Keep file views inline and close verifier and redaction gaps

CHANGELOG.md

@@ -27,6 +27,18 @@ All notable changes to this project are documented here.
 - Verified and documented that a new turn in the same task adopted the updated hook after a cache-preserving CLI upgrade; the original code-mode result remained visible.
 - Confirmed that a nonzero tool exit preserved its status without rejecting a nested Promise, and documented command-selection guidance for the opt-in adapter.
 
+## [0.1.11] - 2026-09-28
+
+### Fixed
+
+- File views (`cat`, `nl`, `sed`, `head`, `tail`, `git show`/`diff`/`blame`) up to 64 KiB stay inline. In a recorded session every packed file read was followed by one or two artifact reads in smaller ranges.
+- Commands that read a receipt artifact are never packed into a receipt pointing at the same artifact. They are counted as `artifact_rereads` and `artifact_reread_bytes`, and the report adds `net_saved_bytes`.
+- Unknown-status output from `cargo test`, `go test`, `npm`/`pnpm`/`yarn`/`bun test`, `jest`, `vitest`, Gradle, Maven, and similar runners stays inline like `pytest` and `unittest`.
+- Recognized verifiers accept descriptor duplication such as `2>&1`. Go word flags such as `-short` and `-bench` are no longer treated as help requests.
+- Receipt redaction keeps indented diagnostics after an `Authorization` header and stops an unterminated private-key marker at its key-like lines instead of removing the rest of the output. It also redacts environment-style names ending in a secret keyword, common token prefixes, and passwords in URL user info. Matching now stays linear on long token-like runs.
+- Documentation files under source directories no longer create verification debt. Failed `apply_patch` results, including `Exit code: N` headers, no longer create debt.
+- Hook-command generator tests skip when the repository generator is not packaged with the installed plugin.
+
 ## [0.1.9] - 2026-09-24
 
 ### Fixed

README.md

@@ -21,7 +21,7 @@ Open `/hooks`, review the resolved commands, and trust the plugin when Codex ask
 
 ## What it does
 
-- `PostToolUse` watches shell and patch results. Eligible extracted text larger than 6 KiB is written under `PLUGIN_DATA`; `gpt-6-astra` uses a 4 KiB threshold. For structured results, the artifact is extracted text, not a byte-for-byte copy of the response object.
+- `PostToolUse` watches shell and patch results. Eligible extracted text larger than 6 KiB is written under `PLUGIN_DATA`; `gpt-6-astra` uses a 4 KiB threshold. For structured results, the artifact is extracted text, not a byte-for-byte copy of the response object. File views (`cat`, `nl`, `sed`, `head`, `tail`, `git show`/`diff`/`blame`) up to 64 KiB, reads of receipt artifacts, and unknown-status test-runner output stay inline.
 - The hook can emit a bounded receipt with status (or `unknown`), hashes, diagnostic lines, and a small preview. On the tested host, the original result remained visible in both direct and code-mode probes despite non-blocking feedback. Receipt redaction is best effort; the exact local artifact is not redacted.
 - Successful code patches create verification debt. A recognized verifier clears it only when its matching `PreToolUse` ran after the latest code patch and a structured exit code or private status sidecar reports exit code zero. Sidecars are a workflow aid, not a security attestation against malicious project code.
 - `PreCompact`, `PostCompact`, and `SessionStart` keep the debt reminder across Codex compaction. `Stop` warns about pending or failed verification without blocking the final answer; the agent must report checks accurately.

README.ru.md

@@ -21,7 +21,7 @@ codex plugin add sol-codex@sol-codex
 
 ## Что делает плагин
 
-- `PostToolUse` обрабатывает результаты shell-команд и патчей. Подходящий извлечённый текст больше 6 KiB сохраняется в `PLUGIN_DATA`; для `gpt-6-astra` порог равен 4 KiB. Для структурированного результата артефакт содержит извлечённый текст, а не побайтовую копию всего объекта ответа.
+- `PostToolUse` обрабатывает результаты shell-команд и патчей. Подходящий извлечённый текст больше 6 KiB сохраняется в `PLUGIN_DATA`; для `gpt-6-astra` порог равен 4 KiB. Для структурированного результата артефакт содержит извлечённый текст, а не побайтовую копию всего объекта ответа. Просмотр файлов (`cat`, `nl`, `sed`, `head`, `tail`, `git show`/`diff`/`blame`) до 64 KiB, чтение артефактов квитанций и вывод тест-раннеров с неизвестным статусом остаются без изменений.
 - Прямой результат может быть заменён ограниченной квитанцией со статусом (либо `unknown`), хешами, диагностическими строками и коротким preview. В code mode исходный вложенный результат может сохраниться. Редактирование секретов в квитанции работает по известным шаблонам; полный локальный артефакт не редактируется.
 - Успешное изменение кода создаёт verification debt. Распознанная команда снимает его только если соответствующий `PreToolUse` сработал после последнего изменения кода, а структурированный статус или приватный status-файл подтвердил код завершения 0.
 - `PreCompact`, `PostCompact` и `SessionStart` сохраняют напоминание после compaction. `Stop` предупреждает о невыполненной или неуспешной проверке, не блокируя ответ; агент обязан честно сообщить статус проверок.

docs/savings.md

@@ -47,6 +47,8 @@ The report has three scopes:
 - `by_model`: events recorded with an exact model slug;
 - `unattributed`: the difference between totals and attributed model counters.
 
+Since 0.1.11, `artifact_rereads` and `artifact_reread_bytes` count commands that read a receipt artifact back, and `totals` and each `by_model` entry include `net_saved_bytes = saved_bytes - artifact_reread_bytes`. A negative value means the agent read more artifact bytes than the receipts replaced. Code-mode results that bypassed the receipt are still counted as receipt events.
+
 ## Deterministic mechanism benchmark
 
 The repository includes a local benchmark that exercises both thresholds, exact artifact hashing, credential redaction, plain-string unknown status, the structured-response status guard, and the net-savings guard:

plugins/sol-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sol-codex",
-  "version": "0.1.10+codex.20260924",
+  "version": "0.1.11+codex.20260928",
   "description": "Local Codex hooks for bounded receipt feedback, verification tracking, and compaction recovery.",
   "author": {
     "name": "Spectorn"