fix: composite domain-answer key (#7) + transcript secret redaction (#9) (#11)

#7 — DomainAnswerStore keyed answers by question TEXT only, so two
different files asking the same question (e.g. "What is the grace
period?") collapsed to one answer; answering it in file A silently
unblocked file B with A's answer. hashQuestion now takes (filePath,
text) and hashes the composite. Same wording in a different file is a
distinct question again.

#9 — Captured transcripts wrote full prompts/responses to disk
unredacted; they can carry pulled-in source and secrets. New
redactSecrets() masks known token shapes (sk-ant-, sk-/sk-proj-,
ghp_/gho_/…, github_pat_, AKIA/ASIA, AIza, xox*, Bearer values, and
SECRET_NAME=value assignments). instrumentLLMCaller/CodexCaller redact
by default (opt out with { redact: false }); the events file is created
mode 0600.

Tests: 387 → 400. New: hashQuestion file-scoping + path-normalization;
redactSecrets per token shape + non-secret passthrough; instrumented
callers redact by default and honor redact:false. No skips.

Refs Codex review #7, #9 (private KB).

Author: telivity-otaip

packages/asil-analyzer/src/__tests__/instrumented-callers.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { instrumentLLMCaller, instrumentCodexCaller } from '../instrumented-callers.js';
+import { EventSink, readEvents, type LLMCallEvent } from '../transcript-writer.js';
+
+function withSink<T>(fn: (sink: EventSink, file: string) => Promise<T>): Promise<T> {
+  const dir = mkdtempSync(join(tmpdir(), 'instr-'));
+  const file = join(dir, 'events.jsonl');
+  const sink = new EventSink(file);
+  return fn(sink, file).finally(() => rmSync(dir, { recursive: true, force: true }));
+}
+
+describe('instrumented callers — redaction (Codex #9)', () => {
+  it('masks secrets in the captured LLM transcript by default', async () => {
+    await withSink(async (sink, file) => {
+      const real = {
+        async call() {
+          return {
+            content: 'sure, your key sk-ant-api03-' + 'z'.repeat(24) + ' works',
+            inputTokens: 1,
+            outputTokens: 1,
+          };
+        },
+      };
+      const llm = instrumentLLMCaller(real, sink);
+      await llm.call('system has GITHUB_TOKEN=ghp_' + 'a'.repeat(36), 'user prompt', 'sonnet');
+      const events = readEvents(file);
+      const call = events.find((e) => e.kind === 'llm-call') as LLMCallEvent;
+      expect(call.responseContent).toContain('«REDACTED»');
+      expect(call.responseContent).not.toContain('sk-ant-api03');
+      expect(call.systemPrompt).toContain('«REDACTED»');
+      expect(call.systemPrompt).not.toContain('ghp_aaaa');
+    });
+  });
+
+  it('honors { redact: false } (raw capture for trusted/debug runs)', async () => {
+    await withSink(async (sink, file) => {
+      const secret = 'sk-ant-api03-' + 'z'.repeat(24);
+      const real = {
+        async call() {
+          return { content: secret, inputTokens: 1, outputTokens: 1 };
+        },
+      };
+      const llm = instrumentLLMCaller(real, sink, { redact: false });
+      await llm.call('s', 'u', 'sonnet');
+      const events = readEvents(file);
+      const call = events.find((e) => e.kind === 'llm-call') as LLMCallEvent;
+      expect(call.responseContent).toBe(secret);
+    });
+  });
+
+  it('redacts codex-call prompts too', async () => {
+    await withSink(async (sink, file) => {
+      const real = {
+        async call() {
+          return { content: 'ok', inputTokens: 0, outputTokens: 0 };
+        },
+      };
+      const codex = instrumentCodexCaller(real, sink);
+      await codex.call('please use ghp_' + 'b'.repeat(36), 'gpt-4o');
+      const events = readEvents(file);
+      const call = events.find((e) => e.kind === 'codex-call') as LLMCallEvent;
+      expect(call.userPrompt).toContain('«REDACTED»');
+      expect(call.userPrompt).not.toContain('ghp_bbbb');
+    });
+  });
+});

packages/asil-analyzer/src/__tests__/redact.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest';
+import { redactSecrets } from '../redact.js';
+
+describe('redactSecrets (Codex #9)', () => {
+  it('masks an Anthropic key', () => {
+    const { text, redactions } = redactSecrets(
+      'key is sk-ant-api03-AbCdEf0123456789_xyz-more and done',
+    );
+    expect(text).not.toContain('sk-ant-api03');
+    expect(text).toContain('«REDACTED»');
+    expect(redactions).toBeGreaterThan(0);
+  });
+
+  it('masks an OpenAI key (incl. sk-proj-)', () => {
+    expect(redactSecrets('sk-proj-abcdefghijklmnopqrstuvwxyz0123').text).toContain(
+      '«REDACTED»',
+    );
+    expect(redactSecrets('sk-abcdefghijklmnopqrstuvwxyz0123').text).not.toContain(
+      'sk-abcdefghij',
+    );
+  });
+
+  it('masks GitHub tokens', () => {
+    const t = redactSecrets('ghp_' + 'A'.repeat(36)).text;
+    expect(t).toContain('«REDACTED»');
+    expect(t).not.toContain('ghp_AAAA');
+  });
+
+  it('masks AWS access key ids', () => {
+    expect(redactSecrets('AKIAIOSFODNN7EXAMPLE').text).toContain('«REDACTED»');
+  });
+
+  it('masks a Bearer header value', () => {
+    const t = redactSecrets('Authorization: Bearer abcdef0123456789ghijklmnop').text;
+    expect(t).toContain('«REDACTED»');
+    expect(t).not.toContain('abcdef0123456789ghij');
+  });
+
+  it('masks the VALUE of a secret-named assignment but keeps the name', () => {
+    const { text } = redactSecrets('ANTHROPIC_API_KEY=sk-ant-supersecretvalue123');
+    expect(text).toContain('ANTHROPIC_API_KEY=');
+    expect(text).not.toContain('supersecretvalue123');
+    expect(text).toContain('«REDACTED»');
+  });
+
+  it('leaves non-secret text untouched', () => {
+    const input = 'The function refactors the parser. No secrets here.';
+    expect(redactSecrets(input).text).toBe(input);
+    expect(redactSecrets(input).redactions).toBe(0);
+  });
+
+  it('handles multiple secrets in one blob', () => {
+    const blob = [
+      'sk-ant-api03-' + 'x'.repeat(20),
+      'ghp_' + 'y'.repeat(36),
+      'just some code',
+    ].join('\n');
+    const { text, redactions } = redactSecrets(blob);
+    expect(redactions).toBeGreaterThanOrEqual(2);
+    expect(text).toContain('just some code');
+  });
+});

packages/asil-analyzer/src/index.ts

@@ -33,7 +33,10 @@ export type {
 } from './transcript-writer.js';
 
 export { instrumentLLMCaller, instrumentCodexCaller } from './instrumented-callers.js';
+export type { InstrumentOptions } from './instrumented-callers.js';
 export { wrapBudgetManager } from './budget-instrument.js';
+export { redactSecrets, DEFAULT_REDACTION_RULES } from './redact.js';
+export type { RedactionRule } from './redact.js';
 
 export {
   analyze,

packages/asil-analyzer/src/instrumented-callers.ts

@@ -12,8 +12,24 @@
  */
 import type { CodexCaller, LLMCaller } from 'asil-improvement-loop';
 import { classifyRole, type EventSink } from './transcript-writer.js';
+import { redactSecrets } from './redact.js';
 
-export function instrumentLLMCaller(real: LLMCaller, sink: EventSink): LLMCaller {
+export interface InstrumentOptions {
+  /** Mask secret-shaped tokens before writing to disk. Default true.
+   *  (Codex review #9 — transcripts can contain pulled-in source/secrets.) */
+  redact?: boolean;
+}
+
+function maybeRedact(text: string, redact: boolean): string {
+  return redact ? redactSecrets(text).text : text;
+}
+
+export function instrumentLLMCaller(
+  real: LLMCaller,
+  sink: EventSink,
+  opts: InstrumentOptions = {},
+): LLMCaller {
+  const redact = opts.redact !== false;
   return {
     async call(systemPrompt: string, userPrompt: string, model: string) {
       const startedAt = Date.now();
@@ -24,9 +40,9 @@ export function instrumentLLMCaller(real: LLMCaller, sink: EventSink): LLMCaller
           kind: 'llm-call',
           ts,
           model,
-          systemPrompt,
-          userPrompt,
-          responseContent: response.content,
+          systemPrompt: maybeRedact(systemPrompt, redact),
+          userPrompt: maybeRedact(userPrompt, redact),
+          responseContent: maybeRedact(response.content, redact),
           inputTokens: response.inputTokens,
           outputTokens: response.outputTokens,
           latencyMs: Date.now() - startedAt,
@@ -52,7 +68,12 @@ export function instrumentLLMCaller(real: LLMCaller, sink: EventSink): LLMCaller
   };
 }
 
-export function instrumentCodexCaller(real: CodexCaller, sink: EventSink): CodexCaller {
+export function instrumentCodexCaller(
+  real: CodexCaller,
+  sink: EventSink,
+  opts: InstrumentOptions = {},
+): CodexCaller {
+  const redact = opts.redact !== false;
   return {
     async call(prompt: string, model: string) {
       const startedAt = Date.now();
@@ -67,8 +88,8 @@ export function instrumentCodexCaller(real: CodexCaller, sink: EventSink): Codex
           // and leave systemPrompt empty so analyzer text scans work
           // uniformly across both call types.
           systemPrompt: '',
-          userPrompt: prompt,
-          responseContent: response.content,
+          userPrompt: maybeRedact(prompt, redact),
+          responseContent: maybeRedact(response.content, redact),
           inputTokens: 0,
           outputTokens: 0,
           latencyMs: Date.now() - startedAt,

packages/asil-analyzer/src/redact.ts

@@ -0,0 +1,73 @@
+/**
+ * Secret redaction for captured transcripts (Codex review #9).
+ *
+ * Transcripts capture full prompts + responses, which can include
+ * source pulled from the target repo, stack traces, and — the real
+ * risk — secrets that happen to appear in that material. Redaction
+ * masks well-known secret token shapes before anything is written to
+ * disk. It is deliberately conservative (mask known shapes, don't try
+ * to be a general-purpose DLP) and runs by default; callers can opt out
+ * with `{ redact: false }` on the instrumented callers.
+ */
+
+export interface RedactionRule {
+  name: string;
+  pattern: RegExp;
+}
+
+/** Known secret token shapes. Ordered roughly by specificity. */
+export const DEFAULT_REDACTION_RULES: RedactionRule[] = [
+  // Anthropic keys: sk-ant-… (long).
+  { name: 'anthropic-key', pattern: /sk-ant-[A-Za-z0-9_-]{16,}/g },
+  // OpenAI keys: sk-…, sk-proj-…, sk-svcacct-… .
+  { name: 'openai-key', pattern: /sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}/g },
+  // GitHub tokens: ghp_, gho_, ghu_, ghs_, ghr_ + 36+ chars.
+  { name: 'github-token', pattern: /gh[posur]_[A-Za-z0-9]{36,}/g },
+  // GitHub fine-grained PAT.
+  { name: 'github-pat', pattern: /github_pat_[A-Za-z0-9_]{22,}/g },
+  // AWS access key id.
+  { name: 'aws-akid', pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+  // Google API key.
+  { name: 'google-key', pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g },
+  // Slack token.
+  { name: 'slack-token', pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+  // Bearer header values.
+  { name: 'bearer', pattern: /[Bb]earer\s+[A-Za-z0-9._-]{20,}/g },
+  // Generic `<SECRETY_NAME>=<value>` / `: <value>` assignments for
+  // env vars whose NAME looks secret-y. Masks only the value.
+  {
+    name: 'assigned-secret',
+    pattern:
+      /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)S?)\b(\s*[:=]\s*)(['"]?)([^\s'"]{6,})\3/gi,
+  },
+];
+
+const MASK = '«REDACTED»';
+
+/**
+ * Redact secret-shaped substrings from `text`. Returns the masked text
+ * and a count of redactions made (useful for a "N secrets masked"
+ * note). Idempotent-ish: re-running over masked text is a no-op for the
+ * token rules.
+ */
+export function redactSecrets(
+  text: string,
+  rules: RedactionRule[] = DEFAULT_REDACTION_RULES,
+): { text: string; redactions: number } {
+  let redactions = 0;
+  let out = text;
+  for (const rule of rules) {
+    if (rule.name === 'assigned-secret') {
+      out = out.replace(rule.pattern, (_m, name, sep, quote, _val) => {
+        redactions += 1;
+        return `${name}${sep}${quote}${MASK}${quote}`;
+      });
+    } else {
+      out = out.replace(rule.pattern, () => {
+        redactions += 1;
+        return MASK;
+      });
+    }
+  }
+  return { text: out, redactions };
+}

packages/asil-analyzer/src/transcript-writer.ts

@@ -130,8 +130,10 @@ export class EventSink {
 
   constructor(private readonly eventsFile: string) {
     mkdirSync(dirname(eventsFile), { recursive: true });
-    // Truncate any prior content so re-runs start clean.
-    writeFileSync(eventsFile, '');
+    // Truncate any prior content so re-runs start clean, and restrict
+    // to owner read/write — transcripts can carry pulled-in source even
+    // after redaction. (Codex review #9.)
+    writeFileSync(eventsFile, '', { mode: 0o600 });
   }
 
   setCurrentTask(taskId: string | null): void {

packages/asil-improvement-loop/src/__tests__/domain-questions.test.ts

@@ -11,24 +11,37 @@ import {
 import { mockRunner } from './helpers.js';
 
 describe('hashQuestion', () => {
-  it('is deterministic for the same input', () => {
-    expect(hashQuestion('How does X work?')).toBe(hashQuestion('How does X work?'));
+  it('is deterministic for the same file + input', () => {
+    expect(hashQuestion('a.ts', 'How does X work?')).toBe(
+      hashQuestion('a.ts', 'How does X work?'),
+    );
   });
 
   it('normalizes whitespace and case (re-formatting does not invalidate the answer)', () => {
-    expect(hashQuestion('How does X work?')).toBe(
-      hashQuestion('  HOW DOES   X work?  '),
+    expect(hashQuestion('a.ts', 'How does X work?')).toBe(
+      hashQuestion('a.ts', '  HOW DOES   X work?  '),
     );
   });
 
   it('returns a different hash when the question is reworded', () => {
-    expect(hashQuestion('How does X work?')).not.toBe(
-      hashQuestion('How does Y work?'),
+    expect(hashQuestion('a.ts', 'How does X work?')).not.toBe(
+      hashQuestion('a.ts', 'How does Y work?'),
+    );
+  });
+
+  it('returns a DIFFERENT hash for the same question in a different file (Codex #7)', () => {
+    // The whole point: identical wording in two files must not collide.
+    expect(hashQuestion('a.ts', 'How does X work?')).not.toBe(
+      hashQuestion('b.ts', 'How does X work?'),
     );
   });
 
+  it('normalizes the file path (./a.ts and a.ts collide)', () => {
+    expect(hashQuestion('./a.ts', 'q')).toBe(hashQuestion('a.ts', 'q'));
+  });
+
   it('returns a 64-char hex sha256', () => {
-    expect(hashQuestion('test')).toMatch(/^[a-f0-9]{64}$/);
+    expect(hashQuestion('f.ts', 'test')).toMatch(/^[a-f0-9]{64}$/);
   });
 });
 

packages/asil-improvement-loop/src/domain-questions.ts

@@ -97,7 +97,7 @@ describe('triageDomainQuestions', () => {
     // Compute what the hash will be by issuing the same call.
     const { hashQuestion } = await import('asil-improvement-loop');
     store.saveAnswer({
-      hash: hashQuestion('How to do X?'),
+      hash: hashQuestion('a.ts', 'How to do X?'),
       filePath: 'a.ts',
       line: 1,
       question: 'How to do X?',