Fix #675: Secret auto-redaction in learning capture pipeline

[AlexMikhalev]

Summary

Implements secret auto-redaction in the learning capture pipeline as specified in issue #675.

Changes

• New redact(&str) -> Cow<str> function with built-in patterns covering:

  • AWS access keys (AKIA...) and secrets
  • GCP service account keys (JSON private_key and private_key_id)
  • Azure GUIDs and connection strings
  • Generic API keys (sk-..., Slack tokens, GitHub tokens)
  • Database connection strings (PostgreSQL, MySQL, MongoDB, Redis)
  • Environment variable assignments

• Redaction format changed from [AWS_KEY_REDACTED] to [REDACTED:<pattern-name>] so downstream readers can see that something was removed.

• RedactionConfig struct with enabled flag and custom_patterns vector for user-defined regex patterns loaded from .terraphim/learning-capture.toml.

• Comprehensive test coverage:

  • Individual tests for each built-in pattern
  • Custom pattern via config test
  • Config disabled test
  • Property test: redact(input).len() <= input.len() * 2
  • Backward compatibility for redact_secrets() alias

• Wiring: Already integrated in capture.rs (capture_failed_command, capture_correction) and hook.rs (process_* functions).

Verification

cargo test -p terraphim_agent --bin terraphim-agent redaction
cargo clippy -p terraphim_agent -- -D warnings
cargo fmt --all -- --check

All 442 tests pass, zero clippy warnings.

Refs #675

[AlexMikhalev]

Security Audit Summary

PR #856 introduces six Claude Code hooks and associated test scripts for the learning capture pipeline, git safety guarding, npm-to-bun enforcement, and LLM pre/post validation. There are no Rust source changes, no Cargo dependency changes, and no Cargo.lock modifications. The entire security surface is confined to the bash hook layer.

Risk: medium

Verdict: concerns

Findings

[MEDIUM] JSON injection via unescaped shell variables in git_safety_guard.sh (lines 50-58)

The permissionDecisionReason value is constructed by embedding $REASON and $COMMAND (both jq-r-extracted strings) directly into a heredoc JSON literal without JSON-escaping:

cat <<EOF
{
  "hookSpecificOutput": {
    "permissionDecisionReason": "BLOCKED ...\n\nReason: $REASON\n\nCommand: $COMMAND\n..."
  }
}
EOF

A command containing a double-quote (e.g., git commit -m "fix: typo") produces malformed JSON. Claude Code's hook parser may silently discard the malformed output, causing the block decision to be ignored. An adversary who knows the guard patterns could craft a command that both matches the guard pattern and breaks the JSON, bypassing the block.

Remediation: use jq -n --arg reason "$REASON" --arg cmd "$COMMAND" to construct the JSON output safely, ensuring special characters are properly escaped.

[MEDIUM] Secret redaction is a trust boundary delegated to an unreviewed binary (learning-capture.sh line 100)

The hook comment states "Redacts secrets automatically before storage" but the hook itself passes raw $COMMAND and $ERROR_OUTPUT (which may contain API tokens, passwords, auth headers from failed curl calls) directly to terraphim-agent learn capture. The redaction logic lives entirely inside the binary. If terraphim-agent has a redaction bug or is absent (the hook is fail-open but the binary IS found), unredacted secrets enter the learning store.

The PR title claims this PR fixes secret auto-redaction, but the hook code does not implement any redaction itself. The security guarantee is unverifiable from the hook diff alone.

Remediation: either (a) implement minimal regex-based redaction in the shell hook as a defence-in-depth layer before passing to the binary, or (b) document explicitly in the hook that redaction is guaranteed by terraphim-agent and add an integration test confirming a token-shaped string does not appear in the learning store after capture.

[LOW] Inconsistent shell safety flags across hooks

• learning-capture.sh, pre-llm-validate.sh, post-llm-check.sh: set -euo pipefail (correct)
• git_safety_guard.sh, npm_to_bun_guard.sh: set -e only (missing -u and pipefail)
• on-file-write.sh: no set flags at all

A hook without -u can silently use an empty variable; without pipefail, a failed pipeline step is invisible. In on-file-write.sh, $FILE_PATH and $PROJECT_DIR are environment-injected and neither is validated nor sanitised before use.

[LOW] Argument-prefix injection via --json "$PROMPT" in pre-llm-validate.sh (line 60)

If $PROMPT begins with -, terraphim-agent validate --connectivity --json "$PROMPT" may interpret the prompt as a flag. This is low risk in practice but violates the principle of separating data from flags. Use -- before user-supplied arguments or pass via stdin.

[INFORMATIONAL] on-file-write.sh output uses emoji

Lines 7 and 9 emit emoji characters. This is a cosmetic violation of the project's no-emoji convention (CLAUDE.md) and may cause rendering issues in terminals without full Unicode support.

Dependency Changes

None. No Cargo.toml or Cargo.lock modifications. No new crates introduced.

Summary

The hooks follow generally sound patterns: fail-open semantics, stdin-based data passing (<<<), and jq --arg for injection-safe substitution in most places. The git_safety_guard JSON construction flaw is the most actionable finding — it can cause a guard bypass under legitimate commands. The redaction trust boundary requires clarification or defence-in-depth.

_{Last security-audited commit: 1d0b60e}