@mossbear/eval-core 0.1.0-alpha.69 → 0.1.0-alpha.71

package/dist/sanitize-command.test.js

@@ -1,6 +1,125 @@
 import { describe, it, expect } from 'vitest';
 import { sanitizeCommand } from './sanitize-command.js';
 describe('sanitizeCommand', () => {
+    it('redacts ordinary credential values passed as separate flag arguments', () => {
+        for (const flag of ['--password', '--token', '--api-key', '--client-secret']) {
+            for (const value of [
+                'fixture-credential',
+                '"fixture credential"',
+                "'fixture credential'",
+            ]) {
+                const redacted = sanitizeCommand(`tool ${flag} ${value} --verbose`);
+                expect(redacted).not.toContain('fixture');
+                expect(redacted).toContain(`${flag} [redacted] --verbose`);
+            }
+        }
+        expect(sanitizeCommand('tool --output result.json')).toBe('tool --output result.json');
+    });
+    it('redacts Basic authorization payloads rather than just the scheme', () => {
+        const payload = Buffer.from('fixture-user:fixture-password').toString('base64');
+        expect(sanitizeCommand(`curl -H "Authorization: Basic ${payload}"`)).not.toContain(payload);
+        expect(sanitizeCommand(`curl -H 'Authorization: basic ${payload}'`)).not.toContain(payload);
+    });
+    it('redacts JSON credentials embedded in shell request bodies', () => {
+        const body = {
+            password: 'fixture-password',
+            apiKey: 'fixture-key',
+            client_secret: 'fixture-secret',
+            message: 'hello',
+        };
+        const command = `curl -d '${JSON.stringify(body)}'`;
+        const redacted = sanitizeCommand(command);
+        expect(redacted).not.toContain('fixture');
+        expect(redacted).toContain('"message":"hello"');
+        expect(sanitizeCommand(String.raw `curl -d '{"password":"fixture\\\"password"}'`)).not.toContain('fixture');
+    });
+    it('redacts shell-escaped JSON keys and every sensitive value shape', () => {
+        const body = {
+            password: 'fixture-password',
+            authorization: 'Basic fixture-credential',
+            tokens: ['fixture-token'],
+            nested: { api_keys: { first: 'fixture-key' } },
+            message: 'hello',
+        };
+        const json = JSON.stringify(body);
+        for (const argument of [`'${json}'`, JSON.stringify(json)]) {
+            const redacted = sanitizeCommand(`curl -d ${argument}`);
+            expect(redacted).not.toContain('fixture');
+            expect(redacted).toContain('hello');
+        }
+    });
+    it('redacts JSON bodies with shell-only escapes and malformed JSON', () => {
+        for (const command of [
+            String.raw `curl -d "{\"password\":\"fixture\$password\"}"`,
+            String.raw `curl -d "{\"password\":\"fixture\!password\"}"`,
+            String.raw `curl -d "{\"password\":\"fixture\\!password\"}"`,
+            'curl -d "{\\"password\\":\\"fixture\\`password\\"}"',
+            String.raw `curl -d "{\"authorization\":\"Basic fixture\$credential\"}"`,
+            String.raw `curl -d '{"password":"fixture-password",}'`,
+        ]) {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        }
+    });
+    it('redacts token authorization schemes', () => {
+        const payload = ['fixture', 'credential'].join('-');
+        expect(sanitizeCommand(`curl -H "Authorization: token ${payload}"`)).not.toContain(payload);
+    });
+    it('redacts credentials in recursively JSON-encoded string values', () => {
+        let body = JSON.stringify({ password: 'fixture-password' });
+        for (let depth = 0; depth < 4; depth++) {
+            body = JSON.stringify({ config: body });
+            for (const argument of [`'${body}'`, JSON.stringify(body)]) {
+                expect(sanitizeCommand(`curl -d ${argument}`)).not.toContain('fixture');
+            }
+        }
+    });
+    it('preserves quoted programs and brace expansion without credentials', () => {
+        for (const command of [
+            "awk '{print $1}' /var/log/syslog",
+            "jq '[.items[] | .name]' resp.json",
+            "echo '{a,b}'",
+        ]) {
+            expect(sanitizeCommand(command)).toBe(command);
+        }
+    });
+    it('redacts complete shell words with concatenated quote sections', () => {
+        const body = JSON.stringify({
+            name: "O'Brien",
+            config: JSON.stringify({ password: 'fixture-password' }),
+        });
+        for (const escaped of ["'\\''", "'\"'\"'"]) {
+            const argument = `'${body.replaceAll("'", escaped)}'`;
+            expect(sanitizeCommand(`curl -d ${argument}`)).not.toContain('fixture');
+            const value = `'fixture${escaped}password'`;
+            expect(sanitizeCommand(`tool --password ${value}`)).toBe('tool --password [redacted]');
+            expect(sanitizeCommand(`PASSWORD=${value} tool`)).toBe('PASSWORD=[redacted] tool');
+        }
+    });
+    it('bounds scanning time for long malformed JSON-like arguments', () => {
+        const command = `jq '{${'x'.repeat(128_000)}: .y}' file.json`;
+        const start = performance.now();
+        expect(sanitizeCommand(command)).toContain('[... truncated,');
+        expect(performance.now() - start).toBeLessThan(2000);
+    });
+    it('preserves author and oauth metadata', () => {
+        for (const command of [
+            'git commit --author="Jane Doe <jane@example.com>"',
+            `curl -d '${JSON.stringify({ author: 'Jane Doe', oauth_provider: 'example' })}'`,
+            'oauth_provider=example tool',
+        ]) {
+            expect(sanitizeCommand(command)).toBe(command);
+        }
+    });
+    it('consumes shell-escaped whitespace in flag and assignment credentials', () => {
+        for (const command of [
+            String.raw `tool --password fixture\ secret --verbose`,
+            String.raw `PASSWORD=fixture\ secret tool`,
+        ]) {
+            const redacted = sanitizeCommand(command);
+            expect(redacted).not.toContain('fixture');
+            expect(redacted).not.toContain(' secret');
+        }
+    });
     it('leaves short benign commands untouched', () => {
         expect(sanitizeCommand('bun test')).toBe('bun test');
         expect(sanitizeCommand('git commit -m "fix: thing"')).toBe('git commit -m "fix: thing"');
@@ -78,4 +197,564 @@ describe('sanitizeCommand', () => {
         expect(out).toContain('[... truncated,');
     });
 });
+describe('command disclosure regressions', () => {
+    it('redacts cookie request headers', () => {
+        expect(sanitizeCommand(`curl -H 'Cookie: session=fixture-cookie; csrf=fixture-csrf' https://example.test`)).not.toContain('fixture-cookie');
+        expect(sanitizeCommand(`curl -b 'session=fixture-cookie' https://example.test`)).not.toContain('fixture-cookie');
+    });
+    it('redacts HTTP username/password arguments in short and long forms', () => {
+        for (const flag of ['-u ', '-u', '--user ', '--user=', '--proxy-user ']) {
+            expect(sanitizeCommand(`curl ${flag}'fixture-user:fixture-password' https://example.test`)).not.toContain('fixture-password');
+        }
+    });
+    it('redacts credentials after shell line continuations', () => {
+        for (const input of [
+            'tool --password \\\n  fixture-continued',
+            'tool --password \\\r\n  fixture-continued',
+        ])
+            expect(sanitizeCommand(input)).not.toContain('fixture-continued');
+    });
+    it('redacts token-only URL userinfo and URL query credentials', () => {
+        for (const input of [
+            'curl https://fixture-userinfo@example.test/',
+            'curl "https://example.test/?api_key=fixture-query&view=summary"',
+        ]) {
+            const output = sanitizeCommand(input);
+            expect(output).not.toContain('fixture-userinfo');
+            expect(output).not.toContain('fixture-query');
+            expect(output).toContain('example.test');
+        }
+    });
+    it('strips here-string file contents while retaining command evidence', () => {
+        const output = sanitizeCommand(`cat <<< 'fixturePrivateSource second word' > output.txt`);
+        expect(output).not.toContain('fixturePrivateSource');
+        expect(output).toContain('cat <<<');
+        expect(output).toContain('output.txt');
+    });
+});
+describe('review command-evidence regressions', () => {
+    it('preserves the host after a cookie header and still redacts query credentials', () => {
+        const text = sanitizeCommand("curl -H 'Cookie: session=fixture-cookie' https://example.test/?api_key=fixture-query");
+        expect(text).not.toContain('fixture-cookie');
+        expect(text).not.toContain('fixture-query');
+        expect(text).toContain('example.test');
+    });
+    it.each([
+        'sort -u fixtures/input.txt',
+        'git add -u .',
+        'grep -b pattern src/app.ts',
+        'ps -u root',
+        'docker run --user 1000:1000',
+    ])('preserves non-HTTP flags: %s', (command) => {
+        expect(sanitizeCommand(command)).toBe(command);
+    });
+    it('redacts HTTP credentials after environment assignments and command separators', () => {
+        const credential = ['fixture-user', 'fixture-password'].join(':');
+        const text = sanitizeCommand(`SORT=1 sort -u input.txt && env MODE=test /usr/bin/curl -u '${credential}' https://example.test`);
+        expect(text).toContain('sort -u input.txt');
+        expect(text).not.toContain('fixture-password');
+        expect(text).toContain('example.test');
+    });
+});
+describe('HTTPie authentication evidence', () => {
+    it.each(['-a ', '-a', '-a=', '--auth ', '--auth='])('redacts auth in the %s form', (flag) => {
+        const output = sanitizeCommand(`http ${flag}'fixture-user:fixture-password' example.test`);
+        expect(output).not.toContain('fixture-password');
+        expect(output).toContain('example.test');
+    });
+    it('preserves the auth type while redacting a bearer token on https', () => {
+        const output = sanitizeCommand('https -A bearer -a fixture-token example.test');
+        expect(output).not.toContain('fixture-token');
+        expect(output).toContain('-A bearer');
+    });
+});
+describe('credential syntax at the command upload boundary', () => {
+    it.each([
+        "bash -c 'API_TOKEN=x curl -x reader:fixture-value@proxy.test:3128 https://example.test'",
+        "bash -c 'password=x; https_proxy=reader:fixture-value@proxy.test:3128 curl https://example.test'",
+        "su -c 'API_TOKEN=x curl -x reader:fixture-value@proxy.test:3128 https://example.test'",
+        "env 'PASSWORD=fixture value' curl https://example.test",
+        "bash -c '{ curl -x reader:fixture-value@proxy.test:3128 https://example.test; }'",
+        "echo 'proxy = reader:fixture-value@proxy.test:3128' | curl -K - https://example.test",
+        "curl -K <(echo 'proxy = reader:fixture-value@proxy.test:3128') https://example.test",
+        "printf '%s\\n' 'proxy=reader:fixture-value@proxy.test:3128' | curl --config - https://example.test",
+    ])('redacts assignment-led scripts and inline proxy configuration: %s', (command) => {
+        expect(sanitizeCommand(command)).not.toContain('fixture');
+    });
+    it.each([
+        'echo \'proxy-user = "reader:fixture-password"\' | curl -K - https://example.test',
+        'echo \'user = "reader:fixture-password"\' | curl -K - https://example.test',
+        'echo \'proxy-user = "reader:fixture-password"\' > cfg && curl -K cfg https://example.test',
+        'curl -K <(echo \'user = "reader:fixture-password"\') https://example.test',
+        "printf '%s\\n' 'user: reader:fixture-password' | curl -K - https://example.test",
+        'echo \'cookie = "SID=fixture-password"\' | curl -K - https://example.test',
+        'echo \'cert = "client.pem:fixture-password"\' | curl -K - https://example.test',
+        "echo 'proxy-cert = client.pem:fixture-password' | curl -K - https://example.test",
+    ])('redacts credential fields in inline curl configuration: %s', (command) => {
+        const output = sanitizeCommand(command);
+        expect(output).not.toContain('fixture');
+        expect(output).toContain('[redacted]');
+    });
+    it.each([
+        'echo \'user = "reader"\' | curl -K - https://example.test',
+        'echo \'cert = "client.pem"\' | curl -K - https://example.test',
+    ])('keeps curl configuration without a password: %s', (command) => {
+        expect(sanitizeCommand(command)).toBe(command);
+    });
+    it.each([
+        'sudo -E curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+        'sudo -u deploy curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+        'timeout --preserve-status 10 curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+        'nice -n 10 curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+        'stdbuf -oL curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+        'xargs curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+        'env -S "curl -x reader:fixture-password@proxy.test:3128 https://example.test"',
+        "su -c 'curl -x reader:fixture-password@proxy.test:3128 https://example.test'",
+        'sudo -s "curl -x reader:fixture-password@proxy.test:3128 https://example.test"',
+        String.raw `env -S "sh -c 'curl -x reader:fixture-password@proxy.test:3128 https://example.test'"`,
+        'bash -c "$(echo curl -x reader:fixture-password@proxy.test:3128 https://example.test)"',
+        "bash -c $'curl -x reader:fixture-password@proxy.test:3128 https://example.test'",
+        String.raw `bash -c $'true\ncurl -x reader:fixture-password@proxy.test:3128 https://example.test'`,
+        String.raw `bash -c $'\x63url -x reader:fixture-password@proxy.test:3128 https://example.test'`,
+        String.raw `bash -c $'echo \'ready\'; \x63url -x reader:fixture-password@proxy.test:3128 https://example.test'`,
+    ])('redacts wrapper and encoded-script credentials: %s', (command) => {
+        const output = sanitizeCommand(command);
+        expect(output).not.toContain('fixture-password');
+        expect(output).toContain('proxy.test:3128');
+        expect(output).toContain('example.test');
+    });
+    it.each([
+        "sh -c 'export https_proxy=reader:fixture-password@proxy.test:3128; curl https://example.test'",
+        "sh -c 'cd /tmp; https_proxy=reader:fixture-password@proxy.test:3128 curl https://example.test'",
+        "eval 'export https_proxy=reader:fixture-password@proxy.test:3128' ; curl https://example.test",
+        "bash -c 'curl -x reader:fixture-password@proxy.test:3128 https://example.test'",
+        'bash -lc "curl -sSx reader:fixture-password@proxy.test:3128 https://example.test"',
+        'sudo bash -c "curl -x reader:fixture-password@proxy.test:3128 https://example.test"',
+        String.raw `bash -c 'sh -c "curl -x reader:fixture-password@proxy.test:3128 https://example.test"'`,
+        "bash -c 'https_proxy=reader:fixture-password@proxy.test:3128 curl -U reader:fixture-other https://example.test'",
+        'eval curl -x reader:fixture-password@proxy.test:3128 https://example.test',
+    ])('redacts credentials inside quoted scripts: %s', (command) => {
+        const output = sanitizeCommand(command);
+        expect(output).not.toContain('fixture-password');
+        expect(output).not.toContain('fixture-other');
+        expect(output).toContain('proxy.test:3128');
+        expect(output).toContain('example.test');
+    });
+    it('bounds deeply nested interpreter scripts without retaining credentials', () => {
+        let command = 'curl -x reader:fixture-password@proxy.test:3128 https://example.test';
+        for (let depth = 0; depth < 12; depth += 1)
+            command = `bash -c ${JSON.stringify(command)}`;
+        const start = performance.now();
+        expect(sanitizeCommand(command)).not.toContain('fixture-password');
+        expect(performance.now() - start).toBeLessThan(2000);
+    });
+    it.each(['--pass ', '--pass=', '--proxy-pass ', '--proxy-pass='])('redacts separate private-key passphrases via %s', (flag) => {
+        expect(sanitizeCommand(`curl ${flag}'fixture-secret' https://example.test`)).not.toContain('fixture-secret');
+    });
+    it.each([
+        'curl reader:fixture-password@internal.test/api',
+        'curl -osx reader:fixture-password@internal.test/api',
+        'curl -- reader:fixture-password@internal.test/api',
+        "curl 'reader:fixture-password@internal.test/api'",
+        "bash -c 'curl reader:fixture-password@internal.test/api'",
+    ])('redacts HTTP-client scheme-less URL credentials: %s', (command) => {
+        const output = sanitizeCommand(command);
+        expect(output).not.toContain('fixture-password');
+        expect(output).toContain('internal.test/api');
+    });
+    it('preserves benign quoted scripts and unrelated userinfo-shaped arguments', () => {
+        for (const command of [
+            "bash -c 'sort -u input.txt; curl -sS https://example.test'",
+            "docker pull 'image:tag@sha256:abc123'",
+            "git clone 'git@github.test:org/repo'",
+        ])
+            expect(sanitizeCommand(command)).toBe(command);
+    });
+    it.each([
+        ['x', 'reader:fixture-password@proxy.test:3128'],
+        ['u', 'reader:fixture-password'],
+        ['U', 'reader:fixture-password'],
+        ['b', 'session=fixture-cookie'],
+        ['E', 'client.pem:fixture-passphrase'],
+        ['H', 'X-Api-Key: fixture-header'],
+        ['d', '%70assword=fixture-form'],
+        ['F', '%70assword=fixture-form'],
+    ])('redacts curl clustered argument flag %s', (flag, value) => {
+        for (const prefix of ['s', 'sS', 'qkLf']) {
+            for (const space of ['', ' ']) {
+                const output = sanitizeCommand(`curl -${prefix}${flag}${space}'${value}' https://example.test`);
+                expect(output).not.toContain('fixture');
+                expect(output).toContain(`-${prefix}${flag}`);
+                expect(output).toContain('https://example.test');
+                if (flag === 'x')
+                    expect(output).toContain('proxy.test:3128');
+            }
+        }
+    });
+    it('does not interpret an argument-taking flag value as more curl flags', () => {
+        const command = "curl -osxreport.txt -sH'Accept: application/json' https://example.test";
+        expect(sanitizeCommand(command)).toBe(command);
+        const proxy = 'curl -sSxproxy.test:3128 https://example.test';
+        expect(sanitizeCommand(proxy)).toBe(proxy);
+    });
+    it.each(['-U ', '-U', '--proxy-user='])('redacts curl proxy credentials via %s', (flag) => {
+        expect(sanitizeCommand(`curl ${flag}'user:fixture proxy password' https://example.test`)).not.toContain('fixture');
+    });
+    it.each(['--oauth2-bearer ', '--oauth2-bearer='])('redacts curl OAuth bearer credentials via %s', (flag) => {
+        expect(sanitizeCommand(`curl ${flag}fixture-bearer https://example.test`)).not.toContain('fixture');
+    });
+    it.each(['-E ', '-E', '--cert ', '--cert=', '--proxy-cert='])('redacts certificate passphrases via %s', (flag) => {
+        expect(sanitizeCommand(`curl ${flag}'client.pem:fixture passphrase' https://example.test`)).not.toContain('fixture');
+    });
+    it.each(['-H ', '-H', '--header ', '--header=', '--proxy-header='])('redacts custom credential headers via %s', (flag) => {
+        expect(sanitizeCommand(`curl ${flag}'X-Api-Key: fixture-header-secret' https://example.test`)).not.toContain('fixture');
+        expect(sanitizeCommand(`curl ${flag}'Accept: application/json' https://example.test`)).toContain('Accept: application/json');
+    });
+    it.each(['-d ', '-d', '--data=', '--data-urlencode ', '-F ', '--form-string='])('redacts credential form bodies via %s', (flag) => {
+        expect(sanitizeCommand(`curl ${flag}'password=fixture%20password&name=reader' https://example.test`)).not.toContain('fixture');
+        expect(sanitizeCommand(`curl ${flag}'%70assword=fixture-password' https://example.test`)).not.toContain('fixture');
+        expect(sanitizeCommand(`curl ${flag}'view=summary' https://example.test`)).toContain('view=summary');
+    });
+    it.each([
+        "'--password'",
+        '"--password"',
+        String.raw `--pass\word`,
+        "'--password=fixture password'",
+    ])('redacts shell-encoded credential flags %s', (flag) => {
+        const command = flag.includes('=')
+            ? `tool ${flag}`
+            : `tool ${flag} 'fixture password' --verbose`;
+        expect(sanitizeCommand(command)).not.toContain('fixture');
+    });
+    it('redacts OAuth fragment credentials while retaining the address', () => {
+        const output = sanitizeCommand('curl "https://example.test/#access_token=fixture-fragment&view=summary"');
+        expect(output).not.toContain('fixture');
+        expect(output).toContain('https://example.test/');
+        expect(output).toContain('view=summary');
+    });
+    it.each(['-x ', '-x', '--proxy ', '--proxy=', '--proxy1.0 '])('redacts scheme-less proxy userinfo via %s', (flag) => {
+        const output = sanitizeCommand(`curl ${flag}'reader:fixture-password@proxy.test:3128' https://example.test`);
+        expect(output).not.toContain('fixture-password');
+        expect(output).toContain('proxy.test:3128');
+        expect(sanitizeCommand(`curl ${flag}proxy.test:3128 https://example.test`)).toContain('proxy.test:3128');
+        expect(sanitizeCommand(`curl ${flag}'http://reader:fixture-password@proxy.test:3128' https://example.test`)).not.toContain('fixture-password');
+    });
+    describe('proxy environment assignments', () => {
+        it.each([
+            "env 'https_proxy=reader:fixture-password@proxy.test:3128' curl https://example.test",
+            'env "ALL_PROXY=reader:fixture-password@proxy.test:3128" curl https://example.test',
+            String.raw `env https_pr\oxy=reader:fixture-password@proxy.test:3128 curl https://example.test`,
+        ])('redacts shell-encoded complete proxy assignments: %s', (command) => {
+            const output = sanitizeCommand(command);
+            expect(output).not.toContain('fixture-password');
+            expect(output).toContain('proxy.test:3128');
+        });
+        const names = ['https_proxy', 'http_proxy', 'HTTPS_PROXY', 'ALL_PROXY', 'all_proxy'];
+        const values = [
+            'reader:fixture-password@proxy.test:3128',
+            "'reader:fixture-password@proxy.test:3128'",
+            '"reader:fixture-password@proxy.test:3128"',
+            "'reader:fixture password@proxy.test:3128'",
+        ];
+        for (const name of names) {
+            it.each(values)(`redacts scheme-less userinfo in ${name}=%s`, (value) => {
+                for (const prefix of ['', 'export ', 'sudo -E ', 'env ']) {
+                    const output = sanitizeCommand(`${prefix}${name}=${value} curl https://example.test`);
+                    expect(output).not.toContain('fixture');
+                    expect(output).toContain('reader:');
+                    expect(output).toContain('proxy.test:3128');
+                    expect(output).toContain('curl https://example.test');
+                }
+            });
+        }
+        it('keeps a proxy value without credentials intact', () => {
+            for (const command of [
+                'https_proxy=proxy.test:3128 curl https://example.test',
+                "ALL_PROXY='socks5://proxy.test:1080' curl https://example.test",
+                'no_proxy=localhost,127.0.0.1 curl https://example.test',
+            ])
+                expect(sanitizeCommand(command)).toBe(command);
+        });
+        it('leaves unrelated scheme-less @ text alone', () => {
+            for (const command of [
+                'docker pull nginx:1.25@sha256:0123456789abcdef',
+                'git clone git@github.com:org/repo.git',
+            ])
+                expect(sanitizeCommand(command)).toBe(command);
+        });
+    });
+    describe('OpenSSL and sshpass credential arguments', () => {
+        it.each([
+            'openssl enc -d -aes-256-cbc -pass pass:fixture-password -in f.enc',
+            "openssl rsa -passin 'pass:fixture password' -in key.pem",
+            'openssl pkcs12 -passout pass:fixture-password -out key.p12',
+            'openssl enc -aes-256-cbc -k fixture-password',
+            'openssl enc -aes-256-cbc -pass=pass:fixture-password',
+            'openssl enc -aes-256-cbc --pass pass:fixture-password',
+            'openssl enc -aes-256-cbc --pass=pass:fixture-password',
+            'openssl rsa --passin pass:fixture-password -in key.pem',
+            'openssl pkcs12 --passout pass:fixture-password -out key.p12',
+            'openssl enc -aes-256-cbc --k fixture-password',
+            'openssl pkcs12 -password pass:fixture-password',
+            "env 'SSHPASS=fixture password' sshpass -e ssh deploy@host",
+            "sudo -u root /usr/bin/openssl enc '-pass' pass:fixture-password",
+            "bash -c 'openssl enc -pass pass:fixture-password'",
+            'sshpass -p fixture-password ssh deploy@host git pull',
+            'sshpass -pfixture-password ssh deploy@host git pull',
+            "sshpass -vp'fixture password' ssh deploy@host",
+            'timeout 10 /usr/bin/sshpass -4vpfixture-password ssh deploy@host',
+            String.raw `sshpass -\p $'fixture\x20password' ssh deploy@host`,
+            "openssl passwd -1 'fixture-password'",
+            'openssl passwd -6 fixture-password',
+            'openssl passwd -salt pepper fixture-password',
+            'sudo openssl passwd -apr1 -salt x fixture-password fixture-second',
+            'openssl enc -aes-256-cbc -K 00fixture1122 -iv 00 -in f -out g',
+            'openssl enc -aes-256-cbc -K=00fixture1122 -in f -out g',
+        ])('redacts direct passwords: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+            expect(sanitizeCommand(command)).toContain('[redacted]');
+        });
+        it.each([
+            'openssl enc -pass env:KEY_PASSWORD -in f.enc',
+            'openssl enc --pass env:KEY_PASSWORD -in f.enc',
+            'openssl rsa -passin file:password-source -in key.pem',
+            'openssl pkcs12 -passout fd:3',
+            'openssl enc -pass stdin',
+            'openssl enc -kfile password-source -in f.enc',
+            'sshpass -e ssh deploy@host',
+            'sshpass -f password-source ssh deploy@host',
+            'sshpass -d 3 ssh deploy@host',
+            'printf -p fixture-public',
+            'tool -pass pass:fixture-public',
+            'openssl passwd -stdin',
+            'openssl passwd -in password-source',
+            'openssl x509 -in cert.pem -noout -text',
+        ])('preserves nonliteral sources and unrelated arguments: %s', (command) => {
+            expect(sanitizeCommand(command)).toBe(command);
+        });
+    });
+    describe('inline curl configuration credentials', () => {
+        it.each([
+            `echo 'us''er = "reader:fixture-password"' | curl -K - file:///dev/null`,
+            String.raw `echo us\er=reader:fixture-password | curl -K - file:///dev/null`,
+            String.raw `echo $'u\x73er = "reader:fixture-password"' | curl -K - file:///dev/null`,
+        ])('decodes shell-encoded config names: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            `printf 'user = "reader:%s"\\n' fixture-password | curl -K - file:///dev/null`,
+            `printf 'cookie = "%s"\\n' SID=fixture-password | curl -K - file:///dev/null`,
+            `printf '%s = %s\\n' user reader:fixture-password | curl -K - file:///dev/null`,
+        ])('redacts printf credential substitutions: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            `bash -c 'echo "user = reader:fixture-password"' | curl -K - file:///dev/null`,
+            `env -S 'printf "user = reader:fixture-password"' | curl -K - file:///dev/null`,
+        ])('redacts wrapped config producers: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            `echo 'user "reader:fixture-password"' | curl -K - file:///dev/null`,
+            `echo 'user: "reader:fixture-password"' | curl -K - file:///dev/null`,
+            `echo '--user = "reader:fixture-password"' | curl -K - file:///dev/null`,
+            `echo '-u "reader:fixture-password"' | curl -K - file:///dev/null`,
+        ])('redacts alternate curl config separators: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            `echo 'proxy-user = "reader:fixture-password"' | curl -K - https://example.test`,
+            `echo 'user = "reader:fixture password"' | curl -K - https://example.test`,
+            `echo 'proxy-user="reader:fixture-password"' > cfg && curl -K cfg https://example.test`,
+            `curl -K <(echo 'user = "reader:fixture-password"') https://example.test`,
+            `echo 'cookie = "SID=fixture-password"' | curl -K - https://example.test`,
+            `echo 'cert = "client.pem:fixture-password"' | curl -K - https://example.test`,
+            `echo 'proxy-cert = "client.pem:fixture-password"' | curl -K - https://example.test`,
+            `printf '%s\\n' 'oauth2-bearer = "fixture-password"' | curl -K - https://example.test`,
+            `printf '%s\\n' 'pass = "fixture-password"' | curl -K - https://example.test`,
+            `echo 'proxy-pass = "fixture-password"' | curl -K - https://example.test`,
+        ])('redacts credential field literals: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it('keeps unrelated flags before a config producer', () => {
+            expect(sanitizeCommand(`sort -u public-file && echo 'user = reader:fixture-password' | curl -K - file:///dev/null`)).toContain('sort -u public-file');
+        });
+        it('retains noncredential curl configuration', () => {
+            const command = `echo 'proxy = proxy.test:3128' | curl -K - https://example.test`;
+            expect(sanitizeCommand(command)).toBe(command);
+        });
+    });
+    describe('OpenSSL positional passwords and raw keys', () => {
+        it('redacts a valid raw AES key while retaining the IV', () => {
+            const key = '00112233445566778899aabbccddeeff';
+            const iv = 'ffeeddccbbaa99887766554433221100';
+            const output = sanitizeCommand(`openssl enc -aes-128-cbc -K ${key} -iv ${iv} -in public-file`);
+            expect(output).not.toContain(key);
+            expect(output).toContain(iv);
+        });
+        it.each(['curl', 'openssl', 'sshpass'])('redacts a password named %s', (password) => {
+            expect(sanitizeCommand(`openssl passwd -1 '${password}'`)).toBe('openssl passwd -1 [redacted]');
+        });
+        it.each([
+            `openssl passwd -1 'fixture-password'`,
+            `openssl passwd -6 'fixture password'`,
+            `openssl passwd -salt public-salt fixture-password`,
+            `openssl passwd -5 fixture-password fixture-other-password`,
+            `openssl passwd -- fixture-password`,
+            `openssl enc -aes-256-cbc -K fixture-key -in public-file`,
+            `openssl enc -aes-256-cbc --K=fixture-key -in public-file`,
+        ])('redacts key material: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            'openssl passwd -1 -salt public-salt -in password-source',
+            'openssl passwd -6 -stdin',
+            'openssl passwd -rand entropy-source -writerand entropy-out -stdin',
+        ])('preserves password sources and salt: %s', (command) => {
+            expect(sanitizeCommand(command)).toBe(command);
+        });
+    });
+    describe('Codex command-redaction findings', () => {
+        it.each([
+            `printf 'variable = cred=reader:fixture-password\nexpand-user = {{cred}}\nurl = file:///dev/null\n' | curl -K -`,
+            `echo 'variable = cred=fixture-password\nexpand-oauth2-bearer = {{cred}}' | curl -K -`,
+            `printf '%s\\n' 'variable = cred=fixture-password' 'expand-header = "X-Api-Key: {{cred}}"' | curl -K -`,
+            `export CRED=fixture-password; printf 'variable = %%CRED\nexpand-user = {{CRED}}' | curl -K -`,
+        ])('redacts expanded credentials in curl config inputs: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            "env 'P.W=fixture-password' openssl enc -pass env:P.W",
+            "env 'P-W=fixture-password' openssl enc -pass env:P-W",
+            "env 'P W=fixture-password' openssl enc -pass 'env:P W'",
+        ])('redacts non-shell environment names: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            'openssl s_client -srppass fixture-password -connect example.test:443',
+            'openssl s_client -srppass=fixture-password -connect example.test:443',
+            'openssl cms -pwri_password fixture-password -encrypt -in /dev/null',
+            'openssl dgst -hmac fixture-password /dev/null',
+        ])('redacts other OpenSSL password/key flags: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it('redacts CMS key bytes while keeping their public identifier', () => {
+            const key = '0'.repeat(32);
+            expect(sanitizeCommand(`openssl cms -secretkey ${key} -secretkeyid public-id`)).toBe('openssl cms -secretkey [redacted] -secretkeyid public-id');
+        });
+        it.each([
+            'curl -u reader:$(printf fixture-password) https://example.test',
+            'sshpass -p$(printf fixture-password) ssh deploy@host',
+            'openssl enc -pass pass:$(printf fixture-password)',
+            'curl -u reader:`printf fixture-password` https://example.test',
+            'sshpass -p`printf fixture-password` ssh deploy@host',
+            'curl -u reader:$(printf "%s" "$(printf fixture-password)") https://example.test',
+            "curl -u reader:$(printf ')%s' fixture-password) https://example.test",
+            'curl -u "reader:$(printf fixture-password)" https://example.test',
+            "bash -c 'curl -u reader:$(printf fixture-password) https://example.test'",
+            'curl -u reader:$(printf fixture-password',
+        ])('redacts command-substitution bodies in credential words: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            'openssl rand -out passwd 16',
+            'openssl x509 -in passwd -noout -text',
+            'openssl cms -secretkeyid public-key-id -help',
+            `echo 'variable = host=example.test\nexpand-url = https://{{host}}' | curl -K -`,
+        ])('preserves subcommand arguments and public config expansions: %s', (command) => {
+            expect(sanitizeCommand(command)).toBe(command);
+        });
+        it.each([
+            'curl --variable cred=reader:fixture-password --expand-user {{cred}} file:///dev/null',
+            'curl --variable=cred=reader:fixture-password --expand-proxy-user={{cred}} https://example.test',
+            "curl --variable 'cred=fixture password' --expand-oauth2-bearer '{{cred:trim}}' https://example.test",
+            'curl --variable cred=fixture-password --expand-header "X-Api-Key: {{cred}}" https://example.test',
+            'curl --variable cred=fixture-password --expand-data "password={{cred}}" https://example.test',
+            'curl --variable cred=fixture-password --expand-url "https://reader:{{cred}}@example.test"',
+            'curl --variable cred=fixture-password --expand-url "https://example.test/#access_token={{cred}}"',
+            'curl --variable cred=fixture-password --expand-variable login=reader:{{cred}} --expand-user {{login}} file:///dev/null',
+            'curl --variable raw=reader:fixture-password@example.test --expand-variable alias={{raw}} --expand-url {{alias}}',
+            'curl --variable raw=reader:fixture-password@example.test --expand-url {{raw}} --variable raw=example.test',
+            'CRED=fixture-password curl --variable %CRED --expand-oauth2-bearer {{CRED}} https://example.test',
+            'curl --variable %CRED=fixture-password --expand-oauth2-bearer {{CRED}} https://example.test',
+            'curl --variable cred[0-99]=fixture-password --expand-oauth2-bearer {{cred}} https://example.test',
+        ])('redacts expanded curl credentials at their source: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            'P=fixture-password openssl enc -aes-256-cbc -pass env:P -in /dev/null -out /dev/null',
+            "env 'P=fixture password' openssl enc -pass env:P",
+            'P+=fixture-password openssl enc -pass env:P',
+            'printf fixture-password | openssl enc -pass stdin',
+            'printf "%s\\n" fixture-password | openssl enc -pass stdin',
+            "printf fixture-password | sh -c 'openssl enc -pass stdin'",
+            'printf fixture-password > pass-source; openssl enc -pass file:pass-source',
+            'openssl enc -pass fd:3 3< <(printf fixture-password)',
+            'openssl enc -pass file:<(printf fixture-password)',
+            'openssl enc -pass stdin <<< fixture-password',
+            'printf fixture-password > pass-source; openssl enc -kfile pass-source',
+            'printf fixture-password | openssl passwd -stdin',
+            'printf fixture-password > pass-source; openssl passwd -in pass-source',
+            'P=$(printf fixture-password) openssl enc -pass env:P',
+        ])('redacts literal OpenSSL passphrase producers: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            'HTTPS_PROXY+=reader:fixture-password@proxy.test:3128 curl https://example.test',
+            "ALL_PROXY+='reader:fixture password@proxy.test:3128' curl https://example.test",
+        ])('redacts appended proxy assignments: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+            expect(sanitizeCommand(command)).toContain('proxy.test:3128');
+        });
+        it.each([
+            'openssl passwd -provider default -stdin',
+            'openssl passwd -provider-path /public/providers -provider default -stdin',
+            'openssl passwd -propquery provider=default -stdin',
+            'openssl passwd -provparam public=value -stdin',
+            'echo "user = reader:public-value"; ssh -K host; curl https://example.test',
+            'curl https://example.test; ssh -K host; echo "user = reader:public-value"',
+            'echo "user = reader:public-value"; curl -o -K https://example.test',
+            'curl --variable host=example.test --expand-url "https://{{host}}/public"',
+            'curl --variable name=public --expand-output {{name}} https://example.test',
+            'echo public-value; openssl enc -pass stdin',
+            'echo public-value; openssl enc -pass env:P',
+        ])('preserves public option values and unrelated commands: %s', (command) => {
+            expect(sanitizeCommand(command)).toBe(command);
+        });
+        it.each([
+            'TOOL=/usr/bin/openssl curl -u reader:fixture-password https://example.test',
+            'sudo -u openssl curl -u reader:fixture-password https://example.test',
+            'env -u openssl curl -u reader:fixture-password https://example.test',
+            '/usr/bin/time -o openssl curl -u reader:fixture-password https://example.test',
+            'xargs -a openssl curl -u reader:fixture-password https://example.test',
+        ])('does not select a client from wrapper option values: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each([
+            'curl https://example.test/openssl -u reader:fixture-password',
+            'curl -o openssl -u reader:fixture-password https://example.test',
+            'http example.test/sshpass --auth reader:fixture-password',
+            'curl --output sshpass --proxy-user reader:fixture-password https://example.test',
+            'sshpass -p fixture-first curl -u reader:fixture-password https://example.test',
+        ])('keeps client identity across argument names: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+        it.each(['url', 'preproxy', 'socks4', 'socks4a', 'socks5', 'socks5-hostname'])('redacts userinfo in the %s config field and flag', (key) => {
+            for (const command of [
+                `echo '${key} = reader:fixture-password@proxy.test:3128' | curl -K -`,
+                `curl --${key} reader:fixture-password@proxy.test:3128 https://example.test`,
+            ]) {
+                expect(sanitizeCommand(command)).not.toContain('fixture');
+                expect(sanitizeCommand(command)).toContain('proxy.test:3128');
+            }
+        });
+        it.each([
+            `echo 'user = reader:fixture-password' | bash -c 'curl -K - https://example.test'`,
+            `printf 'cookie = "%s"' SID=fixture-password | env -S 'curl -K - https://example.test'`,
+            `echo 'user = reader:fixture-password' | sh -c "bash -c 'curl -K - https://example.test'"`,
+        ])('detects nested config consumers from outer producers: %s', (command) => {
+            expect(sanitizeCommand(command)).not.toContain('fixture');
+        });
+    });
+});
 //# sourceMappingURL=sanitize-command.test.js.map