Caveats

What redaction can and cannot do

An agent that sets out to see a secret can see it. run hands the secret to a process, and a process can do what it likes with what it holds: encode it, split it, write it somewhere and read it back. Redaction catches the secret written out as it is, which is what a reflex produces, and nothing here claims more than that.

That is enough, because the reflex is the whole problem. An agent does not read .env out of curiosity. It reads it because a variable was empty, the task was stuck, and cat .env was the shortest path back to the task. Take the shortest path away and give it a shorter one, and the urge goes with it: run puts the secret where the task needs it, a missing key comes back as a message that says what to ask for, preview and doctor --short answer "is it there" without reading anything. The agent gets on with the task. What remains after that is intent, and intent is a question for whoever runs the agent.

The same holds for people. A secret shared with a teammate stops being a paste into a chat and becomes pack and unpack, sealed in transit and landing in that person's vault. And a project's bookkeeping collapses into one file. A .env nobody commits, a .env.example that drifts from it, a .gitignore line keeping the two apart: all of it becomes one committed .monkeys that says what is needed and holds nothing.