agenticreplay 0.1.0 → 0.1.2

package/node_modules/@agenticreplay/core/dist/redaction.js

@@ -0,0 +1,768 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { inflateSync } from 'node:zlib';
+/** Bump when a rule is added or changed, so old traces stay interpretable. */
+// Bumped when a rule's *name* or pattern changes, because both reach the trace: the placeholder is
+// `<secret:<kind>:<hash>>`, and a reader comparing two traces needs to know the policy differed
+// rather than the content. v2 renamed `openai_key` to `sk_api_key`; v3 stopped the entropy sweep
+// eating protocol identifiers (`id`, `tool_use_id`, `tool_call_id`); v4 stopped it eating whole
+// PNGs, which is a change in what reaches the trace for exactly the same reason — the same body
+// recorded under v3 and v4 differs, and a reader has to be able to tell that from the content
+// differing. v5 judges a value a second time with its invisible characters removed, so a key with
+// a zero-width space, a BOM or a Hangul filler inside it is now redacted where v4 wrote it out.
+export const REDACTION_POLICY_VERSION = 5;
+/** Environment capture is allowlist-only (spec §5). Everything else is denied. */
+export const DEFAULT_ENV_ALLOWLIST = [
+    'TERM',
+    'LANG',
+    'LC_ALL',
+    'PATH',
+    'HOME',
+    'SHELL',
+    'TZ',
+    'USER',
+    'PWD',
+];
+/**
+ * Request headers whose value is never written, whatever it looks like (spec §5).
+ *
+ * The single list. There were three — here, in the recording proxy, and in the TLS interceptor —
+ * and they had drifted: `api-key` and `x-goog-api-key` were known to exactly one of them, so the
+ * same Azure or Google credential was stripped on the intercepted path and written on the recorded
+ * one. Nothing about a header set that has to stay identical in three places will keep it that
+ * way, so it is defined once and imported.
+ */
+export const AUTH_REQUEST_HEADERS = [
+    'authorization',
+    'x-api-key',
+    // Azure OpenAI sends the key under its own name, and Google under another.
+    'api-key',
+    'x-goog-api-key',
+    'cookie',
+    'proxy-authorization',
+];
+/** A response can hand out credentials too. `set-cookie` is a session, not metadata. */
+export const AUTH_RESPONSE_HEADERS = ['set-cookie'];
+/** Every header name whose value is never written, in either direction. */
+export const AUTH_HEADERS = [...AUTH_REQUEST_HEADERS, ...AUTH_RESPONSE_HEADERS];
+/**
+ * Order matters: a PEM block or a JWT contains base64 that the narrower rules would otherwise
+ * chew into pieces, leaving fragments of key material on disk.
+ */
+/**
+ * Marks a recorded body held as base64 rather than as text.
+ *
+ * Written by the proxy when a body is not valid UTF-8, and honoured here so the encoding survives
+ * the trace. Kept in this module because the redactor and the proxy have to agree on it.
+ */
+export const BINARY_BODY_PREFIX = 'agenticreplay-base64:';
+const RULES = [
+    {
+        kind: 'private_key',
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+    },
+    { kind: 'jwt', pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+    // `sk-` is not an OpenAI prefix, it is the convention half the industry copied: OpenAI's
+    // `sk-proj-`, Anthropic's `sk-ant-`, OrcaRouter's `sk-orca-` and a dozen gateways all match here.
+    // The rule name reaches the trace, `redactions.json` and the placeholder, so calling every one of
+    // them an OpenAI key told a reader something false about where their credential came from.
+    { kind: 'sk_api_key', pattern: /sk-[A-Za-z0-9_-]{16,}/g },
+    // Every GitHub credential prefix, `ghr_` (refresh) included: it outlives the access token it
+    // renews, so leaving it to the entropy sweep would miss the longest-lived secret of the set.
+    { kind: 'github_token', pattern: /gh[posur]_[A-Za-z0-9]{20,}/g },
+    { kind: 'aws_access_key_id', pattern: /AKIA[0-9A-Z]{16}/g },
+    { kind: 'slack_token', pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+    { kind: 'google_api_key', pattern: /AIza[0-9A-Za-z_-]{35}/g },
+];
+/**
+ * A base64 run that decodes to a whole PNG, wherever it sits in the value.
+ *
+ * The exemption is granted on the payload, not on the syntax around it or the label in front of
+ * it, because every argument for it is an argument about *pixels* — and every draft that granted
+ * it on something a caller writes was a hole:
+ *
+ *   - the media type, so `data:image/png;base64,<credential>` bought one
+ *   - the signature, so `iVBORw0KGgo<credential>` bought one
+ *   - the framing, so `signature + IHDR + IDAT{<credential>} + IEND` with self-consistent lengths
+ *     bought one
+ *   - a *valid* container, so a 1×1 image with the credential in a `tEXt` chunk bought one, and a
+ *     real screenshot with the credential appended inside `IDAT` past the end of the zlib stream
+ *     bought one, and flipping IHDR's interlace byte skipped the size check altogether
+ *
+ * So the rule is now the narrowest one that still serves the case this exists for: **every chunk
+ * has to be a chunk whose bytes the exemption can account for.** Structure (`IHDR`, `IEND`), the
+ * pixel stream (`IDAT`), and a short list of fixed-size ancillary chunks each held to its spec
+ * length, with every chunk's CRC checked so its four CRC bytes are not four more of the caller's.
+ * Anything else — `tEXt`, `iTXt`, `zTXt`, `iCCP`, `cHRM`, `PLTE`, an unknown type — is a place a
+ * caller can put bytes of their choosing, so its presence costs the whole run its exemption and the
+ * sweep runs as it always did. Indexed PNGs therefore have no exemption at all, since they cannot
+ * be valid without a palette.
+ *
+ * The pixel stream is checked, not assumed: the concatenated `IDAT` has to inflate, to consume
+ * every byte of itself doing so (`inflateSync` stops at the end of the zlib stream and ignores
+ * whatever follows, which is where a credential went), and to yield exactly the byte count `IHDR`
+ * describes — including the seven-pass sum when the image is interlaced.
+ *
+ * Measured, on a 1 MB PNG: the chunk walk costs 0.2 ms and the inflate 1.2 ms, against the 55 ms
+ * the base64 decode already costs.
+ *
+ * **PNG only.** JPEG was here and is gone. Its ancillary segments (`COM`, `APPn`) carry arbitrary
+ * bytes, its `DQT`/`DHT` payloads are arbitrary within a shape, and its entropy-coded scan cannot
+ * be told from a credential without a full Huffman decode — so a JPEG exemption can only ever mean
+ * "a marker chain that closes", which is framing, which is what this file kept getting wrong. GIF,
+ * BMP, WebP and AVIF went earlier for the same reason. A format with no validator does not get an
+ * exemption; it gets the sweep, as it did before any of this. The cost is real and is the right way
+ * round: an agent that sends JPEG screenshots still gets them shredded.
+ *
+ * What this still does not claim: a secret written into the pixels themselves is not detectable
+ * here, and no content rule could be — a stored-mode deflate block whose "pixels" are a credential
+ * inflates to the declared size like any other. The line is that the payload has to be a picture;
+ * a picture cannot be proved innocent.
+ */
+/**
+ * Whether `code` is a base64 alphabet character.
+ *
+ * A run used to be found with `/(?:[A-Za-z0-9+/]|\\[/\\])+={0,2}/g`, and a backtracking `+` over a
+ * multi-megabyte run overflows V8's regexp stack: measured, `redactString` threw
+ * `RangeError: Maximum call stack size exceeded` from `RegExpStringIterator.next` at 8 MB of
+ * contiguous base64 — a ~6 MB screenshot, which is the thing this exemption exists to protect. The
+ * entropy sweep's own `TOKEN` never had the problem because `+` and `/` are not in its class, so
+ * real base64 reaches it as thousands of short matches; this prefilter was the first pattern to run
+ * a quantifier across a whole payload, and the same input that the pre-change code walked without
+ * complaint at 16 MB threw here. So runs are found by hand, in one left-to-right pass.
+ */
+function isBase64Char(code) {
+    return ((code >= 0x41 && code <= 0x5a) || // A-Z
+        (code >= 0x61 && code <= 0x7a) || // a-z
+        (code >= 0x30 && code <= 0x39) || // 0-9
+        code === 0x2b || // +
+        code === 0x2f // /
+    );
+}
+/** Shortest run worth decoding: below this it cannot hold a header and any pixels. */
+const MIN_RASTER_CHARS = 40;
+/**
+ * The largest pixel stream worth inflating, as a matter of policy rather than of format.
+ *
+ * An 8K screenshot at four channels is about 127 MiB of raw pixels, so 256 MiB is roughly double the
+ * largest thing anyone is plausibly recording. An IHDR that declares more than this is refused
+ * before any memory is committed — otherwise the header itself, which is the caller's to write,
+ * would set how much the redactor allocates.
+ */
+const MAX_RASTER_RAW_BYTES = 1 << 28;
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+/**
+ * Ancillary chunks whose length the spec fixes, mapped to that length.
+ *
+ * A caller cannot choose how many bytes these hold, and every one of them is shorter than
+ * `MIN_ENTROPY_LENGTH`, so none can carry a run the sweep would have redacted. That is the whole
+ * admission criterion — not that the chunk is harmless, but that exempting it cannot hide anything
+ * the sweep was protecting. Every variable-length chunk is therefore absent, and so is `cHRM`:
+ * fixed at 32 bytes, but 32 bytes is long enough to matter.
+ *
+ * The lengths here are what the caller gets, because the CRCs are checked: four more bytes per
+ * chunk that would otherwise be theirs to fill. The largest of these is `pHYs` at nine, so the
+ * longest run of chosen bytes any admitted chunk can contribute is twelve base64 characters,
+ * against the sweep's threshold of twenty.
+ */
+const PNG_FIXED_ANCILLARY = {
+    gAMA: 4,
+    sRGB: 1,
+    pHYs: 9,
+    tIME: 7,
+    sBIT: 4,
+    bKGD: 6,
+};
+/**
+ * Bytes per pixel for each PNG colour type; an unlisted type is not one this exemption accepts.
+ *
+ * Indexed (3) is absent, which means indexed PNGs are swept like any other unvalidated payload. It
+ * was here, on the argument that an indexed image's palette *is* its pixels — but that argument
+ * does not survive: `PLTE` is up to 768 uncompressed caller-chosen bytes sitting verbatim in the
+ * trace, its entries need not be referenced by any pixel, and nothing about it is checked beyond a
+ * length that the bit depth alone bounds. `IDAT` is not analogous, because it has to inflate to
+ * exactly the size the header declares. Admitting 768 free bytes while rejecting `cHRM` at 32 as
+ * "long enough to matter" was the file contradicting its own admission criterion.
+ */
+const PNG_CHANNELS = { 0: 1, 2: 3, 4: 2, 6: 4 };
+/** The bit depths each colour type allows. A pairing outside this is not an image a decoder reads. */
+const PNG_DEPTHS = {
+    0: [1, 2, 4, 8, 16],
+    2: [8, 16],
+    4: [8, 16],
+    6: [8, 16],
+};
+/** Adam7: `[xOffset, yOffset, xStep, yStep]` for each of the seven passes. */
+const ADAM7 = [
+    [0, 0, 8, 8],
+    [4, 0, 8, 8],
+    [0, 4, 4, 8],
+    [2, 0, 4, 4],
+    [0, 2, 2, 4],
+    [1, 0, 2, 2],
+    [0, 1, 1, 2],
+];
+/**
+ * The exact length of the inflated pixel stream for these image parameters.
+ *
+ * Each scanline is a filter byte plus its packed samples, and an interlaced image is seven smaller
+ * images by the same rule — a pass with no rows or no columns contributes nothing at all, which is
+ * what the guard is for rather than tidiness. Skipping this for interlaced images was a hole: it
+ * let one IHDR byte buy the exemption for an IDAT holding no pixels.
+ */
+function pngRawLength(width, height, channels, depth, interlaced) {
+    const rows = (w, h) => w <= 0 || h <= 0 ? 0 : h * (1 + Math.ceil((w * channels * depth) / 8));
+    if (!interlaced)
+        return rows(width, height);
+    let total = 0;
+    for (const [x0, y0, dx, dy] of ADAM7) {
+        total += rows(Math.ceil((width - x0) / dx), Math.ceil((height - y0) / dy));
+    }
+    return total;
+}
+/** The CRC-32 lookup table, built once: `0xedb88320` is the reversed polynomial PNG uses. */
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n += 1) {
+        let c = n;
+        for (let k = 0; k < 8; k += 1)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+/**
+ * CRC-32 of `data`.
+ *
+ * A local implementation keeps CRC behavior deterministic across supported Node patch releases
+ * and avoids coupling this parser to an optional builtin export. `intercept.ts` looks
+ * `zstdDecompressSync` up dynamically for the same compatibility reason, and
+ * `tls-intercept.test.ts` records what the named import provides instead.
+ *
+ * Computing it here rather than looking it up dynamically leaves one implementation, always
+ * exercised, instead of a fallback branch that only some runtimes ever run. It costs 0.75 ms on a
+ * 381 KB PNG against `zlib.crc32`'s 0.10 ms, which is nothing beside the 55 ms that PNG's base64
+ * decode already costs. Every "a real PNG stays exempt" case in the tests builds its CRCs with
+ * `zlib.crc32`, so those tests pass only while this agrees with Node's.
+ */
+function crc32Of(data) {
+    let c = 0xffffffff;
+    for (let i = 0; i < data.length; i += 1)
+        c = (c >>> 8) ^ CRC_TABLE[(c ^ data[i]) & 0xff];
+    return (c ^ 0xffffffff) >>> 0;
+}
+/**
+ * Whether the chunk beginning at `at` carries the CRC its own bytes imply.
+ *
+ * A caller who can set a length can set a CRC too, so this proves nothing about intent. What it
+ * does is stop the four CRC bytes of every admitted chunk being four bytes of the caller's
+ * choosing — which is the difference between "`pHYs` contributes nine chosen bytes" and "thirteen",
+ * and the whole fixed-length argument is a counting argument.
+ *
+ * The CRC covers the type and the data, not the length field.
+ */
+function hasValidCrc(b, at, len) {
+    return crc32Of(b.subarray(at + 4, at + 8 + len)) === b.readUInt32BE(at + 8 + len);
+}
+/**
+ * Whether these bytes are a PNG this exemption can account for, byte for byte.
+ *
+ * IHDR is read before the walk rather than during it. The spec puts it first, at a fixed size, and
+ * every later decision depends on its fields — so reading it up front is the difference between
+ * checking those fields and checking them after something has already used them.
+ *
+ * The walk then rejects on the first chunk it cannot account for, so an unknown type never reaches
+ * the part that grants anything.
+ */
+function isWholePng(b) {
+    if (!b.subarray(0, 8).equals(PNG_SIGNATURE))
+        return false;
+    // Signature, then IHDR's length and type: 13 bytes of data at a known offset.
+    if (b.length < 33)
+        return false;
+    if (b.readUInt32BE(8) !== 13 || b.subarray(12, 16).toString('latin1') !== 'IHDR')
+        return false;
+    if (!hasValidCrc(b, 8, 13))
+        return false;
+    const width = b.readUInt32BE(16);
+    const height = b.readUInt32BE(20);
+    const depth = b[24];
+    const colour = b[25];
+    const interlace = b[28];
+    const channels = PNG_CHANNELS[colour];
+    if (width === 0 || height === 0 || channels === undefined)
+        return false;
+    if (!PNG_DEPTHS[colour].includes(depth))
+        return false;
+    // Compression and filter: the spec defines one value each, and two interlace methods.
+    if (b[26] !== 0 || b[27] !== 0 || interlace > 1)
+        return false;
+    let at = 33; // 8 signature + 4 length + 4 type + 13 data + 4 CRC
+    let sawEnd = false;
+    const idat = [];
+    while (!sawEnd) {
+        if (at + 12 > b.length)
+            return false;
+        const len = b.readUInt32BE(at);
+        const type = b.subarray(at + 4, at + 8).toString('latin1');
+        const next = at + 12 + len; // length + type + data + CRC
+        if (next > b.length)
+            return false;
+        if (!hasValidCrc(b, at, len))
+            return false;
+        if (type === 'IDAT') {
+            idat.push(Buffer.from(b.subarray(at + 8, at + 8 + len)));
+        }
+        else if (type === 'IEND') {
+            if (len !== 0 || next !== b.length || idat.length === 0)
+                return false;
+            sawEnd = true;
+        }
+        else if (type === 'IHDR') {
+            return false; // exactly one, already read
+        }
+        else {
+            const fixed = PNG_FIXED_ANCILLARY[type];
+            // A chunk whose size the caller picks is a chunk the caller can fill.
+            if (fixed === undefined || len > fixed)
+                return false;
+        }
+        at = next;
+    }
+    // The size is known before the inflate, not after it, so the inflate is bounded by it. Deciding
+    // afterwards meant a 400 KB IDAT declaring 1×1 could expand to whatever it liked: measured, one
+    // 531 KB base64 payload took RSS up by 821 MB, and `--max-old-space-size` does not bound it
+    // because zlib writes outside the JS heap. This is the one place in the write path that runs
+    // over bytes an agent's tools, an MCP server, or (for `agenticreplay scrub`) somebody else's trace file
+    // chose.
+    const expected = pngRawLength(width, height, channels, depth, interlace === 1);
+    if (expected > MAX_RASTER_RAW_BYTES)
+        return false;
+    const stream = Buffer.concat(idat);
+    let raw;
+    try {
+        // `info: true` for `bytesWritten`, which is the input the stream actually consumed. Without it
+        // anything past the end of the zlib stream is never looked at, and `IDAT{<pixels><credential>}`
+        // inflates to the declared size with the credential still in the trace. `@types/node` models
+        // only the plain-Buffer overload, so the shape is spelled out here; only `bytesWritten` and
+        // `buffer` are read from it.
+        const result = inflateSync(stream, { info: true, maxOutputLength: expected });
+        if (result.engine.bytesWritten !== stream.length)
+            return false;
+        raw = result.buffer;
+    }
+    catch {
+        // Not a zlib stream, or a stream that wanted more room than the header asked for — which is
+        // what a decompression bomb is. Either way: not an image, so the sweep runs as it always did.
+        return false;
+    }
+    return raw.length === expected;
+}
+/** Whether these bytes are one complete image this exemption can account for. */
+function isWholeRasterImage(b) {
+    if (b.length < 16)
+        return false;
+    return isWholePng(b);
+}
+/**
+ * The spans of `value` that are whole raster images.
+ *
+ * The signature is checked before anything is decoded, so a long run that is not an image costs
+ * six characters rather than a decode — which matters because this runs over every string a trace
+ * writes.
+ */
+function rasterSpans(value) {
+    const spans = [];
+    let at = 0;
+    while (at < value.length) {
+        const start = at;
+        // One maximal run of the base64 alphabet, `\/` and `\\` counting as the character they stand
+        // for. Advancing to the run's end rather than past its first character is what keeps this
+        // linear: a signature *inside* a run does not start one, so there is nothing to come back for.
+        while (at < value.length) {
+            const code = value.charCodeAt(at);
+            if (isBase64Char(code)) {
+                at += 1;
+                continue;
+            }
+            if (code === 0x5c) {
+                const next = value.charCodeAt(at + 1);
+                if (next === 0x2f || next === 0x5c) {
+                    at += 2;
+                    continue;
+                }
+            }
+            break;
+        }
+        if (at === start) {
+            at += 1;
+            continue;
+        }
+        // Padding only where padding belongs. `Buffer.from(x, 'base64')` stops at the first `=` and
+        // ignores the rest, so a run of `<image>==<credential>` decoded to a valid image and the span
+        // covered the credential with it. Ending the run at the padding splits the two, and an interior
+        // `=` ends a run for the same reason.
+        let end = at;
+        for (let pad = 0; pad < 2 && value.charCodeAt(end) === 0x3d; pad += 1)
+            end += 1;
+        at = end;
+        // `iVBORw` is what a PNG signature looks like once base64-encoded.
+        if (end - start < MIN_RASTER_CHARS || !value.startsWith('iVBORw', start))
+            continue;
+        // `\/` and `\\` stand for payload characters; they are stripped before decoding and the span
+        // still covers them, or the sweep would resume inside the image.
+        const payload = value.slice(start, end).replace(/\\(.)/g, '$1');
+        let bytes;
+        try {
+            bytes = Buffer.from(payload, 'base64');
+        }
+        catch {
+            continue;
+        }
+        if (!isWholeRasterImage(bytes))
+            continue;
+        spans.push([start, end]);
+    }
+    return spans;
+}
+const TOKEN = /[A-Za-z0-9_-]{20,}/g;
+const PLACEHOLDER = /<secret:[a-z_]+:[0-9a-f]{8}>/g;
+const MIN_ENTROPY_LENGTH = 20;
+const ENTROPY_BITS_PER_CHAR = 4.0;
+/** Shannon entropy of the token's own character distribution, in bits per character. */
+function entropy(token) {
+    const freq = new Map();
+    for (const ch of token)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let bits = 0;
+    for (const n of freq.values()) {
+        const p = n / token.length;
+        bits -= p * Math.log2(p);
+    }
+    return bits;
+}
+/**
+ * A long identifier clears 4 bits/char on length alone: `getUserAuthenticationTokenFromRequest`
+ * scores 4.08. Agent traces are mostly source code, so redacting identifiers would corrupt the
+ * payloads the trace exists to preserve. Requiring both digits and letters keeps every random
+ * token (base64url has a digit with p≈0.98 at 20 chars) and drops prose-shaped ones.
+ */
+function looksRandom(token) {
+    return /[0-9]/.test(token) && /[A-Za-z]/.test(token);
+}
+/**
+ * Protocol identifiers, which are not secrets and must survive a recording verbatim.
+ *
+ * A `tool_use` id is generated per call, means nothing outside its own conversation, and the API
+ * requires it to match `^[a-zA-Z0-9_-]+$`. It is also ~25 characters of mixed-case base62, so the
+ * entropy sweep took it every time — and a fork replays recorded assistant turns, the agent echoes
+ * those ids back, and the placeholder then arrives at the live API, which rejects the request:
+ *
+ *   messages.1.content.2.tool_use.id: String should match pattern '^[a-zA-Z0-9_-]+$'
+ *
+ * So `agenticreplay compare`, the feature the tool is pitched on, could not work against any real recording.
+ * Found by forking one, which no fixture could have shown.
+ *
+ * This shields these values from the *entropy heuristic* only. The pattern rules run first and are
+ * untouched, so a real credential parked under a key called `id` is still redacted by shape — what
+ * is relaxed is the guess, not the detection. The value must already look like a protocol id
+ * (`^[A-Za-z0-9_-]*$`, the shape the API demands); anything else under that key is left to the
+ * ordinary sweep.
+ *
+ * The quotes are matched as `\\*"` because a response body is stored as a *string* inside the
+ * event's JSON, so by the time the scanner sees it the text reads `\\"id\\":\\"toolu_…\\"`. A
+ * pattern that only accepted bare quotes matched nothing where it mattered and passed its own test,
+ * which is how the first version of this shipped and still broke every fork.
+ */
+const PROTOCOL_ID_VALUE = /(\\*")(?:id|tool_use_id|tool_call_id)\1\s*:\s*\1[A-Za-z0-9_-]*\1/g;
+/**
+ * The same problem with a different alphabet. An Anthropic `thinking` block carries a `signature`
+ * over its own contents, and the API rejects a turn whose signature does not verify — so a fork,
+ * which replays recorded assistant turns for the agent to echo back, died on
+ * `messages.1.content.0: Invalid \`signature\` in \`thinking\` block`. It is base64, not an
+ * identifier, hence a second shape.
+ *
+ * It is not a credential either: it authenticates thinking text the trace already holds in full, so
+ * keeping it costs no secrecy that was not already spent.
+ */
+const PROTOCOL_SIGNATURE_VALUE = /(\\*")signature\1\s*:\s*\1[A-Za-z0-9+/=_-]*\1/g;
+/**
+ * Regions the entropy sweep must not touch: what it already replaced, and what is not a secret.
+ *
+ * Returned sorted by start, which is what {@link Redactor.redactString}'s sweep relies on to test
+ * containment in one pass rather than one scan of the whole list per token.
+ *
+ * The rasters are appended one at a time, not spread. `push(...spans)` passes one argument per
+ * element and V8 stops at about 125k of them — and a string can hold one span per image, so ~130k
+ * of the smallest PNG this file accepts (a 1×1 greyscale, 92 base64 characters: about 12 MB of
+ * payload, which any tool result or MCP frame can carry) raised
+ * `RangeError: Maximum call stack size exceeded` from here, out through `redactString`, with
+ * nothing on the write path to catch it.
+ */
+function spansOf(value) {
+    const spans = [];
+    // Public directory prefix plus mkdtemp's six characters; this is a recorder-generated
+    // transport location, not a credential. Named credential rules still run first.
+    for (const m of value.matchAll(/\bagenticreplay-(?:shell|spans)-[A-Za-z0-9]{6}\b/g)) {
+        spans.push([m.index, m.index + m[0].length]);
+    }
+    for (const m of value.matchAll(PLACEHOLDER))
+        spans.push([m.index, m.index + m[0].length]);
+    for (const m of value.matchAll(PROTOCOL_ID_VALUE))
+        spans.push([m.index, m.index + m[0].length]);
+    for (const m of value.matchAll(PROTOCOL_SIGNATURE_VALUE)) {
+        spans.push([m.index, m.index + m[0].length]);
+    }
+    for (const span of rasterSpans(value))
+        spans.push(span);
+    return spans.sort((a, b) => a[0] - b[0]);
+}
+/**
+ * WHAT A READER DOES NOT SEE AS A CHARACTER.
+ *
+ * Every shape rule above and the entropy sweep judge runs of `[A-Za-z0-9_-]`, so any character
+ * outside that class placed inside a credential splits it — and one with no visible form splits
+ * it without anyone noticing. `sk-abc` + U+200B + `defghijklmnopqrstuvwxyz` matched no rule, the
+ * run after the space was one the sweep does not consider random, and the key was written to the
+ * trace verbatim: the file `agenticreplay push` shares. Interleave one every fifteen characters and no run
+ * the sweep measures is long enough to be measured at all.
+ *
+ * It is a named set, not "whatever renders blank", and the edges are deliberate. In: Unicode's
+ * Default_Ignorable_Code_Point (the zero-width characters, the BOM, the soft hyphen, the Hangul
+ * fillers, variation selectors, tag characters), every format character, every combining mark,
+ * the C0 and C1 controls other than tab, line feed and carriage return, and U+2800, the one blank
+ * glyph outside all of those that exists to be used as nothing. Out: whitespace, and every visible
+ * character including lookalikes from other scripts. A key broken by a space or a dot is broken
+ * where the reader can see it, and no pattern follows every way a person might put visible pieces
+ * back together — whoever can write the field could as easily write the key into two of them.
+ */
+const INVISIBLE_CLASS = String.raw `\p{Default_Ignorable_Code_Point}\p{Cf}\p{M}\u2800\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F`;
+const HAS_INVISIBLE = new RegExp(`[${INVISIBLE_CLASS}]`, 'u');
+const EVERY_INVISIBLE = new RegExp(`[${INVISIBLE_CLASS}]`, 'gu');
+const VISIBLE_RUN = new RegExp(`[^${INVISIBLE_CLASS}]+`, 'gu');
+/**
+ * `s` as a reader would retype it: every character in the set above removed.
+ *
+ * The one definition every secret judgement in the product uses — this redactor, the CLI's
+ * renderer, the adapters' opaque-token nets — so that "invisible" cannot mean one thing in the
+ * write path and another on the terminal, which is how each of them came to be fixed separately.
+ */
+export function withoutInvisible(s) {
+    return HAS_INVISIBLE.test(s) ? s.replace(EVERY_INVISIBLE, '') : s;
+}
+function hiddenView(s) {
+    if (!HAS_INVISIBLE.test(s))
+        return undefined;
+    let text = '';
+    const runs = [];
+    for (const m of s.matchAll(VISIBLE_RUN)) {
+        runs.push({ from: m.index, to: text.length });
+        text += m[0];
+    }
+    return { text, runs };
+}
+/** Where offset `k` of the view's text sits in the source. Runs are sorted, so a binary search. */
+function sourceOffset(view, k) {
+    let lo = 0;
+    let hi = view.runs.length - 1;
+    while (lo < hi) {
+        const mid = (lo + hi + 1) >> 1;
+        if (view.runs[mid].to <= k)
+            lo = mid;
+        else
+            hi = mid - 1;
+    }
+    const run = view.runs[lo];
+    return run.from + (k - run.to);
+}
+/**
+ * Write-path redactor (spec §5).
+ *
+ * The placeholder is `<secret:kind:hash8>` where hash8 is sha256(salt + secret) truncated, so the
+ * same secret always yields the same placeholder — replay still matches structurally — while the
+ * secret itself is unrecoverable. The salt is per run and never written down, which is what stops
+ * a short secret from being brute-forced out of a published trace.
+ */
+export class Redactor {
+    #salt;
+    #envAllowlist;
+    #records = new Map();
+    constructor(opts = {}) {
+        this.#salt = opts.salt ?? randomBytes(16).toString('hex');
+        this.#envAllowlist = new Set(opts.envAllowlist ?? DEFAULT_ENV_ALLOWLIST);
+    }
+    redactString(s, context, options = {}) {
+        const hits = new Map();
+        const value = this.#scan(s, context, hits, options.entropy !== false);
+        this.#merge(hits);
+        return { value, hits: [...hits.values()] };
+    }
+    redactHeaders(headers) {
+        const hits = new Map();
+        const value = {};
+        for (const [name, raw] of Object.entries(headers)) {
+            const lower = name.toLowerCase();
+            const context = `header:${lower}`;
+            value[name] = AUTH_HEADERS.includes(lower)
+                ? this.#hit(`header_${lower.replace(/-/g, '_')}`, raw, context, hits)
+                : this.#scan(raw, context, hits);
+        }
+        this.#merge(hits);
+        return { value, hits: [...hits.values()] };
+    }
+    redactEnv(env) {
+        const hits = new Map();
+        const out = {};
+        for (const key of this.#envAllowlist) {
+            const raw = env[key];
+            if (raw === undefined)
+                continue;
+            out[key] = this.#scan(raw, `env:${key}`, hits);
+        }
+        this.#merge(hits);
+        return out;
+    }
+    /** Every removal so far, aggregated by rule and identifier. Never contains a value. */
+    records() {
+        return [...this.#records.values()].map((r) => ({ ...r }));
+    }
+    rulesFired() {
+        const out = {};
+        for (const r of this.#records.values())
+            out[r.rule] = (out[r.rule] ?? 0) + r.count;
+        return out;
+    }
+    #scan(input, context, hits, entropy = true) {
+        let value = input;
+        for (const rule of RULES) {
+            value = value.replace(rule.pattern, (m) => this.#hit(rule.kind, m, context, hits));
+        }
+        // Body text is untrusted. A marker in it must never disable redaction of its neighbors.
+        if (entropy)
+            value = this.#scanEntropy(value, context, hits);
+        return this.#scanHidden(value, context, hits, entropy);
+    }
+    /**
+     * The same judgement again, over what a reader would see.
+     *
+     * It only ever adds to the pass above. A match here is acted on only when its extent in the
+     * source is longer than in the view — when an invisible character sits INSIDE it, which is the
+     * one case the raw pass cannot see — so text without such a character is untouched, byte for
+     * byte, and so is everything around a hidden key: a ZWJ emoji two sentences away survives. The
+     * placeholder is computed from the visible characters, so a key spelled with an invisible
+     * character inside it redacts to the same placeholder as the same key without one, and a replay
+     * still matches it structurally.
+     */
+    #scanHidden(value, context, hits, sweep) {
+        const view = hiddenView(value);
+        if (view === undefined)
+            return value;
+        const found = [];
+        for (const rule of RULES) {
+            for (const m of view.text.matchAll(rule.pattern)) {
+                found.push({ a: m.index, b: m.index + m[0].length, kind: rule.kind, secret: m[0] });
+            }
+        }
+        if (sweep) {
+            // The raw sweep's own filters, over the view: placeholders and protocol values stay exempt.
+            const spans = spansOf(view.text);
+            let cursor = 0;
+            let reach = -1;
+            for (const m of view.text.matchAll(TOKEN)) {
+                const token = m[0];
+                const start = m.index;
+                while (cursor < spans.length && spans[cursor][0] <= start) {
+                    if (spans[cursor][1] > reach)
+                        reach = spans[cursor][1];
+                    cursor += 1;
+                }
+                if (start + token.length <= reach)
+                    continue;
+                if (token.length < MIN_ENTROPY_LENGTH || !looksRandom(token))
+                    continue;
+                if (entropy(token) <= ENTROPY_BITS_PER_CHAR)
+                    continue;
+                found.push({ a: start, b: start + token.length, kind: 'high_entropy', secret: token });
+            }
+        }
+        found.sort((x, y) => x.a - y.a || y.b - x.b);
+        let out = '';
+        let cut = 0;
+        let end = -1;
+        let changed = false;
+        for (const f of found) {
+            if (f.a < end)
+                continue;
+            const from = sourceOffset(view, f.a);
+            const to = sourceOffset(view, f.b - 1) + 1;
+            // Nothing invisible inside it: the raw pass saw exactly this and judged it. Not ours.
+            if (to - from === f.b - f.a)
+                continue;
+            out += value.slice(cut, from) + this.#hit(f.kind, f.secret, context, hits);
+            cut = to;
+            end = f.b;
+            changed = true;
+        }
+        return changed ? out + value.slice(cut) : value;
+    }
+    #scanEntropy(value, context, hits) {
+        // Placeholders already written by the pattern rules must not be rescanned as tokens.
+        const spans = spansOf(value);
+        let out = '';
+        let cut = 0;
+        // `spans.some(...)` per token walked the whole list every time, which is quadratic once a value
+        // holds many images — measured, 40k small PNGs cost 2.7 s against 0.14 s before the exemption
+        // existed. Spans arrive sorted by start and `matchAll` yields tokens the same way, so one
+        // cursor carrying the furthest end seen so far answers the same question in a single pass:
+        // `reach` is max(b) over every span with a <= start, and a token is inside one of them exactly
+        // when it ends at or before that.
+        let cursor = 0;
+        let reach = -1;
+        for (const m of value.matchAll(TOKEN)) {
+            const token = m[0];
+            const start = m.index;
+            while (cursor < spans.length && spans[cursor][0] <= start) {
+                if (spans[cursor][1] > reach)
+                    reach = spans[cursor][1];
+                cursor += 1;
+            }
+            // Wholly inside, not merely starting inside. A TOKEN is `[A-Za-z0-9_-]+`, which runs on
+            // past an image payload through a `_` or `-` that base64 has no use for — so a token that
+            // began in the image and ended in a credential was skipped entire, and the credential with
+            // it. Overlap would be wrong the other way: it would exempt text outside the image.
+            if (start + token.length <= reach)
+                continue;
+            if (token.length < MIN_ENTROPY_LENGTH || !looksRandom(token))
+                continue;
+            if (entropy(token) <= ENTROPY_BITS_PER_CHAR)
+                continue;
+            out += value.slice(cut, start) + this.#hit('high_entropy', token, context, hits);
+            cut = start + token.length;
+        }
+        return out + value.slice(cut);
+    }
+    #hit(kind, secret, context, hits) {
+        const hash8 = createHash('sha256').update(this.#salt).update(secret).digest('hex').slice(0, 8);
+        const placeholder = `<secret:${kind}:${hash8}>`;
+        const identifier = context ? `${context}:${hash8}` : hash8;
+        // `\0` as an escape, not a raw NUL byte: a literal NUL in the source makes git classify
+        // this file as binary, so every diff of the redactor — the one file that most needs reading in
+        // review — comes out as "Bin 7248 -> 7441 bytes" instead of lines.
+        const key = `${kind}\0${identifier}`;
+        const seen = hits.get(key);
+        if (seen)
+            seen.count += 1;
+        else
+            hits.set(key, { rule: kind, identifier, placeholder, count: 1 });
+        return placeholder;
+    }
+    #merge(hits) {
+        for (const [key, hit] of hits) {
+            const seen = this.#records.get(key);
+            if (seen)
+                seen.count += hit.count;
+            else
+                this.#records.set(key, { ...hit });
+        }
+    }
+}
+//# sourceMappingURL=redaction.js.map