feat: redact tool output + securitylog/verify/governance/learn CLI - #181
Merged
Conversation
…vernance/learn CLI - Redact tool results before they reach the model (closes confirmed exfiltration gap: hawk only redacted the final assistant response). OutputRedactor.RegisterEnvSecrets imports process env secrets; tool output is redacted via Redact/RedactEnvVars/RedactPaths at the model round-trip chokepoint in stream.go. - Wire the tamper-evident security event log (securitylog) into the engine: permission/approval denials are recorded to the hash-chained SEL (internal/engine/security_events.go). Add securitylog.DefaultDir/Entries. - Add CLI: hawk securitylog show|verify, hawk verify (self-check: SEL chain integrity + managed governance policy validity), hawk governance show|validate|explain, hawk learn list|add|prompt|clear. - Wire LearnPrompt into buildReflectionPrompt (single source of truth for the failure-analysis prompt) so it is no longer dead code; add dedup + Clear to SelfImprover.
Patel230
force-pushed
the
feat/security-hygiene-cli
branch
from
August 6, 2026 03:01
26c3782 to
c21fe18
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on to #180, implementing the four self-contained recommendations from the KiroCrew comparison:
1. Tool-output redaction (HIGH — confirmed gap)
hawk only redacted the final assistant response (PostResponse). Tool results fed
back to the model were un-redacted (stream.go), leaking any secret echoed by a
tool call back to the LLM. Now
redactToolResultruns tool output throughOutputRedactor (25+ patterns) + env-var secrets + home-path collapsing before
it is appended to RawMessages (the model round-trip).
OutputRedactor.RegisterEnvSecretsimport process env values of secret-named env vars (ghp_, sk-, etc.) so
echoed credentials are scrubbed.
2. securitylog CLI + SEL wiring (MED-HIGH)
PR #180 shipped the hash-chained SEL package but nothing wrote to it. Now:
internal/engine/security_events.go: permission/approval denials are appendedto the tamper-evident log via
recordPolicyObservation.securitylog.DefaultDir()/Entries()expose the log for inspection.hawk securitylog show|verifyandhawk verify(self-check: SEL chainintegrity + managed governance policy validity, folded in as requested).
4. governance CLI (MEDIUM)
hawk governance show|validate|explain <tool>surfaces the POLICY ∩ PROFILEengine.
explainrunsEvaluateand prints the deny/allow decision + reason.LoadLayeris exposed as a stable entry point.5. lessons wiring + CLI (MEDIUM)
LearnPromptis now the canonical failure-analysis prompt used bybuildReflectionPrompt(was dead code with zero callers; output formataligns with the existing WHAT_FAILED/WHY_FAILED/WHAT_TO_DO parser).
SelfImprover.Learnnow deduplicates exact repeats.SelfImprover.Clear()added;hawk learn list|add|prompt|clearCLI mirrorsKiroCrew's
kirocrew learn.Verified: go build ./..., go vet, golangci-lint, boundary scripts, and
go test ./internal/engine/... ./internal/securitylog/... ./internal/governance/... ./cmd/all green; manual binary smoke-test of each new command.
Note: #3 (background task executor) was scoped out of this PR — KiroCrew's
TaskRunner actually runs tasks, but hawk's TaskStore is store-only. Happy to
take that on separately as a larger feature.