feat(plugins): redaction pattern registry — vendor token formats as plugins

[webdevtodayjason]

Tracking home: #65449 (Phase 1 of the plugin-interface expansion tracker #64182). Rebased onto current main; the safety properties below are the review bar adopted there.

What does this PR do?

Third piece of the plugin-interface expansion work (with #58524 and #58538): an additive-only redaction pattern registry, so provider plugins own their vendor's token format instead of patching core.

Every new vendor token format has historically been a one-line core PR appending to _PREFIX_PATTERNS in agent/redact.py. That is how fw_, retaindb_, hsk-, mem0_, and brv_ got there, with #58466/#58501 the latest of the class. This makes that class plugin territory:

• agent/redact.py: register_redaction_patterns(patterns, source) validates each pattern, dedupes against built-ins and prior registrations, then atomically rebuilds _PREFIX_RE / _PREFIX_SUBSTRINGS. Registered patterns get identical treatment to built-ins everywhere they apply: same head/tail masking, same non-reusable «redacted:label…» sentinel on file_read content ([Bug]: redact_sensitive_text corrupts API keys in config files when read via read_file/search_files, causing 401 #35519 semantics), same security.redact_secrets operator opt-out.
• Validation is structural, not advisory. Each pattern must compile; must start with at least 2 literal characters (keeps the pre-screen substring gate effective and makes redact-everything patterns like .* structurally impossible); must not contain a top-level alternation (ab|.* would escape the literal-prefix guarantee through its unprefixed branch); and must not nest unbounded quantifiers ((a+)+-style ReDoS shapes are rejected at registration, since registered patterns run against every log line and tool output). Invalid entries are warned and skipped, never raised, so a broken plugin cannot break startup.
• Additive-only by design: there is no API to remove or weaken a built-in pattern. A plugin can only ever over-redact, never expose.
• hermes_cli/plugins.py: PluginContext.register_redaction_patterns() with per-plugin attribution; warns and returns 0 on any failure.
• No bundled vendor plugin: per repo policy, vendor integrations ship as standalone plugin repos, so the earlier nvapi-redaction reference plugin was removed from this PR. End-to-end register() coverage runs through a synthetic plugin written at test time; nvapi-redaction (NVIDIA nvapi- keys, used by NIM / build.nvidia.com endpoints) is ready to publish as a standalone plugin repo once this lands.

Zero behavior change without plugins

With no plugin registered, _PREFIX_RE / _PREFIX_SUBSTRINGS are byte-identical to today's. Existing redaction suites (tests/agent/test_redact.py, tests/tools/test_kanban_redaction.py) pass untouched.

Testing

17 tests in tests/test_redaction_registry.py: baseline gap documentation, masking + built-ins unaffected, invalid-regex / no-literal-prefix / top-level-alternation / nested-unbounded-quantifier / dedupe / non-string rejection, accepted-shape coverage (grouped alternation, literal pipes, bounded quantifiers inside unbounded groups, quantifier chars in character classes), file_read sentinel labeling, reset semantics, PluginContext wiring incl. exception isolation, and a no-mocks end-to-end through a synthetic plugin written at test time. ruff check clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FWMcB7RPSYUpsXDfBgwjzM

[teknium1]

Thanks for isolating the redaction-format gap behind a generic plugin seam. Current main still keeps vendor token formats in agent/redact.py:71-113, so the underlying gap is real.

Problems

• plugins/nvapi-redaction/plugin.yaml:1 adds a vendor-specific NVIDIA plugin to the core tree. AGENTS.md:797-813 requires new third-party vendor integrations to ship as standalone plugin repositories rather than bundled directories.
• In commit 8ba64514, the validation in agent/redact.py does not uphold its stated no-redact-everything guarantee: ab|.* compiles and has the accepted ab literal prefix, while the .* branch remains unprefixed. _extract_literal_prefix() stops at | (agent/redact.py:756-768 on main). The added tests do not cover this shape.

Suggested changes

• Publish nvapi-redaction independently and keep this PR focused on the generic surface.
• Restrict accepted regex structure or reject alternation/unprefixed branches, with a regression test for ab|.*.

This is an automated hermes-sweeper review.

[teknium1]

This introduces an NVIDIA-specific vendor integration under plugins/. AGENTS.md:797-813 requires new third-party integrations to be published as standalone plugins instead; please remove this bundled reference plugin and publish it independently.

[webdevtodayjason]

Both fixed in 165e0e68f.

The alternation bypass was a real hole, good catch. register_redaction_patterns now rejects any pattern with a top-level alternation ('ab|.' and 'ab|cd' both refused with a warning that points authors at the grouped form). Grouped alternation after the prefix (ab(?:x|y)), escaped pipes, and character-class pipes remain accepted, each pinned by its own test, and the regression test covers your exact 'ab|.' shape.

The bundled nvapi-redaction plugin is removed per the AGENTS.md standalone-repo policy; I'll publish it independently. The end-to-end register() coverage that used it now runs through a synthetic plugin written at test time, so the PR stays focused on the generic surface. Suites: tests/test_redaction_registry.py 15 passed, tests/agent/test_redact.py unchanged and green (148 total across both).

[teknium1]

Merged via #84927 with your commit intact (rebase-merge, authorship preserved) — ctx.register_redaction_patterns() is on main with the over-redact-only construction, plus salvage hardening (top-level alternation + ReDoS-shape rejection, per-source attribution). Per repo policy the nvapi reference plugin moved out-of-tree (the e2e test builds a synthetic plugin instead). Thanks @webdevtodayjason! Closing this original. (#65449)