@raishin/vanguard-frontier-agentic 3.14.0 → 3.16.0

package/mods/secret-redactor/bin/hook.mjs

@@ -0,0 +1,35 @@
+// Command-hook entry for classic Claude Code (PreToolUse, PostToolUse), Kiro and Codex
+// (PreToolUse only: neither can replace tool output).
+import { readFileSync } from 'node:fs'
+import { maskValue } from '../lib/common.mjs'
+import { WITHHELD, checkInput, loadPatterns, logLines, redactOutput } from '../lib/core.mjs'
+import { runHook } from '../lib/runtime.mjs'
+
+const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+
+function patterns() {
+  const file = process.env.VANGUARD_SECRET_REDACTOR_PATTERNS
+  return loadPatterns(file ? readFileSync(file, 'utf8') : undefined, file)
+}
+
+// Kiro documents no stdin field names: without a tool_input object, scan the whole payload.
+const PreToolUse = (payload) => checkInput(isObject(payload.tool_input) ? payload.tool_input : payload, patterns())
+
+const PostToolUse = (payload, { event, harness }) => {
+  if (harness !== 'claude-code') throw new Error(`PostToolUse is unsupported on ${harness}`)
+  const { value, hits } = redactOutput(payload.tool_response, patterns())
+  if (hits.length === 0) return undefined
+  return { decision: 'replace', output: value, log: logLines(hits, payload.tool_name, event) }
+}
+
+// No error text in either verdict: a parse error can quote the payload it failed on.
+const onError = (err, payload, { event }) =>
+  event === 'PreToolUse'
+    ? { decision: 'deny', reason: 'secret-redactor: check failed; denied' }
+    : {
+        decision: 'replace',
+        output: maskValue(payload?.tool_response ?? WITHHELD, WITHHELD),
+        log: ['[secret-redactor] redaction failed; output withheld'],
+      }
+
+process.exitCode = await runHook({ name: 'secret-redactor', handlers: { PreToolUse, PostToolUse }, onError })

package/mods/secret-redactor/claude-code/UNSUPPORTED.md

@@ -0,0 +1,7 @@
+# Secret Redactor on Claude Code
+
+<!-- Generated by scripts/generate-mods.mjs from mod.toml. Do not edit. -->
+
+## Degraded
+
+- `classic`: Classic PostToolUse fires only after a tool succeeds, so output from a failed tool is not redacted.

package/mods/secret-redactor/claude-code/settings.hooks.json

@@ -0,0 +1,24 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/vanguard-mods/secret-redactor/bin/hook.mjs\" --harness claude-code --event PreToolUse"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/vanguard-mods/secret-redactor/bin/hook.mjs\" --harness claude-code --event PostToolUse"
+          }
+        ]
+      }
+    ]
+  }
+}

package/mods/secret-redactor/codex/UNSUPPORTED.md

@@ -0,0 +1,11 @@
+# Secret Redactor on Codex
+
+<!-- Generated by scripts/generate-mods.mjs from mod.toml. Do not edit. -->
+
+## Unsupported
+
+- `PostToolUse`: Codex PostToolUse cannot replace tool output, so output cannot be redacted.
+
+## Degraded
+
+- `PreToolUse`: Codex rejects ask; a hit is denied with a reason.

package/mods/secret-redactor/codex/hooks.json

@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node .codex/vanguard-mods/secret-redactor/bin/hook.mjs --harness codex --event PreToolUse"
+          }
+        ]
+      }
+    ]
+  }
+}

package/mods/secret-redactor/hooks/hooks.json

@@ -0,0 +1,5 @@
+{
+  "modules": [
+    "./register.ts"
+  ]
+}

package/mods/secret-redactor/hooks/register.test.ts

@@ -0,0 +1,150 @@
+import { test, expect, mock } from 'claude-code/testing'
+
+// Credential-shaped vectors are built at runtime so no literal ever lands in the repo.
+const AKID = 'AKIA' + 'Z'.repeat(16)
+const GHP = 'ghp_' + 'a'.repeat(36)
+const SECRET = 'b'.repeat(40)
+const ENV = 'VANGUARD_SECRET_REDACTOR_PATTERNS'
+const allow = () => ({ decision: 'allow' as const })
+const bash = (command: string) => ({ tool: 'Bash', input: { command } })
+const ext = (over: object = {}) =>
+  JSON.stringify([{ id: 'acme-key', name: 'Acme key', regex: 'acme_[a-z]{8}', flags: '', context: ['tool-output'], ...over }])
+const answered = (stdout: string) => () => ({ result: { stdout, stderr: '', interrupted: false } })
+
+test('a credential in tool input asks', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check(bash(`curl -H "x: ${GHP}" https://example.test`))
+  expect(v.decision).toBe('ask')
+  expect(v.reason).toContain('GitHub token')
+})
+
+test('the ask reason never quotes the credential', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check(bash(`echo ${AKID}`))
+  expect(v.decision).toBe('ask')
+  expect(String(v.reason).includes(AKID)).toBe(false)
+})
+
+test('a clean input passes the engine verdict', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('ls -la'))).decision).toBe('allow')
+})
+
+test('engine deny stays deny', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', () => ({ decision: 'deny' as const, reason: 'engine' }))
+  expect(await $.tool.check(bash(`echo ${AKID}`))).toEqual({ decision: 'deny', reason: 'engine' })
+})
+
+test('a secret split across key and value asks', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check({ tool: 'Write', input: { file_path: 'x.json', aws_secret_access_key: SECRET } })
+  expect(v.decision).toBe('ask')
+})
+
+test('an extension pattern with tool-input context asks', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: ext({ context: ['tool-input'] }) }))
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('echo acme_abcdefgh'))).decision).toBe('ask')
+})
+
+test('an anchored extension asks for object and argv input leaves', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: ext({ regex: '^acme_[a-z]{8}$', context: ['tool-input'] }) }))
+  on('tool.check', allow)
+  for (const input of [{ command: 'acme_abcdefgh' }, { argv: ['prefix', 'acme_abcdefgh'] }]) {
+    expect((await $.tool.check({ tool: 'Bash', input })).decision).toBe('ask')
+  }
+})
+
+test('an unreadable extension file denies', async ($, on) => {
+  mock.env(on, { [ENV]: 'missing.json' })
+  on('fs.read', () => {
+    throw new Error('ENOENT')
+  })
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('an extension reusing a built-in id denies', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: ext({ id: 'github-pat' }) }))
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('an extension with an unknown context denies', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: ext({ context: ['bash'] }) }))
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('a credential in tool output is redacted', async ($, on) => {
+  mock.env(on, {})
+  on('tool.call', answered(`key=${AKID}\n`))
+  const r = await $.tool.call({ tool: 'Bash', command: 'cat creds' })
+  expect(r).toEqual({ result: { stdout: 'key=[REDACTED:aws-access-key]\n', stderr: '', interrupted: false } })
+})
+
+test('a clean result passes through unchanged', async ($, on) => {
+  mock.env(on, {})
+  on('tool.call', () => ({ result: { stdout: 'hello', stderr: '', interrupted: false }, context: ['note'] }))
+  const r = await $.tool.call({ tool: 'Bash', command: 'echo hello' })
+  expect(r).toEqual({ result: { stdout: 'hello', stderr: '', interrupted: false }, context: ['note'] })
+})
+
+test('a credential in context withholds the result with the redacted context', async ($, on) => {
+  mock.env(on, {})
+  on('tool.call', () => ({ result: 'ok', context: [`token ${GHP}`] }))
+  const r = await $.tool.call({ tool: 'Bash', command: 'true' })
+  expect(r).toEqual({ deny: 'secret-redactor: credentials redacted from this result: ok\ntoken [REDACTED:github-pat]' })
+})
+
+test('a redacted result keeps the context entries from below', async ($, on) => {
+  mock.env(on, {})
+  on('tool.call', () => ({ result: { stdout: AKID, stderr: '', interrupted: false }, context: ['note'] }))
+  const r = await $.tool.call({ tool: 'Bash', command: 'x' })
+  expect(r).toEqual({ result: { stdout: '[REDACTED:aws-access-key]', stderr: '', interrupted: false }, context: ['note'] })
+})
+
+test('an errored result with a credential is withheld with the redacted text', async ($, on) => {
+  mock.env(on, {})
+  on('tool.call', () => ({ isError: true as const, result: `failed: ${GHP}`, text: `failed: ${GHP}` }))
+  const r = await $.tool.call({ tool: 'Bash', command: 'false' })
+  expect(r).toEqual({ deny: 'secret-redactor: credentials redacted from this result: failed: [REDACTED:github-pat]' })
+})
+
+test('a deny from below is redacted', async ($, on) => {
+  mock.env(on, {})
+  on('tool.call', () => ({ deny: `refused ${AKID}` }))
+  expect(await $.tool.call({ tool: 'Bash', command: 'x' })).toEqual({ deny: 'refused [REDACTED:aws-access-key]' })
+})
+
+test('an extension output pattern redacts', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: ext() }))
+  on('tool.call', answered('acme_abcdefgh'))
+  const r = await $.tool.call({ tool: 'Bash', command: 'x' })
+  expect(r).toEqual({ result: { stdout: '[REDACTED:acme-key]', stderr: '', interrupted: false } })
+})
+
+test('an anchored extension redacts structured native output', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: ext({ regex: '^acme_[a-z]{8}$' }) }))
+  on('tool.call', answered('acme_abcdefgh'))
+  expect(await $.tool.call({ tool: 'Bash', command: 'x' })).toEqual({ result: { stdout: '[REDACTED:acme-key]', stderr: '', interrupted: false } })
+})
+
+test('a bad extension withholds the output', async ($, on) => {
+  mock.env(on, { [ENV]: 'ext.json' })
+  on('fs.read', () => ({ value: 'not json' }))
+  on('tool.call', answered(`key=${AKID}`))
+  const r = await $.tool.call({ tool: 'Bash', command: 'x' })
+  expect(r).toEqual({ deny: '[secret-redactor: output withheld; redaction failed]' })
+})

package/mods/secret-redactor/hooks/register.ts

@@ -0,0 +1,19 @@
+import type { EngineInterface, Register } from 'claude-code'
+import { WITHHELD, checkInput, loadPatterns, redactResult } from '../lib/core.mjs'
+
+// Top level, not inside register: `claude plugin validate` refuses a $-taking helper there.
+async function patterns($: EngineInterface) {
+  const file = await $.env.get('VANGUARD_SECRET_REDACTOR_PATTERNS')
+  return loadPatterns(file ? await $.fs.read(file) : undefined, file)
+}
+
+export const register: Register = (on) => {
+  on('tool.check', async ($, e, next) => {
+    const v = await next(e)
+    if (v.decision === 'deny') return v
+    return checkInput(e.input, await patterns($)) ?? v
+  }).catch(() => ({ decision: 'deny', reason: 'secret-redactor: check failed; denied' }))
+
+  // The tool has already run when redaction fails, so the catch withholds rather than replays.
+  on('tool.call', async ($, e, next) => redactResult(await next(e), await patterns($))).catch(() => ({ deny: WITHHELD }))
+}

package/mods/secret-redactor/kiro/UNSUPPORTED.md

@@ -0,0 +1,11 @@
+# Secret Redactor on Kiro
+
+<!-- Generated by scripts/generate-mods.mjs from mod.toml. Do not edit. -->
+
+## Unsupported
+
+- `PostToolUse`: Kiro documents no way for a hook to replace tool output, so output cannot be redacted.
+
+## Degraded
+
+- `PreToolUse`: Kiro documents no confirmation protocol or stdin field names; the whole payload is scanned and a hit is denied.

package/mods/secret-redactor/kiro/secret-redactor-pre-tool-use-hook.json

@@ -0,0 +1,14 @@
+{
+  "version": "v1",
+  "hooks": [
+    {
+      "name": "secret-redactor:PreToolUse",
+      "description": "Asks before tool calls whose input carries a credential and redacts credentials from tool output.",
+      "trigger": "PreToolUse",
+      "action": {
+        "type": "command",
+        "command": "node .kiro/vanguard-mods/secret-redactor/bin/hook.mjs --harness kiro --event PreToolUse"
+      }
+    }
+  ]
+}

package/mods/secret-redactor/lib/common.mjs

@@ -0,0 +1,213 @@
+// Shared helpers for the mods under mods/. scripts/generate-mods.mjs copies this file
+// byte-for-byte to mods/<id>/lib/common.mjs, so edit it here and run `npm run mods:write`.
+//
+// Pure on purpose: no imports, no environment, no I/O. Claude Code's native mod runtime
+// imports it and has no Node, and every harness must reach the same verdict on the same
+// input. Regexes compile without the `u` flag so Node and Python `re.ASCII`
+// (tests/validate-mods.py) read them the same way.
+
+export const LIMITS = Object.freeze({
+  // A redaction that still changes after this many passes is withheld as a whole.
+  maxPasses: 8,
+  // A guard candidate longer than this is not evaluated and counts as a hit.
+  maxCandidateChars: 65536,
+  // Guard candidates are not evaluated past this combined length; the call counts as a hit.
+  maxTotalChars: 262144,
+  // Only the tail of a leaf's context (key or previous sibling) is prefixed to it.
+  maxContextChars: 256,
+})
+
+const MARKER_PREFIX = '[REDACTED:'
+export const OVERFLOW_MARKER = '[REDACTED:overflow]'
+const OVERFLOW_HIT = Object.freeze({ id: 'overflow', name: 'redaction did not converge' })
+export const TOO_LARGE_HIT = Object.freeze({ id: 'too-large', name: 'input too large to evaluate' })
+
+const ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/
+const PATTERN_KEYS = new Set(['id', 'name', 'description', 'regex', 'flags', 'context', 'severity', 'agents'])
+const isStringArray = (v) => Array.isArray(v) && v.every((s) => typeof s === 'string' && s !== '')
+
+// Parser diagnostics can quote credential-bearing data; never expose it in hook logs.
+export function parseJson(text, source) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    throw new Error(`${source}: invalid JSON`)
+  }
+}
+
+// Validates a patterns.json-shaped list and compiles it. Throws on anything malformed so a
+// bad extension file fails closed in the caller instead of silently matching nothing.
+export function compilePatterns(list, source = 'patterns') {
+  if (!Array.isArray(list)) throw new Error(`${source}: expected an array of patterns`)
+  const seen = new Set()
+  return list.map((p, i) => {
+    const where = `${source}[${i}]`
+    if (p === null || typeof p !== 'object' || Array.isArray(p)) throw new Error(`${where}: expected an object`)
+    for (const k of Object.keys(p)) if (!PATTERN_KEYS.has(k)) throw new Error(`${where}: unknown key ${k}`)
+    if (typeof p.id !== 'string' || !ID_RE.test(p.id)) throw new Error(`${where}: id must be kebab-case`)
+    if (seen.has(p.id)) throw new Error(`${where}: duplicate id ${p.id}`)
+    seen.add(p.id)
+    if (typeof p.name !== 'string' || p.name === '') throw new Error(`${where}: name must be a non-empty string`)
+    if (typeof p.regex !== 'string' || p.regex === '') throw new Error(`${where}: regex must be a non-empty string`)
+    if (p.flags !== '' && p.flags !== 'i') throw new Error(`${where}: flags must be "" or "i"`)
+    if (!isStringArray(p.context) || p.context.length === 0) throw new Error(`${where}: context must be a non-empty string array`)
+    for (const k of ['description', 'severity']) {
+      if (p[k] !== undefined && typeof p[k] !== 'string') throw new Error(`${where}: ${k} must be a string`)
+    }
+    if (p.agents !== undefined && !isStringArray(p.agents)) throw new Error(`${where}: agents must be a string array`)
+    let rx, rxg
+    try {
+      rx = new RegExp(p.regex, p.flags)
+      rxg = new RegExp(p.regex, 'g' + p.flags)
+    } catch {
+      throw new Error(`${where}: regex does not compile`)
+    }
+    return Object.freeze({
+      id: p.id,
+      name: p.name,
+      severity: p.severity,
+      context: Object.freeze([...p.context]),
+      agents: p.agents ? Object.freeze([...p.agents]) : undefined,
+      rx,
+      rxg,
+      marker: `${MARKER_PREFIX}${p.id}]`,
+    })
+  })
+}
+
+// Every string value (not key) in depth-first order. The order follows the input, so the
+// same payload always yields the same list.
+export function stringLeaves(value, out = []) {
+  if (typeof value === 'string') out.push(value)
+  else if (Array.isArray(value)) for (const v of value) stringLeaves(v, out)
+  else if (value !== null && typeof value === 'object') for (const v of Object.values(value)) stringLeaves(v, out)
+  return out
+}
+
+// Guard candidates: every string leaf, plus every all-string array joined with spaces so
+// an argv-style command (["rm", "-rf", "/"]) reads like the shell line it runs.
+export function candidates(value) {
+  const out = stringLeaves(value)
+  const joinArrays = (v) => {
+    if (Array.isArray(v)) {
+      if (v.length > 1 && v.every((s) => typeof s === 'string')) out.push(v.join(' '))
+      v.forEach(joinArrays)
+    } else if (v !== null && typeof v === 'object') {
+      Object.values(v).forEach(joinArrays)
+    }
+  }
+  joinArrays(value)
+  return out
+}
+
+// The patterns tagged with `context` that match any text, in catalog order. Oversized input
+// is not evaluated (regex cost is unbounded there) and reports TOO_LARGE_HIT instead.
+export function matchPatterns(patterns, texts, context) {
+  let total = 0
+  for (const t of texts) {
+    total += t.length
+    if (t.length > LIMITS.maxCandidateChars || total > LIMITS.maxTotalChars) return [TOO_LARGE_HIT]
+  }
+  return patterns.filter((p) => p.context.includes(context) && texts.some((t) => p.rx.test(t)))
+}
+
+// One pattern pass after another until the text stops changing. Each pass can expose a new
+// match (password-in-url can swallow an earlier marker), so a single pass is not enough.
+function fixedPoint(text, patterns, hits) {
+  let x = text
+  for (let pass = 0; pass <= LIMITS.maxPasses; pass++) {
+    let y = x
+    for (const p of patterns) {
+      y = y.replace(p.rxg, (m) => {
+        if (m === '') return m
+        hits.add(p)
+        return p.marker
+      })
+    }
+    if (y === x) return x
+    x = y
+  }
+  hits.add(OVERFLOW_HIT)
+  return OVERFLOW_MARKER
+}
+
+// Redacts `s` with `ctx` in front so a secret split across a key and its value, or across
+// argv elements ("Bearer", "<token>"), still matches; then strips the context back off.
+function redactLeaf(s, ctx, patterns, hits) {
+  if (ctx === '') return fixedPoint(s, patterns, hits)
+  const pre = ctx.slice(-LIMITS.maxContextChars) + ' '
+  const y = fixedPoint(pre + s, patterns, hits)
+  if (y === OVERFLOW_MARKER) return y
+  const r = fixedPoint(pre, patterns, new Set())
+  if (y.startsWith(r)) return fixedPoint(y.slice(r.length), patterns, hits)
+  // A match spans the boundary: keep from the marker that covers it. Slicing changes
+  // anchors and boundaries, so also check the standalone leaf after contextual matching.
+  let d = 0
+  while (d < r.length && y[d] === r[d]) d++
+  const i = y.lastIndexOf(MARKER_PREFIX, d)
+  return fixedPoint(i >= 0 ? y.slice(i) : y, patterns, hits)
+}
+
+function walk(v, ctx, patterns, hits) {
+  if (typeof v === 'string') {
+    const local = new Set()
+    const out = redactLeaf(v, ctx, patterns, local)
+    if (out !== v) for (const h of local) hits.add(h)
+    return out
+  }
+  if (Array.isArray(v)) {
+    let prev = null
+    return v.map((el) => {
+      const out = walk(el, typeof prev === 'string' ? prev : ctx, patterns, hits)
+      prev = el
+      return out
+    })
+  }
+  if (v !== null && typeof v === 'object') {
+    const named = typeof v.name === 'string' ? v.name : typeof v.key === 'string' ? v.key : null
+    // fromEntries, not assignment: `out[k] = v` would drop an own "__proto__" key.
+    return Object.fromEntries(
+      Object.entries(v).map(([k, x]) => [
+        walk(k, '', patterns, hits),
+        walk(x, k === 'value' && named !== null ? named : k, patterns, hits),
+      ]),
+    )
+  }
+  return v
+}
+
+// Returns a copy of `value` with every match replaced by `[REDACTED:<id>]`, plus the
+// patterns that fired (catalog order, unique). Keys are redacted too; two keys that redact
+// to the same marker collapse into one, which loses data but never leaks it.
+export function redactValue(value, patterns) {
+  const hits = new Set()
+  const out = walk(value, '', patterns, hits)
+  const order = [...patterns, OVERFLOW_HIT]
+  return { value: out, hits: order.filter((p) => hits.has(p)) }
+}
+
+// Same shape as `value`, every string replaced by `text`. The fallback when redaction
+// itself failed: withhold everything rather than pass anything through.
+export function maskValue(value, text) {
+  if (typeof value === 'string') return text
+  if (Array.isArray(value)) return value.map((v) => maskValue(v, text))
+  if (value !== null && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskValue(v, text)]))
+  }
+  return value
+}
+
+// JSON with object keys sorted at every level, so equal values hash equally.
+export function canonicalJson(value) {
+  if (Array.isArray(value)) return '[' + value.map((v) => (v === undefined ? 'null' : canonicalJson(v))).join(',') + ']'
+  if (value !== null && typeof value === 'object') {
+    const keys = Object.keys(value).filter((k) => value[k] !== undefined).sort()
+    return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(value[k])).join(',') + '}'
+  }
+  return JSON.stringify(value) ?? 'null'
+}
+
+export async function sha256Hex(text) {
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('')
+}

package/mods/secret-redactor/lib/core.mjs

@@ -0,0 +1,61 @@
+// Secret Redactor logic, shared by the native module and the Node hook so every harness
+// reaches the same verdict. Pure: no I/O, no environment.
+import { compilePatterns, parseJson, redactValue } from './common.mjs'
+import builtin from './patterns.mjs'
+
+const BUILTIN = compilePatterns(builtin, 'patterns.json')
+const CONTEXTS = new Set(['tool-input', 'tool-output'])
+const NOTICE = 'secret-redactor: credentials redacted from this result: '
+export const WITHHELD = '[secret-redactor: output withheld; redaction failed]'
+
+const inContext = (patterns, context) => patterns.filter((p) => p.context.includes(context))
+const names = (hits) => hits.map((h) => h.name).join('; ')
+
+// Built-in patterns plus the operator's extension, appended (never replacing). Throws on bad
+// JSON or shape, a reused built-in id or an unknown context; callers fail closed.
+export function loadPatterns(extraText, source = 'extension patterns') {
+  if (extraText === undefined) return BUILTIN
+  const extra = compilePatterns(parseJson(extraText, source), source)
+  for (const p of extra) {
+    if (BUILTIN.some((b) => b.id === p.id)) throw new Error(`${source}: id ${p.id} is a built-in pattern`)
+    if (!p.context.every((c) => CONTEXTS.has(c))) throw new Error(`${source}: ${p.id} context must be tool-input or tool-output`)
+  }
+  return [...BUILTIN, ...extra]
+}
+
+// Asks before a call whose input carries a credential. The reason names the patterns, never
+// the matched text.
+export function checkInput(input, patterns) {
+  const { hits } = redactValue(input, inContext(patterns, 'tool-input'))
+  return hits.length ? { decision: 'ask', reason: `secret-redactor: tool input contains ${names(hits)}` } : undefined
+}
+
+export function redactOutput(output, patterns) {
+  return redactValue(output, inContext(patterns, 'tool-output'))
+}
+
+// Native tool.call result. A clean result goes back untouched (core keeps its own messages).
+// A redacted one becomes the hook's own { result }, which core re-validates and re-maps, so
+// the model's text is rebuilt from the redacted value. What cannot be rebuilt that way is
+// withheld with its redacted text instead: an error, a secret that shows only in core's
+// text, or one in `context` (a hook may add context entries but never rewrite them).
+export function redactResult(r, patterns) {
+  const out = inContext(patterns, 'tool-output')
+  if (typeof r.deny === 'string') {
+    const d = redactValue(r.deny, out)
+    return d.hits.length ? { deny: d.value } : r
+  }
+  const result = redactValue(r.result, out)
+  const context = redactValue(r.context ?? [], out)
+  const text = redactValue(r.text ?? '', out)
+  if (result.hits.length + context.hits.length + text.hits.length === 0) return r
+  if (r.isError || context.hits.length || result.hits.length === 0) {
+    const shown = typeof r.text === 'string' ? text.value : typeof result.value === 'string' ? result.value : (JSON.stringify(result.value) ?? '')
+    return { deny: [NOTICE + shown, ...context.value].join('\n') }
+  }
+  return r.context ? { result: result.value, context: r.context } : { result: result.value }
+}
+
+export function logLines(hits, tool, event) {
+  return hits.map((h) => `[secret-redactor] redacted ${h.name} in ${tool ?? 'unknown tool'} ${event}`)
+}

package/mods/secret-redactor/lib/patterns.mjs

@@ -0,0 +1,75 @@
+// Generated by scripts/generate-mods.mjs from patterns.json. Do not edit.
+export default [
+  {
+    "id": "github-fine-grained-pat",
+    "name": "GitHub fine-grained personal access token",
+    "description": "github_pat_ prefix followed by 22+ [A-Za-z0-9_]. Listed before github-pat so a fine-grained body that happens to contain ghp_ is consumed whole.",
+    "regex": "github_pat_[A-Za-z0-9_]{22,255}",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "github-pat",
+    "name": "GitHub token (ghp/gho/ghu/ghs/ghr)",
+    "description": "GitHub classic PAT / OAuth / user-to-server / server-to-server / refresh token: 3-letter prefix, underscore, 36-255 alphanumerics.",
+    "regex": "(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "aws-secret-key",
+    "name": "AWS secret access key (context-anchored)",
+    "description": "40+ chars of [A-Za-z0-9/+] ONLY when preceded by an AWS secret-key name (aws_secret_access_key, AWS_SECRET_KEY, SecretAccessKey, secretAccessKey, --aws-secret-access-key ...) plus a separator (:, =, =>, or whitespace) with optional quotes/escaped quotes. A bare 40-char base62 run is deliberately NOT matched: it is indistinguishable from a 40-hex git SHA. The match consumes the key name and separator. Listed before aws-access-key so an AKIA-looking prefix inside the value cannot split the secret.",
+    "regex": "(?:aws[_.-]?secret[_.-]?(?:access[_.-]?)?key|secret[_.-]?access[_.-]?key)[\\\\\"']{0,4}(?:[ \\t]*(?::|=>?)[ \\t\\r\\n]*|[ \\t]+)[\\\\\"']{0,4}[A-Za-z0-9/+]{40,}",
+    "flags": "i",
+    "severity": "critical",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "aws-access-key",
+    "name": "AWS access key ID",
+    "description": "AKIA (long-term) or ASIA (STS temporary) followed by 16 uppercase alphanumerics. No boundary anchors (no lookbehind available): fails closed, may over-redact inside long uppercase blobs.",
+    "regex": "(?:AKIA|ASIA)[0-9A-Z]{16}",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "generic-bearer",
+    "name": "HTTP Bearer token",
+    "description": "Bearer (any case) + horizontal whitespace + 16+ token chars [A-Za-z0-9._~+/-] + optional = padding. Spec said '+'; 16+ avoids redacting prose such as 'bearer of'. Token class excludes '[' so it can never extend into a [REDACTED:..] marker.",
+    "regex": "bearer[ \\t]+[A-Za-z0-9._~+/-]{16,}=*",
+    "flags": "i",
+    "severity": "high",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "password-in-url",
+    "name": "Credentials embedded in URL",
+    "description": "scheme://user:password@ . Scheme bounded to 30 chars (avoids quadratic scans on long alnum runs). User/password classes exclude whitespace, quotes, backslash, '/', '@', angle brackets and backtick, so a match cannot cross whitespace, a JSON string quote, or a path. Must stay LAST in the array: its password class accepts '[' and ':' so it can swallow earlier [REDACTED:..] markers (harmless, single pass), and nothing after it can re-form.",
+    "regex": "[A-Za-z][A-Za-z0-9+.-]{0,30}://[^ \\t\\r\\n\"'\\\\/@:?#<>`]*:[^ \\t\\r\\n\"'\\\\/@<>`]+@",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  }
+];