How to enforce secret redaction and credential hygiene in CodexMap atomic file writes?

[somuai]

How does the atomic.js and safeInside engine sanitize API tokens, AWS keys, and Bearer tokens before writing artifacts to disk?

[somuai]

Solution

CodexMap enforces atomic file writes and secret redaction through three complementary layers in lib/atomic.js:

1. Deterministic Secret Scrubbing (redactSecrets):
   Scans buffer streams and text payloads against strict patterns for:

• OpenAI API keys (sk-proj-..., sk-...)
• Anthropic API keys (sk-ant-...)
• Google Gemini keys (AIza...)
• GitHub Tokens (ghp_..., github_pat_...)
• AWS credentials (AKIA...)
• Authorization headers (Bearer ...)

2. Canonical Filesystem Containment (safeInside):
   Validates that target file descriptors reside strictly within the authorized root path using path.relative.

3. Crash-Safe Atomic Write:
   Writes to a staging file with a random suffix before performing an atomic rename via fs.promises.rename to prevent corrupted partial files.