Direction check against #1: capture machinery and analyzers have outgrown the extraction core #24

The roadmap in #1 states the direction: let developers choose what code context to share, without changing how they prefer to code, and do not become a linter, an agent or a static-analysis engine. #1 was closed with every checkbox still unticked, so it cannot be read as a status. This issue compares the current tree (0.12.2, c1c4d11) with it and proposes what to hold back. It does not propose removing a command (#1 lists that as a non-goal).

Where the code and the bugs are

• Lines in rust/src (the files named, not the outline/ subfolder): terminal capture and shell integration (term.rs, commands/cap.rs, commands/term.rs, commands/hook.rs, commands/ingest.rs, commands/shell_help.rs, shellhist.rs, runner.rs) is 2,456 lines. The extraction commands a developer picks by hand (scan, digest, tree, diff, scanner.rs) are 1,177. pack with its automatic selection (pack.rs, callees.rs, resolver.rs) is 1,265.
• Of the 12 issues filed so far, 9 are about capture or shell integration: fix(mcp): scope and redact native-shell-history fallback before returning to agents #2, feat(term): copy opt-in host and shell context alongside captured commands and errors #4, feat(powershell): make help codigest show native PowerShell help without overriding help #5, Commands that need a shell fail on Termux: no /bin/sh #13, PowerShell hook: a nested __cdg call clears the outer capture #14, cap: PowerShell aliases and cmdlets are "Command not found" on Windows #15, cdg cap { ... } fails with 'Command not found: -encodedCommand' #16, term uninstall does not restore startup files byte for byte #20, term captures keep secrets: cut private keys, camelCase keys, Docker auth #21. Two are open and both are privacy defects: term captures keep secrets: cut private keys, camelCase keys, Docker auth #21 (captures keep private keys, camelCase keys, Docker auth) and term uninstall does not restore startup files byte for byte #20 (uninstall does not restore startup files byte for byte). Their fix is fix(term): byte-exact uninstall and masking of cut keys and camelCase secrets #22 (1,085 lines), with a cost measurement in perf(term): measure the capture hooks and state a cost budget #23.
• The capture hook is the one feature that edits shell startup files, runs a background process per command and stores output for later. Everything else in the tool acts only when the developer runs it.

Where it already matches #1

Named files give only those files (pack src/x.py), --with adds automatic sources back, every bundle reports size and the reason for each file, and scan output carries no instruction text by default. mcp is a separate command that nothing else depends on.

Where it does not

1. Language support is uneven, against Codigest v0.9 — Developer-controlled Context Extraction #1's "automatic selection behaves consistently across supported languages". Imports resolve for Python and JS/TS; digest handles Python and MATLAB; semdiff and the called-from-failing-test selection (callees.rs, tree-sitter) are Python only. semdiff misses changes in functions too deep for ast.unparse #17 is a hole in semdiff, fixed by fix(semdiff): hash bodies too deep for ast.unparse #18.
2. Two implementations are tracked: 43 files under src/codigest/ and the Rust build. Every behavior change is made twice and checked by a parity suite (test: parity of pack, diff, semdiff and status between the builds #19). 29 comments in rust/src point at Python files ("as core/prompts.py", "the Python build"); a reader cannot tell which side is the source of truth.
3. fix(term): byte-exact uninstall and masking of cut keys and camelCase secrets #22 and perf(term): measure the capture hooks and state a cost budget #23 are stacked, and term captures keep secrets: cut private keys, camelCase keys, Docker auth #21 is a secrets leak in a feature that gained more surface meanwhile (opt-in host context in feat(term): copy opt-in host and shell context alongside captured commands and errors #4, PowerShell help in feat(powershell): make help codigest show native PowerShell help without overriding help #5). Whether masking was designed before or after those I did not trace.

Proposal

1. Merge fix(term): byte-exact uninstall and masking of cut keys and camelCase secrets #22 before any further capture or shell-integration feature. Add a table of what is masked (key kinds, auth files, camelCase names) as a test contract.
2. State in the README which commands are language specific, and take new language analyzers out of scope until semdiff misses changes in functions too deep for ast.unparse #17-style gaps in the existing ones are closed.
3. Decide the Python build: keep as a launcher for the Rust binary, or keep both with parity as a release gate. Remove the stale references either way.
4. Replace Codigest v0.9 — Developer-controlled Context Extraction #1 with a short status list (done / open / dropped) so the direction has one current statement.

Not checked

I did not run the tests or the hooks, and I have no usage data. The line counts are wc -l over the files named above.