fix: redact secrets from HTML report command output

[oboehmer]

Description

Redact credentials, SNMP community strings, pre-shared keys, and similar sensitive data from command/API output before it is persisted to JSONL and rendered into HTML reports.

add_command_api_execution in collector.py is the single chokepoint where all output (SSH commands and API responses) passes before hitting disk. A new sanitize module applies regex-based redaction rules, with CLI and JSON rulesets kept separate and selected via a content heuristic (output starting with { or [ → JSON rules, otherwise CLI rules).

Closes

• Fixes [bug] HTML report leaks secrets from cached command output #881

Related Issue(s)

• feat(broker): support Genie-driven command execution in broker mode #863 (Genie-driven supplementary calls that introduced show running-config | section tracking)

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Test Framework Affected

• PyATS
• Robot Framework
• Both
• N/A (not test-framework specific)

Network as Code (NaC) Architecture Affected

• All architectures

Platform Tested

• macOS (version tested: darwin)

Key Changes

• New module nac_test/pyats_core/reporting/sanitize.py with separate _CLI_RULES (6 patterns) and _JSON_RULES (1 pattern)
• Content heuristic _looks_like_json() selects the appropriate ruleset, preventing cross-contamination (e.g. CLI description "community center" is not falsely redacted)
• Integration in collector.py:add_command_api_execution — sanitization runs after 50KB truncation, before JSONL write
• Covers both SSH command output and API response bodies through the same chokepoint

CLI patterns redacted

• password/secret/key/key-string/server-key/pac key <type> <value>
• domain-password <value>
• snmp-server community <value>
• snmp-server host ... priv <value>
• set-key ascii/hex <value> (WLAN PSK)
• attribute type password <value> (AAA/RADIUS)

JSON patterns redacted

• Fields matching password, secret, community, presharedKey, sharedSecret, psk, authKey, enableSecret, enablePassword, snmpAuthPassword, snmpPrivPassword, etc.

Testing Done

• Unit tests added/updated
• All existing tests pass (pytest / pre-commit run -a)

Test Commands Used

pytest tests/unit/core/test_sanitize.py -v   # 26 passed
pre-commit run --files nac_test/pyats_core/reporting/sanitize.py nac_test/pyats_core/reporting/collector.py tests/unit/core/test_sanitize.py  # all passed

Checklist

• Code follows project style guidelines (pre-commit run -a passes)
• Self-review of code completed
• Code is commented where necessary (especially complex logic)
• No new warnings introduced
• Changes work on both macOS and Linux