redacted-cli 1.1.0

Claude Code PostToolUse hook that scrubs secrets from tool output
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# engine.example.yml: extra detection rules.
# Copy to ~/.config/redacted/engine.yml (global) or .redacted.engine.yml (project root).
# Policy, learned secrets and the heuristic go in config.yaml.
# keywords, heuristic and value_safe_char from 0.7 are ignored here.

# Extra allow rows: a match whose value (keyed match) or whole text
# (value-only match) fits one of these is not redacted. Learned secrets ignore it.
allow_values:
  - '^svc_[A-Za-z0-9]+$'

# Extra patterns in Go RE2 syntax, run after the built-in ones. The whole match
# is replaced. One that fails to compile withholds all hook output.
patterns:
  - name: acme_key
    regex: 'acme_[A-Za-z0-9]{32,}'