Module redaction 

Functions

config_exclude_patterns

Compile the configured exclude_patterns (#718). Invalid regexes are skipped — a broken exclude must never disable redaction.

redact_text

redact_text_if_enabled

redact_text_with_excludes

#718: redact_text with subtractive user patterns from [secret_detection].exclude_patterns — a match covered by any exclude regex is kept verbatim, so known-safe naming conventions can be carved out without disabling secret detection wholesale.

redact_with_patterns

Apply caller-supplied policy redaction patterns on top of the built-in secret rules: each regex match becomes [REDACTED:<label>]. Returns the transformed text and the number of redactions applied (for audit counts).

redaction_enabled_for_active_role