ryota-murakami · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/.coderabbit.yaml b/.coderabbit.yaml
@@ -17,7 +17,8 @@ reviews:
   poem: false
   in_progress_fortune: false
   auto_review:
-    enabled: true
+    # Owner, 2026-10-27: no hosted review on GitHub from Cycle 0057; the local CodeRabbit CLI reviews each cycle (AGENTS.md Delivery).
+    enabled: false
     auto_incremental_review: true
     auto_pause_after_reviewed_commits: 0
     drafts: false

diff --git a/AGENTS.md b/AGENTS.md
@@ -79,6 +79,7 @@ Driving agent owns state, cycle selection, completion claims; GStack supplies wo
 - Per cycle: local CodeRabbit CLI + `open-code-review-delegate` → `/ship` as PR → required CI → separate exact-HEAD gate → merge as its own step with `--match-head-commit`.
 - A large cycle may use up to three PRs (`cycle100-pt1`, `cycle100-pt2`, …), each passing reviews, CI and gate alone, merged in order; the Issue closes after the last.
 - Codex automatic review off (no Codex cloud step). No `@coderabbitai ignore` in PR bodies (owner, 2026-10-05).
+- Hosted CodeRabbit off from Cycle 0057 (owner, 2026-10-27: 「次のサイクルからGitHubのコード、Rabbitのレビューはトリガーさせないでください。」): `.coderabbit.yaml` keeps `reviews.auto_review.enabled: false` (CodeRabbit reads the PR branch's file); never post `@coderabbitai review`.
 
 **Delivery parameters.**
 
@@ -102,7 +103,7 @@ Driving agent owns state, cycle selection, completion claims; GStack supplies wo
 - Third cycle still has findings (`converged:false`) → the owner's 2026-10-23 rule, feature and bug-fix cycles alike: fix every last-round finding, Minor and below included (Critical always fixed before merge, per the delivery rules); record only still-open Critical/Major defects in a GitHub Issue (next cycle's tasks); merge after required CI + exact-HEAD gate, reporting `converged:false` in the PR. This overrides no-carry for those recorded defects only.
 - The limit is `/ship`'s alone (owner, 2026-10-23): one round is long; full convergence would stall delivery. It records defects of `/ship` rounds the PR cannot close (e.g. a Major finding whose fix/proof needs an unknown root cause or a native check).
 - A Critical finding never merges open: one the PR cannot close holds the merge until fixed (cycle + delivery rules).
-- Local CodeRabbit CLI and hosted CodeRabbit: no round limit; their findings follow the cycle rule at every review, as do gate, CI and native-check failures.
+- Local CodeRabbit CLI: no round limit; its findings follow the cycle rule at every review, as do gate, CI and native-check failures.
 
 **Skills** (read each installed SKILL.md at invocation; this map guides, copies no workflow):
 
@@ -144,10 +145,7 @@ Driving agent owns state, cycle selection, completion claims; GStack supplies wo
 - [.coderabbit.yaml](.coderabbit.yaml) = policy + exclusions: keep its guidelines current; validate with `coderabbit config validate .coderabbit.yaml`; pass it via `--config` beside extra context.
 - Required: local CodeRabbit CLI, findings triage, CI, `open-code-review-delegate` (OCR picks files and rules, the host reviews; each eligible file reviewed or skipped with a reason; default exclusions reported apart; no independent external review).
 - Review against the implementation base; record completion, source cut, covered files, findings.
-- Hosted CodeRabbit (triggered on each PR; owner, 2026-10-23):
-  - wait for it beside CI; fix its findings under the cycle rule every review, no round limit (ship limit is `/ship`'s alone);
-  - rate limit or failed trigger → report "not run", never APPROVED; continue with the local review (runs every cycle anyway);
-  - a PR it reviewed merges only after CodeRabbit approved its exact head (owner, 2026-10-23): follow installed `/coderabbit-resolver` (each finding fixed or dispositioned with evidence; threads resolved via GraphQL `resolveReviewThread`; outside-diff findings audited), then wait for the `coderabbitai[bot]` review on that head to read APPROVED (`request_changes_workflow` in `.coderabbit.yaml` approves once threads are resolved). CHANGES_REQUESTED, no approval or approval of an earlier head → merge held, beside required CI + exact-HEAD gate.
+- Hosted CodeRabbit is not triggered (owner, 2026-10-27; [Delivery](#delivery)): merge waits for no hosted review or approval. A hosted review that still appears is reported in the PR; its findings follow the cycle rule like the local review's. Run the local CodeRabbit CLI on the PR's final range before merge.
 - Missing/private provider context = coverage limit.
 - Every user-visible behavior a CHANGELOG entry names needs a sentence in the packaged README (`extension/README.md`), as `.coderabbit.yaml`'s `CHANGELOG.md` instruction checks. A fix changing user-visible behavior changes that README in the same commit; fixers' briefs say so.
 - Claude Code CLI review: owner-skipped; no native chat acceptance.
@@ -211,10 +209,11 @@ Standing rules, stated as rules (no decision log); delivery chain and ship limit
 ## Development target
 
 - Until nine-project final acceptance starts, actual-editor trials use the owner-designated `nextjs-dashboard` (same repository and revision): Mac **`/Users/ryotamurakami/repository/nextjs-dashboard`**; its macOS Space **`/Users/lume/repository/nextjs-dashboard`**; Windows host **`/home/murakami/laststance/nextjs-dashboard`**.
+- Exception (owner, 2026-10-27): the Node server execution form, which `nextjs-dashboard` lacks, is trialled on a pinned clone of P08 `laststance/switch-time` in the Space (`/Users/lume/qa/c57/switch-time`, revision recorded in the cycle Issue), with its documented local stack. Development evidence only; no final-row credit.
 - Never an easier repository, never a tenth acceptance target. Recheck its revision, settings, dirty state; tell the owner before occupying the desktop; record unsupported behavior and missing setup. Docs-only work needs no native launch.
 - Development results earn no nine-project credit, fill no final row. Final acceptance freezes its own targets and candidate; Stage 1 starts only when its prerequisites hold.
 - Use real opened repositories; isolated inputs verify mechanisms only, never as bundled demos or practical trials. Retired local trial resources are removed; old records in Git are no current proof.
-- Development chats: VS Code = Copilot Chat, model **GPT6 Luna** (owner, 2026-10-21: the cheaper model); Cursor = Agent, model **Grok 4.6 high**, Fast on allowed (owner, 2026-10-24 JST: 「これからGrok4.6Hiのファストオンで大丈夫ですよ。」); after observed credit exhaustion (either host) = the installed **Codex Extension** (Claude Code extension fallback retired).
+- Development chats: VS Code = Copilot Chat, model **GPT6 Luna** (owner, 2026-10-21: the cheaper model; 2026-10-27: switch to GPT-6.1 Terra or GPT-6.1 Luna once the picker lists one; search the picker for `terra` and `6.1` before each VS Code trial, absent on 2026-10-27); Cursor = Agent, model **Grok 4.6 high**, Fast on allowed (owner, 2026-10-24 JST: 「これからGrok4.6Hiのファストオンで大丈夫ですよ。」); after observed credit exhaustion (either host) = the installed **Codex Extension** (Claude Code extension fallback retired).
   - Model missing from the picker → that host's trial is NOT RUN, picker list recorded.
   - Record the actual chat and fallback reason; buy no credits; never label fallback evidence Copilot.
   - Final acceptance has its own standard-chat rules. Historical Claude extension observations keep their identities.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.2.50.0] - 2026-10-27 (development candidate)
+
+Cycle 0057 ([Issue #139](https://github.com/laststance/codebook/issues/139)), a feature cycle, first of its three pull requests: one redaction contract masks credentials in what browser and test runs capture, before any of it reaches the chat, a saved history or Output › Codebook. The parts of the coming Node server profile (its declaration, launch and listener check) arrive here unexposed: no profile, tool or help offers them yet. Tests cover this part; no native editor trial ran on it.
+
+**Masked values.**
+
+- **Secret-named values read `[masked]`**: a variable, property or header whose name ends in a word such as `password`, `passphrase`, `pwd`, `secret`, `token`, `jwt`, `authorization`, `cookie`, `credential`, `session` or `sid`, in a key named for a secret use (`apiKey`, `privateKey`, `AWS_SECRET_ACCESS_KEY`, `signingKey`), or in `sessionId`, is masked with everything inside it, also inside an object's preview (`{apiKey: [masked], host: 'db'}`, including a member previewed as `(2) [...]`); `tokenCount`, `sortKey`, `publicKey`, `primaryKey` and `passwordPolicy` stay visible. A type inspection shows the type and keeps no real value.
+- **Credential-shaped text reads `[masked]`** in captured values, debugger snapshots, test output, the development server's log, failure causes and Output › Codebook: a password in a URL (the user name stays), a JWT, a `Bearer` token, `sk-`, Stripe `sk_`/`rk_`, `ghp_`, `github_pat_`, Slack `xox…-`, Google `AIza`, `npm_`, AWS `AKIA` and `ASIA` keys and a private-key block, also when the output splits one across chunks; text that cannot be a secret is released at once, so output keeps its order around a debugger stop.
+- **What is not masked**: Codebook has no detector for secret content, so a secret in a plainly named variable or in ordinary text stays visible; public keys and certificates stay visible; the editor's own debugger still shows you the real values.
+- **Saved material is unchanged**: values captured after this update may read `[masked]` where they showed a real value before; studies and replays saved earlier are not rewritten.
+
+**Compatibility.** The MCP API stays 1.8 and the bundled skill 1.0.50. `codebook://help/errors` lists one new code, `NODE_SERVER_SOURCE_REFUSED`, which no available profile raises yet. Stored learner data, the Wiki's published format and the marker format do not change.
+
 ## [0.2.49.0] - 2026-10-27 (development candidate)
 
 Cycle 0056 ([Issue #135](https://github.com/laststance/codebook/issues/135)), a bug-fix cycle, last of its three pull requests: a saved test replay opens in Cursor when it is chosen, the Saved studies list and the Learning summary say what is true around **Codebook: Close Study Workspace**, and the LLM Wiki view follows its folder, trusts through the editor's own command and changes its message with its rows. The native trial N56 checked part of this in the real editors, on this part's development candidates (`02acefaa`, `7ff3ab57`, `932cdae3`), not on the released build: VS Code 1.142.0 and Cursor 3.27.12 on macOS 26 (a virtual machine), with the development target `nextjs-dashboard`. It covered the test replay's opens and the Saved studies list after Close in Cursor, the trust command in both editors, and the view's message and rows and a deleted Wiki folder in VS Code; the other changes are covered by tests only. Each candidate was packaged from its own commit; the target's QA clone carried QA-owned edits that the Issue names, and the designated checkout none. N56 did not run again on the released source, which adds the review fixes made after `932cdae3`. Each step's host, candidate and result, and the hashes of its recordings (kept private), are in [Issue #135's comments](https://github.com/laststance/codebook/issues/135#issuecomment-6431339240).

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.2.49.0
+0.2.50.0
diff --git a/extension/README.md b/extension/README.md
@@ -511,6 +511,16 @@ A configured Study retains one article item with its ordered participant-specifi
 
 The run resource's `operationProgress` distinguishes accepted input from `inputDispatched`, `inputAcknowledged`, exact `continuedPause` and `afterVerified`; these transitions also invalidate older saved checkpoints. Study reports observation history and recording persistence separately. **Observation saved** does not certify **Recording saved**. A recording-context failure offers **Retry storage / refresh** without repeating application input. After restart, recording stays unverified until its saved evidence is opened and validated.
 
+## Masked values
+
+Codebook masks credentials before a browser or test run's values reach the chat, a saved history or the Output › Codebook channel. A masked value reads `[masked]`.
+
+- **Masked by name.** A variable, property or header whose name ends in the word `password`, `passwd`, `passphrase`, `pwd`, `pass`, `secret`, `token`, `jwt`, `authorization`, `cookie`, `credential`, `session` or `sid` (plural too), in a key named for a secret use (`api`, `private`, `secret`, `access`, `signing`, `encryption`, `master`, `client`, `auth` or `session` key), or in `session id`, is masked together with everything inside it. Names are read as words in camelCase, snake_case and kebab-case: `accessToken`, `db_passwd`, `set-cookie`, `apiKey`, `AWS_SECRET_ACCESS_KEY` and `sessionId` are masked; `tokenCount`, `sortKey`, `publicKey`, `primaryKey` and `passwordPolicy` stay visible. An object's preview shows such a member as `[masked]` too (`{apiKey: [masked], host: 'db'}`), also when the preview writes it with a length or type first (`(2) [...]`, `Object {...}`). A type inspection shows the type and keeps no real value.
+- **Masked by shape.** In any captured text, a password in a URL (`scheme://user:[masked]@host`; the user name stays), a JWT, a `Bearer` token, an `sk-` key, a Stripe `sk_`/`rk_` live or test key, a `ghp_` or `github_pat_` token, a Slack `xox…-` token, a Google `AIza` key, an `npm_` token, an `AKIA` or `ASIA` AWS key and a private-key block (`-----BEGIN … PRIVATE KEY-----` to its end) are replaced. Test output, the development server's log and errors are masked the same way, also when a secret arrives split across chunks, before any text is cut or stored. Only text that may still turn out to be a secret waits for the rest of its output; other text is released at once, so output keeps its order around a debugger stop.
+- **Not masked.** Codebook has no detector for secret content: a secret held in a plainly named variable or printed as ordinary text stays visible. Public keys and certificates stay visible.
+- **The native debugger is unchanged.** It is the editor's own and still shows you the real values.
+- **Updating.** Values captured after this update may read `[masked]` where they showed a real value before. Studies and replays saved earlier are not rewritten.
+
 ## Study workspace
 
 Codebook contributes `debug.focusEditorOnBreak: false` as the native debugger default, so a breakpoint can select its source and values without moving the keyboard out of the chat. This default applies to native debugging throughout editors where Codebook is enabled. At a stop Codebook did not cause (a step or a continue of yours, a refresh of the debug adapter, or a debug session that is not a Codebook run), Codebook gives the paused file the keyboard once, where the editor would without this default: only at the frame the editor's own stop handling focuses, or when the editor opens that frame's source for the stop. A stop the editor keeps in the background, or one at which it focuses no frame (every frame skipped as library code), moves the keyboard nowhere. Codebook also does nothing while a recording is open or when you set the setting yourself. Existing explicit User and Workspace preferences take precedence; Codebook writes no settings file. Set `debug.focusEditorOnBreak` to `true` in the ordinary editor settings if you prefer the debugger to focus source at a break. Disabling or removing Codebook removes its default contribution.
@@ -559,6 +569,7 @@ Bounded installed development trials in VS Code 1.139.1 and Cursor 3.23.5 ([Cycl
 | A completed run shows `resuming`                   | Its final save of events and run record is under way: until it settles, the run has no result and no `observed`, and a failed save fails the run. Read the run again.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | Missing prerequisite                               | Status names the dependency/configuration key. Correct it before deliberately starting another study.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | Session capacity                                   | A ninth client replaces the least recently seen idle session; `429` with `MCP session limit exceeded; every session has a request in flight. Retry after one completes.` is answered only while all eight have a request in flight: retry then. The replaced client's next request is answered `404` with `Unknown MCP session. Initialize a new transport, then read codebook_status.` A client `DELETE` releases its transport only. It does not stop a study.                                                                                                                                                                                                                                                           |
+| `NODE_SERVER_SOURCE_REFUSED`                       | `codebook://help/errors` lists it for the coming Node server profile; no available profile raises it yet.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 
 GET `/mcp` returns 405; this service provides JSON POST responses and polled resources, with no standalone notification stream. The pinned SDK client supports this. Idle transport sessions expire after five minutes; live application execution has its own deadline.
 

diff --git a/extension/package.json b/extension/package.json
@@ -3,7 +3,7 @@
   "displayName": "codebook",
   "description": "Connect an external agent to source-grounded codebase studies.",
   "publisher": "laststance",
-  "version": "0.2.49",
+  "version": "0.2.50",
   "private": true,
   "engines": {
     "vscode": "^1.120.0",

diff --git a/extension/scripts/tests/package.test.mjs b/extension/scripts/tests/package.test.mjs
@@ -95,7 +95,7 @@ test('a real VSIX loads outside the checkout and excludes bundled applications a
   // Assert
   assert.equal(receipt.isolatedModuleLoad, true)
   assert.equal(receipt.isolatedWikiPageWorker, true)
-  assert.equal(checked.extension.version, '0.2.49')
+  assert.equal(checked.extension.version, '0.2.50')
   assert.equal(checked.extension.apiVersion, '1.8')
   assert.equal(checked.entries, 33)
   assert.equal(receipt.dependencies.length, 16)
@@ -129,7 +129,15 @@ test('a real VSIX loads outside the checkout and excludes bundled applications a
   )
   assert.ok(
     [...original.keys()].every(
-      (path) => !/(?:^|\/)(?:demo|fixture|experiments)(?:\/|$)/.test(path),
+      (path) => !/(?:^|\/)(?:demo|fixtures?|experiments)(?:\/|$)/.test(path),
+    ),
+  )
+  // The node-server tests' HTTP server (src/tests/fixtures/node-server) never ships, under any folder name.
+  assert.ok(
+    [...original.keys()].every(
+      (path) =>
+        !path.includes('node-server/server.') &&
+        !path.endsWith('fixture-server.json'),
     ),
   )
   for (const path of COMPILED_DIRECTORIES) {