feat(examples): add shared secret patterns and host-side redaction

Author: DNKYr

examples/skills_code_review_agent/review/__init__.py

@@ -0,0 +1,6 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Code review pipeline package."""

examples/skills_code_review_agent/review/redaction.py

@@ -0,0 +1,28 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Host-side redaction. Imports the skill's secret_patterns module so the
+sandbox checker and host redaction always share one pattern list."""
+import importlib.util
+from pathlib import Path
+
+_PATTERNS_PATH = (Path(__file__).resolve().parents[1]
+                  / "skills" / "code-review" / "scripts" / "secret_patterns.py")
+
+_spec = importlib.util.spec_from_file_location("cr_secret_patterns", _PATTERNS_PATH)
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+
+
+def redact_text(text):
+    """Redact all secrets in *text* using the shared skill patterns."""
+    if not text:
+        return text
+    return _mod.redact(text)
+
+
+def contains_secret(text):
+    """Return True when *text* contains at least one secret match."""
+    return bool(_mod.find_secrets(text or ""))

examples/skills_code_review_agent/skills/code-review/scripts/secret_patterns.py

@@ -0,0 +1,44 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Secret detection + redaction patterns. Single source of truth for
+check_secrets.py (sandbox side) and review/redaction.py (host side)."""
+import hashlib
+import re
+
+SECRET_PATTERNS = [
+    ("anthropic_key", re.compile(r"sk-ant-[A-Za-z0-9\-]{10,}")),
+    ("openai_key", re.compile(r"sk-[A-Za-z0-9]{20,}")),
+    ("aws_access_key", re.compile(r"AKIA[0-9A-Z]{16}")),
+    ("github_token", re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}")),
+    ("slack_token", re.compile(r"xox[baprs]-[A-Za-z0-9\-]{10,}")),
+    ("jwt", re.compile(r"eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}(?:\.[A-Za-z0-9_\-]{4,})?")),
+    ("private_key", re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")),
+    ("bearer_token", re.compile(r"[Bb]earer\s+[A-Za-z0-9._\-]{12,}")),
+    ("url_basic_auth", re.compile(r"[a-z][a-z0-9+.\-]*://[^/\s:@]+:[^@\s]+@")),
+    ("sensitive_assign", re.compile(
+        r"(?i)(password|passwd|secret|token|api_key|apikey|secret_token|db_password)"
+        r"\s*[:=]\s*[\"'][^\"']{6,}[\"']")),
+]
+
+
+def find_secrets(text):
+    """Return the list of raw secret substrings found in *text*."""
+    found = []
+    for _, pattern in SECRET_PATTERNS:
+        for m in pattern.finditer(text):
+            found.append(m.group(0))
+    return found
+
+
+def _fingerprint(value):
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()[:8]
+
+
+def redact(text):
+    """Replace every secret match with ***REDACTED-<sha8>*** (stable per value)."""
+    for _, pattern in SECRET_PATTERNS:
+        text = pattern.sub(lambda m: "***REDACTED-%s***" % _fingerprint(m.group(0)), text)
+    return text

examples/skills_code_review_agent/tests/test_redaction.py

@@ -0,0 +1,56 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Tests for secret detection and redaction (>=95% detection target)."""
+SAMPLE_SECRETS = [
+    'API_KEY = "sk-abcdefghijklmnopqrstuvwxyz123456"',
+    'key = "sk-ant-api03-abcdefghijklmnopqrst"',
+    "aws AKIAIOSFODNN7EXAMPLE",
+    'token = "ghp_abcdefghijklmnopqrstuvwxyz0123456789"',
+    "Authorization: Bearer abc123def456ghi789jkl",
+    "jwt eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123def456",
+    "-----BEGIN RSA PRIVATE KEY-----",
+    'password = "hunter2secret"',
+    'PASSWD: "topsecretvalue"',
+    'secret = "do-not-leak-me"',
+    'api_key="deadbeefcafe1234"',
+    "https://user:p4ssw0rd@db.example.com/prod",
+    'TOKEN = "9f8e7d6c5b4a39281706f5e4d3c2b1a0"',
+    'apikey: "0123456789abcdefffff"',
+    "Bearer xoxb-1234567890-abcdefghij",
+    'DB_PASSWORD = "prod-db-pass-2026"',
+    'passwd = "another$ecret!"',
+    "AKIA0123456789ABCDEF",
+    'secret_token = "veryhiddenvalue1"',
+    'ghs_abcdefghijklmnopqrstuvwxyz0123456789',
+]
+
+
+def test_detection_rate_at_least_95_percent():
+    from review.redaction import contains_secret
+    detected = sum(1 for s in SAMPLE_SECRETS if contains_secret(s))
+    assert detected / len(SAMPLE_SECRETS) >= 0.95
+
+
+def test_redaction_removes_secret_values():
+    from review.redaction import redact_text
+    for sample in SAMPLE_SECRETS:
+        out = redact_text(sample)
+        assert "***REDACTED-" in out or sample == out, sample
+    assert "hunter2secret" not in redact_text('password = "hunter2secret"')
+    assert "AKIAIOSFODNN7EXAMPLE" not in redact_text("aws AKIAIOSFODNN7EXAMPLE")
+
+
+def test_redaction_is_stable_fingerprint():
+    from review.redaction import redact_text
+    a = redact_text("Bearer abc123def456ghi789jkl")
+    b = redact_text("Bearer abc123def456ghi789jkl")
+    assert a == b
+
+
+def test_plain_text_untouched():
+    from review.redaction import redact_text
+    text = "def add(a, b):\n    return a + b"
+    assert redact_text(text) == text