- check_token refuses values with no lower-case letter (real tokens are mixed
case), so the kept upper-case-constant shape can never hold an accepted
token, even with a _SUFFIX appended.
- The token-shape pattern has no word boundary: a token is found after any
character (_OC..., /OC..., libOC...), and its run takes every following
token character, so an accepted token is always inside one match. Still
one run per match, linear (timing tests unchanged).
- Whole-token redaction runs before access_token= and Authorization
redaction, so OCaccess_token=123456 goes whole, prefix included.
The property test now also surrounds each accepted random token with random
printable-ASCII neighbours (and _FLAG, access_token=) and checks the output is
a start of the left side, one <redacted>, and an end of the right side.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
