[GH-ISSUE #7782] fix(process): honor sensitive inputs across captured terminal projections #4640

New issue

Closed

opened 2026-10-31 00:51:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:51:42 +00:00

Owner

Originally created by @gensokyo-dev on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7782

Before submitting

I searched open and closed issues for related reports.
This report contains no credentials or sensitive target data.

Area

Process capture or runtime observation

Observed behavior

Source finding, subsequently reproduced, at c77735fa83a66552ec45eef435ab3bb36026ecfe: the scenario commitment and interaction journal replace explicitly sensitive input values, but terminal output is retained separately. captureTerminalFrames stores normalized text and optional original raw_data, and sends original output to the renderer. The output path does not consume the sensitive-input declarations. Ordinary input echo can therefore bypass the input-record redaction (confirmed by the owned PTY regression below).

Reproduction

Executed on Linux x64 with the pinned Node runtime at the reported source revision plus a local regression fixture. An owned Node PTY program reads a synthetic stdin value and emits whole and two-write echoes. The same value is declared through an input event with sensitive: true.

npm run test:focused -- tests/boundary/process/processCaptureSensitiveInput.test.ts ran two cases: the sensitive case failed with disclosures in normalized, original, rendered, and serialized; the unmarked control passed. Input dispatch and owned cleanup were asserted. The run took 9.401 s elapsed / 7.244 s CPU, with 664.3 MiB sampled process-family RSS on two CPUs. No real credential or external application was used. The fixture will accompany the PR.

Expected behavior

Honor explicitly marked sensitive values throughout retained capture projections, while preserving unmarked caller data, source identity, coverage, uncertainty and cleanup semantics. CLI/MCP should share the producing implementation. Keep normalization separate from privacy redaction so an original-value backup cannot reintroduce sensitive content. Bound retained bytes and redaction work.

Impact and scope

Potential disclosure in returned or persisted process-capture Evidence when sensitive input is echoed. One Linux run per case is established; other platform coverage and broader frequency remain unknown. No new execution authority is requested.

REA version

Source revision c77735fa83a66552ec45eef435ab3bb36026ecfe (6.8.0).

Runtime and platform

Linux x64, pinned Node 24.22.1; other platform verification pending.

Target and artifact context

Owned synthetic Node PTY echo fixture; no external application or real credential used.

Interface / earliest failure stage

Shared CLI/MCP capture workflow; capture or observation (source-derived).

Relevant output or evidence

Interaction journal masks the explicitly sensitive input record.
Terminal subscription retains output and passes the original text to the renderer.
Executed evidence: the two-case real PTY regression above; the sensitive case exposed the literal in all four terminal representations.
Fix and executed verification: #7804 (ready for review). Linux real PTY, public CLI and advertised MCP Evidence now withhold whole/split/styled echoes; the unmarked control and cancellation partial facts are covered. The final serial real-workflow run passed 5 tests. 212 related source tests, static checks and docs checks passed; exact commands, a transient MCP startup timeout and baseline-only identity failures are recorded in the PR.
Sequential public CLI A/B: fresh-directory completed workload 4.954 s baseline / 4.840 s fixed; reused-directory 4.708 s / 4.967 s. All runs use two CPUs; full CPU/RSS observations, workload and uncertainty are in the PR. No speedup or token reduction is claimed.
Remaining gaps: native macOS/Windows runtime capture. Encoded/transformed values and arbitrary terminal edits are outside the literal-redaction contract.

Additional context

Related but distinct boundaries: #1591 (browser scenario redaction) and #6252 (explicit CLI diagnostic redaction). Evaluate the existing shared explicit-sensitive-value implementation before introducing another interpretation.

Originally created by @gensokyo-dev on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7782 ### Before submitting - [x] I searched open and closed issues for related reports. - [x] This report contains no credentials or sensitive target data. ### Area Process capture or runtime observation ### Observed behavior Source finding, subsequently reproduced, at `c77735fa83a66552ec45eef435ab3bb36026ecfe`: the scenario commitment and interaction journal replace explicitly sensitive input values, but terminal output is retained separately. `captureTerminalFrames` stores normalized text and optional original `raw_data`, and sends original output to the renderer. The output path does not consume the sensitive-input declarations. Ordinary input echo can therefore bypass the input-record redaction (confirmed by the owned PTY regression below). ### Reproduction Executed on Linux x64 with the pinned Node runtime at the reported source revision plus a local regression fixture. An owned Node PTY program reads a synthetic stdin value and emits whole and two-write echoes. The same value is declared through an input event with `sensitive: true`. `npm run test:focused -- tests/boundary/process/processCaptureSensitiveInput.test.ts` ran two cases: the sensitive case failed with disclosures in `normalized`, `original`, `rendered`, and `serialized`; the unmarked control passed. Input dispatch and owned cleanup were asserted. The run took 9.401 s elapsed / 7.244 s CPU, with 664.3 MiB sampled process-family RSS on two CPUs. No real credential or external application was used. The fixture will accompany the PR. ### Expected behavior Honor explicitly marked sensitive values throughout retained capture projections, while preserving unmarked caller data, source identity, coverage, uncertainty and cleanup semantics. CLI/MCP should share the producing implementation. Keep normalization separate from privacy redaction so an original-value backup cannot reintroduce sensitive content. Bound retained bytes and redaction work. ### Impact and scope Potential disclosure in returned or persisted process-capture Evidence when sensitive input is echoed. One Linux run per case is established; other platform coverage and broader frequency remain unknown. No new execution authority is requested. ### REA version Source revision `c77735fa83a66552ec45eef435ab3bb36026ecfe` (6.8.0). ### Runtime and platform Linux x64, pinned Node 24.22.1; other platform verification pending. ### Target and artifact context Owned synthetic Node PTY echo fixture; no external application or real credential used. ### Interface / earliest failure stage Shared CLI/MCP capture workflow; capture or observation (source-derived). ### Relevant output or evidence - [Interaction journal masks the explicitly sensitive input record](https://github.com/morluto/rea/blob/c77735fa83a66552ec45eef435ab3bb36026ecfe/src/process/capture/ProcessCaptureJournal.ts#L92). - [Terminal subscription retains output and passes the original text to the renderer](https://github.com/morluto/rea/blob/c77735fa83a66552ec45eef435ab3bb36026ecfe/src/process/capture/ProcessCaptureLifecycle.ts#L1453). - Executed evidence: the two-case real PTY regression above; the sensitive case exposed the literal in all four terminal representations. - Fix and executed verification: #7804 (ready for review). Linux real PTY, public CLI and advertised MCP Evidence now withhold whole/split/styled echoes; the unmarked control and cancellation partial facts are covered. The final serial real-workflow run passed 5 tests. 212 related source tests, static checks and docs checks passed; exact commands, a transient MCP startup timeout and baseline-only identity failures are recorded in the PR. - Sequential public CLI A/B: fresh-directory completed workload 4.954 s baseline / 4.840 s fixed; reused-directory 4.708 s / 4.967 s. All runs use two CPUs; full CPU/RSS observations, workload and uncertainty are in the PR. No speedup or token reduction is claimed. - Remaining gaps: native macOS/Windows runtime capture. Encoded/transformed values and arbitrary terminal edits are outside the literal-redaction contract. ### Additional context Related but distinct boundaries: #1591 (browser scenario redaction) and #6252 (explicit CLI diagnostic redaction). Evaluate the existing shared explicit-sensitive-value implementation before introducing another interpretation.

bsakaguchi

2026-10-31 00:51:42 +00:00