@bli-cockpit/telemetry-core 0.1.17 → 0.1.18

package/dist/secret-guards.js

@@ -225,7 +225,30 @@ export function redactSecretLikeContent(value, options = {}) {
     });
     return { redacted: true, text, metadata };
 }
+/**
+ * Every region the detector considers a secret, redacted — precisely where a
+ * rule can pinpoint the value, coarsely where none can.
+ *
+ * `containsSecretLikeContent` and `SECRET_REDACTION_RULES` are two lists that
+ * have to agree, and nothing used to make them. When the detector matched and
+ * no rule produced a range, `redactSecretLikeContent` reported
+ * `redacted: false`, and the caller dropped the entire session file
+ * (`secret_like_content_guard`). Drift between the lists cost whole sessions:
+ * 78 fleet-wide as of 2026-08-14, 3 of Viet's 17 Claude sessions.
+ *
+ * The two lists can still drift — regexes are like that — but drift now costs
+ * precision instead of evidence. A detector hit with no matching rule redacts
+ * the whole matched span, so `redactSecretLikeContent` always reports the
+ * redaction it performed and the transcript survives with the value removed.
+ */
 function findSecretRedactionMatches(value) {
+    const accepted = acceptNonOverlapping(secretRuleCandidates(value));
+    const uncovered = detectorFallbackCandidates(value).filter((candidate) => !overlapsAny(candidate, accepted));
+    if (uncovered.length === 0)
+        return accepted;
+    return acceptNonOverlapping([...accepted, ...uncovered]);
+}
+function secretRuleCandidates(value) {
     const candidates = [];
     SECRET_REDACTION_RULES.forEach((rule, priority) => {
         const pattern = cloneGlobalPattern(rule.pattern);
@@ -248,7 +271,36 @@ function findSecretRedactionMatches(value) {
             });
         }
     });
-    candidates.sort((a, b) => {
+    return candidates;
+}
+/**
+ * Ranked below every real rule, so a rule that can name the credential always
+ * wins and the coarse span is only used where nothing else reached.
+ */
+function detectorFallbackCandidates(value) {
+    const candidates = [];
+    const basePriority = SECRET_REDACTION_RULES.length;
+    SECRET_LIKE_CONTENT_PATTERNS.forEach((pattern, offset) => {
+        for (const match of value.matchAll(cloneGlobalPattern(pattern))) {
+            const fullMatch = match[0];
+            const matchIndex = match.index;
+            if (!fullMatch || matchIndex === undefined)
+                continue;
+            candidates.push({
+                start: matchIndex,
+                end: matchIndex + fullMatch.length,
+                ruleId: "unnamed_secret_shape",
+                priority: basePriority + offset,
+            });
+        }
+    });
+    return candidates;
+}
+function overlapsAny(candidate, accepted) {
+    return accepted.some((other) => candidate.start < other.end && other.start < candidate.end);
+}
+function acceptNonOverlapping(candidates) {
+    const ordered = [...candidates].sort((a, b) => {
         if (a.start !== b.start)
             return a.start - b.start;
         if (a.priority !== b.priority)
@@ -257,7 +309,7 @@ function findSecretRedactionMatches(value) {
     });
     const accepted = [];
     let lastEnd = -1;
-    for (const candidate of candidates) {
+    for (const candidate of ordered) {
         if (candidate.start < lastEnd)
             continue;
         accepted.push(candidate);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/telemetry-core",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",