execweave 0.8.34__tar.gz → 0.8.35__tar.gz

{execweave-0.8.34 → execweave-0.8.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: execweave
-Version: 0.8.34
+Version: 0.8.35
 Summary: Turn AI-agent runtime behavior into a local interactive execution graph.
 Project-URL: Homepage, https://github.com/Irish-kw/ExecWeave
 Project-URL: Repository, https://github.com/Irish-kw/ExecWeave
@@ -61,6 +61,10 @@ Provides-Extra: validation
 Requires-Dist: cryptography>=44; extra == 'validation'
 Description-Content-Type: text/markdown
 
+<p align="center">
+  <img src="docs/assets/shot5_brand.jpg" alt="ExecWeave" width="100%">
+</p>
+
 # ExecWeave
 
 <!-- i18n-nav:start -->
@@ -147,7 +151,15 @@ execweave top -- codex
 
 ### Provider integration approval
 
-Some agents and IDEs ask for permission before enabling a local hook or plugin. Approve the ExecWeave integration if you want provider-level prompt, response, tool, model, and conversation evidence. If you do not approve it, OS-runtime observation can still work, but semantic coverage may be reduced.
+Since 0.8.35, `live` only checks hook configuration; it never installs or rewrites it. Explicitly run `execweave hooks install antigravity` (or `claude`, `codex`, `cursor`, `opencode`) from your user-owned environment, without sudo. `execweave hooks status antigravity` checks setup without writing. Provider approval may still be required. **Configured does not mean evidence was delivered.** Missing delivery and incomplete observation are recorded independently of process exit.
+
+See [observation integrity and the negative example](docs/observation-integrity.md) for the three result axes and their honest limits. These changes ship in 0.8.35; earlier versions do not contain them.
+
+**Live privacy and authentication (0.8.35)**
+
+`execweave live` and `execweave top` record the complete provider/model content an integration exposes (prompts, responses, tool values) by default, because the run stays on your own machine for you to inspect. Add `--metadata-only` when a run must not store that plaintext; `--capture-content` remains accepted and selects the default explicitly. Invalid capture-policy values fail closed to metadata-only at automatic recorder boundaries.
+
+The live dashboard no longer puts its API credential in `?t=...`. The announced URL contains no credential. Browser access uses a one-time pairing code submitted in a POST body and then an `HttpOnly; SameSite=Strict` cookie; non-browser API clients use the private `X-ExecWeave-Token` header.
 
 Google Antigravity currently uses the `agy` CLI command. ExecWeave also accepts `antigravity` as a friendly alias.
 
@@ -185,6 +197,8 @@ execweave live --open -- ollama run deepseek-r1:1.5b
 
 This mode does not start an Ollama server. A reachable upstream server is still required.
 
+In both modes the relay forwards every request and, by default, records each inference exchange so the prompts and responses appear in the run and on the dashboard. Add `--metadata-only` (for example, `execweave live --metadata-only --open -- ollama serve`) when the conversation must not be stored.
+
 ## Dashboard
 
 The dashboard is designed to keep large, multi-agent runs inspectable without changing the underlying evidence.
@@ -348,7 +362,8 @@ Raw observations remain separate from derived semantic and correlation outputs.
 - **Failure ownership cleanup:** if the portable collector fails unexpectedly after launching a managed workload, it terminates the workload it owns before recording terminal session state. A filesystem observer that only partially starts is also torn down before the startup error propagates.
 - Linux also provides a `strace` reference backend with stronger syscall-attributed evidence for supported executions.
 - Provider semantics depend on what each integration actually exposes. Missing prompts, hidden reasoning, remote provider internals, and unexposed routing cannot be reconstructed reliably.
-- Full-fidelity provider content may contain credentials, secrets, source code, prompts, tool values, model responses, shell output, and file contents.
+- Full-fidelity provider content may contain credentials, secrets, source code, prompts, tool values, model responses, shell output, and file contents. `live`/`top` store it by default because the run stays on the local machine; the run directory is owner-private, and `--metadata-only` keeps that plaintext out of the run entirely.
+- Run artifacts are written through owner-private primitives. POSIX permissions are established before sensitive bytes are published; the Windows path applies a protected owner DACL. Final Windows guarantees still depend on the release CI matrix and are not inferred from Linux tests.
 - Conversation isolation is an attribution rule, not a redaction boundary. Explicitly routed content may legitimately appear at more than one participant.
 - A local integrity manifest detects changes relative to the manifest; it is not an adversary-resistant trusted logging system if both evidence and manifest remain inside the same writable trust boundary.
 - Review the complete run directory before sharing it.

{execweave-0.8.34 → execweave-0.8.35}/README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="docs/assets/shot5_brand.jpg" alt="ExecWeave" width="100%">
+</p>
+
 # ExecWeave
 
 <!-- i18n-nav:start -->
@@ -84,7 +88,15 @@ execweave top -- codex
 
 ### Provider integration approval
 
-Some agents and IDEs ask for permission before enabling a local hook or plugin. Approve the ExecWeave integration if you want provider-level prompt, response, tool, model, and conversation evidence. If you do not approve it, OS-runtime observation can still work, but semantic coverage may be reduced.
+Since 0.8.35, `live` only checks hook configuration; it never installs or rewrites it. Explicitly run `execweave hooks install antigravity` (or `claude`, `codex`, `cursor`, `opencode`) from your user-owned environment, without sudo. `execweave hooks status antigravity` checks setup without writing. Provider approval may still be required. **Configured does not mean evidence was delivered.** Missing delivery and incomplete observation are recorded independently of process exit.
+
+See [observation integrity and the negative example](docs/observation-integrity.md) for the three result axes and their honest limits. These changes ship in 0.8.35; earlier versions do not contain them.
+
+**Live privacy and authentication (0.8.35)**
+
+`execweave live` and `execweave top` record the complete provider/model content an integration exposes (prompts, responses, tool values) by default, because the run stays on your own machine for you to inspect. Add `--metadata-only` when a run must not store that plaintext; `--capture-content` remains accepted and selects the default explicitly. Invalid capture-policy values fail closed to metadata-only at automatic recorder boundaries.
+
+The live dashboard no longer puts its API credential in `?t=...`. The announced URL contains no credential. Browser access uses a one-time pairing code submitted in a POST body and then an `HttpOnly; SameSite=Strict` cookie; non-browser API clients use the private `X-ExecWeave-Token` header.
 
 Google Antigravity currently uses the `agy` CLI command. ExecWeave also accepts `antigravity` as a friendly alias.
 
@@ -122,6 +134,8 @@ execweave live --open -- ollama run deepseek-r1:1.5b
 
 This mode does not start an Ollama server. A reachable upstream server is still required.
 
+In both modes the relay forwards every request and, by default, records each inference exchange so the prompts and responses appear in the run and on the dashboard. Add `--metadata-only` (for example, `execweave live --metadata-only --open -- ollama serve`) when the conversation must not be stored.
+
 ## Dashboard
 
 The dashboard is designed to keep large, multi-agent runs inspectable without changing the underlying evidence.
@@ -285,7 +299,8 @@ Raw observations remain separate from derived semantic and correlation outputs.
 - **Failure ownership cleanup:** if the portable collector fails unexpectedly after launching a managed workload, it terminates the workload it owns before recording terminal session state. A filesystem observer that only partially starts is also torn down before the startup error propagates.
 - Linux also provides a `strace` reference backend with stronger syscall-attributed evidence for supported executions.
 - Provider semantics depend on what each integration actually exposes. Missing prompts, hidden reasoning, remote provider internals, and unexposed routing cannot be reconstructed reliably.
-- Full-fidelity provider content may contain credentials, secrets, source code, prompts, tool values, model responses, shell output, and file contents.
+- Full-fidelity provider content may contain credentials, secrets, source code, prompts, tool values, model responses, shell output, and file contents. `live`/`top` store it by default because the run stays on the local machine; the run directory is owner-private, and `--metadata-only` keeps that plaintext out of the run entirely.
+- Run artifacts are written through owner-private primitives. POSIX permissions are established before sensitive bytes are published; the Windows path applies a protected owner DACL. Final Windows guarantees still depend on the release CI matrix and are not inferred from Linux tests.
 - Conversation isolation is an attribution rule, not a redaction boundary. Explicitly routed content may legitimately appear at more than one participant.
 - A local integrity manifest detects changes relative to the manifest; it is not an adversary-resistant trusted logging system if both evidence and manifest remain inside the same writable trust boundary.
 - Review the complete run directory before sharing it.

{execweave-0.8.34 → execweave-0.8.35}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "execweave"
-# ExecWeave v0.8.34 release metadata
-version = "0.8.34"
+# ExecWeave v0.8.35 release metadata
+version = "0.8.35"
 description = "Turn AI-agent runtime behavior into a local interactive execution graph."
 readme = "README.md"
 requires-python = ">=3.10"

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/__init__.py

@@ -1,3 +1,3 @@
 """ExecWeave runtime graph package."""
 
-__version__ = "0.8.34"
+__version__ = "0.8.35"

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/_conversation_records_core.py

@@ -1,11 +1,11 @@
 from __future__ import annotations
 
-import json
 import re
 from collections import Counter
 from pathlib import Path
 from typing import Any
 from .content_store import _filesystem_path
+from .private_io import write_private_json, write_private_text
 
 from .agent_topology import (
     COMPLETENESS_ROUTING_ONLY,
@@ -897,9 +897,6 @@ def write_conversation_records(
     entries = payload["entries"]
     json_path = root / "conversations.json"
     markdown_path = root / "conversations.md"
-    json_path.write_text(
-        json.dumps(payload, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    markdown_path.write_text(_render_markdown(entries), encoding="utf-8")
+    write_private_json(json_path, payload, replace=json_path.exists())
+    write_private_text(markdown_path, _render_markdown(entries), replace=markdown_path.exists())
     return json_path, markdown_path

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/_http_proxy_base.py

@@ -4,6 +4,7 @@ import http.client
 import ipaddress
 import json
 import sys
+import threading
 import uuid
 from dataclasses import dataclass
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -16,6 +17,7 @@ from .content_store import FullFidelityContentStore
 from .model_runtime_full_fidelity import runtime_exchange_to_content_events
 from .openai_compatible import append_openai_compatible_records
 from .openai_compatible_full_fidelity import exchange_to_content_events
+from .privacy import full_content_capture_enabled
 from .stream_assembly import (
     OLLAMA_NDJSON,
     OPENAI_CHAT_DELTA,
@@ -208,6 +210,8 @@ def record_exchange_fail_open(
     request_only: bool = False,
     request_recorded: bool = False,
 ) -> bool:
+    if not full_content_capture_enabled():
+        return False
     try:
         request = _json(request_body)
         if not isinstance(request, dict):
@@ -386,8 +390,30 @@ class ExecWeaveHTTPProxyServer(ThreadingHTTPServer):
         self.proxy_config = config
         self.upstream = _parse_upstream(config.upstream)
         self.recorder = recorder
+        # Handler threads are daemonic, so ThreadingMixIn.server_close() does not
+        # join them. A response can reach the client before its recording finishes,
+        # so closing the server waits for those recordings explicitly instead.
+        self._recordings = 0
+        self._recordings_done = threading.Condition()
         super().__init__(address, ExecWeaveHTTPProxyHandler)
 
+    def begin_recording(self) -> None:
+        with self._recordings_done:
+            self._recordings += 1
+
+    def end_recording(self) -> None:
+        with self._recordings_done:
+            self._recordings -= 1
+            self._recordings_done.notify_all()
+
+    def wait_for_recordings(self, timeout: float | None = None) -> bool:
+        with self._recordings_done:
+            return self._recordings_done.wait_for(lambda: self._recordings == 0, timeout)
+
+    def server_close(self) -> None:
+        super().server_close()
+        self.wait_for_recordings()
+
 
 class ExecWeaveHTTPProxyHandler(BaseHTTPRequestHandler):
     server: ExecWeaveHTTPProxyServer

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/_http_proxy_bounded.py

@@ -4,7 +4,9 @@ import http.client
 import itertools
 import json
 import os
+import socket
 import tempfile
+import threading
 from pathlib import Path
 from typing import Any, Iterator
 
@@ -486,34 +488,73 @@ def relay_default(handler: _base.ExecWeaveHTTPProxyHandler) -> None:
         return
     finally:
         connection.close()
+
+    def record() -> None:
+        try:
+            if capture is not None:
+                capture.finish()
+                _record_capture(
+                    handler.server.proxy_config,
+                    exchange_id=exchange_id,
+                    request_body=body,
+                    response_content_type=response_type,
+                    method=handler.command,
+                    request_path=target,
+                    status=status,
+                    capture=capture,
+                )
+            else:
+                handler.server.recorder(
+                    handler.server.proxy_config,
+                    exchange_id=exchange_id,
+                    method=handler.command,
+                    request_path=target,
+                    request_body=body,
+                    request_content_type=handler.headers.get("Content-Type"),
+                    status=status,
+                    response_body=bytes(response_body),
+                    response_content_type=response_type,
+                    request_recorded=request_recorded,
+                )
+        except Exception as exc:
+            print(f"ExecWeave HTTP proxy recorder warning: {exc}", file=_base.sys.stderr)
+        finally:
+            if capture is not None:
+                capture.cleanup()
+
+    _record_after_response(handler, record)
+
+
+# Recording normally finishes in well under this, so the client still sees the end
+# of the response only once its evidence is on disk. A slow disk, lock or scanner
+# must not hold the user's program, though: past this point the response is ended
+# while recording finishes, and closing the server waits for it.
+_CLIENT_RELEASE_SECONDS = 2.0
+
+
+def _record_after_response(handler: _base.ExecWeaveHTTPProxyHandler, record) -> None:
+    server = handler.server
+    server.begin_recording()
+
+    def run() -> None:
+        try:
+            record()
+        finally:
+            server.end_recording()
+
+    worker = threading.Thread(target=run, name="execweave-proxy-record", daemon=True)
     try:
-        if capture is not None:
-            capture.finish()
-            _record_capture(
-                handler.server.proxy_config,
-                exchange_id=exchange_id,
-                request_body=body,
-                response_content_type=response_type,
-                method=handler.command,
-                request_path=target,
-                status=status,
-                capture=capture,
-            )
-        else:
-            handler.server.recorder(
-                handler.server.proxy_config,
-                exchange_id=exchange_id,
-                method=handler.command,
-                request_path=target,
-                request_body=body,
-                request_content_type=handler.headers.get("Content-Type"),
-                status=status,
-                response_body=bytes(response_body),
-                response_content_type=response_type,
-                request_recorded=request_recorded,
-            )
-    except Exception as exc:
-        print(f"ExecWeave HTTP proxy recorder warning: {exc}", file=_base.sys.stderr)
-    finally:
-        if capture is not None:
-            capture.cleanup()
+        worker.start()
+    except RuntimeError:
+        run()
+        return
+    worker.join(_CLIENT_RELEASE_SECONDS)
+    if worker.is_alive():
+        # HTTP/1.0 with Connection: close and no Content-Length, so the client
+        # treats the end of the stream as the end of the response.
+        try:
+            handler.wfile.flush()
+            handler.connection.shutdown(socket.SHUT_WR)
+        except OSError:
+            pass
+        worker.join()

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/_http_proxy_stage.py

@@ -6,6 +6,7 @@ from . import _http_proxy_base as _base
 from . import model_runtime_full_fidelity as _runtime_ff
 from . import openai_compatible_full_fidelity as _openai_ff
 from ._http_proxy_base import *  # noqa: F403
+from .privacy import full_content_capture_enabled
 
 
 # OpenAI-compatible request config is request-side evidence too. Without this relation
@@ -435,6 +436,8 @@ def record_exchange_fail_open(
     request_only: bool = False,
     request_recorded: bool = False,
 ) -> bool:
+    if not full_content_capture_enabled():
+        return False
     try:
         if request_only:
             return _record_request_phase(

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/agent_bootstrap.py

@@ -8,6 +8,8 @@ from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Any, Mapping
 
+from .hook_command import hook_argv, hook_command, hook_markers
+
 _AUTO_FLAG = "--auto"
 _CONFIG_RETRIES = 3
 _SUPPORTED_AGENTS = {
@@ -73,7 +75,7 @@ def _read_bytes(path: Path) -> bytes | None:
 def _contains_execweave_command(value: object, marker: str) -> bool:
     if isinstance(value, dict):
         command = value.get("command")
-        if isinstance(command, str) and marker in command:
+        if isinstance(command, str) and any(value in command for value in hook_markers(marker)):
             return True
         return any(_contains_execweave_command(child, marker) for child in value.values())
     if isinstance(value, list):
@@ -81,6 +83,28 @@ def _contains_execweave_command(value: object, marker: str) -> bool:
     return False
 
 
+def _migrate_hook_commands(value: object, marker: str) -> bool:
+    """Upgrade only our old canonical bare entry point, retaining user settings."""
+    changed = False
+    if isinstance(value, dict):
+        command = value.get("command")
+        if isinstance(command, str):
+            prefix = f"{marker} --auto"
+            suffix = command[len(prefix):] if command.startswith(prefix) else None
+            valid_suffixes = {"", " --event PreInvocation", " --event PostInvocation",
+                              " --event PostToolUse", " --event Stop"}
+            if suffix in valid_suffixes:
+                provider = marker.removeprefix("execweave-").removesuffix("-hook")
+                value["command"] = hook_command(provider) + suffix
+                changed = True
+        for child in value.values():
+            changed = _migrate_hook_commands(child, marker) or changed
+    elif isinstance(value, list):
+        for child in value:
+            changed = _migrate_hook_commands(child, marker) or changed
+    return changed
+
+
 def _merge_hook_fragment(
     current: dict[str, Any],
     fragment: dict[str, Any],
@@ -88,7 +112,7 @@ def _merge_hook_fragment(
     marker: str,
 ) -> tuple[dict[str, Any], bool]:
     merged = deepcopy(current)
-    changed = False
+    changed = _migrate_hook_commands(merged, marker)
 
     for key, value in fragment.items():
         if key == "hooks":
@@ -135,8 +159,9 @@ def _merge_named_hook_fragment(
 ) -> tuple[dict[str, Any], bool]:
     """Merge Antigravity's named-hook ``hooks.json`` schema conservatively."""
     merged = deepcopy(current)
+    changed = _migrate_hook_commands(merged, marker)
     if _contains_execweave_command(merged, marker):
-        return merged, False
+        return merged, changed
     for name, definition in fragment.items():
         if name in merged:
             raise FileExistsError(
@@ -215,9 +240,11 @@ def _write_plugin_file(path: Path, content: str, *, marker: str) -> bool:
                 existing = original.decode("utf-8")
             except UnicodeDecodeError as exc:
                 raise ValueError(f"existing OpenCode plugin is not UTF-8: {path}") from exc
-            if existing == content or marker in existing:
+            if existing == content:
                 return False
-            raise FileExistsError(f"refusing to replace existing OpenCode plugin: {path}")
+            from .opencode_plugin_cli import plugin_text
+            if existing != plugin_text(("execweave-opencode-hook", _AUTO_FLAG)):
+                raise FileExistsError(f"refusing to replace existing OpenCode plugin: {path}")
         if _write_bytes_optimistic(path, original, encoded):
             return True
     raise RuntimeError(f"plugin path changed concurrently while updating {path}")
@@ -254,11 +281,11 @@ def _provider_fragment(provider: str) -> tuple[dict[str, Any], str]:
     if provider == "claude":
         from .claude_hook_cli import claude_hook_config
 
-        return claude_hook_config(f"execweave-claude-hook {_AUTO_FLAG}"), "execweave-claude-hook"
+        return claude_hook_config(hook_command("claude")), "execweave-claude-hook"
     if provider == "codex":
         from .codex_hook_cli import codex_hook_config
 
-        return codex_hook_config(f"execweave-codex-hook {_AUTO_FLAG}"), "execweave-codex-hook"
+        return codex_hook_config(hook_command("codex")), "execweave-codex-hook"
     if provider == "antigravity":
         from .antigravity_hook_cli import antigravity_hook_config
 
@@ -266,7 +293,7 @@ def _provider_fragment(provider: str) -> tuple[dict[str, Any], str]:
     if provider == "cursor":
         from .cursor_hook_cli import cursor_hook_config
 
-        return cursor_hook_config(f"execweave-cursor-hook {_AUTO_FLAG}"), "execweave-cursor-hook"
+        return cursor_hook_config(hook_command("cursor")), "execweave-cursor-hook"
     raise ValueError(f"provider does not use JSON hooks: {provider}")
 
 
@@ -293,7 +320,7 @@ def bootstrap_supported_agent(
         if provider == "opencode":
             from .opencode_plugin_cli import plugin_text
 
-            content = plugin_text(("execweave-opencode-hook", _AUTO_FLAG))
+            content = plugin_text(tuple(hook_argv("opencode")))
             changed = _write_plugin_file(target, content, marker="execweave-opencode-hook")
         else:
             fragment, marker = _provider_fragment(provider)
@@ -317,10 +344,10 @@ def bootstrap_supported_agent(
 
         return AgentBootstrapResult(
             provider=provider,
-            status="active",
+            status="configured_unverified",
             path=str(target),
             changed=changed,
-            detail="specialized hook/plugin bootstrap is configured",
+            detail="specialized hook/plugin configured; delivery unverified",
         )
     except (FileExistsError, OSError, RuntimeError, TypeError, ValueError) as exc:
         return AgentBootstrapResult(
@@ -330,3 +357,39 @@ def bootstrap_supported_agent(
             changed=False,
             detail=_bounded_detail(exc),
         )
+
+
+def inspect_supported_agent(
+    command: list[str], *, home: str | Path | None = None,
+    environment: Mapping[str, str] | None = None,
+) -> AgentBootstrapResult:
+    """Read configuration only. Configuration is never proof of hook delivery."""
+    provider = supported_agent(command)
+    if provider is None:
+        return AgentBootstrapResult(provider=None, status="unavailable",
+                                    detail="no specialized lifecycle integration")
+    env = os.environ if environment is None else environment
+    home_path = Path.home() if home is None else Path(home).expanduser()
+    target = _provider_target(provider, home=home_path, environment=env)
+    try:
+        raw = _read_bytes(target)
+        if raw is None:
+            return AgentBootstrapResult(provider=provider, status="not_configured", path=str(target),
+                                        detail=f"Run execweave hooks install {provider} explicitly; never use sudo")
+        if provider == "opencode":
+            present = any(marker in raw.decode("utf-8")
+                          for marker in hook_markers("execweave-opencode-hook"))
+        else:
+            config = _load_json_object(raw, path=target)
+            present = _contains_execweave_command(config, f"execweave-{provider}-hook")
+            if provider == "claude" and config.get("disableAllHooks") is True:
+                present = False
+            if provider == "antigravity":
+                group = config.get("execweave-observability", {})
+                present = present and isinstance(group, dict) and group.get("enabled") is True
+        return AgentBootstrapResult(provider=provider,
+                                    status="configured_unverified" if present else "not_configured",
+                                    path=str(target), detail="delivery must be verified from recorded evidence")
+    except (OSError, ValueError, UnicodeError) as exc:
+        return AgentBootstrapResult(provider=provider, status="bootstrap_failed", path=str(target),
+                                    detail=type(exc).__name__)

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/anthropic.py

@@ -2,11 +2,12 @@ from __future__ import annotations
 
 import hashlib
 import json
-import os
 import time
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
+
+from .private_io import append_private_text
 from urllib.parse import urlsplit, urlunsplit
 
 
@@ -196,7 +197,8 @@ def response_to_events(
 
 
 def append_anthropic_records(path: str | Path, records: list[dict[str, Any]]) -> Path:
-    output = Path(path).expanduser().resolve()
+    raw_output = Path(path).expanduser()
+    output = raw_output.parent.resolve() / raw_output.name
     output.parent.mkdir(parents=True, exist_ok=True)
     if not records:
         return output
@@ -217,10 +219,7 @@ def append_anthropic_records(path: str | Path, records: list[dict[str, Any]]) ->
                 )
             time.sleep(0.01)
     try:
-        with output.open("a", encoding="utf-8", newline="\n") as handle:
-            handle.write(blob)
-            handle.flush()
-            os.fsync(handle.fileno())
+        append_private_text(output, blob)
     finally:
         try:
             lock_dir.rmdir()

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/anthropic_cli.py

@@ -10,6 +10,7 @@ from pathlib import Path
 from .anthropic import append_anthropic_records, response_to_events, sanitize_anthropic_endpoint
 from .anthropic_full_fidelity import exchange_to_content_events, response_to_content_events
 from .content_store import FullFidelityContentStore
+from .privacy import full_content_capture_enabled
 
 
 def _now() -> str:
@@ -65,6 +66,8 @@ def build_parser() -> argparse.ArgumentParser:
 
 
 def _append_full_fidelity_fail_open(sidecar: Path, records_factory) -> int:
+    if not full_content_capture_enabled():
+        return 0
     try:
         records = records_factory(FullFidelityContentStore(sidecar.parent))
         append_anthropic_records(sidecar, records)

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/antigravity_adapter_base.py

@@ -2,13 +2,14 @@ from __future__ import annotations
 
 import hashlib
 import json
-import os
 import sys
 import time
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
+from .private_io import append_private_text
+
 
 def _now() -> str:
     return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
@@ -435,7 +436,8 @@ def antigravity_hook_to_semantic_events(
 
 
 def append_semantic_records(path: str | Path, records: list[dict[str, Any]]) -> Path:
-    output = Path(path).expanduser().resolve()
+    raw_output = Path(path).expanduser()
+    output = raw_output.parent.resolve() / raw_output.name
     output.parent.mkdir(parents=True, exist_ok=True)
     if not records:
         return output
@@ -454,10 +456,7 @@ def append_semantic_records(path: str | Path, records: list[dict[str, Any]]) ->
                 raise TimeoutError(f"timed out waiting for semantic sidecar lock: {lock_dir}")
             time.sleep(0.01)
     try:
-        with output.open("a", encoding="utf-8", newline="\n") as handle:
-            handle.write(blob)
-            handle.flush()
-            os.fsync(handle.fileno())
+        append_private_text(output, blob)
     finally:
         try:
             lock_dir.rmdir()

{execweave-0.8.34 → execweave-0.8.35}/src/execweave/antigravity_hook_cli.py

@@ -16,6 +16,9 @@ from .antigravity_adapter import (
 from .antigravity_full_fidelity import antigravity_hook_to_content_events
 from .antigravity_trace_capability import antigravity_agent_trace_visibility_event
 from .content_store import FullFidelityContentStore
+from .hook_command import hook_command
+from .private_io import private_artifact_path
+from .privacy import full_content_capture_enabled
 from .conversation_archive import antigravity_conversation_archive_events
 
 _CAPTURE_ERRORS = (OSError, RuntimeError, TimeoutError, TypeError, ValueError)
@@ -42,7 +45,7 @@ def _now() -> str:
 def _handler(event: str) -> dict[str, Any]:
     return {
         "type": "command",
-        "command": f"execweave-antigravity-hook --auto --event {event}",
+        "command": f"{hook_command('antigravity')} --event {event}",
         "timeout": 30,
     }
 
@@ -126,7 +129,7 @@ def main(argv: list[str] | None = None) -> int:
         if sidecar is None:
             configured = os.environ.get("EXECWEAVE_SEMANTIC_SIDECAR")
             sidecar = Path(configured) if configured else _default_sidecar(payload)
-        sidecar = Path(sidecar).expanduser().resolve()
+        sidecar = private_artifact_path(sidecar)
     except _CAPTURE_ERRORS as exc:
         print(f"ExecWeave Antigravity hook warning [setup]: {exc}", file=sys.stderr)
         print(json.dumps(_passive_response(args.event), sort_keys=True))
@@ -156,6 +159,10 @@ def main(argv: list[str] | None = None) -> int:
             print(json.dumps(_passive_response(args.event), sort_keys=True))
             return 1
 
+    if not full_content_capture_enabled():
+        print(json.dumps(_passive_response(args.event), sort_keys=True))
+        return 0
+
     try:
         store = FullFidelityContentStore(sidecar.parent)
     except _CAPTURE_ERRORS as exc: