Technician tool v0.1

Imported from the Google Drive folder 004-technician_tool/v0.1.

kota_tech/core/redact.py

@@ -0,0 +1,37 @@
+"""Secret redaction for anything shown on screen or written to disk.
+
+Firmware prints the OTA token in clear text (ota_client.cpp:
+"OTA token loaded from NVS: %s", "received token: %s") and env.txt
+values may be echoed. Influx tokens are ~88-char base64 strings.
+Redaction is applied before a line leaves the serial layer.
+"""
+
+from __future__ import annotations
+
+import re
+
+MASK = "<REDACTED>"
+
+_RULES: list[re.Pattern[str]] = [
+    # "... token loaded from NVS: X", "... received token: X", "token: X"
+    re.compile(r"(?i)(\btoken\b[^:=\n]{0,40}[:=]\s*)(\S+)"),
+    # HTTP auth header echo: "Authorization: Token X" / "Token X"
+    re.compile(r"(\bToken\s+)([A-Za-z0-9_\-+/=]{16,})"),
+    # env-style secrets: INFLUX_TOKEN=..., PASSWORD=...
+    re.compile(r"(?i)(\b(?:INFLUX_TOKEN|PASSWORD|PASS|SECRET|API_KEY)\s*=\s*)(\S+)"),
+]
+# Bare long base64/url-safe blobs (Influx tokens end in "==").
+_BLOB = re.compile(r"(?<![A-Za-z0-9_\-+/])[A-Za-z0-9_\-+/]{40,}={0,2}(?![A-Za-z0-9_\-+/=])")
+# Pure hex runs (MACs, addresses, hashes) are not secrets.
+_BLOB_ALLOW = re.compile(r"^[0-9A-Fa-f]+$")
+
+
+def redact(text: str) -> str:
+    for rule in _RULES:
+        text = rule.sub(lambda m: m.group(1) + MASK, text)
+
+    def _blob(m: re.Match[str]) -> str:
+        s = m.group(0)
+        return s if _BLOB_ALLOW.search(s) else MASK
+
+    return _BLOB.sub(_blob, text)