cursordoctrine 0.2.1 → 0.2.2

package/linux/hooks/hook-common.sh

@@ -159,6 +159,9 @@ try:
             q = m.group(1).strip()
             if len(q) > 2000:
                 q = q[:2000] + "..."
+            q = re.sub(r"\bnpm_[A-Za-z0-9]{10,}\b", "[REDACTED_NPM_TOKEN]", q)
+            q = re.sub(r"\b(sk-[A-Za-z0-9]{10,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,})\b", "[REDACTED_TOKEN]", q)
+            q = re.sub(r"(?i)(api[_-]?key|token|secret|password)\s*[:=]\s*\S+", r"\1=[REDACTED]", q)
             print(q)
             break
 except Exception:
@@ -172,6 +175,7 @@ except Exception:
     printf '%s' "$reversed" |
         grep -m1 -oE '<user_query>[^<]*</user_query>' 2>/dev/null |
         sed -E 's@</?user_query>@@g' |
+        sed -E 's/\bnpm_[A-Za-z0-9]{10,}\b/[REDACTED_NPM_TOKEN]/g' |
         head -c 2000
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursordoctrine",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Thin self-review hooks for Cursor — the model is the auditor. Intent-trace final review (Tier 0), unified 13-item anti-slop checklist, operational slop detection.",
   "bin": {
     "cursordoctrine": "bin/cli.mjs"

package/windows/hooks/hook-common.ps1

@@ -73,7 +73,17 @@ function Resolve-AgentPath([string]$p) {
     return ConvertTo-FwdPath $p
 }
 
-# Extract the last user <user_query> from a Cursor transcript JSONL. The
+# Strip secrets from text before embedding in agent-facing followups. Intent
+# trace must not re-broadcast tokens the user pasted in chat.
+function Redact-SecretsFromIntent([string]$text) {
+    if (-not $text) { return $text }
+    $text = $text -replace '\bnpm_[A-Za-z0-9]{10,}\b', '[REDACTED_NPM_TOKEN]'
+    $text = $text -replace '\b(sk-[A-Za-z0-9]{10,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,})\b', '[REDACTED_TOKEN]'
+    $text = $text -replace '(?i)(api[_-]?key|token|secret|password)\s*[:=]\s*\S+', '$1=[REDACTED]'
+    return $text
+}
+
+# Extract the last user <user_query> from a Cursor transcript JSONL.
 # transcript is an array of {role, message} records; we walk backward from the
 # end, find the last user turn whose content has a <user_query> tag, and return
 # its text. Returns '' if there is no transcript or no user_query. Capped at
@@ -108,7 +118,7 @@ function Get-LastUserQuery($obj) {
         if ($text -match '(?s)<user_query>\s*(.+?)\s*</user_query>') {
             $q = $Matches[1].Trim()
             if ($q.Length -gt 2000) { $q = $q.Substring(0, 2000) + '...' }
-            return $q
+            return (Redact-SecretsFromIntent $q)
         }
     }
     return ''