hermes - 💡(How to fix) Fix [Bug]: redact_sensitive_text corrupts API keys in config files when read via read_file/search_files, causing 401 [2 pull requests]

Bug Description

When security.redact_secrets is enabled (which is the default), redact_sensitive_text is applied to file content in read_file and search_files tools. Although these calls use code_file=True (which skips the ENV-assignment and JSON-field patterns), the prefix-based patterns (_PREFIX_RE) are still applied.

This means when reading config files like config.yaml or .env, API keys that match known credential prefixes (e.g., sk-..., ghp_..., xai-...) are partially masked in the file content returned to the agent.

How this leads to 401

1. The agent reads the config file via read_file or cat (terminal) to inspect current API keys
2. The prefix-redacted output shows sk-100...6e5f or ghp_abc...abcd instead of the full key
3. If the agent tries to use this masked value (e.g., constructing curl commands, re-configuring, or writing back to config), it passes the corrupted token
4. The API provider returns 401

Concrete evidence found in production: A user's config.yaml was found to contain GITHUB_PERSONAL_ACCESS_TOKEN: ghp_S1...Pn2T — exactly 13 characters matching the mask_secret(head=6, tail=4) output format — clearly the masked value was written back to config, breaking GitHub MCP authentication.

Root cause

tools/file_tools.py lines 664 and 1155:

result.content = redact_sensitive_text(result.content, code_file=True)

code_file=True skips ENV/JSON patterns but still applies _PREFIX_RE which matches sk-..., ghp_..., etc. For config/data files, this masking corrupts the information the agent needs to read.

Expected behavior

When reading config files (.yaml, .json, .env, .toml, .conf), redact_sensitive_text should not apply prefix-based masking because:

• Config files are where the agent looks up its current configuration
• Masking the values in these files only corrupts the agent's understanding
• Terminal output redaction (terminal_tool.py) separately handles display-time masking

When reading source code files (.py, .js, etc.), the current behavior (code_file=True) is fine.

Steps to reproduce

1. Set security.redact_secrets: true (default)
2. Add an API key to config.yaml, e.g.:

   mcp_servers:
     github:
       env:
         GITHUB_PERSONAL_ACCESS_TOKEN: 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

3. Read the config via read_file or cat in terminal
4. Observe that the token shows as ghp_IGy...S199 (masked)
5. If this masked value is written back (e.g. via agent workflow), it permanently breaks authentication

Related

PR #35246 partially addresses this area (switching code_file=True to only apply to source-code files vs all files), but focuses on ENV/JSON patterns being skipped — it still leaves prefix-based masking applied to config files.