@inerrata-corporation/errata 2.0.14-dev.3160 → 2.0.14-dev.3165

package/errata.mjs

@@ -15493,8 +15493,6 @@ function looksLikeSecretValue(raw2, quoted) {
   if (raw2.includes("${") || raw2.includes("{{") || raw2.includes("%(")) return false;
   if (raw2.startsWith("[redacted:")) return false;
   if (quoted) return raw2.length > 0;
-  const lower = raw2.toLowerCase();
-  if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
   if (/^(?:process\.env\.|os\.environ(?:\[|\.)|(?:request|response|config|settings|options)\.)/.test(raw2)) return false;
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(/.test(raw2)) return false;
   return raw2.length > 0;
@@ -15559,75 +15557,36 @@ function scrubHistoryValue(value) {
   const clear = (input) => typeof input === "string" ? input.replace(literals, REDACTED_CREDENTIAL) : Array.isArray(input) ? input.map(clear) : input && typeof input === "object" ? Object.fromEntries(Object.entries(input).map(([k, v]) => [k, clear(v)])) : input;
   return clear(safe);
 }
-var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, ASSIGNMENT_STOPWORDS, CREDENTIAL_RULES, EMAIL_RE;
+var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, PASSWORD_PROSE_DESCRIPTORS, CREDENTIAL_RULES, EMAIL_RE;
 var init_history_text = __esm({
   "../../packages/shared/src/history-text.ts"() {
     "use strict";
-    HISTORY_SCRUBBER_VERSION = "history-scrub-4";
+    HISTORY_SCRUBBER_VERSION = "history-scrub-5";
     REDACTED_CREDENTIAL = "[redacted:credential]";
     REDACTED_EMAIL = "[redacted:email]";
     cred = () => REDACTED_CREDENTIAL;
-    ASSIGNMENT_STOPWORDS = /* @__PURE__ */ new Set([
-      "string",
-      "boolean",
-      "number",
+    PASSWORD_PROSE_DESCRIPTORS = /* @__PURE__ */ new Set([
       "required",
       "optional",
       "undefined",
       "unknown",
-      "function",
-      "process",
-      "request",
-      "response",
-      "password",
-      "secret",
-      "token",
-      "tokens",
-      "credential",
-      "credentials",
-      "bearer",
-      "basic",
-      "example",
       "redacted",
       "nullable",
-      "readonly",
-      "override",
-      "abstract",
-      "interface",
-      "constant",
-      "variable",
-      "property",
-      "parameter",
-      "argument",
-      "callback",
-      "promise",
-      "settings",
-      "options",
-      "default",
       "disabled",
       "enabled",
-      "internal",
-      "external",
-      "protected",
       "provided",
-      "resolved",
       "rejected",
-      "expected",
-      "received",
       "salt",
       "hash",
       "hashed",
-      "hashing",
-      "authentication",
-      "field",
-      "format"
+      "hashing"
     ]);
     CREDENTIAL_RULES = [
       // Human-written seed/reset notes omit assignment punctuation: password `…`
       // or password (…). Preserve names of fields and hash components.
       {
         re: /\b((?:password|passwd|passphrase|pwd)\s+)(["'`(])([^\s"'`,;)}\]]+)(["'`)])/gi,
-        replace: (m) => !ASSIGNMENT_STOPWORDS.has((m[3] ?? "").toLowerCase()) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
+        replace: (m) => !(m[2] === "(" && PASSWORD_PROSE_DESCRIPTORS.has((m[3] ?? "").toLowerCase())) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
       },
       // "with SeedValue42! credentials" and "with SeedValue42!/seeded account".
       // Require mixed-case letters plus a digit, or a password-like special char;
@@ -15657,7 +15616,7 @@ var init_history_text = __esm({
         re: /\b((?:password|passwd|passphrase|pwd)\s+(?:is|was|of)\s+)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
         replace: (m) => {
           const value = m[3] ?? "";
-          if (ASSIGNMENT_STOPWORDS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
+          if (!m[2] && PASSWORD_PROSE_DESCRIPTORS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
           return `${m[1]}${m[2]}${REDACTED_CREDENTIAL}`;
         }
       },
@@ -15693,8 +15652,9 @@ var init_history_text = __esm({
       },
       // Assignments after key-ish names: `password=...`, `API_KEY: "..."`,
       // `"client_secret": "..."`, `AWS_SECRET_ACCESS_KEY=...`, 32+ hex/base64 after
-      // any of them. The value heuristic keeps `token: string` and
-      // `password = process.env.X` intact.
+      // any of them. Recognizable expressions such as `process.env.X` survive.
+      // Bare `password: string` is ambiguous with YAML containing a literal weak
+      // password, so it is redacted. A stopword is never proof of safe code.
       {
         re: /((?:[A-Za-z0-9_.-]*?)(?:password|passwd|passphrase|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|auth[_-]?key|credential)(?:[A-Za-z0-9_-]*))(["']?\s*(?:=>|=|:)\s*)(["'`]?)([^\s"'`,;)}\]]+)/gi,
         replace: (m) => {
@@ -75865,6 +75825,7 @@ var PLACEHOLDER_HANDLES = /* @__PURE__ */ new Set([
   "b"
 ]);
 var isPlaceholderHandle = (h) => PLACEHOLDER_HANDLES.has(h.toLowerCase());
+var FLAG_BODY_HANDLE_RE = /^(?:[a-z0-9]+(?:-[a-z0-9]+){2,}-(?=[0-9a-f]{0,3}\d)[0-9a-f]{4}|(?:pat|sol|drc|dcause|dfix|dprob|prob|claim|err)_[0-9a-f]{6,})$/i;
 var FIX_PREFIX = /^\s*fix:(?:#([a-z][\w-]{0,63}))?\s*/i;
 var CONSTRAINT_RE = /\(\s*constraint:\s*([^()\n]{8,}?)\s*\)/gi;
 var CAUSE_PREFIX = /^\s*cause:(?:#([a-z][\w-]{0,63}))?\s*/i;
@@ -76040,7 +76001,8 @@ function emptyTagDispositions() {
     negated: 0,
     unparseable: 0,
     placeholderEcho: 0,
-    verdictNoHandle: 0
+    verdictNoHandle: 0,
+    flagAsHandle: 0
   };
 }
 function addTagDispositions(a, b) {
@@ -76052,6 +76014,7 @@ function addTagDispositions(a, b) {
   a.unparseable += b.unparseable;
   a.placeholderEcho += b.placeholderEcho;
   a.verdictNoHandle += b.verdictNoHandle;
+  a.flagAsHandle += b.flagAsHandle;
 }
 function parseInlineTags(text) {
   return parseInlineTagsWithDispositions(text).tags;
@@ -76287,6 +76250,11 @@ function parseInlineTagsWithDispositions(text) {
     while ((f = FLAG_RE.exec(sentence)) !== null) {
       const flagThread = f[2];
       const raw3 = f[3].trim();
+      if (FLAG_BODY_HANDLE_RE.test(raw3) && !f[4]) {
+        dispositions.flagAsHandle++;
+        out2.push({ kind: "prior", handle: raw3, sentence: sfield });
+        continue;
+      }
       if (raw3.length >= 8) {
         const segs = raw3.split(CAUSE_ARROW).map((s) => s.trim()).filter((s) => s.length > 0);
         const symptomRaw = segs.length > 1 ? segs[0] : raw3;
@@ -81258,7 +81226,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3160" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3165" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -82975,6 +82943,7 @@ function createWorkspaceEngine(opts) {
         // HZ-corrob-wire: a verdict group naming no resolvable handle — judged,
         // but nothing judgeable was cited.
         tagsVerdictNoHandle: dispositions.verdictNoHandle,
+        tagsFlagAsHandle: dispositions.flagAsHandle,
         unresolvedHandles,
         priorEdgesFlagOff,
         priorEdgesNoSource,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3160",
+  "version": "2.0.14-dev.3165",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {