pulse-coding-agent 0.1.0__py3-none-any.whl

pulse/sandbox/remote/worker.py

@@ -0,0 +1,175 @@
+"""Remote Sandbox Worker.
+
+Wraps the DockerBackend to securely execute commands on behalf of the RemoteServer.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import typing
+from pathlib import Path
+from typing import Any
+
+from pulse.sandbox.backend.docker import DockerBackend
+from pulse.sandbox.network import NetworkPolicy
+from pulse.sandbox.process import ProcessResult
+from pulse.sandbox.remote.models import (
+    ExecutionResultModel,
+    SubmitExecutionRequest,
+    validate_execution_id,
+)
+from pulse.sandbox.resources import ResourcePolicy
+from pulse.sandbox.secrets import SecretPolicy, SecretScrubber
+
+logger = logging.getLogger(__name__)
+
+
+class RemoteWorker:
+    """Executes untrusted code inside a hardened Docker/Podman container.
+
+    This worker acts as the server-side counterpart to the local DockerBackend,
+    enforcing identical security semantics.
+    """
+
+    def __init__(self, workspace_base_path: Path | None = None) -> None:
+        self.backend = DockerBackend()
+        # Default isolation base path where tenant workspaces will be unpacked
+        self.workspace_base_path = workspace_base_path or Path(
+            "/tmp/pulse_remote_workspaces"
+        )
+        self.workspace_base_path.mkdir(parents=True, exist_ok=True)
+        self.overlays: dict[str, Path] = {}
+        self._active_executions: dict[str, asyncio.Task[Any]] = {}
+
+    async def initialize(self) -> None:
+        """Initialize the worker backend."""
+        await self.backend.reconcile()
+
+    async def execute_request(
+        self,
+        req: SubmitExecutionRequest,
+        tenant_id: str = "unknown",
+        output_callback: typing.Callable[[str, bytes], typing.Awaitable[None]]
+        | None = None,
+    ) -> ExecutionResultModel:
+        """Execute a remote request securely."""
+
+        # Deserialize policies
+        res_policy = (
+            ResourcePolicy.from_dict(req.resource_policy_dict)
+            if req.resource_policy_dict
+            else ResourcePolicy(wall_time_seconds=600.0)
+        )
+        net_policy = (
+            NetworkPolicy.from_dict(req.network_policy_dict)
+            if req.network_policy_dict
+            else None
+        )
+        sec_policy = (
+            SecretPolicy.from_dict(req.secret_policy_dict)
+            if req.secret_policy_dict
+            else None
+        )
+        secret_values = list((req.env or {}).values())
+        if sec_policy:
+            secret_values.extend(sec_policy.explicit_env.values())
+        scrubber = SecretScrubber(secret_values)
+
+        async def safe_output_callback(stream: str, data: bytes) -> None:
+            if output_callback is None:
+                return
+            text = data.decode("utf-8", errors="replace")
+            redacted = scrubber.redact(text).encode("utf-8", errors="replace")
+            await output_callback(stream, redacted)
+
+        # Resolve paths for the execution
+        tenant_workspace = self.workspace_base_path / tenant_id / req.execution_id
+        tenant_workspace.mkdir(parents=True, exist_ok=True)
+
+        cwd = (
+            tenant_workspace / req.working_directory
+            if req.working_directory
+            else tenant_workspace
+        )
+
+        # Keep track of the current asyncio task so we can cancel it via cancel()
+        import asyncio
+
+        self._active_executions[req.execution_id] = asyncio.current_task()
+
+        try:
+            # We delegate to DockerBackend for strict isolation (--cap-drop=ALL, etc)
+            result: ProcessResult = await self.backend.execute(
+                command=req.command,
+                workspace_root=tenant_workspace,
+                cwd=cwd,
+                env=req.env,
+                limits=res_policy,
+                network_policy=net_policy,
+                secret_policy=sec_policy,
+                execution_id=req.execution_id,
+                output_callback=safe_output_callback if output_callback else None,
+            )
+
+            # Store the overlay path for retrieval (R6)
+            if result.overlay_path and result.overlay_path.exists():
+                self.overlays[req.execution_id] = result.overlay_path
+
+            return ExecutionResultModel(
+                execution_id=req.execution_id,
+                command=scrubber.redact(result.command),
+                exit_code=result.exit_code,
+                stdout=scrubber.redact(result.stdout),
+                stderr=scrubber.redact(result.stderr),
+                duration_ms=result.duration_ms,
+                timed_out=result.timed_out,
+                truncated=result.truncated,
+                termination_reason=result.termination_reason,
+            )
+
+        except (OSError, RuntimeError, asyncio.CancelledError):
+            logger.error("Worker execution failed with an internal error.")
+            return ExecutionResultModel(
+                execution_id=req.execution_id,
+                command=scrubber.redact(str(req.command)),
+                exit_code=-1,
+                stdout="",
+                stderr="Worker execution failed with an internal error.",
+                duration_ms=0.0,
+                termination_reason="worker_crash",
+            )
+        finally:
+            self._active_executions.pop(req.execution_id, None)
+
+    def get_overlay_path(self, execution_id: str) -> Path | None:
+        """Get the stored overlay path for an execution."""
+        return self.overlays.get(execution_id)
+
+    def cleanup_overlay(self, execution_id: str) -> None:
+        """Clean up the stored overlay."""
+        overlay = self.overlays.pop(execution_id, None)
+        if overlay and overlay.exists():
+            import shutil
+
+            shutil.rmtree(overlay, ignore_errors=True)
+            try:
+                overlay.parent.rmdir()
+            except OSError:
+                pass
+
+    def cleanup_workspace(self, tenant_id: str, execution_id: str) -> None:
+        """Clean up the tenant workspace."""
+        validate_execution_id(execution_id)
+        workspace = self.workspace_base_path / tenant_id / execution_id
+        if workspace.exists():
+            import shutil
+
+            shutil.rmtree(workspace, ignore_errors=True)
+            self.cleanup_overlay(execution_id)
+
+    async def cancel(self, execution_id: str) -> None:
+        """Cancel a running execution on this worker."""
+        task = self._active_executions.get(execution_id)
+        if task and not task.done():
+            task.cancel()

pulse/sandbox/resources.py

@@ -0,0 +1,236 @@
+"""Backend-independent resource governance for sandbox executions.
+
+Policies describe limits without referring to a backend.  Backends translate
+them to native controls (cgroups for containers and ``resource`` on POSIX),
+while :class:`ResourceController` owns the portable execution lifecycle.
+"""
+
+from __future__ import annotations
+
+import os
+import signal
+import sys
+import time
+from dataclasses import asdict, dataclass, replace
+from typing import Any
+
+try:
+    import resource
+except ImportError:  # pragma: no cover - Windows has no resource module
+    resource = None
+
+_linux_prctl: Any | None = None
+if sys.platform.startswith("linux"):
+    try:  # Resolve libc before forking; importing or loading it in preexec can deadlock.
+        import ctypes
+
+        _linux_prctl = ctypes.CDLL(None, use_errno=True).prctl
+    except (ImportError, OSError, AttributeError):  # pragma: no cover - unusual libc
+        _linux_prctl = None
+
+DANGEROUS_ENV_VARS: frozenset[str] = frozenset({
+    "LD_PRELOAD", "LD_LIBRARY_PATH", "DYLD_INSERT_LIBRARIES",
+    "DYLD_LIBRARY_PATH", "PYTHONSTARTUP", "PYTHONPATH", "PERL5LIB",
+    "RUBYLIB", "NODE_OPTIONS", "BASH_ENV", "ENV", "CDPATH",
+})
+
+
+@dataclass(frozen=True, slots=True)
+class ResourcePolicy:
+    """Immutable, serializable limits applied to one sandbox execution.
+
+    A zero or ``None`` limit means that the corresponding native limit is not
+    requested.  Not every operating system exposes every limit; callers can
+    inspect backend capabilities without changing their execution code.
+    """
+
+    cpu_quota_percent: float = 100.0
+    cpu_time_seconds: float | None = None
+    memory_bytes: int | None = 1_073_741_824
+    swap_bytes: int | None = 1_073_741_824
+    disk_bytes: int | None = None
+    max_processes: int | None = 64
+    max_open_files: int | None = 256
+    max_output_bytes: int = 5_242_880
+    wall_time_seconds: float = 30.0
+    termination_grace_seconds: float = 1.5
+    working_directory_bytes: int | None = None
+
+    def __post_init__(self) -> None:
+        for name in ("cpu_quota_percent", "max_output_bytes", "wall_time_seconds", "termination_grace_seconds"):
+            if getattr(self, name) <= 0:
+                raise ValueError(f"{name} must be positive")
+        for name in ("cpu_time_seconds", "memory_bytes", "swap_bytes", "disk_bytes", "max_processes", "max_open_files", "working_directory_bytes"):
+            value = getattr(self, name)
+            if value is not None and value <= 0:
+                raise ValueError(f"{name} must be positive when set")
+
+    def compose(self, **overrides: Any) -> ResourcePolicy:
+        """Return a derived policy, preserving immutability and validation."""
+        return replace(self, **overrides)
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> ResourcePolicy:
+        return cls(**data)
+
+
+@dataclass(frozen=True, slots=True)
+class ExecutionMetrics:
+    """Structured observations collected for a completed execution."""
+
+    elapsed_ms: float
+    cpu_time_ms: float | None = None
+    peak_memory_bytes: int | None = None
+    process_count: int | None = None
+    output_bytes: int = 0
+    exit_status: int | None = None
+    termination_reason: str | None = None
+
+
+class ResourceLimitExceeded(RuntimeError):
+    """A named execution resource limit was reached."""
+
+    def __init__(self, limit_name: str, limit_value: float) -> None:
+        self.limit_name = limit_name
+        self.limit_value = limit_value
+        super().__init__(f"Sandbox resource limit exceeded: {limit_name}={limit_value}")
+
+
+class TimeoutExceeded(ResourceLimitExceeded):
+    """The wall-clock execution deadline elapsed."""
+
+    def __init__(self, timeout_seconds: float) -> None:
+        super().__init__("wall_time_seconds", timeout_seconds)
+
+
+class ResourceMonitor:
+    """Collect portable elapsed/output metrics and POSIX child resource usage."""
+
+    def __init__(self) -> None:
+        self._started_at = 0.0
+        self._rusage_before: Any | None = None
+
+    def start(self) -> None:
+        self._started_at = time.monotonic()
+        self._rusage_before = resource.getrusage(resource.RUSAGE_CHILDREN) if resource else None
+
+    def finish(self, *, output_bytes: int, exit_status: int, termination_reason: str | None, process_count: int | None = 1) -> ExecutionMetrics:
+        cpu_time_ms: float | None = None
+        peak_memory_bytes: int | None = None
+        if resource and self._rusage_before is not None:
+            after = resource.getrusage(resource.RUSAGE_CHILDREN)
+            cpu_time_ms = ((after.ru_utime + after.ru_stime) - (self._rusage_before.ru_utime + self._rusage_before.ru_stime)) * 1000
+            # ru_maxrss is KiB on Linux and bytes on macOS.
+            peak_memory_bytes = int(after.ru_maxrss * (1 if sys.platform == "darwin" else 1024))
+        return ExecutionMetrics((time.monotonic() - self._started_at) * 1000, cpu_time_ms, peak_memory_bytes, process_count, output_bytes, exit_status, termination_reason)
+
+
+class ResourceController:
+    """Coordinates portable timeout, cancellation, output and metrics behavior."""
+
+    def __init__(self, policy: ResourcePolicy | None = None, monitor: ResourceMonitor | None = None) -> None:
+        self.policy = policy or ResourcePolicy()
+        self.monitor = monitor or ResourceMonitor()
+
+    def sanitize_env(self, env: dict[str, str] | None = None) -> dict[str, str]:
+        # An explicit environment is authoritative. Merging it with os.environ
+        # silently reintroduces host credentials into supposedly isolated jobs.
+        merged = dict(os.environ if env is None else env)
+        for variable in DANGEROUS_ENV_VARS:
+            merged.pop(variable, None)
+        return merged
+
+    def make_preexec_fn(self) -> Any | None:
+        """Create POSIX native enforcement for host processes."""
+        if not resource or sys.platform == "win32":
+            return None
+        policy = self.policy
+
+        def set_limit(limit: int, value: int | None) -> None:
+            if value is not None:
+                try:
+                    resource.setrlimit(limit, (value, value))
+                except (OSError, ValueError):
+                    pass
+
+        def preexec() -> None:
+            # Keep this callback async-signal-safe in the post-fork child: all
+            # imports and dynamic-library loading happen at module import time.
+            # PR_SET_PDEATHSIG is 1.
+            if _linux_prctl is not None:
+                _linux_prctl(1, signal.SIGKILL)
+
+            try:
+                if hasattr(resource, "RLIMIT_NPROC"):
+                    set_limit(resource.RLIMIT_NPROC, policy.max_processes)
+                if hasattr(resource, "RLIMIT_NOFILE"):
+                    set_limit(resource.RLIMIT_NOFILE, policy.max_open_files)
+                if hasattr(resource, "RLIMIT_AS"):
+                    set_limit(resource.RLIMIT_AS, policy.memory_bytes)
+                if (
+                    hasattr(resource, "RLIMIT_CPU")
+                    and policy.cpu_time_seconds is not None
+                ):
+                    set_limit(
+                        resource.RLIMIT_CPU, max(1, int(policy.cpu_time_seconds))
+                    )
+                if hasattr(resource, "RLIMIT_FSIZE"):
+                    set_limit(resource.RLIMIT_FSIZE, policy.disk_bytes)
+            except Exception:  # noqa: BLE001 - fail closed at the subprocess boundary
+                # subprocess cannot safely propagate rich exceptions from a
+                # preexec callback. Exit closed if an unexpected limit setup
+                # failure escapes the individual setrlimit guards.
+                os._exit(126)
+
+        return preexec
+
+
+@dataclass(frozen=True, slots=True)
+class ResourceLimits:
+    """Legacy-compatible resource limits adapter.
+
+    New integrations should accept :class:`ResourcePolicy`; this type remains
+    supported by public APIs introduced in earlier sandbox phases.
+    """
+    max_memory_bytes: int = 1_073_741_824
+    max_cpu_percent: float = 100.0
+    max_pids: int = 64
+    max_open_files: int = 256
+    timeout_seconds: float = 30.0
+    max_output_bytes: int = 5_242_880
+    max_file_read_bytes: int = 52_428_800
+    max_storage_bytes: int | None = None
+
+    def to_policy(self) -> ResourcePolicy:
+        return ResourcePolicy(cpu_quota_percent=self.max_cpu_percent, memory_bytes=self.max_memory_bytes, swap_bytes=self.max_memory_bytes, max_processes=self.max_pids, max_open_files=self.max_open_files, max_output_bytes=self.max_output_bytes, wall_time_seconds=self.timeout_seconds, disk_bytes=self.max_storage_bytes)
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+class ResourceLimiter:
+    """Backward-compatible adapter around :class:`ResourceController`."""
+    def __init__(self, limits: ResourceLimits | ResourcePolicy | None = None) -> None:
+        self.policy = limits if isinstance(limits, ResourcePolicy) else (limits or ResourceLimits()).to_policy()
+        self.limits = limits if isinstance(limits, ResourceLimits) else ResourceLimits(
+            max_memory_bytes=self.policy.memory_bytes or 0, max_cpu_percent=self.policy.cpu_quota_percent,
+            max_pids=self.policy.max_processes or 0, max_open_files=self.policy.max_open_files or 0,
+            timeout_seconds=self.policy.wall_time_seconds, max_output_bytes=self.policy.max_output_bytes,
+            max_storage_bytes=self.policy.disk_bytes)
+        self.controller = ResourceController(self.policy)
+
+    def make_preexec_fn(self) -> Any | None:
+        return self.controller.make_preexec_fn()
+
+    def sanitize_env(self, env: dict[str, str] | None = None) -> dict[str, str]:
+        return self.controller.sanitize_env(env)
+
+    def truncate_output(self, content: str | bytes) -> tuple[str, bool]:
+        raw = content.decode("utf-8", errors="replace") if isinstance(content, bytes) else content
+        encoded = raw.encode("utf-8")
+        if len(encoded) <= self.policy.max_output_bytes:
+            return raw, False
+        return encoded[:self.policy.max_output_bytes].decode("utf-8", errors="ignore") + "\n... [OUTPUT TRUNCATED BY SANDBOX RESOURCE LIMITER]", True

pulse/sandbox/secrets.py

@@ -0,0 +1,241 @@
+"""Secret protection and automated credential scrubbing engine.
+
+Redacts API keys, SSH keys, passwords, bearer tokens, and environment secrets
+from logs, terminal outputs, and audit records.
+
+Security hardening (ReDoS remediation):
+    All regex patterns have been audited for catastrophic backtracking.
+    - No nested quantifiers (e.g. (a+)+ patterns).
+    - Alternations are anchored or bounded.
+    - A per-call timeout guard prevents any single redact() from blocking.
+    - Patterns use possessive-equivalent constructs where possible.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import threading
+import urllib.parse
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any
+
+
+class SecretMode(Enum):
+    DENY_ALL = "deny_all"
+    ALLOW_EXPLICIT = "allow_explicit"
+    ALLOW_ALL = "allow_all"
+
+
+class SecretEnforcementLevel(Enum):
+    STRONGLY_ENFORCED = "strongly_enforced"
+    UNSUPPORTED = "unsupported"
+
+
+@dataclass(frozen=True, slots=True)
+class SecretPolicy:
+    """Policy declaring how host secrets should be passed to the sandbox."""
+    mode: SecretMode = SecretMode.DENY_ALL
+    explicit_env: dict[str, str] = field(default_factory=dict)
+    
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "mode": self.mode.value,
+            "explicit_env": self.explicit_env,
+        }
+        
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> SecretPolicy:
+        mode_str = str(data.get("mode", "deny_all")).lower()
+        try:
+            mode = SecretMode(mode_str)
+        except ValueError:
+            mode = SecretMode.DENY_ALL
+        return cls(
+            mode=mode,
+            explicit_env=data.get("explicit_env", {})
+        )
+
+
+def build_isolated_environment(
+    policy: SecretPolicy | None = None, 
+    extra_env: dict[str, str] | None = None
+) -> dict[str, str]:
+    """Construct an isolated environment preventing wholesale host credential inheritance."""
+    # Start with a pristine minimal environment (do NOT merge os.environ by default)
+    isolated = {
+        "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "HOME": "/workspace",
+        "TMPDIR": "/tmp",
+    }
+    
+    if policy is None:
+        policy = SecretPolicy()
+        
+    if policy.mode == SecretMode.ALLOW_ALL:
+        # Development override: inherit host env
+        isolated = dict(os.environ)
+        
+    elif policy.mode == SecretMode.ALLOW_EXPLICIT:
+        isolated.update(policy.explicit_env)
+        
+    # Apply execution-specific non-secret overrides
+    if extra_env:
+        isolated.update(extra_env)
+        
+    return isolated
+
+
+class SecretScrubber:
+    """Regex & value-matching secret redactor with ReDoS protection."""
+
+    REDACTED_LABEL = "[REDACTED_SECRET]"
+    _REDACT_TIMEOUT_SECONDS = 2.0
+
+    # -----------------------------------------------------------------------
+    # ReDoS-safe patterns: no nested quantifiers, no unbounded alternations.
+    # Each pattern is designed for linear-time matching.
+    # -----------------------------------------------------------------------
+    BUILTIN_PATTERNS: list[re.Pattern[str]] = [  # noqa: RUF012
+        # SSH Private Keys — bounded by clear delimiters, lazy inner match
+        re.compile(
+            r"-----BEGIN [A-Z0-9 ]+ PRIVATE KEY-----"
+            r"[\s\S]+?"
+            r"-----END [A-Z0-9 ]+ PRIVATE KEY-----"
+        ),
+        # API Key assignments — simplified: key_name followed by separator then token value
+        # Fixed: removed nested quantifier from original pattern.
+        # Original had \s*[:=\s]\s* which allowed catastrophic backtracking.
+        re.compile(
+            r"(?i)(?:api[_-]?key|secret(?:[_-]?key)?|client[_-]?secret|password|"
+            r"private[_-]?key|access[_-]?token|auth[_-]?token|bearer|internal[_-]?prompt)"
+            r"\s{0,4}[:=]\s{0,4}"
+            r"['\"]?"
+            r"([a-zA-Z0-9_%\\\-\.=]{8,512})"
+            r"['\"]?"
+        ),
+        re.compile(
+            r"(?i)\b(?:pulse[_-])?(?:audit[_-])?"
+            r"(?:release[_-])?"
+            r"(?:secret|api[_-]?key|internal[_-]?(?:prompt|trace))[a-z0-9_%_\\-]{6,256}\b"
+        ),
+        # Google API Keys — fixed-length prefix, bounded suffix
+        re.compile(r"AIzaSy[A-Za-z0-9_\-]{33}"),
+        # OpenAI / Anthropic / Groq / DeepSeek Keys — bounded length
+        re.compile(r"sk-[A-Za-z0-9_-]{20,128}"),
+        # Graphene keys — bounded length
+        re.compile(r"graphene-[A-Za-z0-9_-]{8,128}"),
+        # GitHub Personal Access Tokens — fixed structure
+        re.compile(r"gh[pousr]_[A-Za-z0-9]{36}"),
+        # Slack Tokens — bounded
+        re.compile(r"xox[baprs]-[A-Za-z0-9_-]{10,128}"),
+        # JWT Tokens — three dot-separated base64url segments, bounded
+        re.compile(r"eyJ[A-Za-z0-9_-]{10,512}\.eyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,512}"),
+        # AWS Access Key IDs — fixed-length structure
+        re.compile(r"(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"),
+    ]
+
+    def __init__(self, secrets: list[str] | None = None) -> None:
+        self._exact_secrets: set[str] = set()
+        if secrets:
+            for s in secrets:
+                self.add_secret(s)
+
+    def add_secret(self, secret: str) -> None:
+        """Register an exact sensitive string to redact."""
+        cleaned = secret.strip()
+        if len(cleaned) >= 4:  # Avoid redacting tiny trivial strings like "yes", "true", "x"
+            self._exact_secrets.add(cleaned)
+
+    def redact(self, text: str) -> str:
+        """Scrub all registered secret values and regex patterns from text.
+
+        Security guarantees:
+            - Exact secrets are replaced via str.replace (O(n), no regex).
+            - Each regex pattern is bounded-length and ReDoS-safe.
+            - Total redaction is guarded by a thread-based timeout.
+        """
+        if not text:
+            return text
+
+        # Use a thread-based timeout to guard against any unforeseen backtracking
+        result_container: list[str] = []
+        error_container: list[Exception] = []
+
+        def _do_redact() -> None:
+            try:
+                result_container.append(self._redact_impl(text))
+            # Intentionally broad to isolate execution boundaries and prevent crashes.
+            except Exception as exc:  # noqa: BLE001
+                error_container.append(exc)
+
+        worker = threading.Thread(target=_do_redact, daemon=True)
+        worker.start()
+        worker.join(timeout=self._REDACT_TIMEOUT_SECONDS)
+
+        if worker.is_alive():
+            # Timeout — return generic redaction marker rather than plaintext (fail-closed)
+            return "[REDACTED_DUE_TO_TIMEOUT: redaction exceeded time limit]"
+
+        if error_container:
+            # Unexpected error — return text with error marker
+            return "[REDACTION_FAILED]"
+
+        return result_container[0] if result_container else text
+
+    def contains_explicit_secret(self, text: str) -> bool:
+        """Check if the text contains any of the explicitly registered secrets.
+        
+        This only checks for the exact secret strings provided during authorization,
+        preventing false positives that might occur with generic regex patterns.
+        """
+        if not text or not self._exact_secrets:
+            return False
+            
+        for secret in self._exact_secrets:
+            if secret in text:
+                return True
+        return False
+
+    def _redact_impl(self, text: str) -> str:
+        """Internal redaction without timeout guard."""
+        scrubbed = text
+
+        # Redact exact registered values and common serialized forms. URLs and
+        # JSON strings otherwise provide trivial redaction bypasses.
+        for secret in sorted(self._exact_secrets, key=len, reverse=True):
+            variants = {
+                secret,
+                urllib.parse.quote(secret, safe=""),
+                urllib.parse.quote_plus(secret, safe=""),
+                "".join(
+                    character
+                    if character.isalnum()
+                    else f"%{ord(character):02X}"
+                    for character in secret
+                ),
+                secret.replace("\\", "\\\\").replace("\n", "\\n").replace("\r", "\\r"),
+            }
+            for variant in sorted(variants, key=len, reverse=True):
+                if variant:
+                    scrubbed = re.sub(
+                        re.escape(variant),
+                        self.REDACTED_LABEL,
+                        scrubbed,
+                        flags=re.IGNORECASE,
+                    )
+
+        # 2. Redact regex pattern matches
+        for pattern in self.BUILTIN_PATTERNS:
+            def replace_match(match: re.Match[str]) -> str:
+                # If pattern has sub-captures (e.g. key: value), replace only value part
+                if match.lastindex and match.lastindex >= 1:
+                    full = match.group(0)
+                    val = match.group(1)
+                    return full.replace(val, self.REDACTED_LABEL)
+                return self.REDACTED_LABEL
+
+            scrubbed = pattern.sub(replace_match, scrubbed)
+
+        return scrubbed