From 091ce825fef4f387fe6e55323846ea3d6296a09a Mon Sep 17 00:00:00 2001 From: teknium1 <127238744+teknium1@users.noreply.github.com> Date: Sun, 28 Jun 2026 02:55:36 -0700 Subject: [PATCH] test(redact): fix file_read regression-guard for current-main YAML collapse The salvaged #35519 regression guard asserted that default (non-file_read) mode keeps a head/tail `ghp_S1...Pn2T` mask for a `token: ` line. On current main the YAML config pass (`_YAML_ASSIGN_RE`, key `token`) re-masks the already-prefix-masked value to `***`, so the assertion was stale. Switch to a bare-token context so the guard isolates what it claims (prefix-mask head/tail shape in default mode) without depending on the YAML collapse. --- tests/agent/test_redact.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/agent/test_redact.py b/tests/agent/test_redact.py index e2e644f915a..c28717e5a3a 100644 --- a/tests/agent/test_redact.py +++ b/tests/agent/test_redact.py @@ -795,8 +795,11 @@ class TestFileReadNonReusableRedaction: def test_default_mode_unchanged_keeps_headtail_mask(self): """Regression guard: NON-file_read (logs/display) keeps the existing - head/tail mask shape — only file content gets the sentinel.""" - out = redact_sensitive_text(f"token: {self.GHP}", force=True) + head/tail mask shape — only file content gets the sentinel. Uses a + bare-token context (no ``key:`` prefix) so this isolates the prefix + pass: a ``token: `` line would additionally hit the YAML config + pass and collapse to ``***``, which is unrelated to this guard.""" + out = redact_sensitive_text(f"see {self.GHP} here", force=True) assert "«redacted" not in out # no sentinel in log mode assert "ghp_" in out and "..." in out # head/tail mask preserved