@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/allow-entry.js

@@ -3,15 +3,15 @@ import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermission
 import { judgeRuleToolName, splitNamespacedName } from "./tool-name-aliases.js";
 import { catalogToolNames, isShellFaceToolName } from "./tool-registry.js";
 import { ALLOW_RULE_MEMBERS } from "./allow-rule-shadow.js";
-import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { COMMAND_RULE_TOOL, adjudicatePersistedDomainRules, adjudicatePersistedNameRules, domainRuleSubjectOf, findAdmittingRule, laneToolNamesOf, nameRuleSubjectOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
 import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
 import { callTargetReadingOf } from "./effective-path-target.js";
 import { splitShellCompoundSegments } from "../tools/fs/bash-readonly-classifier.js";
 import { mandateDisclosureOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
-import { valueTypeLabel } from "../agents/tool-filter.js";
+import { valueTypeLabel } from "./tool-name-list.js";
 import { deliverEngineNotice } from "./engine-notice.js";
-export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar", "tool_name", "near_miss"]);
+export const ALLOW_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "content_unsupported", "grammar", "tool_name", "near_miss"]);
 export function nonStringMemberLabel(value) {
     return `<not a string: ${valueTypeLabel(value)}>`;
 }
@@ -69,30 +69,21 @@ function readAllowEntry(raw, behavior, roster) {
         }
         return row(isShellFaceToolName(name) ? { kind: "shell", name } : { kind: "tool", name });
     }
-    if (name === COMMAND_RULE_TOOL) {
-        const allowRead = parseRuleText(raw, behavior);
-        if ("rule" in allowRead)
-            return row({ kind: "command", rule: ruleRowOf(allowRead.rule) });
-        if (behavior === "allow" && allowRead.reject.code === "invalid.bare_interpreter_prefix") {
-            const wide = parseRuleText(raw, "deny");
-            if ("rule" in wide)
-                return row({ kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) });
-        }
-        return inert("grammar");
-    }
-    if (ruleToolGrammarOf(name) === "path") {
-        const read = parseRuleText(raw, behavior);
-        if ("rule" in read) {
-            if (read.rule.match === "subpath" && read.rule.tool === READ_RULE_TOOL && behavior === "allow")
-                return row({ kind: "read_dir", rule: ruleRowOf(read.rule) });
-            if (behavior === "deny")
-                return row({ kind: "path", rule: ruleRowOf(read.rule) });
-        }
-        return inert("path_pattern");
+    const grammar = ruleToolGrammarOf(name);
+    if (grammar === undefined)
+        return inert("content_unsupported");
+    const read = parseRuleText(raw, behavior);
+    if ("rule" in read)
+        return row({ kind: grammar, rule: ruleRowOf(read.rule) });
+    if (grammar === "command" && behavior === "allow" && read.reject.code === "invalid.bare_interpreter_prefix") {
+        const wide = parseRuleText(raw, "deny");
+        if ("rule" in wide)
+            return row({ kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }) });
     }
-    if (/^domain:/.test(parsed.ruleContent))
-        return inert("domain");
-    return inert("content_unsupported");
+    return inert(inertReasonOf(read.reject.code));
+}
+function inertReasonOf(code) {
+    return code === "unsupported.tool" ? "content_unsupported" : "grammar";
 }
 export function compileAllowEntry(raw, behavior, roster) {
     const read = readAllowEntry(raw, behavior, roster);
@@ -150,8 +141,9 @@ export function autoStripped(compiled, call) {
         case "command":
             return shellContentStripped(shellRuleContent(compiled.rule));
         case "namespace":
-        case "read_dir":
         case "path":
+        case "name":
+        case "domain":
             return false;
         default: {
             const exhaustive = compiled;
@@ -199,8 +191,7 @@ export function judgeAllowEntries(rows, req, behavior, ctx) {
             }
         }
     }
-    const pathKind = behavior === "allow" ? "read_dir" : "path";
-    const pathRows = live.filter((r) => r.compiled.kind === pathKind);
+    const pathRows = live.filter((r) => r.compiled.kind === "path");
     if (pathRows.length > 0) {
         const table = pathRows.map((r) => r.compiled.rule);
         for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === "path")) {
@@ -212,6 +203,18 @@ export function judgeAllowEntries(rows, req, behavior, ctx) {
             }
         }
     }
+    for (const grammar of ["name", "domain"]) {
+        const familyRows = live.filter((r) => r.compiled.kind === grammar);
+        if (familyRows.length === 0)
+            continue;
+        const table = familyRows.map((r) => r.compiled.rule);
+        for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === grammar)) {
+            const at = { tool: name, cwd: ctx.root, ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}) };
+            const verdict = grammar === "name" ? adjudicatePersistedNameRules(table, { ...at, name: nameRuleSubjectOf(name, req.args) }) : adjudicatePersistedDomainRules(table, { ...at, host: domainRuleSubjectOf(name, req.args) });
+            if (verdict !== undefined && verdict.behavior === behavior)
+                return [familyRows.find((r) => r.compiled.rule === verdict.rules[0]) ?? familyRows[0]];
+        }
+    }
     return undefined;
 }
 export function allowingRows(rows, req, mode) {
@@ -233,6 +236,9 @@ export class AllowEntryTable {
     entries() {
         return this.held.map((r) => r.entry);
     }
+    holdsPathRows() {
+        return this.held.some((r) => r.compiled.kind === "path");
+    }
     lane(ctx) {
         return {
             allowing: (req, mode) => {
@@ -319,6 +325,7 @@ const SHADOW_REASON = {
     ancestor: "the task that delegated this one owns this question",
     dangerous_delete: "this removal targets a protected location (the filesystem root, a top-level directory, a home directory, or a workspace directory or one of its ancestors) — it is cleared by confirming this call, never by an allow rule",
     unverifiable_delete: "this removal could not be verified safe — it is cleared by confirming this call, never by an allow rule",
+    unverifiable_shell_text: "the text this shell will run cannot be read by the engine — it is cleared by confirming this call, never by an allow rule",
     transcript_write: "this write targets the session transcript — it is cleared by confirming this call, never by an allow rule",
     org_rule: "an organization policy rule requires approval for this call",
     governance_unavailable: "this deployment is org-governed and cannot currently read its organization policy",
@@ -329,7 +336,7 @@ const SHADOW_REASON = {
     requires_user_interaction: "this tool's server declares that a call must be put to a person",
     operator_forced: "this call arrived already marked as requiring confirmation (an earlier layer of this run, or the task that delegated it, judged it so) — it is cleared by confirming this call, never by a standing allow rule",
     shell_floor: mandateDisclosureOf("operator_always"),
-    write_protection_unresolved: mandateDisclosureOf("write_protection_unresolved"),
+    target_unresolved: mandateDisclosureOf("target_unresolved"),
     probe: mandateDisclosureOf("probe_mandate"),
     write_protection: mandateDisclosureOf("write_protection"),
     tool_marks_mcp: mandateDisclosureOf("tool_marks"),
@@ -422,7 +429,7 @@ export function allowedToolsNotGrantedNotice(inert, sessionId) {
     return {
         code: ALLOWED_TOOL_NOT_GRANTED_CODE,
         message: `${inert.length} allowed-tools entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
-            "A list holding `*` voids the list, `mcp__*` names no server, a write-path or domain entry has no allow reading, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
+            "A list holding `*` voids the list, `mcp__*` names no server, a rule the grammar refuses (`grammar`) or one on a tool with no such rule form (`content_unsupported`: an allow by path is an `Edit(…)` or `Read(…)` rule) grants nothing, and a tool name must be spelled as the tool is mounted; name the tools (or `mcp__<server>`) instead." +
             (refusing ? " Such an entry in a disallowed-tools list keeps its Skill from activating: a refusal that reads as nothing is not dropped." : ""),
         detail: { ...(sessionId !== undefined ? { sessionId } : {}), entries: inert.map((e) => ({ ...e })) },
     };

package/dist/core/arg-summary.d.ts

@@ -1,27 +1,15 @@
-/** Known credential SHAPES + `secretKey=value` — redacted from the FINAL abbreviated string, the single scrub
- *  point before any store/SSE fan-out. Conservative (real credential formats). */
-/** every prefix is LEFT-ANCHORED with \`(?<![A-Za-z0-9])\` — without it, ordinary words whose
- *  TAIL spells a prefix were silently redacted (NETWORK-attached → NETWO[redacted], RTMARK-100,
- *  task_categories, monkey=abcd1234, MonkeyJumping…) while triggering unpredictably on suffix
- *  length. \`_\` is deliberately NOT in the anchor class: \`api_key=\`, \`STRIPE=sk_live_…\`-style glued
- *  assignments are REAL credential shapes that must keep scrubbing. The prefixed-token arm also
- *  drops the \`i\` flag: the real vendors' prefixes are lowercase-only (sk_/pk_/rk_/ghp_…), and the
- *  case-insensitive form is what turned every UPPERCASE technical word ending in RK/SK/PK into a
- *  false positive. */
-export type RedactionConfidence = "high" | "medium" | "low";
-/** Which module's rule table minted a finding (ANG-11 provenance). A closed set, and there is no public
- *  factory for a finding — a report's entries can only have been written by one of these tables running
- *  here, so "this finding says X" is an engine statement, not something a caller can hand-assemble into
- *  a report and have the pipeline endorse. */
-export type RedactionSource = "arg-summary" | "untrusted-egress" | "secret-env";
+import { type RedactionConfidence, type RedactionSource, type ValueFamilyRow } from "./credential-vocabulary.js";
+export type { RedactionConfidence, RedactionSource } from "./credential-vocabulary.js";
 /** One redaction hit: what was detected, where (ORIGINAL-input coordinates), how confidently, the marker
- *  literal written in its place, and which rule table minted it. */
+ *  literal written in its place, which rule table minted it, and — present when a vocabulary row minted it — the
+ *  value family (the row's stable id; a host-leak hit such as a URL or a path names none). */
 export interface RedactionFinding {
     kind: string;
     span: readonly [number, number];
     confidence: RedactionConfidence;
     marker: string;
     source: RedactionSource;
+    family?: string;
 }
 /** The minimum a finding must declare to be summarizable. Both text findings ({@link RedactionFinding})
  *  and the env arm's entry findings satisfy it, so {@link summarizeRedactions} is ONE helper rather than
@@ -56,13 +44,15 @@ export interface RedactionPass {
     kind: string;
     confidence: RedactionConfidence;
     marker: string;
-    /** The module this pass is declared in — copied verbatim onto every finding it mints (ANG-11). It
-     *  travels WITH the pass, so a table composed into another module's pipeline (untrusted-egress chains
-     *  {@link SECRET_PASSES}) still attributes its hits to the table that owns the rule, not to whoever ran it. */
+    /** The rule table that owns this pass's rule — copied verbatim onto every finding it mints (ANG-11), whoever
+     *  runs the pass. */
     source: RedactionSource;
     re: RegExp;
     /** A literal replacement (only `$1` substitution is used by these passes) or a replacer fn. */
     replace: string | ((match: string, ...groups: string[]) => string);
+    /** The value family a hit belongs to: one id, or — for a pass joining several rows — the id of the row that
+     *  matches at the hit's offset in the pass input. Absent = the pass is no vocabulary row. */
+    family?: string | ((input: string, at: number) => string);
 }
 /**
  * Run the declared passes in order, collecting findings (original-input spans) when a report is given.
@@ -72,16 +62,19 @@ export interface RedactionPass {
  * only the first (or neither) matches. The OUTPUT keeps every format character that sits OUTSIDE a
  * replaced span — a joiner in an emoji sequence, a non-joiner in Persian text, a soft hyphen in a word
  * — and drops only those INSIDE the span the marker replaces (they were part of the secret). A
- * format-free input takes the exact historical path (byte-identical output). When the replacements
- * cannot be mapped back exactly (a later pass matched across an earlier pass's inserted text), the
- * output is the redacted view itself — every format character dropped: the failure direction is
- * over-stripping, never a leak.
+ * format-free input takes the exact historical path (byte-identical output). The view's replacements and
+ * every boundary scan's are taken as disjoint spans of their input (a later pass that matched across an
+ * earlier pass's inserted text is rendered from the removals instead), so the spans always map back
+ * exactly and no scan is skipped.
  */
 export declare function runRedactionPasses(input: string, passes: readonly RedactionPass[], report?: RedactionReport): string;
-/** The credential-shape passes (the pre-channel SECRET_PATTERNS, now with declared kinds/confidence).
- *  Exported for {@link runRedactionPasses} composition (untrusted-egress chains its URL passes after
- *  these in ONE pipeline so its findings' spans stay in original coordinates). */
-export declare const SECRET_PASSES: readonly RedactionPass[];
+/**
+ * The egress view rendered as passes, in the vocabulary's order: one pass per group (a group of several rows is ONE
+ * leftmost alternation, its hits attributed to the row that matches at the hit's offset). A row whose wide form
+ * captures a label keeps it ahead of the marker; `replacers` renders a kind whose marker placement is a policy (the
+ * URL userinfo).
+ */
+export declare function egressPasses(groups: ReadonlyArray<readonly ValueFamilyRow[]>, replacers?: Readonly<Record<string, (match: string, ...groups: string[]) => string>>): RedactionPass[];
 export declare function scrubSecrets(s: string, report?: RedactionReport): string;
 /** A SHORT, SECRET-SCRUBBED primary-arg summary. Abbreviation REDUCES the surface; a final {@link scrubSecrets}
  *  pass is the leak boundary (the value is PERSISTED + SSE-forwarded and may be read by a platform operator in a

package/dist/core/arg-summary.js

@@ -1,4 +1,5 @@
 import { writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
+import { CREDENTIAL_VOCABULARY, egressPassGroups } from "./credential-vocabulary.js";
 const ACTIVITY_ARG_MAX = 80;
 const SENSITIVE_KEY = /token|secret|key|password|passwd|credential|auth/i;
 export function summarizeRedactions(findings) {
@@ -12,72 +13,216 @@ export function summarizeRedactions(findings) {
     const parts = [...counts].map(([label, n]) => `${label} x${n}`);
     return `${findings.length} redaction${findings.length === 1 ? "" : "s"}: ${parts.join(", ")}`;
 }
-function mapBackOnePass(edits, pos) {
-    let delta = 0;
-    for (const e of edits) {
-        const outStart = e.at + delta;
-        if (pos < outStart)
-            return pos - delta;
-        const outEnd = outStart + e.insertedLen;
-        if (pos < outEnd)
-            return e.at;
-        delta += e.insertedLen - e.removedLen;
-    }
-    return pos - delta;
+function passZeroMapper(batches) {
+    const cursors = batches.map(() => ({ i: 0, delta: 0 }));
+    return (pos) => {
+        let p = pos;
+        for (let b = batches.length - 1; b >= 0; b--) {
+            const edits = batches[b];
+            const c = cursors[b];
+            let mapped;
+            while (mapped === undefined && c.i < edits.length) {
+                const e = edits[c.i];
+                const outStart = e.at + c.delta;
+                if (p < outStart)
+                    mapped = p - c.delta;
+                else if (p < outStart + e.insertedLen)
+                    mapped = e.at;
+                else {
+                    c.delta += e.insertedLen - e.removedLen;
+                    c.i++;
+                }
+            }
+            p = mapped ?? p - c.delta;
+        }
+        return p;
+    };
 }
 const PREEXISTING_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
 const FORMAT_CHAR_RE = /\p{Cf}/u;
 const MAX_FORMAT_SLOT_SCANS = 64;
 const REDACTED_WHOLE = "[redacted]";
-function applyPasses(input, passes, report, toOriginal) {
+function finding(pass, span, family) {
+    const f = { kind: pass.kind, confidence: pass.confidence, span, marker: pass.marker, source: pass.source };
+    if (family !== undefined)
+        f.family = family;
+    return f;
+}
+function insertedFor(pass, match, groups) {
+    return typeof pass.replace === "string"
+        ? pass.replace.replace(/\$(\d)/g, (_m, d) => groups[Number(d) - 1] ?? "")
+        : pass.replace(match, ...groups);
+}
+function removedRegion(pass, match, groups, inserted) {
+    if (typeof pass.replace === "string") {
+        const parts = pass.replace.split(/(\$\d)/).filter((p) => p !== "");
+        const isRef = (p) => /^\$\d$/.test(p);
+        const refText = (p) => groups[Number(p[1]) - 1] ?? "";
+        let head = "";
+        for (const p of parts) {
+            if (!isRef(p))
+                break;
+            head += refText(p);
+        }
+        let tail = "";
+        for (let i = parts.length - 1; i >= 0 && isRef(parts[i]); i--)
+            tail = refText(parts[i]) + tail;
+        if (parts.every(isRef))
+            return [0, match.length];
+        if (!match.startsWith(head))
+            head = "";
+        if (!match.endsWith(tail) || head.length + tail.length > match.length)
+            tail = "";
+        return [head.length, match.length - tail.length];
+    }
+    let head = 0;
+    while (head < match.length && head < inserted.length && match[head] === inserted[head])
+        head++;
+    let tail = 0;
+    while (tail < match.length - head && tail < inserted.length - head && match[match.length - 1 - tail] === inserted[inserted.length - 1 - tail])
+        tail++;
+    return [head, match.length - tail];
+}
+function soloHits(input, passes) {
+    const hits = [];
+    passes.forEach((pass, i) => {
+        for (const m of input.matchAll(new RegExp(pass.re.source, pass.re.flags.includes("g") ? pass.re.flags : `${pass.re.flags}g`))) {
+            const inserted = insertedFor(pass, m[0], m.slice(1));
+            if (inserted === m[0])
+                continue;
+            const [a, b] = removedRegion(pass, m[0], m.slice(1), inserted);
+            if (b <= a)
+                continue;
+            const at = m.index;
+            const family = typeof pass.family === "function" ? pass.family(input, at) : pass.family;
+            hits.push({ start: at + a, end: at + b, marker: inserted.slice(a, inserted.length - (m[0].length - b)), pass: i, family, matchStart: at, matchEnd: at + m[0].length });
+        }
+    });
+    return hits;
+}
+function unremovedHits(hits, removals) {
+    const gone = [];
+    for (const r of [...removals].filter((x) => x.end > x.start).sort((x, y) => x.start - y.start || y.end - x.end)) {
+        const last = gone[gone.length - 1];
+        if (last !== undefined && r.start <= last[1])
+            last[1] = Math.max(last[1], r.end);
+        else
+            gone.push([r.start, r.end]);
+    }
+    return hits.filter((h) => {
+        let lo = 0;
+        let hi = gone.length - 1;
+        let at = -1;
+        while (lo <= hi) {
+            const mid = (lo + hi) >> 1;
+            if (gone[mid][0] <= h.start) {
+                at = mid;
+                lo = mid + 1;
+            }
+            else
+                hi = mid - 1;
+        }
+        return at === -1 || gone[at][1] < h.end;
+    });
+}
+function sequentialRemovals(batches) {
+    const removals = [];
+    for (let j = 0; j < batches.length; j++) {
+        const toPassZero = passZeroMapper(batches.slice(0, j));
+        for (const e of batches[j]) {
+            const start = toPassZero(e.at + e.head);
+            const end = toPassZero(e.at + e.removedLen - e.tail);
+            removals.push({ start, end: Math.max(start, end), marker: e.inserted.slice(e.head, e.insertedLen - e.tail), pass: e.pass, family: e.family });
+        }
+    }
+    return removals;
+}
+function renderRemovals(input, removals) {
+    const sorted = removals.filter((r) => r.end > r.start || r.marker !== "").sort((x, y) => x.start - y.start || y.end - x.end);
+    const edits = [];
+    let out = "";
+    let cursor = 0;
+    for (let i = 0; i < sorted.length;) {
+        const start = sorted[i].start;
+        let end = sorted[i].end;
+        let widest;
+        for (; i < sorted.length && (sorted[i].start < end || sorted[i].start === start || (sorted[i].marker === "" && sorted[i].start === end)); i++) {
+            const r = sorted[i];
+            if (r.end > end)
+                end = r.end;
+            if (r.marker !== "" && (widest === undefined || r.end - r.start > widest.end - widest.start))
+                widest = r;
+        }
+        const marker = widest?.marker ?? REDACTED_WHOLE;
+        out += input.slice(cursor, start) + marker;
+        cursor = end;
+        edits.push({ at: start, removedLen: end - start, insertedLen: marker.length, inserted: marker, family: widest?.family, head: 0, tail: 0, pass: widest?.pass ?? sorted[i - 1].pass });
+    }
+    return { out: out + input.slice(cursor), edits };
+}
+function runPasses(input, passes, findings, toOriginal) {
     const batches = [];
     let cur = input;
-    for (const pass of passes) {
+    passes.forEach((pass, passIndex) => {
         const edits = [];
+        const passInput = cur;
+        const toPassZero = passZeroMapper(batches.slice());
         cur = cur.replace(pass.re, (...args) => {
             const match = args[0];
             const offset = args[args.length - 2];
             const groups = args.slice(1, -2);
-            const inserted = typeof pass.replace === "string"
-                ? pass.replace.replace(/\$(\d)/g, (_m, d) => groups[Number(d) - 1] ?? "")
-                : pass.replace(match, ...groups);
-            if (inserted !== match) {
-                if (report !== undefined) {
-                    let s0 = offset;
-                    let e0 = offset + match.length;
-                    for (let i = batches.length - 1; i >= 0; i--) {
-                        s0 = mapBackOnePass(batches[i], s0);
-                        e0 = mapBackOnePass(batches[i], e0);
-                    }
-                    report.findings.push({
-                        kind: pass.kind,
-                        confidence: pass.confidence,
-                        span: [toOriginal(s0), toOriginal(e0)],
-                        marker: pass.marker,
-                        source: pass.source,
-                    });
-                }
-                edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length, inserted });
-            }
+            const inserted = insertedFor(pass, match, groups);
+            if (inserted === match)
+                return inserted;
+            const family = typeof pass.family === "function" ? pass.family(passInput, offset) : pass.family;
+            if (findings !== undefined)
+                findings.push({ pass: passIndex, f: finding(pass, [toOriginal(toPassZero(offset)), toOriginal(toPassZero(offset + match.length))], family) });
+            const [a, b] = removedRegion(pass, match, groups, inserted);
+            edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length, inserted, family, head: a, tail: match.length - b, pass: passIndex });
             return inserted;
         });
         batches.push(edits);
-    }
+    });
     return { out: cur, batches };
 }
+function applyPasses(input, passes, report, toOriginal, disjoint = false) {
+    const found = report === undefined ? undefined : [];
+    const plain = runPasses(input, passes, found, toOriginal);
+    const solo = soloHits(input, passes);
+    const sequential = solo.length === 0 ? [] : sequentialRemovals(plain.batches);
+    const outer = unremovedHits(solo, sequential);
+    const mappable = !disjoint || replacedSpans(plain.batches) !== undefined;
+    const whole = outer.length === 0 && mappable ? undefined : renderRemovals(input, [...sequential, ...outer]);
+    if (whole === undefined || (whole.out === plain.out && mappable)) {
+        if (report !== undefined)
+            report.findings.push(...found.map((x) => x.f));
+        return plain;
+    }
+    if (report !== undefined) {
+        const seen = new Set(found.map((x) => `${x.pass}:${x.f.span[0]}:${x.f.span[1]}`));
+        for (const h of outer) {
+            const span = [toOriginal(h.matchStart), toOriginal(h.matchEnd)];
+            const key = `${h.pass}:${span[0]}:${span[1]}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({ pass: h.pass, f: finding(passes[h.pass], span, h.family) });
+        }
+        found.sort((x, y) => x.pass - y.pass || x.f.span[0] - y.f.span[0]);
+        report.findings.push(...found.map((x) => x.f));
+    }
+    return { out: whole.out, batches: [whole.edits] };
+}
 function replacedSpans(batches) {
     const spans = [];
     for (let j = 0; j < batches.length; j++) {
+        const toPassZero = passZeroMapper(batches.slice(0, j));
         for (const e of batches[j]) {
-            let s0 = e.at;
-            let e0 = e.at + e.removedLen;
-            for (let i = j - 1; i >= 0; i--) {
-                s0 = mapBackOnePass(batches[i], s0);
-                e0 = mapBackOnePass(batches[i], e0);
-            }
+            const s0 = toPassZero(e.at);
+            const e0 = toPassZero(e.at + e.removedLen);
             if (e0 - s0 !== e.removedLen)
                 return undefined;
-            spans.push({ start: s0, end: e0, inserted: e.inserted, pass: j });
+            spans.push({ start: s0, end: e0, inserted: e.inserted, pass: e.pass, family: e.family });
         }
     }
     spans.sort((a, b) => a.start - b.start);
@@ -125,10 +270,10 @@ export function runRedactionPasses(input, passes, report) {
         const idx = offsetToCharIndex.get(pos);
         return idx === undefined ? input.length : viewToOriginal[idx];
     };
-    const { out, batches } = applyPasses(view, passes, report, toOriginal);
+    const { batches } = applyPasses(view, passes, report, toOriginal, true);
     const viewSpans = replacedSpans(batches);
     if (viewSpans === undefined)
-        return out;
+        return REDACTED_WHOLE;
     const spans = viewSpans.map((sp) => {
         const startIdx = offsetToCharIndex.get(sp.start) ?? viewChars.length;
         const endIdx = offsetToCharIndex.get(sp.end) ?? viewChars.length;
@@ -150,42 +295,49 @@ export function runRedactionPasses(input, passes, report) {
     if (cutOffsets.length > MAX_FORMAT_SLOT_SCANS)
         return REDACTED_WHOLE;
     const extra = [];
-    const rawSpans = replacedSpans(applyPasses(input, passes, undefined, (pos) => pos).batches);
+    const rawSpans = replacedSpans(applyPasses(input, passes, undefined, (pos) => pos, true).batches);
     if (rawSpans !== undefined)
         extra.push(...rawSpans);
     for (const cut of cutOffsets) {
-        const cutSpans = replacedSpans(applyPasses(view.slice(cut), passes, undefined, (pos) => pos).batches);
+        const cutSpans = replacedSpans(applyPasses(view.slice(cut), passes, undefined, (pos) => pos, true).batches);
         if (cutSpans === undefined)
             continue;
         for (const c of cutSpans) {
             const o = viewOffsetToOriginal(c.start + cut, c.end + cut);
-            extra.push({ start: o.start, end: o.end, inserted: c.inserted, pass: c.pass });
+            extra.push({ ...c, start: o.start, end: o.end });
         }
     }
     extra.sort((a, b) => a.start - b.start);
+    const firstEndingAfter = (pos) => {
+        let lo = 0;
+        let hi = spans.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (spans[mid].end > pos)
+                hi = mid;
+            else
+                lo = mid + 1;
+        }
+        return lo;
+    };
     for (const r of extra) {
-        const overlapping = spans.find((v) => r.start < v.end && v.start < r.end);
-        if (overlapping !== undefined) {
-            if (r.start < overlapping.start)
-                overlapping.start = r.start;
-            if (r.end > overlapping.end)
-                overlapping.end = r.end;
+        const at = firstEndingAfter(r.start);
+        const hit = spans[at];
+        if (hit !== undefined && hit.start < r.end) {
+            if (r.start < hit.start)
+                hit.start = r.start;
+            if (r.end > hit.end)
+                hit.end = r.end;
+            let next = at + 1;
+            while (next < spans.length && spans[next].start < hit.end)
+                hit.end = Math.max(hit.end, spans[next++].end);
+            if (next > at + 1)
+                spans.splice(at + 1, next - at - 1);
             continue;
         }
-        spans.push({ start: r.start, end: r.end, inserted: r.inserted });
-        if (report !== undefined) {
-            const pass = passes[r.pass];
-            report.findings.push({ kind: pass.kind, confidence: pass.confidence, span: [r.start, r.end], marker: pass.marker, source: pass.source });
-        }
-        spans.sort((a, b) => a.start - b.start);
-    }
-    for (let i = 1; i < spans.length;) {
-        if (spans[i].start < spans[i - 1].end) {
-            spans[i - 1].end = Math.max(spans[i - 1].end, spans[i].end);
-            spans.splice(i, 1);
-        }
-        else
-            i++;
+        spans.splice(at, 0, { start: r.start, end: r.end, inserted: r.inserted });
+        if (report !== undefined)
+            report.findings.push(finding(passes[r.pass], [r.start, r.end], r.family));
     }
     let result = "";
     let cursor = 0;
@@ -196,27 +348,22 @@ export function runRedactionPasses(input, passes, report) {
     result += input.slice(cursor);
     return result;
 }
-export const SECRET_PASSES = [
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur]|github_pat)[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{20,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{12,}/g, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{20,}/g, replace: "[redacted]" },
-    { kind: "jwt", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])eyJ[A-Za-z0-9._-]{20,}/g, replace: "[redacted]" },
-    { kind: "private-key-block", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /-----BEGIN[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----|$)/g, replace: "[redacted]" },
-    { kind: "bearer-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])Bearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, replace: "[redacted]" },
-    { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(AccountKey=)[A-Za-z0-9+/]{40,}={0,2}/g, replace: "$1[redacted]" },
-    {
-        kind: "keyword-value",
-        confidence: "medium",
-        marker: "[redacted]",
-        source: "arg-summary",
-        re: /(?<![A-Za-z0-9])((?:token|secret|key|password|passwd|credential|authorization)["']?\s*[=:]\s*["']?)[^\s"';|&]{4,}/gi,
-        replace: "$1[redacted]",
-    },
-];
+const BRACKET_MARKER = { "url-credentials": "[redacted-credentials]" };
+const bracketMarker = (kind) => BRACKET_MARKER[kind] ?? "[redacted]";
+const capturesLabel = (re) => new RegExp(`${re.source}|`).exec("").length > 1;
+export function egressPasses(groups, replacers = {}) {
+    return groups.map((rows) => {
+        const head = rows[0];
+        const marker = bracketMarker(head.kind);
+        const re = rows.length === 1 ? head.match : new RegExp(rows.map((r) => `(?:${r.match.source})`).join("|"), head.match.flags);
+        const sticky = rows.map((r) => ({ id: r.id, re: new RegExp(r.match.source, r.match.flags.replace("g", "") + "y") }));
+        const family = rows.length === 1 ? head.id : (input, at) => sticky.find((s) => ((s.re.lastIndex = at), s.re.test(input)))?.id ?? head.id;
+        return { kind: head.kind, confidence: head.confidence, marker, source: head.source, re, replace: replacers[head.kind] ?? (capturesLabel(head.match) ? `$1${marker}` : marker), family };
+    });
+}
+const SHAPE_PASSES = egressPasses(egressPassGroups(CREDENTIAL_VOCABULARY).filter((rows) => rows[0].source === "arg-summary"));
 export function scrubSecrets(s, report) {
-    return runRedactionPasses(s, SECRET_PASSES, report);
+    return runRedactionPasses(s, SHAPE_PASSES, report);
 }
 function truncCodePoints(s) {
     const cp = Array.from(s);