Tell a version pin from a credential by value and word boundary, not case

[christophergeyer]

Reverts #299 and the 0.4.6 filter change, then fixes the bug they were both aiming at.

Neither shipped fix worked, and both cost redaction coverage on the way. Measured over a 325-case corpus run against each version of the filter:

	0.4.5	0.4.6	0.4.7 (#299)	this branch
version pins broken	3	1	1	0
credentials missed	4	6	4	4
regressions vs 0.4.5	—	3	42	0

What went wrong twice

Both fixes read "a package version got redacted" as a question about which names look like credentials, and narrowed the name pattern to exclude package names.

0.4.6 dropped IGNORECASE wholesale. api_key=, hf_token= and authtoken= stopped being redacted at all — a leak 0.4.5 caught. It also fixed only the name==version string form, leaving {"name": "version"} broken, which is the form the record actually serializes.

0.4.7 (#299) replaced that with three casing branches — UPPERCASE, delimited-lowercase, camelCase. 42 credential names that 0.4.5 redacted stopped being redacted:

Hf_Token=  MyToken  Api_Key  APIKey  Github_Token  TOKEN_my  secretValue
and the bare Token / Key / Secret / Password / Credential forms

And adding - to the delimiter set to catch api-key simultaneously pulled in the *-auth package family, so in the serialized form:

{"google-auth": "2.35.0"}  ->  {"google-auth": "[REDACTED]"}

google-auth is a transitive dependency of tensorboard, gcsfs and google-cloud-storage. That is the original bug, in the same serialization, reintroduced by its own fix.

The discriminator is not case

Two guards, 18 lines of code:

Word boundary. The keyword must be its own word within the name — bounded by a delimiter, a case transition, or an edge. api_key and MyToken qualify. tiktoken and tokenizer are single words that merely contain one. This is what keeps --tokenizer=gpt2 executable in a recorded command.

Version guard. A PEP 440 version is never a credential. This is what spares google-auth, dj-rest-auth and social-auth-core, whose names genuinely do carry a delimited keyword and which no name-only pattern can get right.

Because both work on structure rather than case, the pattern no longer excludes any casing — which is why every name 0.4.5 caught is caught again, with no false positives added.

Tests

Consolidated 208 lines / 22 cases into 133 lines / 76 cases. Nine functions became five table-driven ones sharing a forms() helper that asserts each case in all four serializations the record is written in: name==version, name=version, {"name": "version"}, and the escaped JSON nested inside a serialized command.

The integration case now runs through filter_metadata rather than filter_string. That substitution is the entire reason 0.4.6 shipped broken — the string form passed while the published record was still wrong.

They fail against every prior version: 0.4.5 (44 failed), 0.4.6 (46), 0.4.7 (37).

Not addressed here

Pre-existing, unchanged by this branch, tracked separately:

• URL credential rules enumerate schemes, so postgresql://, mongodb+srv:// and rediss:// leak; postgres:// matches but postgresql:// does not.
• Bare-userinfo form (scheme://TOKEN@host) leaks for every scheme except https/ssh/git.
• Provider value-shapes cover only hf_, ghp_, sk-, AKIA; gho_, xoxb-, AIza, ya29., npm_, glpat-, dckr_pat_ and JWTs pass through.
• A redacted URI is not parseable — [REDACTED] in userinfo makes urlparse raise, because the brackets read as an IPv6 literal.

Verification

3 failed, 2595 passed, 9 skipped. The 3 failures are pre-existing and environmental; confirmed identical at 12e6d04 in a worktree. ruff and mypy clean.