߲jrD UdZddlZddlZddlZddlZddlZddlmZddlm Z eje Z dZiZeed<ej$ZdefdZdd Zdd Zd edefd Zehd Zej6ddj9dvZiZeed<ej$Zde fdZ!gdZ"dZ#ejHde#dZ%ejHdejLZ'dZ(dZ)dZ*ejHe(ejLZ+ejHdZ,ejHde(de(de*ejLZ-ejHde)d e(d!e*ejLej\zZ/d"Z0ejHd#e)d$e0d%ejLej\zZ1ejHd&ejLZ2ejHd'ejLZ3ejHd(ejLZ4d)Z5ejHd*e5d+e5d,Z6ejHd-Z7d.ed/e8de fd0Z9d1d2d.ed3e8d4e de fd5Z:d6ed7d8de fd9Z;d6ede fd:ZZ>d?Z?ejHd@e?dAejLZ@ehdBZAdCZBdDZCejHdEZDejHdFZEejHdGZFejHdHejLZGdIZHejHdJeHdKejLZIejHdLZJejHdMZKejHdNejLZLejHdOejLZMejHdPZNejHdQZOejHdRZPejHdSZQejHdTZRejHdUZSejHdVZTejHdWZUedXZVdYeWdd8fdZZXeXe"aYejHd[ZZd edefd\Z[ejHd]Z\d^d^d_d`dadbd;edce8dde8dee8dfedgedefdhZ]diedefdjZ^d6ede fdkZ_d edefdlZ`d edefdmZadnedefdoZbdpedefdqZcd edefdrZdd;eedefdsZfd edefdtZgdiedefduZhd=e fdvZidwdxd edye defdzZjd ed{e defd|Zkd}Zldwdwdwdwdwd~d ede d{e de de de defdZmehdZnehdZoehdZpehdZqdZrdZsdedeWefdZtdede fdZudede fdZvdedzde fdZwdedzde fdZxdZyejHdejLZzd edefdZ{ddwddededzde defdZ|dedefdZ}ded/e8de8fdZ~ded3e8de fdZdedee e ffdZdede fdZdede fdZede"Dad ede fdZiZeed<ej$ZdeWfdZddZedfedfddffZddede8fdZddZGddejZy)zRegex-based secret redaction for logs and tool output. Short tokens (< 18 chars) are fully masked; longer ones keep the first 6 and last 4 characters for debuggability. N) unquote_plus)_BLOCKED_PROJECT_ENV_BASENAMES@_VAULT_REDACTION_VALUESreturnc.ddlm}t|S)Nrget_hermes_home)hermes_constantsr strr s 1/home/ubuntu/.hermes/hermes-agent/agent/redact.py _vault_scoper#s0  !!ct|tr|sy|jddjdd}t5tj t i}||fD]}|s|j|dd||<t|tkDr(|tt|=t|tkDr(dddy#1swYyxYw)aERegister an exact vault secret value for model-facing redaction. Called by the vault fill path BEFORE the injection happens, so no later browser tool result can echo the value back into model context. Also registers the form a text input normalizes it to (CR/LF stripped), since that is what the page holds. N  ) isinstancer replace_VAULT_REDACTION_LOCKr setdefaultrpoplen _VAULT_REDACTION_MAX_PER_PROFILEnextiter)value normalizedbucketvs r register_vault_redaction_valuer!(s eS !tR(00r:J +(33LNBG$ !A 1d# q  !&k<<tDL)*&k<< +++s(C%ACC cvt5tjtddddy#1swYyxYw)zPDrop the current profile's registered values (profile teardown / explicit lock).N)rrrrrr clear_vault_redaction_valuesr$<s, :##LND9:::/8textct|tr|s|St5tj t }|rt |tdnd}dddD]}||vs|j|d}|S#1swY)xYw)zUExact-substring scrub of every vault secret value registered for the current profile.T)keyreverser#Nu«redacted-vault-secret») rr rrgetrsortedrr)r&rvaluesrs r redact_registered_vault_valuesr-Bs dC  I(,,\^<:@C6bID D=<<'BCDD K IIs 4A77B>x-amz-signaturejwtr(authcodetokenapikeysecretapi_keysessionid_tokenpassword signature access_token client_secret refresh_tokenHERMES_REDACT_SECRETStrue>1onyesr>_REDACT_ENABLED_BY_HOMEcddlm}m}|tS|}tj |}||Sd} ddlm}|}|r|j dnd}|>ddlm }|j dxsij d } | dn t| }|)t|jjd v}t5|t|<ddd|S#t$rd}Y'wxYw#1swY|SxYw) zUEffective redaction switch for the active profile (launch snapshot when no override).r)get_hermes_home_overridehermes_home_keyNT)current_secret_scoper=)load_config_readonlysecurityredact_secrets>r?r@rAr>)r rDrE_REDACT_ENABLEDrBr*agent.secret_scoperFhermes_cli.configrGr striplower Exception_REDACT_ENABLED_LOCK) rDrEhome_keycachedenabledrFscoperawrGcfg_vals r _redact_enabledrWjsJ!) H $ ( ( 2F  G ;$&49eii/0t ; >+-11*=CHHIYZG!/$s7|C ?#hnn&,,.2LLG 4,3)4 N 4 NsB C C1 C.-C.1C;)8z(sk-[A-Za-z0-9_-](?:\.?[A-Za-z0-9_-]){9,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxapp-\d+-[A-Za-z0-9-]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_(?:org_)?[A-Za-z0-9]{20,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}zgsk_[A-Za-z0-9]{10,}zsyt_[A-Za-z0-9]{10,}zretaindb_[A-Za-z0-9]{10,}zhsk-[A-Za-z0-9]{10,}zmem0_[A-Za-z0-9]{10,}zbrv_[A-Za-z0-9]{10,}zxai-[A-Za-z0-9]{30,}zntn_[A-Za-z0-9]{10,}zfw-[A-Za-z0-9]{30,}zfw_[A-Za-z0-9]{30,}zfpk_[A-Za-z0-9]{30,}zglpat-[A-Za-z0-9_\-]{10,}zgloas-[A-Za-z0-9_\-]{10,}zgldt-[A-Za-z0-9_\-]{10,}zglrt-[A-Za-z0-9_.\-]{10,}zglrtr-[A-Za-z0-9_.\-]{10,}zglcbt-[A-Za-z0-9_\-]{10,}zglptt-[A-Za-z0-9_\-]{10,}zglft-[A-Za-z0-9_\-]{10,}zglimt-[A-Za-z0-9_\-]{10,}zglagent-[A-Za-z0-9_\-]{10,}zglsoat-[A-Za-z0-9_\-]{10,}zglffct-[A-Za-z0-9_\-]{10,}zglwt-[A-Za-z0-9_\-]{10,}zGR1348941[A-Za-z0-9_\-]{10,}zpk-lf-[A-Za-z0-9\-]{8,}zE(?:API_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PW|CREDENTIAL|AUTH)z([A-Z0-9_]{0,50}z&[A-Z0-9_]{0,50})\s*=\s*(['\"]?)(\S+)\2z(?ckkm  ;;= UT\\^ UAA U1QU8CSCSCUUrT allow_pluraljrcc|t|k\ry||}|jr&|jr||dz jry|xr|dvxrt ||dzdS)z\True if position ``j`` (exclusive end) in ``s`` ends a word; one trailing ``s`` is absorbed.Tr[sSFrb)rr\r]r^ _is_word_end)rXrdrcr`s r rgrg^sbCF{ A$C ;;=S[[]qQx/?/?/A  VC4K VLAEPU,VVrr( keyword_rezre.Pattern[str]cJtfd|jDS)zPTrue if ``keyword_re`` matches ``key`` at a word boundary (see _KEY_KEYWORD_RE).c3K|]:}t|jxrt|j<ywN)rastartrgend).0mr(s r z,_has_word_bounded_keyword..js4oQR~c1779-L,sAEEG2LLosAA)anyfinditer)r(rhs` r _has_word_bounded_keywordrshs! oV`ViVijmVno oorc"t|tS)zYPost-match key validator: ``API_KEY``/``DB_PW`` count, ``KEYBOARD``/``secretary`` do not.)rs_KEY_KEYWORD_RE)r(s r _key_has_secret_keywordrvms $S/ ::rrcdk(sjdrytdk\rtjdrytdk\rtjdrytdkry t fd d Dd k\S) zCredential-like shape test for ambiguous ``token``/``key`` values, so short technical scalars (``CPU``, ``local``) are not masked merely for their key name.*** «redacted:Tz [A-Fa-f0-9]+z[A-Za-z0-9_./+=-]+ Fc3\K|]#}ttj|%ywrk)boolresearch)rnprs r rpz0_looks_like_opaque_credential..}s!QQtBIIa'(Qs),)z[a-z]z[A-Z]z[0-9]) startswithrr fullmatchsum)rs`r _looks_like_opaque_credentialrrs{ ~))-8 5zRBLL%@ 5zRBLL)>F 5zB Q2PQ QUV VVr check_keywordcPtj|ry|dk(s|jdry|r t|sytj|r:t |t s*|ddk(s!td|jdDsyt |txs t|S)zShared gate for the ENV / JSON / YAML assignment passes: skip programmatic env lookups used as values, optionally require a word-bounded keyword in the key, then redact when the key is unambiguously credential-bearing or the value looks opaque.Frxu «redactedr$c3FK|]}tj|ywrk)_OPAQUE_PATH_SEGMENT_REr)rnsegs r rpz,_should_redact_assignment..s%iQT&=&G&G&L%is!/) _ENV_LOOKUP_VALUE_REmatchrrv_PATH_OR_VAR_VALUE_RErs_PASSWORD_KEY_RErqsplit_STRONG_KEY_KEYWORD_REr)r(rrs r _should_redact_assignmentrs!!%( ~)),74S9""5)2KCQa2b 8s?#%iX]XcXcdgXh%i"i %c+A B 4,U35rz(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)">r2r3bearerpasswdr4r5r7r8 auth_token credential raw_secret credentials private_keyr: key_material secret_input secret_value authorizationr;r<)_API_KEY_TOKEN_SECRET _PASSWORD_PASSWD _CREDENTIAL _CREDENTIALS)r3r5r2r4r8rrrz'(?P[A-Za-z_][A-Za-z0-9_]*)'(?P\s*:\s*)(?:(?P[bB]?)'(?P(?:\\.|[^'\\])+)'|(?P[bB]?)\"(?P(?:\\.|[^\"\\])+)\")z*^(?P[ \t]*E[ \t]{2,})(?P.*)$z[^(?P(?:[A-Za-z_]\w*\.)*[A-Za-z_]\w*(?:Error|Exception|Warning):[ \t]*)(?P.*)$z?((?:Proxy-)?Authorization:\s*)([A-Za-z][\w.+-]*\s+)?([^\s\"']+)zS(?:x-api-key|x-goog-api-key|api-key|apikey|x-api-token|x-auth-token|x-access-token)(z \s*:\s*)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zO((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:\s]+:)([^@\s]+)(@)zA((?:https?|wss?|git|ssh|ftp|ftps|sftp)://)([^\s:@/]{8,})(@[^\s]+)z2eyJ[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_=-]{4,}){0,2}z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z;(https?|wss?|ftp)://([^\s/?#]+)([^\s?#]*)\?([^\s#]+)(#\S*)?z+(https?|wss?|ftp)://([^/\s:@]+):([^/\s@]+)@z.([?#&;])([A-Za-z0-9_.~+%\-]+)=([^#&;\s\"'<>]*)z(//)([^/\s?#@]+)@zH^[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*(?:&[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*)+$z5[\x00-\x1f\x7f\u200b-\u200f\u2028-\u202f\u2060\ufeff]zAABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-.patternscVtjddj|zdzS)Nz(?.ds*S&&D*;*A*A!*DDSs)+=)rsub enumeraterlist _PREFIX_RErrrlrmrallrappendgroupreversedr) r&mask_fnstrippedrYrorig_idxoutmatchesro start_origend_origspan replacements r _mask_control_split_tokensrHsV!$$R.H4 'oPda5F5L5LQ5OPHP:rC   *Haggaj) AEE!HqL)A-Jx( DLDDLj.?.?.E  SdS ST*d8n.C NNJ'!''!*2EF GH.6g->5) Hk#' #4Jx 5 773<'Qs E Ez?[\x00-\x1f\x7f\x80-\x9f\u200b-\u200f\u202a-\u202e\u2060-\u2064]r|rxr)headtailfloor placeholderemptyrrrrrcz|rtjd|n|}|s|St||kr|S|d|d|| dS)uMask a secret for display (``hermes config`` / ``status`` / ``dump``): ``sk-p...7890``; shorter than ``floor`` (after control-byte stripping) → ``placeholder``; falsy → ``empty``.rNz...)_DISPLAY_CONTROL_RErr)rrrrrrs r mask_secretrqsR 38  # #B .UE  e*u,;UU5D\N#eTEFm_2UUrr2c&|syt|dddS)uUMask a log token — 18-char floor, preserves 6 prefix / 4 suffix; empty → ``***``.rxr)rrr)r)r2s r _mask_tokenr|s  u11B 77rc|j}|tvry|jr|jtry|jt S)zCReturn True for exact secret keys or credential-suffixed key names.T)casefold_PYTHON_REPR_SECRET_KEYSr]endswith_PYTHON_REPR_ENV_SUFFIXES _PYTHON_REPR_CREDENTIAL_SUFFIXES)r(foldeds r _is_python_repr_secret_keyrsC \\^F )) {{}&?@ ??; <._subskk% )#.;;q> !{{>2  #[[17RFE E[[17RFEKK/E % %e ,;;q> ! E>U--m<;;q> !3%qU+,VHUG3ugFFr)rMatchr _PYTHON_REPR_FIELD_REr)r&rs r _redact_python_repr_fieldsrs1GBHHGG: ! $ $T4 00rc|jd}t|D]\}}d}|}|jdr|ddd}}n,|jds|jdr |dd |d d}}tj |}|t j |}|~|j d t|j d z|z||<dj|S) zHMask repr fields only on pytest/error lines in source-preserving output.T)keependsrz Nrrrbody) splitlinesrr_PYTEST_DIAGNOSTIC_LINE_REr_PYTHON_EXCEPTION_LINE_RErrr)r&linesindexlineending body_liners r %_redact_python_diagnostic_repr_fieldsrs OOTO *E ' t == $Sb 6vI ]]4 DMM$$7 $Sb 49vI*00; =-33I>E   H%,U[[-@AB %L" 775>rquerycX|s|Sdjd|jdDS)zQReplace values of sensitive ``k=v&k=v`` params with ``***``; others pass through.&c3K|]8}|jd\}}}|r|jtvr|dn|:yw)r=***N) partitionrN_SENSITIVE_QUERY_PARAMS)rnpairr(r_s r rpz'_redact_query_string..sF 9Lc1 /F F3%t DPs>A)rr)rs r _redact_query_stringrs1  88KK$ rnamec|}tdD]}t|}||k(rn|}|jjddS)zSDecode a URL parameter name (up to 3 unquote rounds) for case-insensitive matching.-r)rangerrr)rdecodedr next_values r _canonical_url_param_namer sRG 1X!'*        % %c3 //rc^tjd|}tjd|S)zStrict egress-boundary redaction of URL credentials (absolute, relative and network references); preserves keys, separators, public params, hosts, paths.ct|jdtvr%|jd|jddS|jdS)Nrr[rr)r rrros r z0_redact_strict_url_credentials..sN $QWWQZ 04K KWWQZL D1QRQXQXYZQ[rcd|jdvr7|jd|jdjdddS|jddS)N:rr[r:***@z***@)rrr s r r z0_redact_strict_url_credentials..s\qwwWXzHYQWWQZL!5!5c!:1!= >eDbcbibijkblammq_rr)_STRICT_URL_PARAM_REr_STRICT_URL_USERINFO_REr&s r _redact_strict_url_credentialsrs9 # # \]a cD # & &r  rct|dn t|}|s|Stjd|}tjd|S)a%Mask secrets in a CDP/browser endpoint URL before it is logged. Unlike ``redact_sensitive_text`` (which passes web-URL query params and ``user:pass@`` through for OAuth callbacks / magic links), CDP discovery tokens are pure credentials, so this opts INTO both URL redactors. rc |jdd|jd|jddt|jd|jdxsdS) Nr[://rr?rr)rrr s r r z redact_cdp_url..s_QWWQZLAGGAJ< |1=QRSRYRYZ[R\=]<^_`_f_fgh_i_omo^pqrcN|jdd|jddS)Nr[rrrrr s r r z redact_cdp_url..s#QWWQZLAGGAJ. sM#u7G7G7L#Ms!!rryu…»u«redacted-secret»)r_PREFIX_SUBSTRINGS)r2labels` r _mask_token_nonreusabler's6W\DM!3Mr RacE).[u %I4IIrcfd}|S)zbre.sub callback: keep the match unless the key/value pair (groups[0], groups[-1]) needs redaction.c~|j}t|d|ds|jdS|S)Nrrr)groupsrr)ror+rrenders r rz_assignment_sub.._subs:(F2Jm\771: f~rr#)r,rrs`` r _assignment_subr-s KrFmask_nonreusabler/c |rtntd|vrtfdd}tj ||}d|vrt j ||}d|vrAt j|r,tj ||}tj ||}d|vr(d|vr$tj tfdd |}d|vrd |vr t|}d|vr(d|vr$tj tfd d|}|S) u?ENV / config / JSON / YAML assignment passes (skipped for code files). Passes that would match ``token=``/``key=`` URL params skip ``://`` text (web-URL query params are intentionally passed through, see redact_sensitive_text). ``mask_nonreusable`` masks the assignments with the ``«redacted:…»`` sentinel that ``file_read=True`` already uses for prefix-matched credentials. Without it an agent that read a secret-bearing file would hold a head/tail mask shaped like a real but truncated key and could write it back as a dead credential (#35519).rc>|dd|d|d|dS)Nrrr[rr#gmasks r r z%_redact_assignments..&s.1Q4&!A$QqT |AaD60RrTr*rrrc,|dd|ddS)Nrz: "r[rr#r2s r r z%_redact_assignments..=s 1c$qt*Q&?rFrc2|d|d|dS)Nrr[rr#r2s r r z%_redact_assignments..Gs$1qtfT!A$ZL&Ar) r'rr-_ENV_ASSIGN_REr_ENV_ASSIGN_LOWER_RE_CFG_SECRET_WORD_REr_CFG_DOTTED_RE_CFG_ANCHORED_RE_JSON_FIELD_REr_YAML_ASSIGN_RE)r&r/ _redact_envr4s @r _redact_assignmentsr?s'7 "KD d{%&Rbfg !!+t4   (++K>D  !4!;!;D!A!%%k48D#'' T:D d{sd{!! ?u UW[]  d{sd{)$/ d{uD("" AQU VX\^ Kr code_filechfd}tj||}tjd|S)zODB connection-string passwords and bare-token URL userinfo (``://`` text only).c|jd}r3|jdr"|jdr|jdS|jdd|jdS)Nr{}rr[rxr)rrr)ropwr@s r _redact_dbz+_redact_url_credentials.._redact_dbMsZWWQZ s+ C0@771: ''!*S --rc~|jdt|jd|jdS)Nr[rrrrr s r r z)_redact_url_credentials..Us7qwwqzl;qwwqz;R:STUT[T[\]T^S_,`r)_DB_CONNSTR_REr_URL_BARE_TOKEN_RE)r&r@rFs ` r _redact_url_credentialsrKKs1.   j$ /D  ! !"`bf ggrcf|jd}t|dkrdnd}|d|dz|| dzS)Nr[rrz****)rr)rophonekeeps r _redact_phonerPXs> GGAJEE a1QD $<& 5$= 00r)forcer@ file_read secret_fileredact_url_credentialsrQrRrSrTc:|yt|tr|n t|}|s|St|}|s ts|S|xs|xr| }t |r3|rt nt t|}tjfd|}d|vr'|rt nt tjfd|}|s t||}d|vsd|vrtjd|}d |vr.tjd |}tjd |}d |vrd |vrtjd|}d|vr t!||}d|vrt"jd|}|r t%|}d|vrd|vr t'|}d|vrt(jt*|}|S)u Apply all redaction patterns to a block of text. Safe on any string. Enabled by default (``security.redact_secrets: false`` disables); ``force=True`` is for safety boundaries that must never return raw secrets regardless. ``redact_url_credentials=True``: also redact credential-named query params and ``user:pass@`` userinfo — off by default because OAuth-callback / magic-link / pre-signed URLs must survive ordinary tool flows unchanged. ``code_file=True``: skip the ENV/JSON assignment passes for known source code (``MAX_TOKENS=***``, ``"apiKey": "test"`` fixtures). ``file_read=True`` (implies code_file unless ``secret_file``): prefix-matched credentials become a non-reusable sentinel (``«redacted:ghp_…»``) instead of a head/tail mask an agent could write back into config.yaml as a dead credential. Every regex sits behind a cheap substring gate that its pattern requires, so the gates are never false-negative. Set code_file=True to also skip the Python-repr mapping pass (``{'API_KEY': '…'}`` fixtures in source); pytest/exception diagnostic lines get a narrow pass in redact_terminal_output instead. Set file_read=True for file *content* returned to the agent (read_file / search_files / cat). The old mask looked like a real-but-truncated key, so an agent reading it from config.yaml and writing it back silently corrupted the stored credential into a dead 13-char value → 401 (issue #35519). The sentinel is syntactically invalid as a token, so it can't be mistaken for a usable key or written back as one. Set ``secret_file=True`` when the caller has already classified the SOURCE as secret-bearing (``_is_secret_file_arg``: command reads on the terminal side, resolved tool paths on the file side). It re-enables the ENV/JSON/YAML assignment passes that ``file_read`` would otherwise skip, so an opaque prefix-less credential assigned to a credential-shaped key is masked instead of passed through in cleartext (issue #110567). With ``file_read=True`` those assignments are masked with the non-reusable sentinel, so the #35519 write-back hazard stays closed. ``secret_file`` is authoritative: it wins over ``code_file``, so a caller cannot be fail-open by setting both. Files that are not secret-bearing (any source file, a project's own ``config.yaml``) keep the code_file behaviour: ``MAX_TOKENS: 100`` and ``"apiKey": "test"`` fixtures are untouched. Nc2|jdSNr[r)ro _prefix_subs r r z'redact_sensitive_text..s AGGAJ(?r.c2|jdSrWr)ro _zhipu_subs r r z'redact_sensitive_text..sz!''!*/Err. uthorization UTHORIZATIONc|jd|jdxsdzt|jdzS)Nr[rrrrHr s r r z'redact_sensitive_text..s7QWWQZ1771:;K-L{[\[b[bcd[eOf-frrcZ|jdt|jdzS)Nr[rrHr s r r z'redact_sensitive_text..s!qwwqzKPQ .s'QWWQZ-=2,>qwwqzl$*OrBEGINz-----z[REDACTED PRIVATE KEY]reyJc6t|jdSNr)rrr s r r z'redact_sensitive_text..s[%<rrr+)rr r-rW_has_known_prefix_substringr'rrrr_ZHIPU_API_KEY_REr?_AUTH_HEADER_RE_SECRET_HEADER_RE _TELEGRAM_RE_PRIVATE_KEY_RErK_JWT_RErr"_SIGNAL_PHONE_RErP)r&rQr@rRrSrTrXr[s @@r rr^sP |dC(4c$iD  )$ /D _& 'i<_I#4(1:- *$ <~~?F d{09,{  $$%EtL "4)D4!7""#fhlm d{ $$%SUYZ OQUV$7d?""#;TB }&tY7 }{{envsetexportdeclareprintenv>nlawkbatcatsedtacgreprlessmorertypeviewzcatbatcat>.zshrc.bashrc.zlogin.zshenv.profile .zprofile .bash_login .bash_profile>rtrwry)z $HERMES_HOME/z${HERMES_HOME}/)z$HOME/z${HOME}/commandc~g}g}d}|D]}|r|j|||k(rd}|dvr|}|j|6|dvr5dj|j}|r|j|g}o|j|dj|j}|r|j||S)zPipeline/sequence segments, split only on unquoted ``| ; &`` so an ``awk '{print $1; print $2}'`` program or ``grep 'foo|bar'`` pattern stays one segment. Backslash is not an escape (Windows ``C:\Users\...``).Nz'"z|;&r)rrrM)rsegmentsbufrchrs r _command_segmentsrsHCE  JJrNU{  ;E JJrN  ;''#,$$&C$C  2!" ''#,   C  Orpathcddlm} tjj tjj tjj |}|D]q} tjj tjj t|}||k(s#|j|tjzsqyy#ttf$rYywxYw#ttf$rYwxYw)uTrue when an absolute ``config.yaml`` path sits under the active Hermes home or root. The default home's basename is an installation detail — ``.hermes`` on POSIX, ``hermes`` under ``AppData/Local`` on Windows — and a resolved path never spells ``$HERMES_HOME``, so the literal-segment test in ``_is_secret_file_arg`` cannot see a native Windows path. Compare against the resolved homes instead. Only reached for a ``config.yaml`` basename, so the resolve cost stays off the per-token command scan. r) _hermes_dirsFT) agent.file_safetyrosrnormcaserealpath expanduserOSError ValueErrorr rr)rrtargethomebases r _is_under_hermes_homer s/!!"''"2"22773E3Ed3K"LM 77##BGG$4$4SY$?@D T>V..tbff}=   Z  $   s%AC,AC2C/.C/2DDargc |jdjdd}d}tD]%}|j|s|t |d}d}nt D]#}|j|s|t |d}nd|vry|j dDcgc]}|s|j}}|sy|dtvs |dtvry|dd k7r|djd sy|xsd |ddvxs t|Scc}w) aB``.env``-style or shell rc basename anywhere; ``config.yaml`` only under a ``.hermes`` directory, ``$HERMES_HOME``, or the resolved Hermes home (never arbitrary YAML). The resolved-home arm is what covers native Windows, where the home directory is ``%LOCALAPPDATA%\hermes`` and carries no ``.hermes`` segment.z"'\rFNTrrz config.yaml)zconfig.yaml.good.zconfig.yaml.corrupt.z.hermes) rMr_HERMES_HOME_PREFIXESrr_HOME_PREFIXESrrN_ENV_FILE_BASENAMES_SHELL_RC_BASENAMESr)rr hermes_homerpartpartss r _is_secret_file_argr$s! 99U  # #D# .DK' ??6 "F %DK   ! ??6 "F %D  d{&*jjo >dTZZ\ >E >  Ry''598K+K RyM!%)*>*>?l*m  P)uSbz1 P5J45PP ?s DDcb|rt|tsyt|D]}|j}|s|dj dddj }|t vrE|ddDcgc]}|jdr|}}|tvr|dd}td|Dsy ycc}w) aTrue if ``command`` reads a secret-bearing file (see ``_is_secret_file_arg``) to stdout. Defense-in-depth, not a boundary: indirect reads (``sudo cat .env``, ``$(cat .env)``, unresolved variable paths) are not detected, matching ``is_env_dump_command``.Frrr[rNrc32K|]}t|ywrk)r)rnrs r rpz-_command_reads_secret_file..Rs>C"3'>T) rr rrrsplitrN_FILE_READ_COMMANDSr_PATTERN_FIRST_COMMANDSrq)rrtokensreaderr positionals r _command_reads_secret_filerBs *Wc2 )  !!#q)"-335 , , %+ABZKcs~~c7JcK K , ,#ABJ >:> >   Ls +B,B,c|rt|tsyt|D](} tj|}|s|dt vs(yy#t $r|j }Y.wxYw)uTrue if any pipeline/sequence segment starts with an _ENV_DUMP_COMMANDS token. Conservative: unrecognized → False (callers fall back to code_file=True).FrT)rr rshlexrr_ENV_DUMP_COMMANDS)rrrs r is_env_dump_commandrWso *Wc2 ) ![[%F fQi#55    !YY[F !sA  A'&A'z[redaction-unavailable]z2\bBearer\s+(?:\[[^\]]+\]|[A-Za-z0-9._~+/-]{20,}=*)ct|xsd} t|d}d|vrtj d|}|S#t$r tcYSwxYw)uThe one scrub for text leaving the process for a remote reader (chat platforms, A2A peers, telemetry). ``redact_sensitive_text(force=True)`` — the only secret-pattern list — plus a bearer sweep, because a ``Bearer `` value with no vendor prefix carries no shape the prefix matcher can key on. Fails CLOSED: if the redactor raises, the raw text is never returned.rTrQearerzBearer [redacted])r rrOREDACTION_UNAVAILABLE_BEARER_RESIDUE_RErrs r redact_for_egressrmsZ tzr?D%$T6$!%%&94@ K %$$%s :A  A routputc|s|St|xs t| }t|||}|r|s trd|vrd|vr t |}|S)a!Single redaction policy for ALL terminal-output surfaces: the ENV/YAML-assignment pass runs only when ``command`` is an env dump or reads a secret-bearing file (``.env``, shell rc, Hermes ``config.yaml``); otherwise code_file=True avoids false positives on source/config dumps.)rQr@rr)rrrrWr)rrrQr@redacteds r redact_terminal_outputr|s[  (1X5OPW5XYI$V5INHe0cXo#QY/8B OrpatterncFd}t|D]\}}||vs |d|cS|S)zALeading literal chars of a regex (up to the first metacharacter).z [(\.?*+|{^$N)r)rmetarYrs r _extract_literal_prefixrs9 D7#2 :2A;  Nrc|||dz|dzdk(rdndz }|t|kr.||dk7r&|||dk(rdndz }|t|kr ||dk7r&|S)zJGiven ``pattern[i] == "["``, return the index just past the closing ``]``.r[r]r)r)rrYs r _skip_char_classrspga!eAE"c)q0A c'l wqzS0 '!*$Q!+ c'l wqzS0 Hrc|t|k\ry||dvry||dk(rG|jd|}|dk7r||dz|nd}|d djxr|jd Sy) zSTrue if an open-ended quantifier (``*``, ``+``, ``{m,}``) starts at ``pattern[j]``.Fz*+TrCrDrr[rN,)rfindisdigitr)rrdkrs r _unbounded_quantifier_followsrszCLqzTqzS LLa #$7wq1uQCRy  "9t}}S'99 rcdx}}dg}d}|t|kr||}|dk(r|dz }|dk(r t||}n|dk(r|jdn|dk(r@t|dkDr|jnd}|rt ||dzrd }|d xs||d <n>|d k(rt|dk(rd }n(t ||rd |d <|d k(r|j d |}|dz }|t|kr||fS)uOne scan → ``(has_top_level_alternation, has_nested_unbounded_repeat)``. Top-level ``|`` defeats the literal-prefix guarantee (in ``ab|.*`` the prefix binds only the first branch; ``ab(?:x|y)`` is fine). An unbounded quantifier on a group containing one (``(a+)+``, ``(a{2,})+``) is the canonical ReDoS shape. Structural only; overlapping branches (``(a|aa)+``) are not detected. Frrr[r)r[TrrrCrD)rrrrrr)r top_level_altnestedcontains_unboundedrYrinners r _pattern_structurers%#"MF A c'l  QZ : FA  9 !,A 3Y  % %e , 3Y034F0G!0K&**,QVE6wAF%7%;%Du r " 3Y312a7 M *7A 6%) r "SyLLa( Q) c'l * &  rct|dSrdrrs r _has_top_level_alternationr g &q ))rct|dSrWrrs r _has_nested_unbounded_repeatrrrc#2K|]}t|ywrkrrnrs r rprpsP!215Prc4tfdtDS)z4Cheap pre-check before the expensive ``_PREFIX_RE``.c3&K|]}|v ywrkr#)rnrr&s r rpz._has_known_prefix_substring..s5QqDy5s)rqr%rs`r rfrfs 5"45 55r_PLUGIN_PREFIX_PATTERNScdtjDcgc] }|D]}| c}}Scc}}w)z5All plugin-registered patterns in registration order.)rr,)rrs r _plugin_patternsrs+5<<> Q( Q1A QA QQ Qs,c`ttz}t|at d|Day)zRecompile the prefix alternation and pre-screen substrings; callers read the module globals at call time, so the swap propagates immediately.c32K|]}t|ywrkrrs r rpz*_rebuild_prefix_matcher..sLa6q9LrN)_PREFIX_PATTERNSrrrtupler%)combineds r _rebuild_prefix_matcherrs- "2"44H(2JL8LLru%s: skipping redaction pattern %r — top-level alternation escapes the literal-prefix guarantee (in 'ab|.*' the prefix binds only the first branch); wrap alternation in a group after the prefix, e.g. 'ab(?:x|y)'u%s: skipping redaction pattern %r — nested unbounded quantifiers (e.g. '(a+)+') can backtrack catastrophically, and registered patterns run on every log line and tool outputc0tt|dkS)Nr)rrrs r r r sS09:Q>ru~%s: skipping redaction pattern %r — must start with at least 2 literal characters (needed for the pre-screen substring gate)sourcec g}|xsgD]ttrjstj d|:j t j tfdtDd}|rtj ||tvstvs|vrtjd||j|r^t5tj!|gj#|t%dddtj'd|t)|t)|S#t j$r#}tj d||Yd}~rd}~wwxYw#1swYmxYw)u&Additively register credential-token regexes; returns the count accepted. Invalid entries (non-compiling, top-level alternation, nested unbounded quantifiers, < 2 literal prefix chars) and duplicates are warned/skipped, never raised — a broken plugin must not break startup. z/%s: skipping empty/non-string redaction patternz.%s: skipping invalid redaction pattern %r (%s)Nc3:K|]\}}|s|ywrkr#)rnrejectmessagers r rpz.register_redaction_patterns..sa_VWQWX_Q`asz+%s: redaction pattern %r already registeredz&%s: registered %d redaction pattern(s))rr rMloggerwarningrrerrorr_PATTERN_REJECT_RULESrrdebugr_registry_lockrrextendrinfor)rracceptedexcrejectedrs @r register_redaction_patternsr sSH>r!'3'w}} NNLf U --/  JJw a8Macgh  NN8VW 5  & &'5E5G*G7V^K^ LLFPW X  #!&  & # . .vr : A A( K # % &  r#s   %T   8 $$& ""& ("c" +(:    $%"))3V<BBDHbb !#"%y~~':E^]12C1DDlmn "rzzKMM$W 8 /  bjj!2BMMB"rzz"UV ++<*=>*+,  MM 2::#$$DEVDWWhishtuMMBLL P"**$%%5o5FFuvMMBLL *"**AMM$SMM2::8"--H=" d>*::PQ_P``c#de %"**%[\VcVcVdV:>WCWCW$W$Wp3p4Ep$p ;;; W W W535s5d5t5BZr/!22DEr}}U %&, $ #  (RZZ(UV&BJJ8"**_acananonBJJ!$8#9GWrzz@A "**hiVMM  RZZMM  "**J K2::AB RZZ ^_2::LM "rzz"ST %"**%9: fg BJJWX ab[d[/@[%%5 6 BJJL !S!c!L!bjj!cd,-!"#(rVsVSVCVCV V14V>AV8s8s8 =C =D = 1S1S1D.0C0C0U&USU".C.C. J3 J3 Jd@E-c---` h# h$ h3 h1 7mmtmm%)m@Dm26mCFmnNO ! ! $$:;<(stCy<2QSQTQ<d t* t  2 RZZ UWYWdWde C C UZ3td_b(SS c c c  3 3 4  ! !dDj(9 !F****#*$*P?OPP6c6d6!#"!R$R M 23"ab?23  # S F"=**=r