fix(redact): don't mask programmatic env lookups in KEY=value redaction (salvage #2854) - #58534
Merged
Merged
Conversation
'KEY=os.getenv(...)' / 'os.environ[...]' / 'process.env.X' values are variable-name references in code snippets, not leaked secrets. Masking them corrupted pasted code in prose/log contexts (issue #2852): ha_token=os.getenv('HOMEASSISTANT_TOKEN') -> ha_token=os.get...EN'). Skip these values inside _redact_env, which covers all three passes that share the closure (_ENV_ASSIGN_RE, _CFG_DOTTED_RE, _CFG_ANCHORED_RE). Real secret values are still masked. Salvage of PR #2852-fix #2854 — the PR's own placement (an unconditional pass before the code_file gate) would have reintroduced the code-file false-positive class; the skip is applied inside the existing gated pass instead. Tests adapted from the PR. Co-authored-by: crazywriter1 <sampiyonyus@gmail.com>
alt-glitch
added
type/bug
Collaborator
Salvage of #2854 (@crazywriter1) fixing #2852 — related, not a duplicate: the redaction skip was relocated inside the gated |
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
…redact-getenv-skip fix(redact): don't mask programmatic env lookups in KEY=value redaction (salvage NousResearch#2854)
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…redact-getenv-skip fix(redact): don't mask programmatic env lookups in KEY=value redaction (salvage NousResearch#2854)
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…redact-getenv-skip fix(redact): don't mask programmatic env lookups in KEY=value redaction (salvage NousResearch#2854)
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…redact-getenv-skip fix(redact): don't mask programmatic env lookups in KEY=value redaction (salvage NousResearch#2854)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The secret redactor no longer corrupts pasted code that assigns from environment lookups —
ha_token=os.getenv('HOMEASSISTANT_TOKEN')stays intact instead of becomingha_token=os.get...EN'). Fixes #2852.Salvage of #2854 by @crazywriter1 — same intent, relocated: the PR inserted an unconditional redaction pass before the
code_filegate that grew after it branched, which would have reintroduced the code-file false-positive class and duplicated the env pass. The skip now lives inside the existing gated_redact_envclosure, which all three relevant regex passes share (_ENV_ASSIGN_RE,_CFG_DOTTED_RE,_CFG_ANCHORED_RE) — so the lowercaseha_token=corruption the issue reported is fixed too, which the PR's placement missed. Tests adapted from the PR; co-authored credit on the commit.Changes
agent/redact.py:_ENV_LOOKUP_VALUE_RE(os.getenv/os.environ[...]/os.environ.get/process.env/$ENV{) + skip inside_redact_env(+13).tests/agent/test_redact.py:TestEnvLookupPreserved— 9 tests incl. negatives proving real secrets still mask (+46).Validation
MY_API_KEY=os.getenv('OPENAI_API_KEY')MY_API_KEY=***ha_token=os.getenv("HOMEASSISTANT_TOKEN")ha_token=os.get...EN")OPENAI_API_KEY=sk-abc123...tests/agent/test_redact.py(full file)Infographic