@link-foundation/sensitive-data-sanitizer 0.12.0 → 0.12.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.12.2
+
+### Patch Changes
+
+- 704c4b7: Preserve Authorization placeholders, matching brackets and control-byte boundaries. Bound repeated WASM input copies when scanning dense credentials by continuing with the existing RE2JS engine.
+
+## 0.12.1
+
+### Patch Changes
+
+- e54098b: Bound Authorization values at the scheme and credential token, preserve authentication environment configuration, and support NUL log bytes with explicit opt-in. Reset file-worker deadlines on verified progress, expose the worker timeout in the CLI, and speed up ordinary and escaped-JSON logs without removing detection rules.
+
 ## 0.12.0
 
 ### Minor Changes

package/README.md

@@ -65,7 +65,7 @@ sensitive-data-sanitizer history rewrite ./repository --output ./private-preview
 sensitive-data-sanitizer --help
 ```
 
-`--output` creates a new file without clobbering an existing one. `--in-place` replaces the input atomically after verification. Intermediate and output files use mode `0600` on POSIX. Symlinks and NUL-containing binary input are refused. Plain logs preserve invalid UTF-8 bytes exactly; JSON/JSONL and configuration files require valid UTF-8. Directory scans omit `.git` and `node_modules`; skipped binary/malformed-structured/oversized files make the report incomplete. Stdout is written after the complete operation succeeds.
+`--output` creates a new file without clobbering an existing one. `--in-place` replaces the input atomically after verification. Intermediate and output files use mode `0600` on POSIX. Symlinks are refused. NUL-containing input is refused by default; `--allow-binary` explicitly preserves NUL bytes in plain logs while credentials are still sanitized. JSON/JSONL remain strict. Plain logs preserve invalid UTF-8 bytes exactly; JSON/JSONL and configuration files require valid UTF-8. Directory scans omit `.git` and `node_modules`; skipped binary/malformed-structured/oversized files make the report incomplete. Stdout is written after the complete operation succeeds.
 
 | Exit | Meaning                                                                  |
 | ---- | ------------------------------------------------------------------------ |
@@ -73,7 +73,7 @@ sensitive-data-sanitizer --help
 | 1    | A complete scan/history audit found sensitive data                       |
 | 2    | Error, detector failure, or incomplete scan; redaction output is blocked |
 
-Defaults: 32 MiB whole-text input bytes, 100,000 findings and 10,000 files. `--stream` permits 1 GiB total with plain-text records up to the total input limit or 8 MiB JSONL records, bounded workers and atomic publication. `--max-bytes` sets the byte limit; JSON config sets the other sanitizer limits. `--paranoid` adds entropy heuristics and increases false positives. `--native-only` explicitly disables Secretlint.
+Defaults: 32 MiB whole-text input bytes, 100,000 findings and 10,000 files. `--stream` permits 1 GiB total with plain-text records up to the total input limit or 8 MiB JSONL records, bounded workers and atomic publication. `--worker-timeout-ms N` sets the worker inactivity/per-batch deadline (default 60000 ms); verified file progress resets the deadline, so large files can run longer overall. `--max-bytes` sets the byte limit; JSON config sets the other sanitizer limits. `--paranoid` adds entropy heuristics and increases false positives. `--native-only` explicitly disables Secretlint.
 
 ## Configuration
 
@@ -166,6 +166,8 @@ See [contributing](docs/CONTRIBUTING.md). `add`, `multiply` and `delay` live in
 
 The universal app's preview images regenerate on pushes to the default branch. Run `npm run example:web:preview-images` to regenerate them locally; see [the template guide](docs/TEMPLATE-PIPELINE.md) for setup.
 
+Automatic `--env-secrets` discovery skips authentication configuration names such as `GIT_AUTH_TRANSPORT`, `AUTH_MODE` and `AUTH_METHOD`. Explicit `knownSecretsFromEnv(env, names)` selections still include their exact values.
+
 For shared tool logs, `--credentials-only --env-secrets --gh-config` preserves
 public account details while redacting credential patterns and exact local
 secret values. Environment discovery matches credential-related variable names,

package/bin/sensitive-data-sanitizer.js

@@ -50,6 +50,8 @@ history rewrite SOURCE --output DIRECTORY [--apply]
 --model NAME        Installed model passed to the selected bridge
 --language CODE     Model language passed to the selected bridge
 --stream            Process text records; files use a bounded worker
+--allow-binary      Treat NUL as a log byte (plain text only)
+--worker-timeout-ms N Stream worker inactivity/per-batch limit (default 60000)
 --two-pass          Collect identities first, then publish the complete stream
 --json              Sanitize JSON strings and keys; preserve session metadata
 --jsonl             Sanitize JSONL records; combine with --stream for sessions
@@ -84,6 +86,7 @@ function parseArgs(argv) {
     ['--gitleaks', 'gitleaks'],
     ['--trufflehog', 'trufflehog'],
     ['--stream', 'stream'],
+    ['--allow-binary', 'allowBinary'],
     ['--two-pass', 'twoPass'],
     ['--json', 'json'],
     ['--jsonl', 'jsonl'],
@@ -103,6 +106,7 @@ function parseArgs(argv) {
     ['--model', 'model'],
     ['--language', 'language'],
     ['--max-record-bytes', 'maxRecordBytes'],
+    ['--worker-timeout-ms', 'workerTimeoutMs'],
     ['--filter-repo', 'filterRepo'],
     ['--profile', 'profile'],
   ]);
@@ -169,6 +173,7 @@ function validateFeatureArgs(config) {
 }
 
 function validateStructuredArgs(config) {
+  validateStreamArgs(config);
   if (config.twoPass && !config.stream) {
     throw failure('ERR_ARGUMENT');
   }
@@ -177,6 +182,26 @@ function validateStructuredArgs(config) {
   }
 }
 
+function validateStreamArgs(config) {
+  if (config.workerTimeoutMs !== undefined) {
+    config.workerTimeoutMs = Number(config.workerTimeoutMs);
+    if (
+      !config.stream ||
+      !Number.isSafeInteger(config.workerTimeoutMs) ||
+      config.workerTimeoutMs <= 0 ||
+      config.workerTimeoutMs > 2147483647
+    ) {
+      throw failure('ERR_ARGUMENT');
+    }
+  }
+  if (
+    config.allowBinary &&
+    (config.json || config.jsonl || config.command === 'history')
+  ) {
+    throw failure('ERR_ARGUMENT');
+  }
+}
+
 function validateBridge(config) {
   if (!config.presidio && (config.python || config.model || config.language)) {
     throw failure('ERR_ARGUMENT');
@@ -228,7 +253,6 @@ export async function runCli(
     }
     const config = parseArgs(argv);
     const options = await loadOptions(config);
-    config.lossless = !options.structured;
     const engine = createSanitizer(options);
     const context = { stdin, stdout };
     if (config.command === 'history') {
@@ -281,6 +305,10 @@ async function loadOptions(config) {
     options.maxInputLength ?? config.maxBytes,
     config.maxBytes
   );
+  config.lossless = !options.structured;
+  if (config.allowBinary && !config.lossless) {
+    throw failure('ERR_CONFIG');
+  }
   return options;
 }
 
@@ -350,7 +378,10 @@ function selectedDetectors(config, detectors = []) {
 }
 
 function inputText(path, config, stdin) {
-  const options = { lossless: config.lossless };
+  const options = {
+    lossless: config.lossless,
+    allowBinary: Boolean(config.allowBinary),
+  };
   return path === '-'
     ? stdinText(stdin, config.maxBytes, options)
     : readTextFile(path, config.maxBytes, options);

package/bin/stream.js

@@ -24,6 +24,8 @@ export async function streamCommand(
       maxTotalBytes: config.maxBytes,
       replace: Boolean(config.inPlace),
       twoPass: Boolean(config.twoPass),
+      allowBinary: Boolean(config.allowBinary),
+      workerTimeoutMs: config.workerTimeoutMs,
     };
     if (config.path === '-') {
       await sanitizeStreamToFile(stdin, target, {

package/docs/API.md

@@ -15,7 +15,7 @@ Import the ESM root entry; complete declarations are in `src/index.d.ts`. Inputs
 | `redact(text, findings, options)`      | Apply validated ranges without automatic detection/verification                                              |
 | `auditGitHistory(repository, options)` | Read-only audit of local reachable text objects                                                              |
 
-`redactions` counts merged replacement spans. `findings` can contain several detector hits for one replacement. Findings have `{start, end, type, category, rule, line, column}`; no text, quote, match, entropy score, provider details, or raw diagnostic is copied. Debugging is off by default; `debug(event)` receives only `{event: 'detected', count}`.
+`redactions` counts merged replacement spans. `findings` can contain several detector hits for one replacement. Findings have `{start, end, type, category, rule, line, column}`; no text, quote, match, entropy score, provider details, or raw diagnostic is copied. Debugging is off by default; `debug(event)` receives value-free counts, rule timings, residual rounds and registry event metadata (see `DebugEvent` in the TypeScript declarations).
 
 ## Options
 
@@ -34,14 +34,14 @@ Import the ESM root entry; complete declarations are in `src/index.d.ts`. Inputs
 | `maxFindings`      | 100,000 detector hits before deduplication                                                    |
 | `minConfidence`    | 0.5; personal findings below this score remain visible to inspect but are not replaced        |
 | `threshold`        | Alias for minConfidence; both options must agree when supplied                                |
-| `debug`            | Optional trusted callback for counts only                                                     |
+| `debug`            | Optional trusted callback for value-free counts, timing and event metadata                    |
 | `identityMask`     | `false`; identity types keep 2+2 Unicode characters with fixed `***`, or redact below five    |
 | `fakeIdentity`     | Off; `'specimen-and-synthetic'` retains explicitly fake identity values                       |
 | `fakeValues`       | `[]`; exact caller-reviewed identity values to retain, regardless of fakeIdentity             |
 | `structured`       | Off; `'json'` or `'jsonl'` validates and sanitizes string keys/values separately              |
 | `structuralFields` | `[]`; declared property names suppress weak name/ID/entropy heuristics in their string values |
 
-Unknown options and invalid limits are errors. `knownSecretsFromEnv(env, names?)` discovers credential-named variables when names are omitted, or uses an explicit selection, deduplicating nonempty values. It never invokes shell commands or reads auth files. `personalVariants(entries)` generates numeric and ISO/day-first date spellings; name case variants are already handled by detection. Neither helper invents transliterations.
+Unknown options and invalid limits are errors. `knownSecretsFromEnv(env, names?)` discovers credential-named variables (excluding auth configuration names) when names are omitted, or uses an explicit selection, deduplicating nonempty values. It never invokes shell commands or reads auth files. `personalVariants(entries)` generates numeric and ISO/day-first date spellings; name case variants are already handled by detection. Neither helper invents transliterations.
 
 ## Required detectors
 
@@ -188,7 +188,7 @@ await sanitizeStreamToFile(
 );
 ```
 
-`sanitizeFileToFile` rejects source symlinks and writes private temporary output, publishing only after complete verification. `sanitizeFileBounded` additionally uses a worker with a 60-second deadline and requests a 256 MiB old-generation heap and 4 MiB stack on Node (Bun ignores those resourceLimits); `workerHeapMb` and `workerTimeoutMs` are configurable. Worker failure removes its private staging directory before returning. Limits bound package work, not arbitrary external detectors. Callbacks supplied through `sanitizer` run in process; set `worker: false` explicitly to disable isolation. Pass serializable options through `sanitizerOptions` for workers. Memory limits do not include all native/WASM allocation.
+`sanitizeFileToFile` rejects source symlinks and writes private temporary output, publishing only after complete verification. `sanitizeFileBounded` additionally uses a worker with a 60-second inactivity deadline that resets after each verified batch (including discovery in two-pass mode) and requests a 256 MiB old-generation heap and 4 MiB stack on Node (Bun ignores those resourceLimits); `workerHeapMb` and `workerTimeoutMs` are configurable. `workerTimeoutMs` accepts integers from 1 to 2147483647; the CLI exposes it as `--worker-timeout-ms N`. A progressing file may take longer than that overall. One large record must finish within that interval; increase it for unusually costly records. JSONL record workers retain a per-batch deadline. In-process stdin/plain streams have no worker deadline. Worker failure removes its private staging directory before returning. Limits bound package work, not arbitrary external detectors. Callbacks supplied through `sanitizer` run in process; set `worker: false` explicitly to disable isolation. Pass serializable options through `sanitizerOptions` for workers. Memory limits do not include all native/WASM allocation.
 
 ```js
 import { sanitizeFileBounded } from '@link-foundation/sensitive-data-sanitizer';
@@ -298,7 +298,7 @@ when `names` is omitted, using
 `/(?:^|_)(?:TOKEN|(?:API|ACCESS|PRIVATE)?KEY|SECRET|PASSWORD|PASSWD|CREDENTIALS?|AUTH|PAT)(?:_|$)/i`.
 This covers `MY_SERVICE_TOKEN`, `CLAUDE_CODE_OAUTH_TOKEN`, `CODEX_API_KEY`,
 `OPENCODE_API_KEY`, `DASHSCOPE_API_KEY`, `HF_TOKEN` and `TELEGRAM_BOT_TOKEN`.
-An explicit array keeps the previous selection behavior; `[]` selects nothing.
+Automatic discovery excludes names ending in `AUTH_TRANSPORT`, `AUTH_MODE`, `AUTH_METHOD`, `AUTH_TYPE`, `AUTH_URL`, `AUTH_URI`, `AUTH_HOST`, `AUTH_HOSTNAME`, `AUTH_PATH`, `AUTH_ENABLED`, `AUTH_DISABLED`, `AUTH_PORT`, `AUTH_PROTOCOL` or `AUTH_SCHEME` (including prefixed forms such as `HIVE_MIND_GIT_AUTH_TRANSPORT`). Credential names such as `AUTH_TOKEN` still contribute their exact values, including short/low-entropy values; no value-shape filter can reliably distinguish passwords from configuration. An explicit array bypasses the name exclusions; `[]` selects nothing.
 These values are loaded only when the helper or CLI `--env-secrets` is requested.
 
 `await knownSecretsFromGitHubConfig({path?})` reads `oauth_token` and `api_token`
@@ -325,8 +325,7 @@ U+DC80–U+DCFF surrogate; `encodeLogText(string)` restores those bytes. Use the
 encoder when collecting `sanitizeStream` string output containing such bytes.
 Ordinary UTF-8 string encoding would replace them and lose information.
 `sanitizeStreamToFile` and `sanitizeFileBounded` perform the encoding themselves,
-including workers and both passes. NUL bytes still identify binary input and
-block publication. JSON/JSONL, scanner protocol files and configuration retain
+including workers and both passes. NUL bytes identify binary input and block publication by default. Plain streams accept `allowBinary: true`, and CLI file/stdin/scan/output/in-place paths accept `--allow-binary`, to preserve NUL as an ordinary byte while continuing credential detection. The opt-in is rejected for JSON/JSONL and history; it does not relax configuration/scanner validation. JSON/JSONL, scanner protocol files and configuration retain
 strict UTF-8 validation; malformed bytes cannot represent valid JSON text.
 
 Default detection keeps RFC 1918, loopback, link-local and IPv6 local addresses,
@@ -334,3 +333,5 @@ recognized auth-mode metadata, npm dependency version declarations, Actions
 permission values and literal credential references. `publicKnowledge: false`
 restores IP detection; explicit `knownSecrets` and `knownPersonal` retain
 priority. No shell command or workflow expression is executed.
+
+Authorization headers (including Proxy-Authorization) redact the scheme and one credential token. Whitespace, C0 controls (including NUL), DEL, quotes, backslashes and commas end the value, preserving subsequent log text in shell and escaped JSON prompts. Matching brackets opened within a token are included in its redaction; unmatched closing brackets remain part of the surrounding log. Already-redacted tokens and known credential references remain exempt after an optional scheme, including `<token>` placeholders. The debug callback receives value-free `gitleaks-rule` events with rule ID, input length and elapsed milliseconds; tracing is off by default.

package/docs/COVERAGE.md

@@ -6,7 +6,7 @@ Coverage is a union of maintained detectors, explicit known values, context and
 
 The native provider supplements in `src/rules.js` cover GitHub, GitLab, OpenAI, Anthropic, AWS access IDs, Google API/OAuth, Slack, Stripe, SendGrid, Twilio, npm, PyPI, Telegram, Discord, Hugging Face, Shopify, Databricks, Square, Mailchimp, DigitalOcean, Vault, Grafana, Linear, Notion, Vercel, and JWT-shaped values. Prefix matches also protect selected truncated tokens; they do not validate a token with a provider.
 
-The default native engine bundles 221 text rules from Gitleaks 8.30.1 (222 upstream rules; the path-only PKCS12 rule is outside text detection), compiled unchanged with RE2/WASM or RE2JS for inputs above 4 MiB. The MIT license, commit and sync script are retained in `src/vendor/gitleaks`. Keyword prefilters and configured entropy thresholds run natively; upstream comment/path allowlists cannot suppress a sanitizer finding. Quoted hex/base64 entropy detection supplements those rules. The default asynchronous engine additionally uses the pinned Secretlint recommended scanners, excluding its comment-filter rule. Embedded disable directives in untrusted text cannot suppress findings. Optional Gitleaks and TruffleHog invoke their installed detector sets, and custom detectors can add formats. Service counts are not a measure of comparative recall.
+The default native engine bundles 221 text rules from Gitleaks 8.30.1 (222 upstream rules; the path-only PKCS12 rule is outside text detection), compiled unchanged with RE2/WASM or RE2JS for inputs above 4 MiB. Dense rule matches switch to RE2JS after at most eight WASM matches per view, bounding repeated whole-input copies without truncating secrets or changing anchors. The MIT license, commit and sync script are retained in `src/vendor/gitleaks`. Keyword prefilters and configured entropy thresholds run natively; upstream comment/path allowlists cannot suppress a sanitizer finding. Quoted hex/base64 entropy detection supplements those rules. The default asynchronous engine additionally uses the pinned Secretlint recommended scanners, excluding its comment-filter rule. Embedded disable directives in untrusted text cannot suppress findings. Optional Gitleaks and TruffleHog invoke their installed detector sets, and custom detectors can add formats. Service counts are not a measure of comparative recall.
 
 Context rules recognize credential labels with bounded key affixes, JSON and nested escaped JSON, YAML/env/INI assignments, shell flags, XML values, URL userinfo, authorization headers, cookies, webhook paths, and complete or truncated private-key PEM blocks. Low-entropy contextual values such as `password=1234` are protected. Generic token counters, booleans/null/language literals and ordinary Git hashes are excluded to retain useful logs. Supply literal known values for ambiguous credentials or unusual key names.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
   "type": "module",
   "main": "src/index.js",

package/src/context.js

@@ -79,6 +79,10 @@ function generatedWord(text, range) {
 }
 const ignored =
   /^(?:true|false|null|undefined|await|async|function|none|nil)$/i;
+const credentialHint = new RegExp(
+  [...labels.credential, 'pass', 'pw'].map(escapePattern).join('|'),
+  'iu'
+);
 
 function emitValue(text, start, end, emit, details, keyName = '') {
   while (end > start && /[ \t\r]/.test(text[end - 1])) {
@@ -150,6 +154,39 @@ export function valueRange(text, start, mode = 'token', maxLength = Infinity) {
   const end = stop < 0 ? start + tail.length : start + stop;
   return { start, end: Math.min(end, outerQuoteEnd(text, start, end) ?? end) };
 }
+// Header credentials occupy a scheme and one token even inside shell/JSON
+// strings. A closing quote or escape belongs to the surrounding log record.
+export function authorizationRange(text, start) {
+  const opening = /^(\\*)(["'])/.exec(text.slice(start));
+  start += opening?.[0].length ?? 0;
+  const reference = referencePrefix(text.slice(start, start + 512));
+  if (reference) {
+    return { start, end: start + reference[0].length };
+  }
+  const scheme = /^[a-z][a-z0-9_-]*[ \t]+/i.exec(text.slice(start));
+  const tokenStart = start + (scheme?.[0].length ?? 0);
+  const brackets = [];
+  let end = tokenStart;
+  for (; end < text.length; end++) {
+    const char = text[end];
+    const code = text.charCodeAt(end);
+    if (code < 32 || code === 127 || /[\s"'\\,]/.test(char)) {
+      break;
+    }
+    if (char === '<' && end !== tokenStart && !brackets.length) {
+      break;
+    }
+    const closing = { '{': '}', '[': ']', '<': '>' }[char];
+    if (closing) {
+      brackets.push(closing);
+    } else if (/[}\]>]/.test(char) && char !== brackets.pop()) {
+      // An unmatched closer belongs to the enclosing log structure.
+      break;
+    }
+  }
+  const token = text.slice(tokenStart, end);
+  return !token || credentialPlaceholder(token) ? undefined : { start, end };
+}
 function quotedRange(text, start, opening, maxLength) {
   const depth = opening[1].length,
     quote = opening[2];
@@ -301,7 +338,9 @@ function detectCredentials(text, emit) {
         : /[:：]/.test(match[2])
           ? 'line'
           : 'prose';
-    let range = valueRange(text, start, mode);
+    let range = /^(?:proxy-)?authorization$/i.test(match[1])
+      ? authorizationRange(text, start)
+      : valueRange(text, start, mode);
     if (range && mode === 'prose' && genericLabel.test(match[1])) {
       range = generatedWord(text, range);
     }
@@ -416,7 +455,9 @@ function detectCommandPasswords(text, emit) {
 }
 
 export function detectContext(text, emit, credentialsOnly = false) {
-  detectCredentials(text, emit);
+  if (credentialHint.test(text)) {
+    detectCredentials(text, emit);
+  }
   if (!credentialsOnly) {
     detectPersonalLabels(text, emit);
   }

package/src/credentials.js

@@ -10,7 +10,7 @@ export function credentialPlaceholder(value) {
 // Only variable references and the documented gh lookup are exempt. Arbitrary
 // shell commands and Actions expressions can contain literal credentials.
 export function referencePrefix(value) {
-  return /^(?:(?:token|Bearer|Basic)\s+)?(?:\$\{\{\s*(?:secrets|env|vars|github|inputs)\.[A-Za-z_][A-Za-z0-9_.]*\s*\}\}|\$\(gh\s+auth\s+token(?:\s+--hostname\s+[a-z0-9.-]+)?\))(?=$|[\s"',;])/i.exec(
+  return /^(?:(?:token|Bearer|Basic)\s+)?(?:\$\{\{\s*(?:secrets|env|vars|github|inputs)\.[A-Za-z_][A-Za-z0-9_.]*\s*\}\}|\$\(gh\s+auth\s+token(?:\s+--hostname\s+[a-z0-9.-]+)?\))(?=$|[\s"',;\\])/i.exec(
     value
   );
 }

package/src/detection.js

@@ -1,7 +1,7 @@
 import { cardNetwork, cardEvidence } from './confidence.js';
 import { isIP } from 'node:net';
 import { serviceRules } from './rules.js';
-import { detectContext, valueRange } from './context.js';
+import { detectContext, valueRange, authorizationRange } from './context.js';
 import { detectPersonal } from './personal.js';
 import { detectGitleaks } from './gitleaks.js';
 import { detectCatalog } from './entities.js';
@@ -132,7 +132,13 @@ function detectCookies(text, emit) {
 
 export function nativeDetect(text, options, emit) {
   const credential = { type: 'SECRET', category: 'credential' };
-  detectGitleaks(text, emit);
+  detectGitleaks(
+    text,
+    emit,
+    options.debug
+      ? (details) => options.debug({ event: 'gitleaks-rule', ...details })
+      : undefined
+  );
   for (const [rule, pattern] of serviceRules) {
     collectMatches(text, pattern, emit, { ...credential, rule });
   }
@@ -186,14 +192,7 @@ export function nativeDetect(text, options, emit) {
     emit,
     { ...credential, rule: 'private-key' }
   );
-  collectMatches(
-    text,
-    /(?:Proxy-)?Authorization[ \t]*:[ \t]*(?:Bearer|Basic|Digest)[ \t]+([^\r\n"',]+)/gi,
-    emit,
-    { ...credential, rule: 'authorization' },
-    1,
-    (value) => !credentialPlaceholder(value.trim())
-  );
+  detectAuthorization(text, emit, credential);
   detectCookies(text, emit);
   collectMatches(
     text,
@@ -229,6 +228,17 @@ export function nativeDetect(text, options, emit) {
   }
 }
 
+function detectAuthorization(text, emit, credential) {
+  for (const match of text.matchAll(
+    /(?:Proxy-)?Authorization[ \t]*:[ \t]*/gi
+  )) {
+    const range = authorizationRange(text, match.index + match[0].length);
+    if (range && !credentialPlaceholder(text.slice(range.start, range.end))) {
+      emit({ ...range, ...credential, rule: 'authorization' });
+    }
+  }
+}
+
 function detectPersonalFormats(text, options, emit) {
   collectMatches(
     text,

package/src/encoded.js

@@ -1,6 +1,7 @@
 import { TextDecoder } from 'node:util';
 import { Buffer } from 'node:buffer';
 import { failure } from './detection.js';
+import { jsonStringRuns } from './json-string-runs.js';
 
 export function* decodedRuns(text, depth = 0) {
   if (depth >= 2) {
@@ -12,7 +13,7 @@ export function* decodedRuns(text, depth = 0) {
     /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{16,128}(?:\r?\n[A-Za-z0-9_+/-]{1,128})+={0,2}(?![A-Za-z0-9_+/-])/g,
     /(?:&#(?:x[\da-fA-F]{1,6}|\d{1,7});|&(?:amp|lt|gt|quot|apos|nbsp);){2,2048}/g,
     /(?:\\x[\da-fA-F]{2}){2,2048}/g,
-    /"(?:[^"\\\r\n]|\\[^\r\n]){1,8192}"/g,
+    undefined, // JSON candidates use a linear scanner below.
   ];
   const seen = new Set();
   let count = 0;
@@ -21,7 +22,7 @@ export function* decodedRuns(text, depth = 0) {
     if (marker && !text.includes(marker)) {
       continue;
     }
-    for (const match of text.matchAll(pattern)) {
+    for (const match of candidateMatches(text, pattern)) {
       const raw = match[0];
       if (raw.length > 8192) {
         if (isLimitedTextRun(raw)) {
@@ -62,6 +63,10 @@ export function* decodedRuns(text, depth = 0) {
   }
 }
 
+function candidateMatches(text, pattern) {
+  return pattern ? text.matchAll(pattern) : jsonStringRuns(text);
+}
+
 function decodedText(raw, decoded) {
   return (
     decoded !== raw &&

package/src/engines.js

@@ -180,7 +180,9 @@ export function createSanitizer(options = {}) {
     for (const finding of initial) {
       emit(finding);
     }
-    const projection = projectText(text);
+    // Native inspection performs its own normalization. Additional views are
+    // needed here only when a required external engine is enabled.
+    const projection = engines.length ? projectText(text) : undefined;
     for (const engine of engines) {
       for (const finding of await detect(
         engine,

package/src/fake-names.js

@@ -97,21 +97,29 @@ export function latinName(value) {
     .replace(/[а-яё]/g, (c) => transliteration[c]);
 }
 const given = new Map();
-for (const [locale, list] of Object.entries(firstNames)) {
-  for (const name of list.split(' ')) {
-    given.set(latinName(name), locale);
-  }
-}
 const surnames = new Map(),
   female = new Set();
-for (const [locale, data] of Object.entries(locales)) {
-  for (const name of data.person?.first_name?.female ?? []) {
-    female.add(latinName(name));
+let indexed = false;
+function indexNames() {
+  if (indexed) {
+    return;
   }
-  for (const names of Object.values(data.person?.last_name ?? {})) {
-    for (const name of names) {
-      if (!surnames.has(latinName(name))) {
-        surnames.set(latinName(name), locale);
+  indexed = true;
+  for (const [locale, list] of Object.entries(firstNames)) {
+    for (const name of list.split(' ')) {
+      given.set(latinName(name), locale);
+    }
+  }
+  for (const [locale, data] of Object.entries(locales)) {
+    for (const name of data.person?.first_name?.female ?? []) {
+      female.add(latinName(name));
+    }
+    for (const names of Object.values(data.person?.last_name ?? {})) {
+      for (const name of names) {
+        const canonical = latinName(name);
+        if (!surnames.has(canonical)) {
+          surnames.set(canonical, locale);
+        }
       }
     }
   }
@@ -137,6 +145,7 @@ function scriptLocale(value) {
   return undefined;
 }
 export function fakeName(value, key) {
+  indexNames();
   return value.replace(/[\p{L}\p{M}]+/gu, (word) => {
     for (const locale of ['ja', 'zh', 'ko']) {
       const family = firstNames[locale]

package/src/file-worker-result.js

@@ -0,0 +1,34 @@
+import { failure } from './detection.js';
+
+export function workerResult(worker, timeoutMs) {
+  return new Promise((accept, reject) => {
+    let timer,
+      finished = false;
+    const fail = () => {
+      finished = true;
+      clearTimeout(timer);
+      reject(failure('ERR_WORKER'));
+    };
+    const renew = () => {
+      clearTimeout(timer);
+      timer = setTimeout(fail, timeoutMs);
+    };
+    renew();
+    worker.on('message', (result) => {
+      if (finished) {
+        return;
+      }
+      if (result.progress) {
+        renew();
+        return;
+      }
+      finished = true;
+      clearTimeout(timer);
+      result.error
+        ? reject(failure(result.error, result))
+        : accept(result.value);
+    });
+    worker.once('error', fail);
+    worker.once('exit', fail);
+  });
+}

package/src/files.js

@@ -6,8 +6,14 @@ import { TextDecoder } from 'node:util';
 import { failure } from './detection.js';
 import { decodeLogBytes } from './log-bytes.js';
 
-export function decodeText(bytes, { lossless = false } = {}) {
-  if (bytes.includes(0)) {
+export function decodeText(
+  bytes,
+  { lossless = false, allowBinary = false } = {}
+) {
+  if (typeof allowBinary !== 'boolean') {
+    throw failure('ERR_CONFIG');
+  }
+  if (!allowBinary && bytes.includes(0)) {
     throw failure('ERR_BINARY');
   }
   if (lossless) {

package/src/gitleaks.js

@@ -12,7 +12,7 @@ import { keywordMatcher } from './keywords.js';
 
 export const gitleaksRules = [...r0, ...r1, ...r2, ...r3, ...r4, ...r5];
 const compiled = new Map();
-const largePatterns = new Map();
+const linearPatterns = new Map();
 const keywordIndex = keywordMatcher(
   gitleaksRules.flatMap((r) =>
     (r.keywords ?? []).map((word) => word.toLowerCase())
@@ -119,17 +119,6 @@ function* boundedViews(text, prefix, id) {
 }
 
 function scanRule(text, base, rule, emit, large) {
-  // re2-wasm 1.0.2 returns codepoint indices despite its RegExp-like API.
-  // Convert once per view, and keep its search cursor in codepoints too.
-  let offsets;
-  if (!large && /[\uD800-\uDBFF]/.test(text)) {
-    offsets = [0];
-    let offset = 0;
-    for (const char of text) {
-      offset += char.length;
-      offsets.push(offset);
-    }
-  }
   for (const match of ruleMatches(text, rule, large)) {
     const secret = capturedSecret(rule, match);
     if (!secret) {
@@ -140,12 +129,8 @@ function scanRule(text, base, rule, emit, large) {
     const offset = match[0].indexOf(secret),
       last = match[0].lastIndexOf(secret);
     emit({
-      start: base + (offsets ? offsets[match.index] : match.index) + offset,
-      end:
-        base +
-        (offsets ? offsets[match.index] : match.index) +
-        last +
-        secret.length,
+      start: base + match.index + offset,
+      end: base + match.index + last + secret.length,
       type: 'SECRET',
       category: 'credential',
       rule: `gitleaks/${rule.id}`,
@@ -158,28 +143,57 @@ function* ruleMatches(text, rule, large) {
   if (large) {
     // re2-wasm has a fixed 16 MiB heap. RE2JS implements the same linear-time
     // syntax without copying the input into WASM. Its indices are UTF-16.
-    let linear = largePatterns.get(rule.id);
-    if (!linear) {
-      linear = RE2JS.compile(rule.regex);
-      largePatterns.set(rule.id, linear);
-    }
-    if (linear.test(text)) {
-      yield* linear.matchAll(text);
-    }
+    yield* linearMatches(text, rule);
     return;
   }
+  // re2-wasm 1.0.2 returns codepoint indices despite its RegExp-like API.
+  // Normalize matches here so switching engines never changes public offsets.
+  let offsets;
+  if (/[\uD800-\uDBFF]/.test(text)) {
+    offsets = [0];
+    let offset = 0;
+    for (const char of text) {
+      offset += char.length;
+      offsets.push(offset);
+    }
+  }
   let pattern = compiled.get(rule.id);
   if (!pattern) {
     pattern = new RE2(rule.regex, 'gu');
     compiled.set(rule.id, pattern);
   }
   pattern.lastIndex = 0;
-  let match;
-  while ((match = pattern.exec(text)) !== null) {
-    pattern.lastIndex =
-      match.index + Array.from(match[0]).length || pattern.lastIndex + 1;
+  for (let attempts = 0; attempts < 8; attempts++) {
+    const match = pattern.exec(text);
+    if (!match) {
+      return;
+    }
+    pattern.lastIndex = match.index + Math.max(1, Array.from(match[0]).length);
+    match.index = offsets ? offsets[match.index] : match.index;
     yield match;
   }
+  // Every exec recopies the whole view into WASM. Bound those copies even
+  // for dense inputs, then replay at most eight matches in the JS engine.
+  // Keep the original subject: slicing would change anchors and boundaries.
+  const resume = offsets ? offsets[pattern.lastIndex] : pattern.lastIndex;
+  if (resume !== undefined && resume <= text.length) {
+    yield* linearMatches(text, rule, resume);
+  }
+}
+
+function* linearMatches(text, rule, resume = 0) {
+  let linear = linearPatterns.get(rule.id);
+  if (!linear) {
+    linear = RE2JS.compile(rule.regex);
+    linearPatterns.set(rule.id, linear);
+  }
+  if (linear.test(text)) {
+    for (const match of linear.matchAll(text)) {
+      if (match.index >= resume) {
+        yield match;
+      }
+    }
+  }
 }
 
 function capturedSecret(rule, match) {

package/src/index.d.ts

@@ -77,12 +77,19 @@ export interface SanitizerOptions {
   decode?: boolean;
   maxInputLength?: number;
   maxFindings?: number;
-  debug?: (event: { event: 'detected'; count: number }) => void;
+  debug?: (event: DebugEvent) => void;
   /** Used by createSanitizer; synchronous functions use native rules only. */
   detectors?: Detector[];
   /** Required by default in createSanitizer. */
   secretlint?: boolean;
 }
+/** Value-free diagnostics; enabled only when a debug callback is supplied. */
+export type DebugEvent =
+  | { event: 'detected'; count: number }
+  | { event: 'residual-redaction'; round: number }
+  | { event: 'two-pass-confirmation'; type: string }
+  | { event: 'propagation-skipped'; reason: 'length'; type: string }
+  | { event: 'gitleaks-rule'; rule: string; length: number; ms: number };
 export interface SanitizedText {
   text: string;
   findings: Finding[];
@@ -233,6 +240,8 @@ export type Transformation =
   | { mode: 'date-shift'; days: number }
   | { mode: 'bucket'; size: number };
 export interface StreamOptions extends SanitizerOptions {
+  /** Treat NUL as a log byte; default false. Incompatible with JSON/JSONL. */
+  allowBinary?: boolean;
   /** Atomic file APIs only: spool input privately, collect, then redact. */
   twoPass?: boolean;
   maxRegistryValues?: number;
@@ -245,6 +254,7 @@ export interface StreamOptions extends SanitizerOptions {
   /** JSONL record workers, 1–16; default 2, or 1 for callbacks/Deno. */
   workers?: number;
   workerHeapMb?: number;
+  /** 1–2147483647 ms; file inactivity / JSONL per-batch deadline; default 60000. */
   workerTimeoutMs?: number;
   replace?: boolean;
 }

package/src/json-string-runs.js

@@ -0,0 +1,42 @@
+// Match the bounded JSON-string candidates used by encoded detection in one
+// pass. Escaped quotes are also possible openings after an earlier candidate
+// exceeds its bound, matching RegExp's recovery on malformed log fragments.
+export function* jsonStringRuns(text) {
+  let candidates = [],
+    head = 0,
+    units = 0;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (char === '\r' || char === '\n') {
+      candidates = [];
+      head = units = 0;
+      continue;
+    }
+    if (char === '\\' && i + 1 < text.length && !/[\r\n]/.test(text[i + 1])) {
+      units++;
+      if (text[++i] === '"') {
+        candidates.push({ index: i, units });
+      }
+    } else if (char === '"') {
+      const opening = candidates[head];
+      if (opening && units > opening.units) {
+        yield { index: opening.index, 0: text.slice(opening.index, i + 1) };
+        candidates = [];
+        head = units = 0;
+      } else {
+        candidates = [{ index: i, units: ++units }];
+        head = 0;
+      }
+    } else {
+      units++;
+    }
+    // Retain only potentially valid openings, even on huge unfinished lines.
+    while (head < candidates.length && units - candidates[head].units > 8192) {
+      head++;
+    }
+    if (head > 8192) {
+      candidates = candidates.slice(head);
+      head = 0;
+    }
+  }
+}

package/src/jsonl-stream.js

@@ -141,6 +141,20 @@ function workerCount(options, config) {
   // Deno's Node compatibility does not implement resource-limited workers.
   return typeof Deno !== 'undefined' ? 1 : count;
 }
+function workerLimits(options) {
+  const heap = options.workerHeapMb ?? 256,
+    timeout = options.workerTimeoutMs ?? 60000;
+  if (
+    !Number.isSafeInteger(heap) ||
+    heap < 32 ||
+    !Number.isSafeInteger(timeout) ||
+    timeout <= 0 ||
+    timeout > 2147483647
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  return { heap, timeout };
+}
 export async function* sanitizeJsonlStream(source, options, config) {
   const count = config.collecting ? 1 : workerCount(options, config);
   if (count === 1) {
@@ -149,22 +163,16 @@ export async function* sanitizeJsonlStream(source, options, config) {
         batch,
         await prepareStreamEngine(config.engine, batch)
       );
+      if (config.collecting) {
+        config.onProgress?.();
+      }
       if (!config.collecting) {
         yield (await config.engine.sanitize(batch)).text;
       }
     }
     return;
   }
-  const heap = options.workerHeapMb ?? 256,
-    timeout = options.workerTimeoutMs ?? 60000;
-  if (
-    !Number.isSafeInteger(heap) ||
-    heap < 32 ||
-    !Number.isSafeInteger(timeout) ||
-    timeout <= 0
-  ) {
-    throw failure('ERR_CONFIG');
-  }
+  const { heap, timeout } = workerLimits(options);
   const slots = [],
     queue = [];
   let sequence = 0;

package/src/known.js

@@ -73,12 +73,19 @@ function configTokens(config) {
 
 const secretEnvName =
   /(?:^|_)(?:TOKEN|(?:API|ACCESS|PRIVATE)?KEY|SECRET|PASSWORD|PASSWD|CREDENTIALS?|AUTH|PAT)(?:_|$)/i;
+// Configuration suffixes describe how authentication works. Explicit names
+// bypass this filter; credential suffixes such as AUTH_MODE_TOKEN still win.
+const authConfigurationName =
+  /(?:^|_)AUTH_(?:TRANSPORT|MODE|METHOD|TYPE|URL|URI|HOST|HOSTNAME|PATH|ENABLED|DISABLED|PORT|PROTOCOL|SCHEME)$/i;
 /** Opt-in literal values from credential-named keys, or an explicit selection. */
 export function knownSecretsFromEnv(env = process.env, names) {
   if (names === undefined) {
     names =
       env && typeof env === 'object'
-        ? Object.keys(env).filter((name) => secretEnvName.test(name))
+        ? Object.keys(env).filter(
+            (name) =>
+              secretEnvName.test(name) && !authConfigurationName.test(name)
+          )
         : [];
   }
   if (

package/src/log-bytes.js

@@ -31,6 +31,9 @@ export function decodeLogBytes(input) {
 }
 
 export function encodeLogText(text) {
+  if (!/[\uDC80-\uDCFF]/.test(text)) {
+    return Buffer.from(text);
+  }
   const parts = [];
   let start = 0;
   for (let i = 0; i < text.length; i++) {

package/src/sanitizer.js

@@ -329,6 +329,9 @@ function encodedDetect(text, options, emit) {
 }
 
 function locations(text, findings) {
+  if (!findings.length) {
+    return findings;
+  }
   const starts = [0];
   for (let i = 0; i < text.length; i++) {
     if (text[i] === '\n') {

package/src/stream-worker.js

@@ -5,7 +5,8 @@ try {
     value: await sanitizeFileToFile(
       workerData.source,
       workerData.target,
-      workerData.options
+      workerData.options,
+      () => parentPort.postMessage({ progress: true })
     ),
   });
 } catch (error) {

package/src/stream.js

@@ -22,6 +22,7 @@ import { failure, internalFailure } from './detection.js';
 import { sanitizeJsonlStream } from './jsonl-stream.js';
 import { workerExecArgv } from './worker-options.js';
 import { streamIdentity } from './stream-identity.js';
+import { workerResult } from './file-worker-result.js';
 
 const streamKeys = new Set([
   'sanitizer',
@@ -36,14 +37,17 @@ const streamKeys = new Set([
   'replace',
   'maxRegistryValues',
   'twoPass',
+  'allowBinary',
 ]);
 function configuration(options, collecting = false, complete) {
   validatePass(options);
   const suppliedOptions = sanitizerConfiguration(options.sanitizer);
-  const jsonl =
-    (options.sanitizerOptions?.structured ??
-      suppliedOptions?.structured ??
-      options.structured) === 'jsonl';
+  const structured =
+    options.sanitizerOptions?.structured ??
+    suppliedOptions?.structured ??
+    options.structured;
+  const jsonl = structured === 'jsonl';
+  validateBinary(options, structured);
   const batchBytes = options.batchBytes ?? 256 * 1024;
   const maxTotalBytes = options.maxTotalBytes ?? 1024 * 1024 * 1024;
   const maxRecordBytes =
@@ -80,6 +84,15 @@ function configuration(options, collecting = false, complete) {
           },
   };
 }
+function validateBinary(options, structured) {
+  if (
+    (options.allowBinary !== undefined &&
+      typeof options.allowBinary !== 'boolean') ||
+    (options.allowBinary && structured)
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+}
 function validatePass(options) {
   if (options.twoPass !== undefined && typeof options.twoPass !== 'boolean') {
     throw failure('ERR_CONFIG');
@@ -230,6 +243,9 @@ async function* streamWithConfiguration(source, options, config) {
       pending = pending.slice(boundary);
       pendingBytes -= encodeLogText(text).length;
       config.identity.prepare(text, await prepareStreamEngine(engine, text));
+      if (config.collecting) {
+        config.onProgress?.();
+      }
       if (!config.collecting) {
         yield (await engine.sanitize(text)).text;
       }
@@ -244,8 +260,11 @@ async function* streamWithConfiguration(source, options, config) {
   for await (const chunk of source) {
     const bytes = Buffer.from(chunk);
     total += bytes.length;
-    if (total > maxTotalBytes || bytes.includes(0)) {
-      throw failure(bytes.includes(0) ? 'ERR_BINARY' : 'ERR_LIMIT');
+    if (total > maxTotalBytes) {
+      throw failure('ERR_LIMIT');
+    }
+    if (!options.allowBinary && bytes.includes(0)) {
+      throw failure('ERR_BINARY');
     }
     for (
       let i = 0;
@@ -277,7 +296,12 @@ async function* streamWithConfiguration(source, options, config) {
   }
   yield* process(true);
 }
-export async function sanitizeStreamToFile(source, path, options = {}) {
+export async function sanitizeStreamToFile(
+  source,
+  path,
+  options = {},
+  onProgress
+) {
   const target = resolve(path),
     temporary = join(dirname(target), `.sanitizer-${randomUUID()}.tmp`);
   let handle,
@@ -286,12 +310,13 @@ export async function sanitizeStreamToFile(source, path, options = {}) {
     await validateTarget(target, options.replace);
     handle = await open(temporary, 'wx', 0o600);
     const stream = options.twoPass
-      ? twoPassStream(source, temporary, options)
+      ? twoPassStream(source, temporary, options, onProgress)
       : sanitizeStream(source, options);
     for await (const chunk of stream) {
       const bytes = encodeLogText(chunk);
       outputBytes += bytes.length;
       await handle.writeFile(bytes);
+      onProgress?.();
     }
     await handle.sync();
     await handle.close();
@@ -310,11 +335,12 @@ export async function sanitizeStreamToFile(source, path, options = {}) {
     await unlink(temporary).catch(() => {});
   }
 }
-async function* twoPassStream(source, temporary, options) {
+async function* twoPassStream(source, temporary, options, onProgress) {
   const spool = `${temporary}.input`;
   let input;
   try {
     const discovery = configuration(options, true);
+    discovery.onProgress = onProgress;
     input = await open(spool, 'wx', 0o600);
     async function* capture() {
       let total = 0;
@@ -366,7 +392,12 @@ async function validateTarget(target, replace) {
     }
   }
 }
-export async function sanitizeFileToFile(source, target, options = {}) {
+export async function sanitizeFileToFile(
+  source,
+  target,
+  options = {},
+  onProgress
+) {
   let handle;
   try {
     handle = await open(
@@ -380,7 +411,8 @@ export async function sanitizeFileToFile(source, target, options = {}) {
     const result = await sanitizeStreamToFile(
       handle.createReadStream({ highWaterMark: 65536, autoClose: false }),
       target,
-      options
+      options,
+      onProgress
     );
     return { ...result, inputBytes: info.size };
   } catch (error) {
@@ -399,7 +431,8 @@ export async function sanitizeFileBounded(source, target, options = {}) {
     !Number.isSafeInteger(workerHeapMb) ||
     workerHeapMb < 32 ||
     !Number.isSafeInteger(workerTimeoutMs) ||
-    workerTimeoutMs <= 0
+    workerTimeoutMs <= 0 ||
+    workerTimeoutMs > 2147483647
   ) {
     throw failure('ERR_CONFIG');
   }
@@ -430,20 +463,3 @@ export async function sanitizeFileBounded(source, target, options = {}) {
     await rm(staging, { recursive: true, force: true });
   }
 }
-function workerResult(worker, timeoutMs) {
-  return new Promise((accept, reject) => {
-    const timer = setTimeout(() => reject(failure('ERR_WORKER')), timeoutMs);
-    const fail = () => {
-      clearTimeout(timer);
-      reject(failure('ERR_WORKER'));
-    };
-    worker.once('message', (result) => {
-      clearTimeout(timer);
-      result.error
-        ? reject(failure(result.error, result))
-        : accept(result.value);
-    });
-    worker.once('error', fail);
-    worker.once('exit', fail);
-  });
-}