@piagent/platform 1.5.4 → 1.6.0

package/packages/piagent-core/security/sensitive-data.js

@@ -1,221 +1,16 @@
-const REDACTION = "[REDACTED_SECRET]";
-
-const TOKEN_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /\bAKIA[0-9A-Z]{16}\b/g,
-  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
-  /\bgh[opsru]_[A-Za-z0-9_]{20,}\b/g,
-  /\bsk-(?:(?:proj|svcacct|admin|ant)-)?[A-Za-z0-9_-]{20,}\b/g,
-  /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
-  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
-  // An npm token was recognised only where something named it -- `NPM_TOKEN=...`
-  // caught the assignment, a field called `token` caught the field -- so the one
-  // place it actually appears was missed: `//registry.npmjs.org/:_authToken=npm_…`
-  // is the whole of an `.npmrc`, and a `cat` of that file or a failing publish log
-  // carried the credential through unredacted. Every other provider here is
-  // recognised by the shape of its token; npm was the gap.
-  /\bnpm_[A-Za-z0-9]{30,}\b/g,
-  /\bAIza[0-9A-Za-z_-]{20,}\b/g,
-  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g
-];
-
-const CONNECTION_URL_PATTERN = /\b((?:https?|ftp|postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/"']+:)([^@\s/"']+)(@[^\s"'<>]+)/gi;
-const BEARER_PATTERN = /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})\b/gi;
-const BASIC_AUTH_PATTERN = /\b(Basic\s+)([A-Za-z0-9+/]{12,}={0,2})(?=$|[\s,;}])/gi;
-// The value is one whitespace-free token, not the rest of the line. Taking the
-// rest of the line made the result depend on where the header sat among the
-// arguments: `curl URL -H "Authorization: Token abc123"` yielded `abc123"`, short
-// enough to keep, while moving the header before the URL swept the URL into the
-// value and pushed it past the length bar. Same header, same credential, opposite
-// outcome. Credentials carry no spaces, so stopping at the first one also keeps
-// prose like "Authorization: not required for local runs" intact.
-const AUTHORIZATION_HEADER_PATTERN = /\b(Authorization\s*:\s*)([A-Za-z][A-Za-z0-9_-]{0,31})(\s+)([^\s\r\n"'`]+)/gi;
-
-// A credential passed as a command-line option, which is how most CLIs take one.
-// The assignment patterns below require a key starting with a letter, so every
-// `--token=...` and `--token ...` walked straight past them.
-const CLI_OPTION_SECRET_PATTERN = /(^|[\s({[])(--[A-Za-z][A-Za-z0-9_.-]{0,80})(=|\s+)("[^"\r\n]*"|'[^'\r\n]*'|[^\s"'`;,)}]+)/g;
-
-// Under one of these schemes the header carries an opaque credential, so its
-// length says nothing. Anything else after `Authorization:` is more likely prose
-// — "Authorization: not required" — and keeps the ambiguous-syntax length bar.
-const AUTHORIZATION_SCHEMES = new Set([
-  "bearer", "basic", "token", "digest", "negotiate", "ntlm",
-  "oauth", "hawk", "signature", "apikey", "jwt", "aws4-hmac-sha256"
-]);
-const QUERY_SECRET_PATTERN = /([?&])([A-Za-z][A-Za-z0-9_.-]{0,80})(=)([^&#\s]+)/gi;
-const DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*"((?:\\.|[^"\\\r\n])*)"/gim;
-const SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*'((?:\\.|[^'\\\r\n])*)'/gim;
-const SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?[A-Za-z][A-Za-z0-9_.-]{0,80}(?:"|')?\s*)(:|=(?!=))\s*([^"'\s,;}]+)/gim;
-const WHITESPACE_SECRET_ASSIGNMENT_PATTERN = /(^|[\s{[,(;])((?:"|')?(?:aws_)?secret_access_key(?:"|')?\s+)(["']?)([A-Za-z0-9/+=]{20,})/gim;
-
-const SENSITIVE_KEY_TERMS = [
-  "api_key",
-  "token",
-  "password",
-  "passwd",
-  "pwd",
-  "secret",
-  "credential",
-  "client_secret",
-  "access_token",
-  "refresh_token",
-  "secret_access_key",
-  "passphrase",
-  "private_key",
-  "signing_key",
-  "authorization"
-];
-const SENSITIVE_PLURAL_KEYS = new Set([
-  "tokens",
-  "api_keys",
-  "passwords",
-  "secrets",
-  "credentials",
-  "client_secrets",
-  "access_tokens",
-  "refresh_tokens",
-  "session_tokens",
-  "passphrases",
-  "private_keys",
-  "signing_keys",
-  "authorizations"
-]);
-
-function normalizeSecretValue(value) {
-  return String(value ?? "")
-    .trim()
-    .replace(/^[`"']|[`"']$/g, "")
-    .replace(/[.;)]+$/g, "");
-}
-
-function patternMatches(pattern, value) {
-  pattern.lastIndex = 0;
-  return pattern.test(value);
-}
-
-function looksLikeKnownSecret(value) {
-  return TOKEN_PATTERNS.some((pattern) => patternMatches(pattern, value))
-    || patternMatches(CONNECTION_URL_PATTERN, value)
-    || patternMatches(BEARER_PATTERN, value);
-}
-
-function normalizeSecretKey(key) {
-  return String(key ?? "")
-    .trim()
-    .replace(/^["']|["']$/g, "")
-    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-    .replace(/[^A-Za-z0-9]+/g, "_")
-    .replace(/^_+|_+$/g, "")
-    .toLowerCase();
-}
-
-function keyLooksSensitive(key) {
-  const normalized = normalizeSecretKey(key);
-  return SENSITIVE_PLURAL_KEYS.has(normalized) || SENSITIVE_KEY_TERMS.some((term) => normalized === term
-    || normalized.endsWith(`_${term}`));
-}
-
-function valueLooksPlaceholder(value) {
-  const clean = normalizeSecretValue(value);
-  if (!clean) return true;
-  if (/^(?:null|undefined|none|false|true|0|""|'')$/i.test(clean)) return true;
-  if (/^<[^>\n]{1,80}>$/.test(clean)) return true;
-  if (/^\[REDACTED_SECRET\]$/i.test(clean)) return true;
-  if (/^(?:not-set|unset|placeholder|example|changeme|change-me|redacted|xxx|\*{3,})$/i.test(clean)) return true;
-  if (/^your[-_][a-z0-9][a-z0-9_-]*$/i.test(clean)) return true;
-  return false;
-}
-
-// Length is only evidence where the syntax is ambiguous, and `=` is not.
-//
-// A short value used to be kept in the clear whatever the syntax, so `TOKEN=hunter2`
-// and `PASSWORD=short7` went into the ledger verbatim. Every name in
-// SENSITIVE_KEY_TERMS states outright what it holds — there is no `key` or `id`
-// among them — so under an `=`, or inside quotes, a non-placeholder value is the
-// secret the key says it is, at any length.
-//
-// A bare `:` is the ambiguous case, because English uses it too: `password: short`
-// and `The secret: always run tests` are prose, and `Authorization: Token abc123`
-// puts the scheme name where a value would go. Those keep a length bar.
-const SHORT_VALUE_MIN_LENGTH = 8;
-const AMBIGUOUS_VALUE_MIN_LENGTH = 12;
-
-function valueLooksSensitive(key, value, syntax = "unquoted-colon") {
-  const clean = normalizeSecretValue(value);
-  if (!clean || valueLooksPlaceholder(clean)) return false;
-  if (looksLikeKnownSecret(clean)) return true;
-  if (!keyLooksSensitive(key)) return false;
-  if (syntax !== "unquoted-colon") return true;
-  return clean.length >= (keyNamesASecretOutright(key) ? SHORT_VALUE_MIN_LENGTH : AMBIGUOUS_VALUE_MIN_LENGTH);
-}
-
-// Under a bare `:`, these names carry enough intent on their own to redact a short
-// value; the broader terms wait for length before touching prose.
-function keyNamesASecretOutright(key) {
-  const normalized = normalizeSecretKey(key);
-  return ["password", "passwd", "pwd", "secret", "credential", "passphrase", "private_key", "signing_key"]
-    .some((term) => normalized === term || normalized.endsWith(`_${term}`))
-    || ["passwords", "secrets", "credentials", "passphrases", "private_keys", "signing_keys"].includes(normalized);
-}
-
-function assignmentSyntax(separator) {
-  return separator === "=" ? "assignment" : "unquoted-colon";
-}
-
-export function redactSensitiveText(input) {
-  if (typeof input !== "string") return { text: "", redacted: false };
-  let text = input;
-
-  text = text.replace(CONNECTION_URL_PATTERN, (_match, prefix, _password, suffix) => `${prefix}${REDACTION}${suffix}`);
-  text = text.replace(BEARER_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
-  text = text.replace(BASIC_AUTH_PATTERN, (_match, prefix) => `${prefix}${REDACTION}`);
-  text = text.replace(AUTHORIZATION_HEADER_PATTERN, (match, prefix, scheme, spacing, value) => {
-    const syntax = AUTHORIZATION_SCHEMES.has(scheme.toLowerCase()) ? "assignment" : "unquoted-colon";
-    if (!valueLooksSensitive("authorization", value, syntax)) return match;
-    return `${prefix}${scheme}${spacing}${REDACTION}`;
-  });
-
-  // Over-redaction is the safe direction here: a flag whose name says "secret"
-  // and whose argument is a plain name — `docker service create --secret build` —
-  // loses that name from the record and cannot serve as verify evidence. Reading
-  // the name as the credential it is called is the cheaper mistake.
-  text = text.replace(CLI_OPTION_SECRET_PATTERN, (match, prefix, flag, separator, value) => {
-    // A following option is the next flag, not this flag's argument.
-    if (separator !== "=" && value.startsWith("-")) return match;
-    if (!keyLooksSensitive(flag) || !valueLooksSensitive(flag, value, "assignment")) return match;
-    return `${prefix}${flag}${separator === "=" ? "= " : " "}${REDACTION}`;
-  });
-
-  for (const pattern of TOKEN_PATTERNS) text = text.replace(pattern, REDACTION);
-
-  text = text.replace(QUERY_SECRET_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "assignment")) return match;
-    return `${prefix}${key}${separator}${REDACTION}`;
-  });
-
-  text = text.replace(DOUBLE_QUOTED_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "quoted")) return match;
-    return `${prefix}${key}${separator} "${REDACTION}"`;
-  });
-
-  text = text.replace(SINGLE_QUOTED_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, "quoted")) return match;
-    return `${prefix}${key}${separator} '${REDACTION}'`;
-  });
-
-  text = text.replace(SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, separator, value) => {
-    if (!keyLooksSensitive(key) || !valueLooksSensitive(key, value, assignmentSyntax(separator))) return match;
-    return `${prefix}${key}${separator} ${REDACTION}`;
-  });
-
-  text = text.replace(WHITESPACE_SECRET_ASSIGNMENT_PATTERN, (match, prefix, key, quote, value) => {
-    if (!valueLooksSensitive(key, value)) return match;
-    return `${prefix}${key}${quote}${REDACTION}`;
-  });
-
-  return { text, redacted: text !== input };
-}
+import {
+  REDACTION,
+  keyLooksSensitive,
+  redactSensitiveText,
+  valueLooksSensitive
+} from "./sensitive-text.js";
+
+export { redactSensitiveText } from "./sensitive-text.js";
+export {
+  redactSensitiveShellSourceText,
+  redactSensitiveSourceText
+} from "./sensitive-source-formats.js";
+export { redactSensitiveProjectFileText } from "./sensitive-project-file.js";
 
 export function containsSensitiveText(input) {
   return typeof input === "string" && redactSensitiveText(input).redacted;

package/packages/piagent-core/security/sensitive-project-file.js

@@ -0,0 +1,42 @@
+import { redactSensitiveText } from "./sensitive-text.js";
+import {
+  redactSensitiveCssText,
+  redactSensitiveMarkupText,
+  redactSensitiveObjectiveCText,
+  redactSensitiveShellSourceText,
+  redactSensitiveSourceText,
+  redactSensitiveYamlText,
+  redactSourceText
+} from "./sensitive-source-formats.js";
+
+const PROJECT_SOURCE_CODE_PATH = /\.(?:[cm]?[jt]sx?|py|rb|php|java|kt|kts|swift|go|rs|c|cc|cpp|cxx|h|hh|hpp|hxx|cs|scala|lua|r|dart|ex|exs|erl|hrl|fs|fsx|vb|sql|vue|svelte)$/i;
+const PROJECT_SHELL_SOURCE_PATH = /\.(?:sh|bash|zsh|fish)$/i;
+const PROJECT_HASH_COMMENT_SOURCE_PATH = /\.(?:py|rb|php|r|ex|exs)$/i;
+const PROJECT_YAML_PATH = /\.ya?ml$/i;
+const PROJECT_MARKUP_PATH = /\.(?:html?|xml|svg)$/i;
+const PROJECT_CSS_PATH = /\.(?:css|scss)$/i;
+const PROJECT_OBJECTIVE_C_PATH = /\.mm?$/i;
+
+export function redactSensitiveProjectFileText(filePath, input) {
+  const source = typeof input === "string" ? input : "";
+  const result = PROJECT_SHELL_SOURCE_PATH.test(String(filePath ?? ""))
+    ? redactSensitiveShellSourceText(source)
+    : PROJECT_YAML_PATH.test(String(filePath ?? ""))
+      ? redactSensitiveYamlText(source)
+      : PROJECT_MARKUP_PATH.test(String(filePath ?? ""))
+        ? redactSensitiveMarkupText(source)
+        : PROJECT_CSS_PATH.test(String(filePath ?? ""))
+          ? redactSensitiveCssText(source)
+          : PROJECT_OBJECTIVE_C_PATH.test(String(filePath ?? ""))
+            ? redactSensitiveObjectiveCText(source)
+    : PROJECT_SOURCE_CODE_PATH.test(String(filePath ?? ""))
+      ? redactSourceText(source, {
+        shellOnly: false,
+        hashComments: PROJECT_HASH_COMMENT_SOURCE_PATH.test(String(filePath ?? ""))
+      })
+      : redactSensitiveText(source);
+  return {
+    ...result,
+    lineCountPreserved: (source.match(/\n/g) ?? []).length === (result.text.match(/\n/g) ?? []).length
+  };
+}

package/packages/piagent-core/security/sensitive-source-expression.js

@@ -0,0 +1,330 @@
+import {
+  REDACTION,
+  SENSITIVE_KEY_TERMS,
+  SENSITIVE_PLURAL_KEYS,
+  keyLooksSensitive,
+  looksLikeKnownSecret,
+  normalizeSecretKey,
+  redactSensitiveTextInternal,
+  valueLooksPlaceholder
+} from "./sensitive-text.js";
+
+const SOURCE_ASSIGNMENT_START_PATTERN = /(^|[\s{[(;,])((?:(?:const|let|var)\s+)?(#?[$@%]?[A-Za-z_$][A-Za-z0-9_$]*)\s*(?:>>>=|<<=|>>=|\|\|=|\?\?=|&&=|\+=|-=|\*=|\/=|%=|&=|\|=|\^=|<-|:=|=)\s*)/g;
+const SOURCE_TYPED_DECLARATION_START_PATTERN = /(^|[\s{[(;,])((?:const|var)\s+(#?[$@%]?[A-Za-z_$][A-Za-z0-9_$]*)\s+(?:\*|\[\])*[A-Za-z_$][A-Za-z0-9_$.[\]*]*\s*=\s*)/g;
+const SOURCE_COMPOUND_ASSIGNMENT_START_PATTERN = /(^|[\s{[(;,])((#?[$@%]?[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\?\.|\.|->|::)#?[A-Za-z_$][A-Za-z0-9_$]*|\[(?:"[^"\r\n]*"|'[^'\r\n]*'|[A-Za-z_$][A-Za-z0-9_$]*)\])+\s*(?:>>>=|<<=|>>=|\|\|=|\?\?=|&&=|\+=|-=|\*=|\/=|%=|&=|\|=|\^=|<-|:=|=)\s*))/g;
+const SOURCE_BRACE_INITIALIZER_START_PATTERN = /(^|[\s{[(;,])((?:(?:const\s+)?[A-Za-z_$][A-Za-z0-9_$:<>,*&[\]]*\s+)+(#?[$@%]?[A-Za-z_$][A-Za-z0-9_$]*)\s*\{\s*)/g;
+const SOURCE_PREPROCESSOR_DEFINE_START_PATTERN = /(^|[\r\n])([ \t]*#\s*define\s+([A-Za-z_][A-Za-z0-9_]*)\s+)/g;
+const SOURCE_PROPERTY_START_PATTERN = /(^|[\s{[(;,])((?:["']?)([A-Za-z_$][A-Za-z0-9_$]*)(?:["']?)\s*:(?!=)\s*)/g;
+const SOURCE_COMPUTED_PROPERTY_START_PATTERN = /(^|[\s{[(;,])(\[\s*["']([A-Za-z_$][A-Za-z0-9_$]*)["']\s*\]\s*:(?!=)\s*)/g;
+const SOURCE_TEMPLATE_DOUBLE_BINDING_PATTERN = /((?::|v-bind:)([A-Za-z_$][A-Za-z0-9_$.-]*)\s*=\s*)"((?:\\.|[^"\\\r\n])*)"/g;
+const SOURCE_TEMPLATE_SINGLE_BINDING_PATTERN = /((?::|v-bind:)([A-Za-z_$][A-Za-z0-9_$.-]*)\s*=\s*)'((?:\\.|[^'\\\r\n])*)'/g;
+const SHELL_REFERENCE_PATTERN = /^\$(?:[A-Za-z_][A-Za-z0-9_]*|\{[A-Za-z_][A-Za-z0-9_]*\}|\([A-Za-z0-9_./:-]+(?:\s+\$[A-Za-z_][A-Za-z0-9_]*)*\))$/;
+const SOURCE_CALL_START_PATTERN = /(^|[^A-Za-z0-9_$])([$@%]?[A-Za-z_$][A-Za-z0-9_$]*(?:(?:\.|->|::)[A-Za-z_$][A-Za-z0-9_$]*)*)\s*\(/g;
+
+function balancedSourceExpression(value) {
+  const stack = [];
+  const pairs = { ")": "(", "]": "[", "}": "{" };
+  for (const character of value) {
+    if (character === "(" || character === "[" || character === "{") stack.push(character);
+    else if (character === ")" || character === "]" || character === "}") {
+      if (stack.pop() !== pairs[character]) return false;
+    }
+  }
+  return stack.length === 0;
+}
+
+function maskSourceLookupStrings(value) {
+  let valid = true;
+  const text = value.replace(/"((?:\\.|[^"\\\r\n])*)"|'((?:\\.|[^'\\\r\n])*)'/g, (match, doubleQuoted, singleQuoted, offset) => {
+    const literal = doubleQuoted ?? singleQuoted ?? "";
+    const normalized = normalizeSecretKey(literal);
+    const exactLookupKey = SENSITIVE_KEY_TERMS.includes(normalized) || SENSITIVE_PLURAL_KEYS.has(normalized);
+    const environmentLookupKey = /^[A-Z][A-Z0-9_]{1,79}$/.test(literal) && keyLooksSensitive(literal);
+    const before = value.slice(0, offset).trimEnd();
+    const after = value.slice(offset + match.length).trimStart();
+    const bracketLookup = /\[@?$/.test(before) && after.startsWith("]");
+    const accessorLookup = /(?:(?:\.|->|::)(?:get|lookup|valueForKey)|\b(?:getenv|lookup))\s*\($/i.test(before)
+      && /^(?:,|\))/.test(after);
+    const objectiveAccessorLookup = /(?:objectForKey|valueForKey|forKey)\s*:\s*@?$/i.test(before)
+      && /^(?:\]|\s)/.test(after);
+    if ((!exactLookupKey && !environmentLookupKey) || (!bracketLookup && !accessorLookup && !objectiveAccessorLookup)) valid = false;
+    return "PIAGENT_LOOKUP_KEY";
+  });
+  if (!valid || /["'`]/.test(text)) return undefined;
+  return text;
+}
+
+function hasStandaloneNumericSourceLiteral(value) {
+  const pattern = /(^|[^A-Za-z0-9_$])(?:0[xX][0-9A-Fa-f]+|0[bB][01]+|0[oO][0-7]+|(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?n?)(?=$|[^A-Za-z0-9_$])/g;
+  for (let match = pattern.exec(value); match; match = pattern.exec(value)) {
+    const literalStart = match.index + match[1].length;
+    const literalEnd = pattern.lastIndex;
+    const before = value.slice(0, literalStart).trimEnd();
+    const after = value.slice(literalEnd).trimStart();
+    const bracketIndex = before.endsWith("[") && after.startsWith("]")
+      && /[A-Za-z0-9_$)\]]\s*\[$/.test(before);
+    if (!bracketIndex) return true;
+  }
+  return false;
+}
+
+function hasStandaloneKeywordSourceLiteral(value) {
+  const pattern = /(^|[^A-Za-z0-9_$])(?:null|undefined|true|false|nil|none|yes|no)(?=$|[^A-Za-z0-9_$])/gi;
+  for (let match = pattern.exec(value); match; match = pattern.exec(value)) {
+    const literalStart = match.index + match[1].length;
+    const before = value.slice(0, literalStart).trimEnd();
+    if (!before.endsWith(".") && !before.endsWith("->") && !before.endsWith("::")) return true;
+  }
+  return false;
+}
+
+function sourceReference(value, shellOnly) {
+  const clean = String(value ?? "").trim();
+  if (!clean) return false;
+  if (shellOnly) return !redactSensitiveTextInternal(clean).redacted && SHELL_REFERENCE_PATTERN.test(clean);
+  if (looksLikeKnownSecret(clean)) return false;
+  // Ruby percent literals and heredoc openers are literal syntax, not dynamic
+  // references. Never shield their contents from the source redactor.
+  if (/^%(?:q|Q|w|W|i|I|x|r|s)?[({[<]/.test(clean) || /^<<[-~]?/.test(clean)) return false;
+  const masked = maskSourceLookupStrings(clean);
+  if (!masked || !/^(?:await\s+)?[$@%]?[A-Za-z_]/.test(masked)
+    || !/^[A-Za-z0-9_$@%?.()[\]{},!:\s|&+*/<>=-]+$/.test(masked)
+    || !balancedSourceExpression(masked)
+    || hasStandaloneNumericSourceLiteral(masked)
+    || hasStandaloneKeywordSourceLiteral(masked)) return false;
+  return true;
+}
+
+function sourceExpressionEnd(segment, start) {
+  const stack = [];
+  const pairs = { ")": "(", "]": "[", "}": "{" };
+  let quote = "", escaped = false, sawValue = false;
+  for (let index = start; index < segment.length; index += 1) {
+    const character = segment[index];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === quote) quote = "";
+      continue;
+    }
+    if (character === "\"" || character === "'" || character === "`") {
+      quote = character;
+      sawValue = true;
+      continue;
+    }
+    if (character === "(" || character === "[" || character === "{") stack.push(character);
+    else if (character === ")" || character === "]" || character === "}") {
+      if (stack.length === 0) return index;
+      if (stack.at(-1) === pairs[character]) stack.pop();
+    } else if (stack.length === 0 && (character === ";" || character === ",")) {
+      return index;
+    } else if (stack.length === 0 && (character === "\r" || character === "\n")) {
+      if (character === "\r" && segment[index + 1] === "\n") continue;
+      const before = segment.slice(start, index).trimEnd();
+      const after = segment.slice(index + 1).trimStart();
+      const trailingContinuation = /(?:\b(?:await|return|yield|throw|new)|\?\.|\?\?|\|\||&&|[.?:+*/%&|=,<>{[(\\-])$/.test(before);
+      const leadingContinuation = /^(?:\?\.|\?\?|\|\||&&|[([.'"`?:+*/%&|,<>=-])/.test(after);
+      if (sawValue && !trailingContinuation && !leadingContinuation) return index;
+    } else if (!/\s/.test(character)) {
+      sawValue = true;
+    }
+  }
+  return segment.length;
+}
+
+function rewriteSensitiveStarts(segment, pattern, { allowDynamic, shellOnly, placeholder, acceptMatch, reference = sourceReference }) {
+  let output = "", cursor = 0;
+  pattern.lastIndex = 0;
+  for (let match = pattern.exec(segment); match; match = pattern.exec(segment)) {
+    if (match.index < cursor || !keyLooksSensitive(match[3]) || (acceptMatch && !acceptMatch(match))) continue;
+    const valueStart = pattern.lastIndex;
+    const valueEnd = sourceExpressionEnd(segment, valueStart);
+    const rawExpression = segment.slice(valueStart, valueEnd);
+    const expression = rawExpression.trim();
+    const complete = segment.slice(match.index, valueEnd);
+    output += segment.slice(cursor, match.index);
+    const trailingHorizontalWhitespace = rawExpression.match(/[ \t]+$/)?.[0] ?? "";
+    const lineEndings = (rawExpression.match(/\r\n|\n|\r/g) ?? []).join("");
+    output += allowDynamic && reference(expression, shellOnly)
+      ? placeholder(complete)
+      : `${match[1]}${match[2]}${REDACTION}${lineEndings}${trailingHorizontalWhitespace}`;
+    cursor = valueEnd;
+    pattern.lastIndex = valueEnd;
+  }
+  return `${output}${segment.slice(cursor)}`;
+}
+
+function callCloseIndex(segment, openIndex) {
+  let depth = 0, quote = "", escaped = false;
+  for (let index = openIndex; index < segment.length; index += 1) {
+    const character = segment[index];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === quote) quote = "";
+      continue;
+    }
+    if (character === "\"" || character === "'" || character === "`") quote = character;
+    else if (character === "(") depth += 1;
+    else if (character === ")") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+  }
+  return -1;
+}
+
+function callArgumentRanges(segment, start, end) {
+  const ranges = [];
+  let cursor = start, quote = "", escaped = false;
+  const stack = [];
+  const pairs = { ")": "(", "]": "[", "}": "{" };
+  for (let index = start; index <= end; index += 1) {
+    const character = index === end ? "," : segment[index];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === quote) quote = "";
+      continue;
+    }
+    if (character === "\"" || character === "'" || character === "`") quote = character;
+    else if (character === "(" || character === "[" || character === "{") stack.push(character);
+    else if (character === ")" || character === "]" || character === "}") {
+      if (stack.at(-1) === pairs[character]) stack.pop();
+    } else if (character === "," && stack.length === 0) {
+      ranges.push({ start: cursor, end: index });
+      cursor = index + 1;
+    }
+  }
+  return ranges;
+}
+
+function quotedSensitiveLookupKey(value) {
+  const match = /^\s*(["'])((?:\\.|(?!\1)[\s\S])*)\1\s*$/.exec(value);
+  if (!match) return false;
+  const normalized = normalizeSecretKey(match[2]);
+  return SENSITIVE_KEY_TERMS.includes(normalized) || SENSITIVE_PLURAL_KEYS.has(normalized)
+    || (/^[A-Z][A-Z0-9_]{1,79}$/.test(match[2]) && keyLooksSensitive(match[2]));
+}
+
+function setterValueArgument(callee, argumentValues) {
+  const name = callee.split(/\.|->|::/).at(-1) ?? "";
+  const direct = /^(?:set|put|store|update|write|add|assign)(.+)$/i.exec(name);
+  if (direct && keyLooksSensitive(direct[1]) && argumentValues.length >= 1) return 0;
+  if (["set", "put", "store", "update", "write", "add", "assign"].includes(name.toLowerCase())
+    && argumentValues.length >= 2 && quotedSensitiveLookupKey(argumentValues[0])) return 1;
+  return -1;
+}
+
+function couldSetSensitiveValue(callee, segment, openIndex) {
+  const name = callee.split(/\.|->|::/).at(-1) ?? "";
+  const direct = /^(?:set|put|store|update|write|add|assign)(.+)$/i.exec(name);
+  if (direct && keyLooksSensitive(direct[1])) return true;
+  if (!["set", "put", "store", "update", "write", "add", "assign"].includes(name.toLowerCase())) return false;
+
+  // Generic setters can only name a sensitive destination through their first
+  // quoted argument. Check that argument before looking for the matching close.
+  // This keeps deeply nested non-sensitive `set(...)` calls from each rescanning
+  // the entire suffix of the source file.
+  const firstArgument = /^\s*((?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'))\s*,/.exec(segment.slice(openIndex + 1));
+  return Boolean(firstArgument && quotedSensitiveLookupKey(firstArgument[1]));
+}
+
+function rewriteSensitiveCalls(segment, { allowDynamic, placeholder }) {
+  let output = "", cursor = 0;
+  SOURCE_CALL_START_PATTERN.lastIndex = 0;
+  for (let match = SOURCE_CALL_START_PATTERN.exec(segment); match; match = SOURCE_CALL_START_PATTERN.exec(segment)) {
+    if (match.index < cursor) continue;
+    const openIndex = SOURCE_CALL_START_PATTERN.lastIndex - 1;
+    if (!couldSetSensitiveValue(match[2], segment, openIndex)) {
+      // Resume on the opening delimiter so a nested setter in the first
+      // argument remains discoverable. Avoiding a full matching-close scan for
+      // every ordinary nested call keeps this pass linear for adversarially
+      // deep call expressions.
+      SOURCE_CALL_START_PATTERN.lastIndex = openIndex;
+      continue;
+    }
+    const closeIndex = callCloseIndex(segment, openIndex);
+    if (closeIndex < 0) continue;
+    const ranges = callArgumentRanges(segment, openIndex + 1, closeIndex);
+    const values = ranges.map((range) => segment.slice(range.start, range.end));
+    const valueIndex = setterValueArgument(match[2], values);
+    if (valueIndex < 0) {
+      // Restart on the opening delimiter so the regex can consume it as the
+      // prefix of a nested call in the first argument. Advancing past it skips
+      // `setToken(...)` in `wrapper(setToken(...), ...)`.
+      SOURCE_CALL_START_PATTERN.lastIndex = openIndex;
+      continue;
+    }
+    const range = ranges[valueIndex];
+    const expression = segment.slice(range.start, range.end);
+    if (allowDynamic && sourceReference(expression, false)) {
+      SOURCE_CALL_START_PATTERN.lastIndex = closeIndex + 1;
+      continue;
+    }
+    output += segment.slice(cursor, range.start);
+    output += `${REDACTION}${"\n".repeat((expression.match(/\n/g) ?? []).length)}`;
+    cursor = range.end;
+    SOURCE_CALL_START_PATTERN.lastIndex = closeIndex + 1;
+  }
+  return `${output}${segment.slice(cursor)}`;
+}
+
+function rewriteSensitiveValueDecorators(segment) {
+  const rewrite = (pattern, quote) => segment.replace(pattern, (match, prefix, literal, suffix) => {
+    const identifiers = suffix.match(/[$@%]?[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+    const field = identifiers.at(-1) ?? "";
+    const lookup = /^\$\{[A-Za-z_][A-Za-z0-9_.:-]*\}$/.test(literal);
+    if (!keyLooksSensitive(field) || lookup || valueLooksPlaceholder(literal)) return match;
+    return `${prefix}${quote}${REDACTION}${quote}${suffix}`;
+  });
+  let result = rewrite(/(@Value\s*\(\s*)"((?:\\.|[^"\\\r\n])*)"(\s*\)[^;\r\n]{0,160})/g, "\"");
+  result = result.replace(/(@Value\s*\(\s*)'((?:\\.|[^'\\\r\n])*)'(\s*\)[^;\r\n]{0,160})/g, (match, prefix, literal, suffix) => {
+    const identifiers = suffix.match(/[$@%]?[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+    const field = identifiers.at(-1) ?? "";
+    const lookup = /^\$\{[A-Za-z_][A-Za-z0-9_.:-]*\}$/.test(literal);
+    if (!keyLooksSensitive(field) || lookup || valueLooksPlaceholder(literal)) return match;
+    return `${prefix}'${REDACTION}'${suffix}`;
+  });
+  return result;
+}
+
+function rewriteSensitiveSegment(segment, { allowDynamic, shellOnly, placeholder }) {
+  let result = rewriteSensitiveStarts(segment, SOURCE_PREPROCESSOR_DEFINE_START_PATTERN, { allowDynamic, shellOnly, placeholder });
+  result = rewriteSensitiveStarts(result, SOURCE_COMPOUND_ASSIGNMENT_START_PATTERN, { allowDynamic, shellOnly, placeholder });
+  result = rewriteSensitiveStarts(result, SOURCE_TYPED_DECLARATION_START_PATTERN, { allowDynamic, shellOnly, placeholder });
+  result = rewriteSensitiveStarts(result, SOURCE_ASSIGNMENT_START_PATTERN, { allowDynamic, shellOnly, placeholder });
+  if (!shellOnly) {
+    result = rewriteSensitiveStarts(result, SOURCE_BRACE_INITIALIZER_START_PATTERN, {
+      allowDynamic,
+      shellOnly: false,
+      placeholder,
+      acceptMatch: (match) => !/^\s*(?:(?:export|public|private|protected|abstract|final|sealed|static|partial)\s+)*(?:class|struct|interface|enum|union|namespace|record)\b/.test(match[2])
+    });
+    result = rewriteSensitiveStarts(result, SOURCE_COMPUTED_PROPERTY_START_PATTERN, { allowDynamic, shellOnly: false, placeholder });
+    result = rewriteSensitiveStarts(result, SOURCE_PROPERTY_START_PATTERN, { allowDynamic, shellOnly: false, placeholder });
+    result = rewriteSensitiveCalls(result, { allowDynamic, placeholder });
+    result = rewriteSensitiveValueDecorators(result);
+    const rewriteTemplate = (pattern, quote) => {
+      result = result.replace(pattern, (match, prefix, key, value) => {
+        if (!keyLooksSensitive(key)) return match;
+        return allowDynamic && sourceReference(value, false)
+          ? placeholder(match)
+          : `${prefix}${quote}${REDACTION}${quote}`;
+      });
+    };
+    rewriteTemplate(SOURCE_TEMPLATE_DOUBLE_BINDING_PATTERN, "\"");
+    rewriteTemplate(SOURCE_TEMPLATE_SINGLE_BINDING_PATTERN, "'");
+  }
+  return result;
+}
+
+export {
+  balancedSourceExpression,
+  hasStandaloneKeywordSourceLiteral,
+  hasStandaloneNumericSourceLiteral,
+  maskSourceLookupStrings,
+  rewriteSensitiveSegment,
+  rewriteSensitiveStarts,
+  sourceReference
+};