examples: harden secret redaction to >=95% in code-review agent

Slice 4 (criterion 5). redact() now layers full-token provider regexes
(AWS, GitHub, GitLab, Slack, Stripe, Google, SendGrid, npm, JWT, PEM,
bearer, basic-auth URLs) with a Shannon-entropy catch-all for generic
base64/hex secrets. A leak-test corpus (16 secret types) verifies >=95%
masking and zero plaintext survivors, plus a benign-code corpus verifies
no false positives.

detect-secrets stays as the secret-leakage *scanner* but is not used for
redaction: its scan_line returns partial/benign values that hurt
precision. The regex + entropy layers reach 100% on the corpus cleanly.

Updates #92

RELEASE NOTES: NONE

Author: Acture

examples/skills_code_review_agent/README.md

@@ -81,7 +81,9 @@ Implemented: deterministic pipeline, DB persistence (incl. sandbox-run rows), 8
 self-test, CLI, the fake-model agent loop (`run_agent.py`), and **sandbox execution**
 (`--runtime local` runs the scanners in a subprocess sandbox with timeout + output cap and records
 each run; `--runtime container` runs them in a Docker workspace — see `skills/code-review/Dockerfile`
-— and is skipped in tests when Docker is absent). Baseline secret redaction is in place.
+— and is skipped in tests when Docker is absent). **Secret redaction** is hardened: `redact()` layers
+provider-token regexes + a Shannon-entropy catch-all and hits 100% on the leak-test corpus with zero
+false positives (criterion 5, ≥95%).
 
 The **Filter gate** (criterion 7) is in place: `pipeline/policy.py::ReviewPolicy` decides
 allow / deny / needs-human-review for a sandbox action (high-risk command, forbidden path,
@@ -90,6 +92,7 @@ deterministic sandbox gate (a denied action never launches; the block is recorde
 the report's Filter-interception section) and the framework `agent/filter.py::ReviewGuardFilter`
 (TOOL-scoped, attached on the review tool).
 
-Planned follow-up slices: redaction hardening to ≥95% (criterion 5) and OpenTelemetry metrics wiring
-(criterion 9). Note: the default runtime is `inprocess` for fast dry-runs — pass `--runtime local`
-or `--runtime container` to exercise the sandbox path.
+Remaining: exporting the monitoring metrics through an OpenTelemetry reader (they are collected today
+in the report's monitoring section), an independent labelled eval set to prove the hidden-set
+thresholds, and verifying the container runtime on a Docker host. Note: the default runtime is
+`inprocess` for fast dry-runs — pass `--runtime local` or `--runtime container` for the sandbox path.

examples/skills_code_review_agent/pipeline/redaction.py

@@ -3,18 +3,25 @@
 # Copyright (C) 2026 Tencent. All rights reserved.
 #
 # tRPC-Agent-Python is licensed under Apache-2.0.
-
 """Secret redaction — the single choke-point (issue #92, requirement 7 & criterion 5).
 
-Every string that enters the DB or a rendered report MUST pass through ``redact()``. Centralizing
-it here is the load-bearing decision: criterion 5 is binary-checked (one plaintext key/token/
-password in the report or DB = fail), so redaction can never be sprinkled across call sites.
+Every string that enters the DB or a rendered report MUST pass through ``redact()``. Criterion 5 is
+binary-checked (one plaintext key/token/password in the report or DB = fail), so redaction is
+centralized here, never sprinkled across call sites.
+
+Layers, applied in order:
+1. a regex layer that masks the *full* token for common providers and labeled assignments;
+2. a Shannon-entropy catch-all for long high-entropy tokens (generic base64/hex secrets).
 
-MVP: regex baseline covering the common shapes. Slice 4 hardens this with ``detect-secrets`` spans
-and a leak-test corpus proving >=95% and zero plaintext survivors.
+(detect-secrets is used as a *scanner* for the secret-leakage finding category, but not for
+redaction: its scan_line returns partial/benign values that hurt precision here. The regex + entropy
+layers reach 100% on the leak-test corpus with zero false positives.)
+
+The leak-test corpus in the test-suite asserts >=95% masking and zero plaintext survivors.
 """
 from __future__ import annotations
 
+import math
 import re
 from typing import TYPE_CHECKING
 
@@ -23,31 +30,73 @@
 
 _MASK = "***REDACTED***"
 
-# Keeps a leading label group \1 and masks the secret value \2.
-_KV = (r"(?ix)\b(password|passwd|pwd|secret|api[_-]?key|apikey|access[_-]?token|token|auth"
-       r"|client[_-]?secret|private[_-]?key)\b\s*[:=]\s*['\"]?([^\s'\"]{4,})['\"]?")
-
-_STANDALONE = [
-    ("aws_access_key_id", re.compile(r"\b(AKIA|ASIA)[0-9A-Z]{16}\b")),
-    ("aws_secret", re.compile(r"(?i)aws_secret_access_key\s*[:=]\s*['\"]?([A-Za-z0-9/+=]{40})")),
-    ("jwt", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
-    ("bearer", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*")),
-    ("pem", re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----", re.DOTALL)),
-    ("slack", re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b")),
-    ("github_pat", re.compile(r"\bghp_[A-Za-z0-9]{36}\b")),
+# --- Layer 1: full-token regexes -------------------------------------------------------------
+
+# Labeled assignment: keep the label \1, mask the value.
+_KV = re.compile(r"(?ix)\b(password|passwd|pwd|secret|api[_-]?key|apikey|access[_-]?token|token|auth"
+                 r"|client[_-]?secret|private[_-]?key)\b\s*[:=]\s*['\"]?([^\s'\"]{4,})['\"]?")
+
+# Standalone provider tokens — mask the whole match.
+_PROVIDER = [
+    re.compile(r"\b(AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|ASCA)[A-Z0-9]{16}\b"),
+    re.compile(r"(?i)aws_secret_access_key\s*[:=]\s*['\"]?[A-Za-z0-9/+=]{40}"),
+    re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b"),
+    re.compile(r"\bglpat-[A-Za-z0-9_-]{20,}\b"),
+    re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b"),
+    re.compile(r"\b[rs]k_(live|test)_[A-Za-z0-9]{16,}\b"),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    re.compile(r"\bya29\.[0-9A-Za-z_-]{20,}\b"),
+    re.compile(r"\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b"),
+    re.compile(r"\bnpm_[A-Za-z0-9]{36}\b"),
+    re.compile(r"\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b"),
+    re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*"),
+    re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----", re.DOTALL),
 ]
 
-_KV_RE = re.compile(_KV)
+# Basic-auth in a URL: mask the password segment only.
+_URL_AUTH = re.compile(r"(?i)\b([a-z][a-z0-9+.-]*://[^\s:@/]+:)([^\s@/]+)(@)")
+
+# Layer 3 catch-all: long base64/hex tokens; mask only if high-entropy (a real secret, not an id).
+_HIGH_ENTROPY_CANDIDATE = re.compile(r"\b[A-Za-z0-9+/=_-]{20,}\b")
+_B64_ENTROPY_MIN = 4.0
+_HEX_ENTROPY_MIN = 3.0
+_HEX_ONLY = re.compile(r"\A[0-9a-fA-F]+\Z")
+
+
+def _shannon(s: str) -> float:
+    if not s:
+        return 0.0
+    counts: dict[str, int] = {}
+    for ch in s:
+        counts[ch] = counts.get(ch, 0) + 1
+    n = len(s)
+    return -sum((c / n) * math.log2(c / n) for c in counts.values())
+
+
+def _looks_secret(tok: str) -> bool:
+    if _MASK in tok:
+        return False
+    threshold = _HEX_ENTROPY_MIN if _HEX_ONLY.match(tok) else _B64_ENTROPY_MIN
+    return _shannon(tok) >= threshold
+
+
+def _regex_layer(text: str) -> str:
+    out = _KV.sub(lambda m: f"{m.group(1)}={_MASK}", text)
+    out = _URL_AUTH.sub(lambda m: f"{m.group(1)}{_MASK}{m.group(3)}", out)
+    for pat in _PROVIDER:
+        out = pat.sub(_MASK, out)
+    return out
 
 
 def redact(text: str | None) -> str:
     """Mask secrets in a free-text string. Idempotent and safe on None/empty."""
     if not text:
         return text or ""
-    out = _KV_RE.sub(lambda m: f"{m.group(1)}={_MASK}", text)
-    for _name, pat in _STANDALONE:
-        out = pat.sub(_MASK, out)
-    return out
+    lines = []
+    for line in _regex_layer(text).split("\n"):
+        line = _HIGH_ENTROPY_CANDIDATE.sub(lambda m: _MASK if _looks_secret(m.group()) else m.group(), line)
+        lines.append(line)
+    return "\n".join(lines)
 
 
 def redact_finding(f: "Finding") -> "Finding":

tests/examples/test_skills_code_review_agent.py

@@ -222,3 +222,47 @@ def test_report_renders_filter_block_section() -> None:
     md = report_mod.render_md(result.report)
     assert "## 4. Filter interception summary" in md
     assert "over budget" in md
+
+
+# (text containing a secret, the raw secret that must not survive redaction) — the leak-test corpus.
+_LEAK_CORPUS = [
+    ('password = "hunter2supersecret"', "hunter2supersecret"),
+    ('API_KEY: "SK_LIVE_EXAMPLE_TEST_KEY"', "SK_LIVE_EXAMPLE_TEST_KEY"),
+    ('aws_key = "AKIA1234567890ABCDEF"', "AKIA1234567890ABCDEF"),
+    ('aws_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY1"',
+     "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY1"),
+    ('gh = "ghp_16CharsExampleTokenABCDEFabcdef012345"', "ghp_16CharsExampleTokenABCDEFabcdef012345"),
+    ('gitlab = "GLPAT_EXAMPLE_TEST_TOKEN"', "GLPAT_EXAMPLE_TEST_TOKEN"),
+    ('slack = "xoxb-1234567890-ABCDEFxyz0987"', "xoxb-1234567890-ABCDEFxyz0987"),
+    ('google = "AIzaSyD-1234567890abcdefGHIJKLmnopqrstuv"', "AIzaSyD-1234567890abcdefGHIJKLmnopqrstuv"),
+    ('npm = "npm_abcdefABCDEF0123456789abcdefABCDEF01"', "npm_abcdefABCDEF0123456789abcdefABCDEF01"),
+    ('jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"',
+     "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"),
+    ('auth = "Bearer abcdefghijklmnopqrstuvwxyz012345"', "abcdefghijklmnopqrstuvwxyz012345"),
+    ('token = "8f14e45fceea167a5a36dedd4bea2543f1a2b3c4d5e6f708"', "8f14e45fceea167a5a36dedd4bea2543f1a2b3c4d5e6f708"),
+    ('secret = "aGVsbG9zZWNyZXRrZXkxMjM0NTY3ODkwYWJjZGVm"', "aGVsbG9zZWNyZXRrZXkxMjM0NTY3ODkwYWJjZGVm"),
+    ('conn = "postgres_conn_example_redacted"', "S3cr3tP4ssw0rd"),
+    ('DB_PASSWORD=pl4inTextP@ss99', "pl4inTextP@ss99"),
+    ('X-Api-Key: 3f9a2b1c8d7e6f5a4b3c2d1e0f9a8b7c', "3f9a2b1c8d7e6f5a4b3c2d1e0f9a8b7c"),
+]
+_BENIGN = [
+    "def add(a, b): return a + b",
+    "import os",
+    "version = 1.2.3",
+    "result = compute(x, y)",
+    "for i in range(100):",
+    "use ast.literal_eval instead of eval",
+]
+
+
+def test_redaction_meets_95pct_and_no_plaintext() -> None:
+    masked = sum(1 for text, secret in _LEAK_CORPUS if secret not in redact(text))
+    rate = masked / len(_LEAK_CORPUS)
+    assert rate >= 0.95, f"redaction rate {rate:.0%} < 95%"
+    for text, secret in _LEAK_CORPUS:
+        assert secret not in redact(text)
+
+
+def test_redaction_does_not_mangle_benign_code() -> None:
+    for line in _BENIGN:
+        assert "***REDACTED***" not in redact(line), f"false positive on: {line}"