Module secrets 

Canonical secret-token and path prefixes shared by redaction layers across crates.

zeph-core::redact and zeph-memory::store::compression_guidelines both scrub secrets and filesystem paths before persisting or displaying untrusted text. Each crate previously carried its own hand-rolled copy of these lists, and the copies had already begun to drift from each other (see #5917). This module is the single source of truth for the raw prefixes/patterns; consumers compile their own regex::Regex instances from these constants — zeph-common does not depend on regex outside of tests, matching the pattern established by crate::patterns.

Constants

AWS_SECRET_KEY_PATTERN

Regex pattern matching a raw AWS secret access key or session token immediately preceded by a recognizable marker and its assignment separator (see #6592).

BEARER_TOKEN_PATTERN

Regex pattern matching Authorization: Bearer <token> headers.

JWT_PATTERN

Regex pattern matching standalone JWTs (three Base64url-encoded segments separated by dots).

PATH_PREFIXES

Absolute filesystem path prefixes redacted before persisting or displaying untrusted text, to avoid leaking local usernames or directory layout.

PEM_BODY_CAP

Cap, in characters, on the PEM/SSH2 body matched by PEM_PRIVATE_KEY_PATTERN and PEM_PRIVATE_KEY_UNTERMINATED_PATTERN. Kept as a named constant so the value referenced in both patterns’ doc comments (and in zeph_subagent::forward’s streaming holdback cap, which must buffer at least this many bytes past an unclosed header before force-flushing) stays traceable to one definition, even though the patterns themselves are plain &str literals (regex patterns can’t be built from a const usize via string formatting at const-eval time without an extra dependency, so the literal 8192 is duplicated in both pattern strings — keep it in sync with this constant if it ever changes).

PEM_PRIVATE_KEY_PATTERN

Regex pattern matching a full, properly-closed PEM/SSH2 private-key block, from the -----BEGIN ... PRIVATE KEY------style header through the matching footer, inclusive of the body between them (see #6592).

PEM_PRIVATE_KEY_UNTERMINATED_PATTERN

Fallback regex matching a PEM/SSH2 private-key header with no matching footer found within PEM_BODY_CAP characters — a header that is truncated, adversarially left unterminated, or whose footer chunk was dropped by a bounded ingress channel (see #6592 follow-up).

SECRET_PREFIXES

Prefixes of API keys, tokens, and other secret material recognized across Zeph.