land: audit-u03-shell-watcher-logs

[aft-alfonso]

Accepted agent delivery; branch-keyed search descriptor included.

---

Summary by cubic

Hardens bash rewriting, file watching, and logging so shell commands start with a cleaner environment, the watcher stays responsive under event bursts, wide characters render correctly in terminal sessions, and logs redact secrets more reliably.

Performance

• Parses each rewritten command once and shares the result across all built-in rewrite rules.
• Bounds permission-arity lookup to two-word table keys instead of scanning the full argument list.
• Captures open descriptors in the parent and marks only them CLOEXEC (close_range on Linux), so cleanup no longer sweeps unused numbers or depends on the hard descriptor limit.
• Clones the gitignore snapshot before watcher path filtering so filesystem work never holds the rebuild writer lock.

Correctness

• PTY rendering now skips continuation columns of wide glyphs instead of inserting stray spaces.
• GitHub token redaction only scans text containing actual token prefixes (ghp_, gho_, etc.).
• Terminal-sync log lines are redacted before writing to both the file and stderr.
• Windows directory-change notifications are decoded from byte slices and use DWORD-aligned buffers, avoiding unaligned struct reads.

^{Written for commit 838abaf. Summary will update on new commits.}

Confidence Score: 5/5

The PR appears safe to merge; no new blocking issue was established.

Summary

This PR reduces repeated shell parsing, fixes wide-character output, improves log redaction, and updates file watching.

The follow-up changes focus on inherited file descriptors:

• Permission prefixes find command keys without scanning every argument.
• Built-in shell rewrite rules share one parse of each command.
• Child processes mark open descriptors close-on-exec without scanning every descriptor number.
• Watcher path checks use a gitignore snapshot without holding its lock.
• Windows file events use aligned buffers and decode notification bytes safely.
• PTY output renders wide characters without extra spaces.
• Terminal-sync logs redact secrets before writing to either output.
• Session-tagged log messages are formatted directly into the output.
• Watcher documentation and release metadata describe the change and its path-watch contract.

No new actionable issues were established. Both earlier threads were unnumbered and are resolved. The current code addresses their reported causes: fixed descriptor 70_000 is gone, and the fallback no longer scans up to the hard limit.

_{Reviews (2) · Last reviewed commit: "mason: bound descriptor cleanup to paren..." · Reviewed by Greptile}