@mossbear/eval-core 0.1.0-alpha.105 → 0.1.0-alpha.107

package/dist/sanitize-command.js

@@ -269,6 +269,32 @@ function withInheritedInputs(inputs, inherited) {
  * redacted as a command in its own right. An escaped backtick is literal text;
  * `invokedTool` still reads the tool its word names.
  */
+/** Whether an unescaped double quote closes the one open at `from`. */
+function closesQuote(command, from) {
+    for (let index = from; index < command.length; index += 1) {
+        if (command[index] === '\\')
+            index += 1;
+        else if (command[index] === '"')
+            return true;
+    }
+    return false;
+}
+const VALUE_AFTER_BACKTICK = new RegExp(`([ \\t]*)(${SHELL_WORD_SOURCE})`, 'y');
+/**
+ * Whether `body` ends in a credential flag, or a word its chain takes as a
+ * flag's value, that `redacted` no longer ends in: a rewrite took the flag
+ * whose value comes after the body.
+ */
+function endsChainLost(body, redacted) {
+    const last = (text) => text.match(SHELL_WORDS)?.at(-1);
+    const before = last(body);
+    const after = last(redacted);
+    return (redacted !== body &&
+        before !== undefined &&
+        !/\s$/.test(body) &&
+        continuesCredentialChain(before) &&
+        !(after !== undefined && continuesCredentialChain(after)));
+}
 function redactCommandSubstitutions(command, depth = 0, inheritedInputs, valuesFirst = true) {
     if (depth > 8)
         return REDACTED;
@@ -336,6 +362,8 @@ function redactCommandSubstitutions(command, depth = 0, inheritedInputs, valuesF
     let quote = null;
     let out = '';
     let substitutions = 0;
+    // Where in `out` the open double quote began.
+    let quoteOpenedAt = 0;
     for (let index = 0; index < command.length; index += 1) {
         const char = command[index];
         if (char === '\\' && quote !== "'") {
@@ -361,10 +389,30 @@ function redactCommandSubstitutions(command, depth = 0, inheritedInputs, valuesF
                     return `${out}\`${REDACTED}`;
                 const body = unescapeBacktickBody(command.slice(bodyStart, index), quote === '"');
                 const redacted = redactShellSyntax(body, depth + 1, surroundingInputs(), valuesFirst);
+                // Rewriting a body inside a double quote that never closes changes
+                // how the rest of that quote splits into words, which can move a
+                // credential argument's extent: fail closed, as for an unterminated
+                // backtick.
+                if (redacted !== body && quote === '"' && !closesQuote(command, index + 1))
+                    return `${out.slice(0, quoteOpenedAt)}${REDACTED}`;
                 out +=
                     redacted === body
                         ? original
                         : `\`${escapeBacktickBody(redacted, quote === '"')}${unterminated ? '' : '`'}`;
+                // A body that ends in a credential flag hands its value to the word
+                // after the backtick (`\x60… --token\x60value`). Where the rewrite took
+                // that flag, as a chain value it reads, no later pass sees it, so
+                // that word is redacted here.
+                if (!unterminated && quote === null && endsChainLost(body, redacted)) {
+                    VALUE_AFTER_BACKTICK.lastIndex = index + 1;
+                    const value = VALUE_AFTER_BACKTICK.exec(command);
+                    if (value &&
+                        !/[\x60]/.test(value[2]) &&
+                        command[VALUE_AFTER_BACKTICK.lastIndex] !== '(') {
+                        out += `${value[1]}${REDACTED}`;
+                        index = VALUE_AFTER_BACKTICK.lastIndex - 1;
+                    }
+                }
             }
             else if (original.includes('`')) {
                 // `(` already exposes this body to the outer parse; only backticks
@@ -378,8 +426,11 @@ function redactCommandSubstitutions(command, depth = 0, inheritedInputs, valuesF
         }
         if (char === "'" && quote !== '"')
             quote = quote === "'" ? null : "'";
-        else if (char === '"' && quote !== "'")
+        else if (char === '"' && quote !== "'") {
+            if (quote === null)
+                quoteOpenedAt = out.length;
             quote = quote === '"' ? null : '"';
+        }
         out += char;
     }
     return out;
@@ -413,7 +464,7 @@ function redactJsonValue(value, depth = 0) {
     ]));
 }
 function redactJsonArguments(command) {
-    return command.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (argument) => {
+    const redactArgument = (argument) => {
         // Shell double quotes only consume escapes for these characters. JSON's
         // string decoder rejects valid shell escapes such as \$, so decode the
         // shell layer before parsing the request body.
@@ -434,7 +485,23 @@ function redactJsonArguments(command) {
                 return argument;
             return argument.startsWith("'") ? `'${REDACTED}'` : `"${REDACTED}"`;
         }
-    });
+    };
+    // Dropping a word that a substitution closed onto a credential flag
+    // (`[a]` then a backtick and `--token`) hides the flag from the
+    // space-separated rule, so its value is followed here, as for every other
+    // edit that rewrites a word.
+    const next = textChainCursor(command);
+    const chained = new Set();
+    const ranges = [];
+    for (const match of command.matchAll(new RegExp(SHELL_WORD_SOURCE, 'g'))) {
+        const replaced = redactArgument(match[0]);
+        if (replaced === match[0])
+            continue;
+        const end = match.index + match[0].length;
+        ranges.push({ start: match.index, end, text: replaced });
+        ranges.push(...followCredentialChain(match[0], end, next, chained, command));
+    }
+    return applyRanges(command, ranges);
 }
 /**
  * Credential values recognised by the name beside them (URL userinfo,
@@ -443,13 +510,122 @@ function redactJsonArguments(command) {
 const VALUE_REDACTIONS = [
     [/\b([a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:)[^@\s]+@/gi, `$1${REDACTED}@`],
     [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+@/gi, `$1${REDACTED}@`],
-    [/\b(authorization\s*:\s*)(?:(?:bearer|basic|token)\s+)?\S+/gi, `$1${REDACTED}`],
+    // The value never runs on into the next header's name (`…v"|"Authorization:`).
+    [
+        /\b(authorization\s*:\s*)(?:(?:bearer|basic|token)\s+)?(?:(?!\b(?:authorization|set-cookie|cookie)\s*:)\S)+/gi,
+        `$1${REDACTED}`,
+    ],
     [new RegExp(COOKIE_HEADER_SOURCE, 'gi'), `$1${REDACTED}`],
     [
         new RegExp(`([?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=)[^&\\s"'<>]+`, 'gi'),
         `$1${REDACTED}`,
     ],
 ];
+// One piece of the text's quote structure, or one character that is not.
+const QUOTE_STRUCTURE = /\\['"\x60]|\\$|\$'|['"\x60]|\\[\s\S]|[\s\S]/g;
+/**
+ * `match.replace(single, replacement)` for a match of a `VALUE_REDACTIONS`
+ * pattern, keeping the quote structure of the text it removes. A value can
+ * take a quote that closes the word it matched in (`\S+` takes `v'` from
+ * `'Authorization: Bearer v'`), and dropping that quote pairs every later
+ * quote differently, which moves the words the rules after this one read.
+ * So each quote and backtick in the removed text stays, after the marker, as
+ * do the escapes that decide whether one is literal (`\'`, a backslash that
+ * escapes the character after the match, and the `$` of `$'`). Nothing else
+ * of the value survives.
+ */
+function redactValueMatch(match, single, replacement) {
+    const redacted = match.replace(single, replacement);
+    let start = 0;
+    while (start < match.length && match[start] === redacted[start])
+        start += 1;
+    let end = 0;
+    while (end < Math.min(match.length, redacted.length) - start &&
+        match[match.length - 1 - end] === redacted[redacted.length - 1 - end])
+        end += 1;
+    const structure = match
+        .slice(start, match.length - end)
+        .replace(QUOTE_STRUCTURE, (piece) => /^(?:['"\x60]|\\['"\x60]?|\$')$/.test(piece) ? piece : '');
+    return (redacted.slice(0, redacted.length - end) +
+        structure +
+        redacted.slice(redacted.length - end));
+}
+/**
+ * A reader of the quote open at a position of `text`, pairing quotes from the
+ * start of `text` as the shell does. Positions must not decrease.
+ */
+function quoteReader(text) {
+    let position = 0;
+    let quote = null;
+    return (index) => {
+        for (; position < index; position += 1) {
+            const char = text[position];
+            if (quote === "'") {
+                if (char === "'")
+                    quote = null;
+            }
+            else if (char === '\\')
+                position += 1;
+            else if (char === '"')
+                quote = quote === '"' ? null : '"';
+            else if (char === "'" && quote === null)
+                quote = "'";
+        }
+        return quote;
+    };
+}
+/** Where in `text` the open `quote` closes, or -1. */
+function closingQuote(text, quote) {
+    for (let index = 0; index < text.length; index += 1) {
+        if (quote === '"' && text[index] === '\\')
+            index += 1;
+        else if (text[index] === quote)
+            return index;
+    }
+    return -1;
+}
+/**
+ * The edits one `VALUE_REDACTIONS` pattern makes to `text`. A value stops at
+ * a quote that closes the word it matched in, as the shell pairs quotes, when
+ * the word ends there: what follows is the next header or command, or the
+ * command around a substitution's body (`'…: v';'Cookie: …'`, `"…: v"\x60`),
+ * never the value, and a value pattern that ran on into it would take the
+ * header or flag there with it. Text glued after the quote is the same word,
+ * so the value runs on through it. A match the cut leaves the pattern no
+ * longer matching is kept whole.
+ */
+// The URL patterns read a run of scheme characters from every word boundary
+// in it, which is quadratic on a long hyphenated word, and can only match
+// where the text spells `://`.
+const NEEDS_URL_SCHEME = VALUE_REDACTIONS.map(([pattern]) => pattern.source.includes(String.raw `:\/\/`));
+function valueRedactionRanges(text, index) {
+    const [pattern, replacement] = VALUE_REDACTIONS[index];
+    const single = VALUE_PATTERNS[index];
+    if (NEEDS_URL_SCHEME[index] && !text.includes('://'))
+        return [];
+    const quoteAt = quoteReader(text);
+    const ranges = [];
+    pattern.lastIndex = 0;
+    for (let match = pattern.exec(text); match; match = pattern.exec(text)) {
+        let matched = match[0];
+        const quote = quoteAt(match.index);
+        const closing = quote === null ? -1 : closingQuote(matched, quote);
+        if (closing > 0 &&
+            /^(?:[\s;&|()<>\x60]|$)/.test(text.slice(match.index + closing + 1)) &&
+            single.test(matched.slice(0, closing))) {
+            matched = matched.slice(0, closing);
+            pattern.lastIndex = match.index + closing;
+        }
+        ranges.push({
+            start: match.index,
+            end: match.index + matched.length,
+            text: redactValueMatch(matched, single, replacement),
+        });
+    }
+    return ranges;
+}
+/** Apply each `VALUE_REDACTIONS` pattern to `text` through `valueRedactionRanges`. */
+const VALUE_REDACTION_PASSES = VALUE_REDACTIONS.map((_, index) => (text) => applyRanges(text, valueRedactionRanges(text, index)));
 /**
  * Space-separated credential flags have no assignment operator or token
  * prefix. Keep the flag for evidence, but never its value. The value is the
@@ -460,20 +636,22 @@ const VALUE_REDACTIONS = [
  * That reach means the value can itself be a credential flag
  * (`--password --token <value>`). Taking it as the first flag's value must not
  * spare its own value, so the word after a swallowed credential flag is
- * redacted too, for as long as the chain runs. A chained word that spells a
- * credential key is left for the passes after this one to read (see
- * `isChainedValue`), and one with an attached value ends the chain. Every
+ * redacted too, for as long as the chain runs. A chained word that is a bare
+ * credential flag, or ends in a key or header whose value is the next word, is
+ * left for the passes after this one to read (see `handsValueOn`), and one
+ * with an attached value ends the chain. Every
  * match the rule makes on its own is still redacted: the chain only adds.
  */
-const CREDENTIAL_FLAG = new RegExp(`(^|[\\s;&|(\\x60])(--${COMMAND_SENSITIVE_KEY_SOURCE}\\s+)(${SHELL_WORD_SOURCE})`, 'gi');
-const NEXT_SHELL_WORD = new RegExp(`(\\s+)(${SHELL_WORD_SOURCE})`, 'y');
+const CREDENTIAL_FLAG = new RegExp(`(^|[\\s;&|(\\x60])(--${COMMAND_SENSITIVE_KEY_SOURCE}(?:[\\s)\\x60]|\\$\\()+)(${SHELL_WORD_SOURCE})`, 'gi');
+// The next word, across a backtick, `)` or `$(` that cuts a flag from its value.
+const NEXT_SHELL_WORD = new RegExp(`((?:[\\s)\\x60]|\\$\\()+)(${SHELL_WORD_SOURCE})`, 'y');
+const SHELL_WORDS = new RegExp(SHELL_WORD_SOURCE, 'g');
 // The words a credential key is spelled with. Keys are tested by scanning a
 // word's `[\w.-]` runs for one rather than by a regex with `[\w.-]*` on both
 // sides of the key, which backtracks quadratically on a long word.
 const CREDENTIAL_KEY_WORD = new RegExp(`${SENSITIVE_WORD_SOURCE}|SSHPASS|REDISCLI_AUTH|VALKEYCLI_AUTH|MYSQL_PWD`, 'i');
 const ASSIGNMENT_OPERATOR = /\s*[=:]/y;
 const LINE_CONTINUATION = /^\\\r?\n$/;
-const KEY_CHARACTER = /[\w.-]/;
 /** `SENSITIVE_KEY`'s test, without its backtracking on a long name. */
 function isCredentialKeyName(name) {
     return ((/^[\w.-]+$/.test(name) && SENSITIVE_CONTENT.test(name)) ||
@@ -511,50 +689,129 @@ function spellsCredentialKey(text) {
     }
     return false;
 }
+// One piece of a shell word: a quoted string, an escape, a run of plain word
+// characters, or one other character. A flag inside a run follows a word
+// character, which never starts a word, so only a run's start can open one.
+const WORD_PIECES = /\$'(?:\\[\s\S]|[^'\\])*'|'[^']*'|"(?:\\.|[^"\\])*"|\\[\s\S]|[\w.-]+|[\s\S]/g;
+// A piece a flag glued after still starts a word at: a quoted string, or a
+// blank, operator, backtick, quote or backslash, escaped or not.
+const FLAG_BOUNDARY_PIECE = /^(?:\$?'[\s\S]*'|"[\s\S]*"|\\?[\s;&|(\x60'"\\])$/;
 /**
- * Whether `word` ends in a credential flag the space-separated rule reads on
- * its own: it reads boundaries in the raw text, so `\<tab>--token` (an escaped
- * tab) ends in one.
+ * Whether `word` ends in a credential flag: a run of its pieces that decodes
+ * to `--` and a credential key, at the start of the word, opening with a
+ * quote, or after a piece that starts one there. That reads `\<tab>--token` (an escaped tab) and
+ * `"a"--token` (glued after a quoted string, which the shell joins into one
+ * word) as ending in a flag, with quotes inside the flag (`--t''oken`) read
+ * through. A substitution a pass replaced with the redaction marker still
+ * ends where its backtick did, so a flag after the marker starts a word as
+ * it did.
  */
+// Longer than any credential key `CREDENTIAL_KEY_WORD` matches.
+const KEY_WINDOW = 32;
 function endsInCredentialFlag(word) {
+    const pieces = word.match(WORD_PIECES) ?? [];
+    // The decoded suffix is read one piece at a time, front first, without
+    // being rebuilt: a long word would otherwise cost time quadratic in its
+    // length on the hook path. `head` keeps the suffix's first characters,
+    // enough to hold any credential key a newly read piece could start.
+    let head = '';
+    let hasKey = false;
     let start = word.length;
-    while (start > 0 && KEY_CHARACTER.test(word[start - 1]))
-        start -= 1;
-    if (!word.startsWith('--', start))
-        return false;
-    if (start > 0 && !/[\s;&|(\x60]/.test(word[start - 1]))
-        return false;
-    return CREDENTIAL_KEY_WORD.test(word.slice(start + 2));
-}
-/**
- * Whether to redact a word the chain reached. The other rules read credential
- * keys in the raw text and, for nested commands, in decoded words, so a word
- * that spells one either way (a bare credential flag among them) is left whole
- * for them to read, exactly as it reads without the chain.
- */
-function isChainedValue(word) {
-    return ![word, decodeShellWord(word)].some((text) => spellsCredentialKey(text) || startsValueHeader(text));
+    for (let index = pieces.length - 1; index >= 0; index -= 1) {
+        const piece = pieces[index];
+        start -= piece.length;
+        const decoded = decodeShellWord(piece);
+        if (!/^[\w.-]*$/.test(decoded))
+            return false;
+        const joined = decoded + head;
+        hasKey ||= CREDENTIAL_KEY_WORD.test(joined);
+        head = joined.slice(0, KEY_WINDOW);
+        // A key starts with a letter, so a suffix that opens with `--` holds a
+        // key after the dashes exactly when it holds one at all.
+        if (!head.startsWith('--') || !hasKey)
+            continue;
+        if (index === 0 ||
+            /^(?:\$?'|")/.test(piece) ||
+            FLAG_BOUNDARY_PIECE.test(pieces[index - 1]) ||
+            word.endsWith(REDACTED, start))
+            return true;
+    }
+    return false;
 }
 // `VALUE_REDACTIONS` without the global flag, for testing a single word.
 const VALUE_PATTERNS = VALUE_REDACTIONS.map(([pattern]) => new RegExp(pattern.source, pattern.flags.replace('g', '')));
 /**
  * Whether `text` begins a match of a value pattern that runs on into the next
  * word, as a header name does (`Cookie: name=value`). Redacting that word
- * would hide the value from the pattern, so the chain leaves it whole. The
- * test is read off `VALUE_REDACTIONS` itself, so a pattern added later is
- * covered without a list of header names here.
+ * would hide the value from the pattern, so the chain leaves it whole. Where
+ * no word follows (`next` is undefined: an operator or the end), no pattern
+ * can read on, so the word is not left. The test is read off
+ * `VALUE_REDACTIONS` itself, so a pattern added later is covered without a
+ * list of header names here.
  */
-function startsValueHeader(text) {
-    return VALUE_PATTERNS.some((pattern) => [' name=value', ' value'].some((next) => {
-        const match = pattern.exec(text + next);
+function startsValueHeader(word, next) {
+    if (next === undefined)
+        return false;
+    // Only the word's tail and the next word's head are read: what a pattern
+    // takes before the value is a header name, its separator and a scheme, and
+    // crossing into the next word takes a few characters of it. Testing every
+    // pattern against a whole long word costs time quadratic in its length for
+    // each word of a chain.
+    const text = word.slice(-VALUE_HEADER_TAIL);
+    return VALUE_PATTERNS.some((pattern) => [
+        ' name=value',
+        ' value',
+        ...(next ? [` ${next.slice(0, VALUE_HEADER_TAIL)}`] : []),
+    ].some((following) => {
+        const match = pattern.exec(text + following);
         return (match !== null &&
             match.index < text.length &&
             match.index + match[0].length > text.length);
     }));
 }
+const VALUE_HEADER_TAIL = 256;
+/**
+ * Whether `word` ends in a credential key or header whose value is the word
+ * after it (`a'Cookie:` then `s=v`, `xAuthorization:` then `v`), so
+ * redacting `word` would hide the value from the rule that reads the pair.
+ */
+function handsValueOn(word, after) {
+    return [
+        [word, after],
+        [decodeShellWord(word), after === undefined ? undefined : decodeShellWord(after)],
+    ].some(([text, next]) => {
+        if (startsValueHeader(text, next))
+            return true;
+        const key = trailingKeyAssignment(text);
+        return key !== undefined && next !== undefined && spellsCredentialKey(key);
+    });
+}
+/**
+ * The `key=` or `key:` that `text` ends in, read back from its end: an
+ * unanchored `/[\w.-]+\s*[=:]\s*$/` re-reads a long run of word characters
+ * from every position in it, which is quadratic in the run's length.
+ */
+function trailingKeyAssignment(text) {
+    let end = text.length;
+    while (end > 0 && /\s/.test(text[end - 1]))
+        end -= 1;
+    if (end === 0 || !/[=:]/.test(text[end - 1]))
+        return undefined;
+    let start = end - 1;
+    while (start > 0 && /\s/.test(text[start - 1]))
+        start -= 1;
+    const nameEnd = start;
+    while (start > 0 && /[\w.-]/.test(text[start - 1]))
+        start -= 1;
+    return start === nameEnd ? undefined : text.slice(start);
+}
 /** Whether the word after `word` is a credential flag's value. */
 function continuesCredentialChain(word) {
-    return isBareCredentialFlag(word) || endsInCredentialFlag(word);
+    // Decoded too: quotes hide a flag glued after a substitution or the
+    // redaction marker that replaced one (`[redacted]"--passwd"`).
+    return (isBareCredentialFlag(word) ||
+        endsInCredentialFlag(word) ||
+        endsInCredentialFlag(decodeShellWord(word)));
 }
 /**
  * The words to redact after `value`, a word ending at `end` that a rule has
@@ -565,7 +822,7 @@ function continuesCredentialChain(word) {
  * the word here, whatever flag or tool took it. `seen` holds the ends a chain
  * has already left, so a run of flags stays linear.
  */
-function followCredentialChain(value, end, next, seen) {
+function followCredentialChain(value, end, next, seen, text) {
     const ranges = [];
     for (let word = value; continuesCredentialChain(word);) {
         if (seen.has(end))
@@ -576,14 +833,29 @@ function followCredentialChain(value, end, next, seen) {
             break;
         if (isAttachedCredentialFlag(following.word))
             break;
-        if (isChainedValue(following.word))
+        if (!isBareCredentialFlag(following.word) &&
+            !handsValueOn(following.word, wordAfter(text, following.end, next)))
             ranges.push({ start: following.start, end: following.end, text: REDACTED });
         word = following.word;
         end = following.end;
     }
     return ranges;
 }
-/** Steps through `text` by shell word: a chain ends at an operator. */
+/**
+ * The word after position `end` for `startsValueHeader`: undefined where an
+ * operator follows, so no pattern can read on, and empty at the end of the
+ * text, which may be a nested word the enclosing command continues after.
+ */
+function wordAfter(text, end, next) {
+    const following = next(end);
+    if (following)
+        return following.word;
+    return text.slice(end).trim() === '' ? '' : undefined;
+}
+/**
+ * Steps through `text` by shell word: a chain ends at an operator, but not at
+ * a backtick, `)` or `$(`, which cut a flag from its value without ending it.
+ */
 function textChainCursor(text) {
     return (end) => {
         NEXT_SHELL_WORD.lastIndex = end;
@@ -635,7 +907,7 @@ function replaceValues(text, pattern, replace, after = '') {
         if (replaced === match[0])
             continue;
         ranges.push({ start: match.index, end, text: replaced });
-        for (const range of followCredentialChain(match.at(-1) ?? '', end, next, seen)) {
+        for (const range of followCredentialChain(match.at(-1) ?? '', end, next, seen, text + after)) {
             if (range.start < text.length)
                 ranges.push(range);
             else
@@ -648,7 +920,27 @@ function replaceValues(text, pattern, replace, after = '') {
     }
     return { text: applyRanges(text, ranges), after: beyond };
 }
+/**
+ * `credentialFlagValueRanges` of `command` read without the quote at `quote`,
+ * from `from`, the start of the word before it, as ranges of `command`.
+ */
+function withoutUnpairedQuote(command, from, quote, depth) {
+    if (depth >= 8)
+        return [];
+    const at = (position, isEnd) => from +
+        position +
+        (position > quote - from || (!isEnd && position === quote - from) ? 1 : 0);
+    return credentialFlagValueRanges(command.slice(from, quote) + command.slice(quote + 1), depth + 1).map((range) => ({
+        start: at(range.start, false),
+        end: at(range.end, true),
+        text: range.text,
+    }));
+}
 function redactCredentialFlagValues(command) {
+    return applyRanges(command, credentialFlagValueRanges(command));
+}
+/** The ranges `redactCredentialFlagValues` redacts in `command`. */
+function credentialFlagValueRanges(command, depth = 0) {
     const next = textChainCursor(command);
     const ranges = [];
     // A chain runs the same from any word it reaches, so one that reaches a word
@@ -656,10 +948,64 @@ function redactCredentialFlagValues(command) {
     const chained = new Set();
     for (const match of command.matchAll(CREDENTIAL_FLAG)) {
         const end = match.index + match[1].length + match[2].length + match[3].length;
+        // A value cut from its flag by a backtick or `)`, or read past an
+        // unterminated quote (where the text may be a nested word whose header
+        // runs on into the next word of the enclosing command), is less surely
+        // the flag's: one that ends in a key or header whose value is the next
+        // word is left whole for the rule that reads that pair.
+        if ((depth > 0 || /[)\x60]|\$\(/.test(match[2])) &&
+            handsValueOn(match[3], wordAfter(command, end, next)))
+            continue;
         ranges.push({ start: end - match[3].length, end, text: REDACTED });
-        ranges.push(...followCredentialChain(match[3], end, next, chained));
+        ranges.push(...followCredentialChain(match[3], end, next, chained, command));
     }
-    return applyRanges(command, ranges);
+    // A quote or escape in a flag (`'--token'`, `\--token`) hides it from the
+    // pattern above, though the shell passes the tool the same flag. Read each
+    // word as the shell decodes it, so the flag takes its value wherever it
+    // stands, including where a command starts, which the per-tool walker
+    // reads as the program's name.
+    let wordEnd = 0;
+    let wordStart = 0;
+    for (const word of command.matchAll(SHELL_WORDS)) {
+        // A quote between words opens a string that never closes (a word would
+        // have taken a closed one). The shell fails on it, so which quotes pair
+        // is a guess: the unpaired one may be the second half of a flag's own
+        // `''`, or close what the word before it opened. What was typed there is
+        // still what a person meant, so the text is read again without that
+        // quote, from the word before it, and a credential flag keeps its value.
+        const gap = command.slice(wordEnd, word.index);
+        const open = gap.search(/['"]/);
+        if (open !== -1) {
+            ranges.push(...withoutUnpairedQuote(command, wordStart, wordEnd + open, depth));
+            break;
+        }
+        wordStart = word.index;
+        wordEnd = word.index + word[0].length;
+        if (word.index > 0 && !/[\s;&|()]/.test(command[word.index - 1]))
+            continue;
+        // A substitution a pass replaced with the redaction marker ends where its
+        // backtick did, so a flag glued after either starts a word, and a
+        // backtick or `)` after a flag cuts it from its value without ending
+        // it. A flag glued after a quoted string or an escaped blank
+        // (`"a "--token`, `a\ --token`) is the end of a word the chain reads as
+        // a credential flag, so it is read as one here too.
+        const flag = word[0].replace(/^(?:\x60|\[redacted\])+/, '').replace(/\x60+$/, '');
+        if (decodeShellWord(flag) === flag ||
+            !continuesCredentialChain(word[0].replace(/\x60+$/, '')))
+            continue;
+        const end = word.index + word[0].length;
+        const value = next(end);
+        // A value that spells a credential key or starts a header is left whole
+        // for the rules that read one, as the chain leaves it; so is one that
+        // opens a backtick substitution, which the substitution passes read.
+        if (!value ||
+            value.word.includes('\x60') ||
+            handsValueOn(value.word, wordAfter(command, value.end, next)))
+            continue;
+        ranges.push({ start: value.start, end: value.end, text: REDACTED });
+        ranges.push(...followCredentialChain(value.word, value.end, next, chained, command));
+    }
+    return ranges;
 }
 function applyCommandRedactions(command) {
     let out = command;
@@ -689,7 +1035,7 @@ const COMMAND_REDACTIONS = [
         `$1$2$3 ${REDACTED}$4`,
     ],
     [new RegExp(PRIVATE_KEY_BLOCK_SOURCE, 'g'), REDACTED],
-    ...VALUE_REDACTIONS,
+    ...VALUE_REDACTION_PASSES,
     redactCredentialFlagValues,
     // JSON bodies embedded in shell commands are still command text. Quoted
     // keys evade the shell-assignment scanner below, including escaped values.
@@ -1281,7 +1627,7 @@ function redactToolArguments(command, inputs) {
         const word = at === undefined ? undefined : words[at];
         if (!word || edit.end !== word.index + word[0].length)
             return [];
-        return followCredentialChain(word[0], edit.end, nextWord, chainedWords);
+        return followCredentialChain(word[0], edit.end, nextWord, chainedWords, command);
     });
     // A chain edit either matches an edit's word or misses it; on a match the
     // whole-word redaction replaces it, so the chain only ever adds.
@@ -1293,6 +1639,13 @@ function redactToolArguments(command, inputs) {
         else
             edits[same] = chainEdit;
     }
+    // Erasing a header name also erases the context needed to redact its
+    // following value. Rewriting across shell words can change quote pairing,
+    // so this ambiguous credential form fails closed rather than risking a leak.
+    for (const index of VALUE_REDACTIONS.keys()) {
+        if (valueRedactionRanges(command, index).some((range) => edits.some((edit) => range.start >= edit.start && range.start < edit.end && range.end > edit.end)))
+            return REDACTED;
+    }
     edits.sort((a, b) => a.start - b.start);
     for (const edit of edits.reverse())
         command = command.slice(0, edit.start) + edit.text + command.slice(edit.end);
@@ -1388,7 +1741,7 @@ function valueRedactionTargets(command) {
         for (const match of command.match(pattern) ?? []) {
             if (/[`\uE000\uE001]/.test(match))
                 continue;
-            const value = changedPart(match, match.replace(single, replacement));
+            const value = changedPart(match, redactValueMatch(match, single, replacement));
             if (value !== '' && !values.includes(value))
                 values.push(value);
         }
@@ -1408,7 +1761,7 @@ function redactValuesFirst(command, early) {
     for (const [pattern, replacement] of VALUE_REDACTIONS) {
         const single = new RegExp(pattern.source, pattern.flags.replace('g', ''));
         whole = whole.replace(pattern, (match) => {
-            const redacted = match.replace(single, replacement);
+            const redacted = redactValueMatch(match, single, replacement);
             if (!/[`\uE000\uE001]/.test(match) && early.has(changedPart(match, redacted)))
                 return redacted;
             held.push(match);
@@ -1420,17 +1773,31 @@ function redactValuesFirst(command, early) {
         whole = whole.replace(/\uE000(\d+)\uE001/g, (_, index) => held[Number(index)]);
     return whole;
 }
+/**
+ * Redact each `VALUE_REDACTIONS` match in `text` that starts in a word
+ * `rewriteWord` changes and runs on past it, as a header whose value is the
+ * next word does (`"…Set-Cookie:" s=v`). Re-spelling that word moves the
+ * header's name away from its value, so the value patterns, which run after
+ * the rewrite, would no longer see the pair. Every other match is left to
+ * them and to the rewrite, which reads the rest of its word.
+ */
+function redactHeadersAcrossRewrites(text, rewriteWord) {
+    const rewritten = [...text.matchAll(SHELL_WORDS)]
+        .filter((word) => rewriteWord(word[0]) !== word[0])
+        .map((word) => [word.index, word.index + word[0].length]);
+    if (rewritten.length === 0)
+        return text;
+    return applyRanges(text, [...VALUE_REDACTIONS.keys()].flatMap((index) => valueRedactionRanges(text, index).filter((range) => rewritten.some(([from, to]) => range.start >= from && range.start < to && range.end > to))));
+}
 function redactAfterValues(command, depth, writtenInputs, valuesFirst = true) {
     command = redactCommandSubstitutions(command, depth, writtenInputs, valuesFirst);
+    const inputs = withInheritedInputs(backtickAwareInputs(command), writtenInputs);
+    const sensitiveAssignment = new RegExp(`^(${COMMAND_SENSITIVE_KEY_SOURCE})(\\+?=)`, 'i');
     // Nested scripts may be dispatched by any tool. Scan decoded compound
     // words instead of maintaining another list of interpreter/wrapper flags.
     // JSON and sensitive assignments already have structural/whole-word passes;
     // treating their values as commands would lose evidence or word boundaries.
-    const inputs = withInheritedInputs(backtickAwareInputs(command), writtenInputs);
-    const sensitiveAssignment = new RegExp(`^(${COMMAND_SENSITIVE_KEY_SOURCE})(\\+?=)`, 'i');
-    // Resolve credential references before nested word redaction can erase the
-    // expansion marker while leaving its original variable definition behind.
-    let out = redactToolArguments(redactJsonArguments(command), inputs).replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
+    const rewriteWord = (word) => {
         const decoded = decodeShellWord(word);
         // A compound word beginning with a credential assignment may be either
         // an env value or a whole script. Its entire value is private in both
@@ -1452,7 +1819,33 @@ function redactAfterValues(command, depth, writtenInputs, valuesFirst = true) {
         }
         const redacted = redactShellSyntax(decoded, depth + 1, inputs, valuesFirst);
         return redacted === decoded ? word : JSON.stringify(redacted);
-    });
+    };
+    const rewrites = new Map();
+    const rewriteOnce = (word) => {
+        let rewritten = rewrites.get(word);
+        if (rewritten === undefined)
+            rewrites.set(word, (rewritten = rewriteWord(word)));
+        return rewritten;
+    };
+    // Resolve credential references before nested word redaction can erase the
+    // expansion marker while leaving its original variable definition behind.
+    const text = redactHeadersAcrossRewrites(redactToolArguments(redactJsonArguments(command), inputs), rewriteOnce);
+    // A rewrite can take the credential flag a word ends in (the header value
+    // in `'…: v'--token` runs on through it once decoded), so its value is
+    // followed, as for every other edit that rewrites a word.
+    const next = textChainCursor(text);
+    const chained = new Set();
+    const ranges = [];
+    for (const word of text.matchAll(SHELL_WORDS)) {
+        const rewritten = rewriteOnce(word[0]);
+        if (rewritten === word[0])
+            continue;
+        const end = word.index + word[0].length;
+        ranges.push({ start: word.index, end, text: rewritten });
+        if (!continuesCredentialChain(rewritten))
+            ranges.push(...followCredentialChain(word[0], end, next, chained, text));
+    }
+    const out = applyRanges(text, ranges);
     return applyCommandRedactions(redactCredentialAssignments(out, inputs));
 }
 /**