@code-yeongyu/senpi-ai 2026.10.26-2 → 2026.10.27-2

package/dist/utils/secret-classifier.js

@@ -0,0 +1,258 @@
+// What the credential redactor recognizes (senpi#4283): the credential words a name ends with, and the shapes of known
+// key prefixes and JWTs. Each check reads only the characters of the token it is given, forward, without a regular
+// expression.
+import { isAlnum, isBase64Url, isDigit, isLower, isNameChar, isUpper, matchesAt, readUnit } from "./secret-lexer.js";
+/** The last component of a credential name, after digits and qualifiers are stripped (see secretWord). */
+const SECRET_WORDS = new Set([
+    "key",
+    "apikey",
+    "accesskey",
+    "secretkey",
+    "privatekey",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "authtoken",
+    "apitoken",
+    "idtoken",
+    "secret",
+    "clientsecret",
+    "auth",
+    "authorization",
+    "bearer",
+    "cookie",
+    "cookies",
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    "credential",
+    "credentials",
+    "signature",
+    "sig",
+]);
+/** Names whose whole value is a credential at any length; every other credential name needs a 16-character value. */
+export const STRICT_WORDS = new Set([
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    "secret",
+    "clientsecret",
+    "authorization",
+    "bearer",
+]);
+export const COOKIE_WORDS = new Set(["cookie", "cookies"]);
+/** A trailing component that names a part of the credential the name before it holds: api_key_value, apiKeyId. */
+const QUALIFIERS = new Set(["value", "val", "id"]);
+export const SCHEMES = new Set(["bearer", "basic", "token", "apikey"]);
+/** Values that are never credentials, including a replacement an earlier pass wrote (redaction is idempotent). */
+const INERT_VALUES = new Set(["redacted", "null", "true", "false", "none", "undefined"]);
+export const COOKIE_ATTRIBUTES = new Set([
+    "path",
+    "domain",
+    "expires",
+    "max-age",
+    "samesite",
+    "secure",
+    "httponly",
+    "priority",
+    "partitioned",
+]);
+const isUpperOrDigit = (c) => isDigit(c) || isUpper(c);
+const isSlackChar = (c) => isAlnum(c) || c === 45;
+const isPatChar = (c) => isAlnum(c) || c === 95;
+const isWordChar = (c) => isAlnum(c) || c === 95;
+/** Split a name into lowercase components on "_", "-", "." and camelCase, reading only the name's own characters. */
+function nameComponents(text, start, end) {
+    const parts = [];
+    let current = "";
+    for (let i = start; i < end; i++) {
+        const c = text.charCodeAt(i);
+        if (c === 95 || c === 45 || c === 46) {
+            if (current.length > 0)
+                parts.push(current);
+            current = "";
+            continue;
+        }
+        if (isUpper(c) && current.length > 0) {
+            const previous = text.charCodeAt(i - 1);
+            const next = i + 1 < end ? text.charCodeAt(i + 1) : 0;
+            if (isLower(previous) || isDigit(previous) || (isUpper(previous) && isLower(next))) {
+                parts.push(current);
+                current = "";
+            }
+        }
+        current += String.fromCharCode(isUpper(c) ? c + 32 : c);
+    }
+    if (current.length > 0)
+        parts.push(current);
+    return parts;
+}
+function isAllDigits(part) {
+    for (let k = 0; k < part.length; k++)
+        if (!isDigit(part.charCodeAt(k)))
+            return false;
+    return true;
+}
+function withoutTrailingDigits(part) {
+    let end = part.length;
+    while (end > 1 && isDigit(part.charCodeAt(end - 1)))
+        end--;
+    return part.slice(0, end);
+}
+/**
+ * The credential word a name ends with, after its normalization: numbered slots (OPENAI_API_KEY_2, token2,
+ * x-api-key-1) and a trailing qualifier (api_key_value, apiKeyId) still end with the word. "session" counts only as
+ * the whole name, so session_id stays readable; a word elsewhere in a name (token_type, primary_key_column) or inside
+ * a word (monkey, tokenizer, max_tokens) does not count.
+ */
+export function secretWord(text, start, end) {
+    const parts = nameComponents(text, start, end);
+    if (parts.length === 1 && parts[0] === "session")
+        return "session";
+    let last = parts.length - 1;
+    for (;;) {
+        while (last >= 0 && isAllDigits(parts[last] ?? ""))
+            last--;
+        if (last > 0 && QUALIFIERS.has(parts[last] ?? ""))
+            last--;
+        else
+            break;
+    }
+    if (last < 0)
+        return undefined;
+    const word = withoutTrailingDigits(parts[last] ?? "");
+    return SECRET_WORDS.has(word) ? word : undefined;
+}
+/** Where the name ends a token: its last run of name characters (a URL path or escape before it is not the name). */
+export function nameStart(text, start, end) {
+    let i = end;
+    while (i > start && isNameChar(text.charCodeAt(i - 1)))
+        i--;
+    return i;
+}
+export function lowerToken(text, start, end, maxLength) {
+    return end - start > maxLength ? undefined : text.slice(start, end).toLowerCase();
+}
+export function isInert(text, start, end) {
+    const word = lowerToken(text, start, end, 9);
+    return word !== undefined && INERT_VALUES.has(word);
+}
+/** Credential-shaped tokens recognized by their prefix wherever a word starts with it. */
+const PREFIX_RULES = [
+    { prefixes: ["sk-"], min: 8, chars: isBase64Url },
+    { prefixes: ["sk_live_", "sk_test_", "rk_live_", "rk_test_"], min: 16, chars: isAlnum },
+    { prefixes: ["gsk_", "xai-", "hf_"], min: 20, chars: isAlnum },
+    { prefixes: ["xoxa-", "xoxb-", "xoxo-", "xoxp-", "xoxr-", "xoxs-"], min: 10, chars: isSlackChar },
+    { prefixes: ["ghp_", "gho_", "ghu_", "ghs_", "ghr_"], min: 20, chars: isAlnum },
+    { prefixes: ["github_pat_"], min: 20, chars: isPatChar },
+    { prefixes: ["AKIA", "ASIA"], min: 16, chars: isUpperOrDigit, exact: true },
+    { prefixes: ["AIza"], min: 30, chars: isBase64Url },
+];
+/** Bounded work: the prefix plus at most min + 1 characters after it. */
+function matchesPrefixRule(text, start, end, rule) {
+    for (const prefix of rule.prefixes) {
+        if (!matchesAt(text, start, prefix, end))
+            continue;
+        let run = 0;
+        const limit = rule.exact === true ? rule.min + 1 : rule.min;
+        for (let i = start + prefix.length; i < end && run < limit && rule.chars(text.charCodeAt(i)); i++)
+            run++;
+        return rule.exact === true ? run === rule.min : run >= rule.min;
+    }
+    return false;
+}
+/** A known key ends at its alphabet's boundary, not at the end of a URL or filename containing it. */
+export function credentialShapeEnd(text, start, end) {
+    for (const rule of PREFIX_RULES) {
+        if (!matchesPrefixRule(text, start, end, rule))
+            continue;
+        for (const prefix of rule.prefixes) {
+            if (!matchesAt(text, start, prefix, end))
+                continue;
+            let i = start + prefix.length;
+            while (i < end) {
+                const unit = readUnit(text, i);
+                if (!rule.chars(unit.character))
+                    break;
+                i += unit.length;
+            }
+            return i;
+        }
+    }
+    // JWTs have their own segment grammar; retain the conservative span for those.
+    return end;
+}
+/**
+ * Whether a JWT (three base64url segments joined by ".", the first a JSON header "eyJ") starts at p: -1 when one does,
+ * else where the next JWT candidate may start. A candidate before the first "." after p sees the same segments with a
+ * shorter first one, so it cannot match either; skipping to that "." caps every walk at three segments, and each
+ * segment is walked by at most three candidates.
+ */
+function jwtAt(text, p, end) {
+    if (!matchesAt(text, p, "eyJ", end))
+        return p + 1;
+    let segments = 1;
+    let length = 0;
+    let firstDot = -1;
+    let i = p;
+    for (; i < end;) {
+        const unit = readUnit(text, i);
+        const c = unit.character;
+        if (c === 46) {
+            if (firstDot < 0)
+                firstDot = i;
+            const next = i + unit.length < end ? readUnit(text, i + unit.length).character : 0;
+            if (segments === 3)
+                return length >= 5 && !isBase64Url(next) ? -1 : firstDot;
+            if (length < (segments === 1 ? 8 : 5))
+                return firstDot;
+            segments++;
+            length = 0;
+        }
+        else if (isBase64Url(c))
+            length++;
+        else
+            break;
+        i += unit.length;
+    }
+    if (segments === 3 && length >= 5)
+        return -1;
+    return firstDot >= 0 ? firstDot : i;
+}
+/**
+ * Where the first credential-shaped run in [start, end) begins, or -1: a known key prefix or a JWT at the start of a
+ * word anywhere in the token (after "/", "+", "~", "-", "." or "%", so URL userinfo, paths and joined values count),
+ * including percent-encoded token punctuation, never inside a word ("tasks-..." is not "sk-...").
+ * After a credential has already been found, withinCredential also checks inside words: an adjoining key may have
+ * had its prefix consumed by the first key's alphabet. The caller retains the whole token in that ambiguous case.
+ * Constant work per character plus the JWT walks bounded above.
+ */
+export function credentialShapeStart(text, start, end, withinCredential = false) {
+    let stop = end;
+    while (stop > start && text.charCodeAt(stop - 1) === 46)
+        stop--;
+    let jwtFrom = start;
+    let wordStart = true;
+    for (let p = start; p < stop;) {
+        const unit = readUnit(text, p);
+        const candidate = withinCredential || wordStart;
+        wordStart = !isWordChar(unit.character);
+        const position = p;
+        p += unit.length;
+        if (!candidate)
+            continue;
+        for (const rule of PREFIX_RULES)
+            if (matchesPrefixRule(text, position, stop, rule))
+                return position;
+        if (position < jwtFrom)
+            continue;
+        const next = jwtAt(text, position, stop);
+        if (next < 0)
+            return position;
+        jwtFrom = next;
+    }
+    return -1;
+}
+//# sourceMappingURL=secret-classifier.js.map

package/dist/utils/secret-lexer.d.ts

@@ -0,0 +1,51 @@
+interface Unit {
+    character: number;
+    length: number;
+    refusal?: "percent-window";
+}
+export declare const isDigit: (c: number) => boolean;
+export declare const isUpper: (c: number) => boolean;
+export declare const isLower: (c: number) => boolean;
+export declare const isAlnum: (c: number) => boolean;
+export declare const isBase64Url: (c: number) => boolean;
+export declare const isNameChar: (c: number) => boolean;
+export declare function matchesAt(text: string, i: number, literal: string, limit?: number): boolean;
+/** The length of the token unit at i (a value character, or a percent escape of one), or 0 at a delimiter. */
+export declare function tokenUnitLength(text: string, i: number): number;
+/** One logical character and its full source width, shared by token, delimiter and word-boundary scans. */
+export declare function readUnit(text: string, i: number): Unit;
+export interface Delimiter {
+    end: number;
+    /** The first unresolved percent window; callers conservatively redact from here to the end. */
+    refusalStart: number;
+    /** One ":" or "=" between quotes, escapes and spaces, then an optional "[" or "{". */
+    separator: boolean;
+    opensObject: boolean;
+    braceDepth: number;
+    /** The end of the "=" padding it starts with, which belongs to the token before it. */
+    paddingEnd: number;
+    pairEquals: boolean;
+    cookieGap: boolean;
+    spaceOnly: boolean;
+    endsWithLt: boolean;
+    closesTag: boolean;
+    colonOnly: boolean;
+    at: number;
+    endsUserinfo: boolean;
+    /** The quote character the delimiter ends with (it opens the value after it), or -1. */
+    quote: number;
+    /** How many backslashes escape that quote: the escaping depth its closing quote is written at. */
+    quoteBackslashes: number;
+}
+export declare function emptyDelimiter(): Delimiter;
+/** Read the delimiter that starts at i into d, one unit at a time. */
+export declare function readDelimiter(text: string, i: number, d: Delimiter): void;
+/**
+ * Where a quoted value that continues at i ends: its closing quote, written at the opening quote's escaping depth (a
+ * quote behind more backslashes is escaped inside the value), or the end of the line.
+ */
+export declare function quotedValueEnd(text: string, i: number, quote: number, depth: number): number;
+/** Where a bare value that continues at i ends: whitespace, ",", ";", "&", a quote or "<" (a closing tag). */
+export declare function bareValueEnd(text: string, i: number): number;
+export {};
+//# sourceMappingURL=secret-lexer.d.ts.map

package/dist/utils/secret-lexer.js

@@ -0,0 +1,295 @@
+// The lexical layer of the credential redactor (senpi#4283): character classes, percent escapes and HTML entities read
+// as what they encode, the token and delimiter units the one-pass scanner alternates between, and the forward scans
+// that find where a quoted or bare value ends. Every function reads forward from the index it is given; none searches
+// back or uses a regular expression.
+const HTML_ENTITIES = [
+    [""", 34],
+    [""", 34],
+    [""", 34],
+    [""", 34],
+    ["'", 39],
+    ["'", 39],
+    ["'", 39],
+    ["<", 60],
+    [">", 62],
+    ["&", 38],
+];
+const MAX_SEPARATOR_LENGTH = 32;
+const MAX_SCHEME_GAP = 8;
+const PERCENT_WINDOW = 64;
+export const isDigit = (c) => c >= 48 && c <= 57;
+export const isUpper = (c) => c >= 65 && c <= 90;
+export const isLower = (c) => c >= 97 && c <= 122;
+export const isAlnum = (c) => isDigit(c) || isUpper(c) || isLower(c);
+export const isBase64Url = (c) => isAlnum(c) || c === 95 || c === 45;
+export const isNameChar = (c) => isBase64Url(c) || c === 46;
+const isTokenChar = (c) => isNameChar(c) || c === 43 || c === 47 || c === 126;
+const isSpace = (c) => c === 32 || c === 9 || c === 10 || c === 13;
+const isQuote = (c) => c === 34 || c === 39 || c === 96 || c === 92;
+const isOpeningQuote = (c) => c === 34 || c === 39 || c === 96;
+const isTypographicQuote = (c) => c === 0x201c || c === 0x201d || c === 0x2018 || c === 0x2019;
+function hexValue(c) {
+    if (isDigit(c))
+        return c - 48;
+    if (c >= 65 && c <= 70)
+        return c - 55;
+    if (c >= 97 && c <= 102)
+        return c - 87;
+    return -1;
+}
+export function matchesAt(text, i, literal, limit = text.length) {
+    if (i + literal.length > limit)
+        return false;
+    for (let k = 0; k < literal.length; k++)
+        if (text.charCodeAt(i + k) !== literal.charCodeAt(k))
+            return false;
+    return true;
+}
+/** The length of the token unit at i (a value character, or a percent escape of one), or 0 at a delimiter. */
+export function tokenUnitLength(text, i) {
+    const c = text.charCodeAt(i);
+    if (isTokenChar(c))
+        return 1;
+    if (c !== 37)
+        return 0;
+    const unit = readUnit(text, i);
+    if (unit.refusal !== undefined)
+        return 0;
+    return isTokenChar(unit.character) || unit.length === 1 ? unit.length : 0;
+}
+/**
+ * Repeated full-window percent decoding to a fixpoint, keeping each character's original source end.
+ * A pass shrinks the 64-character window by at least two, so both work and storage here are bounded.
+ * Malformed escapes are literal, but an unfinished escape at the window edge is not a proven boundary.
+ */
+function percentWindow(text, start, prefixEnd) {
+    const limit = Math.min(text.length, prefixEnd + PERCENT_WINDOW - 1);
+    let needsDecoding = false;
+    let contiguous = true;
+    let previous = 37;
+    for (let p = prefixEnd; p < limit; p++) {
+        const c = text.charCodeAt(p);
+        const hex = hexValue(c) >= 0;
+        if (previous === 37 && hex) {
+            needsDecoding = true;
+            break;
+        }
+        if (c !== 37 && !hex)
+            contiguous = false;
+        previous = c;
+    }
+    // Without a possible escape no pass can change the window, so do not allocate its fixpoint buffers.
+    if (!needsDecoding) {
+        if (contiguous && limit < text.length)
+            return { character: 37, length: limit - start, refusal: "percent-window" };
+        return { character: 37, length: prefixEnd - start };
+    }
+    const characters = [37];
+    const ends = [prefixEnd];
+    for (let p = prefixEnd; p < limit; p++) {
+        characters.push(text.charCodeAt(p));
+        ends.push(p + 1);
+    }
+    let changed;
+    do {
+        changed = false;
+        let written = 0;
+        for (let p = 0; p < characters.length; p++) {
+            let c = characters[p] ?? 0;
+            const high = hexValue(characters[p + 1] ?? -1);
+            const low = hexValue(characters[p + 2] ?? -1);
+            if (c === 37 && high >= 0 && low >= 0) {
+                c = high * 16 + low;
+                p += 2;
+                changed = true;
+            }
+            characters[written] = c;
+            ends[written++] = ends[p] ?? prefixEnd;
+        }
+        characters.length = written;
+        ends.length = written;
+    } while (changed);
+    const character = characters[0] ?? 37;
+    if (character === 37 && limit < text.length) {
+        // Only a contiguous percent/hex run can depend on text beyond the window. A non-hex literal
+        // breaks the dependency: the percent before it can never decode on any later pass.
+        for (let p = 1; p < characters.length; p++) {
+            const c = characters[p] ?? 0;
+            if (c !== 37 && hexValue(c) < 0)
+                return { character, length: (ends[0] ?? prefixEnd) - start };
+        }
+        return { character, length: limit - start, refusal: "percent-window" };
+    }
+    return { character, length: (ends[0] ?? prefixEnd) - start };
+}
+/** One logical character and its full source width, shared by token, delimiter and word-boundary scans. */
+export function readUnit(text, i) {
+    const c = text.charCodeAt(i);
+    if (c === 37) {
+        let end = i + 1;
+        let decoded = c;
+        // Collapse literal %25 layers in one forward walk before the bounded full-window decoder.
+        // This is the fixpoint of that prefix, not a depth cap: even million-layer canonical chains stay linear.
+        while (end + 1 < text.length) {
+            const high = hexValue(text.charCodeAt(end));
+            const low = hexValue(text.charCodeAt(end + 1));
+            if (high < 0 || low < 0)
+                break;
+            decoded = high * 16 + low;
+            end += 2;
+            if (decoded !== 37)
+                return { character: decoded, length: end - i };
+        }
+        return percentWindow(text, i, end);
+    }
+    if (c === 38) {
+        for (const [entity, character] of HTML_ENTITIES) {
+            if (matchesAt(text, i, entity))
+                return { character, length: entity.length };
+        }
+    }
+    if (c === 0xff1a)
+        return { character: 58, length: 1 };
+    if (c === 0x201c || c === 0x201d)
+        return { character: 34, length: 1 };
+    if (c === 0x2018 || c === 0x2019)
+        return { character: 39, length: 1 };
+    return { character: c, length: 1 };
+}
+export function emptyDelimiter() {
+    return {
+        end: 0,
+        refusalStart: -1,
+        separator: false,
+        opensObject: false,
+        braceDepth: 0,
+        paddingEnd: 0,
+        pairEquals: false,
+        cookieGap: false,
+        spaceOnly: false,
+        endsWithLt: false,
+        closesTag: false,
+        colonOnly: false,
+        at: -1,
+        endsUserinfo: false,
+        quote: -1,
+        quoteBackslashes: 0,
+    };
+}
+/** Read the delimiter that starts at i into d, one unit at a time. */
+export function readDelimiter(text, i, d) {
+    let position = i;
+    let units = 0;
+    let separators = 0;
+    let separatorShape = true;
+    let gapMarks = 0;
+    let gapShape = true;
+    let padding = true;
+    let spaces = 0;
+    let backslashes = 0;
+    let last = -1;
+    let first = -1;
+    let tagShape = true;
+    d.opensObject = false;
+    d.braceDepth = 0;
+    d.paddingEnd = i;
+    d.at = -1;
+    d.endsUserinfo = false;
+    d.quote = -1;
+    d.quoteBackslashes = 0;
+    d.refusalStart = -1;
+    while (position < text.length && tokenUnitLength(text, position) === 0) {
+        const unit = readUnit(text, position);
+        if (unit.refusal !== undefined) {
+            d.refusalStart = position;
+            position = text.length;
+            break;
+        }
+        const c = unit.character;
+        if (units === 0)
+            first = c;
+        else if (!isSpace(c))
+            tagShape = false;
+        if (padding && c === 61)
+            d.paddingEnd = position + unit.length;
+        else {
+            padding = false;
+            if (c === 59 || c === 44)
+                gapMarks++;
+            else if (!isSpace(c) && !isQuote(c))
+                gapShape = false;
+        }
+        if (c === 58 || c === 61)
+            separators++;
+        else if (c === 123) {
+            d.braceDepth++;
+            if (separators === 1)
+                d.opensObject = true;
+            else
+                separatorShape = false;
+        }
+        else if (c === 125) {
+            d.braceDepth--;
+            separatorShape = false;
+        }
+        else if (!isSpace(c) && !isQuote(c) && !(c === 91 && separators === 1))
+            separatorShape = false;
+        if (isSpace(c))
+            spaces++;
+        if (c === 64 && d.at < 0)
+            d.at = position;
+        if (isSpace(c) || c === 63 || c === 35)
+            d.endsUserinfo = true;
+        d.quote = isOpeningQuote(c) ? c : -1;
+        d.quoteBackslashes = backslashes;
+        backslashes = c === 92 ? backslashes + 1 : 0;
+        last = c;
+        units++;
+        position += unit.length;
+    }
+    d.end = position;
+    d.separator = separators === 1 && separatorShape && units <= MAX_SEPARATOR_LENGTH;
+    d.pairEquals = units === 1 && first === 61;
+    d.cookieGap = gapMarks === 1 && gapShape && units <= MAX_SEPARATOR_LENGTH;
+    d.spaceOnly = units > 0 && spaces === units && units <= MAX_SCHEME_GAP;
+    d.endsWithLt = last === 60;
+    d.closesTag = first === 62 && tagShape;
+    d.colonOnly = units === 1 && first === 58;
+}
+/**
+ * Where a quoted value that continues at i ends: its closing quote, written at the opening quote's escaping depth (a
+ * quote behind more backslashes is escaped inside the value), or the end of the line.
+ */
+export function quotedValueEnd(text, i, quote, depth) {
+    let position = i;
+    let backslashes = 0;
+    while (position < text.length) {
+        const raw = text.charCodeAt(position);
+        if (raw === 10 || raw === 13)
+            return position;
+        if (raw === 92) {
+            backslashes++;
+            position++;
+            continue;
+        }
+        const unit = readUnit(text, position);
+        if (unit.refusal !== undefined)
+            return text.length;
+        if (unit.character === quote && backslashes <= depth)
+            return position - backslashes;
+        backslashes = 0;
+        position += unit.length;
+    }
+    return position;
+}
+/** Where a bare value that continues at i ends: whitespace, ",", ";", "&", a quote or "<" (a closing tag). */
+export function bareValueEnd(text, i) {
+    let position = i;
+    for (; position < text.length; position++) {
+        const c = text.charCodeAt(position);
+        if (isSpace(c) || isQuote(c) || isTypographicQuote(c) || c === 44 || c === 59 || c === 38 || c === 60)
+            break;
+    }
+    return position;
+}
+//# sourceMappingURL=secret-lexer.js.map

package/dist/utils/secret-redaction.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Mask credentials in provider or gateway text by value, not by a list of names: the value after a name that ends
+ * with a credential word (in a header, JSON, array, Go map, Python repr, XML, URL query, form body, cookie or
+ * environment assignment, with ASCII, typographic or HTML-escaped quotes, at any escaping depth; 16 characters or
+ * more, or the whole value at any length under a password, secret, authorization or bearer name), every cookie value,
+ * every long value of an object held under such a name, URL userinfo passwords, bearer tokens, and known key prefixes
+ * and JWTs wherever a word starts with one (inside URLs, userinfo and paths too). Model ids, error codes, request ids
+ * and names that merely contain a credential word stay readable. One linear pass, no regular expressions.
+ */
+export declare function redactSecrets(text: string, replacement?: string): string;
+/** Mask only credential-shaped runs (known key prefixes and JWTs), whatever surrounds them. One linear pass. */
+export declare function redactCredentialShapes(text: string, replacement?: string): string;
+//# sourceMappingURL=secret-redaction.d.ts.map