@agent-beam/beam 0.2.38 → 0.2.39

package/dist/credential-egress.js

@@ -0,0 +1,325 @@
+// A bounded, dependency-free shell heuristic, shared by the CLI and edge SDK.
+// Unlike a whole-text keyword conjunction, only transfer arguments / connected
+// stdin are sinks. This is not a general shell or JavaScript taint analyzer.
+const SENSITIVE = /(?:\.env(?:\b|[./])|\.ssh[\\/]|id_(?:rsa|ed25519)|\.aws[\\/]credentials|\.pgpass\b|\.docker[\\/]config\.json|credentials\.json|\b(?:printenv|process\.env|os\.environ)\b|(?:api[_-]?key|access[_-]?token|password|secret)\b|\$\{?[\w]*(?:TOKEN|SECRET|PASSWORD|API_KEY|CREDENTIAL)[\w]*\}?)/i;
+// Preserve quoted arguments as one token. Separators inside quotes cannot join
+// unrelated fixtures into a command. Keep raw quotes for recursive shell -c.
+function commands(text) {
+    const out = [];
+    let tokens = [];
+    let value = "", raw = "", quote = "", tokenStart = 0;
+    const word = () => { if (raw)
+        tokens.push({ value, raw, start: tokenStart, end: tokenStart + raw.length }); value = raw = ""; };
+    const end = (pipe) => { word(); if (tokens.length)
+        out.push({ tokens, pipe, start: tokens[0].start, end: tokens[tokens.length - 1].end }); tokens = []; };
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (!raw && !/\s/.test(c))
+            tokenStart = i;
+        if (!quote && c === "$" && text[i + 1] === "(") {
+            let level = 1;
+            const start = i;
+            i++;
+            while (++i < text.length && level) {
+                if (text[i] === "(")
+                    level++;
+                else if (text[i] === ")")
+                    level--;
+            }
+            const substitution = text.slice(start, i);
+            raw += substitution;
+            value += substitution;
+            i--;
+        }
+        else if (c === "\\" && quote !== "'") {
+            raw += c;
+            if (i + 1 < text.length) {
+                raw += text[++i];
+                if (text[i] !== "\n")
+                    value += text[i];
+            }
+        }
+        else if (quote) {
+            raw += c;
+            if (c === quote)
+                quote = "";
+            else
+                value += c;
+        }
+        else if (c === "'" || c === '"') {
+            quote = c;
+            raw += c;
+        }
+        else if (c === "#" && !raw) {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+            end(false);
+        }
+        else if (c === ";" || c === "\n" || c === "|" || c === "&") {
+            const pipe = c === "|" && text[i + 1] !== "|";
+            end(pipe);
+            if (text[i + 1] === c && (c === "|" || c === "&"))
+                i++;
+        }
+        else if (/\s/.test(c))
+            word();
+        else {
+            raw += c;
+            value += c;
+        }
+    }
+    end(false);
+    return out;
+}
+function executable(tokens) {
+    let i = 0;
+    while (i < tokens.length && (/^[\w]+=[\s\S]*/.test(tokens[i].value) || /^(?:sudo|command|exec)$/.test(tokens[i].value) || tokens[i].value === "env" && i + 1 < tokens.length))
+        i++;
+    return i;
+}
+function name(token) { return token?.value.split(/[\\/]/).pop()?.toLowerCase() ?? ""; }
+// Shell substitutions execute even inside double quotes (but not single quotes).
+function expansionExposure(text, depth) {
+    let quote = "";
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === "\\" && quote !== "'") {
+            i++;
+            continue;
+        }
+        if (c === "'" && quote !== '"') {
+            quote = quote ? "" : "'";
+            continue;
+        }
+        if (quote === "'")
+            continue;
+        if (c === '"') {
+            quote = quote ? "" : '"';
+            continue;
+        }
+        if (c === "$" && text[i + 1] === "(") {
+            const start = i + 2;
+            let level = 1;
+            i++;
+            while (++i < text.length && level) {
+                if (text[i] === "(")
+                    level++;
+                else if (text[i] === ")")
+                    level--;
+            }
+            if (shellExposure(text.slice(start, level ? i : i - 1), depth + 1))
+                return true;
+            i--;
+        }
+        else if (c === "`") {
+            const start = ++i;
+            while (i < text.length && text[i] !== "`") {
+                if (text[i] === "\\")
+                    i++;
+                i++;
+            }
+            if (shellExposure(text.slice(start, i), depth + 1))
+                return true;
+        }
+    }
+    return false;
+}
+function shellExposure(text, depth) {
+    if (depth > 4)
+        return false;
+    // Here-doc bodies are data to their recipient. Examine shell recipients as
+    // code; for files, examine the body only if that path is subsequently run.
+    const lines = text.split("\n");
+    const visible = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const doc = /<<(-)?\s*(?:'([^']+)'|"([^"]+)"|([\w]+))/.exec(line);
+        if (!doc) {
+            visible.push(line);
+            continue;
+        }
+        // Ignore heredoc-looking text inside quoted fixture strings and comments.
+        let quote = "";
+        for (let j = 0; j < doc.index; j++) {
+            const c = line[j];
+            if (c === "\\" && quote !== "'") {
+                j++;
+                continue;
+            }
+            if (quote) {
+                if (c === quote)
+                    quote = "";
+            }
+            else if (c === "'" || c === '"')
+                quote = c;
+            else if (c === "#") {
+                quote = "#";
+                break;
+            }
+        }
+        if (quote) {
+            visible.push(line);
+            continue;
+        }
+        const delimiter = doc[2] ?? doc[3] ?? doc[4];
+        const body = [];
+        while (++i < lines.length && (doc[1] ? lines[i].replace(/^\t+/, "") : lines[i]) !== delimiter)
+            body.push(lines[i]);
+        const head = commands(line)[0]?.tokens ?? [];
+        const recipient = name(head[executable(head)]);
+        const file = />\s*([^\s<>]+)/.exec(line)?.[1];
+        const later = lines.slice(i + 1).join("\n");
+        const runsFile = file && commands(later).some(c => {
+            const at = executable(c.tokens);
+            const cmd = name(c.tokens[at]);
+            return c.tokens[at]?.value === file || /^(?:bun|node|tsx|python[23]?|sh|bash|zsh)$/.test(cmd) && c.tokens.slice(at + 1).some(t => t.value === file);
+        });
+        if ((/^(?:sh|bash|zsh)$/.test(recipient) || /\|\s*(?:sh|bash|zsh)\b/.test(line) || runsFile) && shellExposure(body.join("\n"), depth + 1))
+            return true;
+        // A here-doc sent to curl is itself an outbound payload.
+        if (/^(?:nc|ncat|socat)$/.test(recipient) && SENSITIVE.test(body.join("\n")))
+            return true;
+        if (/^(?:curl|wget)$/.test(recipient) && /(?:@-|--post-file[= ]-)/.test(line) && SENSITIVE.test(body.join("\n")))
+            return true;
+        if (doc[4] && expansionExposure(body.join("\n"), depth))
+            return true;
+        visible.push(line.replace(doc[0], ""));
+    }
+    let sensitiveStdin = false;
+    const sensitiveVariables = new Set();
+    const sensitive = (value) => SENSITIVE.test(value) || [...value.matchAll(/\$\{?([A-Za-z_]\w*)/g)].some(m => sensitiveVariables.has(m[1]));
+    for (const command of commands(visible.join("\n"))) {
+        const { tokens, pipe } = command;
+        const at = executable(tokens);
+        const cmd = name(tokens[at]);
+        for (const token of tokens) {
+            const assignment = /^([A-Za-z_]\w*)=([\s\S]*)$/.exec(token.value);
+            if (!assignment)
+                break;
+            if (sensitive(assignment[2]))
+                sensitiveVariables.add(assignment[1]);
+            else
+                sensitiveVariables.delete(assignment[1]);
+        }
+        if (/^(?:echo|printf|cat|curl|wget|scp|rsync|nc|ncat|socat|env|sh|bash|zsh)$/.test(cmd) || tokens.some(t => /^[A-Za-z_]\w*=/.test(t.value))) {
+            if (expansionExposure(tokens.map(t => t.raw).join(" "), depth))
+                return true;
+        }
+        const args = tokens.slice(at + 1).map(t => t.value);
+        const joined = args.join(" ");
+        // Inspect explicitly executed shell strings, never arbitrary string args to
+        // echo, grep, console.log, detect, etc.
+        if (/^(?:sh|bash|zsh)$/.test(cmd)) {
+            const flag = args.findIndex(a => /^-[a-z]*c[a-z]*$/.test(a));
+            if (flag >= 0 && shellExposure(args[flag + 1] ?? "", depth + 1))
+                return true;
+        }
+        const transfer = /^(?:curl|wget|scp|rsync|nc|ncat|socat)$/.test(cmd);
+        if (transfer) {
+            if (sensitiveStdin && /^(?:nc|ncat|socat)$/.test(cmd))
+                return true;
+            if (/^(?:scp|rsync)$/.test(cmd) && /^[^/\s]+:[\s\S]+/.test(args[args.length - 1] ?? "") && args.slice(0, -1).some(a => sensitive(a)))
+                return true;
+            for (let i = 0; i < args.length; i++) {
+                const arg = args[i];
+                // A URL path mentioning 'secret' is not a secret payload. Query values
+                // and userinfo can carry credentials; payload/header/file options can too.
+                if (/^https?:\/\//i.test(arg) && ((/[?&](?:api[_-]?key|token|password|secret)=/i.test(arg)) || /^https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(arg) || /[?&][^=]+=\$/.test(arg) && sensitive(arg)))
+                    return true;
+                const compact = /^-(?:d|F|H|u|T)(.+)$/.exec(arg);
+                if (compact && sensitive(compact[1]))
+                    return true;
+                if (/^(?:-d|-F|-H|-u|-T|--json|--data(?:-raw|-binary|-urlencode)?|--form|--header|--user|--upload-file|--post-data|--post-file)(?:=|$)/.test(arg)) {
+                    const payload = arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : args[++i] ?? "";
+                    if (sensitive(payload))
+                        return true;
+                    if (sensitiveStdin && /(?:@-|\/dev\/stdin|\/proc\/self\/fd\/0)/.test(payload))
+                        return true;
+                }
+                if (/^<(?:\s*)/.test(arg) && sensitive(arg + (args[i + 1] ?? "")))
+                    return true;
+            }
+        }
+        const readsSensitive = /^(?:cat|printenv|env|echo|printf|head|tail|sed|awk|base64)$/.test(cmd) && (sensitive(joined) || /^(?:printenv|env)$/.test(cmd));
+        const propagates = /^(?:cat|base64|gzip|tee|sed|awk|tr|head|tail)$/.test(cmd);
+        sensitiveStdin = pipe && (readsSensitive || sensitiveStdin && propagates);
+    }
+    return false;
+}
+export function possibleCredentialExposure(text) {
+    if (shellExposure(text, 0))
+        return true;
+    // Skills are natural-language instructions, not just shell programs. Require
+    // an explicit sensitive read followed by a referring delivery instruction.
+    // Do not correlate arbitrary prose, URLs, code strings or separate fixtures.
+    return /(?:^|\n)\s*(?:read|collect|extract)\b[^\n]{0,200}(?:\.env\b|\bAPI_KEY\b|\bcredentials?\b)[^\n]*\n\s*(?:send|upload|exfiltrate)\s+(?:it|them|the\s+(?:credentials?|contents?|secrets?))\b[^\n]{0,200}https?:\/\//i.test(text);
+}
+/** Locate only original executable command/pipeline ranges independently
+ * accepted by the detector. Do not scan inert heredoc bodies as commands. */
+function heredocDataRanges(text) {
+    const hidden = [];
+    const lines = text.split("\n");
+    let offset = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const doc = /<<(-)?\s*(?:'([^']+)'|"([^"]+)"|([\w]+))/.exec(line);
+        let quote = "";
+        if (doc)
+            for (let j = 0; j < doc.index; j++) {
+                const c = line[j];
+                if (c === "\\" && quote !== "'") {
+                    j++;
+                    continue;
+                }
+                if (quote) {
+                    if (c === quote)
+                        quote = "";
+                }
+                else if (c === "'" || c === '"')
+                    quote = c;
+                else if (c === "#") {
+                    quote = "#";
+                    break;
+                }
+            }
+        offset += line.length + 1;
+        if (!doc || quote)
+            continue;
+        const start = offset;
+        const delimiter = doc[2] ?? doc[3] ?? doc[4];
+        while (++i < lines.length) {
+            offset += lines[i].length + 1;
+            if ((doc[1] ? lines[i].replace(/^\t+/, "") : lines[i]) === delimiter)
+                break;
+        }
+        hidden.push({ start, end: offset });
+    }
+    return hidden;
+}
+export function shellActionCommands(text) {
+    const hidden = heredocDataRanges(text);
+    return commands(text).filter(command => !hidden.some(range => command.start < range.end && command.end > range.start));
+}
+export function credentialExposureSpans(text) {
+    const hidden = heredocDataRanges(text);
+    const spans = [];
+    let groupStart;
+    for (const command of commands(text)) {
+        if (hidden.some(range => command.start < range.end && command.end > range.start)) {
+            groupStart = undefined;
+            continue;
+        }
+        groupStart ??= command.start;
+        const candidate = text.slice(groupStart, command.end);
+        if (possibleCredentialExposure(candidate)) {
+            spans.push({ start: groupStart, end: command.end, label: "Sensitive outbound transfer" });
+            if (spans.length === 8)
+                break;
+        }
+        const assignment = /^[A-Za-z_]\w*=/.test(command.tokens[0]?.value ?? "");
+        if (!command.pipe && !assignment)
+            groupStart = undefined;
+    }
+    return spans;
+}
+//# sourceMappingURL=credential-egress.js.map

package/dist/credential-egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-egress.js","sourceRoot":"","sources":["../src/credential-egress.ts"],"names":[],"mappings":"AACA,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,SAAS,GAAG,8RAA8R,CAAC;AAIjT,+EAA+E;AAC/E,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAc,EAAE,CAAC;IAAC,IAAI,MAAM,GAAY,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,UAAU,GAAG,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,CAAC,IAAa,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnK,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,UAAU,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YACvG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAC,GAAG,IAAI,YAAY,CAAC;YAAC,KAAK,IAAI,YAAY,CAAC;YAAC,CAAC,EAAE,CAAC;QAC7F,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACvC,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACxF,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,GAAG,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,EAAE,CAAC;;gBAAM,KAAK,IAAI,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,CAAC,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC;aACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;aACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;QACpE,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,EAAE,CAAC;aAC3B,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC;QAAC,CAAC;IAChC,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,OAAO,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QAAE,CAAC,EAAE,CAAC;IACnL,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,IAAI,CAAC,KAAa,IAAY,OAAO,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAEvG,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAAC,SAAS;QAAC,CAAC;QACvE,IAAI,KAAK,KAAK,GAAG;YAAE,SAAS;QAC5B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAAC,SAAS;QAAC,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YACvG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChF,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YAC9E,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3C,0EAA0E;QAC1E,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,KAAK;oBAAE,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC;iBACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,GAAG,CAAC,CAAC;iBACtC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,GAAG,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,GAAa,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAChD,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,KAAK,IAAI,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QACtJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvJ,yDAAyD;QACzD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9H,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClJ,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAAC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU;gBAAE,MAAM;YACvB,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;;gBAC/D,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,yEAAyE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5I,IAAI,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,4EAA4E;QAC5E,wCAAwC;QACxC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,IAAI,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,cAAc,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,uEAAuE;gBACvE,2EAA2E;gBAC3E,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACvM,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjD,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClD,IAAI,mIAAmI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClJ,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACtF,IAAI,SAAS,CAAC,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACpC,IAAI,cAAc,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC7F,CAAC;gBACD,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjF,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,6DAA6D,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxJ,MAAM,UAAU,GAAG,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,cAAc,GAAG,IAAI,IAAI,CAAC,cAAc,IAAI,cAAc,IAAI,UAAU,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,kNAAkN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvO,CAAC;AAED;6EAC6E;AAC7E,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAgC,EAAE,CAAC;IAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,CAAC;IAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,GAAG,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,GAAG;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,CAAC,GAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAG,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAC,CAAC;oBAAA,CAAC,EAAE,CAAC;oBAAA,SAAS;gBAAA,CAAC;gBAC/D,IAAG,KAAK,EAAC,CAAC;oBAAA,IAAG,CAAC,KAAG,KAAK;wBAAC,KAAK,GAAC,EAAE,CAAC;gBAAA,CAAC;qBAAM,IAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;oBAAC,KAAK,GAAC,CAAC,CAAC;qBAAM,IAAG,CAAC,KAAG,GAAG,EAAC,CAAC;oBAAA,KAAK,GAAC,GAAG,CAAC;oBAAA,MAAM;gBAAA,CAAC;YAC9G,CAAC;QACD,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,KAAK;YAAE,SAAS;QAC5B,MAAM,KAAK,GAAC,MAAM,CAAC;QAAC,MAAM,SAAS,GAAC,GAAG,CAAC,CAAC,CAAC,IAAE,GAAG,CAAC,CAAC,CAAC,IAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAC,IAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAC,EAAE,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,CAAC,CAAC,CAAC,KAAG,SAAS;gBAAE,MAAM;QAAC,CAAC;QAClI,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACzH,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAAC,IAAI,UAA8B,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,UAAU,GAAC,SAAS,CAAC;YAAC,SAAS;QAAC,CAAC;QACrH,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC;QAC7B,MAAM,SAAS,GAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,0BAA0B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,UAAU,EAAC,GAAG,EAAC,OAAO,CAAC,GAAG,EAAC,KAAK,EAAC,6BAA6B,EAAC,CAAC,CAAC;YACnF,IAAG,KAAK,CAAC,MAAM,KAAG,CAAC;gBAAC,MAAM;QAC5B,CAAC;QACD,MAAM,UAAU,GAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAE,EAAE,CAAC,CAAC;QACrE,IAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU;YAAC,UAAU,GAAC,SAAS,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/custom-rules.js

@@ -1,3 +1,4 @@
+import { patternMatch } from "./rule-matches.js";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { getBeamHome } from "./config.js";
@@ -71,7 +72,7 @@ export async function loadCustomRules(home = getBeamHome()) {
             severity: e.severity,
             category: (typeof e.category === "string" && e.category ? e.category : "custom"),
             explanation: typeof e.explanation === "string" && e.explanation ? e.explanation : "User-defined rule.",
-            match: (s) => regex.test(s),
+            match: patternMatch(regex),
         });
     });
     setCustomRules(rules);

package/dist/custom-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-rules.js","sourceRoot":"","sources":["../src/custom-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAA+C,MAAM,WAAW,CAAC;AAIxF,MAAM,gBAAgB,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE5E,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,WAAW,EAAE,IAAY,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAElG,mFAAmF;AACnF,8FAA8F;AAC9F,iGAAiG;AACjG,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAI,GAAG,WAAW,EAAE;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC;QACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAAC,CAAC;QACnH,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IACjC,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,2CAA2C,CAAC,EAAE,CAAC;IAAC,CAAC;IAEvH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,0CAA0C,CAAC,EAAE,CAAC;IAAC,CAAC;IAE5I,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChI,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5G,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9H,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAoB,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,gCAAgC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9M,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QAC3C,OAAO,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnJ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE;YACpB,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9D,QAAQ,EAAE,CAAC,CAAC,QAAoB;YAChC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAiB;YAChG,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB;YACtG,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"custom-rules.js","sourceRoot":"","sources":["../src/custom-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAA+C,MAAM,WAAW,CAAC;AAIxF,MAAM,gBAAgB,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE5E,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,WAAW,EAAE,IAAY,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAElG,mFAAmF;AACnF,8FAA8F;AAC9F,iGAAiG;AACjG,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAI,GAAG,WAAW,EAAE;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC;QACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAAC,CAAC;QACnH,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IACjC,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,2CAA2C,CAAC,EAAE,CAAC;IAAC,CAAC;IAEvH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,0CAA0C,CAAC,EAAE,CAAC;IAAC,CAAC;IAE5I,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChI,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5G,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9H,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAoB,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,gCAAgC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9M,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QAC3C,OAAO,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnJ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE;YACpB,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9D,QAAQ,EAAE,CAAC,CAAC,QAAoB;YAChC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAiB;YAChG,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB;YACtG,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/data-detectors.js

@@ -1,17 +1,58 @@
 const detectors = [
     { kind: "PRIVATE_KEY", pattern: /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, replacement: "[PRIVATE_KEY_REDACTED]" },
     { kind: "API_KEY", pattern: /\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|beam_app_[\w-]{20,})\b/g, replacement: "[API_KEY_REDACTED]" },
-    { kind: "SECRET", pattern: /((?:api[_-]?key|access[_-]?token|token|secret|authorization)\s*[:=]\s*["']?)([^\s,"';&}\]]+)/gi, replacement: "$1[SECRET_REDACTED]" },
-    { kind: "PASSWORD", pattern: /((?:password|passwd|pwd)\s*[:=]\s*["']?)([^\s,"';&}\]]+)/gi, replacement: "$1[PASSWORD_REDACTED]" },
     { kind: "EMAIL", pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, replacement: "[EMAIL_REDACTED]" },
     { kind: "PHONE", pattern: /(?<!\w)(?:\+\d{1,3}[\s.-]?)?(?:\d[\s.-]?){8,14}\d(?!\w)/g, replacement: "[PHONE_REDACTED]" },
 ];
+// SECRET/PASSWORD used to require their keyword sit immediately before "="/":", so
+// AWS_SECRET_ACCESS_KEY (keyword not adjacent -- "_ACCESS_KEY" sits between "SECRET" and "=")
+// went through un-redacted even though it's the standard AWS credential variable name. Fixed by
+// extracting any NAME=value assignment, then checking whether NAME *contains* a credential
+// keyword as a whole underscore/hyphen/camelCase-delimited segment, in any position -- so
+// "secretary_name" (the word "secret" only as a substring, not a segment) still correctly never
+// matches, while "AWS_SECRET_ACCESS_KEY", "appSecretToken", "DB-PASSWORD-HASH" all do.
+const ASSIGNMENT = /\b([A-Za-z][\w.-]*)\s*[:=]\s*["']?([^\s,"';&}\]]+)/g;
+function segments(identifier) {
+    return identifier.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_.-]+/).filter(Boolean);
+}
+const SECRET_SEGMENTS = new Set(["secret", "token", "authorization"]);
+const PASSWORD_SEGMENTS = new Set(["password", "passwd", "pwd"]);
+// "key" alone is far too common a segment to flag by itself (primary_key, sort_key,
+// partition_key are ordinary DB/infra terms, not secrets) -- only the "api"+"key" pairing counts,
+// and only when adjacent, matching the original api[_-]?key compound.
+function hasApiKeyPair(segs) {
+    return segs.some((s, i) => s === "api" && segs[i + 1] === "key");
+}
+// A value pointing at a secret manager instead of holding the secret itself: 1Password
+// (op://vault/item/field), Azure Key Vault app-setting references, HashiCorp Vault paths,
+// Infisical/Doppler references, GitHub Actions' ${{ secrets.X }}, or a generic broker-issued
+// placeholder like __CREDENTIAL_REF_123__. There is nothing to redact -- the real value never
+// left the vault -- so flagging it as an exposed secret would itself be the false positive.
+// `${{ secrets.X }}` is checked by its opening token alone: the SECRET/PASSWORD detectors' own
+// value-capture regex stops at the first whitespace, so it never sees past "${{" either way.
+const CREDENTIAL_REFERENCE = /^(?:op:\/\/|@Microsoft\.KeyVault\(|vault:|infisical:\/\/|doppler:\/\/|\$\{\{|__[A-Z][A-Z0-9_]*_REF_[\w-]+__$)/i;
+const isReference = (value) => CREDENTIAL_REFERENCE.test(value.trim());
 export function detectSensitive(text, custom = []) {
     const findings = [];
     for (const detector of detectors) {
         detector.pattern.lastIndex = 0;
-        for (const match of text.matchAll(detector.pattern))
+        for (const match of text.matchAll(detector.pattern)) {
             findings.push({ kind: detector.kind, confidence: 0.9, start: match.index ?? 0, end: (match.index ?? 0) + match[0].length, replacement: detector.replacement });
+        }
+    }
+    // SECRET/PASSWORD: redact only the captured value (group 2), not the "name=" prefix (group 1),
+    // so "AWS_SECRET_ACCESS_KEY=xxx" redacts to "AWS_SECRET_ACCESS_KEY=[SECRET_REDACTED]", not the
+    // whole assignment. A reference value there (op://, @Microsoft.KeyVault(...), ...) is skipped
+    // entirely -- it isn't a real secret.
+    ASSIGNMENT.lastIndex = 0;
+    for (const match of text.matchAll(ASSIGNMENT)) {
+        const [, name, value] = match;
+        const segs = segments(name);
+        const kind = segs.some(s => SECRET_SEGMENTS.has(s)) || hasApiKeyPair(segs) ? "SECRET" : segs.some(s => PASSWORD_SEGMENTS.has(s)) ? "PASSWORD" : null;
+        if (!kind || isReference(value ?? ""))
+            continue;
+        const start = (match.index ?? 0) + name.length + match[0].slice(name.length).indexOf(value);
+        findings.push({ kind, confidence: 0.9, start, end: start + value.length, replacement: kind === "SECRET" ? "[SECRET_REDACTED]" : "[PASSWORD_REDACTED]" });
     }
     for (const customDetector of custom) {
         try {
@@ -21,7 +62,22 @@ export function detectSensitive(text, custom = []) {
         }
         catch { /* policy validation reports malformed custom detectors */ }
     }
-    return findings.sort((a, b) => b.start - a.start);
+    // Different detectors can match overlapping or identical spans on the same value (an API-key-
+    // shaped value assigned to a field named "token" trips both the API_KEY and SECRET detectors).
+    // Applying two replacements to overlapping ranges corrupts the text (the second splice operates
+    // on offsets computed against the pre-replacement string). Kept in detector-priority order
+    // (array order above: PRIVATE_KEY/API_KEY's precise format match wins over SECRET/PASSWORD's
+    // generic keyword match), via a stable sort by start -- ties keep their original push order --
+    // then a left-to-right sweep that drops anything starting before the last kept finding's end.
+    const nonOverlapping = [];
+    let lastEnd = -1;
+    for (const finding of [...findings].sort((a, b) => a.start - b.start)) {
+        if (finding.start < lastEnd)
+            continue;
+        nonOverlapping.push(finding);
+        lastEnd = finding.end;
+    }
+    return nonOverlapping.sort((a, b) => b.start - a.start);
 }
 export function redactSensitive(text, custom = []) {
     const findings = detectSensitive(text, custom);

package/dist/data-detectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-detectors.js","sourceRoot":"","sources":["../src/data-detectors.ts"],"names":[],"mappings":"AAGA,MAAM,SAAS,GAAwE;IACrF,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,+EAA+E,EAAE,WAAW,EAAE,wBAAwB,EAAE;IACxJ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mKAAmK,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACpO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gGAAgG,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACjK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,4DAA4D,EAAE,WAAW,EAAE,uBAAuB,EAAE;IACjI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC1G,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACxH,CAAC;AAGF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAA2B,EAAE;IACzE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACtN,CAAC;IACD,KAAK,MAAM,cAAc,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9M,CAAC;QAAC,MAAM,CAAC,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAA2B,EAAE;IACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1H,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"data-detectors.js","sourceRoot":"","sources":["../src/data-detectors.ts"],"names":[],"mappings":"AAGA,MAAM,SAAS,GAAwE;IACrF,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,+EAA+E,EAAE,WAAW,EAAE,wBAAwB,EAAE;IACxJ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mKAAmK,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACpO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC1G,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACxH,CAAC;AAEF,mFAAmF;AACnF,8FAA8F;AAC9F,gGAAgG;AAChG,2FAA2F;AAC3F,0FAA0F;AAC1F,gGAAgG;AAChG,uFAAuF;AACvF,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,UAAU,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AACtE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,oFAAoF;AACpF,kGAAkG;AAClG,sEAAsE;AACtE,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,0FAA0F;AAC1F,6FAA6F;AAC7F,8FAA8F;AAC9F,4FAA4F;AAC5F,+FAA+F;AAC/F,6FAA6F;AAC7F,MAAM,oBAAoB,GAAG,gHAAgH,CAAC;AAC9I,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAG/E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAA2B,EAAE;IACzE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACjK,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,+FAA+F;IAC/F,8FAA8F;IAC9F,sCAAsC;IACtC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAK,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACrJ,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,SAAS;QAChD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAM,CAAC,CAAC;QAC/F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,KAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC5J,CAAC;IACD,KAAK,MAAM,cAAc,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9M,CAAC;QAAC,MAAM,CAAC,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,8FAA8F;IAC9F,+FAA+F;IAC/F,gGAAgG;IAChG,2FAA2F;IAC3F,6FAA6F;IAC7F,+FAA+F;IAC/F,8FAA8F;IAC9F,MAAM,cAAc,GAAkB,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,GAAG,OAAO;YAAE,SAAS;QACtC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAA2B,EAAE;IACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1H,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC"}

package/dist/destructive-risk.d.ts

@@ -0,0 +1 @@
+export declare function isScopedTemporaryCleanup(text: string, depth?: number): boolean;

package/dist/destructive-risk.js

@@ -0,0 +1,70 @@
+import { shellActionCommands } from "./credential-egress.js";
+// Deliberately lexical: an explicit, narrow test/scratch path can lower the
+// severity, but does not establish ownership or inspect symlinks on the host.
+export function isScopedTemporaryCleanup(text, depth = 0) {
+    if (depth > 4)
+        return false;
+    const commands = shellActionCommands(text);
+    if (commands.length === 1) {
+        const tokens = commands[0].tokens;
+        if (tokens.length === 3 && /(?:^|\/)(?:bash|sh|zsh)$/.test(tokens[0].value) && /^-[a-z]*c[a-z]*$/.test(tokens[1].value) && /^['"]/.test(tokens[2].raw))
+            return isScopedTemporaryCleanup(tokens[2].value, depth + 1);
+    }
+    let found = false;
+    for (const segment of text.split(/[;&|\n]/)) {
+        if (!/\brm\b/.test(segment))
+            continue;
+        // Wrappers, substitutions and unfamiliar syntax keep the default severity.
+        const command = /^(?:\/(?:usr\/)?bin\/)?rm\s+(.+)$/.exec(segment.trim());
+        if (!command)
+            return false;
+        const raw = command[1];
+        if (/[$`*?{}()[\]<>\\]/.test(raw))
+            return false;
+        const tokens = raw.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+        let recursive = false, force = false, options = true;
+        const paths = [];
+        for (const token of tokens) {
+            const value = token.replace(/^(['"])(.*)\1$/, "$2");
+            if (options && value === "--") {
+                options = false;
+                continue;
+            }
+            if (options && value.startsWith("-")) {
+                if (value === "--recursive")
+                    recursive = true;
+                else if (value === "--force")
+                    force = true;
+                else if (/^-[rfv]+$/.test(value)) {
+                    recursive ||= value.includes("r");
+                    force ||= value.includes("f");
+                }
+                else
+                    return false;
+            }
+            else
+                paths.push(value);
+        }
+        if (!paths.length || !paths.every(isTemporaryTestPath))
+            return false;
+        // Ordinary rm in a mixed cleanup must be scoped too, but this rule's trigger
+        // is still recursive + force. Never create a finding for a plain file delete.
+        found ||= recursive && force;
+    }
+    return found;
+}
+function isTemporaryTestPath(path) {
+    const match = /^\/(?:tmp|private\/tmp|var\/tmp)\/([^/]+)(?:\/([A-Za-z0-9._/-]+))?\/?$/.exec(path);
+    if (!match)
+        return false;
+    const parts = path.split("/");
+    if (parts.some(p => p === "." || p === "..") || /\/\//.test(path))
+        return false;
+    if (!/^[A-Za-z0-9._-]+$/.test(match[1]))
+        return false;
+    // A name is a confidence signal, not permission: keep an alert at MEDIUM.
+    if (!/(?:^|[-_.])(?:test|tests|tmp|temp|scratch|verify)(?:$|[-_.])/i.test(match[1]))
+        return false;
+    return !/(?:^|[/._-])(?:credentials?|secrets?|backups?|production|prod|\.env)(?:$|[/._-])/i.test(path);
+}
+//# sourceMappingURL=destructive-risk.js.map

package/dist/destructive-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive-risk.js","sourceRoot":"","sources":["../src/destructive-risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,KAAK,GAAC,CAAC;IAC5D,IAAG,KAAK,GAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IACxB,MAAM,QAAQ,GAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAG,QAAQ,CAAC,MAAM,KAAG,CAAC,EAAC,CAAC;QAAA,MAAM,MAAM,GAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACtD,IAAG,MAAM,CAAC,MAAM,KAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAC,KAAK,GAAC,CAAC,CAAC,CAAC;IAC/M,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,2EAA2E;QAC3E,MAAM,OAAO,GAAG,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,SAAS,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;QACrD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,OAAO,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7D,IAAI,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,IAAI,KAAK,KAAK,aAAa;oBAAE,SAAS,GAAG,IAAI,CAAC;qBACzC,IAAI,KAAK,KAAK,SAAS;oBAAE,KAAK,GAAG,IAAI,CAAC;qBACtC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;;oBAClG,OAAO,KAAK,CAAC;YACpB,CAAC;;gBAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,6EAA6E;QAC7E,8EAA8E;QAC9E,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,0EAA0E;IAC1E,IAAI,CAAC,+DAA+D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,OAAO,CAAC,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzG,CAAC"}

package/dist/edit-stats.js

@@ -1,5 +1,5 @@
 // How many lines an edit added and removed, worked out on the device from the tool's own input so
-// only the two counts -- never the file contents -- leave the machine.
+// line counts accompany the bounded, redacted edit details in activity telemetry.
 const MAX_LINES = 20_000;
 function lines(text) {
     if (!text)
@@ -53,17 +53,17 @@ export function changedLines(toolInput) {
         const total = { added: 0, removed: 0 };
         for (const edit of input.edits) {
             const e = record(edit);
-            const counts = diffCounts(str(e.old_string) ?? "", str(e.new_string) ?? "");
+            const counts = diffCounts(str(e.old_string) ?? str(e.oldText) ?? str(e.old_text) ?? "", str(e.new_string) ?? str(e.newText) ?? str(e.new_text) ?? "");
             total.added += counts.added;
             total.removed += counts.removed;
         }
         return total;
     }
-    const before = str(input.old_string) ?? str(input.old_str);
-    const after = str(input.new_string) ?? str(input.new_str);
+    const before = str(input.old_string) ?? str(input.old_str) ?? str(input.oldText) ?? str(input.old_text) ?? str(input.oldString);
+    const after = str(input.new_string) ?? str(input.new_str) ?? str(input.newText) ?? str(input.new_text) ?? str(input.newString);
     if (before !== undefined || after !== undefined)
         return diffCounts(before ?? "", after ?? "");
-    const patch = str(input.patch) ?? str(input.diff) ?? str(input.command);
+    const patch = str(input.patch) ?? str(input.patchText) ?? str(input.patch_text) ?? str(input.diff) ?? str(input.command);
     if (patch && /^(\*\*\* Begin Patch|diff --git|--- |@@ )/m.test(patch))
         return patchCounts(patch);
     const content = str(input.content) ?? str(input.contents) ?? str(input.file_text);

package/dist/edit-stats.js.map

@@ -1 +1 @@
-{"version":3,"file":"edit-stats.js","sourceRoot":"","sources":["../src/edit-stats.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,uEAAuE;AAIvE,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,iGAAiG;AACjG,gFAAgF;AAChF,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;;YACvC,KAAK,EAAE,CAAC;IACf,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,KAAK,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACzF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;aAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpG,MAAM,MAAM,GAAG,CAAC,KAAc,EAA2B,EAAE,CACzD,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAExG,6HAA6H;AAC7H,MAAM,UAAU,YAAY,CAAC,SAAkB;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAEhC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;YAC5B,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,KAAK,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"edit-stats.js","sourceRoot":"","sources":["../src/edit-stats.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,kFAAkF;AAIlF,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,iGAAiG;AACjG,gFAAgF;AAChF,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;;YACvC,KAAK,EAAE,CAAC;IACf,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,KAAK,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACzF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;aAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpG,MAAM,MAAM,GAAG,CAAC,KAAc,EAA2B,EAAE,CACzD,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAExG,6HAA6H;AAC7H,MAAM,UAAU,YAAY,CAAC,SAAkB;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAEhC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACtJ,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;YAC5B,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/H,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzH,IAAI,KAAK,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/entity-redaction.d.ts

@@ -0,0 +1,11 @@
+import { type CustomDetector, type DataFinding } from "./data-detectors.js";
+/**
+ * Same redaction `detectSensitive()`/`redactSensitive()` already do, except each distinct real
+ * value gets a stable, numbered placeholder ([SECRET_001], [API_KEY_002], ...) that's consistent
+ * for that exact value within `sessionId`, and distinct per different value of the same kind.
+ * `home` is the beam data directory (injectable for tests); defaults to the real one.
+ */
+export declare function redactWithSessionEntities(text: string, sessionId: string, custom?: CustomDetector[], home?: string): Promise<{
+    text: string;
+    findings: DataFinding[];
+}>;