v0.3.8 — mask credential-shaped values out of Bash output

The guards already refused to read a secrets file and to commit a credential. This release closes the third path: a command that prints one.

What changed

guard-hooks 0.2.5 → 0.2.6 — new output-secret-mask.sh, a PostToolUse hook on Bash. After a command finishes it runs gitleaks' default rules over stdout and stderr and rewrites every credential-shaped value to [REDACTED] before the model sees the result (hookSpecificOutput.updatedToolOutput), with a one-line note so the agent treats the marker as deliberate. It never blocks and it fails open: no gitleaks, more than 2 MB of output, or an unexpected result shape means the output passes through untouched. Measured at about 30 ms per Bash call.

context-handoff and repo-gate are unchanged (0.1.4 / 0.1.5).

Why it matters

A cat of a config file, a printenv, or a verbose CLI that echoes its token used to leave the live value in the transcript for the rest of the session and in the session log on disk. Now only the masked copy reaches the model. Your terminal scrollback and any file the command wrote still hold the value — this masks the agent's copy, nothing else.

Upgrade

brew install gitleaks   # optional; without it the new hook is a silent no-op
claude plugin update guard-hooks@cc-agents-kit

Turn the hook off with CC_GUARD_DISABLE_OUTPUT_SECRET_MASK=1.