mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-01 12:02:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

test(redact): fix file_read regression-guard for current-main YAML collapse

Browse source 
The salvaged #35519 regression guard asserted that default (non-file_read)
mode keeps a head/tail `ghp_S1...Pn2T` mask for a `token: <key>` line. On
current main the YAML config pass (`_YAML_ASSIGN_RE`, key `token`) re-masks
the already-prefix-masked value to `***`, so the assertion was stale. Switch
to a bare-token context so the guard isolates what it claims (prefix-mask
head/tail shape in default mode) without depending on the YAML collapse.
This commit is contained in:
teknium1 2026-06-28 02:55:36 -07:00 • committed by Teknium
parent de928bccde
commit 091ce825fe
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
tests/agent/test_redact.py
View file

@ -795,8 +795,11 @@ class TestFileReadNonReusableRedaction:
def test_default_mode_unchanged_keeps_headtail_mask(self):
"""Regression guard: NON-file_read (logs/display) keeps the existing
head/tail mask shape — only file content gets the sentinel."""
out = redact_sensitive_text(f"token: {self.GHP}", force=True)
head/tail mask shape — only file content gets the sentinel. Uses a
bare-token context (no ``key:`` prefix) so this isolates the prefix
pass: a ``token: <key>`` line would additionally hit the YAML config
pass and collapse to ``***``, which is unrelated to this guard."""
out = redact_sensitive_text(f"see {self.GHP} here", force=True)
assert "«redacted" not in out # no sentinel in log mode
assert "ghp_" in out and "..." in out # head/tail mask preserved