fix(integrations): guard automatic prompt capture and preparation

docs/en/docs/integrations/claude-code.md

@@ -274,3 +274,7 @@ Authorization is environment-only and must not be added to the Server URL or plu
 The outer `UserPromptSubmit` Hook timeout is ten seconds. Recall and capture use one shared wall-clock budget but fail
 independently. HTTPS certificate validation remains enabled when HTTP is explicitly permitted. Restart Claude Code
 after changing its environment.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/en/docs/integrations/codex.md

@@ -362,3 +362,7 @@ The outer Codex hook timeout is ten seconds. Recall, capture, and flush fail ind
 the Server is unavailable or rejects authentication. Without an explicit Scope, the plugin resolves the Session
 binding, workspace binding, then Server default. Process-level settings must be present in the environment that starts
 Codex. Windows setup writes authorization to the user environment, but Desktop must be restarted to inherit it.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/en/docs/integrations/index.md

@@ -45,6 +45,53 @@ powercontext setup
 
 Use the same ref as the Server. `powercontext setup codex dsh` installs, configures, and diagnoses both agents. Use `powercontext config agent codex dsh` to update installed connections without reinstalling or enabling them; consult each Agent guide for native requirements.
 
+## Automatic prompt privacy
+
+The following prompt adapters enable capture by default. Existing capture preferences remain effective
+when updating a plugin; this policy adds credential checks without changing capture defaults.
+
+| Host | Automatic input boundary | Disable capture |
+| --- | --- | --- |
+| Claude Code | `UserPromptSubmit` text | `POWERCONTEXT_CLAUDE_CAPTURE_PROMPTS=false` or setup `--no-capture-prompts` |
+| Codex | `UserPromptSubmit` text | `POWERCONTEXT_CODEX_CAPTURE_PROMPTS=false` |
+| WorkBuddy | Submitted joined prompt text | `POWERCONTEXT_WORKBUDDY_CAPTURE_PROMPTS=false` |
+| OpenCode | User text parts, excluding synthetic parts | `POWERCONTEXT_OPENCODE_CAPTURE_PROMPTS=false` |
+| Pi | `before_agent_start` prompt | `POWERCONTEXT_PI_CAPTURE_PROMPTS=false` |
+| ZCode | `UserPromptSubmit` text | `POWERCONTEXT_ZCODE_CAPTURE_PROMPTS=false` |
+| Kimi Code (experimental) | Text parts of `UserPromptSubmit` | setup `--no-capture-prompts` |
+
+Before automatic capture, these adapters recognize conventional credential assignments (API/access keys
+and tokens, client/private keys, secrets, passwords, passphrases, authorization and cookies), Bearer values
+of at least eight token characters, common provider/GitHub/Slack token shapes, private-key blocks including
+unfinished blocks, and exact occurrences of the configured Server credential. Recognition is best effort:
+unknown formats, obfuscation and credentials without recognizable markers can pass. Conservative matching
+also skips examples such as `password=example`. Ordinary words such as “token budgets” are not assignments.
+The shared synthetic corpus is `tests/fixtures/automatic_prompt_privacy.json`; it defines tested examples,
+not proof that arbitrary credentials are detected.
+
+Authorization, Proxy-Authorization, Cookie and Set-Cookie assignments consume the complete header value,
+including schemes, cookie attributes and folded continuation lines, before ordinary assignments are matched.
+This conservatively removes any other prose on the same header line from the automatic query.
+
+A recognized input is skipped as a whole for capture. The adapter never redacts a Source body and then
+attaches the original event's identity or receipt to it. Accepted events keep their existing host text
+normalization and identity semantics; distinct events and retries follow the host's documented contract.
+Local diagnostics or configured observations report a bounded skip reason (`sensitive_content`, or
+Kimi's `sensitive`) without the rejected text. Pi reports this through its configured diagnostic sink;
+`off` disables that output.
+
+Automatic read-only preparation remains independent: recognized fragments are replaced with `[REDACTED]`
+before building the bounded query, even when capture is disabled. Preparation may therefore lose some
+query specificity; a valid historical response can still be delivered. This changes only the automatic
+query, not stored Source evidence or an explicit tool call. Authentication headers still carry the
+configured credential to the selected Server as required by that connection.
+
+If prompts must not leave the host, disable automatic capture **and** the host's automatic preparation
+hook/extension. Disabling capture alone still allows read-only requests, and detection is not a
+confidentiality guarantee. Keep secrets out of prompts, configure trusted endpoints and review operational
+access. This policy does not scan stored Sources, rewrite immutable revisions, prevent prompt injection,
+or classify all explicit Source writes at the Server.
+
 ## Python Agent frameworks
 
 All 3 adapters are `community`. Install them in the application environment; do not use

docs/en/docs/integrations/kimi-code.md

@@ -124,3 +124,7 @@ uv run pytest tests/test_cli_kimi_code.py
 Set KIMI_CLI_BIN to the installed real binary or built main.mjs, then run uv run pytest tests/e2e/test_kimi_code_host.py. This opt-in test uses disposable Kimi homes, workspaces, Server database and local inference; it needs no live model key and does not modify the user's Kimi profile. An unset variable skips host acceptance and is not a passing qualification.
 
 The [Kimi Code acceptance workflow](https://github.com/oceanbase/powercontext/actions/workflows/kimi-code-acceptance.yml) pins Kimi 2.1.1 and Node 24.21.0 and runs Hook tests plus real-host acceptance on Linux and Windows for pull requests and master updates. Both inference services are controlled; no live provider key is required. A skipped host test fails CI. Artifacts contain CLI provenance, JUnit results and acceptance summaries, excluding Kimi profiles and databases.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/en/docs/integrations/opencode.md

@@ -83,3 +83,7 @@ powercontext doctor opencode
 
 The integration-specific doctor checks the OpenCode version, resolved plugin configuration, and the owned Skill.
 An unavailable Server does not block OpenCode and is checked separately by the default doctor command.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/en/docs/integrations/pi.md

@@ -149,3 +149,7 @@ changing these variables.
 
 Failure diagnostics are silent by default because Pi's TUI renders on stdout with cursor positioning, so
 anything written to stderr lands inside the input bar; set `POWERCONTEXT_PI_DIAGNOSTICS` to see them.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/en/docs/integrations/workbuddy.md

@@ -311,3 +311,7 @@ message. Verify the whole installation with `powercontext doctor`.
 3. Remove the hook files and the scope resolver from `<WORKBUDDY_HOOKS_DIR>`.
 4. Remove `~/.workbuddy/skills/powercontext-project-context`.
 5. Optionally stop the Server and delete its local data directory.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/en/docs/integrations/zcode.md

@@ -463,3 +463,7 @@ Server URL was saved; it cannot change the MCP endpoint in a normal installation
 Remove only the PowerContext path from `plugins.dirs` in `~/.zcode/cli/config.json`. Delete
 `~/.zcode/cli/plugins/powercontext` only after confirming it contains `.powercontext-owned`. Fully quit and reopen
 ZCode. Uninstalling the plugin does not remove Server data or ZCode model configuration.
+
+## Automatic input privacy
+
+See [Automatic prompt privacy](index.md#automatic-prompt-privacy) for this host's capture default, disable control, credential recognition limits and independent read-only query handling. Recognized inputs are skipped for capture; accepted Source content and event identity are not rewritten.

docs/zh/docs/integrations/claude-code.md

@@ -254,3 +254,7 @@ Authorization 只能来自环境变量，不能加入 Server URL 或插件选项
 
 `UserPromptSubmit` Hook 的外层超时为十秒。召回与采集共用一个 wall-clock 时间预算，但会独立降级。
 显式允许 HTTP 不会关闭 HTTPS 证书校验。修改环境变量后需要重启 Claude Code。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。

docs/zh/docs/integrations/codex.md

@@ -322,3 +322,7 @@ Hook 默认允许环回 HTTP，远程 HTTP 需要显式同意，HTTPS 证书校
 Codex Hook 外层超时为十秒。Server 不可用或拒绝鉴权时，恢复、采集和 flush 独立降级，不会阻塞 Codex。未显式指定
 Scope 时，插件依次解析 Session binding、workspace binding 和 Server 默认 Scope。进程级配置必须存在于启动
 Codex 的环境中；Windows setup 会把鉴权写入用户环境，但 Desktop 仍需重启才能继承。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。

docs/zh/docs/integrations/index.md

@@ -42,6 +42,42 @@ powercontext setup
 
 使用与 Server 相同的 ref。`powercontext setup codex dsh` 会安装、配置并诊断两个 Agent。更新已安装连接时使用 `powercontext config agent codex dsh`，不会重新安装或启用插件；原生要求见各 Agent 文档。
 
+## 自动 prompt 隐私策略
+
+以下 prompt 适配器默认开启捕获。更新插件时保留已有捕获偏好；本策略增加凭据检查，不改变捕获默认值。
+
+| 宿主 | 自动输入边界 | 关闭捕获 |
+| --- | --- | --- |
+| Claude Code | `UserPromptSubmit` 文本 | `POWERCONTEXT_CLAUDE_CAPTURE_PROMPTS=false` 或 setup `--no-capture-prompts` |
+| Codex | `UserPromptSubmit` 文本 | `POWERCONTEXT_CODEX_CAPTURE_PROMPTS=false` |
+| WorkBuddy | 宿主提交的拼接 prompt 文本 | `POWERCONTEXT_WORKBUDDY_CAPTURE_PROMPTS=false` |
+| OpenCode | 用户文本部分，排除 synthetic 部分 | `POWERCONTEXT_OPENCODE_CAPTURE_PROMPTS=false` |
+| Pi | `before_agent_start` prompt | `POWERCONTEXT_PI_CAPTURE_PROMPTS=false` |
+| ZCode | `UserPromptSubmit` 文本 | `POWERCONTEXT_ZCODE_CAPTURE_PROMPTS=false` |
+| Kimi Code（实验性） | `UserPromptSubmit` 中的文本部分 | setup `--no-capture-prompts` |
+
+自动捕获前，适配器识别常见凭据赋值（API/access key 和 token、client/private key、secret、password、
+passphrase、authorization、cookie）、至少八个 token 字符的 Bearer 值、常见服务商/GitHub/Slack token
+形状、包含未闭合情况的私钥块，以及当前 Server 凭据在输入中的精确出现。这是尽力识别：未知格式、混淆或
+没有可识别标记的秘密仍可能通过。保守匹配也会跳过 `password=example` 之类示例；“token budgets”这样的
+普通词语不属于赋值。共享合成用例位于 `tests/fixtures/automatic_prompt_privacy.json`，它定义已测试示例，
+不能证明任意凭据都能被识别。
+
+Authorization、Proxy-Authorization、Cookie 和 Set-Cookie 赋值会先匹配完整的 header 值，包含鉴权方案、
+Cookie 属性和折行续接内容，再匹配普通赋值。这种保守处理也会从自动查询中移除同一 header 行的其他说明文字。
+
+识别到凭据时整条跳过捕获，不会修改 Source 正文后继续沿用原事件身份或回执。接受的事件保留既有宿主文本
+规范化和身份语义，不同事件与重试继续遵守各自宿主契约。本地诊断或已配置的观测只报告有界原因
+`sensitive_content`（Kimi 为 `sensitive`），不包含拒绝的文本。Pi 通过配置的诊断输出报告，`off` 表示关闭输出。
+
+自动只读准备与捕获独立：构建有界查询前，识别到的片段会替换为 `[REDACTED]`，关闭捕获时也如此。查询可能
+因此降低针对性，但仍可返回并交付有效历史上下文。变化仅作用于自动查询，不改写存储证据或显式工具调用。
+鉴权请求头仍按连接要求，将配置的凭据发送给所选 Server。
+
+如果 prompt 不允许离开宿主，需要同时关闭自动捕获和宿主的自动准备 hook/extension。仅关闭捕获仍允许只读
+请求，检测器也不是保密保证。不要在 prompt 中放秘密，应配置可信端点并审查运维访问权限。本策略不扫描
+存量 Source、不改写不可变 revision、不防御 prompt injection，也不在 Server 上对全部显式 Source 写入分类。
+
 ## Python Agent 框架
 
 这 3 个适配器均为 `community`，安装到应用环境中，不使用 `powercontext setup <host>`：

docs/zh/docs/integrations/kimi-code.md

@@ -124,3 +124,7 @@ uv run pytest tests/test_cli_kimi_code.py
 设置 KIMI_CLI_BIN 指向真实二进制或构建后的 main.mjs，再运行 uv run pytest tests/e2e/test_kimi_code_host.py。该 opt-in 验收使用隔离 Kimi home、workspace、Server 数据库与本地推理，不需要线上模型 key，也不修改用户宿主配置。未设置变量时跳过宿主验收，跳过不代表通过。
 
 [Kimi Code acceptance 工作流](https://github.com/oceanbase/powercontext/actions/workflows/kimi-code-acceptance.yml) 固定 Kimi 2.1.1 和 Node 24.21.0，在 PR 和 master 更新时于 Linux、Windows 执行 Hook 测试与真实宿主验收。两处推理服务均受控，不需要线上模型 Key；宿主测试被跳过时 CI 失败。产物仅保留 CLI 版本来源、JUnit 结果和验收摘要，不上传 Kimi profile 或数据库。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。

docs/zh/docs/integrations/opencode.md

@@ -78,3 +78,7 @@ powercontext doctor opencode
 
 集成专用 doctor 会检查 OpenCode 版本、解析后的插件配置和 PowerContext 所有的 Skill。Server 状态由默认
 doctor 单独检查；Server 不可用不会阻止 OpenCode 正常工作。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。

docs/zh/docs/integrations/pi.md

@@ -145,3 +145,7 @@ Pi 会拒绝包含凭据、query 或 fragment 的 base URL。召回、采集和
 
 失败诊断默认不输出：Pi 的 TUI 通过光标定位在 stdout 上渲染，写到 stderr 的内容会落在输入栏里；需要查看时请设置
 `POWERCONTEXT_PI_DIAGNOSTICS`。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。

docs/zh/docs/integrations/workbuddy.md

@@ -273,3 +273,7 @@ query、scope、prepared content、citation、response body 或 authorization va
 3. 从 `<WORKBUDDY_HOOKS_DIR>` 删除 hook 文件和 scope resolver。
 4. 删除 `~/.workbuddy/skills/powercontext-project-context`。
 5. 可选：停止 Server 并删除其本地数据目录。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。

docs/zh/docs/integrations/zcode.md

@@ -409,3 +409,7 @@ Server URL 时作为 Hook 的回退值，不能用于修改正常安装的 MCP 
 从 `~/.zcode/cli/config.json` 的 `plugins.dirs` 中只移除 PowerContext 路径；确认
 `~/.zcode/cli/plugins/powercontext` 中存在 `.powercontext-owned` 后，再删除该受管理目录。
 最后完全退出并重启 ZCode。卸载插件不会删除 Server 数据或 ZCode 模型配置。
+
+## 自动输入隐私
+
+本宿主的捕获默认值、关闭方式、凭据识别局限及独立只读查询行为见[自动 prompt 隐私策略](index.md#自动-prompt-隐私策略)。识别到凭据的输入会跳过捕获，已接受的 Source 正文和事件身份不被改写。