fix(hook): secret redaction was broken — rewrite via Python + add tests

[anthroos]

TL;DR

The PostToolUse hook claimed to redact Bearer X, api_key=…, password=…, token=… etc from observation summaries before writing them to ~/.openexp/observations/. A code review found the redaction was broken on the most realistic inputs, including Anthropic API keys (sk-ant-api03-…).

The bug

Empirically verified before this PR (run on macOS, but reproduces identically on Linux GNU sed):

Input	Old output	Status
api_key="abc12345xyz_secretvalue"	api_key="abc12345xyz_secretvalue"	NOT redacted
Bearer sk-ant-api03-veryverysecret	Bearer [REDACTED]-ant-api03-veryverysecret	API key leaks
token=secretvalue1234567890	token=[REDACTED]4567890	Tail leaks
password="hunter2hunter2"	password=[REDACTED]"	Trailing quote leaks
ANTHROPIC_API_KEY=sk-ant-… npm test	unchanged	Inline env-var form not caught at all

Three concrete root causes:

1. The keyword pattern used \047 for ' inside a POSIX bracket expression. Both BSD sed (macOS) and GNU sed interpret \047 as the literal characters \, 0, 4, 7 there, not as an escaped single-quote. The character class never matched the quote forms.
2. The Bearer character class [A-Za-z0-9_\.\-\/+=]+ had unnecessary backslash escapes that fouled the match — only sk consumed before failing on -.
3. Inline env-var form (MY_TOKEN=abc curl …) was never targeted at all; the previous heuristic only caught export TOKEN=….

Plus two secondary issues caught in the same review:

• The ls* skip-list pattern matched lsof, lsblk, lsattr and dropped their observations.
• The Bash branch only redacted SUMMARY. The full COMMAND also gets persisted into context.command in the JSONL — uncovered.

Fix

redact_secrets() rewritten in Python via python3 -c. sed character classes diverge between BSD and GNU; Python regex is portable, readable, and tested. Three rules:

# 1. ANTHROPIC_API_KEY=sk-ant-…, MY_TOKEN=abc, GH_PASSWORD=…
re.sub(r"(^|\s)([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|API|PASS|PWD|AUTH)[A-Z0-9_]*)\s*=\s*\S+", r"\1\2=[REDACTED]", s)

# 2. token=val, password="val", api_key: val (case-insensitive)
re.sub(r"(token|password|api[_-]?key|secret|credential|auth)\s*[:=]\s*[\"\x27]?[^\s\"\x27]{4,}[\"\x27]?", lambda m: m.group(1) + "=[REDACTED]", s, flags=re.IGNORECASE)

# 3. Bearer X, sk-…, ghp_…, AKIA…
re.sub(r"Bearer\s+[A-Za-z0-9._/+=\-]+", "Bearer [REDACTED]", s)
re.sub(r"\bsk-[A-Za-z0-9_\-]{16,}", "[REDACTED]", s)
re.sub(r"\bghp_[A-Za-z0-9]{20,}", "[REDACTED]", s)
re.sub(r"\bAKIA[A-Z0-9]{16}\b", "[REDACTED]", s)

Other changes:

• Skip-list tightened: ls / ls * instead of ls*. pwd / pwd *. Adds grep and rg.
• Bash branch now redacts COMMAND before deriving SUMMARY. Both on-disk fields are clean.
• Drops the brittle if grep ... TOKEN|SECRET heuristic — replaced by the rule (a) regex which is more general and tested.

Tests

New tests/test_post_tool_use_hook.sh — 19 assertions covering the six previously-broken redaction cases, the read-only skip list (including the lsof/lsblk regression), and sensitive-file-path skips on Write. Passes 19/19 against this PR; would fail 6+ on the prior version.

=== Secret redaction (Bash) ===
  PASS  api_key= form
  PASS  Bearer sk-ant-...
  PASS  --token=val
  PASS  --password="val"
  PASS  inline ENV=val
  PASS  export GITHUB_TOKEN
=== Read-only commands skipped ===
  PASS  ls -la / find / cat / pwd / echo / head
=== Non-read-only commands captured (regression: ls* glob) ===
  PASS  lsof -i :8080
  PASS  lsblk
=== Sensitive file paths skipped (Write) ===
  PASS  .env / .env.local / credentials.json / .ssh/id_rsa / *.pem

Performance impact

Each Bash tool call now invokes python3 once (~50ms cold). Acceptable for a hook that fires on Edit/Write/Bash. The hook still fast-exits on read-only commands before reaching Python — no overhead for ls -la, cat, find.

Severity / impact on existing users

Anyone running OpenExp with the previous hook has potentially leaked secrets from Bash tool calls into ~/.openexp/observations/observations-YYYY-MM-DD.jsonl on their own disk. The file is in $HOME with default permissions (700 typically), so not network-exposed — but if a user's transcripts get backed up, synced, or shared, the secrets travel with them.

After merge, recommend a follow-up issue to scan/redact existing observation files. Tracked separately.