e2e 0.15.2 → 0.17.0

package/dist/agent/invocation.js

@@ -53,7 +53,7 @@ export class Invocation {
         this.agent = runtime.select(options.agent);
         this.deadline = runtime.engine.deadline(options.timeoutMs);
         this.pixelTier = options.vision === true || options.vision === 'only';
-        this.system = buildSystem(options.task, this.agent.agentContext);
+        this.system = runtime.redact(buildSystem(options.task, this.agent.agentContext));
         this.systemBytes = tokenUpperBound(this.system);
     }
     get session() {
@@ -179,11 +179,17 @@ export class Invocation {
         for (;;) {
             this.checkDeadline();
             this.consumeModelCall();
-            const prompt = buildPrompt({
+            // The observation is redacted already; the instruction is the test's
+            // own text, which may spell out a registered value. The repair's raw
+            // text is redacted before the prompt cuts it, so the cut never splits a
+            // value into a fragment whole-value matching would miss.
+            const prompt = this.runtime.redact(buildPrompt({
                 ...request.prompt,
                 ...(this.treeWithheld ? { withholdTree: true } : {}),
-                ...(repair === undefined ? {} : { repair }),
-            });
+                ...(repair === undefined
+                    ? {}
+                    : { repair: { ...repair, rawText: repair.rawText === undefined ? undefined : this.runtime.redact(repair.rawText) } }),
+            }));
             // Pixels travel with the observation they were captured for, so the
             // image and the tree in one request always describe one revision.
             const images = imagesFor(request.prompt.observation);
@@ -322,4 +328,3 @@ function imagesFor(observation) {
         },
     ];
 }
-//# sourceMappingURL=invocation.js.map

package/dist/agent/ledger.d.ts

@@ -36,4 +36,3 @@ export interface LedgerContext {
  * handoff to the ledger's own line budget.
  */
 export declare function serializeLedger(steps: readonly PriorStep[], maxBytes: number): LedgerContext;
-//# sourceMappingURL=ledger.d.ts.map

package/dist/agent/ledger.js

@@ -72,4 +72,3 @@ function formatEntry(step, position) {
     const handoff = truncateUtf8(step.explanation, MAX_HANDOFF_BYTES);
     return `${head}\n   observed: ${handoff}`;
 }
-//# sourceMappingURL=ledger.js.map

package/dist/agent/loop-guards.d.ts

@@ -84,4 +84,3 @@ export declare function isFailedResult(toolName: string, text: string): boolean;
  * that the last id was. Warns first, then forces the conclusion.
  */
 export declare function checkFailureStreak(results: readonly GuardToolResult[], thresholds?: LoopGuardThresholds): LoopGuardVerdict;
-//# sourceMappingURL=loop-guards.d.ts.map

package/dist/agent/loop-guards.js

@@ -184,4 +184,3 @@ export function checkFailureStreak(results, thresholds = DEFAULT_LOOP_GUARD_THRE
     }
     return { kind: 'clear' };
 }
-//# sourceMappingURL=loop-guards.js.map

package/dist/agent/model/adapter.d.ts

@@ -102,4 +102,3 @@ export declare function imageTokenUpperBound(image: {
     width: number;
     height: number;
 }): number;
-//# sourceMappingURL=adapter.d.ts.map

package/dist/agent/model/adapter.js

@@ -37,4 +37,3 @@ export function imageTokenUpperBound(image) {
     return (Math.ceil(Math.max(1, image.width) / IMAGE_TILE_PX) *
         Math.ceil(Math.max(1, image.height) / IMAGE_TILE_PX));
 }
-//# sourceMappingURL=adapter.js.map

package/dist/agent/model/overflow.d.ts

@@ -17,4 +17,3 @@
  * provider's words.
  */
 export declare function isContextOverflow(error: unknown): boolean;
-//# sourceMappingURL=overflow.d.ts.map

package/dist/agent/model/overflow.js

@@ -79,4 +79,3 @@ function describesOverflow(error) {
         OVERFLOW_PATTERNS.some((pattern) => pattern.test(text)) &&
         !NON_OVERFLOW_PATTERNS.some((pattern) => pattern.test(text)));
 }
-//# sourceMappingURL=overflow.js.map

package/dist/agent/model/provider-hints.d.ts

@@ -43,4 +43,3 @@ export interface ProviderHints {
 export declare function providerHints(model: ProviderModelRef | undefined): ProviderHints;
 /** A stable key for one system prompt, so every call sharing the prefix routes alike. */
 export declare function promptCacheKey(system: string): string;
-//# sourceMappingURL=provider-hints.d.ts.map

package/dist/agent/model/provider-hints.js

@@ -85,4 +85,3 @@ function withoutBreakpoint(message) {
     }
     return { ...message, providerOptions };
 }
-//# sourceMappingURL=provider-hints.js.map

package/dist/agent/model/schema.d.ts

@@ -17,4 +17,3 @@ import type { JSONSchema7 } from 'ai';
 import type { StandardSchemaV1 } from '../../types.ts';
 /** The caller schema's shape as JSON Schema, or undefined when it has no usable projection. */
 export declare function deriveJsonSchema(schema: StandardSchemaV1): Promise<JSONSchema7 | undefined>;
-//# sourceMappingURL=schema.d.ts.map

package/dist/agent/model/schema.js

@@ -80,4 +80,3 @@ function refinesOnly(member, type) {
 function isSchemaObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-//# sourceMappingURL=schema.js.map

package/dist/agent/model/sdk.d.ts

@@ -72,4 +72,3 @@ export declare function failureHint(cause: unknown): string;
  * the SDK to be loaded, which every caller has done by the time a call failed.
  */
 export declare function isAbort(cause: unknown): boolean;
-//# sourceMappingURL=sdk.d.ts.map

package/dist/agent/model/sdk.js

@@ -9,6 +9,7 @@
 import { withHint } from '../../internal/errors.js';
 import { missingModelError } from '../../config/agent.js';
 import { aiSdk, asSdkLanguageModel, loadAiSdk } from '../ai-sdk.js';
+import { MODEL_REQUEST_HEADERS } from '../../internal/client-identity.js';
 import { packageVersion } from '../../internal/package-version.js';
 import { AgentError } from '../error.js';
 import { isContextOverflow } from './overflow.js';
@@ -75,6 +76,7 @@ export function createModelAdapter(model, agentName = 'default') {
                 maxOutputTokens: call.maxOutputTokens,
                 ...(providerOptions === undefined ? {} : { providerOptions: providerOptions }),
                 maxRetries: TRANSPORT_RETRIES,
+                headers: MODEL_REQUEST_HEADERS,
                 abortSignal: call.signal,
                 timeout: call.timeoutMs,
             };
@@ -303,4 +305,3 @@ export function isAbort(cause) {
         return true;
     return cause instanceof Error && (cause.name === 'AbortError' || cause.name === 'TimeoutError');
 }
-//# sourceMappingURL=sdk.js.map

package/dist/agent/model/stall.d.ts

@@ -8,4 +8,3 @@ import type { AiSdk, SdkLanguageModel } from '../ai-sdk.ts';
  * The caller's cancellation is not a stall and passes through as it was.
  */
 export declare function withStallGuard(ai: AiSdk, model: SdkLanguageModel, onStall?: (stallMs: number) => void, stallMs?: number): SdkLanguageModel;
-//# sourceMappingURL=stall.d.ts.map

package/dist/agent/model/stall.js

@@ -50,4 +50,3 @@ export function withStallGuard(ai, model, onStall = () => undefined, stallMs = M
         },
     });
 }
-//# sourceMappingURL=stall.js.map

package/dist/agent/model/tool-choice.d.ts

@@ -41,4 +41,3 @@ export declare function isForcedToolCallSkipped(error: unknown): error is {
  * quoting the request never reads as a model limitation.
  */
 export declare function isForcedToolChoiceRejected(error: unknown): boolean;
-//# sourceMappingURL=tool-choice.d.ts.map

package/dist/agent/model/tool-choice.js

@@ -72,4 +72,3 @@ function describesRejection(error) {
         return false;
     return [record.message, record.responseBody].some((text) => typeof text === 'string' && FORCED_CHOICE_PATTERNS.some((pattern) => pattern.test(text)));
 }
-//# sourceMappingURL=tool-choice.js.map

package/dist/agent/observation-budget.d.ts

@@ -24,4 +24,3 @@ export interface ObservationBudgetRequest {
  * than fail the adapter's pre-flight check.
  */
 export declare function observationByteBudget(limits: ObservationBudgetLimits, request: ObservationBudgetRequest): number;
-//# sourceMappingURL=observation-budget.d.ts.map

package/dist/agent/observation-budget.js

@@ -40,4 +40,3 @@ export function observationByteBudget(limits, request) {
     const withinTokenCeiling = Math.max(MIN_OBSERVATION_BYTES, limits.maxInputTokens - overhead);
     return Math.min(limits.maxObservationBytes, withinTokenCeiling);
 }
-//# sourceMappingURL=observation-budget.js.map

package/dist/agent/observation-feed.d.ts

@@ -7,24 +7,23 @@
  * executor's redacted view of a capture. Nothing else in the step observes
  * the engine; the dispatcher and the pixel tier ask the feed.
  */
-import type { SemanticNode } from '../engine/surface.ts';
 import type { StepAgentDetails } from '../run/steps.ts';
 import { AgentError } from './error.ts';
 import type { ExecutorObservation, ExecutorObserveOptions, ExecutorTarget } from './executor.ts';
 import type { AgentContext } from './invocation.ts';
-import { type AgentObservation, type SemanticAgentObservation } from './observation.ts';
+import { type AgentObservation, type RedactedNode, type SemanticAgentObservation } from './observation.ts';
 import type { OperationQueue } from './operation-queue.ts';
 import { type SettleMode } from './settle-policy.ts';
 import type { StepAccounting } from './step-accounting.ts';
 /** A target resolved to a node of the observation it was found in. */
 export interface Resolved {
-    readonly node: SemanticNode;
+    readonly node: RedactedNode;
     readonly observation: SemanticAgentObservation;
 }
 /** What a target names on the newest screen: the id as the screen lists it, the node or nothing, and the screen looked at. */
 export interface Lookup {
     readonly id: string;
-    readonly node: SemanticNode | undefined;
+    readonly node: RedactedNode | undefined;
     readonly observation: SemanticAgentObservation;
 }
 export interface ObservationFeedOptions {
@@ -116,8 +115,8 @@ export declare class ObservationFeed {
      * through the queued observe: this runs inside a queued action body, and a
      * queued observation would wait on its own caller.
      */
-    relocate(stale: SemanticNode): Promise<{
-        node: SemanticNode;
+    relocate(stale: RedactedNode): Promise<{
+        node: RedactedNode;
         observation: SemanticAgentObservation;
     } | undefined>;
     /**
@@ -170,4 +169,3 @@ export declare class ObservationFeed {
 }
 /** The error for a target id the newest screen no longer lists. */
 export declare function nodeGone(id: string, latest: SemanticAgentObservation): AgentError;
-//# sourceMappingURL=observation-feed.d.ts.map

package/dist/agent/observation-feed.js

@@ -132,7 +132,7 @@ export class ObservationFeed {
             ...metadata,
             text: observation.text,
             truncated: observation.truncated,
-            ...(options.tree === true ? { tree: projectTree(observation.tree, this.runtime.redact, this.runtime.app.base?.origin) } : {}),
+            ...(options.tree === true ? { tree: projectTree(observation.tree, this.runtime.app.base?.origin) } : {}),
             ...pixels,
         };
     }
@@ -197,8 +197,7 @@ export class ObservationFeed {
      * queued observation would wait on its own caller.
      */
     async relocate(stale) {
-        const options = { redact: this.runtime.redact };
-        const descriptor = describeTarget(stale, options.redact);
+        const descriptor = describeTarget(stale);
         if (descriptor === undefined)
             return undefined;
         this.accounting.checkpoint();
@@ -206,7 +205,7 @@ export class ObservationFeed {
         this.publish(observation);
         if (observation.kind === 'pixels')
             return undefined;
-        const relocated = relocateDescriptor(descriptor, observation.nodes, options);
+        const relocated = relocateDescriptor(descriptor, observation.nodes);
         if (relocated.kind !== 'found')
             return undefined;
         const node = observation.nodes.get(relocated.id);
@@ -376,11 +375,10 @@ export class ObservationFeed {
         const earlier = this.lastSeen(id)?.node;
         if (earlier === undefined)
             return undefined;
-        const options = { redact: this.runtime.redact };
-        const descriptor = describeTarget(earlier, options.redact);
+        const descriptor = describeTarget(earlier);
         if (descriptor === undefined)
             return undefined;
-        const relocated = relocateDescriptor(descriptor, latest.nodes, options);
+        const relocated = relocateDescriptor(descriptor, latest.nodes);
         return relocated.kind === 'found' ? latest.nodes.get(relocated.id) : undefined;
     }
 }
@@ -392,4 +390,3 @@ function echoesInput(node) {
 export function nodeGone(id, latest) {
     return new AgentError('LOCATOR_NOT_FOUND', `node #${id} is not on the current screen (observation ${latest.revision}); it was removed or never existed`);
 }
-//# sourceMappingURL=observation-feed.js.map

package/dist/agent/observation.d.ts

@@ -1,14 +1,15 @@
 /** Observation capture, redaction, and model serialization. */
 import type { Observation, SemanticNode, ViewportSize } from '../engine/surface.ts';
+import type { SecretLedger } from '../internal/redact.ts';
 import type { VisionDegradation } from '../run/steps.ts';
 import type { ExecutorNode, ExecutorObservation, ExecutorPixels } from './executor.ts';
 /** Why pixels the caller asked for are not part of this observation. */
 type PixelsWithheld = 'MASKING_UNPROVEN';
 export type AgentObservation = AgentObservationMetadata & ({
     readonly kind: 'semantic';
-    readonly nodes: ReadonlyMap<string, SemanticNode>;
+    readonly nodes: ReadonlyMap<string, RedactedNode>;
     readonly parents: ReadonlyMap<string, string>;
-    readonly tree: SemanticNode;
+    readonly tree: RedactedNode;
     readonly truncated: boolean;
     readonly pixels?: ExecutorPixels | undefined;
     readonly pixelsWithheld?: PixelsWithheld | undefined;
@@ -37,10 +38,11 @@ interface AgentObservationMetadata {
  *
  * Pixels whose masking the engine cannot prove (fewer masked regions than
  * secure nodes) are withheld before they reach a model or disk; the semantic
- * tree never carries secure values. Registered secret values are additionally
- * replaced by their stable secret name, and so is the leading part of one a
- * field the engine cut at its limit ends with. A field holding one keeps no
- * selection, as a secure field keeps none.
+ * tree never carries secure values. Every string of every node is redacted
+ * once, here (`redactNode`): registered secret values are replaced by their
+ * stable secret name, and so is the leading part of one a field the engine
+ * cut at its limit ends with. A field holding one keeps no selection, as a
+ * secure field keeps none.
  */
 export declare function prepareObservation(observation: Observation, options: {
     redact: (text: string) => string;
@@ -52,6 +54,34 @@ export declare function prepareObservation(observation: Observation, options: {
     /** The app base URL's origin: link targets on it render as paths, which navigation resolves against it. */
     appOrigin?: string | undefined;
 }): AgentObservation;
+/** What redacts a node: whole values, and the leading part of one a cut field ends with. */
+export type NodeRedaction = Pick<SecretLedger, 'redact' | 'redactCut'>;
+declare const REDACTED: unique symbol;
+/**
+ * A semantic node every string of which has passed the attempt's secret
+ * ledger (`redactNode`). Model-facing text and executor trees render only
+ * from this shape, so a node no redaction touched cannot reach them.
+ */
+export interface RedactedNode extends Omit<SemanticNode, 'children'> {
+    readonly [REDACTED]: true;
+    readonly children?: readonly RedactedNode[];
+}
+/**
+ * The node and its subtree with every secret taken out of every field
+ * (`NODE_FIELDS`), before any consumer reads it: the model's text, the
+ * executor's tree, cache descriptors and anchors, failure evidence.
+ */
+export declare function redactNode(node: SemanticNode, redaction: NodeRedaction): RedactedNode;
+/**
+ * An earlier capture's nodes redacted again through the ledger as it is now,
+ * each on its own fields, then linked to its redacted-again children, so the
+ * tree keeps its shape (which nodes are leaves) without a subtree redacted
+ * once per ancestor. A secret a provider resolved after the capture masks
+ * text the capture still shows, so the two captures read alike wherever the
+ * screen did not change. Redacting redacted text changes nothing else: a
+ * marker is never read again.
+ */
+export declare function redactNodesAgain(nodes: ReadonlyMap<string, RedactedNode>, redaction: NodeRedaction): ReadonlyMap<string, RedactedNode>;
 /** Phase metrics describe a node count only when the capture actually read nodes. */
 export declare function observationDetail(observation: AgentObservation): {
     count?: number;
@@ -82,21 +112,20 @@ export declare const INTERACTIVE_ROLES: ReadonlySet<string>;
  */
 export declare function interactiveNodeCount(observation: Pick<ExecutorObservation, 'text'>): number;
 /**
- * Projects the raw tree onto the executor-facing node shape: the same
- * redaction the text serialization applies, field by field, and no value or
- * selection at all for a secure node, and a link target bounded as a line
+ * Projects a redacted tree onto the executor-facing node shape, the fields
+ * the text serialization renders, with a link target bounded as a line
  * bounds it: a target on `appOrigin` keeps that origin and loses no more of
  * its path than the line does. Selectors stay behind — they are relocation
  * material for the trace cache, not something a brain reasons about.
  */
-export declare function projectTree(node: SemanticNode, redact: (text: string) => string, appOrigin?: string): ExecutorNode;
+export declare function projectTree(node: RedactedNode, appOrigin?: string): ExecutorNode;
 /**
  * Renders one node as `#id role "name" text="..." value="..." selection="..." [states]`. Role-less text
  * holders omit the role token entirely: on a large screen they are half the
  * lines, and the model needs their text, not a filler word. A link target on
  * `appOrigin`, the app base URL's, renders as its path.
  */
-export declare function formatNode(node: SemanticNode, depth: number, redact: (text: string) => string, appOrigin?: string): string;
+export declare function formatNode(node: RedactedNode, depth: number, appOrigin?: string): string;
 /**
  * What the screen looks like, independent of which observation looked at it.
  *
@@ -190,4 +219,3 @@ export declare function settleObservation<T>(capture: () => Promise<T>, shapeOf:
  */
 export declare function isTransitionalObservation(observation: AgentObservation): boolean;
 export {};
-//# sourceMappingURL=observation.d.ts.map

package/dist/agent/observation.js

@@ -15,10 +15,11 @@ const UNAVAILABLE_TREE_MARKER = '[semantic capture unavailable: no nodes were re
  *
  * Pixels whose masking the engine cannot prove (fewer masked regions than
  * secure nodes) are withheld before they reach a model or disk; the semantic
- * tree never carries secure values. Registered secret values are additionally
- * replaced by their stable secret name, and so is the leading part of one a
- * field the engine cut at its limit ends with. A field holding one keeps no
- * selection, as a secure field keeps none.
+ * tree never carries secure values. Every string of every node is redacted
+ * once, here (`redactNode`): registered secret values are replaced by their
+ * stable secret name, and so is the leading part of one a field the engine
+ * cut at its limit ends with. A field holding one keeps no selection, as a
+ * secure field keeps none.
  */
 export function prepareObservation(observation, options) {
     const location = observation.location === undefined ? undefined : options.redact(observation.location);
@@ -42,11 +43,10 @@ export function prepareObservation(observation, options) {
             pixels: pixels.cleared,
         };
     }
-    const tree = protectSecrets(observation.tree, options);
+    const tree = redactNode(observation.tree, options);
     const nodes = new Map();
     const parents = new Map();
     indexNodes(tree, nodes, parents);
-    const redact = options.redact;
     const lines = [];
     const encoder = new TextEncoder();
     // The marker is reserved up front so a truncated observation still fits the
@@ -63,7 +63,7 @@ export function prepareObservation(observation, options) {
     const emit = (node, depth) => {
         if (cutByBudget)
             return;
-        const line = formatNode(node, depth, redact, options.appOrigin);
+        const line = formatNode(node, depth, options.appOrigin);
         const size = encoder.encode(`${line}\n`).byteLength;
         if (lines.length > 0 && bytes + size > budget) {
             cutByBudget = true;
@@ -97,40 +97,94 @@ export function prepareObservation(observation, options) {
         ...(pixels.withheld === undefined ? {} : { pixelsWithheld: pixels.withheld }),
     };
 }
-/** The fields an engine may cut, each at its observed limit. */
-const CUT_FIELDS = [
-    ['name', OBSERVED_NAME_LIMIT],
-    ['text', OBSERVED_TEXT_LIMIT],
-    ['value', OBSERVED_TEXT_LIMIT],
-    ['selection', OBSERVED_TEXT_LIMIT],
-];
+/** Leaves a field the engine fills from a closed set (an enum, booleans, numbers) or mints itself as it is. */
+const keep = (value) => value;
 /**
- * The tree with what whole-value redaction misses taken out, before any
- * consumer reads it. Every field exactly as long as its observed limit, and
- * so possibly cut there, passes through `redactCut`: a secret the cut stopped
- * partway through leaves a leading part at the end that no whole value
- * matches. A shorter field is whole, and so is a longer one (a native input's
- * value, which no engine cuts); both are left to `redact`. A selection that
- * may show part of a secret is dropped, as a secure field's is. A subtree
- * with nothing changed is returned as it is.
+ * How each field of a node is redacted, one entry per field of
+ * `SemanticNode`: a field added to the contract does not compile until it
+ * says how its text is redacted, and a key an engine sends that the
+ * contract does not name is dropped. Every string passes through
+ * `redactText`. A secure node keeps no value or selection, and a selection
+ * that may show part of a secret is dropped, as a secure field's is. The ref
+ * is the engine's own handle, sent back to it to act, never page text.
  */
-function protectSecrets(node, redaction) {
-    const withhold = node.selection !== undefined && selectionMayHoldSecret(node, node.selection, redaction);
-    const changed = {};
-    for (const [field, limit] of CUT_FIELDS) {
-        const text = node[field];
-        if (text?.length !== limit || (withhold && field === 'selection'))
+const NODE_FIELDS = {
+    ref: keep,
+    role: (role, _node, redaction) => redactText(role, redaction),
+    name: (name, _node, redaction) => redactText(name, redaction, OBSERVED_NAME_LIMIT),
+    text: (text, _node, redaction) => redactText(text, redaction, OBSERVED_TEXT_LIMIT),
+    value: (value, node, redaction) => (node.states?.secure === true ? undefined : redactText(value, redaction, OBSERVED_TEXT_LIMIT)),
+    selection: (selection, node, redaction) => node.states?.secure === true || selectionMayHoldSecret(node, selection, redaction)
+        ? undefined
+        : redactText(selection, redaction, OBSERVED_TEXT_LIMIT),
+    testId: (testId, _node, redaction) => redactText(testId, redaction),
+    inputPurpose: keep,
+    states: keep,
+    level: keep,
+    attributes: (attributes, _node, redaction) => Object.fromEntries(Object.entries(attributes).map(([key, value]) => [redactText(key, redaction), redactText(value, redaction)])),
+    rect: keep,
+    selector: (selector, _node, redaction) => redactText(selector, redaction),
+    framePath: (framePath, _node, redaction) => framePath.map((selector) => redactText(selector, redaction)),
+};
+/**
+ * The node and its subtree with every secret taken out of every field
+ * (`NODE_FIELDS`), before any consumer reads it: the model's text, the
+ * executor's tree, cache descriptors and anchors, failure evidence.
+ */
+export function redactNode(node, redaction) {
+    const redacted = {};
+    for (const [field, value] of Object.entries(node)) {
+        if (field === 'children' || value === undefined || !Object.hasOwn(NODE_FIELDS, field))
             continue;
-        const redacted = redaction.redactCut(text);
-        if (redacted !== text)
-            changed[field] = redacted;
+        const redactValue = NODE_FIELDS[field];
+        const result = redactValue(value, node, redaction);
+        if (result !== undefined)
+            redacted[field] = result;
     }
-    const children = node.children?.map((child) => protectSecrets(child, redaction));
-    const sameChildren = (children ?? []).every((child, index) => child === node.children?.[index]);
-    if (!withhold && Object.keys(changed).length === 0 && sameChildren)
-        return node;
-    const { selection: _selection, ...withoutSelection } = node;
-    return { ...(withhold ? withoutSelection : node), ...changed, ...(children === undefined ? {} : { children }) };
+    if (node.children !== undefined)
+        redacted['children'] = node.children.map((child) => redactNode(child, redaction));
+    return redacted;
+}
+/**
+ * An earlier capture's nodes redacted again through the ledger as it is now,
+ * each on its own fields, then linked to its redacted-again children, so the
+ * tree keeps its shape (which nodes are leaves) without a subtree redacted
+ * once per ancestor. A secret a provider resolved after the capture masks
+ * text the capture still shows, so the two captures read alike wherever the
+ * screen did not change. Redacting redacted text changes nothing else: a
+ * marker is never read again.
+ */
+export function redactNodesAgain(nodes, redaction) {
+    const again = new Map();
+    for (const [id, { children: _children, ...fields }] of nodes)
+        again.set(id, redactNode(fields, redaction));
+    for (const [id, { children }] of nodes) {
+        const node = again.get(id);
+        if (node === undefined || children === undefined)
+            continue;
+        node.children = children.map((child) => again.get(child.ref.id)).filter((child) => child !== undefined);
+    }
+    return again;
+}
+/**
+ * One observed string with every secret taken out, in the form it is written
+ * and in the one-line form a line, a descriptor, or an anchor shows it
+ * (`collapseText`). A field exactly as long as `limit`, and so possibly cut
+ * there, passes through `redactCut`: a secret the cut stopped partway through
+ * leaves a leading part at the end that no whole value matches. A shorter
+ * field is whole, and so is a longer one (a native input's value, which no
+ * engine cuts); both pass through `redact`. A field whose collapsed form
+ * still holds a secret (the whitespace inside a value widened) is kept
+ * collapsed and redacted, so no later collapse brings the value back.
+ */
+function redactText(text, redaction, limit) {
+    const pass = text.length === limit ? redaction.redactCut : redaction.redact;
+    const redacted = pass(text);
+    const collapsed = collapseText(redacted);
+    if (collapsed === redacted)
+        return redacted;
+    const read = pass(collapsed);
+    return read === collapsed ? redacted : read;
 }
 /**
  * Whether a node's selection may show part of a secret, which no whole-value
@@ -142,7 +196,7 @@ function protectSecrets(node, redaction) {
 function selectionMayHoldSecret(node, selection, redaction) {
     const fields = [node.value, node.text].filter((text) => text !== undefined);
     const cut = (text) => text.length === OBSERVED_TEXT_LIMIT;
-    if (fields.some((text) => (cut(text) ? redaction.redactCut(text) : redaction.redact(text)) !== text))
+    if (fields.some((text) => redactText(text, redaction, OBSERVED_TEXT_LIMIT) !== text))
         return true;
     return fields.some(cut) && !fields.some((text) => text.includes(selection));
 }
@@ -234,33 +288,29 @@ export function interactiveNodeCount(observation) {
     return count;
 }
 /**
- * Projects the raw tree onto the executor-facing node shape: the same
- * redaction the text serialization applies, field by field, and no value or
- * selection at all for a secure node, and a link target bounded as a line
+ * Projects a redacted tree onto the executor-facing node shape, the fields
+ * the text serialization renders, with a link target bounded as a line
  * bounds it: a target on `appOrigin` keeps that origin and loses no more of
  * its path than the line does. Selectors stay behind — they are relocation
  * material for the trace cache, not something a brain reasons about.
  */
-export function projectTree(node, redact, appOrigin) {
-    const secure = node.states?.secure === true;
+export function projectTree(node, appOrigin) {
     const attributes = node.attributes === undefined
         ? undefined
-        : Object.fromEntries(Object.entries(node.attributes).map(([key, value]) => [key, key === 'href' ? treeHref(redact(value), appOrigin) : redact(value)]));
+        : Object.fromEntries(Object.entries(node.attributes).map(([key, value]) => [key, key === 'href' ? treeHref(value, appOrigin) : value]));
     return {
         id: node.ref.id,
         ...(node.role === undefined ? {} : { role: node.role }),
-        ...(node.name === undefined ? {} : { name: redact(node.name) }),
-        ...(node.text === undefined ? {} : { text: redact(node.text) }),
-        ...(node.value === undefined || secure ? {} : { value: redact(node.value) }),
-        ...(node.selection === undefined || secure ? {} : { selection: redact(node.selection) }),
+        ...(node.name === undefined ? {} : { name: node.name }),
+        ...(node.text === undefined ? {} : { text: node.text }),
+        ...(node.value === undefined ? {} : { value: node.value }),
+        ...(node.selection === undefined ? {} : { selection: node.selection }),
         ...(node.inputPurpose === undefined ? {} : { inputPurpose: node.inputPurpose }),
         ...(node.states === undefined ? {} : { states: node.states }),
         ...(attributes === undefined ? {} : { attributes }),
         ...(node.rect === undefined ? {} : { rect: node.rect }),
         ...(node.framePath === undefined ? {} : { framePath: node.framePath }),
-        ...(node.children === undefined
-            ? {}
-            : { children: node.children.map((child) => projectTree(child, redact, appOrigin)) }),
+        ...(node.children === undefined ? {} : { children: node.children.map((child) => projectTree(child, appOrigin)) }),
     };
 }
 /** Depth beyond this renders flat; deep chrome must not buy tokens with spaces. */
@@ -273,37 +323,37 @@ const MAX_HREF_LENGTH = 256;
  * lines, and the model needs their text, not a filler word. A link target on
  * `appOrigin`, the app base URL's, renders as its path.
  */
-export function formatNode(node, depth, redact, appOrigin) {
+export function formatNode(node, depth, appOrigin) {
     const parts = [`#${node.ref.id}`];
     if (node.role !== undefined && node.role !== '')
         parts.push(node.role);
     if (node.name !== undefined && node.name !== '')
-        parts.push(JSON.stringify(redact(node.name)));
+        parts.push(JSON.stringify(node.name));
     const text = node.text === undefined ? '' : collapseText(node.text);
     if (text !== '' && text !== node.name)
-        parts.push(`text=${JSON.stringify(redact(text))}`);
+        parts.push(`text=${JSON.stringify(text)}`);
     // Disambiguators the model needs when role and name repeat. The engine has
     // already reduced href to origin and path.
     if (node.testId !== undefined && node.testId !== '')
         parts.push(`testid=${JSON.stringify(node.testId)}`);
     const href = node.attributes?.['href'];
     if (href !== undefined && href !== '')
-        parts.push(`href=${JSON.stringify(renderHref(redact(href), appOrigin))}`);
+        parts.push(`href=${JSON.stringify(renderHref(href, appOrigin))}`);
     const placeholder = node.attributes?.['placeholder'];
     if (placeholder !== undefined && placeholder !== '' && (node.name ?? '') === '') {
-        parts.push(`placeholder=${JSON.stringify(redact(placeholder))}`);
+        parts.push(`placeholder=${JSON.stringify(placeholder)}`);
     }
     if (node.states?.secure === true) {
         parts.push('value=<secure>');
     }
     else if (node.value !== undefined && node.value !== '') {
-        parts.push(`value=${JSON.stringify(redact(node.value))}`);
+        parts.push(`value=${JSON.stringify(node.value)}`);
     }
     // What a Shift+Arrow press selected: without it the model extends a
     // selection blind and cannot tell one word from its neighbour. Rendered
     // verbatim (escaped), since a selected space or newline is a selection too.
-    if (node.selection !== undefined && node.selection !== '' && node.states?.secure !== true) {
-        parts.push(`selection=${JSON.stringify(redact(node.selection))}`);
+    if (node.selection !== undefined && node.selection !== '') {
+        parts.push(`selection=${JSON.stringify(node.selection)}`);
     }
     if (node.inputPurpose !== undefined && node.inputPurpose !== 'none') {
         parts.push(`purpose=${node.inputPurpose}`);
@@ -474,4 +524,3 @@ function indexNodes(node, into, parents) {
         indexNodes(child, into, parents);
     }
 }
-//# sourceMappingURL=observation.js.map