agenticreplay 0.1.0 → 0.1.2

package/packages/core/test/redaction.test.ts

@@ -1,525 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  AUTH_REQUEST_HEADERS,
-  AUTH_RESPONSE_HEADERS,
-  DEFAULT_ENV_ALLOWLIST,
-  REDACTION_POLICY_VERSION,
-  withoutInvisible,
-  Redactor,
-} from '../src/redaction.js';
-
-const PLACEHOLDER = /^<secret:[a-z_]+:[0-9a-f]{8}>$/;
-
-function fresh(): Redactor {
-  return new Redactor({ salt: 'test-salt' });
-}
-
-describe('placeholder stability', () => {
-  it('does not let a body-controlled binary marker disable secret detection', () => {
-    const secret = 'kR4s7Bq9nV2x6Dg8mP3w5Yh1';
-    expect(fresh().redactString(`agenticreplay-base64:AA== ${secret}`).value).not.toContain(secret);
-  });
-
-  it('preserves generated transport directory names without exempting adjacent tokens', () => {
-    const secret = 'kR4s7Bq9nV2x6Dg8mP3w5Yh1';
-    const result = fresh().redactString(`/tmp/agenticreplay-shell-A9b2Zq/frames ${secret}`).value;
-    expect(result).toContain('agenticreplay-shell-A9b2Zq');
-    expect(result).not.toContain(secret);
-  });
-  it('emits exactly <secret:KIND:HASH8>', () => {
-    const { value } = fresh().redactString('key sk-abcdefghijklmnop0123 end');
-    const found = value.match(/<secret:[^>]*>/g) ?? [];
-    expect(found).toHaveLength(1);
-    expect(found[0]).toMatch(PLACEHOLDER);
-  });
-
-  it('gives the same secret the same placeholder, so replay still matches structurally', () => {
-    const r = fresh();
-    const a = r.redactString('Authorization: Bearer sk-abcdefghijklmnop0123');
-    const b = r.redactString('again: sk-abcdefghijklmnop0123');
-    expect(a.hits[0]?.placeholder).toBe(b.hits[0]?.placeholder);
-  });
-
-  it('gives different secrets different placeholders', () => {
-    const r = fresh();
-    const a = r.redactString('sk-abcdefghijklmnop0123');
-    const b = r.redactString('sk-zyxwvutsrqponm9876');
-    expect(a.hits[0]?.placeholder).not.toBe(b.hits[0]?.placeholder);
-  });
-
-  it('salts per run, so the same secret does not correlate across runs', () => {
-    const one = new Redactor({ salt: 'run-one' }).redactString('sk-abcdefghijklmnop0123');
-    const two = new Redactor({ salt: 'run-two' }).redactString('sk-abcdefghijklmnop0123');
-    expect(one.value).not.toBe(two.value);
-  });
-
-  it('leaves nothing of the secret behind', () => {
-    const secret = 'sk-abcdefghijklmnop0123456789';
-    const { value } = fresh().redactString(`body ${secret} tail`);
-    expect(value).not.toContain(secret);
-    expect(value).not.toContain('abcdefghij');
-    expect(value).toBe(`body ${value.match(/<secret:[^>]*>/)?.[0]} tail`);
-  });
-
-  it('counts repeats of one secret as a single record', () => {
-    const r = fresh();
-    const { hits } = r.redactString('sk-abcdefghijklmnop0123 and sk-abcdefghijklmnop0123');
-    expect(hits).toHaveLength(1);
-    expect(hits[0]?.count).toBe(2);
-  });
-
-  it('never records the value itself', () => {
-    const r = fresh();
-    r.redactString('sk-abcdefghijklmnop0123');
-    const json = JSON.stringify(r.records());
-    expect(json).not.toContain('abcdefghijklmnop');
-  });
-
-  it('is idempotent — a placeholder is not itself redactable', () => {
-    const r = fresh();
-    const once = r.redactString('sk-abcdefghijklmnop0123').value;
-    const twice = r.redactString(once);
-    expect(twice.value).toBe(once);
-    expect(twice.hits).toHaveLength(0);
-  });
-});
-
-describe('pattern rules', () => {
-  const cases: [string, string, string][] = [
-    ['sk_api_key', 'sk-abcdefghijklmnop0123456789', 'openai'],
-    // The same rule covers every vendor that copied the prefix, which is why it is not named for
-    // one of them: OrcaRouter is one external gateway using that prefix, so its keys are among those
-    // most likely to be sitting next to a trace.
-    ['sk_api_key', 'sk-orca-abcdefghijklmnop0123456789', 'orcarouter'],
-    ['sk_api_key', 'sk-ant-api03-abcdefghijklmnop0123456789', 'anthropic'],
-    ['github_token', 'ghp_abcdefghijklmnopqrstuvwxyz0123456789', 'github classic'],
-    ['github_token', 'gho_abcdefghijklmnopqrstuvwxyz0123456789', 'github oauth'],
-    ['github_token', 'ghs_abcdefghijklmnopqrstuvwxyz0123456789', 'github server'],
-    ['github_token', 'ghu_abcdefghijklmnopqrstuvwxyz0123456789', 'github user'],
-    ['github_token', 'ghr_abcdefghijklmnopqrstuvwxyz0123456789', 'github refresh'],
-    ['aws_access_key_id', 'AKIAIOSFODNN7EXAMPLE', 'aws'],
-    ['slack_token', 'xoxb-123456789012-abcdefghijkl', 'slack bot'],
-    ['slack_token', 'xoxp-123456789012-abcdefghijkl', 'slack user'],
-    ['google_api_key', `AIza${'B'.repeat(35)}`, 'google'],
-    [
-      'jwt',
-      'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dBjftJeZ4CVPmB92K27uhbUJU1p1r_wW1g',
-      'jwt',
-    ],
-  ];
-
-  for (const [rule, secret, label] of cases) {
-    it(`catches a ${label} token`, () => {
-      const r = fresh();
-      const { value, hits } = r.redactString(`prefix ${secret} suffix`);
-      expect(value).not.toContain(secret);
-      expect(hits.map((h) => h.rule)).toContain(rule);
-    });
-  }
-
-  it('catches a PEM private key block whole', () => {
-    const pem = [
-      '-----BEGIN RSA PRIVATE KEY-----',
-      'MIIEowIBAAKCAQEAx7Rn3kQ2iVPYbLPqf1oW',
-      'nZ1Z9Yy2K0m5Q7uC3sV8dT4hJgR6pL0aN2bX',
-      '-----END RSA PRIVATE KEY-----',
-    ].join('\n');
-    const { value, hits } = fresh().redactString(`key:\n${pem}\ndone`);
-    expect(value).not.toContain('MIIEowIBAAK');
-    expect(value).not.toContain('BEGIN RSA PRIVATE KEY');
-    expect(hits.map((h) => h.rule)).toContain('private_key');
-    expect(value.startsWith('key:\n')).toBe(true);
-    expect(value.endsWith('\ndone')).toBe(true);
-  });
-
-  it('catches a truncated PEM block that never ends', () => {
-    const { value } = fresh().redactString('-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBg');
-    expect(value).not.toContain('MIIEvQIBADANBg');
-  });
-
-  it('catches a key buried in a JSON request body and leaves the JSON parseable', () => {
-    const body = JSON.stringify({
-      model: 'claude-opus-5',
-      headers: { authorization: 'Bearer sk-proj-Tn0pQrStUvWxYz0123456789AbCdEf' },
-      messages: [{ role: 'user', content: 'here is my key: sk-proj-Tn0pQrStUvWxYz0123456789' }],
-    });
-    const { value, hits } = fresh().redactString(body);
-    expect(value).not.toContain('sk-proj-Tn0pQrStUvWxYz');
-    expect(hits.length).toBeGreaterThan(0);
-    const parsed = JSON.parse(value) as { model: string };
-    expect(parsed.model).toBe('claude-opus-5');
-  });
-
-  /**
-   * A refresh token is the one GitHub credential that survives a rotated access token, so the
-   * pattern rule has to carry it rather than leaning on the entropy sweep: a low-entropy token
-   * body clears neither the entropy floor nor the letters-and-digits test.
-   */
-  it('catches a github refresh token the entropy sweep would never see', () => {
-    const secret = `ghr_${'1'.repeat(30)}`;
-    const { value, hits } = fresh().redactString(`token ${secret} end`);
-    expect(value).not.toContain(secret);
-    expect(hits.map((h) => h.rule)).toContain('github_token');
-  });
-
-  it('catches a high-entropy token with no recognisable prefix', () => {
-    const { value, hits } = fresh().redactString('token=Xq7Lm2Vb9Zt4Rw8Ny1Kc6Ph3Jd5Gs0F');
-    expect(value).not.toContain('Xq7Lm2Vb9Zt4');
-    expect(hits.map((h) => h.rule)).toContain('high_entropy');
-  });
-});
-
-describe('false positives', () => {
-  const clean = [
-    'The quick brown fox jumps over the lazy dog while the agent keeps thinking.',
-    'Please refactor the authentication middleware so that it validates tokens properly.',
-    'I ran the test suite and three of the integration tests failed with a timeout.',
-    'Antidisestablishmentarianism is a supercalifragilisticexpialidocious word.',
-    'export function deriveCheckpoints(events: TraceEvent[]): Checkpoint[] {',
-    'getUserAuthenticationTokenFromRequestHeaders(request, options)',
-    'const setUnhandledRejectionHandlerForBackgroundTasks = () => undefined;',
-    'aVeryLongCamelCaseVariableNameUsedInProductionCode = 1;',
-    '/home/user/AgenticReplay/packages/core/src/redaction.ts',
-    'node_modules/@agenticreplay/schema/dist/index.js',
-    'https://api.anthropic.com/v1/messages?beta=true',
-    'sha256:9f2c14be7d1a0b3c5e6f8a9d2b4c6e8f0a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d',
-    '550e8400-e29b-41d4-a716-446655440000',
-    '2026-08-29T10:00:00.000Z',
-    'run_9f2c14be7d1a',
-    'SCREAMING_SNAKE_CASE_CONSTANT_NAME_THAT_IS_LONG',
-    'this-is-a-long-kebab-case-branch-name-for-a-pull-request',
-    '',
-  ];
-
-  for (const s of clean) {
-    it(`leaves alone: ${JSON.stringify(s.slice(0, 48))}`, () => {
-      const { value, hits } = fresh().redactString(s);
-      expect(hits).toEqual([]);
-      expect(value).toBe(s);
-    });
-  }
-
-  it('does not redact a sha256 digest — every event line carries one', () => {
-    const r = fresh();
-    const digest = 'a3f5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5';
-    expect(r.redactString(digest).hits).toEqual([]);
-  });
-});
-
-describe('redactHeaders', () => {
-  it('replaces every auth header regardless of the value shape', () => {
-    const r = fresh();
-    const { value } = r.redactHeaders({
-      authorization: 'Bearer plainlookingvalue',
-      'x-api-key': 'abc123',
-      cookie: 'session=1',
-      'proxy-authorization': 'Basic dXNlcjpwYXNz',
-      'set-cookie': 'session=1; HttpOnly',
-    });
-    for (const v of Object.values(value)) expect(v).toMatch(PLACEHOLDER);
-  });
-
-  it('knows the vendor header names, not only the standard ones', () => {
-    // Pinned by name rather than only iterated, because a table-driven test over this list gets
-    // *smaller* when a name is deleted from it — it never goes red. Azure OpenAI sends the key as
-    // `api-key` and Google as `x-goog-api-key`; both were known to one of the three copies of this
-    // set that used to exist, which is how the same credential ended up stripped on one code path
-    // and written on another.
-    for (const name of [
-      'authorization',
-      'x-api-key',
-      'api-key',
-      'x-goog-api-key',
-      'cookie',
-      'proxy-authorization',
-    ]) {
-      expect(AUTH_REQUEST_HEADERS, name).toContain(name);
-    }
-    expect(AUTH_RESPONSE_HEADERS).toContain('set-cookie');
-    // Every request header is redacted whatever its value looks like — the list is the contract.
-    const { value } = fresh().redactHeaders(
-      Object.fromEntries(AUTH_REQUEST_HEADERS.map((h) => [h, 'plain-looking-value'])),
-    );
-    for (const v of Object.values(value)) expect(v).toMatch(PLACEHOLDER);
-  });
-
-  it('matches auth header names case-insensitively', () => {
-    const { value } = fresh().redactHeaders({ Authorization: 'Bearer x', 'X-Api-Key': 'y' });
-    expect(value['Authorization']).toMatch(PLACEHOLDER);
-    expect(value['X-Api-Key']).toMatch(PLACEHOLDER);
-  });
-
-  it('keeps the header name and record, but never the value', () => {
-    const r = fresh();
-    const { value, hits } = r.redactHeaders({ authorization: 'Bearer hunter2hunter2' });
-    expect(Object.keys(value)).toEqual(['authorization']);
-    expect(value['authorization']).not.toContain('hunter2');
-    expect(hits).toHaveLength(1);
-    expect(JSON.stringify(hits)).not.toContain('hunter2');
-  });
-
-  it('gives one auth value the same placeholder on every request', () => {
-    const r = fresh();
-    const a = r.redactHeaders({ authorization: 'Bearer sk-abcdefghijklmnop0123' });
-    const b = r.redactHeaders({ authorization: 'Bearer sk-abcdefghijklmnop0123' });
-    expect(a.value['authorization']).toBe(b.value['authorization']);
-  });
-
-  it('still pattern-scans ordinary headers', () => {
-    const r = fresh();
-    const { value, hits } = r.redactHeaders({
-      'user-agent': 'claude-cli/1.2.3',
-      'x-custom': 'token sk-abcdefghijklmnop0123',
-    });
-    expect(value['user-agent']).toBe('claude-cli/1.2.3');
-    expect(value['x-custom']).not.toContain('sk-abcdef');
-    expect(hits).toHaveLength(1);
-  });
-});
-
-describe('redactEnv', () => {
-  it('denies by default — only allowlisted keys survive', () => {
-    const out = fresh().redactEnv({
-      PATH: '/usr/bin',
-      HOME: '/home/user',
-      ANTHROPIC_API_KEY: 'sk-abcdefghijklmnop0123',
-      AWS_SECRET_ACCESS_KEY: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-      SOME_INTERNAL_URL: 'https://internal.example.com',
-    });
-    expect(Object.keys(out).sort()).toEqual(['HOME', 'PATH']);
-    expect(JSON.stringify(out)).not.toContain('sk-abcdef');
-  });
-
-  it('ships a conservative default allowlist', () => {
-    expect(DEFAULT_ENV_ALLOWLIST).toContain('TERM');
-    expect(DEFAULT_ENV_ALLOWLIST).toContain('PATH');
-    expect(DEFAULT_ENV_ALLOWLIST).not.toContain('ANTHROPIC_API_KEY');
-  });
-
-  it('lets a caller replace the allowlist entirely', () => {
-    const r = new Redactor({ salt: 's', envAllowlist: ['CI'] });
-    expect(r.redactEnv({ CI: 'true', PATH: '/usr/bin' })).toEqual({ CI: 'true' });
-  });
-
-  it('drops undefined values, as process.env produces', () => {
-    expect(fresh().redactEnv({ PATH: undefined, HOME: '/h' })).toEqual({ HOME: '/h' });
-  });
-
-  it('redacts inside allowlisted values too', () => {
-    const out = fresh().redactEnv({ PATH: '/usr/bin:/opt/sk-abcdefghijklmnop0123/bin' });
-    expect(out['PATH']).not.toContain('sk-abcdef');
-    expect(out['PATH']?.startsWith('/usr/bin:/opt/')).toBe(true);
-  });
-});
-
-describe('records and rulesFired', () => {
-  it('aggregates across calls by rule and identifier', () => {
-    const r = fresh();
-    r.redactString('sk-abcdefghijklmnop0123');
-    r.redactString('sk-abcdefghijklmnop0123');
-    r.redactString('AKIAIOSFODNN7EXAMPLE');
-    const records = r.records();
-    expect(records).toHaveLength(2);
-    const openai = records.find((x) => x.rule === 'sk_api_key');
-    expect(openai?.count).toBe(2);
-    expect(openai?.identifier).toBeTruthy();
-    expect(openai?.placeholder).toMatch(PLACEHOLDER);
-  });
-
-  it('counts occurrences per rule for the manifest', () => {
-    const r = fresh();
-    r.redactString('sk-abcdefghijklmnop0123 sk-zyxwvutsrqponm9876');
-    r.redactHeaders({ authorization: 'Bearer x' });
-    expect(r.rulesFired()['sk_api_key']).toBe(2);
-    expect(Object.values(r.rulesFired()).reduce((a, b) => a + b, 0)).toBe(3);
-  });
-
-  it('starts empty and stays empty when nothing matches', () => {
-    const r = fresh();
-    r.redactString('nothing to see here');
-    expect(r.records()).toEqual([]);
-    expect(r.rulesFired()).toEqual({});
-  });
-
-  it('declares a policy version for redactions.json', () => {
-    expect(REDACTION_POLICY_VERSION).toBeGreaterThanOrEqual(1);
-  });
-
-  it('tags records with the caller-supplied context', () => {
-    const r = fresh();
-    const { hits } = r.redactString('sk-abcdefghijklmnop0123', 'event:7:payload');
-    expect(hits[0]?.identifier).toContain('event:7:payload');
-  });
-});
-
-describe('protocol identifiers', () => {
-  /**
-   * The bug this exists for: a fork replays recorded assistant turns, the agent echoes their
-   * `tool_use` ids back, and the live API rejects the request because a placeholder is not a legal
-   * id. `agenticreplay compare` could not work against any real Anthropic recording.
-   */
-  it('leaves a tool_use id verbatim, so a fork can echo it back to the API', () => {
-    const body = JSON.stringify({
-      content: [{ type: 'tool_use', id: 'toolu_01A9CkVfSMkVsjE7HB2nQrPz', name: 'Bash' }],
-    });
-    const { value } = fresh().redactString(body);
-    expect(value).toContain('toolu_01A9CkVfSMkVsjE7HB2nQrPz');
-    expect(JSON.parse(value).content[0].id).toMatch(/^[a-zA-Z0-9_-]+$/);
-  });
-
-  it('leaves the ids that refer back to one alone as well', () => {
-    const body = JSON.stringify({
-      tool_use_id: 'toolu_01A9CkVfSMkVsjE7HB2nQrPz',
-      tool_call_id: 'call_9BdRt4Kw2ZpQ7mXvL3nHsYcE',
-    });
-    const { value } = fresh().redactString(body);
-    expect(value).toBe(body);
-  });
-
-  it('still redacts a credential parked under one of those keys, by shape', () => {
-    const body = JSON.stringify({ id: 'sk-live-9f2c14a03b71d4e8a7c5b6d2' });
-    const { value } = fresh().redactString(body);
-    expect(value).not.toContain('sk-live-9f2c14a03b71d4e8a7c5b6d2');
-    expect(value).toContain('<secret:sk_api_key:');
-  });
-
-  it('still redacts a random token that is not an identifier value', () => {
-    const body = JSON.stringify({ note: 'toolu_01A9CkVfSMkVsjE7HB2nQrPz' });
-    const { value } = fresh().redactString(body);
-    expect(value).toContain('<secret:high_entropy:');
-  });
-});
-
-describe('protocol identifiers, as they are actually stored', () => {
-  /**
-   * The response body is a string inside the event's JSON, so the scanner sees escaped quotes. A
-   * pattern that only accepted bare ones protected nothing real — and replay hands these bytes
-   * straight back to the agent, so a placeholder here becomes a 400 from the API on the next turn.
-   */
-  it('protects an id inside a body that has been serialized into JSON', () => {
-    const sse =
-      'data: {"type":"content_block_start","index":2,' +
-      '"content_block":{"type":"tool_use","id":"toolu_01A9CkVfSMkVsjE7HB2nQrPz","name":"Bash"}}';
-    const stored = JSON.stringify(sse);
-    const { value } = fresh().redactString(stored);
-    expect(value).toContain('toolu_01A9CkVfSMkVsjE7HB2nQrPz');
-    expect(JSON.parse(value)).toBe(sse);
-  });
-
-  it('protects one nested two levels deep, as a payload inside an event line', () => {
-    const inner = JSON.stringify({ tool_use_id: 'toolu_01A9CkVfSMkVsjE7HB2nQrPz' });
-    const outer = JSON.stringify({ payload: inner });
-    expect(fresh().redactString(outer).value).toBe(outer);
-  });
-
-  it('does not protect a value under those keys that is not identifier-shaped', () => {
-    const body = JSON.stringify({ id: 'https://x.example/toolu_01A9CkVfSMkVsjE7HB2nQrPz' });
-    expect(fresh().redactString(body).value).toContain('<secret:high_entropy:');
-  });
-});
-
-describe('thinking signatures', () => {
-  const sig = 'ErUBCkYIBRgCKkDx9vQ2mK4/nR8sT1uVwXyZ0aBcDeFgHiJkLmNoPqRsTuVwXyZ012+34567==';
-
-  it('keeps the signature that authenticates a thinking block', () => {
-    const body = JSON.stringify({ type: 'thinking', thinking: 'let me check', signature: sig });
-    expect(fresh().redactString(body).value).toContain(sig);
-  });
-
-  it('keeps it through the escaping a stored response body adds', () => {
-    const stored = JSON.stringify(JSON.stringify({ signature: sig }));
-    expect(fresh().redactString(stored).value).toBe(stored);
-  });
-
-  it('does not turn `signature` into a hiding place for a credential', () => {
-    const body = JSON.stringify({ signature: 'sk-live-9f2c14a03b71d4e8a7c5b6d2' });
-    expect(fresh().redactString(body).value).toContain('<secret:sk_api_key:');
-  });
-});
-
-/**
- * A KEY WITH SOMETHING INVISIBLE INSIDE IT.
- *
- * Every shape rule and the entropy sweep judge runs of `[A-Za-z0-9_-]`, so a zero-width space inside
- * a key split it: `sk-abc` + U+200B + 23 letters matched no rule, the tail was not random enough
- * for the sweep, and the key was written to the trace — the file `agenticreplay push` shares — verbatim.
- * Interleaving one every few characters leaves no run long enough for the sweep to measure.
- */
-describe('write-path redaction sees through invisible characters', () => {
-  const INVISIBLE: [string, string][] = [
-    ['zero-width space', '\u200B'],
-    ['zero-width non-joiner', '\u200C'],
-    ['zero-width joiner', '\u200D'],
-    ['word joiner', '\u2060'],
-    ['byte-order mark', '\uFEFF'],
-    ['soft hyphen', '\u00AD'],
-    ['variation selector 16', '\uFE0F'],
-    ['combining acute accent', '\u0301'],
-    ['Hangul filler', '\u3164'],
-    ['Hangul choseong filler', '\u115F'],
-    ['halfwidth Hangul filler', '\uFFA0'],
-    ['braille pattern blank', '\u2800'],
-    ['escape', '\u001B'],
-    ['tag character', '\u{E0041}'],
-  ];
-  const KEY = 'sk-abcdefghijklmnopqrstuvwxyz';
-
-  it.each(INVISIBLE)('redacts a key with a %s inside it', (_name, ch) => {
-    const r = new Redactor({ salt: 's' });
-    const hidden = KEY.slice(0, 6) + ch + KEY.slice(6);
-    const { value, hits } = r.redactString(`auth ${hidden} end`);
-    expect(withoutInvisible(value)).not.toContain('abcdefghijklmnop');
-    expect(value).toMatch(/^auth <secret:sk_api_key:[0-9a-f]{8}> end$/);
-    expect(hits.map((h) => h.rule)).toContain('sk_api_key');
-  });
-
-  it('gives the hidden key the placeholder the plain key gets', () => {
-    const r = new Redactor({ salt: 's' });
-    const plain = r.redactString(KEY).value;
-    expect(r.redactString(KEY.slice(0, 6) + '\u200B' + KEY.slice(6)).value).toBe(plain);
-  });
-
-  it('leaves no run short enough to hide in when one is interleaved throughout', () => {
-    const r = new Redactor({ salt: 's' });
-    const key = 'sk-proj-AbC123dEf456GhI789jKl012MnO345pQr';
-    const every9 = [...key].map((c, i) => (i % 9 === 8 ? c + '\u200B' : c)).join('');
-    expect(r.redactString(`token=${every9}`).value).toMatch(/^token=<secret:[a-z_]+:[0-9a-f]{8}>$/);
-  });
-
-  it('catches an opaque token the sweep would take, hidden the same way', () => {
-    const r = new Redactor({ salt: 's' });
-    const token = 'Zx81Qp0vR7mT2sL9wK4yH6nB3cF5jD';
-    const split = token.slice(0, 10) + '\uFEFF' + token.slice(10, 20) + '\uFEFF' + token.slice(20);
-    const { value } = r.redactString(`x ${split} y`);
-    expect(withoutInvisible(value)).not.toContain(token.slice(0, 12));
-    expect(value).toContain('<secret:high_entropy:');
-  });
-
-  /** Only what hid a secret is touched; everything around it arrives as it was. */
-  it('keeps an emoji two words away from a hidden key byte for byte', () => {
-    const r = new Redactor({ salt: 's' });
-    const family = '\u{1F468}\u200D\u{1F469}\u200D\u{1F467}';
-    const { value } = r.redactString(`${family} and ${KEY.slice(0, 6)}\u200B${KEY.slice(6)}`);
-    expect(value.startsWith(`${family} and <secret:sk_api_key:`)).toBe(true);
-  });
-
-  it('changes nothing in text that has invisible characters and no secret', () => {
-    const r = new Redactor({ salt: 's' });
-    const text = 'a zero\u200Bwidth space, a soft\u00ADhyphen and a heart \u2764\uFE0F';
-    expect(r.redactString(text).value).toBe(text);
-  });
-
-  /**
-   * The edge, pinned so moving it is a decision: a key broken where the reader can SEE it is out
-   * of scope. Whoever can write the field could as easily write the key into two fields.
-   */
-  it('does not reach across a visible break', () => {
-    const r = new Redactor({ salt: 's' });
-    const text = 'sk-abcdefgh\nijklmnopqrstuvwxyz';
-    expect(r.redactString(text).value).toBe(text);
-  });
-
-  it('bumps the policy version, because what reaches the trace changed', () => {
-    expect(REDACTION_POLICY_VERSION).toBe(5);
-  });
-});