@inerrata-corporation/errata 2.0.14-dev.3162 → 2.0.14-dev.3165

package/errata.mjs

@@ -15493,8 +15493,6 @@ function looksLikeSecretValue(raw2, quoted) {
   if (raw2.includes("${") || raw2.includes("{{") || raw2.includes("%(")) return false;
   if (raw2.startsWith("[redacted:")) return false;
   if (quoted) return raw2.length > 0;
-  const lower = raw2.toLowerCase();
-  if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
   if (/^(?:process\.env\.|os\.environ(?:\[|\.)|(?:request|response|config|settings|options)\.)/.test(raw2)) return false;
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(/.test(raw2)) return false;
   return raw2.length > 0;
@@ -15559,75 +15557,36 @@ function scrubHistoryValue(value) {
   const clear = (input) => typeof input === "string" ? input.replace(literals, REDACTED_CREDENTIAL) : Array.isArray(input) ? input.map(clear) : input && typeof input === "object" ? Object.fromEntries(Object.entries(input).map(([k, v]) => [k, clear(v)])) : input;
   return clear(safe);
 }
-var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, ASSIGNMENT_STOPWORDS, CREDENTIAL_RULES, EMAIL_RE;
+var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, PASSWORD_PROSE_DESCRIPTORS, CREDENTIAL_RULES, EMAIL_RE;
 var init_history_text = __esm({
   "../../packages/shared/src/history-text.ts"() {
     "use strict";
-    HISTORY_SCRUBBER_VERSION = "history-scrub-4";
+    HISTORY_SCRUBBER_VERSION = "history-scrub-5";
     REDACTED_CREDENTIAL = "[redacted:credential]";
     REDACTED_EMAIL = "[redacted:email]";
     cred = () => REDACTED_CREDENTIAL;
-    ASSIGNMENT_STOPWORDS = /* @__PURE__ */ new Set([
-      "string",
-      "boolean",
-      "number",
+    PASSWORD_PROSE_DESCRIPTORS = /* @__PURE__ */ new Set([
       "required",
       "optional",
       "undefined",
       "unknown",
-      "function",
-      "process",
-      "request",
-      "response",
-      "password",
-      "secret",
-      "token",
-      "tokens",
-      "credential",
-      "credentials",
-      "bearer",
-      "basic",
-      "example",
       "redacted",
       "nullable",
-      "readonly",
-      "override",
-      "abstract",
-      "interface",
-      "constant",
-      "variable",
-      "property",
-      "parameter",
-      "argument",
-      "callback",
-      "promise",
-      "settings",
-      "options",
-      "default",
       "disabled",
       "enabled",
-      "internal",
-      "external",
-      "protected",
       "provided",
-      "resolved",
       "rejected",
-      "expected",
-      "received",
       "salt",
       "hash",
       "hashed",
-      "hashing",
-      "authentication",
-      "field",
-      "format"
+      "hashing"
     ]);
     CREDENTIAL_RULES = [
       // Human-written seed/reset notes omit assignment punctuation: password `…`
       // or password (…). Preserve names of fields and hash components.
       {
         re: /\b((?:password|passwd|passphrase|pwd)\s+)(["'`(])([^\s"'`,;)}\]]+)(["'`)])/gi,
-        replace: (m) => !ASSIGNMENT_STOPWORDS.has((m[3] ?? "").toLowerCase()) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
+        replace: (m) => !(m[2] === "(" && PASSWORD_PROSE_DESCRIPTORS.has((m[3] ?? "").toLowerCase())) && looksLikeSecretValue(m[3] ?? "", true) ? `${m[1]}${m[2]}${REDACTED_CREDENTIAL}${m[4]}` : null
       },
       // "with SeedValue42! credentials" and "with SeedValue42!/seeded account".
       // Require mixed-case letters plus a digit, or a password-like special char;
@@ -15657,7 +15616,7 @@ var init_history_text = __esm({
         re: /\b((?:password|passwd|passphrase|pwd)\s+(?:is|was|of)\s+)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
         replace: (m) => {
           const value = m[3] ?? "";
-          if (ASSIGNMENT_STOPWORDS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
+          if (!m[2] && PASSWORD_PROSE_DESCRIPTORS.has(value.toLowerCase()) || value.startsWith("[redacted:") || /\$\{|\{\{|process\./.test(value)) return null;
           return `${m[1]}${m[2]}${REDACTED_CREDENTIAL}`;
         }
       },
@@ -15693,8 +15652,9 @@ var init_history_text = __esm({
       },
       // Assignments after key-ish names: `password=...`, `API_KEY: "..."`,
       // `"client_secret": "..."`, `AWS_SECRET_ACCESS_KEY=...`, 32+ hex/base64 after
-      // any of them. The value heuristic keeps `token: string` and
-      // `password = process.env.X` intact.
+      // any of them. Recognizable expressions such as `process.env.X` survive.
+      // Bare `password: string` is ambiguous with YAML containing a literal weak
+      // password, so it is redacted. A stopword is never proof of safe code.
       {
         re: /((?:[A-Za-z0-9_.-]*?)(?:password|passwd|passphrase|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|auth[_-]?key|credential)(?:[A-Za-z0-9_-]*))(["']?\s*(?:=>|=|:)\s*)(["'`]?)([^\s"'`,;)}\]]+)/gi,
         replace: (m) => {
@@ -81266,7 +81226,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3162" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3165" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3162",
+  "version": "2.0.14-dev.3165",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {