feat: widen the paste rules to cover cloud env vars and PEM keys

[tkc]

Follow-up to #34, after reading Claude Code's own credential detector.

What Claude Code actually does

Inspected the shipped binary (~/.local/share/claude/versions/2.1.273). It carries a table of 59 regexes, each {id, source, flags, confidence}, and:

• No entropy-based detection. entropy appears only in Node internals and in the prose of the maskDuplicates docs. This confirms the limit already stated in our README — a bare AWS secret key is not detectable, and Anthropic reached the same conclusion.
• Capture group 1 is the part to replace — the same convention as (?P<secret>…) here, and as the sandbox's extract setting.
• The confidence tier is chosen by the direction the data travels:

scan(e)             → high only   // detect and label, no replacement
redactTokens(e)     → high only
redactContext(e)    → low only
redact(e)           → redactTokens(redactContext(e))   // outbound: both
redactForDisplay(e) → high only   // shown to a person: conservative

Over-redact on the way out; under-redact on the way to a reader. Their value pattern even matches [REDACTED] itself, so re-running is safe.

Worth noting: per the data-usage docs, this detector runs on telemetry, /feedback bundles and transcript uploads only — "Source code, file contents, and other conversation content are uploaded as-is." The path to the model is covered by user-declared rules instead (Read(./.env) deny rules, sandbox mask). termit's paste boundary sits in that gap.

The three rules taken

1. Cloud environment variables — narrowed, not copied. Theirs redacts the value of anything matching AWS_|GOOGLE_|GCP_|GCLOUD_|AZURE_. Free for telemetry; wrong here. It would strip AWS_REGION=us-east-1 and AWS_PROFILE=default out of your paste, and an agent that cannot see your region cannot answer the question you asked. Narrowed to names carrying SECRET, KEY, TOKEN, PASSWORD or CREDENTIAL — there is a test asserting plain cloud settings arrive untouched.

2. PEM private keys, whole. Previously only caught inside a JSON value, so pasting the key file itself went straight through. The -----END …----- marker is required, so prose mentioning -----BEGIN PRIVATE KEY----- is not swallowed to the end of the paste.

3. GOCSPX- client secrets, the A3T access-key prefix, and AWS's base32 alphabet [A-Z2-7].

Deliberately not taken: the low-confidence tier

sensitive-assign fires on password, token, cookie, authorization, session_id, connection_string. That is right for telemetry and wrong for a paste that a person and an agent both read for meaning — it would damage the code you paste for review. termit's paste follows redactForDisplay, not redact.

Also fixed

Redaction is now idempotent and the count honest. A span already reading [redacted] is neither re-counted nor re-replaced, so AWS_ACCESS_KEY_ID=AKIA… — which matches both the prefix rule and the variable-name rule — reports one secret rather than two.

Test

231 pass (up from 224), 1 ignored. clippy -D warnings and fmt --check clean. Seven new tests: cloud env vars redacted, plain cloud settings byte-for-byte unchanged, a PEM block redacted whole with the surrounding sentences kept, an unterminated PEM left alone, GOCSPX-, no count inflation from overlapping rules, and redacting twice being a no-op. The README's rule list is regenerated from the shipped defaults and pinned to them by the existing test.

docs/references/paste.md records the investigation.

🤖 Generated with Claude Code