@mossbear/eval-core 0.1.0-alpha.106 → 0.1.0-alpha.108

package/dist/sanitize-command.test.js

@@ -1,1313 +1,48 @@
-import { describe, it, expect } from 'vitest';
+import { describe, expect, it } from 'vitest';
 import { sanitizeCommand } from './sanitize-command.js';
-describe('sanitizeCommand', () => {
-    it('redacts ordinary credential values passed as separate flag arguments', () => {
-        for (const flag of ['--password', '--token', '--api-key', '--client-secret']) {
-            for (const value of [
-                'fixture-credential',
-                '"fixture credential"',
-                "'fixture credential'",
-            ]) {
-                const redacted = sanitizeCommand(`tool ${flag} ${value} --verbose`);
-                expect(redacted).not.toContain('fixture');
-                expect(redacted).toContain(`${flag} [redacted] --verbose`);
-            }
-        }
-        expect(sanitizeCommand('tool --output result.json')).toBe('tool --output result.json');
-    });
-    it('redacts Basic authorization payloads rather than just the scheme', () => {
-        const payload = Buffer.from('fixture-user:fixture-password').toString('base64');
-        expect(sanitizeCommand(`curl -H "Authorization: Basic ${payload}"`)).not.toContain(payload);
-        expect(sanitizeCommand(`curl -H 'Authorization: basic ${payload}'`)).not.toContain(payload);
-    });
-    it('redacts JSON credentials embedded in shell request bodies', () => {
-        const body = {
-            password: 'fixture-password',
-            apiKey: 'fixture-key',
-            client_secret: 'fixture-secret',
-            message: 'hello',
-        };
-        const command = `curl -d '${JSON.stringify(body)}'`;
-        const redacted = sanitizeCommand(command);
-        expect(redacted).not.toContain('fixture');
-        expect(redacted).toContain('"message":"hello"');
-        expect(sanitizeCommand(String.raw `curl -d '{"password":"fixture\\\"password"}'`)).not.toContain('fixture');
-    });
-    it('redacts shell-escaped JSON keys and every sensitive value shape', () => {
-        const body = {
-            password: 'fixture-password',
-            authorization: 'Basic fixture-credential',
-            tokens: ['fixture-token'],
-            nested: { api_keys: { first: 'fixture-key' } },
-            message: 'hello',
-        };
-        const json = JSON.stringify(body);
-        for (const argument of [`'${json}'`, JSON.stringify(json)]) {
-            const redacted = sanitizeCommand(`curl -d ${argument}`);
-            expect(redacted).not.toContain('fixture');
-            expect(redacted).toContain('hello');
-        }
-    });
-    it('redacts JSON bodies with shell-only escapes and malformed JSON', () => {
-        for (const command of [
-            String.raw `curl -d "{\"password\":\"fixture\$password\"}"`,
-            String.raw `curl -d "{\"password\":\"fixture\!password\"}"`,
-            String.raw `curl -d "{\"password\":\"fixture\\!password\"}"`,
-            'curl -d "{\\"password\\":\\"fixture\\`password\\"}"',
-            String.raw `curl -d "{\"authorization\":\"Basic fixture\$credential\"}"`,
-            String.raw `curl -d '{"password":"fixture-password",}'`,
-        ]) {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        }
-    });
-    it('redacts token authorization schemes', () => {
-        const payload = ['fixture', 'credential'].join('-');
-        expect(sanitizeCommand(`curl -H "Authorization: token ${payload}"`)).not.toContain(payload);
-    });
-    it('redacts credentials in recursively JSON-encoded string values', () => {
-        let body = JSON.stringify({ password: 'fixture-password' });
-        for (let depth = 0; depth < 4; depth++) {
-            body = JSON.stringify({ config: body });
-            for (const argument of [`'${body}'`, JSON.stringify(body)]) {
-                expect(sanitizeCommand(`curl -d ${argument}`)).not.toContain('fixture');
-            }
-        }
-    });
-    it('preserves quoted programs and brace expansion without credentials', () => {
-        for (const command of [
-            "awk '{print $1}' /var/log/syslog",
-            "jq '[.items[] | .name]' resp.json",
-            "echo '{a,b}'",
-        ]) {
-            expect(sanitizeCommand(command)).toBe(command);
-        }
-    });
-    it('redacts complete shell words with concatenated quote sections', () => {
-        const body = JSON.stringify({
-            name: "O'Brien",
-            config: JSON.stringify({ password: 'fixture-password' }),
-        });
-        for (const escaped of ["'\\''", "'\"'\"'"]) {
-            const argument = `'${body.replaceAll("'", escaped)}'`;
-            expect(sanitizeCommand(`curl -d ${argument}`)).not.toContain('fixture');
-            const value = `'fixture${escaped}password'`;
-            expect(sanitizeCommand(`tool --password ${value}`)).toBe('tool --password [redacted]');
-            expect(sanitizeCommand(`PASSWORD=${value} tool`)).toBe('PASSWORD=[redacted] tool');
-        }
-    });
-    it('bounds scanning time for long malformed JSON-like arguments', () => {
-        const command = `jq '{${'x'.repeat(128_000)}: .y}' file.json`;
-        const start = performance.now();
-        expect(sanitizeCommand(command)).toContain('[... truncated,');
-        expect(performance.now() - start).toBeLessThan(2000);
-    });
-    it('preserves author and oauth metadata', () => {
-        for (const command of [
-            'git commit --author="Jane Doe <jane@example.com>"',
-            `curl -d '${JSON.stringify({ author: 'Jane Doe', oauth_provider: 'example' })}'`,
-            'oauth_provider=example tool',
-        ]) {
-            expect(sanitizeCommand(command)).toBe(command);
-        }
-    });
-    it('consumes shell-escaped whitespace in flag and assignment credentials', () => {
-        for (const command of [
-            String.raw `tool --password fixture\ secret --verbose`,
-            String.raw `PASSWORD=fixture\ secret tool`,
-        ]) {
-            const redacted = sanitizeCommand(command);
-            expect(redacted).not.toContain('fixture');
-            expect(redacted).not.toContain(' secret');
-        }
-    });
-    it('leaves short benign commands untouched', () => {
-        expect(sanitizeCommand('bun test')).toBe('bun test');
-        expect(sanitizeCommand('git commit -m "fix: thing"')).toBe('git commit -m "fix: thing"');
-    });
-    it('redacts our own CLI token, including the space-separated flag form', () => {
-        // The documented setup command puts a live dashboard credential on the
-        // command line, where PostToolUse logs it and the next sync would upload
-        // it in an action summary. The `key=value` rule never sees a
-        // space-separated flag, so the token prefix has to be matched directly.
-        expect(sanitizeCommand('mossbear sync --token mossbear_tPtcsSvXyRxygMSkBjjDpBKz')).toBe('mossbear sync --token [redacted]');
-        expect(sanitizeCommand('mossbear init --token=mossbear_abcdefgh12345678')).toBe('mossbear init --token=[redacted]');
-    });
-    it('still redacts a token issued under the pre-rename prefix', () => {
-        // Those keys are deleted by migration 0056, but a CLI can be older or newer
-        // than the dashboard it syncs to; while one is still live, dropping the rule
-        // would upload it in plaintext.
-        expect(sanitizeCommand('mossbear sync --token auden_tPtcsSvXyRxygMSkBjjDpBKz')).toBe('mossbear sync --token [redacted]');
-    });
-    it('does not redact ordinary words that merely start with the prefix', () => {
-        expect(sanitizeCommand('cd mossbear_repo && ls')).toBe('cd mossbear_repo && ls');
-        expect(sanitizeCommand('cd auden_repo && ls')).toBe('cd auden_repo && ls');
-    });
-    it('redacts bearer tokens in Authorization headers', () => {
-        const out = sanitizeCommand('curl -H "Authorization: Bearer sk-abc123def456ghi789" https://api.example.com');
-        expect(out).not.toContain('sk-abc123def456ghi789');
-        expect(out).toContain('[redacted]');
-        expect(out).toContain('https://api.example.com');
-    });
-    it('redacts credentials in connection-string URLs', () => {
-        const out = sanitizeCommand('psql postgres://mossbear:s3cretpw@db.host:5432/mossbear');
-        expect(out).not.toContain('s3cretpw');
-        expect(out).toContain('postgres://mossbear:[redacted]@db.host:5432/mossbear');
-    });
-    it('redacts sensitive key=value assignments', () => {
-        const out = sanitizeCommand('OPENAI_API_KEY=sk-live-abcdef123456 bun run eval');
-        expect(out).not.toContain('abcdef123456');
-        expect(out).toContain('bun run eval');
-    });
-    it('redacts quoted secret values that contain spaces', () => {
-        const out = sanitizeCommand('PASSWORD="correct horse battery staple" deploy');
-        expect(out).not.toContain('correct horse battery staple');
-        expect(out).toContain('PASSWORD=[redacted]');
-        expect(out).toContain('deploy');
-        const single = sanitizeCommand("DB_PASSWORD='a b c d' run");
-        expect(single).not.toContain('a b c d');
-        expect(single).toContain('run');
-    });
-    it('strips heredoc bodies, keeping only the delimiters', () => {
-        const out = sanitizeCommand("cat > src/config.ts <<EOF\nexport const KEY = 'sk-verysecret12345'\nmore lines\nEOF");
-        expect(out).not.toContain('sk-verysecret12345');
-        expect(out).not.toContain('more lines');
-        expect(out).toContain('[redacted]');
-        expect(out).toContain('EOF');
-    });
-    it('redacts well-known token prefixes standing alone', () => {
-        for (const secret of [
-            'ghp_16C7e42F292c6912E7710c838347Ae178B4a', // oss-boundary-ignore — fake token shape
-            'github_pat_11ABCDEFG_abcdefghij', // oss-boundary-ignore — fake token shape
-            'xoxb-1234567890-abcdefghijk', // oss-boundary-ignore — fake token shape
-            'AKIAIOSFODNN7EXAMPLE', // oss-boundary-ignore — fake token shape
-        ]) {
-            const out = sanitizeCommand(`deploy --with ${secret}`);
-            expect(out).not.toContain(secret);
-        }
-    });
-    it('redacts private key blocks even without an END marker', () => {
-        const out = sanitizeCommand('cat > key.pem <<EOF\n-----BEGIN RSA PRIVATE KEY-----\nMIIEow\nEOF' // oss-boundary-ignore — synthetic fixture, not a real key
-        );
-        expect(out).not.toContain('MIIEow');
-    });
-    it('truncates long commands and notes omitted length', () => {
-        const long = `echo ${'x'.repeat(500)}`;
-        const out = sanitizeCommand(long);
-        expect(out.length).toBeLessThan(300);
-        expect(out).toContain('[... truncated,');
-    });
-});
-describe('command disclosure regressions', () => {
-    it('redacts cookie request headers', () => {
-        expect(sanitizeCommand(`curl -H 'Cookie: session=fixture-cookie; csrf=fixture-csrf' https://example.test`)).not.toContain('fixture-cookie');
-        expect(sanitizeCommand(`curl -b 'session=fixture-cookie' https://example.test`)).not.toContain('fixture-cookie');
-    });
-    it('redacts HTTP username/password arguments in short and long forms', () => {
-        for (const flag of ['-u ', '-u', '--user ', '--user=', '--proxy-user ']) {
-            expect(sanitizeCommand(`curl ${flag}'fixture-user:fixture-password' https://example.test`)).not.toContain('fixture-password');
-        }
-    });
-    it('redacts credentials after shell line continuations', () => {
-        for (const input of [
-            'tool --password \\\n  fixture-continued',
-            'tool --password \\\r\n  fixture-continued',
-        ])
-            expect(sanitizeCommand(input)).not.toContain('fixture-continued');
-    });
-    it('redacts the value of a credential flag that follows another credential flag', () => {
-        // The first flag's rule takes the second flag as its value; the second
-        // flag's own value must not escape because of it.
-        for (const input of [
-            'x --password  \n --token reader:fixture-visible',
-            'x --password --token reader:fixture-visible',
-            'x --password\t--token\treader:fixture-visible',
-            'x --password\n--token\nreader:fixture-visible',
-            'x --password \\\n --token reader:fixture-visible',
-            'x --password "--token" reader:fixture-visible',
-            "x --password '--api-key' reader:fixture-visible",
-            'x --password --token --client-secret reader:fixture-visible',
-            'x `--password\n --token reader:fixture-visible`',
-            'x $(tool --password --token reader:fixture-visible)',
-            "sh -c 'tool --password --token reader:fixture-visible'",
-            'bash -c "tool --password --token reader:fixture-visible"',
-            'env tool --password --token reader:fixture-visible',
-            'sudo tool --password --token reader:fixture-visible',
-            'x --password --token abc--fixture-visible',
-            'x --password --token "a b--fixture-visible" --verbose',
-            "bash -c $'x --password --token \\\\\\n reader:fixture-visible'",
-        ])
-            expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    it('redacts a long credential chain without stalling the hook', () => {
-        // Each shape took minutes before the chain's key test stopped
-        // backtracking and a chain stopped at words another chain had left.
-        for (const input of [
-            `x --password --token ${'token'.repeat(4000)}`,
-            `x --password --${'token'.repeat(4000)}! y`,
-            `x ${Array.from({ length: 4000 }, () => '--token').join(' ')} fixture-visible`,
-        ]) {
-            const output = sanitizeCommand(input);
-            expect(output).not.toContain('fixture-visible');
-            expect(output).not.toContain('tokentoken');
-        }
-    });
-    it('keeps redacting what a credential flag swallowed on its own', () => {
-        expect(sanitizeCommand('x --password\nfixture-secret')).toBe('x --password\n[redacted]');
-        expect(sanitizeCommand('x --password --token fixture-visible')).toBe('x --password [redacted] [redacted]');
-        expect(sanitizeCommand('x --password --token=fixture-visible')).toBe('x --password [redacted]');
-        // A swallowed word that is not a credential flag ends the chain there.
-        expect(sanitizeCommand('x --password --verbose fixture-kept')).toBe('x --password [redacted] fixture-kept');
-        expect(sanitizeCommand('x --password --token; echo fixture-kept')).toBe('x --password [redacted]; echo fixture-kept');
-        // Following the chain must not hide a flag a later rule reads: here the
-        // newline-crossing rule redacts --PASSWORD's value only while the flag
-        // itself is still in the text.
-        for (const input of [
-            'x $\'--credentials\' "--token" --PASSWORD  \n fixture-visible',
-            'tool --auth-token\t\\\n\t--token\treader:fixture-visible',
-            'bash -c "x --password \'--token\' \\\\\n --api-key=fixture-visible"',
-        ])
-            expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    it('redacts a credential flag value after a tool password flag swallowed the flag', () => {
-        // Each tool flag takes the next word as its value; when that word is a
-        // credential flag, the flag's own value must not escape.
-        for (const [input, output] of [
-            [
-                'redis-cli -a --token reader:fixture-visible',
-                'redis-cli -a [redacted] [redacted]',
-            ],
-            [
-                'redis-cli --pass --token reader:fixture-visible',
-                'redis-cli --pass [redacted] [redacted]',
-            ],
-            [
-                'sshpass -p --token reader:fixture-visible ssh host',
-                'sshpass -p [redacted] [redacted] ssh host',
-            ],
-            [
-                'curl --user --token reader:fixture-visible https://example.test',
-                'curl --user [redacted] [redacted] https://example.test',
-            ],
-            [
-                'curl -u --token reader:fixture-visible https://example.test',
-                'curl -u [redacted] [redacted] https://example.test',
-            ],
-        ])
-            expect(sanitizeCommand(input)).toBe(output);
-        for (const input of [
-            'redis-cli --cluster-from-pass --token reader:fixture-visible',
-            'valkey-cli -a --api-key fixture-visible',
-            'REDIS-CLI.exe -a --token fixture-visible',
-            'sshpass -4p --token fixture-visible ssh host',
-            'openssl enc -k --token fixture-visible',
-            'openssl enc -K --secret fixture-visible',
-            'curl -U --token reader:fixture-visible https://example.test',
-            'curl --proxy-user --token reader:fixture-visible https://example.test',
-            'curl --oauth2-bearer --token fixture-visible https://example.test',
-            'curl --cookie --token fixture-visible https://example.test',
-            'curl -su --token reader:fixture-visible https://example.test',
-            'http -a --token reader:fixture-visible example.test',
-            'httpie --auth --token reader:fixture-visible example.test',
-            // Variants: separators, quoting, chains and wrappers.
-            'redis-cli -a\t--token\treader:fixture-visible',
-            'redis-cli -a --token\nreader:fixture-visible',
-            'redis-cli -a \\\n --token \\\n reader:fixture-visible',
-            'redis-cli -a "--token" reader:fixture-visible',
-            "curl -u '--api-key' reader:fixture-visible https://example.test",
-            'curl -u --token --client-secret fixture-visible https://example.test',
-            "sh -c 'redis-cli -a --token reader:fixture-visible'",
-            'bash -c "curl -u --token reader:fixture-visible https://example.test"',
-            'echo $(sshpass -p --token fixture-visible ssh host)',
-            'echo `redis-cli -a --token fixture-visible`',
-            'sudo -u root redis-cli -a --token fixture-visible',
-            'env FOO=1 curl --user --token reader:fixture-visible https://example.test',
-            // A curl config field takes the flag too, on a later line as well.
-            'echo -- --pass --token fixture-visible | curl -K -',
-            'echo -- -u --token reader:fixture-visible | curl -K -',
-            'echo -- oauth2-bearer --token fixture-visible | curl -K -',
-            'echo -- oauth2-bearer --access-token\nfixture-visible | curl -K -',
-        ])
-            expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    it('leaves a header name in a credential chain for the header rules to read', () => {
-        // A chain that redacted `Cookie:` would hide the cookie value from the
-        // header rule, which reads the name and the next word together.
-        for (const [input, output] of [
-            [
-                'redis-cli -a --token Cookie: session=fixture-visible',
-                'redis-cli -a [redacted] Cookie: [redacted]',
-            ],
-            [
-                'curl -u --token Set-Cookie: session=fixture-visible',
-                'curl -u [redacted] Set-Cookie: [redacted]',
-            ],
-            [
-                'x --password --token Cookie: session=fixture-visible',
-                'x --password [redacted] Cookie: [redacted]',
-            ],
-            [
-                'x --password --token\nCookie: session=fixture-visible',
-                'x --password [redacted]\nCookie: [redacted]',
-            ],
-            [
-                'redis-cli -a --token Authorization: Bearer fixture-visible',
-                'redis-cli -a [redacted] Authorization: [redacted]',
-            ],
-        ])
-            expect(sanitizeCommand(input)).toBe(output);
-        for (const input of [
-            'echo -- --pass --token Cookie: session=fixture-visible | curl -K -',
-            "bash -c 'redis-cli -a --token Cookie: session=fixture-visible'",
-            'redis-cli -a --token cookie:session=fixture-visible',
-        ])
-            expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    it('keeps what main redacts and kept around a tool password flag', () => {
-        // The tool flag's own value is still redacted when no chain follows it.
-        expect(sanitizeCommand('redis-cli -a fixture-secret ping')).toBe('redis-cli -a [redacted] ping');
-        expect(sanitizeCommand('curl -u reader:fixture-secret https://example.test')).toBe('curl -u [redacted] https://example.test');
-        // A swallowed word that is not a credential flag ends the chain: a Redis
-        // command after the password stays readable.
-        expect(sanitizeCommand('redis-cli -a --verbose ping')).toBe('redis-cli -a [redacted] ping');
-        // So does a flag that carries its own value, and an operator.
-        expect(sanitizeCommand('redis-cli -a --token=fixture-visible ping')).toBe('redis-cli -a [redacted] ping');
-        expect(sanitizeCommand('redis-cli -a --token; echo fixture-kept')).toBe('redis-cli -a [redacted]; echo fixture-kept');
-        // `--pass` is not a credential key, so the word after it is not its value.
-        expect(sanitizeCommand('redis-cli -a --pass ping')).toBe('redis-cli -a [redacted] ping');
-        // Flags that never swallow the next word as a credential still leave it
-        // to the space-separated rule.
-        expect(sanitizeCommand('mysql --password --token fixture-visible')).toBe('mysql --password [redacted] [redacted]');
-        expect(sanitizeCommand('openssl enc -pass --token fixture-visible')).toBe('openssl enc -pass --token [redacted]');
-        expect(sanitizeCommand('curl -x --token fixture-visible https://example.test')).toBe('curl -x --token [redacted] https://example.test');
-    });
-    // A credential flag pasted where a command starts runs no program, but the
-    // word after it is still the flag's value, however the flag is quoted.
-    it.each([
-        "'--token' fixture-visible",
-        '"--password" fixture-visible',
-        String.raw `\--token fixture-visible`,
-        "x\n'--token' fixture-visible",
-        "redis-cli -a\n'--token' fixture-visible",
-        "x; '--token' fixture-visible",
-        'x | "--api-key" fixture-visible',
-        'sh -c "\'--token\' fixture-visible"',
-    ])('redacts the value of a credential flag that starts a command: %s', (input) => {
-        expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    // A backtick substitution that closes onto a credential flag: both the
-    // value inside the body and the flag's value after it are credentials.
-    it.each([
-        'x `--token fixture-visible`--client-secret fixture-visible',
-        "x `'--token' fixture-visible`--client-secret fixture-visible",
-        '`--token fixture-visible`--client-secret fixture-visible',
-        "'--token' fixture-visible`echo a`--client-secret fixture-visible",
-        `;"--auth-token" 'fixture-visible'\`"--"passwd 'fixture-visible'\`--client-secret 'Cookie: fixture-visible' | tee out`,
-    ])('redacts both values around a substitution that closes onto a flag: %s', (input) => {
-        expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    // A nested word ends where the enclosing command may go on, so a header at
-    // its end is left for the enclosing header rules.
-    it.each([
-        `echo '"--token" 'Cookie: sid=fixture-visible`,
-        // A substitution rewritten inside a double quote that never closes fails
-        // closed from the quote, so the credential argument keeps its extent.
-        'redis-cli -a "x fixture-visible`"--token" "other"`',
-        'redis-cli -a "x fixture-visible`--token other`',
-    ])('keeps redacting around a nested or unterminated word: %s', (input) => {
-        expect(sanitizeCommand(input)).not.toContain('fixture-visible');
-    });
-    it('redacts a header a credential flag takes when nothing follows it', () => {
-        // No header rule can read on past an operator, so the word is the value.
-        expect(sanitizeCommand("x --token --password 'Cookie: fixture-visible' | tee out")).not.toContain('fixture-visible');
-    });
-    it('reads a quoted credential flag as the unquoted one', () => {
-        // A header after the flag is redacted by the header rules first, as it is
-        // after an unquoted flag.
-        for (const flag of ["'--client-secret'", '--client-secret'])
-            expect(sanitizeCommand(`${flag} Authorization: Bearer fixture-visible`)).not.toContain('fixture-visible');
-        // A word that is not a credential flag still names the program.
-        expect(sanitizeCommand("'--verbose' fixture-kept")).toBe("'--verbose' fixture-kept");
-        expect(sanitizeCommand("'--output' fixture-kept")).toBe("'--output' fixture-kept");
-        // An operator ends the flag's command, so the next command keeps its words.
-        expect(sanitizeCommand("'--token'; echo fixture-kept")).toBe("'--token'; echo fixture-kept");
-    });
-    it('redacts token-only URL userinfo and URL query credentials', () => {
-        for (const input of [
-            'curl https://fixture-userinfo@example.test/',
-            'curl "https://example.test/?api_key=fixture-query&view=summary"',
-        ]) {
-            const output = sanitizeCommand(input);
-            expect(output).not.toContain('fixture-userinfo');
-            expect(output).not.toContain('fixture-query');
-            expect(output).toContain('example.test');
-        }
-    });
-    it('strips here-string file contents while retaining command evidence', () => {
-        const output = sanitizeCommand(`cat <<< 'fixturePrivateSource second word' > output.txt`);
-        expect(output).not.toContain('fixturePrivateSource');
-        expect(output).toContain('cat <<<');
-        expect(output).toContain('output.txt');
-    });
-});
-describe('review command-evidence regressions', () => {
-    it('preserves the host after a cookie header and still redacts query credentials', () => {
-        const text = sanitizeCommand("curl -H 'Cookie: session=fixture-cookie' https://example.test/?api_key=fixture-query");
-        expect(text).not.toContain('fixture-cookie');
-        expect(text).not.toContain('fixture-query');
-        expect(text).toContain('example.test');
-    });
-    it.each([
-        'sort -u fixtures/input.txt',
-        'git add -u .',
-        'grep -b pattern src/app.ts',
-        'ps -u root',
-        'docker run --user 1000:1000',
-    ])('preserves non-HTTP flags: %s', (command) => {
-        expect(sanitizeCommand(command)).toBe(command);
-    });
-    it('redacts HTTP credentials after environment assignments and command separators', () => {
-        const credential = ['fixture-user', 'fixture-password'].join(':');
-        const text = sanitizeCommand(`SORT=1 sort -u input.txt && env MODE=test /usr/bin/curl -u '${credential}' https://example.test`);
-        expect(text).toContain('sort -u input.txt');
-        expect(text).not.toContain('fixture-password');
-        expect(text).toContain('example.test');
-    });
-});
-describe('HTTPie authentication evidence', () => {
-    it.each(['-a ', '-a', '-a=', '--auth ', '--auth='])('redacts auth in the %s form', (flag) => {
-        const output = sanitizeCommand(`http ${flag}'fixture-user:fixture-password' example.test`);
-        expect(output).not.toContain('fixture-password');
-        expect(output).toContain('example.test');
-    });
-    it('preserves the auth type while redacting a bearer token on https', () => {
-        const output = sanitizeCommand('https -A bearer -a fixture-token example.test');
-        expect(output).not.toContain('fixture-token');
-        expect(output).toContain('-A bearer');
-    });
-});
-describe('credential syntax at the command upload boundary', () => {
-    it.each([
-        "bash -c 'API_TOKEN=x curl -x reader:fixture-value@proxy.test:3128 https://example.test'",
-        "bash -c 'password=x; https_proxy=reader:fixture-value@proxy.test:3128 curl https://example.test'",
-        "su -c 'API_TOKEN=x curl -x reader:fixture-value@proxy.test:3128 https://example.test'",
-        "env 'PASSWORD=fixture value' curl https://example.test",
-        "bash -c '{ curl -x reader:fixture-value@proxy.test:3128 https://example.test; }'",
-        "echo 'proxy = reader:fixture-value@proxy.test:3128' | curl -K - https://example.test",
-        "curl -K <(echo 'proxy = reader:fixture-value@proxy.test:3128') https://example.test",
-        "printf '%s\\n' 'proxy=reader:fixture-value@proxy.test:3128' | curl --config - https://example.test",
-    ])('redacts assignment-led scripts and inline proxy configuration: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('fixture');
-    });
-    it.each([
-        'echo \'proxy-user = "reader:fixture-password"\' | curl -K - https://example.test',
-        'echo \'user = "reader:fixture-password"\' | curl -K - https://example.test',
-        'echo \'proxy-user = "reader:fixture-password"\' > cfg && curl -K cfg https://example.test',
-        'curl -K <(echo \'user = "reader:fixture-password"\') https://example.test',
-        "printf '%s\\n' 'user: reader:fixture-password' | curl -K - https://example.test",
-        'echo \'cookie = "SID=fixture-password"\' | curl -K - https://example.test',
-        'echo \'cert = "client.pem:fixture-password"\' | curl -K - https://example.test',
-        "echo 'proxy-cert = client.pem:fixture-password' | curl -K - https://example.test",
-    ])('redacts credential fields in inline curl configuration: %s', (command) => {
-        const output = sanitizeCommand(command);
-        expect(output).not.toContain('fixture');
-        expect(output).toContain('[redacted]');
-    });
-    it.each([
-        'echo \'user = "reader"\' | curl -K - https://example.test',
-        'echo \'cert = "client.pem"\' | curl -K - https://example.test',
-    ])('keeps curl configuration without a password: %s', (command) => {
-        expect(sanitizeCommand(command)).toBe(command);
-    });
-    it.each([
-        'sudo -E curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-        'sudo -u deploy curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-        'timeout --preserve-status 10 curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-        'nice -n 10 curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-        'stdbuf -oL curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-        'xargs curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-        'env -S "curl -x reader:fixture-password@proxy.test:3128 https://example.test"',
-        "su -c 'curl -x reader:fixture-password@proxy.test:3128 https://example.test'",
-        'sudo -s "curl -x reader:fixture-password@proxy.test:3128 https://example.test"',
-        String.raw `env -S "sh -c 'curl -x reader:fixture-password@proxy.test:3128 https://example.test'"`,
-        'bash -c "$(echo curl -x reader:fixture-password@proxy.test:3128 https://example.test)"',
-        "bash -c $'curl -x reader:fixture-password@proxy.test:3128 https://example.test'",
-        String.raw `bash -c $'true\ncurl -x reader:fixture-password@proxy.test:3128 https://example.test'`,
-        String.raw `bash -c $'\x63url -x reader:fixture-password@proxy.test:3128 https://example.test'`,
-        String.raw `bash -c $'echo \'ready\'; \x63url -x reader:fixture-password@proxy.test:3128 https://example.test'`,
-    ])('redacts wrapper and encoded-script credentials: %s', (command) => {
-        const output = sanitizeCommand(command);
-        expect(output).not.toContain('fixture-password');
-        expect(output).toContain('proxy.test:3128');
-        expect(output).toContain('example.test');
-    });
-    it.each([
-        "sh -c 'export https_proxy=reader:fixture-password@proxy.test:3128; curl https://example.test'",
-        "sh -c 'cd /tmp; https_proxy=reader:fixture-password@proxy.test:3128 curl https://example.test'",
-        "eval 'export https_proxy=reader:fixture-password@proxy.test:3128' ; curl https://example.test",
-        "bash -c 'curl -x reader:fixture-password@proxy.test:3128 https://example.test'",
-        'bash -lc "curl -sSx reader:fixture-password@proxy.test:3128 https://example.test"',
-        'sudo bash -c "curl -x reader:fixture-password@proxy.test:3128 https://example.test"',
-        String.raw `bash -c 'sh -c "curl -x reader:fixture-password@proxy.test:3128 https://example.test"'`,
-        "bash -c 'https_proxy=reader:fixture-password@proxy.test:3128 curl -U reader:fixture-other https://example.test'",
-        'eval curl -x reader:fixture-password@proxy.test:3128 https://example.test',
-    ])('redacts credentials inside quoted scripts: %s', (command) => {
-        const output = sanitizeCommand(command);
-        expect(output).not.toContain('fixture-password');
-        expect(output).not.toContain('fixture-other');
-        expect(output).toContain('proxy.test:3128');
-        expect(output).toContain('example.test');
-    });
-    it('bounds deeply nested interpreter scripts without retaining credentials', () => {
-        let command = 'curl -x reader:fixture-password@proxy.test:3128 https://example.test';
-        for (let depth = 0; depth < 12; depth += 1)
-            command = `bash -c ${JSON.stringify(command)}`;
-        const start = performance.now();
-        expect(sanitizeCommand(command)).not.toContain('fixture-password');
-        expect(performance.now() - start).toBeLessThan(2000);
-    });
-    it.each(['--pass ', '--pass=', '--proxy-pass ', '--proxy-pass='])('redacts separate private-key passphrases via %s', (flag) => {
-        expect(sanitizeCommand(`curl ${flag}'fixture-secret' https://example.test`)).not.toContain('fixture-secret');
-    });
-    it.each([
-        'curl reader:fixture-password@internal.test/api',
-        'curl -osx reader:fixture-password@internal.test/api',
-        'curl -- reader:fixture-password@internal.test/api',
-        "curl 'reader:fixture-password@internal.test/api'",
-        "bash -c 'curl reader:fixture-password@internal.test/api'",
-    ])('redacts HTTP-client scheme-less URL credentials: %s', (command) => {
-        const output = sanitizeCommand(command);
-        expect(output).not.toContain('fixture-password');
-        expect(output).toContain('internal.test/api');
-    });
-    it('preserves benign quoted scripts and unrelated userinfo-shaped arguments', () => {
-        for (const command of [
-            "bash -c 'sort -u input.txt; curl -sS https://example.test'",
-            "docker pull 'image:tag@sha256:abc123'",
-            "git clone 'git@github.test:org/repo'",
-        ])
-            expect(sanitizeCommand(command)).toBe(command);
-    });
-    it.each([
-        ['x', 'reader:fixture-password@proxy.test:3128'],
-        ['u', 'reader:fixture-password'],
-        ['U', 'reader:fixture-password'],
-        ['b', 'session=fixture-cookie'],
-        ['E', 'client.pem:fixture-passphrase'],
-        ['H', 'X-Api-Key: fixture-header'],
-        ['d', '%70assword=fixture-form'],
-        ['F', '%70assword=fixture-form'],
-    ])('redacts curl clustered argument flag %s', (flag, value) => {
-        for (const prefix of ['s', 'sS', 'qkLf']) {
-            for (const space of ['', ' ']) {
-                const output = sanitizeCommand(`curl -${prefix}${flag}${space}'${value}' https://example.test`);
-                expect(output).not.toContain('fixture');
-                expect(output).toContain(`-${prefix}${flag}`);
-                expect(output).toContain('https://example.test');
-                if (flag === 'x')
-                    expect(output).toContain('proxy.test:3128');
-            }
-        }
-    });
-    it('does not interpret an argument-taking flag value as more curl flags', () => {
-        const command = "curl -osxreport.txt -sH'Accept: application/json' https://example.test";
-        expect(sanitizeCommand(command)).toBe(command);
-        const proxy = 'curl -sSxproxy.test:3128 https://example.test';
-        expect(sanitizeCommand(proxy)).toBe(proxy);
-    });
-    it.each(['-U ', '-U', '--proxy-user='])('redacts curl proxy credentials via %s', (flag) => {
-        expect(sanitizeCommand(`curl ${flag}'user:fixture proxy password' https://example.test`)).not.toContain('fixture');
-    });
-    it.each(['--oauth2-bearer ', '--oauth2-bearer='])('redacts curl OAuth bearer credentials via %s', (flag) => {
-        expect(sanitizeCommand(`curl ${flag}fixture-bearer https://example.test`)).not.toContain('fixture');
-    });
-    it.each(['-E ', '-E', '--cert ', '--cert=', '--proxy-cert='])('redacts certificate passphrases via %s', (flag) => {
-        expect(sanitizeCommand(`curl ${flag}'client.pem:fixture passphrase' https://example.test`)).not.toContain('fixture');
-    });
-    it.each(['-H ', '-H', '--header ', '--header=', '--proxy-header='])('redacts custom credential headers via %s', (flag) => {
-        expect(sanitizeCommand(`curl ${flag}'X-Api-Key: fixture-header-secret' https://example.test`)).not.toContain('fixture');
-        expect(sanitizeCommand(`curl ${flag}'Accept: application/json' https://example.test`)).toContain('Accept: application/json');
-    });
-    it.each(['-d ', '-d', '--data=', '--data-urlencode ', '-F ', '--form-string='])('redacts credential form bodies via %s', (flag) => {
-        expect(sanitizeCommand(`curl ${flag}'password=fixture%20password&name=reader' https://example.test`)).not.toContain('fixture');
-        expect(sanitizeCommand(`curl ${flag}'%70assword=fixture-password' https://example.test`)).not.toContain('fixture');
-        expect(sanitizeCommand(`curl ${flag}'view=summary' https://example.test`)).toContain('view=summary');
-    });
-    it.each([
-        "'--password'",
-        '"--password"',
-        String.raw `--pass\word`,
-        "'--password=fixture password'",
-    ])('redacts shell-encoded credential flags %s', (flag) => {
-        const command = flag.includes('=')
-            ? `tool ${flag}`
-            : `tool ${flag} 'fixture password' --verbose`;
-        expect(sanitizeCommand(command)).not.toContain('fixture');
-    });
-    it('redacts OAuth fragment credentials while retaining the address', () => {
-        const output = sanitizeCommand('curl "https://example.test/#access_token=fixture-fragment&view=summary"');
-        expect(output).not.toContain('fixture');
-        expect(output).toContain('https://example.test/');
-        expect(output).toContain('view=summary');
-    });
-    it.each(['-x ', '-x', '--proxy ', '--proxy=', '--proxy1.0 '])('redacts scheme-less proxy userinfo via %s', (flag) => {
-        const output = sanitizeCommand(`curl ${flag}'reader:fixture-password@proxy.test:3128' https://example.test`);
-        expect(output).not.toContain('fixture-password');
-        expect(output).toContain('proxy.test:3128');
-        expect(sanitizeCommand(`curl ${flag}proxy.test:3128 https://example.test`)).toContain('proxy.test:3128');
-        expect(sanitizeCommand(`curl ${flag}'http://reader:fixture-password@proxy.test:3128' https://example.test`)).not.toContain('fixture-password');
-    });
-    describe('proxy environment assignments', () => {
-        it.each([
-            "env 'https_proxy=reader:fixture-password@proxy.test:3128' curl https://example.test",
-            'env "ALL_PROXY=reader:fixture-password@proxy.test:3128" curl https://example.test',
-            String.raw `env https_pr\oxy=reader:fixture-password@proxy.test:3128 curl https://example.test`,
-        ])('redacts shell-encoded complete proxy assignments: %s', (command) => {
-            const output = sanitizeCommand(command);
-            expect(output).not.toContain('fixture-password');
-            expect(output).toContain('proxy.test:3128');
-        });
-        const names = ['https_proxy', 'http_proxy', 'HTTPS_PROXY', 'ALL_PROXY', 'all_proxy'];
-        const values = [
-            'reader:fixture-password@proxy.test:3128',
-            "'reader:fixture-password@proxy.test:3128'",
-            '"reader:fixture-password@proxy.test:3128"',
-            "'reader:fixture password@proxy.test:3128'",
-        ];
-        for (const name of names) {
-            it.each(values)(`redacts scheme-less userinfo in ${name}=%s`, (value) => {
-                for (const prefix of ['', 'export ', 'sudo -E ', 'env ']) {
-                    const output = sanitizeCommand(`${prefix}${name}=${value} curl https://example.test`);
-                    expect(output).not.toContain('fixture');
-                    expect(output).toContain('reader:');
-                    expect(output).toContain('proxy.test:3128');
-                    expect(output).toContain('curl https://example.test');
-                }
-            });
-        }
-        it('keeps a proxy value without credentials intact', () => {
-            for (const command of [
-                'https_proxy=proxy.test:3128 curl https://example.test',
-                "ALL_PROXY='socks5://proxy.test:1080' curl https://example.test",
-                'no_proxy=localhost,127.0.0.1 curl https://example.test',
-            ])
-                expect(sanitizeCommand(command)).toBe(command);
-        });
-        it('leaves unrelated scheme-less @ text alone', () => {
-            for (const command of [
-                'docker pull nginx:1.25@sha256:0123456789abcdef',
-                'git clone git@github.com:org/repo.git',
-            ])
-                expect(sanitizeCommand(command)).toBe(command);
-        });
-    });
-    describe('OpenSSL and sshpass credential arguments', () => {
-        it.each([
-            'openssl enc -d -aes-256-cbc -pass pass:fixture-password -in f.enc',
-            "openssl rsa -passin 'pass:fixture password' -in key.pem",
-            'openssl pkcs12 -passout pass:fixture-password -out key.p12',
-            'openssl enc -aes-256-cbc -k fixture-password',
-            'openssl enc -aes-256-cbc -pass=pass:fixture-password',
-            'openssl enc -aes-256-cbc --pass pass:fixture-password',
-            'openssl enc -aes-256-cbc --pass=pass:fixture-password',
-            'openssl rsa --passin pass:fixture-password -in key.pem',
-            'openssl pkcs12 --passout pass:fixture-password -out key.p12',
-            'openssl enc -aes-256-cbc --k fixture-password',
-            'openssl pkcs12 -password pass:fixture-password',
-            "env 'SSHPASS=fixture password' sshpass -e ssh deploy@host",
-            "sudo -u root /usr/bin/openssl enc '-pass' pass:fixture-password",
-            "bash -c 'openssl enc -pass pass:fixture-password'",
-            'sshpass -p fixture-password ssh deploy@host git pull',
-            'sshpass -pfixture-password ssh deploy@host git pull',
-            "sshpass -vp'fixture password' ssh deploy@host",
-            'timeout 10 /usr/bin/sshpass -4vpfixture-password ssh deploy@host',
-            String.raw `sshpass -\p $'fixture\x20password' ssh deploy@host`,
-            "openssl passwd -1 'fixture-password'",
-            'openssl passwd -6 fixture-password',
-            'openssl passwd -salt pepper fixture-password',
-            'sudo openssl passwd -apr1 -salt x fixture-password fixture-second',
-            'openssl enc -aes-256-cbc -K 00fixture1122 -iv 00 -in f -out g',
-            'openssl enc -aes-256-cbc -K=00fixture1122 -in f -out g',
-        ])('redacts direct passwords: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-            expect(sanitizeCommand(command)).toContain('[redacted]');
-        });
-        it.each([
-            'openssl enc -pass env:KEY_PASSWORD -in f.enc',
-            'openssl enc --pass env:KEY_PASSWORD -in f.enc',
-            'openssl rsa -passin file:password-source -in key.pem',
-            'openssl pkcs12 -passout fd:3',
-            'openssl enc -pass stdin',
-            'openssl enc -kfile password-source -in f.enc',
-            'sshpass -e ssh deploy@host',
-            'sshpass -f password-source ssh deploy@host',
-            'sshpass -d 3 ssh deploy@host',
-            'printf -p fixture-public',
-            'tool -pass pass:fixture-public',
-            'openssl passwd -stdin',
-            'openssl passwd -in password-source',
-            'openssl x509 -in cert.pem -noout -text',
-        ])('preserves nonliteral sources and unrelated arguments: %s', (command) => {
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-    });
-    describe('redis-cli and mysql password arguments', () => {
-        it.each([
-            'redis-cli -a fixture-password keys "*"',
-            'redis-cli -h cache -a fixture-password get k',
-            'redis-cli --pass fixture-password get k',
-            'redis-cli --pass=fixture-password get k',
-            'redis-cli -a "fixture password" get k',
-            'mysql -u root -pfixture-password -h db',
-            "mysql -u root -p'fixture password' db",
-            'mysql -pfixture-password db',
-            'mysql --password=fixture-password db',
-            'redis-cli --cluster import 127.0.0.1:7000 --cluster-from 127.0.0.1:6379 --cluster-from-pass fixture-password',
-            'redis-cli --cluster-from-pass=fixture-password --cluster info 127.0.0.1:6379',
-            'REDISCLI_AUTH=fixture-password redis-cli get k',
-            'MYSQL_PWD=fixture-password mysql -u root db',
-            'env MYSQL_PWD=fixture-password mysql db',
-            'redis-cli -u redis://:fixture-password@cache:6379 get k',
-        ])('redacts a password argument: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-            expect(sanitizeCommand(command)).toContain('[redacted]');
-        });
-        it.each([
-            'redis-cli -h cache -p 6379 get k',
-            'redis-cli --user reader keys "*"',
-            'redis-cli SET artifact image:tag@sha256:digest',
-            'redis-cli SET contact user@example.com',
-            'mysql -u root -P 3306 db',
-            'mysql -u root -p -h db',
-            'mysql -p mydb',
-            'mysql -h db -p mydb',
-            'mysql --protocol tcp db',
-        ])('preserves unrelated arguments: %s', (command) => {
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-    });
-    describe('valkey-cli and MySQL-family password arguments', () => {
-        it.each([
-            'valkey-cli -a fixture-password get k',
-            'valkey-cli -h cache -a fixture-password get k',
-            'valkey-cli -a "fixture password" get k',
-            'valkey-cli --pass fixture-password get k',
-            'valkey-cli --pass=fixture-password get k',
-            'valkey-cli --cluster-from-pass=fixture-password --cluster info 127.0.0.1:6379',
-            'valkey-cli -u valkey://:fixture-password@cache:6379 get k',
-            'valkey-cli -u valkeys://:fixture-password@cache:6379 get k',
-            'redis-cli -u rediss://:fixture-password@cache:6379 get k',
-            'VALKEYCLI_AUTH=fixture-password valkey-cli get k',
-            'env VALKEYCLI_AUTH=fixture-password valkey-cli get k',
-            'mariadb -u root -pfixture-password -h db',
-            "mariadb -u root -p'fixture password' db",
-            'mariadb -pfixture-password db',
-            'mariadb --password=fixture-password db',
-            'mysqldump -u root -pfixture-password db',
-            "mysqldump -u root -p'fixture password' db",
-            'mysqldump --password=fixture-password db',
-            'mysqladmin -u root -pfixture-password ping',
-            'mysqladmin --password=fixture-password ping',
-            'mariadb-dump -u root -pfixture-password db',
-            'mariadb-dump --password=fixture-password db',
-            'mariadb-admin -u root -pfixture-password ping',
-            'mariadb-admin --password=fixture-password ping',
-            'valkey-cli.exe -a fixture-password get k',
-            'mariadb.exe -pfixture-password db',
-            'mysqldump.EXE -pfixture-password db',
-            'MYSQL.EXE -pfixture-password db',
-            'VALKEY-CLI.EXE -a fixture-password get k',
-            'MYSQL_PWD=fixture-password mariadb -u root db',
-            'env MYSQL_PWD=fixture-password mysqldump db',
-        ])('redacts a password argument: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-            expect(sanitizeCommand(command)).toContain('[redacted]');
-        });
-        // A bare --password prompts in MySQL-family clients, so the next word is an
-        // operand. The tool-agnostic `--credential value` rule cannot tell that apart,
-        // so it redacts the operand: over-redaction, never a leak.
-        it.each([
-            'mysql --password appdb',
-            'mariadb --password appdb db',
-            'mysqldump --password appdb',
-            'mysqladmin --password ping',
-            'mariadb-dump --password appdb',
-        ])('redacts, rather than leaks, the operand after a bare --password: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('appdb');
-            expect(sanitizeCommand(command)).not.toContain('ping');
-        });
-        it.each([
-            'valkey-cli -h cache -p 6379 get k',
-            'valkey-cli --user reader keys "*"',
-            'valkey-cli GET valkey://cache:6379',
-            'valkey-cli SET artifact image:tag@sha256:digest',
-            'valkey-cli SET contact user@example.com',
-            'mariadb -u root -P 3306 db',
-            'mariadb -u root -p -h db',
-            'mariadb -p mydb',
-            'mysqldump -p mydb',
-            'mysqldump --databases mydb',
-            'mysqladmin -u root -p ping',
-            // Unrelated tools keep their -p flags, including names that only start
-            // with a family member's name.
-            'tool -pfixture-public db',
-            'tool.exe -pfixture-public db',
-            'mysql_check -pfixture-public db',
-            'mariadb-dump-helper -pfixture-public db',
-        ])('preserves unrelated arguments: %s', (command) => {
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-    });
-    describe('inline curl configuration credentials', () => {
-        it.each([
-            `echo 'us''er = "reader:fixture-password"' | curl -K - file:///dev/null`,
-            String.raw `echo us\er=reader:fixture-password | curl -K - file:///dev/null`,
-            String.raw `echo $'u\x73er = "reader:fixture-password"' | curl -K - file:///dev/null`,
-        ])('decodes shell-encoded config names: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            `printf 'user = "reader:%s"\\n' fixture-password | curl -K - file:///dev/null`,
-            `printf 'cookie = "%s"\\n' SID=fixture-password | curl -K - file:///dev/null`,
-            `printf '%s = %s\\n' user reader:fixture-password | curl -K - file:///dev/null`,
-        ])('redacts printf credential substitutions: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            `bash -c 'echo "user = reader:fixture-password"' | curl -K - file:///dev/null`,
-            `env -S 'printf "user = reader:fixture-password"' | curl -K - file:///dev/null`,
-        ])('redacts wrapped config producers: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            `echo 'user "reader:fixture-password"' | curl -K - file:///dev/null`,
-            `echo 'user: "reader:fixture-password"' | curl -K - file:///dev/null`,
-            `echo '--user = "reader:fixture-password"' | curl -K - file:///dev/null`,
-            `echo '-u "reader:fixture-password"' | curl -K - file:///dev/null`,
-        ])('redacts alternate curl config separators: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            `echo 'proxy-user = "reader:fixture-password"' | curl -K - https://example.test`,
-            `echo 'user = "reader:fixture password"' | curl -K - https://example.test`,
-            `echo 'proxy-user="reader:fixture-password"' > cfg && curl -K cfg https://example.test`,
-            `curl -K <(echo 'user = "reader:fixture-password"') https://example.test`,
-            `echo 'cookie = "SID=fixture-password"' | curl -K - https://example.test`,
-            `echo 'cert = "client.pem:fixture-password"' | curl -K - https://example.test`,
-            `echo 'proxy-cert = "client.pem:fixture-password"' | curl -K - https://example.test`,
-            `printf '%s\\n' 'oauth2-bearer = "fixture-password"' | curl -K - https://example.test`,
-            `printf '%s\\n' 'pass = "fixture-password"' | curl -K - https://example.test`,
-            `echo 'proxy-pass = "fixture-password"' | curl -K - https://example.test`,
-        ])('redacts credential field literals: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it('keeps unrelated flags before a config producer', () => {
-            expect(sanitizeCommand(`sort -u public-file && echo 'user = reader:fixture-password' | curl -K - file:///dev/null`)).toContain('sort -u public-file');
-        });
-        it('retains noncredential curl configuration', () => {
-            const command = `echo 'proxy = proxy.test:3128' | curl -K - https://example.test`;
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-    });
-    describe('OpenSSL positional passwords and raw keys', () => {
-        it('redacts a valid raw AES key while retaining the IV', () => {
-            const key = '00112233445566778899aabbccddeeff';
-            const iv = 'ffeeddccbbaa99887766554433221100';
-            const output = sanitizeCommand(`openssl enc -aes-128-cbc -K ${key} -iv ${iv} -in public-file`);
-            expect(output).not.toContain(key);
-            expect(output).toContain(iv);
-        });
-        it.each(['curl', 'openssl', 'sshpass'])('redacts a password named %s', (password) => {
-            expect(sanitizeCommand(`openssl passwd -1 '${password}'`)).toBe('openssl passwd -1 [redacted]');
-        });
-        it.each([
-            `openssl passwd -1 'fixture-password'`,
-            `openssl passwd -6 'fixture password'`,
-            `openssl passwd -salt public-salt fixture-password`,
-            `openssl passwd -5 fixture-password fixture-other-password`,
-            `openssl passwd -- fixture-password`,
-            `openssl enc -aes-256-cbc -K fixture-key -in public-file`,
-            `openssl enc -aes-256-cbc --K=fixture-key -in public-file`,
-        ])('redacts key material: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            'openssl passwd -1 -salt public-salt -in password-source',
-            'openssl passwd -6 -stdin',
-            'openssl passwd -rand entropy-source -writerand entropy-out -stdin',
-        ])('preserves password sources and salt: %s', (command) => {
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-    });
-    describe('Codex command-redaction findings', () => {
-        it.each([
-            `printf 'variable = cred=reader:fixture-password\nexpand-user = {{cred}}\nurl = file:///dev/null\n' | curl -K -`,
-            `echo 'variable = cred=fixture-password\nexpand-oauth2-bearer = {{cred}}' | curl -K -`,
-            `printf '%s\\n' 'variable = cred=fixture-password' 'expand-header = "X-Api-Key: {{cred}}"' | curl -K -`,
-            `export CRED=fixture-password; printf 'variable = %%CRED\nexpand-user = {{CRED}}' | curl -K -`,
-        ])('redacts expanded credentials in curl config inputs: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            "env 'P.W=fixture-password' openssl enc -pass env:P.W",
-            "env 'P-W=fixture-password' openssl enc -pass env:P-W",
-            "env 'P W=fixture-password' openssl enc -pass 'env:P W'",
-        ])('redacts non-shell environment names: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            'openssl s_client -srppass fixture-password -connect example.test:443',
-            'openssl s_client -srppass=fixture-password -connect example.test:443',
-            'openssl cms -pwri_password fixture-password -encrypt -in /dev/null',
-            'openssl dgst -hmac fixture-password /dev/null',
-        ])('redacts other OpenSSL password/key flags: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it('redacts CMS key bytes while keeping their public identifier', () => {
-            const key = '0'.repeat(32);
-            expect(sanitizeCommand(`openssl cms -secretkey ${key} -secretkeyid public-id`)).toBe('openssl cms -secretkey [redacted] -secretkeyid public-id');
-        });
-        it.each([
-            'curl -u reader:$(printf fixture-password) https://example.test',
-            'sshpass -p$(printf fixture-password) ssh deploy@host',
-            'openssl enc -pass pass:$(printf fixture-password)',
-            'curl -u reader:`printf fixture-password` https://example.test',
-            'sshpass -p`printf fixture-password` ssh deploy@host',
-            'curl -u reader:$(printf "%s" "$(printf fixture-password)") https://example.test',
-            "curl -u reader:$(printf ')%s' fixture-password) https://example.test",
-            'curl -u "reader:$(printf fixture-password)" https://example.test',
-            "bash -c 'curl -u reader:$(printf fixture-password) https://example.test'",
-            'curl -u reader:$(printf fixture-password',
-        ])('redacts command-substitution bodies in credential words: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            'openssl rand -out passwd 16',
-            'openssl x509 -in passwd -noout -text',
-            'openssl cms -secretkeyid public-key-id -help',
-            `echo 'variable = host=example.test\nexpand-url = https://{{host}}' | curl -K -`,
-        ])('preserves subcommand arguments and public config expansions: %s', (command) => {
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-        it.each([
-            'curl --variable cred=reader:fixture-password --expand-user {{cred}} file:///dev/null',
-            'curl --variable=cred=reader:fixture-password --expand-proxy-user={{cred}} https://example.test',
-            "curl --variable 'cred=fixture password' --expand-oauth2-bearer '{{cred:trim}}' https://example.test",
-            'curl --variable cred=fixture-password --expand-header "X-Api-Key: {{cred}}" https://example.test',
-            'curl --variable cred=fixture-password --expand-data "password={{cred}}" https://example.test',
-            'curl --variable cred=fixture-password --expand-url "https://reader:{{cred}}@example.test"',
-            'curl --variable cred=fixture-password --expand-url "https://example.test/#access_token={{cred}}"',
-            'curl --variable cred=fixture-password --expand-variable login=reader:{{cred}} --expand-user {{login}} file:///dev/null',
-            'curl --variable raw=reader:fixture-password@example.test --expand-variable alias={{raw}} --expand-url {{alias}}',
-            'curl --variable raw=reader:fixture-password@example.test --expand-url {{raw}} --variable raw=example.test',
-            'CRED=fixture-password curl --variable %CRED --expand-oauth2-bearer {{CRED}} https://example.test',
-            'curl --variable %CRED=fixture-password --expand-oauth2-bearer {{CRED}} https://example.test',
-            'curl --variable cred[0-99]=fixture-password --expand-oauth2-bearer {{cred}} https://example.test',
-        ])('redacts expanded curl credentials at their source: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            'P=fixture-password openssl enc -aes-256-cbc -pass env:P -in /dev/null -out /dev/null',
-            "env 'P=fixture password' openssl enc -pass env:P",
-            'P+=fixture-password openssl enc -pass env:P',
-            'printf fixture-password | openssl enc -pass stdin',
-            'printf "%s\\n" fixture-password | openssl enc -pass stdin',
-            "printf fixture-password | sh -c 'openssl enc -pass stdin'",
-            'printf fixture-password > pass-source; openssl enc -pass file:pass-source',
-            'openssl enc -pass fd:3 3< <(printf fixture-password)',
-            'openssl enc -pass file:<(printf fixture-password)',
-            'openssl enc -pass stdin <<< fixture-password',
-            'printf fixture-password > pass-source; openssl enc -kfile pass-source',
-            'printf fixture-password | openssl passwd -stdin',
-            'printf fixture-password > pass-source; openssl passwd -in pass-source',
-            'P=$(printf fixture-password) openssl enc -pass env:P',
-        ])('redacts literal OpenSSL passphrase producers: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            'HTTPS_PROXY+=reader:fixture-password@proxy.test:3128 curl https://example.test',
-            "ALL_PROXY+='reader:fixture password@proxy.test:3128' curl https://example.test",
-        ])('redacts appended proxy assignments: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-            expect(sanitizeCommand(command)).toContain('proxy.test:3128');
-        });
-        it.each([
-            'openssl passwd -provider default -stdin',
-            'openssl passwd -provider-path /public/providers -provider default -stdin',
-            'openssl passwd -propquery provider=default -stdin',
-            'openssl passwd -provparam public=value -stdin',
-            'echo "user = reader:public-value"; ssh -K host; curl https://example.test',
-            'curl https://example.test; ssh -K host; echo "user = reader:public-value"',
-            'echo "user = reader:public-value"; curl -o -K https://example.test',
-            'curl --variable host=example.test --expand-url "https://{{host}}/public"',
-            'curl --variable name=public --expand-output {{name}} https://example.test',
-            'echo public-value; openssl enc -pass stdin',
-            'echo public-value; openssl enc -pass env:P',
-        ])('preserves public option values and unrelated commands: %s', (command) => {
-            expect(sanitizeCommand(command)).toBe(command);
-        });
-        it.each([
-            'TOOL=/usr/bin/openssl curl -u reader:fixture-password https://example.test',
-            'sudo -u openssl curl -u reader:fixture-password https://example.test',
-            'env -u openssl curl -u reader:fixture-password https://example.test',
-            '/usr/bin/time -o openssl curl -u reader:fixture-password https://example.test',
-            'xargs -a openssl curl -u reader:fixture-password https://example.test',
-        ])('does not select a client from wrapper option values: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each([
-            'curl https://example.test/openssl -u reader:fixture-password',
-            'curl -o openssl -u reader:fixture-password https://example.test',
-            'http example.test/sshpass --auth reader:fixture-password',
-            'curl --output sshpass --proxy-user reader:fixture-password https://example.test',
-            'sshpass -p fixture-first curl -u reader:fixture-password https://example.test',
-        ])('keeps client identity across argument names: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-        it.each(['url', 'preproxy', 'socks4', 'socks4a', 'socks5', 'socks5-hostname'])('redacts userinfo in the %s config field and flag', (key) => {
-            for (const command of [
-                `echo '${key} = reader:fixture-password@proxy.test:3128' | curl -K -`,
-                `curl --${key} reader:fixture-password@proxy.test:3128 https://example.test`,
-            ]) {
-                expect(sanitizeCommand(command)).not.toContain('fixture');
-                expect(sanitizeCommand(command)).toContain('proxy.test:3128');
-            }
-        });
-        it.each([
-            `echo 'user = reader:fixture-password' | bash -c 'curl -K - https://example.test'`,
-            `printf 'cookie = "%s"' SID=fixture-password | env -S 'curl -K - https://example.test'`,
-            `echo 'user = reader:fixture-password' | sh -c "bash -c 'curl -K - https://example.test'"`,
-        ])('detects nested config consumers from outer producers: %s', (command) => {
-            expect(sanitizeCommand(command)).not.toContain('fixture');
-        });
-    });
-});
-describe('credential-tool names outside command position', () => {
-    // A path argument whose basename spells a credential tool names a file, not an
-    // invocation: the words after it keep their meaning.
-    it.each([
-        'cat ./bin/curl -u reader:visible',
-        'ls ./bin/curl image:tag@sha256:abc123',
-        'cat scripts/http image:tag@sha256:abc123',
-        'chmod +x ./bin/openssl -k visible-file',
-        'grep -r key /etc/openssl -K visible-file',
-        'cat bin/mysql -pvisible',
-        'cat tools/redis-cli -a visible-file',
-        'cat bin/sshpass -p visible-file',
-        'sudo cat ./bin/curl -u reader:visible',
-        'sudo -u deploy env MODE=1 cat ./bin/curl -u reader:visible',
-        'sudo -E cat ./bin/curl -u reader:visible',
-        'sudo --preserve-env=HOME cat ./bin/curl -u reader:visible',
-        'env -i cat ./bin/curl -u reader:visible',
-        'xargs -0 cat ./bin/curl -u reader:visible',
-        'time -p cat ./bin/curl -u reader:visible',
-        '/usr/bin/cat ./bin/curl -u reader:visible',
-    ])('keeps the arguments of a program that never runs them: %s', (command) => {
-        expect(sanitizeCommand(command)).toBe(command);
-    });
-    it('does not read curl configuration from a file argument named curl', () => {
-        const command = 'cat bin/curl -K cfg; echo user = reader:visible';
-        expect(sanitizeCommand(command)).toBe(command);
-    });
-    it.each(['echo', 'printf'])('does not treat a file argument named %s as a configuration producer', (producer) => {
-        const command = `curl -K cfg https://example.test; ls bin/${producer} -u reader:visible`;
-        expect(sanitizeCommand(command)).toBe(command);
-    });
-    const familyInvocations = [
-        ['curl', 'curl -u reader:fixture-password https://example.test'],
-        ...['http', 'https', 'httpie'].map((tool) => [tool, `${tool} -a reader:fixture-password example.test`]),
-        ['openssl', 'openssl enc -aes-256-cbc -pass pass:fixture-password -in public-file'],
-        ['sshpass', 'sshpass -p fixture-password ssh deploy@host'],
-        ...['redis-cli', 'valkey-cli'].map((tool) => [tool, `${tool} -a fixture-password get k`]),
-        ...[
-            'mysql',
-            'mariadb',
-            'mysqldump',
-            'mysqladmin',
-            'mariadb-dump',
-            'mariadb-admin',
-        ].map((tool) => [tool, `${tool} -pfixture-password db`]),
-    ];
-    it.each(familyInvocations)('still redacts a real /usr/bin/%s invocation', (_, command) => {
-        for (const prefix of [
-            '/usr/bin/',
-            'cat notes.txt && /usr/bin/',
-            'sudo /usr/bin/',
-        ]) {
-            const output = sanitizeCommand(`${prefix}${command}`);
-            expect(output).not.toContain('fixture-password');
-            expect(output).toContain('[redacted]');
-        }
-    });
-    it.each([
-        'watch -n 5 curl -u reader:fixture-password https://example.test',
-        String.raw `find . -exec /usr/bin/curl -u reader:fixture-password https://example.test \;`,
-        'ssh deploy@host /usr/bin/curl -u reader:fixture-password https://example.test',
-        'xargs /usr/bin/curl -u reader:fixture-password https://example.test',
-        'echo curl -u reader:fixture-password',
-        // A wrapper option the table does not model may take the next word as its
-        // value, so that word is not trusted as the program the wrapper runs.
-        'xargs --process-slot-var cat curl -u reader:fixture-password https://example.test',
-        'sudo -U cat curl -u reader:fixture-password https://example.test',
-        'env -P ls curl -u reader:fixture-password https://example.test',
-        'sudo -U env cat curl -u reader:fixture-password https://example.test',
-        // A local script named like a listed program may run anything.
-        './tools/diff curl -u reader:fixture-password https://example.test',
-        '/opt/bin/cat curl -u reader:fixture-password https://example.test',
-        'cat x; sudo -u root ./scripts/cat curl -u reader:fixture-password https://example.test',
-        // A redirection operand names a file, not the command that runs.
-        '>file curl -u reader:fixture-password https://example.test',
-        '< cat curl -u reader:fixture-password https://example.test',
-        '>|ls /usr/bin/curl -u reader:fixture-password https://example.test',
-        '>file echo user = reader:fixture-password | curl -K - https://example.test',
-        // A backtick substitution runs its own command under any outer one.
-        'cat `/usr/bin/curl -u reader:fixture-password https://example.test`',
-    ])('still redacts a tool dispatched by a program it does not model: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('fixture-password');
-    });
-});
-describe('backtick command substitutions', () => {
-    // One command per credential-tool family, plus a URI and an assignment.
-    const bodies = [
-        'curl -u reader:fixture-visible https://example.test',
-        'http -a reader:fixture-visible https://example.test',
-        'openssl enc -aes-256-cbc -pass pass:fixture-visible -in notes.txt',
-        'sshpass -p fixture-visible ssh deploy@host',
-        'redis-cli -a fixture-visible ping',
-        'valkey-cli --pass fixture-visible ping',
-        'mysql -pvisible app',
-        'curl https://reader:fixture-visible@example.test',
-        'redis-cli -u redis://reader:fixture-visible@cache.test ping',
-        'TOKEN=fixture-visible ./deploy',
-        'tool --password fixture-visible',
-    ];
-    const forms = [
-        ['after echo', (body) => `echo \`${body}\``],
-        ['after cat', (body) => `cat \`${body}\``],
-        ['as the command', (body) => `\`${body}\``],
-        ['as an assignment value', (body) => `out=\`${body}\``],
-        ['inside double quotes', (body) => `echo "\`${body}\`"`],
-        ['inside single quotes', (body) => `echo '\`${body}\`'`],
-        ['escaped', (body) => `echo \\\`${body}\\\``],
-        ['nested', (body) => `echo \`echo \\\`${body}\\\`\``],
-        ['after a separator inside', (body) => `echo \`cd /tmp; ${body}\``],
-        ['after a pipe inside', (body) => `echo \`true | ${body}\``],
-        ['inside $(…)', (body) => `echo $(echo \`${body}\`)`],
-        ['inside <(…)', (body) => `diff <(echo \`${body}\`) notes.txt`],
-        ['unterminated', (body) => `echo \`${body}`],
-    ];
-    it.each(forms.flatMap(([form, wrap]) => bodies.map((body) => [form, wrap(body)])))('redacts a credential in a backtick substitution %s: %s', (_, command) => {
-        const output = sanitizeCommand(command);
-        expect(output).not.toContain('visible');
-        expect(output).toContain('[redacted]');
-    });
-    it('keeps the rest of the substitution, as for $(…)', () => {
-        expect(sanitizeCommand('echo `curl -u reader:fixture-visible https://example.test`')).toBe('echo `curl -u [redacted] https://example.test`');
-        expect(sanitizeCommand('echo `mysql -pvisible app` done')).toBe('echo `mysql -p[redacted] app` done');
-        expect(sanitizeCommand('echo \\`curl -u reader:fixture-visible https://example.test\\`')).toBe('echo \\`curl -u [redacted] https://example.test\\`');
-        expect(sanitizeCommand('echo `echo \\`curl -u reader:fixture-visible https://example.test\\``')).toBe('echo `echo \\`curl -u [redacted] https://example.test\\``');
-        // Escapes the body carried come back as they were written.
-        expect(sanitizeCommand("echo `printf 'a\\nb'; echo \\$HOME; curl -u reader:fixture-visible https://example.test`")).toBe("echo `printf 'a\\nb'; echo \\$HOME; curl -u [redacted] https://example.test`");
-    });
-    it('redacts everything after an unterminated backtick', () => {
-        expect(sanitizeCommand('echo `curl -u reader:fixture-visible https://example.test')).toBe('echo `[redacted]');
-        expect(sanitizeCommand('echo `date` `printf fixture-visible')).toBe('echo `date` `[redacted]');
-    });
-    it('links curl config across the substitution boundary', () => {
-        for (const command of [
-            'echo `echo user = reader:fixture-visible | curl -K - https://example.test`',
-            '`echo user = reader:fixture-visible` | curl -K - https://example.test',
-            'echo user = reader:fixture-visible | `curl -K - https://example.test`',
-        ]) {
-            const output = sanitizeCommand(command);
-            expect(output).not.toContain('visible');
-        }
-    });
-    // Redacting the body must not hide which outer assignment it reads.
-    it.each([
-        `export VALUE=fixture-visible; echo \`sh -c 'curl --variable %VALUE --expand-header "Authorization: {{VALUE}}" https://example.test'\``,
-        `export VALUE=fixture-visible; echo \`curl --variable %VALUE --expand-header "Authorization: {{VALUE}}" https://example.test\``,
-    ])('redacts an outer assignment a substitution expands: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // A substitution inside a word must not split the word from its reference.
-    it.each([
-        'export VALUE=:fixture-visible; sh -c "curl --variable %VALUE --expand-user `whoami`{{VALUE}} https://example.test"',
-        'export VALUE=:fixture-visible; curl --variable %VALUE --expand-user `whoami`{{VALUE}} https://example.test',
-    ])('redacts an assignment a word expands after a substitution: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // Rewriting part of a body must not strand a header's value.
-    it.each([
-        'echo \'`echo "`curl -H "Authorization: fixture-visible" https://example.test`"`\'',
-        'echo `echo "`curl -H "Authorization: fixture-visible" https://example.test`"`',
-        'TOKEN=`date`; echo `echo "`curl -H "Authorization: fixture-visible" https://example.test`"`',
-    ])('redacts a header split across substitution bodies: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // A substitution elsewhere must not hide which curl variable a header reads.
-    it.each([
-        'curl --variable value=fixture-visible --expand-header "Authorization: {{value}}" https://example.test; echo `date`',
-        'curl --variable value=fixture-visible --expand-url "https://u:{{value}}@example.test" `date`',
-        'curl --variable value=fixture-visible --expand-url "https://example.test/?token={{value}}" `date`',
-    ])('redacts an inline curl variable beside a substitution: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // A substitution elsewhere must not cut a quoted value short in a script.
-    it.each([
-        'sh -c "tool --password \\"a fixture-visible\\""; echo `date`',
-        'sh -c "curl -H \\"Authorization: Bearer a fixture-visible\\" https://example.test"; echo `date`',
-    ])('redacts a spaced value in an escaped script beside a substitution: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // Inside double quotes a backtick body also escapes `"`.
-    it.each([
-        'sh -c "echo `tool --password \\"a fixture-visible\\"`"',
-        'echo "`tool --password \\"a fixture-visible\\"`"',
-    ])('redacts a spaced value in a double-quoted substitution: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // Bash ends a body at the first unescaped backtick: single quotes inside it
-    // hide none, and an escaped one is part of the body.
-    it.each([
-        'echo "`sh -c \'echo \\`tool --password \\"a fixture-visible\\"\\`\'`"',
-        'echo `sh -c \'echo \\`tool --password "a fixture-visible"\\`\'`',
-        'echo "`sh -c \'echo \\`curl -u reader:fixture-visible https://example.test\\`\'`"',
-    ])('redacts a body whose escaped backtick sits in single quotes: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // The word a header value continues into is still the value.
-    it.each([
-        'curl -H "Cookie: sid=fixture-visible"more-visible https://example.test; echo `date`',
-        'curl -H "Cookie: sid=fixture-visible"more-visible `date`',
-        'echo "Cookie: sid=fixture-visible"more-visible `date`',
-        // Redacting the first header early must not strand the second.
-        'x= "Cookie: sid=fixture-visible""Authorization: {{VALUE}}" PASSWORD="`id`" { "Cookie: sid=fixture-visible"',
-    ])('redacts a header value that runs past its quote beside a substitution: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    // Quoting the parser cannot follow leaves a backtick on the tool's word.
-    it.each([
-        "echo '`curl -u reader:fixture-visible https://example.test",
-        'echo ``curl -u reader:fixture-visible https://example.test',
-        "echo `echo '`' `curl -u reader:fixture-visible https://example.test`",
-    ])('redacts a tool whose word carries a backtick: %s', (command) => {
-        expect(sanitizeCommand(command)).not.toContain('visible');
-    });
-    it.each([
-        'echo `date`',
-        'git checkout `git rev-parse HEAD`',
-        'cat `which curl`',
-        'ls `pwd`/notes',
-        'echo "`whoami`"',
-        // A quoted word with a space inside a body is not an unterminated backtick.
-        'x=`date "+%Y %m"`',
-        'echo `echo "a b"`',
-        "echo `echo 'a b'`",
-        'echo "`date "+%Y %m"`"',
-        String.raw `echo "a \` b"`,
-        String.raw `echo \`date\``,
-    ])('leaves a substitution with no credential unchanged: %s', (command) => {
-        expect(sanitizeCommand(command)).toBe(command);
+describe('executable-only command evidence', () => {
+    it.each([
+        ['git diff -- apps/private.txt', 'git'],
+        ['bun run test && curl --token fixture-private', 'bun'],
+        ['curl -u fixture-user:fixture-password https://private.test', 'curl'],
+        ["sh -c 'curl --token fixture-private'", 'sh'],
+        ['sudo -u fixture-private git status', 'sudo'],
+        ['env PASSWORD=fixture-private node script.js', 'env'],
+        ['  \n\tpython3 -c "print(123)"', 'python3'],
+        ['cat <<EOF\nfixture-private\nEOF', 'cat'],
+        ['mysql Cookie: sid=fixture-private" \t\\--token\t"--secret"--a', 'mysql'],
+        ["'--token' 'fixture-private Cookie: sid=fixture-private'", '[command withheld]'],
+        [
+            "'--passwd' $(fixture-private )Authorization: fixture-private",
+            '[command withheld]',
+        ],
+    ])('omits all arguments and nested source from %s', (source, expected) => {
+        expect(sanitizeCommand(source)).toBe(expected);
+        expect(sanitizeCommand(source)).not.toContain('fixture-private');
+    });
+    it.each([
+        '',
+        'fixture-private',
+        'fixture-private --token value',
+        'PASSWORD=fixture-private git status',
+        '/private/path/git status',
+        "'git' status",
+        'g\\it status',
+        '$(fixture-private)',
+        '`fixture-private`',
+        'gitfixture-private',
+        'git=fixture-private',
+        'git.exe fixture-private',
+        '"git fixture-private',
+        'git\\ fixture-private',
+        '# fixture-private\ngit status',
+        ' '.repeat(128) + 'git status',
+        'g'.repeat(100_000),
+    ])('withholds unsupported source without echoing it: %s', (source) => {
+        expect(sanitizeCommand(source)).toBe('[command withheld]');
+    });
+    it('does not inspect or preserve a large argument body', () => {
+        expect(sanitizeCommand('curl ' + 'fixture-private'.repeat(100_000))).toBe('curl');
     });
 });
 //# sourceMappingURL=sanitize-command.test.js.map