agent-sanitizer 2.62.2 → 2.63.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.62.2",
+  "version": "2.63.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/python/agent_sanitizer/secrets/data/credential-names.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials` and `secrets` are env-name only — `credential`/`credentials` are everyday variable names, and an attribute chain (`credentials = service_account.Credentials.from_service_account_info(info)`) escapes every value-shape skip, so a field-value rendering would redact ordinary source lines. `passphrase` is the exception among them: it is as shape-specific as `password`, and detect-secrets' own KeywordDetector DENYLIST omits it, so name-only would let `passphrase = <secret>` reach the model in cleartext. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret (a key's identifier, the public half of a keypair), which a consumer must not redact. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
+  "$comment": "The credential-noun vocabulary: the words that make an identifier name a secret. Published so every consumer derives its own matcher from ONE list — a newly recognized noun reaches them all through a version bump instead of N hand edits. Read it from Python via agent_sanitizer.secrets (credential_name_segments / credential_field_name_patterns / non_secret_name_segments) or from JavaScript via the npm subpath export `agent-sanitizer/credential-names`. `parts` are the lowercase words of the noun; a consumer renders them for its own matcher (underscore-joined `API_KEY` and bare-joined `APIKEY` for an env-var NAME, `api[_-]?key` for a `field = value` regex). `uses` says which matcher may use the noun, because the two are not interchangeable: `env-name` matches a variable NAME and never inspects a value, so a broad noun there costs nothing, while `field-value` redacts whatever follows `noun = ` and a broad noun there mangles ordinary text — `key = <20 chars>` is a false-positive flood, so `key`, `pat`, `credential`, `credentials` and `secrets` are env-name only — `credential`/`credentials` are everyday variable names, and an attribute chain (`credentials = service_account.Credentials.from_service_account_info(info)`) escapes every value-shape skip, so a field-value rendering would redact ordinary source lines. `passphrase` is the exception among them: it is as shape-specific as `password`, and detect-secrets' own KeywordDetector DENYLIST omits it, so name-only would let `passphrase = <secret>` reach the model in cleartext. `nonSecretSuffixes` are the trailing words that make a credential-shaped name hold a NON-secret — a key's identifier, the public half of a keypair, or metadata ABOUT a secret (its type, display name, label, kind, or the path/file it lives at) — which a consumer must not redact. A bare `id` is deliberately absent: Vault's `secret_id` is itself a credential. Every part is restricted to a-z0-9 so it carries no regex metacharacter; the accessors enforce that and fail closed on a violation, an empty list, or an unknown `uses` value. It sits inside the Python package because a wheel can only ship data under its package directory, while npm's `files`/`exports` can name any path — so ONE physical file backs both ecosystems and there is no copy to drift.",
   "nouns": [
     { "parts": ["api", "key"], "uses": ["env-name", "field-value"] },
     { "parts": ["access", "key"], "uses": ["env-name", "field-value"] },
@@ -24,6 +24,13 @@
   ],
   "nonSecretSuffixes": [
     ["key", "id"],
-    ["public", "key"]
+    ["public", "key"],
+    ["type"],
+    ["name"],
+    ["label"],
+    ["keyword"],
+    ["kind"],
+    ["path"],
+    ["file"]
   ]
 }

package/src/credential-names.mjs

@@ -178,7 +178,8 @@ export function credentialNames() {
  * See this module's header for why that choice belongs to the caller.
  *
  * `declineNonSecret` applies the vocabulary's `nonSecretSuffixes`: a name ending
- * in one holds an identifier or a public key (`AWS_ACCESS_KEY_ID`), not a secret.
+ * in one holds an identifier, a public key, or metadata about a secret
+ * (`AWS_ACCESS_KEY_ID`, `SECRET_TYPE`, `TOKEN_FILE`), not the secret itself.
  * Leave it on for a redactor, where redacting an identifier out of output is a
  * visible defect; turn it off for a scrub whose failure to strip is the worse
  * error. It is applied to the name's trailing run under both scopes, because a
@@ -198,26 +199,29 @@ export function credentialNameMatcher(options = {}) {
   const vocabulary = spec ? parseCredentialNames(spec) : credentialNames();
   const nouns = new Set(vocabulary.segments);
   const nonSecret = new Set(vocabulary.nonSecretSegments);
-  // The longest noun's run length. A run longer than this can match no noun, so
-  // bounding the walk here is what keeps it linear in the name's segment count —
-  // without it a 2000-underscore name costs quadratic time.
-  const maxRun = Math.max(
-    ...vocabulary.segments.map((noun) => noun.split("_").length),
-  );
-  /** @param {string[]} words @returns {string[]} */
-  const trailingRuns = (words) =>
-    Array.from({ length: Math.min(maxRun, words.length) }, (_, i) =>
+  // Each walk is bounded by the longest entry of the set it probes: a run longer
+  // than that matches nothing there, and the bound is what keeps the walk linear
+  // in the name's segment count. The bounds are separate because a two-word
+  // non-secret suffix (`PUBLIC_KEY`) must still be seen when every noun is one word.
+  /** @param {Iterable<string>} segments */
+  const longestRun = (segments) =>
+    Math.max(...Array.from(segments, (s) => s.split("_").length));
+  const maxRun = longestRun(nouns);
+  const maxNonSecretRun = longestRun(nonSecret);
+  /** @param {string[]} words @param {number} bound @returns {string[]} */
+  const trailingRuns = (words, bound) =>
+    Array.from({ length: Math.min(bound, words.length) }, (_, i) =>
       words.slice(words.length - (i + 1)).join("_"),
     );
   return (name) => {
     const words = name.toUpperCase().split("_");
     if (
       declineNonSecret &&
-      trailingRuns(words).some((run) => nonSecret.has(run))
+      trailingRuns(words, maxNonSecretRun).some((run) => nonSecret.has(run))
     )
       return false;
     if (scope === "trailing")
-      return trailingRuns(words).some((run) => nouns.has(run));
+      return trailingRuns(words, maxRun).some((run) => nouns.has(run));
     for (let start = 0; start < words.length; start++)
       for (let span = 1; span <= maxRun && start + span <= words.length; span++)
         if (nouns.has(words.slice(start, start + span).join("_"))) return true;

package/types/credential-names.d.mts

@@ -24,7 +24,8 @@ export function credentialNames(): CredentialNames;
  * See this module's header for why that choice belongs to the caller.
  *
  * `declineNonSecret` applies the vocabulary's `nonSecretSuffixes`: a name ending
- * in one holds an identifier or a public key (`AWS_ACCESS_KEY_ID`), not a secret.
+ * in one holds an identifier, a public key, or metadata about a secret
+ * (`AWS_ACCESS_KEY_ID`, `SECRET_TYPE`, `TOKEN_FILE`), not the secret itself.
  * Leave it on for a redactor, where redacting an identifier out of output is a
  * visible defect; turn it off for a scrub whose failure to strip is the worse
  * error. It is applied to the name's trailing run under both scopes, because a