@maudecode/talaria-web 1.15.0 → 1.17.2

package/dist/redact.js

@@ -1,12 +1,15 @@
 import { str } from './util.js';
 import { snapshotArgs, toolArgs, toolDisplay, toolName } from './sessions/tool-display.js';
+import { messageText } from './sessions/merge.js';
+import { stripAttachedFilesMarker } from './sessions/session.js';
 /**
  * Credential redaction and the public session projection (Python
  * `api/helpers.py`). API responses are a hard boundary: transcript-bearing
  * fields are masked with the local pattern set, and private replay aliases
- * are stripped at their schema positions. The Agent's broader redactor is
- * not consulted (it lives in-process in Python); the local patterns mirror
- * its known credential prefixes.
+ * are stripped at their schema positions. The Agent's redactor
+ * (`agent/redact.py`, `redact_sensitive_text(force=True)`) is not consulted
+ * at runtime; its pattern families are ported here and held to parity by
+ * the `Agent redactor parity` tests.
  */
 const CRED_RE = new RegExp('(?<![A-Za-z0-9_-])(' +
     'sk-[A-Za-z0-9_-]{10,}' +
@@ -16,6 +19,7 @@ const CRED_RE = new RegExp('(?<![A-Za-z0-9_-])(' +
     '|ghu_[A-Za-z0-9]{10,}' +
     '|ghs_[A-Za-z0-9]{10,}' +
     '|ghr_[A-Za-z0-9]{10,}' +
+    '|xapp-\\d+-[A-Za-z0-9-]{10,}' +
     '|xox[baprs]-[A-Za-z0-9-]{10,}' +
     '|AIza[A-Za-z0-9_-]{30,}' +
     '|pplx-[A-Za-z0-9]{10,}' +
@@ -44,6 +48,14 @@ const CRED_RE = new RegExp('(?<![A-Za-z0-9_-])(' +
     '|hsk-[A-Za-z0-9]{10,}' +
     '|mem0_[A-Za-z0-9]{10,}' +
     '|brv_[A-Za-z0-9]{10,}' +
+    '|xai-[A-Za-z0-9]{30,}' +
+    '|ntn_[A-Za-z0-9]{10,}' +
+    '|fw[-_][A-Za-z0-9]{30,}' +
+    '|fpk_[A-Za-z0-9]{30,}' +
+    '|(?:glpat|gloas|gldt|glcbt|glptt|glft|glimt|glagent|glsoat|glffct|glwt)-[A-Za-z0-9_-]{10,}' +
+    '|glrtr?-[A-Za-z0-9_.-]{10,}' +
+    '|GR1348941[A-Za-z0-9_-]{10,}' +
+    '|pk-lf-[A-Za-z0-9-]{8,}' +
     ')(?![A-Za-z0-9_-])', 'g');
 /** One `name=value` auth parameter: an escaped-quoted, quoted or bare value. */
 const AUTH_PARAM = String.raw `[A-Za-z0-9_-]+=(?:\\"(?:[^"\\\r\n]|\\[^"])*\\"|"(?:[^"\\\r\n]|\\.)*"|'[^'\r\n]*'|[^\s,"'\\]*)`;
@@ -54,8 +66,8 @@ const AUTH_PARAM = String.raw `[A-Za-z0-9_-]+=(?:\\"(?:[^"\\\r\n]|\\[^"])*\\"|"(
  * A parameterized credential (`Digest username="bob", response="..."`, `Credential=..., Signature=...`) is masked whole.
  */
 const AUTH_HDR_RE = new RegExp(String.raw `(Authorization:\s*(?:(?!\*+\s)[A-Za-z0-9!#$%&*+.^_|~-]+\s+(?=[^\s,\])]))?)(${AUTH_PARAM}(?:\s*,\s*${AUTH_PARAM})*|[^\s,\])][^\s'",\])]*)`, 'gi');
-/** A JSON Web Token anywhere (`eyJ<header>.<payload>.<signature>`). */
-const JWT_RE = /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g;
+/** A JSON Web Token anywhere (`eyJ<header>.<payload>.<signature>`), or its header alone or with its payload. */
+const JWT_RE = /\beyJ(?:[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}|[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_=-]{4,}){0,2})/g;
 /** A bearer credential in any header or text (`X-Auth: Bearer ...`); `AUTH_HDR_RE` owns the `Authorization:` header. */
 const BEARER_RE = /((?<!Authorization:\s{0,8})\bBearer\s+)([^\s,\])][^\s'",\])]*)/gi;
 /** One shell-quoted piece, which may span lines: `'...'`, `"..."` (with backslash escapes), bash `$'...'` / `$"..."`, or JSON escaped inside a shell string (`\"...\"`). */
@@ -100,6 +112,36 @@ const percentDecode = (text) => text.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => S
 const LISTED_FLAG_RE = /(["'])(-{1,2})([A-Za-z0-9_][A-Za-z0-9_.-]*)\1(\s*,\s*)(?:(["'])((?:\\.|(?!\5)[^\\])*)\5|(\[[^[\]]*\]|\{[^{}]*\}|[^\s,\])}'"[{]+))/g;
 const EMBEDDED_AWS_RE = /(?:AKIA|ASIA)[A-Z0-9]{16}/g;
 const ENV_RE = /([A-Z0-9_]{0,50}(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)[A-Z0-9_]{0,50})\s*=\s*(['"]?)(\S+)\2/g;
+/**
+ * The Agent's other env names: an all-caps one holding `KEY`, `PASS` or `PW` (`OPENAI_KEY`, `DB_PW`), or a `name_key` /
+ * `name_pass` / `name_pw` in any case, URL query parameters included (the Agent skips any text with a URL). One attempt per
+ * identifier, which must hold a keyword, so the scan stays linear on long runs (`PWPWPW…`). The value is the shell word
+ * after `=`, read by `shellWordEnd` (quotes, escapes, `$'…'`).
+ */
+const ENV_SUFFIX_RE = /(?<![A-Za-z0-9_])((?=[A-Z0-9_]*(?:KEY|PASS|PW))[A-Z0-9_]+|[A-Za-z0-9_]+_(?:[Kk][Ee][Yy]|[Pp][Aa][Ss][Ss]|[Pp][Ww])(?![A-Za-z0-9_]))[ \t]*=[ \t]*/g;
+/** The prefilter's view of `ENV_SUFFIX_RE`. */
+const ENV_SUFFIX_TEST_RE = new RegExp(ENV_SUFFIX_RE.source);
+/**
+ * The Agent's env-name keywords, as whole name words (`DB_PW`, `GITHUB_TOKEN`), never inside a word (`KEYBOARD`, `PASSAGE`,
+ * `TOKENIZER`, `AUTHOR_KEY`'s `AUTH`).
+ */
+const ENV_KEYWORD_RE = /(?:^|[^A-Za-z])(?:(?:api|auth|access|refresh|session|secret)[ _.-]?(?:key|token)|token|secret|passwd|password|pass|pw|credential|auth|key)s?(?![A-Za-z])/i;
+/**
+ * Env names whose value is a credential whatever its shape, as whole name words (`DB_PASS`, not `COMPASS_KEY` or
+ * `AUTHOR_KEY`); a bare `KEY` needs an opaque value (`SORT_KEY=name` stays).
+ */
+const ENV_STRONG_NAME_RE = /(?:^|[^A-Za-z])(?:(?:api|auth|access|refresh|session|id|bearer)[ _.-]?(?:key|token)|key[ _.-]?material|secret|passwd|password|pass|pw|credentials?|auth|bearer)s?(?![A-Za-z])/i;
+/**
+ * The Agent's env-assignment gate: a name holding a whole keyword whose value is a credential, because the name is strong
+ * or the value opaque (`GITHUB_TOKEN=abc` and `MAX_TOKENS=100` stay). Env lookups (`os.getenv(…)`) name a variable.
+ */
+const isEnvCredential = (key, value) => !/^(?:os\.(?:getenv|environ)|process\.env|\$ENV\{)/.test(value) && ENV_KEYWORD_RE.test(key) && (ENV_STRONG_NAME_RE.test(key) || looksOpaque(value));
+/** The Agent's `_looks_like_opaque_credential`: a value shaped like a generated secret rather than a word. */
+function looksOpaque(value) {
+    if (value === '***' || /^[A-Fa-f0-9]{16,}$/.test(value) || /^[A-Za-z0-9_./+=-]{20,}$/.test(value))
+        return true;
+    return value.length >= 12 && [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(value)).length >= 2;
+}
 /**
  * `scheme://user:secret@host` (database and basic-auth URLs): the password is masked, the user and host stay. The user
  * and password may be assembled from quoted and escaped shell pieces (`bob:hun'ter2'@`), and every delimiter may be
@@ -171,12 +213,214 @@ const USER_FLAG_RE = /(?<![A-Za-z0-9-])(?:-[uU][ \t]*|--(?:user|proxy-u(?:s(?:e(
 /** The prefilter's view of `USER_FLAG_RE`. */
 const USER_FLAG_TEST_RE = new RegExp(USER_FLAG_RE.source);
 const QUERY_KEY_RE = /([?&]key=)([^\s"'&#]+)/gi;
+/**
+ * A Telegram bot token (`bot<id>:<secret>`): the id stays. The id starts a digit run, so a long number is scanned once
+ * rather than from every digit (a match from mid-run would end at the same `:`).
+ */
+const TELEGRAM_TOKEN_RE = /(bot)?(?<!\d)(\d{8,}):([-A-Za-z0-9_]{30,})/g;
+/** An E.164 phone number, masked to its first and last digits; never inside a word or encoded data (`ab+1234567`). */
+const PHONE_RE = /(?<![A-Za-z0-9])\+[1-9]\d{6,14}(?![A-Za-z0-9])/g;
+/**
+ * A bare token as URL userinfo (`https://TOKEN@github.com`, `ssh://…@`): no `user:` part, at least 8 characters. Round-trip
+ * URLs carry tokens in the query, so a bare userinfo credential is never one.
+ */
+const URL_BARE_TOKEN_RE = /((?:https?|wss?|git|ssh|ftps?|sftp):\/\/)([^\s:@/?#]{8,})(?=@\S)/gi;
+/** C0, DEL, C1 and zero-width characters that can split a token body (`ghp_abc\x1bdef`, `sk-abc\u200bdef`). */
+const CONTROL_CHAR_RE = /[\x00-\x1f\x7f-\x9f\u200b-\u200f\u2028-\u202f\u2060\ufeff]/;
+const CONTROL_CHARS_RE = new RegExp(CONTROL_CHAR_RE.source, 'g');
+/** C0 controls a terminal runs inside an escape sequence without ending it (all but CAN, SUB and ESC), and DEL. */
+const SEQ_C0 = String.raw `\x00-\x17\x19\x1c-\x1f\x7f`;
+/** Where a sequence ends early: CAN or SUB cancels it, and ESC, a C1 control or the end of the text interrupts it. */
+const SEQ_CUT = String.raw `(?:[\x18\x1a]|(?=[\x1b\x80-\x9f]|$))`;
+const SEQ_ESC = String.raw `\x1b[${SEQ_C0}]*`;
+/** Parameters and intermediates in any order: a parameter after an intermediate makes a terminal ignore the CSI. */
+const SEQ_CSI = String.raw `(?:${SEQ_ESC}\[|\x9b)[ -?${SEQ_C0}]*(?:[@-~]|${SEQ_CUT})`;
+const SEQ_NF = String.raw `${SEQ_ESC}[ -/][ -/${SEQ_C0}]*(?:[0-~]|${SEQ_CUT})`;
+const SEQ_SINGLE = String.raw `${SEQ_ESC}[0-OQ-WYZ\\\x60-~]`;
+/**
+ * An ECMA-48 escape sequence as a terminal parses it, or one control or zero-width character. The sequences, 7-bit
+ * `ESC …` or the C1 code point: CSI (`ESC [` … final byte), the strings OSC (… BEL or ST) and DCS, SOS, PM and APC
+ * (… ST), a character-set selection (`ESC ( B`), and a single-character escape (`ESC 7`); each also ends at `SEQ_CUT`.
+ * No part of a sequence can start the part after it, which keeps the scan linear.
+ */
+const ANSI_GAPS_RE = new RegExp([
+    SEQ_CSI,
+    String.raw `(?:${SEQ_ESC}\]|\x9d)[^\x07\x18\x1a\x1b\x80-\x9f]*(?:\x07|\x1b\\|\x9c|${SEQ_CUT})`,
+    String.raw `(?:${SEQ_ESC}[PX^_]|[\x90\x98\x9e\x9f])[^\x18\x1a\x1b\x80-\x9f]*(?:\x1b\\|\x9c|${SEQ_CUT})`,
+    SEQ_NF,
+    SEQ_SINGLE,
+    CONTROL_CHAR_RE.source,
+].join('|'), 'g');
+/** `ANSI_GAPS_RE` with a string's payload kept: only its opener and terminator are gaps. */
+const ANSI_PAYLOAD_GAPS_RE = new RegExp([SEQ_CSI, String.raw `${SEQ_ESC}[\]PX^_]`, SEQ_NF, SEQ_SINGLE, CONTROL_CHAR_RE.source].join('|'), 'g');
+/**
+ * The views a split token is matched on: without whole escape sequences, without them but keeping string payloads (a
+ * terminal title can hold a token), and without control characters only (an escape's final byte can be a token's).
+ */
+const SPLIT_VIEWS = [ANSI_GAPS_RE, ANSI_PAYLOAD_GAPS_RE, CONTROL_CHARS_RE];
+const ANSI_GAP_AT_RE = new RegExp(ANSI_GAPS_RE.source, 'y');
+const TOKEN_CHAR_RE = /[A-Za-z0-9_-]/;
+/** A string sequence's opener, with an OSC's command number (`8;`), which is no payload. */
+const STRING_OPENER_RE = new RegExp(String.raw `^(?:(?:${SEQ_ESC}\]|\x9d)(?:\d*;)?|${SEQ_ESC}[PX^_]|[\x90\x98\x9e\x9f])`);
+const PAYLOAD_RUN_CAP = 65_536;
+const CRED_TEST_RE = new RegExp(CRED_RE.source);
+/** `CRED_RE`'s prefix and body from a position, without its boundaries (a split token checks the original ones). */
+const CRED_RUN_RE = new RegExp(CRED_RE.source.replace(/^\(\?<!\[A-Za-z0-9_-\]\)/, '').replace(/\(\?!\[A-Za-z0-9_-\]\)$/, ''), 'y');
+const SPLIT_TOKEN_CAP = 1024;
+/** Where a `CRED_RE` prefix and body start at a boundary, however they end. */
+const CRED_START_RE = new RegExp(CRED_RE.source.replace(/\(\?!\[A-Za-z0-9_-\]\)$/, ''), 'g');
+const CRED_WHOLE_RE = new RegExp(`^${CRED_RE.source}$`);
+/** `CRED_START_RE` and `CRED_RUN_RE` without their body: a credential's prefix, however little of its body follows. */
+const CRED_PREFIX_RE = new RegExp(CRED_START_RE.source.replace(/\{\d+,?\}/g, '{0}'), 'g');
+const CRED_PREFIX_RUN_RE = new RegExp(CRED_RUN_RE.source.replace(/\{\d+,?\}/g, '{0}'), 'y');
+/** A URL query parameter's value, up to the next `&` or `#`. */
+const QUERY_VALUE_RE = /[^&#]*/y;
 const PRIVKEY_RE = /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g;
 /** A private key whose end marker is missing (a display cap cut it off): masked to the end of the text. */
 const PRIVKEY_OPEN_RE = /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*$/;
 const CODE_ENV_KEY_LITERAL_RE = /([A-Z0-9_]{0,50}(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)[A-Z0-9_]{0,50}=)(["'][)\]:,]+|[)\]:,]+)/y;
 const ENV_KEY_PREFIX_RE = /([A-Z0-9_]{0,50}(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)[A-Z0-9_]{0,50}=)/g;
 const REDACTED_ENV_VALUE_RE = /(?:\*{3,}|[A-Za-z0-9][A-Za-z0-9_.:/+-]{0,32}\.\.\.[A-Za-z0-9_.:/+-]{1,16})/y;
+/**
+ * Where a credential split by control or zero-width characters (`ghp_abc\x1bdef`, `ghp_abc\ndef…`) starting at `i` of the
+ * stripped text ends there, or -1. The run of its prefix and body is read once (capped), then the longest candidate is
+ * taken that ends at a piece boundary of the original, is a whole credential, is not the name of a `KEY=` that follows,
+ * and never reaches a line holding a whole token itself (that line is the prefix pass's and joins nothing).
+ */
+function splitTokenEnd(text, stripped, kept, i) {
+    CRED_RUN_RE.lastIndex = 0;
+    // ponytail: a split credential longer than SPLIT_TOKEN_CAP is cut at the cap; raise it if longer tokens appear.
+    const run = CRED_RUN_RE.exec(stripped.slice(i, i + SPLIT_TOKEN_CAP))?.[0];
+    if (!run)
+        return -1;
+    const start = kept[i];
+    let limit = kept[i + run.length - 1] + 1;
+    for (let lineStart = start; lineStart < limit;) {
+        const lineEnd = text.slice(lineStart, limit).search(/[\r\n]/);
+        const end = lineEnd === -1 ? limit : lineStart + lineEnd;
+        if (CRED_TEST_RE.test(text.slice(lineStart, end))) {
+            limit = lineStart === start ? end : lineStart;
+            break;
+        }
+        if (lineEnd === -1)
+            break;
+        lineStart = end + 1;
+    }
+    for (let e = i + run.length; e > i; e -= 1) {
+        const atBoundary = e === stripped.length || kept[e] - kept[e - 1] > 1 || (e === i + run.length && !/[A-Za-z0-9_-]/.test(stripped[e]));
+        const originalEnd = kept[e - 1] + 1;
+        if (!atBoundary || originalEnd > limit || !CRED_WHOLE_RE.test(stripped.slice(i, e)) || /^[ \t]*=/.test(text.slice(originalEnd, originalEnd + 64)))
+            continue;
+        return e;
+    }
+    return -1;
+}
+/**
+ * The original spans, and the joined text, of prefixed credentials whose body a gap of one of `SPLIT_VIEWS` splits,
+ * matched on the text without those gaps, plus `payloadRunSpan`'s from each prefix. A token starts at a boundary of the
+ * stripped text, or where a stripped gap hid the original one (`note\nghp_…`); one starting inside a token already
+ * masked is part of it.
+ */
+function splitTokenSpans(text, gaps) {
+    const stripped = text.replace(gaps, '');
+    if (stripped.length === text.length)
+        return [];
+    // The original index of each kept character.
+    const kept = [];
+    let at = 0;
+    for (const m of text.matchAll(gaps)) {
+        while (at < m.index)
+            kept.push(at++);
+        at += m[0].length;
+    }
+    while (at < text.length)
+        kept.push(at++);
+    const starts = [...stripped.matchAll(CRED_START_RE)].map((m) => m.index);
+    const prefixStarts = [...stripped.matchAll(CRED_PREFIX_RE)].map((m) => m.index);
+    for (let i = 1; i < kept.length; i += 1) {
+        if (kept[i] - kept[i - 1] <= 1 || !TOKEN_CHAR_RE.test(stripped[i - 1]))
+            continue;
+        starts.push(i);
+        CRED_PREFIX_RUN_RE.lastIndex = i;
+        if (CRED_PREFIX_RUN_RE.test(stripped))
+            prefixStarts.push(i);
+    }
+    const spans = [];
+    let scanned = 0;
+    for (const i of starts.sort((a, b) => a - b)) {
+        if (i < scanned)
+            continue;
+        const e = splitTokenEnd(text, stripped, kept, i);
+        if (e === -1)
+            continue;
+        spans.push([kept[i], kept[e - 1] + 1, stripped.slice(i, e)]);
+        scanned = e;
+    }
+    let walked = 0;
+    for (const i of prefixStarts.sort((a, b) => a - b)) {
+        if (kept[i] < walked)
+            continue;
+        const [span, reached] = payloadRunSpan(text, kept[i]);
+        if (span)
+            spans.push(span);
+        walked = reached;
+    }
+    return spans;
+}
+/**
+ * Fail-closed for a token split across string payloads: from a credential prefix at `start`, the span through the run of
+ * token characters and whole escape sequences after it, when a string payload in the run holds token characters, and
+ * where the run stopped. Any subset of payloads can hold a token's pieces and the rest junk
+ * (`\x1b]0;ghp_ab\x1b]0;x_y\x07cd…`), so the run is masked whole rather than rebuilt.
+ */
+function payloadRunSpan(text, start) {
+    let token = '';
+    let end = start;
+    let hidden = false;
+    let k = start;
+    // ponytail: a run longer than PAYLOAD_RUN_CAP is masked in pieces; raise it if longer hidden tokens appear.
+    while (k < text.length && k - start < PAYLOAD_RUN_CAP) {
+        ANSI_GAP_AT_RE.lastIndex = k;
+        const gap = ANSI_GAP_AT_RE.exec(text)?.[0];
+        if (gap) {
+            const from = STRING_OPENER_RE.exec(gap)?.[0].length ?? gap.length;
+            for (let j = from; j < gap.length; j += 1) {
+                if (!TOKEN_CHAR_RE.test(gap[j]))
+                    continue;
+                token += gap[j];
+                end = k + j + 1;
+                hidden = true;
+            }
+            k += gap.length;
+        }
+        else if (TOKEN_CHAR_RE.test(text[k])) {
+            token += text[k];
+            end = k += 1;
+        }
+        else
+            break;
+    }
+    return [hidden ? [start, end, token] : null, k];
+}
+/** Masks each union of the split-token spans every view finds, so no view masks a piece of a token another one joins. */
+function maskSplitTokens(text) {
+    const spans = SPLIT_VIEWS.flatMap((gaps) => splitTokenSpans(text, gaps)).sort((a, b) => a[0] - b[0]);
+    let out = '';
+    let last = 0;
+    for (let k = 0; k < spans.length;) {
+        const start = spans[k][0];
+        let [, end, token] = spans[k];
+        for (k += 1; k < spans.length && spans[k][0] < end; k += 1) {
+            const [, nextEnd, nextToken] = spans[k];
+            end = Math.max(end, nextEnd);
+            if (nextToken.length > token.length)
+                token = nextToken;
+        }
+        out += text.slice(last, start) + mask(token);
+        last = end;
+    }
+    return out + text.slice(last);
+}
 function mask(token) {
     // By code point, so a partial mask never splits a surrogate pair into invalid JSON.
     const chars = Array.from(token);
@@ -437,6 +681,38 @@ function maskShellWord(value) {
 }
 /** A shell word's content, for the "nothing to mask" checks: the inside of a single quoted piece, else the word. */
 const shellWordInner = (value) => splitQuoted(value)?.inner ?? value;
+/**
+ * `ENV_SUFFIX_RE` assignments whose name is a credential (`DB_PASS=`, `openai_key=`). A password-class name masks any value,
+ * punctuation-only included; a bare `KEY` masks an opaque one. A plain value keeps the Agent's partial mask; a quoted,
+ * escaped or composed one is masked whole. Env lookups (`os.getenv(…)`) and masked values stay.
+ */
+function redactEnvSuffixes(text) {
+    let out = '';
+    let last = 0;
+    const quoteAt = quoteTracker(text);
+    const closeOf = enclosingClose(text);
+    // A skipped value does not move the scan past its word: a later match inside that word reuses its end, and a value is
+    // judged by its head, so many assignments inside one long word (`a_key=x\ a_key=x\ …`) still scan it once.
+    let wordEnd = -1;
+    ENV_SUFFIX_RE.lastIndex = 0;
+    for (let m = ENV_SUFFIX_RE.exec(text); m; m = ENV_SUFFIX_RE.exec(text)) {
+        const key = m[1];
+        const valueStart = m.index + m[0].length;
+        wordEnd = valueStart < wordEnd ? wordEnd : shellWordEnd(text, valueStart, quoteAt(valueStart), closeOf);
+        // A URL query parameter's value ends at the next `&` or `#`, as in `redactCredentialParams`.
+        QUERY_VALUE_RE.lastIndex = valueStart;
+        const valueEnd = /[?&]/.test(text[m.index - 1] ?? '') ? Math.min(wordEnd, valueStart + QUERY_VALUE_RE.exec(text)[0].length) : wordEnd;
+        const value = text.slice(valueStart, valueEnd);
+        const head = value.slice(0, 128);
+        const inner = shellWordInner(head);
+        if (!inner.trim() || inner === '***' || !isEnvCredential(key, shellDequote(head)))
+            continue;
+        out += text.slice(last, valueStart) + (/^[^\s'"\\$`]+$/.test(value) ? mask(value) : maskShellWord(value));
+        last = valueEnd;
+        ENV_SUFFIX_RE.lastIndex = Math.max(valueEnd, ENV_SUFFIX_RE.lastIndex);
+    }
+    return out + text.slice(last);
+}
 /** Credential parameters (`CRED_PARAM_RE`) with their whole shell-word value fully masked. */
 function redactCredentialParams(text) {
     let out = '';
@@ -565,6 +841,198 @@ function redactUserFlags(text) {
     }
     return out + text.slice(last);
 }
+const REGISTRY_LOGIN = { separate: ['-p'], attached: ['-p'], login: true, switches: ['-D', '--debug', '--tls', '--tlsverify', '-r', '--remote', '--syslog'] };
+const MYSQL = { attached: ['-p'] };
+const COMMAND_FLAGS = {
+    docker: REGISTRY_LOGIN, podman: REGISTRY_LOGIN, buildah: REGISTRY_LOGIN, nerdctl: REGISTRY_LOGIN, skopeo: REGISTRY_LOGIN, oras: REGISTRY_LOGIN, helm: REGISTRY_LOGIN,
+    mysql: MYSQL, mysqladmin: MYSQL, mysqldump: MYSQL, mysqlimport: MYSQL, mysqlshow: MYSQL, mysqlcheck: MYSQL, mysqlslap: MYSQL, mysql_upgrade: MYSQL, mysqlbinlog: MYSQL, mysqlsh: MYSQL,
+    mariadb: MYSQL, 'mariadb-admin': MYSQL, 'mariadb-dump': MYSQL, 'mariadb-import': MYSQL, 'mariadb-show': MYSQL, 'mariadb-check': MYSQL, 'mariadb-slap': MYSQL, 'mariadb-upgrade': MYSQL, 'mariadb-binlog': MYSQL,
+    sshpass: { separate: ['-p'], attached: ['-p'], values: ['-f', '-d', '-P'], stop: true },
+    'redis-cli': { separate: ['-a', '--pass'] },
+    smbclient: { separate: ['-U', '--user'], attached: ['-U', '--user='], percent: true },
+};
+/**
+ * A known command's name as a word: bare, after a path, a listed argv element, or composed by quotes (`do"cker"`); or a
+ * word the shell computes in whole or part (`$CLIENT`, `$(echo $(which mysql))`, `` `printf docker` ``, `my${EMPTY}sql`),
+ * which may name any of them wherever it stands (`sudo -u root $CLIENT -ppw`). A computed word is matched whole when its
+ * pieces are flat, so a quoted one reads as a listed element; otherwise up to its first expansion, and read from there.
+ */
+/** A parameter, substitution or backtick piece of a word; a name is read whole, so a word splits into pieces one way only. */
+const EXPANSION = String.raw `\$[A-Za-z_][A-Za-z0-9_]*(?![A-Za-z0-9_])|\$\{[^{}\n]*\}|\$\([^()\n]*\)|\x60[^\x60\n]*\x60`;
+const COMMAND_FLAG_RE = new RegExp(String.raw `(?<![^\s;&|()\x60'"/,[\\])(?:(?:${Object.keys(COMMAND_FLAGS).map((name) => name.replaceAll(/(?<=.)(?=.)/g, String.raw `["'\\]*`)).join('|')}|[\w./-]*(?:${EXPANSION})(?:[\w./-]|${EXPANSION})*)(?=[\s;&|)'",\]]|$)|[\w./-]*(?=\$[({A-Za-z_]|\x60))`, 'g');
+/** Every command's flags, for an executable the shell computes. */
+const ALL_COMMAND_FLAGS = [...new Set(Object.values(COMMAND_FLAGS))];
+const COMMAND_FLAG_TEST_RE = new RegExp(COMMAND_FLAG_RE.source);
+/**
+ * For an argv (`words` as the programs receive them), the words holding a command's secret, each with the offset it starts
+ * at. Every known command named so far is read at once, so a wrapper's operand naming one (`sudo -u mysql docker login -p
+ * pw`) does not hide the command it runs.
+ */
+function commandFlagMasks(words) {
+    const masks = new Map();
+    const states = new Map();
+    const secret = (flags, index, value, from) => {
+        if (value === undefined)
+            return;
+        const at = flags.percent ? value.indexOf('%', from) + 1 : from;
+        if ((at || !flags.percent) && value.slice(at) && value.slice(at) !== '***')
+            masks.set(index, at);
+    };
+    for (let i = 0; i < words.length; i += 1) {
+        const word = words[i];
+        for (const [flags, state] of states) {
+            if (i < state.next)
+                continue;
+            if (!state.active) {
+                // The subcommand is the first operand past the options; one right after a bare option may be its value. One the shell
+                // computes (`docker "$ACTION" -p pw`) may be `login`.
+                if (word === 'login' || /[$`]/.test(word))
+                    state.active = true;
+                else if (!word.startsWith('-') && word !== 'registry' && !(/^-[^=]*$/.test(words[i - 1]) && !flags.switches?.includes(words[i - 1])))
+                    states.delete(flags);
+                continue;
+            }
+            if (flags.separate?.includes(word)) {
+                secret(flags, i + 1, words[i + 1], 0);
+                state.next = i + 2;
+                continue;
+            }
+            const prefix = flags.attached?.find((p) => word.length > p.length && word.startsWith(p));
+            if (prefix !== undefined) {
+                secret(flags, i, word, prefix.length + (word[prefix.length] === '=' ? 1 : 0));
+                continue;
+            }
+            if (flags.values?.includes(word)) {
+                state.next = i + 2;
+                continue;
+            }
+            if (flags.stop && !word.startsWith('-'))
+                states.delete(flags);
+        }
+        const name = word.slice(word.lastIndexOf('/') + 1);
+        // A command named again (`docker login docker -p pw`, a host) keeps the state it is in. A word the shell computes may
+        // be the executable (`sudo -u root $CLIENT -ppw`), so it may be any known command.
+        const named = Object.hasOwn(COMMAND_FLAGS, name) ? [COMMAND_FLAGS[name]] : !word.startsWith('-') && /[$`]/.test(word) ? ALL_COMMAND_FLAGS : [];
+        for (const flags of named)
+            if (!states.has(flags))
+                states.set(flags, { active: !flags.login, next: i + 1 });
+    }
+    return masks;
+}
+/** `raw`, a shell word reading `plain`, masked from `plain`'s offset `from`; a word whose kept part is not literal is masked whole. */
+function maskWordFrom(raw, plain, from) {
+    if (!from)
+        return maskShellWord(raw);
+    const kept = plain.slice(0, from);
+    const quoted = splitQuoted(raw);
+    if (quoted?.inner.startsWith(kept))
+        return `${quoted.open}${kept}***${quoted.close}`;
+    return raw.startsWith(kept) ? kept + maskShellWord(raw.slice(from)) : maskShellWord(raw);
+}
+/** A redirection operator, with its file descriptor. */
+const REDIRECT_RE = /[0-9]*(?:&>>?|<<<|<<-?|<>|>>|>&|<&|>\||[<>])/y;
+/**
+ * The words of the simple command (or `list`ed argv) at `from`, up to a shell metacharacter, the line end, a list's close
+ * or the close of the `enclosing` quote, and where the scan stopped. An unterminated quote ends the command with its word.
+ * Only a list's elements end at `,`, `]` or `}`; in a shell word they are ordinary characters (`-phunter,2`).
+ */
+function commandWords(text, from, enclosing, list) {
+    const spans = [];
+    const [gap, close, stop] = list ? [/[ \t,<>]/, /[\n;&|()\]}]/, /[\s;&|()<>,\]}]/] : [/[ \t]/, /[\n;&|()]/, /[\s;&|()<>]/];
+    let i = from;
+    let redirect = false;
+    for (;;) {
+        while (i < text.length && gap.test(text[i]))
+            i += 1;
+        // A redirection and its target (`</dev/null`, `2> /tmp/e`, `2>&1`) are no argument: the shell removes them.
+        REDIRECT_RE.lastIndex = i;
+        if (!list && i < text.length && text[i] !== enclosing && REDIRECT_RE.test(text)) {
+            i = REDIRECT_RE.lastIndex;
+            redirect = true;
+            continue;
+        }
+        if (i >= text.length || text[i] === enclosing || close.test(text[i]))
+            return { spans, end: i };
+        const start = i;
+        while (i < text.length && text[i] !== enclosing && !stop.test(text[i])) {
+            const c = text[i];
+            if (c === '\\')
+                i += 2;
+            else if ((c === "'" || c === '"') && c !== enclosing) {
+                // A quote groups across newlines, and an inner quote of the other kind (`sh -c "mysql -p'a b'"`) groups for the shell
+                // that runs the command.
+                let k = i + 1;
+                while (k < text.length && text[k] !== c && text[k] !== enclosing)
+                    k += c === '"' && text[k] === '\\' ? 2 : 1;
+                // An unterminated quote runs to the text end (or the enclosing close); its word is still read, so its secret is masked.
+                if (text[k] !== c) {
+                    spans.push([start, Math.min(k, text.length)]);
+                    return { spans, end: Math.min(k, text.length) };
+                }
+                i = k + 1;
+            }
+            else if (c === '`' || (c === '$' && (text[i + 1] === '(' || text[i + 1] === '{'))) {
+                // A substitution is part of its word (`-p$(printf pw)`), spaces and nested ones included.
+                const [open, close] = c === '`' ? ['', '`'] : [text[i + 1], text[i + 1] === '(' ? ')' : '}'];
+                let k = i + 1;
+                for (let depth = 1; k < text.length && text[k] !== enclosing; k += 1) {
+                    if (text[k] === close && (depth -= 1) === 0)
+                        break;
+                    if (text[k] === open && k > i + 1)
+                        depth += 1;
+                }
+                if (text[k] !== close) {
+                    spans.push([start, Math.min(k, text.length)]);
+                    return { spans, end: Math.min(k, text.length) };
+                }
+                i = k + 1;
+            }
+            else
+                i += 1;
+        }
+        if (!redirect)
+            spans.push([start, Math.min(i, text.length)]);
+        redirect = false;
+    }
+}
+/**
+ * `COMMAND_FLAGS` secrets in shell text and listed argv text (`['mysql', '-phunter2']`). A quoted word that holds a known
+ * command (`sh -c 'mysql -phunter2'`) is read as a command of its own.
+ */
+function redactCommandFlags(text) {
+    let out = '';
+    let last = 0;
+    const quoteAt = quoteTracker(text);
+    const re = new RegExp(COMMAND_FLAG_RE);
+    for (let m = re.exec(text); m; m = re.exec(text)) {
+        const quote = quoteAt(m.index).slice(-1);
+        // A listed element (`'mysql',`) is read from its opening quote; a command inside a quoted argument ends at its close.
+        let listed = quote !== '' && text[m.index + m[0].length] === quote;
+        // A computed word matched only to its first expansion (`"$(echo $(which docker))"`) is listed when it fills its quotes.
+        if (!listed && quote && text[m.index - 1] === quote) {
+            const probe = commandWords(text, m.index, quote, false);
+            listed = probe.spans.length === 1 && text[probe.end] === quote;
+        }
+        const { spans, end } = commandWords(text, listed ? text.lastIndexOf(quote, m.index) : m.index, listed ? '' : quote, listed);
+        const words = spans.map(([start, stop]) => shellDequote(text.slice(start, stop)));
+        const masks = commandFlagMasks(words);
+        for (const [k, [start, stop]] of spans.entries()) {
+            if (start < last)
+                continue;
+            const raw = text.slice(start, stop);
+            const from = masks.get(k);
+            // A nested command is a quoted or substituted word with a space, strictly inside this text.
+            const nested = (listed || !quote) && raw.length < text.length && /['"]|\$\(|\x60/.test(raw) && /\s/.test(raw) && COMMAND_FLAG_TEST_RE.test(raw);
+            const replaced = from !== undefined ? maskWordFrom(raw, words[k], from) : nested ? redactCommandFlags(raw) : raw;
+            if (replaced === raw)
+                continue;
+            out += text.slice(last, start) + replaced;
+            last = stop;
+        }
+        re.lastIndex = Math.max(end, re.lastIndex, m.index + 1);
+    }
+    return out + text.slice(last);
+}
 /**
  * Header credentials (`AUTH_HDR_RE`, `BEARER_RE`: a head group, then the credential). A parameterized credential is masked
  * whole; a single credential is read to the end of its shell word, so an adjacent quoted piece (`Bearer foo'bar`, which
@@ -1315,7 +1783,7 @@ export function redactSensitive(text) {
 function redactRules(text) {
     if (!text)
         return text;
-    let out = text.replace(CRED_RE, (_, t) => mask(t));
+    let out = maskSplitTokens(text).replace(CRED_RE, (_, t) => mask(t));
     out = out.replace(EMBEDDED_AWS_RE, (t) => mask(t));
     out = redactHeaderCredentials(out, AUTH_HDR_RE);
     out = out.replace(JWT_RE, (t) => mask(t));
@@ -1323,7 +1791,8 @@ function redactRules(text) {
     for (const re of [COOKIE_ANSI_RE, COOKIE_SQ_RE, COOKIE_DQ_RE, COOKIE_BARE_RE])
         out = out.replace(re, (whole, head, value) => (/[A-Za-z0-9]/.test(value) ? `${head}***` : whole));
     out = redactCredentialParams(out);
-    out = out.replace(ENV_RE, (whole, key, quote, value) => (/[A-Za-z0-9]/.test(value) ? `${key}=${quote}${mask(value)}${quote}` : whole));
+    out = out.replace(ENV_RE, (whole, key, quote, value) => (/[A-Za-z0-9]/.test(value) && isEnvCredential(key, value) ? `${key}=${quote}${mask(value)}${quote}` : whole));
+    out = redactEnvSuffixes(out);
     out = out.replace(LISTED_FLAG_RE, (whole, q, dash, key, gap, vq, quotedValue, bare) => {
         // An unquoted value (a number, `True`, a nested list) is masked whole.
         if (bare !== undefined)
@@ -1338,7 +1807,11 @@ function redactRules(text) {
     out = out.replace(PERCENT_KEY_RE, (whole, head, value) => (value && value !== '***' && isCredentialKey(percentDecode(head.slice(0, -1))) ? `${head}***` : whole));
     out = out.replace(BARE_USERINFO_RE, (_, head, secret) => head + mask(secret));
     out = out.replace(URL_USERINFO_RE, (_, head, secret) => head + (/['"\\]/.test(secret) ? '***' : mask(secret)));
+    out = out.replace(URL_BARE_TOKEN_RE, (_, head, token) => head + mask(token));
+    out = out.replace(TELEGRAM_TOKEN_RE, (_, bot, id) => `${bot ?? ''}${id}:***`);
+    out = out.replace(PHONE_RE, (phone) => { const keep = phone.length <= 8 ? 2 : 4; return `${phone.slice(0, keep)}****${phone.slice(-keep)}`; });
     out = redactUserFlags(out);
+    out = redactCommandFlags(out);
     out = out.replace(QUERY_KEY_RE, (whole, head, value) => (/[A-Za-z0-9]/.test(value) ? head + mask(value) : whole));
     out = out.replace(PRIVKEY_RE, '[REDACTED PRIVATE KEY]').replace(PRIVKEY_OPEN_RE, '[REDACTED PRIVATE KEY]');
     return restoreCodeEnvKeyLiterals(text, out);
@@ -1346,20 +1819,24 @@ function redactRules(text) {
 const CASE_MARKERS = [
     'sk-', 'ghp_', 'github_pat_', 'gho_', 'ghu_', 'ghs_', 'ghr_', 'AKIA', 'ASIA', 'xoxb-', 'xoxa-', 'xoxp-', 'xoxr-', 'xoxs-', 'AIza', 'pplx-', 'fal_', 'fc-',
     'bb_live_', 'gAAAA', 'sk_live_', 'sk_test_', 'rk_live_', 'SG.', 'hf_', 'r8_', 'npm_', 'pypi-', 'dop_v1_', 'doo_v1_', 'am_', 'sk_', 'tvly-', 'exa_',
-    'gsk_', 'syt_', 'retaindb_', 'hsk-', 'mem0_', 'brv_', 'eyJ', '-----BEGIN',
+    'gsk_', 'syt_', 'retaindb_', 'hsk-', 'mem0_', 'brv_', 'xapp-', 'xai-', 'ntn_', 'fw-', 'fw_', 'fpk_', 'glpat-', 'gloas-', 'gldt-', 'glrt-', 'glrtr-',
+    'glcbt-', 'glptt-', 'glft-', 'glimt-', 'glagent-', 'glsoat-', 'glffct-', 'glwt-', 'GR1348941', 'pk-lf-', 'eyJ', '-----BEGIN',
 ];
 const LOWER_MARKERS = [
     'authorization: bearer ', 'authorization: bot ', 'private key', 'postgres://', 'postgresql://', 'mysql://', 'mongodb://', 'redis://', 'amqp://', '://',
     'access_token', 'refresh_token', 'id_token', 'api_key', 'apikey', 'client_secret', 'auth_token', 'raw_secret', 'secret_input', 'key_material',
     'x-amz-signature', 'token=', 'secret=', 'password=', 'passwd', 'password', 'secret', 'token', 'api-key', 'apikey', 'clientsecret', 'private_key', 'credential', ' -u ', '--user ', 'authorization', 'signature', 'bearer ', 'cookie:', 'authorization=', 'key=', '"token"', '"secret"', '"password"', '"bearer"',
 ];
-const TELEGRAM_RE = /(?:bot)?\d{8,}:[-A-Za-z0-9_]{30,}/;
 const DISCORD_RE = /<@!?\d{17,20}>/;
-const PHONE_RE = /(?<![A-Za-z0-9])\+[1-9]\d{6,14}(?![A-Za-z0-9])/;
+const TELEGRAM_TEST_RE = new RegExp(TELEGRAM_TOKEN_RE.source);
+const PHONE_TEST_RE = new RegExp(PHONE_RE.source);
 export function mightContainSensitiveText(text) {
     if (!text)
         return false;
-    if (CASE_MARKERS.some((m) => text.includes(m)))
+    // A control or zero-width character or an ANSI escape sequence inside a prefix (`x\u200bai-…`) does not hide it: the
+    // redactor joins split tokens.
+    const views = SPLIT_VIEWS.map((gaps) => text.replace(gaps, ''));
+    if (CASE_MARKERS.some((m) => views.some((view) => view.includes(m))))
         return true;
     const lower = text.toLowerCase();
     if (LOWER_MARKERS.some((m) => lower.includes(m)))
@@ -1380,11 +1857,15 @@ export function mightContainSensitiveText(text) {
         return true;
     if (USER_FLAG_TEST_RE.test(text))
         return true;
-    if (text.includes(':') && TELEGRAM_RE.test(text))
+    if (COMMAND_FLAG_TEST_RE.test(text))
+        return true;
+    if (text.includes(':') && TELEGRAM_TEST_RE.test(text))
         return true;
     if (text.includes('<@') && DISCORD_RE.test(text))
         return true;
-    if (text.includes('+') && PHONE_RE.test(text))
+    if (text.includes('+') && PHONE_TEST_RE.test(text))
+        return true;
+    if (text.includes('=') && ENV_SUFFIX_TEST_RE.test(text))
         return true;
     return false;
 }
@@ -1424,7 +1905,7 @@ export function redactValue(v, enabled) {
         return Object.fromEntries(Object.entries(v).map(([k, val]) => [k, redactValue(val, enabled)]));
     return v;
 }
-export const PUBLIC_MESSAGE_INTERNAL_FIELDS = new Set(['api_content', '_row_id', '_state_db_row_id', '_db_row_id', 'state_db_row_id', '_active_turn_token', '_active_turn_user', '_fork_child_turn']);
+export const PUBLIC_MESSAGE_INTERNAL_FIELDS = new Set(['api_content', '_row_id', '_state_db_row_id', '_state_db_generation', '_db_row_id', 'state_db_row_id', '_active_turn_token', '_active_turn_user', '_fork_child_turn']);
 export function copyJson(value) {
     if (Array.isArray(value))
         return value.map((v) => copyJson(v));
@@ -1531,6 +2012,19 @@ export function buildActiveTurnToken(streamId, pendingStartedAt) {
         return null;
     return `${str(streamId).trim()}:${formatG17(started)}`;
 }
+/** TAL-452: a user message longer than either limit ships `_collapsible`, so clients fold it behind "Show more". */
+const COLLAPSIBLE_USER_MESSAGE_LINES = 20;
+const COLLAPSIBLE_USER_MESSAGE_CHARS = 2000;
+/**
+ * Whether a public (redacted) row is a typed user message (no steer, wakeup or marker) longer than either limit, measured
+ * without the `[Attached files: ...]` line clients hide.
+ */
+function isCollapsibleUserMessage(item) {
+    if (item.role !== 'user' || item._steer !== undefined || item._background_update !== undefined || item._marker_kind !== undefined)
+        return false;
+    const text = stripAttachedFilesMarker(messageText(item.content));
+    return text.length > COLLAPSIBLE_USER_MESSAGE_CHARS || text.split('\n').length > COLLAPSIBLE_USER_MESSAGE_LINES;
+}
 function publicMessageProjection(message, enabled, activeTurnToken) {
     const isActive = Boolean(message && typeof message === 'object' && message.role === 'user' && activeTurnToken !== null && message._active_turn_token === activeTurnToken);
     const scrubbed = scrubInternalReplayFields([message], { messageRecords: true })[0];
@@ -1544,6 +2038,11 @@ function publicMessageProjection(message, enabled, activeTurnToken) {
     }
     if (isActive)
         item._active_turn_user = true;
+    // Server-owned: a `_collapsible` the stored row carries never survives the projection's own decision.
+    if (isCollapsibleUserMessage(item))
+        item._collapsible = true;
+    else
+        delete item._collapsible;
     return withMessageToolDisplay(scrubbed, item, enabled);
 }
 /**
@@ -1599,7 +2098,11 @@ function redactArgs(value, enabled) {
         if (value.length === 2 && typeof value[0] === 'string' && isCredentialKey(value[0]))
             return [value[0], maskLeaves(value[1])];
         // An argv array (`['login', '--password', 'hunter2']`): a credential flag's value is the next element.
+        const commandMasks = commandFlagMasks(value.map((item) => (typeof item === 'string' || typeof item === 'number' ? String(item) : '')));
         return value.map((item, i) => {
+            const from = commandMasks.get(i);
+            if (from !== undefined)
+                return typeof item === 'string' ? maskWordFrom(item, item, from) : maskLeaves(item);
             const flag = value[i - 1];
             if (typeof flag === 'string' && item !== '' && item !== null && item !== undefined) {
                 if (ARGV_USER_FLAG_RE.test(flag))
@@ -1680,7 +2183,7 @@ export function withToolId(data, id) {
     delete frame.tid;
     return frame;
 }
-function redactNestedMessageContainers(value, enabled) {
+export function redactNestedMessageContainers(value, enabled) {
     const scrubbed = scrubInternalReplayFields(value);
     if (!scrubbed || typeof scrubbed !== 'object' || Array.isArray(scrubbed))
         return redactValue(scrubbed, enabled);