fix(security): mask secret values in secret-source status lines

[andrexibiza]

Related #60295 #69054

What changed and why

The startup status block in hermes_cli/env_loader.py prints secret-source error, remediation-hint, warning, and conflict lines straight to stderr. The merged secret-name suppression (#60295 / #69054) removed the applied-name list from the status line — but a source error or warning that echoes a secret value (e.g. a backend quoting the key back) would still print that value.

This PR routes all four status-line types through a value masker:

• agent/redact.py::mask_known_secret_values() — masks the exact values of credential-named env vars (*_API_KEY, *_TOKEN, *_SECRET, *_KEY, *_PASSWORD), catching opaque tokens that carry no recognizable vendor prefix and would slip past the shape-based regex passes.
• hermes_cli/env_loader.py::_mask_secret_text() — additionally masks every value applied from external secret sources this process (Bitwarden / 1Password / command sources), which is the authoritative set for what the status line is about.

Why this matters to you as a user

Secret names already stopped being printed at startup; now secret values cannot leak through error or warning text either. If a backend echoes your key back inside an error message, you still see the diagnostic — just without the key in it. This closes the value half of the same disclosure class the name fix addressed.

Reproduction steps (current behavior on main)

1. Configure BWS per the docs and export BWS_ACCESS_TOKEN.
2. Point secrets.bitwarden.access_token_env at a token whose value contains a recognizable prefix, or force any source error/warning that quotes a credential value.
3. Observe stderr — the value appears verbatim in the status line.

Current: Bitwarden Secrets Manager: <error text containing the raw secret value>
Expected: same diagnostic with the value replaced by ***.

How to test

• scripts/run_tests.sh tests/test_env_loader_secret_sources.py → 20 passed (2 new regression tests: value-in-warning masked, value-in-error masked while the diagnostic is preserved).
• scripts/run_tests.sh tests/test_env_loader.py tests/test_env_loader_applied_homes.py tests/secret_sources/ tests/agent/test_redact.py tests/hermes_cli/test_redact_config_bridge.py → 143 passed, 0 failed.

Platforms tested

• Windows 11 (git-bash), Python 3.11, canonical scripts/run_tests.sh runner.
• git diff --check clean; check-windows-footguns.py clean on changed files.

Related

• Continues the disclosure-class work from Stop printing Bitwarden secret names during env load #60295 / fix(secrets): stop printing secret names during env load (salvage #60295) #69054 (names) — this is the values half. Follow-on PR in the same series adds handler-level log redaction and widens the tool-output redactor.

Part of #77162
Part of #77165

[teknium1]

Thanks for covering the direct stderr status path; the premise holds on current main: hermes_cli/env_loader.py:563-571 prints source errors, hints, warnings, and conflicts without redaction.

Problems

• In ef46cf0, _mask_secret_text() scans every _SECRET_SOURCE_VALUES_BY_HOME snapshot. Those snapshots are intentionally per-home (hermes_cli/env_loader.py:39-41, 159-164); status output for one profile should not depend on another profile's values.
• ef46cf0 skips exact values shorter than six characters. A short external-source *_PASSWORD or *_TOKEN echoed by a backend would still leak through the status line.

Suggested changes

• Thread home_path into _mask_secret_text() and inspect only that resolved home's snapshot.
• Mask every non-empty value from that authoritative source snapshot, and add short-value plus cross-home regression tests.

Automated hermes-sweeper review.

[andrexibiza]

Fixed in 35c592a77f. Both points addressed:

• Home-scoped masking — _mask_secret_text(text, home_path) now resolves home_path and reads only that home's snapshot (_SECRET_SOURCE_VALUES_BY_HOME[home_key]). Status output for one profile no longer depends on — or masks against — another profile's values.
• No minimum-length filter — every non-empty value from the home's authoritative snapshot is masked. A short external-source *_PASSWORD / *_TOKEN echoed by a backend can no longer leak through a status line (the generic agent.redact env scan skips values under 6 chars, so the snapshot pass is the only thing that can catch these).

Regression tests added to tests/test_env_loader_secret_sources.py:

• test_status_warning_with_short_secret_value_is_masked — a 2-char applied value echoed in a warning is masked through the real apply path.
• test_mask_secret_text_scoped_to_own_home_snapshot — cross-home isolation: each home's status line masks only its own snapshot values, leaving the other home's value untouched.

Validation: scripts/run_tests.sh tests/test_env_loader_secret_sources.py → 22 passed, 0 failed (2 new tests included); git diff --check clean; scripts/check-windows-footguns.py → no footguns.

[andrexibiza]

Addressed both sweeper items. Ready for another look.

[GottZ]

This was generated by AI during triage.

Summary

Three PRs address related secret-value disclosure paths: #77012 masks external-secret-source status errors, hints, warnings, and conflicts with home-scoped snapshots; #77014 combined an earlier status-path implementation with formatter-wide masking; and #77020 independently adds formatter-wide masking for opaque credential environment values while preserving the global opt-out.

Related pull requests

• fix(security): mask secret values in secret-source status lines #77012 related — (+235/-4) — n/a: Masks secret values in source status errors, remediation hints, warnings, and conflicts using only the current home's snapshot plus credential-named environment values. Consistent with the automated keep-open verdict, the complete diff now addresses its two cited problems by masking every non-empty snapshot value and adding short-value and cross-home regression tests.
• feat(security): mask opaque credential values in log output #77014 [closed] related — (+201/-5) — n/a: Closed precursor combining status-path masking with RedactingFormatter wiring; it remains relevant because its status work overlaps fix(security): mask secret values in secret-source status lines #77012 while its formatter scope is now represented independently by feat(security): mask opaque credential values in log output #77020. The author's stated future fold into fix(security): mask secret values in secret-source status lines #77012 is not present in fix(security): mask secret values in secret-source status lines #77012's current diff, which adds the shared helper but does not wire it into RedactingFormatter.
• feat(security): mask opaque credential values in log output #77020 related — (+123/-1) — n/a: Independently masks opaque values of credential-named environment variables in RedactingFormatter, with focused formatter tests. The contributor's COMMENTED keep-open review requested preserving _REDACT_ENABLED and adding a disabled-setting regression test; the complete diff implements both, so that review does not describe an outstanding blocker.

Duplicates

#77014 substantially overlaps #77012 on status-line masking and #77020 on formatter masking, but #77012 and #77020 cover distinct output paths and are not duplicates of each other.

Suggested consolidation

Keep #77012 open with the salvage path of its home-scoped status-output masking and short-value/cross-home tests, and keep #77020 open with the salvage path of its opt-out-aware formatter masking and disabled-setting test. Retain already-closed #77014 as the superseded combined precursor; its two substantive parts are covered separately by #77012 and #77020.

Cross-PR triage: Reviewed 3 pull requests and 0 issues in this complex. Each diff was read against this issue; Assessment working set: 28 kB of PR diffs, 7 kB of issue/PR text, 4 kB of discussion (6 comments), 0 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.

[andrexibiza]

Both sweeper findings were addressed in the current head (35c592a): (1) home-scoped masking — _mask_secret_text(text, home_path) resolves and reads only that homes snapshot, so one profiles status output no longer depends on another profiles values; (2) short values — every non-empty value from the authoritative source snapshot is masked, with short-value and cross-home regression tests added. The GottZ delta confirms the diff now addresses both cited problems. Ready for another look.