fix(claude-code): narrow PostToolUse hook matcher from .* to Bash|Write|Edit|MultiEdit (sable-h0ah)

[Rome-1]

Problem

rafter agent init --with-claude-code (and rafter agent enable claude-code.hooks) registered the rafter hook posttool secret-redaction hook with a catch-all .* matcher. That fires rafter hook posttool after every Claude Code tool call — including Read and MCP tools, which never produce secrets to redact — adding latency to every operation for every rafter-cli user. posttool was designed for shell output + file writes.

Fix

Narrow the Claude Code PostToolUse matcher from .* to Bash|Write|Edit|MultiEdit — the tools whose output is actually worth scanning (shell output + file writes). PreToolUse matchers (Bash, Write|Edit) are unchanged.

Changed in both install paths per language for parity:

• Node: src/commands/agent/init.ts (init/legacy) + src/commands/agent/components.ts (component spec)
• Python: rafter_cli/commands/agent.py (legacy) + rafter_cli/commands/agent_components.py (component spec)

Docs (SKILL.md, shared-docs/PLATFORM_PARITY_AUDIT.md, CHANGELOG.md) and test expectations updated. A PostToolUse-matcher assertion was added to the Python install test to mirror existing Node coverage.

Scope

Claude Code only. Codex (.* PostToolUse) and Gemini (.* AfterTool) have the same broad-matcher latency issue but need platform-correct tool names (Codex Bash|apply_patch, Gemini run_shell_command|write_file|replace|edit) — tracked separately in sable-4alt, not touched here.

Security review

This is rafter's own install path, so it went through rafter-code-review:

• The change is a hardcoded literal-string swap — no user input, no new path/secret/shell handling. No injection/traversal/proto-pollution surface. The new matcher is a flat literal alternation (no ReDoS) and strictly more restrictive than .*.
• Tradeoff (deliberate, documented): the redaction hook no longer fires on Read/MCP outputs — a reduction in defense-in-depth breadth. Acceptable because the actual security control (PreToolUse command interception) is untouched, and redaction still covers the highest-value channels (shell output + file writes). If MCP-output redaction is later wanted, it should return as a targeted matcher, never .*.
• rafter secrets . is clean for this diff (the 106 repo hits are intentional test fixtures). Remote rafter run (SAST/SCA) was not run here — RAFTER_API_KEY is unset in this environment; please let CI / the merger run it.

Testing

• Affected Node files (agent-compatibility, platform-integration): 132 passed.
• Affected Python files (test_agent_init, test_agent_components, test_suppression): 112 passed.
• TypeScript build (tsc): clean. Ruff: zero new errors from this diff.
• Full suites are green except two pre-existing failures unrelated to this change (verified via git stash — they fail without this diff too), tracked in sable-6udz: a Node AuditLogger test (error-handling-gauntlet.test.ts) and a Python version-match test that invokes a stale global rafter binary.

Closes sable-h0ah.

🤖 Generated with Claude Code