From bc7417254f2de6f1c522e3626e6608c69ed7b85e Mon Sep 17 00:00:00 2001
From: luyifan <al3060388206@gmail.com>
Date: Tue, 30 Jun 2026 09:01:02 +0800
Subject: [PATCH] fix(redact): strip controls from masked secrets

---
 agent/redact.py            |  5 +++++
 tests/agent/test_redact.py | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/agent/redact.py b/agent/redact.py
index 6b37d2c4c7110..02c700f333e3e 100644
--- a/agent/redact.py
+++ b/agent/redact.py
@@ -305,6 +305,8 @@
     r"(?<![A-Za-z0-9_-])(" + "|".join(_PREFIX_PATTERNS) + r")(?![A-Za-z0-9_-])"
 )
 
+_CONTROL_CHARS_RE = re.compile(r"[\x00-\x1f\x7f-\x9f]")
+
 
 def mask_secret(
     value: str,
@@ -346,6 +348,9 @@ def mask_secret(
         >>> mask_secret("long-token", head=6, tail=4, floor=18)
         '***'
     """
+    if not value:
+        return empty
+    value = _CONTROL_CHARS_RE.sub("", value)
     if not value:
         return empty
     if len(value) < floor:
diff --git a/tests/agent/test_redact.py b/tests/agent/test_redact.py
index 57956a383b0e8..de116ee16705f 100644
--- a/tests/agent/test_redact.py
+++ b/tests/agent/test_redact.py
@@ -4,7 +4,7 @@
 
 import pytest
 
-from agent.redact import redact_cdp_url, redact_sensitive_text, RedactingFormatter
+from agent.redact import mask_secret, redact_cdp_url, redact_sensitive_text, RedactingFormatter
 
 
 @pytest.fixture(autouse=True)
@@ -15,6 +15,21 @@ def _ensure_redaction_enabled(monkeypatch):
     monkeypatch.setattr("agent.redact._REDACT_ENABLED", True)
 
 
+class TestMaskSecret:
+    def test_printable_secret_mask_shape_is_unchanged(self):
+        assert mask_secret("abcd0123456789zzzz") == "abcd...zzzz"
+
+    def test_strips_controls_from_visible_segments(self):
+        masked = mask_secret("ab\ncd0123456789zz\x85q", empty="missing")
+
+        assert "\n" not in masked
+        assert "\x85" not in masked
+        assert masked == "abcd...9zzq"
+
+    def test_all_control_input_uses_empty_fallback(self):
+        assert mask_secret("\x00\n\x85", empty="missing") == "missing"
+
+
 class TestKnownPrefixes:
     def test_openai_sk_key(self):
         text = "Using key sk-proj-abc123def456ghi789jkl012"