fix(security): redact reads of raven's own oauth token files

[akushonkamen]

Summary

A turn that read one of Raven's own OAuth token files handed the access and refresh tokens to the model, the session record and the provider's logs. The workspace false-positive fix in #833 exempted all of Raven's home from the home-dotfile pattern pass on the grounds that Raven's own keys are taken out by the exact-match pass over config.json -- but that pass reads config.json only (raven/config/held_secrets.py), so the token files under ~/.raven/oauth/<provider>/ are collected by neither pass.

This PR narrows the exemption in _home_config() (raven/security/redact.py) from Raven's whole home to the two places a coding turn reads its own source, the workspace and the scratch (tmp) directories, their backslash spellings and path boundary kept. The rest of Raven's home, the token store first, goes back under the pattern pass: a read of oauth/chatgpt/auth.json, oauth/github_copilot/access-token, oauth/minimax_global.json, or a cat of one, is redacted like another program's settings read. The _home_config() docstring, which said the exact-match pass already covers Raven's own keys, is corrected. The workspace and tmp directories stay exempt, so the false positives #833 fixed do not come back.

This is the fix suggested in #842, announced in my claim comment there.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• The issue's reproduction script, before this change: the oauth file came back unchanged while the codex file was redacted. After this change, the same script redacts both.

• timeout 600 uv run --frozen --all-extras pytest tests/test_security_untrusted_context.py -q: 25 passed, including the new test_ravens_own_oauth_tokens_are_redacted_like_another_programs (reads of oauth/chatgpt/auth.json, oauth/github_copilot/access-token, oauth/minimax_global.json and cat oauth/chatgpt/auth.json all come back redacted, while ls ~/.raven and a read outside the home stay unchanged) next to the existing feat: let raven read and change its own configuration #833 exemption tests.

• timeout 590 uv run --frozen --all-extras pytest tests -q --ignore=tests/manual: 28194 passed, 4 failed, 118 skipped. The 4 fail on this machine with the change stashed on a clean main too, so they are pre-existing and unrelated: an a2a_interop scheme case, test_rpc_files (LibreOffice is installed here), and the two simulation cases also listed in feat: let raven read and change its own configuration #833's verification notes.

• uv run --frozen python -m scripts.check_commit_messages main..HEAD: exit 0. uv run --frozen ruff check and uv run --frozen ruff format --check on the two changed files: pass. uv run --frozen lint-imports: 10 contracts kept, 0 broken.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

Risk

• Security impact: this is the fix. From this change on, a tool result that reaches into Raven's own token store loses its tokens before it reaches the model, the session record and the provider's logs. The workspace and tmp exemption stays, and reads whose arguments never reach the home are untouched, so no redaction noise appears outside Raven's home.

• Backward compatibility: no interface, config or stored-format change. The only behaviour change is that a read of Raven's own home outside workspace and tmp is now pattern-redacted, which is the protection the release before feat: let raven read and change its own configuration #833 never had and feat: let raven read and change its own configuration #833 intended to give.

• Rollback: revert the single commit; no migration, no data change.

• Security impact considered

• Backward compatibility considered

• Rollback path is clear for risky changes

Related Issues

Fixes #842