SecretMatch (services/secret_gate.py)

Provides regex-based scanning and redaction of sensitive credentials to prevent accidental exposure during data exports or memory writes.

# Source: https://github.com/awslabs/cli-agent-orchestrator | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
# Provided via justclaw.it.com; keep this notice with the code.
"""Credential pattern gate for memory writes and archive export.

Pure module — no I/O, no logging, no state. ``scan_for_secrets`` matches
the supplied content against a fixed, ordered list of named regexes and
returns the NAME of the first matching pattern (or ``None`` if clean).
``redact_secrets`` replaces every match of every pattern with a
``[REDACTED:<name>]`` marker for the export ``--redact`` path (#345, D5).
``redact_secrets_with_acceptances`` is the same cascade with a per-finding
allowlist: a match whose ``(pattern name, sha256 of the matched span)`` pair
is accepte

... (truncated -- full source via MCP)