fix: redact streamed tool arguments safely (#37)

* test: add tool-call streaming fixtures

* fix: redact streamed tool arguments

* fix: preserve streamed tool JSON

Caller-audit:
Sources/PastewatchCore/SSEStreamRelay.swift:381 -- VERIFIED typed failures terminate before further socket writes
Sources/PastewatchCore/CurlHTTPClient.swift:845 -- VERIFIED Linux relay preserves the same fail-closed ordering

* fix: scan escaped truncated tool JSON

Caller-audit:
Sources/PastewatchCore/ToolCallStreamRedactor.swift:235 -- unaffected; nil remains the typed tool-byte-mapping termination path

* chore: bump version to 0.33.0

Author: ppiankov

CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-07-19
+
+### Added
+
+- The API proxy now redacts secrets inside **streamed tool-call arguments**. A shared
+  event-aware relay reassembles Anthropic `input_json_delta.partial_json` and
+  OpenAI-compatible/LiteLLM `tool_calls[].function.arguments` fragments across SSE frames
+  before scanning, so a secret split across frame boundaries — or carried in a JSON object
+  key, or spelled with `\u` escapes — is still caught. Redaction preserves the exact JSON
+  bytes outside authorized replacements; a fragment that cannot be redacted while keeping
+  valid JSON is blocked fail-closed rather than forwarded.
+- `pastewatch-cli proxy --debug-stream-dump <path>` captures raw upstream frames,
+  transformed output, and mutation decisions as owner-only (`0600`) JSONL for local
+  protocol diagnosis. Opt-in only, requires the default `per_sse_event` mode (startup
+  fails otherwise), contains unredacted secrets by design, and prints a warning even under
+  `--quiet`. The dump file is opened no-follow to prevent symlink path substitution.
+
+### Fixed
+
+- A `\u`-escaped secret carried in a **truncated or malformed** tool-call JSON payload is
+  no longer forwarded unredacted: complete escaped tokens are decoded and scanned even
+  when the aggregate JSON never parses, and any escape that cannot be mapped and scanned
+  blocks the frame fail-closed.
+- `ProxyServer` serializes the shared `ISO8601DateFormatter`'s lazy cache initialization on
+  Linux (swift-corelibs-foundation) so concurrent audit-log timestamping is thread-safe.
+
 ## [0.32.0] - 2026-07-17
 
 ### Added

README.md

@@ -1,6 +1,6 @@
 # Pastewatch
 [![Stable](https://img.shields.io/badge/status-stable-brightgreen)](https://github.com/ppiankov/pastewatch/releases)
-[![Version](https://img.shields.io/badge/version-0.32.0-blue)](https://github.com/ppiankov/pastewatch/releases/tag/v0.32.0)
+[![Version](https://img.shields.io/badge/version-0.33.0-blue)](https://github.com/ppiankov/pastewatch/releases/tag/v0.33.0)
 [![License: MIT](https://img.shields.io/badge/license-MIT-yellow)](LICENSE)
 [![CI](https://github.com/ppiankov/pastewatch/actions/workflows/ci.yml/badge.svg)](https://github.com/ppiankov/pastewatch/actions/workflows/ci.yml)
 [![ANCC](https://img.shields.io/badge/ANCC-compliant-brightgreen)](https://ancc.dev)
@@ -479,7 +479,11 @@ pastewatch-cli launch --audit-log /tmp/pw-audit.log -- claude
 [2026-03-16T11:36:56Z] PROXY REDACTED 3 secret(s) in /v1/messages
 ```
 
-**Streaming response mode.** `responseStreamingRedactionMode=buffer` is a compatibility mode for full-response buffering. It does not scan buffered response bodies for secrets; use the default `per_sse_event` mode when response redaction is required.
+**Streaming response mode.** `responseStreamingRedactionMode=buffer` is a compatibility mode for full-response buffering. It does not scan buffered response bodies for secrets; use the default `per_sse_event` mode when response redaction is required. The event-aware relay reassembles Anthropic `input_json_delta.partial_json` and OpenAI-compatible/LiteLLM `tool_calls[].function.arguments` fragments before scanning, then preserves all frame bytes outside authorized replacements. This response support does not change request admission: OpenAI-shaped request bodies are still refused.
+
+Response streaming has no authoritative catalog of exact local secret values. It mutates intrinsically identifiable formats and operator-approved custom rules; adding exact-value response matching requires a separately designed local secret source and lifecycle.
+
+For local protocol diagnosis only, `pastewatch-cli proxy --debug-stream-dump <path>` writes raw input frames, transformed output, and mutation decisions as owner-only JSONL. It requires the default `per_sse_event` mode so each record reflects the actual frame decision; startup fails instead of producing an incomplete dump in `raw_stream` or `buffer` mode. The file contains unredacted secrets by design, is disabled unless the option is supplied, and prints a warning even with `--quiet`. Delete it securely after diagnosis and never attach it to an issue or commit.
 
 ### MCP Server - Redacted Read/Write
 
@@ -784,7 +788,7 @@ Works with any comment style (`#`, `//`, `/* */`).
 # .pre-commit-config.yaml
 repos:
   - repo: https://github.com/ppiankov/pastewatch
-    rev: v0.32.0
+    rev: v0.33.0
     hooks:
       - id: pastewatch
 ```
@@ -997,7 +1001,7 @@ Do not pretend it guarantees compliance or safety.
 
 ## Project Status
 
-**Status: Stable, feature-complete** · **v0.32.0** · Accepting compatibility and bug fixes only
+**Status: Stable, feature-complete** · **v0.33.0** · Accepting compatibility and bug fixes only
 
 | Milestone | Status |
 |-----------|--------|

Sources/PastewatchCLI/ProxyCommand.swift

@@ -38,6 +38,12 @@ func proxyShutdownExitCode(didStart: Bool) -> Int32 {
     didStart ? 0 : proxyInterruptedExitCode
 }
 
+// WO-514: raw stream capture must remain conspicuous even when normal logs are quiet.
+func streamDebugDumpWarning(path: String?) -> String? {
+    guard let path else { return nil }
+    return "WARNING: --debug-stream-dump writes raw streaming data with secrets to local file: \(path)\n"
+}
+
 struct Proxy: ParsableCommand {
     static let configuration = CommandConfiguration(
         abstract: "Start API proxy that scans and redacts secrets from outbound requests"
@@ -58,6 +64,10 @@ struct Proxy: ParsableCommand {
     @Option(name: .long, help: "Audit log file path")
     var auditLog: String?
 
+    // WO-514: raw capture requires an explicit CLI path and has no config default.
+    @Option(name: .long, help: "Write raw streaming frames and redaction decisions to a local file")
+    var debugStreamDump: String?
+
     @Flag(name: .long, inversion: .prefixedNo, help: "Inject alert into response when secrets are redacted")
     var alert: Bool = true
 
@@ -92,6 +102,7 @@ struct Proxy: ParsableCommand {
 
         let config = PastewatchConfig.resolve()
         let compiledCustomRules = try requireValidProxyCustomRules(config)
+        let streamDebugSink = try debugStreamDump.map { try StreamDebugSink(path: $0) }
         let server = ProxyServer(
             port: port,
             upstream: upstreamURL,
@@ -103,7 +114,8 @@ struct Proxy: ParsableCommand {
             injectAlert: alert,
             quietLog: quiet,
             caCertPath: caCert,
-            insecureTLS: insecure
+            insecureTLS: insecure,
+            streamDebugSink: streamDebugSink
         )
 
         FileHandle.standardError.write(Data("pastewatch proxy listening on http://127.0.0.1:\(port)\n".utf8))
@@ -113,6 +125,9 @@ struct Proxy: ParsableCommand {
         }
         FileHandle.standardError.write(Data("severity: \(severity.rawValue)\n".utf8))
         FileHandle.standardError.write(Data("alert-injection: \(alert ? "on" : "off")\n".utf8))
+        if let warning = streamDebugDumpWarning(path: debugStreamDump) {
+            FileHandle.standardError.write(Data(warning.utf8))
+        }
         if let warning = ProxyServer.bufferModeWarning(config: config, quiet: quiet) {
             FileHandle.standardError.write(Data(warning.utf8))
         }