nanobot/agent/visibility.py

@@ -50,7 +50,7 @@ def verify_signature(marked_content: str) -> Tuple[bool, str]:
         hashlib.sha256
     ).hexdigest()[:8]
 
-    is_valid = (claimed_sig == expected_sig)
+    is_valid = hmac.compare_digest(claimed_sig, expected_sig)
     return is_valid, content
 
 
@@ -80,4 +80,4 @@ def strip_all_hidden_markers(content: str) -> str:
     Returns:
         Content with all markers stripped
     """
-    return re.sub(r'\[HIDDEN:[a-f0-9]{8}\] ', '', content)
+    return re.sub(r'\[HIDDEN:[a-f0-9]{8}\]\s*', '', content)