Redact instead of block

Blocking a dangerous call is the obvious move. The more interesting one is rewriting it.

What follows is an alternative to the one you just built. A teammate ran a curl against the orders API with a live key pasted straight into the command, and it landed in the shell logs. You want commands like that to keep working, just without the key sitting in them.

A PreToolUse hook can return updatedInput to rewrite a call instead of refusing it. A fresh skeleton is waiting at hooks/redact-secrets.js: it already reads the tool call and spots the key, but it returns nothing. Your .claude/settings.json starts empty here, so you will wire this one up from scratch.