lean_ctx/core/

redaction.rs

macro_rules! static_regex {
    ($pattern:expr_2021) => {{
        static RE: std::sync::OnceLock<regex::Regex> = std::sync::OnceLock::new();
        RE.get_or_init(|| {
            regex::Regex::new($pattern).expect(concat!("BUG: invalid static regex: ", $pattern))
        })
    }};
}

pub fn redaction_enabled_for_active_role() -> bool {
    let role = crate::core::roles::active_role();
    if role.role.name == "admin" {
        role.io.redact_outputs
    } else {
        // Contract: redaction never disabled for non-admin roles.
        true
    }
}

/// Redacts text bound for the model (tool output). Only this entry point
/// counts toward the value surface: persistence passes (`redact_text`) keep
/// secrets out of files, not out of the model context, and an already
/// redacted `[REDACTED:…]` marker never matches again, so nested passes over
/// one output do not double count.
pub fn redact_text_if_enabled(input: &str) -> String {
    if !redaction_enabled_for_active_role() {
        return input.to_string();
    }
    let (out, found) = redact_found(input, config_exclude_patterns().as_slice());
    let hits = found.len();
    // Engine metrics K21: fingerprints only, and only while sharing is on.
    if hits > 0 {
        crate::core::hive_signals::note_secrets(&found);
    }
    crate::core::security_events::note(
        crate::core::security_events::SecurityKind::SecretRedacted,
        hits,
    );
    out
}

/// #718: unquoted identifier or property-access chains (`SvelteKit`,
/// `inputEnv.POCKETBASE_SUPERUSER_PASSWORD`, `serverEnv.getStripeSecretKey`,
/// `confirmRequiredEndpointKeySchema`) are code REFERENCES to a secret, never
/// the literal value — the value lives in a gitignored `.env`. Digits make a
/// token secret-shaped (base64/hex), so any digit keeps the redaction
/// (conservative: `password=hunter2` stays covered).
/// #827: detect pure numeric values — integers, floats, scientific notation.
/// These are never secrets even when the key contains `token` or `key`.
fn looks_like_number(v: &str) -> bool {
    if v.is_empty() {
        return false;
    }
    let s = v.trim_start_matches(['+', '-']);
    if s.is_empty() {
        return false;
    }
    // Integer, float, or scientific notation (1.4e-06, 0.5, 600, 1e10)
    s.parse::<f64>().is_ok()
        && s.chars()
            .all(|c| c.is_ascii_digit() || c == '.' || c == 'e' || c == 'E' || c == '+' || c == '-')
}

fn looks_like_uuid(value: &str) -> bool {
    let value = value
        .trim()
        .trim_matches(|c| c == '"' || c == '\'' || c == '`' || c == '{' || c == '}');
    let groups: Vec<&str> = value.split('-').collect();
    groups.len() == 5
        && [8, 4, 4, 4, 12].iter().zip(&groups).all(|(len, group)| {
            group.len() == *len && group.chars().all(|ch| ch.is_ascii_hexdigit())
        })
}

/// #827: env-variable reference patterns that should not be redacted.
/// Matches: `os.environ/NAME`, `os.getenv("NAME")`, `process.env.NAME`,
/// `inputEnv.NAME`, `${NAME}`, `$NAME`, `%NAME%` (Windows).
fn is_env_reference(v: &str) -> bool {
    if v.starts_with("os.environ/")
        || v.starts_with("os.getenv(")
        || v.starts_with("process.env.")
        || v.starts_with("System.getenv(")
        || v.starts_with("ENV[")
        || v.starts_with("env(")
    {
        return true;
    }
    // Variable interpolation: ${VAR}, $VAR, %VAR%
    if (v.starts_with("${") && v.ends_with('}'))
        || (v.starts_with('$')
            && v[1..]
                .chars()
                .all(|c| c.is_ascii_alphanumeric() || c == '_'))
        || (v.starts_with('%') && v.ends_with('%') && v.len() > 2)
    {
        return true;
    }
    // Dotted identifier chains with an env-like prefix
    if let Some(prefix) = v.split('.').next() {
        let pl = prefix.to_ascii_lowercase();
        if matches!(
            pl.as_str(),
            "env" | "inputenv" | "serverenv" | "secrets" | "vars" | "environ"
        ) && v.contains('.')
        {
            return true;
        }
    }
    false
}

fn is_identifier_reference(value: &str) -> bool {
    let v = value.trim();
    if v.is_empty() || v.starts_with('"') || v.starts_with('\'') || v.starts_with('`') {
        return false;
    }
    // #827: env-variable reference patterns are not secrets.
    // `os.environ/MY_SERVICE_API_KEY`, `process.env.NAME`, `${VAR}`, `$VAR`.
    if is_env_reference(v) {
        return true;
    }
    if v.contains(|c: char| c.is_ascii_digit()) {
        return false;
    }
    v.split('.').all(|segment| {
        let mut chars = segment.chars();
        matches!(chars.next(), Some(c) if c.is_ascii_alphabetic() || c == '_' || c == '$')
            && chars.all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '$')
    })
}

/// #718: obvious provider-token placeholders, `your_key_here`,
/// `<insert-token>`) are documentation, not secrets — `.env.example` files
/// must survive ctx_read verbatim. #1831: so is an asterisk mask (`*****`),
/// which is what a redactor itself writes in place of a secret.
fn is_placeholder_value(value: &str) -> bool {
    let v = value
        .trim()
        .trim_matches(|c| c == '"' || c == '\'' || c == '`')
        .to_ascii_lowercase();
    if v.starts_with('<') && v.ends_with('>') {
        return true;
    }
    if !v.is_empty() && v.chars().all(|c| c == '*') {
        return true;
    }
    const MARKERS: &[&str] = &[
        "change_me",
        "change-me",
        "changeme",
        "example",
        "placeholder",
        "your_",
        "your-",
        "xxx",
        "dummy",
        "sample",
        "todo",
        "fixme",
        "replace_me",
        "replace-me",
        "redacted",
        "...",
        "…",
    ];
    MARKERS.iter().any(|m| v.contains(m))
}

/// Right-hand sides that look like `key: value` but are obviously not secrets:
/// TypeScript type annotations and language literals. Redacting these corrupts
/// source files read through `ctx_read` (GH #430), so the key/value rules skip
/// them. Compared case-insensitively after trimming surrounding quotes.
fn is_non_secret_literal(value: &str) -> bool {
    let v = value
        .trim()
        .trim_matches(|c| c == '"' || c == '\'' || c == '`');
    // #827: pure numbers (integer, float, scientific notation) are never secrets.
    // `input_cost_per_token: 1.4e-06` must not be redacted.
    if looks_like_number(v) {
        return true;
    }
    // Type expressions are never flat secret tokens: real keys/tokens are drawn
    // from `[A-Za-z0-9+/=_-]`, whereas type annotations carry angle brackets,
    // unions, arrays or call/object syntax. `password: Promise<string>` and
    // `apiKey: Record<string, unknown>` must survive ctx_read verbatim (GH #430).
    if v.contains(['<', '>', '|', '(', ')', '[', ']', '{', '}']) {
        return true;
    }
    matches!(
        v.to_ascii_lowercase().as_str(),
        "" | "undefined"
            | "null"
            | "none"
            | "nil"
            | "true"
            | "false"
            | "string"
            | "number"
            | "boolean"
            | "bigint"
            | "symbol"
            | "object"
            | "any"
            | "unknown"
            | "never"
            | "void"
            | "nan"
            | "date"
    ) || is_primitive_type_name(v)
}

/// Primitive type names of Rust, Go, Java and C-family languages. In
/// `const MAX_TOKEN: usize = 4` the "value" after `TOKEN:` is a type
/// annotation, never a credential; masking it corrupts every read of such a
/// source. Matched exactly (case-sensitive), so a password that merely
/// contains one of these words is still protected.
fn is_primitive_type_name(value: &str) -> bool {
    matches!(
        value,
        "bool"
            | "char"
            | "str"
            | "usize"
            | "isize"
            | "u8"
            | "u16"
            | "u32"
            | "u64"
            | "u128"
            | "i8"
            | "i16"
            | "i32"
            | "i64"
            | "i128"
            | "f32"
            | "f64"
            | "int"
            | "int8"
            | "int16"
            | "int32"
            | "int64"
            | "uint"
            | "uint8"
            | "uint16"
            | "uint32"
            | "uint64"
            | "uintptr"
            | "float"
            | "float32"
            | "float64"
            | "double"
            | "long"
            | "short"
            | "byte"
            | "rune"
            | "error"
            | "Self"
    )
}

/// One redaction rule: a labelled regex plus how the match is rebuilt.
struct Rule {
    label: &'static str,
    re: &'static regex::Regex,
    /// When set, group 1 is a prefix to keep and group 2 is the secret value;
    /// the match is left untouched if that value is a non-secret literal
    /// (`password: undefined`), an identifier reference
    /// (`serverEnv.getStripeSecretKey`) or a provider-token placeholder —
    /// see `is_benign_secret_value` (GH #430, #718).
    guard_value: bool,
}

/// Normalization used only for matching: remove invisible zero-width format
/// characters and fold full-width ASCII plus ideographic space to their ASCII
/// forms. Original text and byte boundaries are retained for span-only edits.
fn normalize_for_secret_matching(input: &str) -> (String, Vec<usize>) {
    let mut normalized = String::with_capacity(input.len());
    let mut original_boundaries = vec![0usize];

    for (start, ch) in input.char_indices() {
        let end = start + ch.len_utf8();
        let Some(folded) = fold_secret_match_char(ch) else {
            if let Some(boundary) = original_boundaries.last_mut() {
                *boundary = end;
            }
            continue;
        };
        let folded_len = folded.len_utf8();
        normalized.push(folded);
        for byte in 1..=folded_len {
            original_boundaries.push(if byte == folded_len { end } else { start });
        }
    }

    (normalized, original_boundaries)
}

fn fold_secret_match_char(ch: char) -> Option<char> {
    if matches!(
        ch,
        '\u{200b}' | '\u{200c}' | '\u{200d}' | '\u{2060}' | '\u{feff}'
    ) {
        return None;
    }
    Some(match ch {
        '\u{3000}' => ' ',
        '\u{ff01}'..='\u{ff5e}' => char::from_u32(ch as u32 - 0xfee0).unwrap_or(ch),
        _ => ch,
    })
}

/// A normalized view for detection-only callers that do not need span offsets.
pub(crate) fn normalize_secret_text(input: &str) -> String {
    input.chars().filter_map(fold_secret_match_char).collect()
}

/// The markers of the "Private key block" rule, as that rule spells them
/// (only a PRIVATE KEY END closes a block: a certificate's END does not).
const PRIVATE_KEY_KINDS: &str = r"(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE\s+KEY-----";

fn private_key_marker(end: bool) -> &'static regex::Regex {
    static HEADER: std::sync::OnceLock<regex::Regex> = std::sync::OnceLock::new();
    static END: std::sync::OnceLock<regex::Regex> = std::sync::OnceLock::new();
    let (cell, word) = if end {
        (&END, "END")
    } else {
        (&HEADER, "BEGIN")
    };
    cell.get_or_init(|| {
        regex::Regex::new(&format!(r"-----{word}\s+{PRIVATE_KEY_KINDS}"))
            .expect("BUG: invalid private-key marker")
    })
}

/// Whether `text`, normalized as the "Private key block" rule sees it,
/// holds a private-key header with no private-key END after it: the rule's
/// match would continue in the text that follows.
pub fn ends_inside_private_key_block(text: &str) -> bool {
    let normalized = normalize_secret_text(text);
    let last = |end: bool| {
        private_key_marker(end)
            .find_iter(&normalized)
            .last()
            .map(|found| found.start())
    };
    match (last(false), last(true)) {
        (Some(header), Some(end)) => header > end,
        (Some(_), None) => true,
        (None, _) => false,
    }
}

/// Whether `text`, normalized as the "Private key block" rule sees it,
/// holds a private-key END marker (the one the rule closes a block on).
pub fn contains_private_key_end(text: &str) -> bool {
    private_key_marker(true).is_match(&normalize_secret_text(text))
}

/// Whether the word after a bare `Bearer` is a credential rather than prose or a
/// placeholder. Precision matters on the default redaction path ("Bearer
/// authentication", "Bearer YOUR_TOKEN_HERE" must survive), but the identifier
/// heuristic cannot be used: an opaque base64 token can be letters only. A
/// credential is long and mixes character classes.
pub(crate) fn bearer_value_is_credential(value: &str) -> bool {
    let classes = [
        value.bytes().any(|b| b.is_ascii_uppercase()),
        value.bytes().any(|b| b.is_ascii_lowercase()),
        value.bytes().any(|b| b.is_ascii_digit()),
    ];
    value.len() >= 16
        && classes.iter().filter(|present| **present).count() >= 2
        && !is_placeholder_value(value)
}

/// Combined benign-value check for key/value secret rules (#430 + #718):
/// language literals and type annotations, unquoted identifier/property
/// references, and documentation placeholders are never redacted.
pub(crate) fn is_benign_secret_value(value: &str) -> bool {
    is_comparison_operator_residue(value)
        || is_non_secret_literal(value)
        || is_identifier_reference(value)
        || is_placeholder_value(value)
        || looks_like_uuid(value)
}

/// Benign-value check for a *quoted* value. A quoted string is a literal, never
/// an identifier reference, so that heuristic is skipped (`API_KEY="<letters>"`
/// is a credential). Literals, placeholders, UUIDs and plain numbers — digests,
/// counters, ids in JSON — stay benign.
pub(crate) fn is_benign_quoted_value(value: &str) -> bool {
    is_comparison_operator_residue(value)
        || is_non_secret_literal(value)
        || is_placeholder_value(value)
        || looks_like_uuid(value)
        || (!value.is_empty() && value.bytes().all(|b| b.is_ascii_digit()))
}

/// Whether a "Generic long secret" match is the slug of a knowledge fact's
/// own key: the value of a JSON member named exactly `key` (`"key":"…"` or
/// `"key": "…"`, the quoted form a serialized fact carries) that reads as
/// words. The rule fires on any 32+ character value after a name ending in
/// `key`, so every long fact key was masked — all to the same marker, which
/// merged distinct facts on export and import and broke the ids readers
/// derive from keys.
///
/// Nothing else is exempt: free text (`key: …`, `SIGNING_KEY=…`), any other
/// member name (`encryption_key`, `auth`, `credential`), and a value that
/// does not read as words stay masked. `prefix` is the rule's kept group
/// (the character before the name, the name, the separator).
///
/// Known residual risk: a passphrase made of real words joined by `-`
/// (diceware) stored as the value of a member named `key` reads as a slug
/// and is kept. A secret belongs under a secret's name, where it is masked.
pub(crate) fn is_fact_key_slug(prefix: &str, value: &str) -> bool {
    matches!(prefix, "\"key\":\"" | "\"key\": \"") && looks_like_word_slug(value)
}

/// Lowercase words and short numbers joined by `-`
/// (`governor-design-pull-forward-2026-10-29`): at least three parts, at
/// least two of them words, and at least half of the letter parts words; a
/// number has at most 8 digits (dates, years, counters — not a PIN or an
/// account number). A word has a vowel in at least a fifth of its letters
/// and no run of more than four consonants, or is a one-vowel word of five
/// to nine letters whose consonants before and after the vowel are a common
/// English onset and coda (`rights`, `scripts`, `strict`). A part that is
/// neither must be one of a fixed list of abbreviations (`mr`, `mcp`), which
/// do not count as words. Random letter groups (`qhztvbkr`, `xkq`) fail.
/// Any part with a digit beside letters, an upper-case letter or another
/// character fails the slug.
fn looks_like_word_slug(value: &str) -> bool {
    let parts: Vec<&str> = value.split('-').collect();
    let mut words = 0usize;
    let mut letter_parts = 0usize;
    let all_parts_ok = parts.iter().all(|part| {
        if !part.is_empty() && part.len() <= 8 && part.bytes().all(|b| b.is_ascii_digit()) {
            return true;
        }
        if part.len() < 2 || part.len() > 24 || !part.bytes().all(|b| b.is_ascii_lowercase()) {
            return false;
        }
        letter_parts += 1;
        let word = is_slug_word(part);
        words += usize::from(word);
        word || SLUG_ABBREVIATIONS.contains(part)
    });
    parts.len() >= 3 && all_parts_ok && words >= 2 && words * 2 >= letter_parts
}

/// Vowel-free abbreviations a fact key may carry. A fixed list: a rule for
/// "short and vowel-free" let random letter groups pass as abbreviations.
const SLUG_ABBREVIATIONS: &[&str] = &[
    "cd", "cdn", "cfg", "cmd", "csv", "ctx", "db", "dns", "gc", "grpc", "http", "js", "jwt", "mcp",
    "md", "ml", "mr", "msg", "npm", "pdf", "pkg", "png", "pr", "rs", "sql", "src", "ssh", "svg",
    "tls", "tmp", "ts", "ttl", "xml",
];

/// Consonants before the single vowel of a one-vowel word.
const SLUG_ONSETS: &[&str] = &[
    "", "b", "c", "d", "f", "g", "h", "j", "k", "l", "m", "n", "p", "q", "r", "s", "t", "v", "w",
    "x", "z", "bl", "br", "ch", "cl", "cr", "dr", "fl", "fr", "gl", "gr", "ph", "pl", "pr", "sc",
    "sh", "sk", "sl", "sm", "sn", "sp", "st", "sw", "th", "tr", "tw", "wh", "wr", "chr", "sch",
    "scr", "shr", "spl", "spr", "str", "thr",
];

/// Consonants after the single vowel of a one-vowel word.
const SLUG_CODAS: &[&str] = &[
    "bs", "ch", "ck", "cks", "ct", "cts", "ds", "ft", "fts", "ght", "ghts", "gs", "ks", "ld",
    "lds", "lf", "lk", "lks", "ll", "lls", "lm", "lp", "ls", "lt", "lts", "mp", "mps", "ms", "nch",
    "nd", "nds", "ng", "ngs", "ngth", "ngths", "nk", "nks", "ns", "nt", "nth", "nths", "nts", "ps",
    "pt", "pts", "rch", "rd", "rds", "rk", "rks", "rm", "rms", "rn", "rns", "rst", "rt", "rth",
    "rts", "sh", "sk", "sks", "sp", "ss", "st", "sts", "tch", "th", "ths", "ts", "ws", "x", "xt",
    "xts",
];

fn is_slug_word(part: &str) -> bool {
    let is_vowel = |b: u8| matches!(b, b'a' | b'e' | b'i' | b'o' | b'u' | b'y');
    let vowels = part.bytes().filter(|b| is_vowel(*b)).count();
    let mut run = 0usize;
    let mut longest_run = 0usize;
    for b in part.bytes() {
        run = if is_vowel(b) { 0 } else { run + 1 };
        longest_run = longest_run.max(run);
    }
    if vowels * 5 >= part.len() && longest_run <= 4 {
        return true;
    }
    if vowels != 1 || !(5..=9).contains(&part.len()) {
        return false;
    }
    let Some(at) = part.bytes().position(is_vowel) else {
        return false;
    };
    SLUG_ONSETS.contains(&&part[..at]) && SLUG_CODAS.contains(&&part[at + 1..])
}

/// #1095: when the regex `key=` consumes one `=` from `==`, the captured
/// "value" is a bare `=` (or `==`, `!=`). A comparison operator is never
/// a secret; redacting it corrupts source semantics.
fn is_comparison_operator_residue(value: &str) -> bool {
    let v = value.trim();
    matches!(v, "=" | "==" | "!=" | "<=" | ">=" | "===" | "!==")
}

/// The single source of truth for secret patterns. `shell::redact` delegates
/// here so the two layers can never drift apart again.
///
/// #718 word boundaries: the key/value alternations start with
/// `(?:^|[^a-z0-9])` (consumed into the kept prefix — the regex crate has no
/// lookbehind) so camelCase subwords (`superuserPassword`,
/// `getStripeSecretKey`) never trigger a rule, while SNAKE_CASE env names
/// (`GITHUB_FEEDBACK_TOKEN`) still do: `_` remains a permitted predecessor.
fn redaction_rules() -> Vec<Rule> {
    vec![
        Rule {
            label: "Bearer token",
            // Not the identifier guard (a letters-only base64 token is still a
            // credential); `bearer_value_is_credential` filters prose instead.
            re: static_regex!(r"(?i)(bearer[ \t]+)([a-zA-Z0-9_\-\.]{8,})"),
            guard_value: false,
        },
        Rule {
            label: "Authorization header",
            // Any token-character credential, however short: `Basic dTpw` (u:p) is
            // four characters. Token characters only, so adjacent text survives.
            re: static_regex!(
                r"(?i)(authorization[ \t]*:[ \t]*(?:basic|bearer|token)[ \t]+)([A-Za-z0-9._~+/=-]+)"
            ),
            guard_value: false,
        },
        // Whole token is the secret — no prefix group, so the entire match is
        // replaced. (Previously group 1 captured the key itself and leaked it.)
        Rule {
            label: "AWS key",
            re: static_regex!(r"(?:AKIA|ASIA)[0-9A-Z]{16}"),
            guard_value: false,
        },
        Rule {
            label: "Private key block",
            // No kept prefix: the whole block, markers included, is replaced.
            // A block without its END marker (a truncated file, a line window,
            // a log tail) is still masked: the header plus every following
            // key-material line — PEM headers of encrypted keys, then pure
            // base64 lines. The first other line (code, prose) ends it, so a
            // source that only mentions the header keeps the rest of the file.
            re: static_regex!(
                r"(?s)-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE\s+KEY-----(?:.+?-----END\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE\s+KEY-----|(?-s:[^\n]*)(?:\r?\n[A-Za-z-]+:(?-s:[^\n]*))*(?:\r?\n[A-Za-z0-9+/=]+[ \t]*(?m:$))*)"
            ),
            guard_value: false,
        },
        Rule {
            label: "GitHub token",
            re: static_regex!(r"(gh[pousr]_)[a-zA-Z0-9_]{20,}"),
            guard_value: false,
        },
        Rule {
            label: "GitHub fine-grained token",
            re: static_regex!(r"(github_pat_)[A-Za-z0-9_]{20,}"),
            guard_value: false,
        },
        Rule {
            label: "GitLab token",
            re: static_regex!(r"(glpat-)[A-Za-z0-9_\-]{20,}"),
            guard_value: false,
        },
        // Provider keys are masked whole — the prefix names the provider and
        // key class, so it is not kept. Same patterns as the detector, which
        // also matches them inside nested values without a `key=` prefix.
        Rule {
            label: "Anthropic API key",
            re: crate::core::secret_detection::anthropic_key_re(),
            guard_value: false,
        },
        Rule {
            label: "OpenAI API key",
            re: crate::core::secret_detection::openai_key_re(),
            guard_value: false,
        },
        Rule {
            label: "JWT",
            re: static_regex!(
                r"eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}(?:\.[A-Za-z0-9_\-]{8,})?"
            ),
            guard_value: false,
        },
        Rule {
            label: "Slack token",
            re: static_regex!(r"(xox[bpas]-)[0-9a-zA-Z\-]{10,}"),
            guard_value: false,
        },
        Rule {
            label: "Stripe key",
            re: static_regex!(r"([sr]k_live_)[0-9a-zA-Z]{10,}"),
            guard_value: false,
        },
        Rule {
            label: "npm token",
            re: static_regex!(r"(npm_)[A-Za-z0-9]{10,}"),
            guard_value: false,
        },
        // Key/value secrets run after provider-specific forms so `key=<AWS key id>`
        // retains the more precise provider class label.
        Rule {
            label: "API key param",
            re: static_regex!(
                r#"(?im)((?:^|[^a-z0-9])(?:aws[_-]?secret[_-]?access[_-]?key|secret[_-]?access[_-]?key|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|access[_-]?token|client[_-]?secret|token|password|passwd|pwd|secret)(?:\\?["'])?[ \t]*[=:][ \t]*(?:\\?["'])?)([^\s\r\n,;&"']+)"#
            ),
            guard_value: true,
        },
        Rule {
            label: "URL-encoded secret",
            re: static_regex!(
                r"(?im)((?:^|[^a-z0-9])(?:aws[_-]?secret[_-]?access[_-]?key|secret[_-]?access[_-]?key|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|access[_-]?token|client[_-]?secret|token|password|passwd|pwd|secret)[ \t]*[=:][ \t]*)(?:((?:%[0-9a-f]{2}|[A-Za-z0-9_\-]){20,}))"
            ),
            guard_value: true,
        },
        // Group 1 = prefix (kept), group 2 = the 32+ char value. Guarded since
        // #718: 32-char identifiers like `confirmRequiredEndpointKeySchema`
        // are references, not secrets.
        Rule {
            label: "Generic long secret",
            re: static_regex!(
                r#"(?im)((?:^|[^a-z0-9])(?:key|token|secret|password|credential|auth)(?:\\?["'])?[ \t]*[=:][ \t]*(?:\\?["'])?)([a-zA-Z0-9+/=\-_]{32,})"#
            ),
            guard_value: true,
        },
    ]
}

pub fn redact_text(input: &str) -> String {
    redact_text_with_excludes(input, &[])
}

thread_local! {
    /// The public key a package signature was verified with, while its
    /// document is being released on this thread.
    static VERIFIED_SIGNER_KEY: std::cell::RefCell<Option<String>> =
        const { std::cell::RefCell::new(None) };
}

/// Run `release` with `key` known as the Ed25519 PUBLIC key a package
/// signature has just been verified with. Inside, the built-in "Generic long
/// secret" rule — and only that rule — does not read the member
/// `"signer_public_key":"<key>"` (a bundle) or `"public_key":"<key>"` (a
/// package manifest's signature) as a secret: a public key is none, and the
/// rule fires on it only because a 64-digit value follows a name ending in
/// `key`. Every other rule, every configured pattern, every policy pack and
/// the gateway still see the original text with the real key in it and
/// decide as always. A `key` that is not 64 lowercase hex digits exempts
/// nothing.
pub fn with_verified_signer_key<T>(key: &str, release: impl FnOnce() -> T) -> T {
    let well_formed = key.len() == 64
        && key
            .bytes()
            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte));
    if !well_formed {
        return release();
    }
    struct Restore(Option<String>);
    impl Drop for Restore {
        fn drop(&mut self) {
            VERIFIED_SIGNER_KEY.with(|slot| *slot.borrow_mut() = self.0.take());
        }
    }
    let _restore = Restore(VERIFIED_SIGNER_KEY.with(|slot| slot.replace(Some(key.to_owned()))));
    release()
}

/// Whether the generic rule's match is the verified signer key in its own
/// member: `before` is the text up to the match, which starts at the `_` of
/// `_key`.
fn is_verified_signer_key(before: &str, value: &str) -> bool {
    (before.ends_with("\"signer_public") || before.ends_with("\"public"))
        && VERIFIED_SIGNER_KEY.with(|slot| slot.borrow().as_deref() == Some(value))
}

/// #718: `redact_text` with subtractive user patterns from
/// `[secret_detection].exclude_patterns` — a match covered by any exclude
/// regex is kept verbatim, so known-safe naming conventions can be carved out
/// without disabling secret detection wholesale.
pub fn redact_text_with_excludes(input: &str, excludes: &[regex::Regex]) -> String {
    redact_counting(input, excludes).0
}

/// Database URL with inline credentials: scheme (1), user (2, may be empty —
/// `redis://:pw@host`), password (3), host (4). The password runs to the last
/// `@` before the host, so an unencoded `@` in it cannot leak a tail. Shared
/// with the detector so both layers agree on what a credential is.
pub(crate) fn database_url_re() -> &'static regex::Regex {
    static_regex!(
        r"(?i)((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis)://)([^:/@?#\s]*):([^/?#\s]+)@([^@/?#\s]+)"
    )
}

/// True when a [`database_url_re`] match carries a real credential. A
/// placeholder password is not one, and neither is an already redacted
/// `scheme://[REDACTED:db_url]@host` — its `:` would otherwise read as
/// `user:password`, so a re-scan of redacted output found a "residual" secret
/// and the context gateway withheld the whole file.
pub(crate) fn database_url_has_credential(caps: &regex::Captures) -> bool {
    caps.get(2)
        .is_none_or(|user| !user.as_str().starts_with("[REDACTED"))
        && caps
            .get(3)
            .is_some_and(|password| !is_placeholder_value(password.as_str()))
}

/// [`redact_text_with_excludes`] plus the number of secrets it replaced.
///
/// One mask label per secret kind: the rule's own `label`, whoever asks. The
/// gateway's scanner (`secret_detection::scan_and_redact`) and a project
/// pack's built-in pass (`policy::content::evaluate_text`) both end here, so a
/// value masked by one is spelled exactly as the other would spell it and a
/// second pass over masked text changes nothing. (The scanner used to map the
/// labels to its pattern names — `[REDACTED:aws_key]` next to
/// `[REDACTED:AWS key]` — which made every order-of-masking comparison fail
/// for a built-in secret.)
fn redact_counting(input: &str, excludes: &[regex::Regex]) -> (String, usize) {
    let (out, found) = redact_found(input, excludes);
    (out, found.len())
}

/// The redacted text and the label of each redacted span (never its text).
fn redact_found(input: &str, excludes: &[regex::Regex]) -> (String, Vec<&'static str>) {
    let (normalized, boundaries) = normalize_for_secret_matching(input);
    let mut replacements = Vec::new();
    // The label of each replacement, index for index.
    let mut labels: Vec<&'static str> = Vec::new();

    // userinfo with a password in any other URL (`https://user:pw@host`): the
    // tokens elsewhere in such a URL were masked, the password stayed (focus
    // analysis 2026-10-15).
    let url_re = static_regex!(
        r"(?i)((?:https?|ftps?|sftp|ssh|amqps?|smtps?|ldaps?|wss?|git)://)([^:/@?#\s]+):([^@/?#\s]+)@([^/?#\s]+)"
    );
    for (re, label) in [
        (database_url_re(), "Database credentials"),
        (url_re, "URL credentials"),
    ] {
        for caps in re.captures_iter(&normalized) {
            let Some(whole) = caps.get(0) else {
                continue;
            };
            let start = boundaries[whole.start()];
            let end = boundaries[whole.end()];
            let original = input.get(start..end).unwrap_or(whole.as_str());
            if excluded(excludes, whole.as_str()) || excluded(excludes, original) {
                continue;
            }
            // A placeholder password or an already redacted URL is no
            // credential (shared with the detector, see `database_url_re`).
            if !database_url_has_credential(&caps) {
                continue;
            }
            let scheme = caps
                .get(1)
                .map_or("", |m| original_span(input, &boundaries, m));
            let host = caps
                .get(4)
                .map_or("", |m| original_span(input, &boundaries, m));
            replacements.push((start, end, format!("{scheme}[REDACTED:{label}]@{host}")));
            labels.push(label);
        }
    }

    for rule in redaction_rules() {
        for caps in rule.re.captures_iter(&normalized) {
            let Some(whole) = caps.get(0) else {
                continue;
            };
            let start = boundaries[whole.start()];
            let end = boundaries[whole.end()];
            let original = input.get(start..end).unwrap_or(whole.as_str());
            if excluded(excludes, whole.as_str()) || excluded(excludes, original) {
                continue;
            }
            // A quoted value is a literal, never an identifier reference, so the
            // benign-value guard does not apply to it.
            if rule.guard_value
                && let Some(value) = caps.get(2)
                && if is_quoted_at(&normalized, value.start()) {
                    is_benign_quoted_value(value.as_str())
                } else {
                    is_benign_secret_value(value.as_str())
                }
            {
                continue;
            }
            if rule.label == "Bearer token"
                && caps
                    .get(2)
                    .is_some_and(|value| !bearer_value_is_credential(value.as_str()))
            {
                continue;
            }
            if rule.label == "Generic long secret"
                && caps.get(2).is_some_and(|value| {
                    caps.get(1)
                        .is_some_and(|prefix| is_fact_key_slug(prefix.as_str(), value.as_str()))
                        || is_verified_signer_key(&normalized[..whole.start()], value.as_str())
                })
            {
                continue;
            }
            // Overlapping matches: the wider span wins. Skipping a wider match (a whole
            // private-key block) because a narrower rule already hit inside it would
            // leak the rest of the block.
            let overlapping: Vec<usize> = replacements
                .iter()
                .enumerate()
                .filter(|(_, (other_start, other_end, _))| start < *other_end && *other_start < end)
                .map(|(i, _)| i)
                .collect();
            if overlapping.iter().any(|&i| {
                let (other_start, other_end, _) = &replacements[i];
                *other_start <= start && end <= *other_end
            }) {
                continue;
            }
            let start = overlapping
                .iter()
                .map(|&i| replacements[i].0)
                .fold(start, usize::min);
            let end = overlapping
                .iter()
                .map(|&i| replacements[i].1)
                .fold(end, usize::max);
            for &i in overlapping.iter().rev() {
                replacements.remove(i);
                labels.remove(i);
            }

            let label = rule.label;
            let replacement = caps.get(1).map_or_else(
                || format!("[REDACTED:{label}]"),
                |prefix| {
                    let original_prefix = original_span(input, &boundaries, prefix);
                    format!("{original_prefix}[REDACTED:{label}]")
                },
            );
            replacements.push((start, end, replacement));
            labels.push(label);
        }
    }

    let mut spans: Vec<((usize, usize, String), &'static str)> =
        replacements.into_iter().zip(labels).collect();
    spans.sort_by_key(|((start, _, _), _)| *start);
    let mut found = Vec::with_capacity(spans.len());
    let mut out = input.to_string();
    for ((start, end, replacement), label) in spans.into_iter().rev() {
        found.push(label);
        out.replace_range(start..end, &replacement);
    }
    found.reverse();
    (out, found)
}

fn original_span<'a>(input: &'a str, boundaries: &[usize], matched: regex::Match<'_>) -> &'a str {
    let start = boundaries.get(matched.start()).copied().unwrap_or_default();
    let end = boundaries.get(matched.end()).copied().unwrap_or(start);
    input.get(start..end).unwrap_or("")
}

/// Whether the byte before `pos` in `text` is a quote (the value is a quoted literal).
fn is_quoted_at(text: &str, pos: usize) -> bool {
    pos > 0 && matches!(text.as_bytes()[pos - 1], b'"' | b'\'')
}

fn excluded(excludes: &[regex::Regex], value: &str) -> bool {
    excludes.iter().any(|pattern| pattern.is_match(value))
}

/// Compile the configured `exclude_patterns` (#718). Invalid regexes are
/// skipped — a broken exclude must never disable redaction.
///
/// #952: regex compilation — the expensive part of this call — used to run
/// on every redaction call (`ctx_read`, `ctx_shell`, `ctx_execute` all funnel
/// through `redact_text_if_enabled`) regardless of whether the config had
/// changed. Cached here, keyed on `Arc::ptr_eq` against the config `Arc`:
/// `Config::load_arc` returns the *same* `Arc` when the underlying config
/// content hash is unchanged, so a real config edit is exactly what
/// invalidates this cache too — no separate change-detection needed.
pub fn config_exclude_patterns() -> std::sync::Arc<Vec<regex::Regex>> {
    type Cache = Option<(
        std::sync::Arc<crate::core::config::Config>,
        std::sync::Arc<Vec<regex::Regex>>,
    )>;
    static CACHE: std::sync::Mutex<Cache> = std::sync::Mutex::new(None);

    let cfg = crate::core::config::Config::load_arc();

    if let Ok(guard) = CACHE.lock()
        && let Some((cached_cfg, patterns)) = &*guard
        && std::sync::Arc::ptr_eq(cached_cfg, &cfg)
    {
        return std::sync::Arc::clone(patterns);
    }

    let compiled = std::sync::Arc::new(
        cfg.secret_detection
            .exclude_patterns
            .iter()
            .filter_map(|p| regex::Regex::new(p).ok())
            .collect::<Vec<_>>(),
    );

    if let Ok(mut guard) = CACHE.lock() {
        *guard = Some((cfg, std::sync::Arc::clone(&compiled)));
    }

    compiled
}

/// Apply caller-supplied policy redaction patterns on top of the built-in
/// secret rules: each regex match becomes `[REDACTED:<label>]`. Returns the
/// transformed text and the number of redactions applied (for audit counts).
///
/// Used by context policy packs (GL #673) so a pack's `[redaction]` block
/// actually removes matching content from what the model sees. The patterns are
/// the pack's `[redaction]` entries, precompiled by
/// [`crate::core::policy::runtime`].
#[must_use]
pub fn redact_with_patterns(input: &str, patterns: &[(String, regex::Regex)]) -> (String, usize) {
    let mut out = input.to_string();
    let mut hits = 0usize;
    for (label, re) in patterns {
        let mut local = 0usize;
        out = re
            .replace_all(&out, |_caps: &regex::Captures| {
                local += 1;
                format!("[REDACTED:{label}]")
            })
            .to_string();
        hits += local;
    }
    (out, hits)
}

#[cfg(test)]
mod tests {
    use super::*;

    /// A package manifest's verified signature key is kept in its own
    /// member, as written or nested in an envelope; any other value there,
    /// and any key outside the exemption, is still masked.
    #[test]
    fn a_verified_package_signer_key_is_not_masked() {
        let key = "ab".repeat(32);
        let plain = format!(r#"{{"signature":{{"public_key":"{key}"}}}}"#);
        let nested = serde_json::to_string(&plain).expect("nested");
        assert!(
            !redact_text(&plain).contains(&key),
            "masked without the exemption"
        );
        with_verified_signer_key(&key, || {
            assert_eq!(redact_text(&plain), plain);
            assert_eq!(redact_text(&nested), nested);
            let other = plain.replace(&key, &"cd".repeat(32));
            assert_ne!(redact_text(&other), other, "only the verified key");
        });
    }

    #[test]
    fn standalone_provider_keys_are_fully_masked_in_nested_values() {
        let suffix = "aB3_".repeat(9);
        for prefix in ["sk-proj-", "sk-svcacct-", "sk-ant-"] {
            let secret = format!("{prefix}{suffix}");
            let raw = serde_json::json!({"nested":[secret.clone()]}).to_string();
            let safe = redact_text(&raw);
            assert!(!safe.contains(&suffix), "must mask the entire token");
            assert!(!safe.contains(prefix), "must not retain the secret prefix");
            assert!(safe.contains("REDACTED"));
            assert!(!crate::core::secret_detection::detect_secrets(&secret).is_empty());
        }
        assert_eq!(
            redact_text("sk-proj-your_key_here"),
            "sk-proj-your_key_here"
        );
    }

    // --- #952: exclude_patterns compilation cache ---

    #[test]
    fn config_exclude_patterns_reuses_compiled_regexes_when_config_unchanged() {
        // Other tests swap the config dir; "unchanged" needs the env lock.
        let _lock = crate::core::data_dir::test_env_lock();
        let first = config_exclude_patterns();
        let second = config_exclude_patterns();
        assert!(
            std::sync::Arc::ptr_eq(&first, &second),
            "unchanged config must reuse the cached compiled patterns, not recompile"
        );
    }

    #[test]
    fn redacts_bearer_token() {
        let s = "Authorization: Bearer abcdefghijklmnopqrstuvwxyz012345";
        let out = redact_text(s);
        assert!(out.contains("[REDACTED"));
        assert!(!out.contains("abcdefghijklmnopqrstuvwxyz"));
    }

    #[test]
    fn redacts_private_key_block() {
        let s = "-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----";
        let out = redact_text(s);
        assert!(out.contains("[REDACTED"));
        assert!(!out.contains("\nabc\n"));
    }

    /// A key cut off before its END marker — a line window, a truncated file,
    /// a log tail — is masked through its last key-material line; text before
    /// the header and code after the key material survive.
    #[test]
    fn redacts_a_truncated_private_key_but_not_the_code_around_it() {
        let s = concat!(
            "config:\n-----BEGIN RSA PRIVATE",
            " KEY-----\nProc-Type: 4,ENCRYPTED\nMIIEpAIBAAKCAQEA\nqx7Wmore"
        );
        let out = redact_text(s);
        assert!(out.starts_with("config:\n"), "{out}");
        assert!(out.contains("[REDACTED"), "{out}");
        for leaked in ["RSA PRIVATE", "Proc-Type", "MIIEpAIBAAKCAQEA", "qx7Wmore"] {
            assert!(!out.contains(leaked), "{leaked} leaked: {out}");
        }

        // A source that only names the header keeps the rest of the file.
        let source = concat!(
            "const HEADER: &str = \"-----BEGIN PRIVATE",
            " KEY-----\";\nfn parse(pem: &str) -> bool {\n    pem.starts_with(HEADER)\n}\n"
        );
        let out = redact_text(source);
        assert!(out.contains("fn parse(pem: &str) -> bool {"), "{out}");
        assert!(out.contains("pem.starts_with(HEADER)"), "{out}");
    }

    #[test]
    fn redacts_api_key_param_value() {
        let out = redact_text("password=hunter2-super-secret-value");
        assert!(
            out.contains("password=[REDACTED:API key param]"),
            "got: {out}"
        );
        assert!(!out.contains("hunter2"));
    }

    /// GH #430: TypeScript type annotations and language literals must NOT be
    /// redacted — over-eager masking corrupted source files read via ctx_read.
    #[test]
    fn keeps_non_secret_literals() {
        for s in [
            "password: undefined",
            "secret: string",
            "token: null",
            "apiKey: boolean",
            "password = false",
            "secret: any",
            "let pwd: number = 1",
        ] {
            assert_eq!(redact_text(s), s, "must not redact non-secret literal: {s}");
        }
    }

    /// GH #430: TS type annotations (generics, unions, arrays, function/object
    /// types) carry angle brackets / brackets that real secret tokens never do,
    /// so they must survive verbatim even when the key looks sensitive.
    #[test]
    fn keeps_type_annotations() {
        for s in [
            "password: Promise<string>",
            "apiKey: Record<string, unknown>",
            "token: string[]",
            "secret: () => void",
            "password: string | undefined",
            "credential: { value: string }",
        ] {
            assert_eq!(redact_text(s), s, "must not redact type annotation: {s}");
        }
    }

    /// A primitive type after a sensitive-looking name is a declaration, not
    /// a credential (`const ESTIMATED_CHARS_PER_TOKEN: u64 = 4;` was read
    /// back as `[REDACTED:API key param] = 4`). A value that merely contains
    /// a type name stays protected.
    #[test]
    fn keeps_primitive_type_declarations() {
        for s in [
            "const ESTIMATED_CHARS_PER_TOKEN: u64 = 4;",
            "const MAX_TOKEN: usize = 4;",
            "    max_token: u32,",
            "var Token int64",
            "secret: bool = false",
            "fn token(&self) -> Self",
            "private long token;",
        ] {
            assert_eq!(redact_text(s), s, "must not redact a type declaration: {s}");
        }
        let out = redact_text("password: usize4Hunter2");
        assert!(
            out.contains("[REDACTED"),
            "a real value stays masked: {out}"
        );
    }

    /// Whole-token secrets must be removed, not annotated in place — previously
    /// the closure kept group 1 (the key itself) and only appended `[REDACTED]`.
    #[test]
    fn fully_redacts_aws_key() {
        let aws_key = concat!("AK", "IAIOSFODNN7EXAMPLE");
        let out = redact_text(aws_key);
        assert!(!out.contains(aws_key), "AWS key leaked: {out}");
        assert!(out.contains("[REDACTED:AWS key]"));
    }

    #[test]
    fn fully_redacts_generic_long_secret() {
        // `credential=` is not covered by the API-key-param rule, so this
        // exercises the generic fallback (the previously leaky path).
        let secret = "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6"; // 32 chars
        let out = redact_text(&format!("credential={secret}"));
        assert!(!out.contains(secret), "long secret leaked: {out}");
        assert!(
            out.contains("credential=[REDACTED:Generic long secret]"),
            "got: {out}"
        );
    }

    #[test]
    fn redacts_github_token_keeping_prefix() {
        let github_token = concat!("gh", "p_", "abcdefghijklmnopqrstuvwxyz0123");
        let out = redact_text(github_token);
        assert!(
            out.starts_with(concat!("gh", "p_", "[REDACTED:GitHub token]")),
            "got: {out}"
        );
        assert!(!out.contains("abcdefghijklmnopqrstuvwxyz"));
    }

    // ── #718: benign identifier references, prose and placeholders ──

    /// Repro 1: prose that mentions a keyword must not have the following
    /// word redacted — "token: SvelteKit's…" is documentation, not a secret.
    #[test]
    fn keeps_prose_identifier_after_keyword() {
        let s = "the CSRF token: SvelteKit's native origin-check on form actions";
        assert_eq!(redact_text(s), s, "prose must survive verbatim");
    }

    /// Repro 2: camelCase subwords must not trigger the keyword alternation,
    /// and identifier/property-access RHS values are references, not secrets.
    #[test]
    fn keeps_identifier_and_property_references() {
        for s in [
            "superuserPassword: inputEnv.POCKETBASE_SUPERUSER_PASSWORD",
            "export const getStripeSecretKey = serverEnv.getStripeSecretKey;",
            "const apiKey = config.stripeApiKey",
        ] {
            assert_eq!(redact_text(s), s, "identifier reference redacted: {s}");
        }
    }

    /// Repro 3: a 32+ char identifier (Zod schema name) is a reference —
    /// "Generic long secret" needs the same value guard as the API-key rule.
    #[test]
    fn keeps_long_schema_identifier() {
        let s = "endpoint_key: confirmRequiredEndpointKeySchema,";
        assert_eq!(redact_text(s), s, "schema identifier must not be redacted");
    }

    /// Repro 4: obvious placeholder values (.env.example) are documentation.
    #[test]
    fn keeps_placeholder_values() {
        for s in [
            concat!("GITHUB_FEEDBACK_TOKEN=gh", "p_change_me"),
            "API_KEY=your_key_here",
            "password=<insert-password>",
            "SECRET_KEY=xxxxxxxx",
        ] {
            assert_eq!(redact_text(s), s, "placeholder redacted: {s}");
        }
    }

    /// #1830: a keyword with no value on its line must not take the next
    /// line's diff marker or key for its value.
    #[test]
    fn a_valueless_key_does_not_reach_into_the_next_line() {
        for s in [
            "+token:\n+  accesstoken: acc",
            "token:\n  refreshtoken: ref",
            "password =\n-  old_value",
            "Authorization: Bearer\nnext_line_word",
            "credential:\n  ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef012345",
        ] {
            assert_eq!(redact_text(s), s, "crossed a line break: {s:?}");
        }
        // The value on the key's own line is still redacted.
        let out = redact_text("token:\n  password: hunter2-real-value");
        assert!(!out.contains("hunter2"), "leaked: {out}");
        assert!(
            out.starts_with("token:\n  password: [REDACTED"),
            "got: {out}"
        );
    }

    /// #1831: an asterisk mask is what a redactor writes; it is not a secret,
    /// and a `full` read must round-trip it into an edit.
    #[test]
    fn keeps_asterisk_masks() {
        for s in [
            "password: *****",
            "password: ***",
            r#"expected := []string{"password: *****", "title: My Home"}"#,
            "token=*",
        ] {
            assert_eq!(redact_text(s), s, "mask redacted: {s}");
        }
        // A value that merely contains asterisks is not a mask.
        assert!(redact_text("password: ab*cd1234").contains("[REDACTED"));
    }

    #[test]
    fn key_value_redaction_never_crosses_a_line_break() {
        let samples = [
            concat!("token:", "\n", "refreshtoken: harmless"),
            concat!("Authorization: Bearer", "\n", "next_line_word"),
            concat!(
                "credential:",
                "\n  ",
                "ABCDEFGHIJKLMNOP",
                "QRSTUVWXYZabcdef",
                "012345"
            ),
        ];
        for s in samples {
            assert_eq!(redact_text(s), s, "redaction crossed a line: {s:?}");
        }
        let same_line_secret = ["token: ", "abc123", "def456", "ghi789"].concat();
        let out = redact_text(&same_line_secret);
        assert!(
            out.contains("[REDACTED:API key param]"),
            "same-line secrets must remain redacted: {out}"
        );
    }

    #[test]
    fn asterisk_masks_survive_redaction() {
        for s in [
            "password: *****",
            "password: ***",
            r#"expected := []string{"password: *****", "title: My Home"}"#,
            "token=*",
        ] {
            assert_eq!(redact_text(s), s, "mask changed: {s}");
        }
    }

    /// The flip side: real secret-shaped values must STILL be redacted after
    /// the #718 guards.
    #[test]
    fn still_redacts_real_secret_values() {
        // Digit-bearing value after a snake_case env name.
        let out = redact_text("GITHUB_TOKEN=ghpA1b2c3d4e5f6g7h8");
        assert!(!out.contains("ghpA1b2c3d4e5f6g7h8"), "leaked: {out}");
        // SNAKE_CASE env assignment with digits (the _ predecessor stays a
        // word boundary that MATCHES).
        let out = redact_text("MY_SECRET=abc123def456ghi789");
        assert!(!out.contains("abc123def456ghi789"), "leaked: {out}");
        // Quoted 32+ char literal: a quoted value is never an identifier
        // reference, so the Generic-long-secret guard keeps redacting it.
        let quoted = "key: 'abcdefghijklmnopqrstuvwxyzabcdef'";
        let out = redact_text(quoted);
        assert!(
            !out.contains("abcdefghijklmnopqrstuvwxyzabcdef"),
            "leaked: {out}"
        );
    }

    /// #718: exclude_patterns carve matches out subtractively.
    #[test]
    fn exclude_patterns_skip_matching_redactions() {
        let excludes = vec![regex::Regex::new(r"LCTX_TEST_\w+").unwrap()];
        let input = "token=LCTX_TEST_a1b2c3d4e5";
        assert_eq!(
            redact_text_with_excludes(input, &excludes),
            input,
            "excluded match must stay verbatim"
        );
        // Without the exclude the same value IS redacted (digits → secret).
        assert!(redact_text(input).contains("[REDACTED"));
    }

    #[test]
    fn identifier_and_placeholder_heuristics() {
        assert!(is_identifier_reference("serverEnv.getStripeSecretKey"));
        assert!(is_identifier_reference("confirmRequiredEndpointKeySchema"));
        assert!(is_identifier_reference("$scope._private"));
        assert!(!is_identifier_reference("abc123"), "digits → secret-shaped");
        assert!(!is_identifier_reference("\"quoted\""), "literal value");
        assert!(!is_identifier_reference("a-b"), "dash is not identifier");
        assert!(is_placeholder_value(concat!("gh", "p_change_me")));
        assert!(is_placeholder_value("<token>"));
        assert!(is_placeholder_value("your_api_key_123"));
        assert!(!is_placeholder_value("A1b2C3d4E5f6G7h8"));
    }

    #[test]
    fn policy_patterns_redact_with_label_and_count() {
        let patterns = vec![(
            "employee_id".to_string(),
            regex::Regex::new(r"EMP-\d{4}").unwrap(),
        )];
        let (out, hits) = redact_with_patterns("user EMP-1234 and EMP-5678", &patterns);
        assert_eq!(hits, 2);
        assert!(!out.contains("EMP-1234"));
        assert!(out.contains("[REDACTED:employee_id]"));
    }

    #[test]
    fn policy_patterns_noop_when_no_match() {
        let patterns = vec![("iban".to_string(), regex::Regex::new(r"CH\d{2}").unwrap())];
        let (out, hits) = redact_with_patterns("nothing sensitive here", &patterns);
        assert_eq!(hits, 0);
        assert_eq!(out, "nothing sensitive here");
    }

    /// GH #827: scientific notation and plain numbers after keys containing
    /// `token` must not be redacted — these are pricing/cost fields.
    #[test]
    fn keeps_numeric_values_827() {
        for (input, desc) in [
            ("input_cost_per_token: 1.4e-06", "scientific notation"),
            ("output_cost_per_token: 4.4e-06", "scientific notation"),
            (
                "cache_read_input_token_cost: 1.9e-07",
                "scientific notation",
            ),
            ("token: 600", "plain integer"),
            ("secret: 0.5", "decimal float"),
            ("api_key: 42", "small integer"),
            ("password: 3.14", "pi float"),
        ] {
            assert_eq!(
                redact_text(input),
                input,
                "must not redact numeric value ({desc}): {input}"
            );
        }
    }

    /// GH #827: env-variable references must not be redacted — they are
    /// pointers to secrets, not the secrets themselves.
    #[test]
    fn keeps_env_references_827() {
        for (input, desc) in [
            (
                "api_key: os.environ/MY_SERVICE_API_KEY",
                "Python os.environ/",
            ),
            ("secret: os.getenv(MY_KEY)", "Python os.getenv()"),
            ("token: process.env.API_TOKEN", "Node process.env"),
            (
                "password: inputEnv.POCKETBASE_SUPERUSER_PASSWORD",
                "inputEnv dot ref",
            ),
            ("api_key: ${MY_API_KEY}", "shell interpolation ${}"),
            ("secret: $MY_SECRET", "shell $VAR"),
            ("token: %API_TOKEN%", "Windows %VAR%"),
            ("api_key: ENV[API_KEY]", "Ruby ENV[]"),
            ("secret: env(SECRET_KEY)", "Laravel env()"),
            ("password: System.getenv(DB_PASS)", "Java System.getenv"),
        ] {
            assert_eq!(
                redact_text(input),
                input,
                "must not redact env ref ({desc}): {input}"
            );
        }
    }

    /// GH #827: real secrets must STILL be redacted (regression guard).
    #[test]
    fn still_redacts_real_secrets_827() {
        for input in [
            "api_key: sk-1234567890abcdef1234567890abcdef",
            "password: hunter2-super-secret-value",
            "token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature",
        ] {
            let out = redact_text(input);
            assert!(
                out.contains("[REDACTED"),
                "must redact real secret: {input} -> {out}"
            );
        }
    }

    /// GH #1095: `token == ""` in Go source must not be redacted — the regex
    /// consumes the first `=` leaving group 2 = `=` (comparison residue).
    #[test]
    fn keeps_comparison_operators_in_source() {
        for s in [
            r#"if token == "" {"#,
            r#"if token, err = checkPulsares(); token == "" || err != nil {"#,
            r#"if password != "" {"#,
            r"assert secret == expected_value",
        ] {
            assert_eq!(redact_text(s), s, "comparison operator corrupted: {s}");
        }
    }

    /// A knowledge fact's own key is a slug, not a secret: every long one
    /// was masked to the same marker, merging distinct facts on export and
    /// import. Only that member, in its quoted JSON form, with words for
    /// parts, is kept; every other place and shape stays masked.
    #[test]
    fn only_a_word_slug_as_a_fact_key_is_kept() {
        for kept in [
            r#"{"key":"governor-design-pull-forward-2026-10-29"}"#,
            r#"{"key": "hive-desktop-knowledge-speed-round-one"}"#,
            // Words with one vowel in six or seven letters, abbreviations.
            r#"{"key":"gotcha-code-reviewer-no-probe-rights"}"#,
            r#"{"key":"hive-mr-ci-scripts-strict-backlog-check"}"#,
        ] {
            assert_eq!(redact_text(kept), kept);
        }
        let masked_cases = [
            // Random letter groups, a hex digest, a long number.
            r#"{"key":"qhztvbkr-plmnwxsd-rtvbnmkl-zxcvbnml"}"#.to_owned(),
            r#"{"key":"deadbeef-cafebabe-facefeed-0123456789"}"#.to_owned(),
            format!(r#"{{"key":"my-pin-{}"}}"#, "4".repeat(26)),
            // Mostly vowel-free groups: abbreviations do not make a slug.
            r#"{"key":"zxq-vbk-pwm-rtk-qzx-bnm-lkj-word-also"}"#.to_owned(),
            // A slug under any other name, or in free text.
            r#"{"auth":"governor-design-pull-forward-2026-10-29"}"#.to_owned(),
            r#"{"credential":"governor-design-pull-forward-2026-10-29"}"#.to_owned(),
            r#"{"encryption_key":"correct-horse-battery-staple-orbit-lamp"}"#.to_owned(),
            "SIGNING_KEY=governor-design-pull-forward-2026-10-29".to_owned(),
            "MASTER_KEY=governor-design-pull-forward-2026-10-29".to_owned(),
            "key: hive-desktop-knowledge-speed-round-one".to_owned(),
        ];
        for masked in masked_cases {
            assert!(redact_text(&masked).contains("[REDACTED"), "{masked}");
        }
    }

    /// The fact-key exemption must not let random keys through: lowercase
    /// letter groups joined by `-` under a JSON `key` member stay masked by
    /// the redactor and found by secret detection (`high_entropy_secret`,
    /// 40+ characters) about as often as before the exemption existed
    /// (at most ~4% of a shape reads as words). Seeded, so deterministic.
    #[test]
    fn random_lowercase_keys_under_a_key_member_stay_masked() {
        let mut state = 0x9e37_79b9_7f4a_7c15_u64;
        let mut letter = || {
            state ^= state << 13;
            state ^= state >> 7;
            state ^= state << 17;
            char::from(b'a' + u8::try_from(state % 26).unwrap_or(0))
        };
        let mut random_key = |groups: usize, size: usize| {
            (0..groups)
                .map(|_| (0..size).map(|_| letter()).collect::<String>())
                .collect::<Vec<_>>()
                .join("-")
        };
        const SAMPLES: usize = 2000;
        const MAX_KEPT: usize = SAMPLES * 6 / 100;
        for (groups, size) in [(8, 4), (9, 3), (12, 2), (5, 6)] {
            let kept = (0..SAMPLES)
                .filter(|_| {
                    let doc = format!(r#"{{"key":"{}"}}"#, random_key(groups, size));
                    !redact_text(&doc).contains("[REDACTED")
                })
                .count();
            assert!(
                kept <= MAX_KEPT,
                "{groups}x{size}: {kept} of {SAMPLES} random keys kept"
            );
        }
        for (groups, size) in [(10, 4), (11, 3), (14, 2), (6, 6)] {
            let missed = (0..SAMPLES)
                .filter(|_| {
                    let doc = format!(r#"{{"key":"{}"}}"#, random_key(groups, size));
                    crate::core::secret_detection::detect_secrets(&doc).is_empty()
                })
                .count();
            assert!(
                missed <= MAX_KEPT,
                "{groups}x{size}: {missed} of {SAMPLES} random keys undetected"
            );
        }
    }
}