Pull Request 说明

Thanks for your pull-request.
The full list of commands accepted by me can be found at here.
You can get sig-info at here.
You can self-configure the PR merge rules for this repository. For more details, please refer to Here.
For more, you also can visit HICANN.

PR Approval Progress

✅ Congratulations! All modules have met the lgtm and approve requirements.

Module Approval Details

💡 Tip:

• Committer can comment /approve or /lgtm
• Commenting /approve implies both code review (lgtm) and intent to merge (approve)

CLA Signature Pass

qq_41667743, thanks for your pull request. All authors of the commits have signed the CLA. 👍

/compile

/lgtm

/approve

[P1] 脱敏正则新增边界判断，导致原本会遮蔽的凭据明文进入归一化输出

位置： trace_normalize.py:61，重点看第 61–63 行；PR 提交中的对应文件。

新正则在敏感名称前加入 (?<![\w-])，但仅允许 access/auth/refresh 等有限前缀。日志中常见的 GITCODE_TOKEN、HF_TOKEN、CI_JOB_TOKEN 和 client_secret 因此不再匹配：TOKEN / secret 前面的下划线被新边界排除，完整变量名又不在允许模式内。

实际影响： shell 命令、环境输出或配置文本含这些赋值时，normalize 成功返回，却把凭据原样保留在供后续 Agent 读取的归一化事件中，且脱敏计数为 0。这是相对基线的保护能力回退，不是尚未支持的新格式。

用同一组虚构凭据分别运行两个提交的完整 parse_records → normalize_source → _redact → JSON 序列化 流程，得到：

完整复现结果。所有样例均使用虚构值。

在本地仓库根目录可快速复现：

python3 - <<'PY'
import sys
sys.path.insert(0, '.agents/skills/ops-knowledge-trace-ingest/scripts')
from test_trace_normalize import _normalize_text
value = 'review_fake_opaque_credential'
r = _normalize_text('user: inspect config\nconfig: GITCODE_TOKEN=' + value + '\nassistant: done\n')
print('redactions:', r['redactions'])
print('plaintext_in_output:', value in '\n'.join(r['serialized']))
PY

当前输出为 redactions: 0、plaintext_in_output: True。

最小修正要求： 恢复带业务/提供方前缀的敏感变量名识别，同时保留对 token_count、secretary 等普通字段的排除。为上述四类名称增加完整归一化输出的回归，覆盖无引号及带引号赋值；同步检查结构化敏感键的识别，避免文本与 JSON 两条路径行为分裂。

Notification

This pull request has been changed(code update) or closed, so removes the following label(s): ci-pipeline-passed.

Notice

New code changes of the pull request are detected and remove these labels approved. 😳

/compile

Notification

This pull request has been changed(code update) or closed, so removes the following label(s): ci-pipeline-passed.

/compile

/lgtm

/approve

/lgtm
/approve