codiedev 0.9.80 → 0.9.81

package/dist/scrub/rules.js

@@ -0,0 +1,645 @@
+"use strict";
+// Secret/PII scrubber for session transcripts.
+//
+// Runs server-side over the decoded transcript before it is stored at rest
+// (see /api/captureSession) and over LLM-generated summary fields before they
+// are persisted. Design goal: catch secrets (recall) while redacting as little
+// benign content as possible (fidelity). See spec-transcript-scrubber.md.
+//
+// Principles:
+//   - Lead with precise, prefix/structured detectors (near-zero false positives).
+//   - No free-floating entropy rules — entropy is only considered inside
+//     secret-named assignment contexts.
+//   - Every redaction is tagged [REDACTED:<rule>] so false positives are auditable.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERIC_RULES = void 0;
+exports.shannonEntropy = shannonEntropy;
+exports.scrubSecrets = scrubSecrets;
+exports.redactSpans = redactSpans;
+exports.looksLikeTestValue = looksLikeTestValue;
+exports.secretFindings = secretFindings;
+exports.possibleSecrets = possibleSecrets;
+exports.redactPossible = redactPossible;
+const scrubProviderRules_1 = require("./scrubProviderRules");
+/** Shannon entropy in bits per character, as Gitleaks measures it. */
+function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const counts = new Map();
+    for (const ch of s)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values()) {
+        const p = n / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+// A secret-named assignment whose KEY ends in one of these is metadata ABOUT a
+// secret (its vault name, file, ARN, URL…), not the secret itself.
+const SECRET_REF_KEY = /_(?:NAME|ID|ARN|FILE|PATH|URL|URI|HOST|REGION|BUCKET|PREFIX|ENABLED|TYPE|VERSION|COUNT)$/i;
+// Does this assignment value look like an actual secret rather than a label,
+// dictionary word, or placeholder? Real secrets are long and/or mixed
+// alphanumeric; benign values are short words, lowercase kebab, or placeholders.
+function looksSecret(v) {
+    // --- reject non-secret shapes (the fidelity lever) ---
+    if (v.includes("<") || v.includes(">"))
+        return false; // <your-token>
+    if (/^(your[-_]|changeme|change-me|placeholder|example|none|null|undefined|redacted|true|false)/i.test(v))
+        return false;
+    if (/[${}]/.test(v) || v.includes("$("))
+        return false; // ${VAR} / $(cmd) refs
+    // Code punctuation — real secrets never contain these; source code does.
+    // (React hooks `useState(...)`, TS types `string;`, arg lists `a, b)`.)
+    if (/[()[\]{};,]/.test(v))
+        return false;
+    if (/:\/\//.test(v) || /^https?:/i.test(v))
+        return false; // URLs
+    if (/^[~./]|^[A-Za-z]:\\/.test(v))
+        return false; // file path (/, ./, ~/, C:\)
+    if (/\.(pem|key|json|crt|cer|txt|log|env|conf|config|ya?ml|pub|p12|pfx|sh|js|ts|py)$/i.test(v))
+        return false; // path with a known file extension
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(v))
+        return false; // dotted code identifier
+    if (/^[A-Za-z-]+$/.test(v))
+        return false; // all letters/hyphens, no digit → identifier / word / type
+    // --- require secret entropy ---
+    if (/^[0-9a-f]{16,}$/i.test(v))
+        return true; // hex token
+    if (v.length >= 12 && /[0-9]/.test(v) && /[A-Za-z]/.test(v))
+        return true; // mixed alnum w/ a digit
+    if (v.length >= 20 && /[+/=]/.test(v))
+        return true; // base64 blob
+    return false;
+}
+// Documentation/sample values that share a real key's shape (same list as the
+// phiScan audit). Rejected so docs and fixtures are not redacted.
+const PLACEHOLDER = /x{6,}|\.\.\.|your|example|placeholder|changeme|redacted|dummy|fake|<|\$\{|\*{4,}/i;
+const notPlaceholder = (v) => !PLACEHOLDER.test(v);
+const notTestValue = (v) => notPlaceholder(v) && !looksLikeTestValue(v);
+// URL passwords that are clearly not real: `user:password@`, `:pass@`, `:secret@`.
+const URL_PASSWORD_PLACEHOLDER = /^(?:pass(?:word)?|secret|pwd|test|admin|root|guest)$/i;
+// Order matters only for readability; overlap resolution (below) is by span,
+// not by rule order. All regexes are global.
+const RULES = [
+    // PEM private-key blocks (any key type), multiline.
+    {
+        name: "pem-private-key",
+        re: /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+    },
+    // JWTs (three base64url segments). Also covers `Bearer eyJ...`.
+    {
+        name: "jwt",
+        re: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    },
+    // OpenAI project keys: anchored on the literal sk-proj- prefix, so the
+    // permissive body (which may contain -/_) can't match kebab identifiers.
+    { name: "openai-key", re: /\bsk-proj-[A-Za-z0-9_-]{20,}/g },
+    // OpenAI classic keys: alphanumeric body only, so `sk-feature-branch-...`
+    // (hyphenated kebab) is rejected — the hyphen breaks the run below 20.
+    { name: "openai-key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
+    // Stripe secret/restricted keys.
+    { name: "stripe-key", re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g },
+    // GitHub tokens: ghp_ gho_ ghu_ ghs_ ghr_ (+ fine-grained github_pat_).
+    { name: "github-token", re: /\bgh[posru]_[A-Za-z0-9]{36,}/g },
+    { name: "github-token", re: /\bgithub_pat_[A-Za-z0-9_]{40,}/g },
+    // AWS access key ids.
+    { name: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    // Google API keys.
+    { name: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    // Slack tokens.
+    { name: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+    // Formats the phiScan secret audit (convex/lib/secretAudit.ts on
+    // feat/phi-count-scan) found surviving in stored transcripts. Same shapes as
+    // its SURVIVOR_RULES so the audit and the scrubber agree on what a key is.
+    { name: "gitlab-token", re: /\bgl(?:pat|dt|rt|ptt|cbt|oas|soat|ffct|imt)-[A-Za-z0-9_-]{20,}/g, validate: notPlaceholder },
+    // sk-ant-api03-… has hyphens, so the classic openai-key rule never matched it.
+    { name: "anthropic-key", re: /\bsk-ant-(?:api|admin)\d{2}-[A-Za-z0-9_-]{40,}/g, validate: notPlaceholder },
+    // Convex deploy keys: `prod:happy-otter-123|<base64>`.
+    { name: "convex-deploy-key", re: /\b(?:prod|dev|preview):[a-z0-9-]+\|[A-Za-z0-9+/=]{40,}/g, validate: notPlaceholder },
+    { name: "linear-key", re: /\blin_(?:api|oauth)_[A-Za-z0-9]{30,}/g, validate: notPlaceholder },
+    // Our own keys: cdv_ (CLI), cdvm_ (model gateway), cdvci_, cdvi_, cdvd_,
+    // cdvx_, cdvh_, cdvr_, cdva_, cdvs_. Every body is 40+ random alnum/hex
+    // (lib/secureTokens.ts, lib/dataApiToken.ts); the 32+ floor keeps display
+    // prefixes like `cdvi_01234567…` and seed names like `cdv_seed` intact.
+    { name: "codiedev-key", re: /\bcdv(?:m|ci|i|d|x|h|r|a|s)?_[A-Za-z0-9]{32,}\b/g, validate: notPlaceholder },
+    // Browser sign-in tokens (convex/oauth.ts): access cdv_at_, refresh cdv_rt_,
+    // device code cdv_dc_, each + base64url of 32 random bytes (43 chars). The
+    // public client id cdv_client_ is not a secret.
+    { name: "codiedev-key", re: /\bcdv_(?:at|rt|dc)_[A-Za-z0-9_-]{40,}/g, validate: notPlaceholder },
+    { name: "fireworks-key", re: /\bfw_[A-Za-z0-9]{20,}/g, validate: notPlaceholder },
+    { name: "slack-webhook", re: /hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{20,}/g, validate: notPlaceholder },
+    { name: "npm-token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, validate: notPlaceholder },
+    { name: "sendgrid-key", re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, validate: notPlaceholder },
+    { name: "twilio-key", re: /\bSK[0-9a-f]{32}\b/g, validate: notPlaceholder },
+    // Azure: redact the key/signature value, keep the connection string readable.
+    { name: "azure-storage-key", re: /AccountKey=([A-Za-z0-9+/=]{40,})/g, group: 1, validate: notPlaceholder },
+    { name: "azure-sas", re: /[?&]sig=([A-Za-z0-9%+/=]{30,})/g, group: 1, validate: notPlaceholder },
+    // Passwords inside DB / basic-auth URLs. Only the password is redacted so the
+    // host, user and database stay readable for summaries and debugging.
+    {
+        name: "url-password",
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|mssql|sqlserver|amqps?|https?):\/\/[^:\s/"'@\\]+:([^@\s"'/\\]{6,})@[A-Za-z0-9.-]+/g,
+        group: 1,
+        validate: (v) => notPlaceholder(v) && !URL_PASSWORD_PLACEHOLDER.test(v),
+    },
+    // Generic Bearer tokens (non-JWT covered above) — redact only the token.
+    { name: "bearer-token", re: /\bBearer\s+([A-Za-z0-9._-]{20,})/g, group: 1 },
+    // Secret-named assignments: redact the value of KEY/SECRET/PASSWORD/etc.
+    // Name must look secret-y; value must be >= 8 non-space chars. This is the
+    // only entropy-ish rule and it is gated on the assignment name so benign
+    // env assignments (NODE_ENV=production, PORT=3000, LOG_LEVEL=debug) are safe.
+    {
+        name: "secret-assignment",
+        // The secret keyword must END the key name (it abuts the : or =), so the
+        // secret-word as a SUBSTRING of a larger code identifier does NOT match:
+        // `Last_Password_Change=`, `PasswordHash=`, `class ApiKeyController : Base`.
+        // Compound forms (SECRET_KEY, CLIENT_SECRET…) are listed before their parts.
+        // Quotes around the key or value may be JSON-escaped (\"KEY\": \"value\") —
+        // transcripts embed JSON-encoded tool results, so both forms must match;
+        // the value run excludes backslash so it stops at an escaped closing quote.
+        re: /\b([A-Za-z0-9_-]*?(?:SECRET[_-]?KEY|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|REFRESH[_-]?TOKEN|API[_-]?KEY|PASSWORD|PASSWD|SECRET|TOKEN))\\?['"]?\s*[:=]\s*(?:\\?['"])?([^\s'"\\]{8,})(?:\\?['"])?/gi,
+        group: 2,
+        validate: (v, m) => !SECRET_REF_KEY.test(m[1]) &&
+            !/public/i.test(m[1]) && // .NET `PublicKeyToken=`, `PublicKey=` — public, not secret
+            // Pagination cursors (Jira nextPageToken, S3 ContinuationToken…) are
+            // high-entropy but not secrets — the one confirmed FP of the shadow week.
+            !/(?:page|continuation)[_-]?token$/i.test(m[1]) &&
+            m.input[m.index - 1] !== ":" && // ARN/path segment `arn:…:secret:<name>` — names a secret
+            looksSecret(v),
+    },
+    // Formats Gitleaks doesn't give a prefix rule for, seen in our sessions.
+    { name: "supabase-token", re: /\bsbp_[a-f0-9]{40}\b/g, validate: notTestValue },
+    { name: "groq-key", re: /\bgsk_[A-Za-z0-9]{48,56}\b/g, validate: notTestValue },
+    { name: "xai-key", re: /\bxai-[A-Za-z0-9]{70,90}\b/g, validate: notTestValue },
+    { name: "replicate-token", re: /\br8_[A-Za-z0-9]{37}\b/g, validate: notTestValue },
+    // Provider-prefix formats ported from Gitleaks (scrubProviderRules.ts).
+    ...scrubProviderRules_1.PROVIDER_RULES.map((r) => ({
+        name: r.name,
+        re: r.re,
+        ...(r.group !== undefined ? { group: r.group } : {}),
+        ...(r.firstGroup ? { firstGroup: true } : {}),
+        keywords: r.keywords,
+        fallback: true,
+        validate: (v) => notTestValue(v) && (r.entropy === undefined || shannonEntropy(v) >= r.entropy),
+    })),
+];
+// Every rule keyword, found in one case-insensitive pass over the text
+// instead of one search per keyword.
+const ALL_KEYWORDS = [...new Set(RULES.flatMap((r) => r.keywords ?? []))].sort((a, b) => b.length - a.length);
+const KEYWORD_RE = new RegExp(ALL_KEYWORDS.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "gi");
+const KEYWORD_PARTS = new Map(ALL_KEYWORDS.map((k) => [k, ALL_KEYWORDS.filter((p) => k.includes(p))]));
+function keywordsIn(input) {
+    const found = new Set();
+    if (!ALL_KEYWORDS.length)
+        return found;
+    KEYWORD_RE.lastIndex = 0;
+    let m;
+    while ((m = KEYWORD_RE.exec(input)) !== null) {
+        // A keyword inside a longer one (sk_ in sk_live_) is present too.
+        for (const k of KEYWORD_PARTS.get(m[0].toLowerCase()) ?? [])
+            found.add(k);
+        if (found.size === ALL_KEYWORDS.length)
+            break;
+    }
+    return found;
+}
+function scrubSecrets(input, opts = {}) {
+    if (!input)
+        return { text: input, redactions: [] };
+    // 1) Collect every candidate span across all rules.
+    const candidates = [];
+    const fallbacks = [];
+    const generic = [];
+    // A caller's rules are few; they skip the keyword pre-check.
+    const extra = (opts.extraRules ?? []).map((r) => ({ name: r.name, re: new RegExp(r.re.source, r.re.flags.includes("g") ? r.re.flags : r.re.flags + "g"), validate: notTestValue }));
+    const present = keywordsIn(input);
+    for (const rule of extra.length ? [...RULES, ...extra] : RULES) {
+        if (rule.keywords?.length && !rule.keywords.some((k) => present.has(k)))
+            continue;
+        rule.re.lastIndex = 0;
+        let m;
+        while ((m = rule.re.exec(input)) !== null) {
+            let start = m.index;
+            let end = m.index + m[0].length;
+            const groupIndex = rule.firstGroup ? m.findIndex((g, i) => i > 0 && g) : rule.group;
+            if (rule.firstGroup && groupIndex === -1) {
+                if (m[0].length === 0)
+                    rule.re.lastIndex++;
+                continue; // no secret group matched: never redact the whole match
+            }
+            if (groupIndex !== undefined && groupIndex > 0) {
+                const gv = m[groupIndex];
+                if (gv === undefined || gv === "")
+                    continue;
+                if (rule.validate && !rule.validate(gv, m))
+                    continue;
+                // Locate the group within the match (it appears after the name/prefix).
+                const rel = m[0].lastIndexOf(gv);
+                if (rel >= 0) {
+                    start = m.index + rel;
+                    end = start + gv.length;
+                }
+            }
+            else if (rule.validate && !rule.validate(m[0], m)) {
+                if (m[0].length === 0)
+                    rule.re.lastIndex++;
+                continue;
+            }
+            if (end > start)
+                (rule.fallback ? fallbacks : exports.GENERIC_RULES.has(rule.name) ? generic : candidates).push({ rule: rule.name, start, end });
+            // Guard against zero-width matches looping forever.
+            if (m[0].length === 0)
+                rule.re.lastIndex++;
+        }
+    }
+    if (candidates.length === 0 && fallbacks.length === 0 && generic.length === 0)
+        return { text: input, redactions: [] };
+    // 2) Resolve overlaps: earlier start wins; on tie, longer span wins. Most
+    //    specific first: hand-written provider rules, then ported provider
+    //    rules, then the generic ones (a secret-named variable, a bearer
+    //    header, a JWT) only where nothing more specific matched.
+    const pick = (list, taken) => {
+        list.sort((a, b) => a.start - b.start || b.end - a.end);
+        const out = [];
+        let cursor = -1;
+        let t = 0;
+        for (const c of list) {
+            if (c.start < cursor)
+                continue;
+            while (t < taken.length && taken[t].end <= c.start)
+                t++;
+            if (t < taken.length && taken[t].start < c.end)
+                continue;
+            out.push(c);
+            cursor = c.end;
+        }
+        return out;
+    };
+    let chosen = pick(candidates, []);
+    for (const tier of [fallbacks, generic]) {
+        if (tier.length)
+            chosen = [...chosen, ...pick(tier, chosen)].sort((a, b) => a.start - b.start);
+    }
+    return { text: redactSpans(input, chosen), redactions: chosen };
+}
+/** Rewrite `input` with each span replaced by `[REDACTED:<rule>]`. Spans must
+ *  be sorted by start and not overlap. One forward pass: repeated
+ *  slice+concat would copy the whole string per redaction (quadratic). */
+function redactSpans(input, spans) {
+    const parts = [];
+    let last = 0;
+    for (const c of spans) {
+        parts.push(input.slice(last, c.start), `[REDACTED:${c.rule}]`);
+        last = c.end;
+    }
+    parts.push(input.slice(last));
+    return parts.join("");
+}
+// Rules without a provider-specific format: the only ones that misfire on
+// test values, and the ones whose findings need a person to check.
+exports.GENERIC_RULES = new Set(["secret-assignment", "bearer-token", "jwt"]);
+const SEQUENTIAL = /0123456|1234567|2345678|3456789|abcdefg|bcdefgh|qwertyu/i;
+const WORDISH = /^[A-Za-z]{2,}$/;
+/** Values that share a key's shape but are test or sample values: words
+ *  joined by _ or - with only digits or one repeated character between
+ *  (`cdv_local_pilot_token_2026`, `…_token_000000`), a long counting run
+ *  (`sk-1234567890…`), or a long repeated tail. Still removed from sessions;
+ *  just not listed as a key to rotate. */
+function looksLikeTestValue(value) {
+    if (SEQUENTIAL.test(value))
+        return true;
+    if (/(.)\1{9,}$/.test(value))
+        return true;
+    const parts = value.split(/[_-]+/).filter(Boolean);
+    if (parts.length < 3)
+        return false;
+    const words = parts.filter((p) => WORDISH.test(p)).length;
+    const filler = parts.filter((p) => /^\d+$/.test(p) || /^(.)\1*$/.test(p)).length;
+    return words >= 2 && words + filler === parts.length;
+}
+const TEST_FILE = /(?:\.test\.|\.spec\.|__tests__|(?:^|\/)tests?\/|fixtures?\/|__mocks__)/i;
+// `NAME=`, `NAME: `, `"NAME": "`, `export NAME=`, `--name=` just before the value.
+const NAME_BEFORE = /([A-Za-z_][A-Za-z0-9_.-]{0,63})\??["']?\s*[:=]\s*\??["']?(?:Bearer\s+)?$/;
+function nameBefore(input, start, lineStart) {
+    const window = input.slice(Math.max(lineStart, start - 160), start).replace(/\\[nrt]/g, " ");
+    const m = window.match(NAME_BEFORE)?.[1];
+    if (!m || /^(?:https?|Bearer|Authorization)$/i.test(m))
+        return m === "Authorization" ? m : undefined;
+    return m;
+}
+const FILE_PATH_FIELD = /"(?:file_path|filePath|path|target_file)"\s*:\s*"([^"]{1,400})"/g;
+const REDIRECT = /(?:>>?|\btee(?:\s+-a)?)\s*['"]?([^\s'"<>|;&()]{2,300})/g;
+const CONFIG_FILE = /((?:[\w.~-]+\/)*\.env(?:\.[\w-]+)?|(?:[\w.~-]+\/)*[\w.-]+\.(?:env|ya?ml|toml|ini|cfg|conf|properties|tfvars|npmrc|netrc|pgpass))(?![\w/])/g;
+const lastTwo = (p) => p.replace(/\\\//g, "/").split("/").filter(Boolean).slice(-2).join("/");
+function lastMatch(re, text) {
+    let last;
+    for (const m of text.matchAll(re))
+        last = m[1];
+    return last;
+}
+/** The file this line writes or reads, if it names one. */
+function fileOf(input, start, lineStart) {
+    const lineEnd = input.indexOf("\n", start);
+    const line = input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd);
+    const before = input.slice(Math.max(lineStart, start - 400), start);
+    const hit = lastMatch(FILE_PATH_FIELD, line) ?? lastMatch(REDIRECT, before) ?? lastMatch(CONFIG_FILE, before);
+    if (!hit || hit.startsWith("/dev/") || hit === "&1" || hit === "&2")
+        return undefined;
+    const short = lastTwo(hit);
+    return short && short.length <= 120 ? short : undefined;
+}
+// Transcript shapes (one JSON object per line):
+//   Claude Code: {"type":"user"|"assistant","message":{"role","content":[{type:"tool_use",name,input}|{type:"tool_result"}|text]}}
+//   Codex:       {"type":"response_item","payload":{"type":"message",role}|{"type":"function_call",name,arguments}|{"type":"function_call_output"}}
+//   Others:      matched by the same generic markers (role, *tool*call*, *result*/*output*).
+const TOOL_CALL_TYPE = /^(?:tool_use|function_call|custom_tool_call|tool_call|toolCall|tool_request|tool\.execution_start|server_tool_use|mcp_tool_use)$/;
+const TOOL_OUTPUT_TYPE = /^(?:tool_result|function_call_output|custom_tool_call_output|tool_output|toolResult|tool\.execution_complete|mcp_tool_result)$/;
+const SHELL_TOOL = /bash|shell|exec|terminal|run_command|run_terminal/i;
+const GIT_COMMIT = /\bgit\s+(?:[^\n]*\s)?(?:commit|push)\b/;
+/** Classify one redaction by the nearest enclosing tool call, tool result or
+ *  message role in its transcript line. Non-JSON lines are "unknown". */
+function locate(input, r, cache) {
+    const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
+    let parsed = cache.get(lineStart);
+    if (parsed === undefined) {
+        const lineEnd = input.indexOf("\n", r.end);
+        try {
+            parsed = JSON.parse(input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd));
+        }
+        catch {
+            parsed = null;
+        }
+        cache.set(lineStart, parsed);
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return { where: "unknown" };
+    // Search for an alphanumeric run from the secret: JSON escaping (\n, \")
+    // differs between the raw line and the parsed strings.
+    const runs = input.slice(r.start, r.end).match(/[A-Za-z0-9]{8,}/g);
+    const needle = runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null;
+    if (!needle)
+        return { where: "unknown" };
+    let path = null;
+    const walk = (node, trail) => {
+        if (path)
+            return;
+        if (typeof node === "string") {
+            if (node.includes(needle))
+                path = trail;
+            return;
+        }
+        if (!node || typeof node !== "object")
+            return;
+        if (Array.isArray(node)) {
+            node.forEach((c) => walk(c, [...trail, { node: c }]));
+            return;
+        }
+        for (const [k, c] of Object.entries(node))
+            walk(c, [...trail, { node: c, key: k }]);
+    };
+    walk(parsed, [{ node: parsed }]);
+    if (!path)
+        return { where: "unknown" };
+    const frames = path;
+    for (let i = frames.length - 1; i >= 0; i--) {
+        const n = frames[i].node;
+        if (!n || typeof n !== "object" || Array.isArray(n))
+            continue;
+        const type = typeof n.type === "string" ? n.type : "";
+        const tool = typeof n.name === "string" ? n.name : typeof n.toolName === "string" ? n.toolName : undefined;
+        if (TOOL_CALL_TYPE.test(type)) {
+            const args = JSON.stringify(n.input ?? n.arguments ?? n.args ?? "");
+            if (tool && SHELL_TOOL.test(tool) && GIT_COMMIT.test(args))
+                return { where: "commit", tool };
+            return tool ? { where: "tool_call", tool } : { where: "tool_call" };
+        }
+        if (TOOL_OUTPUT_TYPE.test(type))
+            return tool ? { where: "tool_output", tool } : { where: "tool_output" };
+        if (n.role === "user" || (type === "user" && i === 0))
+            return { where: "prompt" };
+        if (n.role === "assistant" || (type === "assistant" && i === 0))
+            return { where: "assistant" };
+    }
+    return { where: "unknown" };
+}
+const MAX_LOCATIONS = 8;
+/** One finding per distinct (rule, last-4) in a scrub result, with every
+ *  distinct place it appeared. */
+function secretFindings(input, redactions, opts = {}) {
+    const seen = new Map();
+    const cache = new Map();
+    for (const r of redactions) {
+        let value = input.slice(r.start, r.end);
+        // A PEM block ends in a fixed footer; take the hint from the key body.
+        if (r.rule === "pem-private-key")
+            value = value.split("-----END")[0];
+        const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+        if (!hint)
+            continue;
+        const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
+        const name = nameBefore(input, r.start, lineStart);
+        const file = fileOf(input, r.start, lineStart);
+        if (looksLikeTestValue(value))
+            continue;
+        if (exports.GENERIC_RULES.has(r.rule) && file && TEST_FILE.test(file))
+            continue;
+        if (opts.skip?.({ rule: r.rule, value, ...(name ? { name } : {}), ...(file ? { file } : {}) }))
+            continue;
+        const key = `${r.rule}\u0000${hint}`;
+        const finding = seen.get(key) ?? { rule: r.rule, hint, locations: [] };
+        if (name && !finding.name)
+            finding.name = name;
+        if (file && !finding.file)
+            finding.file = file;
+        seen.set(key, finding);
+        const loc = locate(input, r, cache);
+        if (finding.locations.length < MAX_LOCATIONS && !finding.locations.some((l) => l.where === loc.where && l.tool === loc.tool)) {
+            finding.locations.push(loc);
+        }
+    }
+    return [...seen.values()];
+}
+// Key-ish names the secret-assignment rule doesn't cover (it already handles
+// API_KEY, SECRET, TOKEN, PASSWORD…). The keyword must end the name.
+const KEYISH_ASSIGNMENT = /\b([A-Za-z][A-Za-z0-9_-]*?(?:KEY|CREDENTIALS?|CREDS?|AUTH|SIGNATURE|SIGNING[_-]?KEY|SALT|DSN|PASS|PWD|PASSPHRASE|CONN(?:ECTION)?[_-]?STRING|COOKIE))\\?['"]?\s*[:=]\s*(?:\\?['"])?([A-Za-z0-9+/=_.-]{20,200})(?:\\?['"])?/gi;
+// Names that hold random-looking values that aren't secrets.
+const NOT_SECRET_NAME = /(?:cache|idempoten|partition|sort|primary|foreign|composite|unique|hash|etag|checksum|digest|storage|object|row|item|react|list|map|lookup|index|public|publishable|pub|page|continuation|cursor|nonce|trace|span|request|correlation|commit|sha|fingerprint|kid|key[_-]?id|keyof|monkey|turkey|hotkey|shortcut)/i;
+// Unknown vendor tokens: `acme_live_…`, `xyz_prod_…`, `foo_sk_…`. pk_ is public.
+const PREFIXED_TOKEN = /\b((?!pk_)[a-z][a-z0-9]{1,9}_(?:live|prod|secret|sk|key|token|api)_)([A-Za-z0-9]{24,})\b/g;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function shannon(v) {
+    const counts = new Map();
+    for (const c of v)
+        counts.set(c, (counts.get(c) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values()) {
+        const p = n / v.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/** Random enough to be a credential, and not a known non-secret shape. */
+function randomLooking(v) {
+    if (v.length < 20 || UUID.test(v))
+        return false;
+    if (/^\d+$/.test(v) || /^[A-Za-z]+$/.test(v))
+        return false;
+    if (/[._-]{2}|^[._-]|[._-]$/.test(v))
+        return false;
+    if (/\.[a-z]{2,4}$/i.test(v) || /^[a-z]+(?:[._-][a-z]+)+$/i.test(v))
+        return false; // file names, dotted/kebab words
+    if (PLACEHOLDER.test(v))
+        return false;
+    // Slugs and ids: `openai/gpt-5-mini` (base64 never mixes / and -), and
+    // lowercase names like `local-team_app-4870`.
+    if (v.includes("/") && v.includes("-"))
+        return false;
+    if (/^[a-z0-9]+(?:[_-][a-z0-9]+){2,}$/.test(v))
+        return false;
+    if (!/[0-9]/.test(v) || !/[A-Za-z]/.test(v))
+        return false;
+    return shannon(v) >= 3.5;
+}
+function shapeOf(v) {
+    if (/^[0-9a-f]+$/i.test(v))
+        return "hex";
+    if (/[+/=]/.test(v))
+        return "base64";
+    return "alnum";
+}
+// Long runs with letters AND digits get masked in snippets; names like
+// `partnerCredentials` stay readable.
+const LONG_RUN = /[A-Za-z0-9+/=_-]{16,}/g;
+const maskRuns = (s) => s.replace(LONG_RUN, (r) => (/[0-9]/.test(r) && /[A-Za-z]/.test(r) ? "••••" : r));
+/** The decoded string (prompt text, command, tool output…) the value sits
+ *  in, when its transcript line is JSON; else the raw line. */
+function containingText(text, start, end, cache) {
+    const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+    const lineEndRaw = text.indexOf("\n", end);
+    const raw = text.slice(lineStart, lineEndRaw === -1 ? text.length : lineEndRaw);
+    let parsed = cache.get(lineStart);
+    if (parsed === undefined) {
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            parsed = null;
+        }
+        cache.set(lineStart, parsed);
+    }
+    const value = text.slice(start, end);
+    let hit = null;
+    const walk = (node) => {
+        if (hit !== null)
+            return;
+        if (typeof node === "string") {
+            if (!node.includes(value))
+                return;
+            // Codex function_call arguments are JSON in a string: look inside.
+            if (/^[[{]/.test(node.trim())) {
+                try {
+                    walk(JSON.parse(node));
+                }
+                catch { /* not JSON */ }
+            }
+            if (hit === null)
+                hit = node;
+            return;
+        }
+        if (node && typeof node === "object")
+            for (const c of Object.values(node))
+                walk(c);
+    };
+    if (parsed !== null)
+        walk(parsed);
+    return hit ?? raw;
+}
+/** ~80 characters around a value, the value shown as ••••last4 and every
+ *  other random-looking run masked, so the snippet can't carry a secret. */
+function snippetAround(text, start, end, hint, cache) {
+    const value = text.slice(start, end);
+    const host = containingText(text, start, end, cache);
+    const at = host.indexOf(value);
+    const from = Math.max(0, at - 40);
+    const to = Math.min(host.length, at + value.length + 40);
+    const before = maskRuns(host.slice(from, at));
+    const after = maskRuns(host.slice(at + value.length, to));
+    return `${from > 0 ? "…" : ""}${before}••••${hint}${after}${to < host.length ? "…" : ""}`.replace(/\s+/g, " ").trim();
+}
+const MAX_POSSIBLE = 20;
+function possibleSecrets(text, limit = MAX_POSSIBLE) {
+    if (!text)
+        return [];
+    const found = new Map();
+    const cache = new Map();
+    const add = (label, prefix, value, start) => {
+        const end = start + value.length;
+        const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+        const key = `${label.toLowerCase()}\u0000${hint}\u0000${value.length}`;
+        let item = found.get(key);
+        if (!item) {
+            if (found.size >= limit)
+                return;
+            item = { label, prefix, hint, length: value.length, shape: shapeOf(value), snippet: snippetAround(text, start, end, hint, cache), locations: [], spans: [] };
+            found.set(key, item);
+        }
+        item.spans.push({ start, end });
+        const loc = locate(text, { rule: "possible", start, end }, cache);
+        if (item.locations.length < MAX_LOCATIONS && !item.locations.some((l) => l.where === loc.where && l.tool === loc.tool))
+            item.locations.push(loc);
+    };
+    KEYISH_ASSIGNMENT.lastIndex = 0;
+    let m;
+    while ((m = KEYISH_ASSIGNMENT.exec(text)) !== null) {
+        const [whole, rawName, value] = m;
+        // `\nAZURE_KEY=` in JSON-escaped text: the n belongs to the escape.
+        const name = text[m.index - 1] === "\\" ? rawName.replace(/^(?:u00[0-9a-fA-F]{2}|[ntr](?=[A-Z]))/, "") : rawName;
+        // A signed URL's signature parameter (`?…&signature=`) expires with the URL.
+        const before = text.slice(Math.max(0, m.index - 7), m.index);
+        if (/sig(?:nature)?$/i.test(name) && /(?:[?&]|\\u0026|\\u003f)$/i.test(before + rawName.slice(0, rawName.length - name.length)))
+            continue;
+        if (NOT_SECRET_NAME.test(name) || SECRET_REF_KEY.test(name))
+            continue;
+        if (text[m.index - 1] === ":" || text[m.index - 1] === ".")
+            continue; // arn:…, obj.key
+        if (!randomLooking(value))
+            continue;
+        add(name, undefined, value, m.index + whole.lastIndexOf(value));
+    }
+    PREFIXED_TOKEN.lastIndex = 0;
+    while ((m = PREFIXED_TOKEN.exec(text)) !== null) {
+        const [whole, prefix, body] = m;
+        if (!randomLooking(body))
+            continue;
+        const start = m.index;
+        // Already found under its name (`X-Acme-Key: acme_live_…`): one item,
+        // keep the name and note the prefix.
+        const named = [...found.values()].find((f) => f.spans.some((sp) => sp.start < start + whole.length && start < sp.end));
+        if (named) {
+            named.prefix ??= prefix;
+            continue;
+        }
+        add(prefix.replace(/_$/, ""), prefix, whole, start);
+    }
+    return [...found.values()];
+}
+/** Redact every occurrence of an already-reviewed possible secret. */
+function redactPossible(text, match, rule = "reviewed-secret") {
+    const hits = possibleSecrets(text, Infinity).filter((p) => p.label.toLowerCase() === match.label.toLowerCase() && p.hint === match.hint && p.length === match.length);
+    const spans = hits.flatMap((h) => h.spans).sort((a, b) => a.start - b.start);
+    if (!spans.length)
+        return { text, redactions: [] };
+    const parts = [];
+    let last = 0;
+    const redactions = [];
+    for (const s of spans) {
+        if (s.start < last)
+            continue;
+        parts.push(text.slice(last, s.start), `[REDACTED:${rule}]`);
+        redactions.push({ rule, start: s.start, end: s.end });
+        last = s.end;
+    }
+    parts.push(text.slice(last));
+    return { text: parts.join(""), redactions };
+}

package/dist/scrub/scrubProviderRules.d.ts

@@ -0,0 +1,14 @@
+export interface ProviderRule {
+    name: string;
+    re: RegExp;
+    /** Capture group holding the secret; the whole match when absent. */
+    group?: number;
+    /** The secret is the first capture group that matched (Gitleaks' default). */
+    firstGroup?: boolean;
+    /** Minimum Shannon entropy of the secret, as Gitleaks checks it. */
+    entropy?: number;
+    /** Lowercase strings one of which must appear for the rule to run. */
+    keywords: string[];
+}
+export declare const PROVIDER_RULES: ProviderRule[];
+export declare const PROVIDER_RULE_LABELS: Record<string, string>;