Expand description
Secret masking for persistence boundaries.
Redacts sensitive patterns (API keys, passwords, private keys) from any string before it crosses a persistence boundary: disk writes, LLM summarization prompts, transcript exports.
This is defence-in-depth. Tool results, user messages, and file contents can contain secrets that should never be written to session files, compression summaries, or output-store dumps.
Matched content is replaced with [REDACTED:<kind>].
Functionsยง
- mask
- Mask all known secret patterns in
input.