agent-redact 0.2.0__tar.gz

agent_redact-0.2.0/.gitignore

@@ -0,0 +1,51 @@
+# Dependencies
+node_modules/
+.pnp
+.pnp.js
+
+# Build outputs
+build/
+*.tsbuildinfo
+
+# Coverage & Tests
+coverage/
+.nyc_output/
+
+# Logs
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+*.log
+
+# Environment & Secrets (ironic if leaked here!)
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+
+# IDE & OS
+.vscode/
+.idea/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+.DS_Store
+Thumbs.db
+
+# Cache
+.eslintcache
+.vitest/
+.turbo/
+
+
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+python/dist/
+*.egg-info/

agent_redact-0.2.0/PKG-INFO

@@ -0,0 +1,55 @@
+Metadata-Version: 2.5
+Name: agent-redact
+Version: 0.2.0
+Summary: Secret & PII redaction for Python AI agents (wrapper around the agent-redact CLI)
+Project-URL: Homepage, https://github.com/TonyDuongg/agent-redact
+Project-URL: Issues, https://github.com/TonyDuongg/agent-redact/issues
+Author: Tony Duong
+License-Expression: MIT
+Keywords: ai-agents,llm,pii,redaction,secrets,security
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# agent-redact (Python)
+
+Python bindings for [agent-redact](https://github.com/TonyDuongg/agent-redact). This is a thin, dependency-free wrapper around the Node.js CLI, so Python agents get exactly the same detection engine as the npm package.
+
+```bash
+pip install agent-redact
+```
+
+> **Node.js 20+ is still required.** This package contains only the Python wrapper; the detection engine is the Node.js CLI (see below for how it is found).
+
+**Requirements:**
+- Python 3.10+
+- Node.js 20+
+- the CLI, from one of these (checked in order):
+  1. `AGENT_REDACT_CLI` set to the **absolute** path of `dist/cli/index.js`;
+  2. a global `npm install -g agent-redact`;
+  3. npm next to `node`: the matching version is installed once into a private user cache (`--ignore-scripts`) and reused.
+
+The CLI is always started as `node <absolute path>`. It is never run through `.cmd`/`.bat` shims, through `npx`, or from a binary found in the current directory, so scanning an untrusted repository cannot hijack it.
+
+```python
+from agent_redact import redact, scan, Session
+
+# One-way redaction
+result = redact("deploy with AKIA...")       # result.text, result.matches (no secret values)
+redact(text, presets=["vn-pii"])             # opt-in presets
+
+# Reversible masking across a whole conversation
+with Session() as s:
+    safe_prompt = s.redact(user_prompt)      # [AWS_ACCESS_KEY_ID_1] …
+    answer = llm(safe_prompt)
+    print(s.unmask(answer))                  # placeholders restored locally
+
+# Repository / staged-changes audit
+findings = scan(["."])                       # honours .gitignore in git repos
+findings = scan(staged=True)                 # what is about to be committed
+```
+
+`Session` keeps its vault in a private temporary directory, **encrypted** with a random per-session passphrase that is never written to disk, and deletes it on `close()` or when the `with` block ends.

agent_redact-0.2.0/README.md

@@ -0,0 +1,39 @@
+# agent-redact (Python)
+
+Python bindings for [agent-redact](https://github.com/TonyDuongg/agent-redact). This is a thin, dependency-free wrapper around the Node.js CLI, so Python agents get exactly the same detection engine as the npm package.
+
+```bash
+pip install agent-redact
+```
+
+> **Node.js 20+ is still required.** This package contains only the Python wrapper; the detection engine is the Node.js CLI (see below for how it is found).
+
+**Requirements:**
+- Python 3.10+
+- Node.js 20+
+- the CLI, from one of these (checked in order):
+  1. `AGENT_REDACT_CLI` set to the **absolute** path of `dist/cli/index.js`;
+  2. a global `npm install -g agent-redact`;
+  3. npm next to `node`: the matching version is installed once into a private user cache (`--ignore-scripts`) and reused.
+
+The CLI is always started as `node <absolute path>`. It is never run through `.cmd`/`.bat` shims, through `npx`, or from a binary found in the current directory, so scanning an untrusted repository cannot hijack it.
+
+```python
+from agent_redact import redact, scan, Session
+
+# One-way redaction
+result = redact("deploy with AKIA...")       # result.text, result.matches (no secret values)
+redact(text, presets=["vn-pii"])             # opt-in presets
+
+# Reversible masking across a whole conversation
+with Session() as s:
+    safe_prompt = s.redact(user_prompt)      # [AWS_ACCESS_KEY_ID_1] …
+    answer = llm(safe_prompt)
+    print(s.unmask(answer))                  # placeholders restored locally
+
+# Repository / staged-changes audit
+findings = scan(["."])                       # honours .gitignore in git repos
+findings = scan(staged=True)                 # what is about to be committed
+```
+
+`Session` keeps its vault in a private temporary directory, **encrypted** with a random per-session passphrase that is never written to disk, and deletes it on `close()` or when the `with` block ends.

agent_redact-0.2.0/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "agent-redact"
+version = "0.2.0"
+description = "Secret & PII redaction for Python AI agents (wrapper around the agent-redact CLI)"
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.10"
+authors = [{ name = "Tony Duong" }]
+keywords = ["security", "redaction", "secrets", "pii", "llm", "ai-agents"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Operating System :: OS Independent",
+  "Topic :: Security",
+  "Typing :: Typed",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/TonyDuongg/agent-redact"
+Issues = "https://github.com/TonyDuongg/agent-redact/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agent_redact"]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]

agent_redact-0.2.0/src/agent_redact/__init__.py

@@ -0,0 +1,363 @@
+"""Python bindings for agent-redact.
+
+This package is a thin, dependency-free wrapper around the agent-redact Node.js CLI, so
+Python agents (LangChain, CrewAI, AutoGen, plain SDK code) get exactly the same detection
+engine as the npm package. It needs Node.js 20+ and one of:
+
+* ``AGENT_REDACT_CLI`` set to the absolute path of ``dist/cli/index.js`` (or an executable),
+* a global ``npm install -g agent-redact``, or
+* npm next to ``node``: the matching version is installed once into a private user cache
+  (with ``--ignore-scripts``) and reused.
+
+The CLI is always started as ``node <absolute path>``: never through ``.cmd``/``.bat`` shims,
+``npx``, or a binary found in the current directory.
+
+Secret values are never written to disk in plaintext: :class:`Session` keeps its vault
+encrypted with a random per-session passphrase that only lives in this process.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import secrets
+import shutil
+import subprocess
+import tempfile
+from dataclasses import dataclass, field
+from typing import Iterable, Mapping, Sequence
+
+__version__ = "0.2.0"
+
+__all__ = [
+    "AgentRedactError",
+    "Finding",
+    "Match",
+    "RedactResult",
+    "Session",
+    "redact",
+    "scan",
+    "__version__",
+]
+
+
+class AgentRedactError(RuntimeError):
+    """Raised when the CLI cannot be found or exits with an error."""
+
+
+@dataclass(frozen=True)
+class Match:
+    """One redacted span. The secret value itself is never included."""
+
+    pattern_id: str
+    pattern_name: str
+    category: str
+    severity: str
+    start: int
+    end: int
+    replacement: str
+
+
+@dataclass(frozen=True)
+class RedactResult:
+    text: str
+    matches: list[Match] = field(default_factory=list)
+    stats: dict[str, int] = field(default_factory=dict)
+
+    @property
+    def total_leaks(self) -> int:
+        return len(self.matches)
+
+    @property
+    def has_leaks(self) -> bool:
+        return bool(self.matches)
+
+
+@dataclass(frozen=True)
+class Finding:
+    """A finding from :func:`scan`, without the secret value."""
+
+    file: str
+    line: int
+    column: int
+    pattern_id: str
+    pattern_name: str
+    severity: str
+    category: str
+    fingerprint: str
+
+
+_NOT_FOUND = (
+    "agent-redact CLI not found. Install Node.js 20+ and run `npm install -g agent-redact`, "
+    "or set AGENT_REDACT_CLI to the absolute path of dist/cli/index.js."
+)
+
+
+def _safe_which(name: str) -> str | None:
+    """Like shutil.which, but only searches absolute PATH entries and never the current
+    directory (Windows searches cwd first by default; a scanned repo could plant a binary)."""
+    cwd = os.path.realpath(os.getcwd())
+    exts = [""]
+    if os.name == "nt":
+        exts = [e.lower() for e in os.environ.get("PATHEXT", ".EXE").split(os.pathsep) if e] + [""]
+    for entry in os.environ.get("PATH", "").split(os.pathsep):
+        if not entry or not os.path.isabs(entry) or os.path.realpath(entry) == cwd:
+            continue
+        for ext in exts:
+            candidate = os.path.join(entry, name + ext)
+            if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
+                return candidate
+    return None
+
+
+def _node() -> str:
+    node = _safe_which("node")
+    if not node:
+        raise AgentRedactError("`node` (Node.js 20+) was not found on PATH. " + _NOT_FOUND)
+    return node
+
+
+def _global_cli_js() -> str | None:
+    """Resolve the JS entry of a global `npm i -g agent-redact` without running npm's shims."""
+    shim = _safe_which("agent-redact")
+    if not shim:
+        return None
+    real = os.path.realpath(shim)  # POSIX: the bin is a symlink to dist/cli/index.js
+    if real.endswith(".js") and os.path.isfile(real):
+        return real
+    # Windows: <prefix>\agent-redact.cmd sits next to <prefix>\node_modules\agent-redact
+    candidate = os.path.join(os.path.dirname(shim), "node_modules", "agent-redact", "dist", "cli", "index.js")
+    return candidate if os.path.isfile(candidate) else None
+
+
+def _cache_root() -> str:
+    if os.name == "nt":
+        base = os.environ.get("LOCALAPPDATA") or os.path.expanduser("~\\AppData\\Local")
+    else:
+        base = os.environ.get("XDG_CACHE_HOME") or os.path.expanduser("~/.cache")
+    return os.path.join(base, "agent-redact", "cli")
+
+
+def _cached_cli_js() -> str:
+    """Install the matching CLI once into a private cache (no install scripts) and reuse it.
+
+    npm is run through its own JS entry with the cache directory as cwd, never inside a
+    caller-controlled directory, so a project's .npmrc cannot redirect the install.
+    """
+    target = os.path.join(_cache_root(), __version__)
+    entry = os.path.join(target, "node_modules", "agent-redact", "dist", "cli", "index.js")
+    if os.path.isfile(entry):
+        return entry
+    node = _node()
+    node_dir = os.path.dirname(node)
+    npm_cli = next(
+        (
+            p
+            for p in (
+                os.path.join(node_dir, "node_modules", "npm", "bin", "npm-cli.js"),  # Windows layout
+                os.path.join(node_dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),  # POSIX
+            )
+            if os.path.isfile(p)
+        ),
+        None,
+    )
+    if not npm_cli:
+        raise AgentRedactError(_NOT_FOUND)
+    os.makedirs(os.path.dirname(target), exist_ok=True)
+    staging = tempfile.mkdtemp(prefix=f"{__version__}-", dir=os.path.dirname(target))
+    proc = subprocess.run(
+        [node, npm_cli, "install", "--prefix", staging, "--no-audit", "--no-fund", "--ignore-scripts",
+         "--userconfig", os.devnull, f"agent-redact@{__version__}"],
+        cwd=staging,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        check=False,
+    )
+    if proc.returncode != 0:
+        shutil.rmtree(staging, ignore_errors=True)
+        raise AgentRedactError(f"could not install agent-redact@{__version__}: {proc.stderr.strip()}")
+    try:
+        os.replace(staging, target)  # atomic publish; a concurrent installer may have won
+    except OSError:
+        shutil.rmtree(staging, ignore_errors=True)
+    if not os.path.isfile(entry):
+        raise AgentRedactError(_NOT_FOUND)
+    return entry
+
+
+def _cli_command() -> list[str]:
+    """Always `node <absolute path to dist/cli/index.js>`: never a .cmd/.bat shim, never npx,
+    never a relative path that could resolve inside an untrusted working directory."""
+    explicit = os.environ.get("AGENT_REDACT_CLI")
+    if explicit:
+        if not os.path.isabs(explicit):
+            raise AgentRedactError("AGENT_REDACT_CLI must be an absolute path")
+        if explicit.endswith((".js", ".mjs", ".cjs")):
+            return [_node(), explicit]
+        return [explicit]
+    js = _global_cli_js() or _cached_cli_js()
+    return [_node(), js]
+
+
+def _run(
+    args: Sequence[str],
+    *,
+    stdin: str | None = None,
+    env: Mapping[str, str] | None = None,
+    ok_codes: Iterable[int] = (0,),
+    cwd: str | None = None,
+) -> subprocess.CompletedProcess[str]:
+    command = [*_cli_command(), *args]
+    try:
+        proc = subprocess.run(
+            command,
+            input=stdin if stdin is not None else "",
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            env=dict(env) if env is not None else None,
+            cwd=cwd,
+            check=False,
+        )
+    except OSError as exc:  # e.g. the executable disappeared
+        raise AgentRedactError(f"could not start agent-redact: {exc}") from exc
+    if proc.returncode not in tuple(ok_codes):
+        message = (proc.stderr or proc.stdout or "").strip() or f"exit code {proc.returncode}"
+        raise AgentRedactError(message)
+    return proc
+
+
+def _common_flags(presets: Sequence[str], entropy: bool, config: str | None) -> list[str]:
+    flags: list[str] = []
+    if presets:
+        flags += ["--preset", ",".join(presets)]
+    if entropy:
+        flags.append("--entropy")
+    if config:
+        flags += ["--config", config]
+    return flags
+
+
+def redact(
+    text: str,
+    *,
+    presets: Sequence[str] = (),
+    entropy: bool = False,
+    config: str | None = None,
+) -> RedactResult:
+    """One-way redaction: secrets become ``[REDACTED_<TYPE>]`` placeholders."""
+    proc = _run(["--json", *_common_flags(presets, entropy, config)], stdin=text)
+    data = json.loads(proc.stdout)
+    matches = [
+        Match(
+            pattern_id=m["patternId"],
+            pattern_name=m["patternName"],
+            category=m["category"],
+            severity=m["severity"],
+            start=m["startIndex"],
+            end=m["endIndex"],
+            replacement=m["replacement"],
+        )
+        for m in data.get("matches", [])
+    ]
+    return RedactResult(text=data["text"], matches=matches, stats=data.get("stats", {}))
+
+
+def scan(
+    paths: Sequence[str] = (),
+    *,
+    staged: bool = False,
+    presets: Sequence[str] = (),
+    entropy: bool = False,
+    config: str | None = None,
+    baseline: str | None = None,
+    cwd: str | None = None,
+) -> list[Finding]:
+    """Scan files/directories (honouring .gitignore inside git repos) or the git index."""
+    if not paths and not staged:
+        raise ValueError("pass at least one path, or staged=True")
+    args = [*paths, "--format", "json", *_common_flags(presets, entropy, config)]
+    if staged:
+        args.append("--staged")
+    if baseline:
+        args += ["--baseline", baseline]
+    proc = _run(args, ok_codes=(0, 1), cwd=cwd)  # exit 1 means "findings present"
+    data = json.loads(proc.stdout)
+    return [
+        Finding(
+            file=f["file"],
+            line=f["line"],
+            column=f["column"],
+            pattern_id=f["patternId"],
+            pattern_name=f["patternName"],
+            severity=f["severity"],
+            category=f["category"],
+            fingerprint=f["fingerprint"],
+        )
+        for f in data.get("findings", [])
+    ]
+
+
+class Session:
+    """Reversible masking across several calls, e.g. one LLM conversation.
+
+    Placeholders are numbered consistently across calls (``[AWS_ACCESS_KEY_ID_1]``,
+    ``[AWS_ACCESS_KEY_ID_2]`` …) and :meth:`unmask` restores them. The vault lives in a
+    private temporary directory, encrypted with a random passphrase that is passed to the
+    CLI through an environment variable and never written anywhere. Use as a context
+    manager (or call :meth:`close`) to delete it.
+
+    >>> with Session() as s:                                    # doctest: +SKIP
+    ...     safe = s.redact(user_prompt)
+    ...     answer = call_llm(safe)
+    ...     print(s.unmask(answer))
+    """
+
+    _KEY_ENV = "AGENT_REDACT_PY_SESSION_KEY"
+
+    def __init__(self, *, presets: Sequence[str] = (), entropy: bool = False, config: str | None = None) -> None:
+        self._dir = tempfile.mkdtemp(prefix="agent-redact-")
+        self._vault = os.path.join(self._dir, "vault.json")
+        self._env = {**os.environ, self._KEY_ENV: secrets.token_urlsafe(32)}
+        self._flags = _common_flags(presets, entropy, config)
+        self._closed = False
+
+    def _vault_flags(self) -> list[str]:
+        return ["--vault-key-env", self._KEY_ENV]
+
+    def redact(self, text: str) -> str:
+        """Mask secrets with reversible, session-wide numbered placeholders."""
+        self._ensure_open()
+        args = ["-r", "--vault-out", self._vault, *self._vault_flags(), *self._flags]
+        if os.path.exists(self._vault):
+            args += ["--vault-in", self._vault]
+        return _run(args, stdin=text, env=self._env).stdout
+
+    def unmask(self, text: str) -> str:
+        """Restore placeholders produced by this session (unknown ones are left as is)."""
+        self._ensure_open()
+        if not os.path.exists(self._vault):
+            return text
+        return _run(["--unmask", self._vault, *self._vault_flags()], stdin=text, env=self._env).stdout
+
+    def close(self) -> None:
+        if not self._closed:
+            shutil.rmtree(self._dir, ignore_errors=True)
+            self._closed = True
+
+    def _ensure_open(self) -> None:
+        if self._closed:
+            raise AgentRedactError("this Session is closed")
+
+    def __enter__(self) -> "Session":
+        return self
+
+    def __exit__(self, *exc: object) -> None:
+        self.close()
+
+    def __del__(self) -> None:  # best effort cleanup
+        try:
+            self.close()
+        except Exception:
+            pass

agent_redact-0.2.0/tests/test_agent_redact.py

@@ -0,0 +1,114 @@
+"""Tests run against the repository's built CLI (dist/cli/index.js) unless
+AGENT_REDACT_CLI is already set. Build it first with `npm run build`."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+import pytest
+
+REPO = Path(__file__).resolve().parents[2]
+os.environ.setdefault("AGENT_REDACT_CLI", str(REPO / "dist" / "cli" / "index.js"))
+
+import agent_redact  # noqa: E402
+from agent_redact import AgentRedactError, Session, redact, scan  # noqa: E402
+
+# Token-shaped fixtures are assembled at runtime so they never appear verbatim in the repo
+AWS = "AKIA" + "IOSFODNN7EXAMPLE"
+AWS2 = "AKIA" + "ABCDEFGHIJKLMNOP"
+
+
+def test_version_matches_npm_package() -> None:
+    pkg = json.loads((REPO / "package.json").read_text(encoding="utf-8"))
+    assert agent_redact.__version__ == pkg["version"]
+
+
+def test_redact_returns_text_and_matches_without_values() -> None:
+    result = redact(f"key {AWS} end")
+    assert result.text == "key [REDACTED_AWS_ACCESS_KEY_ID] end"
+    assert result.total_leaks == 1 and result.has_leaks
+    assert result.matches[0].pattern_id == "aws-access-key-id"
+    assert AWS not in repr(result)
+
+
+def test_redact_handles_unicode_and_presets() -> None:
+    cccd = "079" + "2" + "03" + "012345"
+    assert redact(f"Xin chào {AWS} ổn").text == "Xin chào [REDACTED_AWS_ACCESS_KEY_ID] ổn"
+    assert cccd in redact(f"CCCD {cccd}").text  # opt-in only
+    assert redact(f"CCCD {cccd}", presets=["vn-pii"]).text == "CCCD [REDACTED_VN_CITIZEN_ID]"
+
+
+def test_unknown_preset_raises() -> None:
+    with pytest.raises(AgentRedactError, match="Unknown preset"):
+        redact("x", presets=["nope"])
+
+
+def test_session_numbers_consistently_and_unmasks(tmp_path: Path) -> None:
+    with Session() as s:
+        first = s.redact(f"first {AWS}")
+        second = s.redact(f"second {AWS2} and again {AWS}")
+        assert first == "first [AWS_ACCESS_KEY_ID_1]"
+        assert second == "second [AWS_ACCESS_KEY_ID_2] and again [AWS_ACCESS_KEY_ID_1]"
+        assert s.unmask("use [AWS_ACCESS_KEY_ID_2] then [AWS_ACCESS_KEY_ID_1]") == f"use {AWS2} then {AWS}"
+
+        vault = Path(s._vault)  # noqa: SLF001 - verify the on-disk format
+        content = vault.read_text(encoding="utf-8")
+        assert json.loads(content)["format"] == "agent-redact-vault"  # encrypted
+        assert AWS not in content and AWS2 not in content
+        vault_dir = vault.parent
+    assert not vault_dir.exists()  # deleted on exit
+
+
+def test_session_unmask_before_redact_is_identity() -> None:
+    with Session() as s:
+        assert s.unmask("nothing [AWS_ACCESS_KEY_ID_1]") == "nothing [AWS_ACCESS_KEY_ID_1]"
+
+
+def test_closed_session_raises() -> None:
+    s = Session()
+    s.close()
+    with pytest.raises(AgentRedactError, match="closed"):
+        s.redact("x")
+
+
+def test_scan_reports_findings_without_values(tmp_path: Path) -> None:
+    (tmp_path / "app.env").write_text(f"\nKEY={AWS}\n", encoding="utf-8")
+    (tmp_path / "clean.txt").write_text("nothing here", encoding="utf-8")
+    findings = scan(["."], cwd=str(tmp_path))
+    assert [(f.file, f.line, f.pattern_id) for f in findings] == [("app.env", 2, "aws-access-key-id")]
+    assert AWS not in repr(findings)
+
+
+def test_scan_requires_a_target() -> None:
+    with pytest.raises(ValueError):
+        scan()
+
+
+def test_missing_cli_raises_helpful_error(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("AGENT_REDACT_CLI", raising=False)
+    monkeypatch.setattr(agent_redact, "_safe_which", lambda _name: None)
+    with pytest.raises(AgentRedactError, match="not found"):
+        redact("x")
+
+
+def test_relative_cli_override_is_rejected(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("AGENT_REDACT_CLI", "dist/cli/index.js")
+    with pytest.raises(AgentRedactError, match="absolute path"):
+        redact("x")
+
+
+def test_safe_which_ignores_cwd_and_relative_path_entries(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    planted = tmp_path / ("agent-redact.exe" if os.name == "nt" else "agent-redact")
+    planted.write_text("#!/bin/sh\necho pwned\n", encoding="utf-8")
+    planted.chmod(0o755)
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("PATH", os.pathsep.join([".", "", str(tmp_path)]))
+    assert agent_redact._safe_which("agent-redact") is None  # noqa: SLF001
+
+
+def test_cli_command_never_uses_shims_or_npx() -> None:
+    cmd = agent_redact._cli_command()  # noqa: SLF001
+    assert os.path.basename(cmd[0]).lower().startswith("node")
+    assert cmd[1].endswith("index.js") and os.path.isabs(cmd[1])