sponge_filter_secrets
Synopsis
Section titled “Synopsis”sponge_filter_secrets <command> <exit_code> <previously_in_history>Description
Section titled “Description”Custom sponge filter that prevents commands from being stored in history when they contain the literal value of any exported environment variable whose name indicates it holds a credential (TOKEN, PASSWORD, SECRET, API_KEY, etc.). This catches shell-expansion leakage where a variable value is embedded directly in the command string at execution time — a case that static regex patterns cannot cover.
Any variable whose name matches the sensitive-name heuristic and whose value is longer than 8 characters is checked. List-valued variables are handled: every element is checked. Values that are an existing file or directory path (a leading ~/ is expanded) are skipped; a value that merely starts with / or ~ but is not an existing path is still treated as a credential. The value is escaped for literal regex matching before comparison.
The sensitive-name heuristic is shared with the session-start registration (conf.d/sponge_privacy.fish) and includes any extra names listed in $__fish_sponge_extra_sensitive.
Arguments
Section titled “Arguments”command |
The exact command that was entered |
exit_code |
Exit code of the command (unused) |
previously_in_history |
“true”/“false” flag (unused) |
Exit Status
Section titled “Exit Status”0 |
Command contains a secret value — filter out of history |
1 |
No secret value found — keep in history |
Example
Section titled “Example”# Register with sponge (done automatically by conf.d/sponge_privacy.fish):set -U -a sponge_filters sponge_filter_secretsDependencies: __fish_sponge_sensitive_pattern