@basein/runner 0.3.24 → 0.3.26

package/dist/record/redact.js

@@ -45,13 +45,23 @@
  * `token: newToken`). A separator never spans a line break: an empty
  * `DB_PASSWORD=` must not take the next line with it.
  *
+ * A VALUE IN QUOTES IS READ TO ITS CLOSING QUOTE, spaces, `&`, `;` and all: a
+ * passphrase has words in it. Nor is it code for what it starts with or holds:
+ * a password may start with `$`, `!` or `(` and have a bracket in it
+ * (`"p@ss(w0rd)1"`), and went out as it was while that made a value look like
+ * code. Only a reference — `${VAR}`, `$(cmd)`, `<placeholder>`, `{{ template }}`
+ * — exempts it. Unquoted, an expression still shows by its shape.
+ *
  * JSON TEXT IS REDACTED AS JSON. A serialized tool payload goes through
  * {@link redactJsonText}, which parses it and runs the rules on each string
  * leaf — the same pass its producer's {@link redact} made — so the result is
  * always valid JSON and, when nothing new was found, the producer's bytes
- * exactly (live replay serializes a result the same way and compares). The
- * rules still tolerate JSON-escaped text (a string leaf that holds a JSON
- * document, a preview of one): they never start a match inside an escape
+ * exactly (live replay serializes a result the same way and compares). A
+ * string leaf is text, whatever it holds: a JSON document in one — a file's
+ * content, what an MCP tool returns in `content[].text` — gets the text rules
+ * where it stands, and is never parsed and written back. The text rules read
+ * JSON text, plain and JSON-escaped (a document held in a string, a preview of
+ * one cut off before it parses): they never start a match inside an escape
  * sequence and never replace a quote or a backslash, so an escaped document
  * stays parseable.
  *
@@ -278,14 +288,109 @@ export function isSecretEnvName(name) {
     return false;
 }
 // ── free-text values ────────────────────────────────────────────────────────
-/** A value that is visibly code or a reference, not a literal secret. */
-function looksLikeCode(value) {
-    if (value.startsWith(REDACTED))
+/** A boolean-ish setting: never a credential, whatever the name beside it. */
+const FLAG_LITERAL = /^(?:true|false|yes|no|on|off|enabled|disabled|null|none)$/i;
+/** A type in a declaration: `password: string` declares a field, it does not set one. */
+const TYPE_NAME = /^(?:string|number|boolean|bigint|symbol|object|any|unknown|never|void|str|int|float|bool|bytes|dict|list|char|varchar|text|uuid)$/i;
+/** Name segments a variable *for* a secret carries: `newToken`, `apiKey`, `secret_value`. */
+const SECRET_WORDS = new Set([
+    "token", "secret", "password", "passwd", "passphrase", "pass", "pwd", "key", "auth",
+    "credential", "credentials", "cookie", "session", "jwt", "bearer", "dsn",
+]);
+/**
+ * A value that stands for a secret kept somewhere else, written whole:
+ * `${DB_PASSWORD}`, `$(cat ~/.token)`, `%DB_PASSWORD%`, `<your-password>`,
+ * `{{ vault_password }}`, `{password}`.
+ *
+ * The whole value has to be the reference. The test used to be its first
+ * character — `$`, `%`, `{` or `<` — and a literal password that only starts
+ * like a reference was sent as it was: `$up3rS3cret`, `%2FAbCdEf…`, `<3Kittens!`.
+ */
+const REFERENCE = new RegExp(`^(?:${[
+    /\$\{(?:[^{}]|\{[^{}]*\})*\}/, // ${VAR}, ${VAR:-${OTHER}}, ${{ secrets.X }}
+    /\$\(.*\)/, // $(command)
+    /`[^`]*`/, // `command`
+    /\$[0-9@*#?!$-]/, // $1, $@
+    /%(?:[0-9]|[A-Za-z_][A-Za-z0-9_]*%)/, // %VAR%, %1
+    /<[^<>]+>/, // <placeholder>
+    /\{\{.*\}\}/, // {{ template }}
+    /\{[A-Za-z_][\w.]*\}/, // {placeholder}
+]
+    .map((r) => r.source)
+    .join("|")})$`);
+/**
+ * True for a {@link REFERENCE}, and for `$NAME`: a `$` and one whole name
+ * (`PGPASSWORD=$pw psql`, `token=$tok`, `X-Api-Key: $API_KEY`).
+ *
+ * A name that mixes upper and lower case around a digit is the exception: it
+ * is what a generated password looks like when its first character is a `$`
+ * — `$up3rS3cret`, `$ecretPass1` — where a variable is `$DB_PASSWORD`,
+ * `$tok`, `$apiKey` or `$VAR1`. Nothing else about the text tells the two
+ * apart, and the first is the one that must not be sent.
+ */
+function isReference(value) {
+    // One quoting inside the other is a shell's way to write it: `'export API_KEY='"$API_KEY"'; run'`.
+    const wrap = /^(\\?["']).*\1$/.exec(value);
+    const inner = wrap ? value.slice(wrap[1].length, -wrap[1].length) : value;
+    if (REFERENCE.test(inner))
         return true;
-    if (/^[$%{<([`@&*!=#]/.test(value))
-        return true; // ${VAR}, %VAR%, <placeholder>, expressions
-    if (/[(){}[\]]/.test(value))
-        return true; // calls, indexing, literals
+    const ident = /^\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(inner)?.[1];
+    return ident !== undefined && !(/\d/.test(ident) && /[a-z]/.test(ident) && /[A-Z]/.test(ident));
+}
+/** What opens a reference that may have a space in it, and what closes it. */
+const OPENERS = [
+    ["$(", ")"],
+    ["${", "}"],
+    ["{{", "}}"],
+    ["`", "`"],
+    ["<", ">"],
+];
+/** What follows a value on its line, as far as a reference could reasonably run. */
+const LINE_REST = /[^\r\n\\]{0,200}/y;
+/**
+ * An unquoted value ends at the first space, so a reference with a space in it
+ * arrives cut: `$(cat` of `$(cat ~/.token)`, `<your` of `<your api key>`. It
+ * is one all the same when what it opened is closed further along the line.
+ * `<3Kittens!` opens nothing that closes, and is a password.
+ */
+function opensReference(value, text, end) {
+    for (const [open, close] of OPENERS) {
+        if (!value.startsWith(open))
+            continue;
+        // Closed inside the value with more after it: `${PREFIX}s3cret` is a literal in part.
+        if (value.includes(close, open.length))
+            return false;
+        LINE_REST.lastIndex = end;
+        return (LINE_REST.exec(text)?.[0] ?? "").includes(close);
+    }
+    return false;
+}
+/** A call or an index, from its first character: `os.getenv(`, `buildAuth(user);`, `tokens[0]`. */
+const CALL_OR_INDEX = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*[([]/;
+/**
+ * A value that is visibly code or a reference, not a literal secret.
+ *
+ * In quotes only a reference is. `"!Sup3rS3cret"`, `'@dm1nP@ssw0rd'` and
+ * `"(Secret)1!"` are strings, whatever they start with or hold; each was sent
+ * as it was while a first character or a bracket anywhere made a value code.
+ * Unquoted, an expression shows by its shape: it opens with an operator or a
+ * bracket, or it is a call or an index. A bracket that closes in the middle of
+ * a word is neither: `p@ss(w0rd)1`, `abc(def)123456`.
+ *
+ * @param text the text the value was found in, and `end` where its match
+ *             ends there: an unquoted reference may go on past its value.
+ */
+function looksLikeCode(value, quoted, text, end) {
+    if (isReference(quoted ? value : value.replace(/[,;]$/, "")))
+        return true;
+    if (!quoted) {
+        if (opensReference(value, text, end))
+            return true;
+        if (/^[([{`@&*!=#]/.test(value))
+            return true; // expressions, YAML tags and anchors, comments
+        if (CALL_OR_INDEX.test(value) && !/[)\]][\w$]/.test(value))
+            return true;
+    }
     if (/^(true|false|null|none|nil|undefined|required|optional|enabled|disabled|yes|no|on|off|\*+|x+|\.{3}|…)[,;]?$/i.test(value)) {
         return true;
     }
@@ -295,15 +400,6 @@ function looksLikeCode(value) {
         return true; // `password: password,`
     return false;
 }
-/** A boolean-ish setting: never a credential, whatever the name beside it. */
-const FLAG_LITERAL = /^(?:true|false|yes|no|on|off|enabled|disabled|null|none)$/i;
-/** A type in a declaration: `password: string` declares a field, it does not set one. */
-const TYPE_NAME = /^(?:string|number|boolean|bigint|symbol|object|any|unknown|never|void|str|int|float|bool|bytes|dict|list|char|varchar|text|uuid)$/i;
-/** Name segments a variable *for* a secret carries: `newToken`, `apiKey`, `secret_value`. */
-const SECRET_WORDS = new Set([
-    "token", "secret", "password", "passwd", "passphrase", "pass", "pwd", "key", "auth",
-    "credential", "credentials", "cookie", "session", "jwt", "bearer", "dsn",
-]);
 /**
  * A bare identifier that refers to the secret instead of spelling it out: a
  * type (`password: string`), the key's own word (`self.password = password`),
@@ -358,6 +454,95 @@ const QUOTE = `((?:\\\\["'])|["']|)`;
  * as part of the word: `…\nsk-proj-…` inside a JSON document held in a string.
  */
 const B = `(?:(?<=\\\\[nrt])|\\b)`;
+/**
+ * What stands between `"…"`: any character, or a backslash and the one it
+ * escapes — an escaped `\n` or `\/` is part of the value, as a .env file's
+ * `KEY="line1\nline2"` has it. In JSON text a plain `"` is only ever a
+ * delimiter, and never followed by a `\n`, so nothing is taken across a line.
+ */
+const IN_DOUBLE_QUOTES = `(?:[^"\\\\\\r\\n]|\\\\[^\\r\\n])`;
+/**
+ * Between `'…'`. A JSON `\n` or `\r` ends it: a JSON string holds a single
+ * quote as it is, so an unclosed one would take the lines after it.
+ */
+const IN_SINGLE_QUOTES = `(?:[^'\\\\\\r\\n]|\\\\[^nr\\r\\n])`;
+/**
+ * Between `\"…\"`, the quotes of a JSON document held in a string. There a
+ * backslash of the value's own is `\\`, and a quote of its own `\\\"`; a `\"`
+ * on its own is the closing quote.
+ */
+const IN_ESCAPED_QUOTES = `(?:[^"\\\\\\r\\n]|\\\\\\\\(?:\\\\["\\\\]|[^"\\\\\\r\\n])|\\\\[/bftu])`;
+/**
+ * A value in quotes, read to its closing quote: a passphrase has spaces in
+ * it, and `&`, `;` or `)` inside quotes are part of the password, not the end
+ * of it. `SMTP_PASSWORD="correct horse battery staple"` used to lose its first
+ * word and send the other three.
+ *
+ * One alternative for each way the quotes are written, each a (quote, value)
+ * pair of groups with the closing quote left in the text.
+ *
+ * Not a value: what follows a quote that CLOSES a string — `"API_KEY=" + key`
+ * in source, `["API_KEY=", 123, "x"]` in JSON. So a quoted value here does not
+ * start with a space or with `, : ] }`; one that does is left to the form the
+ * rule had before, which reads what follows the quote up to the next space.
+ */
+function quotedForms(min) {
+    const opens = `(?![\\s,:\\]}])`;
+    return [
+        `(")${opens}(${IN_DOUBLE_QUOTES}{${min},})(?=")`,
+        `(')${opens}(${IN_SINGLE_QUOTES}{${min},})(?=')`,
+        `(\\\\")${opens}(${IN_ESCAPED_QUOTES}{${min},})(?=\\\\")`,
+    ].join("|");
+}
+/**
+ * The end of a line after a value, with nothing between them but blanks and a
+ * `#` comment. In JSON text the line ends at a `\n` escape, and a file's last
+ * line at the quote that closes the string holding it.
+ */
+const LINE_END = /[ \t]*(?:#[^\r\n"'\\]*)?(?:$|[\r\n"']|\\[nr"])/y;
+/** Where a shell stops reading an unquoted word. */
+const SHELL_SEPARATOR = /[;&|)`]/;
+/**
+ * Words run together, each one capitalised: `JavaScript`, `TypeScript`. After
+ * `Basic` that is a heading, not a credential. Base64 of eight characters or
+ * more is almost never made of capitalised words, so telling them apart costs
+ * no credential in practice.
+ */
+const CAPITALISED_WORDS = /^(?:[A-Z][a-z]+){2,}$/;
+/**
+ * Words joined by `-`, each perhaps numbered, or a short number between them:
+ * `jenkins-build-agent-number-forty-two`, `ci-runner-eu-west-1`. A UUID's
+ * groups of hex mix letters and digits as no word does, and a key of 32 hex
+ * characters has no `-` at all.
+ */
+const HYPHENATED_WORDS = /^(?:[A-Za-z]+\d{0,3}|\d{1,3})(?:-(?:[A-Za-z]+\d{0,3}|\d{1,3}))+$/;
+/**
+ * The parameter that carries the signature of a signed URL: an Azure SAS
+ * (`sig`), S3 and Google Cloud Storage presigned URLs (`X-Amz-Signature`,
+ * `X-Goog-Signature`), CloudFront (`Signature`). Whoever has it has the file.
+ *
+ * Secret in a query string only, so not one of {@link isSecretKey}'s names:
+ * as a key, `signature` is an ordinary argument of a code tool (a function's
+ * signature), and `sig` a signal's name.
+ */
+const SIGNED_URL_PARAM = /^(?:sig|signature|x-amz-signature|x-goog-signature)$/i;
+/** Where a match ends, and in what text: `replace()` passes both after a rule's own groups. */
+function matchEnd(match, rest) {
+    return { text: rest[rest.length - 1], end: rest[rest.length - 2] + match.length };
+}
+/**
+ * What a rule built on {@link quotedForms} read: the one (quote, value) pair
+ * among its alternatives that took part in the match. `rest` is everything
+ * `replace()` passes from the first of those pairs on.
+ */
+function matchedValue(match, rest) {
+    for (let i = 0; i + 3 < rest.length; i += 2) {
+        const value = rest[i + 1];
+        if (typeof value === "string")
+            return { quote: rest[i] ?? "", value, ...matchEnd(match, rest) };
+    }
+    return { quote: "", value: "", ...matchEnd(match, rest) };
+}
 /**
  * Value shapes that are secret wherever they appear, including inside prose.
  * Order matters: specific token shapes first, so an assignment rule after them
@@ -378,7 +563,12 @@ const SECRET_SHAPES = [
     // which is most of the cost on a result made of many short strings.
     {
         re: new RegExp(`${B}(?:${[
-            /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/, // JWT
+            // JWT. Not after an earlier `eyJ` of the same run of token characters:
+            // a `-` is one of them and a word boundary too, so in `eyJaaaa-eyJaaaa-…`
+            // every `eyJ` began a scan to the end of the run — 256 KiB of it took
+            // 8 s. A later one could only match where the first did: a first
+            // segment ends at the run's end whichever `eyJ` it began at.
+            new RegExp(`\\beyJ(?<!${B}eyJ[A-Za-z0-9_-]*?-eyJ)[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]*`),
             /\bsk-[A-Za-z0-9_-]{16,}/, // OpenAI / Anthropic style
             /\b[rs]k_(?:live|test)_[A-Za-z0-9]{10,}/, // Stripe secret / restricted
             /\bwhsec_[A-Za-z0-9]{20,}/, // Stripe webhook secret
@@ -398,22 +588,79 @@ const SECRET_SHAPES = [
             .join("|")})`, "g"),
         replace: REDACTED,
     },
-    // The password half of URL userinfo: postgres://admin:S3cret@host → admin:[redacted]@host.
+    // The password half of URL userinfo: postgres://admin:S3cret@host → admin:[redacted]@host,
+    // and with no user name before it: redis://:S3cret@host. A password that is a
+    // variable is not one: `redis://:$REDIS_PASSWORD@redis:6379`,
+    // `postgres://${DB_USER}:${DB_PASSWORD}@db/app` — a compose file's, a
+    // script's — go as they are.
+    //
+    // Found from its `://`, and the scheme checked behind that. Read forwards, a
+    // scheme began after every `.`, `+` and `-` of a run of its own characters
+    // and ran to the end of it: `a.a.a.a…` cost 23 s for 256 KiB.
     {
         hint: (t) => t.includes("://"),
-        re: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@"'\\]+:)[^\s@/"'\\]+@/gi,
-        replace: `$1${REDACTED}@`,
+        re: /(:\/\/(?<=\b[a-z][a-z0-9+.-]*:\/\/)[^\s:/@"'\\]*:)([^\s@/"'\\]+)@/gi,
+        replace: (m, head, password) => password === REDACTED || isReference(password) ? m : `${head}${REDACTED}@`,
     },
-    // HTTP Basic credentials. Prose ("Basic authentication") is left alone.
+    // User-info that is only a token: https://<token>@github.com/owner/repo.git, a
+    // Sentry DSN, and the user half of `https://<token>:x-oauth-basic@…`, whose
+    // password half the rule above has just taken. A user name is short and a
+    // word; a token is 32 characters or more, or 20 with a digit and both cases.
+    // Words joined by `-` are a name however long they run
+    // (`jenkins-build-agent-number-forty-two`); 32 hex characters, or a UUID,
+    // are still a token.
+    {
+        hint: (t) => t.includes("://") && t.includes("@"),
+        re: /(:\/\/(?<=\b[a-z][a-z0-9+.-]*:\/\/))([A-Za-z0-9_-]{20,})(?=(?::[^\s@/"'\\]*)?@[^\s@/"'\\]+)/gi,
+        replace: (m, head, user) => (user.length >= 32 && !HYPHENATED_WORDS.test(user)) || (/\d/.test(user) && /[a-z]/.test(user) && /[A-Z]/.test(user))
+            ? `${head}${REDACTED}`
+            : m,
+    },
+    // HTTP Basic credentials. Prose ("Basic authentication", "Basic JavaScript") is left alone.
     {
         re: new RegExp(`${B}Basic[ \\t]+([A-Za-z0-9+/]{8,}={0,2})(?![A-Za-z0-9+/=])`, "g"),
-        replace: (m, cred) => /[0-9+/=]/.test(cred) || /[A-Z]/.test(cred.slice(1)) ? `Basic ${REDACTED}` : m,
+        replace: (m, cred) => /[0-9+/=]/.test(cred) || (/[A-Z]/.test(cred.slice(1)) && !CAPITALISED_WORDS.test(cred)) ? `Basic ${REDACTED}` : m,
     },
     // curl -u user:password / --user user:password.
+    //
+    // Between the flag and the user name: blanks and `=` up to a quote, or up to
+    // the last blank, or one `=`. It was `[\s=]+`, and a user name may hold `=`
+    // too, so the two shared a run of `=` in every way there is to split it:
+    // ` -u ====…` cost 43 s for 256 KiB. These three match the same text, each
+    // in one way.
+    //
+    // What `-u` is given may be a URL instead (`redis-cli -u redis://:pw@host`),
+    // whose password the URL rule has read already: `//` after the colon is not
+    // a password. Nor is a variable (`curl -u admin:$ADMIN_PASSWORD`).
     {
         hint: (t) => t.includes("-u") || t.includes("--user"),
-        re: /((?:^|\s)(?:-u|--user)[\s=]+["']?[^\s:"'\\]+:)[^\s"'\\]+/g,
-        replace: `$1${REDACTED}`,
+        re: /((?:^|\s)(?:-u|--user)(?:[\s=]+["']|[\s=]*\s|=)[^\s:"'\\]+:)(?!\/\/)([^\s"'\\]+)/g,
+        replace: (m, head, password) => (isReference(password) ? m : `${head}${REDACTED}`),
+    },
+    // `docker login -u me -p <password>` and `sshpass -p <password>`, the value
+    // after a blank or none (`-phunter2222`, `-p'two words'`). For most
+    // commands `-p` is a port, a path or "parents" (`docker run -p 8080:80`,
+    // `mkdir -p`), so it is read after these two only, and not past a `;`, `&`
+    // or `|` that ends the command it is in.
+    {
+        hint: (t) => t.includes("-p") && (t.includes("docker") || t.includes("sshpass")),
+        re: new RegExp(`(\\b(?:docker[ \\t]+login\\b[^\\r\\n;&|]{0,200}?|sshpass)[ \\t]+-p[ \\t]*)(?:${quotedForms(1)}|()([^\\s"'\\\\]+))`, "g"),
+        replace: (m, head, ...rest) => {
+            const { quote, value, text, end } = matchedValue(m, rest);
+            if (value === REDACTED || isReference(value) || (!quote && opensReference(value, text, end)))
+                return m;
+            return `${head}${quote}${REDACTED}`;
+        },
+    },
+    // Cookies given to curl on the command line: `curl -b 'sid=…'`, `--cookie "sid=…; theme=dark"`.
+    // A value with no `=` in it is the name of a cookie file, not a cookie.
+    {
+        hint: (t) => t.includes("-b") || t.includes("--cookie"),
+        re: new RegExp(`((?:\\bcurl\\b[^\\r\\n;&|]{0,300}?[ \\t]-b[ \\t]+|[ \\t]--cookie[ \\t=]+))(?:${quotedForms(1)}|()([^\\s"'\\\\]+))`, "g"),
+        replace: (m, head, ...rest) => {
+            const { quote, value } = matchedValue(m, rest);
+            return value.includes("=") ? `${head}${quote}${REDACTED}` : m;
+        },
     },
     // Authorization with a scheme the shapes above do not know (Token, Digest, …).
     {
@@ -426,75 +673,161 @@ const SECRET_SHAPES = [
         re: /((?:^|[;"'\s])(?:AccountKey|SharedAccessKey|SharedAccessSignature|Password|Pwd)=)([^;"'\s\\]+)/gi,
         replace: (m, head, value) => (value.startsWith(REDACTED) ? m : `${head}${REDACTED}`),
     },
-    // A secret in a query string: ?access_token=…&page=2, &api_key=….
+    // A secret in a query string or a URL fragment: ?access_token=…&page=2,
+    // &api_key=…, #access_token=… (where an OAuth implicit grant puts it), and
+    // the signature of a signed URL.
     {
-        hint: (t) => t.includes("=") && (t.includes("?") || t.includes("&")),
-        re: /([?&])([A-Za-z_][A-Za-z0-9_.-]*)=([^&#\s"'\\]{4,})/g,
-        replace: (m, sep, name, value) => isSecretKey(name) && !value.startsWith(REDACTED) && !/^[$%{<]/.test(value) ? `${sep}${name}=${REDACTED}` : m,
+        hint: (t) => t.includes("=") && (t.includes("?") || t.includes("&") || t.includes("#")),
+        re: /([?&#])([A-Za-z_][A-Za-z0-9_.-]*)=([^&#\s"'\\]{4,})/g,
+        replace: (m, sep, name, value) => (isSecretKey(name) || SIGNED_URL_PARAM.test(name)) && value !== REDACTED && !isReference(value)
+            ? `${sep}${name}=${REDACTED}`
+            : m,
     },
-    // Command-line flags: --password=…, --api-key=…, --token …
+    // Command-line flags: --password=…, --api-key=…, --token …, the value bare
+    // or in quotes, the name's words joined by `-` or `_` (`--api_key`).
     {
         hint: (t) => t.includes("-"),
-        re: /(\s--?(?:[a-z0-9]+-)*(?:password|passwd|passphrase|token|api-?key|secret|access-?key|auth-?token)(?:=|[ \t]+))([^\s"'\\-][^\s"'\\]*)/gi,
-        replace: (m, head, value) => value.startsWith(REDACTED) || /^[$%{<]/.test(value) || (/\s$/.test(head) && value.length < 6)
-            ? m
-            : `${head}${REDACTED}`,
+        re: new RegExp(`(\\s--?(?:[a-z0-9]+[-_])*(?:password|passwd|passphrase|token|api[-_]?key|secret|access[-_]?key|auth[-_]?token)(?:=|[ \\t]+))(?:${quotedForms(1)}|()([^\\s"'\\\\-][^\\s"'\\\\]*))`, "gi"),
+        replace: (m, head, ...rest) => {
+            const { quote, value, text, end } = matchedValue(m, rest);
+            if (value === REDACTED)
+                return m;
+            if (!value.startsWith(REDACTED)) {
+                const flag = head.trim().replace(/^-+|=$/g, "");
+                if (isReference(value) || (!quote && opensReference(value, text, end)))
+                    return m;
+                if (/\s$/.test(head) && value.length < 6)
+                    return m;
+                // Help text names a type or the flag itself: `--token string   Auth token`, `--password PASSWORD`.
+                if (!quote && (TYPE_NAME.test(value) || (/^[A-Z][A-Z_]*$/.test(value) && namesItself(flag, value))))
+                    return m;
+            }
+            return `${head}${quote}${REDACTED}`;
+        },
     },
     // Cookie headers carry sessions: `Cookie: sid=…; theme=dark` loses all of it.
+    //
+    // Not after an earlier `Cookie:` of the same stretch of line: that one took
+    // the rest of it if an `=` follows, and if none does, none follows this one
+    // either. Without the check every `Cookie:` of a line with no `=` read to
+    // the line's end — 25 s for 256 KiB of them.
+    //
+    // And the value does not start with a blank, which the blanks of the head
+    // have taken: `Cookie:` and 256 KiB of spaces shared the run between the
+    // head and the value in every way there is to split it — a minute.
     {
-        re: new RegExp(`${B}((?:Set-)?Cookie[ \\t]*:[ \\t]*)([^\\r\\n"'\\\\]*=[^\\r\\n"'\\\\]*)`, "gi"),
+        re: new RegExp(`${B}(?=(?:Set-)?Cookie[ \\t]*:)(?<!${B}Cookie[ \\t]*:[^\\r\\n"'\\\\]*?)((?:Set-)?Cookie[ \\t]*:[ \\t]*)(?![ \\t])([^\\r\\n"'\\\\]*=[^\\r\\n"'\\\\]*)`, "gi"),
         replace: (m, head, value) => (value.startsWith(REDACTED) ? m : `${head}${REDACTED}`),
     },
     // Header form with a hyphenated name: `X-Api-Key: …`, `X-Auth-Token: …`, `-H 'Private-Token: …'`.
     {
         hint: (t) => t.includes(":") && t.includes("-"),
         re: new RegExp(`(${WORD_START})((?:[A-Za-z0-9]+-)+[A-Za-z0-9]+)([ \\t]*:[ \\t]*)${QUOTE}(${V}{6,})`, "g"),
-        replace: (m, pre, name, sep, quote, value) => isSecretKey(name) && !looksLikeCode(value) ? `${pre}${name}${sep}${quote}${REDACTED}` : m,
+        replace: (m, pre, name, sep, quote, value, ...rest) => {
+            if (!isSecretKey(name) || value === REDACTED)
+                return m;
+            const { text, end } = matchEnd(m, rest);
+            if (!value.startsWith(REDACTED) && looksLikeCode(value, quote !== "", text, end))
+                return m;
+            return `${pre}${name}${sep}${quote}${REDACTED}`;
+        },
     },
     // Shell and dotenv form: `export GITHUB_TOKEN=…`, `PGPASSWORD=… psql`, `API_KEY = "…"`.
+    //
+    // Unquoted, the value ends where a shell would end it — at a space or at
+    // `; & | )` or a backtick — because a command may go on from there:
+    // `FOO_TOKEN=abc123&& make deploy`. Whether such a character is part of the
+    // password instead (`DB_PASSWORD=S3cr&tP@ssw0rd!` in a .env file) is for the
+    // next rule to say: it knows whether the assignment is the whole line.
     {
         hint: (t) => t.includes("="),
-        re: new RegExp(`(${WORD_START})((?:export[ \\t]+)?)([A-Z][A-Z0-9_]*)([ \\t]*=(?!=)[ \\t]*)${QUOTE}([^\\s"'\\\\;&|\`)]{3,})`, "g"),
-        replace: (m, pre, exp, name, sep, quote, value) => {
-            if (!isSecretEnvName(name) || value.startsWith(REDACTED))
-                return m;
-            // A flag is not a credential: `SKIP_AUTH=true`, `REQUIRE_OTP=off`.
-            if (FLAG_LITERAL.test(value))
-                return m;
-            // `NAME=value` with no spaces is how env files and shells write it; with
-            // spaces it may be code, so a call or a reference is left alone.
-            if (sep.trim() !== sep && (looksLikeCode(value) || (!quote && namesItself(name, value))))
-                return m;
-            if (/^[$%{<]/.test(value))
+        re: new RegExp(`(${WORD_START})((?:export[ \\t]+)?)([A-Z][A-Z0-9_]*)([ \\t]*=(?!=)[ \\t]*)(?:${quotedForms(3)}|${QUOTE}([^\\s"'\\\\;&|\`)]{3,}))`, "g"),
+        replace: (m, pre, exp, name, sep, ...rest) => {
+            const { quote, value, text, end } = matchedValue(m, rest);
+            if (!isSecretEnvName(name) || value === REDACTED)
                 return m;
+            // What an earlier rule left of a value is still the value: `GITHUB_TOKEN=[redacted]-suffix`.
+            if (!value.startsWith(REDACTED)) {
+                // A flag is not a credential: `SKIP_AUTH=true`, `REQUIRE_OTP=off`.
+                if (FLAG_LITERAL.test(value))
+                    return m;
+                // `NAME=value` with no spaces is how env files and shells write it; with
+                // spaces it may be code, so a call or a reference is left alone.
+                if (sep.trim() !== sep && (looksLikeCode(value, quote !== "", text, end) || (!quote && namesItself(name, value)))) {
+                    return m;
+                }
+                if (isReference(value) || (!quote && opensReference(value, text, end)))
+                    return m;
+            }
             return `${pre}${exp}${name}${sep}${quote}${REDACTED}`;
         },
     },
     // Env/ini/YAML/properties lines with any-case names: `password: …`, `aws_secret_access_key = …`,
-    // `spring.datasource.password=…`, indented or `export`ed.
+    // `spring.datasource.password=…`, indented or `export`ed — and an .npmrc line,
+    // whose name comes after the registry it is for: `//registry.example/:_authToken=…`.
     {
         hint: (t) => t.includes("=") || t.includes(":"),
-        re: new RegExp(`(${LINE_START}(?:[ \\t]|\\\\t)*(?:-[ \\t]+)?(?:export[ \\t]+)?)([A-Za-z_][A-Za-z0-9_.-]*)([ \\t]*[=:][ \\t]*)${QUOTE}(${V}{4,})`, "g"),
-        replace: (m, pre, name, sep, quote, value) => {
-            if (!isSecretKey(name) && !isSecretEnvName(name))
-                return m;
-            if (looksLikeCode(value))
-                return m;
-            // `password: string`, `token: newToken`, `api_key = apiKey`: code naming the secret.
-            if (!quote && namesItself(name, value))
-                return m;
-            if (sep.includes(":") && value.length < 6 && !quote)
+        re: new RegExp(`(${LINE_START}(?:[ \\t]|\\\\t)*(?:-[ \\t]+)?(?:export[ \\t]+)?(?://[^\\s"'\\\\=]*/:)?)([A-Za-z_][A-Za-z0-9_.-]*)([ \\t]*[=:][ \\t]*)(?:${quotedForms(4)}|${QUOTE}(${V}{4,}))`, "g"),
+        replace: (m, pre, name, sep, ...rest) => {
+            const { quote, value, text, end } = matchedValue(m, rest);
+            if ((!isSecretKey(name) && !isSecretEnvName(name)) || value === REDACTED)
                 return m;
+            if (!value.startsWith(REDACTED)) {
+                if (looksLikeCode(value, quote !== "", text, end))
+                    return m;
+                // `password: string`, `token: newToken`, `api_key = apiKey`: code naming the secret.
+                if (!quote && namesItself(name, value))
+                    return m;
+                if (sep.includes(":") && value.length < 6 && !quote)
+                    return m;
+            }
+            else if (!quote && sep.includes("=")) {
+                // The shell rule took the head of this value and stopped at `&`, `;`,
+                // `|`, `)` or a backtick. On a line that is this assignment and nothing
+                // more the rest is the rest of the password (`DB_PASSWORD=S3cr&tP@ssw0rd!`),
+                // and all of it goes. Where the line goes on it is a command
+                // (`FOO_TOKEN=[redacted]&& make deploy`), and from that character on it stays.
+                LINE_END.lastIndex = end;
+                if (!LINE_END.test(text)) {
+                    const cut = value.search(SHELL_SEPARATOR);
+                    const own = cut < 0 ? value : value.slice(0, cut);
+                    return own === REDACTED ? m : `${pre}${name}${sep}${REDACTED}${value.slice(own.length)}`;
+                }
+            }
             return `${pre}${name}${sep}${quote}${REDACTED}`;
         },
     },
     // JSON form inside text: "password": "hunter2" (also with JSON-escaped quotes).
+    //
+    // The value runs to its closing quote, escapes and all. It used to end at
+    // the first backslash, so a value holding `\/`, `\u0026` or `\n` was not
+    // matched at all, and one holding `\"` kept everything after it. The form
+    // of before comes last, for a value whose quotes are not a pair
+    // (`\"password\": "…"`): what it matched it still does.
     {
         hint: (t) => t.includes('"') && t.includes(":"),
-        re: /(\\?")([A-Za-z_][A-Za-z0-9_.-]*)(\\?")(\s*:\s*)(\\?")([^"\\\r\n]{4,})(?=\\?")/g,
-        replace: (m, q1, name, q2, sep, q3, value) => isSecretKey(name) && !/^[$%{<]/.test(value) && !value.startsWith(REDACTED)
-            ? `${q1}${name}${q2}${sep}${q3}${REDACTED}`
-            : m,
+        re: new RegExp(`(\\\\?")([A-Za-z_][A-Za-z0-9_.-]*)(\\\\?")(\\s*:\\s*)(?:(")(${IN_DOUBLE_QUOTES}{4,})(?=")|(\\\\")(${IN_ESCAPED_QUOTES}{4,})(?=\\\\")|(\\\\?")([^"\\\\\\r\\n]{4,})(?=\\\\?"))`, "g"),
+        replace: (m, q1, name, q2, sep, ...rest) => {
+            const { quote, value } = matchedValue(m, rest);
+            return isSecretKey(name) && value !== REDACTED && !isReference(value) ? `${q1}${name}${q2}${sep}${quote}${REDACTED}` : m;
+        },
+    },
+    // A number under a key that names the secret itself, in JSON text: a
+    // one-time code (`"otp": 482913`), a PIN — which the same object passed as an
+    // object loses by its key. A whole number of four digits or more, under a
+    // strong key only: a count under `tokens` and an id under `sessionId` stay,
+    // and so do `"token": 0` and a ratio. Written back as a string in the key's
+    // own quotes, so the document still parses.
+    {
+        hint: (t) => t.includes('"') && t.includes(":"),
+        re: /(\\?")([A-Za-z_][A-Za-z0-9_.-]*)(\\?")(\s*:\s*)(\d{4,})(?![\w.])/g,
+        replace: (m, q1, name, q2, sep) => secretKeyStrength(name) === "strong" ? `${q1}${name}${q2}${sep}${q1}${REDACTED}${q1}` : m,
+    },
+    // The strings of a list under a secret key, in JSON text: `"tokens":
+    // ["tok_…"]`, `"set-cookie": ["sid=…; Path=/"]`.
+    {
+        hint: (t) => t.includes("[") && t.includes('"') && t.includes(":"),
+        apply: redactSecretLists,
     },
 ];
 /**
@@ -546,8 +879,13 @@ function redactPass(text) {
     }
     return out;
 }
-const PEM_BEGIN = /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY-----/g;
-const PEM_END = /-----END ([A-Z0-9 ]*)PRIVATE KEY-----/g;
+/**
+ * `-----BEGIN RSA PRIVATE KEY-----`, and PGP armor, which says one word more:
+ * `-----BEGIN PGP PRIVATE KEY BLOCK-----`. The END line has to be of the same
+ * kind, so a block does not end at the END line of a key of another.
+ */
+const PEM_BEGIN = /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY( BLOCK)?-----/g;
+const PEM_END = /-----END ([A-Z0-9 ]*)PRIVATE KEY( BLOCK)?-----/g;
 /**
  * What a key cut off before its END line is made of: base64, its headers
  * (`Proc-Type: 4,ENCRYPTED`) and line breaks, raw or JSON-escaped. A backslash
@@ -569,10 +907,11 @@ function redactPem(text) {
     const ends = new Map();
     PEM_END.lastIndex = 0;
     for (let m = PEM_END.exec(text); m; m = PEM_END.exec(text)) {
-        let list = ends.get(m[1]);
+        const kind = m[1] + (m[2] ?? "");
+        let list = ends.get(kind);
         if (!list)
-            ends.set(m[1], (list = []));
-        list.push(m.index);
+            ends.set(kind, (list = []));
+        list.push({ at: m.index, to: m.index + m[0].length });
     }
     const cursor = new Map();
     let quote = -2; // the first `"` at or after the last position asked about; -1 = none
@@ -580,20 +919,20 @@ function redactPem(text) {
     let last = 0;
     PEM_BEGIN.lastIndex = 0;
     for (let m = PEM_BEGIN.exec(text); m; m = PEM_BEGIN.exec(text)) {
-        const label = m[1];
+        const kind = m[1] + (m[2] ?? "");
         const after = m.index + m[0].length;
         let stop = -1;
-        const list = ends.get(label);
+        const list = ends.get(kind);
         if (list) {
-            let i = cursor.get(label) ?? 0;
-            while (i < list.length && list[i] < after)
+            let i = cursor.get(kind) ?? 0;
+            while (i < list.length && list[i].at < after)
                 i += 1;
-            cursor.set(label, i);
+            cursor.set(kind, i);
             if (i < list.length) {
                 if (quote !== -1 && quote < after)
                     quote = text.indexOf('"', after);
-                if (quote === -1 || quote >= list[i])
-                    stop = list[i] + `-----END ${label}PRIVATE KEY-----`.length;
+                if (quote === -1 || quote >= list[i].at)
+                    stop = list[i].to;
             }
         }
         if (stop < 0) {
@@ -607,8 +946,107 @@ function redactPem(text) {
     }
     return last === 0 ? text : out + text.slice(last);
 }
+/**
+ * A member whose value is a list, `"tokens": [`, with its key's quotes plain
+ * or JSON-escaped (`\"tokens\": [`, a document held in a string). Between the
+ * key and the bracket: blanks, and in escaped text a `\n` or a `\t`.
+ */
+const LIST_HEAD = /(\\?")([A-Za-z_][A-Za-z0-9_.-]*)\1(?:\s|\\[nrt])*:(?:\s|\\[nrt])*\[/g;
+/** What may stand between the items of a list. */
+const LIST_SPACE = /(?:\s|\\[nrt])*/y;
+/** An item in plain quotes, and its text. */
+const LIST_STRING = /"((?:[^"\\\r\n]|\\[^\r\n])*)"/y;
+/** An item in JSON-escaped quotes, and its text. */
+const LIST_ESCAPED_STRING = new RegExp(`\\\\"(${IN_ESCAPED_QUOTES}*)\\\\"`, "y");
+/** An item that is a number, or `true`, `false` or `null`. */
+const LIST_OTHER = /(?:-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)(?![\w.])/y;
+/**
+ * The items of every list under a secret key, as `[redacted]` each in its own
+ * quotes: a string always, a whole number of four digits or more under a
+ * strong key — what the same list passed as an object loses by its key. The
+ * list keeps its shape and its spacing, and the text around it every byte.
+ *
+ * Not a regex over the list: read item by item, each from where the last one
+ * ended, so a list is read once however long it is. An item that is not a
+ * string, a number or a literal — an object, a list — ends the reading: an
+ * object in the list is read by its own keys, by the rules above.
+ */
+function redactSecretLists(text) {
+    let out = "";
+    let last = 0;
+    let changed = false;
+    LIST_HEAD.lastIndex = 0;
+    for (let m = LIST_HEAD.exec(text); m; m = LIST_HEAD.exec(text)) {
+        const strength = secretKeyStrength(m[2]);
+        if (!strength)
+            continue;
+        const quote = m[1];
+        const item = quote.length === 2 ? LIST_ESCAPED_STRING : LIST_STRING;
+        let at = m.index + m[0].length;
+        for (;;) {
+            LIST_SPACE.lastIndex = at;
+            LIST_SPACE.exec(text);
+            at = LIST_SPACE.lastIndex;
+            item.lastIndex = at;
+            const s = item.exec(text);
+            if (s) {
+                const value = s[1];
+                const from = at + quote.length;
+                if (value !== "" && value !== REDACTED && !isReference(value)) {
+                    out += text.slice(last, from) + REDACTED;
+                    last = from + value.length;
+                    changed = true;
+                }
+                at = item.lastIndex;
+            }
+            else {
+                LIST_OTHER.lastIndex = at;
+                const o = LIST_OTHER.exec(text);
+                if (!o)
+                    break;
+                if (strength === "strong" && /^\d{4,}$/.test(o[0])) {
+                    out += `${text.slice(last, at)}${quote}${REDACTED}${quote}`;
+                    last = at + o[0].length;
+                    changed = true;
+                }
+                at = LIST_OTHER.lastIndex;
+            }
+            LIST_SPACE.lastIndex = at;
+            LIST_SPACE.exec(text);
+            at = LIST_SPACE.lastIndex;
+            if (text[at] !== ",")
+                break;
+            at += 1;
+        }
+        // The next list starts after this one: no item is read twice.
+        if (LIST_HEAD.lastIndex < at)
+            LIST_HEAD.lastIndex = at;
+    }
+    return changed ? out + text.slice(last) : text;
+}
 /** Deep enough for any producer's output ({@link redact} stops at 24) inside a wrapper. */
 const JSON_TEXT_MAX_DEPTH = 64;
+/**
+ * Whether a string can be a JSON object or array, by its first and last
+ * characters alone. A log line (`[INFO] …`) or a preview cut off before its
+ * end is spared a parse that would read all of it to fail at the last character.
+ */
+function mayHoldJson(text) {
+    let first = 0;
+    while (first < text.length && isJsonSpace(text.charCodeAt(first)))
+        first += 1;
+    const open = text.charCodeAt(first);
+    if (open !== 0x7b && open !== 0x5b)
+        return false; // { [
+    let last = text.length - 1;
+    while (last > first && isJsonSpace(text.charCodeAt(last)))
+        last -= 1;
+    return text.charCodeAt(last) === open + 2; // } ]
+}
+/** The four characters JSON allows between its tokens. */
+function isJsonSpace(code) {
+    return code === 0x20 || code === 0x0a || code === 0x0d || code === 0x09;
+}
 /**
  * Redact a string that holds JSON — a serialized tool input, result or error —
  * and return JSON, always.
@@ -621,7 +1059,11 @@ const JSON_TEXT_MAX_DEPTH = 64;
  * producers redact first — the original bytes come back untouched: live replay
  * serializes a result the same way and compares against what was recorded.
  * Text that is not JSON (a truncated preview, a producer's plain error) gets
- * {@link redactText}: there is no structure to keep.
+ * {@link redactText}: there is no structure to keep. Unless the rules gave it
+ * one: a private key written over several lines can be all that kept a
+ * document from parsing, and with the key gone it is redacted as the JSON it
+ * now is — or the next pass over it (the recorder's, after its producer's)
+ * would be the one to do that, and move its bytes.
  */
 export function redactJsonText(text) {
     let parsed;
@@ -629,7 +1071,16 @@ export function redactJsonText(text) {
         parsed = JSON.parse(text);
     }
     catch {
-        return redactText(text);
+        const plain = redactText(text);
+        if (plain === text || !mayHoldJson(plain))
+            return plain;
+        try {
+            parsed = JSON.parse(plain);
+        }
+        catch {
+            return plain;
+        }
+        text = plain;
     }
     let cleaned;
     try {
@@ -690,6 +1141,14 @@ function walk(value, depth, maxDepth, seen) {
             // Cut first: shapes are scanned in linear time, but twenty-odd passes
             // over a 20 MB leaf is still a visible pause on a hook's path, and no
             // consumer sends anything close to this size.
+            // A string is text, whatever it holds. A JSON document in one — a file a
+            // Write puts on disk, what an MCP tool returns in `content[].text` — is
+            // not parsed and written back: that lost its formatting and its big
+            // numbers, and rule 2 emptied a config's `env` block (`"browser": true`
+            // in an .eslintrc became "[redacted]"), and the plan wrote that file.
+            // The text rules read the JSON in it where it is: a value under a secret
+            // key, a number under one (a one-time code), the strings of a list
+            // (`"tokens": [...]`, a `set-cookie` array).
             return redactText(value.length > REDACT_SCAN_MAX_CHARS ? truncateString(value, REDACT_SCAN_MAX_CHARS) : value);
         case "number":
             return Number.isFinite(value) ? value : String(value);