@mossbear/eval-core 0.1.0-alpha.69 → 0.1.0-alpha.71

package/dist/sanitize-command.js

@@ -2,15 +2,16 @@
  * Secret redaction and length-capping for shell command text.
  *
  * Command text can embed secrets or whole file bodies (heredocs, inline env
- * vars). The CLI runs every logged command through this before it becomes an
- * action summary, so nothing that leaves the machine carries credentials or
- * bulk file content (`packages/cli/src/action-queue.ts`). File contents are
- * never read or included in the first place.
+ * vars). The CLI runs logged commands through this before creating an action
+ * summary. Recognized credential syntax is removed; arbitrary shell/tool
+ * programs remain an open language, so pattern scanning cannot prove that
+ * every surviving argument is credential-free.
  *
  * Lives in eval-core rather than the CLI because grading is what consumes the
  * result: this is the boundary that decides what a grader may ever see of a
  * command.
  */
+import { COOKIE_HEADER_SOURCE, SENSITIVE_KEY_SOURCE, SENSITIVE_WORD_SOURCE, SHELL_WORD_SOURCE, } from './credential-patterns.js';
 import { PRIVATE_KEY_BLOCK_SOURCE, REDACTED } from './redaction.js';
 /**
  * Maximum characters of a single command string that survive redaction.
@@ -19,6 +20,200 @@ import { PRIVATE_KEY_BLOCK_SOURCE, REDACTED } from './redaction.js';
  * must not leave the machine.
  */
 const MAX_COMMAND_CHARS = 200;
+// SSHPASS is sshpass's dedicated environment credential, despite not
+// containing the usual password/token spelling.
+const COMMAND_SENSITIVE_KEY_SOURCE = `(?:${SENSITIVE_KEY_SOURCE}|SSHPASS)`;
+const SENSITIVE_KEY = new RegExp(`^${COMMAND_SENSITIVE_KEY_SOURCE}$`, 'i');
+const SENSITIVE_CONTENT = new RegExp(SENSITIVE_WORD_SOURCE, 'i');
+// Only switches that consume no argument may precede an argument flag in
+// curl's short-option clusters. For example, -sx is proxy auth, while -osx
+// names an output file and must not be interpreted as a proxy option.
+const CURL_SHORT_SWITCHES = '[012346aBfgGiIjJklLMnNOpqRsSvVZ:#]*';
+const CURL_PAYLOAD_FLAG = new RegExp(`^(-${CURL_SHORT_SWITCHES}[dHF])(.+)?$|^(--(?:data|data-raw|data-binary|data-urlencode|json|form|form-string|header|proxy-header))(?:=(.*))?$`);
+const CURL_CONFIG_FLAG = new RegExp(`^(?:-${CURL_SHORT_SWITCHES}K|--config(?:=|$))`);
+const CURL_URL_OPTIONS = 'url|proxy|proxy1\\.0|preproxy|socks4|socks4a|socks5|socks5-hostname';
+const CURL_URL_FIELD = new RegExp(`^(?:${CURL_URL_OPTIONS})$`, 'i');
+const CREDENTIAL_TOOLS = ['curl', 'http', 'https', 'httpie', 'openssl', 'sshpass'];
+// Valued wrapper options name users, files or scripts, never the child tool.
+const WRAPPER_VALUE_FLAGS = {
+    sudo: /^-(?:[AbEHIKknPSVbveis]*[ughpDTRCrt])(.+)?$|^--(?:user|group|host|prompt|chdir|chroot|command-timeout|close-from|role|type)(?:=(.*))?$/,
+    doas: /^-[uC](.+)?$/,
+    env: /^-[uCSa](.+)?$|^--(?:unset|chdir|split-string|argv0)(?:=(.*))?$/,
+    time: /^-[of](.+)?$|^--(?:output|format)(?:=(.*))?$/,
+    xargs: /^-[adEILnPs](.+)?$|^--(?:arg-file|delimiter|eof|replace|max-lines|max-args|max-procs|max-chars)(?:=(.*))?$/,
+};
+const CURL_AUTH_OPTIONS = `user|proxy-user|${CURL_URL_OPTIONS}|cookie|oauth2-bearer|cert|proxy-cert|pass|proxy-pass`;
+const CURL_AUTH_FLAG = new RegExp(`^(-${CURL_SHORT_SWITCHES}[uUbEx])(.+)?$|^(--(?:${CURL_AUTH_OPTIONS}))(?:=(.*))?$`);
+const CURL_EXPANSION = /\{\{([A-Za-z0-9_]+)(?::[^{}]*)?\}\}/g;
+const CURL_EXPAND_FLAG = new RegExp(`^--expand-(${CURL_AUTH_OPTIONS}|header|proxy-header|data|data-raw|data-binary|data-urlencode|json|form|form-string)(?:=(.*))?$`);
+function hasPrivateConfigVariables(body) {
+    if (!/\b(?:expand-)?variable\s*[=: \t]/i.test(body))
+        return false;
+    if (/\bexpand-(?:user|proxy-user|oauth2-bearer|cookie|cert|proxy-cert|pass|proxy-pass|header|proxy-header|data(?:-raw|-binary|-urlencode)?|json|form(?:-string)?)\s*[=: \t]/i.test(body))
+        return true;
+    return (/\bexpand-(?:url|proxy|preproxy|socks[45](?:a|-hostname)?)\s*[=: \t]/i.test(body) &&
+        (/[^/\s:@]+:[^@\s]*@/.test(body) ||
+            new RegExp(`[?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=`, 'i').test(body)));
+}
+function decodeShellWord(word) {
+    return word.replace(/\$'((?:\\[\s\S]|[^'\\])*)'|'([^']*)'|"((?:\\.|[^"\\])*)"|\\([\s\S])|([^'"\\]+)/g, (_, ansi, single, double, escaped, plain) => {
+        if (ansi !== undefined)
+            return ansi.replace(/\\(?:x([\da-f]{1,2})|u([\da-f]{1,4})|U([\da-f]{1,8})|([0-7]{1,3})|([\s\S]))/gi, (escape, hex, unicode, wide, octal, character) => {
+                if (hex || unicode || wide || octal) {
+                    const code = Number.parseInt(hex ?? unicode ?? wide ?? octal, octal ? 8 : 16);
+                    return code <= 0x10ffff ? String.fromCodePoint(code) : escape;
+                }
+                const controls = {
+                    a: '\x07',
+                    b: '\b',
+                    e: '\x1b',
+                    E: '\x1b',
+                    f: '\f',
+                    n: '\n',
+                    r: '\r',
+                    t: '\t',
+                    v: '\v',
+                };
+                return controls[character] ?? (/['"\\?]/.test(character) ? character : escape);
+            });
+        if (single !== undefined)
+            return single;
+        if (double !== undefined)
+            return double.replace(/\\([$`"\\\n])/g, (_, character) => character === '\n' ? '' : character);
+        return escaped ?? plain ?? '';
+    });
+}
+/** A program supplying a credential argument carries private produced content. */
+function redactCommandSubstitutions(command) {
+    const marker = '__SUBSTITUTION_BOUNDARY__';
+    if (command.includes(marker))
+        return REDACTED;
+    const isCredentialInput = (start, end) => {
+        const probe = command.slice(0, start) + marker + command.slice(end + 1);
+        const inputs = getToolInputs(probe);
+        let redacted = redactCredentialAssignments(redactToolArguments(redactJsonArguments(probe), inputs), inputs);
+        for (const [pattern, replacement] of COMMAND_REDACTIONS)
+            redacted = redacted.replace(pattern, replacement);
+        return !redacted.includes(marker);
+    };
+    const findEnd = (start, closing, depth) => {
+        if (depth > 8)
+            return command.length;
+        let quote = null;
+        let groups = 0;
+        for (let index = start; index < command.length; index += 1) {
+            const char = command[index];
+            if (char === '\\' && quote !== "'") {
+                index += 1;
+                continue;
+            }
+            if (closing === '`' && char === '`')
+                return index;
+            if (quote === "'") {
+                if (char === "'")
+                    quote = null;
+                continue;
+            }
+            if (char === '$' && command[index + 1] === '(') {
+                index = findEnd(index + 2, ')', depth + 1);
+                continue;
+            }
+            if (char === '`') {
+                index = findEnd(index + 1, '`', depth + 1);
+                continue;
+            }
+            if (char === "'" && quote === null)
+                quote = "'";
+            else if (char === '"')
+                quote = quote === '"' ? null : '"';
+            else if (quote === null && char === '(')
+                groups += 1;
+            else if (quote === null && char === ')') {
+                if (groups === 0 && closing === ')')
+                    return index;
+                groups -= 1;
+            }
+        }
+        return command.length;
+    };
+    let quote = null;
+    let out = '';
+    let substitutions = 0;
+    for (let index = 0; index < command.length; index += 1) {
+        const char = command[index];
+        if (char === '\\' && quote !== "'") {
+            out += command.slice(index, index + 2);
+            index += 1;
+            continue;
+        }
+        if (quote !== "'" && (char === '`' || (char === '$' && command[index + 1] === '('))) {
+            if (++substitutions > 64)
+                return out + REDACTED;
+            const start = index;
+            index = findEnd(index + (char === '`' ? 1 : 2), char === '`' ? '`' : ')', 0);
+            out += isCredentialInput(start, index) ? REDACTED : command.slice(start, index + 1);
+            continue;
+        }
+        if (char === "'" && quote !== '"')
+            quote = quote === "'" ? null : "'";
+        else if (char === '"' && quote !== "'")
+            quote = quote === '"' ? null : '"';
+        out += char;
+    }
+    return out;
+}
+function hasSensitiveContent(text) {
+    // Even malformed JSON may spell a key with unicode escapes.
+    return SENSITIVE_CONTENT.test(text.replace(/\\u([0-9a-f]{4})/gi, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))));
+}
+function redactJsonValue(value, depth = 0) {
+    // Bound traversal independently of the later command-length cap. Deep
+    // payloads are content, so dropping a subtree is the conservative answer.
+    if (depth > 20)
+        return REDACTED;
+    if (typeof value === 'string' && /^\s*[[{]/.test(value)) {
+        try {
+            const parsed = JSON.parse(value);
+            const redacted = JSON.stringify(redactJsonValue(parsed, depth + 1));
+            return redacted === JSON.stringify(parsed) ? value : redacted;
+        }
+        catch {
+            return hasSensitiveContent(value) ? REDACTED : value;
+        }
+    }
+    if (Array.isArray(value))
+        return value.map((item) => redactJsonValue(item, depth + 1));
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        SENSITIVE_KEY.test(key) ? REDACTED : redactJsonValue(item, depth + 1),
+    ]));
+}
+function redactJsonArguments(command) {
+    return command.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (argument) => {
+        // Shell double quotes only consume escapes for these characters. JSON's
+        // string decoder rejects valid shell escapes such as \$, so decode the
+        // shell layer before parsing the request body.
+        const raw = decodeShellWord(argument);
+        if (!/^\s*[[{]/.test(raw))
+            return argument;
+        try {
+            const parsed = JSON.parse(raw);
+            const redacted = JSON.stringify(redactJsonValue(parsed));
+            if (redacted === JSON.stringify(parsed))
+                return argument;
+            return argument.startsWith("'") ? `'${redacted}'` : JSON.stringify(redacted);
+        }
+        catch {
+            // A JSON-like payload that cannot be decoded may still contain escaped
+            // credential keys. Drop its contents rather than scan partial syntax.
+            if (!hasSensitiveContent(raw))
+                return argument;
+            return argument.startsWith("'") ? `'${REDACTED}'` : `"${REDACTED}"`;
+        }
+    });
+}
 /**
  * Redactions applied to command text, in order: heredoc bodies (bulk inline
  * file content), private-key blocks, URL userinfo credentials, Authorization
@@ -28,6 +223,7 @@ const MAX_COMMAND_CHARS = 200;
  * the length cap below is the backstop for anything these patterns miss.
  */
 const COMMAND_REDACTIONS = [
+    [new RegExp(`(<<<\\s*)${SHELL_WORD_SOURCE}`, 'g'), `$1${REDACTED}`],
     // Heredoc: `cmd <<[-]['"]?WORD['"]? \n <body> \n WORD`. The body is inline
     // file content (secrets, source) that must never leave the machine — replace
     // it wholesale, keeping only the delimiters. Runs first so a heredoc'd
@@ -41,7 +237,25 @@ const COMMAND_REDACTIONS = [
     ],
     [new RegExp(PRIVATE_KEY_BLOCK_SOURCE, 'g'), REDACTED],
     [/\b([a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:)[^@\s]+@/gi, `$1${REDACTED}@`],
-    [/\b(authorization\s*:\s*)(?:bearer\s+)?\S+/gi, `$1${REDACTED}`],
+    [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+@/gi, `$1${REDACTED}@`],
+    [/\b(authorization\s*:\s*)(?:(?:bearer|basic|token)\s+)?\S+/gi, `$1${REDACTED}`],
+    [new RegExp(COOKIE_HEADER_SOURCE, 'gi'), `$1${REDACTED}`],
+    [
+        new RegExp(`([?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=)[^&\\s"'<>]+`, 'gi'),
+        `$1${REDACTED}`,
+    ],
+    // Space-separated credential flags have no assignment operator or token
+    // prefix. Keep the flag for evidence, but never its value.
+    [
+        new RegExp(`(^|[\\s;&|(])(--${COMMAND_SENSITIVE_KEY_SOURCE}\\s+)${SHELL_WORD_SOURCE}`, 'gi'),
+        `$1$2${REDACTED}`,
+    ],
+    // JSON bodies embedded in shell commands are still command text. Quoted
+    // keys evade the shell-assignment scanner below, including escaped values.
+    [
+        new RegExp(`("${COMMAND_SENSITIVE_KEY_SOURCE}"\\s*:\\s*)"(?:\\\\.|[^"\\\\])*"`, 'gi'),
+        `$1"${REDACTED}"`,
+    ],
     // Sensitive assignment: an env-var-ish key (the sensitive word optionally
     // wrapped in `DB_…` / `…_FILE` segments, so `DB_PASSWORD`/`OPENAI_API_KEY`
     // match, not just a bare word) followed by `=`/`:` and a value that is a
@@ -50,7 +264,7 @@ const COMMAND_REDACTIONS = [
     // never fires mid-word; the whole value — quotes included — is redacted so
     // whitespace-containing passphrases can't slip through.
     [
-        /(^|[\s;&|(])([\w.-]*(?:api[_-]?key|access[_-]?key|secret[_-]?key|client[_-]?secret|token|secret|passw(?:or)?d|credentials?)[\w.-]*\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s]+)/gi,
+        new RegExp(`(^|[\\s;&|(])(${COMMAND_SENSITIVE_KEY_SOURCE}\\s*[=:]\\s*)${SHELL_WORD_SOURCE}`, 'gi'),
         `$1$2${REDACTED}`,
     ],
     // Our own CLI token (`API_KEY_PREFIX`, the prefix the dashboard mints CLI
@@ -76,6 +290,556 @@ const COMMAND_REDACTIONS = [
     [/\bxox[baprs]-[A-Za-z0-9-]{8,}/g, REDACTED],
     [/\bAKIA[0-9A-Z]{16}\b/g, REDACTED],
 ];
+/**
+ * Proxy addresses take userinfo with or without a URL scheme, so the general
+ * URL rule cannot see the scheme-less form. A bare `a:b@c` is not matched
+ * everywhere because ordinary text has that shape too (`image:tag@sha256:…`);
+ * only values in HTTP-client commands or proxy assignments are checked.
+ */
+const PROXY_USERINFO = /^((?:[a-z][a-z\d+.-]*:\/\/)?[^/?#:@]*:)[^/?#]*@/i;
+/**
+ * Redact the password from proxy environment assignments (`https_proxy=`,
+ * `ALL_PROXY=`, …), which HTTP clients read at startup. Keeps the user and
+ * host, matching the URL-userinfo rule, and leaves unauthenticated values as
+ * they are. Other inline curl authentication fields lose their whole value.
+ */
+function redactCredentialAssignments(command, inputs) {
+    let assignments = command.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
+        // `env` accepts a quoted whole NAME=value argument. Decode the complete
+        // word before identifying its key, just as for shell-encoded options.
+        const assignment = /^([^=\0]+)=([\s\S]*)$/.exec(decodeShellWord(word));
+        if (!assignment)
+            return word;
+        let key = assignment[1];
+        let operator = '=';
+        const proxy = assignment[2];
+        if (key.endsWith('+') && !inputs.env.has(key)) {
+            key = key.slice(0, -1);
+            operator = '+=';
+        }
+        if (inputs.env.has(key))
+            return `${key}${operator}${REDACTED}`;
+        if (!/^(?:\w+_)?proxy$/i.test(key))
+            return word;
+        if (!PROXY_USERINFO.test(proxy))
+            return word;
+        const redacted = proxy.replace(PROXY_USERINFO, `$1${REDACTED}@`);
+        return `${key}${operator}${redacted}`;
+    });
+    if (inputs.passSources.size || inputs.env.size)
+        assignments = assignments.replace(new RegExp(`(<<<[ \\t]*)${SHELL_WORD_SOURCE}`, 'g'), `$1${REDACTED}`);
+    // Config literals are produced by echo/printf before curl consumes -K.
+    // Keep that channel separate from executable flags: sort -u and OpenSSL
+    // passphrase source options must not become curl configuration by spelling.
+    const words = [
+        ...assignments.matchAll(new RegExp(`${SHELL_WORD_SOURCE}|[;&|()\\n]`, 'g')),
+    ];
+    if (!inputs.curlConfig && !inputs.passSources.size && !inputs.env.size)
+        return assignments;
+    const fields = new RegExp(`(^|[\\s'\"])(-{0,2}(?:(?:\\w+_)?proxy|${CURL_AUTH_OPTIONS})|-[uUbEx])([ \\t]*(?:=|:)[ \\t]*|[ \\t]+)(${SHELL_WORD_SOURCE})`, 'gi');
+    const edits = [];
+    let producerStart = null;
+    let producerPrintf = false;
+    const finishProducer = (end) => {
+        if (producerStart === null)
+            return;
+        const body = assignments.slice(producerStart, end);
+        const prefix = assignments.slice(0, producerStart);
+        const producesPassphrase = (assignments[end] === '|' &&
+            (inputs.passSources.has('stdin') ||
+                [...inputs.passSources].some((source) => source.startsWith('fd:')))) ||
+            ([...inputs.passSources].some((source) => /^(?:fd:|file:)/.test(source)) &&
+                prefix.includes('<(')) ||
+            [...inputs.passSources].some((source) => source.startsWith('file:') &&
+                body.includes('>') &&
+                body.includes(source.slice(5))) ||
+            [...inputs.env].some((key) => prefix.includes(`${key}=`) && prefix.includes('('));
+        if (producesPassphrase) {
+            edits.push({ start: producerStart, end, text: ` ${REDACTED} ` });
+            producerStart = null;
+            return;
+        }
+        if (!inputs.curlConfig) {
+            producerStart = null;
+            return;
+        }
+        const decodedBody = [...body.matchAll(new RegExp(SHELL_WORD_SOURCE, 'g'))]
+            .map((word) => decodeShellWord(word[0]))
+            .join(' ');
+        if (hasPrivateConfigVariables(decodedBody)) {
+            edits.push({ start: producerStart, end, text: ` ${REDACTED} ` });
+            producerStart = null;
+            return;
+        }
+        const redactField = (match, prefix, key, separator, value) => {
+            if (/^-[a-z]$/i.test(key) && !['-u', '-U', '-b', '-E', '-x'].includes(key))
+                return match;
+            const credential = decodeShellWord(value);
+            const field = key.replace(/^-+/, '');
+            if (producerPrintf && credential.includes('%'))
+                return `${prefix}${key}${separator}${REDACTED}`;
+            if (/^(?:proxy-)?(?:user|cert)$/i.test(field)) {
+                if (!credential.includes(':'))
+                    return match;
+                return `${prefix}${key}${separator}${credential.replace(/^([^:]*:)[\s\S]*$/, `$1${REDACTED}`)}`;
+            }
+            if (/^cookie$/i.test(field) && !credential.includes('='))
+                return match;
+            if (/^(?:(?:\w+_)?proxy|x)$/i.test(field) || CURL_URL_FIELD.test(field))
+                return PROXY_USERINFO.test(credential)
+                    ? `${prefix}${key}${separator}${credential.replace(PROXY_USERINFO, `$1${REDACTED}@`)}`
+                    : match;
+            return `${prefix}${key}${separator}${REDACTED}`;
+        };
+        // A producer's literals obey shell quoting before becoming config text.
+        // Decode concatenated/escaped field names before matching them, while
+        // retaining untouched words and also scanning unquoted multiword fields.
+        let text = body.replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
+            const decoded = decodeShellWord(word);
+            const redacted = decoded.replace(fields, redactField);
+            return redacted === decoded ? word : JSON.stringify(redacted);
+        });
+        text = text.replace(fields, redactField);
+        // A printf template may take the credential from later arguments. Once
+        // its format is private, drop the argument list rather than expose the
+        // values substituted into it or attempt to interpret printf formatting.
+        if (text !== body && producerPrintf && body.includes('%'))
+            text = ` ${REDACTED} `;
+        if (text !== body)
+            edits.push({ start: producerStart, end, text });
+        producerStart = null;
+    };
+    for (const word of words) {
+        if (/^[;&|()\n]$/.test(word[0]))
+            finishProducer(word.index);
+        else if (producerStart === null &&
+            ['echo', 'printf'].includes(decodeShellWord(word[0]).split(/[\\/]/).at(-1) ?? '')) {
+            producerStart = word.index + word[0].length;
+            producerPrintf = decodeShellWord(word[0]).split(/[\\/]/).at(-1) === 'printf';
+        }
+    }
+    finishProducer(assignments.length);
+    let result = assignments;
+    for (const edit of edits.reverse())
+        result = result.slice(0, edit.start) + edit.text + result.slice(edit.end);
+    return result;
+}
+/** Redact known tool credential flags without matching unrelated short flags. */
+function redactToolArguments(command, inputs) {
+    const words = [...command.matchAll(new RegExp(`${SHELL_WORD_SOURCE}|[;&|()\n]`, 'g'))];
+    const edits = [];
+    let client = null;
+    let options = true;
+    let opensslPasswd = false;
+    let opensslSubcommandRead = false;
+    const variables = new Map();
+    const expansions = [];
+    const resolveVariable = (contents, depth = 0) => {
+        if (depth > 20)
+            return 'private:@';
+        return contents.replace(CURL_EXPANSION, (_, name) => resolveVariable(variables.get(name)?.at(-1)?.contents ?? '', depth + 1));
+    };
+    const finishCurl = () => {
+        const privateNames = new Set();
+        for (const expansion of expansions) {
+            if (CURL_URL_FIELD.test(expansion.field) &&
+                !PROXY_USERINFO.test(expansion.resolved) &&
+                !new RegExp(`[?&#]${COMMAND_SENSITIVE_KEY_SOURCE}=`, 'i').test(expansion.resolved))
+                continue;
+            for (const match of expansion.contents.matchAll(CURL_EXPANSION))
+                privateNames.add(match[1]);
+        }
+        // Expanded variable definitions can themselves refer to other definitions.
+        // Walk each name once, including all assignments, without evaluating shell code.
+        for (const name of privateNames) {
+            for (const variable of variables.get(name) ?? []) {
+                if (variable.env)
+                    inputs?.env.add(name);
+                if (variable.contents === undefined)
+                    continue;
+                for (const match of variable.contents.matchAll(CURL_EXPANSION))
+                    privateNames.add(match[1]);
+                edits.push({
+                    start: variable.start,
+                    end: variable.end,
+                    text: `${variable.prefix}${REDACTED}`,
+                });
+            }
+        }
+        variables.clear();
+        expansions.length = 0;
+    };
+    for (let index = 0; index < words.length; index += 1) {
+        const word = words[index];
+        if (!word)
+            continue;
+        const raw = word[0];
+        if (/^[;&|()\n]$/.test(raw)) {
+            finishCurl();
+            client = null;
+            opensslPasswd = false;
+            opensslSubcommandRead = false;
+            options = true;
+            continue;
+        }
+        const decoded = decodeShellWord(raw);
+        if (opensslPasswd) {
+            // passwd hashes each positional plaintext password. Its source and salt
+            // flags consume nonsecret references, which must not be mistaken for it.
+            const sourceFlag = /^-{1,2}(?:in|salt|rand|writerand|provider|provider-path|provparam|propquery)(?:=(.*))?$/.exec(decoded);
+            if (options && sourceFlag) {
+                if (inputs && /^-{1,2}in(?:=|$)/.test(decoded)) {
+                    const source = sourceFlag[1] ?? words[index + 1]?.[0];
+                    if (source)
+                        inputs.passSources.add(`file:${decodeShellWord(source)}`);
+                }
+                if (sourceFlag[1] === undefined)
+                    index += 1;
+                continue;
+            }
+            if (options && /^-{1,2}stdin$/.test(decoded))
+                inputs?.passSources.add('stdin');
+            if (!options || !decoded.startsWith('-')) {
+                edits.push({ start: word.index, end: word.index + raw.length, text: REDACTED });
+                continue;
+            }
+        }
+        if (client === 'sshpass') {
+            // sshpass dispatches a child after its own credential/source options.
+            // Consume source arguments so a filename named curl is not executable.
+            const source = /^-[fdP](.*)$/.exec(decoded);
+            if (options && source) {
+                if (!source[1])
+                    index += 1;
+                continue;
+            }
+            if (options && /^-[evhV]+$/.test(decoded))
+                continue;
+            if (!options || !decoded.startsWith('-'))
+                client = null;
+        }
+        if (!CREDENTIAL_TOOLS.includes(client ?? '')) {
+            if (/^\w+\+?=/.test(decoded))
+                continue;
+            const wrapperValue = options
+                ? WRAPPER_VALUE_FLAGS[client ?? '']?.exec(decoded)
+                : null;
+            if (wrapperValue) {
+                if (wrapperValue[1] === undefined && wrapperValue[2] === undefined)
+                    index += 1;
+                continue;
+            }
+        }
+        const executable = decoded.split(/[\\/]/).at(-1) ?? decoded;
+        if (WRAPPER_VALUE_FLAGS[executable] && !CREDENTIAL_TOOLS.includes(client ?? '')) {
+            client = executable;
+            options = true;
+            continue;
+        }
+        // Dispatching tools may take their own options and positional arguments.
+        // Once a credential-consuming tool appears, its subsequent flags still carry
+        // credentials; a wrapper's -u or timeout must not hide that client.
+        if (CREDENTIAL_TOOLS.includes(executable) &&
+            !CREDENTIAL_TOOLS.includes(client ?? '')) {
+            client = executable;
+            opensslPasswd = false;
+            opensslSubcommandRead = false;
+            options = true;
+            continue;
+        }
+        if (client === null) {
+            if (/^[\w]+=.*/.test(decoded) ||
+                ['env', 'sudo', 'command', 'exec', 'nohup'].includes(decoded))
+                continue;
+            client = decoded.split(/[\\/]/).at(-1) ?? decoded;
+            continue;
+        }
+        if (client === 'openssl' && !opensslSubcommandRead && !decoded.startsWith('-')) {
+            opensslSubcommandRead = true;
+            opensslPasswd = decoded === 'passwd';
+            continue;
+        }
+        if (decoded === '--') {
+            options = false;
+            continue;
+        }
+        if (client === 'curl' && options) {
+            // Public source/output arguments cannot become config flags by spelling.
+            const publicSource = /^(-[oAw])(.+)?$|^(--(?:output|output-dir|write-out|user-agent|cacert|capath))(?:=(.*))?$/.exec(decoded);
+            if (publicSource) {
+                if (publicSource[2] === undefined && publicSource[4] === undefined)
+                    index += 1;
+                continue;
+            }
+            if (CURL_CONFIG_FLAG.test(decoded) && inputs)
+                inputs.curlConfig = true;
+            const variableFlag = /^--(?:expand-)?variable(?:=(.*))?$/.exec(decoded);
+            const expandFlag = CURL_EXPAND_FLAG.exec(decoded);
+            if (variableFlag || expandFlag) {
+                const attached = variableFlag ? variableFlag[1] : expandFlag[2];
+                const value = attached === undefined ? words[index + 1] : word;
+                if (!value || /^[;&|()\n]$/.test(value[0]))
+                    continue;
+                const contents = attached ?? decodeShellWord(value[0]);
+                if (variableFlag) {
+                    const definition = /^(%?)([A-Za-z0-9_]+)(?:\[[^\]]*\])?(?:=([\s\S]*)|@[^\s]*|$)/.exec(contents);
+                    if (definition) {
+                        const name = definition[2];
+                        const entries = variables.get(name) ?? [];
+                        entries.push({
+                            start: value.index,
+                            end: value.index + value[0].length,
+                            prefix: (attached === undefined ? '' : `${decoded.split('=')[0]}=`) +
+                                contents.slice(0, contents.indexOf('=') + 1),
+                            contents: definition[3],
+                            env: definition[1] === '%',
+                        });
+                        variables.set(name, entries);
+                    }
+                }
+                else
+                    expansions.push({
+                        field: expandFlag[1],
+                        contents,
+                        resolved: resolveVariable(contents),
+                    });
+                if (attached === undefined)
+                    index += 1;
+                continue;
+            }
+        }
+        if (client === 'openssl' && options && /^-{1,2}kfile(?:=|$)/.test(decoded)) {
+            const attached = decoded.includes('=')
+                ? decoded.slice(decoded.indexOf('=') + 1)
+                : undefined;
+            const source = attached ?? words[index + 1]?.[0];
+            if (source)
+                inputs?.passSources.add(`file:${decodeShellWord(source)}`);
+            if (attached === undefined)
+                index += 1;
+            continue;
+        }
+        // Curl also accepts URLs without a scheme and uses their userinfo as
+        // credentials. Restrict this shape to HTTP-client arguments so image
+        // digests and SSH paths in other commands retain their meaning.
+        if (['curl', 'http', 'https', 'httpie'].includes(client) &&
+            (!options || !decoded.startsWith('-')) &&
+            PROXY_USERINFO.test(decoded)) {
+            edits.push({
+                start: word.index,
+                end: word.index + raw.length,
+                text: decoded.replace(PROXY_USERINFO, `$1${REDACTED}@`),
+            });
+            continue;
+        }
+        if (!options)
+            continue;
+        // Decode option spellings before classifying them: shell quotes and
+        // escapes change syntax, never the credential the invoked tool receives.
+        const sensitiveFlag = /^--([^=]+)(?:=(.*))?$/.exec(decoded);
+        if (sensitiveFlag && SENSITIVE_KEY.test(sensitiveFlag[1])) {
+            const attached = sensitiveFlag[2];
+            const value = attached === undefined ? words[index + 1] : word;
+            if (value && !/^[;&|()\n]$/.test(value[0])) {
+                edits.push({
+                    start: value.index,
+                    end: value.index + value[0].length,
+                    text: attached === undefined ? REDACTED : `--${sensitiveFlag[1]}=${REDACTED}`,
+                });
+                if (attached === undefined)
+                    index += 1;
+            }
+            continue;
+        }
+        // OpenSSL passphrase sources name their transport: pass: embeds the
+        // password; env/file/fd/stdin retain only a source reference. The enc
+        // -k/-K options carry a password/raw key directly, as does sshpass -p.
+        const directPasswordFlag = client === 'openssl'
+            ? /^(-{1,2}(?:pass(?:in|out)?|password|srppass|pwri_password|secretkey|hmac|[kK]))(?:=(.*))?$/.exec(decoded)
+            : client === 'sshpass'
+                ? /^(-[46v]*p)(.*)$/.exec(decoded)
+                : null;
+        if (directPasswordFlag) {
+            const name = directPasswordFlag[1];
+            const attached = client === 'sshpass' ? directPasswordFlag[2] || undefined : directPasswordFlag[2];
+            const value = attached === undefined ? words[index + 1] : word;
+            if (!value || /^[;&|()\n]$/.test(value[0]))
+                continue;
+            const password = attached ?? decodeShellWord(value[0]);
+            if (client === 'openssl' && inputs) {
+                if (/^env:[^=\0]+$/.test(password))
+                    inputs.env.add(password.slice(4));
+                else if (/^(?:stdin|(?:file|fd):)/.test(password))
+                    inputs.passSources.add(password);
+            }
+            if (client !== 'openssl' ||
+                /^(?:k|srppass|pwri_password|secretkey|hmac)$/i.test(name.replace(/^-+/, '')) ||
+                password.startsWith('pass:')) {
+                edits.push({
+                    start: value.index,
+                    end: value.index + value[0].length,
+                    text: attached === undefined
+                        ? REDACTED
+                        : `${name}${client === 'openssl' ? '=' : ''}${REDACTED}`,
+                });
+            }
+            if (attached === undefined)
+                index += 1;
+            continue;
+        }
+        if (!['curl', 'http', 'https', 'httpie'].includes(client))
+            continue;
+        const payloadFlag = client === 'curl' ? CURL_PAYLOAD_FLAG.exec(decoded) : null;
+        if (payloadFlag) {
+            const name = payloadFlag[1] ?? payloadFlag[3];
+            const attached = payloadFlag[2] ?? payloadFlag[4];
+            const value = attached === undefined ? words[index + 1] : word;
+            if (!value || /^[;&|()\n]$/.test(value[0]))
+                continue;
+            const payload = attached ?? decodeShellWord(value[0]);
+            const header = /^([^:]+):/.exec(payload);
+            const isHeader = ['--header', '--proxy-header'].includes(name) ||
+                (!name.startsWith('--') && name.endsWith('H'));
+            // JSON is handled structurally above. Form fields must also inspect
+            // percent-decoded names: passwords do not become public by encoding.
+            const formHasCredential = [...new URLSearchParams(payload).keys()].some((key) => SENSITIVE_KEY.test(key));
+            if (isHeader ? header && SENSITIVE_KEY.test(header[1].trim()) : formHasCredential) {
+                edits.push({
+                    start: value.index,
+                    end: value.index + value[0].length,
+                    text: attached === undefined
+                        ? REDACTED
+                        : `${name}${name.startsWith('--') ? '=' : ''}${REDACTED}`,
+                });
+            }
+            if (attached === undefined)
+                index += 1;
+            continue;
+        }
+        const flag = client === 'curl'
+            ? CURL_AUTH_FLAG.exec(decoded)
+            : /^(-a)(.+)?$|^(--auth)(?:=(.*))?$/.exec(decoded);
+        if (!flag)
+            continue;
+        const name = flag[1] ?? flag[3];
+        const attached = flag[2] ?? flag[4];
+        const value = attached === undefined ? words[index + 1] : word;
+        if (!value || /^[;&|()\n]$/.test(value[0]))
+            continue;
+        let replacement = REDACTED;
+        if (CURL_URL_FIELD.test(name.replace(/^-+/, '')) ||
+            (!name.startsWith('--') && name.endsWith('x'))) {
+            const proxy = attached ?? decodeShellWord(value[0]);
+            if (!PROXY_USERINFO.test(proxy)) {
+                if (attached === undefined)
+                    index += 1;
+                continue;
+            }
+            replacement = proxy.replace(PROXY_USERINFO, `$1${REDACTED}@`);
+        }
+        if (attached !== undefined) {
+            edits.push({
+                start: word.index,
+                end: word.index + raw.length,
+                text: `${name}${name?.startsWith('--') ? '=' : ''}${replacement}`,
+            });
+        }
+        else {
+            edits.push({
+                start: value.index,
+                end: value.index + value[0].length,
+                text: replacement,
+            });
+            index += 1;
+        }
+    }
+    finishCurl();
+    edits.sort((a, b) => a.start - b.start);
+    for (const edit of edits.reverse())
+        command = command.slice(0, edit.start) + edit.text + command.slice(edit.end);
+    return command;
+}
+/** Find config consumers across shell wrappers before scanning their producers. */
+function getToolInputs(command, depth = 0) {
+    const inputs = {
+        curlConfig: depth > 8,
+        env: new Set(),
+        passSources: new Set(),
+    };
+    if (depth > 8)
+        return inputs;
+    // Use the same invocation parser as redaction; an SSH -K is not curl config.
+    redactToolArguments(command, inputs);
+    const words = [...command.matchAll(new RegExp(SHELL_WORD_SOURCE, 'g'))];
+    for (const word of words) {
+        const decoded = decodeShellWord(word[0]);
+        if (decoded === word[0] || !/[\s;&|()]/.test(decoded))
+            continue;
+        const nested = getToolInputs(decoded, depth + 1);
+        inputs.curlConfig ||= nested.curlConfig;
+        for (const key of nested.env)
+            inputs.env.add(key);
+        for (const source of nested.passSources)
+            inputs.passSources.add(source);
+    }
+    if (inputs.curlConfig) {
+        for (const word of words) {
+            const body = decodeShellWord(word[0]);
+            if (!hasPrivateConfigVariables(body))
+                continue;
+            for (const match of body.matchAll(/\b(?:expand-)?variable\s*[=: \t]+["']?%+([A-Za-z0-9_]+)/g))
+                inputs.env.add(match[1]);
+        }
+    }
+    return inputs;
+}
+/** Apply the same boundary to scripts carried inside quoted shell words. */
+function redactShellSyntax(command, depth = 0, inheritedInputs) {
+    // Nested shell/eval wrappers cannot create unbounded recursive scanning.
+    if (depth > 8)
+        return REDACTED;
+    command = redactCommandSubstitutions(command);
+    // Nested scripts may be dispatched by any tool. Scan decoded compound
+    // words instead of maintaining another list of interpreter/wrapper flags.
+    // JSON and sensitive assignments already have structural/whole-word passes;
+    // treating their values as commands would lose evidence or word boundaries.
+    const inputs = getToolInputs(command);
+    inputs.curlConfig ||= inheritedInputs?.curlConfig ?? false;
+    for (const key of inheritedInputs?.env ?? [])
+        inputs.env.add(key);
+    for (const source of inheritedInputs?.passSources ?? [])
+        inputs.passSources.add(source);
+    const sensitiveAssignment = new RegExp(`^(${COMMAND_SENSITIVE_KEY_SOURCE})(\\+?=)`, 'i');
+    // Resolve credential references before nested word redaction can erase the
+    // expansion marker while leaving its original variable definition behind.
+    let out = redactToolArguments(redactJsonArguments(command), inputs).replace(new RegExp(SHELL_WORD_SOURCE, 'g'), (word) => {
+        const decoded = decodeShellWord(word);
+        // A compound word beginning with a credential assignment may be either
+        // an env value or a whole script. Its entire value is private in both
+        // cases; dropping it avoids guessing which later spans belong to it.
+        const assignment = sensitiveAssignment.exec(decoded);
+        if (assignment)
+            return `${assignment[1]}${assignment[2]}${REDACTED}`;
+        if (decoded === word || !/[\s;&|()]/.test(decoded))
+            return word;
+        if (/^\s*[[{]/.test(decoded)) {
+            try {
+                JSON.parse(decoded);
+                return word;
+            }
+            catch {
+                // A shell group begins with '{' too; only valid JSON belongs to the
+                // structural JSON pass instead of the nested-command pass.
+            }
+        }
+        const redacted = redactShellSyntax(decoded, depth + 1, inputs);
+        return redacted === decoded ? word : JSON.stringify(redacted);
+    });
+    out = redactCredentialAssignments(out, inputs);
+    for (const [pattern, replacement] of COMMAND_REDACTIONS)
+        out = out.replace(pattern, replacement);
+    return out;
+}
 /**
  * Redact common secret shapes from a shell command and cap its length so
  * command text never carries credentials or bulk file content off-box.
@@ -83,10 +847,9 @@ const COMMAND_REDACTIONS = [
  * Pure function — no I/O.
  */
 export function sanitizeCommand(command) {
-    let out = command;
-    for (const [pattern, replacement] of COMMAND_REDACTIONS) {
-        out = out.replace(pattern, replacement);
-    }
+    // Shell continuations disappear before tokenization; otherwise a flag's
+    // value can be mistaken for the continuation itself and escape redaction.
+    let out = redactShellSyntax(command.replace(/\\\r?\n/g, ''));
     if (out.length > MAX_COMMAND_CHARS) {
         out = `${out.slice(0, MAX_COMMAND_CHARS)} [... truncated, ${out.length - MAX_COMMAND_CHARS} characters omitted]`;
     }