plugins/ops-guards/hooks/lib/redact.mjs

Functions

Imports

It imports no other module of this repo. Imported by plugins/ops-guards/hooks/register.js.

Source

1// Secret redaction for tool output (job_1e4b82452fe0, mod 2).
2//
3// Pure functions, no imports: a hooks module may import only its own files, and the
4// tests run them under plain `node --test`.
5//
6// Key shapes are read from the code that makes them, not guessed:
7//   capsid src/improve-run.ts        operator key  capsid_ + 64 hex  (32 random bytes)
8//   capsid src/agents-schema.ts      agent key     capsid_agent_ + 64 hex
9// The `ro:` prefix in OPERATOR_KEY_HASH is on the stored hash entry, never on a key.
10// Vendor shapes are from their docs (2026-10-08): GitHub token prefixes ghp_, gho_, ghu_,
11// ghs_, ghr_ and github_pat_ (about-authentication-to-github); Cloudflare's scannable
12// prefix cfut_ (create-token). Neither vendor documents a length or character set, so
13// those patterns take a prefix plus a generous run of token characters. A legacy
14// Cloudflare token has no prefix, so it is caught only when assigned to a named variable.
15
16const TOKEN_CHARS = '[A-Za-z0-9_\\-]';
17
18/** [kind, regex, replacement]. A function replacement keeps the label in front of a value. */
19export const PATTERNS = [
20  ['private-key', /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g],
21  ['capsid-key', /capsid_(?:agent_)?[0-9a-f]{32,}/gi],
22  ['cloudflare-token', new RegExp(`cfut_${TOKEN_CHARS}{20,}`, 'g')],
23  ['github-token', new RegExp(`(?:gh[pousr]_|github_pat_)${TOKEN_CHARS}{20,}`, 'g')],
24  ['anthropic-key', new RegExp(`sk-ant-${TOKEN_CHARS}{20,}`, 'g')],
25  [
26    'named-secret',
27    /\b((?:CLOUDFLARE_API_TOKEN|CLOUDFLARE_API_KEY|CF_API_TOKEN|CF_API_KEY|OPERATOR_KEY|CAPSID_OPERATOR_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN|GH_TOKEN)\s*[=:]\s*["']?)[^\s"']{12,}/g,
28    (_m, label) => `${label}[REDACTED:named-secret]`,
29  ],
30  [
31    'bearer',
32    /\b(Bearer\s+)[A-Za-z0-9._~+/=\-]{20,}/g,
33    (_m, label) => `${label}[REDACTED:bearer]`,
34  ],
35];
36
37/** Replace every secret in a string. */
38export function redactText(text) {
39  let out = text;
40  for (const [kind, re, replace] of PATTERNS) {
41    out = out.replace(re, replace ?? `[REDACTED:${kind}]`);
42  }
43  return out;
44}
45
46/**
47 * Redact every string inside a tool result of any shape, returning a copy. The shape of a
48 * Read or Bash result is not fixed by the docs I could read, so this walks all of it
49 * rather than naming fields. Non-strings pass through; cycles are cut.
50 */
51export function redactResult(value, seen = new WeakSet()) {
52  if (typeof value === 'string') return redactText(value);
53  if (value === null || typeof value !== 'object') return value;
54  if (seen.has(value)) return value;
55  seen.add(value);
56  if (Array.isArray(value)) return value.map((v) => redactResult(v, seen));
57  const out = {};
58  for (const [k, v] of Object.entries(value)) out[k] = redactResult(v, seen);
59  return out;
60}
61
62// Files whose contents a session never needs: driver and seat keys, and the project MCP
63// config that carries a driver bearer token.
64const KEY_PATH = /(?:^|[\\/\s"'=])\.capsid[\\/][^\s"'\\/]*\.key\b/i;
65const MCP_JSON = /(?:^|[\\/\s"'=])\.mcp\.json\b/i;
66
67export function isSecretPath(path) {
68  return typeof path === 'string' && (KEY_PATH.test(path) || MCP_JSON.test(path));
69}
70
71// A command that only checks a key file exists (Test-Path, ls, stat) is allowed. One that
72// reads the contents is not.
73const READ_VERBS =
74  /(?:^|[\s;&|(`$])(?:cat|type|more|less|head|tail|sed|awk|grep|egrep|rg|findstr|xxd|od|base64|certutil|cp|copy|mv|move|scp|curl|Get-Content|gc|Select-String|sls|Copy-Item|cpi|Import-Clixml|ConvertFrom-Json|ReadAllText)\b|<\s*\S/i;
75
76export function readsSecretFile(command) {
77  if (typeof command !== 'string') return false;
78  return command
79    .split(/\r?\n|;|&&|\|\|/)
80    .some((segment) => isSecretPath(segment) && READ_VERBS.test(segment));
81}
82
83export const SECRET_READ_DENY =
84  'Key files and .mcp.json are never read into a session. Nothing a driver does needs their contents. ' +
85  'To check one exists use Test-Path or ls; to use a key, ask the user to run the command with the ! prefix so the key stays out of the transcript.';