super-skill-cli 0.9.2__py3-none-any.whl

super_skill/config.py

@@ -0,0 +1,25 @@
+"""Path resolution. All roots are env-overridable so tests never touch the real
+~/.super-skill state or the host's ~/.claude/skills directory."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+def state_root() -> Path:
+    """Registry + control state (git-backed in WS). docs/02 §4.1."""
+    return Path(os.environ.get("SUPER_SKILL_HOME", "~/.super-skill")).expanduser()
+
+
+def host_skills_dir() -> Path:
+    """Claude Code personal skills dir — v1 direct distribution target (R-SCOPE-3)."""
+    return Path(os.environ.get("SUPER_SKILL_HOST_SKILLS", "~/.claude/skills")).expanduser()
+
+
+def registry_dir() -> Path:
+    return state_root() / "registry"
+
+
+def skills_dir() -> Path:
+    return registry_dir() / "skills"

super_skill/doctor.py

@@ -0,0 +1,119 @@
+"""Registry integrity self-check and repair (`super-skill doctor [--fix]`).
+
+`check_registry` is read-only: it verifies the WS registry is internally
+consistent and, when a host dir is given, in sync with it. The highest-value
+check is content-hash integrity — a version's on-disk SKILL.md must still hash to
+the `artifact_hash` recorded when it was promoted, catching tampering,
+corruption, or a hand-edit that bypassed the registry.
+
+`repair` fixes the mechanically-fixable issues: git is the WS backend, so a
+tampered/missing version file is restored from HEAD (which holds the committed,
+correct content), and host drift is re-materialized from the active version.
+Issues that need judgment (a dangling active pointer, a name mismatch) are left
+for the user. Repair always re-verifies afterwards and reports what actually
+remains — an attempted fix is not a fix (see the doctor exit-code lesson).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from .registry import Registry, RegistryError
+from .skillmd import content_hash
+
+
+@dataclass(frozen=True)
+class DoctorIssue:
+    skill_id: str
+    severity: str  # "error" (integrity broken) | "warn" (drift / cosmetic)
+    message: str
+    kind: str = ""  # machine-dispatchable: see check_registry
+    version: str | None = None
+
+
+def check_registry(reg: Registry, host_dir: Path | None = None) -> list[DoctorIssue]:
+    issues: list[DoctorIssue] = []
+    for rec in reg.list_skills():
+        sid = rec.skill.skill_id
+        active = rec.skill.active_version
+
+        if active is not None and active not in rec.versions:
+            issues.append(
+                DoctorIssue(sid, "error", f"active pointer {active!r} not in versions",
+                            kind="dangling_active")
+            )
+
+        for ver, sv in rec.versions.items():
+            try:
+                raw = reg.version_text(sid, ver)
+            except RegistryError:
+                issues.append(
+                    DoctorIssue(sid, "error", f"{ver}: SKILL.md file missing",
+                                kind="file_missing", version=ver)
+                )
+                continue
+            if content_hash(raw) != sv.artifact_hash:
+                issues.append(
+                    DoctorIssue(sid, "error", f"{ver}: content hash mismatch (tampered/corrupt)",
+                                kind="hash_mismatch", version=ver)
+                )
+            if sv.frontmatter.name != sid:
+                issues.append(
+                    DoctorIssue(sid, "warn",
+                                f"{ver}: frontmatter name {sv.frontmatter.name!r} != skill_id",
+                                kind="name_mismatch", version=ver)
+                )
+
+        if host_dir is not None and active is not None and active in rec.versions:
+            host_md = host_dir / sid / "SKILL.md"
+            if not host_md.exists():
+                issues.append(
+                    DoctorIssue(sid, "warn", "active version not materialized to host",
+                                kind="host_missing")
+                )
+            elif content_hash(host_md.read_text(encoding="utf-8")) != content_hash(
+                reg.version_text(sid, active)
+            ):
+                issues.append(
+                    DoctorIssue(sid, "warn",
+                                "host SKILL.md differs from active version (edited/stale)",
+                                kind="host_drift")
+                )
+
+    return issues
+
+
+@dataclass(frozen=True)
+class RepairAction:
+    issue: DoctorIssue
+    action: str  # what was attempted
+    ok: bool
+
+
+def repair(
+    reg: Registry, host_dir: Path | None = None
+) -> tuple[list[RepairAction], list[DoctorIssue]]:
+    """Fix the mechanically-fixable issues, then RE-VERIFY.
+
+    Returns (actions attempted, issues still present after re-check). The caller
+    decides exit status from the *remaining* issues, never from attempts."""
+    actions: list[RepairAction] = []
+    for issue in check_registry(reg, host_dir):
+        if issue.kind in ("hash_mismatch", "file_missing") and issue.version is not None:
+            rel = f"registry/skills/{issue.skill_id}/versions/{issue.version}/SKILL.md"
+            try:
+                reg._git("checkout", "HEAD", "--", rel)
+                actions.append(RepairAction(issue, f"restored {rel} from git HEAD", True))
+            except RegistryError as e:
+                actions.append(RepairAction(issue, f"git restore failed: {e}", False))
+        elif issue.kind in ("host_missing", "host_drift") and host_dir is not None:
+            try:
+                reg.materialize(issue.skill_id, host_dir)
+                actions.append(RepairAction(issue, "re-materialized active version to host", True))
+            except RegistryError as e:
+                actions.append(RepairAction(issue, f"materialize failed: {e}", False))
+        # dangling_active / name_mismatch need judgment — left for the user.
+
+    remaining = check_registry(reg, host_dir)
+    return actions, remaining

super_skill/evallite.py

@@ -0,0 +1,93 @@
+"""eval-lite: the deterministic hard-gate layer (docs/04 §1.6, FR-EVAL-2).
+
+At personal scale (n=1–3, corpus <~150 cases) the deterministic layer is THE
+hard gate; the statistical layer (precision/recall, +5pp, bootstrap CI) is
+diagnostic only and needs a real corpus, so it is not run here. The four-arm
+protocol degrades to a No Skill / Skill two-arm — and at WS there is neither a
+golden corpus nor an agent harness to run it, so that arm is honestly labelled
+``Insufficient Evidence`` rather than skipped or faked (docs/04 §1.6 统计诚实).
+
+What is checked here, without an LLM: structure/schema, zero credential/PII leak
+in the SKILL.md text, and the agentskills body token budget. The instruction
+gate (§2.4bis) is a separate hard gate run first in ``candidate.approve``.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+from .redact import redact_text
+from .skillmd import SkillMdError, parse
+
+# agentskills.io: SKILL.md body should stay under ~5000 tokens. We have no
+# tokenizer at WS, so approximate (~0.75 words/token) — deliberately conservative.
+TOKEN_BUDGET = 5000
+_WORDS_PER_TOKEN = 0.75
+
+
+@dataclass(frozen=True)
+class EvalCheck:
+    name: str
+    passed: bool
+    detail: str = ""
+
+
+@dataclass
+class EvalReport:
+    checks: list[EvalCheck] = field(default_factory=list)
+    # The No Skill/Skill two-arm needs a corpus + harness we do not have at WS.
+    insufficient_evidence: bool = True
+
+    @property
+    def passed(self) -> bool:
+        """Deterministic hard gate: every check must pass (一票否决)."""
+        return all(c.passed for c in self.checks)
+
+    def failures(self) -> list[EvalCheck]:
+        return [c for c in self.checks if not c.passed]
+
+
+class EvalError(RuntimeError):
+    """Raised when the deterministic gate fails. Carries the report."""
+
+    def __init__(self, report: EvalReport) -> None:
+        self.report = report
+        names = ", ".join(c.name for c in report.failures())
+        super().__init__(f"eval-lite deterministic gate failed: {names}")
+
+
+def _approx_tokens(text: str) -> int:
+    return int(len(re.findall(r"\S+", text)) / _WORDS_PER_TOKEN)
+
+
+def eval_lite(raw: str) -> EvalReport:
+    """Run the deterministic hard-gate checks on a candidate SKILL.md."""
+    checks: list[EvalCheck] = []
+
+    # 1. structure / schema
+    try:
+        parsed = parse(raw)
+        checks.append(EvalCheck("schema", True, "frontmatter valid"))
+    except SkillMdError as e:
+        return EvalReport(checks=[EvalCheck("schema", False, str(e))])
+
+    # 2. zero credential / PII leak in the instruction text (凭据与 PII 泄漏 = 0)
+    text = f"{parsed.frontmatter.description}\n{parsed.body}"
+    _, counts = redact_text(text)
+    leaks = {k: c for k, c in counts.items() if k != "home_path"}
+    checks.append(
+        EvalCheck(
+            "no_secret_leak",
+            not leaks,
+            "clean" if not leaks else f"found {leaks}",
+        )
+    )
+
+    # 3. agentskills body token budget
+    tok = _approx_tokens(parsed.body)
+    checks.append(
+        EvalCheck("token_budget", tok < TOKEN_BUDGET, f"~{tok} tokens (limit {TOKEN_BUDGET})")
+    )
+
+    return EvalReport(checks=checks, insufficient_evidence=True)

super_skill/gate.py

@@ -0,0 +1,102 @@
+"""Instruction-layer adversarial gate (docs/04 §2.4bis) — WS rule-based form.
+
+v1's ONLY mandatory security gate. v1 candidates are pure text with no scripts,
+so the host Agent treats the SKILL.md body + description as TRUSTED instructions
+and runs them in the user's real session — outside any sandbox, with full
+credentials. A poisoned imperative distilled from captured content (dependency
+errors, READMEs, issues, web pages) is exactly the code×instruction seam that
+MalSkillBench shows single-tool scanners miss.
+
+This pass scans body + description for external-action imperatives. Per §2.4bis a
+T1 pure-text skill needs *higher*, not lower, injection scrutiny, so it errs
+toward flagging: a false positive costs one human edit; a miss ships a
+`curl | bash` to the host. The cross-modal (script↔manifest) and LLM-judge layers
+land at M1 — v1 candidates carry no scripts, so there is nothing to cross-check.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from .skillmd import parse
+
+# (category, pattern). Case-insensitive. Ordered most-severe first.
+_RULES: list[tuple[str, re.Pattern[str]]] = [
+    (
+        "pipe_to_shell",
+        re.compile(
+            r"(?i)\b(?:curl|wget|fetch)\b[^\n|]{0,200}\|\s*"
+            r"(?:bash|sh|zsh|python3?|node|ruby|perl|eval)\b"
+        ),
+    ),
+    (
+        "run_undeclared_script",
+        re.compile(
+            r"(?i)\beval\s*\(|\bexec\s*\(|\bos\.system\b|\bsubprocess\.\w+"
+            r"|\bchmod\s+\+x\b|\bsudo\b|\bnpx\s+\S|"
+            r"(?:run|execute)\s+(?:this|the\s+following|the\s+attached)\s+\w*\s*script"
+        ),
+    ),
+    (
+        "credential_access",
+        re.compile(
+            r"(?i)~/\.ssh|~/\.aws|\bid_rsa\b|\.env\b|\bprivate[_-]?key\b"
+            r"|\b(?:API[_-]?KEY|SECRET[_-]?KEY|ACCESS[_-]?KEY|AWS_SECRET_ACCESS_KEY)\b"
+            r"|\b(?:password|passwd)\b"
+        ),
+    ),
+    (
+        "network_fetch",
+        re.compile(
+            r"(?i)\b(?:curl|wget)\b"
+            r"|\b(?:download|fetch|retrieve)\b[^\n]{0,60}https?://"
+        ),
+    ),
+    (
+        "prompt_injection_override",
+        re.compile(
+            r"(?i)ignore\s+(?:all\s+)?(?:previous|prior|above)"
+            r"|disregard\s+(?:the\s+)?(?:above|previous|prior)"
+            r"|forget\s+(?:all\s+)?(?:previous|prior)"
+            r"|you\s+are\s+now\b|override\s+[^\n]{0,40}instructions"
+        ),
+    ),
+]
+
+
+@dataclass(frozen=True)
+class Finding:
+    category: str
+    location: str  # "description" | "body"
+    snippet: str
+
+
+class InstructionGateError(RuntimeError):
+    """Raised when the gate blocks a promotion. Carries the findings so callers
+    can report exactly what tripped it."""
+
+    def __init__(self, findings: list[Finding]) -> None:
+        self.findings = findings
+        cats = ", ".join(sorted({f.category for f in findings}))
+        super().__init__(f"instruction-layer gate blocked: {cats}")
+
+
+def scan_text(text: str, location: str) -> list[Finding]:
+    findings: list[Finding] = []
+    for category, pat in _RULES:
+        for m in pat.finditer(text):
+            snippet = " ".join(m.group(0).split())[:80]
+            findings.append(Finding(category=category, location=location, snippet=snippet))
+    return findings
+
+
+def scan_skill_md(raw: str) -> list[Finding]:
+    """Scan a SKILL.md's description + body for external-action imperatives.
+
+    description is scanned separately: §2.4bis forbids imperative / second-person
+    external-action language there (it would both win routing and inject)."""
+    parsed = parse(raw)
+    return scan_text(parsed.frontmatter.description, "description") + scan_text(
+        parsed.body, "body"
+    )

super_skill/hooks.py

@@ -0,0 +1,33 @@
+"""Claude Code hooks config generation (docs/03 WS: capture from day 1).
+
+Produces the ``hooks`` block that wires the six host events to
+``super-skill capture`` so real sessions accumulate into the WAL. We only
+*generate* the config — writing it into ``~/.claude/settings.json`` is the
+user's call (user-global config is §5 hard-AUTH), so ``super-skill hooks-config``
+prints it for the user to merge, rather than editing settings behind their back.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+# Events without a per-tool matcher fire once; PreToolUse/PostToolUse fire
+# per tool call and take a matcher.
+_EVENTS_NO_MATCHER = ("SessionStart", "UserPromptSubmit", "Stop", "SessionEnd")
+_EVENTS_WITH_MATCHER = ("PreToolUse", "PostToolUse")
+ALL_EVENTS = _EVENTS_NO_MATCHER + _EVENTS_WITH_MATCHER
+
+DEFAULT_COMMAND = "super-skill capture"
+
+
+def hooks_settings(command: str = DEFAULT_COMMAND) -> dict[str, Any]:
+    """Return a settings.json fragment: every host event piped to ``command``.
+
+    capture reads the hook JSON on stdin and never fails the session (NFR-3)."""
+    run = {"hooks": [{"type": "command", "command": command}]}
+    hooks: dict[str, list[dict[str, Any]]] = {}
+    for ev in _EVENTS_NO_MATCHER:
+        hooks[ev] = [dict(run)]
+    for ev in _EVENTS_WITH_MATCHER:
+        hooks[ev] = [{"matcher": "*", **run}]
+    return {"hooks": hooks}

super_skill/mine.py

@@ -0,0 +1,101 @@
+"""Coarse opportunity mining (docs/03 WS: "surface you solved X 3 times").
+
+Clusters captured events into task families by keyword bigrams shared across
+DISTINCT sessions, surfacing families that recur >=3 sessions — the FR-GEN-1
+primary signal. This is the WS heuristic; the M2 Opportunity Miner with weighted
+scoring (frequency/failure/verifier availability/...) is later.
+"""
+
+from __future__ import annotations
+
+import re
+from collections import defaultdict
+from collections.abc import Iterable
+from dataclasses import dataclass, field
+
+from .schemas import CaptureEvent
+
+_STOP = frozenset(
+    "the a an and or of to in on for with without into from at by is are was were be this"
+    " that these those it its as not no yes do did use used run running file files code"
+    " error add change fix fixed test tests value values case cases new get set".split()
+)
+
+# Hook-envelope keys the CLI dumps wholesale into payload. They are metadata, not
+# task content, and dominate families ("userpromptsubmit x", cwd-derived slugs) if
+# mined — coarse mining should read content, not the envelope.
+_ENVELOPE_KEYS = frozenset(
+    "hook_event_name session_id event_id transcript_path cwd permission_mode"
+    " timestamp consent_scope tool_name".split()
+)
+
+# Redaction leaves ``[REDACTED:kind]`` / ``~`` placeholders; drop the whole
+# placeholder so "redacted" and the kind name don't become mined tokens.
+_REDACTION_RE = re.compile(r"\[REDACTED:[^\]]*\]")
+
+
+def _tokens(text: str) -> list[str]:
+    text = _REDACTION_RE.sub(" ", text)
+    out = []
+    for t in re.sub(r"[^a-z0-9/_.\- ]", " ", text.lower()).split():
+        t = t.strip("-./_")
+        if len(t) >= 3 and not t.isdigit() and t not in _STOP:
+            out.append(t)
+    return out
+
+
+def _event_text(ev: CaptureEvent) -> str:
+    parts: list[str] = []
+
+    def walk(o: object) -> None:
+        if isinstance(o, str):
+            parts.append(o)
+        elif isinstance(o, dict):
+            for k, v in o.items():
+                if k not in _ENVELOPE_KEYS:  # skip envelope metadata, mine content
+                    walk(v)
+        elif isinstance(o, list):
+            for v in o:
+                walk(v)
+
+    walk(ev.payload)
+    return " ".join(parts)
+
+
+@dataclass
+class OpportunityFamily:
+    label: str
+    session_count: int
+    event_count: int
+    projects: set[str] = field(default_factory=set)
+
+
+def mine_families(
+    events: Iterable[CaptureEvent], *, min_sessions: int = 3
+) -> list[OpportunityFamily]:
+    """Return recurring keyword-bigram families sorted by session recurrence."""
+    bg_sessions: dict[str, set[str]] = defaultdict(set)
+    bg_events: dict[str, int] = defaultdict(int)
+    bg_projects: dict[str, set[str]] = defaultdict(set)
+
+    for ev in events:
+        toks = _tokens(_event_text(ev))
+        grams = {f"{toks[i]} {toks[i + 1]}" for i in range(len(toks) - 1)}
+        for g in grams:
+            bg_sessions[g].add(ev.session_id)
+            bg_events[g] += 1
+            if ev.project_id:
+                bg_projects[g].add(ev.project_id)
+
+    families = [
+        OpportunityFamily(
+            label=g,
+            session_count=len(s),
+            event_count=bg_events[g],
+            projects=bg_projects[g],
+        )
+        for g, s in bg_sessions.items()
+        if len(s) >= min_sessions
+    ]
+    families.sort(key=lambda f: (-f.session_count, -f.event_count))
+    return families

super_skill/minestate.py

@@ -0,0 +1,57 @@
+"""Mine watermark (D#67): remember how many distinct sessions had been captured
+the last time the user mined, so ``status``/``mine`` can nudge once enough new
+sessions have accumulated — "you solved X across N unmined sessions, run mine".
+
+Deliberately tiny: one JSON file in the state root, overwritten (never appended)
+each mine. Missing/corrupt reads as 0 so a fresh or hand-broken state degrades to
+"everything is unmined" rather than crashing a read-only status.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+_FILE = "mine_state.json"
+_DEFAULT_THRESHOLD = 3
+
+
+def reminder_threshold() -> int:
+    """Distinct unmined sessions before status nudges (env-overridable)."""
+    raw = os.environ.get("SUPER_SKILL_MINE_REMINDER")
+    if raw is None:
+        return _DEFAULT_THRESHOLD
+    try:
+        return int(raw)
+    except ValueError:
+        return _DEFAULT_THRESHOLD
+
+
+def _path(root: Path) -> Path:
+    return root / _FILE
+
+
+def mined_sessions(root: Path) -> int:
+    """Distinct-session count recorded at the last mine (0 if absent/corrupt)."""
+    p = _path(root)
+    if not p.exists():
+        return 0
+    try:
+        data = json.loads(p.read_text(encoding="utf-8"))
+        return int(data["mined_sessions"])
+    except (ValueError, KeyError, TypeError):
+        return 0
+
+
+def record_mined(root: Path, session_count: int) -> None:
+    """Persist the current distinct-session count as the new watermark."""
+    root.mkdir(parents=True, exist_ok=True)
+    _path(root).write_text(
+        json.dumps({"mined_sessions": session_count}), encoding="utf-8"
+    )
+
+
+def unmined(root: Path, current_sessions: int) -> int:
+    """Distinct sessions captured since the last mine (clamped at 0)."""
+    return max(0, current_sessions - mined_sessions(root))

super_skill/redact.py

@@ -0,0 +1,95 @@
+"""Regex redaction (WS degraded form of FR-CAP-2).
+
+Runs BEFORE anything is written to the WAL: secret VALUES never reach disk — only
+the kind and the field where one was found are recorded (FR-CAP-2, §8 SAFETY).
+This is the WS regex pass; the full M2 double-redaction + allowlist is later.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from collections.abc import Callable
+from typing import Any
+
+from .schemas import RedactionMark
+
+_HOME = os.path.expanduser("~")
+
+# (kind, pattern, group). Ordered specific -> generic; earlier wins on overlap.
+# group 0 = redact whole match; group N = redact only that capture, keep context.
+_PATTERNS: list[tuple[str, re.Pattern[str], int]] = [
+    ("private_key", re.compile(
+        r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----",
+        re.DOTALL,
+    ), 0),
+    ("anthropic_key", re.compile(r"sk-ant-[A-Za-z0-9_-]{16,}"), 0),
+    ("openai_key", re.compile(r"sk-[A-Za-z0-9]{20,}"), 0),
+    ("github_token", re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}"), 0),
+    ("aws_key", re.compile(r"AKIA[0-9A-Z]{16}"), 0),
+    ("slack_token", re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}"), 0),
+    ("bearer_token", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*"), 0),
+    ("assigned_secret", re.compile(
+        r"(?i)\b(?:api[_-]?key|secret|token|password|passwd|pwd|access[_-]?key)\b"
+        r"\s*[:=]\s*['\"]?([^\s'\"]{6,})",
+    ), 1),
+    ("email", re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b"), 0),
+]
+
+# Private home path -> ~ (not a secret, but FR-CAP-2 lists 私有路径).
+_HOME_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(re.escape(_HOME)),
+    re.compile(r"/home/[^/\s'\"]+"),
+    re.compile(r"/Users/[^/\s'\"]+"),
+]
+
+
+def redact_text(text: str) -> tuple[str, dict[str, int]]:
+    """Return (redacted_text, {kind: count}). Secret values are replaced with a
+    ``[REDACTED:kind]`` token; home paths collapse to ``~``."""
+    counts: dict[str, int] = {}
+
+    def _make_repl(kind: str, group: int, token: str) -> Callable[[re.Match[str]], str]:
+        def _r(m: re.Match[str]) -> str:
+            counts[kind] = counts.get(kind, 0) + 1
+            return token if group == 0 else m.group(0).replace(m.group(group), token)
+
+        return _r
+
+    for kind, pat, group in _PATTERNS:
+        text = pat.sub(_make_repl(kind, group, f"[REDACTED:{kind}]"), text)
+
+    # home paths collapse to ~ (private path, not a secret value)
+    for pat in _HOME_PATTERNS:
+        text = pat.sub(_make_repl("home_path", 0, "~"), text)
+
+    return text, counts
+
+
+def redact_payload(obj: Any, _path: str = "") -> tuple[Any, list[RedactionMark]]:
+    """Recursively redact all string leaves in a JSON-like structure, collecting
+    marks that record kind + dotted field path (never the value)."""
+    marks: list[RedactionMark] = []
+    if isinstance(obj, str):
+        red, counts = redact_text(obj)
+        marks.extend(
+            RedactionMark(kind=k, location=_path or "(root)", count=c)
+            for k, c in counts.items()
+        )
+        return red, marks
+    if isinstance(obj, dict):
+        out_d: dict[str, Any] = {}
+        for k, v in obj.items():
+            child = f"{_path}.{k}" if _path else str(k)
+            out_d[k], sub = redact_payload(v, child)
+            marks.extend(sub)
+        return out_d, marks
+    if isinstance(obj, list):
+        out_l: list[Any] = []
+        for i, v in enumerate(obj):
+            child = f"{_path}[{i}]"
+            rv, sub = redact_payload(v, child)
+            out_l.append(rv)
+            marks.extend(sub)
+        return out_l, marks
+    return obj, marks