Make the copied-secret ignore rules user-configurable #6

Merged

Breadway merged 1 commit from feature/clip-5-configurable-ignore-rules into main

2026-09-11 11:01:33 +08:00

Breadway commented

2026-09-09 19:53:43 +08:00

Owner

Summary

is_sensitive in breadclipd/src/ignore_rules.rs was a fixed set of five heuristics with no config surface. This adds an [ignore] section to config.toml:

[ignore]
patterns = ['^ACME-\d{4,}\b']   # extra regexes to treat as sensitive
disable  = ["otp"]              # built-in rules to switch off, by name

patterns: extra regular expressions. Copied text matching any of them is treated as sensitive and never persisted (host- or org-specific secret shapes the built-ins do not know about). An invalid pattern is logged to stderr and skipped, never fatal.
disable: built-in rule names to switch off (private_key, credential_line, otp, card_number, api_token) for the case where a heuristic keeps tripping on something the user genuinely wants kept (an internal ID that is Luhn-valid, an OTP-shaped confirmation code, ...). An unknown name is logged and ignored.

An absent [ignore] section leaves the built-in heuristic exactly as before.

Changes

breadclip-core/src/config.rs: new IgnoreConfig { patterns, disable } on Config (drops the Copy derive, keeps Clone); a string_array helper reads a TOML string array, dropping a non-array value or non-string entries. Parsing stays on the same non-destructive toml_edit path as the rest of the config.
breadclipd/src/ignore_rules.rs: is_sensitive is now a method on a Ruleset compiled from IgnoreConfig (Ruleset::from_config). Ruleset::default() is byte-for-byte the old behaviour. Each built-in check is gated by its name so disable can turn it off; patterns are checked last. New regex dependency in breadclipd.
breadclipd/src/main.rs: the two capture paths take &Ruleset, built once per capture event in capture_once (alongside the existing per-event config::load()).
README.md, contrib/config.toml.example, module docs: document the new section.

Verification

cargo build --workspace and cargo build --release --locked
cargo test --workspace --locked: 31 breadclipd + 19 breadclip-core tests pass, including new tests for parsing, extra-pattern matching, rule disabling, invalid-pattern skipping, and unknown-name handling
cargo clippy --workspace --all-targets --locked -- -D warnings: clean
cargo fmt --all --check: my changes are clean (two pre-existing unrelated drift spots in main.rs tests left untouched; breadclip CI does not gate fmt)

Closes #5

## Summary `is_sensitive` in `breadclipd/src/ignore_rules.rs` was a fixed set of five heuristics with no config surface. This adds an `[ignore]` section to `config.toml`: ```toml [ignore] patterns = ['^ACME-\d{4,}\b'] # extra regexes to treat as sensitive disable = ["otp"] # built-in rules to switch off, by name ``` - `patterns`: extra regular expressions. Copied text matching any of them is treated as sensitive and never persisted (host- or org-specific secret shapes the built-ins do not know about). An invalid pattern is logged to stderr and skipped, never fatal. - `disable`: built-in rule names to switch off (`private_key`, `credential_line`, `otp`, `card_number`, `api_token`) for the case where a heuristic keeps tripping on something the user genuinely wants kept (an internal ID that is Luhn-valid, an OTP-shaped confirmation code, ...). An unknown name is logged and ignored. An absent `[ignore]` section leaves the built-in heuristic exactly as before. ## Changes - `breadclip-core/src/config.rs`: new `IgnoreConfig { patterns, disable }` on `Config` (drops the `Copy` derive, keeps `Clone`); a `string_array` helper reads a TOML string array, dropping a non-array value or non-string entries. Parsing stays on the same non-destructive `toml_edit` path as the rest of the config. - `breadclipd/src/ignore_rules.rs`: `is_sensitive` is now a method on a `Ruleset` compiled from `IgnoreConfig` (`Ruleset::from_config`). `Ruleset::default()` is byte-for-byte the old behaviour. Each built-in check is gated by its name so `disable` can turn it off; `patterns` are checked last. New `regex` dependency in `breadclipd`. - `breadclipd/src/main.rs`: the two capture paths take `&Ruleset`, built once per capture event in `capture_once` (alongside the existing per-event `config::load()`). - `README.md`, `contrib/config.toml.example`, module docs: document the new section. ## Verification - `cargo build --workspace` and `cargo build --release --locked` - `cargo test --workspace --locked`: 31 breadclipd + 19 breadclip-core tests pass, including new tests for parsing, extra-pattern matching, rule disabling, invalid-pattern skipping, and unknown-name handling - `cargo clippy --workspace --all-targets --locked -- -D warnings`: clean - `cargo fmt --all --check`: my changes are clean (two pre-existing unrelated drift spots in `main.rs` tests left untouched; breadclip CI does not gate fmt) Closes #5

Breadway added 1 commit

2026-09-09 19:53:43 +08:00

feat(ignore): make the copied-secret rules user-configurable

check / check (push) Successful in 25s

Details

322261b85f

The is_sensitive heuristic was a fixed set of five checks with no config
surface. Add an [ignore] section to config.toml:

- patterns: extra regular expressions; copied text matching any is
  treated as sensitive and never persisted (host- or org-specific secret
  shapes the built-ins do not know about). An invalid pattern is logged
  and skipped, never fatal.
- disable: built-in rule names to switch off (private_key,
  credential_line, otp, card_number, api_token) when one keeps tripping
  on something the user genuinely wants kept.

An absent [ignore] section leaves the built-in heuristic unchanged.
Parsing follows the same non-destructive toml_edit discipline as the
rest of the config. is_sensitive is now a method on a Ruleset built
from the config once per capture event.

Closes #5

Breadway referenced this pull request

2026-09-09 19:55:39 +08:00

Make the copied-secret ignore rules user-configurable #5

Breadway merged commit 045712e377 into main

2026-09-11 11:01:33 +08:00

Breadway deleted branch feature/clip-5-configurable-ignore-rules

2026-09-11 11:01:33 +08:00

Breadway referenced this pull request

2026-09-11 11:01:42 +08:00

Make the copied-secret ignore rules user-configurable #5