[liby]

preallow 0.0.10 redacts what its output scan finds instead of withholding the whole output. Each credential-shaped value, and every other copy of it in the result, property names included, becomes [redacted by preallow: <kind>], and a note beside the result tells the agent that the call ran, that a marker is not a usable value, and that the same call run again goes to the classifier. A failed call's error text is redacted the same way. Before, one token in a long log or a process listing cost the agent the rest of it. The trade-off was the user's choice: a credential the patterns miss, sitting beside one they find, now reaches the model, and the README lists it among the known gaps.

The whole output is still withheld where redacting cannot cover what the model reads: a hit in the file a large result is saved to, which the agent can read later; a hit, or a copy of a value found anywhere else, in a context entry another hook attached, which core keeps whole; and a value the rendered text shows that the tool's record does not hold. The redacted answer is a new { result } without ref, since core reuses the messages a ref names. A redacted call stays allowed for the session, so if the engine refuses the redacted answer, .catch withholds the output.

A redaction has to cover the whole credential, so the spans changed. A PEM key runs to its end marker whatever starts its lines, such as Read's line numbers, or else through its base64 lines; PuTTY keys take their continuation lines and an age identity ends at its fixed length. findLeaks returns each gitleaks finding with its secret group's span, and jwt-base64 and microsoft-teams-webhook, whose groups hold only part of the token, are generated without capturing groups. The plugin's own shapes name the value, so TOKEN= stays readable.

The scan now also reads the tool's record, because Read's line numbers or JSON escaping can hide a shape, such as a netrc password, from the text. A record value counts only where the text the model reads shows it, so the file an Edit result keeps is left alone. Reading records exposed a false positive the line numbers had hidden: an empty API_KEY= took the next line's name for its value. A value now starts on its name's line unless it is quoted.

Separately, gitleaks' sourcegraph-access-token rule took any 40-character hex string in a text naming Sourcegraph, so a commit hash in gh pr view or a git log beside the word withheld the output. The generator drops that alternative and keyword, keeping the sgp_ forms; a legacy token is still found under a name such as SRC_ACCESS_TOKEN= by the plugin's own shapes, and the generator fails if a gitleaks update changes the alternative.

Over 230,286 tool outputs from local transcripts, kept outside this repository, the new scan redacts 492 and withholds 85; every output 0.0.9 withheld by its text is now redacted, apart from the Sourcegraph and empty-assignment false positives it no longer flags, and the redacted outputs keep 83.1% of their characters. Of the 85 withheld, 16 have a hit in the saved file and 69 have a saved file the evaluation could no longer read. No redacted result still holds a match. An output of a megabyte holding 38,000 distinct values takes about 8.5 of the hook's 10 seconds, as it did before this change; an output past the limit is withheld.