@sayknow-cli/utils 0.7.10 → 0.7.12

package/src/index.ts

@@ -2,13 +2,18 @@ export { createAbortableStream, once, untilAborted } from "./abortable";
 export * from "./async";
 export * from "./broken-pipe";
 export * from "./color";
+export * from "./crash-fingerprint";
+export * from "./crash-journal";
+export * from "./crash-redaction";
 export * from "./dirs";
 export * from "./env";
+export * from "./error-classification";
 export * from "./fetch-retry";
 export * from "./format";
 export * from "./frontmatter";
 export * from "./fs-error";
 export * from "./glob";
+export * from "./header-value";
 export * from "./hook-fetch";
 export * from "./json";
 export * as logger from "./logger";
@@ -20,6 +25,7 @@ export * as procmgr from "./procmgr";
 export * as prompt from "./prompt";
 export * as ptree from "./ptree";
 export { AbortError, ChildProcess, Exception, NonZeroExitError } from "./ptree";
+export * from "./safe-error";
 export * from "./safe-stderr";
 export * from "./sanitize-text";
 export * from "./snowflake";

package/src/logger.ts

@@ -11,15 +11,164 @@
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "node:fs";
+import * as path from "node:path";
 import type * as winston from "winston";
-import { getLogsDir } from "./dirs";
+import { getEffectiveLogsDir } from "./dirs";
 
-/** Ensure a logs directory exists; return the resolved path. */
+const LOG_DIR_MODE = 0o700;
+const LOG_FILE_MODE = 0o600;
+
+type LogPathPlatform = NodeJS.Platform | "posix";
+
+function logPathKind(platform: LogPathPlatform): "posix" | "win32" {
+	return platform === "win32" ? "win32" : "posix";
+}
+
+function isLogSeparator(char: string, platform: LogPathPlatform): boolean {
+	return char === "/" || (logPathKind(platform) === "win32" && char === "\\");
+}
+
+/** A filesystem root. On POSIX a backslash is a file name, not a root or a separator. */
+export function isFsRoot(target: string, platform: LogPathPlatform = process.platform): boolean {
+	if (logPathKind(platform) === "win32") {
+		return target === "/" || target === "\\" || /^[A-Za-z]:[\\/]$/.test(target);
+	}
+	if (target.length === 0) return false;
+	for (const char of target) {
+		if (char !== "/") return false;
+	}
+	return true;
+}
+
+/**
+ * Drop trailing separators without changing the directory name.
+ * POSIX removes only `/`. Windows also removes `\`.
+ * A root keeps one separator so `C:\` does not become the drive-relative name `C:`.
+ */
+export function lexicalLogPath(target: string, platform: LogPathPlatform = process.platform): string {
+	if (target.length === 0) return target;
+	let end = target.length;
+	while (end > 0 && isLogSeparator(target[end - 1] ?? "", platform)) {
+		const kept = target.slice(0, end);
+		const shorter = target.slice(0, end - 1);
+		if (isFsRoot(kept, platform) && !isFsRoot(shorter, platform)) break;
+		if (end === 1) break;
+		end -= 1;
+	}
+	return target.slice(0, end);
+}
+
+function pathFor(platform: LogPathPlatform): { normalize(target: string): string } {
+	return logPathKind(platform) === "win32" ? path.win32 : path.posix;
+}
+
+/** True when "." / ".." collapse to a filesystem root. Does not follow symlinks. */
+export function resolvesAsFsRoot(target: string, platform: LogPathPlatform = process.platform): boolean {
+	const lexical = lexicalLogPath(target, platform);
+	if (isFsRoot(lexical, platform)) return true;
+	const collapsed = lexicalLogPath(pathFor(platform).normalize(lexical), platform);
+	return isFsRoot(collapsed, platform);
+}
+
+/** Skip mode repair for every spelling of a filesystem root. The transport path stays unchanged. */
+function skipRootModeRepair(target: string): boolean {
+	const lexical = lexicalLogPath(target);
+	if (resolvesAsFsRoot(lexical) || resolvesAsFsRoot(path.resolve(lexical))) return true;
+	try {
+		return resolvesAsFsRoot(fs.realpathSync.native(lexical));
+	} catch {
+		return false;
+	}
+}
+
+/** Drop a trailing "/." so "./link/." is judged as "./link". ".." is not collapsed. */
+function pathForSymlinkCheck(target: string): string {
+	let current = lexicalLogPath(target);
+	const win = process.platform === "win32";
+	for (;;) {
+		const dot = current.endsWith("/.") || (win && current.endsWith("\\."));
+		if (!dot) return current;
+		current = lexicalLogPath(current.slice(0, -2));
+	}
+}
+
+function isFinalSymlink(target: string): boolean {
+	try {
+		return fs.lstatSync(pathForSymlinkCheck(target)).isSymbolicLink();
+	} catch {
+		return false;
+	}
+}
+
+/** True when this inode is the filesystem root. Unknown identity fails closed. */
+function inodeIsFsRoot(st: fs.Stats): boolean {
+	if (process.platform === "win32") return false;
+	try {
+		const root = fs.statSync("/");
+		return st.dev === root.dev && st.ino === root.ino;
+	} catch {
+		return true;
+	}
+}
+
+/** Clear group/world bits on this inode. A symlink, including a "." suffix, is not opened. */
+function tightenOwnerOnly(target: string, mode: number, kind: "directory" | "file"): void {
+	const lexical = lexicalLogPath(target);
+	if (skipRootModeRepair(lexical) || isFinalSymlink(lexical)) return;
+	// A trailing "/." is not the directory. lstat and O_NOFOLLOW must use the
+	// same path the symlink check used, or a swapped link is followed.
+	const repairPath = kind === "directory" ? pathForSymlinkCheck(lexical) : lexical;
+	let fd: number | undefined;
+	try {
+		const listed = fs.lstatSync(repairPath);
+		if (kind === "directory" ? !listed.isDirectory() : !listed.isFile()) return;
+		if (inodeIsFsRoot(listed) || (listed.mode & 0o077) === 0) return;
+		const noFollow = (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0);
+		const directoryFlag = kind === "directory" ? (fs.constants.O_DIRECTORY ?? 0) : 0;
+		const writeOnly = fs.constants.O_WRONLY | noFollow;
+		const readOnly = fs.constants.O_RDONLY | noFollow | directoryFlag;
+		try {
+			fd = fs.openSync(repairPath, kind === "file" ? writeOnly : readOnly);
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code !== "EACCES" && code !== "EPERM") throw error;
+			try {
+				if (kind !== "file") throw error;
+				fd = fs.openSync(repairPath, fs.constants.O_RDONLY | noFollow);
+			} catch (again) {
+				const againCode = (again as NodeJS.ErrnoException).code;
+				if (againCode !== "EACCES" && againCode !== "EPERM") throw again;
+				reportSkippedRepair(kind);
+				return;
+			}
+		}
+		const opened = fs.fstatSync(fd);
+		if (opened.dev !== listed.dev || opened.ino !== listed.ino || inodeIsFsRoot(opened)) return;
+		if (kind === "directory" ? !opened.isDirectory() : !opened.isFile()) return;
+		if ((opened.mode & 0o077) === 0) return;
+		fs.fchmodSync(fd, mode);
+	} catch {
+		// A mode repair must not take logging down.
+	} finally {
+		if (fd !== undefined) {
+			try {
+				fs.closeSync(fd);
+			} catch {
+				// The mode was already repaired, or the close raced an exit.
+			}
+		}
+	}
+}
+
+/** Ensure a logs directory exists at mode 0700; return the path the transport should use. */
 function ensureDir(dir: string): string {
-	if (!fs.existsSync(dir)) {
-		fs.mkdirSync(dir, { recursive: true });
+	const lexical = lexicalLogPath(dir);
+	if (skipRootModeRepair(lexical) || isFinalSymlink(lexical)) return lexical;
+	if (!fs.existsSync(lexical)) {
+		fs.mkdirSync(lexical, { recursive: true, mode: LOG_DIR_MODE });
 	}
-	return dir;
+	tightenOwnerOnly(lexical, LOG_DIR_MODE, "directory");
+	return lexical;
 }
 
 type WinstonModule = typeof import("winston");
@@ -34,6 +183,7 @@ let dailyRotateFileCtor: DailyRotateFileCtor | undefined;
 let winstonLogger: Logger | undefined;
 let loggerInit: Promise<Logger> | undefined;
 let flushingBufferedLogs = false;
+let repairNoteQueued = false;
 const bufferedLogs: LogRecord[] = [];
 /** Cap pre-init buffering so a hung/failed winston import cannot grow heap unboundedly. */
 const MAX_BUFFERED_LOGS = 10_000;
@@ -73,18 +223,57 @@ function makeLogFormat(winston: WinstonModule): winston.Logform.Format {
 	);
 }
 
-/** Build a rotating file transport, materializing the target directory lazily. */
+/**
+ * Build a rotating file transport, materializing the target directory lazily.
+ *
+ * Destination precedence:
+ *   1. `dir` — an explicit path from {@link setTransports}(`{ file: "<path>" }`).
+ *   2. {@link getEffectiveLogsDir} — the provenance-checked `SKC_LOG_DIR`
+ *      override, else the real config root (`~/.skc/logs`).
+ *
+ * The resolution is centralized in `dirs.ts` rather than read from the
+ * environment here: the log *readers* (report bundles, the debug log view, the
+ * HTTP dump directory) call the same helper, and a second env read in this file
+ * is what let the transport write somewhere the readers never looked.
+ */
 function makeFileTransport(DailyRotateFile: DailyRotateFileCtor, dir?: string): Transport {
-	return new DailyRotateFile({
-		dirname: ensureDir(dir ?? getLogsDir()),
+	const dirname = ensureDir(dir ?? getEffectiveLogsDir());
+	const transport = new DailyRotateFile({
+		dirname,
 		filename: "skc.%DATE%.log",
 		datePattern: "YYYY-MM-DD",
 		maxSize: "10m",
 		maxFiles: 5,
 		zippedArchive: true,
+		// `options` replaces the library default `{ flags: "a" }`. Keep append so
+		// an existing log is not truncated. `mode` applies when the file is created.
+		options: { flags: "a", mode: LOG_FILE_MODE },
 	});
+	// winston-daily-rotate-file never listens on its file-stream-rotator stream,
+	// so a failed open or write of the log file (EACCES, EISDIR, EMFILE, the log
+	// directory removed under a live process) is emitted with no listener and
+	// becomes an uncaught exception from a single `logger.warn()`.
+	const stream = transport.logStream as unknown as NodeJS.EventEmitter;
+	let currentLog: string | undefined;
+	const repairLog = (): void => {
+		if (!currentLog) return;
+		tightenOwnerOnly(currentLog, LOG_FILE_MODE, "file");
+	};
+	// `new` names the active file (including one that already existed at 0666).
+	// `open` runs after a newly created file exists, so a late create is covered.
+	stream.on("new", (file: unknown) => {
+		if (typeof file !== "string") return;
+		currentLog = file;
+		repairLog();
+	});
+	stream.on("open", repairLog);
+	stream.on("error", ignoreSinkError);
+	return transport;
 }
 
+/** Logging failures must never take the process down; the record is dropped. */
+function ignoreSinkError(): void {}
+
 function makeConsoleTransport(winston: WinstonModule): Transport {
 	return new winston.transports.Console({ format: makeLogFormat(winston) });
 }
@@ -94,6 +283,7 @@ function applyTransports(
 	modules: { winston: WinstonModule; DailyRotateFile: DailyRotateFileCtor },
 ): void {
 	logger.clear();
+	logger.silent = !transportOptions.console && !transportOptions.file;
 	if (transportOptions.file) {
 		logger.add(
 			makeFileTransport(
@@ -117,6 +307,9 @@ async function getWinstonLogger(): Promise<Logger> {
 			// Don't exit on error - logging failures shouldn't crash the app
 			exitOnError: false,
 		});
+		// winston re-emits every transport `error` on the logger itself; with no
+		// listener that re-emit throws.
+		logger.on("error", ignoreSinkError);
 		applyTransports(logger, modules);
 		winstonLogger = logger;
 		flushBufferedLogs();
@@ -142,6 +335,35 @@ function flushBufferedLogs(): void {
 	}
 }
 
+/**
+ * A skipped mode repair is logged through the transports already configured.
+ * The default is file-only, so this must not write the terminal. Console
+ * output stays opt-in via {@link setTransports}(`{ console: true }`).
+ */
+function reportSkippedRepair(kind: "directory" | "file"): void {
+	if (flushingBufferedLogs) return;
+	if (!transportOptions.console && !transportOptions.file) return;
+	bufferedLogs.push({
+		level: "error",
+		message: `rotating log mode repair skipped for an unopenable ${kind}`,
+	});
+	if (bufferedLogs.length > MAX_BUFFERED_LOGS) {
+		bufferedLogs.splice(0, bufferedLogs.length - MAX_BUFFERED_LOGS);
+	}
+	// Init flushes after the transports exist. A later repair runs from a
+	// stream callback, so deliver it after that callback returns.
+	if (!winstonLogger || repairNoteQueued) return;
+	repairNoteQueued = true;
+	queueMicrotask(() => {
+		repairNoteQueued = false;
+		try {
+			flushBufferedLogs();
+		} catch {
+			// A repair notice must not take logging down.
+		}
+	});
+}
+
 function writeLog(level: LogLevel, message: string, context?: Record<string, unknown>): void {
 	try {
 		if (winstonLogger && !flushingBufferedLogs) {
@@ -249,21 +471,21 @@ export function printTimings(): void {
 	}
 
 	gRootSpan.end = performance.now();
+	// Close still-open spans (e.g. cli:dispatch, which wraps the very run that
+	// prints) so they report elapsed-at-print instead of a misleading 0ms.
+	const root = gRootSpan;
+	const printNow = root.end;
+	const closeOpenSpans = (span: Span): void => {
+		for (const child of span.children) closeOpenSpans(child);
+		if (span.end === undefined && !span.point) span.end = printNow;
+	};
+	closeOpenSpans(root);
 	const lines: string[] = [];
 	lines.push("");
 	lines.push("--- Startup timings (hierarchical) ---");
-	const work: Span[] = [];
-	const loads: Span[] = [];
-	for (const child of gRootSpan.children) {
-		if (isModuleLoadSpan(child)) loads.push(child);
-		else work.push(child);
-	}
-	for (const child of work.sort((a, b) => a.start - b.start)) {
+	for (const child of [...gRootSpan.children].sort((a, b) => a.start - b.start)) {
 		printSpan(child, 0, lines);
 	}
-	if (loads.length > 0) {
-		printModuleLoadSummary(loads, 0, lines);
-	}
 	const totalMs = (gRootSpan.end - gRootSpan.start).toFixed(1);
 	lines.push(`Total: ${totalMs}ms`);
 	lines.push("--------------------------------------");
@@ -274,46 +496,28 @@ export function printTimings(): void {
 
 /**
  * Begin recording startup timings under a new root span.
- * Idempotent: a second call while already recording is a no-op so that side-effect
- * starters (see module-timer.ts) and explicit starters (main.ts) can coexist.
+ * Idempotent: a second call while already recording is a no-op so that the
+ * early starter (cli.ts, the first CLI statement) and the explicit starter
+ * (main.ts) can coexist.
+ *
+ * The root is anchored at the process-start origin rather than at the call:
+ * `performance.now()` counts milliseconds since `performance.timeOrigin`
+ * (process start) on Bun, so `start: 0` makes `Total` the true
+ * time-since-process-start. Runtime bootstrap plus static module linking and
+ * evaluation then land in the root's self time instead of being invisible
+ * before the first statement of cli.ts.
  */
 export function startTiming(): void {
 	if (gRecordTimings) return;
 	gRootSpan = {
 		op: "(root)",
-		start: performance.now(),
+		start: 0,
 		parent: undefined,
 		children: [],
 	};
 	gRecordTimings = true;
 }
 
-/**
- * Record an externally-measured span as a leaf child of the active span (or root
- * when no span is active). Used by the module-load timing plugin to splice load
- * events into the tree retroactively.
- */
-export function recordModuleLoadSpan(path: string, start: number, durationMs: number): void {
-	if (!gRecordTimings || !gRootSpan) return;
-	const parent = spanStorage.getStore() ?? gRootSpan;
-	const span: Span = {
-		op: `load:${shortenLoadPath(path)}`,
-		start,
-		end: start + durationMs,
-		parent,
-		children: [],
-	};
-	parent.children.push(span);
-}
-
-function shortenLoadPath(p: string): string {
-	const cwd = process.cwd();
-	if (p.startsWith(`${cwd}/`)) return p.slice(cwd.length + 1);
-	const home = process.env.HOME;
-	if (home && p.startsWith(`${home}/`)) return `~/${p.slice(home.length + 1)}`;
-	return p;
-}
-
 /**
  * End timing window and clear buffers.
  */
@@ -359,13 +563,6 @@ function fmtMs(ms: number): string {
 	return `${ms.toFixed(0)}ms`;
 }
 
-const MODULE_LOAD_PREFIX = "load:";
-const MODULE_LOAD_VERBOSE_TOP = 10;
-
-function isModuleLoadSpan(span: Span): boolean {
-	return span.op.startsWith(MODULE_LOAD_PREFIX);
-}
-
 function printSpan(span: Span, depth: number, lines: string[]): void {
 	const indent = "  ".repeat(depth);
 	if (span.point) {
@@ -380,51 +577,9 @@ function printSpan(span: Span, depth: number, lines: string[]): void {
 	const selfStr = span.children.length > 0 && self > LOGGED_TIMING_THRESHOLD_MS ? ` (self ${fmtMs(self)})` : "";
 	lines.push(`${indent}${span.op}: ${fmtMs(dur)}${selfStr}${tag}`);
 
-	// Split children into work spans and module-load spans for summarization.
-	const work: Span[] = [];
-	const loads: Span[] = [];
-	for (const child of span.children) {
-		if (isModuleLoadSpan(child)) loads.push(child);
-		else work.push(child);
-	}
-	for (const child of work.sort((a, b) => a.start - b.start)) {
+	for (const child of [...span.children].sort((a, b) => a.start - b.start)) {
 		printSpan(child, depth + 1, lines);
 	}
-	if (loads.length > 0) {
-		printModuleLoadSummary(loads, depth + 1, lines);
-	}
-}
-
-/** Collapse the (typically hundreds of) module-load spans into one summary line. */
-function printModuleLoadSummary(loads: Span[], depth: number, lines: string[]): void {
-	const childIndent = "  ".repeat(depth);
-	const grandIndent = "  ".repeat(depth + 1);
-	let unionStart = Number.POSITIVE_INFINITY;
-	let unionEnd = 0;
-	let totalSelf = 0;
-	for (const span of loads) {
-		if (span.end === undefined) continue;
-		if (span.start < unionStart) unionStart = span.start;
-		if (span.end > unionEnd) unionEnd = span.end;
-		totalSelf += span.end - span.start;
-	}
-	const wall = unionEnd > unionStart ? unionEnd - unionStart : 0;
-	lines.push(`${childIndent}(modules): ${loads.length} loaded, wall ${fmtMs(wall)}, sum ${fmtMs(totalSelf)}`);
-	// Resolve SKC-first with PI fallback inline (no ./env import) so this
-	// foundational logger stays off the env module's dependency graph, which the
-	// tab-worker native-free runtime contract (issue-2598-repro) walks.
-	const showAll = (process.env.SKC_TIMING?.trim() || process.env.PI_TIMING?.trim()) === "full";
-	const sorted = [...loads].sort((a, b) => durationOf(b) - durationOf(a));
-	const visible = showAll ? sorted : sorted.slice(0, MODULE_LOAD_VERBOSE_TOP);
-	for (const span of visible) {
-		const dur = durationOf(span);
-		if (dur < LOGGED_TIMING_THRESHOLD_MS) break;
-		const tag = isParallel(span) ? " [parallel]" : "";
-		lines.push(`${grandIndent}${span.op}: ${fmtMs(dur)}${tag}`);
-	}
-	if (!showAll && sorted.length > MODULE_LOAD_VERBOSE_TOP) {
-		lines.push(`${grandIndent}… ${sorted.length - MODULE_LOAD_VERBOSE_TOP} more (PI_TIMING=full to show all)`);
-	}
 }
 
 /** A span is parallel if it overlaps a sibling that started before it. */

package/src/native-process.ts

@@ -0,0 +1,19 @@
+/**
+ * Lazy synchronous binding for @sayknow-cli/natives process control.
+ *
+ * The natives package entry loads the compiled addon at import time, so a
+ * static import anywhere in the `@sayknow-cli/utils` root barrel graph would
+ * materialize the addon for every barrel consumer. The W5b S1/idle
+ * module-trace gate requires that merely importing the barrel never loads
+ * @sayknow-cli/natives; process-control callers bind at first real use instead.
+ */
+type NativeProcessBindings = Pick<typeof import("@sayknow-cli/natives"), "Process" | "ProcessStatus">;
+
+let bindings: NativeProcessBindings | undefined;
+
+export function nativeProcessBindings(): NativeProcessBindings {
+	if (!bindings) {
+		bindings = require("@sayknow-cli/natives") as NativeProcessBindings;
+	}
+	return bindings;
+}

package/src/postmortem.ts

@@ -10,6 +10,7 @@ import inspector from "node:inspector";
 import * as path from "node:path";
 import { isMainThread } from "node:worker_threads";
 import { BROKEN_PIPE_EXIT_CODE, createProcessStdoutEpipeClassifier } from "./broken-pipe";
+import { redactCrashSecrets } from "./crash-redaction";
 import { getCrashLogPath } from "./dirs";
 import * as logger from "./logger";
 import { safeStderrWrite } from "./safe-stderr";
@@ -217,61 +218,6 @@ export const CRASH_LOG_MAX_BYTES = 512 * 1024;
 export const CRASH_RECORD_MAX_BYTES = 64 * 1024;
 const CRASH_RECORD_TRUNCATION_MARKER = "\n… [crash record truncated]\n\n";
 
-/**
- * Best-effort scrub of credential material from a crash record before it is
- * persisted indefinitely. Covers bearer/basic-style headers, key=value or
- * JSON key forms of common credential names, and well-known vendor token
- * shapes. Normal messages and stack frames are untouched; matches are
- * replaced in place so surrounding diagnostic context survives.
- */
-function redactCrashSecrets(text: string): string {
-	let redacted = text;
-	redacted = redacted.replace(/\b(?:Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "«redacted-auth»");
-	redacted = redacted.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "«redacted-jwt»");
-	redacted = redacted.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "«redacted-api-key»");
-	// `gh[opsur]_` covers the classic PAT/OAuth/server/user/refresh prefixes;
-	// fine-grained PATs use an entirely different `github_pat_` prefix.
-	redacted = redacted.replace(/\bgh[opsur]_[A-Za-z0-9]{16,}\b/g, "«redacted-github-token»");
-	redacted = redacted.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "«redacted-github-token»");
-	redacted = redacted.replace(/\bxox[baprs]-[A-Za-z0-9-]{8,}\b/g, "«redacted-slack-token»");
-	redacted = redacted.replace(/\bnpm_[A-Za-z0-9]{20,}\b/g, "«redacted-npm-token»");
-	redacted = redacted.replace(/\bglpat-[A-Za-z0-9_-]{20,}\b/g, "«redacted-gitlab-token»");
-	// Stripe separates with `_`, so the `sk-` rule above never matched one.
-	redacted = redacted.replace(/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g, "«redacted-api-key»");
-	redacted = redacted.replace(/\bhf_[A-Za-z0-9]{20,}\b/g, "«redacted-api-key»");
-	// A PEM block carries the key material itself, so it is redacted whole rather
-	// than line by line, before narrower rules can chew on the base64 body.
-	redacted = redacted.replace(
-		/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
-		"«redacted-private-key»",
-	);
-	// Google API keys are a fixed 39-character shape with no label of their own.
-	redacted = redacted.replace(
-		/(?<![A-Za-z0-9_-])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9_-])/g,
-		"«redacted-google-api-key»",
-	);
-	// Basic-auth credentials embedded in a URL. Scheme and host stay readable
-	// because they are the diagnostic value; only the userinfo is dropped. The
-	// scheme-character run is boundary anchored so a long alphabetic run cannot
-	// go quadratic, while leading digits and scheme punctuation stay in the
-	// capture so longer and boundary-adjacent URLs still redact.
-	redacted = redacted.replace(
-		/(?<![A-Za-z0-9+.-])([0-9+.-]*[a-z][a-z0-9+.-]*:\/\/)[^/\s:@]{1,256}:[^/\s@]{1,256}@/gi,
-		"$1«redacted-url-credential»@",
-	);
-	// AKIA is the long-term AWS access key id; ASIA the temporary/STS one, which
-	// is the shape that actually shows up in a crashed request. ABIA/ACCA
-	// complete the set. The id alone is not the credential: STS payloads carry
-	// `SecretAccessKey` and `SessionToken` alongside it, so the labeled-value
-	// rule below names both.
-	redacted = redacted.replace(/\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g, "«redacted-aws-key»");
-	redacted = redacted.replace(
-		/(?<![A-Za-z0-9_])(["']?(?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|client[_-]?secret|secret[_-]?key|secret[_-]?access[_-]?key|password|passwd|authorization)["']?\s*[=:]\s*["']?)[^\s"',;}\]]{8,}/gi,
-		"$1«redacted»",
-	);
-	return redacted;
-}
-
 /**
  * Bound one record to CRASH_RECORD_MAX_BYTES without splitting a UTF-8
  * sequence. Keeps the header (timestamp/label/message) at the front, where