feat: redact cloud credentials on paste

[tkc]

Copying a block of logs, JSON or ~/.aws/credentials to ask an agent about it carries any live key straight into the model's context. ⌘V now redacts before the text reaches the session, keeping the surrounding text so the agent still sees what you meant to show it:

aws_secret_access_key = [redacted]
"private_key": "[redacted]"

The bottom bar says pasted with 2 secrets redacted — ⌥⌘V pastes it unchanged, so it never happens silently, and ⌥⌘V gives you the real thing when you want it (typing a key into aws configure). ⌘C and OSC 52 are untouched — rewriting a copy would silently break selecting a key on screen in order to use it.

Rules live in config, not in the binary

[paste]
mask   = true
redact = [
  '\b(?P<secret>(AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16})\b',
  '(?i)"(aws_secret_access_key|secretaccesskey|sessiontoken|private_key|client_secret)"\s*:\s*"(?P<secret>[^"]+)"',
  ...
]

The part named secret is what gets replaced, so the name and the quotes around it survive automatically. A broken pattern is refused at startup, naming its index — verified for real:

$ termit                      # with redact = ["[unclosed"]
termit: invalid config: paste.redact[0] is not a valid regex: [unclosed
  regex parse error: unclosed character class
exit=1

What iTerm2 gave, and what changed

iTerm2 puts an ordered transform pipeline behind paste (sanitizePasteEvent: in iTermPasteHelper.m: newlines → punctuation → unsafe control codes → tabs → shell escaping → regex substitution → base64) and ships the regex tool with no rules of its own. Two deliberate differences:

• Named capture instead of pattern+substitution. iTerm2 pairs a regex with a replacement string you write with $1. Marking the span (?P<secret>…) instead means a mistyped replacement can't eat the context.
• ⌥⌘V, not ⌘⇧V. That is iTerm2's Advanced Paste slot, and it sidesteps the Cmd+Shift combination this codebase already had to work around once (⌘I exists because ⌘⇧R doesn't always arrive).

termit ships defaults where iTerm2 ships none, because a tool nobody writes rules for protects nobody — but they stay in config, so no AWS key shape is compiled into termit. docs/references/paste.md records this.

Cost

regex was already linked via env_logger → env_filter, so making it a direct dependency costs 33 KB of binary (9,641,456 → 9,674,560) and no compile time. Rust's regex has no backtracking, so a user-supplied pattern cannot hang the terminal.

Limits, stated in the README too

• A bare AWS secret key cannot be detected. 40 characters of base64 with no marker; a rule catching it also catches passwords, hashes and git SHAs. It is caught next to its name, which is how it arrives in a credentials file or an API response. gitleaks has the same limitation for the same reason.
• password and token are deliberately not in the defaults — they fire on code you paste for review and damage it. There is a test asserting ordinary code passes through byte-for-byte.

Test

224 pass, 1 ignored. clippy -D warnings and fmt --check clean. Nine tests on the redactor cover a real credentials file, aws sts JSON, a GCP service-account key (the \n inside the quoted value is why the quoted rule takes everything to the closing quote), Google API keys and OAuth tokens, code that must survive untouched, empty rules, a rule with no secret group, and a broken pattern. A test pins the README's example to the shipped defaults so the two can't drift.

Not covered by a test: the wiring from clipboard through redact to the pty, and whether ⌥⌘V actually arrives on a given machine — I can't press keys from here. --keytest will show it; if it doesn't arrive, mask = false is the fallback.

🤖 Generated with Claude Code