@mossbear/eval-core 0.1.0-alpha.104 → 0.1.0-alpha.105

package/dist/sanitize-command.js

@@ -54,9 +54,13 @@ const REDIS_URI = /^(?:rediss?|valkeys?):\/\//i;
 /**
  * The tool a word invokes: its basename, lowercased, without a Windows
  * executable suffix. Windows resolves executable names case-insensitively.
+ * Backticks are dropped, so a word a substitution begins or ends (`` `curl ``)
+ * still names its tool when quoting hides the substitution from the parser.
  */
 function invokedTool(word) {
-    return (word.split(/[\\/]/).at(-1) ?? word).replace(/\.exe$/i, '').toLowerCase();
+    return (word.replaceAll('`', '').split(/[\\/]/).at(-1) ?? word)
+        .replace(/\.exe$/i, '')
+        .toLowerCase();
 }
 const CREDENTIAL_TOOLS = [
     'curl',
@@ -87,6 +91,68 @@ const WRAPPER_VALUE_FLAGS = {
     time: /^-[of](.+)?$|^--(?:output|format)(?:=(.*))?$/,
     xargs: /^-[adEILnPs](.+)?$|^--(?:arg-file|delimiter|eof|replace|max-lines|max-args|max-procs|max-chars)(?:=(.*))?$/,
 };
+// Wrapper options known to take no value. Any other option, unless its value is
+// attached with `=`, may have consumed the next word.
+const WRAPPER_SWITCHES = {
+    sudo: /^-[AbEHIKklnPSsVvie]+$|^--(?:preserve-env|login|shell|set-home|non-interactive|background)$/,
+    doas: /^-[nsL]+$/,
+    env: /^-[i0v]+$|^-$|^--(?:ignore-environment|null|debug)$/,
+    time: /^-[pvqa]+$|^--(?:portability|verbose|quiet|append)$/,
+    xargs: /^-[0rtpxo]+$|^--(?:null|no-run-if-empty|verbose|interactive|exit|open-tty)$/,
+};
+// Programs that never run an argument as a command, so a credential tool's name
+// among their arguments is a file (`cat ./bin/curl`), not an invocation. Any
+// program not listed may dispatch (`timeout`, `watch`, `find -exec`, `ssh`), and
+// keeps treating every word as a possible invocation, so an unlisted program
+// errs toward over-redaction.
+const NON_DISPATCHING_TOOLS = new Set([
+    'basename',
+    'cat',
+    'chgrp',
+    'chmod',
+    'chown',
+    'cmp',
+    'cp',
+    'diff',
+    'dirname',
+    'du',
+    'file',
+    'grep',
+    'head',
+    'ln',
+    'ls',
+    'mkdir',
+    'mv',
+    'readlink',
+    'realpath',
+    'rm',
+    'stat',
+    'tail',
+    'touch',
+    'wc',
+    'which',
+]);
+/**
+ * Whether the command word starting at `index` of `text` runs a listed program:
+ * bare, or from a system bin directory. A same-named local script
+ * (`./tools/diff`) may run anything, and a redirection operand (`>file curl`)
+ * names a file, not the command.
+ */
+function isNonDispatching(text, index, word) {
+    let before = index - 1;
+    while (text[before] === ' ' || text[before] === '\t')
+        before -= 1;
+    // `>&file` and `>|file` redirect too.
+    if (text[before] === '&' || text[before] === '|')
+        before -= 1;
+    if (text[before] === '<' || text[before] === '>')
+        return false;
+    // A backtick in the command word may start a substitution that runs anything.
+    if (word.includes('`'))
+        return false;
+    return (NON_DISPATCHING_TOOLS.has(invokedTool(word)) &&
+        /^(?:(?:\/usr)?\/bin\/)?[^\\/]+$/.test(word));
+}
 const CURL_AUTH_OPTIONS = `user|proxy-user|${CURL_URL_OPTIONS}|cookie|oauth2-bearer|cert|proxy-cert|pass|proxy-pass`;
 const CURL_AUTH_FLAG = new RegExp(`^(-${CURL_SHORT_SWITCHES}[uUbEx])(.+)?$|^(--(?:${CURL_AUTH_OPTIONS}))(?:=(.*))?$`);
 const CURL_EXPANSION = /\{\{([A-Za-z0-9_]+)(?::[^{}]*)?\}\}/g;
@@ -128,22 +194,110 @@ function decodeShellWord(word) {
         return escaped ?? plain ?? '';
     });
 }
-/** A program supplying a credential argument carries private produced content. */
-function redactCommandSubstitutions(command) {
+/**
+ * Undo the escapes a backtick substitution's body carries for `\\` and `\``,
+ * and for `\"` when the substitution sits inside double quotes.
+ * `\$` is left escaped: the word parser decodes it either way.
+ */
+function unescapeBacktickBody(body, doubleQuoted = false) {
+    return body.replace(doubleQuoted ? /\\([\\`"])/g : /\\([\\`])/g, '$1');
+}
+/** Spell a body back inside backticks, reversing `unescapeBacktickBody`. */
+function escapeBacktickBody(body, doubleQuoted = false) {
+    return body.replace(doubleQuoted ? /\\(?=[\\`"]|$)|[`"]/g : /\\(?=[\\`]|$)|`/g, '\\$&');
+}
+/**
+ * The command with each backtick substitution spelled `$(…)`. `(` separates
+ * words for the tool parsers and a backtick does not, so tool-input discovery
+ * reads this spelling to see the commands inside backticks.
+ */
+function backticksAsSubshells(command, depth = 0) {
+    if (depth > 8 || !command.includes('`'))
+        return command;
+    let quote = null;
+    let out = '';
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index];
+        if (char === '\\' && quote !== "'") {
+            out += command.slice(index, index + 2);
+            index += 1;
+            continue;
+        }
+        if (char === '`' && quote !== "'") {
+            let end = index + 1;
+            while (end < command.length && command[end] !== '`')
+                end += command[end] === '\\' ? 2 : 1;
+            const body = unescapeBacktickBody(command.slice(index + 1, end));
+            out += `$(${backticksAsSubshells(body, depth + 1)})`;
+            index = end;
+            continue;
+        }
+        if (char === "'" && quote !== '"')
+            quote = quote === "'" ? null : "'";
+        else if (char === '"' && quote !== "'")
+            quote = quote === '"' ? null : '"';
+        out += char;
+    }
+    return out;
+}
+/**
+ * Tool inputs read from the command as written and from its `$(…)` spelling.
+ * The respelling separates a backtick body from its first word but also
+ * splits a word that runs on past the substitution, so neither alone sees
+ * every reference.
+ */
+function backtickAwareInputs(command) {
+    const inputs = getToolInputs(command);
+    return command.includes('`')
+        ? withInheritedInputs(getToolInputs(backticksAsSubshells(command)), inputs)
+        : inputs;
+}
+function withInheritedInputs(inputs, inherited) {
+    inputs.curlConfig ||= inherited?.curlConfig ?? false;
+    for (const name of inherited?.curlVariables ?? [])
+        inputs.curlVariables.add(name);
+    for (const key of inherited?.env ?? [])
+        inputs.env.add(key);
+    for (const source of inherited?.passSources ?? [])
+        inputs.passSources.add(source);
+    return inputs;
+}
+/**
+ * A program supplying a credential argument carries private produced content.
+ * Any other backtick substitution runs a command of its own, which a backtick
+ * does not separate from its first word the way `(` does, so its body is
+ * redacted as a command in its own right. An escaped backtick is literal text;
+ * `invokedTool` still reads the tool its word names.
+ */
+function redactCommandSubstitutions(command, depth = 0, inheritedInputs, valuesFirst = true) {
+    if (depth > 8)
+        return REDACTED;
     const marker = '__SUBSTITUTION_BOUNDARY__';
     if (command.includes(marker))
         return REDACTED;
+    let contextInputs;
+    // A body also feeds, or consumes, the commands around it.
+    const surroundingInputs = () => (contextInputs ??= withInheritedInputs(backtickAwareInputs(command), inheritedInputs));
     const isCredentialInput = (start, end) => {
         const probe = command.slice(0, start) + marker + command.slice(end + 1);
         const inputs = getToolInputs(probe);
-        let redacted = redactCredentialAssignments(redactToolArguments(redactJsonArguments(probe), inputs), inputs);
-        for (const [pattern, replacement] of COMMAND_REDACTIONS)
-            redacted = redacted.replace(pattern, replacement);
-        return !redacted.includes(marker);
+        const redacted = redactCredentialAssignments(redactToolArguments(redactJsonArguments(probe), inputs), inputs);
+        return !applyCommandRedactions(redacted).includes(marker);
     };
     const findEnd = (start, closing, depth) => {
         if (depth > 8)
             return command.length;
+        // A backtick body ends at the first unescaped backtick, as bash reads it:
+        // quotes inside it do not hide one, and `\` escapes even inside `'…'`.
+        if (closing === '`') {
+            for (let index = start; index < command.length; index += 1) {
+                if (command[index] === '\\')
+                    index += 1;
+                else if (command[index] === '`')
+                    return index;
+            }
+            return command.length;
+        }
         let quote = null;
         let groups = 0;
         for (let index = start; index < command.length; index += 1) {
@@ -152,8 +306,6 @@ function redactCommandSubstitutions(command) {
                 index += 1;
                 continue;
             }
-            if (closing === '`' && char === '`')
-                return index;
             if (quote === "'") {
                 if (char === "'")
                     quote = null;
@@ -195,8 +347,33 @@ function redactCommandSubstitutions(command) {
             if (++substitutions > 64)
                 return out + REDACTED;
             const start = index;
-            index = findEnd(index + (char === '`' ? 1 : 2), char === '`' ? '`' : ')', 0);
-            out += isCredentialInput(start, index) ? REDACTED : command.slice(start, index + 1);
+            const bodyStart = index + (char === '`' ? 1 : 2);
+            index = findEnd(bodyStart, char === '`' ? '`' : ')', 0);
+            const original = command.slice(start, index + 1);
+            if (isCredentialInput(start, index))
+                out += REDACTED;
+            else if (char === '`') {
+                // In the command as written, an unterminated backtick leaves the
+                // body's extent unknown: fail closed. A nested pass sees words the
+                // parser split at a backtick (`"a b"\``), so it parses the rest instead.
+                const unterminated = command[index] !== '`';
+                if (unterminated && depth === 0)
+                    return `${out}\`${REDACTED}`;
+                const body = unescapeBacktickBody(command.slice(bodyStart, index), quote === '"');
+                const redacted = redactShellSyntax(body, depth + 1, surroundingInputs(), valuesFirst);
+                out +=
+                    redacted === body
+                        ? original
+                        : `\`${escapeBacktickBody(redacted, quote === '"')}${unterminated ? '' : '`'}`;
+            }
+            else if (original.includes('`')) {
+                // `(` already exposes this body to the outer parse; only backticks
+                // nested inside it need a pass of their own.
+                const body = command.slice(bodyStart, index);
+                out += `$(${redactCommandSubstitutions(body, depth + 1, surroundingInputs(), valuesFirst)}${command.slice(index, index + 1)}`;
+            }
+            else
+                out += original;
             continue;
         }
         if (char === "'" && quote !== '"')
@@ -259,6 +436,237 @@ function redactJsonArguments(command) {
         }
     });
 }
+/**
+ * Credential values recognised by the name beside them (URL userinfo,
+ * Authorization and Cookie headers, query keys) rather than by shell words.
+ */
+const VALUE_REDACTIONS = [
+    [/\b([a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:)[^@\s]+@/gi, `$1${REDACTED}@`],
+    [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+@/gi, `$1${REDACTED}@`],
+    [/\b(authorization\s*:\s*)(?:(?:bearer|basic|token)\s+)?\S+/gi, `$1${REDACTED}`],
+    [new RegExp(COOKIE_HEADER_SOURCE, 'gi'), `$1${REDACTED}`],
+    [
+        new RegExp(`([?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=)[^&\\s"'<>]+`, 'gi'),
+        `$1${REDACTED}`,
+    ],
+];
+/**
+ * Space-separated credential flags have no assignment operator or token
+ * prefix. Keep the flag for evidence, but never its value. The value is the
+ * next shell word across any whitespace, newlines included: a word typed on
+ * the line after `--password` is very likely the password, even though bash
+ * would read it as a new command.
+ *
+ * That reach means the value can itself be a credential flag
+ * (`--password --token <value>`). Taking it as the first flag's value must not
+ * spare its own value, so the word after a swallowed credential flag is
+ * redacted too, for as long as the chain runs. A chained word that spells a
+ * credential key is left for the passes after this one to read (see
+ * `isChainedValue`), and one with an attached value ends the chain. Every
+ * match the rule makes on its own is still redacted: the chain only adds.
+ */
+const CREDENTIAL_FLAG = new RegExp(`(^|[\\s;&|(\\x60])(--${COMMAND_SENSITIVE_KEY_SOURCE}\\s+)(${SHELL_WORD_SOURCE})`, 'gi');
+const NEXT_SHELL_WORD = new RegExp(`(\\s+)(${SHELL_WORD_SOURCE})`, 'y');
+// The words a credential key is spelled with. Keys are tested by scanning a
+// word's `[\w.-]` runs for one rather than by a regex with `[\w.-]*` on both
+// sides of the key, which backtracks quadratically on a long word.
+const CREDENTIAL_KEY_WORD = new RegExp(`${SENSITIVE_WORD_SOURCE}|SSHPASS|REDISCLI_AUTH|VALKEYCLI_AUTH|MYSQL_PWD`, 'i');
+const ASSIGNMENT_OPERATOR = /\s*[=:]/y;
+const LINE_CONTINUATION = /^\\\r?\n$/;
+const KEY_CHARACTER = /[\w.-]/;
+/** `SENSITIVE_KEY`'s test, without its backtracking on a long name. */
+function isCredentialKeyName(name) {
+    return ((/^[\w.-]+$/.test(name) && SENSITIVE_CONTENT.test(name)) ||
+        /^(?:SSHPASS|REDISCLI_AUTH|VALKEYCLI_AUTH|MYSQL_PWD)$/i.test(name));
+}
+function isBareCredentialFlag(word) {
+    const flag = /^--([^=]+)$/.exec(decodeShellWord(word));
+    return flag !== null && isCredentialKeyName(flag[1]);
+}
+/**
+ * `--token=<value>` carries its own value, which the attached-flag and
+ * assignment rules redact while keeping the flag's name readable to the
+ * passes after them.
+ */
+function isAttachedCredentialFlag(word) {
+    const flag = /^--([^=]+)=/.exec(decodeShellWord(word));
+    return flag !== null && isCredentialKeyName(flag[1]);
+}
+/**
+ * Whether `text` spells a credential key where the other rules read one: a
+ * `[\w.-]` run at the start, or after a shell boundary, quote or escape (where
+ * a decoded word starts), that is a `--` flag or is followed by `=` or `:`.
+ */
+function spellsCredentialKey(text) {
+    for (const run of text.matchAll(/[\w.-]+/g)) {
+        if (run.index > 0 && !/[\s;&|(\x60'"\\]/.test(text[run.index - 1]))
+            continue;
+        if (!CREDENTIAL_KEY_WORD.test(run[0]))
+            continue;
+        if (run[0].startsWith('--'))
+            return true;
+        ASSIGNMENT_OPERATOR.lastIndex = run.index + run[0].length;
+        if (ASSIGNMENT_OPERATOR.test(text))
+            return true;
+    }
+    return false;
+}
+/**
+ * Whether `word` ends in a credential flag the space-separated rule reads on
+ * its own: it reads boundaries in the raw text, so `\<tab>--token` (an escaped
+ * tab) ends in one.
+ */
+function endsInCredentialFlag(word) {
+    let start = word.length;
+    while (start > 0 && KEY_CHARACTER.test(word[start - 1]))
+        start -= 1;
+    if (!word.startsWith('--', start))
+        return false;
+    if (start > 0 && !/[\s;&|(\x60]/.test(word[start - 1]))
+        return false;
+    return CREDENTIAL_KEY_WORD.test(word.slice(start + 2));
+}
+/**
+ * Whether to redact a word the chain reached. The other rules read credential
+ * keys in the raw text and, for nested commands, in decoded words, so a word
+ * that spells one either way (a bare credential flag among them) is left whole
+ * for them to read, exactly as it reads without the chain.
+ */
+function isChainedValue(word) {
+    return ![word, decodeShellWord(word)].some((text) => spellsCredentialKey(text) || startsValueHeader(text));
+}
+// `VALUE_REDACTIONS` without the global flag, for testing a single word.
+const VALUE_PATTERNS = VALUE_REDACTIONS.map(([pattern]) => new RegExp(pattern.source, pattern.flags.replace('g', '')));
+/**
+ * Whether `text` begins a match of a value pattern that runs on into the next
+ * word, as a header name does (`Cookie: name=value`). Redacting that word
+ * would hide the value from the pattern, so the chain leaves it whole. The
+ * test is read off `VALUE_REDACTIONS` itself, so a pattern added later is
+ * covered without a list of header names here.
+ */
+function startsValueHeader(text) {
+    return VALUE_PATTERNS.some((pattern) => [' name=value', ' value'].some((next) => {
+        const match = pattern.exec(text + next);
+        return (match !== null &&
+            match.index < text.length &&
+            match.index + match[0].length > text.length);
+    }));
+}
+/** Whether the word after `word` is a credential flag's value. */
+function continuesCredentialChain(word) {
+    return isBareCredentialFlag(word) || endsInCredentialFlag(word);
+}
+/**
+ * The words to redact after `value`, a word ending at `end` that a rule has
+ * just taken as a credential's value. If `value` is itself a credential flag,
+ * the redaction hides the flag the space-separated rule would read, so its
+ * value, and the chain after it, are redacted here instead. This is the one
+ * rule for every value edit: each rule that redacts a word as a value passes
+ * the word here, whatever flag or tool took it. `seen` holds the ends a chain
+ * has already left, so a run of flags stays linear.
+ */
+function followCredentialChain(value, end, next, seen) {
+    const ranges = [];
+    for (let word = value; continuesCredentialChain(word);) {
+        if (seen.has(end))
+            break;
+        seen.add(end);
+        const following = next(end);
+        if (!following)
+            break;
+        if (isAttachedCredentialFlag(following.word))
+            break;
+        if (isChainedValue(following.word))
+            ranges.push({ start: following.start, end: following.end, text: REDACTED });
+        word = following.word;
+        end = following.end;
+    }
+    return ranges;
+}
+/** Steps through `text` by shell word: a chain ends at an operator. */
+function textChainCursor(text) {
+    return (end) => {
+        NEXT_SHELL_WORD.lastIndex = end;
+        let next = NEXT_SHELL_WORD.exec(text);
+        // A line continuation left in a nested script is not a word.
+        while (next && LINE_CONTINUATION.test(next[2]))
+            next = NEXT_SHELL_WORD.exec(text);
+        if (!next)
+            return undefined;
+        return {
+            word: next[2],
+            start: NEXT_SHELL_WORD.lastIndex - next[2].length,
+            end: NEXT_SHELL_WORD.lastIndex,
+        };
+    };
+}
+/**
+ * Replace each range of `text` with its text. Where ranges overlap, the
+ * earlier one is written and the text under the later one is dropped, so an
+ * overlap never puts back what either range removed.
+ */
+function applyRanges(text, ranges) {
+    ranges.sort((a, b) => a.start - b.start);
+    let out = '';
+    let cursor = 0;
+    for (const range of ranges) {
+        if (range.end <= cursor)
+            continue;
+        if (range.start >= cursor)
+            out += text.slice(cursor, range.start) + range.text;
+        cursor = range.end;
+    }
+    return out + text.slice(cursor);
+}
+/**
+ * `text.replace(pattern, replace)` for a pattern whose last group is a value
+ * the replacement may redact. A redacted value keeps its credential chain,
+ * which may run on into `after`, the text that follows `text`; the words it
+ * redacts there are returned as ranges of `after`.
+ */
+function replaceValues(text, pattern, replace, after = '') {
+    const next = textChainCursor(text + after);
+    const seen = new Set();
+    const ranges = [];
+    const beyond = [];
+    for (const match of text.matchAll(pattern)) {
+        const end = match.index + match[0].length;
+        const replaced = replace(match[0], ...match.slice(1).map((group) => group ?? ''));
+        if (replaced === match[0])
+            continue;
+        ranges.push({ start: match.index, end, text: replaced });
+        for (const range of followCredentialChain(match.at(-1) ?? '', end, next, seen)) {
+            if (range.start < text.length)
+                ranges.push(range);
+            else
+                beyond.push({
+                    start: range.start - text.length,
+                    end: range.end - text.length,
+                    text: range.text,
+                });
+        }
+    }
+    return { text: applyRanges(text, ranges), after: beyond };
+}
+function redactCredentialFlagValues(command) {
+    const next = textChainCursor(command);
+    const ranges = [];
+    // A chain runs the same from any word it reaches, so one that reaches a word
+    // another chain already left stops there, keeping a run of flags linear.
+    const chained = new Set();
+    for (const match of command.matchAll(CREDENTIAL_FLAG)) {
+        const end = match.index + match[1].length + match[2].length + match[3].length;
+        ranges.push({ start: end - match[3].length, end, text: REDACTED });
+        ranges.push(...followCredentialChain(match[3], end, next, chained));
+    }
+    return applyRanges(command, ranges);
+}
+function applyCommandRedactions(command) {
+    let out = command;
+    for (const redaction of COMMAND_REDACTIONS)
+        out = typeof redaction === 'function' ? redaction(out) : out.replace(...redaction);
+    return out;
+}
 /**
  * Redactions applied to command text, in order: heredoc bodies (bulk inline
  * file content), private-key blocks, URL userinfo credentials, Authorization
@@ -281,20 +689,8 @@ const COMMAND_REDACTIONS = [
         `$1$2$3 ${REDACTED}$4`,
     ],
     [new RegExp(PRIVATE_KEY_BLOCK_SOURCE, 'g'), REDACTED],
-    [/\b([a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:)[^@\s]+@/gi, `$1${REDACTED}@`],
-    [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+@/gi, `$1${REDACTED}@`],
-    [/\b(authorization\s*:\s*)(?:(?:bearer|basic|token)\s+)?\S+/gi, `$1${REDACTED}`],
-    [new RegExp(COOKIE_HEADER_SOURCE, 'gi'), `$1${REDACTED}`],
-    [
-        new RegExp(`([?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=)[^&\\s"'<>]+`, 'gi'),
-        `$1${REDACTED}`,
-    ],
-    // Space-separated credential flags have no assignment operator or token
-    // prefix. Keep the flag for evidence, but never its value.
-    [
-        new RegExp(`(^|[\\s;&|(])(--${COMMAND_SENSITIVE_KEY_SOURCE}\\s+)${SHELL_WORD_SOURCE}`, 'gi'),
-        `$1$2${REDACTED}`,
-    ],
+    ...VALUE_REDACTIONS,
+    redactCredentialFlagValues,
     // JSON bodies embedded in shell commands are still command text. Quoted
     // keys evade the shell-assignment scanner below, including escaped values.
     [
@@ -306,10 +702,11 @@ const COMMAND_REDACTIONS = [
     // match, not just a bare word) followed by `=`/`:` and a value that is a
     // double/single-quoted string (spaces and all) or an unquoted run up to the
     // next whitespace. Anchored at a shell-token boundary ($1, preserved) so it
-    // never fires mid-word; the whole value — quotes included — is redacted so
+    // never fires mid-word (a backtick opens a substitution's first word, as
+    // `(` does); the whole value — quotes included — is redacted so
     // whitespace-containing passphrases can't slip through.
     [
-        new RegExp(`(^|[\\s;&|(])(${COMMAND_SENSITIVE_KEY_SOURCE}\\s*[=:]\\s*)${SHELL_WORD_SOURCE}`, 'gi'),
+        new RegExp(`(^|[\\s;&|(\\x60])(${COMMAND_SENSITIVE_KEY_SOURCE}\\s*[=:]\\s*)${SHELL_WORD_SOURCE}`, 'gi'),
         `$1$2${REDACTED}`,
     ],
     // Our own CLI token (`API_KEY_PREFIX`, the prefix the dashboard mints CLI
@@ -441,10 +838,16 @@ function redactCredentialAssignments(command, inputs) {
         // retaining untouched words and also scanning unquoted multiword fields.
         let text = body.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
             const decoded = decodeShellWord(word);
-            const redacted = decoded.replace(fields, redactField);
+            const redacted = replaceValues(decoded, fields, redactField).text;
             return redacted === decoded ? word : JSON.stringify(redacted);
         });
-        text = text.replace(fields, redactField);
+        // The body ends at the producer's operator, but a field's credential
+        // chain reaches on across a newline, as `redactCredentialFlagValues`
+        // does, so the chain's words after the body are edited too.
+        const fieldEdits = replaceValues(text, fields, redactField, assignments.slice(end));
+        text = fieldEdits.text;
+        for (const range of fieldEdits.after)
+            edits.push({ start: end + range.start, end: end + range.end, text: range.text });
         // A printf template may take the credential from later arguments. Once
         // its format is private, drop the argument list rather than expose the
         // values substituted into it or attempt to interpret printf formatting.
@@ -454,20 +857,33 @@ function redactCredentialAssignments(command, inputs) {
             edits.push({ start: producerStart, end, text });
         producerStart = null;
     };
+    // Decided at each command's first word, so a file argument named echo under
+    // a program that never runs its arguments is not mistaken for a producer.
+    // Wrappers are not looked past here, which only errs toward redaction.
+    let commandSeen = false;
+    let argumentsInert = false;
     for (const word of words) {
-        if (/^[;&|()\n]$/.test(word[0]))
+        if (/^[;&|()\n]$/.test(word[0])) {
             finishProducer(word.index);
-        else if (producerStart === null &&
-            ['echo', 'printf'].includes(decodeShellWord(word[0]).split(/[\\/]/).at(-1) ?? '')) {
+            commandSeen = false;
+            argumentsInert = false;
+            continue;
+        }
+        const decoded = decodeShellWord(word[0]);
+        if (!commandSeen && !/^\w+\+?=/.test(decoded)) {
+            commandSeen = true;
+            argumentsInert = isNonDispatching(assignments, word.index, decoded);
+        }
+        const tool = invokedTool(decoded);
+        // A backtick substitution runs its own command, whatever the outer one is.
+        const inert = argumentsInert && !word[0].includes('`');
+        if (producerStart === null && !inert && ['echo', 'printf'].includes(tool)) {
             producerStart = word.index + word[0].length;
-            producerPrintf = decodeShellWord(word[0]).split(/[\\/]/).at(-1) === 'printf';
+            producerPrintf = tool === 'printf';
         }
     }
     finishProducer(assignments.length);
-    let result = assignments;
-    for (const edit of edits.reverse())
-        result = result.slice(0, edit.start) + edit.text + result.slice(edit.end);
-    return result;
+    return applyRanges(assignments, edits);
 }
 /** Redact known tool credential flags without matching unrelated short flags. */
 function redactToolArguments(command, inputs) {
@@ -477,6 +893,11 @@ function redactToolArguments(command, inputs) {
     let options = true;
     let opensslPasswd = false;
     let opensslSubcommandRead = false;
+    // Set once a wrapper in the current command receives an option it does not
+    // model, which may have taken the next word as its value.
+    let wrapperOptionUnknown = false;
+    // The current command is a program that never runs its arguments.
+    let argumentsInert = false;
     const variables = new Map();
     const expansions = [];
     const resolveVariable = (contents, depth = 0) => {
@@ -485,7 +906,7 @@ function redactToolArguments(command, inputs) {
         return contents.replace(CURL_EXPANSION, (_, name) => resolveVariable(variables.get(name)?.at(-1)?.contents ?? '', depth + 1));
     };
     const finishCurl = () => {
-        const privateNames = new Set();
+        const privateNames = new Set(inputs?.curlVariables);
         for (const expansion of expansions) {
             if (CURL_URL_FIELD.test(expansion.field) &&
                 !PROXY_USERINFO.test(expansion.resolved) &&
@@ -511,6 +932,8 @@ function redactToolArguments(command, inputs) {
                 });
             }
         }
+        for (const name of privateNames)
+            inputs?.curlVariables.add(name);
         variables.clear();
         expansions.length = 0;
     };
@@ -524,6 +947,8 @@ function redactToolArguments(command, inputs) {
             client = null;
             opensslPasswd = false;
             opensslSubcommandRead = false;
+            wrapperOptionUnknown = false;
+            argumentsInert = false;
             options = true;
             continue;
         }
@@ -576,7 +1001,11 @@ function redactToolArguments(command, inputs) {
             }
         }
         const executable = invokedTool(decoded);
-        if (WRAPPER_VALUE_FLAGS[executable] && !CREDENTIAL_TOOLS.includes(client ?? '')) {
+        // A backtick substitution runs its own command, whatever the outer one is.
+        const inert = argumentsInert && !raw.includes('`');
+        if (!inert &&
+            WRAPPER_VALUE_FLAGS[executable] &&
+            !CREDENTIAL_TOOLS.includes(client ?? '')) {
             client = executable;
             options = true;
             continue;
@@ -584,7 +1013,8 @@ function redactToolArguments(command, inputs) {
         // Dispatching tools may take their own options and positional arguments.
         // Once a credential-consuming tool appears, its subsequent flags still carry
         // credentials; a wrapper's -u or timeout must not hide that client.
-        if (CREDENTIAL_TOOLS.includes(executable) &&
+        if (!inert &&
+            CREDENTIAL_TOOLS.includes(executable) &&
             !CREDENTIAL_TOOLS.includes(client ?? '')) {
             client = executable;
             opensslPasswd = false;
@@ -592,11 +1022,30 @@ function redactToolArguments(command, inputs) {
             options = true;
             continue;
         }
+        // A wrapper's first operand (its modelled valued options were consumed
+        // above) is the program it runs, which decides whether later words can be
+        // invocations. After an option the table does not model, that operand may
+        // be the option's value instead, so the wrapper keeps dispatching.
+        if (client !== null && WRAPPER_VALUE_FLAGS[client]) {
+            if (options && decoded.startsWith('-')) {
+                if (decoded !== '--' &&
+                    !decoded.includes('=') &&
+                    !WRAPPER_SWITCHES[client]?.test(decoded))
+                    wrapperOptionUnknown = true;
+            }
+            else if (!wrapperOptionUnknown) {
+                client = executable;
+                argumentsInert = isNonDispatching(command, word.index, decoded);
+                options = true;
+                continue;
+            }
+        }
         if (client === null) {
             if (/^[\w]+=.*/.test(decoded) ||
                 ['env', 'sudo', 'command', 'exec', 'nohup'].includes(decoded))
                 continue;
             client = invokedTool(decoded);
+            argumentsInert = isNonDispatching(command, word.index, decoded);
             continue;
         }
         if (client === 'openssl' && !opensslSubcommandRead && !decoded.startsWith('-')) {
@@ -804,6 +1253,46 @@ function redactToolArguments(command, inputs) {
         }
     }
     finishCurl();
+    // Every edit above replaces a whole word, and a word an edit replaces is
+    // gone before `redactCredentialFlagValues` reads the text. Where that word
+    // was a credential flag, the flag's value would escape, so the chain is
+    // followed here for every edit, whichever tool or flag made it.
+    const wordAt = new Map(words.map((word, at) => [word.index, at]));
+    const wordEndingAt = new Map(words.map((word, at) => [word.index + word[0].length, at]));
+    const nextWord = (end) => {
+        let next = wordEndingAt.get(end);
+        if (next === undefined)
+            return undefined;
+        next += 1;
+        while (words[next] && /^(?:\n|\\\r?\n)$/.test(words[next][0]))
+            next += 1;
+        const following = words[next];
+        if (!following || /^[;&|()\n]$/.test(following[0]))
+            return undefined;
+        return {
+            word: following[0],
+            start: following.index,
+            end: following.index + following[0].length,
+        };
+    };
+    const chainedWords = new Set();
+    const chainEdits = edits.flatMap((edit) => {
+        const at = wordAt.get(edit.start);
+        const word = at === undefined ? undefined : words[at];
+        if (!word || edit.end !== word.index + word[0].length)
+            return [];
+        return followCredentialChain(word[0], edit.end, nextWord, chainedWords);
+    });
+    // A chain edit either matches an edit's word or misses it; on a match the
+    // whole-word redaction replaces it, so the chain only ever adds.
+    const editAt = new Map(edits.map((edit, at) => [edit.start, at]));
+    for (const chainEdit of chainEdits) {
+        const same = editAt.get(chainEdit.start);
+        if (same === undefined)
+            edits.push(chainEdit);
+        else
+            edits[same] = chainEdit;
+    }
     edits.sort((a, b) => a.start - b.start);
     for (const edit of edits.reverse())
         command = command.slice(0, edit.start) + edit.text + command.slice(edit.end);
@@ -815,6 +1304,7 @@ function getToolInputs(command, depth = 0) {
         curlConfig: depth > 8,
         env: new Set(),
         passSources: new Set(),
+        curlVariables: new Set(),
     };
     if (depth > 8)
         return inputs;
@@ -831,6 +1321,8 @@ function getToolInputs(command, depth = 0) {
             inputs.env.add(key);
         for (const source of nested.passSources)
             inputs.passSources.add(source);
+        for (const name of nested.curlVariables)
+            inputs.curlVariables.add(name);
     }
     if (inputs.curlConfig) {
         for (const word of words) {
@@ -844,21 +1336,97 @@ function getToolInputs(command, depth = 0) {
     return inputs;
 }
 /** Apply the same boundary to scripts carried inside quoted shell words. */
-function redactShellSyntax(command, depth = 0, inheritedInputs) {
+/** The part of `before` that `after` replaced: what a redaction removed. */
+function changedPart(before, after) {
+    let start = 0;
+    while (start < before.length && before[start] === after[start])
+        start += 1;
+    let end = 0;
+    while (end < before.length - start &&
+        before[before.length - 1 - end] === after[after.length - 1 - end])
+        end += 1;
+    return before.slice(start, before.length - end);
+}
+function redactShellSyntax(command, depth = 0, inheritedInputs, valuesFirst = true) {
     // Nested shell/eval wrappers cannot create unbounded recursive scanning.
     if (depth > 8)
         return REDACTED;
-    command = redactCommandSubstitutions(command);
+    // Redacting a backtick body can erase the reference (`{{VALUE}}`) that
+    // marks an outer assignment private, so read its inputs from the command
+    // as written too.
+    const writtenInputs = command.includes('`')
+        ? withInheritedInputs(backtickAwareInputs(command), inheritedInputs)
+        : inheritedInputs;
+    // Rewriting part of a backtick body can separate a header from its value, so
+    // the value patterns redact such a match before any body is rewritten. Only
+    // such a match: one whose value the later passes remove anyway is left to
+    // them, since the word-based rules see the rest of its word (`"Cookie: a"b`).
+    // Redacting one match early changes what the later passes see, so a value
+    // still in their output is redacted early too and the passes run again.
+    if (valuesFirst && command.includes('`') && !command.includes('\uE000')) {
+        const values = valueRedactionTargets(command);
+        if (values.length > 0) {
+            const withoutValuesFirst = redactShellSyntax(command, depth, inheritedInputs, false);
+            const early = new Set(values.filter((value) => withoutValuesFirst.includes(value)));
+            for (let round = 0;; round += 1) {
+                const out = redactAfterValues(redactValuesFirst(command, round < 3 ? early : new Set(values)), depth, writtenInputs);
+                const stranded = values.filter((value) => !early.has(value) && out.includes(value));
+                if (stranded.length === 0 || round === 3)
+                    return out;
+                for (const value of stranded)
+                    early.add(value);
+            }
+        }
+    }
+    return redactAfterValues(command, depth, writtenInputs, valuesFirst);
+}
+/** The values the `VALUE_REDACTIONS` would remove from text with no backtick in the match. */
+function valueRedactionTargets(command) {
+    const values = [];
+    for (const [pattern, replacement] of VALUE_REDACTIONS) {
+        const single = new RegExp(pattern.source, pattern.flags.replace('g', ''));
+        for (const match of command.match(pattern) ?? []) {
+            if (/[`\uE000\uE001]/.test(match))
+                continue;
+            const value = changedPart(match, match.replace(single, replacement));
+            if (value !== '' && !values.includes(value))
+                values.push(value);
+        }
+    }
+    return values;
+}
+/**
+ * Apply the value patterns whose value is in `early`, holding every other
+ * match aside so no later pattern can match part of it. A match that spans a
+ * backtick is always held: the substitution pass owns that boundary, and an
+ * unterminated one must still fail closed. A reference this erases is still
+ * in the caller's `writtenInputs`.
+ */
+function redactValuesFirst(command, early) {
+    const held = [];
+    let whole = command;
+    for (const [pattern, replacement] of VALUE_REDACTIONS) {
+        const single = new RegExp(pattern.source, pattern.flags.replace('g', ''));
+        whole = whole.replace(pattern, (match) => {
+            const redacted = match.replace(single, replacement);
+            if (!/[`\uE000\uE001]/.test(match) && early.has(changedPart(match, redacted)))
+                return redacted;
+            held.push(match);
+            return `\uE000${held.length - 1}\uE001`;
+        });
+    }
+    // A held match can contain an earlier one; each refers only to earlier ones.
+    while (whole.includes('\uE000'))
+        whole = whole.replace(/\uE000(\d+)\uE001/g, (_, index) => held[Number(index)]);
+    return whole;
+}
+function redactAfterValues(command, depth, writtenInputs, valuesFirst = true) {
+    command = redactCommandSubstitutions(command, depth, writtenInputs, valuesFirst);
     // Nested scripts may be dispatched by any tool. Scan decoded compound
     // words instead of maintaining another list of interpreter/wrapper flags.
     // JSON and sensitive assignments already have structural/whole-word passes;
     // treating their values as commands would lose evidence or word boundaries.
-    const inputs = getToolInputs(command);
-    inputs.curlConfig ||= inheritedInputs?.curlConfig ?? false;
-    for (const key of inheritedInputs?.env ?? [])
-        inputs.env.add(key);
-    for (const source of inheritedInputs?.passSources ?? [])
-        inputs.passSources.add(source);
+    const inputs = withInheritedInputs(backtickAwareInputs(command), writtenInputs);
     const sensitiveAssignment = new RegExp(`^(${COMMAND_SENSITIVE_KEY_SOURCE})(\\+?=)`, 'i');
     // Resolve credential references before nested word redaction can erase the
     // expansion marker while leaving its original variable definition behind.
@@ -882,13 +1450,10 @@ function redactShellSyntax(command, depth = 0, inheritedInputs) {
                 // structural JSON pass instead of the nested-command pass.
             }
         }
-        const redacted = redactShellSyntax(decoded, depth + 1, inputs);
+        const redacted = redactShellSyntax(decoded, depth + 1, inputs, valuesFirst);
         return redacted === decoded ? word : JSON.stringify(redacted);
     });
-    out = redactCredentialAssignments(out, inputs);
-    for (const [pattern, replacement] of COMMAND_REDACTIONS)
-        out = out.replace(pattern, replacement);
-    return out;
+    return applyCommandRedactions(redactCredentialAssignments(out, inputs));
 }
 /**
  * Redact common secret shapes from a shell command and cap its length so