fix(redact): mask secrets in Python mapping reprs

[aerbaser]

What does this PR do?

Masks opaque credential values embedded in Python mapping repr output, including pytest/traceback shapes such as:

E       kwargs={'env': {'BRAVE_API_KEY': 'opaque-provider-value'}}

Hermes already redacts KEY=value, double-quoted JSON fields, known vendor prefixes, headers, URLs, and other credential forms. Python repr normally uses single-quoted mapping fields, so an opaque value with no recognized vendor prefix bypassed both redact_sensitive_text(..., force=True) and pytest diagnostic output.

Before

sample = "kwargs={'env': {'BRAVE_API_KEY': 'opaque-provider-value-1234567890'}}"
redact_sensitive_text(sample, force=True) == sample

After

kwargs={'env': {'BRAVE_API_KEY': '***'}}

The full value is replaced with *** rather than a head/tail mask. This prevents an escaped quote from being split at a masking boundary and keeps real repr() output parseable for both str and bytes values.

Design

• Captures identifier-shaped keys, then applies a high-confidence policy:
  • exact established credential fields (api_key, access_token, client_secret, private_key, etc.);
  • uppercase env keys ending in credential suffixes (_API_KEY, _TOKEN, _PASSWORD, etc.).
• Explicitly leaves metadata such as TOKEN_COUNT, AUTH_METHOD, PASSWORD_POLICY, SECRET_NAME, and CREDENTIAL_TYPE unchanged.
• Supports single- or double-quoted values, optional b prefixes, and escaped characters.
• Preserves programmatic env lookup fixtures such as {'API_KEY': "os.getenv('OPENAI_API_KEY')"}.
• Keeps code_file=True byte-preserving.
• At terminal/process boundaries, applies repr masking only to high-confidence pytest diagnostic lines (E ...) and final Python *Error / *Exception / *Warning lines. Ordinary source emitted by cat, Python scripts, or pytest remains unchanged.
• Diagnostic classification is content-based rather than launcher-based, so wrapped invocations (uv run pytest, poetry run pytest, coverage run -m pytest, /usr/bin/env pytest, etc.) behave consistently.
• Uses the existing redaction preference and force=True behavior; no new config or tool surface.

Related work

• fix(config): redact model api_key in config show output #50259 documented the same single-quoted Python-dict limitation for hermes config show, but that report was closed as implemented through a config-specific structured path rather than the generic log/terminal redactor.
• fix(agent): escape-aware JSON field redaction for embedded quotes #69196 addresses escaped quotes inside double-quoted JSON fields. This PR is complementary: it adds a separate Python-repr matcher and does not modify _JSON_FIELD_RE.

No exact open issue/PR for generic Python mapping repr redaction was found.

Type of change

• Bug fix
• Security hardening
• Tests

Verification

scripts/run_tests.sh \
  tests/agent/test_redact.py \
  tests/tools/test_terminal_output_transform_hook.py -q
→ 198 passed

uvx --from ruff==0.15.10 ruff check agent/redact.py tests/agent/test_redact.py
→ All checks passed

python3 -m py_compile agent/redact.py tests/agent/test_redact.py
git diff --check
→ passed

Additional synthetic verification:

• 32-case escaped str/bytes repr oracle passed with ast.literal_eval;
• 6 negative metadata-key controls passed;
• 7 wrapped pytest launcher diagnostics passed;
• Python/cat/pytest source-preservation controls passed;
• a 1,000,039-character escaped repr value was fully masked in ~109 ms on the test host.

All test values are synthetic; no real credentials are used.

Checklist

• Scoped to agent/redact.py and tests/agent/test_redact.py
• Existing source-code false-positive protections preserved
• Focused canonical test runner passed
• Ruff and syntax checks passed
• No config/schema/tool changes
• Linux verification

[teknium1]

Thanks for tracing the single-quoted repr() gap. Current main still lacks this coverage: agent/redact.py:700-764 has only ENV, double-quoted JSON, and YAML structured-field passes, so the reported opaque dict-repr shape remains exposed.

Problems

• tools/code_execution_tool.py:1152-1156 and :1572-1580 redact executor output with code_file=True. The PR adds the generic repr pass only under not code_file and calls its diagnostic-only helper only from redact_terminal_output; therefore equivalent traceback/pytest diagnostics from execute_code remain unmasked.

Suggested changes

• Reuse the narrow diagnostic repr pass for both code-execution output paths, with regression tests covering stdout/stderr diagnostics and source-preservation controls.
• During salvage, retain current main's false-positive guard at agent/redact.py:245-260 and config-regex pre-gate at :724-733; GitHub currently reports this PR as merge-conflicted.

Automated hermes-sweeper review.

[teknium1]

Salvaged onto current main in #92586 (your commit cherry-picked, authorship preserved) with two additions: the conflict resolution keeps main's newer .env-file-read gate in redact_terminal_output, and the repr key class was widened to mixed-case credential suffixes (UserPassword, sessionToken) per the same gap OpenHands fixed in software-agent-sdk#4508. Thanks @aerbaser — credit stays with you in the git history. #92586 will close this when it merges.

[teknium1]

Landed via #92586 — thanks @aerbaser. Merged as 5280dec0ee with your commits on main under your authorship; we added one guard so the repr pass leaves values an upstream pass already masked alone (kept Digest *** intact).