Hardens bash rewriting, file watching, and logging so shell commands start with a cleaner environment, the watcher stays responsive under event bursts, wide characters render correctly in terminal sessions, and logs redact secrets more reliably.
Performance
Parses each rewritten command once and shares the result across all built-in rewrite rules.
Bounds permission-arity lookup to two-word table keys instead of scanning the full argument list.
Captures open descriptors in the parent and marks only them CLOEXEC (close_range on Linux), so cleanup no longer sweeps unused numbers or depends on the hard descriptor limit.
Clones the gitignore snapshot before watcher path filtering so filesystem work never holds the rebuild writer lock.
Correctness
PTY rendering now skips continuation columns of wide glyphs instead of inserting stray spaces.
GitHub token redaction only scans text containing actual token prefixes (ghp_, gho_, etc.).
Terminal-sync log lines are redacted before writing to both the file and stderr.
Windows directory-change notifications are decoded from byte slices and use DWORD-aligned buffers, avoiding unaligned struct reads.
Confidence Score: 5/5
The PR appears safe to merge; no new blocking issue was established.
Summary
This PR reduces repeated shell parsing, fixes wide-character output, improves log redaction, and updates file watching.
The follow-up changes focus on inherited file descriptors:
Permission prefixes find command keys without scanning every argument.
Built-in shell rewrite rules share one parse of each command.
Child processes mark open descriptors close-on-exec without scanning every descriptor number.
Watcher path checks use a gitignore snapshot without holding its lock.
Windows file events use aligned buffers and decode notification bytes safely.
PTY output renders wide characters without extra spaces.
Terminal-sync logs redact secrets before writing to either output.
Session-tagged log messages are formatted directly into the output.
Watcher documentation and release metadata describe the change and its path-watch contract.
No new actionable issues were established. Both earlier threads were unnumbered and are resolved. The current code addresses their reported causes: fixed descriptor 70_000 is gone, and the fallback no longer scans up to the hard limit.
