Redact Message Text Before It's Shown in a Shared Terminal

A different control surface from logging: this is about what a human physically watching the terminal sees in real time — a screen-shared pairing session, a recorded demo — independent of whatever ends up in the transcript file afterward.

Notification & Escalation Routing Event: MessageDisplay Claude Code Open source · Free

1. Save this as the hook script

#!/usr/bin/env python3
"""MessageDisplay hook — masks secret/PII patterns in live-streamed
display text. Uses hookSpecificOutput.displayContent (display-only;
the transcript itself is unchanged)."""
import json, re, sys

data = json.load(sys.stdin)
text = data.get("message_text", "")

PATTERNS = [r"AKIA[0-9A-Z]{16}", r"sk-(ant|proj|live)-[A-Za-z0-9_-]{20,}",
            r"\b\d{3}-\d{2}-\d{4}\b"]

masked = text
changed = False
for p in PATTERNS:
    if re.search(p, masked):
        masked = re.sub(p, "[REDACTED]", masked)
        changed = True

if changed:
    print(json.dumps({
        "hookSpecificOutput": {"hookEventName": "MessageDisplay", "displayContent": masked}
    }))

sys.exit(0)

Save to a path inside your project, e.g. .claude/hooks/redact-message-shared-terminal.sh, then chmod +x it.

2. Wire it into .claude/settings.json

{
  "hooks": {
    "MessageDisplay": [
      {
        "hooks": [
          {"type": "command", "command": "python3 .claude/hooks/redact-message-shared-terminal.py"}
        ]
      }
    ]
  }
}

Before you use this

A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.

Related hooks

Route Permission-Prompt Notifications to a Webhook
Posts a permission_prompt notification to a configured webhook instead of leaving it only…
Alert on an Unexpected auth_success Notification
Flags an OAuth/auth completion notification from any MCP server not already trusted in th…
Dedupe Repeated Idle-Prompt Notifications
Suppresses repeat idle-prompt notifications after the first, logging a count instead.
Escalate Quota Auto-Resume Events to an Ops Log
Tracks quota_auto_resume_fired notifications separately — a reliability signal for unatte…
← All hooks
FEEDBACK