pi-lens 4.3.0 → 4.4.0

package/dist/clients/recent-touches.js

@@ -1,240 +0,0 @@
-/**
- * Cross-process touched-files record (#492).
- *
- * #485 (clients/agent-nudge.ts) delivers an inline "these files were
- * autoformatted by pi-lens" context nudge, fed by the IN-PROCESS
- * `pilens:files:touched` bus event (#482, clients/bus-publish.ts). That
- * covers every run/turn of the SAME pi process, but subagents spawn real
- * child `pi` processes — a separate process, a separate in-memory bus, a
- * separate accumulator. Nothing about #485 crosses that boundary in either
- * direction:
- *
- *   - Child blind to parent: parent's turn_end autoformat dirties the tree;
- *     a child asked to commit runs `git status`, finds unexplained `M`
- *     files, burns turns investigating.
- *   - Parent blind to child: the child is ephemeral, but the parent keeps
- *     working in the same tree after the child returns and its pi-lens
- *     autoformatted on top of the child's edits.
- *
- * This module is the shared substrate: a single project-scoped
- * `recent-touches.json` (via `getProjectDataDir(cwd)` — NEVER a hardcoded
- * `.pi-lens` path) that every pi-lens instance (parent or child) both
- * appends to (on publish) and reads from (session_start / turn_start). Ring
- * buffer capped at ~50 entries; atomic tmp+rename writes, same pattern as
- * the instance registry (#474, clients/instance-registry.ts). `pid` is what
- * makes consumption self-excluding: a process must never see its own writes
- * come back around as a "cross-process" nudge.
- *
- * Non-goals (#492): no IPC, no daemon, no `fs.watch` — a passive file,
- * appended on publish and read at session_start / mtime-gated at
- * turn_start. Not a general cross-process event bus; one record for one
- * nudge feed.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { writeFileAtomicAsync } from "./atomic-write.js";
-import { getProjectDataDir } from "./file-utils.js";
-import { normalizeFilePath } from "./path-utils.js";
-export const RECENT_TOUCHES_MAX_ENTRIES = 50;
-/** Freshness window for the CHILD session_start consumer (15 minutes). */
-const RECENT_TOUCHES_FRESHNESS_MS = 15 * 60 * 1000;
-function recentTouchesPath(cwd) {
-    return path.join(getProjectDataDir(cwd), "recent-touches.json");
-}
-// --- Kill switch: reuse the #485 flag (house style per clients/agent-nudge.ts) ---
-// This module does not define its own env var — #492 is explicitly a feed
-// INTO the same nudge pipeline, so one switch governs the whole path
-// (producer, both consumers) as specified in the issue.
-let _enabledCache;
-function isRecentTouchesEnabled() {
-    if (_enabledCache === undefined) {
-        _enabledCache = process.env.PI_LENS_AGENT_NUDGE !== "0";
-    }
-    return _enabledCache;
-}
-/** Test-only: reset all module state between test files/cases. */
-export function _resetRecentTouchesForTests() {
-    _enabledCache = undefined;
-    _lastSeenMtimeMs = undefined;
-    _lastSeenSizeBytes = undefined;
-    _lastConsumedCursor.clear();
-}
-// --- Read (never throws — missing file, corrupt JSON, or wrong shape ⇒ empty) ---
-async function readRecentTouchesAsync(cwd) {
-    try {
-        const raw = await fs.promises.readFile(recentTouchesPath(cwd), "utf-8");
-        const parsed = JSON.parse(raw);
-        if (parsed && Array.isArray(parsed.entries)) {
-            return parsed;
-        }
-        return { entries: [] };
-    }
-    catch {
-        return { entries: [] };
-    }
-}
-// --- Write (atomic tmp + rename via clients/atomic-write.ts, #762) ---
-async function writeRecentTouchesAsync(cwd, file) {
-    const dir = getProjectDataDir(cwd);
-    const target = recentTouchesPath(cwd);
-    try {
-        await fs.promises.mkdir(dir, { recursive: true });
-    }
-    catch {
-        // Best-effort record — a failed mkdir just means this batch of touches
-        // never reaches other instances; never throw for the caller (the
-        // producer seam is the fire-and-forget bus-publish path).
-        return;
-    }
-    // bestEffort (default): same reasoning as the mkdir failure above.
-    await writeFileAtomicAsync(target, JSON.stringify(file));
-}
-/**
- * Append this process's touched paths to the shared record (read-modify-
- * write-whole-file, ring-buffer capped at `RECENT_TOUCHES_MAX_ENTRIES` —
- * oldest entries drop first). Called from the SAME seam as
- * `publishFilesTouched` (clients/bus-publish.ts) so parent and child run
- * identical code. Never throws — callers must swallow/log failures
- * themselves (this function already does internally via the write helper).
- */
-export async function appendRecentTouches(args) {
-    if (!isRecentTouchesEnabled())
-        return;
-    if (args.paths.length === 0)
-        return;
-    const now = Date.now();
-    const pid = process.pid;
-    const newEntries = args.paths.map((p) => ({
-        path: normalizeFilePath(p),
-        reason: args.reason,
-        ts: now,
-        pid,
-        sessionId: args.sessionId,
-    }));
-    const file = await readRecentTouchesAsync(args.cwd);
-    const merged = [...file.entries, ...newEntries];
-    // Ring buffer: keep the newest N (oldest-first array, so slice from the tail).
-    const capped = merged.length > RECENT_TOUCHES_MAX_ENTRIES
-        ? merged.slice(merged.length - RECENT_TOUCHES_MAX_ENTRIES)
-        : merged;
-    await writeRecentTouchesAsync(args.cwd, { entries: capped });
-}
-// --- Shared foreign-entry filter (both consumers) ---
-/**
- * The baseline relevance filter EVERY consumer applies: not our own pid,
- * within the freshness window, and the file still exists on disk. Shared so
- * the turn_start reader can never drift from the session_start reader again
- * — the original turn_start implementation only filtered pid + cursor, which
- * meant a fresh process's FIRST turn_start (unset mtime watermark, cursor 0)
- * would surface every entry in the record, including days-old touches of
- * since-deleted files (the ring buffer caps count, not age — nothing ever
- * expires entries in place).
- */
-function passesForeignEntryFilter(entry, selfPid, now, freshnessMs) {
-    if (entry.pid === selfPid)
-        return false;
-    if (now - entry.ts > freshnessMs)
-        return false;
-    try {
-        return fs.existsSync(entry.path);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Read entries for the CHILD-at-session_start consumer: `pid !== self`,
- * newer than the freshness window, and whose file still exists on disk.
- * The child has no read-guard history yet (it just started), so relevance
- * here is recency + existence only — the read-guard-based relevance filter
- * is applied later, upstream, by the caller feeding these into #485's
- * accumulator (agent-nudge.ts intentionally has no session-agnostic
- * "cross-process" bypass of its own relevance filter — this function is
- * the point where that decision is made, per #492 point 6).
- *
- * Never throws: ENOENT / EACCES / parse errors on the record file already
- * collapse to an empty read inside `readRecentTouchesAsync`; a
- * `fs.existsSync` per candidate is wrapped defensively too.
- */
-export async function readCrossProcessTouchesForSessionStart(args) {
-    if (!isRecentTouchesEnabled())
-        return [];
-    try {
-        const selfPid = args.selfPid ?? process.pid;
-        const now = args.now ?? Date.now();
-        const freshnessMs = args.freshnessMs ?? RECENT_TOUCHES_FRESHNESS_MS;
-        const file = await readRecentTouchesAsync(args.cwd);
-        return file.entries.filter((e) => passesForeignEntryFilter(e, selfPid, now, freshnessMs));
-    }
-    catch {
-        return [];
-    }
-}
-// --- Consumer: parent at turn_start (mtime-gated hot path) ---
-// Module state: the last mtime (+ size, #2300) we've already consumed, and a
-// per-cwd cursor (max ts already surfaced) so repeated reads of an
-// unchanged-since-last-check file never re-emit the same entries into the
-// accumulator twice.
-let _lastSeenMtimeMs;
-let _lastSeenSizeBytes;
-const _lastConsumedCursor = new Map();
-/**
- * Parent-at-turn_start consumer. Hot path: ONE `fs.stat` per call; when the
- * mtime matches the last-seen mtime, returns `[]` immediately — no read, no
- * JSON parse. On a changed mtime, reads the file and applies TWO filters:
- *   1. the shared foreign-entry filter (`pid !== self`, within the
- *      freshness window, file still exists) — the same baseline the
- *      session_start reader applies, so a fresh process's first turn_start
- *      can never nudge about days-old touches of since-deleted files;
- *   2. `ts` newer than this cwd's last-consumed cursor (dedupes identical
- *      path+ts across repeated reads — a touch already surfaced once must
- *      never come back), then advances both the mtime watermark and the
- *      cursor.
- *
- * Wrapped so ENOENT/EACCES/parse errors NEVER throw into turn_start — a
- * missing record file (no cross-process activity yet) is the common case
- * and must be silent, not logged as an error.
- */
-export async function readCrossProcessTouchesForTurnStart(args) {
-    if (!isRecentTouchesEnabled())
-        return [];
-    try {
-        const target = recentTouchesPath(args.cwd);
-        let mtimeMs;
-        let sizeBytes;
-        try {
-            const stat = await fs.promises.stat(target);
-            mtimeMs = stat.mtimeMs;
-            sizeBytes = stat.size;
-        }
-        catch {
-            // No record file yet (ENOENT) or inaccessible (EACCES) — nothing to
-            // report; do not disturb the mtime watermark.
-            return [];
-        }
-        // #2300: size alongside mtime — a same-mtime-bucket rewrite (a sibling
-        // process's write landing in the same coarse-granularity mtime tick)
-        // changes the file's length, so mtime equality alone would wrongly
-        // short-circuit to "nothing new" and drop its entries.
-        if (_lastSeenMtimeMs === mtimeMs && _lastSeenSizeBytes === sizeBytes) {
-            return [];
-        }
-        _lastSeenMtimeMs = mtimeMs;
-        _lastSeenSizeBytes = sizeBytes;
-        const selfPid = args.selfPid ?? process.pid;
-        const now = args.now ?? Date.now();
-        const freshnessMs = args.freshnessMs ?? RECENT_TOUCHES_FRESHNESS_MS;
-        const file = await readRecentTouchesAsync(args.cwd);
-        const cursorKey = normalizeFilePath(args.cwd);
-        const cursor = _lastConsumedCursor.get(cursorKey) ?? 0;
-        const fresh = file.entries.filter((e) => e.ts > cursor && passesForeignEntryFilter(e, selfPid, now, freshnessMs));
-        if (file.entries.length > 0) {
-            const maxTs = Math.max(...file.entries.map((e) => e.ts));
-            _lastConsumedCursor.set(cursorKey, Math.max(cursor, maxTs));
-        }
-        return fresh;
-    }
-    catch {
-        return [];
-    }
-}

package/dist/clients/redact/secrets.js

@@ -1,449 +0,0 @@
-const PEM_BEGIN = "-----BEGIN ";
-const PEM_DELIMITER = "-----";
-function codePointOf(char) {
-    return char?.codePointAt(0) ?? -1;
-}
-function isAsciiAlphaNumeric(char) {
-    const code = codePointOf(char);
-    return ((code >= 48 && code <= 57) ||
-        (code >= 65 && code <= 90) ||
-        (code >= 97 && code <= 122));
-}
-function isUpperAlphaNumeric(char) {
-    const code = codePointOf(char);
-    return (code >= 48 && code <= 57) || (code >= 65 && code <= 90);
-}
-function isIdentifierChar(char) {
-    return char === "_" || isAsciiAlphaNumeric(char);
-}
-function isTokenChar(char) {
-    return char === "-" || isIdentifierChar(char);
-}
-const PREFIXED_SECRETS = [
-    {
-        prefix: "ghp_",
-        minSuffixLength: 20,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:github-token]",
-    },
-    {
-        prefix: "gho_",
-        minSuffixLength: 20,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:github-token]",
-    },
-    {
-        prefix: "ghu_",
-        minSuffixLength: 20,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:github-token]",
-    },
-    {
-        prefix: "ghs_",
-        minSuffixLength: 20,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:github-token]",
-    },
-    {
-        prefix: "ghr_",
-        minSuffixLength: 20,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:github-token]",
-    },
-    {
-        prefix: "github_pat_",
-        minSuffixLength: 20,
-        predicate: isTokenChar,
-        replacement: "[REDACTED:github-token]",
-    },
-    {
-        prefix: "AKIA",
-        minSuffixLength: 16,
-        predicate: isUpperAlphaNumeric,
-        replacement: "[REDACTED:aws-access-key]",
-    },
-    {
-        prefix: "ASIA",
-        minSuffixLength: 16,
-        predicate: isUpperAlphaNumeric,
-        replacement: "[REDACTED:aws-access-key]",
-    },
-    {
-        prefix: "sk_live_",
-        minSuffixLength: 16,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:stripe-key]",
-    },
-    {
-        prefix: "sk_test_",
-        minSuffixLength: 16,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:stripe-key]",
-    },
-    {
-        prefix: "rk_live_",
-        minSuffixLength: 16,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:stripe-key]",
-    },
-    {
-        prefix: "rk_test_",
-        minSuffixLength: 16,
-        predicate: isAsciiAlphaNumeric,
-        replacement: "[REDACTED:stripe-key]",
-    },
-    {
-        prefix: "glpat-",
-        minSuffixLength: 20,
-        predicate: isTokenChar,
-        replacement: "[REDACTED:gitlab-token]",
-    },
-    {
-        prefix: "AIza",
-        minSuffixLength: 35,
-        predicate: isTokenChar,
-        replacement: "[REDACTED:google-api-key]",
-    },
-    {
-        prefix: "GOCSPX-",
-        minSuffixLength: 20,
-        predicate: isTokenChar,
-        replacement: "[REDACTED:google-oauth-secret]",
-    },
-    {
-        prefix: "sk-proj-",
-        minSuffixLength: 20,
-        predicate: isTokenChar,
-        replacement: "[REDACTED:openai-key]",
-    },
-    {
-        prefix: "sk-svcacct-",
-        minSuffixLength: 20,
-        predicate: isTokenChar,
-        replacement: "[REDACTED:openai-key]",
-    },
-];
-/**
- * Minimum suffix length for a legacy `sk-<base62>` OpenAI key. Legacy keys are
- * 48 base62 chars; require a high bar so ordinary kebab-case identifiers
- * (`sk-skeleton-loading-placeholder`, `sk-button-large`) never match.
- */
-const OPENAI_LEGACY_MIN_SUFFIX = 40;
-function consumeWhile(options) {
-    let end = options.start;
-    while (end < options.text.length && options.predicate(options.text[end])) {
-        end++;
-    }
-    return end;
-}
-function scanPrefixedSecret(position) {
-    for (const secret of PREFIXED_SECRETS) {
-        if (position.text[position.start] !== secret.prefix[0] ||
-            !position.text.startsWith(secret.prefix, position.start)) {
-            continue;
-        }
-        const suffixStart = position.start + secret.prefix.length;
-        const end = consumeWhile({
-            text: position.text,
-            start: suffixStart,
-            predicate: secret.predicate,
-        });
-        return end - suffixStart >= secret.minSuffixLength
-            ? { end, replacement: secret.replacement }
-            : { end: Math.max(end, suffixStart) };
-    }
-    return undefined;
-}
-function scanSlackToken(position) {
-    const variant = position.text[position.start + 3];
-    if (!position.text.startsWith("xox", position.start) ||
-        variant === undefined ||
-        variant < "a" ||
-        variant > "z" ||
-        position.text[position.start + 4] !== "-") {
-        return undefined;
-    }
-    const suffixStart = position.start + 5;
-    const end = consumeWhile({
-        text: position.text,
-        start: suffixStart,
-        predicate: isTokenChar,
-    });
-    return end - suffixStart >= 10
-        ? { end, replacement: "[REDACTED:slack-token]" }
-        : { end: Math.max(end, suffixStart) };
-}
-function scanSendGridKey(position) {
-    if (!position.text.startsWith("SG.", position.start))
-        return undefined;
-    const retryAt = position.start + 1;
-    const firstStart = position.start + 3;
-    const firstEnd = firstStart + 22;
-    for (let index = firstStart; index < firstEnd; index++) {
-        if (!isTokenChar(position.text[index]))
-            return { end: retryAt };
-    }
-    if (position.text[firstEnd] !== ".")
-        return { end: retryAt };
-    const secondStart = firstEnd + 1;
-    const end = secondStart + 43;
-    for (let index = secondStart; index < end; index++) {
-        if (!isTokenChar(position.text[index]))
-            return { end: retryAt };
-    }
-    return isTokenChar(position.text[end])
-        ? { end: retryAt }
-        : { end, replacement: "[REDACTED:sendgrid-key]" };
-}
-function createJwtSegment(options) {
-    const possibleCandidate = options.text.indexOf("eyJ", options.start);
-    const candidate = possibleCandidate !== -1 &&
-        possibleCandidate < options.end &&
-        options.end - (possibleCandidate + 3) >= 5
-        ? possibleCandidate
-        : -1;
-    return {
-        candidate,
-        length: options.end - options.start,
-        end: options.end,
-    };
-}
-function chooseSecretRange(options) {
-    if (!options.candidate)
-        return options.current;
-    if (!options.current)
-        return options.candidate;
-    return options.candidate.start < options.current.start ||
-        (options.candidate.start === options.current.start &&
-            options.candidate.end > options.current.end)
-        ? options.candidate
-        : options.current;
-}
-function findNestedJwtRange(segments) {
-    let result;
-    const jweStart = segments.length - 5;
-    if (jweStart >= 0 &&
-        segments[jweStart].candidate !== -1 &&
-        segments[jweStart + 2].length > 0 &&
-        segments[jweStart + 3].length > 0 &&
-        segments[jweStart + 4].length > 0) {
-        result = {
-            start: segments[jweStart].candidate,
-            end: segments[jweStart + 4].end,
-        };
-    }
-    const jwtStart = segments.length - 3;
-    const isJwt = jwtStart >= 0 &&
-        segments[jwtStart].candidate !== -1 &&
-        segments[jwtStart + 1].length > 0 &&
-        segments[jwtStart + 2].length > 0;
-    return isJwt
-        ? chooseSecretRange({
-            current: result,
-            candidate: {
-                start: segments[jwtStart].candidate,
-                end: segments[jwtStart + 2].end,
-            },
-        })
-        : result;
-}
-function topLevelJwtEnd(options) {
-    if (options.segmentCount >= 5 &&
-        options.segmentLengths[2] > 0 &&
-        options.segmentLengths[3] > 0 &&
-        options.segmentLengths[4] > 0) {
-        return options.segmentEnds[4];
-    }
-    return options.segmentCount >= 3 &&
-        options.segmentLengths[1] > 0 &&
-        options.segmentLengths[2] > 0
-        ? options.segmentEnds[2]
-        : undefined;
-}
-function scanJwt(position) {
-    if (!position.text.startsWith("eyJ", position.start))
-        return undefined;
-    let segmentStart = position.start + 3;
-    let cursor = consumeWhile({
-        text: position.text,
-        start: segmentStart,
-        predicate: isTokenChar,
-    });
-    if (cursor - segmentStart < 5)
-        return { end: cursor };
-    const segmentLengths = [cursor - segmentStart];
-    const segmentEnds = [cursor];
-    const recentSegments = [
-        createJwtSegment({ text: position.text, start: segmentStart, end: cursor }),
-    ];
-    let segmentCount = 1;
-    let nestedRange;
-    while (position.text[cursor] === ".") {
-        segmentStart = cursor + 1;
-        cursor = consumeWhile({
-            text: position.text,
-            start: segmentStart,
-            predicate: isTokenChar,
-        });
-        segmentCount++;
-        recentSegments.push(createJwtSegment({
-            text: position.text,
-            start: segmentStart,
-            end: cursor,
-        }));
-        if (recentSegments.length > 5)
-            recentSegments.shift();
-        nestedRange = chooseSecretRange({
-            current: nestedRange,
-            candidate: findNestedJwtRange(recentSegments),
-        });
-        if (segmentLengths.length < 5) {
-            segmentLengths.push(cursor - segmentStart);
-            segmentEnds.push(cursor);
-        }
-    }
-    const topLevelEnd = topLevelJwtEnd({
-        segmentCount,
-        segmentLengths,
-        segmentEnds,
-    });
-    if (topLevelEnd !== undefined) {
-        return { end: topLevelEnd, replacement: "[REDACTED:jwt]" };
-    }
-    return nestedRange
-        ? { ...nestedRange, replacement: "[REDACTED:jwt]" }
-        : { end: cursor };
-}
-/**
- * Legacy OpenAI keys are `sk-` followed by base62 (ASCII alphanumeric only —
- * no `-`/`_`). Redact only on a strict shape: at least
- * OPENAI_LEGACY_MIN_SUFFIX alphanumeric chars AND at least one digit. Stopping
- * the suffix at the first non-alphanumeric char means a hyphenated identifier
- * such as `sk-skeleton-loading-placeholder` yields only `skeleton` (8 chars) —
- * far below the bar — so ordinary kebab-case slugs are never touched.
- */
-function scanOpenAiLegacyKey(position) {
-    if (!position.text.startsWith("sk-", position.start))
-        return undefined;
-    const suffixStart = position.start + 3;
-    let end = suffixStart;
-    let hasDigit = false;
-    while (end < position.text.length &&
-        isAsciiAlphaNumeric(position.text[end])) {
-        const code = codePointOf(position.text[end]);
-        if (code >= 48 && code <= 57)
-            hasDigit = true;
-        end++;
-    }
-    return end - suffixStart >= OPENAI_LEGACY_MIN_SUFFIX && hasDigit
-        ? { end, replacement: "[REDACTED:openai-key]" }
-        : { end: Math.max(end, suffixStart) };
-}
-function scanSecretAt(position) {
-    const initial = position.text[position.start];
-    if (initial === "S")
-        return scanSendGridKey(position);
-    if (initial === "x")
-        return scanSlackToken(position);
-    // `s`: modern `sk-proj-`/`sk-svcacct-`/`sk_live_`/`sk_test_` via the prefix
-    // registry, else fall back to the strict legacy `sk-<base62>` scanner.
-    if (initial === "s") {
-        return scanPrefixedSecret(position) ?? scanOpenAiLegacyKey(position);
-    }
-    if (initial === "A" ||
-        initial === "G" ||
-        initial === "g" ||
-        initial === "r") {
-        return scanPrefixedSecret(position);
-    }
-    return undefined;
-}
-function redactScannedSecrets(options) {
-    let cursor = 0;
-    let copyFrom = 0;
-    let result = "";
-    const position = { text: options.text, start: 0 };
-    while (cursor < options.text.length) {
-        position.start = cursor;
-        const scan = options.scanner(position);
-        if (!scan) {
-            cursor++;
-            continue;
-        }
-        if (scan.replacement) {
-            const replacementStart = scan.start ?? cursor;
-            result +=
-                options.text.slice(copyFrom, replacementStart) + scan.replacement;
-            copyFrom = scan.end;
-        }
-        cursor = Math.max(cursor + 1, scan.end);
-    }
-    return copyFrom === 0 ? options.text : result + options.text.slice(copyFrom);
-}
-function redactTokenSecrets(text) {
-    return redactScannedSecrets({ text, scanner: scanSecretAt });
-}
-function redactJwtSecrets(text) {
-    return redactScannedSecrets({ text, scanner: scanJwt });
-}
-function isPrivateKeyLabel(label) {
-    if (label.length === 0 ||
-        label.length > 64 ||
-        !label.includes("PRIVATE KEY")) {
-        return false;
-    }
-    for (const char of label) {
-        const code = codePointOf(char);
-        if (char !== " " && (code < 48 || code > 57) && (code < 65 || code > 90)) {
-            return false;
-        }
-    }
-    return true;
-}
-function findUnescapedQuote(position) {
-    let escaped = false;
-    for (let index = position.start; index < position.text.length; index++) {
-        const char = position.text[index];
-        if (char === "\\") {
-            escaped = !escaped;
-            continue;
-        }
-        if (char === '"' && !escaped)
-            return index;
-        escaped = false;
-    }
-    return position.text.length;
-}
-function redactPrivateKeyBlocks(text) {
-    let cursor = 0;
-    let result = "";
-    while (cursor < text.length) {
-        const begin = text.indexOf(PEM_BEGIN, cursor);
-        if (begin === -1)
-            return result + text.slice(cursor);
-        const labelStart = begin + PEM_BEGIN.length;
-        const labelEnd = text.indexOf(PEM_DELIMITER, labelStart);
-        if (labelEnd === -1)
-            return result + text.slice(cursor);
-        const label = text.slice(labelStart, labelEnd);
-        if (!isPrivateKeyLabel(label)) {
-            const next = labelEnd + PEM_DELIMITER.length;
-            result += text.slice(cursor, next);
-            cursor = next;
-            continue;
-        }
-        const contentStart = labelEnd + PEM_DELIMITER.length;
-        const endMarker = `-----END ${label}-----`;
-        const end = text.indexOf(endMarker, contentStart);
-        result += text.slice(cursor, begin) + "[REDACTED:private-key]";
-        if (end === -1) {
-            cursor = findUnescapedQuote({ text, start: contentStart });
-            continue;
-        }
-        cursor = end + endMarker.length;
-    }
-    return result;
-}
-export function redactSecrets(text) {
-    return redactJwtSecrets(redactTokenSecrets(redactPrivateKeyBlocks(text)));
-}