@basein/runner 0.2.11 → 0.3.0

package/dist/record/redact.js

@@ -4,47 +4,649 @@
  * The proxy sits on the credential path for every wrapped server (§9), and every
  * argument and result it sees crosses a process boundary and then the network.
  * So redaction runs on the recording copy of both arguments *and* results,
- * before the step report is even queued.
+ * before the step report is even queued — and once more, as the last line of
+ * defence, on every free-text field `RemoteRecorder` sends (the prompt, the
+ * answer, the reasoning, error messages), because those never pass through a
+ * structured payload at all.
  *
  * Three rules, in the order they fire:
- *   1. **By key.** A value under a key matching {@link SECRET_KEY} is replaced
- *      wholesale, whatever its type. `authorization: { scheme, token }` loses
- *      both halves, because the object as a whole is the secret.
+ *   1. **By key.** A value under a key that names a secret ({@link isSecretKey})
+ *      is replaced wholesale, whatever its type. `authorization: { scheme, token }`
+ *      loses both halves, because the object as a whole is the secret.
  *   2. **`env` blocks.** An object under an `env` key has *every* value replaced.
  *      MCP server configs put credentials there under arbitrary names, so no key
  *      pattern would catch them.
- *   3. **By shape.** A string that looks like a bearer token, a JWT, an
- *      `sk-`/`ghp_`-style key or an AWS access key id is replaced wherever it
- *      appears — including inside free text, where key-matching cannot reach.
+ *   3. **By shape.** A string that looks like a credential — a bearer token, a
+ *      JWT, a provider key, a PEM private key, a password in a URL, a
+ *      `DB_PASSWORD=…` line of a `.env` file, an `X-Api-Key:` header — is
+ *      replaced wherever it appears, including inside free text, where key
+ *      matching cannot reach. Reading `.env` or `~/.aws/credentials` is a routine
+ *      thing for an agent to do; its result is recorded like any other.
+ *
+ * KEYS ARE MATCHED ON WHOLE NAME SEGMENTS, not substrings. The old rule was one
+ * unanchored alternation, so `author`, `max_tokens`, `nextPageToken` and
+ * `tokenizer` were all "secrets" — the recording lost real arguments (numbers
+ * became the string "[redacted]") and a scenario built from it had nothing to
+ * replay. Names are split on camelCase, snake_case, kebab-case and dots, and a
+ * segment has to *be* the secret word (`token`, `accessToken`, `x-api-key`), not
+ * merely contain it. The names 0.2.12's substring rule caught that do hold
+ * credentials are still caught: plurals (`tokens`, `api_keys`), an `auth` that
+ * ends the name (`basic_auth`, `X-Upstream-Auth`), `oauth`, `authentication`,
+ * `auth_code` — and a number under the secret itself (`token: 482913`, an OTP).
+ *
+ * TEXT RULES ARE ANCHORED TO WHERE SECRETS ARE WRITTEN, not to every
+ * `name = value` in sight. A recorded Read of source code must survive: its
+ * bytes are what a scenario's output logic is authored against, and
+ * `const token = await getToken()` is not a secret. So assignments are only
+ * redacted in env/ini/YAML line form, shell `NAME=value` form, header form and
+ * JSON `"key": "value"` form, and never when the value is visibly code (a call,
+ * a member access, a `${reference}`, a type in a declaration such as
+ * `password: string`, or a variable named for the same thing such as
+ * `token: newToken`). A separator never spans a line break: an empty
+ * `DB_PASSWORD=` must not take the next line with it.
+ *
+ * JSON TEXT IS REDACTED AS JSON. A serialized tool payload goes through
+ * {@link redactJsonText}, which parses it and runs the rules on each string
+ * leaf — the same pass its producer's {@link redact} made — so the result is
+ * always valid JSON and, when nothing new was found, the producer's bytes
+ * exactly (live replay serializes a result the same way and compares). The
+ * rules still tolerate JSON-escaped text (a string leaf that holds a JSON
+ * document, a preview of one): they never start a match inside an escape
+ * sequence and never replace a quote or a backslash, so an escaped document
+ * stays parseable.
  *
  * Redaction never throws and never mutates its input: a cycle, a `BigInt`, a
  * getter that explodes — each degrades to a placeholder rather than losing the
  * step or, worse, taking the session down.
  */
+import { truncateString } from "./truncate.js";
 export const REDACTED = "[redacted]";
-/** Keys whose values are secret regardless of shape. */
+/**
+ * The substring rule this module used before key segments. Kept exported for
+ * anything that imported it, and applied again under `BIR_REDACT_LEGACY_KEYS=1`.
+ *
+ * @deprecated over-matches ordinary names (`author`, `max_tokens`); use {@link isSecretKey}.
+ */
 export const SECRET_KEY = /(token|secret|password|passwd|api[_-]?key|apikey|authorization|auth|cookie|session[_-]?id|credential|private[_-]?key|access[_-]?key|client[_-]?secret)/i;
 /** Keys whose *children* are all secret (values only — the names stay). */
 const ENV_KEY = /^env(ironment)?$/i;
-/** Value shapes that are secret wherever they appear, including inside prose. */
+/**
+ * A string leaf longer than this is cut before its shapes are scanned. Every
+ * consumer caps a recorded payload far below it (64 KiB), so the cut is never
+ * visible in what is sent — it only stops a 20 MB tool result from costing a
+ * few hundred milliseconds of regex work on a hook's path.
+ */
+export const REDACT_SCAN_MAX_CHARS = 256 * 1024;
+// ── keys ──────────────────────────────────────────────────────────────────
+/** Split a name into lower-case segments: camelCase, snake_case, kebab-case, dots. */
+function segments(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .toLowerCase()
+        .split(/[\s_\-.:/]+/)
+        .filter(Boolean);
+}
+/**
+ * A last segment that makes a secret-sounding name a *description* of the
+ * secret rather than the secret: `tokenCount`, `secretName`, `passwordFile`,
+ * `api_key_env`. Their values are numbers, names and paths.
+ */
+const NEUTRAL_TAILS = new Set([
+    "count", "counts", "limit", "limits", "usage", "used", "budget", "type", "types",
+    "length", "len", "size", "estimate", "total", "index", "name", "names", "domain",
+    "path", "paths", "file", "files", "dir", "url", "uri", "endpoint", "enabled",
+    "disabled", "required", "provider", "method", "mode", "format", "env", "var",
+    "variable", "policy", "ttl", "expiry", "lifetime", "rotation", "hint", "label",
+]);
+/**
+ * A `token` (or `tokens`) after one of these is a pagination cursor or a
+ * counter, not a credential: `page_token`, `max_tokens`, `cached_tokens`.
+ */
+const NON_SECRET_TOKEN_QUALIFIERS = new Set([
+    "page", "next", "continuation", "pagination", "sync", "cursor", "max", "min",
+    "num", "input", "output", "prompt", "completion", "total", "reasoning", "cache",
+    "cached",
+]);
+/** The same words run together into one segment: `maxtokens`, `cachedtokens`. */
+const NON_SECRET_TOKENS_COMPOUND = new RegExp(`^(?:${[...NON_SECRET_TOKEN_QUALIFIERS].join("|")})tokens$`);
+/** `<qualifier> key` pairs that are credentials: `api key`, `private key`, … */
+const KEY_QUALIFIERS = new Set([
+    "api", "access", "private", "secret", "encryption", "signing", "master",
+    "account", "client", "app", "license", "subscription", "service", "shared",
+    "session", "auth",
+]);
+/** Keys that are secret only as the whole name. */
+const WHOLE_KEYS = new Set(["auth", "pass", "pwd", "dsn", "jwt", "bearer", "otp"]);
+/**
+ * What may follow `oauth` / `authentication` / `auth code` and make the name a
+ * description rather than the secret, besides {@link NEUTRAL_TAILS}:
+ * `oauth_scopes`, `authenticationStatus`, the `Authentication-Results` mail
+ * header. Only for these words: `tokenStatus` could still hold a token.
+ */
+const AUTH_DESCRIPTOR_TAILS = new Set([
+    "scope", "scopes", "status", "result", "results", "scheme", "schemes", "flow", "error", "errors",
+]);
+/** A one-time code, as the last segment: `otp`, `mfa_otp`, `totp`, `passcode`. */
+const ONE_TIME_CODES = new Set(["otp", "totp", "hotp", "passcode"]);
+/**
+ * Verdicts by key. A 50k-row result repeats the same handful of keys 50k
+ * times, and splitting each one into segments again made redaction several
+ * times slower than the payload is worth. Bounded, and simply cleared when full.
+ */
+const keyVerdicts = new Map();
+const KEY_CACHE_MAX = 5_000;
+/**
+ * `BIR_REDACT_LEGACY_KEYS=1` also applies the old substring rule, for anyone
+ * who preferred over-redaction (`author`, `max_tokens` lost) to the new
+ * segment matching. Never less redaction than today's rules.
+ */
+const LEGACY_KEYS = process.env.BIR_REDACT_LEGACY_KEYS === "1";
+export function secretKeyStrength(name) {
+    const cached = keyVerdicts.get(name);
+    if (cached !== undefined)
+        return cached ?? undefined;
+    const verdict = judgeKey(name) ?? (LEGACY_KEYS && SECRET_KEY.test(name) ? "strong" : undefined);
+    if (keyVerdicts.size >= KEY_CACHE_MAX)
+        keyVerdicts.clear();
+    keyVerdicts.set(name, verdict ?? null);
+    return verdict;
+}
+function judgeKey(name) {
+    const key = name.trim();
+    if (!key)
+        return undefined;
+    const lower = key.toLowerCase();
+    const segs = segments(key);
+    if (segs.length === 0)
+        return undefined;
+    const last = segs[segs.length - 1];
+    const neutral = segs.length > 1 && NEUTRAL_TAILS.has(last);
+    if (WHOLE_KEYS.has(lower))
+        return "strong";
+    // Substring on purpose: `pgpassword`, `dbPasswd`, `keyPassphrase`.
+    if (/pass(word|wd|phrase)/.test(lower))
+        return neutral ? undefined : "strong";
+    if (neutral)
+        return undefined;
+    for (let i = 0; i < segs.length; i++) {
+        const s = segs[i];
+        const prev = i > 0 ? segs[i - 1] : "";
+        const next = segs[i + 1] ?? "";
+        // The secret itself is the last segment (`mfa_token`, `api_key`); a
+        // segment further in is something about it (`token_id`), and keeps numbers.
+        const itself = i === segs.length - 1 ? "strong" : "weak";
+        if (s === "secret" || s === "secrets" || (s.length > 6 && s.endsWith("secret")))
+            return "strong";
+        if (s === "credential" || s === "credentials" || /[a-z]credentials?$/.test(s))
+            return "strong";
+        if (s === "authorization" || s === "cookie" || s === "cookies")
+            return "strong";
+        if (s === "connectionstring" || (s === "connection" && next === "string"))
+            return "strong";
+        if (s === "conn" && next === "str")
+            return "strong";
+        if (s === "private" && (next === "key" || next === "keys"))
+            return "strong";
+        if (s === "privatekey" || s === "secretkey" || s === "privatekeys" || s === "secretkeys")
+            return "strong";
+        if (s === "token" || (s.length > 5 && s.endsWith("token"))) {
+            if (s === "token" && NON_SECRET_TOKEN_QUALIFIERS.has(prev))
+                continue;
+            if (/^(page|next|continuation|pagination|sync|max|min)token$/.test(s))
+                continue;
+            return itself;
+        }
+        // A list of them — `tokens`, `refreshTokens`, `api_keys` — is as secret as
+        // one, but a number there is a count (`tokens: 1234` in an LLM's usage).
+        if (s === "tokens" || (s.length > 6 && s.endsWith("tokens"))) {
+            if (s === "tokens" && NON_SECRET_TOKEN_QUALIFIERS.has(prev))
+                continue;
+            if (NON_SECRET_TOKENS_COMPOUND.test(s))
+                continue;
+            return "weak";
+        }
+        if (s === "key" && KEY_QUALIFIERS.has(prev))
+            return prev === "session" ? "weak" : itself;
+        if (s === "keys" && KEY_QUALIFIERS.has(prev))
+            return "weak";
+        if (/^(api|access|auth|encryption|signing|master|account|client|app|license|subscription)key$/.test(s))
+            return itself;
+        if (/^(api|access|auth|encryption|signing|master|account|client|app|license|subscription|session)keys?$/.test(s)) {
+            return "weak";
+        }
+        if (s === "session" && (next === "id" || next === "key"))
+            return "weak";
+        if (s === "sessionid" || s === "sessid" || s === "phpsessid")
+            return "weak";
+        if (s === "auth") {
+            // The credential an `auth` names: `basic_auth`, `httpAuth`, `X-Upstream-Auth`.
+            // `authMethod`, `auth_type` and `oauth_provider` never get here (a neutral tail).
+            if (i === segs.length - 1 || prev === "x" || prev === "proxy" || next === "header" || next === "key" || next === "value") {
+                return "weak";
+            }
+            if (next === "code" && !isDescriptor(segs[i + 2] ?? ""))
+                return "strong";
+        }
+        if ((s === "oauth" || s === "authentication") && !isDescriptor(next))
+            return "weak";
+        if (s === "authcode" && !isDescriptor(next))
+            return "strong";
+        if (ONE_TIME_CODES.has(s) && i === segs.length - 1)
+            return "strong";
+        if (s === "code" && (prev === "mfa" || prev === "otp" || prev === "totp" || prev === "2fa"))
+            return itself;
+        if (s === "jwt" || s === "bearer")
+            return "weak";
+    }
+    return undefined;
+}
+/** `oauth_provider_id`, `authenticationStatus`: the name describes the credential, it does not hold it. */
+function isDescriptor(segment) {
+    return NEUTRAL_TAILS.has(segment) || AUTH_DESCRIPTOR_TAILS.has(segment);
+}
+/** True when a value under `name` is a secret (see {@link secretKeyStrength}). */
+export function isSecretKey(name) {
+    return secretKeyStrength(name) !== undefined;
+}
+/**
+ * The same question for an UPPER_SNAKE environment variable name, where the
+ * words run together (`PGPASSWORD`, `GITHUB_TOKEN`, `AWS_SECRET_ACCESS_KEY`)
+ * and substring matching is the convention rather than the mistake — minus
+ * the counters (`MAX_TOKENS`, `TOKENIZERS_PARALLELISM`) and file pointers
+ * (`PASSWORD_FILE`, the Docker secrets convention).
+ */
+export function isSecretEnvName(name) {
+    const n = name.toUpperCase();
+    if (/_(FILE|PATH|DIR|NAME|URL|URI|ENABLED|TYPE|COUNT|LIMIT|LENGTH|SIZE|TTL|EXPIRY)$/.test(n))
+        return false;
+    // Settings *about* the secret — `CREDENTIALS_CHECK_MS = 2_000`, `TOKEN_HEADER`.
+    if (/_(MS|SECONDS|SECS|TIMEOUT|INTERVAL|RETRIES|ATTEMPTS|MAX|MIN|DAYS|HOURS|MINUTES|BYTES|CHARS|VERSION|HEADER|PREFIX|FIELD|PARAM|ALGORITHM|ISSUER|AUDIENCE|SCOPES?|EXPIRES(_IN)?|LIFETIME)$/.test(n)) {
+        return false;
+    }
+    if (/PASS(WORD|WD|PHRASE)|SECRET|CREDENTIAL|PRIVATE_?KEY|API_?KEY|ACCESS_?KEY|AUTH_?KEY|COOKIE|CONNECTION_?STRING/.test(n)) {
+        return true;
+    }
+    if (/(^|_)(PWD|DSN|PASS|SESSION_?ID|SESSION_?KEY|JWT|AUTH_?CODE|OTP|MFA_?CODE)(_|$)/.test(n))
+        return true;
+    // `BASIC_AUTH=user:pass`, `HTTP_AUTH=…`, `GITHUB_OAUTH=…`. A flag such as
+    // `SKIP_AUTH=true` is left alone by the rules that read these lines.
+    if (/(^|_)O?AUTH$/.test(n))
+        return true;
+    if (/TOKEN(?!S|IZ)/.test(n))
+        return !/(^|_)(PAGE|NEXT|MAX|MIN|CONTINUATION)_?TOKEN/.test(n);
+    return false;
+}
+// ── free-text values ────────────────────────────────────────────────────────
+/** A value that is visibly code or a reference, not a literal secret. */
+function looksLikeCode(value) {
+    if (value.startsWith(REDACTED))
+        return true;
+    if (/^[$%{<([`@&*!=#]/.test(value))
+        return true; // ${VAR}, %VAR%, <placeholder>, expressions
+    if (/[(){}[\]]/.test(value))
+        return true; // calls, indexing, literals
+    if (/^(true|false|null|none|nil|undefined|required|optional|enabled|disabled|yes|no|on|off|\*+|x+|\.{3}|…)[,;]?$/i.test(value)) {
+        return true;
+    }
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+[,;]?$/.test(value))
+        return true; // user.password, process.env.X
+    if (/^[A-Za-z_$][\w$]*[,;]$/.test(value))
+        return true; // `password: password,`
+    return false;
+}
+/** A boolean-ish setting: never a credential, whatever the name beside it. */
+const FLAG_LITERAL = /^(?:true|false|yes|no|on|off|enabled|disabled|null|none)$/i;
+/** A type in a declaration: `password: string` declares a field, it does not set one. */
+const TYPE_NAME = /^(?:string|number|boolean|bigint|symbol|object|any|unknown|never|void|str|int|float|bool|bytes|dict|list|char|varchar|text|uuid)$/i;
+/** Name segments a variable *for* a secret carries: `newToken`, `apiKey`, `secret_value`. */
+const SECRET_WORDS = new Set([
+    "token", "secret", "password", "passwd", "passphrase", "pass", "pwd", "key", "auth",
+    "credential", "credentials", "cookie", "session", "jwt", "bearer", "dsn",
+]);
+/**
+ * A bare identifier that refers to the secret instead of spelling it out: a
+ * type (`password: string`), the key's own word (`self.password = password`),
+ * or a compound variable name carrying it (`token: newToken`,
+ * `api_key = apiKey`, `secret = secret_value`). Only lowerCamel or snake_case
+ * names without a digit count as compound, so `password: hunter`,
+ * `password: MySecret1` and `api_key: abcdef` are still literals.
+ */
+function namesItself(name, value) {
+    if (TYPE_NAME.test(value))
+        return true;
+    if (!/^[A-Za-z_$][A-Za-z_$]*$/.test(value))
+        return false;
+    const segs = segments(name);
+    const flat = value.toLowerCase().replace(/[_$]/g, "");
+    if (flat === segs.join("") || flat === segs[segs.length - 1])
+        return true;
+    if (!/^[a-z][a-z$]*(?:[A-Z][a-z$]*|_[a-z$]+)+$/.test(value))
+        return false;
+    return segs.some((s) => SECRET_WORDS.has(s) && flat.includes(s));
+}
+/**
+ * A value shaped like an opaque credential rather than a word of prose or an
+ * identifier. Random tokens of any useful length carry a digit or a symbol
+ * with near certainty; `tokens`, `authentication` and `authHeader` do not.
+ */
+function looksLikeCredential(value) {
+    if (value.length < 8)
+        return false;
+    if (value.startsWith(REDACTED))
+        return false;
+    return /\d/.test(value) || /[-._~+/=]/.test(value) || value.length >= 32;
+}
+/** Characters a value may not contain: whitespace, quotes and a JSON escape. */
+const V = `[^\\s"'\\\\]`;
+/**
+ * A line start in plain text, or in JSON text where newlines are `\n` escapes
+ * and a file's first line starts right after the string's opening quote.
+ */
+const LINE_START = `(?:^|[\\r\\n"]|\\\\[nr])`;
+/** Before a shell word: whitespace, an operator, a quote, or a JSON escape. */
+const WORD_START = `(?:^|[\\s;&|(\`"':]|\\\\[nrt])`;
+/**
+ * An opening quote, JSON-escaped or not, or none. A backslash is taken only
+ * together with the quote it escapes: `(\\\\?["']?)` used to take the lone
+ * backslash of a `\n` after an empty `KEY=`, and the value after it, which
+ * left `KEY=\[redacted]` — an invalid escape in a JSON document.
+ */
+const QUOTE = `((?:\\\\["'])|["']|)`;
+/**
+ * `\b`, or just after a JSON `\n`/`\r`/`\t` escape, where `\b` sees the `n`
+ * as part of the word: `…\nsk-proj-…` inside a JSON document held in a string.
+ */
+const B = `(?:(?<=\\\\[nrt])|\\b)`;
+/**
+ * Value shapes that are secret wherever they appear, including inside prose.
+ * Order matters: specific token shapes first, so an assignment rule after them
+ * sees `[redacted]` and leaves it alone.
+ */
 const SECRET_SHAPES = [
-    /\bBearer\s+[A-Za-z0-9\-._~+/]+=*/gi, // Authorization header value
-    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g, // JWT
-    /\bsk-[A-Za-z0-9_-]{16,}/g, // OpenAI / Anthropic style
-    /\bgh[pousr]_[A-Za-z0-9]{16,}/g, // GitHub tokens
-    /\bxox[abposr]-[A-Za-z0-9-]{10,}/g, // Slack tokens
-    /\bAKIA[0-9A-Z]{16}\b/g, // AWS access key id
-    /\b(?:AIza)[0-9A-Za-z_-]{20,}/g, // Google API key
+    // A PEM private key, whole — or cut off by truncation before its END line.
+    {
+        hint: (t) => t.includes("PRIVATE KEY"),
+        apply: redactPem,
+    },
+    // Authorization header value. Prose ("Bearer tokens expire") is left alone.
+    {
+        re: new RegExp(`${B}Bearer[ \\t]+([A-Za-z0-9\\-._~+/]+=*)`, "gi"),
+        replace: (m, tok) => (looksLikeCredential(tok) ? REDACTED : m),
+    },
+    // Provider token shapes, as one alternation: one scan instead of fifteen,
+    // which is most of the cost on a result made of many short strings.
+    {
+        re: new RegExp(`${B}(?:${[
+            /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/, // JWT
+            /\bsk-[A-Za-z0-9_-]{16,}/, // OpenAI / Anthropic style
+            /\b[rs]k_(?:live|test)_[A-Za-z0-9]{10,}/, // Stripe secret / restricted
+            /\bwhsec_[A-Za-z0-9]{20,}/, // Stripe webhook secret
+            /\bgh[pousr]_[A-Za-z0-9]{16,}/, // GitHub tokens
+            /\bgithub_pat_[A-Za-z0-9_]{20,}/, // GitHub fine-grained PAT
+            /\bglpat-[A-Za-z0-9_-]{20,}/, // GitLab PAT
+            /\bnpm_[A-Za-z0-9]{36}\b/, // npm
+            /\bhf_[A-Za-z0-9]{30,}/, // Hugging Face
+            /\bxox[abposr]-[A-Za-z0-9-]{10,}/, // Slack tokens
+            /\bxapp-[A-Za-z0-9-]{10,}/, // Slack app token
+            /\bAKIA[0-9A-Z]{16}\b/, // AWS access key id
+            /\bAIza[0-9A-Za-z_-]{20,}/, // Google API key
+            /\bya29\.[A-Za-z0-9_-]{20,}/, // Google OAuth access token
+            /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/, // SendGrid
+        ]
+            .map((r) => r.source.replace(/^\\b/, ""))
+            .join("|")})`, "g"),
+        replace: REDACTED,
+    },
+    // The password half of URL userinfo: postgres://admin:S3cret@host → admin:[redacted]@host.
+    {
+        hint: (t) => t.includes("://"),
+        re: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@"'\\]+:)[^\s@/"'\\]+@/gi,
+        replace: `$1${REDACTED}@`,
+    },
+    // HTTP Basic credentials. Prose ("Basic authentication") is left alone.
+    {
+        re: new RegExp(`${B}Basic[ \\t]+([A-Za-z0-9+/]{8,}={0,2})(?![A-Za-z0-9+/=])`, "g"),
+        replace: (m, cred) => /[0-9+/=]/.test(cred) || /[A-Z]/.test(cred.slice(1)) ? `Basic ${REDACTED}` : m,
+    },
+    // curl -u user:password / --user user:password.
+    {
+        hint: (t) => t.includes("-u") || t.includes("--user"),
+        re: /((?:^|\s)(?:-u|--user)[\s=]+["']?[^\s:"'\\]+:)[^\s"'\\]+/g,
+        replace: `$1${REDACTED}`,
+    },
+    // Authorization with a scheme the shapes above do not know (Token, Digest, …).
+    {
+        re: new RegExp(`${B}((?:Proxy-)?Authorization[ \\t]*[:=][ \\t]*(?:\\\\?["'])?(?:[A-Za-z][A-Za-z0-9-]*[ \\t]+)?)([^\\s"'\\\\,;]{8,})`, "gi"),
+        replace: (m, head, value) => (looksLikeCredential(value) ? `${head}${REDACTED}` : m),
+    },
+    // Azure-style connection strings: …;AccountKey=…; and Password=… inside them.
+    {
+        hint: (t) => t.includes("="),
+        re: /((?:^|[;"'\s])(?:AccountKey|SharedAccessKey|SharedAccessSignature|Password|Pwd)=)([^;"'\s\\]+)/gi,
+        replace: (m, head, value) => (value.startsWith(REDACTED) ? m : `${head}${REDACTED}`),
+    },
+    // A secret in a query string: ?access_token=…&page=2, &api_key=….
+    {
+        hint: (t) => t.includes("=") && (t.includes("?") || t.includes("&")),
+        re: /([?&])([A-Za-z_][A-Za-z0-9_.-]*)=([^&#\s"'\\]{4,})/g,
+        replace: (m, sep, name, value) => isSecretKey(name) && !value.startsWith(REDACTED) && !/^[$%{<]/.test(value) ? `${sep}${name}=${REDACTED}` : m,
+    },
+    // Command-line flags: --password=…, --api-key=…, --token …
+    {
+        hint: (t) => t.includes("-"),
+        re: /(\s--?(?:[a-z0-9]+-)*(?:password|passwd|passphrase|token|api-?key|secret|access-?key|auth-?token)(?:=|[ \t]+))([^\s"'\\-][^\s"'\\]*)/gi,
+        replace: (m, head, value) => value.startsWith(REDACTED) || /^[$%{<]/.test(value) || (/\s$/.test(head) && value.length < 6)
+            ? m
+            : `${head}${REDACTED}`,
+    },
+    // Cookie headers carry sessions: `Cookie: sid=…; theme=dark` loses all of it.
+    {
+        re: new RegExp(`${B}((?:Set-)?Cookie[ \\t]*:[ \\t]*)([^\\r\\n"'\\\\]*=[^\\r\\n"'\\\\]*)`, "gi"),
+        replace: (m, head, value) => (value.startsWith(REDACTED) ? m : `${head}${REDACTED}`),
+    },
+    // Header form with a hyphenated name: `X-Api-Key: …`, `X-Auth-Token: …`, `-H 'Private-Token: …'`.
+    {
+        hint: (t) => t.includes(":") && t.includes("-"),
+        re: new RegExp(`(${WORD_START})((?:[A-Za-z0-9]+-)+[A-Za-z0-9]+)([ \\t]*:[ \\t]*)${QUOTE}(${V}{6,})`, "g"),
+        replace: (m, pre, name, sep, quote, value) => isSecretKey(name) && !looksLikeCode(value) ? `${pre}${name}${sep}${quote}${REDACTED}` : m,
+    },
+    // Shell and dotenv form: `export GITHUB_TOKEN=…`, `PGPASSWORD=… psql`, `API_KEY = "…"`.
+    {
+        hint: (t) => t.includes("="),
+        re: new RegExp(`(${WORD_START})((?:export[ \\t]+)?)([A-Z][A-Z0-9_]*)([ \\t]*=(?!=)[ \\t]*)${QUOTE}([^\\s"'\\\\;&|\`)]{3,})`, "g"),
+        replace: (m, pre, exp, name, sep, quote, value) => {
+            if (!isSecretEnvName(name) || value.startsWith(REDACTED))
+                return m;
+            // A flag is not a credential: `SKIP_AUTH=true`, `REQUIRE_OTP=off`.
+            if (FLAG_LITERAL.test(value))
+                return m;
+            // `NAME=value` with no spaces is how env files and shells write it; with
+            // spaces it may be code, so a call or a reference is left alone.
+            if (sep.trim() !== sep && (looksLikeCode(value) || (!quote && namesItself(name, value))))
+                return m;
+            if (/^[$%{<]/.test(value))
+                return m;
+            return `${pre}${exp}${name}${sep}${quote}${REDACTED}`;
+        },
+    },
+    // Env/ini/YAML/properties lines with any-case names: `password: …`, `aws_secret_access_key = …`,
+    // `spring.datasource.password=…`, indented or `export`ed.
+    {
+        hint: (t) => t.includes("=") || t.includes(":"),
+        re: new RegExp(`(${LINE_START}(?:[ \\t]|\\\\t)*(?:-[ \\t]+)?(?:export[ \\t]+)?)([A-Za-z_][A-Za-z0-9_.-]*)([ \\t]*[=:][ \\t]*)${QUOTE}(${V}{4,})`, "g"),
+        replace: (m, pre, name, sep, quote, value) => {
+            if (!isSecretKey(name) && !isSecretEnvName(name))
+                return m;
+            if (looksLikeCode(value))
+                return m;
+            // `password: string`, `token: newToken`, `api_key = apiKey`: code naming the secret.
+            if (!quote && namesItself(name, value))
+                return m;
+            if (sep.includes(":") && value.length < 6 && !quote)
+                return m;
+            return `${pre}${name}${sep}${quote}${REDACTED}`;
+        },
+    },
+    // JSON form inside text: "password": "hunter2" (also with JSON-escaped quotes).
+    {
+        hint: (t) => t.includes('"') && t.includes(":"),
+        re: /(\\?")([A-Za-z_][A-Za-z0-9_.-]*)(\\?")(\s*:\s*)(\\?")([^"\\\r\n]{4,})(?=\\?")/g,
+        replace: (m, q1, name, q2, sep, q3, value) => isSecretKey(name) && !/^[$%{<]/.test(value) && !value.startsWith(REDACTED)
+            ? `${q1}${name}${q2}${sep}${q3}${REDACTED}`
+            : m,
+    },
 ];
-/** Replace every secret-shaped run inside a string. */
+/**
+ * Can any rule match? Every shape above needs one of these characters or
+ * words, so a leaf without them — most of a large result: names, ids, prose
+ * without punctuation — skips twenty-odd regex passes.
+ */
+const MAYBE_SECRET = /[=:\-_.@]|AKIA|AIza|Bearer|Basic/i;
+/** Most passes {@link redactText} makes; the second one almost never changes anything. */
+const MAX_PASSES = 3;
+/**
+ * Replace every secret-shaped run inside a string.
+ *
+ * Idempotent: redacting the result again changes nothing. That is what lets a
+ * payload be redacted by its producer and again at the recorder without its
+ * bytes moving (live replay compares against them). One pass is not always a
+ * fixed point — a match one rule declined (`Authorization: Authorization: …`)
+ * can hide a secret that only shows once a later rule has run — so a pass that
+ * changed something is followed by another, until one changes nothing.
+ */
 export function redactText(text) {
     let out = text;
+    for (let pass = 0; pass < MAX_PASSES; pass++) {
+        const next = redactPass(out);
+        if (next === out)
+            break;
+        out = next;
+    }
+    return out;
+}
+function redactPass(text) {
+    if (text.length < 8 || !MAYBE_SECRET.test(text))
+        return text;
+    let out = text;
     for (const shape of SECRET_SHAPES) {
-        shape.lastIndex = 0;
-        out = out.replace(shape, REDACTED);
+        if (shape.hint && !shape.hint(out))
+            continue;
+        if (shape.apply) {
+            out = shape.apply(out);
+            continue;
+        }
+        if (!shape.re || shape.replace === undefined)
+            continue;
+        shape.re.lastIndex = 0;
+        out =
+            typeof shape.replace === "string"
+                ? out.replace(shape.re, shape.replace)
+                : out.replace(shape.re, shape.replace);
     }
     return out;
 }
+const PEM_BEGIN = /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY-----/g;
+const PEM_END = /-----END ([A-Z0-9 ]*)PRIVATE KEY-----/g;
+/**
+ * What a key cut off before its END line is made of: base64, its headers
+ * (`Proc-Type: 4,ENCRYPTED`) and line breaks, raw or JSON-escaped. A backslash
+ * only as part of `\n`/`\r`/`\t`, so an escaped quote (`\"`) ends it rather
+ * than being eaten — which used to leave a JSON document with a dangling `\`.
+ */
+const PEM_BODY = /(?:[A-Za-z0-9+/=\s:,.-]|\\[nrt])*/y;
+/**
+ * Every PEM private key, whole or truncated, as `[redacted]`.
+ *
+ * Not one regex: `BEGIN…[^"]*?…END` rescanned to the end of the text for each
+ * BEGIN line that had no END, so a log repeating the header was quadratic
+ * (60 ms for 64 KiB, about a second for a leaf of the size {@link redact}
+ * scans). Here the END lines are found once, and each BEGIN looks up the next
+ * one of its kind — linear however the text is built. As before, a key never
+ * spans a `"`: in JSON text that is the end of the string it lives in.
+ */
+function redactPem(text) {
+    const ends = new Map();
+    PEM_END.lastIndex = 0;
+    for (let m = PEM_END.exec(text); m; m = PEM_END.exec(text)) {
+        let list = ends.get(m[1]);
+        if (!list)
+            ends.set(m[1], (list = []));
+        list.push(m.index);
+    }
+    const cursor = new Map();
+    let quote = -2; // the first `"` at or after the last position asked about; -1 = none
+    let out = "";
+    let last = 0;
+    PEM_BEGIN.lastIndex = 0;
+    for (let m = PEM_BEGIN.exec(text); m; m = PEM_BEGIN.exec(text)) {
+        const label = m[1];
+        const after = m.index + m[0].length;
+        let stop = -1;
+        const list = ends.get(label);
+        if (list) {
+            let i = cursor.get(label) ?? 0;
+            while (i < list.length && list[i] < after)
+                i += 1;
+            cursor.set(label, i);
+            if (i < list.length) {
+                if (quote !== -1 && quote < after)
+                    quote = text.indexOf('"', after);
+                if (quote === -1 || quote >= list[i])
+                    stop = list[i] + `-----END ${label}PRIVATE KEY-----`.length;
+            }
+        }
+        if (stop < 0) {
+            PEM_BODY.lastIndex = after;
+            PEM_BODY.exec(text);
+            stop = Math.max(after, PEM_BODY.lastIndex);
+        }
+        out += text.slice(last, m.index) + REDACTED;
+        last = stop;
+        PEM_BEGIN.lastIndex = stop;
+    }
+    return last === 0 ? text : out + text.slice(last);
+}
+/** Deep enough for any producer's output ({@link redact} stops at 24) inside a wrapper. */
+const JSON_TEXT_MAX_DEPTH = 64;
+/**
+ * Redact a string that holds JSON — a serialized tool input, result or error —
+ * and return JSON, always.
+ *
+ * Running {@link redactText} over the serialized text could not promise that:
+ * a rule that met `\n` after an empty `KEY=` wrote `KEY=\[redacted]`, and the
+ * service stored a payload no parser accepts. So the text is parsed and every
+ * string leaf gets the rules as plain text, exactly as its producer's
+ * {@link redact} did. When that finds nothing new — the normal case, since
+ * producers redact first — the original bytes come back untouched: live replay
+ * serializes a result the same way and compares against what was recorded.
+ * Text that is not JSON (a truncated preview, a producer's plain error) gets
+ * {@link redactText}: there is no structure to keep.
+ */
+export function redactJsonText(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return redactText(text);
+    }
+    let cleaned;
+    try {
+        cleaned = JSON.stringify(redact(parsed, JSON_TEXT_MAX_DEPTH));
+    }
+    catch {
+        return JSON.stringify({ truncated: true, reason: "unserializable" });
+    }
+    try {
+        if (cleaned === JSON.stringify(parsed))
+            return text;
+    }
+    catch {
+        /* too deep to compare: send the redacted form */
+    }
+    return cleaned;
+}
 /**
  * Deep-clone `value` with secrets removed. The result is always JSON-safe, so
  * the caller can serialise it without a second failure mode.
@@ -53,16 +655,42 @@ export function redactText(text) {
  * @param maxDepth guard against pathological nesting (default 24).
  */
 export function redact(value, maxDepth = 24) {
-    return walk(value, undefined, 0, maxDepth, new WeakSet());
+    return walk(value, 0, maxDepth, new WeakSet());
+}
+/**
+ * Set an own property, including one named `__proto__`: JSON.parse makes that
+ * an ordinary key, and a plain assignment would set the copy's prototype
+ * instead — the key would vanish from what is recorded.
+ */
+function put(target, key, value) {
+    if (key === "__proto__") {
+        Object.defineProperty(target, key, { value, enumerable: true, writable: true, configurable: true });
+    }
+    else {
+        target[key] = value;
+    }
+}
+/** The value that replaces `v` under a secret key of strength `strength`. */
+function underSecretKey(v, strength) {
+    // A flag or a counter under a weak key (`sessionId: 42`, `tokens: 1234`) is
+    // not a credential; a number under `password` or `mfa_token` might be one (a
+    // PIN, a one-time code), so strong keys redact everything but a flag.
+    if (strength === "weak" && (typeof v === "boolean" || (typeof v === "number" && Number.isFinite(v)))) {
+        return v;
+    }
+    if (typeof v === "boolean")
+        return v;
+    return REDACTED;
 }
-function walk(value, key, depth, maxDepth, seen) {
-    if (key !== undefined && SECRET_KEY.test(key))
-        return REDACTED;
+function walk(value, depth, maxDepth, seen) {
     if (value === null || value === undefined)
         return value ?? null;
     switch (typeof value) {
         case "string":
-            return redactText(value);
+            // Cut first: shapes are scanned in linear time, but twenty-odd passes
+            // over a 20 MB leaf is still a visible pause on a hook's path, and no
+            // consumer sends anything close to this size.
+            return redactText(value.length > REDACT_SCAN_MAX_CHARS ? truncateString(value, REDACT_SCAN_MAX_CHARS) : value);
         case "number":
             return Number.isFinite(value) ? value : String(value);
         case "boolean":
@@ -83,7 +711,7 @@ function walk(value, key, depth, maxDepth, seen) {
     seen.add(obj);
     try {
         if (Array.isArray(obj)) {
-            return obj.map((item) => walk(item, undefined, depth + 1, maxDepth, seen));
+            return obj.map((item) => walk(item, depth + 1, maxDepth, seen));
         }
         if (obj instanceof Date)
             return obj.toISOString();
@@ -91,18 +719,19 @@ function walk(value, key, depth, maxDepth, seen) {
             return { name: obj.name, message: redactText(obj.message) };
         const out = {};
         for (const [k, v] of Object.entries(obj)) {
-            if (SECRET_KEY.test(k)) {
-                out[k] = REDACTED;
+            const strength = secretKeyStrength(k);
+            if (strength) {
+                put(out, k, underSecretKey(v, strength));
             }
             else if (ENV_KEY.test(k) && v && typeof v === "object" && !Array.isArray(v)) {
                 // Rule 2: an env block's names are useful, its values never are.
                 const env = {};
                 for (const name of Object.keys(v))
-                    env[name] = REDACTED;
-                out[k] = env;
+                    put(env, name, REDACTED);
+                put(out, k, env);
             }
             else {
-                out[k] = walk(v, k, depth + 1, maxDepth, seen);
+                put(out, k, walk(v, depth + 1, maxDepth, seen));
             }
         }
         return out;