Make the copied-secret ignore rules user-configurable #5

New issue

Closed

opened 2026-09-09 09:09:31 +08:00 by Breadway · 2 comments

Breadway commented 2026-09-09 09:09:31 +08:00

Owner

Copy link

Broken out from ECO-15 (bread-ecosystem audit, 2026-09-05). Verified still open on main as of 2026-09-09.

breadclipd/src/ignore_rules.rs is a fixed is_sensitive(&text) heuristic (one-time codes, Luhn-valid card numbers, private key blocks, password: lines, known API token prefixes). CLIP-3's PR body notes the original spec called for user-configurable match rules (MIME, app, regex, documented in EVENTS.md); what shipped is the fixed heuristic with no config surface, described as simpler and documented as such.

breadclip-core's Config today is just retention, panel_width, capture_primary (breadclip-core/src/config.rs). Add an [ignore] section so users can:

• add patterns (for example an internal ticket-ID format, or a host-specific token shape), and
• relax or disable a built-in rule that trips a false positive (an internal ID that happens to be Luhn-valid, an OTP-shaped confirmation code the user genuinely wants on the clipboard).

Follow bread-utils' non-destructive TOML discipline that the rest of the config already uses. Keep the built-in heuristic as the default when the section is absent.

Broken out from ECO-15 (bread-ecosystem audit, 2026-09-05). Verified still open on main as of 2026-09-09. `breadclipd/src/ignore_rules.rs` is a fixed `is_sensitive(&text)` heuristic (one-time codes, Luhn-valid card numbers, private key blocks, `password:` lines, known API token prefixes). CLIP-3's PR body notes the original spec called for user-configurable match rules (MIME, app, regex, documented in `EVENTS.md`); what shipped is the fixed heuristic with no config surface, described as simpler and documented as such. `breadclip-core`'s `Config` today is just `retention`, `panel_width`, `capture_primary` (`breadclip-core/src/config.rs`). Add an `[ignore]` section so users can: - add patterns (for example an internal ticket-ID format, or a host-specific token shape), and - relax or disable a built-in rule that trips a false positive (an internal ID that happens to be Luhn-valid, an OTP-shaped confirmation code the user genuinely wants on the clipboard). Follow bread-utils' non-destructive TOML discipline that the rest of the config already uses. Keep the built-in heuristic as the default when the section is absent.

Breadway added the

enhancement

label 2026-09-09 09:09:32 +08:00

Breadway referenced this issue from a commit 2026-09-09 19:52:24 +08:00

feat(ignore): make the copied-secret rules user-configurable

Breadway referenced this issue from a pull request that will close it, 2026-09-09 19:53:43 +08:00

Make the copied-secret ignore rules user-configurable #6

Breadway commented 2026-09-09 19:55:39 +08:00

Author

Owner

Copy link

PR: #6

Added an [ignore] section to config.toml with two lists:

• patterns: extra regexes; matching text is treated as sensitive and never persisted. Invalid patterns are logged and skipped.
• disable: built-in rule names to switch off (private_key, credential_line, otp, card_number, api_token).

An absent section leaves the built-in heuristic byte-for-byte unchanged (Ruleset::default()). is_sensitive is now a method on a Ruleset compiled from config once per capture event. Parsing uses the same non-destructive toml_edit path as the rest of the config. New regex dep in breadclipd.

Verified: cargo build --workspace + --release --locked, cargo test --workspace --locked (all pass, incl. new parsing / pattern / disable / invalid-pattern tests), cargo clippy --workspace --all-targets --locked -- -D warnings clean. Docs updated in README, contrib/config.toml.example, and module comments.

One choice worth a look in review: the config keys are patterns and disable (the issue left the exact schema open).

PR: https://git.breadway.dev/Breadway/breadclip/pulls/6 Added an `[ignore]` section to `config.toml` with two lists: - `patterns`: extra regexes; matching text is treated as sensitive and never persisted. Invalid patterns are logged and skipped. - `disable`: built-in rule names to switch off (`private_key`, `credential_line`, `otp`, `card_number`, `api_token`). An absent section leaves the built-in heuristic byte-for-byte unchanged (`Ruleset::default()`). `is_sensitive` is now a method on a `Ruleset` compiled from config once per capture event. Parsing uses the same non-destructive `toml_edit` path as the rest of the config. New `regex` dep in `breadclipd`. Verified: `cargo build --workspace` + `--release --locked`, `cargo test --workspace --locked` (all pass, incl. new parsing / pattern / disable / invalid-pattern tests), `cargo clippy --workspace --all-targets --locked -- -D warnings` clean. Docs updated in README, `contrib/config.toml.example`, and module comments. One choice worth a look in review: the config keys are `patterns` and `disable` (the issue left the exact schema open).

Breadway closed this issue 2026-09-11 11:01:33 +08:00

Breadway commented 2026-09-11 11:01:42 +08:00

Author

Owner

Copy link

Reviewed and merged (squash, PR #6).

Acceptance criteria: (1) add an [ignore] section for extra patterns and rule disabling, (2) follow bread-utils' non-destructive TOML discipline, (3) keep the built-in heuristic as default when the section is absent. All three are met: IgnoreConfig.patterns/disable on Config, parsed through the same toml_edit DocumentMut path, Ruleset::default() byte-for-byte the old behavior. Tests assert actual classification outcomes (a given text plus config disables/adds a rule and is_sensitive reflects it), not just structure. CI green, no conflicts. Clean work.

Reviewed and merged (squash, PR #6). Acceptance criteria: (1) add an [ignore] section for extra patterns and rule disabling, (2) follow bread-utils' non-destructive TOML discipline, (3) keep the built-in heuristic as default when the section is absent. All three are met: IgnoreConfig.patterns/disable on Config, parsed through the same toml_edit DocumentMut path, Ruleset::default() byte-for-byte the old behavior. Tests assert actual classification outcomes (a given text plus config disables/adds a rule and is_sensitive reflects it), not just structure. CI green, no conflicts. Clean work.

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

fix/eco-83-check-checkout-isolation

feature/breadbug-pilot

fix/clip-17-rc-cache-cleanup

v0.3.0

v0.3.0-rc.1

v0.2.4

v0.2.3

v0.2.2

v0.2.1

v0.2.0

v0.1.1

v0.1.0

Labels

Clear labels   

ci

  

enhancement

No labels

ci

enhancement

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Breadway/breadclip#5

No description provided.