Struct RedactSecretsHook 

pub struct RedactSecretsHook;

On PreToolUse, performs in-place replacement of likely sensitive fields in args.

Matches (case-insensitive substring): password / secret / token / api_key / apikey / authorization. When matched, the field value is replaced with "***" and patched into args.

Only operates when args is an Object; other shapes (arrays, strings) are left untouched — the shape of args is defined by the tool itself, and deep recursive rewriting could break tool semantics.

Does not handle password=xxx embedded inside a bash command string — that would require shell lexing, which is beyond the stability guarantees of this builtin.

Trait Implementations

impl StepHandler for RedactSecretsHook

fn handle_step<'a>( &'a self, envelope: &'a Value, _ctx: HookCtx<'a>, ) -> BoxFuture<'a, Result<Option<Value>, HookError>>

Step model: consumes the before_tool_apply envelope {tool, args}, redacts potentially sensitive fields in args in place, and returns a {args: <redacted>} verdict if any were found (the engine applies it back to the step, modifying args).