[caiovicentino]

Client 0.1.42, from a measured dogfooding log: 687 commands of one Claude Code session run through ekbasis-claude-hook 0.1.41 in log mode (shell guard and preflight on, hosted API).

Security: credentials typed on a command line stay on the machine

Until 0.1.41 the command line went verbatim into the state the client sends (hook, CLI, MCP tools, Python API) and into the hook's log in log mode. A key typed on it (printf '%s' 'vck_…' > f, export TOKEN=…, curl -H "Authorization: Bearer …", https://user:token@…, --password=…) reached the server and the disk. In that session's log it happened once.

ekbasis.redact.redact_line now runs on every state Ekbasis.ask sends, on feedback notes, on the hook's log record, reasons and messages, and on the monitor's log. It replaces credential-looking values with placeholders made of [A-Za-z0-9_] (REDACTED_1, vck_REDACTED_2; the same value gets the same placeholder), and keeps quotes, spaces, redirections and paths. The parsed line keeps the same shape (tested).

• What it replaces:
  • tokens with a known prefix (sk-ant-, sk-, sk_live_, vck_, hf_, ghp_/gho_/ghs_, github_pat_, xox?-, AKIA/ASIA, glpat-, npm_, pypi-AgE, AIza, JWTs);
  • PEM private key bodies;
  • Authorization, X-Api-Key, X-Auth-Token and Cookie header values;
  • passwords in URLs;
  • --password, --token, --api-key, --secret values;
  • values of assignments and JSON/YAML keys named like token, secret, passw, api_key, auth (not author), credential or private_key, when the value has 8+ characters and is not a number, a boolean or a path;
  • as a last resort, long random-looking words.
• What stays: variables and substitutions ($TOKEN, $(cat key)), paths, git refs, commit ids, sha256 sums and UUIDs.
• Log and switch: the hook's log records "redacted": n, and EKBASIS_REDACT=0 turns redaction off.
• Docs: README and docs/SECURITY.md now say what leaves the machine (the redacted command line; a listing of names, sizes and keyed fingerprints, never contents; for git, the repository's state) and the limits of redaction.
• Measured on the 687 logged lines: redaction changes none of them (none still holds a credential). On 14 of them with made-up credentials added (a key written to a file, a Bearer token, an exported token), each run through the hook with and without redaction against the hosted API (one line at a time, at most 2 requests in flight):
  • all 14 got the same decision and the same kinds of warning;
  • the probabilities moved by up to 17 points, about as much as repeated runs of an unchanged line move;
  • no redacted log held the credential.

The guards read a variable set earlier on the same line

The git guard and the shell guard (shell.resolve, used by parse and by the hook's line reader) read $NAME / ${NAME} with its value when the line sets NAME before, to a known value: G=/repo; git -C "$G" status, D=build; rm -rf "$D".

The assignment must be:

• a command made only of NAME=value words (a literal, or names already known);
• run unconditionally at the top level;
• the only place the line sets NAME.

Everything else is still not guessed and stays "cannot foresee", as before:

• a variable from the environment;
• one set twice or used before it is set;
• one that is exported, read, or set by a loop, a condition, a pipeline, a subshell or a command substitution;
• every variable of a line with eval, source or a function.

The shell guard's state names the values it used.

Preflight does not guess at a step it cannot read

• Inline code and other machines. A step that runs code given inline to an interpreter (python3 -c, python3 - <<'EOF', node -e, …) or runs on another machine (ssh, scp/rsync to or from a host) is never named as the failing step. The other steps are still judged. When none of them changes anything, the line is "cannot judge": silent, or one warning with EKBASIS_PREFLIGHT_FAIL_CLOSED=1.
• Why per step and not the whole line. Making the whole line "cannot judge" lost 3 real catches. In each, preflight had said "step 3 python3 assets_src/make_chart_jev.py likely fails, step 2 (an inline edit) already ran", and the session's transcript shows exactly that failure.
• Loops on one line. Root cause of "for f in …; do …; done is likely to fail (checked in code)": one-line chains were cut at ; into commands named for/do/done/case/esac. Code then found them "not installed" and decided that the step fails. Such lines are now "cannot judge", as scripts already were.
• Two more code facts that misfired, both fixed:
  • a redirection into a folder that an earlier step creates (mkdir -p out; … > out/log);
  • a command given by its path (./node_modules/.bin/tsc), which code took as "not installed".

Replay: 0.1.41 and 0.1.42 on the same commands and state

	0.1.41	0.1.42
lines flagged	299	137
preflight warnings	171	52
… on commands that really failed (the session ran them all)	6	3
shell guard "could not foresee"	64	19
git guard "cannot foresee"	76	15
shell guard "may lose" / overwrites (judged now, not cannot-foresee)	45 / 1	57 / 4

What disappeared: 246 flags on 221 lines.

• 56 for one-line loops, 53 for inline code, 12 for remote steps;
• 6 code facts that were wrong;
• 118 where a variable is now read;
• 1 model answer that moved under the threshold, on a command that had succeeded.

True-positive check:

• Of the disappeared flags, those on commands that really failed are 3 preflight warnings that had named an inline step that did not fail, 2 lines that are still asked, and 1 read-only line.
• Each line where a flag went away because a variable was now read, and where content could be lost, was run again with the work at stake put back (a dirty file, a repository with uncommitted work, dry-run outputs): 0.1.42 flags 15 of 15.

Known follow-up: 10 new preflight warnings, all on commands that succeeded. They sit on lines where 0.1.41's git guard gave up first and preflight never ran. Their cause: preflight's listing does not follow a cd from an earlier step (an issue will be opened).

Checks

• Python 3.12: 393 passed, 30 skipped, including 30 new tests: in-line variables, preflight from sanitized log lines, every redaction pattern, no false redaction of paths/hashes/branches/sums, and that the line keeps its shape.
• Docker framework tests pass locally; the PostgreSQL ones run in CI.
• Python 3.9: the new and touched test modules pass.
• The plugin copy is in sync.
• Version 0.1.42 is set in _version.py, pyproject.toml, plugin.json and server.json.
• The TypeScript SDK is unchanged; it has no command-line logic.

🤖 Generated with Claude Code