secrets-redactor

1import type { Register } from 'claude-code'
2
3const MARK = '[REDACTED:'
4
5const PATTERNS: [kind: string, pattern: RegExp][] = [
6  ['private-key', /-----BEGIN [A-Z ]*PRIVATE KEY( BLOCK)?-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY( BLOCK)?-----/g],
7  ['aws-access-key', /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g],
8  ['github-token', /\b(gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b/g],
9  ['gitlab-token', /\bglpat-[A-Za-z0-9_-]{20,}\b/g],
10  ['slack-token', /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g],
11  ['stripe-key', /\b[sr]k_live_[A-Za-z0-9]{20,}\b/g],
12  ['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
13  ['anthropic-key', /\bsk-ant-[A-Za-z0-9_-]{20,}/g],
14  ['openai-key', /\bsk-(proj-|svcacct-)?[A-Za-z0-9_-]{32,}/g],
15  ['jwt', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g],
16  ['npm-token', /\bnpm_[A-Za-z0-9]{36}\b/g],
17]
18
19// user:password@ in connection strings; only the password goes.
20const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@/]{3,})(@)/gi
21const AWS_SECRET = /(aws_secret_access_key\s*[=:]\s*["']?)([A-Za-z0-9/+=]{40})/gi
22const ASSIGNMENT = /((?:password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret)["']?\s*[:=]\s*)(["'])([^"'\s]{8,})\2/gi
23
24export function redact(text: string, aggressive = false): { text: string; count: number } {
25  let count = 0
26  let out = text
27  for (const [kind, pattern] of PATTERNS) {
28    out = out.replace(pattern, () => (count++, `${MARK}${kind}]`))
29  }
30  out = out.replace(URL_PASSWORD, (_, head, __, at) => (count++, `${head}${MARK}password]${at}`))
31  out = out.replace(AWS_SECRET, (_, head) => (count++, `${head}${MARK}aws-secret]`))
32  if (aggressive) out = out.replace(ASSIGNMENT, (_, head, quote) => (count++, `${head}${quote}${MARK}secret]${quote}`))
33  return { text: out, count }
34}
35
36type Block = { type: string; [field: string]: unknown }
37
38// Rewrites text blocks and tool_result contents (string or nested text blocks); everything else passes as is.
39export function redactBlocks(blocks: readonly Block[], aggressive: boolean): { blocks: Block[]; count: number } {
40  let count = 0
41  const text = (value: string) => {
42    const result = redact(value, aggressive)
43    count += result.count
44    return result.text
45  }
46  const walk = (block: Block): Block => {
47    if (block.type === 'text' && typeof block.text === 'string') return { ...block, text: text(block.text) }
48    if (block.type !== 'tool_result') return block
49    if (typeof block.content === 'string') return { ...block, content: text(block.content) }
50    if (Array.isArray(block.content)) return { ...block, content: (block.content as Block[]).map(walk) }
51    return block
52  }
53  const out = blocks.map(walk)
54  return { blocks: out, count }
55}
56
57export const register: Register = (on, options) => {
58  const aggressive = options.aggressive === true
59
60  on('prompt.submit', async ($, e, next) => {
61    const { text, count } = redact(e.text, aggressive)
62    if (count === 0) return next(e)
63    $.ui.toast(`secrets-redactor: removed ${count} secret(s) from your prompt before sending.`)
64    return next({ ...e, text })
65  }).catch(($, e, next) => (next.called ? next(e) : { drop: 'secrets-redactor could not scan this prompt, so it was not sent.' }))
66
67  on('session.append', { door: 'tool-result' }, async ($, e, next) => {
68    const { blocks, count } = redactBlocks(e.message.content, aggressive)
69    if (count === 0) return next(e)
70    $.ui.status(`secrets-redactor: ${count} secret(s) hidden from Claude`)
71    return next({ ...e, message: { ...e.message, content: blocks } })
72  }).catch(($, e, next) =>
73    // Could not scan it: withhold the output rather than risk leaking it.
74    next({
75      ...e,
76      message: {
77        ...e.message,
78        content: e.message.content.map(block =>
79          block.type === 'tool_result' ? { ...block, content: 'Output withheld: secrets-redactor could not scan it.', is_error: true } : block,
80        ),
81      },
82    }),
83  )
84
85  // A redacted value written back to disk would destroy the real secret.
86  on('tool.check', async ($, e, next) => {
87    const args = (e.input ?? {}) as Record<string, unknown>
88    const written = [args.content, args.new_string, args.new_source, args.command].filter(v => typeof v === 'string') as string[]
89    if (written.some(v => v.includes(MARK))) {
90      return { decision: 'deny', reason: `secrets-redactor: this would write a ${MARK}…] placeholder over a real secret. Ask the user to make this change themselves.` }
91    }
92    return next(e)
93  }).catch(($, e, next) => (next.called ? next(e) : { decision: 'ask', reason: 'secrets-redactor could not check this call.' }))
94}
95