@shipi18n/core 2.10.0 → 2.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipi18n/core",
-  "version": "2.10.0",
+  "version": "2.11.1",
   "description": "Translation QA for i18n locale files: placeholder and plural validation, key parity, coverage, and an LLM-as-judge semantic review. Also a structure-preserving translation engine — bring your own OpenAI or Anthropic key.",
   "type": "module",
   "main": "src/index.js",

package/src/formats/android.js

@@ -67,6 +67,71 @@ function unescapeAndroid(s) {
 const isUntranslatable = (el) => el['@_translatable'] === 'false' || el['@_translatable'] === false
 const asArray = (v) => (Array.isArray(v) ? v : v == null ? [] : [v])
 
+/**
+ * AAPT string-escaping rules, applied to the RAW text (before backslash
+ * unescaping). An apostrophe outside a "…"-quoted span must be `\'`, and every
+ * `"` must be balanced or escaped `\"` — an unescaped apostrophe is the classic
+ * `values-fr/strings.xml` build breaker ("Apostrophe not preceded by \\").
+ * Returns a finding descriptor, or null if the string is clean.
+ */
+function androidEscapingProblem(raw) {
+  let inQuote = false
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw[i]
+    if (c === '\\') {
+      i++ // the next char is escaped — skip it
+      continue
+    }
+    if (c === '"') {
+      inQuote = !inQuote
+      continue
+    }
+    if (c === "'" && !inQuote) {
+      return {
+        type: 'android-unescaped-apostrophe',
+        message: "unescaped apostrophe — Android needs \\' or a \"…\"-wrapped string (AAPT compile error)",
+      }
+    }
+  }
+  if (inQuote) {
+    return {
+      type: 'android-unbalanced-quote',
+      message: 'unbalanced double-quote — Android needs \\" for a literal quote (AAPT compile error)',
+    }
+  }
+  return null
+}
+
+/**
+ * Escaping findings for one strings.xml document — the errors AAPT would throw
+ * that the check engine can't see once the parser has decoded the values.
+ * Checked on the raw node text (backslashes/quotes intact). Untranslatable and
+ * unnamed entries are skipped, matching parseAndroidStrings.
+ * @param {string} xml
+ * @returns {Array<{type:string, severity:'error', path:string, message:string}>}
+ */
+export function androidEscapingFindings(xml) {
+  const res = parser.parse(xml)?.resources || {}
+  const findings = []
+  const check = (raw, path) => {
+    const p = androidEscapingProblem(String(raw))
+    if (p) findings.push({ type: p.type, severity: 'error', path, message: p.message })
+  }
+  for (const s of res.string || []) {
+    if (!s['@_name'] || isUntranslatable(s)) continue
+    check(nodeText(s), s['@_name'])
+  }
+  for (const p of res.plurals || []) {
+    if (!p['@_name'] || isUntranslatable(p)) continue
+    for (const it of asArray(p.item)) if (it['@_quantity']) check(nodeText(it), `${p['@_name']}[${it['@_quantity']}]`)
+  }
+  for (const a of res['string-array'] || []) {
+    if (!a['@_name'] || isUntranslatable(a)) continue
+    asArray(a.item).forEach((it, i) => check(nodeText(it), `${a['@_name']}[${i}]`))
+  }
+  return findings
+}
+
 /**
  * Parse a strings.xml document into a plain locale object.
  * @param {string} xml

package/src/formats/po.js

@@ -14,7 +14,7 @@
  */
 import { extractPlaceholders } from '../placeholders.js'
 
-const CTXT_SEP = '\u0004'
+export const CTXT_SEP = '\u0004'
 
 /** Decode the C-style escapes gettext uses in quoted strings. */
 function unescapePo(s) {
@@ -33,13 +33,13 @@ function npluralsFromHeader(headerMsgstr) {
 }
 
 /**
- * Parse a .po/.pot document.
+ * Low-level: parse a .po/.pot into raw entries (msgid/msgctxt/msgstr/msgstrs/
+ * fuzzy), before any check semantics. Shared by parsePo and the WordPress JED
+ * sync check, which needs the plural msgstrs that parsePo folds away.
  * @param {string} text
- * @returns {{ language: string|null, nplurals: number|null,
- *             source: Record<string,string>, target: Record<string,string>,
- *             findings: Array<object> }}
+ * @returns {Array<{msgid?:string,msgctxt?:string,msgidPlural?:string,msgstr?:string,msgstrs?:string[],fuzzy?:boolean}>}
  */
-export function parsePo(text) {
+export function readPoEntries(text) {
   const lines = text.split(/\r?\n/)
   const entries = []
   let cur = null
@@ -94,7 +94,18 @@ export function parsePo(text) {
     }
   }
   flush()
+  return entries
+}
 
+/**
+ * Parse a .po/.pot document into source/target/findings for the check engine.
+ * @param {string} text
+ * @returns {{ language: string|null, nplurals: number|null,
+ *             source: Record<string,string>, target: Record<string,string>,
+ *             findings: Array<object> }}
+ */
+export function parsePo(text) {
+  const entries = readPoEntries(text)
   const source = Object.create(null) // null-proto: crafted keys can't pollute
   const target = Object.create(null)
   const findings = []

package/src/formats/wp-jed.js

@@ -0,0 +1,130 @@
+/**
+ * WordPress `.po` ↔ JED `.json` sync check.
+ *
+ * Since WP 5.0, JavaScript strings are translated from a JED-format JSON that
+ * `wp i18n make-json` GENERATES from the `.po`. The trap: editing the `.po` and
+ * forgetting to re-run make-json. The PHP side then shows the new translation
+ * while the JS side silently serves the stale one — and nothing in the WP
+ * toolchain flags it. This check does.
+ *
+ * Direction matters. The JED file holds only the strings used in JS, so it is a
+ * SUBSET of the `.po`. We therefore validate JED → `.po`:
+ *   - jed-drift : a string whose JED translation differs from the current `.po`
+ *                 msgstr → the JSON is stale, re-run `wp i18n make-json`.
+ *   - jed-orphan: a string in the JED that no longer exists in the `.po` → a
+ *                 removed/renamed source string the JSON still references.
+ * A `.po` string absent from the JED is NOT flagged — that's a normal PHP-only
+ * string, and flagging it would bury the real signal in noise.
+ *
+ * JED shape (make-json output):
+ *   { "domain": "messages",
+ *     "locale_data": { "messages": {
+ *        "": { "domain": ..., "lang": ..., "plural-forms": ... },   // metadata
+ *        "Save": ["Guardar"],                                        // singular
+ *        "ctxtSave": ["Guardar (ctx)"],                        // + context
+ *        "%s item": ["%s artículo", "%s artículos"] } } }           // plural forms
+ */
+import { readPoEntries, CTXT_SEP } from './po.js'
+
+/** A key → translation-forms[] map from a `.po`, matching JED's keying. */
+function poMap(text) {
+  const map = Object.create(null)
+  for (const e of readPoEntries(text)) {
+    if (e.msgid === undefined) continue
+    if (e.msgid === '' && e.msgctxt === undefined) continue // header entry
+    const key = e.msgctxt !== undefined ? `${e.msgctxt}${CTXT_SEP}${e.msgid}` : e.msgid
+    map[key] = e.msgidPlural !== undefined ? e.msgstrs || [] : [e.msgstr ?? '']
+  }
+  return map
+}
+
+/** True if a parsed JSON value looks like a JED locale file. */
+export function isJed(json) {
+  return !!json && typeof json === 'object' && !!json.locale_data && typeof json.locale_data === 'object'
+}
+
+/** Pull the active domain's translation entries out of a JED object. */
+function jedEntries(json) {
+  const ld = json.locale_data
+  const domains = Object.keys(ld)
+  // Prefer the declared domain when present; else the first (make-json emits one).
+  const domain = json.domain && ld[json.domain] ? json.domain : domains[0]
+  const block = ld[domain]
+  if (!block || typeof block !== 'object') throw new Error('JED locale_data has no usable domain block')
+  const entries = Object.create(null)
+  for (const k of Object.keys(block)) {
+    if (k === '') continue // the "" pseudo-entry is metadata, not a string
+    const v = block[k]
+    entries[k] = Array.isArray(v) ? v : [v] // tolerate a bare string value
+  }
+  return { domain, entries }
+}
+
+/** Human-readable form of a possibly context-qualified key. */
+function showKey(key) {
+  return key.includes(CTXT_SEP) ? key.split(CTXT_SEP).join(' ⁄ ') : key
+}
+
+/**
+ * Compare one JED JSON against its source `.po`.
+ * @param {string} poText  raw .po/.pot text
+ * @param {object} jed     parsed JED JSON object
+ * @returns {{ domain?: string, findings: object[],
+ *             stats: { checked:number, drift:number, orphan:number,
+ *                      jedEntries:number, poEntries:number } }}
+ */
+export function checkJedSync(poText, jed) {
+  if (!isJed(jed)) {
+    return {
+      findings: [{ type: 'invalid-file', severity: 'error', path: '(jed)', message: 'not a JED file — no locale_data object' }],
+      stats: { checked: 0, drift: 0, orphan: 0, jedEntries: 0, poEntries: 0 },
+    }
+  }
+  const po = poMap(poText)
+  const { domain, entries } = jedEntries(jed)
+  const findings = []
+  let checked = 0
+  let drift = 0
+  let orphan = 0
+
+  for (const key of Object.keys(entries)) {
+    const jedForms = entries[key]
+    const poForms = po[key]
+    const shown = showKey(key)
+
+    if (poForms === undefined) {
+      orphan++
+      findings.push({
+        type: 'jed-orphan',
+        severity: 'warning',
+        path: shown,
+        message: 'in the JS JSON but not in the .po — a removed/renamed source string the build still ships',
+      })
+      continue
+    }
+
+    checked++
+    const n = Math.max(jedForms.length, poForms.length)
+    for (let i = 0; i < n; i++) {
+      const jt = jedForms[i] ?? ''
+      const pt = poForms[i] ?? ''
+      if (jt !== pt) {
+        drift++
+        findings.push({
+          type: 'jed-drift',
+          severity: 'error',
+          path: n > 1 ? `${shown} [form ${i}]` : shown,
+          message: 'JS JSON is out of sync with the .po — re-run `wp i18n make-json`',
+          source: pt,
+          translation: jt,
+        })
+      }
+    }
+  }
+
+  return {
+    domain,
+    findings,
+    stats: { checked, drift, orphan, jedEntries: Object.keys(entries).length, poEntries: Object.keys(po).length },
+  }
+}

package/src/index.js

@@ -14,12 +14,14 @@ export { translateJSON, translateStrings, flatten, unflatten } from './translate
 export { extractPlaceholders, validatePlaceholders } from './placeholders.js'
 export { isICUControl, checkICU } from './icu.js'
 export { checkTranslations } from './check.js'
-export { runCheck, runSemantic, discoverLayout, compileIgnores, statsFrom, aggregateLanguage, SEP } from './tree.js'
+export { runCheck, runSemantic, discoverLayout, compileIgnores, statsFrom, aggregateLanguage, SEP, scanResultSecrets } from './tree.js'
+export { scanSecrets, maskSecret } from './secrets.js'
 export { lockId, lockEntry, lockFinding, emptyLocks, normalizeLocks, LOCKS_VERSION } from './locks.js'
 export { parseArbBundle, arbLangFromFilename, arbLangFromContent, stripArbMetadata } from './formats/arb.js'
 export { parseXcstrings } from './formats/xcstrings.js'
-export { parseAndroidStrings, androidLangFromValuesDir } from './formats/android.js'
-export { parsePo } from './formats/po.js'
+export { parseAndroidStrings, androidLangFromValuesDir, androidEscapingFindings } from './formats/android.js'
+export { parsePo, readPoEntries, CTXT_SEP } from './formats/po.js'
+export { checkJedSync, isJed } from './formats/wp-jed.js'
 export { parseXliff } from './formats/xliff.js'
 export { reviewTranslations, DEFAULT_JUDGE_MODELS, buildReviewPrompt, parseVerdicts, pairHash } from './review.js'
 export { getLanguageName, LANGUAGE_NAMES } from './languages.js'

package/src/placeholders.js

@@ -42,8 +42,29 @@ export function extractPlaceholders(str) {
   return found.sort()
 }
 
+// An ICU argument used with a function: {count, plural, …}, {gender, select, …},
+// {n, selectordinal, …}, {v, number}, {d, date}, … The bare `{count,` form does
+// not match the single-brace placeholder pattern, so a translation that upgrades
+// a plain {count} to an ICU plural would otherwise read as "dropped {count}".
+const ICU_ARG =
+  /\{\s*([a-zA-Z0-9_]+)\s*,\s*(?:plural|selectordinal|select|number|date|time|spellout|ordinal|duration)\b/g
+const SIMPLE_BRACE = /^\{([a-zA-Z0-9_.]+)\}$/ // a react-intl/ICU {name} placeholder token
+
+/** Names used as ICU function arguments in a string. */
+function icuArgNames(str) {
+  const set = new Set()
+  if (typeof str !== 'string') return set
+  ICU_ARG.lastIndex = 0
+  let m
+  while ((m = ICU_ARG.exec(str)) !== null) set.add(m[1])
+  return set
+}
+
 /**
  * Does the translation preserve exactly the placeholders of the source?
+ * A source `{x}` is considered present when the translation uses `x` as an ICU
+ * argument (`{x, plural|select|…}`) and vice-versa — upgrading a plain variable
+ * to an ICU plural is correct, not a dropped placeholder.
  * @param {string} source
  * @param {string} translation
  * @returns {{ ok: boolean, missing: string[], added: string[] }}
@@ -53,14 +74,20 @@ export function validatePlaceholders(source, translation) {
   const out = extractPlaceholders(translation)
   const outCounts = tally(out)
   const srcCounts = tally(src)
+  const srcIcu = icuArgNames(source)
+  const outIcu = icuArgNames(translation)
   const missing = []
   const added = []
   for (const [ph, n] of Object.entries(srcCounts)) {
-    const diff = n - (outCounts[ph] || 0)
+    let diff = n - (outCounts[ph] || 0)
+    const b = SIMPLE_BRACE.exec(ph)
+    if (diff > 0 && b && outIcu.has(b[1])) diff = 0 // used as an ICU arg in the translation
     for (let i = 0; i < diff; i++) missing.push(ph)
   }
   for (const [ph, n] of Object.entries(outCounts)) {
-    const diff = n - (srcCounts[ph] || 0)
+    let diff = n - (srcCounts[ph] || 0)
+    const b = SIMPLE_BRACE.exec(ph)
+    if (diff > 0 && b && srcIcu.has(b[1])) diff = 0 // source used it as an ICU arg
     for (let i = 0; i < diff; i++) added.push(ph)
   }
   return { ok: missing.length === 0 && added.length === 0, missing, added }

package/src/reporters.js

@@ -76,6 +76,12 @@ export const RULE_META = {
   'semantic-mistranslation': 'LLM judge (majority vote): the translation states something different from the source.',
   'semantic-omission': 'LLM judge (majority vote): meaningful source content is missing from the translation.',
   'semantic-addition': 'LLM judge (majority vote): the translation contains claims the source does not make.',
+  'jed-drift': 'A WordPress JED .json string is out of sync with the .po (re-run wp i18n make-json).',
+  'jed-orphan': 'A WordPress JED .json carries a string the .po no longer has.',
+  'secret-detected': 'A locale string contains a secret or PII (API key, private key, card, email).',
+  'secret-preflight': 'A string was withheld from the LLM because it held a secret or PII.',
+  'android-unescaped-apostrophe': "An Android strings.xml apostrophe is not escaped (\\') or double-quote-wrapped.",
+  'android-unbalanced-quote': 'An Android strings.xml has an unbalanced or unescaped double-quote.',
 }
 
 /** SARIF 2.1.0 — one run, one rule per finding type, one result per finding. */

package/src/secrets.js

@@ -0,0 +1,103 @@
+/**
+ * Secret / PII detection — a pre-flight before `--semantic` ships strings to a
+ * third-party LLM, and an opt-in `check` rule.
+ *
+ * The BYO-LLM privacy story has a hole: a locale string that contains an API key,
+ * a private key, or a customer's email/card gets sent verbatim to the model
+ * provider the moment you run `--semantic`. No i18n tool guards that send. This
+ * does — and because the semantic pass only ever transmits the pairs we scan
+ * here, the pre-flight is complete by construction: what gets sent gets scanned.
+ *
+ * Bias: high precision over recall. False positives that fail a build teach users
+ * to add `--severity secret-preflight=off` and stop trusting the tool, so every
+ * pattern is prefix- or checksum-anchored (Luhn for cards, known key prefixes),
+ * example/test values are filtered out, and phone matching requires a `+` country
+ * code. Matches are always MASKED — a finding never echoes the secret it found.
+ */
+
+/** Mask a matched value so it never appears in a finding, log, or report. */
+export function maskSecret(s) {
+  if (s.length <= 6) return '•'.repeat(s.length)
+  return s.slice(0, 3) + '•'.repeat(Math.min(6, s.length - 5)) + s.slice(-2)
+}
+
+/** Luhn checksum — filters random digit runs from real card numbers. */
+function luhnValid(digits) {
+  let sum = 0
+  let dbl = false
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48
+    if (d < 0 || d > 9) return false
+    if (dbl) {
+      d *= 2
+      if (d > 9) d -= 9
+    }
+    sum += d
+    dbl = !dbl
+  }
+  return sum % 10 === 0 && digits.length >= 13
+}
+
+// Placeholder / documentation emails that should not trip the PII detector.
+const EXAMPLE_EMAIL =
+  /@(?:example\.(?:com|org|net)|test(?:\.\w+)?|localhost|(?:your|my)?(?:company|domain|email|site)\.\w+|acme\.\w+)$/i
+
+// High-confidence secrets first; email/phone (PII) last. Order matters: the first
+// pattern to claim a span wins, so a provider key is never re-reported as a
+// generic token. `re` must be global (we exec in a loop).
+const PATTERNS = [
+  { kind: 'private-key', severity: 'error', re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/g },
+  { kind: 'aws-access-key', severity: 'error', re: /\b(?:AKIA|ASIA|AGPA|AIDA)[0-9A-Z]{16}\b/g },
+  { kind: 'gcp-api-key', severity: 'error', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: 'github-token', severity: 'error', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g },
+  { kind: 'github-pat', severity: 'error', re: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g },
+  { kind: 'slack-token', severity: 'error', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: 'stripe-key', severity: 'error', re: /\b[rs]k_(?:live|test)_[0-9A-Za-z]{16,}\b/g },
+  { kind: 'anthropic-key', severity: 'error', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/g },
+  { kind: 'openai-key', severity: 'error', re: /\bsk-(?:proj-)?[A-Za-z0-9]{20,}\b/g },
+  { kind: 'jwt', severity: 'error', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  { kind: 'credit-card', severity: 'error', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
+  {
+    kind: 'email',
+    severity: 'warning',
+    re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+    filter: (m) => !EXAMPLE_EMAIL.test(m),
+  },
+  // Phone: require a leading + country code — a bare 10-digit run is far too
+  // ambiguous (IDs, timestamps, quantities) to flag without crying wolf.
+  { kind: 'phone', severity: 'warning', re: /\+\d[\d ().-]{7,}\d/g },
+]
+
+/**
+ * Scan one string for secrets / PII.
+ * @param {string} str
+ * @returns {Array<{kind:string, severity:'error'|'warning', masked:string}>}
+ *          masked values only — never the raw secret.
+ */
+export function scanSecrets(str) {
+  if (!str || typeof str !== 'string') return []
+  const hits = []
+  const claimed = [] // [start,end) spans already attributed to a higher-confidence pattern
+  const overlaps = (a, b) => claimed.some(([s, e]) => a < e && b > s)
+
+  for (const p of PATTERNS) {
+    p.re.lastIndex = 0
+    let m
+    while ((m = p.re.exec(str)) !== null) {
+      const val = m[0]
+      if (val === '') {
+        p.re.lastIndex++
+        continue
+      }
+      const start = m.index
+      const end = start + val.length
+      if (overlaps(start, end)) continue
+      if (p.filter && !p.filter(val)) continue
+      if (p.luhn && !luhnValid(val.replace(/\D/g, ''))) continue
+      claimed.push([start, end])
+      hits.push({ kind: p.kind, severity: p.severity, masked: maskSecret(val) })
+      if (hits.length >= 50) return hits // pathological input backstop
+    }
+  }
+  return hits
+}

package/src/tree.js

@@ -14,9 +14,10 @@ import { checkTranslations } from './check.js'
 import { parse as parseYaml } from 'yaml'
 import { parseArbBundle } from './formats/arb.js'
 import { parseXcstrings } from './formats/xcstrings.js'
-import { parseAndroidStrings, androidLangFromValuesDir } from './formats/android.js'
+import { parseAndroidStrings, androidLangFromValuesDir, androidEscapingFindings } from './formats/android.js'
 import { parsePo } from './formats/po.js'
 import { parseXliff } from './formats/xliff.js'
+import { scanSecrets } from './secrets.js'
 
 // Locale files are JSON or YAML. The check logic is format-agnostic once the
 // file is parsed to an object, so support is entirely a parse + discovery
@@ -316,15 +317,19 @@ export function androidStringsMode({ input, source, isIgnored, glossary }) {
     const file = join(dir, d, 'strings.xml')
     const ns = 'strings'
     let data
+    let rawXml
     try {
-      data = parseAndroidStrings(readTextCapped(file))
+      rawXml = readTextCapped(file)
+      data = parseAndroidStrings(rawXml)
     } catch (err) {
       // A malformed/malicious target (bad XML, external entities, …) is a finding, not a crash.
       const findings = [{ type: 'invalid-file', severity: 'error', path: ns, message: `could not parse ${rel(file)}: ${err.message}` }]
       languages.push(aggregateLanguage(lang, [{ ns, file: rel(file), findings, stats: statsFrom(findings, 0, 0) }]))
       continue
     }
-    const { findings, stats } = checkTranslations({ source: sourceData, target: data, targetLang: lang, glossary })
+    const { findings: engineFindings, stats } = checkTranslations({ source: sourceData, target: data, targetLang: lang, glossary })
+    // Escaping errors AAPT would throw but the decoded values can't reveal.
+    const findings = [...engineFindings, ...androidEscapingFindings(rawXml)]
     const kept = findings.filter((f) => !isIgnored(ns, f.path))
     addPairs(perLang, lang, ns, sourceData, data, isIgnored)
     languages.push(
@@ -508,7 +513,7 @@ export function runCheck({ input, source = 'en', ignoreKeys, glossary, locks } =
  */
 
 export async function runSemantic(result, { provider, apiKey, model, baseURL, passes, glossary, cache, fail = false }) {
-  const totals = { judged: 0, cached: 0, flagged: 0, calls: 0, parseFailures: 0, excluded: 0 }
+  const totals = { judged: 0, cached: 0, flagged: 0, calls: 0, parseFailures: 0, excluded: 0, redacted: 0 }
 
   for (const l of result.languages) {
     const pairs = result.semanticPairs?.[l.lang]
@@ -526,31 +531,50 @@ export async function runSemantic(result, { provider, apiKey, model, baseURL, pa
         totals.excluded++
         continue
       }
+      // Privacy pre-flight: never transmit a pair carrying a secret/PII to the
+      // LLM. Withhold it (fail-closed) and record a finding instead of sending.
+      const leaks = [...scanSecrets(pairs.source[key]), ...scanSecrets(pairs.target[key])]
+      if (leaks.length) {
+        totals.redacted++
+        const sepAt = key.indexOf(SEP)
+        const nsEntry = l.namespaces.find((n) => n.ns === key.slice(0, sepAt))
+        if (nsEntry) {
+          nsEntry.findings.push({
+            type: 'secret-preflight',
+            severity: leaks.some((h) => h.severity === 'error') ? 'error' : 'warning',
+            path: key.slice(sepAt + 1),
+            message: `withheld from the LLM — detected ${[...new Set(leaks.map((h) => h.kind))].join(', ')}`,
+          })
+        }
+        continue
+      }
       src[key] = pairs.source[key]
       tgt[key] = pairs.target[key]
     }
-    if (!Object.keys(src).length) continue
-
-    const { findings, stats } = await reviewTranslations({
-      source: src, target: tgt, from: result.source, to: l.lang,
-      provider, apiKey, model, baseURL, passes, glossary, cache,
-    })
-    for (const k of Object.keys(stats)) totals[k] = (totals[k] ?? 0) + (stats[k] ?? 0)
-
-    for (const f of findings) {
-      const sepAt = f.path.indexOf(SEP)
-      const ns = f.path.slice(0, sepAt)
-      const path = f.path.slice(sepAt + 1)
-      const nsEntry = l.namespaces.find((n) => n.ns === ns)
-      if (!nsEntry) continue
-      nsEntry.findings.push({
-        type: `semantic-${f.category}`,
-        severity: fail ? 'error' : 'warning',
-        path,
-        message: f.note || f.category,
-        source: f.source,
-        translation: f.translation,
+    // Even when nothing is left to send (all pairs excluded or withheld), the
+    // pre-flight may have added secret findings, so still recompute stats below.
+    if (Object.keys(src).length) {
+      const { findings, stats } = await reviewTranslations({
+        source: src, target: tgt, from: result.source, to: l.lang,
+        provider, apiKey, model, baseURL, passes, glossary, cache,
       })
+      for (const k of Object.keys(stats)) totals[k] = (totals[k] ?? 0) + (stats[k] ?? 0)
+
+      for (const f of findings) {
+        const sepAt = f.path.indexOf(SEP)
+        const ns = f.path.slice(0, sepAt)
+        const path = f.path.slice(sepAt + 1)
+        const nsEntry = l.namespaces.find((n) => n.ns === ns)
+        if (!nsEntry) continue
+        nsEntry.findings.push({
+          type: `semantic-${f.category}`,
+          severity: fail ? 'error' : 'warning',
+          path,
+          message: f.note || f.category,
+          source: f.source,
+          translation: f.translation,
+        })
+      }
     }
     for (const n of l.namespaces) n.stats = statsFrom(n.findings, n.stats.sourceKeys, n.stats.targetKeys)
     const re = aggregateLanguage(l.lang, l.namespaces)
@@ -560,3 +584,35 @@ export async function runSemantic(result, { provider, apiKey, model, baseURL, pa
   return totals
 }
 
+/**
+ * Opt-in standalone scan: flag secrets/PII sitting in the locale strings
+ * themselves (a leak regardless of any LLM). Walks the same string set the
+ * semantic pass would send, attaches `secret-detected` findings, recomputes
+ * stats/totals, and returns the number of strings flagged.
+ */
+export function scanResultSecrets(result) {
+  let flagged = 0
+  for (const l of result.languages) {
+    const pairs = result.semanticPairs?.[l.lang]
+    if (!pairs) continue
+    for (const key of Object.keys(pairs.target || {})) {
+      const hits = [...scanSecrets(pairs.source?.[key]), ...scanSecrets(pairs.target[key])]
+      if (!hits.length) continue
+      flagged++
+      const sepAt = key.indexOf(SEP)
+      const nsEntry = l.namespaces.find((n) => n.ns === key.slice(0, sepAt))
+      if (!nsEntry) continue
+      nsEntry.findings.push({
+        type: 'secret-detected',
+        severity: hits.some((h) => h.severity === 'error') ? 'error' : 'warning',
+        path: key.slice(sepAt + 1),
+        message: `possible secret/PII in a locale string: ${[...new Set(hits.map((h) => h.kind))].join(', ')}`,
+      })
+    }
+    for (const n of l.namespaces) n.stats = statsFrom(n.findings, n.stats.sourceKeys, n.stats.targetKeys)
+    l.stats = aggregateLanguage(l.lang, l.namespaces).stats
+  }
+  recomputeTotals(result)
+  return flagged
+}
+