JjdZddlZddlZddlZddlZejeZehdZ ehdZ ej dd dvZ gdZd Zejd ed Zd Zd ZejdZejdededeejZejdedeejejzZdZejdedejejzZdZejdedejZejdejZdZejdedejZejdZ ejdZ!ejd ejZ"ejd!ejZ#ejd"Z$ejd#Z%ejd$Z&ejd%Z'ejd&ejZ(ejd'Z)ejd(d)*ezd*zZ+d+d+d,d-d.d/d0e,d1e-d2e-d3e-d4e,d5e,d6e,fd7Z.d8e,d6e,fd9Z/d:e,d6e,fd;Z0dZ2d0e3d6e,fd?Z4ddQeDZ?dx-amz-signaturejwtkeyauthcodetokenapikeysecretapi_keysessionid_tokenpassword signature access_token client_secret refresh_token>rrrrr r r r r private_keyr authorizationrrHERMES_REDACT_SECRETStrue>1onyesr))zsk-[A-Za-z0-9_-]{10,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxapp-\d+-[A-Za-z0-9-]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_[A-Za-z0-9_-]{10,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}zgsk_[A-Za-z0-9]{10,}zsyt_[A-Za-z0-9]{10,}zretaindb_[A-Za-z0-9]{10,}zhsk-[A-Za-z0-9]{10,}zmem0_[A-Za-z0-9]{10,}zbrv_[A-Za-z0-9]{10,}zxai-[A-Za-z0-9]{30,}zntn_[A-Za-z0-9]{10,}zfw-[A-Za-z0-9]{30,}zfw_[A-Za-z0-9]{30,}zfpk_[A-Za-z0-9]{30,}z9(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)z([A-Z0-9_]{0,50}z&[A-Z0-9_]{0,50})\s*=\s*(['\"]?)(\S+)\2z?(?:api[ _.\-]?key|token|secret|passwd|password|credential|auth)z(['\"]?)([^\s&]+?)\2(?=[\s&]|$)z0^(?:os\.(?:getenv|environ)|process\.env|\$ENV\{)z'((?:[A-Za-z0-9_\-]+\.)+[A-Za-z0-9_.\-]*z![A-Za-z0-9_.\-]*|[A-Za-z0-9_.\-]*z$[A-Za-z0-9_.\-]*\.[A-Za-z0-9_.\-]+)=z((^[ \t]*(?:export[ \t]+)?[A-Za-z0-9_\-]*z[A-Za-z0-9_\-]*)=z:(?:api[ _.\-]?key|token|secret|passwd|password|credential)z(^[ \t]*[A-Za-z0-9_.\-]*z,[A-Za-z0-9_.\-]*)(:[ \t]*)(?!['\"])([^\s&]+)z(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)"z?((?:Proxy-)?Authorization:\s*)([A-Za-z][\w.+-]*\s+)?([^\s\"']+)zS(?:x-api-key|x-goog-api-key|api-key|apikey|x-api-token|x-auth-token|x-access-token)(z \s*:\s*)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zO((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:\s]+:)([^@\s]+)(@)zA((?:https?|wss?|git|ssh|ftp|ftps|sftp)://)([^\s:@/]{8,})(@[^\s]+)z2eyJ[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_=-]{4,}){0,2}z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z;(https?|wss?|ftp)://([^\s/?#]+)([^\s?#]*)\?([^\s#]+)(#\S*)?z+(https?|wss?|ftp)://([^/\s:@]+):([^/\s@]+)@z`\b((?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)\s+[^ \t\r\n\"']*?)\?([^ \t\r\n\"']+)zH^[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*(?:&[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*)+$z(?>> mask_secret("sk-proj-abcdef1234567890") 'sk-p...7890' >>> mask_secret("short") # fully masked '***' >>> mask_secret("") # empty default '' >>> mask_secret("", empty="(not set)") # empty override '(not set)' >>> mask_secret("long-token", head=6, tail=4, floor=18) '***' Nz...)len)r%r r!r"r#r$s 2/home/rurouni/.hermes/hermes-agent/agent/redact.py mask_secretr*5sOP   5zzEETEl . .udUVV} . ..rc0|sdSt|dddS)uOMask a log token — conservative 18-char floor, preserves 6 prefix / 4 suffix.rr)r r!r")r*)rs r) _mask_tokenr/ds( u u11B 7 7 77r+queryc`|s|Sg}|dD]~}d|vr|||d\}}}|tvr||di||d|S)aRedact sensitive parameter values in a URL query string. Handles `k=v&k=v` format. Sensitive keys (case-insensitive) have values replaced with `***`. Non-sensitive keys pass through unchanged. Empty or malformed pairs are preserved as-is. &=z=***)splitappend partitionlower_SENSITIVE_QUERY_PARAMSjoin)r0partspairr_r%s r)_redact_query_stringr=ls  E C   d?? LL    s++ Q 99;;1 1 1 LLC & & & & LL     88E??r+textcfdtjdtfd}t||S)uScan text for URLs with query strings and redact sensitive params. Catches opaque tokens that don't match vendor prefix regexes, e.g. `https://example.com/cb?code=ABC123&state=xyz` → `...?code=***&state=xyz`. mr&c|d}|d}|d}t|d}|dpd}|d||d||S) Nrr://?groupr=)r@scheme authoritypathr0fragments r)_subz&_redact_url_query_params.._subsGGAJJ wwqzz$QWWQZZ00771::#@@Y@@@u@h@@@r+)reMatchstr_URL_WITH_QUERY_REsubr>rNs r)_redact_url_query_paramsrUsD AASAAAA  ! !$ - --r+c:td|S)zStrip `user:password@` from HTTP/WS/FTP URLs. DB protocols (postgres, mysql, mongodb, redis, amqp) are handled separately by `_DB_CONNSTR_RE`. c^|dd|ddS)NrBrFrCz:***@rIr@s r)z&_redact_url_userinfo..s+QWWQZZ55AGGAJJ555r+)_URL_USERINFO_RErSr>s r)_redact_url_userinfor]s%   55   r+ct|dnt|}|s|St|}t|}|S)aMask secrets in a CDP/browser endpoint URL before it is logged. The global ``redact_sensitive_text`` deliberately passes web-URL query params and ``user:pass@`` userinfo through unmasked (OAuth callbacks, magic-link / pre-signed URLs the agent is meant to follow -- see the web-URL note above). CDP discovery endpoints are NOT such a workflow: their query-string tokens and userinfo passwords are pure credentials that must never reach the logs. So for CDP URLs we opt INTO the two URL redactors that the global pass leaves off. This is the single source of truth for redacting a CDP URL that is passed *directly* to a log or error message. Callers that instead need to redact an exception whose text embeds the URL (e.g. a ``websockets`` connect error) should route that through their own error-text helper, which delegates here -- see ``tools.browser_supervisor._redact_cdp_error_text``. Nr)redact_sensitive_textrQrUr])r%r>s r)redact_cdp_urlr`sK" !u}#e** E ED  #D ) )D  % %D Kr+cfdtjdtfd}t||S)zARedact sensitive query params in HTTP access-log request targets.r@r&c~|d}t|d}|d|S)NrBrCrGrH)r@prefixr0s r)rNz6_redact_http_request_target_query_params.._subs<$QWWQZZ00""5"""r+)rOrPrQ_HTTP_REQUEST_TARGET_QUERY_RErSrTs r)(_redact_http_request_target_query_paramsres>##S#### ) , ,T4 8 88r+c|rd|vsd|vr|St|s|St|S)uNRedact sensitive values in a form-urlencoded body. Only applies when the entire input looks like a pure form body (k=v&k=v with no newlines, no other text). Single-line non-form text passes through unchanged. This is a conservative pass — the `_redact_url_query_params` function handles embedded query strings.  r2) _FORM_BODY_REmatchstripr=r\s r)_redact_form_bodyrksZ 44<<3d??   tzz|| , ,  - --r+ch|sdSd}tD]}||r|}n|rd|dndS)uRedact a prefix-matched credential to a NON-REUSABLE sentinel. Unlike :func:`_mask_token` (which keeps head/tail chars — fine for logs that are never fed back into a config), this emits a marker that: * cannot be mistaken for a usable-but-truncated key, so an agent that reads it from a config file and writes it back does NOT corrupt the stored credential into a dead 13-char string (issue #35519); and * still does not leak the secret material (no head/tail chars). The vendor prefix label is preserved for debuggability so the agent can still tell *which* credential is present (e.g. a GitHub PAT vs an OpenAI key) without seeing any of its bytes. u«redacted-secret»ru «redacted:u…»)_PREFIX_SUBSTRINGS startswith)rlabelrSs r)_mask_token_nonreusablerpsl %$$ E!   C  E E */ I % % % % %4IIr+F)force code_file file_readrqrrrsc |dSt|tst|}|s|S|s ts|S|rd}t|r.|rtnt t  fd|}|sd|vrXd}t||}d|vr6t||}t||}d|vr"d|vrd }t||}d|vr"d|vrd }t||}d |vsd |vrtd |}d|vrtd|}d|vrd}t||}d|vrd|vrt d|}d|vrY|rd}t"||}nt"d|}t$d|}d|vrt&d|}d|vrd|vrt)|}d|vrd} t*| |}|S)uApply all redaction patterns to a block of text. Safe to call on any string -- non-matching text passes through unchanged. Enabled by default. Disable via security.redact_secrets: false in config.yaml. Set force=True for safety boundaries that must never return raw secrets regardless of the user's global logging redaction preference. Set code_file=True to skip the ENV-assignment and JSON-field regex patterns when the text is known to be source code (e.g. MAX_TOKENS=*** constants, "apiKey": "test" fixtures). Prefix patterns, auth headers, private keys, DB connstrings, JWTs, and URL secrets are still redacted. Set file_read=True for file *content* returned to the agent (read_file / search_files / cat). Secrets are STILL redacted — they are never exposed — but prefix-matched credentials are replaced with a non-reusable sentinel (``«redacted:ghp_…»``) instead of a head/tail-preserving mask (``ghp_S1...Pn2T``). The old mask looked like a real-but-truncated key, so an agent reading it from config.yaml and writing it back silently corrupted the stored credential into a dead 13-char value → 401 (issue #35519). The sentinel is syntactically invalid as a token, so it can't be mistaken for a usable key or written back as one. Implies code_file=True (config/data files shouldn't trigger the source-code ENV/JSON false-positive paths). Performance: each regex pattern is gated behind a cheap substring pre-check (e.g. ``"=" in text`` for ENV assignments, ``"://" in text`` for URLs, ``"eyJ" in text`` for JWTs). On a typical hermes log line (no secrets) this drops the 13-pattern scan from ~5.6us to ~1.8us per record (-68%). The pre-checks are conservative — false positives still run the full regex, which then doesn't match. False negatives are impossible because every regex requires the gated substring to match. NTc@|dS)NrBrX)r@ _prefix_subs r)rZz'redact_sensitive_text..#s AGGAJJ(?(?r+r3c|d|d|d}}}t|r|dS|d|t||S)NrBrCrDrr3rI_ENV_LOOKUP_VALUE_RErir/)r@namequoter%s r) _redact_envz*redact_sensitive_text.._redact_env(s{%&WWQZZQWWQZZUe(--e44&771::%CCC E(:(:CECCCr+rF:"c|d|d}}t|r|dS|dt|dS)NrBrCrz: "r~rx)r@rr%s r) _redact_jsonz+redact_sensitive_text.._redact_json;sfWWQZZU(--e44&771::%77+e"4"47777r+c|d|d|d}}}t|r|dS||t|S)NrBrCrDrrx)r@rsepr%s r) _redact_yamlz+redact_sensitive_text.._redact_yamlIss"#''!**aggajj!''!**%S(--e44&771::%8s8K$6$6888r+ uthorization UTHORIZATIONc|d|dpdzt|dzS)NrBrCrrDrIr/rYs r)rZz'redact_sensitive_text..Xs;aggajjAGGAJJ$4"5 AGGAJJ8O8OOr+cr|dt|dzS)NrBrCrrYs r)rZz'redact_sensitive_text..`s'aggajj;qwwqzz#:#::r+ch|dpd}|d}||dS)NrBrrCz:***rX)r@rcdigitss r)_redact_telegramz/redact_sensitive_text.._redact_telegramfs9WWQZZ%2FWWQZZF*f*** *r+BEGINz-----z[REDACTED PRIVATE KEY]c|d}|dr*|dr|dS|dd|dS)NrC{}rrBrrD)rIrnendswith)r@pws r) _redact_dbz)redact_sensitive_text.._redact_dbxspWWQZZ==%%&"++c*:*:&771::%''!**55555r+c\|dd|dS)NrBrrDrXrYs r)rZz'redact_sensitive_text..s(1771::0N0N!''!**0N0Nr+c|dt|d|dS)NrBrCrDrrYs r)rZz'redact_sensitive_text..s<J[%<%<JaggajjJJr+eyJcFt|dS)Nr)r/rIrYs r)rZz'redact_sensitive_text..s[%<%<r+r2+c|d}t|dkr|dddz|ddzS|dddz|ddzS)NrBrCz****r)rIr()r@phones r) _redact_phonez,redact_sensitive_text.._redact_phones`GGAJJE5zzQRaRy6)E"##J66!9v%bcc 2 2r+) isinstancerQ_REDACT_ENABLED_has_known_prefix_substringrpr/ _PREFIX_RErS_ENV_ASSIGN_RE_CFG_DOTTED_RE_CFG_ANCHORED_RE_JSON_FIELD_RE_YAML_ASSIGN_RE_AUTH_HEADER_RE_SECRET_HEADER_RE _TELEGRAM_RE_PRIVATE_KEY_RE_DB_CONNSTR_RE_URL_BARE_TOKEN_RE_JWT_RErk_SIGNAL_PHONE_RE) r>rqrrrsr|rrrrrrvs @r)r_r_s+N |t dC 4yy  _  #4((G1:K-- ~~????FF +; $;; D D D"%%k488D D  %))+t<<'++K>> $;;3$;; 8 8 8"%%lD99D $;;5,, 9 9 9#&&|T::D 4!7!7"" O O    d{{ $$ : :     d{{ + + + 0$77$7d??""#;TBB }}  V 6 6 6 "%%j$77DD!%%&N&NPTUUD"%% J J     }}{{<envsetexportdeclareprintenvcommandc6|rt|tsdStjd|}|D]g}|}|s t j|}n$#t $r|}YnwxYw|r|dtvrdShdS)aReturn True if ``command`` dumps environment variables to stdout. Detects ``env`` / ``printenv`` / ``set`` / ``export`` / ``declare`` as the first token of any segment in a pipeline or sequence (``;`` / ``&&`` / ``||`` / ``|``). Conservative: a parse failure or anything unrecognized returns False (callers then fall back to the safer code_file=True path, which still masks prefix-shaped keys). Fz[|;&]+rT)rrQrOr4rjshlex ValueError_ENV_DUMP_COMMANDS)rsegmentssegtokenss r)is_env_dump_commandrs *Wc22ux 7++H  iikk   ![%%FF ! ! !YY[[FFF !  fQi#55544 5s A  BB)rqoutputcR|s|St|pd }t|||S)uRedact secrets from terminal/process stdout. Single redaction policy for ALL terminal-output surfaces — foreground ``terminal`` results AND background ``process(action=poll/log/wait)`` output — so they can't diverge. Picks ``code_file`` based on whether ``command`` is an environment dump: - env-dump command (``env``/``printenv``/``set``/``export``/``declare``) → ``code_file=False`` so the ENV-assignment pass masks opaque tokens. - anything else (or unknown command) → ``code_file=True`` to avoid false positives on source/config dumps. ``force=True`` bypasses the global ``security.redact_secrets`` preference for safety boundaries that must never emit raw credentials. r)rqrr)rr_)rrrqrrs r)redact_terminal_outputrs:$  ' 2666I u J J JJr+patterncTd}t|D]\}}||vr |d|cS|S)aGReturn the leading literal characters of a regex pattern. Stops at the first regex metacharacter (``[``, ``(``, ``\``, ``.``, ``?``, ``*``, ``+``, ``|``, ``{``, ``^``, ``$``). Returns the literal that any match of the pattern MUST contain as a substring, so the pre-screen never produces false negatives. z [(\.?*+|{^$N) enumerate)rmetaichs r)_extract_literal_prefixrsK D7##2 ::2A2;     Nr+c#4K|]}t|VdSN)r).0ps r) rs<#$Ar+cDtfdtDS)zReturn True if ``text`` contains any known credential prefix substring. Used as a cheap pre-check before invoking the expensive ``_PREFIX_RE``. c3 K|]}|vV dSr)rrr>s r)rz._has_known_prefix_substring.. s'55QqDy555555r+)anyrmr\s`r)rrs) 5555"4555 5 55r+) zGET zPOST zPUT zPATCH zDELETE zHEAD zOPTIONS zTRACE zCONNECT cl|tfdtDS)z?Cheap pre-check before scanning for access-log request targets.c3 K|]}|vV dSrr)rmethoduppers r)rz-_has_http_method_substring.. s'EE6vEEEEEEr+)rr_HTTP_METHOD_SUBSTRINGS)r>rs @r)_has_http_method_substringrs4 JJLLE EEEE-DEEE E EEr+cBeZdZdZdfd Zdejdeffd ZxZ S) RedactingFormatterz9Log formatter that redacts secrets from all log messages.N%c @tj|||fi|dSr)super__init__)selffmtdatefmtstylekwargs __class__s r)rzRedactingFormatter.__init__&s,gu7777777r+recordr&cdt|}t|Sr)rformatr_)rroriginalrs r)rzRedactingFormatter.format)s&77>>&))$X...r+)NNr) __name__ __module__ __qualname____doc__rlogging LogRecordrQr __classcell__)rs@r)rr#srCC888888/W./3//////////r+rr)ErrosrOr getLoggerrlogger frozensetr8_SENSITIVE_BODY_KEYSgetenvr7r_PREFIX_PATTERNS_SECRET_ENV_NAMEScompiler_SECRET_CFG_NAMES _CFG_VALUEry IGNORECASEr MULTILINEr_YAML_CFG_NAMESr_JSON_KEY_NAMESrr_SECRET_HEADER_NAMESrrrrrrrrRr[rdrhr9rrQintr*r/r=rUr]objectr`rerkrpboolr_rrrrtuplermrrr Formatterrrr+r)rs  8 $ $ $)%%%,!y"""4")3V<<BBDDHbb***^QU+UUU*W / "rz7/@* M 2:`0A``T^``MBL P"*]]]]MBL  Z-/---M""*FM[BJ, ,,,Mrz* "*OVM( RZM  "*%  2:ABB  RZ2:2!+ M!! O RZSXX&6777:OO ,/,/,/ ,/ ,/  ,/  ,/  ,/ ,/ ,/,/,/,/^8s8s8888, .3 .3 . . . . s s    &S293939999 .C .C . . . . J3J3JJJJ<        RYNNNOOt6(,K>CKKK K*K7;KKKKKF S S    U(8 6c6d6666 FSFTFFFF /////*/////r+