feat(privacy): MONITOR_PRIVACY_REDACT — opt-in ingest-time secret redaction

[Mukller]

Summary

Implements the server-side backend of the privacy controls requested in #148.

Adds a new opt-in feature that scans hook event payloads for secret-like values and replaces them with [REDACTED] before the event is written to SQLite or broadcast over WebSocket.

What's included

File	Change
server/lib/privacy-filter.js	New module — redactPayload(), isRedactionEnabled(), PATTERNS
server/__tests__/privacy-filter.test.js	28 unit tests — all passing
server/routes/hooks.js	Integrate redaction between cwd-filter check and processEvent()
.env.example	Document MONITOR_PRIVACY_REDACT variable

Activation

# .env
MONITOR_PRIVACY_REDACT=true

Off by default — zero impact to existing deployments.

Built-in detectors (no external dependencies)

• SDK key prefixes: sk-*, sk-ant-*, ghp_*, github_pat_*, xoxb-*, xoxp-*, AIza*, ya29.*
• AWS access keys: AKIA*, ASIA*, AROA* (20-char format)
• PEM private key blocks: RSA, EC, DSA, OPENSSH
• Bearer tokens in header-like strings
• URL credentials (user:pass@host)
• Generic assignments: api_key=, secret_key=, access_token=, auth_token=

Safety guarantees

• Structural routing fields preserved: session_id, hook_event_id, cwd are never touched
• Fail-safe: redaction is guarded by isRedactionEnabled() — a misconfigured env var cannot break ingestion
• Redacted count surfaced: the /api/hooks/event response includes "redactedCount": N when N > 0, enabling future observability without exposing original values
• No external deps: pure Node.js built-ins only

Not included (out of scope for this PR)

• Settings UI for rule CRUD (Feature: Configurable privacy controls for hook payload ingestion #148 scope item — left for a follow-up)
• Hash / drop-event-payload actions (module is structured to extend)
• Historical rewrite of existing events

Tests

node --test server/__tests__/privacy-filter.test.js
# ℹ tests 28 | pass 28 | fail 0

Closes #148 (partial — backend module; UI to follow)

[gemini-code-assist]

Code Review

This pull request introduces Russian documentation, an ingest-time working directory ignore filter via MONITOR_IGNORE_CWD, and an opt-in privacy redaction filter via MONITOR_PRIVACY_REDACT to mask secrets in hook event payloads. Feedback suggests preserving the transcript_path field from redaction to avoid breaking subsequent server operations, and optimizing the secret-matching logic by trimming string values once before iterating through patterns.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The transcript_path property is a critical structural field used by the server to locate and parse session transcripts (e.g., for token extraction, compaction tracking, and watchdog checks). If the file path happens to contain a substring that matches any of the generic secret patterns (such as a directory named api_key or secret_key), the entire transcript_path will be redacted to [REDACTED]. This will cause subsequent transcript-reading operations to fail.\n\nAdditionally, skipping secret matching for transcript_path avoids unnecessary regex evaluations on file path strings.\n\nPlease add transcript_path to the list of preserved structural keys.

Suggested change

	if (key === "session_id" || key === "hook_event_id" || key === "cwd") {
	if (key === "session_id" || key === "hook_event_id" || key === "cwd" || key === "transcript_path") {

[gemini-code-assist]

In matchSecret, value.trim() is called inside the loop for every pattern where scan is false. Since there are multiple such patterns (e.g., sdk-key-prefix and aws-key), this results in redundant string trimming and memory allocations on every check.\n\nTrimming the string once before the loop improves performance and reduces garbage collection overhead.

Suggested change

	function matchSecret(value) {
	if (typeof value !== "string" || value.length < 8) return null;
	for (const { name, pattern, scan } of PATTERNS) {
	if (scan ? pattern.test(value) : pattern.test(value.trim())) return name;
	}
	return null;
	}
	function matchSecret(value) {
	if (typeof value !== "string" || value.length < 8) return null;
	const trimmed = value.trim();
	for (const { name, pattern, scan } of PATTERNS) {
	if (scan ? pattern.test(value) : pattern.test(trimmed)) return name;
	}
	return null;
	}

[Mukller]

I have read the CLA Document and I hereby sign the CLA