sponge_filter_secrets

Usage

sponge_filter_secrets <command> <exit_code> <previously_in_history>

Custom sponge filter that prevents commands from being stored in history
when they contain the literal value of any exported environment variable
whose name indicates it holds a credential (TOKEN, PASSWORD, SECRET,
API_KEY, etc.).  This catches shell-expansion leakage where a variable
value is embedded directly in the command string at execution time — a
case that static regex patterns cannot cover.

Any variable whose name matches the sensitive-name heuristic and whose value is longer than 8 characters (excluding bare paths) is checked. The value is escaped for literal regex matching before comparison.

Arguments:

command	The exact command that was entered
exit_code	Exit code of the command (unused)
previously_in_history	“true”/“false” flag (unused)

Exit Status:

0	Command contains a secret value — filter out of history
1	No secret value found — keep in history

Examples

# Register with sponge (done automatically by conf.d/sponge_privacy.fish):
set -U -a sponge_filters sponge_filter_secrets