@hoilab/ada-cli 0.85.0 → 0.85.3

package/dist/core/secretos/obfuscator.js

@@ -0,0 +1,1182 @@
+import { buildHashBase, buildKeyedReplacementRun, buildPlaceholder, defaultPlaceholderKey, inferCaseHint, lookupFriendlyPlaceholderAlias, MIN_OBFUSCATE_SECRET_LEN, PLACEHOLDER_RE, placeholderWithoutFriendlyName, resumePlaceholderScanAfterRejectedCandidate, sanitizedLabelCollidesWithSecret, sanitizeForCollisionCheck, sanitizeSecretFriendlyName, } from "./placeholder.js";
+import { buildReplaceRegexScan, countOutsidePlaceholderRanges, deepWalkStrings, deobfuscateGeneratedPlaceholderRanges, extendPastAdjacentPlaceholders, firstOutsidePlaceholderRange, mapReplaceRegexMatch, outsidePlaceholderRangesAnyIndependentlyMatch, placeholderInnerText, redactWithFixedReplacementOutsidePlaceholders, replaceRange, textOutsidePlaceholderRanges, trailingOutsidePreservedPlaceholderChunk, transformOutsidePlaceholdersTracked, } from "./placeholder-scan.js";
+import { compileSecretRegex } from "./regex.js";
+import { ensureDistinctReplacement, findNonMatchingReplacement, generateDeterministicReplacement, regexHasUnresolvableShortMatchFallback, regexRematchesInContext, } from "./replacement.js";
+// ═══════════════════════════════════════════════════════════════════════════
+// SecretObfuscator
+// ═══════════════════════════════════════════════════════════════════════════
+export class SecretObfuscator {
+    /** Plain secrets: secret → index (known at construction) */
+    #plainMappings = new Map();
+    /** Regex entries (patterns compiled at construction) */
+    #regexEntries = [];
+    /** All obfuscate-mode mappings: index → { secret, placeholder } */
+    #obfuscateMappings = new Map();
+    /** Replace-mode plain mappings: secret → replacement */
+    #replaceMappings = new Map();
+    /** Reverse lookup for LIVE deobfuscation (provider output, tool-call args):
+     *  keyed placeholder → secret plus recursion policy. Only placeholders this
+     *  obfuscator generated under the per-install key (and their friendly-name-
+     *  independent aliases) live here, so a prompt-injected model cannot synthesize
+     *  one without the key. */
+    #deobfuscateMap = new Map();
+    /** Exact placeholder tokens generated by this obfuscator revision (no aliases). */
+    #generatedPlaceholders = new Set();
+    /** Deterministic replace chunks emitted by this obfuscator, used to keep re-obfuscation idempotent. */
+    #generatedReplaceChunks = new Set();
+    /** Every configured plain-secret literal value (both obfuscate and replace
+     *  mode), collected before any placeholder is minted. A generated placeholder
+     *  must never equal one of these — otherwise a later-processed secret whose
+     *  raw value happens to equal an earlier secret's placeholder would be
+     *  indistinguishable from that placeholder on the NEXT obfuscate() pass (its
+     *  own plain-secret redaction already ran, sorted by length, before the
+     *  placeholder existed) and would survive verbatim in provider-visible text. */
+    #configuredSecretValues = new Set();
+    /** Regex values seen in the current obfuscate input, used to keep friendly labels from exposing normalized matches that are discovered later in the same pass. */
+    #currentRegexSecretValues = new Set();
+    /** Placeholder base-key (exact value for :M, case-folded otherwise) → base hash. */
+    #placeholderBaseByKey = new Map();
+    /** Placeholder base hash → owner key, used to avoid ambiguous placeholders. */
+    #placeholderBaseOwners = new Map();
+    /** Next available index for regex match discoveries */
+    #nextIndex;
+    /** Whether any secrets were configured */
+    #hasAny;
+    /**
+     * Private per-install (or per-process) key for the keyed placeholder digest.
+     * Resolved lazily when the constructor received a key PROVIDER: the first
+     * placeholder mint or keyed fallback marker triggers resolution, so callers
+     * can defer persisting `secret-placeholder.key` until a dynamic regex entry
+     * actually matches session content.
+     */
+    #key;
+    #keyProvider;
+    constructor(entries, key = defaultPlaceholderKey()) {
+        if (typeof key === "function") {
+            this.#keyProvider = key;
+        }
+        else {
+            this.#setPlaceholderKey(key);
+        }
+        // Collect every configured plain-secret literal AND compile every regex
+        // entry BEFORE minting any placeholder below, so a placeholder's friendly
+        // name (checked against both in `#createPlaceholder`) can never embed a
+        // LATER entry's raw value or regex coverage, regardless of entries[]
+        // order — same reasoning as the base-collision guard below, extended to
+        // the friendly-name collision guard.
+        for (const entry of entries) {
+            if (entry.type === "plain") {
+                this.#configuredSecretValues.add(entry.content);
+                continue;
+            }
+            try {
+                const regex = compileSecretRegex(entry.content, entry.flags);
+                const mode = entry.mode ?? "obfuscate";
+                // A default (no custom `replacement`) replace-mode regex that can
+                // never redact a 1-2 char match distinctly from itself (see
+                // `regexHasUnresolvableShortMatchFallback`) is dropped rather than
+                // risk a real secret round-tripping unredacted; `secrets/index.ts`
+                // warns loudly for the `secrets.yml`-loaded path — this is the
+                // silent backstop for direct construction.
+                if (mode === "replace" &&
+                    entry.replacement === undefined &&
+                    regexHasUnresolvableShortMatchFallback(regex)) {
+                    continue;
+                }
+                this.#regexEntries.push({
+                    regex,
+                    mode,
+                    replacement: entry.replacement,
+                    friendlyName: entry.friendlyName,
+                });
+            }
+            catch {
+                // Invalid regex — skip silently (validation happens at load time)
+            }
+        }
+        let index = 0;
+        let hasRealSec = this.#regexEntries.length > 0;
+        for (const entry of entries) {
+            if (entry.type !== "plain")
+                continue;
+            const mode = entry.mode ?? "obfuscate";
+            if (mode === "obfuscate") {
+                if (entry.content.length < MIN_OBFUSCATE_SECRET_LEN) {
+                    // Tone down short plain secret obfuscation to avoid false matches on small words like "esp".
+                    continue;
+                }
+                const placeholder = this.#createPlaceholder(entry.content, entry.friendlyName);
+                this.#plainMappings.set(entry.content, index);
+                this.#obfuscateMappings.set(index, { secret: entry.content, placeholder });
+                this.#generatedPlaceholders.add(placeholder);
+                index++;
+                hasRealSec = true;
+            }
+            else {
+                // replace mode
+                const replacement = entry.replacement ?? this.#generateSecretReplacement(entry.content);
+                this.#replaceMappings.set(entry.content, replacement);
+                hasRealSec = true;
+            }
+        }
+        this.#nextIndex = index;
+        this.#hasAny = hasRealSec;
+    }
+    /**
+     * The keyed-hash key makes obfuscate-mode placeholder bases un-dictionaryable,
+     * but it can be persisted in a user-readable file (`secret-placeholder.key`).
+     * A prompt-injected tool read (read/bash) could otherwise surface it to the
+     * provider verbatim and undo that protection, so redact the key itself from
+     * obfuscated (provider-visible) output as a one-way secret.
+     */
+    #setPlaceholderKey(key) {
+        this.#key = key;
+        this.#replaceMappings.set(key, this.#generateSecretReplacement(key));
+        this.#configuredSecretValues.add(key);
+    }
+    /** Resolve the placeholder key once, minting its self-redaction on first use. */
+    #getKey() {
+        let key = this.#key;
+        if (key === undefined) {
+            key = this.#keyProvider?.() ?? defaultPlaceholderKey();
+            this.#keyProvider = undefined;
+            this.#setPlaceholderKey(key);
+        }
+        return key;
+    }
+    /** Whether this pass will mint a keyed placeholder from a regex match. */
+    #willMintRegexPlaceholder(secretValues) {
+        for (const entry of this.#regexEntries) {
+            if (entry.mode !== "obfuscate")
+                continue;
+            for (const value of secretValues) {
+                entry.regex.lastIndex = 0;
+                const matches = entry.regex.test(value);
+                entry.regex.lastIndex = 0;
+                if (matches)
+                    return true;
+            }
+        }
+        return false;
+    }
+    hasSecrets() {
+        return this.#hasAny;
+    }
+    /** Obfuscate all secrets in text. Bidirectional placeholders for obfuscate mode, one-way for replace. */
+    obfuscate(text, sharedRegexSecretValues) {
+        if (!this.#hasAny)
+            return text;
+        this.#currentRegexSecretValues = this.collectRegexSecretValuesForObfuscation(text);
+        for (const secretValue of sharedRegexSecretValues ?? []) {
+            this.#currentRegexSecretValues.add(secretValue);
+        }
+        // Resolve a lazy key before the replace phase whenever this pass will mint
+        // a regex placeholder. The key registers itself as a replace-mode secret;
+        // resolving it later, while processing the regex match, would expose key
+        // bytes already present in this same provider-visible input.
+        if (this.#keyProvider !== undefined && this.#willMintRegexPlaceholder(this.#currentRegexSecretValues)) {
+            this.#getKey();
+        }
+        let result = text;
+        // `origin` runs parallel to `result` (one tag char per result char): "I" for
+        // bytes carried from the INPUT (placeholders from a PRIOR obfuscate() call)
+        // and "F" for bytes this call freshly inserted. The SDK obfuscates messages
+        // in both convertToLlm and transformProviderContext, and prior-turn messages
+        // re-enter every turn, so obfuscate() must be a fixed point: a regex must not
+        // re-redact around a placeholder that arrived in the input (which would
+        // corrupt a prior replacement marker, e.g. REDACTED -> REDACTEDDACTED).
+        // Tracking by RANGE (not token value) keeps a fresh placeholder that happens
+        // to equal a prior one (same secret seen raw again) eligible for cross-match.
+        let origin = "I".repeat(text.length);
+        // 1. Process replace-mode plain secrets
+        for (const [secret, replacement] of [...this.#replaceMappings].sort((a, b) => b[0].length - a[0].length)) {
+            ({ text: result, origin } = this.#replaceOutsidePlaceholdersTracked(result, origin, secret, replacement, "I"));
+        }
+        for (const secretValue of this.#collectRegexSecretValues(result)) {
+            this.#currentRegexSecretValues.add(secretValue);
+        }
+        for (const secretValue of this.#collectRegexSecretValuesAfterRegexReplacements(result, origin)) {
+            this.#currentRegexSecretValues.add(secretValue);
+        }
+        for (const secretValue of sharedRegexSecretValues ?? []) {
+            this.#currentRegexSecretValues.add(secretValue);
+        }
+        ({ text: result, origin } = this.#stripUnsafeFriendlyPrefixes(result, origin));
+        // 2. Process obfuscate-mode plain secrets
+        for (const [secret, index] of [...this.#plainMappings].sort((a, b) => b[0].length - a[0].length)) {
+            const mapping = this.#obfuscateMappings.get(index);
+            ({ text: result, origin } = this.#replaceOutsidePlaceholdersTracked(result, origin, secret, this.#placeholderForCurrentInput(mapping.placeholder), "F"));
+        }
+        // 3. Process regex entries — discover new matches
+        for (const entry of this.#regexEntries) {
+            entry.regex.lastIndex = 0;
+            const matches = this.#collectRegexMatches(result, entry.regex, entry.mode, origin, entry.replacement);
+            for (const match of matches) {
+                if (entry.mode === "replace") {
+                    if (match.preserveGeneratedPlaceholders) {
+                        if (match.preserveInputPlaceholders &&
+                            entry.replacement === undefined &&
+                            match.inputPlaceholderOutsideChunkCount === 1 &&
+                            match.inputPlaceholderOutsideStart >= 0 &&
+                            origin
+                                .slice(match.inputPlaceholderOutsideStart, match.inputPlaceholderOutsideStart + match.inputPlaceholderOutside.length)
+                                .includes("F") &&
+                            this.#generatedReplaceChunks.has(match.inputPlaceholderOutside)) {
+                            continue;
+                        }
+                        // Same greedy-spillover fixed point as the obfuscate branch below: when
+                        // the match only reached across a prior-call placeholder because the
+                        // placeholder's own value satisfies the regex, and the surrounding raw
+                        // bytes do not independently match, re-redacting those bytes drifts the
+                        // deterministic scramble across passes (e.g. `…#…#ZZJ5sotJ` →
+                        // `…#…#ZZpvsotJ`), invalidating prompt-cache prefixes despite no new
+                        // input. Leave the placeholder and its spillover verbatim — a fixed
+                        // point. Structurally-required bytes (placeholder value alone cannot
+                        // match) and independently-matching outside chunks still fall through to
+                        // the redaction below. Only prior-call (`origin "I"`) placeholders set
+                        // these flags, so first-pass redaction of genuinely new bytes is intact.
+                        if (match.inputPlaceholderInnerIndependentlyMatches &&
+                            !match.inputPlaceholderOutsideIndependentlyMatches) {
+                            continue;
+                        }
+                        let replaceEnd = match.end;
+                        let span = result.slice(match.start, replaceEnd);
+                        if (entry.replacement !== undefined) {
+                            const trailingChunk = trailingOutsidePreservedPlaceholderChunk(span, (placeholder) => this.#isGeneratedPlaceholder(placeholder));
+                            if (trailingChunk.length > 0 && entry.replacement.startsWith(trailingChunk)) {
+                                const trailingSuffix = entry.replacement.slice(trailingChunk.length);
+                                if (trailingSuffix.length > 0 && result.slice(replaceEnd).startsWith(trailingSuffix)) {
+                                    replaceEnd += trailingSuffix.length;
+                                    span = result.slice(match.start, replaceEnd);
+                                }
+                            }
+                        }
+                        // A custom replacement is a single redaction marker for the whole
+                        // match, so emit it once around the preserved placeholder rather
+                        // than per surrounding chunk (which duplicates it, e.g.
+                        // `api_key=***#…#api_key=***`). Without one, each surrounding chunk
+                        // gets its own length-matched fixed-point marker, checked in the
+                        // expanded scan context so marker bytes cannot re-match beside the
+                        // preserved placeholder on the next pass. The origin of any placeholder
+                        // PRESERVED inside `span` must survive verbatim — blanket-tagging the
+                        // whole redacted span "I" would relabel a same-call-fresh ("F")
+                        // placeholder as prior-call, wrongly triggering the spillover-skip
+                        // above for a LATER regex entry over content this call just redacted.
+                        const spanOrigin = origin.slice(match.start, replaceEnd);
+                        const redacted = entry.replacement !== undefined
+                            ? redactWithFixedReplacementOutsidePlaceholders(span, spanOrigin, entry.replacement, (placeholder) => this.#isGeneratedPlaceholder(placeholder))
+                            : this.#redactRegexMatchOutsidePlaceholders(span, spanOrigin, entry.regex, match.scanContext);
+                        result = replaceRange(result, match.start, replaceEnd, redacted.text);
+                        origin = replaceRange(origin, match.start, replaceEnd, redacted.origin);
+                    }
+                    else {
+                        const replacement = entry.replacement ?? match.defaultReplacement;
+                        if (replacement === undefined) {
+                            throw new Error("regex replace match missing a generated replacement");
+                        }
+                        result = replaceRange(result, match.start, match.end, replacement);
+                        origin = replaceRange(origin, match.start, match.end, "I".repeat(replacement.length));
+                    }
+                }
+                else {
+                    if (match.scanMatchLength < MIN_OBFUSCATE_SECRET_LEN) {
+                        // Tone down short regex matches to avoid obfuscating small
+                        // words/fragments. Measure the regex's own match length in the
+                        // canonical (placeholder-expanded) scan view, not the rewritten
+                        // source span, so the threshold reflects how much content the regex
+                        // actually matched.
+                        continue;
+                    }
+                    if (match.preserveInputPlaceholders) {
+                        // The match straddled a prior-call placeholder. When the placeholder's
+                        // own value already satisfies the regex on its own AND the surrounding
+                        // raw bytes do not independently match, those bytes are greedy spillover
+                        // (e.g. the trailing `A` in `SECRETUV→#…#A`): obfuscating them mints
+                        // fresh placeholders on re-obfuscation and drifts the provider-visible
+                        // history and prompt-cache prefix. Leave the placeholder atomic and the
+                        // spillover verbatim — a fixed point. Outside bytes are still obfuscated
+                        // when the placeholder value alone cannot match (they are structurally
+                        // part of the secret, e.g. an `api_key=` prefix the regex requires) or
+                        // when they independently match the regex on their own.
+                        if (match.inputPlaceholderInnerIndependentlyMatches &&
+                            !match.inputPlaceholderOutsideIndependentlyMatches) {
+                            continue;
+                        }
+                        const span = result.slice(match.start, match.end);
+                        const spanOrigin = origin.slice(match.start, match.end);
+                        const obfuscated = this.#obfuscateOutsidePlaceholdersTracked(span, spanOrigin, entry.friendlyName);
+                        result = replaceRange(result, match.start, match.end, obfuscated.text);
+                        origin = replaceRange(origin, match.start, match.end, obfuscated.origin);
+                        continue;
+                    }
+                    // obfuscate mode — get or create stable index
+                    let index = this.#findObfuscateIndex(match.canonicalValue);
+                    if (index === undefined) {
+                        index = this.#nextIndex++;
+                        const placeholder = this.#createPlaceholder(match.canonicalValue, entry.friendlyName, match.recursive);
+                        this.#obfuscateMappings.set(index, { secret: match.canonicalValue, placeholder });
+                        this.#generatedPlaceholders.add(placeholder);
+                    }
+                    const mapping = this.#obfuscateMappings.get(index);
+                    const placeholder = this.#placeholderForCurrentInput(mapping.placeholder);
+                    result = replaceRange(result, match.start, match.end, placeholder);
+                    origin = replaceRange(origin, match.start, match.end, "F".repeat(placeholder.length));
+                }
+            }
+            if (entry.mode === "replace") {
+                for (const secretValue of this.#collectRegexSecretValues(result)) {
+                    this.#currentRegexSecretValues.add(secretValue);
+                }
+            }
+        }
+        ({ text: result, origin } = this.#stabilizeReplaceRegexPlaceholderSpillover(result, origin));
+        this.#currentRegexSecretValues = new Set();
+        return result;
+    }
+    /** Deobfuscate keyed placeholders for provider output, tool-call arguments, replay, and display. */
+    deobfuscate(text) {
+        return this.#deobfuscate(text);
+    }
+    // Reverse-direction counterpart to `#isGeneratedPlaceholder`'s guard: the
+    // bare-alias fallback below intentionally accepts ANY prefix so a
+    // placeholder minted under a renamed friendly name still deobfuscates
+    // (see `#prefixIsSecretShaped`'s docstring for why), but unconditionally
+    // stripping and ignoring an attacker-authored prefix would let a forged
+    // token like `$$GITHUBPATABC123_<suffix-copied-from-any-real-placeholder>$$`
+    // restore to that OTHER secret's raw value with no check at all — worse
+    // than the obfuscate-direction leak, since deobfuscation is what feeds
+    // tool-call arguments and provider-output restoration. Refuse the
+    // fallback (leave the token as opaque, unresolved text) when the prefix
+    // is itself secret-shaped; an exact full-token match is unaffected, since
+    // that was minted by this instance and carries no forgery risk.
+    #lookupLiveAlias(placeholder) {
+        const direct = this.#deobfuscateMap.get(placeholder);
+        if (direct !== undefined)
+            return direct;
+        const body = placeholder.slice(2, -2);
+        const match = /^([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)$/.exec(body);
+        if (match === null || this.#prefixIsSecretShaped(match[1]))
+            return undefined;
+        return this.#deobfuscateMap.get(`$$${match[2]}$$`);
+    }
+    #deobfuscate(text) {
+        if (!this.#hasAny || !text.includes("$$"))
+            return text;
+        let result = text;
+        for (;;) {
+            let shouldContinue = false;
+            const next = result.replace(PLACEHOLDER_RE, (match) => {
+                const mapped = this.#lookupLiveAlias(match);
+                if (mapped !== undefined) {
+                    shouldContinue ||= mapped.recursive;
+                    return mapped.secret;
+                }
+                return match;
+            });
+            if (next === result || !shouldContinue || !next.includes("$$"))
+                return next;
+            result = next;
+        }
+    }
+    /** Deep-walk an object, deobfuscating string values for LIVE paths (keyed placeholders only). */
+    deobfuscateObject(obj) {
+        if (!this.#hasAny)
+            return obj;
+        return deepWalkStrings(obj, (s) => this.deobfuscate(s));
+    }
+    /** Deep-walk an object, obfuscating all string values. */
+    obfuscateObject(obj) {
+        if (!this.#hasAny)
+            return obj;
+        return deepWalkStrings(obj, (s) => this.obfuscate(s));
+    }
+    #generateReplacement(chunk) {
+        // Redact a per-chunk remainder to a marker that is a fixed point under
+        // re-redaction on ANY obfuscator sharing the key, so persisted obfuscated text
+        // — and the provider prompt-cache prefixes it anchors — never drifts across a
+        // restart. The marker keeps the `Z`/`ZZ` sentinel prefix (already a fixed point
+        // for <=2-char remainders) and, for longer remainders, a key-derived run that
+        // depends ONLY on the key and length. A fresh obfuscator reproduces the
+        // identical marker (so re-redacting it stays idempotent across restarts, where
+        // the content-derived chunk plus the session-local `#generatedReplaceChunks`
+        // were not), yet the run is unpredictable without the per-install key, so raw
+        // remainder bytes that merely look sentinel-shaped (e.g. `ZZZZ`) cannot equal
+        // the marker and are still redacted instead of passed through.
+        const replacement = chunk.length <= 2
+            ? "Z".repeat(chunk.length)
+            : `ZZ${buildKeyedReplacementRun(this.#getKey(), chunk.length - 2)}`;
+        this.#generatedReplaceChunks.add(replacement);
+        return replacement;
+    }
+    /**
+     * Replacement for a whole CONFIGURED secret value (a plain replace-mode entry
+     * or the redacted key). Unlike a per-chunk remainder redaction, the output
+     * must differ from the input so a value equal to the `Z`/`ZZ` sentinel is not
+     * emitted verbatim. A plain secret only matches its own literal, so the
+     * perturbed output stays a fixed point under re-obfuscation.
+     */
+    #generateSecretReplacement(secret) {
+        const replacement = ensureDistinctReplacement(generateDeterministicReplacement(secret), secret);
+        this.#generatedReplaceChunks.add(replacement);
+        return replacement;
+    }
+    /**
+     * Replacement for a default (no custom replacement) regex match. The output must
+     * be a fixed point under re-obfuscation: a regex can re-match its own replacement,
+     * and a later obfuscate() pass would then re-redact it — at best churning the
+     * provider-visible text, at worst oscillating back to the raw matched value. The
+     * deterministic replacement already differs from most values, but it is
+     * all-alphanumeric and a regex may still match it, either directly (a `Z`/`ZZ`
+     * sentinel collision, or a class like `[A-Za-z0-9]+`) or only in context
+     * (lookbehind/lookahead/`\b`, e.g. `(?<=api=)[AZ]`). When it would re-match,
+     * search same-length candidates IN CONTEXT for one the regex does not re-match:
+     * that value is a stable fixed point and cannot re-leak. A single perturbation is
+     * not enough — it may also match (e.g. `B`, not `A`, for `Z|A`) — so the search
+     * tries further candidates before giving up. When no candidate avoids the regex (a
+     * pathological match-everything config such as `.`/`[\s\S]`), the content-hash
+     * deterministic value is NOT usable as a fallback: it will itself be re-matched on
+     * the next pass, and because it is derived from the bytes being replaced, rehashing
+     * those bytes (the marker itself, not the original secret) produces a DIFFERENT
+     * value — churning the redaction, and the provider prompt-cache prefix it anchors,
+     * across every re-obfuscation. Fall back instead to a marker that depends only
+     * on `this.#key` and the value's length, not its content, so re-matching and
+     * re-redacting it reproduces the IDENTICAL marker every time, which the
+     * pathological case requires since no value can escape the regex at all. This
+     * cannot reuse `#generateReplacement`'s own <=2-char branch directly: that
+     * branch is the fixed `Z`/`ZZ` sentinel, which is itself a value this fallback
+     * could be asked to replace (an input of exactly `Z` or `ZZ`), and returning it
+     * unchanged would ship the raw secret to the provider — the exact failure plain
+     * replace-mode secrets avoid via `ensureDistinctReplacement`. Neither
+     * `ensureDistinctReplacement`'s single-char flip NOR a length-changing marker is
+     * usable here: a pathological regex re-matches ANY same-length value, including
+     * a flipped one, so a value-dependent flip oscillates between the two forever;
+     * and a regex with no quantifier (matching one input character per match, e.g.
+     * `.`) re-scans a LONGER marker as several independent same-regex matches on the
+     * next pass, re-expanding each one — unbounded growth, not a fixed point. Use a
+     * SAME-LENGTH keyed run instead of the sentinel for <=2 chars: content-independent
+     * (so it is trivially its own fixed point once emitted) and no longer a public,
+     * install-independent constant, closing the specific guessable collision
+     * (`Z`/`ZZ`) the sentinel had. A same-length, content-independent marker cannot
+     * mathematically rule out equaling some pathological input by construction (the
+     * marker is itself a same-length string a match-everything regex also matches),
+     * but that residual case now requires guessing this install's private key rather
+     * than a universal constant — the same class of accepted risk
+     * `generateDeterministicReplacement`'s hash collision already carries for longer
+     * values.
+     * A regex that is UNCONDITIONALLY pathological for a length <= 2 — matching
+     * literally every candidate in isolation, independent of context, like `.`
+     * or `[\s\S]` — is now rejected at construction/config-load time instead
+     * (see `regexHasUnresolvableShortMatchFallback`), since for that narrow
+     * case the residual risk above is fully avoidable rather than merely
+     * unlikely. This branch, and the residual risk above, still applies to a
+     * length > 2 pathological config and to a length <= 2 pattern that is only
+     * pathological in a SPECIFIC match's surrounding context (the
+     * construction-time check tests the regex in isolation, not every context
+     * it could appear in).
+     */
+    #generateRegexReplacement(value, regex, context) {
+        let replacement = generateDeterministicReplacement(value);
+        // Verify in context, not just against the sentinel collision: the
+        // deterministic replacement is all-alphanumeric and a context-sensitive regex
+        // (lookbehind/lookahead/`\b`) can re-match it even when it differs from the
+        // value, so a later pass would re-redact and could oscillate back to the raw
+        // secret. Search for a candidate the regex does not re-match in place.
+        if (replacement === value || regexRematchesInContext(replacement, regex, context)) {
+            const stable = findNonMatchingReplacement(value, regex, context);
+            // See docstring above: same-length keyed run for <=2 chars (never the
+            // `Z`/`ZZ` sentinel, which a <=2 char value could itself be), otherwise
+            // the ordinary keyed-run fallback #generateReplacement already uses.
+            replacement =
+                stable ??
+                    (value.length <= 2
+                        ? buildKeyedReplacementRun(this.#getKey(), value.length)
+                        : this.#generateReplacement(value));
+            regex.lastIndex = 0;
+        }
+        this.#generatedReplaceChunks.add(replacement);
+        return replacement;
+    }
+    #generateRegexChunkReplacement(chunk, regex, context) {
+        let replacement = this.#generateReplacement(chunk);
+        if (regexRematchesInContext(replacement, regex, context)) {
+            const stable = findNonMatchingReplacement(chunk, regex, context);
+            if (stable !== undefined) {
+                replacement = stable;
+                this.#generatedReplaceChunks.add(replacement);
+            }
+            regex.lastIndex = 0;
+        }
+        return replacement;
+    }
+    #redactRegexMatchOutsidePlaceholders(text, origin, regex, context) {
+        let scanCursor = context.start;
+        return transformOutsidePlaceholdersTracked(text, origin, (placeholder) => this.#isGeneratedPlaceholder(placeholder), (chunk) => {
+            const start = scanCursor;
+            scanCursor += chunk.length;
+            if (chunk.length === 0)
+                return "";
+            return this.#generateRegexChunkReplacement(chunk, regex, {
+                text: context.text,
+                start,
+                end: scanCursor,
+            });
+        }, (placeholder) => {
+            scanCursor +=
+                lookupFriendlyPlaceholderAlias(this.#deobfuscateMap, placeholder)?.secret.length ?? placeholder.length;
+            return placeholder;
+        });
+    }
+    #stabilizeReplaceRegexPlaceholderSpillover(text, origin) {
+        let result = text;
+        let currentOrigin = origin;
+        for (const entry of this.#regexEntries) {
+            if (entry.mode !== "replace" || entry.replacement !== undefined)
+                continue;
+            entry.regex.lastIndex = 0;
+            const matches = this.#collectRegexMatches(result, entry.regex, entry.mode, currentOrigin, entry.replacement);
+            entry.regex.lastIndex = 0;
+            for (const match of matches) {
+                if (!match.preserveGeneratedPlaceholders)
+                    continue;
+                if (match.preserveInputPlaceholders &&
+                    entry.replacement === undefined &&
+                    match.inputPlaceholderOutsideChunkCount === 1 &&
+                    match.inputPlaceholderOutsideStart >= 0 &&
+                    currentOrigin
+                        .slice(match.inputPlaceholderOutsideStart, match.inputPlaceholderOutsideStart + match.inputPlaceholderOutside.length)
+                        .includes("F") &&
+                    this.#generatedReplaceChunks.has(match.inputPlaceholderOutside)) {
+                    continue;
+                }
+                if (match.inputPlaceholderInnerIndependentlyMatches && !match.inputPlaceholderOutsideIndependentlyMatches) {
+                    continue;
+                }
+                const span = result.slice(match.start, match.end);
+                const spanOrigin = currentOrigin.slice(match.start, match.end);
+                const redacted = entry.replacement !== undefined
+                    ? redactWithFixedReplacementOutsidePlaceholders(span, spanOrigin, entry.replacement, (placeholder) => this.#isGeneratedPlaceholder(placeholder))
+                    : this.#redactRegexMatchOutsidePlaceholders(span, spanOrigin, entry.regex, match.scanContext);
+                if (redacted.text === span)
+                    continue;
+                result = replaceRange(result, match.start, match.end, redacted.text);
+                currentOrigin = replaceRange(currentOrigin, match.start, match.end, redacted.origin);
+            }
+        }
+        return { text: result, origin: currentOrigin };
+    }
+    /** Find the obfuscate index for a known secret value. */
+    #findObfuscateIndex(secret) {
+        // Check plain mappings first
+        const plainIndex = this.#plainMappings.get(secret);
+        if (plainIndex !== undefined)
+            return plainIndex;
+        // Check regex-discovered mappings
+        for (const [index, mapping] of this.#obfuscateMappings) {
+            if (mapping.secret === secret)
+                return index;
+        }
+        return undefined;
+    }
+    #createPlaceholder(secret, friendlyName, recursive = false) {
+        const hint = inferCaseHint(secret);
+        // Key the base on the EXACT secret value, never a case-folded form. The
+        // case hint is only a model-visible label. If two distinct secrets that
+        // differ solely by ASCII case shared one case-folded base, a provider that
+        // saw one placeholder could swap the hint to synthesize the sibling
+        // secret's keyed token, and live deobfuscation (provider output / tool-call
+        // args) would restore a value that was never provider-visible. Exact-value
+        // keying gives every secret an independent base, so a sibling token cannot
+        // be derived without the per-install key.
+        const baseKey = secret;
+        // A friendly name that embeds a configured secret's literal (or matches a
+        // configured regex pattern) would bake that secret straight into a
+        // LEGITIMATE, exact-registered placeholder — later scans recognize the
+        // whole token as already-generated on an EXACT match, before the
+        // alias-fallback prefix check above ever runs, so the embedded secret
+        // would never be scanned. Drop the label for this mint rather than risk
+        // it; the secret still gets a bare (unprefixed) placeholder. The collision
+        // check runs against the FULL normalized label — `sanitizeForCollisionCheck`,
+        // not yet capped at `MAX_FRIENDLY_NAME_LEN` — so a secret longer than the
+        // 32-char display cap (or one whose sanitized form exceeds it) still gets
+        // caught: a truncated `requestedFriendlyName` can never contain a longer
+        // secret's full sanitized form, so checking the truncated label would let
+        // the secret's first 32 (post-cap) characters leak as an accepted prefix.
+        const requestedFriendlyName = friendlyName ? sanitizeSecretFriendlyName(friendlyName) : undefined;
+        const sanitizedFriendlyName = requestedFriendlyName !== undefined &&
+            friendlyName !== undefined &&
+            !this.#friendlyNameCollidesWithSecret(sanitizeForCollisionCheck(friendlyName), friendlyName, secret)
+            ? requestedFriendlyName
+            : undefined;
+        const preferredBase = this.#resolvePreferredPlaceholderBase(baseKey);
+        const preferredPlaceholder = buildPlaceholder(hint, preferredBase, sanitizedFriendlyName);
+        if (!this.#placeholderConflicts(preferredPlaceholder, secret)) {
+            this.#registerDeobfuscationAlias(preferredPlaceholder, secret, recursive);
+            return preferredPlaceholder;
+        }
+        for (let attempt = 1;; attempt++) {
+            const fallbackBase = this.#reserveFallbackPlaceholderBase(baseKey, attempt);
+            const placeholder = buildPlaceholder(hint, fallbackBase, sanitizedFriendlyName);
+            if (!this.#placeholderConflicts(placeholder, secret)) {
+                this.#registerDeobfuscationAlias(placeholder, secret, recursive);
+                return placeholder;
+            }
+        }
+    }
+    #resolvePreferredPlaceholderBase(baseKey) {
+        const existing = this.#placeholderBaseByKey.get(baseKey);
+        if (existing !== undefined)
+            return existing;
+        for (let attempt = 0;; attempt++) {
+            const base = attempt === 0
+                ? buildHashBase(this.#getKey(), baseKey)
+                : buildHashBase(this.#getKey(), `${baseKey}\0${attempt}`);
+            const owner = this.#placeholderBaseOwners.get(base);
+            if (owner !== undefined && owner !== baseKey)
+                continue;
+            this.#placeholderBaseOwners.set(base, baseKey);
+            this.#placeholderBaseByKey.set(baseKey, base);
+            return base;
+        }
+    }
+    #reserveFallbackPlaceholderBase(baseKey, startAttempt) {
+        for (let attempt = startAttempt;; attempt++) {
+            const owner = `${baseKey}\0collision\0${attempt}`;
+            const base = buildHashBase(this.#getKey(), `${baseKey}\0collision\0${attempt}`);
+            if (this.#placeholderBaseOwners.has(base))
+                continue;
+            this.#placeholderBaseOwners.set(base, owner);
+            return base;
+        }
+    }
+    #placeholderCollides(placeholder, secret) {
+        const existing = this.#deobfuscateMap.get(placeholder);
+        return existing !== undefined && existing.secret !== secret;
+    }
+    // A friendly placeholder is only safe if BOTH its full token and its
+    // friendly-name-independent alias are free (or already ours), AND the token
+    // itself is not another configured secret's literal value. Without the
+    // latter check, a placeholder minted for secret A that happens to equal
+    // secret B's raw content passes silently: B's own plain-secret redaction
+    // pass (sorted by length, run once per obfuscate() call) already completed
+    // before A's placeholder existed in the text, so B is never redacted out of
+    // it — A's placeholder becomes a verbatim, provider-visible copy of B.
+    #placeholderConflicts(placeholder, secret) {
+        if (this.#placeholderCollides(placeholder, secret))
+            return true;
+        if (this.#configuredSecretValues.has(placeholder) && placeholder !== secret)
+            return true;
+        const unprefixed = placeholderWithoutFriendlyName(placeholder);
+        if (unprefixed === undefined)
+            return false;
+        if (this.#placeholderCollides(unprefixed, secret))
+            return true;
+        return this.#configuredSecretValues.has(unprefixed) && unprefixed !== secret;
+    }
+    // A sanitized friendly name must not double as a live secret: it becomes a
+    // verbatim, model-visible prefix on every placeholder minted for THIS
+    // secret, baked in via an exact `#deobfuscateMap` entry rather than the
+    // alias fallback — so it needs its own check independent of the scan-skip
+    // alias guard in `#isGeneratedPlaceholder`. Reuses `#prefixIsSecretShaped`
+    // for the sanitized-vs-sanitized comparisons (configured plain secrets,
+    // every regex-discovered secret this instance has ever minted a
+    // placeholder for) and the sanitized-label-vs-regex-pattern check, then
+    // adds two label-specific checks `#prefixIsSecretShaped` cannot make: the
+    // CURRENT secret being minted right now — which, on its first-ever mint,
+    // is not yet in `#prefixIsSecretShaped`'s previously-discovered set, since
+    // that set is only populated AFTER this call returns — normalized the
+    // same way (catches, e.g., `friendlyName: "TOKABC123"` for a regex secret
+    // whose literal match is `tok_abc123`, which the sanitized-name-vs-pattern
+    // check misses when the pattern is case-sensitive/punctuated); and the RAW
+    // (pre-sanitization) label against every configured regex pattern (catches
+    // `friendlyName: "tok_abc123"` literally, which the SANITIZED label
+    // `"TOKABC123"` could never match against that same case-sensitive
+    // pattern). Any of these means the text is meant to be redacted, not
+    // stamped unredacted onto every use of this secret.
+    #collectRegexSecretValues(text) {
+        const values = new Set();
+        for (const entry of this.#regexEntries) {
+            entry.regex.lastIndex = 0;
+            for (;;) {
+                const match = entry.regex.exec(text);
+                if (match === null)
+                    break;
+                if (match[0].length === 0) {
+                    entry.regex.lastIndex++;
+                    continue;
+                }
+                values.add(match[0]);
+            }
+            entry.regex.lastIndex = 0;
+        }
+        return values;
+    }
+    collectRegexSecretValuesForObfuscation(text) {
+        const values = this.#collectRegexSecretValues(text);
+        let result = text;
+        let origin = "I".repeat(text.length);
+        for (const [secret, replacement] of [...this.#replaceMappings].sort((a, b) => b[0].length - a[0].length)) {
+            ({ text: result, origin } = this.#replaceOutsidePlaceholdersTracked(result, origin, secret, replacement, "I"));
+        }
+        for (const secretValue of this.#collectRegexSecretValues(result)) {
+            values.add(secretValue);
+        }
+        for (const secretValue of this.#collectRegexSecretValuesAfterRegexReplacements(result, origin)) {
+            values.add(secretValue);
+        }
+        return values;
+    }
+    #collectRegexSecretValuesAfterRegexReplacements(text, origin) {
+        const values = new Set();
+        let simulated = text;
+        let simulatedOrigin = origin;
+        for (const entry of this.#regexEntries) {
+            if (entry.mode !== "replace")
+                continue;
+            entry.regex.lastIndex = 0;
+            const matches = this.#collectRegexMatches(simulated, entry.regex, entry.mode, simulatedOrigin, entry.replacement);
+            entry.regex.lastIndex = 0;
+            if (matches.length === 0)
+                continue;
+            for (const match of [...matches].sort((a, b) => b.start - a.start)) {
+                const replacement = entry.replacement ?? match.defaultReplacement;
+                if (replacement === undefined)
+                    continue;
+                for (const secretValue of this.#collectRegexSecretValues(replacement)) {
+                    values.add(secretValue);
+                }
+                simulated = replaceRange(simulated, match.start, match.end, replacement);
+                simulatedOrigin = replaceRange(simulatedOrigin, match.start, match.end, "I".repeat(replacement.length));
+            }
+            for (const secretValue of this.#collectRegexSecretValues(simulated)) {
+                values.add(secretValue);
+            }
+        }
+        return values;
+    }
+    #friendlyNameCollidesWithSecret(sanitizedName, rawName, secret) {
+        if (this.#prefixIsSecretShaped(sanitizedName))
+            return true;
+        const sanitizedSecretValue = sanitizeForCollisionCheck(secret);
+        if (sanitizedLabelCollidesWithSecret(sanitizedName, sanitizedSecretValue))
+            return true;
+        for (const entry of this.#regexEntries) {
+            entry.regex.lastIndex = 0;
+            const matches = entry.regex.test(rawName);
+            entry.regex.lastIndex = 0;
+            if (matches)
+                return true;
+        }
+        return false;
+    }
+    #placeholderForCurrentInput(placeholder) {
+        const unprefixed = placeholderWithoutFriendlyName(placeholder);
+        if (unprefixed === undefined)
+            return placeholder;
+        const match = /^([A-Z0-9]+)_/.exec(placeholder.slice(2, -2));
+        if (match === null || !this.#prefixIsSecretShaped(match[1]))
+            return placeholder;
+        return unprefixed;
+    }
+    #stripUnsafeFriendlyPrefixes(text, origin) {
+        PLACEHOLDER_RE.lastIndex = 0;
+        let result = "";
+        let resultOrigin = "";
+        let cursor = 0;
+        for (;;) {
+            const match = PLACEHOLDER_RE.exec(text);
+            if (match === null)
+                break;
+            const placeholder = match[0];
+            const unprefixed = placeholderWithoutFriendlyName(placeholder);
+            const replacement = unprefixed !== undefined ? this.#placeholderForCurrentInput(placeholder) : placeholder;
+            if (replacement === placeholder) {
+                resumePlaceholderScanAfterRejectedCandidate(match);
+                continue;
+            }
+            result += text.slice(cursor, match.index);
+            resultOrigin += origin.slice(cursor, match.index);
+            result += replacement;
+            resultOrigin += origin[match.index]?.repeat(replacement.length) ?? "";
+            cursor = match.index + placeholder.length;
+        }
+        result += text.slice(cursor);
+        resultOrigin += origin.slice(cursor);
+        return { text: result, origin: resultOrigin };
+    }
+    stripUnsafeFriendlyPlaceholderPrefixes(text, sharedRegexSecretValues) {
+        const previousRegexSecretValues = this.#currentRegexSecretValues;
+        this.#currentRegexSecretValues = new Set(sharedRegexSecretValues);
+        try {
+            return this.#stripUnsafeFriendlyPrefixes(text, "I".repeat(text.length)).text;
+        }
+        finally {
+            this.#currentRegexSecretValues = previousRegexSecretValues;
+        }
+    }
+    #registerDeobfuscationAlias(placeholder, secret, recursive) {
+        const existing = this.#deobfuscateMap.get(placeholder);
+        if (existing === undefined || existing.secret === secret) {
+            this.#deobfuscateMap.set(placeholder, { secret, recursive });
+        }
+        const unprefixed = placeholderWithoutFriendlyName(placeholder);
+        if (unprefixed !== undefined) {
+            const existingUnprefixed = this.#deobfuscateMap.get(unprefixed);
+            if (existingUnprefixed === undefined || existingUnprefixed.secret === secret) {
+                this.#deobfuscateMap.set(unprefixed, { secret, recursive });
+            }
+        }
+    }
+    // Whether an alnum-only, uppercase friendly-name-shaped prefix dropped from
+    // a candidate placeholder token is itself something that should have been
+    // redacted, rather than an arbitrary label: a sanitized form of a
+    // configured plain secret's value, a sanitized form of any regex-
+    // discovered secret's value this instance has ever minted a placeholder
+    // for, or text a configured regex pattern matches directly. Shared by the
+    // obfuscate-direction guard below and the deobfuscate-direction bare-alias
+    // guard in `#deobfuscate` — both fall back to a friendly-name-independent
+    // alias keyed only by the hash suffix, so both need the same defense
+    // against a forged/attacker-chosen prefix.
+    #prefixIsSecretShaped(prefix) {
+        for (const secretValue of this.#configuredSecretValues) {
+            const sanitizedSecret = sanitizeForCollisionCheck(secretValue);
+            if (sanitizedLabelCollidesWithSecret(prefix, sanitizedSecret))
+                return true;
+        }
+        for (const secretValue of this.#currentRegexSecretValues) {
+            const sanitizedSecret = sanitizeForCollisionCheck(secretValue);
+            if (sanitizedLabelCollidesWithSecret(prefix, sanitizedSecret))
+                return true;
+        }
+        for (const { secret } of this.#obfuscateMappings.values()) {
+            const sanitizedSecret = sanitizeForCollisionCheck(secret);
+            if (sanitizedLabelCollidesWithSecret(prefix, sanitizedSecret))
+                return true;
+        }
+        for (const entry of this.#regexEntries) {
+            entry.regex.lastIndex = 0;
+            const matches = entry.regex.test(prefix);
+            entry.regex.lastIndex = 0;
+            if (matches)
+                return true;
+        }
+        return false;
+    }
+    // A placeholder is an exact match, or the friendly-name-independent bare
+    // alias: needed so a placeholder minted under a NOW-renamed friendly name
+    // (same secret, same key, different `secrets.yml` label) still round-trips
+    // when older provider-visible text is re-scanned by a renamed-config
+    // instance — the hash suffix is a keyed digest of the secret VALUE alone,
+    // so a same-key instance recomputes it identically regardless of the
+    // label. The dropped prefix is otherwise unconstrained text, though: an
+    // attacker who has observed ANY live placeholder's hash suffix elsewhere
+    // in the transcript could wrap it around a DIFFERENT real secret's
+    // plaintext (or a normalized rendering of one) to make the whole token
+    // look pre-redacted and smuggle that secret through untouched.
+    // `#prefixIsSecretShaped` above guards against that, shared with the
+    // deobfuscate-direction check in `#deobfuscate`.
+    #isGeneratedPlaceholder(placeholder) {
+        if (this.#deobfuscateMap.has(placeholder))
+            return true;
+        const match = /^([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)$/.exec(placeholder.slice(2, -2));
+        if (match === null)
+            return false;
+        if (this.#prefixIsSecretShaped(match[1]))
+            return false;
+        return this.#deobfuscateMap.has(`$$${match[2]}$$`);
+    }
+    // Replace `search` with `replacement` outside known generated placeholders while
+    // maintaining a parallel `origin` tag string (one char per result char): kept
+    // bytes keep their tag, inserted `replacement` bytes get `tag`, and preserved
+    // placeholder spans keep their original tags. Lets later passes tell prior-call
+    // placeholders ("I") from ones freshly inserted this call ("F") by RANGE.
+    #replaceOutsidePlaceholdersTracked(text, origin, search, replacement, tag) {
+        if (search.length === 0)
+            return { text, origin };
+        PLACEHOLDER_RE.lastIndex = 0;
+        let outText = "";
+        let outOrigin = "";
+        let pending = 0;
+        const emitChunk = (from, to) => {
+            let last = from;
+            let idx = text.indexOf(search, from);
+            while (idx !== -1 && idx + search.length <= to) {
+                outText += text.slice(last, idx) + replacement;
+                outOrigin += origin.slice(last, idx) + tag.repeat(replacement.length);
+                last = idx + search.length;
+                idx = text.indexOf(search, last);
+            }
+            outText += text.slice(last, to);
+            outOrigin += origin.slice(last, to);
+        };
+        for (;;) {
+            const match = PLACEHOLDER_RE.exec(text);
+            if (match === null)
+                break;
+            if (!(this.#isGeneratedPlaceholder(match[0]) && match[0] !== search)) {
+                resumePlaceholderScanAfterRejectedCandidate(match);
+                continue;
+            }
+            emitChunk(pending, match.index);
+            outText += match[0];
+            outOrigin += origin.slice(match.index, match.index + match[0].length);
+            pending = match.index + match[0].length;
+        }
+        emitChunk(pending, text.length);
+        return { text: outText, origin: outOrigin };
+    }
+    #placeholderForRegexChunk(secret, friendlyName) {
+        let index = this.#findObfuscateIndex(secret);
+        if (index === undefined) {
+            index = this.#nextIndex++;
+            const placeholder = this.#createPlaceholder(secret, friendlyName);
+            this.#obfuscateMappings.set(index, { secret, placeholder });
+            this.#generatedPlaceholders.add(placeholder);
+        }
+        return this.#placeholderForCurrentInput(this.#obfuscateMappings.get(index).placeholder);
+    }
+    #obfuscateOutsidePlaceholdersTracked(text, origin, friendlyName) {
+        PLACEHOLDER_RE.lastIndex = 0;
+        let outText = "";
+        let outOrigin = "";
+        let pending = 0;
+        const emitChunk = (from, to) => {
+            if (from >= to)
+                return;
+            const placeholder = this.#placeholderForRegexChunk(text.slice(from, to), friendlyName);
+            outText += placeholder;
+            outOrigin += "F".repeat(placeholder.length);
+        };
+        for (;;) {
+            const match = PLACEHOLDER_RE.exec(text);
+            if (match === null)
+                break;
+            if (!this.#isGeneratedPlaceholder(match[0])) {
+                resumePlaceholderScanAfterRejectedCandidate(match);
+                continue;
+            }
+            emitChunk(pending, match.index);
+            outText += match[0];
+            outOrigin += origin.slice(match.index, match.index + match[0].length);
+            pending = match.index + match[0].length;
+        }
+        emitChunk(pending, text.length);
+        return { text: outText, origin: outOrigin };
+    }
+    #knownPlaceholderRanges(text) {
+        PLACEHOLDER_RE.lastIndex = 0;
+        const ranges = [];
+        for (;;) {
+            const match = PLACEHOLDER_RE.exec(text);
+            if (match === null)
+                break;
+            if (this.#isGeneratedPlaceholder(match[0])) {
+                ranges.push({ start: match.index, end: match.index + match[0].length });
+            }
+            else {
+                resumePlaceholderScanAfterRejectedCandidate(match);
+            }
+        }
+        return ranges;
+    }
+    #collectRegexMatches(text, regex, mode, origin, replacement) {
+        const knownPlaceholderRanges = this.#knownPlaceholderRanges(text);
+        const regexScan = buildReplaceRegexScan(text, knownPlaceholderRanges, this.#deobfuscateMap);
+        const scanText = regexScan.text;
+        regex.lastIndex = 0;
+        const matches = [];
+        for (;;) {
+            const match = regex.exec(scanText);
+            if (match === null)
+                break;
+            if (match[0].length === 0) {
+                regex.lastIndex++;
+                continue;
+            }
+            let start = match.index;
+            let end = match.index + match[0].length;
+            let scanMatchLength = match[0].length;
+            let scanMatchValue = match[0];
+            let canonicalValue = "";
+            let recursive = false;
+            let preserveGeneratedPlaceholders = false;
+            let preserveInputPlaceholders = false;
+            let inputPlaceholderOutside = "";
+            let inputPlaceholderOutsideIndependentlyMatches = false;
+            let inputPlaceholderOutsideStart = -1;
+            let inputPlaceholderOutsideChunkCount = 0;
+            let inputPlaceholderInnerIndependentlyMatches = false;
+            let mapped = mapReplaceRegexMatch(regexScan.segments, start, end);
+            if (mapped.partialPlaceholderCut) {
+                // The match straddles a generated placeholder (its boundary falls inside
+                // the secret's expanded value). Rewriting across the token drops bytes
+                // (obfuscate) or drifts the redaction across re-obfuscation passes
+                // (replace), so the cut secret must stay as its existing placeholder.
+                // But wholly-outside bytes on either side of the placeholder are still
+                // provider-visible content covered by the regex. Probe the prefix against
+                // the full expanded scan text so right-hand context supplied by the
+                // placeholder still satisfies lookahead/alternatives, then clamp the
+                // accepted match to the prefix boundary. If no prefix is available, redact
+                // the outside suffix that was covered by the full-context match. Every
+                // resume point computed below is chained through
+                // `extendPastAdjacentPlaceholders`: a resume position that lands exactly on
+                // the START of ANOTHER placeholder must skip that one too before a fresh
+                // `regex.exec` attempt runs there, so a run of adjacent placeholders resolves
+                // identically whether its LEADING member is raw text this call is about to
+                // placeholder or is already a placeholder from a prior call/pass (see that
+                // helper's doc for the cross-call drift this prevents).
+                const cutResumeIndex = mapped.cutResumeIndex;
+                const prefixScanEnd = mapped.firstPlaceholderScanStart;
+                let handledOutside = false;
+                if (prefixScanEnd > match.index) {
+                    regex.lastIndex = match.index;
+                    const prefixMatch = regex.exec(scanText);
+                    if (prefixMatch !== null && prefixMatch[0].length > 0 && prefixMatch.index < prefixScanEnd) {
+                        const prefixStart = prefixMatch.index;
+                        const prefixEnd = Math.min(prefixMatch.index + prefixMatch[0].length, prefixScanEnd);
+                        const prefixMapped = mapReplaceRegexMatch(regexScan.segments, prefixStart, prefixEnd);
+                        if (!prefixMapped.partialPlaceholderCut && prefixEnd > prefixStart) {
+                            start = prefixStart;
+                            end = prefixEnd;
+                            scanMatchValue = scanText.slice(prefixStart, prefixEnd);
+                            // Keep the full match length in the expanded scan view (not the
+                            // clamped prefix length) — the short-match guard below measures the
+                            // regex's own match length, so a full-size match with a short
+                            // outside-prefix remainder must not be undercounted as too short,
+                            // matching the suffix-clamp branch below.
+                            scanMatchLength = match[0].length;
+                            mapped = prefixMapped;
+                            regex.lastIndex = extendPastAdjacentPlaceholders(regexScan.segments, prefixEnd);
+                            handledOutside = true;
+                        }
+                    }
+                }
+                if (!handledOutside && cutResumeIndex < end) {
+                    const suffixStart = cutResumeIndex;
+                    const suffixEnd = end;
+                    const suffixMapped = mapReplaceRegexMatch(regexScan.segments, suffixStart, suffixEnd);
+                    if (!suffixMapped.partialPlaceholderCut) {
+                        start = suffixStart;
+                        end = suffixEnd;
+                        scanMatchValue = scanText.slice(suffixStart, suffixEnd);
+                        scanMatchLength = match[0].length;
+                        mapped = suffixMapped;
+                        regex.lastIndex = extendPastAdjacentPlaceholders(regexScan.segments, suffixEnd);
+                        handledOutside = true;
+                    }
+                }
+                if (!handledOutside) {
+                    regex.lastIndex = extendPastAdjacentPlaceholders(regexScan.segments, cutResumeIndex);
+                    continue;
+                }
+            }
+            // Scan-space coordinates of the match (placeholders expanded). The default
+            // redaction's fixed-point check must run against this expanded view — the
+            // view re-obfuscation actually scans — not the literal `#…#` text, or a
+            // redaction adjacent to a placeholder (e.g. an outside prefix before a cut
+            // secret) could drift when the placeholder expands and connects to it.
+            const scanMatchStart = start;
+            const scanMatchEnd = end;
+            let defaultReplacement;
+            start = mapped.start;
+            end = mapped.end;
+            preserveGeneratedPlaceholders = mapped.preserveGeneratedPlaceholders;
+            // A match overlapping a placeholder that arrived in the INPUT (origin tag
+            // "I" — generated by a PRIOR obfuscate() call) must preserve that
+            // placeholder atomically so repeated obfuscation stays a fixed point. If
+            // raw bytes surround it, they still need redaction; branch-specific
+            // replacement below keeps prior placeholders while covering the
+            // non-placeholder chunks.
+            const overlapsInputPlaceholder = knownPlaceholderRanges.some((range) => start < range.end && end > range.start && origin[range.start] === "I");
+            preserveInputPlaceholders = overlapsInputPlaceholder;
+            if (overlapsInputPlaceholder) {
+                const firstOutside = firstOutsidePlaceholderRange(start, end, knownPlaceholderRanges);
+                if (mode === "replace" &&
+                    replacement !== undefined &&
+                    firstOutside !== undefined &&
+                    text.slice(firstOutside.start, firstOutside.start + replacement.length) === replacement) {
+                    const expandedEnd = firstOutside.start + replacement.length;
+                    if (expandedEnd > end) {
+                        regex.lastIndex = Math.max(regex.lastIndex, match.index + match[0].length + expandedEnd - end);
+                        end = expandedEnd;
+                    }
+                }
+                inputPlaceholderOutside = textOutsidePlaceholderRanges(text, start, end, knownPlaceholderRanges);
+                inputPlaceholderOutsideStart =
+                    firstOutsidePlaceholderRange(start, end, knownPlaceholderRanges)?.start ?? -1;
+                inputPlaceholderOutsideChunkCount = countOutsidePlaceholderRanges(start, end, knownPlaceholderRanges);
+                if (inputPlaceholderOutside.length === 0)
+                    continue;
+                const resumeIndex = regex.lastIndex;
+                // Test each outside chunk in isolation rather than the concatenation of
+                // all of them: concatenating chunks that sit on either side of the
+                // placeholder erases the `#…#` token boundary between them (e.g. a
+                // prefix "ABCDEFGH" that independently matches `\b[A-Z]{8}\b` next to a
+                // placeholder, followed by a raw "I" suffix, concatenates to "ABCDEFGHI"
+                // — which does NOT match, since the boundary the placeholder provided is
+                // gone). That false negative would leave a genuinely independent,
+                // secret-shaped chunk unredacted. Each chunk is tested in BOTH its real
+                // literal-token context (where the token's own non-word boundary can
+                // complete a boundary-sensitive pattern) and the EXPANDED scan context —
+                // the same view re-obfuscation's own regex scan runs against — so a
+                // lookbehind/lookahead that only resolves once the neighboring
+                // placeholder is expanded (e.g. `(?<=ABCDEFGH)SECRET` beside a
+                // placeholder for `ABCDEFGH`) also counts as an independent match.
+                inputPlaceholderOutsideIndependentlyMatches = outsidePlaceholderRangesAnyIndependentlyMatch(text, scanText, regexScan.segments, start, end, knownPlaceholderRanges, regex);
+                // Whether the placeholder's own (deobfuscated) value satisfies the regex
+                // with the surrounding raw bytes dropped. When it does, those raw bytes
+                // are greedy spillover the match never needed (e.g. the trailing `A` in
+                // `SECRETUV→#…#A`); obfuscating them on re-obfuscation drifts the
+                // provider-visible history and prompt-cache prefix. When it does NOT
+                // (e.g. `api_key=` literal that the placeholder value alone cannot match),
+                // the outside bytes are structurally required and must be obfuscated.
+                const innerText = placeholderInnerText(text, start, end, knownPlaceholderRanges, this.#deobfuscateMap);
+                regex.lastIndex = 0;
+                inputPlaceholderInnerIndependentlyMatches = innerText.length > 0 && regex.test(innerText);
+                regex.lastIndex = resumeIndex;
+            }
+            if (mode === "replace") {
+                canonicalValue = scanMatchValue;
+                recursive = mapped.recursive;
+            }
+            else {
+                const overlappingRanges = knownPlaceholderRanges.filter((range) => start < range.end && end > range.start);
+                const containedByPlaceholder = overlappingRanges.some((range) => start >= range.start && end <= range.end);
+                if (containedByPlaceholder) {
+                    continue;
+                }
+                const canonical = deobfuscateGeneratedPlaceholderRanges(text, start, end, knownPlaceholderRanges, this.#deobfuscateMap);
+                canonicalValue = canonical.text;
+                recursive = canonical.recursive;
+            }
+            const scanContext = {
+                text: scanText,
+                start: scanMatchStart,
+                end: scanMatchEnd,
+            };
+            if (mode === "replace" && replacement === undefined && !preserveGeneratedPlaceholders) {
+                const savedLastIndex = regex.lastIndex;
+                defaultReplacement = this.#generateRegexReplacement(scanMatchValue, regex, scanContext);
+                regex.lastIndex = savedLastIndex;
+            }
+            matches.push({
+                start,
+                end,
+                value: text.slice(start, end),
+                defaultReplacement,
+                canonicalValue,
+                scanMatchLength,
+                recursive,
+                preserveGeneratedPlaceholders,
+                preserveInputPlaceholders,
+                inputPlaceholderOutside,
+                inputPlaceholderOutsideIndependentlyMatches,
+                inputPlaceholderOutsideStart,
+                inputPlaceholderOutsideChunkCount,
+                inputPlaceholderInnerIndependentlyMatches,
+                scanContext,
+            });
+        }
+        return matches.reverse();
+    }
+}
+//# sourceMappingURL=obfuscator.js.map