From 14a5ee87fe53e8b9aeaa2589d7e566d9043f36b0 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Tue, 26 May 2026 22:34:59 -0500 Subject: [PATCH] [core] Delegate non-redact path in represent_sensitive Hand off to represent_stringify for the !secret + plain-str branches instead of duplicating the is_secret check and scalar emission. --- esphome/yaml_util.py | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/esphome/yaml_util.py b/esphome/yaml_util.py index 2f3d25b4fc..bfe1fb0136 100644 --- a/esphome/yaml_util.py +++ b/esphome/yaml_util.py @@ -1014,21 +1014,18 @@ class ESPHomeDumper(yaml.SafeDumper): return self.represent_scalar(tag="tag:yaml.org,2002:str", value=str(value)) def represent_sensitive(self, value: SensitiveStr) -> yaml.ScalarNode: - # ``!secret`` references win: keep the original representation so the - # dumped YAML round-trips back to ``!secret name`` instead of leaking - # the resolved value. - if is_secret(value): - return self.represent_secret(value) - if self._redact_sensitive: - # Emit the conceal sequence as literal ``\033`` text (not actual - # ESC bytes) so the dump matches the previous regex-based output - # and downstream consumers like device-builder, which match - # ``\033[8m...\033[28m`` against the rendered text, keep working. + # Only the redact-and-not-a-secret branch is unique to sensitive + # values; otherwise let ``represent_stringify`` handle ``!secret`` + # precedence and the plain-str fallthrough. Conceal sequence is + # emitted as literal ``\033`` text (not actual ESC bytes) so the + # output matches the prior regex format and device-builder's + # ``\033[8m...\033[28m`` parser keeps working. + if self._redact_sensitive and not is_secret(value): return self.represent_scalar( tag="tag:yaml.org,2002:str", value=f"\\033[8m{value}\\033[28m", ) - return self.represent_scalar(tag="tag:yaml.org,2002:str", value=str(value)) + return self.represent_stringify(value) # pylint: disable=arguments-renamed def represent_bool(self, value):