From 7db0b89393c207d0a6fdeb7c072f9d5f8f06dbb7 Mon Sep 17 00:00:00 2001
From: hanhui <hanhui@bytedance.com>
Date: Wed, 3 Jun 2026 03:23:04 +0800
Subject: [PATCH] fix: keep outbound redaction on regex path

---
 package-lock.json                     |  4 +--
 src/engines/gliner.ts                 |  3 +--
 src/engines/regex.ts                  | 10 ++++++++
 src/message-sending-handler.ts        | 13 +++++-----
 src/scanner.ts                        |  7 ++++++
 tests/message-sending-handler.test.ts | 36 +++++++++++++++++++++++++++
 tests/regex.test.ts                   | 22 ++++++++++++++++
 7 files changed, 84 insertions(+), 11 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a58f329..24b2b72 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@datafog/fogclaw",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@datafog/fogclaw",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "license": "MIT",
       "dependencies": {
         "gliner": "^0.0.19",
diff --git a/src/engines/gliner.ts b/src/engines/gliner.ts
index 1c1f7ec..06d03a3 100644
--- a/src/engines/gliner.ts
+++ b/src/engines/gliner.ts
@@ -1,6 +1,5 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { env } from "@xenova/transformers";
 
 import type { Entity } from "../types.js";
 import { canonicalType } from "../types.js";
@@ -53,7 +52,7 @@ function toAbsolutePath(value: string): string {
 }
 
 function getModelCacheDir(): string {
-  return env.localModelPath ?? path.join(process.cwd(), ".cache");
+  return process.env.TRANSFORMERS_CACHE ?? path.join(process.cwd(), ".cache");
 }
 
 function sanitizeModelReference(modelPath: string): string {
diff --git a/src/engines/regex.ts b/src/engines/regex.ts
index 1560195..a2dee5c 100644
--- a/src/engines/regex.ts
+++ b/src/engines/regex.ts
@@ -26,6 +26,16 @@ const PATTERNS: PatternDef[] = [
     pattern:
       /\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|(?:(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2})[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4})|(?:3[47]\d{2}[-\s]?\d{6}[-\s]?\d{5}))\b/g,
   },
+  {
+    label: "SECRET",
+    pattern:
+      /(?<![A-Za-z0-9_])(?:secret|client[_-]?secret|app[_-]?secret|appSecret|password|passwd|pwd|private[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9._~+/=\-]{8,}["']?/gi,
+  },
+  {
+    label: "TOKEN",
+    pattern:
+      /(?<![A-Za-z0-9_])(?:token|access[_-]?token|refresh[_-]?token|api[_-]?key|authorization)\s*[:=]\s*["']?(?:Bearer\s+)?[A-Za-z0-9._~+/=\-]{8,}["']?/gi,
+  },
   {
     label: "IP_ADDRESS",
     pattern:
diff --git a/src/message-sending-handler.ts b/src/message-sending-handler.ts
index 5dd5db6..31f235d 100644
--- a/src/message-sending-handler.ts
+++ b/src/message-sending-handler.ts
@@ -1,9 +1,9 @@
 /**
  * Async message_sending hook handler for FogClaw.
  *
- * Scans outbound message text for PII using the full Scanner
- * (regex + GLiNER), redacts detected entities, and returns
- * modified content. Never cancels message delivery.
+ * Scans outbound message text for PII using the Scanner's regex-only path,
+ * redacts detected entities, and returns modified content. Never cancels
+ * message delivery.
  *
  * Note: message_sending is defined in OpenClaw but not yet invoked
  * upstream. This handler activates automatically when wired.
@@ -40,9 +40,8 @@ export interface MessageSendingResult {
 /**
  * Create an async message_sending hook handler.
  *
- * Uses the full Scanner (regex + GLiNER) since this hook supports
- * async handlers. All guardrail modes produce span-level redaction;
- * cancel is never returned.
+ * Uses regex only to keep final reply delivery fast. All guardrail modes
+ * produce span-level redaction; cancel is never returned.
  */
 export function createMessageSendingHandler(
   config: FogClawConfig,
@@ -57,7 +56,7 @@ export function createMessageSendingHandler(
     const text = event.content;
     if (!text) return;
 
-    const result = await scanner.scan(text);
+    const result = scanner.scanRegexOnly(text);
     if (result.entities.length === 0) return;
 
     // All modes produce span-level redaction for outbound messages.
diff --git a/src/scanner.ts b/src/scanner.ts
index 700e3a4..9f886df 100644
--- a/src/scanner.ts
+++ b/src/scanner.ts
@@ -81,6 +81,13 @@ export class Scanner {
     return { entities: merged, text };
   }
 
+  scanRegexOnly(text: string): { entities: Entity[]; text: string } {
+    if (!text) return { entities: [], text };
+
+    const entities = deduplicateEntities(this.filterByPolicy(this.regexEngine.scan(text)));
+    return { entities, text };
+  }
+
   private filterByConfidence(entities: Entity[]): Entity[] {
     return entities.filter((entity) => {
       const threshold = this.getThresholdForLabel(entity.label);
diff --git a/tests/message-sending-handler.test.ts b/tests/message-sending-handler.test.ts
index 66486ac..f7234d5 100644
--- a/tests/message-sending-handler.test.ts
+++ b/tests/message-sending-handler.test.ts
@@ -79,6 +79,42 @@ describe("createMessageSendingHandler", () => {
     expect(result!.content).not.toContain("john@example.com");
   });
 
+  it("uses regex-only scanning to keep outbound delivery fast", async () => {
+    const config = makeConfig();
+    const scanner = new Scanner(config);
+    const fullScan = vi.spyOn(scanner, "scan").mockRejectedValue(new Error("GLiNER path should not run"));
+    const handler = createMessageSendingHandler(config, scanner);
+
+    const result = await handler(
+      { to: "user", content: "Send to john@example.com" },
+      makeCtx(),
+    );
+
+    expect(result).toBeDefined();
+    expect(result!.content).toContain("[EMAIL_1]");
+    expect(fullScan).not.toHaveBeenCalled();
+  });
+
+  it("redacts secrets and tokens in outbound message", async () => {
+    const config = makeConfig();
+    const scanner = new Scanner(config);
+    const handler = createMessageSendingHandler(config, scanner);
+
+    const result = await handler(
+      {
+        to: "user",
+        content: "secret=abcDEF123456 token: Bearer tok_1234567890",
+      },
+      makeCtx(),
+    );
+
+    expect(result).toBeDefined();
+    expect(result!.content).toContain("[SECRET_1]");
+    expect(result!.content).toContain("[TOKEN_1]");
+    expect(result!.content).not.toContain("abcDEF123456");
+    expect(result!.content).not.toContain("tok_1234567890");
+  });
+
   it("returns void when no PII found", async () => {
     const config = makeConfig();
     const scanner = new Scanner(config);
diff --git a/tests/regex.test.ts b/tests/regex.test.ts
index 7a26271..5d7dcde 100644
--- a/tests/regex.test.ts
+++ b/tests/regex.test.ts
@@ -168,6 +168,28 @@ describe("CREDIT_CARD", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// SECRET / TOKEN
+// ---------------------------------------------------------------------------
+describe("SECRET", () => {
+  it("detects assigned secrets", () => {
+    const entities = assertSpans("client_secret=abcDEF123456 and password: hunter2222");
+    const secrets = entities.filter((e) => e.label === "SECRET");
+    expect(secrets.map((e) => e.text)).toEqual(["client_secret=abcDEF123456", "password: hunter2222"]);
+  });
+});
+
+describe("TOKEN", () => {
+  it("detects assigned tokens and bearer values", () => {
+    const entities = assertSpans("token: Bearer tok_1234567890 api-key=key_1234567890");
+    const tokens = entities.filter((e) => e.label === "TOKEN");
+    expect(tokens.map((e) => e.text)).toEqual([
+      "token: Bearer tok_1234567890",
+      "api-key=key_1234567890",
+    ]);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // IP_ADDRESS
 // ---------------------------------------------------------------------------