@mossbear/eval-core 0.1.0-alpha.106 → 0.1.0-alpha.108

package/dist/sanitize-command.js

@@ -1,1569 +1,97 @@
 /**
- * Secret redaction and length-capping for shell command text.
+ * Command evidence is an executable label, never arguments or shell source.
  *
- * Command text can embed secrets or whole file bodies (heredocs, inline env
- * vars). The CLI runs logged commands through this before creating an action
- * summary. Recognized credential syntax is removed; arbitrary shell/tool
- * programs remain an open language, so pattern scanning cannot prove that
- * every surviving argument is credential-free.
+ * Only literal, known executable names are admitted. An arbitrary first word
+ * can itself be a credential or file content, so unsupported syntax and custom
+ * executables produce a fixed withholding marker. Wrappers are not unwrapped:
+ * `sh -c ...` reports `sh`, and nothing inside its script is inspected.
  *
- * Lives in eval-core rather than the CLI because grading is what consumes the
- * result: this is the boundary that decides what a grader may ever see of a
- * command.
+ * The exported name is retained for callers that also print hook diagnostics.
  */
-import { COOKIE_HEADER_SOURCE, SENSITIVE_KEY_SOURCE, SENSITIVE_WORD_SOURCE, SHELL_WORD_SOURCE, } from './credential-patterns.js';
-import { PRIVATE_KEY_BLOCK_SOURCE, REDACTED } from './redaction.js';
-/**
- * Maximum characters of a single command string that survive redaction.
- * Short commands convey which tools the agent invoked — which is all a grader
- * needs; anything longer is bulk payload (heredocs, inline file writes) that
- * must not leave the machine.
- */
-const MAX_COMMAND_CHARS = 200;
-// SSHPASS, REDISCLI_AUTH, VALKEYCLI_AUTH and MYSQL_PWD are each tool's dedicated
-// environment credential, despite not containing the usual password/token spelling.
-const COMMAND_SENSITIVE_KEY_SOURCE = `(?:${SENSITIVE_KEY_SOURCE}|SSHPASS|REDISCLI_AUTH|VALKEYCLI_AUTH|MYSQL_PWD)`;
-const SENSITIVE_KEY = new RegExp(`^${COMMAND_SENSITIVE_KEY_SOURCE}$`, 'i');
-const SENSITIVE_CONTENT = new RegExp(SENSITIVE_WORD_SOURCE, 'i');
-// Only switches that consume no argument may precede an argument flag in
-// curl's short-option clusters. For example, -sx is proxy auth, while -osx
-// names an output file and must not be interpreted as a proxy option.
-const CURL_SHORT_SWITCHES = '[012346aBfgGiIjJklLMnNOpqRsSvVZ:#]*';
-const CURL_PAYLOAD_FLAG = new RegExp(`^(-${CURL_SHORT_SWITCHES}[dHF])(.+)?$|^(--(?:data|data-raw|data-binary|data-urlencode|json|form|form-string|header|proxy-header))(?:=(.*))?$`);
-const CURL_CONFIG_FLAG = new RegExp(`^(?:-${CURL_SHORT_SWITCHES}K|--config(?:=|$))`);
-const CURL_URL_OPTIONS = 'url|proxy|proxy1\\.0|preproxy|socks4|socks4a|socks5|socks5-hostname';
-const CURL_URL_FIELD = new RegExp(`^(?:${CURL_URL_OPTIONS})$`, 'i');
-// Tool families share one credential syntax, so each family is defined once and
-// every member inherits its password flags, URI handling and attached-value rules.
-// MySQL-family clients read a bare -p as a password prompt, so only the attached
-// -p<password> spelling carries a credential.
-const MYSQL_FAMILY = [
-    'mysql',
-    'mariadb',
-    'mysqldump',
-    'mysqladmin',
-    'mariadb-dump',
-    'mariadb-admin',
-];
-// redis-cli and valkey-cli (a Redis fork) take the same password flags and URIs.
-const REDIS_FAMILY = ['redis-cli', 'valkey-cli'];
-const MYSQL_PASSWORD_FLAG = /^(-p)(.*)$/;
-const REDIS_PASSWORD_FLAG = /^(-a|--pass|--cluster-from-pass)(?:=(.*))?$/;
-// Both families accept redis:// and valkey:// URIs, with or without TLS (`s`).
-const REDIS_URI = /^(?:rediss?|valkeys?):\/\//i;
-/**
- * The tool a word invokes: its basename, lowercased, without a Windows
- * executable suffix. Windows resolves executable names case-insensitively.
- * Backticks are dropped, so a word a substitution begins or ends (`` `curl ``)
- * still names its tool when quoting hides the substitution from the parser.
- */
-function invokedTool(word) {
-    return (word.replaceAll('`', '').split(/[\\/]/).at(-1) ?? word)
-        .replace(/\.exe$/i, '')
-        .toLowerCase();
-}
-const CREDENTIAL_TOOLS = [
-    'curl',
-    'http',
-    'https',
-    'httpie',
-    'openssl',
-    'sshpass',
-    ...REDIS_FAMILY,
-    ...MYSQL_FAMILY,
-];
-// Password flags by tool. Each regex captures the flag name and, when the value
-// is attached, the value itself.
-const DIRECT_PASSWORD_FLAGS = new Map([
-    [
-        'openssl',
-        /^(-{1,2}(?:pass(?:in|out)?|password|srppass|pwri_password|secretkey|hmac|[kK]))(?:=(.*))?$/,
-    ],
-    ['sshpass', /^(-[46v]*p)(.*)$/],
-    ...REDIS_FAMILY.map((tool) => [tool, REDIS_PASSWORD_FLAG]),
-    ...MYSQL_FAMILY.map((tool) => [tool, MYSQL_PASSWORD_FLAG]),
-]);
-// Valued wrapper options name users, files or scripts, never the child tool.
-const WRAPPER_VALUE_FLAGS = {
-    sudo: /^-(?:[AbEHIKknPSVbveis]*[ughpDTRCrt])(.+)?$|^--(?:user|group|host|prompt|chdir|chroot|command-timeout|close-from|role|type)(?:=(.*))?$/,
-    doas: /^-[uC](.+)?$/,
-    env: /^-[uCSa](.+)?$|^--(?:unset|chdir|split-string|argv0)(?:=(.*))?$/,
-    time: /^-[of](.+)?$|^--(?:output|format)(?:=(.*))?$/,
-    xargs: /^-[adEILnPs](.+)?$|^--(?:arg-file|delimiter|eof|replace|max-lines|max-args|max-procs|max-chars)(?:=(.*))?$/,
-};
-// Wrapper options known to take no value. Any other option, unless its value is
-// attached with `=`, may have consumed the next word.
-const WRAPPER_SWITCHES = {
-    sudo: /^-[AbEHIKklnPSsVvie]+$|^--(?:preserve-env|login|shell|set-home|non-interactive|background)$/,
-    doas: /^-[nsL]+$/,
-    env: /^-[i0v]+$|^-$|^--(?:ignore-environment|null|debug)$/,
-    time: /^-[pvqa]+$|^--(?:portability|verbose|quiet|append)$/,
-    xargs: /^-[0rtpxo]+$|^--(?:null|no-run-if-empty|verbose|interactive|exit|open-tty)$/,
-};
-// Programs that never run an argument as a command, so a credential tool's name
-// among their arguments is a file (`cat ./bin/curl`), not an invocation. Any
-// program not listed may dispatch (`timeout`, `watch`, `find -exec`, `ssh`), and
-// keeps treating every word as a possible invocation, so an unlisted program
-// errs toward over-redaction.
-const NON_DISPATCHING_TOOLS = new Set([
-    'basename',
+const EXECUTABLES = new Set([
+    'awk',
+    'bash',
+    'bun',
     'cat',
-    'chgrp',
+    'cd',
     'chmod',
     'chown',
     'cmp',
     'cp',
+    'curl',
+    'cut',
+    'date',
+    'deno',
     'diff',
-    'dirname',
-    'du',
-    'file',
+    'docker',
+    'echo',
+    'env',
+    'find',
+    'gh',
+    'git',
+    'go',
     'grep',
     'head',
-    'ln',
+    'java',
+    'jq',
+    'less',
     'ls',
+    'make',
     'mkdir',
+    'mossbear',
     'mv',
-    'readlink',
-    'realpath',
+    'mysql',
+    'mysqladmin',
+    'node',
+    'npm',
+    'npx',
+    'openssl',
+    'perl',
+    'php',
+    'pip',
+    'pip3',
+    'pnpm',
+    'powershell',
+    'printf',
+    'ps',
+    'psql',
+    'pwsh',
+    'python',
+    'python3',
+    'redis-cli',
+    'rg',
     'rm',
-    'stat',
+    'ruby',
+    'rustc',
+    'cargo',
+    'sed',
+    'sh',
+    'sort',
+    'ssh',
+    'sudo',
     'tail',
+    'tar',
+    'tee',
+    'test',
     'touch',
+    'tr',
+    'true',
+    'tsc',
+    'unzip',
+    'uv',
+    'vitest',
     'wc',
+    'wget',
     'which',
+    'xargs',
+    'yarn',
+    'zsh',
 ]);
-/**
- * Whether the command word starting at `index` of `text` runs a listed program:
- * bare, or from a system bin directory. A same-named local script
- * (`./tools/diff`) may run anything, and a redirection operand (`>file curl`)
- * names a file, not the command.
- */
-function isNonDispatching(text, index, word) {
-    let before = index - 1;
-    while (text[before] === ' ' || text[before] === '\t')
-        before -= 1;
-    // `>&file` and `>|file` redirect too.
-    if (text[before] === '&' || text[before] === '|')
-        before -= 1;
-    if (text[before] === '<' || text[before] === '>')
-        return false;
-    // A backtick in the command word may start a substitution that runs anything.
-    if (word.includes('`'))
-        return false;
-    return (NON_DISPATCHING_TOOLS.has(invokedTool(word)) &&
-        /^(?:(?:\/usr)?\/bin\/)?[^\\/]+$/.test(word));
-}
-const CURL_AUTH_OPTIONS = `user|proxy-user|${CURL_URL_OPTIONS}|cookie|oauth2-bearer|cert|proxy-cert|pass|proxy-pass`;
-const CURL_AUTH_FLAG = new RegExp(`^(-${CURL_SHORT_SWITCHES}[uUbEx])(.+)?$|^(--(?:${CURL_AUTH_OPTIONS}))(?:=(.*))?$`);
-const CURL_EXPANSION = /\{\{([A-Za-z0-9_]+)(?::[^{}]*)?\}\}/g;
-const CURL_EXPAND_FLAG = new RegExp(`^--expand-(${CURL_AUTH_OPTIONS}|header|proxy-header|data|data-raw|data-binary|data-urlencode|json|form|form-string)(?:=(.*))?$`);
-function hasPrivateConfigVariables(body) {
-    if (!/\b(?:expand-)?variable\s*[=: \t]/i.test(body))
-        return false;
-    if (/\bexpand-(?:user|proxy-user|oauth2-bearer|cookie|cert|proxy-cert|pass|proxy-pass|header|proxy-header|data(?:-raw|-binary|-urlencode)?|json|form(?:-string)?)\s*[=: \t]/i.test(body))
-        return true;
-    return (/\bexpand-(?:url|proxy|preproxy|socks[45](?:a|-hostname)?)\s*[=: \t]/i.test(body) &&
-        (/[^/\s:@]+:[^@\s]*@/.test(body) ||
-            new RegExp(`[?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=`, 'i').test(body)));
-}
-function decodeShellWord(word) {
-    return word.replace(/\$'((?:\\[\s\S]|[^'\\])*)'|'([^']*)'|"((?:\\.|[^"\\])*)"|\\([\s\S])|([^'"\\]+)/g, (_, ansi, single, double, escaped, plain) => {
-        if (ansi !== undefined)
-            return ansi.replace(/\\(?:x([\da-f]{1,2})|u([\da-f]{1,4})|U([\da-f]{1,8})|([0-7]{1,3})|([\s\S]))/gi, (escape, hex, unicode, wide, octal, character) => {
-                if (hex || unicode || wide || octal) {
-                    const code = Number.parseInt(hex ?? unicode ?? wide ?? octal, octal ? 8 : 16);
-                    return code <= 0x10ffff ? String.fromCodePoint(code) : escape;
-                }
-                const controls = {
-                    a: '\x07',
-                    b: '\b',
-                    e: '\x1b',
-                    E: '\x1b',
-                    f: '\f',
-                    n: '\n',
-                    r: '\r',
-                    t: '\t',
-                    v: '\v',
-                };
-                return controls[character] ?? (/['"\\?]/.test(character) ? character : escape);
-            });
-        if (single !== undefined)
-            return single;
-        if (double !== undefined)
-            return double.replace(/\\([$`"\\\n])/g, (_, character) => character === '\n' ? '' : character);
-        return escaped ?? plain ?? '';
-    });
-}
-/**
- * Undo the escapes a backtick substitution's body carries for `\\` and `\``,
- * and for `\"` when the substitution sits inside double quotes.
- * `\$` is left escaped: the word parser decodes it either way.
- */
-function unescapeBacktickBody(body, doubleQuoted = false) {
-    return body.replace(doubleQuoted ? /\\([\\`"])/g : /\\([\\`])/g, '$1');
-}
-/** Spell a body back inside backticks, reversing `unescapeBacktickBody`. */
-function escapeBacktickBody(body, doubleQuoted = false) {
-    return body.replace(doubleQuoted ? /\\(?=[\\`"]|$)|[`"]/g : /\\(?=[\\`]|$)|`/g, '\\$&');
-}
-/**
- * The command with each backtick substitution spelled `$(…)`. `(` separates
- * words for the tool parsers and a backtick does not, so tool-input discovery
- * reads this spelling to see the commands inside backticks.
- */
-function backticksAsSubshells(command, depth = 0) {
-    if (depth > 8 || !command.includes('`'))
-        return command;
-    let quote = null;
-    let out = '';
-    for (let index = 0; index < command.length; index += 1) {
-        const char = command[index];
-        if (char === '\\' && quote !== "'") {
-            out += command.slice(index, index + 2);
-            index += 1;
-            continue;
-        }
-        if (char === '`' && quote !== "'") {
-            let end = index + 1;
-            while (end < command.length && command[end] !== '`')
-                end += command[end] === '\\' ? 2 : 1;
-            const body = unescapeBacktickBody(command.slice(index + 1, end));
-            out += `$(${backticksAsSubshells(body, depth + 1)})`;
-            index = end;
-            continue;
-        }
-        if (char === "'" && quote !== '"')
-            quote = quote === "'" ? null : "'";
-        else if (char === '"' && quote !== "'")
-            quote = quote === '"' ? null : '"';
-        out += char;
-    }
-    return out;
-}
-/**
- * Tool inputs read from the command as written and from its `$(…)` spelling.
- * The respelling separates a backtick body from its first word but also
- * splits a word that runs on past the substitution, so neither alone sees
- * every reference.
- */
-function backtickAwareInputs(command) {
-    const inputs = getToolInputs(command);
-    return command.includes('`')
-        ? withInheritedInputs(getToolInputs(backticksAsSubshells(command)), inputs)
-        : inputs;
-}
-function withInheritedInputs(inputs, inherited) {
-    inputs.curlConfig ||= inherited?.curlConfig ?? false;
-    for (const name of inherited?.curlVariables ?? [])
-        inputs.curlVariables.add(name);
-    for (const key of inherited?.env ?? [])
-        inputs.env.add(key);
-    for (const source of inherited?.passSources ?? [])
-        inputs.passSources.add(source);
-    return inputs;
-}
-/**
- * A program supplying a credential argument carries private produced content.
- * Any other backtick substitution runs a command of its own, which a backtick
- * does not separate from its first word the way `(` does, so its body is
- * redacted as a command in its own right. An escaped backtick is literal text;
- * `invokedTool` still reads the tool its word names.
- */
-/** Whether an unescaped double quote closes the one open at `from`. */
-function closesQuote(command, from) {
-    for (let index = from; index < command.length; index += 1) {
-        if (command[index] === '\\')
-            index += 1;
-        else if (command[index] === '"')
-            return true;
-    }
-    return false;
-}
-function redactCommandSubstitutions(command, depth = 0, inheritedInputs, valuesFirst = true) {
-    if (depth > 8)
-        return REDACTED;
-    const marker = '__SUBSTITUTION_BOUNDARY__';
-    if (command.includes(marker))
-        return REDACTED;
-    let contextInputs;
-    // A body also feeds, or consumes, the commands around it.
-    const surroundingInputs = () => (contextInputs ??= withInheritedInputs(backtickAwareInputs(command), inheritedInputs));
-    const isCredentialInput = (start, end) => {
-        const probe = command.slice(0, start) + marker + command.slice(end + 1);
-        const inputs = getToolInputs(probe);
-        const redacted = redactCredentialAssignments(redactToolArguments(redactJsonArguments(probe), inputs), inputs);
-        return !applyCommandRedactions(redacted).includes(marker);
-    };
-    const findEnd = (start, closing, depth) => {
-        if (depth > 8)
-            return command.length;
-        // A backtick body ends at the first unescaped backtick, as bash reads it:
-        // quotes inside it do not hide one, and `\` escapes even inside `'…'`.
-        if (closing === '`') {
-            for (let index = start; index < command.length; index += 1) {
-                if (command[index] === '\\')
-                    index += 1;
-                else if (command[index] === '`')
-                    return index;
-            }
-            return command.length;
-        }
-        let quote = null;
-        let groups = 0;
-        for (let index = start; index < command.length; index += 1) {
-            const char = command[index];
-            if (char === '\\' && quote !== "'") {
-                index += 1;
-                continue;
-            }
-            if (quote === "'") {
-                if (char === "'")
-                    quote = null;
-                continue;
-            }
-            if (char === '$' && command[index + 1] === '(') {
-                index = findEnd(index + 2, ')', depth + 1);
-                continue;
-            }
-            if (char === '`') {
-                index = findEnd(index + 1, '`', depth + 1);
-                continue;
-            }
-            if (char === "'" && quote === null)
-                quote = "'";
-            else if (char === '"')
-                quote = quote === '"' ? null : '"';
-            else if (quote === null && char === '(')
-                groups += 1;
-            else if (quote === null && char === ')') {
-                if (groups === 0 && closing === ')')
-                    return index;
-                groups -= 1;
-            }
-        }
-        return command.length;
-    };
-    let quote = null;
-    let out = '';
-    let substitutions = 0;
-    // Where in `out` the open double quote began.
-    let quoteOpenedAt = 0;
-    for (let index = 0; index < command.length; index += 1) {
-        const char = command[index];
-        if (char === '\\' && quote !== "'") {
-            out += command.slice(index, index + 2);
-            index += 1;
-            continue;
-        }
-        if (quote !== "'" && (char === '`' || (char === '$' && command[index + 1] === '('))) {
-            if (++substitutions > 64)
-                return out + REDACTED;
-            const start = index;
-            const bodyStart = index + (char === '`' ? 1 : 2);
-            index = findEnd(bodyStart, char === '`' ? '`' : ')', 0);
-            const original = command.slice(start, index + 1);
-            if (isCredentialInput(start, index))
-                out += REDACTED;
-            else if (char === '`') {
-                // In the command as written, an unterminated backtick leaves the
-                // body's extent unknown: fail closed. A nested pass sees words the
-                // parser split at a backtick (`"a b"\``), so it parses the rest instead.
-                const unterminated = command[index] !== '`';
-                if (unterminated && depth === 0)
-                    return `${out}\`${REDACTED}`;
-                const body = unescapeBacktickBody(command.slice(bodyStart, index), quote === '"');
-                const redacted = redactShellSyntax(body, depth + 1, surroundingInputs(), valuesFirst);
-                // Rewriting a body inside a double quote that never closes changes
-                // how the rest of that quote splits into words, which can move a
-                // credential argument's extent: fail closed, as for an unterminated
-                // backtick.
-                if (redacted !== body && quote === '"' && !closesQuote(command, index + 1))
-                    return `${out.slice(0, quoteOpenedAt)}${REDACTED}`;
-                out +=
-                    redacted === body
-                        ? original
-                        : `\`${escapeBacktickBody(redacted, quote === '"')}${unterminated ? '' : '`'}`;
-            }
-            else if (original.includes('`')) {
-                // `(` already exposes this body to the outer parse; only backticks
-                // nested inside it need a pass of their own.
-                const body = command.slice(bodyStart, index);
-                out += `$(${redactCommandSubstitutions(body, depth + 1, surroundingInputs(), valuesFirst)}${command.slice(index, index + 1)}`;
-            }
-            else
-                out += original;
-            continue;
-        }
-        if (char === "'" && quote !== '"')
-            quote = quote === "'" ? null : "'";
-        else if (char === '"' && quote !== "'") {
-            if (quote === null)
-                quoteOpenedAt = out.length;
-            quote = quote === '"' ? null : '"';
-        }
-        out += char;
-    }
-    return out;
-}
-function hasSensitiveContent(text) {
-    // Even malformed JSON may spell a key with unicode escapes.
-    return SENSITIVE_CONTENT.test(text.replace(/\\u([0-9a-f]{4})/gi, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))));
-}
-function redactJsonValue(value, depth = 0) {
-    // Bound traversal independently of the later command-length cap. Deep
-    // payloads are content, so dropping a subtree is the conservative answer.
-    if (depth > 20)
-        return REDACTED;
-    if (typeof value === 'string' && /^\s*[[{]/.test(value)) {
-        try {
-            const parsed = JSON.parse(value);
-            const redacted = JSON.stringify(redactJsonValue(parsed, depth + 1));
-            return redacted === JSON.stringify(parsed) ? value : redacted;
-        }
-        catch {
-            return hasSensitiveContent(value) ? REDACTED : value;
-        }
-    }
-    if (Array.isArray(value))
-        return value.map((item) => redactJsonValue(item, depth + 1));
-    if (!value || typeof value !== 'object')
-        return value;
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-        key,
-        SENSITIVE_KEY.test(key) ? REDACTED : redactJsonValue(item, depth + 1),
-    ]));
-}
-function redactJsonArguments(command) {
-    const redactArgument = (argument) => {
-        // Shell double quotes only consume escapes for these characters. JSON's
-        // string decoder rejects valid shell escapes such as \$, so decode the
-        // shell layer before parsing the request body.
-        const raw = decodeShellWord(argument);
-        if (!/^\s*[[{]/.test(raw))
-            return argument;
-        try {
-            const parsed = JSON.parse(raw);
-            const redacted = JSON.stringify(redactJsonValue(parsed));
-            if (redacted === JSON.stringify(parsed))
-                return argument;
-            return argument.startsWith("'") ? `'${redacted}'` : JSON.stringify(redacted);
-        }
-        catch {
-            // A JSON-like payload that cannot be decoded may still contain escaped
-            // credential keys. Drop its contents rather than scan partial syntax.
-            if (!hasSensitiveContent(raw))
-                return argument;
-            return argument.startsWith("'") ? `'${REDACTED}'` : `"${REDACTED}"`;
-        }
-    };
-    // Dropping a word that a substitution closed onto a credential flag
-    // (`[a]` then a backtick and `--token`) hides the flag from the
-    // space-separated rule, so its value is followed here, as for every other
-    // edit that rewrites a word.
-    const next = textChainCursor(command);
-    const chained = new Set();
-    const ranges = [];
-    for (const match of command.matchAll(new RegExp(SHELL_WORD_SOURCE, 'g'))) {
-        const replaced = redactArgument(match[0]);
-        if (replaced === match[0])
-            continue;
-        const end = match.index + match[0].length;
-        ranges.push({ start: match.index, end, text: replaced });
-        ranges.push(...followCredentialChain(match[0], end, next, chained, command));
-    }
-    return applyRanges(command, ranges);
-}
-/**
- * Credential values recognised by the name beside them (URL userinfo,
- * Authorization and Cookie headers, query keys) rather than by shell words.
- */
-const VALUE_REDACTIONS = [
-    [/\b([a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:)[^@\s]+@/gi, `$1${REDACTED}@`],
-    [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+@/gi, `$1${REDACTED}@`],
-    [/\b(authorization\s*:\s*)(?:(?:bearer|basic|token)\s+)?\S+/gi, `$1${REDACTED}`],
-    [new RegExp(COOKIE_HEADER_SOURCE, 'gi'), `$1${REDACTED}`],
-    [
-        new RegExp(`([?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=)[^&\\s"'<>]+`, 'gi'),
-        `$1${REDACTED}`,
-    ],
-];
-/**
- * Space-separated credential flags have no assignment operator or token
- * prefix. Keep the flag for evidence, but never its value. The value is the
- * next shell word across any whitespace, newlines included: a word typed on
- * the line after `--password` is very likely the password, even though bash
- * would read it as a new command.
- *
- * That reach means the value can itself be a credential flag
- * (`--password --token <value>`). Taking it as the first flag's value must not
- * spare its own value, so the word after a swallowed credential flag is
- * redacted too, for as long as the chain runs. A chained word that spells a
- * credential key is left for the passes after this one to read (see
- * `isChainedValue`), and one with an attached value ends the chain. Every
- * match the rule makes on its own is still redacted: the chain only adds.
- */
-const CREDENTIAL_FLAG = new RegExp(`(^|[\\s;&|(\\x60])(--${COMMAND_SENSITIVE_KEY_SOURCE}\\s+)(${SHELL_WORD_SOURCE})`, 'gi');
-const NEXT_SHELL_WORD = new RegExp(`(\\s+)(${SHELL_WORD_SOURCE})`, 'y');
-const SHELL_WORDS = new RegExp(SHELL_WORD_SOURCE, 'g');
-// The words a credential key is spelled with. Keys are tested by scanning a
-// word's `[\w.-]` runs for one rather than by a regex with `[\w.-]*` on both
-// sides of the key, which backtracks quadratically on a long word.
-const CREDENTIAL_KEY_WORD = new RegExp(`${SENSITIVE_WORD_SOURCE}|SSHPASS|REDISCLI_AUTH|VALKEYCLI_AUTH|MYSQL_PWD`, 'i');
-const ASSIGNMENT_OPERATOR = /\s*[=:]/y;
-const LINE_CONTINUATION = /^\\\r?\n$/;
-const KEY_CHARACTER = /[\w.-]/;
-/** `SENSITIVE_KEY`'s test, without its backtracking on a long name. */
-function isCredentialKeyName(name) {
-    return ((/^[\w.-]+$/.test(name) && SENSITIVE_CONTENT.test(name)) ||
-        /^(?:SSHPASS|REDISCLI_AUTH|VALKEYCLI_AUTH|MYSQL_PWD)$/i.test(name));
-}
-function isBareCredentialFlag(word) {
-    const flag = /^--([^=]+)$/.exec(decodeShellWord(word));
-    return flag !== null && isCredentialKeyName(flag[1]);
-}
-/**
- * `--token=<value>` carries its own value, which the attached-flag and
- * assignment rules redact while keeping the flag's name readable to the
- * passes after them.
- */
-function isAttachedCredentialFlag(word) {
-    const flag = /^--([^=]+)=/.exec(decodeShellWord(word));
-    return flag !== null && isCredentialKeyName(flag[1]);
-}
-/**
- * Whether `text` spells a credential key where the other rules read one: a
- * `[\w.-]` run at the start, or after a shell boundary, quote or escape (where
- * a decoded word starts), that is a `--` flag or is followed by `=` or `:`.
- */
-function spellsCredentialKey(text) {
-    for (const run of text.matchAll(/[\w.-]+/g)) {
-        if (run.index > 0 && !/[\s;&|(\x60'"\\]/.test(text[run.index - 1]))
-            continue;
-        if (!CREDENTIAL_KEY_WORD.test(run[0]))
-            continue;
-        if (run[0].startsWith('--'))
-            return true;
-        ASSIGNMENT_OPERATOR.lastIndex = run.index + run[0].length;
-        if (ASSIGNMENT_OPERATOR.test(text))
-            return true;
-    }
-    return false;
-}
-/**
- * Whether `word` ends in a credential flag the space-separated rule reads on
- * its own: it reads boundaries in the raw text, so `\<tab>--token` (an escaped
- * tab) ends in one.
- */
-function endsInCredentialFlag(word) {
-    let start = word.length;
-    while (start > 0 && KEY_CHARACTER.test(word[start - 1]))
-        start -= 1;
-    if (!word.startsWith('--', start))
-        return false;
-    // A substitution a pass replaced with the redaction marker still ends where
-    // its backtick did, so a flag after the marker starts a word as it did.
-    if (start > 0 &&
-        !/[\s;&|(\x60]/.test(word[start - 1]) &&
-        !word.slice(0, start).endsWith(REDACTED))
-        return false;
-    return CREDENTIAL_KEY_WORD.test(word.slice(start + 2));
-}
-/**
- * Whether to redact a word the chain reached. The other rules read credential
- * keys in the raw text and, for nested commands, in decoded words, so a word
- * that spells one either way (a bare credential flag among them) is left whole
- * for them to read, exactly as it reads without the chain. So is a header that
- * a value pattern reads on into `after`, the word that follows it.
- */
-function isChainedValue(word, after) {
-    return ![
-        [word, after],
-        [decodeShellWord(word), after === undefined ? undefined : decodeShellWord(after)],
-    ].some(([text, next]) => spellsCredentialKey(text) || startsValueHeader(text, next));
-}
-// `VALUE_REDACTIONS` without the global flag, for testing a single word.
-const VALUE_PATTERNS = VALUE_REDACTIONS.map(([pattern]) => new RegExp(pattern.source, pattern.flags.replace('g', '')));
-/**
- * Whether `text` begins a match of a value pattern that runs on into the next
- * word, as a header name does (`Cookie: name=value`). Redacting that word
- * would hide the value from the pattern, so the chain leaves it whole. Where
- * no word follows (`next` is undefined: an operator or the end), no pattern
- * can read on, so the word is not left. The test is read off
- * `VALUE_REDACTIONS` itself, so a pattern added later is covered without a
- * list of header names here.
- */
-function startsValueHeader(text, next) {
-    if (next === undefined)
-        return false;
-    return VALUE_PATTERNS.some((pattern) => [' name=value', ' value', ...(next ? [` ${next}`] : [])].some((following) => {
-        const match = pattern.exec(text + following);
-        return (match !== null &&
-            match.index < text.length &&
-            match.index + match[0].length > text.length);
-    }));
-}
-/** Whether the word after `word` is a credential flag's value. */
-function continuesCredentialChain(word) {
-    // Decoded too: quotes hide a flag glued after a substitution or the
-    // redaction marker that replaced one (`[redacted]"--passwd"`).
-    return (isBareCredentialFlag(word) ||
-        endsInCredentialFlag(word) ||
-        endsInCredentialFlag(decodeShellWord(word)));
-}
-/**
- * The words to redact after `value`, a word ending at `end` that a rule has
- * just taken as a credential's value. If `value` is itself a credential flag,
- * the redaction hides the flag the space-separated rule would read, so its
- * value, and the chain after it, are redacted here instead. This is the one
- * rule for every value edit: each rule that redacts a word as a value passes
- * the word here, whatever flag or tool took it. `seen` holds the ends a chain
- * has already left, so a run of flags stays linear.
- */
-function followCredentialChain(value, end, next, seen, text) {
-    const ranges = [];
-    for (let word = value; continuesCredentialChain(word);) {
-        if (seen.has(end))
-            break;
-        seen.add(end);
-        const following = next(end);
-        if (!following)
-            break;
-        if (isAttachedCredentialFlag(following.word))
-            break;
-        if (isChainedValue(following.word, wordAfter(text, following.end, next)))
-            ranges.push({ start: following.start, end: following.end, text: REDACTED });
-        word = following.word;
-        end = following.end;
-    }
-    return ranges;
-}
-/**
- * The word after position `end` for `startsValueHeader`: undefined where an
- * operator follows, so no pattern can read on, and empty at the end of the
- * text, which may be a nested word the enclosing command continues after.
- */
-function wordAfter(text, end, next) {
-    const following = next(end);
-    if (following)
-        return following.word;
-    return text.slice(end).trim() === '' ? '' : undefined;
-}
-/** Steps through `text` by shell word: a chain ends at an operator. */
-function textChainCursor(text) {
-    return (end) => {
-        NEXT_SHELL_WORD.lastIndex = end;
-        let next = NEXT_SHELL_WORD.exec(text);
-        // A line continuation left in a nested script is not a word.
-        while (next && LINE_CONTINUATION.test(next[2]))
-            next = NEXT_SHELL_WORD.exec(text);
-        if (!next)
-            return undefined;
-        return {
-            word: next[2],
-            start: NEXT_SHELL_WORD.lastIndex - next[2].length,
-            end: NEXT_SHELL_WORD.lastIndex,
-        };
-    };
-}
-/**
- * Replace each range of `text` with its text. Where ranges overlap, the
- * earlier one is written and the text under the later one is dropped, so an
- * overlap never puts back what either range removed.
- */
-function applyRanges(text, ranges) {
-    ranges.sort((a, b) => a.start - b.start);
-    let out = '';
-    let cursor = 0;
-    for (const range of ranges) {
-        if (range.end <= cursor)
-            continue;
-        if (range.start >= cursor)
-            out += text.slice(cursor, range.start) + range.text;
-        cursor = range.end;
-    }
-    return out + text.slice(cursor);
-}
-/**
- * `text.replace(pattern, replace)` for a pattern whose last group is a value
- * the replacement may redact. A redacted value keeps its credential chain,
- * which may run on into `after`, the text that follows `text`; the words it
- * redacts there are returned as ranges of `after`.
- */
-function replaceValues(text, pattern, replace, after = '') {
-    const next = textChainCursor(text + after);
-    const seen = new Set();
-    const ranges = [];
-    const beyond = [];
-    for (const match of text.matchAll(pattern)) {
-        const end = match.index + match[0].length;
-        const replaced = replace(match[0], ...match.slice(1).map((group) => group ?? ''));
-        if (replaced === match[0])
-            continue;
-        ranges.push({ start: match.index, end, text: replaced });
-        for (const range of followCredentialChain(match.at(-1) ?? '', end, next, seen, text + after)) {
-            if (range.start < text.length)
-                ranges.push(range);
-            else
-                beyond.push({
-                    start: range.start - text.length,
-                    end: range.end - text.length,
-                    text: range.text,
-                });
-        }
-    }
-    return { text: applyRanges(text, ranges), after: beyond };
-}
-function redactCredentialFlagValues(command) {
-    const next = textChainCursor(command);
-    const ranges = [];
-    // A chain runs the same from any word it reaches, so one that reaches a word
-    // another chain already left stops there, keeping a run of flags linear.
-    const chained = new Set();
-    for (const match of command.matchAll(CREDENTIAL_FLAG)) {
-        const end = match.index + match[1].length + match[2].length + match[3].length;
-        ranges.push({ start: end - match[3].length, end, text: REDACTED });
-        ranges.push(...followCredentialChain(match[3], end, next, chained, command));
-    }
-    // A quote or escape in a flag (`'--token'`, `\--token`) hides it from the
-    // pattern above, though the shell passes the tool the same flag. Read each
-    // word as the shell decodes it, so the flag takes its value wherever it
-    // stands, including where a command starts, which the per-tool walker
-    // reads as the program's name.
-    let wordEnd = 0;
-    for (const word of command.matchAll(SHELL_WORDS)) {
-        // A quote between words opens a string that never closes (a word would
-        // have taken a closed one), and the shell reads the rest as its text.
-        if (/['"]/.test(command.slice(wordEnd, word.index)))
-            break;
-        wordEnd = word.index + word[0].length;
-        if (word.index > 0 && !/[\s;&|(]/.test(command[word.index - 1]))
-            continue;
-        // A substitution a pass replaced with the redaction marker ends where its
-        // backtick did, so a flag glued after either starts a word.
-        const flag = word[0].replace(/^(?:\x60|\[redacted\])+/, '');
-        if (decodeShellWord(flag) === flag || !isBareCredentialFlag(flag))
-            continue;
-        const end = word.index + word[0].length;
-        const value = next(end);
-        // A value that spells a credential key or starts a header is left whole
-        // for the rules that read one, as the chain leaves it; so is one that
-        // opens a backtick substitution, which the substitution passes read.
-        if (!value ||
-            value.word.includes('\x60') ||
-            !isChainedValue(value.word, wordAfter(command, value.end, next)))
-            continue;
-        ranges.push({ start: value.start, end: value.end, text: REDACTED });
-        ranges.push(...followCredentialChain(value.word, value.end, next, chained, command));
-    }
-    return applyRanges(command, ranges);
-}
-function applyCommandRedactions(command) {
-    let out = command;
-    for (const redaction of COMMAND_REDACTIONS)
-        out = typeof redaction === 'function' ? redaction(out) : out.replace(...redaction);
-    return out;
-}
-/**
- * Redactions applied to command text, in order: heredoc bodies (bulk inline
- * file content), private-key blocks, URL userinfo credentials, Authorization
- * headers, sensitive key=value / key: value pairs (quoted values with spaces
- * included), then well-known bare token prefixes (OpenAI/Anthropic sk-,
- * GitHub ghp_/github_pat_, Slack xox*, AWS AKIA). Redaction is best-effort —
- * the length cap below is the backstop for anything these patterns miss.
- */
-const COMMAND_REDACTIONS = [
-    [new RegExp(`(<<<\\s*)${SHELL_WORD_SOURCE}`, 'g'), `$1${REDACTED}`],
-    // Heredoc: `cmd <<[-]['"]?WORD['"]? \n <body> \n WORD`. The body is inline
-    // file content (secrets, source) that must never leave the machine — replace
-    // it wholesale, keeping only the delimiters. Runs first so a heredoc'd
-    // private key / token is gone before the narrower patterns below even scan.
-    // Terminates on the closing delimiter line or end-of-input (unterminated
-    // capture). Over-matching a rare `a << B` bit-shift only over-redacts, which
-    // is the safe failure mode here.
-    [
-        /(<<-?\s*['"]?)([A-Za-z_]\w*)(['"]?)[\s\S]*?(\n[ \t]*\2\b|$)/g,
-        `$1$2$3 ${REDACTED}$4`,
-    ],
-    [new RegExp(PRIVATE_KEY_BLOCK_SOURCE, 'g'), REDACTED],
-    ...VALUE_REDACTIONS,
-    redactCredentialFlagValues,
-    // JSON bodies embedded in shell commands are still command text. Quoted
-    // keys evade the shell-assignment scanner below, including escaped values.
-    [
-        new RegExp(`("${COMMAND_SENSITIVE_KEY_SOURCE}"\\s*:\\s*)"(?:\\\\.|[^"\\\\])*"`, 'gi'),
-        `$1"${REDACTED}"`,
-    ],
-    // Sensitive assignment: an env-var-ish key (the sensitive word optionally
-    // wrapped in `DB_…` / `…_FILE` segments, so `DB_PASSWORD`/`OPENAI_API_KEY`
-    // match, not just a bare word) followed by `=`/`:` and a value that is a
-    // double/single-quoted string (spaces and all) or an unquoted run up to the
-    // next whitespace. Anchored at a shell-token boundary ($1, preserved) so it
-    // never fires mid-word (a backtick opens a substitution's first word, as
-    // `(` does); the whole value — quotes included — is redacted so
-    // whitespace-containing passphrases can't slip through.
-    [
-        new RegExp(`(^|[\\s;&|(\\x60])(${COMMAND_SENSITIVE_KEY_SOURCE}\\s*[=:]\\s*)${SHELL_WORD_SOURCE}`, 'gi'),
-        `$1$2${REDACTED}`,
-    ],
-    // Our own CLI token (`API_KEY_PREFIX`, the prefix the dashboard mints CLI
-    // tokens under). Listed with the third-party prefixes because the documented
-    // setup path — `mossbear sync --token mossbear_…` — is a *space-separated*
-    // flag, so the `key=value` rule above never sees it: without this, the hook
-    // logs that command and the next sync uploads a live dashboard credential in
-    // an action summary. The product's own secret shape is the one most likely to
-    // appear in a command a user runs. Any future re-mint under a new prefix has
-    // to be added here in the same change — a token this rule does not match is
-    // one the action log keeps in plaintext.
-    [/\bmossbear_[A-Za-z0-9_-]{8,}/g, REDACTED],
-    // The pre-rename prefix. Every key issued under it is deleted by migration
-    // `0056-revoke_legacy_prefix_cli_tokens.ts`, so this matches nothing that can
-    // still authenticate — it is kept because a CLI redacting on the user's
-    // machine can be older or newer than the dashboard it syncs to, and the
-    // window where one of these is still live is exactly the window where
-    // dropping the rule would upload it in plaintext.
-    [/\bauden_[A-Za-z0-9_-]{8,}/g, REDACTED],
-    [/\bsk-[A-Za-z0-9_-]{8,}/g, REDACTED],
-    [/\bgh[pousr]_[A-Za-z0-9]{8,}/g, REDACTED],
-    [/\bgithub_pat_[A-Za-z0-9_]{8,}/g, REDACTED],
-    [/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, REDACTED],
-    [/\bAKIA[0-9A-Z]{16}\b/g, REDACTED],
-];
-/**
- * Proxy addresses take userinfo with or without a URL scheme, so the general
- * URL rule cannot see the scheme-less form. A bare `a:b@c` is not matched
- * everywhere because ordinary text has that shape too (`image:tag@sha256:…`);
- * only values in HTTP-client commands or proxy assignments are checked.
- */
-const PROXY_USERINFO = /^((?:[a-z][a-z\d+.-]*:\/\/)?[^/?#:@]*:)[^/?#]*@/i;
-/**
- * Redact the password from proxy environment assignments (`https_proxy=`,
- * `ALL_PROXY=`, …), which HTTP clients read at startup. Keeps the user and
- * host, matching the URL-userinfo rule, and leaves unauthenticated values as
- * they are. Other inline curl authentication fields lose their whole value.
- */
-function redactCredentialAssignments(command, inputs) {
-    let assignments = command.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
-        // `env` accepts a quoted whole NAME=value argument. Decode the complete
-        // word before identifying its key, just as for shell-encoded options.
-        const assignment = /^([^=\0]+)=([\s\S]*)$/.exec(decodeShellWord(word));
-        if (!assignment)
-            return word;
-        let key = assignment[1];
-        let operator = '=';
-        const proxy = assignment[2];
-        if (key.endsWith('+') && !inputs.env.has(key)) {
-            key = key.slice(0, -1);
-            operator = '+=';
-        }
-        if (inputs.env.has(key))
-            return `${key}${operator}${REDACTED}`;
-        if (!/^(?:\w+_)?proxy$/i.test(key))
-            return word;
-        if (!PROXY_USERINFO.test(proxy))
-            return word;
-        const redacted = proxy.replace(PROXY_USERINFO, `$1${REDACTED}@`);
-        return `${key}${operator}${redacted}`;
-    });
-    if (inputs.passSources.size || inputs.env.size)
-        assignments = assignments.replace(new RegExp(`(<<<[ \\t]*)${SHELL_WORD_SOURCE}`, 'g'), `$1${REDACTED}`);
-    // Config literals are produced by echo/printf before curl consumes -K.
-    // Keep that channel separate from executable flags: sort -u and OpenSSL
-    // passphrase source options must not become curl configuration by spelling.
-    const words = [
-        ...assignments.matchAll(new RegExp(`${SHELL_WORD_SOURCE}|[;&|()\\n]`, 'g')),
-    ];
-    if (!inputs.curlConfig && !inputs.passSources.size && !inputs.env.size)
-        return assignments;
-    const fields = new RegExp(`(^|[\\s'\"])(-{0,2}(?:(?:\\w+_)?proxy|${CURL_AUTH_OPTIONS})|-[uUbEx])([ \\t]*(?:=|:)[ \\t]*|[ \\t]+)(${SHELL_WORD_SOURCE})`, 'gi');
-    const edits = [];
-    let producerStart = null;
-    let producerPrintf = false;
-    const finishProducer = (end) => {
-        if (producerStart === null)
-            return;
-        const body = assignments.slice(producerStart, end);
-        const prefix = assignments.slice(0, producerStart);
-        const producesPassphrase = (assignments[end] === '|' &&
-            (inputs.passSources.has('stdin') ||
-                [...inputs.passSources].some((source) => source.startsWith('fd:')))) ||
-            ([...inputs.passSources].some((source) => /^(?:fd:|file:)/.test(source)) &&
-                prefix.includes('<(')) ||
-            [...inputs.passSources].some((source) => source.startsWith('file:') &&
-                body.includes('>') &&
-                body.includes(source.slice(5))) ||
-            [...inputs.env].some((key) => prefix.includes(`${key}=`) && prefix.includes('('));
-        if (producesPassphrase) {
-            edits.push({ start: producerStart, end, text: ` ${REDACTED} ` });
-            producerStart = null;
-            return;
-        }
-        if (!inputs.curlConfig) {
-            producerStart = null;
-            return;
-        }
-        const decodedBody = [...body.matchAll(new RegExp(SHELL_WORD_SOURCE, 'g'))]
-            .map((word) => decodeShellWord(word[0]))
-            .join(' ');
-        if (hasPrivateConfigVariables(decodedBody)) {
-            edits.push({ start: producerStart, end, text: ` ${REDACTED} ` });
-            producerStart = null;
-            return;
-        }
-        const redactField = (match, prefix, key, separator, value) => {
-            if (/^-[a-z]$/i.test(key) && !['-u', '-U', '-b', '-E', '-x'].includes(key))
-                return match;
-            const credential = decodeShellWord(value);
-            const field = key.replace(/^-+/, '');
-            if (producerPrintf && credential.includes('%'))
-                return `${prefix}${key}${separator}${REDACTED}`;
-            if (/^(?:proxy-)?(?:user|cert)$/i.test(field)) {
-                if (!credential.includes(':'))
-                    return match;
-                return `${prefix}${key}${separator}${credential.replace(/^([^:]*:)[\s\S]*$/, `$1${REDACTED}`)}`;
-            }
-            if (/^cookie$/i.test(field) && !credential.includes('='))
-                return match;
-            if (/^(?:(?:\w+_)?proxy|x)$/i.test(field) || CURL_URL_FIELD.test(field))
-                return PROXY_USERINFO.test(credential)
-                    ? `${prefix}${key}${separator}${credential.replace(PROXY_USERINFO, `$1${REDACTED}@`)}`
-                    : match;
-            return `${prefix}${key}${separator}${REDACTED}`;
-        };
-        // A producer's literals obey shell quoting before becoming config text.
-        // Decode concatenated/escaped field names before matching them, while
-        // retaining untouched words and also scanning unquoted multiword fields.
-        let text = body.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
-            const decoded = decodeShellWord(word);
-            const redacted = replaceValues(decoded, fields, redactField).text;
-            return redacted === decoded ? word : JSON.stringify(redacted);
-        });
-        // The body ends at the producer's operator, but a field's credential
-        // chain reaches on across a newline, as `redactCredentialFlagValues`
-        // does, so the chain's words after the body are edited too.
-        const fieldEdits = replaceValues(text, fields, redactField, assignments.slice(end));
-        text = fieldEdits.text;
-        for (const range of fieldEdits.after)
-            edits.push({ start: end + range.start, end: end + range.end, text: range.text });
-        // A printf template may take the credential from later arguments. Once
-        // its format is private, drop the argument list rather than expose the
-        // values substituted into it or attempt to interpret printf formatting.
-        if (text !== body && producerPrintf && body.includes('%'))
-            text = ` ${REDACTED} `;
-        if (text !== body)
-            edits.push({ start: producerStart, end, text });
-        producerStart = null;
-    };
-    // Decided at each command's first word, so a file argument named echo under
-    // a program that never runs its arguments is not mistaken for a producer.
-    // Wrappers are not looked past here, which only errs toward redaction.
-    let commandSeen = false;
-    let argumentsInert = false;
-    for (const word of words) {
-        if (/^[;&|()\n]$/.test(word[0])) {
-            finishProducer(word.index);
-            commandSeen = false;
-            argumentsInert = false;
-            continue;
-        }
-        const decoded = decodeShellWord(word[0]);
-        if (!commandSeen && !/^\w+\+?=/.test(decoded)) {
-            commandSeen = true;
-            argumentsInert = isNonDispatching(assignments, word.index, decoded);
-        }
-        const tool = invokedTool(decoded);
-        // A backtick substitution runs its own command, whatever the outer one is.
-        const inert = argumentsInert && !word[0].includes('`');
-        if (producerStart === null && !inert && ['echo', 'printf'].includes(tool)) {
-            producerStart = word.index + word[0].length;
-            producerPrintf = tool === 'printf';
-        }
-    }
-    finishProducer(assignments.length);
-    return applyRanges(assignments, edits);
-}
-/** Redact known tool credential flags without matching unrelated short flags. */
-function redactToolArguments(command, inputs) {
-    const words = [...command.matchAll(new RegExp(`${SHELL_WORD_SOURCE}|[;&|()\n]`, 'g'))];
-    const edits = [];
-    let client = null;
-    let options = true;
-    let opensslPasswd = false;
-    let opensslSubcommandRead = false;
-    // Set once a wrapper in the current command receives an option it does not
-    // model, which may have taken the next word as its value.
-    let wrapperOptionUnknown = false;
-    // The current command is a program that never runs its arguments.
-    let argumentsInert = false;
-    const variables = new Map();
-    const expansions = [];
-    const resolveVariable = (contents, depth = 0) => {
-        if (depth > 20)
-            return 'private:@';
-        return contents.replace(CURL_EXPANSION, (_, name) => resolveVariable(variables.get(name)?.at(-1)?.contents ?? '', depth + 1));
-    };
-    const finishCurl = () => {
-        const privateNames = new Set(inputs?.curlVariables);
-        for (const expansion of expansions) {
-            if (CURL_URL_FIELD.test(expansion.field) &&
-                !PROXY_USERINFO.test(expansion.resolved) &&
-                !new RegExp(`[?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=`, 'i').test(expansion.resolved))
-                continue;
-            for (const match of expansion.contents.matchAll(CURL_EXPANSION))
-                privateNames.add(match[1]);
-        }
-        // Expanded variable definitions can themselves refer to other definitions.
-        // Walk each name once, including all assignments, without evaluating shell code.
-        for (const name of privateNames) {
-            for (const variable of variables.get(name) ?? []) {
-                if (variable.env)
-                    inputs?.env.add(name);
-                if (variable.contents === undefined)
-                    continue;
-                for (const match of variable.contents.matchAll(CURL_EXPANSION))
-                    privateNames.add(match[1]);
-                edits.push({
-                    start: variable.start,
-                    end: variable.end,
-                    text: `${variable.prefix}${REDACTED}`,
-                });
-            }
-        }
-        for (const name of privateNames)
-            inputs?.curlVariables.add(name);
-        variables.clear();
-        expansions.length = 0;
-    };
-    for (let index = 0; index < words.length; index += 1) {
-        const word = words[index];
-        if (!word)
-            continue;
-        const raw = word[0];
-        if (/^[;&|()\n]$/.test(raw)) {
-            finishCurl();
-            client = null;
-            opensslPasswd = false;
-            opensslSubcommandRead = false;
-            wrapperOptionUnknown = false;
-            argumentsInert = false;
-            options = true;
-            continue;
-        }
-        const decoded = decodeShellWord(raw);
-        if (opensslPasswd) {
-            // passwd hashes each positional plaintext password. Its source and salt
-            // flags consume nonsecret references, which must not be mistaken for it.
-            const sourceFlag = /^-{1,2}(?:in|salt|rand|writerand|provider|provider-path|provparam|propquery)(?:=(.*))?$/.exec(decoded);
-            if (options && sourceFlag) {
-                if (inputs && /^-{1,2}in(?:=|$)/.test(decoded)) {
-                    const source = sourceFlag[1] ?? words[index + 1]?.[0];
-                    if (source)
-                        inputs.passSources.add(`file:${decodeShellWord(source)}`);
-                }
-                if (sourceFlag[1] === undefined)
-                    index += 1;
-                continue;
-            }
-            if (options && /^-{1,2}stdin$/.test(decoded))
-                inputs?.passSources.add('stdin');
-            if (!options || !decoded.startsWith('-')) {
-                edits.push({ start: word.index, end: word.index + raw.length, text: REDACTED });
-                continue;
-            }
-        }
-        if (client === 'sshpass') {
-            // sshpass dispatches a child after its own credential/source options.
-            // Consume source arguments so a filename named curl is not executable.
-            const source = /^-[fdP](.*)$/.exec(decoded);
-            if (options && source) {
-                if (!source[1])
-                    index += 1;
-                continue;
-            }
-            if (options && /^-[evhV]+$/.test(decoded))
-                continue;
-            if (!options || !decoded.startsWith('-'))
-                client = null;
-        }
-        if (!CREDENTIAL_TOOLS.includes(client ?? '')) {
-            if (/^\w+\+?=/.test(decoded))
-                continue;
-            const wrapperValue = options
-                ? WRAPPER_VALUE_FLAGS[client ?? '']?.exec(decoded)
-                : null;
-            if (wrapperValue) {
-                if (wrapperValue[1] === undefined && wrapperValue[2] === undefined)
-                    index += 1;
-                continue;
-            }
-        }
-        const executable = invokedTool(decoded);
-        // A backtick substitution runs its own command, whatever the outer one is.
-        const inert = argumentsInert && !raw.includes('`');
-        if (!inert &&
-            WRAPPER_VALUE_FLAGS[executable] &&
-            !CREDENTIAL_TOOLS.includes(client ?? '')) {
-            client = executable;
-            options = true;
-            continue;
-        }
-        // Dispatching tools may take their own options and positional arguments.
-        // Once a credential-consuming tool appears, its subsequent flags still carry
-        // credentials; a wrapper's -u or timeout must not hide that client.
-        if (!inert &&
-            CREDENTIAL_TOOLS.includes(executable) &&
-            !CREDENTIAL_TOOLS.includes(client ?? '')) {
-            client = executable;
-            opensslPasswd = false;
-            opensslSubcommandRead = false;
-            options = true;
-            continue;
-        }
-        // A wrapper's first operand (its modelled valued options were consumed
-        // above) is the program it runs, which decides whether later words can be
-        // invocations. After an option the table does not model, that operand may
-        // be the option's value instead, so the wrapper keeps dispatching.
-        if (client !== null && WRAPPER_VALUE_FLAGS[client]) {
-            if (options && decoded.startsWith('-')) {
-                if (decoded !== '--' &&
-                    !decoded.includes('=') &&
-                    !WRAPPER_SWITCHES[client]?.test(decoded))
-                    wrapperOptionUnknown = true;
-            }
-            else if (!wrapperOptionUnknown) {
-                client = executable;
-                argumentsInert = isNonDispatching(command, word.index, decoded);
-                options = true;
-                continue;
-            }
-        }
-        if (client === null) {
-            if (/^[\w]+=.*/.test(decoded) ||
-                ['env', 'sudo', 'command', 'exec', 'nohup'].includes(decoded))
-                continue;
-            client = invokedTool(decoded);
-            argumentsInert = isNonDispatching(command, word.index, decoded);
-            continue;
-        }
-        if (client === 'openssl' && !opensslSubcommandRead && !decoded.startsWith('-')) {
-            opensslSubcommandRead = true;
-            opensslPasswd = decoded === 'passwd';
-            continue;
-        }
-        if (decoded === '--') {
-            options = false;
-            continue;
-        }
-        if (client === 'curl' && options) {
-            // Public source/output arguments cannot become config flags by spelling.
-            const publicSource = /^(-[oAw])(.+)?$|^(--(?:output|output-dir|write-out|user-agent|cacert|capath))(?:=(.*))?$/.exec(decoded);
-            if (publicSource) {
-                if (publicSource[2] === undefined && publicSource[4] === undefined)
-                    index += 1;
-                continue;
-            }
-            if (CURL_CONFIG_FLAG.test(decoded) && inputs)
-                inputs.curlConfig = true;
-            const variableFlag = /^--(?:expand-)?variable(?:=(.*))?$/.exec(decoded);
-            const expandFlag = CURL_EXPAND_FLAG.exec(decoded);
-            if (variableFlag || expandFlag) {
-                const attached = variableFlag ? variableFlag[1] : expandFlag[2];
-                const value = attached === undefined ? words[index + 1] : word;
-                if (!value || /^[;&|()\n]$/.test(value[0]))
-                    continue;
-                const contents = attached ?? decodeShellWord(value[0]);
-                if (variableFlag) {
-                    const definition = /^(%?)([A-Za-z0-9_]+)(?:\[[^\]]*\])?(?:=([\s\S]*)|@[^\s]*|$)/.exec(contents);
-                    if (definition) {
-                        const name = definition[2];
-                        const entries = variables.get(name) ?? [];
-                        entries.push({
-                            start: value.index,
-                            end: value.index + value[0].length,
-                            prefix: (attached === undefined ? '' : `${decoded.split('=')[0]}=`) +
-                                contents.slice(0, contents.indexOf('=') + 1),
-                            contents: definition[3],
-                            env: definition[1] === '%',
-                        });
-                        variables.set(name, entries);
-                    }
-                }
-                else
-                    expansions.push({
-                        field: expandFlag[1],
-                        contents,
-                        resolved: resolveVariable(contents),
-                    });
-                if (attached === undefined)
-                    index += 1;
-                continue;
-            }
-        }
-        if (client === 'openssl' && options && /^-{1,2}kfile(?:=|$)/.test(decoded)) {
-            const attached = decoded.includes('=')
-                ? decoded.slice(decoded.indexOf('=') + 1)
-                : undefined;
-            const source = attached ?? words[index + 1]?.[0];
-            if (source)
-                inputs?.passSources.add(`file:${decodeShellWord(source)}`);
-            if (attached === undefined)
-                index += 1;
-            continue;
-        }
-        // Curl also accepts URLs without a scheme and uses their userinfo as
-        // credentials. Restrict this shape to HTTP-client arguments so image
-        // digests and SSH paths in other commands retain their meaning. The Redis
-        // family reads a URI only with an explicit scheme; its other positional
-        // words are Redis command arguments, which must keep their meaning.
-        if (['curl', 'http', 'https', 'httpie', ...REDIS_FAMILY].includes(client) &&
-            (!REDIS_FAMILY.includes(client) || REDIS_URI.test(decoded)) &&
-            (!options || !decoded.startsWith('-')) &&
-            PROXY_USERINFO.test(decoded)) {
-            edits.push({
-                start: word.index,
-                end: word.index + raw.length,
-                text: decoded.replace(PROXY_USERINFO, `$1${REDACTED}@`),
-            });
-            continue;
-        }
-        if (!options)
-            continue;
-        // Decode option spellings before classifying them: shell quotes and
-        // escapes change syntax, never the credential the invoked tool receives.
-        const sensitiveFlag = /^--([^=]+)(?:=(.*))?$/.exec(decoded);
-        if (sensitiveFlag && SENSITIVE_KEY.test(sensitiveFlag[1])) {
-            const attached = sensitiveFlag[2];
-            const value = attached === undefined ? words[index + 1] : word;
-            if (value && !/^[;&|()\n]$/.test(value[0])) {
-                edits.push({
-                    start: value.index,
-                    end: value.index + value[0].length,
-                    text: attached === undefined ? REDACTED : `--${sensitiveFlag[1]}=${REDACTED}`,
-                });
-                if (attached === undefined)
-                    index += 1;
-            }
-            continue;
-        }
-        // Password flags are per tool: the spelling is what names the credential,
-        // so each tool's table entry is the only place its flags are defined.
-        const directPasswordFlag = DIRECT_PASSWORD_FLAGS.get(client ?? '')?.exec(decoded);
-        if (directPasswordFlag) {
-            const name = directPasswordFlag[1];
-            const mysqlFamily = MYSQL_FAMILY.includes(client ?? '');
-            const attached = client === 'sshpass' || mysqlFamily
-                ? directPasswordFlag[2] || undefined
-                : directPasswordFlag[2];
-            // MySQL reads a bare -p as a prompt, so the next word is the database, not
-            // a password. Only the attached -p<pw> spelling carries one.
-            if (mysqlFamily && attached === undefined)
-                continue;
-            const value = attached === undefined ? words[index + 1] : word;
-            if (!value || /^[;&|()\n]$/.test(value[0]))
-                continue;
-            const password = attached ?? decodeShellWord(value[0]);
-            if (client === 'openssl' && inputs) {
-                if (/^env:[^=\0]+$/.test(password))
-                    inputs.env.add(password.slice(4));
-                else if (/^(?:stdin|(?:file|fd):)/.test(password))
-                    inputs.passSources.add(password);
-            }
-            if (client !== 'openssl' ||
-                /^(?:k|srppass|pwri_password|secretkey|hmac)$/i.test(name.replace(/^-+/, '')) ||
-                password.startsWith('pass:')) {
-                edits.push({
-                    start: value.index,
-                    end: value.index + value[0].length,
-                    text: attached === undefined
-                        ? REDACTED
-                        : `${name}${client === 'openssl' || name.startsWith('--') ? '=' : ''}${REDACTED}`,
-                });
-            }
-            if (attached === undefined)
-                index += 1;
-            continue;
-        }
-        if (!['curl', 'http', 'https', 'httpie'].includes(client))
-            continue;
-        const payloadFlag = client === 'curl' ? CURL_PAYLOAD_FLAG.exec(decoded) : null;
-        if (payloadFlag) {
-            const name = payloadFlag[1] ?? payloadFlag[3];
-            const attached = payloadFlag[2] ?? payloadFlag[4];
-            const value = attached === undefined ? words[index + 1] : word;
-            if (!value || /^[;&|()\n]$/.test(value[0]))
-                continue;
-            const payload = attached ?? decodeShellWord(value[0]);
-            const header = /^([^:]+):/.exec(payload);
-            const isHeader = ['--header', '--proxy-header'].includes(name) ||
-                (!name.startsWith('--') && name.endsWith('H'));
-            // JSON is handled structurally above. Form fields must also inspect
-            // percent-decoded names: passwords do not become public by encoding.
-            const formHasCredential = [...new URLSearchParams(payload).keys()].some((key) => SENSITIVE_KEY.test(key));
-            if (isHeader ? header && SENSITIVE_KEY.test(header[1].trim()) : formHasCredential) {
-                edits.push({
-                    start: value.index,
-                    end: value.index + value[0].length,
-                    text: attached === undefined
-                        ? REDACTED
-                        : `${name}${name.startsWith('--') ? '=' : ''}${REDACTED}`,
-                });
-            }
-            if (attached === undefined)
-                index += 1;
-            continue;
-        }
-        const flag = client === 'curl'
-            ? CURL_AUTH_FLAG.exec(decoded)
-            : /^(-a)(.+)?$|^(--auth)(?:=(.*))?$/.exec(decoded);
-        if (!flag)
-            continue;
-        const name = flag[1] ?? flag[3];
-        const attached = flag[2] ?? flag[4];
-        const value = attached === undefined ? words[index + 1] : word;
-        if (!value || /^[;&|()\n]$/.test(value[0]))
-            continue;
-        let replacement = REDACTED;
-        if (CURL_URL_FIELD.test(name.replace(/^-+/, '')) ||
-            (!name.startsWith('--') && name.endsWith('x'))) {
-            const proxy = attached ?? decodeShellWord(value[0]);
-            if (!PROXY_USERINFO.test(proxy)) {
-                if (attached === undefined)
-                    index += 1;
-                continue;
-            }
-            replacement = proxy.replace(PROXY_USERINFO, `$1${REDACTED}@`);
-        }
-        if (attached !== undefined) {
-            edits.push({
-                start: word.index,
-                end: word.index + raw.length,
-                text: `${name}${name?.startsWith('--') ? '=' : ''}${replacement}`,
-            });
-        }
-        else {
-            edits.push({
-                start: value.index,
-                end: value.index + value[0].length,
-                text: replacement,
-            });
-            index += 1;
-        }
-    }
-    finishCurl();
-    // Every edit above replaces a whole word, and a word an edit replaces is
-    // gone before `redactCredentialFlagValues` reads the text. Where that word
-    // was a credential flag, the flag's value would escape, so the chain is
-    // followed here for every edit, whichever tool or flag made it.
-    const wordAt = new Map(words.map((word, at) => [word.index, at]));
-    const wordEndingAt = new Map(words.map((word, at) => [word.index + word[0].length, at]));
-    const nextWord = (end) => {
-        let next = wordEndingAt.get(end);
-        if (next === undefined)
-            return undefined;
-        next += 1;
-        while (words[next] && /^(?:\n|\\\r?\n)$/.test(words[next][0]))
-            next += 1;
-        const following = words[next];
-        if (!following || /^[;&|()\n]$/.test(following[0]))
-            return undefined;
-        return {
-            word: following[0],
-            start: following.index,
-            end: following.index + following[0].length,
-        };
-    };
-    const chainedWords = new Set();
-    const chainEdits = edits.flatMap((edit) => {
-        const at = wordAt.get(edit.start);
-        const word = at === undefined ? undefined : words[at];
-        if (!word || edit.end !== word.index + word[0].length)
-            return [];
-        return followCredentialChain(word[0], edit.end, nextWord, chainedWords, command);
-    });
-    // A chain edit either matches an edit's word or misses it; on a match the
-    // whole-word redaction replaces it, so the chain only ever adds.
-    const editAt = new Map(edits.map((edit, at) => [edit.start, at]));
-    for (const chainEdit of chainEdits) {
-        const same = editAt.get(chainEdit.start);
-        if (same === undefined)
-            edits.push(chainEdit);
-        else
-            edits[same] = chainEdit;
-    }
-    edits.sort((a, b) => a.start - b.start);
-    for (const edit of edits.reverse())
-        command = command.slice(0, edit.start) + edit.text + command.slice(edit.end);
-    return command;
-}
-/** Find config consumers across shell wrappers before scanning their producers. */
-function getToolInputs(command, depth = 0) {
-    const inputs = {
-        curlConfig: depth > 8,
-        env: new Set(),
-        passSources: new Set(),
-        curlVariables: new Set(),
-    };
-    if (depth > 8)
-        return inputs;
-    // Use the same invocation parser as redaction; an SSH -K is not curl config.
-    redactToolArguments(command, inputs);
-    const words = [...command.matchAll(new RegExp(SHELL_WORD_SOURCE, 'g'))];
-    for (const word of words) {
-        const decoded = decodeShellWord(word[0]);
-        if (decoded === word[0] || !/[\s;&|()]/.test(decoded))
-            continue;
-        const nested = getToolInputs(decoded, depth + 1);
-        inputs.curlConfig ||= nested.curlConfig;
-        for (const key of nested.env)
-            inputs.env.add(key);
-        for (const source of nested.passSources)
-            inputs.passSources.add(source);
-        for (const name of nested.curlVariables)
-            inputs.curlVariables.add(name);
-    }
-    if (inputs.curlConfig) {
-        for (const word of words) {
-            const body = decodeShellWord(word[0]);
-            if (!hasPrivateConfigVariables(body))
-                continue;
-            for (const match of body.matchAll(/\b(?:expand-)?variable\s*[=: \t]+["']?%+([A-Za-z0-9_]+)/g))
-                inputs.env.add(match[1]);
-        }
-    }
-    return inputs;
-}
-/** Apply the same boundary to scripts carried inside quoted shell words. */
-/** The part of `before` that `after` replaced: what a redaction removed. */
-function changedPart(before, after) {
-    let start = 0;
-    while (start < before.length && before[start] === after[start])
-        start += 1;
-    let end = 0;
-    while (end < before.length - start &&
-        before[before.length - 1 - end] === after[after.length - 1 - end])
-        end += 1;
-    return before.slice(start, before.length - end);
-}
-function redactShellSyntax(command, depth = 0, inheritedInputs, valuesFirst = true) {
-    // Nested shell/eval wrappers cannot create unbounded recursive scanning.
-    if (depth > 8)
-        return REDACTED;
-    // Redacting a backtick body can erase the reference (`{{VALUE}}`) that
-    // marks an outer assignment private, so read its inputs from the command
-    // as written too.
-    const writtenInputs = command.includes('`')
-        ? withInheritedInputs(backtickAwareInputs(command), inheritedInputs)
-        : inheritedInputs;
-    // Rewriting part of a backtick body can separate a header from its value, so
-    // the value patterns redact such a match before any body is rewritten. Only
-    // such a match: one whose value the later passes remove anyway is left to
-    // them, since the word-based rules see the rest of its word (`"Cookie: a"b`).
-    // Redacting one match early changes what the later passes see, so a value
-    // still in their output is redacted early too and the passes run again.
-    if (valuesFirst && command.includes('`') && !command.includes('\uE000')) {
-        const values = valueRedactionTargets(command);
-        if (values.length > 0) {
-            const withoutValuesFirst = redactShellSyntax(command, depth, inheritedInputs, false);
-            const early = new Set(values.filter((value) => withoutValuesFirst.includes(value)));
-            for (let round = 0;; round += 1) {
-                const out = redactAfterValues(redactValuesFirst(command, round < 3 ? early : new Set(values)), depth, writtenInputs);
-                const stranded = values.filter((value) => !early.has(value) && out.includes(value));
-                if (stranded.length === 0 || round === 3)
-                    return out;
-                for (const value of stranded)
-                    early.add(value);
-            }
-        }
-    }
-    return redactAfterValues(command, depth, writtenInputs, valuesFirst);
-}
-/** The values the `VALUE_REDACTIONS` would remove from text with no backtick in the match. */
-function valueRedactionTargets(command) {
-    const values = [];
-    for (const [pattern, replacement] of VALUE_REDACTIONS) {
-        const single = new RegExp(pattern.source, pattern.flags.replace('g', ''));
-        for (const match of command.match(pattern) ?? []) {
-            if (/[`\uE000\uE001]/.test(match))
-                continue;
-            const value = changedPart(match, match.replace(single, replacement));
-            if (value !== '' && !values.includes(value))
-                values.push(value);
-        }
-    }
-    return values;
-}
-/**
- * Apply the value patterns whose value is in `early`, holding every other
- * match aside so no later pattern can match part of it. A match that spans a
- * backtick is always held: the substitution pass owns that boundary, and an
- * unterminated one must still fail closed. A reference this erases is still
- * in the caller's `writtenInputs`.
- */
-function redactValuesFirst(command, early) {
-    const held = [];
-    let whole = command;
-    for (const [pattern, replacement] of VALUE_REDACTIONS) {
-        const single = new RegExp(pattern.source, pattern.flags.replace('g', ''));
-        whole = whole.replace(pattern, (match) => {
-            const redacted = match.replace(single, replacement);
-            if (!/[`\uE000\uE001]/.test(match) && early.has(changedPart(match, redacted)))
-                return redacted;
-            held.push(match);
-            return `\uE000${held.length - 1}\uE001`;
-        });
-    }
-    // A held match can contain an earlier one; each refers only to earlier ones.
-    while (whole.includes('\uE000'))
-        whole = whole.replace(/\uE000(\d+)\uE001/g, (_, index) => held[Number(index)]);
-    return whole;
-}
-function redactAfterValues(command, depth, writtenInputs, valuesFirst = true) {
-    command = redactCommandSubstitutions(command, depth, writtenInputs, valuesFirst);
-    // Nested scripts may be dispatched by any tool. Scan decoded compound
-    // words instead of maintaining another list of interpreter/wrapper flags.
-    // JSON and sensitive assignments already have structural/whole-word passes;
-    // treating their values as commands would lose evidence or word boundaries.
-    const inputs = withInheritedInputs(backtickAwareInputs(command), writtenInputs);
-    const sensitiveAssignment = new RegExp(`^(${COMMAND_SENSITIVE_KEY_SOURCE})(\\+?=)`, 'i');
-    // Resolve credential references before nested word redaction can erase the
-    // expansion marker while leaving its original variable definition behind.
-    let out = redactToolArguments(redactJsonArguments(command), inputs).replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
-        const decoded = decodeShellWord(word);
-        // A compound word beginning with a credential assignment may be either
-        // an env value or a whole script. Its entire value is private in both
-        // cases; dropping it avoids guessing which later spans belong to it.
-        const assignment = sensitiveAssignment.exec(decoded);
-        if (assignment)
-            return `${assignment[1]}${assignment[2]}${REDACTED}`;
-        if (decoded === word || !/[\s;&|()]/.test(decoded))
-            return word;
-        if (/^\s*[[{]/.test(decoded)) {
-            try {
-                JSON.parse(decoded);
-                return word;
-            }
-            catch {
-                // A shell group begins with '{' too; only valid JSON belongs to the
-                // structural JSON pass instead of the nested-command pass.
-            }
-        }
-        const redacted = redactShellSyntax(decoded, depth + 1, inputs, valuesFirst);
-        return redacted === decoded ? word : JSON.stringify(redacted);
-    });
-    return applyCommandRedactions(redactCredentialAssignments(out, inputs));
-}
-/**
- * Redact common secret shapes from a shell command and cap its length so
- * command text never carries credentials or bulk file content off-box.
- *
- * Pure function — no I/O.
- */
+const COMMAND_WITHHELD = '[command withheld]';
 export function sanitizeCommand(command) {
-    // Shell continuations disappear before tokenization; otherwise a flag's
-    // value can be mistaken for the continuation itself and escape redaction.
-    let out = redactShellSyntax(command.replace(/\\\r?\n/g, ''));
-    if (out.length > MAX_COMMAND_CHARS) {
-        out = `${out.slice(0, MAX_COMMAND_CHARS)} [... truncated, ${out.length - MAX_COMMAND_CHARS} characters omitted]`;
-    }
-    return out;
+    // Inspect a bounded prefix only. Never decode quotes, substitutions, escaped
+    // words, paths or assignments, and never copy any unrecognized input back.
+    const first = /^[ \t\r\n]*([a-z][a-z0-9.+-]{0,31})(?=[ \t\r\n;|&<>]|$)/.exec(command.slice(0, 128))?.[1];
+    return first && EXECUTABLES.has(first) ? first : COMMAND_WITHHELD;
 }
 //# sourceMappingURL=sanitize-command.js.map