fix: prevent redaction false positives for token-like values

[kjanat]

This pull request improves the detection and redaction logic for secrets and tokens, making it both stricter and more accurate. It ensures that only valid tokens are redacted (not just by their prefixes), improves JWT shape validation, and expands the list of trivial values that should not be redacted. Several new and updated tests demonstrate the improved handling of common prefix collisions and edge cases.

Detection logic improvements:

• Token redaction now requires both a known prefix and a sufficiently long, valid body in the correct alphabet, preventing accidental redaction of variables that merely share a prefix (e.g., npm_command or npm_lifecycle_event are no longer redacted, but real tokens like npm_Pw6... are).
• JWT detection is stricter: a value must have three dotted segments, and the first two must be valid base64url-encoded JSON objects (start with ey) to be considered a JWT, preventing false positives on ordinary identifier chains [1] [2].

Handling of trivial and non-secret values:

• The list of trivial words that are never redacted now includes read and write, covering common permission scopes.
• Documentation and test cases clarify that values like id-token: write and short numerics are not secrets and remain visible [1] [2].

Test suite enhancements:

• Added new test cases to verify that only true tokens are redacted and that variables with common prefixes are left untouched [1] [2] [3].
• Updated documentation to explain the improved detection rules and rationale behind them.

These changes make the redaction process more robust, reducing false positives and ensuring that only actual secrets are masked.

[coderabbitai]

📝 Walkthrough

Improve secret and token detection accuracy.

Require recognised token prefixes, valid character alphabets, and issuer-specific minimum lengths before redaction. Tighten JWT detection to require three segments with base64url-encoded JSON headers and claims. Preserve read, write, and common npm variable values. Add documentation and regression tests for prefix collisions, JWTs, permission scopes, and embedded tokens.

Walkthrough

The redaction engine now validates known token prefixes against minimum lengths and issuer-specific alphabets. It recognises sk- tokens, requires JWT header and claims segments to begin with ey, and treats read and write as trivial values. New fixtures cover CI configuration, npm environment variables, token-prefix collisions, JWTs, bearer tokens, and unchanged token-like values. The README documents these rules.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• kjanat/envctl#2: Related to environment-derived redaction behaviour in src/redact.c.
• kjanat/envctl#4: Directly related to token-prefix detection and overlapping fixture coverage.
• kjanat/envctl#5: Related to secret-value detection changes in src/redact.c.

Poem

Ahoy, false positives, walk the plank,
ey marks JWTs; short tokens sank.
read and write now pass the gate,
True secrets meet their masked fate.
Cleaner redaction sails ahead.

🚥 Pre-merge checks | ✅ 6 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Changelog Update	⚠️ Warning	The PR modifies source code in src/redact.c, but CHANGELOG.md is absent and therefore was not updated under Unreleased.	Add CHANGELOG.md with an entry under ## [Unreleased] describing the token, JWT, and trivial-value detection changes.
Semver Version Bump Validation	⚠️ Warning	src/redact.c contains functional changes, but no recognised version file exists in either base or PR, so no SemVer version bump is present.	Add a recognised version file or update the project’s recognised version field with a SemVer PATCH increment for these bug fixes.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title Check	✅ Passed	Title check skipped as CodeRabbit has written the PR title.
Agents.Md Documentation Updated	✅ Passed	No AGENTS.md file exists in the repository, so the documentation-update requirement is not applicable.
Description check	✅ Passed	The description directly matches the changes to token validation, JWT detection, trivial values, documentation, and tests.

---

_{Comment @coderabbitai help to get the list of available commands.}