fix(secret-scrub): keep query tails and ordinary key fields

Author: TheGreatAxios

src/plugins/tool-result-secret-scrub.test.ts

@@ -234,6 +234,59 @@ describe("bare-KEY names in JSON paths", () => {
   });
 });
 
+describe("query secrets keep characters after quotes", () => {
+  test("does not leave a tail after a quote in password, api_key, or token", () => {
+    for (const name of ["password", "api_key", "token"] as const) {
+      for (const quote of ["'", '"'] as const) {
+        const text = `GET https://provider.invalid/v1?${name}=p${quote}LEAKTAIL&format=json`;
+        const out = scrubSecretShapedContent(text);
+        expect(out).toBe(
+          `GET https://provider.invalid/v1?${name}=${CREDENTIAL_REDACTION}&format=json`,
+        );
+        expect(out).not.toContain("LEAKTAIL");
+      }
+    }
+  });
+});
+
+describe("storage key names stay readable", () => {
+  test("keeps partition, sort, primary, cache, and prompt_cache keys", () => {
+    const value = {
+      partition_key: "tenant",
+      sort_key: 2,
+      primary_key: ["id"],
+      cache_key: [1, 2],
+      prompt_cache_key: 9,
+      OPENAI_KEY: "sk-live-abc123",
+      api_key: ["still-secret"],
+    };
+    expect(scrubSecretShapedValue(value)).toEqual({
+      partition_key: "tenant",
+      sort_key: 2,
+      primary_key: ["id"],
+      cache_key: [1, 2],
+      prompt_cache_key: 9,
+      OPENAI_KEY: CREDENTIAL_REDACTION,
+      api_key: CREDENTIAL_REDACTION,
+    });
+
+    const text =
+      '{"partition_key":"tenant","sort_key":2,"primary_key":["id"],"cache_key":[1],"prompt_cache_key":"sess","OPENAI_KEY":"sk-live-abc123","api_key":"still-secret"}';
+    const scrubbed = scrubSecretShapedContent(text);
+    expect(scrubbed).toContain('"partition_key":"tenant"');
+    expect(scrubbed).toContain('"sort_key":2');
+    expect(scrubbed).toContain('"primary_key":["id"]');
+    expect(scrubbed).toContain('"cache_key":[1]');
+    expect(scrubbed).toContain('"prompt_cache_key":"sess"');
+    expect(scrubbed).not.toContain("sk-live-abc123");
+    expect(scrubbed).not.toContain("still-secret");
+
+    const query =
+      "GET https://provider.invalid/v1?sort_key=created_at&partition_key=tenant&format=json";
+    expect(scrubSecretShapedContent(query)).toBe(query);
+  });
+});
+
 describe("bare-KEY names in query parameters", () => {
   test("redacts ?OPENAI_KEY= among benign params, adjacent params survive", () => {
     const text =

src/plugins/tool-result-secret-scrub.ts

@@ -18,11 +18,24 @@ const API_KEY_PATTERNS: RegExp[] = [
   /\bBasic\s+[a-zA-Z0-9+/]{8,}={0,2}/g,
 ];
 
-const SECRET_QUERY_PARAMETER =
-  /([?&](?:api[_-]?key|access[_-]?token|token|password|secret|credential|[^&#\s='"]*_key)=)(?!\[redacted: looks like a credential\])[^&#\s"']+/gi;
-
-const JSON_CREDENTIAL_FIELD =
-  /("(?:api[_-]?key|access[_-]?token|token|password|secret|credential|authorization|[^"]+_key)"\s*:\s*")([^"\r\n]+)(")/gi;
+// A *_key name is a credential only when a secret marker is its own
+// underscore-separated segment (api_key, MY_API_KEY, private_key, OPENAI_KEY).
+// Storage roles such as partition_key, sort_key, primary_key, cache_key, and
+// prompt_cache_key have no such segment, so they stay. Marker-free vendor keys
+// are left alone on purpose: missing a rare key beats wiping database keys.
+const CREDENTIAL_KEY_MARKER =
+  "api|secret|private|access|auth|token|password|credential|openai";
+const MARKER_KEY_SUFFIX = `(?:[a-z0-9]+_)*(?:${CREDENTIAL_KEY_MARKER})_key`;
+
+const SECRET_QUERY_PARAMETER = new RegExp(
+  `([?&](?:api[_-]?key|access[_-]?token|token|password|secret|credential|${MARKER_KEY_SUFFIX})=)(?!\\[redacted: looks like a credential\\])[^&#\\s]+`,
+  "gi",
+);
+
+const JSON_CREDENTIAL_FIELD = new RegExp(
+  `("(?:api[_-]?key|access[_-]?token|token|password|secret|credential|authorization|${MARKER_KEY_SUFFIX})"\\s*:\\s*")([^"\\r\\n]+)(")`,
+  "gi",
+);
 
 // Grep/shell lines often look like path:line:KEY=value
 const ENV_ASSIGNMENT = /(?:^|:)([A-Z][A-Z0-9_]+)=([^\n]+)/gm;
@@ -76,11 +89,13 @@ export function scrubSecretShapedContent(text: string): string {
 }
 
 const JSON_SAFE_ERROR = "Tool result is not JSON-safe";
-// Bare-KEY class (OPENAI_KEY, MY_API_KEY): the underscore boundary keeps
-// MONKEY-style words out, and the required prefix keeps an ordinary field
-// named exactly "key" readable.
-const CREDENTIAL_FIELD =
-  /^(?:api[_ -]?key|access[_ -]?token|token|password|secret|credential|authorization|auth|.+_key)$/i;
+// Bare-KEY class (OPENAI_KEY, MY_API_KEY). The marker segment keeps storage
+// roles (partition_key, sort_key, cache_key) readable, and requiring _key
+// keeps MONKEY and a field named exactly "key" readable.
+const CREDENTIAL_FIELD = new RegExp(
+  `^(?:api[_ -]?key|access[_ -]?token|token|password|secret|credential|authorization|auth|${MARKER_KEY_SUFFIX})$`,
+  "i",
+);
 
 /**
  * Returns a detached JSON-safe value without invoking input accessors or custom