A Byte Cap and Secret Gate Before You Send an OSS Patch to a Free Model

#!/usr/bin/env python3
'''Build a bounded, redacted context bundle for model review.'''
import argparse, hashlib, io, json, re, subprocess, sys
from pathlib import Path

PATTERNS = [
    ('private_key_block',
     re.compile(r'-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----', re.S),
     '[REDACTED_PRIVATE_KEY_BLOCK]'),
    ('assignment',
     re.compile(r'(?i)([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY)[A-Z0-9_]*[ ]*=[ ]*)(\S+)'),
     r'\1[REDACTED]'),
    ('github_token', re.compile(r'gh[pousr]_[A-Za-z0-9]{20,}'), '[REDACTED_GITHUB_TOKEN]'),
    ('api_key', re.compile(r'sk-[A-Za-z0-9_-]{16,}'), '[REDACTED_API_KEY]'),
    ('aws_key', re.compile(r'AKIA[0-9A-Z]{16}'), '[REDACTED_AWS_KEY]'),
]
LEFTOVER = [
    re.compile(r'gh[pousr]_[A-Za-z0-9]{20,}'),
    re.compile(r'sk-[A-Za-z0-9_-]{16,}'),
    re.compile(r'AKIA[0-9A-Z]{16}'),
    re.compile(r'-----BEGIN [A-Z ]*PRIVATE KEY-----'),
]

def run(cmd):
    return subprocess.run(cmd, text=True, capture_output=True, check=False).stdout

def main():
    p = argparse.ArgumentParser()
    p.add_argument('repo')
    p.add_argument('out')
    p.add_argument('max_bytes', type=int)
    p.add_argument('test_log')
    a = p.parse_args()
    if a.max_bytes < 1024:
        sys.exit('max_bytes must be at least 1024')

    log = Path(a.test_log).read_text(errors='replace')
    buf = io.StringIO()
    print('## Repo state', file=buf)
    print('', file=buf)
    print('```

', file=buf)
    print(run(['git', '-C', a.repo, 'status', '--porcelain=v1']), file=buf)
    print('

```', file=buf)
    print('', file=buf)
    print('## Diff', file=buf)
    print('', file=buf)
    print('```

diff', file=buf)
    print(run(['git', '-C', a.repo, 'diff', '--unified=3', '--no-color']), file=buf)
    print('

```', file=buf)
    print('', file=buf)
    print('## Test log tail', file=buf)
    print('', file=buf)
    print('```

', file=buf)
    print(chr(10).join(log.splitlines()[-400:]), file=buf)
    print('

```', file=buf)

    text = buf.getvalue()
    counts = {}
    for name, pat, repl in PATTERNS:
        text, n = pat.subn(repl, text)
        if n:
            counts[name] = n

    for pat in LEFTOVER:
        if pat.search(text):
            print('secret gate failed: unredacted pattern remains', file=sys.stderr)
            sys.exit(3)

    data = text.encode('utf-8')[:a.max_bytes]
    Path(a.out).write_text(data.decode('utf-8', errors='ignore'))
    manifest = {
        'bytes': len(data),
        'sha256': hashlib.sha256(data).hexdigest(),
        'redactions': counts,
        'commit': run(['git', '-C', a.repo, 'rev-parse', '--short', 'HEAD']).strip(),
    }
    Path(str(a.out) + '.manifest.json').write_text(json.dumps(manifest, indent=2))
    print(json.dumps(manifest), file=sys.stderr)

if __name__ == '__main__':
    main()

python3 ctxpack.py . /tmp/oss-bundle.md 12000 /tmp/failing-test.log

set -eu
work=$(mktemp -d)
git -C "$work" init -q
printf 'x\n' > "$work/a.txt"
git -C "$work" add a.txt
git -C "$work" -c user.email=a@b -c user.name=t commit -qm init

fake="ghp_$(printf 'a%.0s' $(seq 1 36))"
printf 'token=%s\n' "$fake" > "$work/test.log"
python3 ctxpack.py "$work" "$work/out.md" 20000 "$work/test.log"
grep -q 'token=\[REDACTED\]' "$work/out.md"
if grep -q "$fake" "$work/out.md"; then echo 'leak'; exit 1; fi

printf -- '-----BEGIN RSA PRIVATE KEY-----\nMIIE\n' > "$work/bad.log"
set +e
python3 ctxpack.py "$work" "$work/bad.md" 20000 "$work/bad.log"
code=$?
set -e
test "$code" -eq 3

awk 'BEGIN { for (i=0; i<200000; i++) print "frame " i ": assertion failed" }' > "$work/big.log"
python3 ctxpack.py "$work" "$work/big.md" 8000 "$work/big.log"
test "$(wc -c < "$work/big.md")" -le 8000

You are reviewing a patch, not writing one.
The bundle is complete for this task. Do not assume missing files.
Return exactly three sections:
1. Three failure modes that the tests do not cover.
2. One test per failure mode.
3. One question a maintainer will ask before merging.
Do not claim the patch is correct.