+
    Ӄi                        R t ^ RIt^ RIt^ RIt]P                  ! ]4      t]P                  ! RR4      P                  4       R;9  t	. RNRNRNRNRNR	NR
NRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNR NR!NR"NR#NR$NR%NR&Nt
R't]P                  ! R(] R)24      tR*t]P                  ! R+] R,2]P                  4      t]P                  ! R-]P                  4      t]P                  ! R.4      t]P                  ! R/4      t]P                  ! R0]P                  4      t]P                  ! R14      t]P                  ! R2R3P-                  ]
4      ,           R4,           4      tR5 R6 ltR7 R8 lt ! R9 R:]P4                  4      tR# )<a2  Regex-based secret redaction for logs and tool output.

Applies pattern matching to mask API keys, tokens, and credentials
before they reach log files, verbose output, or gateway logs.

Short tokens (< 18 chars) are fully masked. Longer tokens preserve
the first 6 and last 4 characters for debuggability.
NHERMES_REDACT_SECRETS zsk-[A-Za-z0-9_-]{10,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_[A-Za-z0-9_-]{10,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}zgsk_[A-Za-z0-9]{10,}zsyt_[A-Za-z0-9]{10,}zretaindb_[A-Za-z0-9]{10,}zhsk-[A-Za-z0-9]{10,}zmem0_[A-Za-z0-9]{10,}zbrv_[A-Za-z0-9]{10,}z9(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)z([A-Z0-9_]{0,50}z&[A-Z0-9_]{0,50})\s*=\s*(['\"]?)(\S+)\2z(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)"z!(Authorization:\s*Bearer\s+)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zK((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:]+:)([^@]+)(@)z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z(?<![A-Za-z0-9_-])(|z)(?![A-Za-z0-9_-])c                0    V ^8  d   QhR\         R\         /# )   tokenreturnstr)formats   ")/home/ubuntu/hermes-agent/agent/redact.py__annotate__r   j   s     ) )s )s )    c                H    \        V 4      ^8  d   R# V R,           RV RR  2# )z0Mask a token, preserving prefix for long tokens.***:N   Nz...N)len)r   s   &r   _mask_tokenr   j   s+    
5zBBi[E"#J<((r   c                0    V ^8  d   QhR\         R\         /# )r   textr   r	   )r   s   "r   r   r   q   s     9 9 9 9r   c                   V f   R# \        V \        4      '       g   \        V 4      p V '       g   V # \        '       g   V # \        P	                  R V 4      p R p\
        P	                  W4      p R p\        P	                  W 4      p \        P	                  R V 4      p R p\        P	                  W04      p \        P	                  RV 4      p \        P	                  R V 4      p R	 p\        P	                  W@4      p V # )
zApply all redaction patterns to a block of text.

Safe to call on any string -- non-matching text passes through unchanged.
Disabled when security.redact_secrets is false in config.yaml.
Nc                 6    \        V P                  ^4      4      #    )r   groupms   &r   <lambda>'redact_sensitive_text.<locals>.<lambda>   s    K
$;r   c                     V P                  ^4      V P                  ^4      V P                  ^4      r2pV RV \        V4       V 2# )r   =r   r   )r   namequotevalues   &   r   _redact_env*redact_sensitive_text.<locals>._redact_env   sD    WWQZQWWQZUqE 23E7;;r   c                 f    V P                  ^4      V P                  ^4      r!V R\        V4       R2# )r   z: ""r"   )r   keyr%   s   &  r   _redact_json+redact_sensitive_text.<locals>._redact_json   s2    WWQZUc+e,-Q//r   c                 b    V P                  ^4      \        V P                  ^4      4      ,           # r   r"   r   s   &r   r   r      s    !''!*{1771:66r   c                 h    V P                  ^4      ;'       g    RpV P                  ^4      pV V R2# )r   r   z:***r   )r   prefixdigitss   &  r   _redact_telegram/redact_sensitive_text.<locals>._redact_telegram   s5    !!r&&&r   z[REDACTED PRIVATE KEY]c                 L    V P                  ^4       RV P                  ^4       2# )r   r   r/   r   s   &r   r   r      s    1771:,c!''!*(Fr   c                     V P                  ^4      p\        V4      ^8:  d   VR,          R,           VRR ,           # VR,          R,           VRR ,           # )r   :Nr   Nz****N:N   Nr   )r   r   )r   phones   & r   _redact_phone,redact_sensitive_text.<locals>._redact_phone   sN    
u:?9v%bc
22Ry6!E"#J..r   )
isinstancer
   _REDACT_ENABLED
_PREFIX_REsub_ENV_ASSIGN_RE_JSON_FIELD_RE_AUTH_HEADER_RE_TELEGRAM_RE_PRIVATE_KEY_RE_DB_CONNSTR_RE_SIGNAL_PHONE_RE)r   r&   r+   r2   r9   s   &    r   redact_sensitive_textrF   q   s     |dC  4y? >>;TBD< k0D0 l1D 6D' ,3D 7>D FMD/
 4DKr   c                   R   a a ] tR t^t oRtRV 3R lltV3R lV 3R lltRtVtV ;t	# )RedactingFormatterz9Log formatter that redacts secrets from all log messages.c                ,   < \         SV `  ! WV3/ VB  R # N)super__init__)selffmtdatefmtstylekwargs	__class__s   &&&&,r   rL   RedactingFormatter.__init__   s    u77r   c                :   < V ^8  d   QhRS[ P                  RS[/# )r   recordr   )logging	LogRecordr
   )r   __classdict__s   "r   r   RedactingFormatter.__annotate__   s!     / /W.. /3 /r   c                8   < \         SV `  V4      p\        V4      # rJ   )rK   r   rF   )rM   rU   originalrR   s   && r   r   RedactingFormatter.format   s    7>&)$X..r    )NN%)
__name__
__module____qualname____firstlineno____doc__rL   r   __static_attributes____classdictcell____classcell__)rR   rX   s   @@r   rH   rH      s     C8/ / /r   rH   )0falsenooff)rc   rV   osre	getLoggerr_   loggergetenvlowerr<   _PREFIX_PATTERNS_SECRET_ENV_NAMEScompiler?   _JSON_KEY_NAMES
IGNORECASEr@   rA   rB   rC   rD   rE   joinr=   r   rF   	FormatterrH   r]   r   r   <module>rx      s    	 				8	$ ))3R8>>@Hcc$$$ $$ 	$
 $ $ $ $$ $ $ $ $ "$  $ $   !$"  #$$  %$& '$( )$* +$, -$. /$0 1$2 3$4 5$6 7$8 9$: ;$< =$> ?$@ !A$B C$D E$F G$ N Q +,,TU
 Z	/	,-MM **(MM zz*
 **O RMM ::AB  ZZSXX&677:OO

)9x/** /r   