switchroom 0.19.34 → 0.19.36

package/telegram-plugin/tests/secret-detect-cross-engine.test.ts

@@ -0,0 +1,263 @@
+/**
+ * DIFFERENTIAL test — run BOTH redaction engines over the same corpus and
+ * compare their output byte for byte.
+ *
+ * Why this file exists (#3982 adversarial review, BLOCKER 1 + MAJOR 4):
+ *
+ * The write-path work shipped two anti-fork mechanisms and neither could
+ * see the fork that actually existed.
+ *
+ *   1. `check-secret-pattern-parity` byte-compares the generated table
+ *      against `patterns.ts`. It proves the pattern SOURCES are equal —
+ *      and the sources WERE equal. Identical source is not identical
+ *      behaviour: Python `re` treats `\b` / `\w` / `\d` and `re.I`
+ *      case-folding as UNICODE-aware for `str` patterns, JavaScript
+ *      `RegExp` without the `u` flag treats them as ASCII-only. Every
+ *      generated rule is `\b`-anchored, so a synthetic `sk-ant-`-shaped
+ *      key written next to Japanese, Chinese, Russian or accented-Latin
+ *      text was masked by TypeScript and stored VERBATIM by Python.
+ *      CJK has no word spacing, so "token abutting a non-ASCII letter"
+ *      is the ordinary case, not an exotic one.
+ *   2. `secret_redaction_vectors.json` pins BEHAVIOUR — but every vector
+ *      it shipped with exercised only the two hand-written imperative
+ *      rules. Zero vectors touched any of the ~60 GENERATED patterns, so
+ *      the whole generated table had no behavioural coverage at all.
+ *
+ * Fixed vectors are still the primary contract (they pin what the output
+ * should BE, which a differential test cannot). This file adds the thing
+ * neither mechanism had: a machine-generated corpus, wide enough to cover
+ * combinations nobody thought to write down, run through both engines
+ * with the outputs compared. A future semantic divergence — a new
+ * shorthand class, an `re.I` folding difference, a `\s` definition
+ * mismatch — fails HERE without anyone having predicted it.
+ *
+ * The Python half runs in a real `python3` subprocess importing the
+ * shipped `lib/secret_redact.py`. That is deliberate: an in-process
+ * re-implementation would be a third engine, and a third engine can fork
+ * too.
+ *
+ * Every credential-shaped literal is synthetic, assembled at runtime, and
+ * never echoed into an assertion message — divergences are reported by
+ * family + neighbour codepoint only.
+ */
+import { describe, it, expect } from "vitest";
+import { execFileSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { redact } from "../secret-detect/redact.js";
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const PY_SCRIPTS_DIR = join(repoRoot, "vendor", "hindsight-memory", "scripts");
+
+/**
+ * Read a JSON array of strings on stdin, write the redacted array on
+ * stdout. Nothing is printed to stdout except the JSON, so a stray
+ * warning cannot be mistaken for output.
+ */
+const PY_DRIVER = [
+  "import json,sys",
+  "sys.path.insert(0, sys.argv[1])",
+  "from lib.secret_redact import redact",
+  "data = json.load(sys.stdin)",
+  "sys.stdout.write(json.dumps([redact(s) for s in data]))",
+].join("\n");
+
+function pythonRedactAll(inputs: string[]): string[] {
+  const out = execFileSync("python3", ["-c", PY_DRIVER, PY_SCRIPTS_DIR], {
+    input: JSON.stringify(inputs),
+    encoding: "utf-8",
+    maxBuffer: 32 * 1024 * 1024,
+  });
+  return JSON.parse(out) as string[];
+}
+
+// ─── Corpus ───────────────────────────────────────────────────────────
+
+/** One synthetic credential per family the generated table claims to cover. */
+const FILL = "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJ";
+const FAMILIES: Record<string, string> = {
+  anthropic_api_key: "sk-" + "ant-" + "api03-" + FILL,
+  openai_api_key: "sk-" + FILL + "KKKK",
+  github_pat: "ghp_" + FILL.slice(0, 36),
+  aws_access_key: "AKIA" + FILL.slice(0, 16),
+  google_api_key: "AIza" + FILL.slice(0, 35),
+  slack_token: "xoxb-" + "111111111111" + "-" + FILL.slice(0, 24),
+  jwt: "eyJ" + "AAAABBBBCCCC" + "." + "DDDDEEEEFFFF" + "." + "GGGGHHHHIIII",
+  telegram_bot_token: "1234567" + ":" + FILL.slice(0, 30),
+  laravel_sanctum_token: "17|" + FILL,
+  env_key_value: "API_TOKEN=" + "zQ7x" + "Vb2n" + "Kd9w" + "Rt4y",
+  bearer_header: "Authorization: Bearer " + FILL.slice(0, 24),
+  basic_header: "Authorization: Basic " + "YWxpY2U6" + "c3VwZXJzZWNyZXQ=",
+  db_uri: "postgres://appuser:" + "LmN0pQrS7t" + "@db.internal:5432/prod",
+  memorable_password: "wifi password: " + "Fluffy" + "Barnaby" + "1998",
+};
+
+/**
+ * Neighbour characters placed immediately before and after the
+ * credential. The non-ASCII entries are the whole point: they are where
+ * `\b` means different things in the two engines. The whitespace entries
+ * cover the OPPOSITE hazard — JS `\s` is Unicode-aware without `/u`, so
+ * a naive `re.ASCII` port would fork on the SEPARATOR instead.
+ */
+const NEIGHBOURS = [
+  "",
+  " ",
+  "\n",
+  "\t",
+  ".",
+  ",",
+  ")",
+  '"',
+  "'",
+  "-",
+  "_",
+  "/",
+  "é", // é  — accented Latin
+  "к", // к  — Cyrillic
+  "中", // 中 — CJK (no word spacing: the ordinary case)
+  "あ", // あ — Japanese kana
+  "ก", // ก — Thai
+  "ω", // ω — Greek
+  " ", // NBSP        — JS \s matches, ASCII \s does not
+  "　", // ideographic space — same
+  "", // BOM         — same
+  "K", // K (Kelvin sign) — re.I folds this to 'k' in Unicode mode
+  "ſ", // ſ (long s)      — re.I folds this to 's' in Unicode mode
+];
+
+/** Prose that must survive both engines untouched. */
+const NEGATIVES = [
+  "The password is required.",
+  "The password is incorrect.",
+  "Ken confirmed the password is unchanged.",
+  "password: required, minimum twelve characters, mixed case",
+  "POSTGRES_PASSWORD: vault:pg/password",
+  "postgres_password: vault:pg/password",
+  "PASSWORD: ${DB_PASSWORD}",
+  "JWT_SECRET=<generate-with-openssl-rand>",
+  "ANTHROPIC_API_KEY: vault:anthropic/api_key",
+  "const API_KEY = process.env.ANTHROPIC_API_KEY",
+  "--token <value>   the API token",
+  '{"token": "the bearer token to use"}',
+  "I told him the answer was probably Gandalf the Grey.",
+  "他のパスワードは安全です。",
+];
+
+interface Case {
+  text: string;
+  family: string;
+  pre: string;
+  post: string;
+  /**
+   * True when the neighbours leave the rule's `\b` anchors intact, i.e.
+   * when a hit is EXPECTED. An empty neighbour glues the credential to
+   * the surrounding `note`/`end` filler and a `_` is itself a word
+   * character, so `noteAKIA…` is legitimately not a token in EITHER
+   * engine — those cases still have to AGREE, but they must not be
+   * asserted to mask.
+   */
+  anchored: boolean;
+}
+
+const isWordChar = (s: string) => /^[A-Za-z0-9_]$/.test(s);
+
+function buildCorpus(): Case[] {
+  const cases: Case[] = [];
+  for (const [family, value] of Object.entries(FAMILIES)) {
+    for (const pre of NEIGHBOURS) {
+      for (const post of NEIGHBOURS) {
+        // `note` / `end` supply the effective neighbour when the slot is
+        // empty.
+        const anchored =
+          !isWordChar(pre === "" ? "e" : pre) &&
+          !isWordChar(post === "" ? "e" : post);
+        cases.push({
+          text: `note${pre}${value}${post}end`,
+          family,
+          pre,
+          post,
+          anchored,
+        });
+      }
+    }
+  }
+  for (const text of NEGATIVES) {
+    cases.push({ text, family: "negative", pre: "", post: "", anchored: false });
+  }
+  return cases;
+}
+
+/** `U+0041` style, so a failure message never carries secret bytes. */
+function cp(s: string): string {
+  if (s === "") return "none";
+  return `U+${s.codePointAt(0)!.toString(16).toUpperCase().padStart(4, "0")}`;
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────
+
+describe("TS and Python redactors agree (differential)", () => {
+  const corpus = buildCorpus();
+  const tsOut = corpus.map((c) => redact(c.text));
+  const pyOut = pythonRedactAll(corpus.map((c) => c.text));
+
+  it("covers every credential family across a wide neighbour matrix", () => {
+    // A shrinking corpus would silently weaken the guarantee.
+    expect(corpus.length).toBeGreaterThanOrEqual(1000);
+    expect(Object.keys(FAMILIES).length).toBeGreaterThanOrEqual(14);
+  });
+
+  it("produces byte-identical output for every case", () => {
+    const divergences = corpus
+      .map((c, i) => ({ c, i }))
+      .filter(({ i }) => tsOut[i] !== pyOut[i])
+      .map(({ c, i }) => ({
+        family: c.family,
+        pre: cp(c.pre),
+        post: cp(c.post),
+        // Booleans only — never the text.
+        tsMasked: tsOut[i]!.includes("[REDACTED"),
+        pyMasked: pyOut[i]!.includes("[REDACTED"),
+      }));
+    expect(divergences).toEqual([]);
+  });
+
+  it("never lets one engine store a credential the other masked", () => {
+    // The asymmetric half of the fork, stated as its own outcome: this is
+    // the assertion that would have gone red on the shipped code.
+    const leaks = corpus
+      .map((c, i) => ({ c, i }))
+      .filter(
+        ({ c, i }) =>
+          c.family !== "negative" &&
+          !pyOut[i]!.includes("[REDACTED") &&
+          tsOut[i]!.includes("[REDACTED"),
+      )
+      .map(({ c }) => ({ family: c.family, pre: cp(c.pre), post: cp(c.post) }));
+    expect(leaks).toEqual([]);
+  });
+
+  it("masks the credential in both engines for every anchored case", () => {
+    const anchored = corpus
+      .map((c, i) => ({ c, i }))
+      .filter(({ c }) => c.anchored);
+    // Sanity: the anchored subset must still be the bulk of the matrix,
+    // otherwise the filter above could silently hollow this out.
+    expect(anchored.length).toBeGreaterThanOrEqual(600);
+    const missed = anchored
+      .filter(
+        ({ i }) =>
+          !(tsOut[i]!.includes("[REDACTED") && pyOut[i]!.includes("[REDACTED")),
+      )
+      .map(({ c }) => ({ family: c.family, pre: cp(c.pre), post: cp(c.post) }));
+    expect(missed).toEqual([]);
+  });
+
+  it("leaves prose untouched in both engines", () => {
+    for (const [i, c] of corpus.entries()) {
+      if (c.family !== "negative") continue;
+      expect(tsOut[i]).toBe(c.text);
+      expect(pyOut[i]).toBe(c.text);
+    }
+  });
+});

package/telegram-plugin/tests/secret-detect-write-path.test.ts

@@ -0,0 +1,403 @@
+/**
+ * Two engines, one behaviour — the TypeScript half.
+ *
+ * Agent memory is written from BOTH languages: the vendored Hindsight plugin
+ * retains from Python (`vendor/hindsight-memory/scripts/lib/client.py`), while
+ * the MCP shim, the handoff mirror and the profile CLI write from TypeScript.
+ * If the two redactors drift, a credential blocked on one path sails through
+ * the other, and nothing goes red — the fork is silent by construction.
+ *
+ * Two mechanisms stop that, and this file is half of the second:
+ *
+ *   1. ONE pattern table. `vendor/hindsight-memory/scripts/lib/secret_patterns.json`
+ *      is GENERATED from `telegram-plugin/secret-detect/patterns.ts` and
+ *      byte-compared by `scripts/check-secret-pattern-parity.ts` in `bun lint`.
+ *   2. ONE behaviour contract. `lib/secret_redaction_vectors.json` is asserted
+ *      here AND by `vendor/hindsight-memory/scripts/tests/test_secret_redact.py`.
+ *      The imperative gates (entropy floors, placeholder suppression, the
+ *      memorable-password character-class rule) are hand-ported and cannot be
+ *      generated, so they are pinned by shared expected OUTPUT instead.
+ *
+ * Also covers the two detection gaps this write-path work closed: connection-
+ * string passwords and human-memorable passwords.
+ *
+ * Every credential-shaped literal here is synthetic.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { redact } from "../secret-detect/redact.js";
+import { isInertValue } from "../secret-detect/inert-values.js";
+import { scanDbUris, DB_URI_RULE_ID } from "../secret-detect/db-uri.js";
+import {
+  looksLikeMemorablePassword,
+  scanMemorablePasswords,
+} from "../secret-detect/kv-scanner.js";
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const VECTORS_PATH = join(
+  repoRoot,
+  "vendor/hindsight-memory/scripts/lib/secret_redaction_vectors.json",
+);
+
+type Vector = { name: string; input: string; expected: string };
+const vectors = (
+  JSON.parse(readFileSync(VECTORS_PATH, "utf-8")) as { vectors: Vector[] }
+).vectors;
+
+describe("shared TS/Python redaction vectors", () => {
+  it("carries a non-trivial contract", () => {
+    // A shrinking vector file would silently weaken the cross-language
+    // guarantee; the Python suite asserts the same floor.
+    expect(vectors.length).toBeGreaterThanOrEqual(50);
+  });
+
+  it("covers the GENERATED pattern table, not just the imperative gates", () => {
+    // #3982 review, MAJOR 4: every vector originally shipped exercised
+    // only `db_uri_password`, `memorable_password` and `redact_urls` —
+    // the two hand-ported rules plus the URL pass. Nothing touched any of
+    // the ~60 GENERATED patterns, which is precisely why a Unicode
+    // word-boundary fork inside them shipped past a green CI.
+    for (const marker of [
+      "[REDACTED:anthropic_api_key]",
+      "[REDACTED:jwt]",
+      "[REDACTED:aws_access_key]",
+      "[REDACTED:pem_private_key]",
+      "[REDACTED:bearer_auth_header]",
+      "[REDACTED:basic_auth_header]",
+    ]) {
+      expect(
+        vectors.some((v) => v.expected.includes(marker)),
+        `no vector pins ${marker}`,
+      ).toBe(true);
+    }
+    // ...and several must sit ADJACENT to non-ASCII text, which is where
+    // the two regex engines actually disagreed.
+    const nonAsciiPositives = vectors.filter(
+      (v) =>
+        /[^\u0000-\u007f]/.test(v.input) && v.expected.includes("[REDACTED"),
+    );
+    expect(nonAsciiPositives.length).toBeGreaterThanOrEqual(4);
+  });
+
+  for (const vector of vectors) {
+    it(vector.name, () => {
+      expect(redact(vector.input)).toBe(vector.expected);
+    });
+  }
+});
+
+describe("connection-string credentials (gap 1)", () => {
+  it("masks the password of a non-http scheme URI", () => {
+    // url-redact.ts only ever matched http/https/ws/wss/ftp, so a
+    // `postgres://` DSN — the single most common way a production password
+    // reaches a chat log — was stored verbatim.
+    const password = "Hunter" + "Two99";
+    const out = redact("dsn postgres://appuser:" + password + "@db.internal:5432/prod");
+    expect(out).not.toContain(password);
+    expect(out).toContain(`[REDACTED:${DB_URI_RULE_ID}]`);
+    // Everything diagnostically useful survives.
+    expect(out).toContain("appuser");
+    expect(out).toContain("db.internal:5432/prod");
+  });
+
+  it("ignores a URI with no credentials", () => {
+    expect(scanDbUris("postgres://db.internal:5432/prod")).toEqual([]);
+  });
+
+  it("is idempotent over an already-masked DSN", () => {
+    const once = redact("postgres://u:" + "Pineapple" + "Roof8" + "@h/d");
+    expect(redact(once)).toBe(once);
+  });
+
+  it("masks a password containing an unencoded @ in FULL", () => {
+    // #3982 review, MAJOR 3. The original pattern excluded `@` from the
+    // password class so the match stopped at the FIRST `@`, which stored
+    // 9 of 11 password bytes in clear AND leaked the length of the
+    // masked prefix. Unencoded `@` in a pasted DSN is common.
+    const password = "p" + "@" + "ssW0rd123";
+    const out = redact("postgres://appuser:" + password + "@db.internal:5432/prod");
+    expect(out).toBe(
+      "postgres://appuser:[REDACTED:db_uri_password]@db.internal:5432/prod",
+    );
+    // No 4+ byte fragment of the password survives — the shipped code
+    // stored `ssW0rd123`, which this catches. (Shorter fragments would
+    // collide with the surviving port/host bytes.)
+    for (let i = 0; i + 4 <= password.length; i++) {
+      expect(out).not.toContain(password.slice(i, i + 4));
+    }
+  });
+
+  it("stops at the authority terminator, not at the next @ on the line", () => {
+    const out = redact(
+      "mysql://root:" + "t0psecretpw" + "@db.internal/app then mail ops@example.com",
+    );
+    expect(out).toBe(
+      "mysql://root:[REDACTED:db_uri_password]@db.internal/app then mail ops@example.com",
+    );
+  });
+
+  it("masks each DSN separately in a comma-joined list", () => {
+    // Adversarial case for the MAJOR-3 fix: the password class now
+    // INCLUDES `@`, so greedy matching backs off to the LAST `@`. The
+    // hazard that introduces is one match swallowing two DSNs and hiding
+    // the first host. It does not — `/` terminates the authority, so the
+    // first URI's path ends the first match.
+    const a = "Ab" + "3xQ" + "9zK";
+    const b = "Zt" + "7wM" + "2vR";
+    const out = redact(
+      "postgres://u1:" + a + "@h1.internal:5432/a,postgres://u2:" + b + "@h2.internal:5432/b",
+    );
+    expect(out).toBe(
+      "postgres://u1:[REDACTED:db_uri_password]@h1.internal:5432/a," +
+        "postgres://u2:[REDACTED:db_uri_password]@h2.internal:5432/b",
+    );
+  });
+
+  it("does not run a password past a query or fragment delimiter", () => {
+    const pw = "Ab" + "3xQ" + "9zK";
+    expect(redact("mysql://u:" + pw + "@host/db?opt=x@y")).toBe(
+      "mysql://u:[REDACTED:db_uri_password]@host/db?opt=x@y",
+    );
+    expect(redact("redis://u:" + pw + "@host#frag@z")).toBe(
+      "redis://u:[REDACTED:db_uri_password]@host#frag@z",
+    );
+  });
+});
+
+describe("human-memorable passwords (gap 2)", () => {
+  it("masks a family-name style password behind a password label", () => {
+    // The kv-scanner's 4.0-bits entropy floor is tuned for random tokens; a
+    // memorable password scores well under it, so `password: <words>` was
+    // never a hit.
+    const password = "Fluffy" + "Barnaby" + "1998";
+    const out = redact("wifi password: " + password);
+    expect(out).not.toContain(password);
+    expect(out).toContain("[REDACTED:memorable_password]");
+  });
+
+  it("accepts the ` is ` phrasing and prefixed identifiers", () => {
+    expect(scanMemorablePasswords("the password is Mango" + "TreeHouse77")).toHaveLength(1);
+    expect(scanMemorablePasswords("db_password=Rutherford" + "2024x")).toHaveLength(1);
+  });
+
+  it("does NOT fire on prose or placeholders", () => {
+    // False positives here corrupt stored conversation irreversibly, so the
+    // rule requires >= 2 character classes: single-class English words are out.
+    for (const prose of [
+      "The password policy requires rotation every 90 days.",
+      "the password is rotated quarterly",
+      "password: ${DB_PASSWORD}",
+      "password=<your-password-here>",
+      "password: vault:postgres/app_password",
+      "password: [REDACTED:memorable_password]",
+    ]) {
+      expect(redact(prose)).toBe(prose);
+    }
+  });
+
+  it("does NOT fire on prose that ENDS the sentence", () => {
+    // #3982 review, BLOCKER 2. The value class is `[^\s"']`, so the
+    // sentence terminator was captured INTO the value and the `.` itself
+    // supplied the second character class the gate asks for. Every string
+    // below redacted as a credential on the shipped code — and
+    // sentence-final is the most common position for these words, so the
+    // suite's original "mid-sentence" cases were tests chosen to pass.
+    //
+    // The cost was not just noise: "Ken confirmed the password is
+    // unchanged." stored as "…the password is [REDACTED:...]", which
+    // INVERTS the meaning for every later recall.
+    for (const prose of [
+      "The password is required.",
+      "The password is incorrect.",
+      "The password is unchanged.",
+      "The password is different.",
+      "The password is protected.",
+      "Ken confirmed the password is unchanged.",
+      "password: required, minimum twelve characters, mixed case",
+      "The passphrase is unchanged; rotate it next quarter.",
+    ]) {
+      expect(redact(prose)).toBe(prose);
+    }
+  });
+
+  it("still masks a real password that ends a sentence, punctuation included", () => {
+    const password = "Mango" + "TreeHouse77";
+    const out = redact("The wifi password is " + password + ".");
+    expect(out).toBe("The wifi password is [REDACTED:memorable_password]");
+    expect(out).not.toContain(password);
+  });
+
+  it("does not leak the last byte of a password that ends in punctuation", () => {
+    // Masking only the punctuation-stripped core would leave a real
+    // trailing `!` in clear.
+    const password = "Fluffy" + "Barnaby" + "1998!";
+    const out = redact("password: " + password);
+    expect(out).toBe("password: [REDACTED:memorable_password]");
+  });
+
+  it("classifies candidate values by character-class breadth", () => {
+    expect(looksLikeMemorablePassword("Fluffy" + "Barnaby" + "1998")).toBe(true);
+    expect(looksLikeMemorablePassword("rotated")).toBe(false); // too short + 1 class
+    expect(looksLikeMemorablePassword("quarterly")).toBe(false); // 1 class
+    expect(looksLikeMemorablePassword("required.")).toBe(false); // punctuation != a class
+    expect(looksLikeMemorablePassword("unchanged.")).toBe(false);
+    expect(looksLikeMemorablePassword("incorrect,")).toBe(false);
+    expect(looksLikeMemorablePassword("aaaaaaaaaa1A")).toBe(false); // <4 distinct chars
+    expect(looksLikeMemorablePassword("${SOME_VAR}")).toBe(false);
+  });
+});
+
+describe("inert values are not credentials (MAJOR 5)", () => {
+  // The inert-value list existed before #3982's review but applied ONLY
+  // to the new memorable_password rule, so LETTER CASE decided whether a
+  // vault reference survived: the ALL-CAPS spelling matched
+  // `env_key_value` and was destroyed, the lowercase one matched
+  // `memorable_password` and survived. A vault key NAME is exactly what
+  // switchroom wants an agent to remember, and `src/cli/memory.ts`
+  // prints a "credential-shaped text was replaced" warning each time —
+  // so the false positives were also training operators to ignore it.
+  it("preserves placeholders and references regardless of case", () => {
+    for (const line of [
+      "POSTGRES_PASSWORD: vault:pg/password",
+      "postgres_password: vault:pg/password",
+      "ANTHROPIC_API_KEY: vault:anthropic/api_key",
+      "PASSWORD: ${DB_PASSWORD}",
+      "password: ${DB_PASSWORD}",
+      "API_TOKEN=%API_TOKEN%",
+      "JWT_SECRET=<generate-with-openssl-rand>",
+      "DB_PASSWORD=changeme-in-production",
+      "const API_KEY = process.env.ANTHROPIC_API_KEY",
+      '{"token": "the bearer token to use"}',
+      "--token <value>   the API token",
+    ]) {
+      expect(redact(line)).toBe(line);
+    }
+  });
+
+  it("still masks a REAL value in the same slots", () => {
+    // The gate must not become a way to smuggle a credential through.
+    const token = "zQ7x" + "Vb2n" + "Kd9w" + "Rt4y";
+    for (const line of [
+      "POSTGRES_PASSWORD: " + token,
+      "ANTHROPIC_API_KEY=" + token,
+      '{"token": "' + token + '"}',
+      "--token " + token,
+    ]) {
+      expect(redact(line)).not.toContain(token);
+    }
+  });
+
+  // #3982 review, MAJOR 7. Five of the inert patterns were either not
+  // end-anchored (`/^vault:/`, `/^\[REDACTED/`, the `process.env` rule)
+  // or accepted any payload (`/^<[^>]*>$/`, `/^\{\{…\}\}$/`), so a value
+  // that merely CARRIED an inert-looking wrapper skipped the three gated
+  // rules and was stored verbatim — a regression against coverage
+  // already shipped on main, in the very mechanism added to harden it.
+  const WRAPPERS: Array<(v: string) => string> = [
+    (v) => v,
+    (v) => `<${v}>`,
+    (v) => `{{${v}}}`,
+    (v) => `vault:pg/password${v}`,
+    (v) => `vault:pg/${v}`,
+    (v) => `[REDACTED]${v}`,
+    (v) => `[REDACTED:env_key_value]${v}`,
+    (v) => `process.env.${v}`,
+    (v) => `changeme-${v}`,
+    (v) => `todo_${v}`,
+    (v) => `\${${v}}`,
+    (v) => `%${v}%`,
+  ];
+  const SLOTS: Array<(v: string) => string> = [
+    (v) => `POSTGRES_PASSWORD: ${v}`,
+    (v) => `ANTHROPIC_API_KEY=${v}`,
+    (v) => `{"token": "${v}"}`,
+    (v) => `--token ${v}`,
+  ];
+
+  it("does not let an inert WRAPPER smuggle a real value through", () => {
+    const token = "zQ7x" + "Vb2n" + "Kd9w" + "Rt4y";
+    const hexish =
+      "a8f3c1d2" + "e4b50f6a" + "9c7d3e81" + "b2f45a6c" + "d90e17bb";
+    // A SINGLE-character-class run is the other half: it clears no
+    // entropy gate, but `main` masked it and a 16-letter passphrase is a
+    // real credential, so the run floor has to catch it too.
+    const flat = "abcdefgh" + "ijklmnop";
+    for (const secret of [token, hexish, flat]) {
+      for (const wrap of WRAPPERS) {
+        for (const slot of SLOTS) {
+          const line = slot(wrap(secret));
+          expect(redact(line), line).not.toContain(secret);
+        }
+      }
+    }
+  });
+
+  it("keeps skipping values that are inert END TO END", () => {
+    // The other direction of MAJOR 7: anchoring must not re-open the
+    // false positives MAJOR 5 closed.
+    for (const value of [
+      "vault:pg/password",
+      "vault:anthropic/api_key",
+      "[REDACTED]",
+      "[REDACTED:memorable_password]",
+      "process.env.ANTHROPIC_API_KEY",
+      'os.environ["ANTHROPIC_API_KEY"]',
+      "import.meta.env.VITE_API_KEY",
+      "<your-password-here>",
+      "<generate-with-openssl-rand>",
+      "{{ db_password }}",
+      "${DB_PASSWORD}",
+      "%API_TOKEN%",
+      "changeme-in-production",
+      "todo-before-launch",
+      "****",
+      "the bearer token to use",
+    ]) {
+      expect(isInertValue(value), value).toBe(true);
+    }
+  });
+
+  it("does not treat a trailing newline as end-of-value", () => {
+    // Python `$` also matches BEFORE a final newline, JavaScript `$`
+    // (no /m) does not; the Python mirror spells every anchor `\Z` so
+    // the engines cannot fork here. Asserted on both sides.
+    for (const value of ["<value>\n", "{{token}}\n", "${DB_PASSWORD}\n"]) {
+      expect(isInertValue(value), JSON.stringify(value)).toBe(false);
+    }
+  });
+});
+
+describe("authorization headers (MAJOR 6)", () => {
+  it("masks a lowercased bearer header (HTTP/2 wire form)", () => {
+    const token = "AAAABBBB" + "CCCCDDDD" + "EEEEFFFF";
+    for (const line of [
+      "Authorization: Bearer " + token,
+      "authorization: bearer " + token,
+      "AUTHORIZATION: BEARER " + token,
+    ]) {
+      const out = redact(line);
+      expect(out).not.toContain(token);
+      expect(out).toContain("[REDACTED:bearer_auth_header]");
+    }
+  });
+
+  it("masks a Basic header — base64 is an encoding, not a cipher", () => {
+    const creds = "YWxpY2U6" + "c3VwZXJzZWNyZXQ=";
+    for (const line of [
+      "Authorization: Basic " + creds,
+      "authorization: basic " + creds,
+    ]) {
+      const out = redact(line);
+      expect(out).not.toContain(creds);
+      expect(out).toContain("[REDACTED:basic_auth_header]");
+    }
+  });
+
+  it("does not fire on the WORD bearer in prose", () => {
+    const prose = "ask the bearer of the token to rotate it";
+    expect(redact(prose)).toBe(prose);
+  });
+});

package/telegram-plugin/tests/turn-flush-safety.test.ts

@@ -294,7 +294,7 @@ describe('#2798 turn-flush punctuation/bold parity with reply', () => {
 
     const start = moduleSrc.indexOf('export function normalizeOutboundBody(')
     const redactIdx = moduleSrc.indexOf('redact(text, site)', start)
-    const normIdx = moduleSrc.indexOf('stripExcessBold(normalizePunctuation(text))', start)
+    const normIdx = moduleSrc.indexOf('stripExcessBold(normalizePunctuation(text),', start)
     const scrubIdx = moduleSrc.indexOf('scrubVoice(text)', start)
     expect(start).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(start)
@@ -322,7 +322,7 @@ describe('#2798 turn-flush punctuation/bold parity with reply', () => {
     // Parity, structurally: after consolidation the reply and turn_flush sites
     // share ONE normalization implementation — the punctuation/bold wrapper
     // lives only inside normalizeOutboundBody, and both sites invoke it.
-    expect(replyModuleSrc).toContain('stripExcessBold(normalizePunctuation(text))')
+    expect(replyModuleSrc).toContain('stripExcessBold(normalizePunctuation(text),')
     expect(streamSrc).toContain('normalizeOutboundBody(')
     expect(streamSrc).toContain(`'turn_flush',`)
   })