@ictechgy/context-guard 0.4.15 → 0.4.16

package/plugins/context-guard/bin/context-guard-sanitize-output

@@ -10,9 +10,11 @@ from __future__ import annotations
 import argparse
 import codecs
 import collections
+from dataclasses import dataclass
 import hashlib
+import importlib.util
 import os
-from pathlib import PurePosixPath
+from pathlib import Path, PurePosixPath
 import queue
 import re
 import signal
@@ -20,7 +22,36 @@ import subprocess
 import sys
 import threading
 import time
-from typing import BinaryIO, Iterable, Iterator, TextIO
+from types import ModuleType
+from typing import BinaryIO, Iterable, Iterator, NamedTuple, TextIO
+
+
+def load_credential_policy() -> ModuleType:
+    script_dir = Path(__file__).resolve().parent
+    candidate = (
+        script_dir.parent / "lib" / "credential_policy.py"
+        if script_dir.name == "bin"
+        else script_dir / "credential_policy.py"
+    )
+    spec = importlib.util.spec_from_file_location(
+        "_context_guard_sanitize_credential_policy",
+        candidate,
+    )
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f"could not load credential policy: {candidate}")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+_CREDENTIAL_POLICY = load_credential_policy()
+SECRET_KEY = _CREDENTIAL_POLICY.SECRET_KEY
+CAMEL_ACRONYM_BOUNDARY_RE = _CREDENTIAL_POLICY.CAMEL_ACRONYM_BOUNDARY_RE
+CAMEL_WORD_BOUNDARY_RE = _CREDENTIAL_POLICY.CAMEL_WORD_BOUNDARY_RE
+normalize_sensitive_key = _CREDENTIAL_POLICY.normalize_sensitive_key
+is_sensitive_key = _CREDENTIAL_POLICY.is_sensitive_key
+redact_url_like_secret_params = _CREDENTIAL_POLICY.redact_url_like_secret_params
+redact_high_confidence_credentials = _CREDENTIAL_POLICY.redact_high_confidence_credentials
 
 TERMINAL_CONTROL_RE = re.compile(
     r"(?:"
@@ -40,6 +71,22 @@ ABSOLUTE_PATH_RE = re.compile(
 WINDOWS_PATH_RE = re.compile(
     rf"(?P<prefix>^|[\s('\"=])(?P<path>[A-Za-z]:\\(?:{PATH_SEGMENT}\\)+{PATH_SEGMENT})"
 )
+TRACEBACK_PATH_RE = re.compile(
+    rf"(?P<prefix>\bFile\s+[\"'])(?P<path>/(?:{PATH_SEGMENT}/)+{PATH_SEGMENT})"
+    r"(?P<suffix>[\"'],\s+line\s+\d+)"
+)
+LOCATION_PATH_RE = re.compile(
+    rf"(?P<prefix>^(?:\s*[+-]\s*)?)(?P<path>/(?:{PATH_SEGMENT}/)+{PATH_SEGMENT})"
+    r"(?P<suffix>:\d+(?::\d+)?(?=[:\s]|$))"
+)
+DIFF_PATH_RE = re.compile(
+    rf"(?P<prefix>^(?:---|\+\+\+)\s+)(?P<path>/(?:{PATH_SEGMENT}/)+{PATH_SEGMENT})"
+    r"(?P<suffix>(?:\t.*)?$)"
+)
+LISTING_PATH_RE = re.compile(
+    rf"(?P<prefix>^\s*)(?P<path>/(?:{PATH_SEGMENT}/)+{PATH_SEGMENT})"
+    r"(?P<suffix>/?(?:\s+->\s+\S+)?\s*$)"
+)
 PRIVATE_KEY_BEGIN_RE = re.compile(
     r"-----BEGIN (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----"
 )
@@ -52,25 +99,25 @@ AUTH_HEADER_RE = re.compile(
 COOKIE_HEADER_RE = re.compile(
     r"(?i)^(?P<prefix>\s*(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:Set-)?Cookie\s*:\s*).+$"
 )
-SESSION_SECRET_KEY = (
-    r"(?:session(?:[_-]?(?:id|token))?|sessionid|sid|jsessionid|"
-    r"csrf(?:[_-]?token)?|xsrf(?:[_-]?token)?)"
-)
-SECRET_KEY = (
-    r"[A-Za-z0-9_.-]*(?:api[_-]?key|apikey|token|secret|password|passwd|pwd|"
-    r"private[_-]?key|access[_-]?key|client[_-]?secret)[A-Za-z0-9_.-]*"
-    rf"|{SESSION_SECRET_KEY}"
-    r"|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|"
-    r"GOOGLE_APPLICATION_CREDENTIALS|AZURE_CLIENT_SECRET"
-)
+# QUOTED_VALUE_BODY의 두 대안은 첫 문자가 서로 겹치지 않아야 한다.
+# 예전 형태 `(?:\\.|(?!(?P=quote)).)*`에서는 역슬래시 하나가 `\\.`의 시작이면서
+# 동시에 두 번째 대안의 `.`이기도 했다. 닫는 따옴표가 없는 줄에서는 역슬래시
+# 연속 구간을 나누는 방법이 피보나치 수만큼 생겨 지수 시간 백트래킹(ReDoS)이
+# 발생했다 — 47자짜리 줄이 7.6초를 소모했다.
+# 두 번째 대안에서 역슬래시를 제외해 각 위치에서 적용 가능한 대안이 하나뿐이도록
+# 만든다. 뒤에 붙은 `\\?`는 이 배제로 잃게 되는 유일한 문자열 부류, 즉 값이
+# 짝지어지지 않은 역슬래시 하나로 끝나는 경우(`token = "abc\"` → value `abc\`)를
+# 복원한다. 이 형태가 예전 형태와 언어·스팬·그룹 모두에서 동치임은
+# tests/test_sanitize_output_redos.py의 차분 배터리로 고정한다.
+QUOTED_VALUE_BODY = r"(?:\\.|(?!(?P=quote))[^\\])*\\?"
 INLINE_QUOTED_SECRET_ASSIGNMENT_RE = re.compile(
     rf"(?i)(?P<lead>^|[\s;{{\[,])"
     rf"(?P<prefix>(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:export\s+)?"
     rf"[\"']?(?:{SECRET_KEY})[\"']?\s*[:=]\s*)"
-    rf"(?P<quote>[\"'])(?P<value>(?:\\.|(?!(?P=quote)).)*)(?P=quote)(?P<tail>[^\s,;}}\]]*)"
+    rf"(?P<quote>[\"'])(?P<value>{QUOTED_VALUE_BODY})(?P=quote)(?P<tail>[^\s,;}}\]]*)"
 )
 CODE_IDENTIFIER = r"[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*"
-CALL_ARGUMENT_CHUNK = r"(?:[^()\"'\n;]+|\"(?:\\.|[^\"\\])*\"|'(?:\\.|[^'\\])*'|\([^()]*\))*"
+CALL_ARGUMENT_CHUNK = r"(?:[^()\"'\n;]|\"(?:\\.|[^\"\\])*\"|'(?:\\.|[^'\\])*'|\([^()]*\))*"
 INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_RE = re.compile(
     rf"(?i)(?P<lead>^|[\s;{{\[,])"
     rf"(?P<prefix>(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:export\s+)?"
@@ -109,28 +156,131 @@ UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_RE = re.compile(
     rf"(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:export\s+)?"
     rf"[\"']?(?:{SECRET_KEY})[\"']?\s*[:=]\s*(?P<value>(?![\"']).*)$"
 )
+# F-14 one-pass scanner.
+#
+# 아홉 개 consumer 는 모두 아래 fragment 를 각자 품고 있었다. unanchored 패턴에서는
+# offset 마다 `[^:\n]+` 가 다음 콜론까지 삼키고 되돌아오므로, 콜론이 드문 긴 줄에서
+# offset 당 O(n) 작업이 발생해 전체가 이차가 된다(측정: 82KB 한 줄 2.62초,
+# 배가 비율 3.6~3.96). 대신 줄마다 앞머리 location prefix 를 단조 좌→우로 한 번만
+# 확정하고, consumer 에는 fragment 를 제거한 쌍둥이 패턴을 먹인다.
+LOCATION_PREFIX_FRAGMENT = r"(?:(?:[^:\n]+):\d+(?::\d+)?:)?"
+# path 성분에서 '=' 를 제외한다. 허용하면 'api_key=abc:123:456def' 처럼 비밀 값 안에서
+# 줄이 쪼개져 앞부분만 가려지고 뒷부분이 남는 절단 누출이 발생한다. grep/diff 경로에
+# '=' 가 들어가는 경우는 드물고, 그런 줄은 그냥 fast path 를 쓰지 않을 뿐이다.
+# 공백과 유니코드는 계약대로 계속 허용한다.
+LOCATION_PREFIX_SCAN_RE = re.compile(
+    r"\A(?P<lead>[ \t]*(?:[+-][ \t]*)?)(?P<location>[^:\n=]+:\d+(?::\d+)?:)"
+)
+# 후보 스팬의 신호는 두 종류이고 처리도 달라야 한다.
+#
+# ASSIGNMENT: 비밀 키나 헤더 이름 뒤에 ':' 또는 '=' 가 오면 그 스팬은 경로가 아니라
+# 값의 일부다. 예: 'token:123456789:AAH-...' 는 앞부분만 가리면 뒷부분이 남는다.
+# 이 경우 분리 자체를 하지 않고 전체 줄을 consumer 에 넘긴다.
+#
+# PATH_ONLY: 따옴표나 private key 표지처럼 경로 자체에 들어갈 수 있는 문자는 후보를
+# 경로로 인정하되, 그 스팬도 함께 검사한다. 예: "src/it's.py:5:api_key='x'".
+LOCATION_PREFIX_ASSIGNMENT_SIGNAL_RE = re.compile(
+    rf"(?i)(?:-----BEGIN|(?:Proxy-)?Authorization\s*:|(?:Set-)?Cookie\s*:"
+    rf"|[\"']?(?:{SECRET_KEY})[\"']?\s*[:=])"
+)
+LOCATION_PREFIX_PATH_ONLY_SIGNAL_RE = re.compile(r"[\"']")
+NINE_LOCATION_CONSUMERS = (
+    "AUTH_HEADER_RE",
+    "COOKIE_HEADER_RE",
+    "INLINE_QUOTED_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_FALLBACK_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_BRACKETED_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_SECRET_ASSIGNMENT_RE",
+    "UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_RE",
+    "MULTILINE_SECRET_ASSIGNMENT_RE",
+)
+
+
+def without_location_prefix(compiled: re.Pattern[str]) -> re.Pattern[str]:
+    """Return the same consumer with its embedded location prefix removed.
+
+    Deriving the twin from the compiled source keeps the two spellings from
+    drifting: if the fragment ever moves or changes, this fails loudly instead of
+    silently leaving a per-offset location scan in place.
+    """
+    source = compiled.pattern
+    if source.count(LOCATION_PREFIX_FRAGMENT) != 1:
+        raise RuntimeError(
+            "consumer no longer embeds exactly one location prefix fragment"
+        )
+    return re.compile(source.replace(LOCATION_PREFIX_FRAGMENT, "", 1), compiled.flags)
+
+
+class ScannedLine(NamedTuple):
+    """One monotonic left-to-right split of a line into prefix and remainder.
+
+    An assignment signal inside the candidate means the span is part of a value
+    rather than a path, so no split is reported at all; splitting there would
+    redact only the leading part and leave the tail behind. A path-only signal
+    such as a quote in a filename keeps the split but sets ``declined``, and
+    unanchored consumers then also scan the bounded candidate span.
+    """
+
+    prefix: str
+    remainder: str
+    scan_index: int
+    declined: bool = False
+
+
+def scan_location_prefix(line: str) -> ScannedLine:
+    """Identify a leading grep/diff location prefix in exactly one anchored scan.
+
+    The scan index only ever moves forward: it is the end of the anchored match,
+    or zero when there is no prefix.
+
+    The path component must keep accepting spaces and Unicode, because real grep
+    and diff output carries such filenames. That permissiveness means the
+    anchored run can reach past a secret that happens to sit before a later
+    ``:<digits>:`` sequence, so the candidate span is checked once for consumer
+    signal and flagged when any is present. The check is a single bounded pass, so
+    the scan stays linear.
+    """
+    match = LOCATION_PREFIX_SCAN_RE.match(line)
+    if match is None:
+        return ScannedLine("", line, 0)
+    end = match.end()
+    candidate = line[:end]
+    if LOCATION_PREFIX_ASSIGNMENT_SIGNAL_RE.search(candidate):
+        # 값의 일부를 경로로 오인한 경우다. 분리하면 앞부분만 가려져 뒤가 남는다.
+        return ScannedLine("", line, 0, False)
+    declined = bool(LOCATION_PREFIX_PATH_ONLY_SIGNAL_RE.search(candidate))
+    return ScannedLine(candidate, line[end:], end, declined)
+
+
 CONTINUATION_OPERATOR_RE = re.compile(
     r"(?i)(?:\\|\|\||&&|\?\?|[+*/%&|^?,]|\?|:|\bor\b|\band\b|\belse\b)\s*(?://.*|#.*)?$"
 )
-URL_LIKE_RE = re.compile(r"\b[A-Za-z][A-Za-z0-9+.-]*://[^\s]+")
-URL_SECRET_PARAM_RE = re.compile(rf"(?i)([?&#;](?:{SECRET_KEY})=)[^\s?&#;]+")
 SAFE_UNQUOTED_VALUES = {
     "[redacted]",
+    "bool",
+    "boolean",
+    "bytes",
     "false",
+    "float",
+    "int",
+    "integer",
     "none",
     "null",
+    "object",
     "os.getenv",
     "process.env",
+    "str",
+    "string",
     "true",
     "undefined",
+    "unknown",
 }
 IDENTIFIER_CHAIN_RE = re.compile(r"^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)+$")
 SAFE_ENV_LOOKUP_CALL_RE = re.compile(r"^(?:os\.getenv|os\.environ\.get)\(\s*[\"'][A-Za-z0-9_.-]{1,80}[\"']\s*\)$")
 SAFE_RE_COMPILE_CALL_RE = re.compile(r"^re\.compile\([^;\n]*\)$")
 SAFE_CODE_EXPRESSION_CALL_RE = re.compile(rf"^{CODE_IDENTIFIER}\(\s*(?:{CODE_IDENTIFIER}(?:\s*,\s*{CODE_IDENTIFIER})*)?\s*\)$")
 GETTER_CALL_RE = re.compile(rf"^{CODE_IDENTIFIER}\.get\(\s*[\"'](?P<key>[A-Za-z0-9_.-]{{1,80}})[\"']\s*\)$")
-CAMEL_ACRONYM_BOUNDARY_RE = re.compile(r"(?<=[A-Z])(?=[A-Z][a-z])")
-CAMEL_WORD_BOUNDARY_RE = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
 SAFE_GETTER_KEY_NAMES = {
     "access_key",
     "access_token",
@@ -162,26 +312,18 @@ SAFE_GETTER_KEY_NAMES = {
     "sid",
     "token",
 }
-INLINE_PATTERNS: tuple[tuple[re.Pattern[str], str], ...] = (
-    (re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/=-]+"), "[REDACTED]"),
-    (re.compile(r"(?i)\bBasic\s+[A-Za-z0-9._~+/=-]+"), "[REDACTED]"),
-    (re.compile(rf"(?i)([?&#](?:{SECRET_KEY})=)[^\s&#;]+"), r"\1[REDACTED]"),
-    (re.compile(r"(?i)(--(?:api[_-]?key|token|secret|password|client[_-]?secret)\s+)\S+"), r"\1[REDACTED]"),
-    (re.compile(r"(?i)(--(?:api[_-]?key|token|secret|password|client[_-]?secret)=)\S+"), r"\1[REDACTED]"),
-    (re.compile(r"(?i)((?:-p|-u|--user)\s+)\S+:\S+"), r"\1[REDACTED]"),
-    (re.compile(r"gh[pousr]_[A-Za-z0-9_]{20,}"), "[REDACTED]"),
-    (re.compile(r"github_pat_[A-Za-z0-9_]{20,}"), "[REDACTED]"),
-    (re.compile(r"glpat-[A-Za-z0-9_-]{12,}"), "[REDACTED]"),
-    (re.compile(r"xox[abprs]-[A-Za-z0-9-]{10,}"), "[REDACTED]"),
-    (re.compile(r"(?:AKIA|ASIA)[0-9A-Z]{16}"), "[REDACTED]"),
-    (re.compile(r"(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{16,}"), "[REDACTED]"),
-    (re.compile(r"sk-(?:ant|proj)-[A-Za-z0-9_-]{12,}"), "[REDACTED]"),
-    (re.compile(r"sk-[A-Za-z0-9][A-Za-z0-9_-]{20,}"), "[REDACTED]"),
-    (re.compile(r"npm_[A-Za-z0-9]{20,}"), "[REDACTED]"),
-    (re.compile(r"AIza[0-9A-Za-z_\-]{20,}"), "[REDACTED]"),
-    (re.compile(r"SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}"), "[REDACTED]"),
-    (re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+"), "[REDACTED]"),
-    (re.compile(r"([a-z][a-z0-9+.-]*://)[^/\s:@]+:[^/\s@]+@", re.IGNORECASE), r"\1[REDACTED]@"),
+ASSIGNMENT_KEY_RE = re.compile(
+    r"(?P<key>[A-Za-z_$][A-Za-z0-9_$.-]*)[\"']?\s*[:=]\s*$"
+)
+SOURCE_SAFE_VALUE_RE = re.compile(
+    r"^(?:"
+    r"[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*|"
+    r"[A-Za-z_$][A-Za-z0-9_$]*(?:\[[A-Za-z0-9_$., |]+\])+|"
+    r"\d+(?:\.\d+)?|"
+    r"\$\{[A-Za-z0-9_.-]+\}|"
+    r"<[A-Za-z0-9_.-]+>|"
+    r"(?:YOUR|REPLACE|EXAMPLE|PLACEHOLDER)_[A-Z0-9_]+"
+    r")$"
 )
 ANCHOR_RE = re.compile(
     r"^(?:diff --git |index [0-9a-f]|--- |\+\+\+ |@@ |Binary files |(?:[^:\n]+):\d+(?::\d+)?:)",
@@ -200,6 +342,55 @@ COMMAND_MAX_UNTERMINATED_LINE_CHARS = 4_096
 RAW_TRUNCATION_REDACTION_HOLDBACK_CHARS = 1_024
 
 
+SANITIZATION_MODES = (
+    "unknown_text",
+    "command_search_diff",
+    "filesystem_listing",
+    "source_code",
+)
+
+
+@dataclass(frozen=True)
+class SanitizationContext:
+    mode: str = "unknown_text"
+    private_roots: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        if self.mode not in SANITIZATION_MODES:
+            raise ValueError(f"unsupported sanitization context: {self.mode}")
+        object.__setattr__(
+            self,
+            "private_roots",
+            tuple(str(root) for root in self.private_roots),
+        )
+
+
+def coerce_sanitization_context(
+    value: SanitizationContext | str,
+    *,
+    private_roots: Iterable[str] = (),
+) -> SanitizationContext:
+    if isinstance(value, SanitizationContext):
+        supplied_roots = tuple(str(root) for root in private_roots)
+        normalized_context_roots = _normalized_private_roots(value.private_roots)
+        if supplied_roots and _normalized_private_roots(
+            supplied_roots
+        ) != normalized_context_roots:
+            raise ValueError(
+                "private_roots must be declared inside SanitizationContext "
+                "when a context object is supplied"
+            )
+        roots = normalized_context_roots
+        mode = value.mode
+    else:
+        roots = tuple(str(root) for root in private_roots)
+        mode = str(value)
+    return SanitizationContext(
+        mode=mode,
+        private_roots=_normalized_private_roots(roots),
+    )
+
+
 def bounded_int(value: object, default: int, minimum: int, maximum: int) -> int:
     try:
         number = int(value)
@@ -231,16 +422,98 @@ def stable_hash(value: str, length: int = 12) -> str:
     return hashlib.sha256(value.encode("utf-8", errors="replace")).hexdigest()[:length]
 
 
-def anonymize_absolute_paths(text: str) -> str:
+def anonymized_path(path: str) -> str:
+    normalized = path.replace("\\", "/")
+    name = PurePosixPath(normalized).name or "path"
+    return f"{name}#path:{stable_hash(path)}"
+
+
+def anonymize_absolute_paths_with_count(text: str) -> tuple[str, int]:
+    count = 0
+
     def repl(match: re.Match[str]) -> str:
+        nonlocal count
         prefix = match.group("prefix")
         path = match.group("path")
-        normalized = path.replace("\\", "/")
-        name = PurePosixPath(normalized).name or "path"
-        return f"{prefix}{name}#path:{stable_hash(path)}"
+        count += 1
+        return f"{prefix}{anonymized_path(path)}"
 
     text = ABSOLUTE_PATH_RE.sub(repl, text)
-    return WINDOWS_PATH_RE.sub(repl, text)
+    return WINDOWS_PATH_RE.sub(repl, text), count
+
+
+def anonymize_absolute_paths(text: str) -> str:
+    return anonymize_absolute_paths_with_count(text)[0]
+
+
+def _replace_named_paths(text: str, pattern: re.Pattern[str]) -> tuple[str, int]:
+    count = 0
+
+    def repl(match: re.Match[str]) -> str:
+        nonlocal count
+        count += 1
+        return (
+            match.group("prefix")
+            + anonymized_path(match.group("path"))
+            + match.group("suffix")
+        )
+
+    return pattern.sub(repl, text), count
+
+
+def _normalized_private_roots(private_roots: Iterable[str]) -> tuple[str, ...]:
+    normalized: list[str] = []
+    for root in private_roots:
+        value = os.path.normpath(os.path.abspath(os.path.expanduser(str(root))))
+        if value not in normalized:
+            normalized.append(value)
+    return tuple(normalized)
+
+
+def _is_under_private_root(path: str, private_roots: tuple[str, ...]) -> bool:
+    normalized = os.path.normpath(os.path.abspath(os.path.expanduser(path)))
+    return any(
+        normalized == root or normalized.startswith(root.rstrip(os.sep) + os.sep)
+        for root in private_roots
+    )
+
+
+def anonymize_private_root_paths(
+    text: str,
+    private_roots: tuple[str, ...],
+) -> tuple[str, int]:
+    if not private_roots:
+        return text, 0
+    count = 0
+
+    def repl(match: re.Match[str]) -> str:
+        nonlocal count
+        path = match.group("path")
+        if not _is_under_private_root(path, private_roots):
+            return match.group(0)
+        count += 1
+        return match.group("prefix") + anonymized_path(path)
+
+    return ABSOLUTE_PATH_RE.sub(repl, text), count
+
+
+def anonymize_paths_for_context(
+    text: str,
+    *,
+    context: SanitizationContext,
+) -> tuple[str, int]:
+    if context.mode in {"unknown_text", "source_code"}:
+        return text, 0
+
+    total = 0
+    if context.mode == "filesystem_listing":
+        text, count = anonymize_private_root_paths(text, context.private_roots)
+        total += count
+
+    for pattern in (TRACEBACK_PATH_RE, LOCATION_PATH_RE, DIFF_PATH_RE):
+        text, count = _replace_named_paths(text, pattern)
+        total += count
+    return text, total
 
 
 def cap_line(line: str, max_line_chars: int) -> tuple[str, bool]:
@@ -260,21 +533,38 @@ def normalize_getter_key(key: str) -> str:
     return re.sub(r"_+", "_", key).strip("_").lower()
 
 
+def assignment_key(prefix: str) -> str | None:
+    match = ASSIGNMENT_KEY_RE.search(prefix)
+    return match.group("key") if match is not None else None
+
+
 def is_safe_getter_key(key: str) -> bool:
     return normalize_getter_key(key) in SAFE_GETTER_KEY_NAMES
 
 
-def should_redact_unquoted_secret_value(line: str, match: re.Match[str]) -> bool:
+def should_redact_unquoted_secret_value(
+    line: str,
+    match: re.Match[str],
+    *,
+    context: SanitizationContext,
+) -> bool:
     value = match.group("value").strip()
     prefix = match.group("prefix")
     if not value:
         return False
     if value.lower() in SAFE_UNQUOTED_VALUES:
         return False
+    if re.search(r":\s*$", prefix):
+        return not (
+            context.mode == "source_code"
+            and SOURCE_SAFE_VALUE_RE.match(value) is not None
+        )
     if IDENTIFIER_CHAIN_RE.match(value):
         return False
     if SAFE_ENV_LOOKUP_CALL_RE.match(value) or SAFE_RE_COMPILE_CALL_RE.match(value):
         return False
+    if context.mode == "source_code" and SOURCE_SAFE_VALUE_RE.match(value):
+        return False
     getter_match = GETTER_CALL_RE.match(value)
     if re.search(r"\s[:=]\s*$", prefix) and (
         SAFE_CODE_EXPRESSION_CALL_RE.match(value)
@@ -284,45 +574,99 @@ def should_redact_unquoted_secret_value(line: str, match: re.Match[str]) -> bool
     return True
 
 
-def redact_url_like_secret_params(line: str) -> tuple[str, bool]:
-    redacted = False
-
-    def url_repl(match: re.Match[str]) -> str:
-        nonlocal redacted
-        url, count = URL_SECRET_PARAM_RE.subn(r"\1[REDACTED]", match.group(0))
-        if count:
-            redacted = True
-        return url
-
-    return URL_LIKE_RE.sub(url_repl, line), redacted
-
-
-def redact_secret_assignments(line: str) -> tuple[str, bool]:
+def redact_secret_assignments(
+    line: str,
+    *,
+    context: SanitizationContext,
+) -> tuple[str, bool]:
+    """Redact inline secret assignments using the no-location consumer twins.
+
+    The leading grep/diff location prefix is identified once by the scanner and
+    reattached untouched, so no consumer re-parses it at every offset.
+    """
+    # URL 형태 비밀 파라미터는 분리 전 전체 줄에서 처리한다. prefix 안에 들어 있어도
+    # 가려지지 않고 다시 붙는 일이 없어야 한다.
     line, redacted = redact_url_like_secret_params(line)
+    # 반드시 URL 치환 이후의 문자열에서 다시 스캔한다. 호출자가 미리 계산한 split 을
+    # 받아 쓰면 치환으로 길이가 바뀐 문자열에 낡은 오프셋을 적용해 내용이 유실된다.
+    scan = scan_location_prefix(line)
+    location_prefix = scan.prefix
+    line = scan.remainder
 
     def quoted_repl(match: re.Match[str]) -> str:
         nonlocal redacted
+        key = assignment_key(match.group("prefix"))
+        if key is None or not is_sensitive_key(key):
+            return match.group(0)
         redacted = True
         return f"{match.group('lead')}{match.group('prefix')}{match.group('quote')}[REDACTED]{match.group('quote')}"
 
     def unquoted_repl(match: re.Match[str]) -> str:
         nonlocal redacted
-        if not should_redact_unquoted_secret_value(line, match):
+        key = assignment_key(match.group("prefix"))
+        if key is None or not is_sensitive_key(key):
+            return match.group(0)
+        if not should_redact_unquoted_secret_value(line, match, context=context):
             return match.group(0)
         redacted = True
         return f"{match.group('lead')}{match.group('prefix')}[REDACTED]"
 
-    line = INLINE_QUOTED_SECRET_ASSIGNMENT_RE.sub(quoted_repl, line)
-    line = INLINE_UNQUOTED_FALLBACK_SECRET_ASSIGNMENT_RE.sub(unquoted_repl, line)
-    line = INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_RE.sub(unquoted_repl, line)
-    line = INLINE_UNQUOTED_BRACKETED_SECRET_ASSIGNMENT_RE.sub(unquoted_repl, line)
-    line = INLINE_UNQUOTED_SECRET_ASSIGNMENT_RE.sub(unquoted_repl, line)
-    return line, redacted
+    def apply(span: str) -> str:
+        # 언제나 fragment 를 제거한 쌍둥이만 쓴다. 원본으로 되돌아가면 offset 마다
+        # location 을 다시 파싱해 이차 비용이 되살아난다.
+        span = INLINE_QUOTED_SECRET_ASSIGNMENT_NO_LOCATION_RE.sub(quoted_repl, span)
+        span = INLINE_UNQUOTED_FALLBACK_SECRET_ASSIGNMENT_NO_LOCATION_RE.sub(unquoted_repl, span)
+        span = INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_NO_LOCATION_RE.sub(unquoted_repl, span)
+        span = INLINE_UNQUOTED_BRACKETED_SECRET_ASSIGNMENT_NO_LOCATION_RE.sub(unquoted_repl, span)
+        span = INLINE_UNQUOTED_SECRET_ASSIGNMENT_NO_LOCATION_RE.sub(unquoted_repl, span)
+        return span
+
+    # 후보 스팬이 consumer 신호를 품었을 때만 그 스팬도 검사한다. 두 스팬 모두 길이가
+    # 유계이므로 전체는 선형으로 남는다.
+    if scan.declined:
+        location_prefix = apply(location_prefix)
+    return location_prefix + apply(line), redacted
 
 
 MULTILINE_SECRET_ASSIGNMENT_RE = re.compile(
     rf"(?i)(?:^|[\s;{{\[,])(?:(?:[^:\n]+):\d+(?::\d+)?:)?\s*(?:[+-]\s*)?(?:export\s+)?"
-    rf"[\"']?(?:{SECRET_KEY})[\"']?\s*[:=]\s*(?P<quote>[\"'])"
+    rf"[\"']?(?P<key>{SECRET_KEY})[\"']?\s*[:=]\s*(?P<quote>[\"'])"
+)
+
+
+# fragment 를 제거한 일곱 쌍둥이. 이차 비용은 unanchored consumer 에서만 발생하므로
+# 그 일곱 개만 쌍둥이로 돌린다. ^ 로 고정된 헤더 두 개는 fragment 를 한 위치에서만
+# 시도하니 원본을 그대로 쓰고, 스캐너 없이 스스로 prefix 를 건너뛴다.
+UNANCHORED_LOCATION_CONSUMERS = (
+    "INLINE_QUOTED_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_FALLBACK_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_BRACKETED_SECRET_ASSIGNMENT_RE",
+    "INLINE_UNQUOTED_SECRET_ASSIGNMENT_RE",
+    "UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_RE",
+    "MULTILINE_SECRET_ASSIGNMENT_RE",
+)
+ANCHORED_LOCATION_CONSUMERS = ("AUTH_HEADER_RE", "COOKIE_HEADER_RE")
+INLINE_QUOTED_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    INLINE_QUOTED_SECRET_ASSIGNMENT_RE
+)
+INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    INLINE_UNQUOTED_CALL_SECRET_ASSIGNMENT_RE
+)
+INLINE_UNQUOTED_FALLBACK_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    INLINE_UNQUOTED_FALLBACK_SECRET_ASSIGNMENT_RE
+)
+INLINE_UNQUOTED_BRACKETED_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    INLINE_UNQUOTED_BRACKETED_SECRET_ASSIGNMENT_RE
+)
+INLINE_UNQUOTED_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    INLINE_UNQUOTED_SECRET_ASSIGNMENT_RE
+)
+UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_RE
+)
+MULTILINE_SECRET_ASSIGNMENT_NO_LOCATION_RE = without_location_prefix(
+    MULTILINE_SECRET_ASSIGNMENT_RE
 )
 
 
@@ -347,11 +691,23 @@ def has_unescaped_quote(text: str, quote: str, start: int = 0) -> bool:
 
 
 def detect_multiline_secret_assignment(line: str) -> str | None:
-    """Return the quote delimiter when any secret assignment starts a multiline value."""
-    for marker in MULTILINE_SECRET_ASSIGNMENT_RE.finditer(line):
-        quote = marker.group("quote")
-        if not has_unescaped_quote(line, quote, marker.end("quote")):
-            return quote
+    """Return the quote delimiter when any secret assignment starts a multiline value.
+
+    The leading location prefix is removed by the one-pass scanner first, so the
+    detector never re-parses it. Quote balancing still runs against the same
+    remainder the detector matched in, which keeps offsets consistent.
+    """
+    scan = scan_location_prefix(line)
+    # 전체 줄을 먼저 본다: $ 와 줄 끝 의미가 기준선과 같아야 한다. 그 다음 remainder 를
+    # 보아 location prefix 바로 뒤에 붙은 키(콜론 직후)까지 잡는다. 둘 다 한 번씩이라 선형.
+    spans = (line, scan.remainder) if scan.prefix else (line,)
+    for span in spans:
+        for marker in MULTILINE_SECRET_ASSIGNMENT_NO_LOCATION_RE.finditer(span):
+            if not is_sensitive_key(marker.group("key")):
+                continue
+            quote = marker.group("quote")
+            if not has_unescaped_quote(span, quote, marker.end("quote")):
+                return quote
     return None
 
 
@@ -382,9 +738,22 @@ def ends_with_continuation_operator(text: str) -> bool:
 
 
 def detect_multiline_secret_expression(line: str) -> int | None:
-    marker = UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_RE.search(line)
+    # 스캐너가 앞머리 location prefix 를 먼저 떼어내므로 detector 는 그것을 재파싱하지 않는다.
+    # prefix 슬라이싱과 offset 이 어긋나지 않도록 이후 계산도 같은 remainder 위에서 한다.
+    scan = scan_location_prefix(line)
+    spans = (line, scan.remainder) if scan.prefix else (line,)
+    marker = None
+    for span in spans:
+        marker = UNQUOTED_MULTILINE_SECRET_ASSIGNMENT_NO_LOCATION_RE.search(span)
+        if marker is not None:
+            line = span
+            break
     if marker is None:
         return None
+    prefix = line[: marker.start("value")]
+    key = assignment_key(prefix)
+    if key is None or not is_sensitive_key(key):
+        return None
     value = marker.group("value").strip()
     if not value:
         return 0
@@ -419,12 +788,23 @@ def secret_or_private_key_redaction_label(line: str) -> str:
 
 
 class LineSanitizer:
-    def __init__(self, *, show_paths: bool = False) -> None:
+    def __init__(
+        self,
+        *,
+        show_paths: bool = False,
+        context: SanitizationContext | str = "unknown_text",
+        private_roots: Iterable[str] = (),
+    ) -> None:
         self.show_paths = show_paths
+        self.context = coerce_sanitization_context(
+            context,
+            private_roots=private_roots,
+        )
         self.in_private_key_block = False
         self.multiline_secret_quote: str | None = None
         self.multiline_secret_expression_depth: int | None = None
         self.redactions = 0
+        self.path_redactions = 0
 
     def sanitize(self, raw_line: str) -> tuple[str, bool]:
         line = strip_ansi(raw_line)
@@ -481,6 +861,11 @@ class LineSanitizer:
             self.multiline_secret_expression_depth = expression_depth
             return self._finish(diff_prefix + "[REDACTED MULTILINE SECRET]\n", True)
 
+        # 헤더 두 consumer 는 ^ 로 고정되어 있으므로 스캐너가 떼어낸 remainder 에 적용하고
+        # 앞머리 prefix 를 손대지 않은 채 다시 붙인다. 바이트 재구성은 정확해야 한다.
+        # 헤더 두 consumer 는 ^ 로 고정되어 있어 location fragment 를 단 한 위치에서만
+        # 시도한다. 즉 이차 비용의 원인이 아니므로 원본 패턴을 그대로 쓰고, 자신이
+        # 앞머리 prefix 를 건너뛰게 둔다. 스캐너는 unanchored consumer 만 돕는다.
         new_line, count = AUTH_HEADER_RE.subn(r"\g<prefix>[REDACTED]", line)
         if count:
             redacted = True
@@ -491,22 +876,30 @@ class LineSanitizer:
             redacted = True
             line = new_line
 
-        line, assignment_redacted = redact_secret_assignments(line)
+        line, assignment_redacted = redact_secret_assignments(
+            line,
+            context=self.context,
+        )
         if assignment_redacted:
             redacted = True
 
-        for pattern, replacement in INLINE_PATTERNS:
-            line, count = pattern.subn(replacement, line)
-            if count:
-                redacted = True
+        line, credential_redactions = redact_high_confidence_credentials(line)
+        if credential_redactions:
+            redacted = True
 
         return self._finish(line, redacted)
 
     def _finish(self, line: str, redacted: bool) -> tuple[str, bool]:
+        if not self.show_paths:
+            line, path_redactions = anonymize_paths_for_context(
+                line,
+                context=self.context,
+            )
+            if path_redactions:
+                self.path_redactions += path_redactions
+                redacted = True
         if redacted:
             self.redactions += 1
-        if not self.show_paths:
-            line = anonymize_absolute_paths(line)
         return line, redacted
 
 
@@ -600,7 +993,11 @@ class BoundedOutput:
 
 
 def sanitize_stream(stream: Iterable[str], args: argparse.Namespace) -> tuple[str, int, int]:
-    sanitizer = LineSanitizer(show_paths=args.show_paths)
+    sanitizer = LineSanitizer(
+        show_paths=args.show_paths,
+        context=getattr(args, "context", "unknown_text"),
+        private_roots=getattr(args, "private_root", ()),
+    )
     bounded = BoundedOutput(
         max_lines=args.max_lines,
         max_chars=args.max_chars,
@@ -872,6 +1269,33 @@ def stdin_has_data(stdin: TextIO) -> bool:
     return not stdin.isatty()
 
 
+def command_uses_search_diff_output(command: list[str]) -> bool:
+    if not command:
+        return False
+    executable = os.path.basename(command[0])
+    if executable in {"grep", "rg"}:
+        return True
+    if executable != "git":
+        return False
+    value_options = {"-C", "-c", "--git-dir", "--work-tree", "--namespace"}
+    skip_next = False
+    for arg in command[1:]:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg == "--":
+            break
+        if arg in value_options:
+            skip_next = True
+            continue
+        if any(arg.startswith(option + "=") for option in value_options if option.startswith("--")):
+            continue
+        if arg.startswith("-"):
+            continue
+        return arg in {"diff", "grep", "log", "show"}
+    return False
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         description="Redact secrets and budget grep/diff/log output before sending it to Claude."
@@ -896,6 +1320,30 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="show raw absolute paths instead of basename#path:<hash>; local debugging only because private paths may be exposed",
     )
+    parser.add_argument(
+        "--context",
+        choices=SANITIZATION_MODES,
+        default="unknown_text",
+        help=(
+            "sanitization origin policy (default: unknown_text); path-aware modes "
+            "only anonymize structurally proven locations"
+        ),
+    )
+    parser.add_argument(
+        "--private-root",
+        action="append",
+        default=[],
+        help=(
+            "private root eligible for path anonymization in filesystem_listing "
+            "mode; may be repeated"
+        ),
+    )
+    parser.add_argument(
+        "--context-guard-wrapper-v1",
+        choices=("command_search_diff",),
+        dest="wrapper_context",
+        help=argparse.SUPPRESS,
+    )
     parser.add_argument("command", nargs=argparse.REMAINDER)
     return parser
 
@@ -907,6 +1355,30 @@ def main() -> int:
     command = args.command
     if command and command[0] == "--":
         command = command[1:]
+    if args.wrapper_context is not None:
+        if len(command) != 3 or command[0:2] != ["bash", "-lc"] or not command[2]:
+            print(
+                "context-guard-sanitize-output: invalid context-guard wrapper v1 shape",
+                file=sys.stderr,
+            )
+            return 2
+        context = coerce_sanitization_context(
+            args.wrapper_context,
+            private_roots=args.private_root,
+        )
+    else:
+        context = coerce_sanitization_context(
+            args.context,
+            private_roots=args.private_root,
+        )
+        if (
+            context.mode == "unknown_text"
+            and command_uses_search_diff_output(command)
+        ):
+            context = SanitizationContext(
+                mode="command_search_diff",
+                private_roots=context.private_roots,
+            )
 
     proc: subprocess.Popen[bytes] | None = None
     command_stream: TimedCommandStream | None = None
@@ -927,14 +1399,17 @@ def main() -> int:
         print("context-guard-sanitize-output: missing command or stdin", file=sys.stderr)
         return 2
 
+    args.context = context
     output, _redactions, _line_count = sanitize_stream(stream, args)
     rc: int | None = None
     if proc is not None:
         rc = command_stream.returncode() if command_stream is not None else proc.wait()
         if command_stream is not None and command_stream.timed_out and not command_stream.timeout_reported:
-            timeout_line, _redacted = LineSanitizer(show_paths=args.show_paths).sanitize(
-                command_stream.timeout_message()
-            )
+            timeout_line, _redacted = LineSanitizer(
+                show_paths=args.show_paths,
+                context=context,
+                private_roots=args.private_root,
+            ).sanitize(command_stream.timeout_message())
             command_stream.timeout_reported = True
             output = output + timeout_line