Capture.sh defaults every verification screenshot to the user's Downloads root, contradicting the hook that forces raw captures to /tmp (follow-up to #1566)

[xmasyx]

Follow-up to #1530 and #1566. Both halves of #1566 shipped and work — the installer's name-anchored rules (interceptor-screenshot-*, interceptor-capture-*, plus interceptor-macos-screenshot-*, which is a good addition we hadn't proposed) keep captures out of a user's backup commit, and the ContextReduction rewrite is still there as defense in depth. This issue is about the half that was never in scope: not where captures must not go, but where they should go in the first place.

Upstream currently disagrees with itself

LifeOS/install/hooks/ContextReduction.hook.sh (~line 94) forces a raw interceptor screenshot --save into an ephemeral directory:

REWRITTEN="${ENV_PREFIX}mkdir -p /tmp/pai-screenshots && ( cd /tmp/pai-screenshots && $CMD_BODY )"

LifeOS/install/skills/Interceptor/Tools/Capture.sh (line 184) — the sanctioned wrapper the skill tells you to use instead of the raw command — sends every capture to the user's Downloads root:

OUT="${LIFEOS_DOWNLOADS_DIR:-${HOME}/Downloads}/interceptor-capture-${ts}-${rand}.png"

So the unsanctioned path is ephemeral and the sanctioned path is durable and user-facing. One of the two is wrong, and it is not the hook.

Why Downloads is the wrong default

A verification capture exists so the agent can look at a page and close a claim. Once viewed, it is dead weight. Sending that traffic to Downloads puts agent-internal artifacts in the one directory the human curates by hand, mixed in with files they actually downloaded. The observed outcome on an install doing routine web verification is a steady accumulation the user eventually deletes manually — which is the tell that the default was never serving them.

The gitignore rules from #1566 made these files safe. They did not make them wanted.

The distinction that fixes it

Captures fall into two classes, and which one applies is known at the moment the shot is taken:

• verification — the agent needs to see a page. Ephemeral, agent-owned, should never reach the user's filesystem.
• deliverable — the image is the product: it goes into a document for a client, the user asked to see it, or it is evidence they will reopen later. Durable, user-owned.

Because it is knowable at call time, this should be an explicit flag rather than a heuristic.

Proposed fix

In Capture.sh, default to the ephemeral directory the hook already designates, and add an opt-in for the durable case:

# arg parse
DELIVER=0
...
        --deliver)
            DELIVER=1
            shift
            ;;

# destination
if [ "$DELIVER" -eq 1 ]; then
    OUT="${LIFEOS_DOWNLOADS_DIR:-${HOME}/Downloads}/Interceptor/interceptor-capture-${ts}-${rand}.png"
else
    OUT="/tmp/pai-screenshots/interceptor-capture-${ts}-${rand}.png"
fi

Note the deliverable path is a subdirectory, not the Downloads root: a directory the tool owns can be reasoned about, and it keeps $LIFEOS_DOWNLOADS_DIR meaning "the downloads root" for every other consumer (the Art skill writes there too, and its output is meant to be seen — repointing that variable would bury it).

The --out PATH help text at line 45 still advertises ~/Downloads/interceptor-capture-*.png and needs updating with it.

Two consequences worth stating:

1. This makes the hook's rewrite redundant on the sanctioned path — it stays valuable for the raw command, but the wrapper stops fighting it.
2. Whatever housekeeping sweeps captures must not sweep the deliverable directory. We hit this immediately: an ephemeral-sweep root pointed at the deliverable folder will trash the one class of capture that is not disposable, on a timer, silently. The sweep belongs on the ephemeral directory only.

Verification

Implemented and measured on an install:

• default → /tmp/pai-screenshots/interceptor-capture-<ts>-<pid>.png; --deliver → <downloads>/Interceptor/interceptor-capture-<ts>-<pid>.png.
• Two-pole check on the sweeper: with both files backdated to the same mtime, a dry run lists the ephemeral capture and leaves the deliverable one untouched.
• bash -n clean.

Credit where it is due

The prompt for this was the install's human asking a question rather than filing a complaint: "what am I actually supposed to do with these screenshots?" The first response was to move them into a subfolder of Downloads, which answered the clutter and missed the point. The reframing — almost none of them are for the human at all — is what produced the fix. Worth recording because the tidier is the tempting build, and it is the wrong one.

[danielmiessler]

Fixed, with one deliberate change from what you proposed.

You're right that the sanctioned wrapper and the hook disagree: ContextReduction only rewrites the raw interceptor screenshot form, so calling Capture.sh — the path the skill tells you to use — never hit it, and every verification screenshot landed in the Downloads root.

We didn't take the /tmp default, though. A standing rule here sends review artifacts to ~/Downloads and never to /tmp, so the fix keeps Downloads and adds the subdirectory instead: captures now default to ~/Downloads/Interceptor/. Same complaint solved — the curated directory stops filling up — without crossing that rule. We also skipped the --deliver flag; one changed default was the whole fix.

Ships in the next release.

[xmasyx]

Thanks for taking this, and for saying explicitly which part you changed and why. The ~/Downloads-never-/tmp rule is yours to hold, and this isn't an argument against it.

One thing our issue got wrong, and it's ours: we defined the two classes and argued at length why Downloads is the wrong home for the verification class, but we never actually argued why Downloads is the right home for the deliverable class. We treated it as obvious. Reading the issue back, the section heading says "Why Downloads is the wrong default" without qualifying which default, so it reads as an argument against Downloads generally. That framing invited exactly the reading you gave it, and it made the two classes look like one.

Worth saying plainly: on the deliverable class we were never in disagreement. Our proposal already sent those to <downloads>/Interceptor/. The split was only ever about the other class.

The reason the split matters isn't tidiness, and it's the consequence we listed but didn't defend hard enough:

Whatever housekeeping sweeps captures must not sweep the deliverable directory.

With one class, that constraint can't be satisfied. Either housekeeping runs on Interceptor/ and eventually deletes a capture someone put in a client document, or housekeeping doesn't run and the directory grows without bound. The second is where the fix lands today: Interceptor/ is durable, nothing sweeps it, and an install doing routine web verification writes to it all day. The curated directory stops filling up, and a directory that no longer has an owner starts filling up in its place. That's the same accumulation one level down, minus the visibility that made anyone notice the first time.

There's also a smaller thing the new default surfaces. ContextReduction.hook.sh still rewrites the raw interceptor screenshot --save form into /tmp/pai-screenshots. So the two paths still disagree, just with the signs flipped: the sanctioned wrapper now writes durably to Downloads, and the raw command writes to the ephemeral directory your standing rule rules out. If the rule is that review artifacts never go to /tmp, the hook is the thing that crosses it.

A version that keeps your rule intact. The split doesn't need /tmp at all. It needs two directories with different lifetimes:

# verification (default) -> swept, tool-owned
OUT="${LIFEOS_DOWNLOADS_DIR:-${HOME}/Downloads}/Interceptor/scratch/interceptor-capture-${ts}-${rand}.png"

# --deliver -> durable, never swept
OUT="${LIFEOS_DOWNLOADS_DIR:-${HOME}/Downloads}/Interceptor/interceptor-capture-${ts}-${rand}.png"

Nothing reaches /tmp, nothing reaches the Downloads root, housekeeping gets a directory it can safely own, and --deliver keeps its meaning: the human asked for this one. If the flag itself is the part you'd rather not carry, the sweep alone still fixes the unbounded case, as long as it points at a directory that only ever receives disposable captures.

Either way, thanks for the quick turnaround, and for engaging with the reasoning rather than just the patch.