# NousResearch/hermes-agent · Redaction masking lowercase variables; IGNORECASE removal and tests

## Open now

- Nothing open on GitHub.

The members concern redaction incorrectly masking lowercase Python variable assignments, with a bug report and related changes that remove re.IGNORECASE from _ENV_ASSIGN_RE and add regression tests. They appear to share one theme, though the titles alone don't confirm the outcome of any change.

## TL;DR

- 4 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 2 PR(s) closed without merging.
- A fix was merged to main in PR #5185. Verify it addresses your case.
- **Recommended:** read PR #5185 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-5185`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.50`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #4367: \[Bug\]: Redaction incorrectly masks lowercase Python variable assignments

## Prior & competing PRs

- **#5185: test(redact): add regression tests for lowercase variable redaction (#4367)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `tests/agent/test_redact.py`
  - fix hunks:
  - `tests/agent/test_redact.py`

    ```diff
    @@ -82,6 +82,38 @@ def test_path_unchanged(self):
             result = redact_sensitive_text(text)
             assert result == text
     
    +    def test_lowercase_python_variable_token_unchanged(self):
    +        # Regression: #4367 — lowercase 'token' assignment must not be redacted
    +        text = "before_tokens = [redacted:secret-assignment]"
    +        result = redact_sensitive_text(text)
    +        assert result == text
    +
    +    def test_lowercase_python_variable_api_key_unchanged(self):
    +        # Regression: #4367 — lowercase 'api_key' must not be redacted
    +        text = "api_key = config.get('api_key')"
    +        result = redact_sensitive_text(text)
    +        assert result == text
    +
    +    def test_typescript_await_token_unchanged(self):
    +        # Regression: #4367 — 'await' keyword must not be redacted as a secret value
    +        text = "const token = await getToken();"
    +        result = redact_sensitive_text(text)
    +        assert result == text
    +
    +    def test_typescript_await_secret_unchanged(self):
    +        # Regression: #4367 — similar pattern with 'secret' variable
    +        text = "const secret = await fetchSecret();"
    +        result = redact_sensitive_text(text)
    +        assert result == text
    +
    +    def test_export_whitespace_preserved(self):
    +        # Regression: #4367 — whitespace before uppercase env var must be preserved
    +        text = "export SECRET_TOKEN=mypassword"
    +        result = redact_sensitive_text(text)
    +        assert result.startswith("export ")
    +        assert "SECRET_TOKEN=" in result
    +        assert "mypassword" not in result
    +
     
     class TestJsonFields:
         def test_json_api_key(self):
    ```
- **#4384: fix: redact.py - remove IGNORECASE from _ENV_ASSIGN_RE (#4367)**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `#5185`
- **#4476: fix(redact): remove re.IGNORECASE from _ENV_ASSIGN_RE to prevent masking lowercase variables**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `#5185`

## Fix status

- Merged to main in PR #5185 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-04-05`. This confirmation is old and may be out of date (a revert/reopen would not have invalidated it here); re-verify.
- Subsystem: `agent`