Module redact 

One redaction chokepoint, shared by every writer that puts text on disk.

This lived in mur-agent-runtime::hooks::b0_helpers and was reachable only from the runtime’s own telemetry writer. B0 rule 9 is named “telemetry sink redaction”, which reads like a guarantee about everything MUR writes — it was not. The CLI hook pipeline’s capture queue (mur-core::inject::queue) went to disk unredacted, and on a real install accumulated 934 MB of verbatim command lines including API keys (#979).

It sits in mur-common because both mur-agent-runtime and mur-core write text, and neither may depend on the other for it.

mur-common::skill::scan::secrets DETECTS secrets and reports findings; this module REPLACES them. The two are deliberately separate: a scanner that silently rewrote its input would be a surprising scanner.

Functions

redact_home_path

Replace home-directory-style absolute paths with ~/. Catches macOS /Users/<user>/, Linux /home/<user>/, and Windows C:\Users\<user>\ so error messages don’t leak the OS user account name in telemetry. Conservative: only the username portion is collapsed; the trailing path is preserved so debugging context survives.

redact_secrets

redact_value

Redact every string leaf of a JSON value in place.