{"repo":"NousResearch/hermes-agent","public_id":"4367","display_label":"Redaction masking lowercase variables; IGNORECASE removal and tests","summary":"The members concern redaction incorrectly masking lowercase Python variable assignments, with a bug report and related changes that remove re.IGNORECASE from _ENV_ASSIGN_RE and add regression tests. They appear to share one theme, though the titles alone don't confirm the outcome of any change.","subsystem":"agent","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":5185,"merged_at":"2026-04-05T07:10:16+00:00"},"resolution":{"state":"resolved","by":"pr-5185"},"freshness":{"state":"stale","last_verified_at":"2026-04-05T07:10:16+00:00","is_stale":true},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":4367,"pr_number":5185,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-04-05T07:10:16+00:00"}],"members":[{"kind":"issue","number":4367,"title":"[Bug]: Redaction incorrectly masks lowercase Python variable assignments","url":null,"state":"closed"},{"kind":"pr","number":4384,"title":"fix: redact.py - remove IGNORECASE from _ENV_ASSIGN_RE (#4367)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#5185","number":5185}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":4476,"title":"fix(redact): remove re.IGNORECASE from _ENV_ASSIGN_RE to prevent masking lowercase variables","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#5185","number":5185}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":5185,"title":"test(redact): add regression tests for lowercase variable redaction (#4367)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/agent/test_redact.py"],"fix_hunks":[{"file":"tests/agent/test_redact.py","hunks":["@@ -82,6 +82,38 @@ def test_path_unchanged(self):\n         result = redact_sensitive_text(text)\n         assert result == text\n \n+    def test_lowercase_python_variable_token_unchanged(self):\n+        # Regression: #4367 — lowercase 'token' assignment must not be redacted\n+        text = \"before_tokens = [redacted:secret-assignment]\"\n+        result = redact_sensitive_text(text)\n+        assert result == text\n+\n+    def test_lowercase_python_variable_api_key_unchanged(self):\n+        # Regression: #4367 — lowercase 'api_key' must not be redacted\n+        text = \"api_key = config.get('api_key')\"\n+        result = redact_sensitive_text(text)\n+        assert result == text\n+\n+    def test_typescript_await_token_unchanged(self):\n+        # Regression: #4367 — 'await' keyword must not be redacted as a secret value\n+        text = \"const token = await getToken();\"\n+        result = redact_sensitive_text(text)\n+        assert result == text\n+\n+    def test_typescript_await_secret_unchanged(self):\n+        # Regression: #4367 — similar pattern with 'secret' variable\n+        text = \"const secret = await fetchSecret();\"\n+        result = redact_sensitive_text(text)\n+        assert result == text\n+\n+    def test_export_whitespace_preserved(self):\n+        # Regression: #4367 — whitespace before uppercase env var must be preserved\n+        text = \"export SECRET_TOKEN=mypassword\"\n+        result = redact_sensitive_text(text)\n+        assert result.startswith(\"export \")\n+        assert \"SECRET_TOKEN=\" in result\n+        assert \"mypassword\" not in result\n+\n \n class TestJsonFields:\n     def test_json_api_key(self):\n"]}]}],"trust":{"default_tier":"verified","includes_suggested":false}}