fix(agent/redact): preserve lowercase Python variable assignments from redaction

[InB4DevOps]

Fix: Preserve lowercase Python variable assignments from redaction

Problem

The redaction regex in agent/redact.py incorrectly redacted values of lowercase Python variable assignments, treating them as environment variables containing secrets.

Before:

before_tokens = self._estimate_current_context_tokens()

Was incorrectly transformed to:

before_tokens = ***

Root Cause

The _ENV_ASSIGN_RE regex used the re.IGNORECASE flag, which caused it to match lowercase Python variable names (like before_tokens, api_key, my_token) in addition to uppercase environment variables (like API_KEY, OPENAI_API_KEY).

Solution

1. Removed re.IGNORECASE flag — now only ALL-uppercase environment variables match
2. Added (?:(?:^|\s)) anchor — ensures match starts at beginning of string or after whitespace
3. Added regression test — test_lowercase_python_vars_not_redacted with 3 test cases

Changes

agent/redact.py

• Added comment documenting the ALL-uppercase requirement (line 54)
• Changed regex pattern to anchor at start/whitespace
• Removed re.IGNORECASE flag

tests/agent/test_redact.py

• Added test_lowercase_python_vars_not_redacted method
• Tests 3 cases: before_tokens, my_token, api_key

Testing

All 39 tests pass:

python3 -m pytest tests/agent/test_redact.py -v
# 39 passed, 5 warnings in 0.35s

Verification

Before fix:

"before_tokens = self._estimate_current_context_tokens()" → "before_tokens = ***"

After fix:

"before_tokens = self._estimate_current_context_tokens()" → "before_tokens = self._estimate_current_context_tokens()"

---

Closes: #4367