rea-agents 6.4.0 → 6.5.0

package/dist/artifacts/readStableArtifact.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, open } from "node:fs/promises";
 import { ArtifactReaderFailure } from "./ArtifactReader.js";
+import { OwnedFileHandle } from "../filesystem/OwnedFileHandle.js";
 const FILE_SYSTEM = {
     lstat: (path) => lstat(path, { bigint: true }),
     open,
@@ -18,15 +19,23 @@ const afterValidation = async (path, stage, read) => {
         throw cause;
     }
 };
+const assertReadActive = (signal) => {
+    if (signal?.aborted)
+        throw new ArtifactReaderFailure("cancelled", "Artifact read cancelled", {
+            cause: signal.reason,
+        });
+};
 /** Read one bounded regular file and reject replacement or in-place changes. */
-export const readStableArtifact = async (path, maximumBytes, signal, fileSystem = FILE_SYSTEM) => {
-    signal?.throwIfAborted();
+export const readStableArtifact = async (path, maximumBytes, signal, fileSystem = FILE_SYSTEM, resourceScope) => {
+    assertReadActive(signal);
     const before = await fileSystem.lstat(path);
     if (!before.isFile() || before.isSymbolicLink())
         throw new ArtifactReaderFailure("path", `Expected a regular file without a symlink: ${path}`);
     if (before.size > BigInt(maximumBytes))
         throw new ArtifactReaderFailure("limit", `Selected artifact exceeds ${String(maximumBytes)} bytes: ${path}`);
     const file = await afterValidation(path, "before open", () => fileSystem.open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK));
+    const owner = resourceScope === undefined ? undefined : new OwnedFileHandle(file);
+    let failure;
     try {
         const initial = await file.stat({ bigint: true });
         if (!initial.isFile() ||
@@ -39,7 +48,7 @@ export const readStableArtifact = async (path, maximumBytes, signal, fileSystem
             autoClose: false,
             highWaterMark: 65536,
         })) {
-            signal?.throwIfAborted();
+            assertReadActive(signal);
             const value = chunk;
             if (!Buffer.isBuffer(value))
                 throw new ArtifactReaderFailure("format", `Artifact stream did not return bytes: ${path}`);
@@ -59,10 +68,25 @@ export const readStableArtifact = async (path, maximumBytes, signal, fileSystem
             stat.ctimeNs !== initial.ctimeNs) ||
             BigInt(count) !== initial.size)
             throw new ArtifactReaderFailure("integrity", `Artifact changed during read: ${path}`);
+        assertReadActive(signal);
         const bytes = Buffer.concat(chunks, count);
         return { bytes, sha256: createHash("sha256").update(bytes).digest("hex") };
     }
+    catch (cause) {
+        failure = cause;
+        throw cause;
+    }
     finally {
-        await file.close();
+        if (owner === undefined || resourceScope === undefined)
+            await file.close();
+        else {
+            const cleanup = await resourceScope.release({
+                kind: "file-handle",
+                resource: path,
+                handle: owner,
+            });
+            if (cleanup.kind === "failed")
+                throw ArtifactReaderFailure.withCleanup(failure ?? cleanup.cause, ArtifactReaderFailure.cleanupObservation(cleanup.cause, path));
+        }
     }
 };

package/dist/browser/BrowserProcessStartup.js

@@ -5,6 +5,7 @@ export class BrowserStartupError extends Error {
     failure;
     executable;
     elapsedMs;
+    startupTimeoutMs;
     exitCode;
     signalCode;
     stderr;
@@ -13,28 +14,37 @@ export class BrowserStartupError extends Error {
         this.failure = diagnostics.failure;
         this.executable = diagnostics.executable;
         this.elapsedMs = diagnostics.elapsedMs;
+        this.startupTimeoutMs = diagnostics.startupTimeoutMs;
         this.exitCode = diagnostics.exitCode;
         this.signalCode = diagnostics.signalCode;
         this.stderr = diagnostics.stderr;
     }
 }
+/**
+ * Single owner of the wait for Chrome to publish its DevToolsActivePort.
+ *
+ * Callers that need a different budget pass `timeoutMs`; nobody else should
+ * restate this number, because a per-caller literal silently changes how long
+ * a cold Chrome launch is tolerated before the failure names its ceiling.
+ */
+export const BROWSER_DEVTOOLS_STARTUP_TIMEOUT_MS = 60_000;
 /** Wait for Chrome's valid DevToolsActivePort or a terminal process outcome. */
 export const waitForBrowserDevtoolsPort = async (options) => {
-    const timeoutMs = options.timeoutMs ?? 15_000;
+    const timeoutMs = options.timeoutMs ?? BROWSER_DEVTOOLS_STARTUP_TIMEOUT_MS;
     const pollIntervalMs = options.pollIntervalMs ?? 25;
     const startedAt = performance.now();
-    const terminal = childTermination(options, startedAt);
+    const terminal = childTermination(options, startedAt, timeoutMs);
     const deadline = startedAt + timeoutMs;
     while (true) {
         const terminalState = currentTerminalState(options.child);
         if (terminalState !== null)
-            throw startupError(options, startedAt, terminalState);
+            throw startupError(options, startedAt, timeoutMs, terminalState);
         const port = await readDevtoolsPort(options.activePortPath);
         if (port !== null)
             return port;
         const remainingMs = deadline - performance.now();
         if (remainingMs <= 0)
-            throw startupError(options, startedAt, { failure: "timeout" });
+            throw startupError(options, startedAt, timeoutMs, { failure: "timeout" });
         const outcome = await Promise.race([
             terminal,
             delay(Math.min(pollIntervalMs, remainingMs)).then(() => null),
@@ -43,15 +53,15 @@ export const waitForBrowserDevtoolsPort = async (options) => {
             throw outcome;
     }
 };
-const childTermination = (options, startedAt) => new Promise((resolve) => {
+const childTermination = (options, startedAt, startupTimeoutMs) => new Promise((resolve) => {
     options.child.once("error", (cause) => {
-        resolve(startupError(options, startedAt, {
+        resolve(startupError(options, startedAt, startupTimeoutMs, {
             failure: "spawn-error",
             cause,
         }));
     });
     options.child.once("exit", () => {
-        resolve(startupError(options, startedAt, options.child.signalCode === null
+        resolve(startupError(options, startedAt, startupTimeoutMs, options.child.signalCode === null
             ? { failure: "exited" }
             : { failure: "signalled" }));
     });
@@ -63,10 +73,11 @@ const currentTerminalState = (child) => {
         return { failure: "exited" };
     return null;
 };
-const startupError = (options, startedAt, state) => new BrowserStartupError({
+const startupError = (options, startedAt, startupTimeoutMs, state) => new BrowserStartupError({
     failure: state.failure,
     executable: options.executable,
     elapsedMs: Math.max(0, Math.round(performance.now() - startedAt)),
+    startupTimeoutMs,
     exitCode: options.child.exitCode,
     signalCode: options.child.signalCode,
     stderr: options.stderr(),
@@ -86,4 +97,4 @@ const readDevtoolsPort = async (path) => {
     }
 };
 const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
-const browserStartupMessage = (failure, diagnostics) => `Chrome CDP startup ${failure}; executable=${diagnostics.executable}; elapsed_ms=${String(diagnostics.elapsedMs)}; exit_code=${diagnostics.exitCode === null ? "null" : String(diagnostics.exitCode)}; signal=${diagnostics.signalCode ?? "null"}; stderr=${diagnostics.stderr.length === 0 ? "<empty>" : diagnostics.stderr}`;
+const browserStartupMessage = (failure, diagnostics) => `Chrome CDP startup ${failure}; executable=${diagnostics.executable}; elapsed_ms=${String(diagnostics.elapsedMs)}; startup_timeout_ms=${String(diagnostics.startupTimeoutMs)}; exit_code=${diagnostics.exitCode === null ? "null" : String(diagnostics.exitCode)}; signal=${diagnostics.signalCode ?? "null"}; stderr=${diagnostics.stderr.length === 0 ? "<empty>" : diagnostics.stderr}`;

package/dist/browser/BrowserScenarioPartialObservation.js

@@ -1,3 +1,4 @@
+import { PLAYWRIGHT_RESPONSE_BODY_PROVENANCE_LIMITATION } from "../domain/browserNetworkEvidence.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { AnalysisCancelledError, AnalysisTimeoutError, } from "../domain/analysisErrorCore.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
@@ -5,51 +6,66 @@ import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
 import { PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const OPERATION = "capture_browser_scenario";
-const browserScenarioLimitations = (session, scenario) => [
-    "Event sequence records provider receipt order; simultaneous browser causality is not inferred.",
-    "Network content is retained only when selected; response bytes are browser-decoded, not compressed wire bytes.",
-    "Request bytes are limited to what Playwright exposes; not_exposed does not establish body absence or multipart file coverage.",
-    "Network content reads settle within 5 seconds each and never wait for unfinished responses or refetch them.",
-    "Playwright scenario events do not expose request initiator stacks; receipt order does not prove causality.",
-    "Storage values are hashed only after declared-secret redaction.",
-    ...(scenario.storage.local_storage.length === 0 &&
-        scenario.storage.session_storage.length === 0
-        ? []
-        : [
-            "Non-cookie storage seeds use CDP pre-script instrumentation; only pauses in the scenario's private seed script are resumed by this observer.",
-        ]),
-    ...(session.eventLimitations?.() ?? []),
-    ...(session.mode === "connect"
-        ? [
-            "CDP attachment cannot recover pre-attach events or guarantee launch-time context options.",
-        ]
-        : []),
-];
+const browserScenarioLimitations = (session, scenario, events) => {
+    const capturedResponseBody = scenario.capture.network.response_body &&
+        events.some((event) => event.kind === "network-content" &&
+            event.phase === "response" &&
+            event.body.state === "captured" &&
+            (event.body.representation === "playwright-response-body-bytes" ||
+                event.body.representation === "browser-decoded-response-bytes"));
+    return [
+        "Event sequence records provider receipt order; simultaneous browser causality is not inferred.",
+        "Network content is retained only when selected; Playwright response-body bytes are API results and are not guaranteed to match wire bytes.",
+        "Request bytes are limited to what Playwright exposes; not_exposed does not establish body absence or multipart file coverage.",
+        "Network content reads settle within 5 seconds each and the observer does not request bodies from unfinished responses.",
+        ...(capturedResponseBody
+            ? [PLAYWRIGHT_RESPONSE_BODY_PROVENANCE_LIMITATION]
+            : []),
+        "Playwright scenario events do not expose request initiator stacks; receipt order does not prove causality.",
+        "Storage values are hashed only after declared-secret redaction.",
+        ...(scenario.storage.local_storage.length === 0 &&
+            scenario.storage.session_storage.length === 0
+            ? []
+            : [
+                "Non-cookie storage seeds use CDP pre-script instrumentation; only pauses in the scenario's private seed script are resumed by this observer.",
+            ]),
+        ...(session.eventLimitations?.() ?? []),
+        ...(session.mode === "connect"
+            ? [
+                "CDP attachment cannot recover pre-attach events or guarantee launch-time context options.",
+            ]
+            : []),
+    ];
+};
 /** Project one session into the common capture fields used by success and failure. */
-export const browserScenarioCaptureData = (input) => ({
-    browser: {
-        mode: input.session.mode,
-        process_ownership: input.session.processOwnership,
-        cleanup: input.cleanup,
-        product: input.session.product,
-        version: input.session.version,
-    },
-    scenario: {
-        start_origin: new URL(input.scenario.start_url.url).origin,
-        action_count: input.scenario.actions.length,
-        secret_references: input.scenario.secrets
-            .map(({ secret_id: id }) => id)
-            .sort(),
-        network_content: input.scenario.capture.network,
-    },
-    duration_ms: Date.now() - input.startedAt,
-    steps: [...input.steps],
-    events: input.session.events(),
-    limitations: [
-        ...browserScenarioLimitations(input.session, input.scenario),
-        ...(input.limitations ?? []),
-    ],
-});
+export const browserScenarioCaptureData = (input) => {
+    const events = input.session.events();
+    return {
+        browser: {
+            mode: input.session.mode,
+            process_ownership: input.session.processOwnership,
+            cleanup: input.cleanup,
+            product: input.session.product,
+            version: input.session.version,
+        },
+        scenario: {
+            start_origin: new URL(input.scenario.start_url.url).origin,
+            action_count: input.scenario.actions.length,
+            secret_references: input.scenario.secrets
+                .map(({ secret_id: id }) => id)
+                .sort(),
+            network_content: input.scenario.capture.network,
+            event_families: [...new Set(input.scenario.capture.events)].sort(),
+        },
+        duration_ms: Math.max(0, Math.round(performance.now() - input.startedAt)),
+        steps: [...input.steps],
+        events,
+        limitations: [
+            ...browserScenarioLimitations(input.session, input.scenario, events.items),
+            ...(input.limitations ?? []),
+        ],
+    };
+};
 /** Describe the cleanup failure without discarding its resource evidence. */
 export const browserScenarioCleanupObservation = (cause) => cause instanceof AnalysisError && cause.cleanup !== undefined
     ? cause.cleanup

package/dist/browser/BrowserScenarioSecrets.js

@@ -2,45 +2,150 @@ import { createHash } from "node:crypto";
 import { sanitizeBrowserUrl, } from "../domain/browserObservation.js";
 const REDACTION_PREFIX = "[REDACTED:";
 const encodedSecretValues = (secret) => new Set([
-    secret,
     encodeURIComponent(secret),
     new URLSearchParams([["value", secret]]).toString().slice("value=".length),
 ]);
-const secretSpellings = (secret, spellings) => {
+const normalizePercentEscapes = (value) => {
+    if (!value.includes("%"))
+        return value;
+    return value.replace(/%[0-9a-f]{2}/giu, (escape) => escape.toLowerCase());
+};
+const secretPatterns = (secret, spellings) => {
     if (secret === "")
         return [];
-    if (spellings === "raw")
-        return [secret];
-    const values = [...encodedSecretValues(secret)];
-    if (spellings === "bytes")
-        values.push(JSON.stringify(secret).slice(1, -1));
-    return [...new Set(values)].filter((value) => value !== "");
+    const patterns = [
+        { text: secret, searchText: secret, percentInsensitive: false },
+        ...[...encodedSecretValues(secret)].map((text) => ({
+            text,
+            searchText: normalizePercentEscapes(text),
+            percentInsensitive: true,
+        })),
+    ];
+    if (spellings === "text")
+        patterns.push({
+            text: JSON.stringify(secret).slice(1, -1),
+            searchText: JSON.stringify(secret).slice(1, -1),
+            percentInsensitive: false,
+        });
+    const seen = new Set();
+    return patterns.filter(({ text, percentInsensitive }) => {
+        if (text === "")
+            return false;
+        const key = `${percentInsensitive ? "percent" : "literal"}:${text}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+};
+const declaredPatterns = (values, spellings) => {
+    const seen = new Set();
+    return [...values.values()]
+        .flatMap((secret) => secretPatterns(secret, spellings))
+        .filter(({ text, percentInsensitive }) => {
+        const key = `${percentInsensitive ? "percent" : "literal"}:${text}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+};
+const secretReplacements = (values, spellings) => [...values]
+    .flatMap(([id, secret]) => secretPatterns(secret, spellings).map((pattern) => ({ id, ...pattern })))
+    .sort((left, right) => right.text.length - left.text.length ||
+    (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+const normalizePercentEscapesBytes = (value) => {
+    if (value.indexOf(37) < 0)
+        return value;
+    const normalized = Buffer.from(value);
+    for (let index = 0; index + 2 < normalized.length; index += 1)
+        if (normalized[index] === 37 &&
+            isHexByte(normalized[index + 1]) &&
+            isHexByte(normalized[index + 2])) {
+            normalized[index + 1] = lowercaseHexByte(normalized[index + 1]);
+            normalized[index + 2] = lowercaseHexByte(normalized[index + 2]);
+            index += 2;
+        }
+    return normalized;
 };
-const declaredLiterals = (values, spellings) => [
-    ...new Set([...values.values()].flatMap((secret) => secretSpellings(secret, spellings))),
-];
+const isHexByte = (value) => value !== undefined &&
+    ((value >= 48 && value <= 57) ||
+        (value >= 65 && value <= 70) ||
+        (value >= 97 && value <= 102));
+const lowercaseHexByte = (value) => value >= 65 && value <= 70 ? value + 32 : value;
+const patternMatches = (value, normalizedValue, pattern) => (pattern.percentInsensitive ? normalizedValue : value).includes(pattern.searchText);
+const containsSecretPattern = (value, normalizedValue, patterns) => {
+    if (patterns.length === 0)
+        return false;
+    return patterns.some((pattern) => patternMatches(value, normalizedValue, pattern));
+};
+const containsSecretBytePattern = (value, normalizedValue, needles) => needles.some((needle) => (needle.percentInsensitive ? normalizedValue : value).includes(needle.needle));
 /** Pick a marker that does not itself contain a declared secret spelling. */
-const redactionMarker = (id, literals) => [`${REDACTION_PREFIX}${id}]`, "[REDACTED]", "…", ""].find((candidate) => literals.every((literal) => !candidate.includes(literal))) ?? "";
-const replaceSecretLiterals = (value, values, spellings, literals) => {
-    const replacements = [...values]
-        .flatMap(([id, secret]) => secretSpellings(secret, spellings).map((text) => ({ id, text })))
-        .sort((left, right) => right.text.length - left.text.length ||
-        (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
-    let output = value;
-    for (const replacement of replacements)
-        output = output.replaceAll(replacement.text, redactionMarker(replacement.id, literals));
-    return output;
+const redactionMarker = (id, patterns) => {
+    const candidates = [`${REDACTION_PREFIX}${id}]`, "[REDACTED]", "…", ""];
+    return (candidates.find((candidate) => patterns.every((pattern) => !patternMatches(candidate, normalizePercentEscapes(candidate), pattern))) ?? "");
 };
-const secretNeedles = (values, literals) => [...values].flatMap(([id, secret]) => secretSpellings(secret, "bytes").map((text) => ({
-    id,
-    needle: Buffer.from(text),
-    marker: Buffer.from(redactionMarker(id, literals)),
-})));
+const replaceSecretLiterals = (value, replacements, patterns) => {
+    const normalizedValue = replacements.some(({ percentInsensitive }) => percentInsensitive)
+        ? normalizePercentEscapes(value)
+        : value;
+    const parts = [];
+    let offset = 0;
+    while (offset < value.length) {
+        let next;
+        for (const replacement of replacements) {
+            const search = replacement.searchText;
+            const view = replacement.percentInsensitive ? normalizedValue : value;
+            const index = view.indexOf(search, offset);
+            if (index >= 0 &&
+                (next === undefined ||
+                    index < next.index ||
+                    (index === next.index && replacement.text.length > next.text.length)))
+                next = { ...replacement, index };
+        }
+        if (next === undefined)
+            break;
+        const marker = redactionMarker(next.id, patterns);
+        parts.push(value.slice(offset, next.index), marker);
+        offset = next.index + next.text.length;
+    }
+    if (parts.length === 0)
+        return value;
+    parts.push(value.slice(offset));
+    return parts.join("");
+};
+const secretNeedles = (replacements, patterns) => replacements.map((pattern) => ({
+    id: pattern.id,
+    needle: Buffer.from(pattern.searchText),
+    percentInsensitive: pattern.percentInsensitive,
+    marker: Buffer.from(redactionMarker(pattern.id, patterns)),
+}));
 /** Resolved secret values kept only for one in-memory scenario session. */
 export class BrowserScenarioSecrets {
     values;
+    urlPatterns;
+    textPatterns;
+    urlReplacements;
+    textReplacements;
+    textNeedles;
+    redactionCostPerCharacter;
     constructor(values) {
         this.values = values;
+        this.urlPatterns = declaredPatterns(values, "url");
+        this.textPatterns = declaredPatterns(values, "text");
+        this.urlReplacements = secretReplacements(values, "url");
+        this.textReplacements = secretReplacements(values, "text");
+        this.textNeedles = secretNeedles(this.textReplacements, this.textPatterns);
+        this.redactionCostPerCharacter = 8;
+        for (const [replacements, patterns] of [
+            [this.textReplacements, this.textPatterns],
+            [this.urlReplacements, this.urlPatterns],
+        ])
+            for (const replacement of replacements)
+                this.redactionCostPerCharacter = Math.max(this.redactionCostPerCharacter, 8 +
+                    (Buffer.byteLength(redactionMarker(replacement.id, patterns)) * 8 +
+                        128) /
+                        replacement.text.length);
     }
     static resolve(scenario, environment) {
         const values = new Map();
@@ -67,18 +172,36 @@ export class BrowserScenarioSecrets {
             url.searchParams.append(name, this.value(value));
         return url.href;
     }
+    /** Conservative preflight for output expansion and per-match part arrays.
+     * Callers measuring untrusted observations must reserve this cost before
+     * invoking redaction. A one-byte secret can otherwise expand every byte.
+     */
+    redactionAllocationCost(length) {
+        return Math.ceil(length * this.redactionCostPerCharacter);
+    }
     redact(value) {
-        const literals = declaredLiterals(this.values, "raw");
-        const output = replaceSecretLiterals(value, this.values, "raw", literals);
-        return literals.some((literal) => output.includes(literal)) ? "" : output;
+        const patterns = this.textPatterns;
+        if (patterns.length === 0)
+            return value;
+        const output = replaceSecretLiterals(value, this.textReplacements, patterns);
+        return containsSecretPattern(output, normalizePercentEscapes(output), patterns)
+            ? ""
+            : output;
     }
-    /** Replace declared UTF-8, URI/form, and JSON-escaped secrets without decoding binary data. */
+    /** Replace declared UTF-8, URI/form, and JSON-escaped secret spellings. */
     redactBytes(value) {
-        const literals = declaredLiterals(this.values, "bytes");
-        const candidates = secretNeedles(this.values, literals)
+        const patterns = this.textPatterns;
+        if (patterns.length === 0)
+            return value;
+        const candidates = this.textNeedles;
+        const hasPercentPatterns = candidates.some(({ percentInsensitive }) => percentInsensitive);
+        const normalizedValue = hasPercentPatterns && value.indexOf(37) >= 0
+            ? normalizePercentEscapesBytes(value)
+            : value;
+        const sortedCandidates = candidates
             .map((candidate) => ({
             ...candidate,
-            index: value.indexOf(candidate.needle),
+            index: (candidate.percentInsensitive ? normalizedValue : value).indexOf(candidate.needle),
         }))
             .sort((left, right) => right.needle.length - left.needle.length ||
             (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
@@ -86,11 +209,14 @@ export class BrowserScenarioSecrets {
         let offset = 0;
         while (true) {
             let next;
-            for (const candidate of candidates) {
+            for (const candidate of sortedCandidates) {
                 if (candidate.index >= 0 && candidate.index < offset)
-                    candidate.index = value.indexOf(candidate.needle, offset);
+                    candidate.index = (candidate.percentInsensitive ? normalizedValue : value).indexOf(candidate.needle, offset);
                 if (candidate.index >= 0 &&
-                    (next === undefined || candidate.index < next.index))
+                    (next === undefined ||
+                        candidate.index < next.index ||
+                        (candidate.index === next.index &&
+                            candidate.needle.length > next.needle.length)))
                     next = candidate;
             }
             if (next === undefined)
@@ -102,15 +228,20 @@ export class BrowserScenarioSecrets {
             return value;
         parts.push(value.subarray(offset));
         const redacted = Buffer.concat(parts);
-        return literals.some((literal) => redacted.includes(Buffer.from(literal)))
+        const normalizedRedacted = hasPercentPatterns && redacted.indexOf(37) >= 0
+            ? normalizePercentEscapesBytes(redacted)
+            : redacted;
+        return containsSecretBytePattern(redacted, normalizedRedacted, candidates)
             ? Buffer.alloc(0)
             : redacted;
     }
     /** Remove only declared secret values from one URL and report that action. */
     sanitizeUrl(value) {
-        const literals = declaredLiterals(this.values, "url");
-        const output = replaceSecretLiterals(value, this.values, "url", literals);
-        if (literals.some((literal) => output.includes(literal)))
+        const patterns = this.urlPatterns;
+        if (patterns.length === 0)
+            return sanitizeBrowserUrl(value);
+        const output = replaceSecretLiterals(value, this.urlReplacements, patterns);
+        if (containsSecretPattern(output, normalizePercentEscapes(output), patterns))
             return {
                 url: "",
                 origin: null,
@@ -124,14 +255,13 @@ export class BrowserScenarioSecrets {
         };
     }
     fingerprint(value) {
-        for (const secret of this.values.values())
-            if (secret !== "" && value.includes(secret))
-                return { value_state: "redacted-secret", value_sha256: null };
+        const patterns = this.textPatterns;
+        if (patterns.length > 0 &&
+            containsSecretPattern(value, normalizePercentEscapes(value), patterns))
+            return { value_state: "redacted-secret", value_sha256: null };
         return {
             value_state: "hashed",
-            value_sha256: createHash("sha256")
-                .update(this.redact(value))
-                .digest("hex"),
+            value_sha256: createHash("sha256").update(value).digest("hex"),
         };
     }
 }