Repository navigation
[Bug] Raw envelopes reach disk before redaction runs, with no file mode set #71
Description
Found by a six-perspective adversarial review of #60.
packages/guardian/src/envelope-log-sink.ts:10-19 states the design plainly: "no field stripping, no redaction, no reordering." server.ts:517 writes the request to .acs/envelopes.jsonl on parse, before dispatch() and before any policy evaluation. ToolCallRequestPayload.raw_command and ToolCallResultPayload.outputs carry the shell commands and tool output that hold credentials.
The sharp part is an asymmetry in the test suite. Dozens of assertions cover redaction on the model-facing path, in hosts/opencode/test/result-gate.test.ts and apply-opencode-output.test.ts. There are none on the envelope-log or audit-sink path. A reader who sees the first set concludes secrets are handled.
Neither audit-sink.ts nor envelope-log-sink.ts passes a mode to mkdirSync or appendFileSync, so files land at the process umask, typically world-readable.
.acs/ is gitignored, which closes the accidental-commit path. That is not the same as the file being safe at rest.
Activity
rocklambros commentedon Oct 12, 2026
A third file joins the two listed here. #244 adds an OTLP trace file (
ACS_OTEL_FILE) that holds decision reasoning, tool names, capabilities, and provenancesource_idvalues, which can be URLs or file paths. Raw tool arguments are not exported. I've asked #244 to create that file with mode0600and its directory with0700, so it should not need fixing here. Please include it when checking this issue's acceptance criteria. Its sample collector config is also movingdebugtoverbosity: basic, so it doesn't print every attribute to stdout.Create the trace file readable by its owner only
Answer the 12 October review of the Go Guardian
MK023 commentedon Oct 27, 2026
Here is a measurement from a real Claude Code session: Claude Code 2.1.308, ACS
integrationatfd6ff383, the shipped hook and the stock manifest.The model ran
caton a file containingAWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE, the example key from the AWS documentation. The result gate answeredmodifywithredaction_applied, and the model receivedAWS_ACCESS_KEY_ID=[REDACTED].The
steps/toolCallResultrequest in.acs/envelopes.jsonlstill holds the key in plaintext, atparams.payload.outputs[0].value. The Inspector log holds it in plaintext too. The.acs/*.jsonlfiles had mode 644. All four runs, three non-interactive and one interactive, gave the same result.The redaction protects what the model sees, but the Guardian's own log keeps the plaintext. README line 370 already says this for tool arguments: "Nothing is stripped or redacted, so the file holds raw tool arguments." My runs show that it holds for tool output as well.