§
    ‰eîiv1  ã                   ó\  — d Z ddlZddlZddlZ ej        e¦  «        Z eh d£¦  «        Z eh d£¦  «        Z	 ej
        dd¦  «                             ¦   «         dvZg d¢Zd	Z ej        d
e› d�¦  «        ZdZ ej        de› d�ej        ¦  «        Z ej        dej        ¦  «        Z ej        d¦  «        Z ej        d¦  «        Z ej        dej        ¦  «        Z ej        d¦  «        Z ej        d¦  «        Z ej        d¦  «        Z ej        d¦  «        Z ej        d¦  «        Z ej        d¦  «        Z ej        dd                     e¦  «        z   dz   ¦  «        Zde de fd„Z!de de fd „Z"d!e de fd"„Z#d!e de fd#„Z$d!e de fd$„Z%d!e de fd%„Z& G d&„ d'ej'        ¦  «        Z(dS )(a2  Regex-based secret redaction for logs and tool output.

Applies pattern matching to mask API keys, tokens, and credentials
before they reach log files, verbose output, or gateway logs.

Short tokens (< 18 chars) are fully masked. Longer tokens preserve
the first 6 and last 4 characters for debuggability.
é    N>   úx-amz-signatureÚjwtÚkeyÚauthÚcodeÚtokenÚapikeyÚsecretÚapi_keyÚsessionÚid_tokenÚpasswordÚ	signatureÚaccess_tokenÚclient_secretÚrefresh_token>   r   r   r   r   r	   r
   r   r   r   Úprivate_keyr   Úauthorizationr   r   ÚHERMES_REDACT_SECRETSÚ )Ú0ÚfalseÚnoÚoff)#zsk-[A-Za-z0-9_-]{10,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_[A-Za-z0-9_-]{10,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}zgsk_[A-Za-z0-9]{10,}zsyt_[A-Za-z0-9]{10,}zretaindb_[A-Za-z0-9]{10,}zhsk-[A-Za-z0-9]{10,}zmem0_[A-Za-z0-9]{10,}zbrv_[A-Za-z0-9]{10,}z9(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)z([A-Z0-9_]{0,50}z&[A-Z0-9_]{0,50})\s*=\s*(['\"]?)(\S+)\2z„(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)"z!(Authorization:\s*Bearer\s+)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zK((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:]+:)([^@]+)(@)z2eyJ[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_=-]{4,}){0,2}z<@!?(\d{17,20})>z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z;(https?|wss?|ftp)://([^\s/?#]+)([^\s?#]*)\?([^\s#]+)(#\S*)?z+(https?|wss?|ftp)://([^/\s:@]+):([^/\s@]+)@zH^[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*(?:&[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*)+$z(?<![A-Za-z0-9_-])(ú|z)(?![A-Za-z0-9_-])r   Úreturnc                 óZ   — t          | ¦  «        dk     rdS | dd…         › d| dd…         › �S )z0Mask a token, preserving prefix for long tokens.é   ú***Né   z...éüÿÿÿ)Úlen)r   s    ú./home/div/.hermes/hermes-agent/agent/redact.pyÚ_mask_tokenr$   ·   s:   € å
ˆ5�z„z�B‚€ØˆuØ�B�Q�BŒiÐ(Ð(˜E " # #œJÐ(Ð(Ð(ó    Úqueryc                 ó`  — | s| S g }|                       d¦  «        D ]~}d|vr|                     |¦  «         Œ|                     d¦  «        \  }}}|                     ¦   «         t          v r|                     |› d�¦  «         Œi|                     |¦  «         Œd                     |¦  «        S )a   Redact sensitive parameter values in a URL query string.

    Handles `k=v&k=v` format. Sensitive keys (case-insensitive) have values
    replaced with `***`. Non-sensitive keys pass through unchanged.
    Empty or malformed pairs are preserved as-is.
    ú&ú=z=***)ÚsplitÚappendÚ	partitionÚlowerÚ_SENSITIVE_QUERY_PARAMSÚjoin)r&   ÚpartsÚpairr   Ú_Úvalues         r#   Ú_redact_query_stringr4   ¾   sº   € ð ð ØˆØ€EØ—’˜CÑ Ô ð ð ˆØ�dˆ?ˆ?Ø�LŠL˜ÑÔÐØØŸš sÑ+Ô+‰ˆˆQ�Ø�9Š9‰;Œ;Õ1Ð1Ð1Ø�LŠL˜C˜˜˜Ñ&Ô&Ð&Ð&à�LŠL˜ÑÔÐÐØ�8Š8�E‰?Œ?Ðr%   Útextc                 óf   — dt           j        dt          fd„}t                               || ¦  «        S )uà   Scan text for URLs with query strings and redact sensitive params.

    Catches opaque tokens that don't match vendor prefix regexes, e.g.
    `https://example.com/cb?code=ABC123&state=xyz` â†’ `...?code=***&state=xyz`.
    Úmr   c                 ó  — |                       d¦  «        }|                       d¦  «        }|                       d¦  «        }t          |                       d¦  «        ¦  «        }|                       d¦  «        pd}|› d|› |› d|› |› �S )	Né   é   é   é   é   r   ú://ú?)Úgroupr4   )r7   ÚschemeÚ	authorityÚpathr&   Úfragments         r#   Ú_subz&_redact_url_query_params.<locals>._subÚ   s€   € Ø—’˜‘”ˆØ—G’G˜A‘J”Jˆ	Ø�wŠw�q‰zŒzˆÝ$ Q§W¢W¨Q¡Z¤ZÑ0Ô0ˆØ—7’7˜1‘:”:Ð# ˆØÐ@Ð@˜YÐ@¨Ð@Ð@¨uÐ@°hÐ@Ð@Ð@r%   )ÚreÚMatchÚstrÚ_URL_WITH_QUERY_REÚsub)r5   rE   s     r#   Ú_redact_url_query_paramsrK   Ô   sD   € ðA•”ð A�Sð Að Að Að Aõ ×!Ò! $¨Ñ-Ô-Ð-r%   c                 ó:   — t                                d„ | ¦  «        S )zœStrip `user:password@` from HTTP/WS/FTP URLs.

    DB protocols (postgres, mysql, mongodb, redis, amqp) are handled
    separately by `_DB_CONNSTR_RE`.
    c                 ó^   — |                       d¦  «        › d|                       d¦  «        › d�S )Nr9   r>   r:   z:***@©r@   ©r7   s    r#   ú<lambda>z&_redact_url_userinfo.<locals>.<lambda>ë   s+   € �Q—W’W˜Q‘Z”ZÐ5Ð5 A§G¢G¨A¡J¤JÐ5Ð5Ð5€ r%   )Ú_URL_USERINFO_RErJ   ©r5   s    r#   Ú_redact_url_userinforS   ä   s%   € õ ×ÒØ5Ð5Øñô ð r%   c                 ó¸   — | rd| v sd| vr| S t                                |                      ¦   «         ¦  «        s| S t          |                      ¦   «         ¦  «        S )uN  Redact sensitive values in a form-urlencoded body.

    Only applies when the entire input looks like a pure form body
    (k=v&k=v with no newlines, no other text). Single-line non-form
    text passes through unchanged. This is a conservative pass â€” the
    `_redact_url_query_params` function handles embedded query strings.
    ú
r(   )Ú_FORM_BODY_REÚmatchÚstripr4   rR   s    r#   Ú_redact_form_bodyrY   ð   sZ   € ð ð �4˜4�<�< 3¨d ? ?Øˆå×Ò˜tŸzšz™|œ|Ñ,Ô,ð ØˆÝ §
¢
¡¤Ñ-Ô-Ð-r%   c                 ó  — | €dS t          | t          ¦  «        st          | ¦  «        } | s| S t          s| S t                               d„ | ¦  «        } d„ }t
                               || ¦  «        } d„ }t                               || ¦  «        } t                               d„ | ¦  «        } d„ }t                               || ¦  «        } t                               d| ¦  «        } t                               d„ | ¦  «        } t                               d	„ | ¦  «        } t          | ¦  «        } t          | ¦  «        } t          | ¦  «        } t                               d
„ | ¦  «        } d„ }t                                || ¦  «        } | S )zÇApply all redaction patterns to a block of text.

    Safe to call on any string -- non-matching text passes through unchanged.
    Disabled when security.redact_secrets is false in config.yaml.
    Nc                 óF   — t          |                      d¦  «        ¦  «        S )Nr9   ©r$   r@   rO   s    r#   rP   z'redact_sensitive_text.<locals>.<lambda>  s   € ¥K°·²¸±
´
Ñ$;Ô$;€ r%   c                 ó°   — |                       d¦  «        |                       d¦  «        |                       d¦  «        }}}|› d|› t          |¦  «        › |› �S )Nr9   r:   r;   r)   ©r@   r$   )r7   ÚnameÚquoter3   s       r#   Ú_redact_envz*redact_sensitive_text.<locals>._redact_env  sS   € ØŸWšW Q™ZœZ¨¯ª°©¬°Q·W²W¸Q±Z´Z�UˆeˆØÐ;Ð;˜Ð;¥¨EÑ 2Ô 2Ð;°EÐ;Ð;Ð;r%   c                 ó€   — |                       d¦  «        |                       d¦  «        }}|› dt          |¦  «        › d�S )Nr9   r:   z: "ú"r^   )r7   r   r3   s      r#   Ú_redact_jsonz+redact_sensitive_text.<locals>._redact_json  s>   € Ø—W’W˜Q‘Z”Z §¢¨¡¤ˆUˆØÐ/Ð/�+ eÑ,Ô,Ð/Ð/Ð/Ð/r%   c                 ór   — |                       d¦  «        t          |                       d¦  «        ¦  «        z   S )Nr9   r:   r^   rO   s    r#   rP   z'redact_sensitive_text.<locals>.<lambda>   s'   € �!—'’'˜!‘*”*�{¨1¯7ª7°1©:¬:Ñ6Ô6Ñ6€ r%   c                 óh   — |                       d¦  «        pd}|                       d¦  «        }|› |› d�S )Nr9   r   r:   z:***rN   )r7   ÚprefixÚdigitss      r#   Ú_redact_telegramz/redact_sensitive_text.<locals>._redact_telegram%  s9   € Ø—’˜‘”Ð!˜rˆØ—’˜‘”ˆØÐ&˜&Ð&Ð&Ð&Ð&r%   z[REDACTED PRIVATE KEY]c                 ó\   — |                       d¦  «        › d|                       d¦  «        › �S )Nr9   r   r;   rN   rO   s    r#   rP   z'redact_sensitive_text.<locals>.<lambda>/  s(   € ¨1¯7ª7°1©:¬:Ð(FÐ(F¸!¿'º'À!¹*¼*Ð(FÐ(F€ r%   c                 óF   — t          |                      d¦  «        ¦  «        S )Nr   r\   rO   s    r#   rP   z'redact_sensitive_text.<locals>.<lambda>2  s   € ¥¨Q¯WªW°Q©Z¬ZÑ!8Ô!8€ r%   c                 ó@   — dd|                       d¦  «        v rdnd› d�S )Nz<@ú!r   r   z***>rN   rO   s    r#   rP   z'redact_sensitive_text.<locals>.<lambda>?  s+   € Ð-X¸ÀÇÂÈÁ
Ä
Ð9JÐ9J°#°#ÐPRÐ-XÐ-XÐ-X€ r%   c                 ó²   — |                       d¦  «        }t          |¦  «        dk    r|d d…         dz   |dd …         z   S |d d…         dz   |dd …         z   S )Nr9   é   r:   z****éþÿÿÿr<   r!   )r@   r"   )r7   Úphones     r#   Ú_redact_phonez,redact_sensitive_text.<locals>._redact_phoneB  s`   € Ø—’˜‘
”
ˆÝˆu‰:Œ:˜Š?ˆ?Ø˜˜!˜”9˜vÑ%¨¨b¨c¨c¬
Ñ2Ð2Ø�R�a�RŒy˜6Ñ! E¨"¨#¨#¤JÑ.Ð.r%   )Ú
isinstancerH   Ú_REDACT_ENABLEDÚ
_PREFIX_RErJ   Ú_ENV_ASSIGN_REÚ_JSON_FIELD_REÚ_AUTH_HEADER_REÚ_TELEGRAM_REÚ_PRIVATE_KEY_REÚ_DB_CONNSTR_REÚ_JWT_RErS   rK   rY   Ú_DISCORD_MENTION_REÚ_SIGNAL_PHONE_RE)r5   ra   rd   ri   rr   s        r#   Úredact_sensitive_textr      s±  € ð €|ØˆtÝ�d�CÑ Ô ð Ý�4‰yŒyˆØð ØˆÝð Øˆõ �>Š>Ð;Ð;¸TÑBÔB€Dð<ð <ð <õ ×Ò˜k¨4Ñ0Ô0€Dð0ð 0ð 0õ ×Ò˜l¨DÑ1Ô1€Dõ ×ÒØ6Ð6Øñô €Dð'ð 'ð 'õ ×ÒÐ,¨dÑ3Ô3€Dõ ×ÒÐ7¸Ñ>Ô>€Dõ ×ÒÐFÐFÈÑMÔM€Dõ �;Š;Ð8Ð8¸$Ñ?Ô?€Dõ   Ñ%Ô%€Dõ $ DÑ)Ô)€Dõ ˜TÑ"Ô"€Dõ ×"Ò"Ð#XÐ#XÐZ^Ñ_Ô_€Dð/ð /ð /õ
 ×Ò ¨tÑ4Ô4€Dà€Kr%   c                   óB   ‡ — e Zd ZdZdˆ fd„	Zdej        defˆ fd„Zˆ xZ	S )	ÚRedactingFormatterz9Log formatter that redacts secrets from all log messages.Nú%c                 ó@   •—  t          ¦   «         j        |||fi |¤Ž d S ©N)ÚsuperÚ__init__)ÚselfÚfmtÚdatefmtÚstyleÚkwargsÚ	__class__s        €r#   r†   zRedactingFormatter.__init__O  s,   ø€ Ø�‰ŒÔ˜˜g uÐ7Ð7°Ð7Ð7Ð7Ð7Ð7r%   Úrecordr   c                 ód   •— t          ¦   «                              |¦  «        }t          |¦  «        S r„   )r…   Úformatr   )r‡   r�   ÚoriginalrŒ   s      €r#   r�   zRedactingFormatter.formatR  s&   ø€ Ý‘7”7—>’> &Ñ)Ô)ˆÝ$ XÑ.Ô.Ð.r%   )NNr‚   )
Ú__name__Ú
__module__Ú__qualname__Ú__doc__r†   ÚloggingÚ	LogRecordrH   r�   Ú__classcell__)rŒ   s   @r#   r�   r�   L  sr   ø€ € € € € ØCÐCð8ð 8ð 8ð 8ð 8ð 8ð/˜WÔ.ð /°3ð /ð /ð /ð /ð /ð /ð /ð /ð /ð /r%   r�   ))r”   r•   ÚosrF   Ú	getLoggerr‘   ÚloggerÚ	frozensetr.   Ú_SENSITIVE_BODY_KEYSÚgetenvr-   rt   Ú_PREFIX_PATTERNSÚ_SECRET_ENV_NAMESÚcompilerv   Ú_JSON_KEY_NAMESÚ
IGNORECASErw   rx   ry   rz   r{   r|   r}   r~   rI   rQ   rV   r/   ru   rH   r$   r4   rK   rS   rY   r   Ú	Formatterr�   © r%   r#   ú<module>r¥      sL  ððð ð €€€Ø 	€	€	€	Ø 	€	€	€	à	ˆÔ	˜8Ñ	$Ô	$€ð
 $˜)ð %ð %ð %ñ ô Ð ð, !�yð "ð "ð "ñ ô Ð ð& �"”)Ð3°RÑ8Ô8×>Ò>Ñ@Ô@ÐHcÐc€ð$ð $ð $Ð ðN QÐ Ø�”ØUÐ+ÐUÐUÐUñô €ð
 Z€Ø�”Ø-ˆ/Ð-Ð-Ð-Ø„Mñô €ð �"”*Ø(Ø„Mñô €ð ˆrŒzØ*ñô €ð
 �"”*ØOñô €ð �”ØRØ„Mñô €ð ˆ"Œ*ð%ñô €ð !�b”jÐ!4Ñ5Ô5Ð ð �2”:ÐAÑBÔBÐ ð
  �R”Zðñô Ð ð �2”:Ø2ñô Ð ð �”
ØOñô €ð
 ˆRŒZØ˜SŸXšXÐ&6Ñ7Ô7Ñ7Ð:OÑOñô €
ð
)�sð )˜sð )ð )ð )ð )ð ð ¨ð ð ð ð ð,. 3ð .¨3ð .ð .ð .ð .ð 	˜sð 	 sð 	ð 	ð 	ð 	ð.˜Cð . Cð .ð .ð .ð .ð I ð I¨ð Ið Ið Ið IðX/ð /ð /ð /ð /˜Ô*ñ /ô /ð /ð /ð /r%   