@sema-agent/server 7.79.2 → 7.80.0

package/dist/trace/redact.js

@@ -206,7 +206,6 @@ function forgetEscapedSeparatorTails() {
     escapedTailsValue = undefined;
 }
 const VALUE_ARM_STICKY = new Map();
-const POOL_ONLY_ARMS = new Set();
 const VALUE_ARM_BODIES = [];
 const valueArm = (prefixSrc, valueClass, min, evidence) => {
     const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
@@ -226,28 +225,31 @@ const valueArm = (prefixSrc, valueClass, min, evidence) => {
             }
         }
     })();
-    POOL_ONLY_ARMS.add(g);
     return g;
 };
 let anyValueArm;
 function anyValueArmRe() {
     return (anyValueArm ??= new RegExp(`(?:${VALUE_ARM_BODIES.join("|")})`, "y"));
 }
-const ARM_RANK = { keyword: 1, shape: 2, fragment: 3 };
+const ARM_RANK = { structural: 0, keyword: 1, shape: 2, fragment: 3 };
 let poolSpanCount = 0;
 let poolArmCount = 0;
 let poolBoundaryArmCount = 0;
 let coveredPositions = 0;
 let headScreenHits = 0;
 let fullYCalls = 0;
+let forensicLevels = 0;
+let ssh2ScanBytes = 0;
 export function armPoolBudgetForTest() {
-    return { spanCount: poolSpanCount, coveredPositions, headScreenHits, fullYCalls, armCount: poolArmCount, boundaryArmCount: poolBoundaryArmCount };
+    return { spanCount: poolSpanCount, coveredPositions, headScreenHits, fullYCalls, armCount: poolArmCount, boundaryArmCount: poolBoundaryArmCount, forensicLevels, ssh2ScanBytes };
 }
 export function resetArmPoolBudgetForTest() {
     poolSpanCount = 0;
     coveredPositions = 0;
     headScreenHits = 0;
     fullYCalls = 0;
+    forensicLevels = 0;
+    ssh2ScanBytes = 0;
 }
 const unitBit = (t, c) => (t[c >>> 5] >>> (c & 31)) & 1;
 let codeUnitDomain;
@@ -477,16 +479,17 @@ function deriveLiteralHead(re) {
         first: unionMembers(per.map((p) => p.first)),
     };
 }
-function scanResumeAfterHit(start, end, head) {
-    return Math.max(start + 1, end - Math.max(head - 1, 0));
+function scanResumeAfterHit(start, end, back) {
+    return Math.max(start + 1, end - back);
 }
+const spanOffset = (a, m) => (a.outside === 1 ? m[1].length : 0);
 function collectRegexSpans(a, text, out) {
     const g = a.g;
     g.lastIndex = 0;
     for (let m = g.exec(text); m !== null; m = g.exec(text)) {
         const end = m.index + m[0].length;
-        out.push({ start: m.index, end, repl: a.repl, rank: a.rank, order: a.order });
-        g.lastIndex = scanResumeAfterHit(m.index, end, a.head);
+        out.push({ start: m.index + spanOffset(a, m), end, repl: a.repl, rank: a.rank, order: a.order });
+        g.lastIndex = scanResumeAfterHit(m.index, end, a.back);
     }
 }
 function resolveSpanOverlaps(spans) {
@@ -514,7 +517,7 @@ function applySpans(text, spans) {
     return { out: parts.join(""), count: spans.length };
 }
 function collectValueArmSpans(arm, text, out) {
-    const { g, y, head, repl, rank, order } = arm;
+    const { g, y, back, repl, rank, order } = arm;
     const tails = escapedSeparatorTails(text);
     if (tails === undefined) {
         collectRegexSpans(arm, text, out);
@@ -563,11 +566,11 @@ function collectValueArmSpans(arm, text, out) {
         else
             break;
         out.push({ start: idx, end, repl, rank, order });
-        pos = scanResumeAfterHit(idx, end, head);
+        pos = scanResumeAfterHit(idx, end, back);
     }
 }
 function collectStickySpans(a, text, at, out) {
-    const { y, head, repl, rank, order } = a;
+    const { y, back, repl, rank, order } = a;
     let pos = 0;
     for (const p of at) {
         if (p < pos)
@@ -578,15 +581,14 @@ function collectStickySpans(a, text, at, out) {
         if (m === null)
             continue;
         const end = p + m[0].length;
-        out.push({ start: p, end, repl, rank, order });
-        pos = scanResumeAfterHit(p, end, head);
+        out.push({ start: p + spanOffset(a, m), end, repl, rank, order });
+        pos = scanResumeAfterHit(p, end, back);
     }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => {
     const re = new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
         `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${atLeast(valueClass, min)}${tailSrc})`, "g");
-    POOL_ONLY_ARMS.add(re);
     return re;
 };
 const STRUCTURAL_SECRET_PATTERNS = [
@@ -633,6 +635,8 @@ function skipPemSeps(s, i, limit) {
     for (;;) {
         if (i >= limit)
             return i;
+        if (opaqueUnitEnd(i) >= 0)
+            return i;
         const c = s.charCodeAt(i);
         if (isSepCode(c)) {
             i += 1;
@@ -675,16 +679,16 @@ function pemInlineSepLen(s, i, limit) {
     return 0;
 }
 function probePemHeaderToken(s, p, limit) {
-    if (p >= limit || !isIdentStartCode(s.charCodeAt(p)))
+    if (p >= limit || opaqueUnitEnd(p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
         return -1;
     p += 1;
     let identLen = 1;
-    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && isIdentCode(s.charCodeAt(p))) {
+    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && opaqueUnitEnd(p) < 0 && isIdentCode(s.charCodeAt(p))) {
         p += 1;
         identLen += 1;
     }
     for (;;) {
-        if (p >= limit)
+        if (p >= limit || opaqueUnitEnd(p) >= 0)
             return -1;
         const c = s.charCodeAt(p);
         if (c === CH_SPACE || c === CH_TAB) {
@@ -716,6 +720,11 @@ function parsePemHeaderLine(s, i, limit, allowBare, json) {
     for (;;) {
         if (p >= limit)
             return setPemHdr(start, p, p, true);
+        const unit = opaqueUnitEnd(p);
+        if (unit >= 0) {
+            p = Math.min(unit, limit);
+            continue;
+        }
         const c = s.charCodeAt(p);
         if (c !== CH_CR && c !== CH_LF && c !== CH_SPACE && c !== CH_TAB && c !== CH_BACKSLASH && c !== CH_QUOTE) {
             p += 1;
@@ -741,6 +750,8 @@ function parsePemHeaderLine(s, i, limit, allowBare, json) {
         }
         let q = p;
         for (;;) {
+            if (opaqueUnitEnd(q) >= 0)
+                break;
             const b = pemLineBreakLen(s, q, limit);
             if (b === 1)
                 return setPemHdr(start, p, q + 1, false);
@@ -766,7 +777,7 @@ function parsePemBody(s, i, limit) {
     for (;;) {
         const q = skipPemSeps(s, p, limit);
         let r = q;
-        while (r < limit && isBase64Code(s.charCodeAt(r)))
+        while (r < limit && opaqueUnitEnd(r) < 0 && isBase64Code(s.charCodeAt(r)))
             r += 1;
         if (r - q < PEM_BODY_RUN_MIN)
             break;
@@ -779,13 +790,15 @@ function rightmostPemRunEnd(s, from, to) {
     let best = -1;
     let runStart = -1;
     for (let p = from; p <= to; p++) {
-        if (p < to && s.charCodeAt(p) === CH_LAQUO) {
-            const tokenEnd = redactionTokenEndAt(s, p, to);
-            if (tokenEnd > 0) {
+        if (p < to) {
+            const unit = opaqueUnitEnd(p);
+            if (unit > 0) {
                 if (runStart >= 0 && p - runStart >= PEM_BODY_RUN_MIN)
                     best = p;
                 runStart = -1;
-                p = tokenEnd - 1;
+                if (unit > to)
+                    return best;
+                p = unit - 1;
                 continue;
             }
         }
@@ -832,15 +845,74 @@ function findPemFence(text, from) {
         if (close < 0)
             return undefined;
         from = labelFrom;
+        if (inOpaqueUnit(fence))
+            continue;
         if (!isPemFenceLabel(text, labelFrom, close))
             continue;
         return { fence, after: close + PEM_FENCE_CLOSE.length };
     }
 }
-function redactPemFragments(text, json) {
-    let count = 0;
-    let out;
-    let copied = 0;
+const SSH2_FENCE_OPEN = "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----";
+const SSH2_FENCE_CLOSE = "---- END SSH2 ENCRYPTED PRIVATE KEY ----";
+const SSH2_BODY_MAX = 8192;
+function unitCountWithin(from, to, max) {
+    if (to - from <= max)
+        return true;
+    const st = scanEvidence.starts;
+    if (st.length === 0)
+        return false;
+    const k = firstCredentialSpanFrom(scanEvidence, from);
+    if (k >= st.length || st[k] >= to)
+        return false;
+    let n = 0;
+    for (let p = from; p < to;) {
+        if (n > max)
+            return false;
+        const unit = opaqueUnitEnd(p);
+        p = unit > 0 && unit <= to ? unit : p + 1;
+        n += 1;
+    }
+    return n <= max;
+}
+function collectSsh2FenceSpans(text, span) {
+    let cachedFrom = 0;
+    let cachedAt;
+    const nextClose = (from) => {
+        if (cachedAt !== undefined && cachedFrom <= from && (cachedAt < 0 || cachedAt >= from))
+            return cachedAt;
+        let p = text.indexOf(SSH2_FENCE_CLOSE, from);
+        ssh2ScanBytes += (p < 0 ? text.length : p) - from;
+        while (p >= 0 && inOpaqueUnit(p)) {
+            const q = text.indexOf(SSH2_FENCE_CLOSE, p + 1);
+            ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
+            p = q;
+        }
+        cachedFrom = from;
+        cachedAt = p;
+        return p;
+    };
+    for (let from = 0;;) {
+        const fence = text.indexOf(SSH2_FENCE_OPEN, from);
+        if (fence < 0)
+            return;
+        if (inOpaqueUnit(fence)) {
+            from = fence + 1;
+            continue;
+        }
+        const bodyFrom = fence + SSH2_FENCE_OPEN.length;
+        const close = nextClose(bodyFrom);
+        if (close < 0)
+            return;
+        if (!unitCountWithin(bodyFrom, close, SSH2_BODY_MAX)) {
+            from = fence + 1;
+            continue;
+        }
+        const end = close + SSH2_FENCE_CLOSE.length;
+        span(fence, end);
+        from = scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length);
+    }
+}
+function collectPemFragmentSpans(text, json, span) {
     let cur = findPemFence(text, 0);
     let inherited = false;
     while (cur !== undefined) {
@@ -867,29 +939,24 @@ function redactPemFragments(text, json) {
         let bodyEnd = parsePemBody(text, pos, limit);
         if (bodyEnd < 0)
             bodyEnd = rightmost;
-        if (bodyEnd >= 0) {
-            out ??= [];
-            out.push(text.slice(copied, cur.fence), PEM_FRAGMENT_TOKEN);
-            copied = bodyEnd;
-            count += 1;
-        }
+        if (bodyEnd >= 0)
+            span(cur.fence, bodyEnd);
         cur = next;
     }
-    if (out === undefined)
-        return { out: text, count: 0 };
-    out.push(text.slice(copied));
-    return { out: out.join(""), count };
 }
-function redactHeadlessPpkBodies(text) {
+function collectHeadlessPpkSpans(text, span) {
     const KEY = "Private-Lines: ";
     const n = text.length;
     const isB64 = (c) => (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 43 || c === 47 || c === 61;
-    const skipHs = (i) => { while (i < n && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
+    const b64At = (i) => opaqueUnitEnd(i) < 0 && isB64(text.charCodeAt(i));
+    const skipHs = (i) => { while (i < n && opaqueUnitEnd(i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
         i += 1; return i; };
     const skipNewlines = (i) => {
         let q = skipHs(i);
         let seen = false;
         for (;;) {
+            if (opaqueUnitEnd(q) >= 0)
+                break;
             let any = false;
             if (text.charCodeAt(q) === 13) {
                 q += 1;
@@ -921,6 +988,8 @@ function redactHeadlessPpkBodies(text) {
         return seen ? q : -1;
     };
     const escapedNewlineLen = (i) => {
+        if (opaqueUnitEnd(i) >= 0)
+            return 0;
         let k = i;
         while (k < n && text.charCodeAt(k) === 92)
             k += 1;
@@ -933,20 +1002,23 @@ function redactHeadlessPpkBodies(text) {
         const b = skipHs(i);
         if (b >= n)
             return true;
+        if (opaqueUnitEnd(b) >= 0)
+            return false;
         const c = text.charCodeAt(b);
         return c === 10 || c === 13 || c === 34 || escapedNewlineLen(b) > 0;
     };
-    let out = "";
-    let last = 0;
-    let count = 0;
     let search = 0;
     for (;;) {
         const at = text.indexOf(KEY, search);
         if (at === -1)
             break;
+        if (inOpaqueUnit(at)) {
+            search = at + KEY.length;
+            continue;
+        }
         let p = at + KEY.length;
         const d0 = p;
-        while (p < n && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
+        while (p < n && opaqueUnitEnd(p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
             p += 1;
         if (p === d0) {
             search = at + KEY.length;
@@ -959,15 +1031,15 @@ function redactHeadlessPpkBodies(text) {
             if (q0 === -1)
                 break;
             let q = q0;
-            const mk = text.charCodeAt(q);
+            const mk = opaqueUnitEnd(q) < 0 ? text.charCodeAt(q) : -1;
             if (mk === 43 || mk === 45)
                 q = skipHs(q + 1);
             let r = q;
-            while (r < n && isB64(text.charCodeAt(r)))
+            while (r < n && b64At(r))
                 r += 1;
             if (r - q < 4) {
                 r = q0;
-                while (r < n && isB64(text.charCodeAt(r)))
+                while (r < n && b64At(r))
                     r += 1;
                 if (r - q0 < 4)
                     break;
@@ -981,12 +1053,9 @@ function redactHeadlessPpkBodies(text) {
             search = p;
             continue;
         }
-        out += text.slice(last, at) + HEADLESS_PPK_TOKEN;
-        last = end;
+        span(at, end);
         search = end;
-        count += 1;
     }
-    return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
 const FRAGMENT_SECRET_PATTERNS = [
     [valueArm("sk-", "[A-Za-z0-9_-]", 6, "needs-left-boundary"), "«redacted:key:partial»"],
@@ -1000,21 +1069,12 @@ const FRAGMENT_SECRET_PATTERNS = [
 ];
 const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
-const REDACTION_TOKEN_MAX = Math.max(...[...REDACTION_TOKENS].map((t) => t.length));
 {
     const closed = new RegExp(`^${REDACTION_TOKEN_RE_SRC}$`);
     for (const t of REDACTION_TOKENS)
         if (!closed.test(t))
             throw new Error(`redact: token ${t} is outside the closed form ${REDACTION_TOKEN_RE_SRC}`);
 }
-function redactionTokenEndAt(s, p, limit) {
-    const max = Math.min(limit, p + REDACTION_TOKEN_MAX);
-    for (let e = p + 2; e <= max; e++) {
-        if (s.charCodeAt(e - 1) === 187)
-            return REDACTION_TOKENS.has(s.slice(p, e)) ? e : 0;
-    }
-    return 0;
-}
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
 const FRAGMENT_ARM_TOKENS = new Set(FRAGMENT_SECRET_PATTERNS.map(([, repl]) => repl));
 {
@@ -1031,42 +1091,118 @@ const FRAGMENT_ARM_TOKENS = new Set(FRAGMENT_SECRET_PATTERNS.map(([, repl]) => r
 }
 const armOfToken = (repl) => (FRAGMENT_ARM_TOKENS.has(repl) ? "fragment" : "full");
 const NO_HITS = [];
-const singleHit = (label, arm, r) => r.count > 0 ? { out: r.out, hits: [{ label, count: r.count, arm }] } : { out: r.out, hits: NO_HITS };
-const regexRule = ([re, repl]) => {
-    const groupCount = (new RegExp(`${re.source}|`).exec("")?.length ?? 1) - 1;
-    const refs = [...repl.matchAll(/\$(.)/g)].map(([, d]) => d ?? "");
-    for (const d of refs) {
-        if (!/^[1-9]$/.test(d) || Number(d) > groupCount)
-            throw new Error(`redact: replacement ${JSON.stringify(repl)} uses unsupported ref $${d}`);
-    }
-    const expand = refs.length === 0 ? undefined : (args) => repl.replace(/\$([1-9])/g, (_, d) => args[Number(d)] ?? "");
-    const arm = armOfToken(repl);
-    if (POOL_ONLY_ARMS.has(re) || arm === "fragment")
-        throw new Error(`redact: rule ${JSON.stringify(repl)} belongs in the arm pool, not a per-arm section`);
-    const label = labelOfToken(repl);
-    const applyOnce = (text, wantCount) => {
-        if (!wantCount)
-            return { out: text.replace(re, repl), count: 0 };
-        let n = 0;
-        const out = text.replace(re, (...args) => {
-            n += 1;
-            return expand === undefined ? repl : expand(args);
-        });
-        return { out, count: n };
-    };
-    return { run: (text, wantCount) => singleHit(label, arm, applyOnce(text, wantCount)) };
-};
 const URL_USERINFO_PATTERN = (() => {
     const row = FULL_ARM_PATTERNS.find(([, repl]) => repl.endsWith("»@"));
     if (row === undefined)
         throw new Error("redact: URL-userinfo rule missing from FULL_ARM_PATTERNS");
     return row;
 })();
+const SSH2_FENCE_PATTERN = (() => {
+    const row = FULL_ARM_PATTERNS.find(([re]) => re.source.startsWith(SSH2_FENCE_OPEN));
+    if (row === undefined)
+        throw new Error("redact: SSH2 fence rule missing from FULL_ARM_PATTERNS");
+    return row;
+})();
 const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 || c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff;
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
+const TOKEN_UNIT_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+function tokenUnitEnd(text, p) {
+    TOKEN_UNIT_Y.lastIndex = p;
+    return TOKEN_UNIT_Y.test(text) ? TOKEN_UNIT_Y.lastIndex : -1;
+}
+const NO_CREDENTIAL_SPANS = { starts: new Int32Array(0), ends: new Int32Array(0) };
+function credentialSpans(text, spans, withSpans) {
+    const iv = withSpans ? spans.map((sp) => [sp.start, sp.end]) : [];
+    for (let i = text.indexOf("«"); i >= 0; i = text.indexOf("«", i + 1)) {
+        const e = tokenUnitEnd(text, i);
+        if (e > 0) {
+            iv.push([i, e]);
+            i = e - 1;
+        }
+    }
+    if (iv.length === 0)
+        return NO_CREDENTIAL_SPANS;
+    iv.sort((a, b) => a[0] - b[0]);
+    const starts = new Int32Array(iv.length);
+    const ends = new Int32Array(iv.length);
+    let k = 0;
+    let [cs, ce] = iv[0];
+    for (let j = 1; j < iv.length; j++) {
+        const [s2, e2] = iv[j];
+        if (s2 <= ce)
+            ce = Math.max(ce, e2);
+        else {
+            starts[k] = cs;
+            ends[k] = ce;
+            k += 1;
+            cs = s2;
+            ce = e2;
+        }
+    }
+    starts[k] = cs;
+    ends[k] = ce;
+    k += 1;
+    return { starts: starts.subarray(0, k), ends: ends.subarray(0, k) };
+}
+function sameCredentialSpans(a, b) {
+    if (a.starts.length !== b.starts.length)
+        return false;
+    for (let i = 0; i < a.starts.length; i++)
+        if (a.starts[i] !== b.starts[i] || a.ends[i] !== b.ends[i])
+            return false;
+    return true;
+}
+function firstCredentialSpanFrom(cs, from) {
+    let lo = 0;
+    let hi = cs.starts.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (cs.starts[mid] < from)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo;
+}
+function credentialSpansCover(cs, from, to) {
+    let k = firstCredentialSpanFrom(cs, from + 1) - 1;
+    if (k < 0)
+        k = 0;
+    return k < cs.starts.length && cs.starts[k] <= from && cs.ends[k] >= to;
+}
+let scanEvidence = NO_CREDENTIAL_SPANS;
+let scanEvidenceCursor = 0;
+function setScanEvidence(cs) {
+    scanEvidence = cs;
+    scanEvidenceCursor = 0;
+}
+function inOpaqueUnit(p) {
+    const st = scanEvidence.starts;
+    if (st.length === 0)
+        return false;
+    const k = firstCredentialSpanFrom(scanEvidence, p) - 1;
+    return k >= 0 && st[k] < p && scanEvidence.ends[k] > p;
+}
+function opaqueUnitEnd(p) {
+    const st = scanEvidence.starts;
+    if (st.length === 0)
+        return -1;
+    let k = scanEvidenceCursor;
+    while (k < st.length && st[k] < p)
+        k += 1;
+    while (k > 0 && st[k - 1] >= p)
+        k -= 1;
+    scanEvidenceCursor = k;
+    return k < st.length && st[k] === p ? scanEvidence.ends[k] : -1;
+}
 function scanUserinfoRun(text, i, kind, json) {
     const n = text.length;
     while (i < n) {
+        const unit = opaqueUnitEnd(i);
+        if (unit >= 0) {
+            i = unit;
+            continue;
+        }
         const c = text.charCodeAt(i);
         if (json && c === 92) {
             if (i + 1 < n && !isLineTerminator(text.charCodeAt(i + 1))) {
@@ -1095,48 +1231,19 @@ function scanUserinfoRun(text, i, kind, json) {
     }
     return i;
 }
-const REDACTION_TOKEN_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
-const SHAPE_STICKY = SHAPE_SECRET_PATTERNS.map(([re]) => new RegExp(re.source, "y"));
-function keyShapedUsernameEnd(text, p) {
-    for (const re of SHAPE_STICKY) {
-        re.lastIndex = p;
-        if (re.test(text))
-            return re.lastIndex;
-    }
-    return -1;
-}
 function matchUserinfoAt(text, p, json) {
-    REDACTION_TOKEN_Y.lastIndex = p;
-    const tokEnd = REDACTION_TOKEN_Y.test(text) ? REDACTION_TOKEN_Y.lastIndex : -1;
-    const afterTok = tokEnd >= 0 ? text.charCodeAt(tokEnd) : -1;
-    if (afterTok === 64)
+    const userEnd = scanUserinfoRun(text, p, "plain-user", json);
+    if (text.charCodeAt(userEnd) !== 58)
         return null;
-    let userEnd = -1;
-    let kind;
-    if (afterTok === 58) {
-        userEnd = tokEnd;
-        kind = "token-pass";
-    }
-    else if ((() => { const e = keyShapedUsernameEnd(text, p); return e >= 0 && text.charCodeAt(e) === 58 ? ((userEnd = e), true) : false; })()) {
-        kind = "token-pass";
-    }
-    else {
-        userEnd = scanUserinfoRun(text, p, "plain-user", json);
-        if (text.charCodeAt(userEnd) !== 58)
-            return null;
-        kind = "plain-pass";
-    }
-    const passEnd = scanUserinfoRun(text, userEnd + 1, kind, json);
+    const keyId = userEnd > p && credentialSpansCover(scanEvidence, p, userEnd);
+    const passEnd = scanUserinfoRun(text, userEnd + 1, keyId ? "token-pass" : "plain-pass", json);
     if (passEnd === userEnd + 1 || text.charCodeAt(passEnd) !== 64)
         return null;
     return [userEnd, passEnd + 1];
 }
-function redactUrlUserinfo(text, json) {
-    const [head, repl] = URL_USERINFO_PATTERN;
+function collectUrlUserinfoSpans(text, json, span) {
+    const head = URL_USERINFO_PATTERN[0];
     head.lastIndex = 0;
-    let out = "";
-    let last = 0;
-    let count = 0;
     for (let m = head.exec(text); m !== null; m = head.exec(text)) {
         const colon = m.index;
         const hit = matchUserinfoAt(text, colon + 3, json);
@@ -1144,18 +1251,14 @@ function redactUrlUserinfo(text, json) {
             head.lastIndex = colon + 1;
             continue;
         }
-        const user = text.slice(colon, hit[0]);
-        out += text.slice(last, colon) + repl.replace(/\$1/g, () => user);
-        last = hit[1];
+        span(hit[0], hit[1]);
         head.lastIndex = hit[1];
-        count += 1;
     }
-    return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
-function redactPpkContainers(text, record) {
+function collectPpkContainerSpans(text, record, span) {
     const HEAD = "PuTTY-User-Key-File-";
     const MAC = "Private-MAC: ";
     const HASH = "Private-Hash: ";
@@ -1174,7 +1277,7 @@ function redactPpkContainers(text, record) {
     const isVersionedHead = (at) => {
         let p = at + HEAD.length;
         const start = p;
-        while (p < text.length) {
+        while (p < text.length && opaqueUnitEnd(p) < 0) {
             const c = text.charCodeAt(p);
             if (c >= 48 && c <= 57)
                 p += 1;
@@ -1185,13 +1288,13 @@ function redactPpkContainers(text, record) {
     };
     const nextVersionedHead = (from) => {
         let p = find(HEAD, from);
-        while (p !== Number.POSITIVE_INFINITY && !isVersionedHead(p))
+        while (p !== Number.POSITIVE_INFINITY && (inOpaqueUnit(p) || !isVersionedHead(p)))
             p = find(HEAD, p + HEAD.length);
         return p;
     };
     const hexRunEnd = (from) => {
         let e = from;
-        while (e < text.length) {
+        while (e < text.length && opaqueUnitEnd(e) < 0) {
             const c = text.charCodeAt(e);
             if ((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))
                 e += 1;
@@ -1200,9 +1303,6 @@ function redactPpkContainers(text, record) {
         }
         return e;
     };
-    let out = "";
-    let last = 0;
-    let count = 0;
     let at = nextVersionedHead(0);
     while (at !== Number.POSITIVE_INFINITY) {
         let pos = at + HEAD.length + 1;
@@ -1229,6 +1329,10 @@ function redactPpkContainers(text, record) {
             let gapBlank = true;
             if (limit !== Number.POSITIVE_INFINITY) {
                 for (let i = hexEnd; i < limit; i++) {
+                    if (opaqueUnitEnd(i) >= 0) {
+                        gapBlank = false;
+                        break;
+                    }
                     const c = text.charCodeAt(i);
                     if (c !== 32 && c !== 10 && c !== 13 && c !== 9) {
                         gapBlank = false;
@@ -1242,120 +1346,206 @@ function redactPpkContainers(text, record) {
         }
         if (ateToEnd && record)
             recordFailOpen("server.redact.ppk-eat-to-end", `from=${at} len=${text.length}`);
-        out += text.slice(last, at) + PPK_CONTAINER_TOKEN;
-        last = end;
-        count += 1;
+        span(at, end);
         at = end >= text.length ? Number.POSITIVE_INFINITY : nextVersionedHead(end);
     }
-    return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
-const URL_USERINFO_LABEL = labelOfToken(URL_USERINFO_PATTERN[1]);
-const urlUserinfoRule = { run: (text, _wantCount, json) => singleHit(URL_USERINFO_LABEL, "full", redactUrlUserinfo(text, json)) };
-const armPoolRule = (() => {
-    const arms = [
-        ...KEYWORD_SECRET_PATTERNS.map((row) => [row, ARM_RANK.keyword]),
-        ...SHAPE_SECRET_PATTERNS.map((row) => [row, ARM_RANK.shape]),
-        ...FRAGMENT_SECRET_PATTERNS.map((row) => [row, ARM_RANK.fragment]),
-    ].map(([[re, repl], rank], order) => {
-        if (/\$./.test(repl))
-            throw new Error(`redact: arm-pool replacement ${JSON.stringify(repl)} must not use $N refs`);
+const armPool = (() => {
+    const spanRepl = (token) => {
+        const body = token.startsWith("$1") ? token.slice(2) : token;
+        if (/\$./.test(body))
+            throw new Error(`redact: arm-pool replacement ${JSON.stringify(token)} may only use a leading $1 (the run kept outside the span)`);
+        return body;
+    };
+    const literalAnchorHead = (re) => {
+        const src = re.source;
+        let i = src.startsWith("(") && !src.startsWith("(?") ? 1 : 0;
+        let out = "";
+        for (; i < src.length; i++) {
+            const c = src[i];
+            if (c === "\\") {
+                const e = src[i + 1];
+                if (e === undefined || !HEAD_LITERAL_ESCAPES.has(e))
+                    break;
+                if ("*+?{".includes(src[i + 2] ?? ""))
+                    break;
+                out += src.slice(i, i + 2);
+                i += 1;
+                continue;
+            }
+            if ("([{|).^$*+?".includes(c))
+                break;
+            if ("*+?{".includes(src[i + 1] ?? ""))
+                break;
+            out += c;
+        }
+        if (out.length === 0)
+            throw new Error(`redact: structural arm /${src}/ has no literal anchor head — its same-arm rewind amount cannot be derived`);
+        return out;
+    };
+    const regexMember = ([re, token], rank, order, structural) => {
+        const repl = spanRepl(token);
+        const outside = token.startsWith("$1") ? 1 : 0;
         const y = VALUE_ARM_STICKY.get(re);
-        const head = deriveLiteralHead(re);
-        if (y !== undefined && (head.len === 0 || head.src === undefined || head.first === undefined)) {
-            throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
+        let back;
+        let headSrc;
+        let headFirst;
+        if (structural) {
+            back = literalAnchorHead(re).length;
+            headSrc = undefined;
+            headFirst = undefined;
         }
-        return { g: re, y, head: head.len, headSrc: head.src, headFirst: head.first, repl, rank, order };
-    });
-    const boundaryArms = arms.flatMap((a) => (a.y === undefined || a.headSrc === undefined || a.headFirst === undefined ? [] : [{ ...a, y: a.y, headSrc: a.headSrc, headFirst: a.headFirst }]));
-    const plainArms = arms.filter((a) => a.y === undefined);
-    const headScreen = new RegExp(`(?:${boundaryArms.map((a) => a.headSrc).join("|")})`, "y");
-    const headFirstUnit = unionMembers(boundaryArms.map((a) => a.headFirst)) ?? new Uint32Array(0x10000 >>> 5).fill(0xffffffff);
-    poolArmCount = arms.length;
-    poolBoundaryArmCount = boundaryArms.length;
-    return {
-        run: (text, wantCount) => {
-            const spans = [];
-            for (const a of plainArms)
-                collectRegexSpans(a, text, spans);
-            for (const a of boundaryArms)
-                collectValueArmSpans(a, text, spans);
-            if (boundaryArms.length > 0 && spans.length > 0) {
-                const tried = new Uint8Array(text.length + 1);
-                const freshCovered = (from) => {
-                    const at = [];
-                    for (let k = from; k < spans.length; k++) {
-                        const s = spans[k];
-                        for (let p = s.start; p <= s.end; p++) {
-                            if (tried[p] === 1)
-                                continue;
-                            tried[p] = 1;
-                            coveredPositions += 1;
-                            if (unitBit(headFirstUnit, text.charCodeAt(p)) !== 1)
-                                continue;
-                            headScreen.lastIndex = p;
-                            if (headScreen.exec(text) === null)
-                                continue;
-                            at.push(p);
-                        }
-                    }
-                    headScreenHits += at.length;
-                    return at.sort((x, y) => x - y);
-                };
-                for (let at = freshCovered(0); at.length > 0;) {
-                    const before = spans.length;
-                    for (const a of boundaryArms)
-                        collectStickySpans(a, text, at, spans);
-                    at = freshCovered(before);
-                }
+        else {
+            const d = deriveLiteralHead(re);
+            back = Math.max(d.len - 1, 0);
+            headSrc = d.src;
+            headFirst = d.first;
+            if (y !== undefined && (d.len === 0 || headSrc === undefined || headFirst === undefined)) {
+                throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
             }
-            poolSpanCount += spans.length;
-            const kept = resolveSpanOverlaps(spans);
-            const out = applySpans(text, kept).out;
-            if (!wantCount || kept.length === 0)
-                return { out, hits: NO_HITS };
-            const strong = spans.filter((sp) => armOfToken(sp.repl) === "full").sort((a, b) => a.start - b.start);
-            const byArmedToken = new Map();
-            let si = 0;
-            let strongMaxEnd = -1;
-            for (const sp of kept) {
-                while (si < strong.length && strong[si].start < sp.end) {
-                    strongMaxEnd = Math.max(strongMaxEnd, strong[si].end);
-                    si += 1;
+        }
+        if (y !== undefined && outside === 1)
+            throw new Error(`redact: value arm /${re.source}/ cannot carry an outside-span $1 prefix`);
+        const arm = { g: re, y, back, headSrc, headFirst, repl, rank, order, outside };
+        const boundary = y === undefined || headSrc === undefined || headFirst === undefined ? undefined : { ...arm, y, headSrc, headFirst };
+        return {
+            token,
+            rank,
+            order,
+            phase: 1,
+            collect: boundary === undefined
+                ? (text, _json, _observe, out) => collectRegexSpans(arm, text, out)
+                : (text, _json, _observe, out) => collectValueArmSpans(boundary, text, out),
+            retry: boundary === undefined ? undefined : (text, at, out) => collectStickySpans(boundary, text, at, out),
+            headSrc: boundary === undefined ? undefined : headSrc,
+            headFirst: boundary === undefined ? undefined : headFirst,
+        };
+    };
+    const scannerMember = (token, order, phase, scan) => {
+        const repl = spanRepl(token);
+        return {
+            token,
+            rank: ARM_RANK.structural,
+            order,
+            phase,
+            collect: (text, json, observe, out) => scan(text, json, observe, (start, end) => out.push({ start, end, repl, rank: ARM_RANK.structural, order })),
+            retry: undefined,
+            headSrc: undefined,
+            headFirst: undefined,
+        };
+    };
+    const members = [];
+    for (const row of STRUCTURAL_SECRET_PATTERNS) {
+        const order = members.length;
+        members.push(row === URL_USERINFO_PATTERN
+            ? scannerMember(row[1], order, 2, (text, json, _observe, span) => collectUrlUserinfoSpans(text, json, span))
+            : row === SSH2_FENCE_PATTERN
+                ? scannerMember(row[1], order, 2, (text, _json, _observe, span) => collectSsh2FenceSpans(text, span))
+                : regexMember(row, ARM_RANK.structural, order, true));
+    }
+    members.push(scannerMember(PPK_CONTAINER_TOKEN, members.length, 2, (text, _json, observe, span) => collectPpkContainerSpans(text, observe, span)));
+    members.push(scannerMember(PEM_FRAGMENT_TOKEN, members.length, 2, (text, json, _observe, span) => collectPemFragmentSpans(text, json, span)));
+    members.push(scannerMember(HEADLESS_PPK_TOKEN, members.length, 2, (text, _json, _observe, span) => collectHeadlessPpkSpans(text, span)));
+    for (const row of KEYWORD_SECRET_PATTERNS)
+        members.push(regexMember(row, ARM_RANK.keyword, members.length, false));
+    for (const row of SHAPE_SECRET_PATTERNS)
+        members.push(regexMember(row, ARM_RANK.shape, members.length, false));
+    for (const row of FRAGMENT_SECRET_PATTERNS)
+        members.push(regexMember(row, ARM_RANK.fragment, members.length, false));
+    const retryMembers = members.filter((m) => m.retry !== undefined);
+    const phase1 = members.filter((m) => m.phase === 1);
+    const phase2 = members.filter((m) => m.phase === 2);
+    const headScreen = new RegExp(`(?:${retryMembers.map((m) => m.headSrc).join("|")})`, "y");
+    const headFirstUnit = unionMembers(retryMembers.map((m) => m.headFirst)) ?? new Uint32Array(0x10000 >>> 5).fill(0xffffffff);
+    poolArmCount = members.length;
+    poolBoundaryArmCount = retryMembers.length;
+    return (text, wantCount, json, observe) => {
+        const spans = [];
+        let tried;
+        const freshCovered = (from) => {
+            const at = [];
+            const seen = (tried ??= new Uint8Array(text.length + 1));
+            for (let k = from; k < spans.length; k++) {
+                const s = spans[k];
+                for (let p = s.start; p <= s.end; p++) {
+                    if (seen[p] === 1)
+                        continue;
+                    seen[p] = 1;
+                    coveredPositions += 1;
+                    if (unitBit(headFirstUnit, text.charCodeAt(p)) !== 1)
+                        continue;
+                    headScreen.lastIndex = p;
+                    if (headScreen.exec(text) === null)
+                        continue;
+                    at.push(p);
                 }
-                const arm = strongMaxEnd > sp.start ? "full" : armOfToken(sp.repl);
-                const key = `${sp.repl}\u0000${arm}`;
-                const cur = byArmedToken.get(key);
-                if (cur === undefined)
-                    byArmedToken.set(key, { token: sp.repl, arm, count: 1 });
-                else
-                    cur.count += 1;
             }
-            return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })) };
-        },
+            headScreenHits += at.length;
+            return at.sort((x, y) => x - y);
+        };
+        const closeCoveragePositions = (from) => {
+            if (retryMembers.length === 0 || spans.length === from)
+                return;
+            for (let at = freshCovered(from); at.length > 0;) {
+                const before = spans.length;
+                for (const m of retryMembers)
+                    m.retry(text, at, spans);
+                at = freshCovered(before);
+            }
+        };
+        setScanEvidence(NO_CREDENTIAL_SPANS);
+        for (const m of phase1)
+            m.collect(text, json, observe, spans);
+        closeCoveragePositions(0);
+        if (phase2.length > 0) {
+            let evidence = credentialSpans(text, spans, false);
+            for (let level = 0;; level += 1) {
+                const before = spans.length;
+                setScanEvidence(evidence);
+                for (const m of phase2)
+                    m.collect(text, json, observe && level === 0, spans);
+                closeCoveragePositions(before);
+                forensicLevels += 1;
+                const next = credentialSpans(text, spans, true);
+                if (sameCredentialSpans(next, evidence))
+                    break;
+                evidence = next;
+            }
+            setScanEvidence(NO_CREDENTIAL_SPANS);
+        }
+        poolSpanCount += spans.length;
+        const kept = resolveSpanOverlaps(spans);
+        const out = applySpans(text, kept).out;
+        if (!wantCount || kept.length === 0)
+            return { out, hits: NO_HITS };
+        const tokenOf = (sp) => members[sp.order].token;
+        const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full").sort((a, b) => a.start - b.start);
+        const byArmedToken = new Map();
+        let si = 0;
+        let strongMaxEnd = -1;
+        for (const sp of kept) {
+            while (si < strong.length && strong[si].start < sp.end) {
+                strongMaxEnd = Math.max(strongMaxEnd, strong[si].end);
+                si += 1;
+            }
+            const token = tokenOf(sp);
+            const arm = strongMaxEnd > sp.start ? "full" : armOfToken(token);
+            const key = `${token}\u0000${arm}`;
+            const cur = byArmedToken.get(key);
+            if (cur === undefined)
+                byArmedToken.set(key, { token, arm, count: 1 });
+            else
+                cur.count += 1;
+        }
+        return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })) };
     };
 })();
-const SECRET_RULES = [
-    ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p))),
-    { run: (text, _wantCount, _json, observe) => singleHit(labelOfToken(PPK_CONTAINER_TOKEN), armOfToken(PPK_CONTAINER_TOKEN), redactPpkContainers(text, observe)) },
-    { run: (text, _wantCount, json) => singleHit(labelOfToken(PEM_FRAGMENT_TOKEN), armOfToken(PEM_FRAGMENT_TOKEN), redactPemFragments(text, json)) },
-    { run: (text) => singleHit(labelOfToken(HEADLESS_PPK_TOKEN), armOfToken(HEADLESS_PPK_TOKEN), redactHeadlessPpkBodies(text)) },
-    armPoolRule,
-    { run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, hits: NO_HITS }) },
-];
 let onRedaction;
 export function setRedactionObserver(fn) {
     onRedaction = fn;
 }
 function applyRules(text, wantCount, json, observe) {
-    let out = text;
-    const hits = [];
-    for (const rule of SECRET_RULES) {
-        const r = rule.run(out, wantCount, json, observe);
-        out = r.out;
-        if (wantCount && r.hits.length > 0)
-            hits.push(...r.hits);
-    }
-    return { out, hits };
+    return armPool(text, wantCount, json, observe);
 }
 function reportHits(hits) {
     if (onRedaction === undefined)