@sema-agent/server 7.135.0 → 7.137.0

package/dist/trace/redact.js

@@ -1,5 +1,5 @@
 import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
-import { CONTROL_AND_BIDI_CHARS, isHierarchicalUrl } from "@sema-agent/settings-schema";
+import { CONTROL_AND_BIDI_CHARS, CREDENTIAL_PARAM_NAMES, isHierarchicalUrl } from "@sema-agent/settings-schema";
 import { recordFailOpen } from "../observability/fail-open.js";
 const normalizeForRedaction = stripFormatCharacters;
 export function mapNormalizedToOriginal(text, normalized) {
@@ -819,13 +819,57 @@ if (/[\]^-]/.test(SCHEME_DELIMITER_CHARS))
 const SCHEME_DELIMITER_CODES = new Set([...SCHEME_DELIMITER_CHARS].map((c) => c.charCodeAt(0)));
 const isSchemeDelimiterCode = (c) => SCHEME_DELIMITER_CODES.has(c);
 const SCHEME_SEPARATOR_CLASS = `[\\s${SCHEME_DELIMITER_CHARS.replace(/\\/g, "\\\\")}]`;
-const LEXICAL_KEYWORD_ARMS = new Set();
+function expandKeywordForms(src) {
+    let forms = [""];
+    for (let i = 0; i < src.length;) {
+        let alts;
+        const pair = /^\[([A-Za-z])([A-Za-z])\]/.exec(src.slice(i));
+        if (pair !== null) {
+            if (pair[1].toLowerCase() !== pair[2].toLowerCase())
+                throw new Error(`redact: keyword source ${src} holds a class that is not a case pair`);
+            alts = [pair[1], pair[2]];
+            i += 4;
+        }
+        else if (/[A-Za-z0-9]/.test(src.charAt(i))) {
+            alts = [src.charAt(i)];
+            i += 1;
+        }
+        else {
+            throw new Error(`redact: keyword source ${src} holds an atom the head reading cannot enumerate (only letters, digits and [Xx] case pairs)`);
+        }
+        forms = forms.flatMap((f) => alts.map((a) => f + a));
+    }
+    const whole = new RegExp(`^(?:${src})$`);
+    for (const f of forms)
+        if (!whole.test(f))
+            throw new Error(`redact: keyword source ${src} does not match its own enumerated form ${f}`);
+    return forms;
+}
+const LEXICAL_KEYWORD_ARMS = new Map();
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "", separatorClass = "\\s") => {
     const re = new RegExp(`(?:${keywordSrc}${separatorClass}+${atLeast(valueClass, min)}${tailSrc}` +
         `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${atLeast(valueClass, min)}${tailSrc})`, "g");
-    LEXICAL_KEYWORD_ARMS.add(re);
+    const separator = new RegExp(`^${separatorClass}$`);
+    const value = new RegExp(`^${valueClass}$`);
+    LEXICAL_KEYWORD_ARMS.set(re, { forms: expandKeywordForms(keywordSrc), min, isSeparator: (u) => separator.test(u), isValue: (u) => value.test(u) });
     return re;
 };
+function undecidedKeywordStart(text, t) {
+    const n = text.length;
+    let valueRun = 0;
+    while (valueRun < t.min && valueRun < n && t.isValue(text.charAt(n - 1 - valueRun)))
+        valueRun += 1;
+    if (valueRun >= t.min)
+        return -1;
+    let sepStart = n - valueRun;
+    while (sepStart > 0 && t.isSeparator(text.charAt(sepStart - 1)))
+        sepStart -= 1;
+    for (const f of t.forms) {
+        if (sepStart >= f.length && text.startsWith(f, sepStart - f.length))
+            return sepStart - f.length;
+    }
+    return -1;
+}
 const CREDENTIAL_NAME_ANCHORS = {
     api_key: "structure-only", apikey: "structure-only", "api-key": "structure-only", key: "structure-only",
     token: "structure-only", access_token: "structure-only", refresh_token: "structure-only", id_token: "structure-only",
@@ -836,15 +880,14 @@ const CREDENTIAL_NAME_ANCHORS = {
     "x-amz-signature": "structure-only", "x-amz-security-token": "structure-only", "x-amz-credential": "structure-only",
     sas: "structure-only",
 };
-const CREDENTIAL_NAME_WORDS = Object.keys(CREDENTIAL_NAME_ANCHORS);
 const CREDENTIAL_NAME_ALT = (() => {
-    for (const w of CREDENTIAL_NAME_WORDS) {
+    for (const w of CREDENTIAL_PARAM_NAMES) {
         if (!/^[a-z][a-z0-9_-]*$/.test(w))
             throw new Error(`redact: credential name ${JSON.stringify(w)} must be lowercase [a-z0-9_-] (the alternation is built without escaping)`);
     }
-    return [...CREDENTIAL_NAME_WORDS].sort((a, b) => b.length - a.length || (a < b ? -1 : 1)).join("|");
+    return [...CREDENTIAL_PARAM_NAMES].sort((a, b) => b.length - a.length || (a < b ? -1 : 1)).join("|");
 })();
-const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_NAME_WORDS.map((w) => w.length));
+const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_PARAM_NAMES.map((w) => w.length));
 const asciiLower = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase());
 function credentialNameAnchor(name) {
     return CREDENTIAL_ANCHOR_OF.get(asciiLower(name));
@@ -1085,14 +1128,17 @@ function isPemFenceLabel(s, from, to) {
         return false;
     if (!s.startsWith(PEM_KEY_WORD, end - PEM_KEY_WORD.length))
         return false;
+    return !pemLabelDashRuleBroken(s, from, to);
+}
+function pemLabelDashRuleBroken(s, from, to) {
     if (s.charCodeAt(from) === 45)
-        return false;
+        return true;
     if (s.charCodeAt(from + 1) === 45)
-        return false;
+        return true;
     for (let i = from + 1; i < to; i++)
         if (s.charCodeAt(i) === 45 && s.charCodeAt(i + 1) === 45)
-            return false;
-    return true;
+            return true;
+    return false;
 }
 const PEM_FENCE_OPEN = "-----BEGIN";
 const PEM_FENCE_CLOSE = "-----";
@@ -1137,7 +1183,7 @@ function unitCountWithin(scan, from, to, max) {
     }
     return n <= max;
 }
-function collectSsh2FenceSpans(scan, text, span) {
+function collectSsh2FenceSpans(scan, text, span, isHead) {
     let cachedFrom = 0;
     let cachedAt;
     const nextClose = (from) => {
@@ -1163,6 +1209,10 @@ function collectSsh2FenceSpans(scan, text, span) {
             continue;
         }
         const bodyFrom = fence + SSH2_FENCE_OPEN.length;
+        if (isHead && unitCountWithin(scan, bodyFrom, text.length, SSH2_BODY_MAX)) {
+            span(fence, text.length, true);
+            return;
+        }
         const close = nextClose(bodyFrom);
         if (close < 0)
             return;
@@ -1177,11 +1227,20 @@ function collectSsh2FenceSpans(scan, text, span) {
 }
 const PEM_END_OPEN = "-----END";
 const PEM_FENCE_BODY_MAX = 8192;
+const PEM_LINE_INVALID = -1;
+const PEM_LINE_OPEN = -2;
 function pemFenceLineEnd(text, labelFrom) {
     const close = text.indexOf(PEM_FENCE_CLOSE, labelFrom);
-    return close >= 0 && isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : -1;
+    if (close < 0) {
+        let to = text.length;
+        while (to > labelFrom && text.charCodeAt(to - 1) === 45)
+            to -= 1;
+        const stillPossible = text.length - to >= 2 ? isPemFenceLabel(text, labelFrom, to) : !pemLabelDashRuleBroken(text, labelFrom, to);
+        return stillPossible ? PEM_LINE_OPEN : PEM_LINE_INVALID;
+    }
+    return isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : PEM_LINE_INVALID;
 }
-function collectPemFenceSpans(text, span) {
+function collectPemFenceSpans(text, span, isHead) {
     let endFrom = -1;
     let endAt = -1;
     let endAfter = -1;
@@ -1201,13 +1260,17 @@ function collectPemFenceSpans(text, span) {
         if (fence < 0)
             return;
         const bodyFrom = pemFenceLineEnd(text, fence + PEM_FENCE_OPEN.length);
-        if (bodyFrom < 0) {
+        if (bodyFrom === PEM_LINE_INVALID) {
             from = fence + 1;
             continue;
         }
-        earliestEndFence(bodyFrom);
-        if (endAt < 0)
+        if (bodyFrom !== PEM_LINE_OPEN)
+            earliestEndFence(bodyFrom);
+        if (bodyFrom === PEM_LINE_OPEN || endAt < 0) {
+            if (isHead)
+                span(fence, text.length, true);
             return;
+        }
         if (endAt - bodyFrom > PEM_FENCE_BODY_MAX) {
             from = fence + 1;
             continue;
@@ -1248,9 +1311,19 @@ function collectPemFragmentSpans(scan, text, json, span) {
         cur = next;
     }
 }
-function collectHeadlessPpkSpans(scan, text, span) {
+function collectHeadlessPpkSpans(scan, text, span, isHead) {
     const KEY = "Private-Lines: ";
     const n = text.length;
+    const LINE_NONE = -1;
+    const LINE_OPEN = -2;
+    const openAt = (i) => {
+        if (!isHead)
+            return false;
+        let k = i;
+        while (k < n && opaqueUnitEnd(scan, k) < 0 && text.charCodeAt(k) === 92)
+            k += 1;
+        return k >= n;
+    };
     const isB64 = (c) => (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 43 || c === 47 || c === 61;
     const b64At = (i) => opaqueUnitEnd(scan, i) < 0 && isB64(text.charCodeAt(i));
     const skipHs = (i) => { while (i < n && opaqueUnitEnd(scan, i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
@@ -1289,7 +1362,9 @@ function collectHeadlessPpkSpans(scan, text, span) {
             seen = true;
             q = skipHs(q);
         }
-        return seen ? q : -1;
+        if (openAt(q))
+            return LINE_OPEN;
+        return seen ? q : LINE_NONE;
     };
     const escapedNewlineLen = (i) => {
         if (opaqueUnitEnd(scan, i) >= 0)
@@ -1304,13 +1379,35 @@ function collectHeadlessPpkSpans(scan, text, span) {
     };
     const atLineEnd = (i) => {
         const b = skipHs(i);
-        if (b >= n)
+        if (b >= n || openAt(b))
             return true;
         if (opaqueUnitEnd(scan, b) >= 0)
             return false;
         const c = text.charCodeAt(b);
         return c === 10 || c === 13 || c === 34 || escapedNewlineLen(b) > 0;
     };
+    const bodyLineAt = (from) => {
+        const q0 = skipNewlines(from);
+        if (q0 < 0)
+            return q0;
+        let q = q0;
+        const mk = opaqueUnitEnd(scan, q) < 0 ? text.charCodeAt(q) : -1;
+        if (mk === 43 || mk === 45)
+            q = skipHs(q + 1);
+        let r = q;
+        while (r < n && b64At(r))
+            r += 1;
+        if (r - q < 4) {
+            if (isHead && r >= n)
+                return LINE_OPEN;
+            r = q0;
+            while (r < n && b64At(r))
+                r += 1;
+            if (r - q0 < 4)
+                return LINE_NONE;
+        }
+        return atLineEnd(r) ? r : LINE_NONE;
+    };
     let search = 0;
     for (;;) {
         const at = text.indexOf(KEY, search);
@@ -1324,40 +1421,28 @@ function collectHeadlessPpkSpans(scan, text, span) {
         const d0 = p;
         while (p < n && opaqueUnitEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
             p += 1;
-        if (p === d0) {
+        if (p === d0 && p < n) {
             search = at + KEY.length;
             continue;
         }
-        let end = p;
-        let lines = 0;
-        for (;;) {
-            const q0 = skipNewlines(end);
-            if (q0 === -1)
+        let end = -1;
+        let open = false;
+        for (let from = p;;) {
+            const r = bodyLineAt(from);
+            if (r === LINE_NONE)
                 break;
-            let q = q0;
-            const mk = opaqueUnitEnd(scan, q) < 0 ? text.charCodeAt(q) : -1;
-            if (mk === 43 || mk === 45)
-                q = skipHs(q + 1);
-            let r = q;
-            while (r < n && b64At(r))
-                r += 1;
-            if (r - q < 4) {
-                r = q0;
-                while (r < n && b64At(r))
-                    r += 1;
-                if (r - q0 < 4)
-                    break;
-            }
-            if (!atLineEnd(r))
+            end = r === LINE_OPEN ? n : r;
+            if (r === LINE_OPEN) {
+                open = true;
                 break;
-            lines += 1;
-            end = r;
+            }
+            from = r;
         }
-        if (lines === 0) {
+        if (end < 0) {
             search = p;
             continue;
         }
-        span(at, end);
+        span(at, end, open);
         search = end;
     }
 }
@@ -1442,10 +1527,6 @@ const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c =
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
 const isControlCode = (c) => c < 0x20 || c === 0x7f;
 const TOKEN_UNIT_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
-export const CREDENTIAL_PARAM_NAMES = Object.freeze([...CREDENTIAL_NAME_WORDS]);
-export function isCredentialParamName(decodedName) {
-    return credentialNameAnchor(decodedName) !== undefined;
-}
 const CREDENTIAL_NAME_SCAN_MAX = CREDENTIAL_NAME_MAX * 3 + 1;
 function decodeAsciiName(name) {
     let out = "";
@@ -1757,10 +1838,12 @@ function scanUrlRun(scan, text, i, kind, json) {
     noteEvidenceRead(scan, i);
     return i;
 }
-function matchUserinfoAt(scan, text, p, json) {
+function matchUserinfoAt(scan, text, p, json, isHead) {
     const probeEnd = scanUrlRun(scan, text, p, "plain-user", json);
     const keyId = probeEnd > p && text.charCodeAt(probeEnd) === 58 && credentialSpansCover(scan, p, probeEnd);
-    scanUrlRun(scan, text, p, keyId ? "token-pass" : "plain-pass", json);
+    const runEnd = scanUrlRun(scan, text, p, keyId ? "token-pass" : "plain-pass", json);
+    if (isHead && runEnd >= text.length && runEnd > p)
+        return runEnd;
     const at = scan.lastAt;
     if (at <= p)
         return null;
@@ -1778,7 +1861,7 @@ function growUrlSegments(list) {
     list.a = bigger;
     return true;
 }
-function collectUrlCredentialSpans(scan, text, json, span) {
+function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     const dirty = scan.dirty;
     const hr = scan.headsRead;
     const hw = scan.headsWrite;
@@ -1814,12 +1897,12 @@ function collectUrlCredentialSpans(scan, text, json, span) {
         else {
             scan.footLo = FOOT_NONE;
             scan.footHi = -1;
-            at = matchUserinfoAt(scan, text, start, json) ?? -1;
+            at = matchUserinfoAt(scan, text, start, json, isHead) ?? -1;
             lo = scan.footLo;
             hi = scan.footHi;
             urlSegmentRuns += 1;
             if (at >= 0 && at !== (known ? ph[pc + 1] : -2))
-                span(start, at);
+                span(start, at, isHead && at >= text.length);
         }
         if (hw.n + URL_SEG_STRIDE <= hw.a.length || growUrlSegments(hw)) {
             const w = hw.a;
@@ -1915,7 +1998,8 @@ function jsonSecretFieldValueQuoteAt(text, p) {
         i += 1;
     return text.charCodeAt(i) === CH_QUOTE ? i : -1;
 }
-function jsonStringEndAt(text, q) {
+const STRING_OPEN = -2;
+function jsonStringEndAt(text, q, isHead) {
     const n = text.length;
     for (let i = q + 1; i < n;) {
         const c = text.charCodeAt(i);
@@ -1926,21 +2010,23 @@ function jsonStringEndAt(text, q) {
                 i += 2;
                 continue;
             }
-            return -1;
+            return isHead && i + 1 >= n ? STRING_OPEN : -1;
         }
         i += 1;
     }
-    return -1;
+    return isHead ? STRING_OPEN : -1;
 }
-function collectJsonSecretFieldSpans(text, span) {
+function collectJsonSecretFieldSpans(text, span, isHead) {
     for (let p = text.indexOf(JSON_FIELD_ANCHOR); p >= 0;) {
         const q = jsonSecretFieldValueQuoteAt(text, p);
-        const end = q < 0 ? -1 : jsonStringEndAt(text, q);
-        if (end < 0) {
+        const found = q < 0 ? -1 : jsonStringEndAt(text, q, isHead);
+        if (found === -1) {
             p = text.indexOf(JSON_FIELD_ANCHOR, p + 1);
             continue;
         }
-        span(q, end);
+        const open = found === STRING_OPEN;
+        const end = open ? text.length : found;
+        span(q, end, open);
         p = text.indexOf(JSON_FIELD_ANCHOR, scanResumeAfterHit(p, end, JSON_FIELD_ANCHOR.length));
     }
 }
@@ -2088,7 +2174,7 @@ function anchorHeadAt(text, op, json) {
     }
     return { strength, quotedName: quote !== 0, spacedLeft, listSep };
 }
-function quotedValueEnd(text, cs, quote, json) {
+function quotedValueEnd(text, cs, quote, json, isHead) {
     const n = text.length;
     let i = cs;
     while (i < n) {
@@ -2097,18 +2183,18 @@ function quotedValueEnd(text, cs, quote, json) {
         if (ch === quote)
             return i;
         if (ch === JSON_STRING_END)
-            break;
+            return -1;
         i += unitLenOf(unit);
         if (ch === CH_BACKSLASH && quote !== JSON_STRING_END) {
             if (i >= n)
                 break;
             const escaped = readAnchorUnit(text, i, json);
             if (unitChOf(escaped) === JSON_STRING_END)
-                break;
+                return -1;
             i += unitLenOf(escaped);
         }
     }
-    return -1;
+    return isHead ? STRING_OPEN : -1;
 }
 function bareValueEnd(text, s, json, listSep) {
     const n = text.length;
@@ -2153,7 +2239,7 @@ function bareValueEnd(text, s, json, listSep) {
     }
     return e;
 }
-function literalValueAt(text, s, json, declaredIfBare, listSep) {
+function literalValueAt(text, s, json, declaredIfBare, listSep, isHead) {
     const n = text.length;
     if (s >= n)
         return undefined;
@@ -2166,7 +2252,9 @@ function literalValueAt(text, s, json, declaredIfBare, listSep) {
             return undefined;
         if (!isAsciiAlnumCode(unitChOf(readAnchorUnit(text, vs, json))))
             return undefined;
-        const close = quotedValueEnd(text, vs, first, json);
+        const close = quotedValueEnd(text, vs, first, json, isHead);
+        if (close === STRING_OPEN)
+            return { start: vs, end: n, quoted: true, open: true };
         if (close >= 0)
             return { start: vs, end: close, quoted: true };
     }
@@ -2234,7 +2322,7 @@ function schemeValueAt(text, s, json) {
         return undefined;
     return { start: vs, end: e, quoted: false };
 }
-function collectAnchoredValueSpans(text, json, span) {
+function collectAnchoredValueSpans(text, json, span, isHead) {
     const n = text.length;
     let resume = 0;
     let nextEq = text.indexOf("=");
@@ -2275,10 +2363,10 @@ function collectAnchoredValueSpans(text, json, span) {
                 v = schemeValueAt(text, s, json);
                 break;
             case "declarative":
-                v = literalValueAt(text, s, json, head.quotedName || (!head.spacedLeft && !spacedRight), head.listSep);
+                v = literalValueAt(text, s, json, head.quotedName || (!head.spacedLeft && !spacedRight), head.listSep, isHead);
                 break;
             case "any-form":
-                v = literalValueAt(text, s, json, true, head.listSep);
+                v = literalValueAt(text, s, json, true, head.listSep, isHead);
                 break;
             default: {
                 const unhandled = head.strength;
@@ -2287,14 +2375,14 @@ function collectAnchoredValueSpans(text, json, span) {
         }
         if (v === undefined)
             continue;
-        span(v.start, v.end);
+        span(v.start, v.end, v.open === true);
         resume = v.quoted ? v.start : v.end;
     }
 }
 export function structuralScannerForTest(arm) {
     const collect = (scan) => (text) => {
         const out = [];
-        scan(text, (start, end) => out.push([start, end]));
+        scan(text, (start, end) => out.push([start, end]), false);
         return out;
     };
     switch (arm) {
@@ -2307,7 +2395,7 @@ export function structuralScannerForTest(arm) {
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
-function collectPpkContainerSpans(scan, text, eat, span) {
+function collectPpkContainerSpans(scan, text, eat, span, isHead) {
     const HEAD = "PuTTY-User-Key-File-";
     const MAC = "Private-MAC: ";
     const HASH = "Private-Hash: ";
@@ -2323,9 +2411,8 @@ function collectPpkContainerSpans(scan, text, eat, span) {
         cache.set(needle, v);
         return v;
     };
-    const isVersionedHead = (at) => {
+    const versionEnd = (at) => {
         let p = at + HEAD.length;
-        const start = p;
         while (p < text.length && opaqueUnitEnd(scan, p) < 0) {
             const c = text.charCodeAt(p);
             if (c >= 48 && c <= 57)
@@ -2333,7 +2420,15 @@ function collectPpkContainerSpans(scan, text, eat, span) {
             else
                 break;
         }
-        return p > start && text.startsWith(": ", p);
+        return p;
+    };
+    const isVersionedHead = (at) => {
+        const p = versionEnd(at);
+        return p > at + HEAD.length && text.startsWith(": ", p);
+    };
+    const isOpenHead = (at) => {
+        const p = versionEnd(at);
+        return p >= text.length || (p === text.length - 1 && p > at + HEAD.length && text.charCodeAt(p) === 58);
     };
     const nextVersionedHead = (from) => {
         let p = find(HEAD, from);
@@ -2356,13 +2451,16 @@ function collectPpkContainerSpans(scan, text, eat, span) {
     while (at !== Number.POSITIVE_INFINITY) {
         let pos = at + HEAD.length + 1;
         let end = text.length;
-        let ateToEnd = true;
+        let ateToEnd = !isHead;
+        let open = false;
         for (;;) {
             const mac = find(MAC, pos);
             const hash = find(HASH, pos);
             const term = Math.min(mac, hash);
-            if (term === Number.POSITIVE_INFINITY)
+            if (term === Number.POSITIVE_INFINITY) {
+                open = isHead;
                 break;
+            }
             const hexStart = term + (term === mac ? MAC.length : HASH.length);
             const hexEnd = hexRunEnd(hexStart);
             if (hexEnd - hexStart < 32) {
@@ -2389,17 +2487,22 @@ function collectPpkContainerSpans(scan, text, eat, span) {
                     }
                 }
             }
+            const undecided = isHead && limit === Number.POSITIVE_INFINITY;
             ateToEnd = straggler < limit || !gapBlank;
-            end = ateToEnd ? text.length : hexEnd;
+            end = ateToEnd || undecided ? text.length : hexEnd;
+            open = undecided;
             break;
         }
         if (ateToEnd && eat !== undefined && eat.from < 0) {
             eat.from = at;
             eat.len = text.length;
         }
-        span(at, end);
+        span(at, end, open);
         at = end >= text.length ? Number.POSITIVE_INFINITY : nextVersionedHead(end);
     }
+    const last = isHead ? text.lastIndexOf(HEAD) : -1;
+    if (last >= 0 && !inOpaqueUnit(scan, last) && isOpenHead(last))
+        span(last, text.length, true);
 }
 const armPool = (() => {
     const spanRepl = (token) => {
@@ -2421,6 +2524,7 @@ const armPool = (() => {
             throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
         }
         const arm = { g: re, y, back, headSrc, headFirst, repl, rank, order };
+        const keywordTail = LEXICAL_KEYWORD_ARMS.get(re);
         const boundary = y === undefined || headSrc === undefined || headFirst === undefined ? undefined : { ...arm, y, headSrc, headFirst };
         return {
             token,
@@ -2428,9 +2532,17 @@ const armPool = (() => {
             order,
             phase: 1,
             lexical: LEXICAL_KEYWORD_ARMS.has(re),
-            collect: boundary === undefined
-                ? (text, _json, _eat, out) => collectRegexSpans(arm, text, out)
-                : (text, _json, _eat, out) => collectValueArmSpans(boundary, text, out),
+            collect: (text, _json, _eat, out, isHead) => {
+                if (boundary === undefined)
+                    collectRegexSpans(arm, text, out);
+                else
+                    collectValueArmSpans(boundary, text, out);
+                if (isHead && keywordTail !== undefined) {
+                    const at = undecidedKeywordStart(text, keywordTail);
+                    if (at >= 0)
+                        out.push({ start: at, end: text.length, repl, rank, order, undecided: true });
+                }
+            },
             retry: boundary === undefined ? undefined : (text, at, out) => collectStickySpans(boundary, text, at, out),
             headSrc: boundary === undefined ? undefined : headSrc,
             headFirst: boundary === undefined ? undefined : headFirst,
@@ -2444,7 +2556,7 @@ const armPool = (() => {
             order,
             phase: 1,
             lexical,
-            collect: (text, json, eat, out) => arm(text, json, eat, (start, end) => out.push({ start, end, repl, rank, order })),
+            collect: (text, json, eat, out, isHead) => arm(text, json, eat, (start, end, undecided) => out.push(undecided === true ? { start, end, repl, rank, order, undecided } : { start, end, repl, rank, order }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
@@ -2459,7 +2571,7 @@ const armPool = (() => {
             order,
             phase: 2,
             lexical: false,
-            collect: (scan, text, json, eat, out) => arm(scan, text, json, eat, (start, end) => out.push({ start, end, repl, rank, order })),
+            collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, undecided) => out.push(undecided === true ? { start, end, repl, rank, order, undecided } : { start, end, repl, rank, order }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
@@ -2467,22 +2579,22 @@ const armPool = (() => {
     };
     const structuralScannerMember = (row, order) => {
         if (row === PEM_FENCE_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span) => collectPemFenceSpans(text, span));
+            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectPemFenceSpans(text, span, isHead));
         if (row === SSH2_FENCE_PATTERN)
-            return forensicMember(row[1], order, (scan, text, _json, _eat, span) => collectSsh2FenceSpans(scan, text, span));
+            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, span, isHead));
         if (row === URL_CREDENTIAL_PATTERN)
-            return forensicMember(row[1], order, (scan, text, json, _eat, span) => collectUrlCredentialSpans(scan, text, json, span));
+            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead));
         if (row === JSON_SECRET_FIELD_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span) => collectJsonSecretFieldSpans(text, span));
+            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead));
         throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
     };
     const members = [];
     for (const row of STRUCTURAL_SECRET_PATTERNS)
         members.push(structuralScannerMember(row, members.length));
-    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span) => collectPpkContainerSpans(scan, text, eat, span)));
+    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead)));
     members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span) => collectPemFragmentSpans(scan, text, json, span)));
-    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span) => collectHeadlessPpkSpans(scan, text, span)));
-    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span) => collectAnchoredValueSpans(text, json, span), ARM_RANK.keyword, true));
+    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead)));
+    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead) => collectAnchoredValueSpans(text, json, span, isHead), ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
@@ -2513,8 +2625,9 @@ const armPool = (() => {
     const headFirstUnit = unionMembers(retryMembers.map((m) => m.headFirst)) ?? new Uint32Array(0x10000 >>> 5).fill(0xffffffff);
     poolArmCount = members.length;
     poolBoundaryArmCount = retryMembers.length;
-    return (text, wantCount, json, eat, scope) => {
+    return (text, wantCount, json, eat, scope, reach) => {
         readings += 1;
+        const isHead = reach !== undefined;
         const lane = LANES[scope];
         const spans = [];
         let tried;
@@ -2550,7 +2663,7 @@ const armPool = (() => {
             }
         };
         for (const m of lane.phase1)
-            m.collect(text, json, eat, spans);
+            m.collect(text, json, eat, spans, isHead);
         closeCoveragePositions(0);
         if (lane.phase2.length > 0) {
             const scan = buildForensicScan(credentialSpans(text), lane.phase2.length);
@@ -2567,7 +2680,7 @@ const armPool = (() => {
                     }
                     scan.footLo = FOOT_NONE;
                     scan.footHi = -1;
-                    lane.phase2[j].collect(scan, text, json, level === 0 ? eat : undefined, spans);
+                    lane.phase2[j].collect(scan, text, json, level === 0 ? eat : undefined, spans, isHead);
                     foot[2 * j] = scan.footLo;
                     foot[2 * j + 1] = scan.footHi;
                     forensicRuns += 1;
@@ -2582,11 +2695,12 @@ const armPool = (() => {
             }
         }
         poolSpanCount += spans.length;
-        const kept = resolveSpanOverlaps(spans);
+        const survives = (sp) => sp.undecided !== true || reach === undefined || reach(sp.start);
+        const kept = resolveSpanOverlaps(reach === undefined ? spans : spans.filter(survives));
         if (!wantCount || kept.length === 0)
             return { hits: NO_HITS, kept };
         const tokenOf = (sp) => members[sp.order].token;
-        const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full").sort((a, b) => a.start - b.start);
+        const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full" && survives(sp)).sort((a, b) => a.start - b.start);
         const byArmedToken = new Map();
         const stamped = [];
         let si = 0;
@@ -2613,8 +2727,8 @@ let onRedaction;
 export function setRedactionObserver(fn) {
     onRedaction = fn;
 }
-function applyRules(text, wantCount, json, eat, scope) {
-    return armPool(text, wantCount, json, eat, scope);
+function applyRules(text, wantCount, json, eat, scope, reach) {
+    return armPool(text, wantCount, json, eat, scope, reach);
 }
 function reportHits(hits) {
     if (onRedaction === undefined)
@@ -2627,6 +2741,7 @@ function reportHits(hits) {
         }
     }
 }
+export const WHOLE_EXTENT = { kind: "whole" };
 function invisibleClassesOf(layout) {
     switch (layout) {
         case "multi-line":
@@ -2639,7 +2754,99 @@ function invisibleClassesOf(layout) {
         }
     }
 }
-function runRedaction(text, observe, json, wantHits, scope, layout) {
+function trailingPartialEscapeStart(s) {
+    const n = s.length;
+    const runStart = (end) => {
+        let k = end;
+        while (k > 0 && s.charCodeAt(k - 1) === CH_BACKSLASH)
+            k -= 1;
+        return k;
+    };
+    const highSurrogateEscapeStartBefore = (end) => {
+        let j = end;
+        let value = -1;
+        let bodyStart = -1;
+        if (j >= 1 && s.charCodeAt(j - 1) === CH_RBRACE) {
+            let k = j - 1;
+            while (k > 0 && hexDigitValue(s.charCodeAt(k - 1)) >= 0)
+                k -= 1;
+            if (k >= 2 && s.charCodeAt(k - 1) === CH_LBRACE && s.charCodeAt(k - 2) === CH_u && j - 1 - k >= 1) {
+                value = readHexRunValue(s, k, j - 1);
+                bodyStart = k - 2;
+            }
+        }
+        else if (j >= 5 && s.charCodeAt(j - 5) === CH_u) {
+            value = readHexRun(s, j - 4, 4);
+            bodyStart = j - 5;
+        }
+        if (value < 0xd800 || value > 0xdbff)
+            return -1;
+        const k = runStart(bodyStart);
+        return k < bodyStart ? k : -1;
+    };
+    let j = n;
+    while (j > 0 && hexDigitValue(s.charCodeAt(j - 1)) >= 0)
+        j -= 1;
+    const hexRun = n - j;
+    let element = -1;
+    if (j >= 2 && s.charCodeAt(j - 1) === CH_LBRACE && s.charCodeAt(j - 2) === CH_u)
+        element = j - 2;
+    else if (j >= 1 && s.charCodeAt(j - 1) === CH_u && hexRun <= 3)
+        element = j - 1;
+    else if (j >= 1 && s.charCodeAt(j - 1) === CH_x && hexRun <= 1)
+        element = j - 1;
+    else if (hexRun === 0 && n >= 1 && s.charCodeAt(n - 1) === CH_BACKSLASH)
+        element = n;
+    if (element >= 0) {
+        const k = runStart(element);
+        if (k >= element)
+            return -1;
+        const high = highSurrogateEscapeStartBefore(k);
+        return high >= 0 ? high : k;
+    }
+    return highSurrogateEscapeStartBefore(n);
+}
+function readHexRunValue(s, from, to) {
+    let v = 0;
+    for (let k = from; k < to; k++) {
+        const d = hexDigitValue(s.charCodeAt(k));
+        if (d < 0)
+            return -1;
+        v = v * 16 + d;
+        if (v > 0x10ffff)
+            return -1;
+    }
+    return v;
+}
+function shortestReading(text, layout) {
+    const raw = collectRawControlCuts(text, invisibleClassesOf(layout));
+    const normalized = normalizeForRedaction(deleteInvisibleCharacters(text, raw, raw.present).text);
+    const open = trailingPartialEscapeStart(normalized);
+    const spelled = collectSpelledCuts(normalized);
+    const length = deleteInvisibleCharacters(normalized, spelled, spelled.present).text.length;
+    return open < 0 ? { visible: length, partial: false } : { visible: length - (normalized.length - open), partial: true };
+}
+export function readingHeadEnd(text, layout, units, from = 0) {
+    const rest = text.length - from;
+    let len = Math.min(rest, units);
+    let first = true;
+    let grow = 64;
+    while (len < rest) {
+        const { visible, partial } = shortestReading(text.slice(from, from + len), layout);
+        if (visible >= units) {
+            if (!partial)
+                return from + len;
+            len = Math.min(rest, len + grow);
+            grow *= 2;
+            continue;
+        }
+        const step = first && visible * 2 >= len ? Math.ceil((units - visible) / (visible / len)) + 1 : Math.max(units - visible, len);
+        first = false;
+        len = Math.min(rest, len + step);
+    }
+    return text.length;
+}
+function runRedaction(text, observe, json, wantHits, scope, layout, extent) {
     const wantCount = wantHits || (onRedaction !== undefined && observe);
     const eat = observe ? { from: -1, len: 0 } : undefined;
     let spans = [];
@@ -2647,15 +2854,17 @@ function runRedaction(text, observe, json, wantHits, scope, layout) {
     let readsSoFar = 0;
     let unioned = false;
     const read = (layers, view) => {
-        const r = applyRules(view, wantCount, json, eat, scope);
+        const toOriginal = createViewToOriginal(layers);
+        const reach = extent.kind === "head" ? (viewStart) => toOriginal.start(viewStart) < extent.emitEnd : undefined;
+        const r = applyRules(view, wantCount, json, eat, scope, reach);
         forgetEscapedSeparatorTails();
         readsSoFar += 1;
         if (readsSoFar === 1) {
-            spans = spansInOriginal(layers, r.kept);
+            spans = toOriginal.spans(r.kept);
             hits = r.hits;
             return;
         }
-        const extra = spansInOriginal(layers, r.kept);
+        const extra = toOriginal.spans(r.kept);
         if (extra.length === 0)
             return;
         spans = resolveSpanOverlaps([...spans, ...extra]);
@@ -2697,41 +2906,36 @@ function hitsOfSpans(spans) {
     }
     return [...by.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm }));
 }
-function spansInOriginal(layers, kept) {
-    let out = kept;
-    for (const layer of layers) {
-        if (out.length === 0)
-            return out;
-        let at;
+function createViewToOriginal(layers) {
+    let ats;
+    const layerMaps = () => (ats ??= layers.flatMap((layer) => {
         if ("fold" in layer) {
             const fold = layer.fold;
-            if (fold.at === undefined)
-                continue;
-            at = (v) => viewIndexInInput(fold, v);
+            return fold.at === undefined ? [] : [(v) => viewIndexInInput(fold, v)];
         }
-        else {
-            if (layer.view === layer.input)
-                continue;
-            const map = mapNormalizedToOriginal(layer.input, layer.view);
-            at = (v) => map[v];
-        }
-        out = out.map((s) => ({ ...s, start: at(s.start), end: at(s.end - 1) + 1 }));
-    }
-    return out;
+        if (layer.view === layer.input)
+            return [];
+        const map = mapNormalizedToOriginal(layer.input, layer.view);
+        return [(v) => map[v]];
+    }));
+    return {
+        start: (viewIndex) => layerMaps().reduce((p, at) => at(p), viewIndex),
+        spans: (kept) => (kept.length === 0 ? kept : layerMaps().reduce((out, at) => out.map((s) => ({ ...s, start: at(s.start), end: at(s.end - 1) + 1 })), kept)),
+    };
 }
 export function redactSecrets(text, opts) {
-    return runRedaction(text, opts?.observe ?? true, opts?.json === true, false, "free-text", "multi-line").text;
+    return runRedaction(text, opts?.observe ?? true, opts?.json === true, false, "free-text", "multi-line", WHOLE_EXTENT).text;
 }
 export function redactSecretsWithArms(text, opts) {
-    const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true, "free-text", "multi-line");
+    const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true, "free-text", "multi-line", WHOLE_EXTENT);
     return { text: r.text, arms: new Set(r.hits.map((h) => h.arm)) };
 }
 export function redactionSpansForTest(text, opts) {
-    const r = runRedaction(text, false, opts?.json === true, false, "free-text", "multi-line");
+    const r = runRedaction(text, false, opts?.json === true, false, "free-text", "multi-line", WHOLE_EXTENT);
     return { text: r.text, spans: r.spans.map((sp) => ({ start: sp.start, end: sp.end })) };
 }
-export function proposeRedactionSpans(text, scope, layout) {
-    return runRedaction(text, true, false, false, scope, layout).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
+export function proposeRedactionSpans(text, scope, layout, extent) {
+    return runRedaction(text, true, false, false, scope, layout, extent).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
 }
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
@@ -2833,7 +3037,7 @@ function unitCarriesCredential(unit) {
         for (const v of armValueClassViews())
             views.add(boundedUnitView(spelling, v.inClass, v.filler));
     views.delete("");
-    const hit = [...views].some((view) => runRedaction(view, true, false, false, "bounded-unit", "multi-line").text !== view);
+    const hit = [...views].some((view) => runRedaction(view, true, false, false, "bounded-unit", "multi-line", WHOLE_EXTENT).text !== view);
     return { hit, unreadable: decoded.residue };
 }
 function displaySafePathname(pathname) {
@@ -2863,7 +3067,7 @@ function shapeLawCredentialInQueryOrFragment(canonical) {
     const boundary = canonical.indexOf("?");
     if (boundary < 0)
         return false;
-    if (runRedaction(canonical, false, false, false, "free-text", "multi-line").spans.some((sp) => sp.end > boundary))
+    if (runRedaction(canonical, false, false, false, "free-text", "multi-line", WHOLE_EXTENT).spans.some((sp) => sp.end > boundary))
         return true;
     for (const unit of canonical.slice(boundary + 1).split("&").flatMap((sg) => {
         const eq = sg.indexOf("=");