Found during the v0.5.0 (#5/#6/#7) review, pre-existing on the command path and out of scope for that PR.
redact()'s generic keyword+separator rule in hooks/_lib.sh (tl_jq_redact_defs) has a value-capture group \"?(?:...|[^\s"]+) that optionally consumes a leading quote but never consumes a matching trailing quote. A quoted value like:
password="hunter2superlongvalue"
redacts to:
The secret itself IS masked (no leak) - this is purely a cosmetic malformed-output bug: an orphaned trailing quote left in the buffer/handoff log.
Repro:
printf '%s' '{"session_id":"q","tool_name":"Bash","tool_input":{"description":"x","command":"config: password=\"hunter2superlongvalue\""}}' | sh hooks/session-capture.shFix: the value-capture group's quoted alternative needs to consume a trailing quote to match the leading one, e.g. distinguish "..." (quoted, consume both) from an unquoted bare run, rather than one shared alternation.
Low priority - cosmetic, no security impact.
Found during the v0.5.0 (#5/#6/#7) review, pre-existing on the command path and out of scope for that PR.
redact()'s generic keyword+separator rule inhooks/_lib.sh(tl_jq_redact_defs) has a value-capture group\"?(?:...|[^\s"]+)that optionally consumes a leading quote but never consumes a matching trailing quote. A quoted value like:redacts to:
The secret itself IS masked (no leak) - this is purely a cosmetic malformed-output bug: an orphaned trailing quote left in the buffer/handoff log.
Repro:
Fix: the value-capture group's quoted alternative needs to consume a trailing quote to match the leading one, e.g. distinguish
"..."(quoted, consume both) from an unquoted bare run, rather than one shared alternation.Low priority - cosmetic, no security impact.