -427,6 +432,8 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 		// #90: nested-call policy — invalid values skip into the one-shot warning channel
 		const nestedRaw = raw.codemodeNestedCalls;
 		if (nestedRaw !== undefined && nestedRaw !== "gate" && nestedRaw !== "rules-only") skipped.push(`codemodeNestedCalls: ${JSON.stringify(nestedRaw)}`);
+		// ADR-0007: audit redaction — non-boolean values skip into the one-shot warning channel, redaction stays on
+		if (raw.auditRedactSecrets !== undefined && typeof raw.auditRedactSecrets !== "boolean") skipped.push(`auditRedactSecrets: ${JSON.stringify(raw.auditRedactSecrets)}`);
 		return {
 			rules: {
 				allow: compile(raw.allow),
@@ -442,6 +449,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				classifierMinConfidence: minConfOk ? minConfRaw : null,
 				classifierFallbackMode: fbModeRaw === undefined ? "enforce" : fbModeRaw === "enforce" ? "enforce" : "shadow", // invalid values land on the conservative shadow (standing invalid-config precedent); the key-less default is enforce
 				codemodeNestedCalls: nestedRaw === "rules-only" ? "rules-only" : "gate", // invalid values keep the safe default (gate)
+				auditRedactSecrets: raw.auditRedactSecrets !== false, // default on; only an explicit false disables (ADR-0007)
 			},
 			skipped,
 			shortcutWarning: shortcut.warning,
@@ -820,6 +828,8 @@ interface ProtectedSet {
 	prefixes: string[];
 	/** 读拒绝前缀(#54):verdicts 审计目录——记录含不可信原始输出,禁回流 agent context */
 	readPrefixes: string[];
+	/** Subagent-artifacts write-exemption tree (ADR-0008): <agentDir>/sessions — headless write/edit to its subagent-artifacts subtree passes deterministically */
+	runtimeWritePrefixes: string[];
 	/** bash/powershell 命令串危险特征(子串匹配,可绕——变更检测兜底) */
 	bashPatterns: RegExp[];
 	/** 变更检测基线(词法路径 + 类别;session_start 时快照全文) */
@@ -977,7 +987,15 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 	}
 	bashPatterns.push(new RegExp(`(?:${[...vAlts].join("|")})`));
 
-	return { exact: [...exact], prefixes: [...prefixes], readPrefixes: verdictsForms, bashPatterns, watchBases };
+	// ADR-0008: <agentDir>/sessions is pi's own runtime output tree (subagent
+	// artifacts live there); write/edit grade as deterministic allow. The prefix
+	// uses the ancestor-rebuild tier (rebuiltForms), matching the target-side
+	// forms: sessions/ may not exist yet on a fresh install, and an allow-grade
+	// exemption must not hinge on directory existence (baseForms alone would
+	// miss the firmlink real form and silently void the exemption).
+	const runtimeWritePrefixes = rebuiltForms(path.join(agentDir, "sessions"));
+
+	return { exact: [...exact], prefixes: [...prefixes], readPrefixes: verdictsForms, runtimeWritePrefixes, bashPatterns, watchBases };
 }
 
 /** Does the resolved write path hit the protected set (realpath guards against
@@ -1008,6 +1026,20 @@ export function isProtectedReadPath(rawPath: string | undefined, cwd: string, pr
 	return false;
 }
 
+/** ADR-0008: subagent-artifacts write exemption — EVERY canonical form must sit
+ *  under <agentDir>/sessions AND carry a subagent-artifacts directory segment
+ *  (intersection semantics, same discipline as the in-cwd allowance): a lexical
+ *  hit whose real form escapes (symlink alias) earns no exemption and falls back
+ *  to the classifier. Gated to headless sessions at the call site — an
+ *  interactive session keeps its ask capability. */
+const SUBAGENT_ARTIFACTS_SEG = /(^|\/)subagent-artifacts(\/|$)/;
+export function isSubagentArtifactWrite(rawPath: string, cwd: string, prot: ProtectedSet): boolean {
+	if (prot.runtimeWritePrefixes.length === 0 || !rawPath) return false;
+	const forms = rebuiltForms(path.resolve(cwd, expandHome(rawPath)));
+	const inTree = (f: string) => prot.runtimeWritePrefixes.some((p) => f === p || f.startsWith(p + path.sep));
+	return forms.every((f) => inTree(f) && SUBAGENT_ARTIFACTS_SEG.test(f));
+}
+
 /** 自保护层裁决(第 0 层,先于一切):触碰门禁自身文件 → 不可豁免的 deny;其余 null 交后续层 */
 function selfProtectCheck(toolName: string, input: Record<string, unknown>, cwd: string, prot: ProtectedSet): RuleResult | null {
 	switch (toolName) {
@@ -1778,20 +1810,110 @@ export interface AuditRecord {
 	fallback?: FallbackAudit;
 }
 
+// ============================================================================
+// Audit secret redaction (ADR-0007)
+// ============================================================================
+
+/** sha256 fingerprint (first 8 hex), unsalted: deterministic — the same secret
+ *  keeps one fingerprint across records, preserving clustering and diffability.
+ *  The threat model anchors on high-entropy API keys, for which the rainbow
+ *  tables that salting guards against are infeasible (ADR-0007). */
+function redactionFingerprint(secret: string): string {
+	return crypto.createHash("sha256").update(secret).digest("hex").slice(0, 8);
+}
+
+/** Context-guided value redaction — shapeless secrets identified by neighboring
+ *  structure (assignment/header/URL position). Every value character class
+ *  excludes `<` (every replacement starts with `<`, so layering is idempotent);
+ *  `#` is excluded only where a bare fragment could look like a value (bearer,
+ *  query). The URL value class also excludes `/` (RFC 3986 userinfo forbids it —
+ *  and it keeps `host:8080/path@…` port shapes out of the password slot). */
+const REDACT_CONTEXT_RULES: ReadonlyArray<{ re: RegExp; build: (...m: string[]) => string }> = [
+	{ re: /(https?:\/\/[^/\s:@]+:)([^@/\s<]{8,})(?=@)/g, build: (...m) => `${m[1]}<redacted:url#${redactionFingerprint(m[2])}>` },
+	{ re: /(-u\s+"?)([^:\s"<]+):([^"\s<]{8,})(")/g, build: (...m) => `${m[1]}${m[2]}:<redacted:basic#${redactionFingerprint(m[3])}>${m[4]}` },
+	{ re: /(-u\s+)([^:\s"<]+):([^"\s<]{8,})/g, build: (...m) => `${m[1]}${m[2]}:<redacted:basic#${redactionFingerprint(m[3])}>` },
+	// query runs before env: a `?token=…` param belongs to the query tag; the env
+	// bare-name branch (TOKEN/APIKEY/SECRET) then only sees non-query positions
+	{ re: /([?&](?:token|apikey|api_key|access_token|client_secret|signature|sig)=)([^&\s"'#<>]{8,})/gi, build: (...m) => `${m[1]}<redacted:query#${redactionFingerprint(m[2])}>` },
+	{ re: /\b([A-Za-z_][A-Za-z0-9_]*(?:_KEY|_TOKEN|_SECRET|_PASSWORD|_CREDENTIALS?)|APIKEY|TOKEN|SECRET)(=)("[^"<]{8,}"|[^\s"<&;]{8,})/gi, build: (...m) => `${m[1]}${m[2]}<redacted:env#${redactionFingerprint(m[3].replace(/^"|"$/g, ""))}>` },
+	{ re: /(\bbearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi, build: (...m) => `${m[1]}<redacted:bearer#${redactionFingerprint(m[2])}>` },
+];
+
+/** Exact provider token shapes (near-zero false positives). Order matters both
+ *  here (specific prefix before general: sk-ant before sk) and against the
+ *  context layer: shapes run SECOND, so a provider-shaped *username* (e.g.
+ *  `-u "sk-…:shapelesspass"`) still has its raw form visible when the context
+ *  rules match — running shapes first would rewrite the username into a marker
+ *  and the `<` exclusion would defeat the `-u` rule, dropping the shapeless
+ *  password raw. All patterns are character classes + bounded/greedy
+ *  quantifiers — no nested quantifiers, no backtrack blowup. */
+const REDACT_TOKEN_SHAPES: ReadonlyArray<{ type: string; re: RegExp }> = [
+	{ type: "jwt", re: /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
+	{ type: "github_pat", re: /github_pat_[A-Za-z0-9_]{22,}/g },
+	{ type: "gh", re: /gh[posur]_[A-Za-z0-9]{30,}/g },
+	{ type: "sk-ant", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+	{ type: "sk", re: /sk-[A-Za-z0-9][A-Za-z0-9_-]{15,}/g },
+	{ type: "pk", re: /pk-[A-Za-z0-9][A-Za-z0-9_-]{15,}/g },
+	{ type: "aws", re: /AKIA[0-9A-Z]{16}/g },
+	{ type: "slack", re: /xox[abprs]-[A-Za-z0-9-]{10,}/g },
+	{ type: "google", re: /AIza[0-9A-Za-z_-]{30,}/g },
+];
+
+function redactString(s: string): string {
+	let out = s;
+	for (const { re, build } of REDACT_CONTEXT_RULES) {
+		out = out.replace(re, build);
+	}
+	for (const { type, re } of REDACT_TOKEN_SHAPES) {
+		out = out.replace(re, (m) => `<redacted:${type}#${redactionFingerprint(m)}>`);
+	}
+	return out;
+}
+
+/** Audit redaction: recursively processes every string value of the record
+ *  (input/actionLine/transcript/reason/fallback…), returning a fresh tree and
+ *  never mutating the caller's object (pendingAudit is spread later for the
+ *  userAnswer finalize). Exotic objects (Date, …) pass through untouched —
+ *  JSON.stringify keeps authority over their serialization. Applies to the
+ *  persisted copy only — the adjudication pipeline and the classifier input
+ *  keep the raw text: the fact that a command carries a secret is itself an
+ *  adjudication signal (ADR-0007). */
+export function redactSecrets<T>(value: T): T {
+	if (typeof value === "string") return redactString(value) as T;
+	if (Array.isArray(value)) return value.map((v) => redactSecrets(v)) as T;
+	if (value !== null && typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return value;
+		const out: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(value as Record<string, unknown>)) out[k] = redactSecrets(v);
+		return out as T;
+	}
+	return value;
+}
+
 /** Audit sink (#54): append-only and fail-soft (the first write failure surfaces
  *  once via drainWarning; verdicts are never affected). The dir is created
  *  lazily — audit on with no gray-zone call all session leaves zero filesystem trace. */
 export class AuditLog {
 	private warning: string | null = null;
 	private warned = false;
-	constructor(readonly dir: string) {}
+	constructor(readonly dir: string, readonly redact = true) {}
 
 	append(record: AuditRecord): void {
 		// sessionId comes from the host with no shape guarantee: narrow to a safe filename charset
 		const file = path.join(this.dir, `${record.sessionId.replace(/[^a-zA-Z0-9_-]/g, "_")}.jsonl`);
 		try {
 			fs.mkdirSync(this.dir, { recursive: true });
-			fs.appendFileSync(file, JSON.stringify(record) + "\n");
+			// ADR-0007: redact the persisted copy only (new tree — the caller's
+			// pendingAudit object is spread later for the userAnswer finalize);
+			// a redaction failure fails open: record integrity over hygiene
+			let persisted: AuditRecord = record;
+			if (this.redact) {
+				try {
+					persisted = redactSecrets(record);
+				} catch { /* fail-open */ }
+			}
+			fs.appendFileSync(file, JSON.stringify(persisted) + "\n");
 		} catch (err) {
 			if (!this.warned) {
 				this.warned = true;
@@ -1859,7 +1981,7 @@ export class SessionState {
 
 	/** #54: the audit flag follows the rules (applies to new sessions); the dir is anchored to the install path */
 	private makeAudit(rules: UserRules): AuditLog | null {
-		return rules.audit && this.agentDir ? new AuditLog(path.join(this.agentDir, "verdicts")) : null;
+		return rules.audit && this.agentDir ? new AuditLog(path.join(this.agentDir, "verdicts"), rules.auditRedactSecrets) : null;
 	}
 
 	/** 会话重置:重载用户规则(配置改动新会话生效)+ 按会话 cwd 重锚 denyPaths
@@ -2018,6 +2140,14 @@ export async function adjudicate(
 	const rule = classifyByRules(call.toolName, call.input, env.cwd, state.userRules, state.prot, state.anchoredDenyPathBases(env.cwd));
 	if (rule.verdict === "allow") return { verdict: "allow", reason: rule.reason ?? "", source: "rule", degraded: false };
 	if (rule.verdict === "deny") return { verdict: "deny", reason: rule.reason ?? "", source: "rule", degraded: false };
+	// ADR-0008: subagent artifacts — a headless (no-UI) session writing pi's own
+	// runtime artifact tree passes deterministically; user deny and denyPaths have
+	// already ruled above (declarations beat the built-in exemption), and only the
+	// gray grade is lifted. An interactive session keeps its ask capability, so the
+	// exemption stays headless-only. Read and bash are deliberately NOT exempt.
+	if (rule.verdict === "gray" && !env.hasUI && (call.toolName === "write" || call.toolName === "edit") && isSubagentArtifactWrite(String(call.input.path ?? ""), env.cwd, state.prot)) {
+		return { verdict: "allow", reason: "subagent artifacts (headless) — deterministic write exemption (ADR-0008)", source: "rule", degraded: false };
+	}
 
 	// #62: the audit surface widens to protected-path asks (their user answers grade the
 	// denyPaths rules); rule allow/deny stay unaudited (no corpus value, #54). Record

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.14.0",
+	"version": "0.15.0",
 	"description": "A minimal permission gate for Pi, inspired by Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",