
    i                        d Z ddlZddlZddlZ ej        e          Z ej        dd                                          dvZ	g dZ
dZ ej        de d	          Zd
Z ej        de dej                  Z ej        dej                  Z ej        d          Z ej        d          Z ej        dej                  Z ej        d          Z ej        d          Z ej        d          Z ej        dd                    e
          z   dz             ZdedefdZdedefdZ G d dej                  ZdS )a2  Regex-based secret redaction for logs and tool output.

Applies pattern matching to mask API keys, tokens, and credentials
before they reach log files, verbose output, or gateway logs.

Short tokens (< 18 chars) are fully masked. Longer tokens preserve
the first 6 and last 4 characters for debuggability.
    NHERMES_REDACT_SECRETS )0falsenooff)#zsk-[A-Za-z0-9_-]{10,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_[A-Za-z0-9_-]{10,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}zgsk_[A-Za-z0-9]{10,}zsyt_[A-Za-z0-9]{10,}zretaindb_[A-Za-z0-9]{10,}zhsk-[A-Za-z0-9]{10,}zmem0_[A-Za-z0-9]{10,}zbrv_[A-Za-z0-9]{10,}z9(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)z([A-Z0-9_]{0,50}z&[A-Z0-9_]{0,50})\s*=\s*(['\"]?)(\S+)\2z(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)"z!(Authorization:\s*Bearer\s+)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zK((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:]+:)([^@]+)(@)z2eyJ[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_=-]{4,}){0,2}z<@!?(\d{17,20})>z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z(?<![A-Za-z0-9_-])(|z)(?![A-Za-z0-9_-])tokenreturnc                 Z    t          |           dk     rdS | dd          d| dd          S )z0Mask a token, preserving prefix for long tokens.   ***N   z...)len)r
   s    4/home/agentuser/.hermes/hermes-agent/agent/redact.py_mask_tokenr   u   s:    
5zzBuBQBi((E"##J(((    textc                    | dS t          | t                    st          |           } | s| S t          s| S t                              d |           } d }t
                              ||           } d }t                              ||           } t                              d |           } d }t                              ||           } t                              d|           } t                              d |           } t                              d	 |           } t                              d
 |           } d }t                              ||           } | S )zApply all redaction patterns to a block of text.

    Safe to call on any string -- non-matching text passes through unchanged.
    Disabled when security.redact_secrets is false in config.yaml.
    Nc                 F    t          |                     d                    S )N   r   groupms    r   <lambda>z'redact_sensitive_text.<locals>.<lambda>   s    K

$;$; r   c                     |                      d          |                      d          |                      d          }}}| d| t          |           | S )Nr         =r   r   )r   namequotevalues       r   _redact_envz*redact_sensitive_text.<locals>._redact_env   sS    WWQZZQWWQZZUe;;;E 2 2;E;;;r   c                     |                      d          |                      d          }}| dt          |           dS )Nr   r   z: ""r"   )r   keyr%   s      r   _redact_jsonz+redact_sensitive_text.<locals>._redact_json   s>    WWQZZU//+e,,////r   c                 r    |                      d          t          |                      d                    z   S )Nr   r   r"   r   s    r   r   z'redact_sensitive_text.<locals>.<lambda>   s'    !''!**{1771::666 r   c                 h    |                      d          pd}|                      d          }| | dS )Nr   r   r   z:***r   )r   prefixdigitss      r   _redact_telegramz/redact_sensitive_text.<locals>._redact_telegram   s9    !r&&&&&&r   z[REDACTED PRIVATE KEY]c                 \    |                      d           d|                      d           S )Nr   r   r    r-   r   s    r   r   z'redact_sensitive_text.<locals>.<lambda>   s(    1771::(F(F!''!**(F(F r   c                 F    t          |                     d                    S )Nr   r   r   s    r   r   z'redact_sensitive_text.<locals>.<lambda>   s    QWWQZZ!8!8 r   c                 @    dd|                      d          v rdnd dS )Nz<@!r   r   z***>r-   r   s    r   r   z'redact_sensitive_text.<locals>.<lambda>   s+    -X

9J9J##PR-X-X-X r   c                     |                      d          }t          |          dk    r|d d         dz   |dd          z   S |d d         dz   |dd          z   S )Nr      r   z****   r   )r   r   )r   phones     r   _redact_phonez,redact_sensitive_text.<locals>._redact_phone   s`    

u::??!9v%bcc
22RaRy6!E"##J..r   )
isinstancestr_REDACT_ENABLED
_PREFIX_REsub_ENV_ASSIGN_RE_JSON_FIELD_RE_AUTH_HEADER_RE_TELEGRAM_RE_PRIVATE_KEY_RE_DB_CONNSTR_RE_JWT_RE_DISCORD_MENTION_RE_SIGNAL_PHONE_RE)r   r&   r*   r0   r:   s        r   redact_sensitive_textrI   |   s    |tdC   4yy   >>;;TBBD< < < k400D0 0 0 lD11D 66 D' ' ' ,d33D 7>>D FFMMD ;;88$??D ""#X#XZ^__D/ / /
 t44DKr   c                   B     e Zd ZdZd fd	Zdej        def fdZ xZ	S )	RedactingFormatterz9Log formatter that redacts secrets from all log messages.N%c                 @     t                      j        |||fi | d S N)super__init__)selffmtdatefmtstylekwargs	__class__s        r   rP   zRedactingFormatter.__init__   s,    gu7777777r   recordr   c                 d    t                                          |          }t          |          S rN   )rO   formatrI   )rQ   rW   originalrV   s      r   rY   zRedactingFormatter.format   s&    77>>&))$X...r   )NNrL   )
__name__
__module____qualname____doc__rP   logging	LogRecordr<   rY   __classcell__)rV   s   @r   rK   rK      sr        CC8 8 8 8 8 8/W. /3 / / / / / / / / / /r   rK   )r^   r_   osre	getLoggerr[   loggergetenvlowerr=   _PREFIX_PATTERNS_SECRET_ENV_NAMEScompiler@   _JSON_KEY_NAMES
IGNORECASErA   rB   rC   rD   rE   rF   rG   rH   joinr>   r<   r   rI   	FormatterrK    r   r   <module>rp      s,     				 						8	$	$ ")3R88>>@@Hcc$ $ $ N Q U+UUU 
 Z-/---M  "*(M  rz* 
 "*O  RM  "*%  !bj!455  2:ABB  RZSXX&6777:OO 

)s )s ) ) ) )? ? ? ? ? ?D/ / / / /* / / / / /r   