tryharness 0.7.22 → 0.7.25

package/lib/files.mjs

@@ -1,13 +1,22 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { inflateRawSync } from "node:zlib";
 
 export function ensureDir(dir) {
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  try { fs.chmodSync(dir, 0o700); } catch {}
+  try {
+    fs.chmodSync(dir, 0o700);
+  } catch {}
 }
 
 export function readJson(file, fallback = {}) {
-  try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return fallback; }
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return fallback;
+  }
 }
 
 export function writeJsonAtomic(file, value, mode = 0o600) {
@@ -15,12 +24,18 @@ export function writeJsonAtomic(file, value, mode = 0o600) {
   const temporary = `${file}.tmp-${process.pid}-${Date.now()}`;
   fs.writeFileSync(temporary, JSON.stringify(value, null, 2) + "\n", { mode });
   fs.renameSync(temporary, file);
-  try { fs.chmodSync(file, mode); } catch {}
+  try {
+    fs.chmodSync(file, mode);
+  } catch {}
 }
 
 export function appendLog(file, message) {
   ensureDir(path.dirname(file));
-  try { fs.appendFileSync(file, `${new Date().toISOString()} ${message}\n`, { mode: 0o600 }); } catch {}
+  try {
+    fs.appendFileSync(file, `${new Date().toISOString()} ${message}\n`, {
+      mode: 0o600,
+    });
+  } catch {}
 }
 
 export function listJsonl(root) {
@@ -29,7 +44,11 @@ export function listJsonl(root) {
   while (pending.length) {
     const dir = pending.pop();
     let entries = [];
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
     for (const entry of entries) {
       const full = path.join(dir, entry.name);
       if (entry.isDirectory()) pending.push(full);
@@ -46,15 +65,229 @@ export function listJsonl(root) {
 
 // A file's type from its name, for files an agent attaches without saying; anything unknown is plain bytes.
 const MIME_TYPES = {
-  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp", svg: "image/svg+xml", heic: "image/heic", avif: "image/avif", bmp: "image/bmp", ico: "image/x-icon",
-  pdf: "application/pdf", json: "application/json", zip: "application/zip", gz: "application/gzip", tar: "application/x-tar", wasm: "application/wasm", xml: "application/xml",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document", xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  heic: "image/heic",
+  avif: "image/avif",
+  bmp: "image/bmp",
+  ico: "image/x-icon",
+  pdf: "application/pdf",
+  json: "application/json",
+  zip: "application/zip",
+  gz: "application/gzip",
+  tar: "application/x-tar",
+  wasm: "application/wasm",
+  xml: "application/xml",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
   pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  mp3: "audio/mpeg", wav: "audio/wav", m4a: "audio/mp4", ogg: "audio/ogg", flac: "audio/flac", mp4: "video/mp4", mov: "video/quicktime", webm: "video/webm",
-  txt: "text/plain", md: "text/markdown", csv: "text/csv", tsv: "text/tab-separated-values", html: "text/html", css: "text/css", log: "text/plain", diff: "text/x-diff", patch: "text/x-diff",
-  js: "text/javascript", mjs: "text/javascript", ts: "text/x-typescript", tsx: "text/x-typescript", py: "text/x-python", rs: "text/x-rust", go: "text/x-go", sh: "text/x-shellscript",
-  yaml: "text/yaml", yml: "text/yaml", toml: "text/x-toml", sql: "text/x-sql",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  m4a: "audio/mp4",
+  ogg: "audio/ogg",
+  flac: "audio/flac",
+  mp4: "video/mp4",
+  mov: "video/quicktime",
+  webm: "video/webm",
+  txt: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  tsv: "text/tab-separated-values",
+  html: "text/html",
+  css: "text/css",
+  log: "text/plain",
+  diff: "text/x-diff",
+  patch: "text/x-diff",
+  js: "text/javascript",
+  mjs: "text/javascript",
+  ts: "text/x-typescript",
+  tsx: "text/x-typescript",
+  py: "text/x-python",
+  rs: "text/x-rust",
+  go: "text/x-go",
+  sh: "text/x-shellscript",
+  yaml: "text/yaml",
+  yml: "text/yaml",
+  toml: "text/x-toml",
+  sql: "text/x-sql",
 };
 export function mimeFor(name) {
-  return MIME_TYPES[String(name).toLowerCase().split(".").pop()] || "application/octet-stream";
+  return (
+    MIME_TYPES[String(name).toLowerCase().split(".").pop()] ||
+    "application/octet-stream"
+  );
+}
+
+// The entries of a zip whose names pass `wanted`, as text (an Office file is zipped XML).
+function zipEntries(bytes, wanted) {
+  const end = bytes.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]));
+  const entries = [];
+  for (
+    let at = end < 0 ? 0 : bytes.readUInt32LE(end + 16),
+      count = end < 0 ? 0 : bytes.readUInt16LE(end + 10);
+    count-- > 0 && bytes.readUInt32LE(at) === 0x02014b50;
+  ) {
+    const method = bytes.readUInt16LE(at + 10),
+      size = bytes.readUInt32LE(at + 20),
+      local = bytes.readUInt32LE(at + 42),
+      nameLength = bytes.readUInt16LE(at + 28);
+    const name = bytes.toString("utf8", at + 46, at + 46 + nameLength);
+    at +=
+      46 +
+      nameLength +
+      bytes.readUInt16LE(at + 30) +
+      bytes.readUInt16LE(at + 32);
+    if (!wanted(name)) continue;
+    const start =
+        local +
+        30 +
+        bytes.readUInt16LE(local + 26) +
+        bytes.readUInt16LE(local + 28),
+      raw = bytes.subarray(start, start + size);
+    entries.push({
+      name,
+      xml: (method === 8 ? inflateRawSync(raw) : raw).toString("utf8"),
+    });
+  }
+  return entries;
+}
+const ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+const unescapeXml = (text) =>
+  text.replace(/&(#x[0-9a-f]+|#\d+|\w+);/gi, (all, code) =>
+    code[0] !== "#"
+      ? (ENTITIES[code] ?? all)
+      : String.fromCodePoint(
+          code[1].toLowerCase() === "x"
+            ? parseInt(code.slice(2), 16)
+            : Number(code.slice(1))
+        )
+  );
+// A Word or PowerPoint part's words: its text runs, a line per paragraph.
+const runsOf = (xml, ns) =>
+  unescapeXml(
+    [
+      ...xml.matchAll(
+        new RegExp(
+          `<${ns}:t(?:\\s[^>]*)?>([^<]*)</${ns}:t>|<${ns}:tab/>|<${ns}:br/>|</${ns}:p>`,
+          "g"
+        )
+      ),
+    ]
+      .map(([tag, text]) => text ?? (tag.endsWith("tab/>") ? "\t" : "\n"))
+      .join("")
+  ).trim();
+const numbered = (name) => Number(name.match(/(\d+)\.xml$/)?.[1] ?? 0);
+// A spreadsheet's cells, a line per row and a tab between cells, sheet by sheet under its name.
+function sheetsOf(entries) {
+  const xml = (name) => entries.find((entry) => entry.name === name)?.xml ?? "";
+  const shared = (
+    xml("xl/sharedStrings.xml").match(/<si\b[\s\S]*?<\/si>/g) ?? []
+  ).map((si) =>
+    [...si.matchAll(/<t(?:\s[^>]*)?>([^<]*)<\/t>/g)].map((t) => t[1]).join("")
+  );
+  const names = [
+    ...xml("xl/workbook.xml").matchAll(/<sheet\b[^>]*\bname="([^"]*)"/g),
+  ].map((sheet) => sheet[1]);
+  return entries
+    .filter((entry) => entry.name.startsWith("xl/worksheets/"))
+    .sort((a, b) => numbered(a.name) - numbered(b.name))
+    .map((sheet, index) => {
+      const rows = [
+        ...sheet.xml.matchAll(/<row\b[^>]*?(?:\/>|>([\s\S]*?)<\/row>)/g),
+      ].map((row) =>
+        [...(row[1] ?? "").matchAll(/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g)]
+          .map(([, attrs, inner = ""]) => {
+            // A formula saved without its result reads as the formula.
+            const type = attrs.match(/\bt="(\w+)"/)?.[1],
+              formula = inner.match(/<f\b[^>]*>([^<]*)<\/f>/)?.[1],
+              value =
+                inner.match(/<v>([^<]*)<\/v>/)?.[1] ??
+                (formula ? `=${formula}` : "");
+            return type === "s"
+              ? (shared[Number(value)] ?? "")
+              : type === "inlineStr"
+                ? [...inner.matchAll(/<t(?:\s[^>]*)?>([^<]*)<\/t>/g)]
+                    .map((t) => t[1])
+                    .join("")
+                : value;
+          })
+          .join("\t")
+      );
+      return `${names[index] ?? `Sheet ${index + 1}`}:\n${unescapeXml(rows.join("\n"))}`;
+    })
+    .join("\n\n");
+}
+// What Spotlight's importer read from the file, as it prints it (macOS's own PDF reader, no download needed).
+const unescapeSpotlight = (text) =>
+  text.replace(/\\(U[0-9a-fA-F]{4}|[\s\S])/g, (all, code) =>
+    code.length === 5
+      ? String.fromCharCode(parseInt(code.slice(1), 16))
+      : ({ n: "\n", t: "\t", r: "\r" }[code] ?? code)
+  );
+function pdfText(file, run) {
+  if (process.platform !== "darwin") {
+    const read = run("pdftotext", ["-layout", file, "-"], {
+      encoding: "utf8",
+      maxBuffer: 256 * 2 ** 20,
+    });
+    return read.status === 0 && read.stdout.trim() ? read.stdout.trim() : null;
+  }
+  // The importer goes by the file's extension.
+  const dir = /\.pdf$/i.test(file)
+    ? null
+    : fs.mkdtempSync(path.join(os.tmpdir(), "harness-pdf-"));
+  try {
+    if (dir) fs.copyFileSync(file, path.join(dir, "file.pdf"));
+    const read = run(
+      "mdimport",
+      ["-t", "-d3", dir ? path.join(dir, "file.pdf") : file],
+      { encoding: "utf8", maxBuffer: 256 * 2 ** 20 }
+    );
+    const found = /kMDItemTextContent = "((?:[^"\\]|\\.)*)"/.exec(
+      `${read.stdout}${read.stderr}`
+    );
+    return found ? unescapeSpotlight(found[1]).trim() : null;
+  } finally {
+    if (dir) fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+const OFFICE = {
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document": {
+    parts: (name) => name === "word/document.xml",
+    text: (entries) =>
+      entries.map((entry) => runsOf(entry.xml, "w")).join("\n"),
+  },
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation": {
+    parts: (name) => /^ppt\/slides\/slide\d+\.xml$/.test(name),
+    text: (entries) =>
+      entries
+        .sort((a, b) => numbered(a.name) - numbered(b.name))
+        .map(
+          (entry) => `Slide ${numbered(entry.name)}:\n${runsOf(entry.xml, "a")}`
+        )
+        .join("\n\n"),
+  },
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": {
+    parts: (name) =>
+      /^xl\/(sharedStrings|workbook|worksheets\/sheet\d+)\.xml$/.test(name),
+    text: sheetsOf,
+  },
+};
+export const isDocument = (mime) =>
+  mime === "application/pdf" || Object.hasOwn(OFFICE, mime);
+/** A PDF's or a Word, Excel or PowerPoint file's words, read on this computer; null when it cannot be read here. */
+export function documentText(file, mime, { run = spawnSync } = {}) {
+  try {
+    if (mime === "application/pdf") return pdfText(file, run);
+    const office = OFFICE[mime];
+    return office
+      ? office.text(zipEntries(fs.readFileSync(file), office.parts))
+      : null;
+  } catch {
+    return null;
+  }
 }

package/lib/firewall.mjs

@@ -0,0 +1,288 @@
+import { secretReason } from "./secrets.mjs";
+import { personalSpans } from "./personal.mjs";
+
+// The handoff firewall: two small local models on the text agents pass each other. Inbound, an injection guard reads
+// what an agent, page, tool or file hands another agent and flags or holds words that try to give orders. Outbound, a
+// credential model joins the room's patterns (secrets.mjs) and swaps any key or password in a brief bound for a hosted
+// agent for a placeholder, restored when the answer comes back to this computer. Neither model decides anything about
+// money or permissions: those stay code-enforced. Thresholds come from the handoff-firewall eval (measured on this
+// computer's own threads); a guard that cannot run leaves the text as it was, with the patterns still applied.
+
+const OVERLAP = 200;
+// A guard's score is its logit margin (injection minus benign), the scale its card calibrates on; the maximum over
+// windows stands for the whole text. Measured on this computer's own threads (handoff-firewall eval, October 14): small
+// windows find a sentence planted in a long page, large ones almost never hold a harmless post. A hold (the person must
+// release it) is Wolf Defender over 1,800-character windows at 2.5: no harmless post held, 90% of standalone attacks
+// held. A flag (a label every reader sees) is a hold or Horizon over 300-character windows at 6.0: 3.4% of real
+// harmless posts and pages flagged, 83% of planted and all standalone attacks caught (84% planted at 4.4% flagged with
+// the thresholds chosen on one half of the attacks and checked on the other). Without Horizon, Wolf Defender flags alone
+// over 400-character windows at 1.6 (3.9% flagged, 63% planted, 95% standalone).
+const HOLD_WINDOW = 1_800;
+const FLAG_WINDOW = 300;
+const FALLBACK_WINDOW = 400;
+export const GUARD_HOLD = 2.5;
+export const GUARD_FLAG = 6.0;
+export const FALLBACK_FLAG = 1.6;
+// Lines worth asking the credential model about: an assignment, a header, or a long unbroken token.
+const CANDIDATE_LINE =
+  /[=:]\s*\S{12,}|\b(?:bearer|authorization|token|secret|password|passwd|api[_-]?key|private[_-]?key)\b|[A-Za-z0-9_\-+/]{24,}/i;
+const TOKEN = /[^\s"'`,;()<>{}[\]]{12,}/g;
+const USERINFO = /\b[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:([^\s@/]+)@/i;
+const ASSIGNED =
+  /(?:[=:]|\b(?:is|key|token|password|secret|passwd)\b)\s*(["']?)([^\s"'`,;]{8,})\1/i;
+
+/** The secret itself on a flagged line: a URL's password, a token that mixes kinds of characters, or an assigned value. */
+// A public wallet address is not a secret, and work for Bankr needs it whole (the credential model scores a line holding
+// one as a credential; local-stack smoke 6b). An Ethereum or bech32 address always; base58 only where the line says it
+// is an address, since API keys of that length look the same. Private keys stay secrets: 64 hex, or base58 of 51 or more.
+const publicAddress = (token, line) =>
+  /^0x[0-9a-fA-F]{40}$/.test(token) ||
+  /^(?:bc1|tb1|ltc1)[a-z0-9]{25,62}$/.test(token) ||
+  (/^[1-9A-HJ-NP-Za-km-z]{26,44}$/.test(token) &&
+    /\b(?:address|wallet|solana|sol|btc|bitcoin|send|sent|pay|to)\b/i.test(
+      line
+    ));
+
+export function secretSpan(line) {
+  const url = line.match(USERINFO);
+  if (url) return { at: url.index + url[0].lastIndexOf(url[1]), text: url[1] };
+  const classes = (token) =>
+    [/[a-z]/, /[A-Z]/, /\d/, /[^A-Za-z0-9]/].filter((re) => re.test(token))
+      .length;
+  // A NAME=value or name:value token keeps its name; only the value is the secret.
+  const value = (token) => {
+    const split = token.match(/^[A-Za-z_][\w.-]*[=:](.{8,})$/);
+    return split ? split[1] : token;
+  };
+  const tokens = [...line.matchAll(TOKEN)]
+    .map((m) => ({
+      at: m.index,
+      text: value(m[0].replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9=]+$/g, "")),
+    }))
+    .map((t) => ({ ...t, at: line.indexOf(t.text, t.at) }))
+    .filter(
+      (t) =>
+        t.text.length >= 12 &&
+        (classes(t.text) >= 3 ||
+          (t.text.length >= 24 && classes(t.text) >= 2)) &&
+        !/^[\w.-]+\.[a-z]{2,}$/i.test(t.text) &&
+        !/^(?:\/|\.\.?\/)/.test(t.text) &&
+        !publicAddress(t.text, line)
+    );
+  if (tokens.length)
+    return tokens.sort(
+      (a, b) =>
+        classes(b.text) - classes(a.text) || b.text.length - a.text.length
+    )[0];
+  const assigned = line.match(ASSIGNED);
+  return assigned
+    ? {
+        at: assigned.index + assigned[0].lastIndexOf(assigned[2]),
+        text: assigned[2],
+      }
+    : null;
+}
+
+/** Overlapping windows over a long text, the start and end always included. */
+export function windows(text, size, max = Math.ceil(24_000 / size)) {
+  const value = String(text);
+  if (value.length <= size) return [value];
+  const out = [];
+  for (let at = 0; at < value.length; at += size - Math.min(OVERLAP, size / 4))
+    out.push(value.slice(at, at + size));
+  return out.length <= max ? out : [...out.slice(0, max - 2), ...out.slice(-2)];
+}
+
+export function createFirewall({ inference, log = () => {} }) {
+  const margin = async (id, text, size, lane) =>
+    Math.max(
+      ...(
+        await inference.logits(id, windows(text, size), {
+          lane,
+          maxLength: 640,
+        })
+      ).map((row) => row[1] - row[0])
+    );
+  /** { score, holdScore, verdict: "clean" | "flag" | "hold" } for text one agent hands another. */
+  const inspect = async (text, { lane = "handoff" } = {}) => {
+    if (!String(text).trim())
+      return { score: -Infinity, holdScore: -Infinity, verdict: "clean" };
+    try {
+      const holdScore = await margin("guard", text, HOLD_WINDOW, lane);
+      if (holdScore >= GUARD_HOLD)
+        return { score: holdScore, holdScore, verdict: "hold" };
+      const short = await margin("guard-short", text, FLAG_WINDOW, lane).catch(
+        (error) => {
+          log(
+            `firewall: the short-window guard could not run (${error.message})`
+          );
+          return null;
+        }
+      );
+      if (short !== null)
+        return {
+          score: short,
+          holdScore,
+          verdict: short >= GUARD_FLAG ? "flag" : "clean",
+        };
+      const score = await margin("guard", text, FALLBACK_WINDOW, lane);
+      return {
+        score,
+        holdScore,
+        verdict: score >= FALLBACK_FLAG ? "flag" : "clean",
+      };
+    } catch (error) {
+      log(`firewall: the guard could not run (${error.message})`);
+      return { score: null, verdict: "clean", unavailable: true };
+    }
+  };
+
+  /** Secret spans in a text: [{ start, end, reason }], from the patterns and the credential model. */
+  const secrets = async (text, { lane = "handoff" } = {}) => {
+    const value = String(text);
+    const spans = [];
+    let offset = 0;
+    const lines = value.split("\n").map((line) => {
+      const start = offset;
+      offset += line.length + 1;
+      return { line, start };
+    });
+    const candidates = lines.filter(
+      ({ line }) =>
+        line.length <= 2_000 &&
+        (CANDIDATE_LINE.test(line) || secretReason(line))
+    );
+    let probabilities = [];
+    if (candidates.length) {
+      try {
+        probabilities = (
+          await inference.logits(
+            "credentials",
+            candidates.map(({ line }) => line),
+            { lane, maxLength: 256 }
+          )
+        )
+          // The model's own calibration (policy.json): temperature 2.0954, threshold 0.74.
+          .map((row) => {
+            const a = row[0] / 2.0954,
+              b = row[1] / 2.0954;
+            return 1 / (1 + Math.exp(a - b));
+          });
+      } catch (error) {
+        log(`firewall: the credential model could not run (${error.message})`);
+      }
+    }
+    candidates.forEach(({ line, start }, i) => {
+      const flagged = (probabilities[i] ?? 0) >= 0.74 || secretReason(line);
+      if (!flagged) return;
+      const span = secretSpan(line);
+      if (span)
+        spans.push({
+          start: start + span.at,
+          end: start + span.at + span.text.length,
+          reason: secretReason(line) || "a credential",
+        });
+    });
+    return spans.sort((a, b) => a.start - b.start);
+  };
+
+  /**
+   * The text with every secret replaced by [SECRET_n]; vault maps placeholders back. Restore with restore(text, vault).
+   * A vault passed in keeps placeholders stable across a thread. With personal set (a request that only decides, nothing
+   * acts on the values), emails, phone numbers, wallet addresses and amounts become [EMAIL_n], [PHONE_n], [WALLET_n] and
+   * [AMOUNT_n] too.
+   */
+  const scrub = async (
+    text,
+    { vault = new Map(), lane = "handoff", personal = false } = {}
+  ) => {
+    const value = String(text);
+    const found = await secrets(value, { lane });
+    const spans = personal
+      ? [
+          ...found,
+          ...personalSpans(value).filter(
+            (span) =>
+              !found.some(
+                (other) => other.start < span.end && span.start < other.end
+              )
+          ),
+        ].sort((a, b) => a.start - b.start)
+      : found;
+    if (!spans.length) return { text: value, masked: 0, vault };
+    const reverse = new Map(
+      [...vault].map(([placeholder, original]) => [original, placeholder])
+    );
+    let out = "";
+    let at = 0;
+    for (const span of spans) {
+      if (span.start < at) continue;
+      const original = value.slice(span.start, span.end);
+      let placeholder = reverse.get(original);
+      if (!placeholder) {
+        placeholder = `[${LABELS[span.kind] ?? "SECRET"}_${vault.size + 1}]`;
+        vault.set(placeholder, original);
+        reverse.set(original, placeholder);
+      }
+      out += value.slice(at, span.start) + placeholder;
+      at = span.end;
+    }
+    return { text: out + value.slice(at), masked: spans.length, vault };
+  };
+
+  return { inspect, secrets, scrub };
+}
+
+const LABELS = {
+  email: "EMAIL",
+  phone: "PHONE",
+  wallet: "WALLET",
+  money: "AMOUNT",
+};
+
+/** Puts a vault's originals back in place of its placeholders (only ever for text staying on this computer). */
+export function restore(text, vault) {
+  let out = String(text);
+  for (const [placeholder, original] of vault)
+    out = out.split(placeholder).join(original);
+  return out;
+}
+
+/** restore over every string in a JSON-like value. */
+export function restoreDeep(value, vault) {
+  if (typeof value === "string") return restore(value, vault);
+  if (Array.isArray(value))
+    return value.map((item) => restoreDeep(item, vault));
+  if (value && typeof value === "object")
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key,
+        restoreDeep(item, vault),
+      ])
+    );
+  return value;
+}
+
+/** Applies scrub to every string in a JSON-like value. */
+export async function scrubDeep(
+  firewall,
+  value,
+  vault = new Map(),
+  options = {}
+) {
+  if (typeof value === "string")
+    return (await firewall.scrub(value, { vault, ...options })).text;
+  if (Array.isArray(value)) {
+    const out = [];
+    for (const item of value)
+      out.push(await scrubDeep(firewall, item, vault, options));
+    return out;
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value))
+      out[key] = await scrubDeep(firewall, item, vault, options);
+    return out;
+  }
+  return value;
+}