+ lHj9#Rt^RIHt^RIt^RIHt^RIHt^RIH t H t H t H t ] !0Rm4t] !0Rm4t!RR]4tRRltR R /R R lltR RltR R R^/RRlltRRltRR R /RRllltR R /RRlltR#)aDelegation-owned output projections, using the existing text redactor. Child output is scrubbed before it is shortened or handed to another consumer. Parent-authored instructions and delivery coordinates retain their exact values. Live streamed text needs its own buffering policy and does not pass through here. Policy (``force``): copies that leave the process or persist (spill files, the async_delegations rows and their replay/recovery, worker IPC, memory providers, lifecycle hooks) are always scrubbed (``force=True``, the default). The parent model's own in-process copy and live progress honour ``security.redact_secrets: false`` (``force=False``), the same as any other tool result the parent reads. Registered vault values are scrubbed in both modes. ) annotationsN)Any)REDACTION_UNAVAILABLEis_secret_field_nameredact_for_egressredact_sensitive_textc&]tRt^7t$RtR]R&RtR#) _ParentCopyaJThe parent's own (opt-out) text carrying the forced projection of the same output. The forced copy is made from the complete output *before* the parent's copy is budget-trimmed: a head/tail cut can drop a PEM ``BEGIN`` marker and leave a key body the text redactor no longer recognizes. Persistent/external sinks read ``forced``.strforcedN)__name__ __module__ __qualname____firstlineno____doc____annotations____static_attributes__r ?/home/ubuntu/.hermes/hermes-agent/tools/delegation_redaction.pyr r 7sZ Krr c$V^8dQhRRRRRR/#)textr r returnr )formats"r __annotate__rAs!c33rc8W8XdV#\V4pWnV#)z\``text`` for the parent, remembering ``forced`` for persistent sinks (plain str when equal).)r r )rr carriers&& r parent_copyrAs  ~ $GN NrforceTc$V^8dQhRRRRRR/#)rrrrboolrr r )rs"rrrJs! % %C %4 %3 %rc"\V\4'dV'd VP#T#V'g\P!4'd \ V4#\ \T;'gR44# \d \u#i;i)zLScrub one child-produced string. ``force=False`` honours the user's opt-out.) isinstancer r _redact_redact_enabledrrr Exceptionr)rrs&$rredact_child_textr(Jsk$ $$#t{{-- '')) &&%$S_55 %$$%sA:/ A::B Bc(V^8dQhRRRRRRRR/#)rkeyr valuerr!rr )rs"rrrVs.DDsD3DtDDrc\WR7pW18wg\V4'gV#\P!W/4p\WBR7pWT8XdV#\P!V4p\T\4'd4\T4^8Xd$\\TP44R4MRp\T\4'dT#\ # \ d \ u#i;i)zRedact a string value with its key as context: once a JSON summary is parsed apart, the key-gated ``"api_key": ""`` rule no longer sees the key, so credential-named fields get that pass on a one-field document. Fails closed for those fields only.rN)r(rjsondumpsloads ValueErrorrr$dictlennextitervaluesr )r*r+rcleanedrawscrubbedprobeonlys&&& r _redact_fieldr<Vs 3G3C88 **c\ "C 2H% 8$0:%/F/F3u:YZ?4U\\^$d +`dDdC((4C.CC %$$%sCC%$C%_depthc(V^8dQhRRRRRRRR/#)rr+rrr!r=intrr )rs"rrris(!!c!T!#!c!rc hV^@8d\#\V\4'd \WR7#\V\4'dwVP 4UUu/uFYwr4\\V4VR7\V\4'd\ \V4WA4M\WAV^,R7bK[ upp#\V\\34'd%VUu.uFp\WAV^,R7NK up#Ve"\V\\\34'dV#\#uuppiuupi)zQCopy JSON-shaped child data; unsupported or excessively deep values are withheld.r-)rr=) rr$r r(r2itemsr<redact_child_valuelisttupler!r?float)r+rr=r*items&$$ rrBrBis {$$% 44%#[[]  +  c#he 4dC((c#h4'&1*M N +   %$''UZ[UZT"4VaZHUZ[[ } 54e*<==   \s AD)D/c(V^8dQhRRRRRRRR/#)rsummaryr structuredr!rrr )rs"rrrs(44C4T4$434rc4\V\4'd \WR7#V'd\V\4'd^RIHpV!V4pV'dVP V4MRpRpV^8d\P!V4MRpV^8diVRVW\V4,Rr\WbR7p W8XdTM\P!V RR7p \WrR7V ,\WR7,#\WR7# \dRpLi;i)aStructured (schema) summaries are redacted per value and re-serialized: a text pass can eat JSON delimiters (``KEY=***`` swallowing the closing quote and comma) and break an answer that was valid. The JSON is located with the validator's own extraction grammar (code fence / surrounding prose), so every wrapper the validator accepts stays accepted; the wrapper text gets the text pass. Unchanged output keeps its original formatting; anything without a parseable candidate gets the text pass.r-)extract_json_candidateNF) ensure_ascii) r$r r(r tools.delegation_output_schemarKfindr.r0r1r3rBr/) rHrIrrK candidatestartparsedprefixsuffixr7bodys &&& rredact_summaryrVs';'' 66j#..I*73 +4 Y'" .3qjTZZ *dF A:$Ve_gc)n6L6M.NF(=G ' 19tzz'X]7^D$V9D@CTU[Cii i g 33 E s-D DDc$V^8dQhRRRRRR/#)rresultdict[str, Any]rr!rr )rs"rrrs"111d1^l1rc T\V\4;'gRV9p/pVP4FwrVVR8XdY\V\4'dCVUu.uF1p\V\4'd \ WrR7M \ WrR7NK3 upWE&KdVR8Xd\ WcV4WE&K{V\9dTM \ WbR7WE&K RV9dVPR4VPR48wdRR.r\V\4'd<^RI H p VPR4p T !\V \4'dT MRV4wrWR&VPR R 4VPR R 4V'g\ WR7VR &R VR &V#uupi \dR .p L[i;i)akProject a result or batch, preserving accounting and host-owned model/task identity. Revalidation here is only for a summary changed by redaction. General schema revalidation after annotations/truncation belongs to the output-schema owner. Old durable entries do not retain the schema, so their previous positive verdict cannot certify a newly redacted summary. schema_validresultsr-rHFzOThe redacted summary has not been validated against the original output_schema.)validate_outputr#z9Output validation was unavailable after secret redaction. schema_errorsN schema_notezTSecret redaction changed the delivered summary; do not treat it as validated output.)r$r2rArCredact_child_resultrBrV_RESULT_METADATAgetrNr]r r'pop) rX output_schemarrIr7r*r+entryvaliderrorsr]rHs &&$ rr`r`sM40LLNf4LJGlln  )  5$ 7 7 # #EeT**$E7';<# GL I )%UCGL 006H6\ L%GKK $:fjj>S$S a  mT * * F W!++i0 /)'377GR!  #( OT* M4('9&'NGO $f M " NK6 WUV Ws7F4FF'&F'c$V^8dQhRRRRRR/#)reventrYrr!rr )rs"rrrs!>T^rc\VP4UUu/uFwr#V\9gKW#bK uppVR7pTPVP4UUu/uFwr#V\9gKW#bK upp4V#uuppiuuppi)zRScrub output while leaving parent instructions and routing outside the projection.r-)r`rA_PARENT_EVENT_FIELDSupdate)rirr*r+r7s&$ rredact_completion_eventrms|!&+kkmWm sBV7VmW_dG NN&+kkmSm s>R7RmS N X TsA? A? B /B >goalroletypegoalsgroupmodelcontextuser_idscope_idtoolsets user_name session_key completed_at delegation_id dispatched_atorigin_session_idparent_session_idorigin_ui_session_id>rrrsstatus task_index _child_role exit_reason)N)r __future__rr.typingr agent.redactredactr%rrrr frozensetrkrar r rr(r<rBrVr`rmr rrrs # !,L # %$ %D&!D!!,461UY11hDr