Function generateRedactTaxonomyTable

scripts/resolvers/redact-doc.ts:66–100

(_ctx: TemplateContext, args?: string[])

};

export function generateRedactTaxonomyTable(_ctx: TemplateContext, args?: string[]): string {
  // Compact mode: HIGH-tier rows only (the credentials that BLOCK), one line of
  // prose for MEDIUM/LOW. For skills that RUN redaction (e.g. /spec) but aren't
  // the security catalog — they need to know what blocks + where the full list
  // is, not inline all ~30 patterns. /cso renders the full table.
  const compact = args?.[0] === 'compact';
  const out: string[] = [];

  const tiers: Tier[] = compact ? ['HIGH'] : ['HIGH', 'MEDIUM', 'LOW'];
  for (const tier of tiers) {
    out.push(`**${TIER_BLURB[tier]}**`, '');
    out.push('| ID | Catches | Example |');
    out.push('|----|---------|---------|');
    for (const p of PATTERNS.filter((x) => x.tier === tier)) {
      out.push(`| \`${p.id}\` | ${p.description} | ${EXAMPLE[p.id] ?? '—'} |`);
    }
    out.push('');
  }

  if (compact) {
    out.push(
      'MEDIUM (PII / legal / internal + high-FP credential shapes like ' +
        '`pk_live_`/`AIza`/JWT/`*_KEY=`) confirms via AskUserQuestion; LOW surfaces ' +
        'as an FYI. Full taxonomy: `lib/redact-patterns.ts` (or `/cso`).',
    );
  } else {
    out.push(
      'Calibration: a gate that cries wolf gets ignored, so context-variable / ' +
        'high-FP credential shapes (Stripe publishable `pk_live_`, Google `AIza`, ' +
        'JWTs, env-style `*_KEY=`) sit at MEDIUM, not HIGH. The full taxonomy lives ' +
        'in `lib/redact-patterns.ts` and this table is generated from it.',
    );
  }
  return out.join('\n');
}

// ── Invocation block (scan-at-sink) ──────────────────────────────────────────