humanish 0.114.0 → 0.115.0

package/dist/evidence/encoded-text.d.ts

@@ -1,17 +1,19 @@
+/** Each run of characters U+0080 to U+00FF read as the UTF-8 bytes they may be: é as é. */
+export declare const latin1RunsAsUtf8: (text: string) => string;
 /**
  * Undoes JSON and JS escapes, percent-encoding and HTML character references, one pass each. Each
- * percent escape is one character, the byte's code, so `caf%C3%A9` reads as `café`;
- * decodeEscapesUtf8 reads it as `café`. A scan checks both: either reading can split a value that
- * the other keeps whole, as `%E2%80%80` (U+2000, a space, in UTF-8) does.
+ * percent escape is one character, the byte's code, so `caf%C3%A9` reads as `café`; readingsOf
+ * also gives the reading as UTF-8, `café`.
  */
 export declare function decodeEscapes(text: string): string;
-/** decodeEscapes with each run of percent escapes read as UTF-8. */
-export declare function decodeEscapesUtf8(text: string): string;
 /**
- * The UTF-8 reading of text's escapes when it differs from decodeEscapes, which it can only where
- * a percent escape holds a byte of 0x80 or more.
+ * Every reading of the text a scan matches, each once: as written, decodeEscapes, with percent
+ * escapes read as UTF-8, decodeEscapes with transfer escapes expanded, and the text as written and
+ * decoded with each run of U+0080 to U+00FF characters read as UTF-8 bytes, which undoes text that
+ * a reader already decoded one byte per character. Either percent reading can split a value that
+ * the other keeps whole, as `%E2%80%80` (U+2000, a space, in UTF-8) does.
  */
-export declare function utf8ReadingOf(text: string, decoded: string): string | undefined;
+export declare function readingsOf(text: string): string[];
 /** How scanEncodedText reads text. */
 export interface EncodedTextScanOptions {
     /** Do not count an encoded binary run as opaque. */
@@ -26,9 +28,8 @@ export interface EncodedTextScan {
     readonly opaque: boolean;
 }
 /**
- * Scans text for secrets as written, after decodeEscapes (also with percent escapes read as UTF-8)
- * and transfer escapes, and inside each
- * base64 (standard, URL-safe or line-wrapped) and hex run. A run that decodes to text is scanned in
+ * Scans text for secrets in each of its readingsOf, and inside each base64 (standard, URL-safe or
+ * line-wrapped) and hex run. A run that decodes to text is scanned in
  * turn. A run that decodes to an archive, or to other binary past MIN_OPAQUE_BASE64_RUN characters,
  * is opaque unless the caller allows opaque runs.
  */

package/dist/evidence/encoded-text.js

@@ -2,43 +2,44 @@
 // undoes the encodings a reader undoes for free (JSON and JS escapes, percent-encoding, HTML
 // entities) and looks inside base64 runs. verify and bundle export share decodeEscapes, so they
 // judge the same decoded text.
+import { isUtf8 } from "node:buffer";
 import { createHash } from "node:crypto";
 import { readPlainText } from "./plain-text.js";
 import { containsSensitive } from "./redaction.js";
 // HTML5 named references that stand for printable ASCII. Letters and digits have only numeric
 // references, which decodeEscapes handles.
-const ASCII_ENTITIES = {
-    amp: "&",
-    apos: "'",
-    ast: "*",
-    bsol: "\\",
-    colon: ":",
-    comma: ",",
-    commat: "@",
-    dollar: "$",
-    equals: "=",
-    excl: "!",
-    grave: "`",
-    gt: ">",
-    hat: "^",
-    lcub: "{",
-    lowbar: "_",
-    lpar: "(",
-    lsqb: "[",
-    lt: "<",
-    num: "#",
-    percnt: "%",
-    period: ".",
-    plus: "+",
-    quest: "?",
-    quot: '"',
-    rcub: "}",
-    rpar: ")",
-    rsqb: "]",
-    semi: ";",
-    sol: "/",
-    verbar: "|",
-};
+const ASCII_ENTITIES = new Map([
+    ["amp", "&"],
+    ["apos", "'"],
+    ["ast", "*"],
+    ["bsol", "\\"],
+    ["colon", ":"],
+    ["comma", ","],
+    ["commat", "@"],
+    ["dollar", "$"],
+    ["equals", "="],
+    ["excl", "!"],
+    ["grave", "`"],
+    ["gt", ">"],
+    ["hat", "^"],
+    ["lcub", "{"],
+    ["lowbar", "_"],
+    ["lpar", "("],
+    ["lsqb", "["],
+    ["lt", "<"],
+    ["num", "#"],
+    ["percnt", "%"],
+    ["period", "."],
+    ["plus", "+"],
+    ["quest", "?"],
+    ["quot", '"'],
+    ["rcub", "}"],
+    ["rpar", ")"],
+    ["rsqb", "]"],
+    ["semi", ";"],
+    ["sol", "/"],
+    ["verbar", "|"],
+]);
 function codePoint(value, original) {
     return Number.isInteger(value) && value >= 0 && value <= 0x10ffff
         ? String.fromCodePoint(value)
@@ -57,20 +58,19 @@ function sequenceLength(lead) {
     return 0;
 }
 /**
- * A run of percent escapes read as UTF-8, as a browser reads a URL. A byte that starts no valid
- * sequence stands for itself, the character with that code, as decodeEscapes reads every byte.
+ * Bytes read as UTF-8, as a browser reads a URL. A byte that starts no valid sequence stands for
+ * itself, the character with that code, as decodeEscapes reads every byte.
  */
-function decodePercentRun(run) {
-    const bytes = Buffer.from(run.replace(/%/g, ""), "hex");
+function utf8Characters(bytes) {
+    if (isUtf8(bytes))
+        return bytes.toString("utf8");
     let text = "";
     for (let at = 0; at < bytes.length;) {
         const length = sequenceLength(bytes[at]);
-        const sequence = length > 0 ? bytes.subarray(at, at + length) : undefined;
-        const decoded = sequence?.length === length ? sequence.toString("utf8") : undefined;
-        // Node writes the replacement character for an overlong form, a surrogate half or a bad
-        // continuation byte, so a sequence counts only when its character encodes back to its bytes.
-        if (decoded !== undefined && Buffer.from(decoded, "utf8").equals(sequence)) {
-            text += decoded;
+        const sequence = bytes.subarray(at, at + length);
+        // isUtf8 refuses an overlong form, a surrogate half and a bad continuation byte.
+        if (length > 0 && sequence.length === length && isUtf8(sequence)) {
+            text += sequence.toString("utf8");
             at += length;
         }
         else {
@@ -80,31 +80,47 @@ function decodePercentRun(run) {
     }
     return text;
 }
+const decodePercentRun = (run) => utf8Characters(Buffer.from(run.replace(/%/g, ""), "hex"));
+// A character from U+0080 to U+00FF, which a byte of 0x80 or more becomes when read one per
+// character.
+const HIGH_BYTE = /[\x80-\xff]/;
+/** Each run of characters U+0080 to U+00FF read as the UTF-8 bytes they may be: é as é. */
+export const latin1RunsAsUtf8 = (text) => text.replace(/[\x80-\xff]+/g, (run) => utf8Characters(Buffer.from(run, "latin1")));
 function decodePercentBytes(run) {
     return Buffer.from(run.replace(/%/g, ""), "hex").toString("latin1");
 }
 /**
  * Undoes JSON and JS escapes, percent-encoding and HTML character references, one pass each. Each
- * percent escape is one character, the byte's code, so `caf%C3%A9` reads as `café`;
- * decodeEscapesUtf8 reads it as `café`. A scan checks both: either reading can split a value that
- * the other keeps whole, as `%E2%80%80` (U+2000, a space, in UTF-8) does.
+ * percent escape is one character, the byte's code, so `caf%C3%A9` reads as `café`; readingsOf
+ * also gives the reading as UTF-8, `café`.
  */
 export function decodeEscapes(text) {
     return decodeWith(text, decodePercentBytes);
 }
-/** decodeEscapes with each run of percent escapes read as UTF-8. */
-export function decodeEscapesUtf8(text) {
-    return decodeWith(text, decodePercentRun);
+/** The readings a scan matches, with the two that scanEncodedText also searches for runs. */
+function readings(text) {
+    const decoded = decodeEscapes(text);
+    // The UTF-8 reading differs only where a percent escape holds a byte of 0x80 or more, which
+    // decodeEscapes writes as a character from U+0080 to U+00FF. Testing the decoded text also
+    // catches a `%` that a `\u0025` wrote.
+    const utf8 = HIGH_BYTE.test(decoded) ? decodeWith(text, decodePercentRun) : decoded;
+    const expanded = decodeTransferEscapes(decoded);
+    const recovered = [text, decoded].filter((reading) => HIGH_BYTE.test(reading));
+    return {
+        decoded,
+        expanded,
+        all: [...new Set([text, decoded, utf8, expanded, ...recovered.map(latin1RunsAsUtf8)])],
+    };
 }
 /**
- * The UTF-8 reading of text's escapes when it differs from decodeEscapes, which it can only where
- * a percent escape holds a byte of 0x80 or more.
+ * Every reading of the text a scan matches, each once: as written, decodeEscapes, with percent
+ * escapes read as UTF-8, decodeEscapes with transfer escapes expanded, and the text as written and
+ * decoded with each run of U+0080 to U+00FF characters read as UTF-8 bytes, which undoes text that
+ * a reader already decoded one byte per character. Either percent reading can split a value that
+ * the other keeps whole, as `%E2%80%80` (U+2000, a space, in UTF-8) does.
  */
-export function utf8ReadingOf(text, decoded) {
-    if (!/%[89a-f][0-9a-f]/i.test(text))
-        return undefined;
-    const utf8 = decodeEscapesUtf8(text);
-    return utf8 === decoded ? undefined : utf8;
+export function readingsOf(text) {
+    return readings(text).all;
 }
 function decodeWith(text, percent) {
     return text
@@ -114,7 +130,10 @@ function decodeWith(text, percent) {
         .replace(/(?:%[0-9a-f]{2})+/gi, percent)
         .replace(/&#x([0-9a-f]{1,6});?/gi, (match, hex) => codePoint(Number.parseInt(hex, 16), match))
         .replace(/&#(\d{1,7});?/g, (match, digits) => codePoint(Number.parseInt(digits, 10), match))
-        .replace(/&([a-z]+);/gi, (match, name) => ASCII_ENTITIES[name.toLowerCase()] ?? match);
+        .replace(/&([a-z]+);/gi, namedReference);
+}
+function namedReference(match, name) {
+    return ASCII_ENTITIES.get(name.toLowerCase()) ?? match;
 }
 // Sixteen characters hold twelve bytes, enough for the start of a key. Shorter runs are mostly
 // words and identifiers.
@@ -262,8 +281,7 @@ function inspectDecoded(bytes, run, options, depth) {
     if (inner !== undefined) {
         if (depth < MAX_DEPTH)
             return scanEncodedText(inner, options, depth + 1);
-        const innerDecoded = decodeEscapes(inner);
-        return matches(inner) || (innerDecoded !== inner && matches(innerDecoded)) ? SENSITIVE : CLEAN;
+        return readingsOf(inner).some(matches) ? SENSITIVE : CLEAN;
     }
     // A key next to a few binary bytes is still a printable stretch.
     if (matches(printableStretches(bytes)))
@@ -276,22 +294,15 @@ function inspectDecoded(bytes, run, options, depth) {
     };
 }
 /**
- * Scans text for secrets as written, after decodeEscapes (also with percent escapes read as UTF-8)
- * and transfer escapes, and inside each
- * base64 (standard, URL-safe or line-wrapped) and hex run. A run that decodes to text is scanned in
+ * Scans text for secrets in each of its readingsOf, and inside each base64 (standard, URL-safe or
+ * line-wrapped) and hex run. A run that decodes to text is scanned in
  * turn. A run that decodes to an archive, or to other binary past MIN_OPAQUE_BASE64_RUN characters,
  * is opaque unless the caller allows opaque runs.
  */
 export function scanEncodedText(text, options = {}, depth = 0) {
     const matches = matcherOf(options);
-    const decoded = decodeEscapes(text);
-    const utf8 = utf8ReadingOf(text, decoded);
-    const expanded = decodeTransferEscapes(decoded);
-    // A decoding that returns the same string would match the same way, so it is not matched again.
-    if (matches(text) ||
-        (decoded !== text && matches(decoded)) ||
-        (utf8 !== undefined && matches(utf8)) ||
-        (expanded !== decoded && matches(expanded)))
+    const { decoded, expanded, all } = readings(text);
+    if (all.some(matches))
         return SENSITIVE;
     const runs = [];
     // A piece or a run decoded from a slash only adds findings; its bytes are not judged opaque.
@@ -341,7 +352,7 @@ export function scanEncodedText(text, options = {}, depth = 0) {
 // Bump when scanEncodedText, decodeEscapes or the sensitive patterns change what they return. The
 // cache lives in one process, so the version guards results across a hot reload or a test that
 // swaps the scanner.
-const ENCODED_SCAN_VERSION = 4;
+const ENCODED_SCAN_VERSION = 5;
 // Distinct files one process verifies in a burst (a run's files, a serve library's runs).
 const SCAN_CACHE_LIMIT = 256;
 const scanCache = new Map();

package/dist/evidence/redaction.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Every marker humanish writes in place of what it withholds. The known-value scrub leaves text
+ * wholly inside one of these as it is, so a writer of a new marker adds it here.
+ */
+export declare const REDACTION_MARKERS: {
+    readonly secret: "[REDACTED_SECRET]";
+    readonly localPath: "[REDACTED_LOCAL_PATH]";
+    readonly runtimePath: "[REDACTED_RUNTIME_PATH]";
+    readonly promptText: "[REDACTED_PROMPT_TEXT]";
+    readonly lobbyCode: "[REDACTED_LOBBY_CODE]";
+};
 /** Every pattern containsSensitive tests. A test pins each to ASCII, which scanEncodedText relies on. */
 export declare function sensitivePatterns(): readonly RegExp[];
 /** True if the text contains a credential. Local paths and a URL on an E2B host alone do not count. */

package/dist/evidence/redaction.js

@@ -126,18 +126,29 @@ const SECRET_PATTERNS = [
     SANDBOX_URL,
     /BEGIN (RSA|OPENSSH|PRIVATE) KEY/gi,
 ];
+/**
+ * Every marker humanish writes in place of what it withholds. The known-value scrub leaves text
+ * wholly inside one of these as it is, so a writer of a new marker adds it here.
+ */
+export const REDACTION_MARKERS = {
+    secret: "[REDACTED_SECRET]",
+    localPath: "[REDACTED_LOCAL_PATH]",
+    runtimePath: "[REDACTED_RUNTIME_PATH]",
+    promptText: "[REDACTED_PROMPT_TEXT]",
+    lobbyCode: "[REDACTED_LOBBY_CODE]",
+};
 const LOCAL_PATH_PATTERNS = [
-    [/\/private\/var\/folders\/[^\s"'`<>)]*/g, "[REDACTED_LOCAL_PATH]"],
-    [/\/var\/folders\/[^\s"'`<>)]*/g, "[REDACTED_LOCAL_PATH]"],
-    [/\/private\/tmp\/[^\s"'`<>)]*/g, "[REDACTED_LOCAL_PATH]"],
-    [/\/tmp\/[^\s"'`<>)]*/g, "[REDACTED_LOCAL_PATH]"],
-    [/\/Users\/[A-Za-z0-9._-]+(?:\/[^\s"'`<>)]*)?/g, "[REDACTED_LOCAL_PATH]"],
-    [/\/home\/[A-Za-z0-9._-]+(?:\/[^\s"'`<>)]*)?/g, "[REDACTED_RUNTIME_PATH]"],
+    [/\/private\/var\/folders\/[^\s"'`<>)]*/g, REDACTION_MARKERS.localPath],
+    [/\/var\/folders\/[^\s"'`<>)]*/g, REDACTION_MARKERS.localPath],
+    [/\/private\/tmp\/[^\s"'`<>)]*/g, REDACTION_MARKERS.localPath],
+    [/\/tmp\/[^\s"'`<>)]*/g, REDACTION_MARKERS.localPath],
+    [/\/Users\/[A-Za-z0-9._-]+(?:\/[^\s"'`<>)]*)?/g, REDACTION_MARKERS.localPath],
+    [/\/home\/[A-Za-z0-9._-]+(?:\/[^\s"'`<>)]*)?/g, REDACTION_MARKERS.runtimePath],
     // A Windows profile path, with `\`, `\\` (JSON-escaped) or `/` between segments. A match never
     // ends in a backslash, so it cannot swallow the escape of a closing quote.
     [
         /\b[A-Za-z]:(?:\\\\|\\|\/)Users(?:\\\\|\\|\/)[^\\/\s"'`<>)]+[^\s"'`<>)]*/g,
-        "[REDACTED_LOCAL_PATH]",
+        REDACTION_MARKERS.localPath,
     ],
 ];
 /** Every pattern containsSensitive tests. A test pins each to ASCII, which scanEncodedText relies on. */
@@ -265,7 +276,7 @@ function redactSecrets(text) {
     return SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, (...args) => {
         const groups = args.at(-1);
         const keep = isRecord(groups) && typeof groups.keep === "string" ? groups.keep : "";
-        return `${keep}[REDACTED_SECRET]`;
+        return `${keep}${REDACTION_MARKERS.secret}`;
     }), text);
 }
 /** Redact secrets to [REDACTED_SECRET] and local paths to their path labels. */
@@ -274,7 +285,7 @@ export function redactText(text) {
 }
 /** Redact every sensitive match (secrets and paths) to a single [REDACTED_SECRET] label. */
 export function redactToSecretLabel(text) {
-    return redactLocalPaths(redactSecrets(text), "[REDACTED_SECRET]");
+    return redactLocalPaths(redactSecrets(text), REDACTION_MARKERS.secret);
 }
 function canonicalizePath(value) {
     const resolved = path.resolve(value);
@@ -526,7 +537,7 @@ function blurPass(src, width, height, radius, horizontal) {
  * pattern-match, such as provisioned keys and subject env values. `values` is read on each call,
  * so a value registered later is scrubbed too.
  */
-export function scrubLiterals(values, marker = "[REDACTED_SECRET]") {
+export function scrubLiterals(values, marker = REDACTION_MARKERS.secret) {
     return (text) => values.reduce((current, value) => current.split(value).join(marker), text);
 }
 /**

package/dist/evidence/secret-scrub.d.ts

@@ -1,10 +1,17 @@
 /**
  * A value as written, and percent-encoded, JSON-escaped once (also with non-ASCII characters as
- * `\u` escapes) and twice, its UTF-8 bytes read one per character, base64 at each byte offset, base64url and hex. Twice, because a JSON event can carry a command's JSON output as a string. An
+ * `\u` escapes) and twice, its UTF-8 bytes read one per character and the reverse, base64 at each
+ * byte offset, base64url and hex. Twice, because a JSON event can carry a command's JSON output as
+ * a string. An
  * escaped form is searched for at any length, as the value is: it holds a backslash or a `%`, so it
  * is not ordinary text.
  */
 export declare function encodedForms(value: string): string[];
+/**
+ * A check that the text holds one of the values' forms outside the markers in any of its
+ * readingsOf. A scrub's output must pass it.
+ */
+export declare function holdsSecretValue(values: readonly string[]): (text: string) => boolean;
 /**
  * A scrub that replaces each non-empty value and its encoded forms with `[REDACTED_SECRET]`. Every
  * occurrence of every form is found on its own, and overlapping finds are merged into one span, so
@@ -12,5 +19,11 @@ export declare function encodedForms(value: string): string[];
  * through decodeEscapes, the decoder verify uses, and returns the decoded text: a warning with
  * percent-encoding, JSON escapes or HTML references shows them decoded, with the values removed.
  * That finds a value written partly encoded, which no single encoded form matches.
+ *
+ * The result's other readingsOf only detect. If one still holds a form, the scrub returns
+ * `[REDACTED_SECRET]` in place of the whole text. That happens for a value encoded twice, which
+ * the decoded text shows encoded once; for a value the UTF-8 or transfer reading holds, such as
+ * one with one of two non-ASCII characters percent-encoded; and for a value that holds part of a
+ * marker, such as `ET]x`, which the marker that replaced it can spell again.
  */
 export declare function scrubSecretValues(values: readonly string[]): (text: string) => string;

package/dist/evidence/secret-scrub.js

@@ -2,10 +2,14 @@
 // run's warnings. A value is found as written and in the encoded forms an HTTP client, a log line or
 // a JSON body gives it, so a token that reaches the text percent-encoded or base64-encoded is still
 // removed. Pattern redaction (redactText) runs after this and finds secrets by shape.
-import { decodeEscapes } from "./encoded-text.js";
-const REDACTED = "[REDACTED_SECRET]";
-// A marker already in the text, from this scrub or from redactText. No value is matched inside one.
-const MARKER = /\[REDACTED_[A-Z0-9_]+\]/g;
+import { escapeRegExp } from "../run/text.js";
+import { decodeEscapes, latin1RunsAsUtf8, readingsOf } from "./encoded-text.js";
+import { REDACTION_MARKERS } from "./redaction.js";
+const REDACTED = REDACTION_MARKERS.secret;
+// A form wholly inside a marker humanish writes is the marker's own text, as when a value is part
+// of the marker's name. Other bracketed text, such as `[REDACTED_373433393231]`, is searched like
+// any text.
+const MARKER = new RegExp(Object.values(REDACTION_MARKERS).map(escapeRegExp).join("|"), "g");
 // The shortest encoded form searched for. Shorter base64 or hex runs are ordinary text often enough
 // that matching them would redact words. A value itself is searched for at any length.
 const MIN_ENCODED_FORM = 8;
@@ -27,7 +31,9 @@ function base64Middles(bytes, encoding) {
 }
 /**
  * A value as written, and percent-encoded, JSON-escaped once (also with non-ASCII characters as
- * `\u` escapes) and twice, its UTF-8 bytes read one per character, base64 at each byte offset, base64url and hex. Twice, because a JSON event can carry a command's JSON output as a string. An
+ * `\u` escapes) and twice, its UTF-8 bytes read one per character and the reverse, base64 at each
+ * byte offset, base64url and hex. Twice, because a JSON event can carry a command's JSON output as
+ * a string. An
  * escaped form is searched for at any length, as the value is: it holds a backslash or a `%`, so it
  * is not ordinary text.
  */
@@ -57,13 +63,18 @@ export function encodedForms(value) {
     const bytewise = bytes.toString("latin1");
     if (bytewise !== value)
         escaped.push(bytewise);
+    // The mirror: a value such as xéz€ whose characters include bytes that read as UTF-8, written
+    // with them read (xéz€). No reading of the text turns xéz€ back into the value.
+    const mirrored = latin1RunsAsUtf8(value);
+    if (mirrored !== value)
+        escaped.push(mirrored);
     return [value, ...escaped, ...binary.filter((form) => form.length >= MIN_ENCODED_FORM)];
 }
 /**
- * Whether [at, end) overlaps a marker. The markers are one regex's matches, so they are sorted and
- * disjoint: only the first marker that ends after `at` can also start before `end`.
+ * Whether [at, end) lies wholly inside one marker. The markers are one regex's matches, so they are
+ * sorted and disjoint: only the first marker that ends after `at` can hold it.
  */
-function overlapsMarker(markers, at, end) {
+function insideMarker(markers, at, end) {
     let low = 0;
     let high = markers.length;
     while (low < high) {
@@ -73,33 +84,96 @@ function overlapsMarker(markers, at, end) {
         else
             low = middle + 1;
     }
-    return low < markers.length && markers[low][0] < end;
+    return low < markers.length && markers[low][0] <= at && end <= markers[low][1];
 }
-/** Every occurrence of every form, outside the markers, merged where they overlap or touch. */
-function secretSpans(text, forms) {
+/**
+ * The Knuth-Morris-Pratt failure table: entry `k` is the length of the longest proper prefix of
+ * the form's first `k` characters that is also their suffix.
+ */
+function failureTable(form) {
+    const table = new Int32Array(form.length + 1);
+    for (let at = 1, length = 0; at < form.length; at += 1) {
+        while (length > 0 && form[at] !== form[length])
+            length = table[length];
+        if (form[at] === form[length])
+            length += 1;
+        table[at + 1] = length;
+    }
+    return table;
+}
+/**
+ * Calls `found` with the start of every occurrence of the form, overlapping ones included, in time
+ * linear in the text. indexOf skips to the next occurrence. After one, the failure table carries
+ * the match on through the occurrences that overlap it, so no character is compared again, until
+ * no prefix of the form is left matched and indexOf takes over.
+ */
+function eachOccurrence(text, form, found) {
+    let table;
+    for (let at = text.indexOf(form); at !== -1;) {
+        found(at);
+        table ??= failureTable(form);
+        let matched = table[form.length];
+        let next = at + form.length;
+        for (; matched > 0 && next < text.length; next += 1) {
+            while (matched > 0 && text[next] !== form[matched])
+                matched = table[matched];
+            if (text[next] === form[matched])
+                matched += 1;
+            if (matched === form.length) {
+                found(next + 1 - form.length);
+                matched = table[form.length];
+            }
+        }
+        at = matched > 0 ? -1 : text.indexOf(form, next);
+    }
+}
+/** Every occurrence of every form not wholly inside a marker, in no order. */
+function occurrences(text, forms) {
     const markers = [];
     for (const match of text.matchAll(MARKER)) {
         const start = match.index ?? 0;
         markers.push([start, start + match[0].length]);
     }
+    const found = [];
+    for (const form of forms)
+        eachOccurrence(text, form, (at) => {
+            if (!insideMarker(markers, at, at + form.length))
+                found.push([at, at + form.length]);
+        });
+    return found;
+}
+/** The occurrences sorted and merged where they overlap or touch. */
+function merged(found) {
+    found.sort((left, right) => left[0] - right[0]);
     const spans = [];
-    for (const form of forms) {
-        for (let at = text.indexOf(form); at !== -1; at = text.indexOf(form, at + 1)) {
-            const end = at + form.length;
-            if (!overlapsMarker(markers, at, end))
-                spans.push([at, end]);
-        }
-    }
-    spans.sort((left, right) => left[0] - right[0]);
-    const merged = [];
-    for (const span of spans) {
-        const last = merged.at(-1);
+    for (const span of found) {
+        const last = spans.at(-1);
         if (last !== undefined && span[0] <= last[1])
             last[1] = Math.max(last[1], span[1]);
         else
-            merged.push([span[0], span[1]]);
+            spans.push([span[0], span[1]]);
+    }
+    return spans;
+}
+function replaceSpans(text, spans) {
+    let result = "";
+    let cursor = 0;
+    for (const [start, end] of spans) {
+        result += text.slice(cursor, start) + REDACTED;
+        cursor = end;
     }
-    return merged;
+    return result + text.slice(cursor);
+}
+const formsOf = (values) => [
+    ...new Set(values.filter((value) => value.length > 0).flatMap(encodedForms)),
+];
+/**
+ * A check that the text holds one of the values' forms outside the markers in any of its
+ * readingsOf. A scrub's output must pass it.
+ */
+export function holdsSecretValue(values) {
+    const forms = formsOf(values);
+    return (text) => readingsOf(text).some((reading) => occurrences(reading, forms).length > 0);
 }
 /**
  * A scrub that replaces each non-empty value and its encoded forms with `[REDACTED_SECRET]`. Every
@@ -108,19 +182,21 @@ function secretSpans(text, forms) {
  * through decodeEscapes, the decoder verify uses, and returns the decoded text: a warning with
  * percent-encoding, JSON escapes or HTML references shows them decoded, with the values removed.
  * That finds a value written partly encoded, which no single encoded form matches.
+ *
+ * The result's other readingsOf only detect. If one still holds a form, the scrub returns
+ * `[REDACTED_SECRET]` in place of the whole text. That happens for a value encoded twice, which
+ * the decoded text shows encoded once; for a value the UTF-8 or transfer reading holds, such as
+ * one with one of two non-ASCII characters percent-encoded; and for a value that holds part of a
+ * marker, such as `ET]x`, which the marker that replaced it can spell again.
  */
 export function scrubSecretValues(values) {
-    const forms = [...new Set(values.filter((value) => value.length > 0).flatMap(encodedForms))];
+    const forms = formsOf(values);
     if (forms.length === 0)
         return (text) => text;
+    const holds = holdsSecretValue(values);
     return (text) => {
         const decoded = decodeEscapes(text);
-        let result = "";
-        let cursor = 0;
-        for (const [start, end] of secretSpans(decoded, forms)) {
-            result += decoded.slice(cursor, start) + REDACTED;
-            cursor = end;
-        }
-        return result + decoded.slice(cursor);
+        const result = replaceSpans(decoded, merged(occurrences(decoded, forms)));
+        return holds(result) ? REDACTED : result;
     };
 }

package/dist/feedback/draft.d.ts

@@ -1,7 +1,7 @@
 import type { RunBundle, RunFeedbackCandidate } from "../run/bundle.js";
 import type { PreparedRunArtifactPaths } from "../run/paths.js";
 import { loadRunBundlePrepared } from "../run/locate.js";
-import { type RunNotes } from "../run/notes.js";
+import { type RunNotes } from "../run/note-files.js";
 export declare const FEEDBACK_SCHEMA = "humanish.feedback.v1";
 export interface FeedbackDraft {
     schema: typeof FEEDBACK_SCHEMA;