fix: keep outbound redaction on regex path (#4)

Co-authored-by: hanhui <hanhui@bytedance.com>

Author: hanhuihanhui

package-lock.json

@@ -1,6 +1,5 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { env } from "@xenova/transformers";
 
 import type { Entity } from "../types.js";
 import { canonicalType } from "../types.js";
@@ -53,7 +52,7 @@ function toAbsolutePath(value: string): string {
 }
 
 function getModelCacheDir(): string {
-  return env.localModelPath ?? path.join(process.cwd(), ".cache");
+  return process.env.TRANSFORMERS_CACHE ?? path.join(process.cwd(), ".cache");
 }
 
 function sanitizeModelReference(modelPath: string): string {

src/engines/gliner.ts

@@ -26,6 +26,16 @@ const PATTERNS: PatternDef[] = [
     pattern:
       /\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|(?:(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4})|(?:3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}))\b/g,
   },
+  {
+    label: "SECRET",
+    pattern:
+      /(?<![A-Za-z0-9_])(?:secret|client[_-]?secret|app[_-]?secret|appSecret|password|passwd|pwd|private[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9._~+/=\-]{8,}["']?/gi,
+  },
+  {
+    label: "TOKEN",
+    pattern:
+      /(?<![A-Za-z0-9_])(?:token|access[_-]?token|refresh[_-]?token|api[_-]?key|authorization)\s*[:=]\s*["']?(?:Bearer\s+)?[A-Za-z0-9._~+/=\-]{8,}["']?/gi,
+  },
   {
     label: "IP_ADDRESS",
     pattern:

src/engines/regex.ts

@@ -1,9 +1,9 @@
 /**
  * Async message_sending hook handler for FogClaw.
  *
- * Scans outbound message text for PII using the full Scanner
- * (regex + GLiNER), redacts detected entities, and returns
- * modified content. Never cancels message delivery.
+ * Scans outbound message text for PII using the Scanner's regex-only path,
+ * redacts detected entities, and returns modified content. Never cancels
+ * message delivery.
  *
  * Note: message_sending is defined in OpenClaw but not yet invoked
  * upstream. This handler activates automatically when wired.
@@ -40,9 +40,8 @@ export interface MessageSendingResult {
 /**
  * Create an async message_sending hook handler.
  *
- * Uses the full Scanner (regex + GLiNER) since this hook supports
- * async handlers. All guardrail modes produce span-level redaction;
- * cancel is never returned.
+ * Uses regex only to keep final reply delivery fast. All guardrail modes
+ * produce span-level redaction; cancel is never returned.
  */
 export function createMessageSendingHandler(
   config: FogClawConfig,
@@ -57,7 +56,7 @@ export function createMessageSendingHandler(
     const text = event.content;
     if (!text) return;
 
-    const result = await scanner.scan(text);
+    const result = scanner.scanRegexOnly(text);
     if (result.entities.length === 0) return;
 
     // All modes produce span-level redaction for outbound messages.

src/message-sending-handler.ts

@@ -81,6 +81,13 @@ export class Scanner {
     return { entities: merged, text };
   }
 
+  scanRegexOnly(text: string): { entities: Entity[]; text: string } {
+    if (!text) return { entities: [], text };
+
+    const entities = deduplicateEntities(this.filterByPolicy(this.regexEngine.scan(text)));
+    return { entities, text };
+  }
+
   private filterByConfidence(entities: Entity[]): Entity[] {
     return entities.filter((entity) => {
       const threshold = this.getThresholdForLabel(entity.label);

src/scanner.ts

@@ -79,6 +79,42 @@ describe("createMessageSendingHandler", () => {
     expect(result!.content).not.toContain("john@example.com");
   });
 
+  it("uses regex-only scanning to keep outbound delivery fast", async () => {
+    const config = makeConfig();
+    const scanner = new Scanner(config);
+    const fullScan = vi.spyOn(scanner, "scan").mockRejectedValue(new Error("GLiNER path should not run"));
+    const handler = createMessageSendingHandler(config, scanner);
+
+    const result = await handler(
+      { to: "user", content: "Send to john@example.com" },
+      makeCtx(),
+    );
+
+    expect(result).toBeDefined();
+    expect(result!.content).toContain("[EMAIL_1]");
+    expect(fullScan).not.toHaveBeenCalled();
+  });
+
+  it("redacts secrets and tokens in outbound message", async () => {
+    const config = makeConfig();
+    const scanner = new Scanner(config);
+    const handler = createMessageSendingHandler(config, scanner);
+
+    const result = await handler(
+      {
+        to: "user",
+        content: "secret=abcDEF123456 token: Bearer tok_1234567890",
+      },
+      makeCtx(),
+    );
+
+    expect(result).toBeDefined();
+    expect(result!.content).toContain("[SECRET_1]");
+    expect(result!.content).toContain("[TOKEN_1]");
+    expect(result!.content).not.toContain("abcDEF123456");
+    expect(result!.content).not.toContain("tok_1234567890");
+  });
+
   it("returns void when no PII found", async () => {
     const config = makeConfig();
     const scanner = new Scanner(config);

tests/message-sending-handler.test.ts

@@ -168,6 +168,28 @@ describe("CREDIT_CARD", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// SECRET / TOKEN
+// ---------------------------------------------------------------------------
+describe("SECRET", () => {
+  it("detects assigned secrets", () => {
+    const entities = assertSpans("client_secret=abcDEF123456 and password: hunter2222");
+    const secrets = entities.filter((e) => e.label === "SECRET");
+    expect(secrets.map((e) => e.text)).toEqual(["client_secret=abcDEF123456", "password: hunter2222"]);
+  });
+});
+
+describe("TOKEN", () => {
+  it("detects assigned tokens and bearer values", () => {
+    const entities = assertSpans("token: Bearer tok_1234567890 api-key=key_1234567890");
+    const tokens = entities.filter((e) => e.label === "TOKEN");
+    expect(tokens.map((e) => e.text)).toEqual([
+      "token: Bearer tok_1234567890",
+      "api-key=key_1234567890",
+    ]);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // IP_ADDRESS
 // ---------------------------------------------------------------------------