rechrome 1.40.0 → 1.41.0

package/fill-secret.ts

@@ -21,7 +21,8 @@ export const SECRET_MASK = "***";
 export const SECRET_MASK_TTL_MS = 15 * 60_000;
 /** Shorter values are never masked: masking "1" everywhere would turn every 1 in every output
  *  into ***, corrupting ids and refs for the daemon's lifetime. A TOTP code (6 digits) still is.
- *  The fill-secret command's own output is still scrubbed of its value, whatever the length. */
+ *  A short value is kept out of fill-secret's own reply by dropping the echoed code that holds it,
+ *  and out of its error message by an exact replace; anything the page itself shows is not masked. */
 export const MIN_MASK_LENGTH = 6;
 export const maskable = (value: string | undefined | null): value is string => !!value && value.length >= MIN_MASK_LENGTH;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"
@@ -23,6 +23,9 @@
     "listeners.js",
     "fill-secret.ts",
     "fill-secret.js",
+    "redact.ts",
+    "redact.js",
+    "secret-rules",
     "extension",
     "rechrome.js",
     "rechrome.ts",
@@ -50,7 +53,7 @@
     "vendor-cli": "bash scripts/vendor-cli.sh",
     "prepare": "bash scripts/vendor-cli.sh --prepare",
     "check-pack": "bash scripts/check-pack.sh",
-    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build fill-secret.ts --target=bun --outfile=fill-secret.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bun build secret.ts --target=bun --external node-datachannel --outfile=secret.js && bun build shares.ts --target=bun --external node-datachannel --outfile=shares.js && bun build e2e.ts --target=bun --external node-datachannel --outfile=e2e.js && bun build webrtc.ts --target=bun --external node-datachannel --outfile=webrtc.js && bun build signal-relay.ts --target=bun --external node-datachannel --outfile=signal-relay.js && bash scripts/check-pack.sh"
+    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build fill-secret.ts --target=bun --outfile=fill-secret.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bun build secret.ts --target=bun --external node-datachannel --outfile=secret.js && bun build shares.ts --target=bun --external node-datachannel --outfile=shares.js && bun build e2e.ts --target=bun --external node-datachannel --outfile=e2e.js && bun build webrtc.ts --target=bun --external node-datachannel --outfile=webrtc.js && bun build signal-relay.ts --target=bun --external node-datachannel --outfile=signal-relay.js && bun build redact.ts --target=bun --outfile=redact.js && bash scripts/check-pack.sh"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/rechrome.js

@@ -5,6 +5,7 @@ import { readListeners, writeListeners as writeListenersFile, listenerAddress, i
 import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
+import { redact } from "./redact.js";
 import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
@@ -642,7 +643,7 @@ export async function getOrCreateUrl(persist = true): Promise<string> {
     const envRaw = await file(globalEnvFile).text().catch(() => "");
     const lines = envRaw.trimEnd().split("\n").filter(l => !l.startsWith(`${ENV_KEY}=`));
     const content = [...lines, newLine, ""].join("\n");
-    await Bun.write(globalEnvFile, content);
+    await writeAtomic(globalEnvFile, content, 0o600); // holds the management key
   }
   process.env[ENV_KEY] = url;
   return url;
@@ -1779,7 +1780,7 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     if (!picked.startsWith(SETUP)) return picked;
     const dir = picked.slice(SETUP.length);
     console.error(`[rech] ${dir} isn't set up yet; running rech setup --profile ${JSON.stringify(dir)} first.`);
-    await setup({ profile: dir });
+    await setup({ profile: dir, skipShare: true });
     const after = await readTokenRegistry();
     const key = unregisteredChromeProfiles(after, { [dir]: {} }).length ? undefined : canonicalProfileKeys(after).find(k => after[k].profileDir === dir);
     if (process.exitCode || !key) throw new Error(`Setup didn't register ${dir}; nothing shared. Retry with: rech setup --profile ${JSON.stringify(dir)}`);
@@ -2188,7 +2189,13 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   }
   const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
   // The daemon already masks the value; this is a second line of defence for an older daemon.
-  const scrub = (s: string) => secret && s ? s.replaceAll(secret, SECRET_MASK) : s;
+  // Then any secret-shaped string (API keys, tokens) in page text, unless RECH_REDACT=0.
+  const scrub = (s: string) => {
+    if (!s) return s;
+    if (secret) s = s.replaceAll(secret, SECRET_MASK);
+    if (process.env.RECH_REDACT === "0") return s;
+    try { return redact(s).text; } catch { return s; } // missing rules must not swallow output
+  };
   const { files, existingSession } = served;
   const status = served.status, stdout = scrub(served.stdout), stderr = scrub(served.stderr);
   if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
@@ -2730,7 +2737,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
   const envRaw = await file(globalEnvFile).text().catch(() => "");
   const lines = envRaw.trimEnd().split("\n");
   const filtered = lines.filter(l => !l.startsWith(`${ENV_KEY}=`));
-  await Bun.write(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"));
+  await writeAtomic(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"), 0o600);
 
   const home = HOME;
   const bunBin = Bun.which("bun") ?? process.execPath;
@@ -3427,7 +3434,6 @@ async function saveGlobalUrl(url: string): Promise<string> {
   return writeEnvUrl(GLOBAL_ENV_FILE, url);
 }
 
-/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 /** Write a file whole or not at all: a temp file beside it, then rename (atomic on one filesystem). */
 export async function writeAtomic(path: string, data: string, mode?: number): Promise<void> {
   // A symlinked .env.local stays a link: write the file it points to.
@@ -3464,6 +3470,7 @@ export async function ensureProjectDir(dir: string): Promise<void> {
   if (!existsSync(readme)) await writeAtomic(readme, PROJECT_DIR_README);
 }
 
+/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
   await writeAtomic(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), 0o600);
@@ -3974,7 +3981,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
-  if (bridgeVerified && isTTY && !opts.listen) await setupShareStep(ask, profileEmail);
+  if (bridgeVerified && isTTY && !opts.listen && !opts.skipShare) await setupShareStep(ask, profileEmail);
   rl?.close();
   envWatcher?.close();
   if (bridgeVerified)
@@ -4423,7 +4430,7 @@ async function status(): Promise<void> {
 }
 
 
-export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean };
+export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean; /** Called from `rech share`, which shares the profile itself. */ skipShare?: boolean };
 export type RechHandlers = {
   serve(): Promise<void> | void;
   status(): Promise<void>;

package/rechrome.ts

@@ -5,6 +5,7 @@ import { readListeners, writeListeners as writeListenersFile, listenerAddress, i
 import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.ts";
+import { redact } from "./redact.ts";
 import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
@@ -642,7 +643,7 @@ export async function getOrCreateUrl(persist = true): Promise<string> {
     const envRaw = await file(globalEnvFile).text().catch(() => "");
     const lines = envRaw.trimEnd().split("\n").filter(l => !l.startsWith(`${ENV_KEY}=`));
     const content = [...lines, newLine, ""].join("\n");
-    await Bun.write(globalEnvFile, content);
+    await writeAtomic(globalEnvFile, content, 0o600); // holds the management key
   }
   process.env[ENV_KEY] = url;
   return url;
@@ -1779,7 +1780,7 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     if (!picked.startsWith(SETUP)) return picked;
     const dir = picked.slice(SETUP.length);
     console.error(`[rech] ${dir} isn't set up yet; running rech setup --profile ${JSON.stringify(dir)} first.`);
-    await setup({ profile: dir });
+    await setup({ profile: dir, skipShare: true });
     const after = await readTokenRegistry();
     const key = unregisteredChromeProfiles(after, { [dir]: {} }).length ? undefined : canonicalProfileKeys(after).find(k => after[k].profileDir === dir);
     if (process.exitCode || !key) throw new Error(`Setup didn't register ${dir}; nothing shared. Retry with: rech setup --profile ${JSON.stringify(dir)}`);
@@ -2188,7 +2189,13 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   }
   const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
   // The daemon already masks the value; this is a second line of defence for an older daemon.
-  const scrub = (s: string) => secret && s ? s.replaceAll(secret, SECRET_MASK) : s;
+  // Then any secret-shaped string (API keys, tokens) in page text, unless RECH_REDACT=0.
+  const scrub = (s: string) => {
+    if (!s) return s;
+    if (secret) s = s.replaceAll(secret, SECRET_MASK);
+    if (process.env.RECH_REDACT === "0") return s;
+    try { return redact(s).text; } catch { return s; } // missing rules must not swallow output
+  };
   const { files, existingSession } = served;
   const status = served.status, stdout = scrub(served.stdout), stderr = scrub(served.stderr);
   if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
@@ -2730,7 +2737,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
   const envRaw = await file(globalEnvFile).text().catch(() => "");
   const lines = envRaw.trimEnd().split("\n");
   const filtered = lines.filter(l => !l.startsWith(`${ENV_KEY}=`));
-  await Bun.write(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"));
+  await writeAtomic(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"), 0o600);
 
   const home = HOME;
   const bunBin = Bun.which("bun") ?? process.execPath;
@@ -3427,7 +3434,6 @@ async function saveGlobalUrl(url: string): Promise<string> {
   return writeEnvUrl(GLOBAL_ENV_FILE, url);
 }
 
-/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 /** Write a file whole or not at all: a temp file beside it, then rename (atomic on one filesystem). */
 export async function writeAtomic(path: string, data: string, mode?: number): Promise<void> {
   // A symlinked .env.local stays a link: write the file it points to.
@@ -3464,6 +3470,7 @@ export async function ensureProjectDir(dir: string): Promise<void> {
   if (!existsSync(readme)) await writeAtomic(readme, PROJECT_DIR_README);
 }
 
+/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
   await writeAtomic(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), 0o600);
@@ -3974,7 +3981,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
-  if (bridgeVerified && isTTY && !opts.listen) await setupShareStep(ask, profileEmail);
+  if (bridgeVerified && isTTY && !opts.listen && !opts.skipShare) await setupShareStep(ask, profileEmail);
   rl?.close();
   envWatcher?.close();
   if (bridgeVerified)
@@ -4423,7 +4430,7 @@ async function status(): Promise<void> {
 }
 
 
-export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean };
+export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean; /** Called from `rech share`, which shares the profile itself. */ skipShare?: boolean };
 export type RechHandlers = {
   serve(): Promise<void> | void;
   status(): Promise<void>;

package/redact.js

@@ -0,0 +1,236 @@
+// @bun
+// redact.ts
+import { readFileSync } from "fs";
+function goToJs(src) {
+  let flags = "";
+  for (;; ) {
+    const m = /^\(\?([is]+)\)/.exec(src);
+    if (!m)
+      break;
+    flags += m[1];
+    src = src.slice(m[0].length);
+  }
+  src = src.replaceAll("(?P<", "(?<").replaceAll("\\z", "$").replaceAll("[[:alnum:]]", "[A-Za-z0-9]").replaceAll("[:alnum:]", "A-Za-z0-9").replaceAll("[:alpha:]", "A-Za-z").replaceAll("[:digit:]", "0-9").replaceAll("[:space:]", "\\s");
+  let out = "";
+  const closers = [];
+  let extra = 0;
+  for (let i = 0;i < src.length; i++) {
+    const c = src[i];
+    if (c === "\\") {
+      out += c + (src[i + 1] ?? "");
+      i++;
+      continue;
+    }
+    if (c === "[") {
+      let j = i + 1;
+      if (src[j] === "^")
+        j++;
+      if (src[j] === "]")
+        j++;
+      while (j < src.length && src[j] !== "]") {
+        if (src[j] === "\\")
+          j++;
+        j++;
+      }
+      out += src.slice(i, j + 1);
+      i = j;
+      continue;
+    }
+    if (src.startsWith("(?i)", i)) {
+      out += "(?i:";
+      extra++;
+      i += 3;
+      continue;
+    }
+    if (c === "(") {
+      closers.push(extra);
+      extra = 0;
+      out += c;
+      continue;
+    }
+    if (c === ")") {
+      out += ")".repeat(extra);
+      extra = closers.pop() ?? 0;
+      out += c;
+      continue;
+    }
+    if (c === "|" && extra) {
+      out += ")".repeat(extra) + "|" + "(?i:".repeat(extra);
+      continue;
+    }
+    out += c;
+  }
+  out += ")".repeat(extra);
+  return { source: out, flags: [...new Set(flags)].join("") };
+}
+function loadGitleaksRules(toml) {
+  const c = Bun.TOML.parse(toml);
+  const compile = (r) => {
+    const j = goToJs(r);
+    return new RegExp(j.source, j.flags);
+  };
+  const gAllow = (c.allowlist?.regexes ?? []).map(compile);
+  const gStop = (c.allowlist?.stopwords ?? []).map((s) => s.toLowerCase());
+  const rules = [];
+  for (const r of c.rules) {
+    if (!r.regex)
+      continue;
+    const allow = [...gAllow];
+    const allowMatch = [];
+    const allowLine = [];
+    const stop = [...gStop];
+    for (const a of [...r.allowlists ?? [], ...r.allowlist ? [r.allowlist] : []]) {
+      const into = a.regexTarget === "match" ? allowMatch : a.regexTarget === "line" ? allowLine : allow;
+      for (const x of a.regexes ?? [])
+        into.push(compile(x));
+      for (const s of a.stopwords ?? [])
+        stop.push(String(s).toLowerCase());
+    }
+    const j = goToJs(r.regex);
+    rules.push({
+      id: r.id,
+      re: new RegExp(j.source, j.flags + "gd"),
+      keywords: (r.keywords ?? []).map((k) => k.toLowerCase()),
+      ...r.entropy ? { entropy: r.entropy } : {},
+      ...r.secretGroup ? { group: r.secretGroup } : {},
+      allow,
+      ...allowMatch.length ? { allowMatch } : {},
+      ...allowLine.length ? { allowLine } : {},
+      stop
+    });
+  }
+  return rules;
+}
+var OWN_RULES = [
+  { id: "url-secret-param", re: /[?&](?:access_token|token|key|api_key|apikey|secret|client_secret|password|passwd|pwd|sig|signature)=([^&\s#<>"'|]{6,})/gid, group: 1, keywords: ["="], allow: [/^(?:x+|\*+|\.\.\.|your[-_]?\w*|xxx\w*)$/i], stop: [] },
+  { id: "sk-key", re: /\b(sk-(?:proj-|ant-|or-v1-|svcacct-)?[A-Za-z0-9_-]{20,})/gd, group: 1, keywords: ["sk-"], entropy: 3.5, allow: [], stop: [] },
+  { id: "otp-code", re: /(?:code|\u30B3\u30FC\u30C9|otp|pin|passcode|\u8A8D\u8A3C|\u78BA\u8A8D\u756A\u53F7|\u30EF\u30F3\u30BF\u30A4\u30E0)[^\d\n]{0,20}(?<![\d.])(\d{6})(?![\d.])/gid, group: 1, keywords: [], allow: [], stop: [] }
+];
+var cached;
+function secretRules() {
+  cached ??= [...loadGitleaksRules(readFileSync(new URL("./secret-rules/gitleaks.toml", import.meta.url), "utf8")), ...OWN_RULES];
+  return cached;
+}
+function shannon(s) {
+  const f = new Map;
+  for (const ch of s)
+    f.set(ch, (f.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const n of f.values()) {
+    const p = n / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+function findKnown(text, known) {
+  const forms = new Set;
+  for (const v of known) {
+    if (v.length < 6)
+      continue;
+    forms.add(v);
+    forms.add(JSON.stringify(v).slice(1, -1));
+  }
+  const out = [];
+  for (const f of [...forms].sort((a, b) => b.length - a.length)) {
+    for (let i = text.indexOf(f);i >= 0; i = text.indexOf(f, i + f.length))
+      out.push({ id: "known-secret", start: i, end: i + f.length });
+  }
+  return out;
+}
+var OPAQUE_RUN = /[A-Za-z0-9+/=_-]{4096,}/g;
+function findSecrets(text, opts = {}) {
+  if (text.length >= 4096 && OPAQUE_RUN.test(text)) {
+    OPAQUE_RUN.lastIndex = 0;
+    const out = opts.known?.length ? findKnown(text, opts.known) : [];
+    let at = 0;
+    for (const m of [...text.matchAll(OPAQUE_RUN), { index: text.length, 0: "" }]) {
+      const piece = text.slice(at, m.index);
+      if (piece)
+        for (const h of findSecrets(piece, { ...opts, known: [] }))
+          out.push({ ...h, start: h.start + at, end: h.end + at });
+      at = m.index + m[0].length;
+    }
+    return out;
+  }
+  OPAQUE_RUN.lastIndex = 0;
+  const rules = opts.rules ?? secretRules();
+  const lower = text.toLowerCase();
+  const out = opts.known?.length ? findKnown(text, opts.known) : [];
+  for (const r of rules) {
+    if (r.keywords.length && !r.keywords.some((k) => lower.includes(k)))
+      continue;
+    for (const m of text.matchAll(r.re)) {
+      const gi = r.group ?? m.findIndex((g, i) => i > 0 && !!g);
+      const secret = gi > 0 ? m[gi] : m[0];
+      if (!secret)
+        continue;
+      if (r.entropy && shannon(secret) < r.entropy)
+        continue;
+      if (r.allow.some((a) => a.test(secret)))
+        continue;
+      if (r.allowMatch?.some((a) => a.test(m[0])))
+        continue;
+      if (r.allowLine) {
+        const ls = text.lastIndexOf(`
+`, m.index) + 1;
+        const le = text.indexOf(`
+`, m.index + m[0].length);
+        if (r.allowLine.some((a) => a.test(text.slice(ls, le < 0 ? undefined : le))))
+          continue;
+      }
+      const sl = secret.toLowerCase();
+      if (r.stop.some((s) => sl.includes(s)))
+        continue;
+      const span = r.group ? m.indices?.[r.group] : undefined;
+      if (span)
+        out.push({ id: r.id, start: span[0], end: span[1] });
+      else {
+        let a = m.index;
+        let b = m.index + m[0].length;
+        const edge = /[\s'"`;=:,]/;
+        while (a < b && edge.test(text[a]))
+          a++;
+        for (;; ) {
+          if (b > a && edge.test(text[b - 1]))
+            b--;
+          else if (b - 2 >= a && /\\[nr]/.test(text.slice(b - 2, b)))
+            b -= 2;
+          else
+            break;
+        }
+        out.push({ id: r.id, start: a, end: b });
+      }
+    }
+  }
+  return out;
+}
+function redact(text, opts = {}) {
+  const hits = findSecrets(text, opts).sort((a, b) => a.start - b.start || b.end - a.end);
+  if (!hits.length)
+    return { text, kinds: [] };
+  const spans = [];
+  for (const h of hits) {
+    const last = spans[spans.length - 1];
+    if (last && h.start < last.end) {
+      if (h.end - h.start > last.end - last.start)
+        last.id = h.id;
+      last.end = Math.max(last.end, h.end);
+    } else
+      spans.push({ ...h });
+  }
+  let out = "";
+  let at = 0;
+  for (const s of spans) {
+    out += text.slice(at, s.start) + `[redacted:${s.id}]`;
+    at = s.end;
+  }
+  return { text: out + text.slice(at), kinds: [...new Set(spans.map((s) => s.id))] };
+}
+export {
+  OWN_RULES,
+  findSecrets,
+  goToJs,
+  loadGitleaksRules,
+  redact,
+  secretRules
+};