codiedev 0.9.89 → 0.9.91

package/dist/scrub/promptRules.js

@@ -0,0 +1,941 @@
+"use strict";
+// Stable-branch copy of main's scrub/rules.ts (0.9.90 backport of #2610), used
+// only by promptGuard so a stopped prompt matches main exactly. scrub/rules.ts
+// stays an exact copy of this branch's convex/lib/scrubSecrets.ts.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHAPE_RULES = exports.isTestFile = exports.GENERIC_RULES = void 0;
+exports.shannonEntropy = shannonEntropy;
+exports.scrubSecrets = scrubSecrets;
+exports.redactSpans = redactSpans;
+exports.looksLikeTestValue = looksLikeTestValue;
+exports.locateInLine = locateInLine;
+exports.locateMarkers = locateMarkers;
+exports.namesASecret = namesASecret;
+exports.notWorthRotating = notWorthRotating;
+exports.hintOf = hintOf;
+exports.secretFindings = secretFindings;
+exports.possibleSecrets = possibleSecrets;
+exports.redactPossible = redactPossible;
+// Secret/PII scrubber for session transcripts.
+//
+// Runs server-side over the decoded transcript before it is stored at rest
+// (see /api/captureSession) and over LLM-generated summary fields before they
+// are persisted. Design goal: catch secrets (recall) while redacting as little
+// benign content as possible (fidelity). See spec-transcript-scrubber.md.
+//
+// Principles:
+//   - Lead with precise, prefix/structured detectors (near-zero false positives).
+//   - No free-floating entropy rules — entropy is only considered inside
+//     secret-named assignment contexts.
+//   - Every redaction is tagged [REDACTED:<rule>] so false positives are auditable.
+const scrubProviderRules_1 = require("./scrubProviderRules");
+/** Shannon entropy in bits per character, as Gitleaks measures it. */
+function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const counts = new Map();
+    for (const ch of s)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values()) {
+        const p = n / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+// A secret-named assignment whose KEY ends in one of these is metadata ABOUT a
+// secret (its vault name, file, ARN, URL…), not the secret itself.
+const SECRET_REF_KEY = /_(?:NAME|ID|ARN|FILE|PATH|URL|URI|HOST|REGION|BUCKET|PREFIX|ENABLED|TYPE|VERSION|COUNT)$/i;
+// Does this assignment value look like an actual secret rather than a label,
+// dictionary word, or placeholder? Real secrets are long and/or mixed
+// alphanumeric; benign values are short words, lowercase kebab, or placeholders.
+function looksSecret(v) {
+    // --- reject non-secret shapes (the fidelity lever) ---
+    if (v.includes("<") || v.includes(">"))
+        return false; // <your-token>
+    if (/^(your[-_]|changeme|change-me|placeholder|example|none|null|undefined|redacted|true|false)/i.test(v))
+        return false;
+    if (/[${}]/.test(v) || v.includes("$("))
+        return false; // ${VAR} / $(cmd) refs
+    // Code punctuation — real secrets never contain these; source code does.
+    // (React hooks `useState(...)`, TS types `string;`, arg lists `a, b)`.)
+    if (/[()[\]{};,]/.test(v))
+        return false;
+    if (/:\/\//.test(v) || /^https?:/i.test(v))
+        return false; // URLs
+    if (/^[~./]|^[A-Za-z]:\\/.test(v))
+        return false; // file path (/, ./, ~/, C:\)
+    if (/\.(pem|key|json|crt|cer|txt|log|env|conf|config|ya?ml|pub|p12|pfx|sh|js|ts|py)$/i.test(v))
+        return false; // path with a known file extension
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(v))
+        return false; // dotted code identifier
+    if (/^[A-Za-z-]+$/.test(v))
+        return false; // all letters/hyphens, no digit → identifier / word / type
+    // --- require secret entropy ---
+    if (/^[0-9a-f]{16,}$/i.test(v))
+        return true; // hex token
+    if (v.length >= 12 && /[0-9]/.test(v) && /[A-Za-z]/.test(v))
+        return true; // mixed alnum w/ a digit
+    if (v.length >= 20 && /[+/=]/.test(v))
+        return true; // base64 blob
+    return false;
+}
+// Documentation/sample values that share a real key's shape (same list as the
+// phiScan audit). Rejected so docs and fixtures are not redacted.
+const PLACEHOLDER = /x{6,}|\.\.\.|your|example|placeholder|changeme|redacted|dummy|fake|<|\$\{|\*{4,}/i;
+const notPlaceholder = (v) => !PLACEHOLDER.test(v);
+const notTestValue = (v) => notPlaceholder(v) && !looksLikeTestValue(v);
+// URL passwords that are clearly not real: `user:password@`, `:pass@`, `:secret@`.
+const URL_PASSWORD_PLACEHOLDER = /^(?:pass(?:word)?|secret|pwd|test|admin|root|guest)$/i;
+// Order matters only for readability; overlap resolution (below) is by span,
+// not by rule order. All regexes are global.
+const RULES = [
+    // PEM private-key blocks (any key type), multiline.
+    {
+        name: "pem-private-key",
+        re: /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+    },
+    // JWTs (three base64url segments). Also covers `Bearer eyJ...`.
+    {
+        name: "jwt",
+        re: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    },
+    // OpenAI project keys: anchored on the literal sk-proj- prefix, so the
+    // permissive body (which may contain -/_) can't match kebab identifiers.
+    { name: "openai-key", re: /\bsk-proj-[A-Za-z0-9_-]{20,}/g },
+    // OpenAI classic keys: alphanumeric body only, so `sk-feature-branch-...`
+    // (hyphenated kebab) is rejected — the hyphen breaks the run below 20.
+    { name: "openai-key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
+    // Stripe secret/restricted keys.
+    { name: "stripe-key", re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g },
+    // GitHub tokens: ghp_ gho_ ghu_ ghs_ ghr_ (+ fine-grained github_pat_).
+    { name: "github-token", re: /\bgh[posru]_[A-Za-z0-9]{36,}/g },
+    { name: "github-token", re: /\bgithub_pat_[A-Za-z0-9_]{40,}/g },
+    // AWS access key ids.
+    { name: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    // Google API keys.
+    { name: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    // Slack tokens.
+    { name: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+    // Formats the phiScan secret audit (convex/lib/secretAudit.ts on
+    // feat/phi-count-scan) found surviving in stored transcripts. Same shapes as
+    // its SURVIVOR_RULES so the audit and the scrubber agree on what a key is.
+    { name: "gitlab-token", re: /\bgl(?:pat|dt|rt|ptt|cbt|oas|soat|ffct|imt)-[A-Za-z0-9_-]{20,}/g, validate: notPlaceholder },
+    // sk-ant-api03-… has hyphens, so the classic openai-key rule never matched it.
+    { name: "anthropic-key", re: /\bsk-ant-(?:api|admin)\d{2}-[A-Za-z0-9_-]{40,}/g, validate: notPlaceholder },
+    // Convex deploy keys: `prod:happy-otter-123|<base64>`.
+    { name: "convex-deploy-key", re: /\b(?:prod|dev|preview):[a-z0-9-]+\|[A-Za-z0-9+/=]{40,}/g, validate: notPlaceholder },
+    { name: "linear-key", re: /\blin_(?:api|oauth)_[A-Za-z0-9]{30,}/g, validate: notPlaceholder },
+    // Our own keys: cdv_ (CLI), cdvm_ (model gateway), cdvci_, cdvi_, cdvd_,
+    // cdvx_, cdvh_, cdvr_, cdva_, cdvs_. Every body is 40+ random alnum/hex
+    // (lib/secureTokens.ts, lib/dataApiToken.ts); the 32+ floor keeps display
+    // prefixes like `cdvi_01234567…` and seed names like `cdv_seed` intact.
+    { name: "codiedev-key", re: /\bcdv(?:m|ci|i|d|x|h|r|a|s)?_[A-Za-z0-9]{32,}\b/g, validate: notPlaceholder },
+    // Browser sign-in tokens (convex/oauth.ts): access cdv_at_, refresh cdv_rt_,
+    // device code cdv_dc_, each + base64url of 32 random bytes (43 chars). The
+    // public client id cdv_client_ is not a secret.
+    { name: "codiedev-key", re: /\bcdv_(?:at|rt|dc)_[A-Za-z0-9_-]{40,}/g, validate: notPlaceholder },
+    { name: "fireworks-key", re: /\bfw_[A-Za-z0-9]{20,}/g, validate: notPlaceholder },
+    { name: "slack-webhook", re: /hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{20,}/g, validate: notPlaceholder },
+    { name: "npm-token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, validate: notPlaceholder },
+    { name: "sendgrid-key", re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, validate: notPlaceholder },
+    { name: "twilio-key", re: /\bSK[0-9a-f]{32}\b/g, validate: notPlaceholder },
+    // Azure: redact the key/signature value, keep the connection string readable.
+    { name: "azure-storage-key", re: /AccountKey=([A-Za-z0-9+/=]{40,})/g, group: 1, validate: notPlaceholder },
+    { name: "azure-sas", re: /[?&]sig=([A-Za-z0-9%+/=]{30,})/g, group: 1, validate: notPlaceholder },
+    // Passwords inside DB / basic-auth URLs. Only the password is redacted so the
+    // host, user and database stay readable for summaries and debugging.
+    {
+        name: "url-password",
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|mssql|sqlserver|amqps?|https?):\/\/[^:\s/"'@\\]+:([^@\s"'/\\]{6,})@[A-Za-z0-9.-]+/g,
+        group: 1,
+        validate: (v) => notPlaceholder(v) && !URL_PASSWORD_PLACEHOLDER.test(v),
+    },
+    // Generic Bearer tokens (non-JWT covered above) — redact only the token.
+    { name: "bearer-token", re: /\bBearer\s+([A-Za-z0-9._-]{20,})/g, group: 1 },
+    // Secret-named assignments: redact the value of KEY/SECRET/PASSWORD/etc.
+    // Name must look secret-y; value must be >= 8 non-space chars. This is the
+    // only entropy-ish rule and it is gated on the assignment name so benign
+    // env assignments (NODE_ENV=production, PORT=3000, LOG_LEVEL=debug) are safe.
+    {
+        name: "secret-assignment",
+        // The secret keyword must END the key name (it abuts the : or =), so the
+        // secret-word as a SUBSTRING of a larger code identifier does NOT match:
+        // `Last_Password_Change=`, `PasswordHash=`, `class ApiKeyController : Base`.
+        // Compound forms (SECRET_KEY, CLIENT_SECRET…) are listed before their parts.
+        // Quotes around the key or value may be JSON-escaped (\"KEY\": \"value\") —
+        // transcripts embed JSON-encoded tool results, so both forms must match;
+        // the value run excludes backslash so it stops at an escaped closing quote.
+        re: /\b([A-Za-z0-9_-]*?(?:SECRET[_-]?KEY|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|REFRESH[_-]?TOKEN|API[_-]?KEY|PASSWORD|PASSWD|SECRET|TOKEN))\\?['"]?\s*[:=]\s*(?:\\?['"])?([^\s'"\\]{8,})(?:\\?['"])?/gi,
+        group: 2,
+        validate: (v, m) => !SECRET_REF_KEY.test(m[1]) &&
+            !/public/i.test(m[1]) && // .NET `PublicKeyToken=`, `PublicKey=` — public, not secret
+            // Pagination cursors (Jira nextPageToken, S3 ContinuationToken…) are
+            // high-entropy but not secrets — the one confirmed FP of the shadow week.
+            !/(?:page|continuation)[_-]?token$/i.test(m[1]) &&
+            m.input[m.index - 1] !== ":" && // ARN/path segment `arn:…:secret:<name>` — names a secret
+            looksSecret(v),
+    },
+    // Formats Gitleaks doesn't give a prefix rule for, seen in our sessions.
+    { name: "supabase-token", re: /\bsbp_[a-f0-9]{40}\b/g, validate: notTestValue },
+    { name: "groq-key", re: /\bgsk_[A-Za-z0-9]{48,56}\b/g, validate: notTestValue },
+    { name: "xai-key", re: /\bxai-[A-Za-z0-9]{70,90}\b/g, validate: notTestValue },
+    { name: "replicate-token", re: /\br8_[A-Za-z0-9]{37}\b/g, validate: notTestValue },
+    // Provider-prefix formats ported from Gitleaks (scrubProviderRules.ts).
+    ...scrubProviderRules_1.PROVIDER_RULES.map((r) => ({
+        name: r.name,
+        re: r.re,
+        ...(r.group !== undefined ? { group: r.group } : {}),
+        ...(r.firstGroup ? { firstGroup: true } : {}),
+        keywords: r.keywords,
+        fallback: true,
+        validate: (v) => notTestValue(v) && (r.entropy === undefined || shannonEntropy(v) >= r.entropy),
+    })),
+];
+// Every rule keyword, found in one case-insensitive pass over the text
+// instead of one search per keyword.
+const ALL_KEYWORDS = [...new Set(RULES.flatMap((r) => r.keywords ?? []))].sort((a, b) => b.length - a.length);
+const KEYWORD_RE = new RegExp(ALL_KEYWORDS.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "gi");
+const KEYWORD_PARTS = new Map(ALL_KEYWORDS.map((k) => [k, ALL_KEYWORDS.filter((p) => k.includes(p))]));
+function keywordsIn(input) {
+    const found = new Set();
+    if (!ALL_KEYWORDS.length)
+        return found;
+    KEYWORD_RE.lastIndex = 0;
+    let m;
+    while ((m = KEYWORD_RE.exec(input)) !== null) {
+        // A keyword inside a longer one (sk_ in sk_live_) is present too.
+        for (const k of KEYWORD_PARTS.get(m[0].toLowerCase()) ?? [])
+            found.add(k);
+        if (found.size === ALL_KEYWORDS.length)
+            break;
+    }
+    return found;
+}
+function scrubSecrets(input, opts = {}) {
+    if (!input)
+        return { text: input, redactions: [] };
+    // 1) Collect every candidate span across all rules.
+    const candidates = [];
+    const fallbacks = [];
+    const generic = [];
+    // A caller's rules are few; they skip the keyword pre-check.
+    const extra = (opts.extraRules ?? []).map((r) => ({ name: r.name, re: new RegExp(r.re.source, r.re.flags.includes("g") ? r.re.flags : r.re.flags + "g"), validate: notTestValue }));
+    const present = keywordsIn(input);
+    for (const rule of extra.length ? [...RULES, ...extra] : RULES) {
+        if (rule.keywords?.length && !rule.keywords.some((k) => present.has(k)))
+            continue;
+        rule.re.lastIndex = 0;
+        let m;
+        while ((m = rule.re.exec(input)) !== null) {
+            let start = m.index;
+            let end = m.index + m[0].length;
+            const groupIndex = rule.firstGroup ? m.findIndex((g, i) => i > 0 && g) : rule.group;
+            if (rule.firstGroup && groupIndex === -1) {
+                if (m[0].length === 0)
+                    rule.re.lastIndex++;
+                continue; // no secret group matched: never redact the whole match
+            }
+            if (groupIndex !== undefined && groupIndex > 0) {
+                const gv = m[groupIndex];
+                if (gv === undefined || gv === "")
+                    continue;
+                if (rule.validate && !rule.validate(gv, m))
+                    continue;
+                // Locate the group within the match (it appears after the name/prefix).
+                const rel = m[0].lastIndexOf(gv);
+                if (rel >= 0) {
+                    start = m.index + rel;
+                    end = start + gv.length;
+                }
+            }
+            else if (rule.validate && !rule.validate(m[0], m)) {
+                if (m[0].length === 0)
+                    rule.re.lastIndex++;
+                continue;
+            }
+            if (end > start)
+                (rule.fallback ? fallbacks : exports.GENERIC_RULES.has(rule.name) ? generic : candidates).push({ rule: rule.name, start, end });
+            // Guard against zero-width matches looping forever.
+            if (m[0].length === 0)
+                rule.re.lastIndex++;
+        }
+    }
+    if (candidates.length === 0 && fallbacks.length === 0 && generic.length === 0)
+        return { text: input, redactions: [] };
+    // 2) Resolve overlaps: earlier start wins; on tie, longer span wins. Most
+    //    specific first: hand-written provider rules, then ported provider
+    //    rules, then the generic ones (a secret-named variable, a bearer
+    //    header, a JWT) only where nothing more specific matched.
+    const pick = (list, taken) => {
+        list.sort((a, b) => a.start - b.start || b.end - a.end);
+        const out = [];
+        let cursor = -1;
+        let t = 0;
+        for (const c of list) {
+            if (c.start < cursor)
+                continue;
+            while (t < taken.length && taken[t].end <= c.start)
+                t++;
+            if (t < taken.length && taken[t].start < c.end)
+                continue;
+            out.push(c);
+            cursor = c.end;
+        }
+        return out;
+    };
+    let chosen = pick(candidates, []);
+    for (const tier of [fallbacks, generic]) {
+        if (tier.length)
+            chosen = [...chosen, ...pick(tier, chosen)].sort((a, b) => a.start - b.start);
+    }
+    return { text: redactSpans(input, chosen), redactions: chosen };
+}
+/** Rewrite `input` with each span replaced by `[REDACTED:<rule>]`. Spans must
+ *  be sorted by start and not overlap. One forward pass: repeated
+ *  slice+concat would copy the whole string per redaction (quadratic). */
+function redactSpans(input, spans) {
+    const parts = [];
+    let last = 0;
+    for (const c of spans) {
+        parts.push(input.slice(last, c.start), `[REDACTED:${c.rule}]`);
+        last = c.end;
+    }
+    parts.push(input.slice(last));
+    return parts.join("");
+}
+// Rules without a provider-specific format: the only ones that misfire on
+// test values, and the ones whose findings need a person to check.
+exports.GENERIC_RULES = new Set(["secret-assignment", "bearer-token", "jwt"]);
+const SEQUENTIAL = /0123456|1234567|2345678|3456789|abcdefg|bcdefgh|qwertyu/i;
+const WORDISH = /^[A-Za-z]{2,}$/;
+/** Values that share a key's shape but are test or sample values: words
+ *  joined by _ or - with only digits or one repeated character between
+ *  (`cdv_local_pilot_token_2026`, `…_token_000000`), a long counting run
+ *  (`sk-1234567890…`), or a long repeated tail. Still removed from sessions;
+ *  just not listed as a key to rotate. */
+function looksLikeTestValue(value) {
+    if (SEQUENTIAL.test(value))
+        return true;
+    if (/(.)\1{9,}$/.test(value))
+        return true;
+    const parts = value.split(/[_-]+/).filter(Boolean);
+    if (parts.length < 3)
+        return false;
+    const words = parts.filter((p) => WORDISH.test(p)).length;
+    const filler = parts.filter((p) => /^\d+$/.test(p) || /^(.)\1*$/.test(p)).length;
+    return words >= 2 && words + filler === parts.length;
+}
+// `foo.test.ts`, `tests/x.py`, `test_auth.py`, `Cert_Tests.cs`, `fixtures/…`.
+const TEST_FILE = /(?:\.test\.|\.spec\.|__tests__|__mocks__|fixtures?\/|(?:^|[\/_.-])tests?[\/_.-])/i;
+// `CertPairTests.cs`, `LoginTest.java`: case matters, or `latests.ts` would match.
+const TEST_FILE_SUFFIX = /[a-z0-9]Tests?\.\w+$/;
+const isTestFile = (file) => TEST_FILE.test(file) || TEST_FILE_SUFFIX.test(file);
+exports.isTestFile = isTestFile;
+// `NAME=`, `NAME: `, `"NAME": "`, `export NAME=`, `--name=` just before the value.
+const NAME_BEFORE = /([A-Za-z_][A-Za-z0-9_.-]{0,63})\??["']?\s*[:=]\s*\??["']?(?:Bearer\s+)?$/;
+function nameBefore(input, start, lineStart) {
+    const window = input.slice(Math.max(lineStart, start - 160), start).replace(/\\[nrt]/g, " ");
+    const m = window.match(NAME_BEFORE)?.[1];
+    if (!m || /^(?:https?|Bearer|Authorization)$/i.test(m))
+        return m === "Authorization" ? m : undefined;
+    return m;
+}
+const FILE_PATH_FIELD = /"(?:file_path|filePath|path|target_file)"\s*:\s*"([^"]{1,400})"/g;
+// A shell redirect to a path. Not an arrow (`=>`, `->`), not a diff or quote
+// marker at the start of a line (`> AWS_KEY=…`, also JSON-escaped `\n> …`),
+// and the target has to look like a path (no `=`, `\`, `@`, `{`, `,`).
+const REDIRECT = /(?<![-=>\w]|\\n|\\r)(?<!^)(?:>>?|\btee(?:\s+-a)?)[ \t]*['"]?([\w.~/-]{2,300})/gm;
+const PATH_LIKE = /[./]/;
+const CONFIG_FILE = /((?:[\w.~-]+\/)*\.env(?:\.[\w-]+)?|(?:[\w.~-]+\/)*[\w.-]+\.(?:env|ya?ml|toml|ini|cfg|conf|properties|tfvars|npmrc|netrc|pgpass))(?![\w/])/g;
+const lastTwo = (p) => p.replace(/\\\//g, "/").split("/").filter(Boolean).slice(-2).join("/");
+function lastMatch(re, text) {
+    let last;
+    for (const m of text.matchAll(re))
+        last = m[1];
+    return last;
+}
+/** The file this line writes or reads, if it names one. */
+function fileOf(input, start, lineStart) {
+    const lineEnd = input.indexOf("\n", start);
+    const line = input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd);
+    const before = input.slice(Math.max(lineStart, start - 400), start);
+    const redirect = lastMatch(REDIRECT, before);
+    const hit = lastMatch(FILE_PATH_FIELD, line) ?? (redirect && PATH_LIKE.test(redirect) && !/^[.\d-]+$/.test(redirect) ? redirect : undefined) ?? lastMatch(CONFIG_FILE, before);
+    if (!hit || hit.startsWith("/dev/"))
+        return undefined;
+    const short = lastTwo(hit);
+    return short && short.length <= 120 ? short : undefined;
+}
+// Transcript shapes (one JSON object per line):
+//   Claude Code: {"type":"user"|"assistant","message":{"role","content":[{type:"tool_use",name,input}|{type:"tool_result"}|text]}}
+//   Codex:       {"type":"response_item","payload":{"type":"message",role}|{"type":"function_call",name,arguments}|{"type":"function_call_output"}}
+//   Others:      matched by the same generic markers (role, *tool*call*, *result*/*output*).
+const TOOL_CALL_TYPE = /^(?:tool_use|function_call|custom_tool_call|tool_call|toolCall|tool_request|tool\.execution_start|server_tool_use|mcp_tool_use)$/;
+const TOOL_OUTPUT_TYPE = /^(?:tool_result|function_call_output|custom_tool_call_output|tool_output|toolResult|tool\.execution_complete|mcp_tool_result)$/;
+const SHELL_TOOL = /bash|shell|exec|terminal|run_command|run_terminal/i;
+const GIT_COMMIT = /\bgit\s+(?:[^\n]*\s)?(?:commit|push)\b/;
+// A person's message this long was pasted, not typed: keys in it came along
+// with a log, config file or API response.
+const PASTE_LINES = 8;
+const PASTE_CHARS = 800;
+/** A line of the transcript, parsed once per scan. */
+function lineAt(input, at, cache) {
+    const lineStart = input.lastIndexOf("\n", at - 1) + 1;
+    let parsed = cache.get(lineStart);
+    if (parsed === undefined) {
+        const lineEnd = input.indexOf("\n", at);
+        try {
+            parsed = JSON.parse(input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd));
+        }
+        catch {
+            parsed = null;
+        }
+        cache.set(lineStart, parsed);
+    }
+    return parsed;
+}
+/** The tool a result belongs to. Claude Code's tool_result carries only the
+ *  call's id, so find the tool_use with that id (an earlier line). */
+function toolForResult(input, id, cache) {
+    if (!/^[\w-]{6,}$/.test(id))
+        return undefined;
+    const at = input.indexOf(`"${id}"`);
+    if (at === -1)
+        return undefined;
+    let name;
+    const walk = (node) => {
+        if (name || !node || typeof node !== "object")
+            return;
+        if (Array.isArray(node)) {
+            node.forEach(walk);
+            return;
+        }
+        const n = node;
+        if ((n.id === id || n.call_id === id || n.toolCallId === id) && typeof n.name === "string" && TOOL_CALL_TYPE.test(typeof n.type === "string" ? n.type : "tool_use")) {
+            name = n.name;
+            return;
+        }
+        Object.values(n).forEach(walk);
+    };
+    walk(lineAt(input, at, cache));
+    return name;
+}
+/** Classify one redaction by the nearest enclosing tool call, tool result or
+ *  message role in its transcript line. Non-JSON lines are "unknown". */
+function locate(input, r, cache, exact) {
+    const parsed = lineAt(input, r.start, cache);
+    if (parsed === null || typeof parsed !== "object")
+        return { where: "unknown" };
+    // Search for an alphanumeric run from the secret: JSON escaping (\n, \")
+    // differs between the raw line and the parsed strings.
+    const runs = exact ? null : input.slice(r.start, r.end).match(/[A-Za-z0-9]{8,}/g);
+    const needle = exact ?? (runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null);
+    if (!needle)
+        return { where: "unknown" };
+    return classify(parsed, needle, input, cache);
+}
+/** Where in one transcript line (a JSONL record) some text appeared, and the
+ *  file that line reads or writes, if it names one. For any detector that
+ *  works line by line (PHI/PII). `text` is the matched text as it reads
+ *  after JSON unescaping. */
+function locateInLine(line, text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        parsed = null;
+    }
+    const fileHit = lastMatch(FILE_PATH_FIELD, line);
+    const file = fileHit && !fileHit.startsWith("/dev/") ? lastTwo(fileHit).slice(0, 120) : undefined;
+    if (parsed === null || typeof parsed !== "object")
+        return { where: "unknown", ...(file ? { file } : {}) };
+    const runs = text.match(/[A-Za-z0-9]{4,}/g);
+    const needle = runs ? runs.reduce((a, b) => (b.length > a.length ? b : a)) : null;
+    const loc = needle ? classify(parsed, needle, line, new Map()) : { where: "unknown" };
+    return { ...loc, ...(file ? { file } : {}) };
+}
+/** Where `needle` sits in one parsed record. `input` is the whole transcript
+ *  (or just this line), used to name the tool behind a tool result. */
+function classify(parsed, needle, input, cache) {
+    let path = null;
+    const walk = (node, trail) => {
+        if (path)
+            return;
+        if (typeof node === "string") {
+            if (node.includes(needle))
+                path = trail;
+            return;
+        }
+        if (!node || typeof node !== "object")
+            return;
+        if (Array.isArray(node)) {
+            node.forEach((c) => walk(c, [...trail, { node: c }]));
+            return;
+        }
+        for (const [k, c] of Object.entries(node))
+            walk(c, [...trail, { node: c, key: k }]);
+    };
+    walk(parsed, [{ node: parsed }]);
+    if (!path)
+        return { where: "unknown" };
+    const frames = path;
+    for (let i = frames.length - 1; i >= 0; i--) {
+        const n = frames[i].node;
+        if (!n || typeof n !== "object" || Array.isArray(n))
+            continue;
+        const type = typeof n.type === "string" ? n.type : "";
+        const tool = typeof n.name === "string" ? n.name : typeof n.toolName === "string" ? n.toolName : undefined;
+        if (TOOL_CALL_TYPE.test(type)) {
+            const args = JSON.stringify(n.input ?? n.arguments ?? n.args ?? "");
+            if (tool && SHELL_TOOL.test(tool) && GIT_COMMIT.test(args))
+                return { where: "commit", tool };
+            return tool ? { where: "tool_call", tool } : { where: "tool_call" };
+        }
+        if (TOOL_OUTPUT_TYPE.test(type)) {
+            const id = n.tool_use_id ?? n.call_id ?? n.toolCallId;
+            const named = tool ?? (typeof id === "string" ? toolForResult(input, id, cache) : undefined);
+            return named ? { where: "tool_output", tool: named } : { where: "tool_output" };
+        }
+        if (n.role === "user" || (type === "user" && i === 0)) {
+            const line = frames[0].node;
+            // Claude Code repeats a tool's result beside the message (toolUseResult).
+            if (frames.some((f) => f.key === "toolUseResult")) {
+                const content = line.message?.content;
+                const id = Array.isArray(content) ? content.find((c) => c && typeof c === "object" && "tool_use_id" in c)?.tool_use_id : undefined;
+                const named = typeof id === "string" ? toolForResult(input, id, cache) : undefined;
+                return named ? { where: "tool_output", tool: named } : { where: "tool_output" };
+            }
+            if (line.isMeta === true || line.isCompactSummary === true)
+                return { where: "attached" };
+            const text = frames[frames.length - 1].node;
+            if (typeof text === "string" && (text.length >= PASTE_CHARS || text.split("\n").length >= PASTE_LINES))
+                return { where: "pasted" };
+            return { where: "typed" };
+        }
+        if (n.role === "assistant" || (type === "assistant" && i === 0))
+            return { where: "assistant" };
+    }
+    return { where: "unknown" };
+}
+/** Where each `[REDACTED:<rule>]` marker sits in an already-scrubbed
+ *  transcript. Re-labels older findings that predate typed/pasted/attached. */
+function locateMarkers(scrubbed, rule) {
+    const marker = `[REDACTED:${rule}]`;
+    const cache = new Map();
+    const out = [];
+    for (let at = scrubbed.indexOf(marker); at !== -1; at = scrubbed.indexOf(marker, at + marker.length)) {
+        const loc = locate(scrubbed, { rule, start: at, end: at + marker.length }, cache, marker);
+        if (!out.some((l) => l.where === loc.where && l.tool === loc.tool))
+            out.push(loc);
+        if (out.length >= 16)
+            break;
+    }
+    return out;
+}
+// ─── Is this a key someone should rotate? ───
+//
+// Everything a rule matches is removed from the session. Only a key that is
+// real, still usable and worth a person's time is listed to rotate: the list
+// is read as "do this", so a placeholder on it costs more than a miss.
+/** Rules that match a shape (a secret-named variable, a header, a URL, a PEM
+ *  block) rather than a provider's own key format. */
+exports.SHAPE_RULES = new Set([
+    "secret-assignment", "bearer-token", "jwt", "pem-private-key", "url-password", "curl-auth-header", "curl-auth-user",
+]);
+// Words placeholder passwords and sample tokens are built from.
+const FILLER_WORD = /secret|password|passwd|passw|pass|pwd|token|apikey|key|auth|bearer|basic|api|app|access|refresh|client|user|name|admin|root|guest|test(?:ing)?|dummy|sample|example|demo|default|change(?:me|it)?|service|local(?:host)?|super|your|mine|my|the|new|old|temp|tmp|dev|prod|stag(?:ing)?|value|string|here|foo|bar|baz|qux|private|public|hello|world|welcome|letmein/gi;
+const LEET = { "0": "o", "1": "l", "3": "e", "4": "a", "5": "s", "7": "t", "@": "a", $: "s" };
+/** Built from filler words plus digits or punctuation: `secret1`,
+ *  `MySecret123`, `pa55w0rd`, `test-api-key`. */
+function madeOfFillerWords(v) {
+    const residue = (t) => {
+        FILLER_WORD.lastIndex = 0;
+        if (!FILLER_WORD.test(t))
+            return Infinity;
+        return t.replace(FILLER_WORD, "").replace(/[^A-Za-z]/g, "").length;
+    };
+    return residue(v) <= 3 || residue(v.replace(/[013457@$]/g, (c) => LEET[c])) <= 3;
+}
+/** Two or more three-character counting runs: `abc123`, `abc123def456`.
+ *  Three in a long value, where two can happen by chance (64 hex digits). */
+function hasCountingRuns(v) {
+    const t = v; // same case only: `hIj` in a mixed-case key is chance, not counting
+    const need = t.length > 24 ? 3 : 2;
+    let runs = 0;
+    for (let i = 0; i + 2 < t.length; i++) {
+        const a = t.charCodeAt(i);
+        if (!/[A-Za-z0-9]/.test(t[i]) || t.charCodeAt(i + 1) !== a + 1 || t.charCodeAt(i + 2) !== a + 2)
+            continue;
+        if (++runs >= need)
+            return true;
+        i += 2;
+    }
+    return false;
+}
+// Letter pairs that turn up inside English words and service names. A run of
+// random letters almost always has a pair that isn't here.
+const WORD_PAIRS = new Set(("ab ac ad ae ag ai ak al am an ao ap ar as at au av aw ax ay az ba be bi bj bl bo br bs bu by ca ce ch ci ck cl co " +
+    "cr cs ct cu cy da db de dg di dm do dr ds du dw dy ea eb ec ed ee ef eg ei el em en eo ep er es et eu ev ew ex ey " +
+    "fa fe ff fi fl fo fr ft fu ga ge gh gi gl gn go gr gs gu gy ha hc he hi ho hs ht hu ia ib ic id ie if ig il im in " +
+    "io ip ir is it iu iv ix iz ja je jo ju ka ke ki kn ko ks ku la ld le lf li lk ll lm lo lp ls lt lu lv ly ma mb me " +
+    "mi mm mo mp ms mu my na nc nd ne nf ng ni nk nm nn no ns nt nv ny oa ob oc od oe of og oi ok ol om on oo op or os " +
+    "ot ou ov ow ox oz pa pe ph pi pl po pp pr ps pt pu py qu ra rc rd re rg ri rk rl rm rn ro rr rs rt ru ry sa sc se " +
+    "sh si sk sl sm sn so sp ss st su sw sy ta te th ti tl to tr ts tt tu tw ty ua ub uc ud ue ug ui ul um un uo up ur " +
+    "us ut va ve vi vo vu wa we wh wi wo ws xp xt ya yc ye yl ym yn yo yp ys yt za ze zi zo").split(" "));
+/** A token that reads as a word: three or more letters in one case (or
+ *  Capitalised), a vowel, and letter pairs words are made of. A long one
+ *  may have one odd pair (a product name). */
+function readsAsWord(t) {
+    if (t.length < 3 || !/^(?:[a-z]+|[A-Z]+|[A-Z][a-z]+)$/.test(t))
+        return false;
+    const l = t.toLowerCase();
+    if (!/[aeiouy]/.test(l))
+        return false;
+    let odd = 0;
+    for (let i = 0; i + 1 < l.length; i++)
+        if (!WORD_PAIRS.has(l.slice(i, i + 2)))
+            odd++;
+    return odd <= (l.length >= 7 ? 1 : 0);
+}
+/** The name or location of a secret, or a value built from words, rather
+ *  than a random key: an ARN, a secret-store path, or a value whose letters
+ *  are mostly whole words (`mobile-data/client2`, `bracecomb-hc-service`,
+ *  `mobileDataClientV2`). A random key does not break into words, whatever
+ *  separators it has: under 1% of random 16-character keys pass this, and
+ *  next to none at 24 or more. */
+function namesASecret(v) {
+    if (/^arn:[a-z-]+:/i.test(v))
+        return true;
+    if (/^(?:vault|ssm|secretsmanager|keyvault|op|ref|env|file):/i.test(v))
+        return true;
+    if (/(?:^|\/)secrets?\//i.test(v))
+        return true; // secret/data/app, projects/p/secrets/name
+    const tokens = v
+        .replace(/([a-z])([A-Z])/g, "$1 $2")
+        .replace(/([A-Za-z])(\d)/g, "$1 $2")
+        .replace(/(\d)([A-Za-z])/g, "$1 $2")
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean);
+    let total = 0;
+    let letters = 0;
+    let inWords = 0;
+    for (const t of tokens) {
+        total += t.length;
+        if (/^\d+$/.test(t))
+            continue;
+        letters += t.length;
+        if (readsAsWord(t))
+            inWords += t.length;
+    }
+    return inWords >= 6 && inWords / letters >= 0.7 && letters / total >= 0.5;
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** A JWT that is cut short, already expired, or issued for a day or less:
+ *  nothing to rotate. One with no expiry, or a long one, stays. */
+function jwtNotWorthRotating(v, now) {
+    const parts = v.split(".");
+    if (parts.length < 3)
+        return true; // header only, or cut off
+    let payload;
+    try {
+        payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+    }
+    catch {
+        return true; // truncated in the transcript: not a usable token
+    }
+    if (!payload || typeof payload.exp !== "number")
+        return false;
+    if (payload.exp * 1000 < now + DAY_MS)
+        return true;
+    return typeof payload.iat === "number" && (payload.exp - payload.iat) * 1000 <= DAY_MS;
+}
+/** The base64 body of a PEM block, without armor headers or (escaped) line breaks. */
+function pemBody(block) {
+    return block
+        .replace(/-----BEGIN[A-Z ]*PRIVATE KEY-----/, "")
+        .split("-----END")[0]
+        .split(/\\r|\\n|\r|\n/)
+        .filter((l) => !l.includes(":")) // Proc-Type / DEK-Info
+        .join("")
+        .replace(/\s+/g, "");
+}
+/** True when a redacted value should not be listed as a key to rotate: a
+ *  placeholder, a sample or test value, a reference to a variable, or a
+ *  credential that expires by itself. `now` is injectable for tests. */
+function notWorthRotating(k, now = Date.now()) {
+    const { rule, name, file } = k;
+    const value = k.value.trim();
+    if (looksLikeTestValue(value))
+        return true;
+    if (exports.SHAPE_RULES.has(rule) && file && (0, exports.isTestFile)(file))
+        return true;
+    if (rule === "pem-private-key") {
+        const body = pemBody(value);
+        // The smallest real key (Ed25519, PKCS#8) is 64 base64 characters.
+        return body.length < 60 || !/^[A-Za-z0-9+/=]+$/.test(body) || shannonEntropy(body) < 4;
+    }
+    // Documentation keys (AKIAIOSFODNN7EXAMPLE), `<your-token>`, `xxxxxxxx`.
+    if (PLACEHOLDER.test(value))
+        return true;
+    if (hasCountingRuns(value))
+        return true;
+    // Credentials that expire by themselves: STS keys and session tokens, JWTs.
+    if (rule === "aws-access-key" && value.startsWith("ASIA"))
+        return true;
+    if (name && /(?:session|security)[_-]?token$/i.test(name))
+        return true;
+    if (/^(?:IQoJ|FwoG|FQoG|AQoD)[A-Za-z0-9+/]{20,}/.test(value))
+        return true; // STS session token
+    if (value.startsWith("eyJ"))
+        return jwtNotWorthRotating(value, now);
+    if (!exports.SHAPE_RULES.has(rule))
+        return false;
+    // `X-Atlassian-Token: no-check` switches off a CSRF check; it isn't a credential.
+    if (name && /^x-atlassian-token$/i.test(name))
+        return true;
+    let secret = value;
+    if (rule === "curl-auth-user") {
+        const at = value.indexOf(":");
+        const user = value.slice(0, at).replace(/["']/g, "");
+        secret = value.slice(at + 1).replace(/["']/g, "");
+        if (at < 0 || !secret || secret === user)
+            return true;
+    }
+    if (rule === "url-password" && name && secret === name)
+        return true; // postgres:postgres@
+    if (secret.includes("$"))
+        return true; // $TOKEN, ${TOKEN}: a reference, not the key
+    if (/^[A-Za-z._-]+$/.test(secret))
+        return true; // words or an identifier: `no-check`, `header.payload.signature`
+    if (/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(secret))
+        return true; // OAUTH2_CLIENT_SECRET: a variable's name
+    if (madeOfFillerWords(secret))
+        return true;
+    if (rule === "secret-assignment" && namesASecret(secret))
+        return true; // points at a secret, isn't one
+    return rule !== "url-password" && shannonEntropy(secret) < 3;
+}
+/** Last four letters or digits of a value. A PEM block ends in a fixed
+ *  footer, and in a transcript its line breaks are a literal `\n`: the hint
+ *  comes from the key body, without either. */
+function hintOf(rule, value) {
+    const body = rule === "pem-private-key" ? value.split("-----END")[0].replace(/\\[nr]/g, "") : value;
+    return body.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+}
+const MAX_LOCATIONS = 8;
+/** One finding per distinct (rule, last-4) in a scrub result, with every
+ *  distinct place it appeared. */
+function secretFindings(input, redactions, opts = {}) {
+    const seen = new Map();
+    const cache = new Map();
+    for (const r of redactions) {
+        const value = input.slice(r.start, r.end);
+        const hint = hintOf(r.rule, value);
+        if (!hint)
+            continue;
+        const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
+        const name = nameBefore(input, r.start, lineStart);
+        const file = fileOf(input, r.start, lineStart);
+        if (notWorthRotating({ rule: r.rule, value, ...(name ? { name } : {}), ...(file ? { file } : {}) }, opts.now))
+            continue;
+        if (opts.skip?.({ rule: r.rule, value, ...(name ? { name } : {}), ...(file ? { file } : {}) }))
+            continue;
+        const key = `${r.rule}\u0000${hint}`;
+        const finding = seen.get(key) ?? { rule: r.rule, hint, locations: [] };
+        if (name && !finding.name)
+            finding.name = name;
+        if (file && !finding.file)
+            finding.file = file;
+        seen.set(key, finding);
+        const loc = locate(input, r, cache);
+        if (finding.locations.length < MAX_LOCATIONS && !finding.locations.some((l) => l.where === loc.where && l.tool === loc.tool)) {
+            finding.locations.push(loc);
+        }
+    }
+    return [...seen.values()];
+}
+// Key-ish names the secret-assignment rule doesn't cover (it already handles
+// API_KEY, SECRET, TOKEN, PASSWORD…). The keyword must end the name.
+const KEYISH_ASSIGNMENT = /\b([A-Za-z][A-Za-z0-9_-]*?(?:KEY|CREDENTIALS?|CREDS?|AUTH|SIGNATURE|SIGNING[_-]?KEY|SALT|DSN|PASS|PWD|PASSPHRASE|CONN(?:ECTION)?[_-]?STRING|COOKIE))\\?['"]?\s*[:=]\s*(?:\\?['"])?([A-Za-z0-9+/=_.-]{20,200})(?:\\?['"])?/gi;
+// Names that hold random-looking values that aren't secrets.
+const NOT_SECRET_NAME = /(?:cache|idempoten|partition|sort|primary|foreign|composite|unique|hash|etag|checksum|digest|storage|object|row|item|react|list|map|lookup|index|public|publishable|pub|page|continuation|cursor|nonce|trace|span|request|correlation|commit|sha|fingerprint|kid|key[_-]?id|keyof|monkey|turkey|hotkey|shortcut)/i;
+// Unknown vendor tokens: `acme_live_…`, `xyz_prod_…`, `foo_sk_…`. pk_ is public.
+const PREFIXED_TOKEN = /\b((?!pk_)[a-z][a-z0-9]{1,9}_(?:live|prod|secret|sk|key|token|api)_)([A-Za-z0-9]{24,})\b/g;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function shannon(v) {
+    const counts = new Map();
+    for (const c of v)
+        counts.set(c, (counts.get(c) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values()) {
+        const p = n / v.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/** Random enough to be a credential, and not a known non-secret shape. */
+function randomLooking(v) {
+    if (v.length < 20 || UUID.test(v))
+        return false;
+    if (/^\d+$/.test(v) || /^[A-Za-z]+$/.test(v))
+        return false;
+    if (/[._-]{2}|^[._-]|[._-]$/.test(v))
+        return false;
+    if (/\.[a-z]{2,4}$/i.test(v) || /^[a-z]+(?:[._-][a-z]+)+$/i.test(v))
+        return false; // file names, dotted/kebab words
+    if (PLACEHOLDER.test(v))
+        return false;
+    // Slugs and ids: `openai/gpt-5-mini` (base64 never mixes / and -), and
+    // lowercase names like `local-team_app-4870`.
+    if (v.includes("/") && v.includes("-"))
+        return false;
+    if (/^[a-z0-9]+(?:[_-][a-z0-9]+){2,}$/.test(v))
+        return false;
+    if (!/[0-9]/.test(v) || !/[A-Za-z]/.test(v))
+        return false;
+    return shannon(v) >= 3.5;
+}
+function shapeOf(v) {
+    if (/^[0-9a-f]+$/i.test(v))
+        return "hex";
+    if (/[+/=]/.test(v))
+        return "base64";
+    return "alnum";
+}
+// Long runs with letters AND digits get masked in snippets; names like
+// `partnerCredentials` stay readable.
+const LONG_RUN = /[A-Za-z0-9+/=_-]{16,}/g;
+const maskRuns = (s) => s.replace(LONG_RUN, (r) => (/[0-9]/.test(r) && /[A-Za-z]/.test(r) ? "••••" : r));
+/** The decoded string (prompt text, command, tool output…) the value sits
+ *  in, when its transcript line is JSON; else the raw line. */
+function containingText(text, start, end, cache) {
+    const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+    const lineEndRaw = text.indexOf("\n", end);
+    const raw = text.slice(lineStart, lineEndRaw === -1 ? text.length : lineEndRaw);
+    let parsed = cache.get(lineStart);
+    if (parsed === undefined) {
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            parsed = null;
+        }
+        cache.set(lineStart, parsed);
+    }
+    const value = text.slice(start, end);
+    let hit = null;
+    const walk = (node) => {
+        if (hit !== null)
+            return;
+        if (typeof node === "string") {
+            if (!node.includes(value))
+                return;
+            // Codex function_call arguments are JSON in a string: look inside.
+            if (/^[[{]/.test(node.trim())) {
+                try {
+                    walk(JSON.parse(node));
+                }
+                catch { /* not JSON */ }
+            }
+            if (hit === null)
+                hit = node;
+            return;
+        }
+        if (node && typeof node === "object")
+            for (const c of Object.values(node))
+                walk(c);
+    };
+    if (parsed !== null)
+        walk(parsed);
+    return hit ?? raw;
+}
+/** ~80 characters around a value, the value shown as ••••last4 and every
+ *  other random-looking run masked, so the snippet can't carry a secret. */
+function snippetAround(text, start, end, hint, cache) {
+    const value = text.slice(start, end);
+    const host = containingText(text, start, end, cache);
+    const at = host.indexOf(value);
+    const from = Math.max(0, at - 40);
+    const to = Math.min(host.length, at + value.length + 40);
+    const before = maskRuns(host.slice(from, at));
+    const after = maskRuns(host.slice(at + value.length, to));
+    return `${from > 0 ? "…" : ""}${before}••••${hint}${after}${to < host.length ? "…" : ""}`.replace(/\s+/g, " ").trim();
+}
+const MAX_POSSIBLE = 20;
+function possibleSecrets(text, limit = MAX_POSSIBLE) {
+    if (!text)
+        return [];
+    const found = new Map();
+    const cache = new Map();
+    const add = (label, prefix, value, start) => {
+        const end = start + value.length;
+        const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+        const key = `${label.toLowerCase()}\u0000${hint}\u0000${value.length}`;
+        let item = found.get(key);
+        if (!item) {
+            if (found.size >= limit)
+                return;
+            item = { label, prefix, hint, length: value.length, shape: shapeOf(value), snippet: snippetAround(text, start, end, hint, cache), locations: [], spans: [] };
+            found.set(key, item);
+        }
+        item.spans.push({ start, end });
+        const loc = locate(text, { rule: "possible", start, end }, cache);
+        if (item.locations.length < MAX_LOCATIONS && !item.locations.some((l) => l.where === loc.where && l.tool === loc.tool))
+            item.locations.push(loc);
+    };
+    KEYISH_ASSIGNMENT.lastIndex = 0;
+    let m;
+    while ((m = KEYISH_ASSIGNMENT.exec(text)) !== null) {
+        const [whole, rawName, value] = m;
+        // `\nAZURE_KEY=` in JSON-escaped text: the n belongs to the escape.
+        const name = text[m.index - 1] === "\\" ? rawName.replace(/^(?:u00[0-9a-fA-F]{2}|[ntr](?=[A-Z]))/, "") : rawName;
+        // A signed URL's signature parameter (`?…&signature=`) expires with the URL.
+        const before = text.slice(Math.max(0, m.index - 7), m.index);
+        if (/sig(?:nature)?$/i.test(name) && /(?:[?&]|\\u0026|\\u003f)$/i.test(before + rawName.slice(0, rawName.length - name.length)))
+            continue;
+        if (NOT_SECRET_NAME.test(name) || SECRET_REF_KEY.test(name))
+            continue;
+        if (text[m.index - 1] === ":" || text[m.index - 1] === ".")
+            continue; // arn:…, obj.key
+        if (!randomLooking(value))
+            continue;
+        add(name, undefined, value, m.index + whole.lastIndexOf(value));
+    }
+    PREFIXED_TOKEN.lastIndex = 0;
+    while ((m = PREFIXED_TOKEN.exec(text)) !== null) {
+        const [whole, prefix, body] = m;
+        if (!randomLooking(body))
+            continue;
+        const start = m.index;
+        // Already found under its name (`X-Acme-Key: acme_live_…`): one item,
+        // keep the name and note the prefix.
+        const named = [...found.values()].find((f) => f.spans.some((sp) => sp.start < start + whole.length && start < sp.end));
+        if (named) {
+            named.prefix ??= prefix;
+            continue;
+        }
+        add(prefix.replace(/_$/, ""), prefix, whole, start);
+    }
+    return [...found.values()];
+}
+/** Redact every occurrence of an already-reviewed possible secret. */
+function redactPossible(text, match, rule = "reviewed-secret") {
+    const hits = possibleSecrets(text, Infinity).filter((p) => p.label.toLowerCase() === match.label.toLowerCase() && p.hint === match.hint && p.length === match.length);
+    const spans = hits.flatMap((h) => h.spans).sort((a, b) => a.start - b.start);
+    if (!spans.length)
+        return { text, redactions: [] };
+    const parts = [];
+    let last = 0;
+    const redactions = [];
+    for (const s of spans) {
+        if (s.start < last)
+            continue;
+        parts.push(text.slice(last, s.start), `[REDACTED:${rule}]`);
+        redactions.push({ rule, start: s.start, end: s.end });
+        last = s.end;
+    }
+    parts.push(text.slice(last));
+    return { text: parts.join(""), redactions };
+}