Context
src/services/agent-action-explanation-card.ts's PUBLIC_FORBIDDEN_PATTERN (lines 10-11), applied in sanitizePublicCardText (lines 122-130) to the only text this module ever exposes on the publicSafe card (summary/whyNow/rerunWhen), includes seed phrases?/mnemonics? but is missing private keys?.
Every other public-safe redaction vocabulary in this codebase includes it: control-panel-roles.ts:297, decision-pack.ts:1438, weekly-value-report.ts:417, extension-contributor-context.ts:31, and this module's closest sibling miner-dashboard-recommendations.ts:45. src/signals/redaction.ts:18-22's own doc comment even calls out that these two specific surfaces "keep their own... vocabularies... and extra terms like 'seed phrase'/'private key'" — but only miner-dashboard-recommendations.ts actually has private key in its list; agent-action-explanation-card.ts doesn't, despite the shared doc comment implying both do.
Concrete failure: an agent action's why/blockedBy text referencing an App-credential issue (a live topic elsewhere in this codebase — see src/github/app.ts's private-key-rotation handling) would pass through publicSafe.whyNow unredacted.
⚠️ Required pattern — read miner-dashboard-recommendations.ts:45's forbidden-term list (the sibling this module is supposed to match, per src/signals/redaction.ts:18-22's own doc comment) before starting. Add the same private keys? term to agent-action-explanation-card.ts's PUBLIC_FORBIDDEN_PATTERN — do not invent new wording.
Requirements
PUBLIC_FORBIDDEN_PATTERN in agent-action-explanation-card.ts must include private keys?, matching the term already present in miner-dashboard-recommendations.ts and the other four sibling redaction lists.
Deliverables
Test Coverage Requirements
src/** — 99%+ Codecov patch target, both branches. Mirror the existing "seed phrase"/"mnemonic" redaction test for the new "private key" case.
Expected Outcome
agent-action-explanation-card.ts's public-safe redaction vocabulary matches its documented sibling (miner-dashboard-recommendations.ts) and the other four redaction lists across the codebase, closing a gap where App-credential-adjacent text could reach the public card unredacted.
Links & Resources
src/services/agent-action-explanation-card.ts (lines 10-11, 122-130)src/services/miner-dashboard-recommendations.ts:45 (the sibling to match)src/signals/redaction.ts:18-22 (the doc comment describing both surfaces as sharing this extra vocabulary)
Context
src/services/agent-action-explanation-card.ts'sPUBLIC_FORBIDDEN_PATTERN(lines 10-11), applied insanitizePublicCardText(lines 122-130) to the only text this module ever exposes on thepublicSafecard (summary/whyNow/rerunWhen), includesseed phrases?/mnemonics?but is missingprivate keys?.Every other public-safe redaction vocabulary in this codebase includes it:
control-panel-roles.ts:297,decision-pack.ts:1438,weekly-value-report.ts:417,extension-contributor-context.ts:31, and this module's closest siblingminer-dashboard-recommendations.ts:45.src/signals/redaction.ts:18-22's own doc comment even calls out that these two specific surfaces "keep their own... vocabularies... and extra terms like 'seed phrase'/'private key'" — but onlyminer-dashboard-recommendations.tsactually hasprivate keyin its list;agent-action-explanation-card.tsdoesn't, despite the shared doc comment implying both do.Concrete failure: an agent action's
why/blockedBytext referencing an App-credential issue (a live topic elsewhere in this codebase — seesrc/github/app.ts's private-key-rotation handling) would pass throughpublicSafe.whyNowunredacted.Requirements
PUBLIC_FORBIDDEN_PATTERNinagent-action-explanation-card.tsmust includeprivate keys?, matching the term already present inminer-dashboard-recommendations.tsand the other four sibling redaction lists.Deliverables
private keys?added toPUBLIC_FORBIDDEN_PATTERN.publicSafecard fields the same way "seed phrase" already is.Test Coverage Requirements
src/**— 99%+ Codecov patch target, both branches. Mirror the existing "seed phrase"/"mnemonic" redaction test for the new "private key" case.Expected Outcome
agent-action-explanation-card.ts's public-safe redaction vocabulary matches its documented sibling (miner-dashboard-recommendations.ts) and the other four redaction lists across the codebase, closing a gap where App-credential-adjacent text could reach the public card unredacted.Links & Resources
src/services/agent-action-explanation-card.ts(lines 10-11, 122-130)src/services/miner-dashboard-recommendations.ts:45(the sibling to match)src/signals/redaction.ts:18-22(the doc comment describing both surfaces as sharing this extra vocabulary)