@sema-agent/client-core 0.93.1 → 0.94.0

package/dist/displayUntrusted.js

@@ -1,4 +1,4 @@
-import { SETTINGS_SECRET_LITERAL_RE } from './generated/settingsSchemaTables.js';
+import { SETTINGS_PRIVATE_KEY_PEM_HEADER, SETTINGS_SECRET_LITERAL_RE } from './generated/settingsSchemaTables.js';
 export const REDACTION_MARKER_PREFIX = '\u00abredacted';
 const MARKER_RE = /^\u00abredacted(?::[a-z-]{1,16}){0,2}\u00bb$/;
 const REDACTED_USERINFO = '\u00abredacted:userinfo\u00bb';
@@ -28,9 +28,12 @@ const UNIT_NONE = 0;
 const UNIT_SEQUENCE = 1;
 const UNIT_SINGLE = 2;
 const SECRET_LITERAL_RE = SETTINGS_SECRET_LITERAL_RE;
+const PRIVATE_KEY_PEM_HEADER = SETTINGS_PRIVATE_KEY_PEM_HEADER;
 const SCHEME_TOKEN_RE = /(?:^|[^A-Za-z0-9_-])(?:bearer|basic)[ \t]+\S{8,4096}/i;
 const JWT_RE = /(?:^|[^A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{4,2048}/i;
 function scanForSecretLiteral(s) {
+    if (PRIVATE_KEY_PEM_HEADER.test(s))
+        return true;
     if (SECRET_LITERAL_RE.test(s) || SCHEME_TOKEN_RE.test(s) || JWT_RE.test(s))
         return true;
     return s.split(/[^A-Za-z0-9_-]+/).some(tok => tok !== '' && SECRET_LITERAL_RE.test(tok));
@@ -1474,6 +1477,453 @@ function quotedAddressEnd(S, from, to) {
     }
     return to;
 }
+function isInlineBlank(ch) {
+    if (ch === VIEW_SEPARATOR)
+        return true;
+    const c = ch.charCodeAt(0);
+    if (c === 0x0a || c === 0x0d || c === 0x2028 || c === 0x2029)
+        return false;
+    return isRegexSpace(c) || isNameBlank(c);
+}
+const isAnyBlank = (ch) => ch === VIEW_SEPARATOR || isRegexSpace(ch.charCodeAt(0)) || isNameBlank(ch.charCodeAt(0));
+function nodePropertyEnd(text, at) {
+    const sigil = text.charAt(at);
+    let j = at + 1;
+    if (sigil === '!') {
+        if (text.charAt(j) === '<') {
+            const limit = Math.min(text.length, j + 512);
+            let k = j + 1;
+            while (k < limit && text.charAt(k) !== '>' && !isAnyBlank(text.charAt(k)))
+                k++;
+            if (text.charAt(k) !== '>' || k === j + 1)
+                return -1;
+            j = k + 1;
+        }
+        else {
+            while (j < text.length && !isBareValueStop(text.charAt(j)))
+                j++;
+        }
+    }
+    else if (sigil === '&') {
+        while (j < text.length && !isBareValueStop(text.charAt(j)))
+            j++;
+        if (j === at + 1)
+            return -1;
+    }
+    else
+        return -1;
+    return j < text.length && isInlineBlank(text.charAt(j)) ? j : -1;
+}
+function nodeProperties(text, from) {
+    let i = from;
+    while (text.charAt(i) === VIEW_SEPARATOR)
+        i++;
+    const start = i;
+    let end = -1;
+    for (;;) {
+        const c = text.charAt(i);
+        if (c !== '!' && c !== '&')
+            break;
+        const e = nodePropertyEnd(text, i);
+        if (e === -1)
+            break;
+        end = e;
+        i = e;
+        while (i < text.length && isInlineBlank(text.charAt(i)))
+            i++;
+    }
+    return end === -1 ? null : { start, end, next: i };
+}
+function propertiesSameLine(S, pr) {
+    if (pr.next >= S.text.length)
+        return false;
+    const a = S.rawStart(pr.start);
+    const b = S.rawStart(pr.next);
+    return b >= a && !/[\n\r\u2028\u2029\u0085]/.test(S.raw.slice(a, b));
+}
+function hasValueAt(text, at) {
+    if (at >= text.length)
+        return false;
+    const c = text.charAt(at);
+    if (c === '|' || c === '>' || c === '[' || c === '\\' || isQuoteChar(c))
+        return true;
+    return !isBareValueStop(c) && c !== VIEW_SEPARATOR;
+}
+const SGR_REMNANT = /^\[[0-9;]*m(?:\u00abredacted|\s|$)/;
+function bracketPairs(text) {
+    const pairs = new Int32Array(text.length).fill(-1);
+    const stack = [];
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        if (c === 0x5b)
+            stack.push(i);
+        else if (c === 0x5d) {
+            const o = stack.pop();
+            if (o !== undefined)
+                pairs[o] = i;
+        }
+    }
+    return pairs;
+}
+const LIST_NEUTRAL_ITEM = /^(?:object Object|Object|Array|Circular|Getter|Setter|Getter\/Setter|native code|hidden|masked|omitted|truncated)$/i;
+function afterClosingQuote(text, end) {
+    let k = end;
+    while (text.charAt(k) === VIEW_SEPARATOR)
+        k++;
+    let q = k;
+    while (text.charCodeAt(q) === 0x5c)
+        q++;
+    const c = text.charAt(q);
+    return isQuoteChar(c) ? q + 1 : end;
+}
+function matchBrace(text, open) {
+    let depth = 0;
+    let quote = '';
+    for (let i = open; i < text.length; i++) {
+        const c = text.charAt(i);
+        if (quote !== '') {
+            if (c === '\\')
+                i++;
+            else if (c === quote)
+                quote = '';
+            continue;
+        }
+        if (isQuoteChar(c))
+            quote = c;
+        else if (c === '{')
+            depth++;
+        else if (c === '}' && --depth === 0)
+            return i;
+    }
+    return text.length;
+}
+function flowListItems(text, open, idx, budget) {
+    if (budget.left <= 0 || SGR_REMNANT.test(text.slice(open, open + 32)))
+        return null;
+    budget.pairs ??= bracketPairs(text);
+    const plainClose = budget.pairs[open] ?? -1;
+    if (plainClose >= 0 && text.charAt(plainClose + 1) === '(')
+        return null;
+    const out = flowListScan(text, open, idx);
+    budget.left -= out.end - open;
+    return out.link ? null : { items: out.items, end: out.end };
+}
+function flowListScan(text, open, idx) {
+    const items = [];
+    const n = text.length;
+    let depth = 0;
+    let i = open;
+    while (i < n) {
+        const ch = text.charAt(i);
+        if (ch === '[') {
+            depth++;
+            i++;
+            continue;
+        }
+        if (ch === ']') {
+            depth--;
+            i++;
+            if (depth <= 0)
+                return { items, end: i, link: text.charAt(i) === '(' };
+            continue;
+        }
+        if (ch === ',' || ch === '}' || isAnyBlank(ch) || ch === '\n' || ch === '\r') {
+            i++;
+            continue;
+        }
+        const escapedBreak = ch === '\\' ? lineBreakLengthAt(text, i) : 0;
+        if (escapedBreak > 0) {
+            i += escapedBreak;
+            continue;
+        }
+        if (ch === '{') {
+            const e = matchBrace(text, i);
+            if (e > i + 1)
+                items.push({ start: i + 1, end: e });
+            i = Math.min(n, e + 1);
+            continue;
+        }
+        let q = i;
+        while (text.charCodeAt(q) === 0x5c)
+            q++;
+        if (isQuoteChar(text.charAt(q))) {
+            const v = scanSecretValue(text, i, idx);
+            if (v === null) {
+                i = q + 1;
+                continue;
+            }
+            items.push({ start: v.start, end: v.end, quoted: true });
+            i = Math.max(afterClosingQuote(text, v.end), i + 1);
+            continue;
+        }
+        let j = i;
+        while (j < n) {
+            const c = text.charAt(j);
+            if (c === ',' || c === ']' || c === '[' || c === '{' || c === '}' || c === '\n' || c === '\r' || (c === '\\' && lineBreakLengthAt(text, j) > 0))
+                break;
+            j++;
+        }
+        let e = j;
+        while (e > i && isAnyBlank(text.charAt(e - 1)))
+            e--;
+        if (e > i)
+            items.push({ start: i, end: e });
+        i = j > i ? j : i + 1;
+    }
+    return { items, end: n, link: false };
+}
+const PAIR_ITEM = /^[A-Za-z_][A-Za-z0-9_.-]*(?:=|:(?!\/))[^\s,;]/;
+function lineBreakAtView(S, k) {
+    const ch = S.text.charAt(k);
+    if (ch === '\n' || ch === '\r' || ch === '\u2028' || ch === '\u2029')
+        return true;
+    if (ch !== VIEW_SEPARATOR)
+        return false;
+    const a = S.rawStart(k);
+    return /[\n\r\u2028\u2029\u0085]/.test(S.raw.slice(a, Math.max(a + 1, S.rawEnd(k))));
+}
+function scanListItem(S, i, idx) {
+    const text = S.text;
+    const v = scanSecretValue(text, i, idx);
+    if (v === null)
+        return null;
+    let q = i;
+    while (text.charCodeAt(q) === 0x5c)
+        q++;
+    if (isQuoteChar(text.charAt(q)))
+        return v;
+    for (let k = v.start; k < v.end; k++) {
+        if (text.charAt(k) !== VIEW_SEPARATOR || !lineBreakAtView(S, k))
+            continue;
+        let e = k;
+        while (e > v.start && text.charAt(e - 1) === VIEW_SEPARATOR)
+            e--;
+        return e > v.start ? { start: v.start, end: e } : null;
+    }
+    return v;
+}
+function commaListTail(S, from, idx) {
+    const text = S.text;
+    const items = [];
+    const n = text.length;
+    let i = from;
+    let end = from;
+    for (;;) {
+        let k = i;
+        while (k < n && isInlineBlank(text.charAt(k)) && !lineBreakAtView(S, k))
+            k++;
+        if (text.charAt(k) !== ',')
+            break;
+        k++;
+        while (k < n && isInlineBlank(text.charAt(k)) && !lineBreakAtView(S, k))
+            k++;
+        if (k >= n || credentialWordStartsAt(text, k, idx.tokenInner) || PAIR_ITEM.test(text.slice(k, k + 256)))
+            break;
+        let q = k;
+        while (text.charCodeAt(q) === 0x5c)
+            q++;
+        const quotedItem = isQuoteChar(text.charAt(q));
+        if (q > k && !quotedItem)
+            break;
+        const v = scanListItem(S, k, idx);
+        if (v === null)
+            break;
+        const after = quotedItem ? afterClosingQuote(text, v.end) : v.end;
+        let t = after;
+        let lineEnd = false;
+        while (t < n && isInlineBlank(text.charAt(t))) {
+            if (lineBreakAtView(S, t)) {
+                lineEnd = true;
+                break;
+            }
+            t++;
+        }
+        const term = text.charAt(t);
+        const stops = lineEnd || t >= n || term === ',' || term === ';' || term === ')' || term === ']' || term === '}' || term === '\\' || isQuoteChar(term) || term === '\n' || term === '\r';
+        if (!stops)
+            break;
+        items.push(v);
+        i = after;
+        end = after;
+    }
+    return { items, end };
+}
+function viewIndexOfRaw(S, p) {
+    let lo = 0;
+    let hi = S.text.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >> 1;
+        if (S.rawStart(mid) < p)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    while (lo < S.text.length && S.text.charAt(lo) === VIEW_SEPARATOR)
+        lo++;
+    return lo;
+}
+function dotsBeforeMarker(raw, p) {
+    let k = p;
+    while (raw.charCodeAt(k) === 0x2e)
+        k++;
+    if (k === p)
+        return p;
+    let m = k;
+    while (m < k + 3 && (raw.charCodeAt(m) === 0x5c || raw.charCodeAt(m) === 0x22 || raw.charCodeAt(m) === 0x27))
+        m++;
+    if (raw.startsWith(REDACTION_MARKER_PREFIX, m) || /^\[[0-9;]{0,12}m\u00abredacted/.test(raw.slice(k, k + 24)))
+        return k;
+    return p;
+}
+function escapedBlankLen(raw, p) {
+    if (raw.charCodeAt(p) !== 0x5c || raw.charCodeAt(p + 1) !== 0x75)
+        return 0;
+    const hex = raw.slice(p + 2, p + 6);
+    return /^[0-9A-Fa-f]{4}$/.test(hex) && isRawBlank(Number.parseInt(hex, 16)) ? 6 : 0;
+}
+function dotsBeforeDash(raw, p) {
+    let k = p;
+    while (raw.charCodeAt(k) === 0x2e)
+        k++;
+    return k > p && raw.charCodeAt(k) === 0x2d ? k : p;
+}
+function dashEntryAt(scan, p, escaped) {
+    const raw = scan.raw;
+    if (raw.charCodeAt(p) !== 0x2d)
+        return false;
+    if (p + 1 >= raw.length)
+        return true;
+    return isRawBlank(raw.charCodeAt(p + 1)) || scan.view.rawUnit[p + 1] === 1 || blockBreakAt(raw, p + 1, escaped) > 0 || escapedBlankLen(raw, p + 1) > 0 || dotsBeforeMarker(raw, p + 1) !== p + 1;
+}
+function lineContentStart(scan, lines, i, skipDots = true) {
+    const raw = scan.raw;
+    const unit = scan.view.rawUnit;
+    const { seq, payload } = blockMarks(scan);
+    const end = lines.ends[i] ?? raw.length;
+    let k = lines.starts[i] ?? 0;
+    while (k < end) {
+        if (payload[k] === 1)
+            break;
+        if (seq[k] === 1 || isRawBlank(raw.charCodeAt(k)) || unit[k] === 1)
+            k++;
+        else if (escapedBlankLen(raw, k) > 0)
+            k += 6;
+        else
+            break;
+    }
+    return skipDots && k < end ? dotsBeforeDash(raw, k) : k;
+}
+function seqLineIndent(scan, lines, i) {
+    const base = lines.indent[i] ?? -1;
+    if (base < 0)
+        return base;
+    const raw = scan.raw;
+    const unit = scan.view.rawUnit;
+    const { seq, payload } = blockMarks(scan);
+    const end = lines.ends[i] ?? raw.length;
+    let k = lines.starts[i] ?? 0;
+    let width = 0;
+    while (k < end) {
+        if (payload[k] === 1)
+            break;
+        if (escapedBlankLen(raw, k) > 0) {
+            width++;
+            k += 6;
+        }
+        else if (seq[k] === 1)
+            k++;
+        else if (isRawBlank(raw.charCodeAt(k))) {
+            width++;
+            k++;
+        }
+        else if (unit[k] === 1)
+            k++;
+        else
+            break;
+    }
+    if (k < end) {
+        const d = dotsBeforeDash(raw, k);
+        width += d - k;
+    }
+    return width;
+}
+function blockSeqEntries(scan, rawFrom, rawLabel) {
+    const raw = scan.raw;
+    const unit = scan.view.rawUnit;
+    let p = dotsBeforeDash(raw, rawFrom);
+    let escaped = false;
+    if (raw.charCodeAt(p) === 0x5c && lineBreakLengthAt(raw, p) > 0) {
+        escaped = true;
+        for (;;) {
+            const n = lineBreakLengthAt(raw, p);
+            if (n === 0 || raw.charCodeAt(p) !== 0x5c)
+                break;
+            p += n;
+            while (p < raw.length && (isRawBlank(raw.charCodeAt(p)) || unit[p] === 1 || escapedBlankLen(raw, p) > 0)) {
+                const n = escapedBlankLen(raw, p);
+                p += n > 0 ? n : 1;
+            }
+            p = dotsBeforeDash(raw, p);
+        }
+    }
+    if (!dashEntryAt(scan, p, escaped))
+        return null;
+    const lines = blockLines(scan, escaped);
+    const first = blockLineOf(lines, p);
+    const labelLine = blockLineOf(lines, rawLabel);
+    const labelIndent = Math.max(0, lines.indent[labelLine] ?? 0);
+    const entryIndent = seqLineIndent(scan, lines, first);
+    const labelHead = lineContentStart(scan, lines, labelLine, false);
+    const labelFirst = rawLabel >= labelHead && !/\s/.test(raw.slice(labelHead, rawLabel));
+    if (lineContentStart(scan, lines, first) !== p || entryIndent < 0 || (labelFirst ? entryIndent < labelIndent : entryIndent <= labelIndent))
+        return null;
+    const out = [];
+    const work = [first];
+    const total = lines.starts.length;
+    while (work.length > 0) {
+        let i = work.pop() ?? total;
+        const ind = seqLineIndent(scan, lines, i);
+        while (i < total) {
+            const dash = lineContentStart(scan, lines, i);
+            const end = lines.ends[i] ?? raw.length;
+            let v = dash + 1;
+            while (v < end && (isRawBlank(raw.charCodeAt(v)) || unit[v] === 1 || escapedBlankLen(raw, v) > 0)) {
+                const n = escapedBlankLen(raw, v);
+                v += n > 0 ? n : 1;
+            }
+            v = dotsBeforeMarker(raw, v);
+            if (v < end) {
+                let whole = -1;
+                if (dashEntryAt(scan, v, escaped)) {
+                    let last = (lines.outOf[i] ?? total) - 1;
+                    while (last > i && (lines.indent[last] ?? -1) === -1)
+                        last--;
+                    whole = lines.ends[last] ?? end;
+                }
+                out.push({ dash, value: v, whole });
+            }
+            else {
+                const k = lines.nextContent[i + 1] ?? total;
+                if (k < total && seqLineIndent(scan, lines, k) > ind) {
+                    const kp = lineContentStart(scan, lines, k);
+                    if (dashEntryAt(scan, kp, escaped)) {
+                        out.push({ dash, value: -1, whole: -1 });
+                        work.push(k);
+                    }
+                    else
+                        out.push({ dash, value: kp, whole: -1 });
+                }
+                else
+                    out.push({ dash, value: -1, whole: -1 });
+            }
+            const j = lines.outOf[i] ?? total;
+            if (j >= total || seqLineIndent(scan, lines, j) !== ind || !dashEntryAt(scan, lineContentStart(scan, lines, j), escaped))
+                break;
+            i = j;
+        }
+    }
+    return out;
+}
 function labelCandidates(S, pass, regions, out, blocks) {
     const text = S.text;
     const unitAt = (k) => S.unitAt(k);
@@ -1481,6 +1931,11 @@ function labelCandidates(S, pass, regions, out, blocks) {
     const schemePass = pass !== 'label';
     const tokenPass = pass === 'token';
     const idx = new InnerWordIndex(text, tokenPass);
+    let listIdx = null;
+    const listIndex = () => (listIdx ??= new InnerWordIndex(text, idx.tokenInner));
+    let skipFrom = -1;
+    let skipTo = -1;
+    const flowBudget = { left: 4 * text.length + 4096, pairs: null };
     const extensionCache = new Map();
     let stops;
     const push = (start, end, kindText, te = -1, cls) => {
@@ -1603,6 +2058,88 @@ function labelCandidates(S, pass, regions, out, blocks) {
             r0++;
         maskGaps(r0, outerEnd);
     };
+    const itemNeutral = (a, b) => {
+        const rawItem = text.slice(a, b);
+        const item = withoutSeparators(rawItem).trim();
+        if (item === '')
+            return true;
+        return valueIsWholeMarker(S, a, b, idx.tokenInner) || MARKER_WITH_DOTS.test(item) || isDiagnosticValue(item, rawItem) || LIST_NEUTRAL_ITEM.test(item);
+    };
+    const flowListLike = (label, items) => {
+        if (/s$/i.test(label) || items.length !== 1)
+            return true;
+        const only = items[0];
+        return only === undefined || only.quoted === true || !/\s/.test(withoutSeparators(text.slice(only.start, only.end)).trim());
+    };
+    const listMask = (label, spans, valueLike) => {
+        const neutral = spans.map((s) => itemNeutral(s.start, s.end));
+        const names = !valueLike && spans.every((s, i) => neutral[i] === true || isNamedNotValue(label, withoutSeparators(text.slice(s.start, s.end)).trim()));
+        return spans.map((_, i) => !names && neutral[i] !== true);
+    };
+    const seqItems = (scan, ents, label) => {
+        const li = listIndex();
+        const spans = [];
+        let valueLike = false;
+        for (const e of ents) {
+            if (e.value < 0)
+                continue;
+            if (e.whole >= 0) {
+                scan.out.push({ start: e.value, end: e.whole, kind: 'secret', cls: 'word', tokenEnd: e.whole, pretrimmed: true });
+                valueLike = true;
+                continue;
+            }
+            let vi = viewIndexOfRaw(S, e.value);
+            if (vi >= text.length)
+                continue;
+            const pr = nodeProperties(text, vi);
+            if (pr !== null && hasValueAt(text, pr.next) && propertiesSameLine(S, pr)) {
+                push(pr.start, pr.end, REDACTED_SECRET);
+                vi = pr.next;
+            }
+            const c = text.charAt(vi);
+            if (c === '|' || c === '>') {
+                const blk = blockScalarExtent(scan, S.rawStart(vi), e.dash);
+                if (blk !== null) {
+                    scan.out.push({ start: blk.start, end: blk.end, kind: 'secret', cls: 'word', tokenEnd: blk.end, pretrimmed: true });
+                    valueLike = true;
+                    continue;
+                }
+            }
+            if (c === '[') {
+                const fl = flowListItems(text, vi, li, flowBudget);
+                if (fl !== null && flowListLike(label, fl.items)) {
+                    for (const it of fl.items)
+                        spans.push(it);
+                    continue;
+                }
+            }
+            if (c === '{') {
+                const close = matchBrace(text, vi);
+                if (close > vi + 1)
+                    spans.push({ start: vi + 1, end: close });
+                continue;
+            }
+            if (c === '*')
+                continue;
+            let q = vi;
+            while (text.charCodeAt(q) === 0x5c)
+                q++;
+            const quotedItem = isQuoteChar(text.charAt(q));
+            const v = scanListItem(S, vi, li);
+            if (v === null)
+                continue;
+            const keyAt = quotedItem ? afterClosingQuote(text, v.end) : v.end - 1;
+            const keyNext = text.charAt(keyAt + 1);
+            if (text.charAt(keyAt) === ':' && (keyAt + 1 >= text.length || isAnyBlank(keyNext) || keyNext === '\n' || keyNext === '\r'))
+                continue;
+            spans.push(v);
+        }
+        const flags = listMask(label, spans, valueLike);
+        spans.forEach((s, i) => {
+            if (flags[i] === true)
+                push(s.start, s.end, REDACTED_SECRET);
+        });
+    };
     const regionKind = regions.length === 0 ? null : new Uint8Array(text.length);
     if (regionKind !== null)
         for (const r of regions)
@@ -1632,8 +2169,10 @@ function labelCandidates(S, pass, regions, out, blocks) {
         return a;
     };
     re.lastIndex = 0;
-    for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
+    hits: for (let hit = re.exec(text); hit !== null; hit = re.exec(text)) {
         const label = hit[1] ?? '';
+        if (hit.index >= skipFrom && hit.index < skipTo)
+            continue;
         if (schemePass && (label.toLowerCase() === 'token') !== tokenPass)
             continue;
         if (isTokenCountLabel(text, hit.index, label))
@@ -1642,16 +2181,67 @@ function labelCandidates(S, pass, regions, out, blocks) {
             continue;
         if (schemePass && labelStartsAt(text, hit.index))
             continue;
-        const from = hit.index + hit[0].length;
-        if (blocks !== undefined && (text.charCodeAt(from) === 0x7c || text.charCodeAt(from) === 0x3e) && isColonSeparator(hit[0].slice((hit[1] ?? '').length))) {
-            const blk = blockScalarExtent(blocks, S.rawStart(from), S.rawStart(hit.index));
-            if (blk !== null)
-                blocks.out.push({ start: blk.start, end: blk.end, kind: 'secret', cls: 'word', tokenEnd: blk.end, pretrimmed: true });
-        }
-        if (credentialWordStartsAt(text, from, idx.tokenInner)) {
-            pushInnerRemainder(from);
-            re.lastIndex = from;
-            continue;
+        let from = hit.index + hit[0].length;
+        const colonSep = isColonSeparator(hit[0].slice((hit[1] ?? '').length));
+        let bulletSkipped = false;
+        for (;;) {
+            if (colonSep) {
+                const pr = nodeProperties(text, from);
+                if (pr !== null && hasValueAt(text, pr.next) && propertiesSameLine(S, pr) && !credentialWordStartsAt(text, pr.next, idx.tokenInner)) {
+                    push(pr.start, pr.end, REDACTED_SECRET);
+                    from = pr.next;
+                }
+            }
+            if (blocks !== undefined && (text.charCodeAt(from) === 0x7c || text.charCodeAt(from) === 0x3e) && colonSep) {
+                const blk = blockScalarExtent(blocks, S.rawStart(from), S.rawStart(hit.index));
+                if (blk !== null)
+                    blocks.out.push({ start: blk.start, end: blk.end, kind: 'secret', cls: 'word', tokenEnd: blk.end, pretrimmed: true });
+            }
+            if (credentialWordStartsAt(text, from, idx.tokenInner)) {
+                pushInnerRemainder(from);
+                re.lastIndex = from;
+                continue hits;
+            }
+            if (!schemePass && text.charAt(from) === '[') {
+                const fl = flowListItems(text, from, listIndex(), flowBudget);
+                if (fl !== null && flowListLike(label, fl.items)) {
+                    const flags = listMask(label, fl.items, false);
+                    fl.items.forEach((s, i) => {
+                        if (flags[i] === true)
+                            push(s.start, s.end, REDACTED_SECRET);
+                    });
+                    re.lastIndex = Math.max(fl.end, from);
+                    continue hits;
+                }
+            }
+            if (!schemePass && colonSep && blocks !== undefined && (text.charAt(from) === '-' || text.charAt(from) === '\\' || text.charAt(from) === '.')) {
+                const ents = blockSeqEntries(blocks, S.rawStart(from), S.rawStart(hit.index));
+                if (ents !== null) {
+                    seqItems(blocks, ents, label);
+                    re.lastIndex = from;
+                    continue hits;
+                }
+            }
+            if (!(colonSep && text.charAt(from) === '-' && from + 1 < text.length))
+                break;
+            const afterDots = dotsBeforeMarker(text, from + 1);
+            if (!(isInlineBlank(text.charAt(from + 1)) || S.gapAfter(from) || afterDots !== from + 1))
+                break;
+            let b = afterDots;
+            while (b < text.length && isInlineBlank(text.charAt(b)))
+                b++;
+            if (b >= text.length || isAnyBlank(text.charAt(b)))
+                break;
+            from = b;
+            bulletSkipped = true;
+        }
+        if (bulletSkipped) {
+            const first = scanListItem(S, from, listIndex());
+            const j = first === null ? from : first.end;
+            if (j > from + 1 && text.charAt(j - 1) === ':' && (j >= text.length || isAnyBlank(text.charAt(j)))) {
+                re.lastIndex = from;
+                continue;
+            }
         }
         let v0s = scanSecretValue(text, from, idx);
         if (v0s === null) {
@@ -1702,6 +2292,23 @@ function labelCandidates(S, pass, regions, out, blocks) {
                 continue;
             }
         }
+        let forceFirstMask = false;
+        if (!schemePass && /s$/i.test(label) && !inQuery(v.start)) {
+            const afterFirst = quoted ? afterClosingQuote(text, v0.end) : v0.end;
+            const tail = commaListTail(S, afterFirst, listIndex());
+            if (tail.items.length > 0) {
+                const spans = [{ start: v.start, end: v.end }, ...tail.items];
+                const flags = listMask(label, spans, false);
+                for (let i = 1; i < spans.length; i++) {
+                    const s = spans[i];
+                    if (s !== undefined && flags[i] === true)
+                        push(s.start, s.end, REDACTED_SECRET);
+                }
+                forceFirstMask = flags[0] === true;
+                skipFrom = afterFirst;
+                skipTo = tail.end;
+            }
+        }
         if (valueIsWholeMarker(S, v.start, v.end, idx.tokenInner)) {
             re.lastIndex = quoted ? from : v.end;
             continue;
@@ -1757,7 +2364,7 @@ function labelCandidates(S, pass, regions, out, blocks) {
             re.lastIndex = v.end;
             continue;
         }
-        if (!schemePass && isNamedNotValue(label, value)) {
+        if (!schemePass && !forceFirstMask && isNamedNotValue(label, value)) {
             re.lastIndex = v.end;
             continue;
         }
@@ -1866,8 +2473,20 @@ function longestAlnumRun(word) {
     return best;
 }
 const JWT_WORD = /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}$/;
-const PEM_BEGIN_SOURCE = '-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----';
+const PEM_BEGIN_SOURCE = `${PRIVATE_KEY_PEM_HEADER.source}(?: BLOCK)?-----`;
+const PEM_CASE_FLAGS = PRIVATE_KEY_PEM_HEADER.flags.includes('i') ? 'i' : '';
+const PEM_LEAD = '-----BEGIN';
 const PEM_END_MARK = '-----END';
+function pemEndIndex(text, from) {
+    const re = new RegExp(PEM_END_MARK, `g${PEM_CASE_FLAGS}`);
+    re.lastIndex = from;
+    const m = re.exec(text);
+    return m === null ? -1 : m.index;
+}
+function pemLeadAt(s, at) {
+    const seg = s.slice(at, at + PEM_LEAD.length);
+    return PEM_CASE_FLAGS === 'i' ? seg.toUpperCase() === PEM_LEAD : seg === PEM_LEAD;
+}
 function lineBreakLengthAt(text, at) {
     if (text.startsWith('\r\n', at))
         return 2;
@@ -1971,7 +2590,18 @@ function blockLines(scan, escaped) {
     nextContent[starts.length] = starts.length;
     for (let i = starts.length - 1; i >= 0; i--)
         nextContent[i] = (indent[i] ?? -1) !== -1 ? i : (nextContent[i + 1] ?? starts.length);
-    const built = { starts, ends, indent, nextContent, memo: new Map() };
+    const outOf = new Int32Array(starts.length + 1).fill(starts.length);
+    const stack = [];
+    for (let i = starts.length - 1; i >= 0; i--) {
+        const ind = indent[i] ?? -1;
+        if (ind === -1)
+            continue;
+        while (stack.length > 0 && (indent[stack[stack.length - 1] ?? 0] ?? -1) > ind)
+            stack.pop();
+        outOf[i] = stack.length > 0 ? (stack[stack.length - 1] ?? starts.length) : starts.length;
+        stack.push(i);
+    }
+    const built = { starts, ends, indent, nextContent, outOf, memo: new Map() };
     scan.lines[slot] = built;
     return built;
 }
@@ -2068,11 +2698,11 @@ function pemBodyEndWithoutTrailer(text, from) {
 }
 function pemBlocks(text, soft = () => false) {
     const out = [];
-    if (!text.includes('-----BEGIN'))
+    if (!(PEM_CASE_FLAGS === 'i' ? text.toUpperCase().includes(PEM_LEAD) : text.includes(PEM_LEAD)))
         return out;
     const head = pemHeadView(text, soft);
-    const begin = new RegExp(PEM_BEGIN_SOURCE, 'g');
-    const trailer = /-----END[A-Z0-9 ]*-----/y;
+    const begin = new RegExp(PEM_BEGIN_SOURCE, `g${PEM_CASE_FLAGS}`);
+    const trailer = new RegExp(`${PEM_END_MARK}[A-Z0-9 ]*-----`, `y${PEM_CASE_FLAGS}`);
     let nextEnd = -2;
     for (let b = begin.exec(head); b !== null; b = begin.exec(head)) {
         let bodyStart = b.index + b[0].length;
@@ -2083,7 +2713,7 @@ function pemBlocks(text, soft = () => false) {
             while (bodyStart < text.length && (text[bodyStart] === ' ' || text[bodyStart] === '\t'))
                 bodyStart++;
         if (nextEnd !== -1 && nextEnd < bodyStart)
-            nextEnd = text.indexOf(PEM_END_MARK, bodyStart);
+            nextEnd = pemEndIndex(text, bodyStart);
         let bodyEnd;
         let regionEnd;
         if (nextEnd === -1) {
@@ -2114,8 +2744,8 @@ function pemHeadView(text, soft) {
     return chars === null ? text : chars.join('');
 }
 function pemBeginAt(S, at) {
-    const k = at + '-----BEGIN'.length;
-    return S.text.startsWith('-----BEGIN', at) && (S.text[k] === ' ' || (k < S.text.length && pemSoft(S, k)));
+    const k = at + PEM_LEAD.length;
+    return pemLeadAt(S.text, at) && (S.text[k] === ' ' || (k < S.text.length && pemSoft(S, k)));
 }
 const pemSoft = (S, k) => S.dropped(k) || S.painted(k);
 function pemBlockToRaw(S, blk) {
@@ -3458,3 +4088,4 @@ export function displayUntrustedMarks(text, opts = {}) {
         return { text: out, marks: [] };
     return { text: out.text, marks: collectMarks(out, ledger) };
 }
+const isQuoteChar = (c) => c.charCodeAt(0) === 0x22 || c.charCodeAt(0) === 0x27 || (c === '' && /`/.test(c));