@sema-agent/core 7.34.0 → 7.35.0

package/dist/core/secret-env.js

@@ -1,18 +1,72 @@
 import { deliverEngineNotice } from "./engine-notice.js";
-import { redactSecrets } from "./untrusted-egress.js";
-import { ANSI_C_ESCAPES, argvOf, lexShell, substitutionsInHeredocBody } from "../shell/lex.js";
-const TOKEN_COUNT_WORDS = ["MAX", "OUTPUT", "INPUT", "THINKING", "NUM", "TOTAL"];
-const CREDENTIAL_WORD = `KEY|KEYS|TOKEN|(?<!(?:^|_)(?:${TOKEN_COUNT_WORDS.join("|")})_)TOKENS|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY`;
-const SECRET_ENV_RE = new RegExp(`(^|_)(${CREDENTIAL_WORD})(?:_(?:\\d+|ID))?$`, "i");
-const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?(?:${CREDENTIAL_WORD})(?:_|$)`, "is");
-const SECRET_ENV_EXACT_NAMES = new Set([
-    "DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH",
-    "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
-    "NPM_CONFIG__AUTH", "NPM_CONFIG__AUTHTOKEN",
-    "OTEL_EXPORTER_OTLP_HEADERS", "OTEL_EXPORTER_OTLP_TRACES_HEADERS", "OTEL_EXPORTER_OTLP_METRICS_HEADERS",
-    "OTEL_EXPORTER_OTLP_LOGS_HEADERS", "OTEL_EXPORTER_OTLP_PROFILES_HEADERS",
-    "OTEL_EXPORTER_OTLP_SPAN_HEADERS", "OTEL_EXPORTER_OTLP_METRIC_HEADERS",
-]);
+const GIT_CONFIG_ENV_RE = /^GIT_CONFIG_(?:COUNT|PARAMETERS|(?:KEY|VALUE)_[0-9]+)$/;
+const PROXY_ENV_RE = /^(?:(?:https?|ftp|all|no)_proxy|npm_config_(?:https?_)?proxy|npm_config_noproxy|yarn_proxy|(?:yarn|global_agent|docker|claude_code)_(?:https?|no)_proxy|cloudsdk_proxy_[a-z]+|electron_get_use_proxy)$/i;
+function isExemptEnvName(name) {
+    return GIT_CONFIG_ENV_RE.test(name) || PROXY_ENV_RE.test(name);
+}
+const CREDENTIAL_ENV_NAMES = new Set([
+    "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_ARTIFACTS_API_TOKEN", "CLAUDE_CODE_MEMORY_API_TOKEN",
+    "CLAUDE_CODE_SLACK_TAG_TOKEN", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_FOUNDRY_AUTH_TOKEN",
+    "ANTHROPIC_AWS_API_KEY", "ANTHROPIC_CUSTOM_HEADERS", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+    "AWS_BEARER_TOKEN_BEDROCK", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_GHA_CREDS_PATH", "AZURE_CLIENT_SECRET",
+    "IDENTITY_HEADER", "MSI_SECRET", "AZURE_CLIENT_CERTIFICATE_PATH", "AZURE_CLIENT_CERTIFICATE_PASSWORD",
+    "AZURE_PASSWORD", "AZURE_FEDERATED_TOKEN_FILE", "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN", "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", "CLOUDSDK_AUTH_ACCESS_TOKEN",
+    "GOOGLE_OAUTH_ACCESS_TOKEN", "CLAUDE_CODE_OAUTH_REFRESH_TOKEN", "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN",
+    "HUGGINGFACEHUB_API_TOKEN", "NODE_AUTH_TOKEN", "NUGET_AUTH_TOKEN", "CARGO_REGISTRY_TOKEN", "TWINE_PASSWORD",
+    "TWINE_USERNAME", "PYPI_TOKEN", "PYPI_API_TOKEN", "UV_PUBLISH_TOKEN", "UV_PUBLISH_PASSWORD", "UV_PUBLISH_USERNAME",
+    "FLIT_PASSWORD", "FLIT_USERNAME", "HATCH_INDEX_AUTH", "HATCH_INDEX_USER", "GEM_HOST_API_KEY", "MATURIN_PYPI_TOKEN",
+    "MATURIN_PASSWORD", "MATURIN_USERNAME", "CONAN_LOGIN_USERNAME", "CONAN_PASSWORD", "ANACONDA_API_TOKEN",
+    "BINSTAR_API_TOKEN", "VAULT_TOKEN", "VAULT_AUTH_TOKEN", "VAULT_ROLE_ID", "VAULT_SECRET_ID", "CONSUL_HTTP_TOKEN",
+    "CONSUL_HTTP_AUTH", "NOMAD_TOKEN", "NOMAD_HTTP_AUTH", "CI_REGISTRY_USER", "CI_DEPLOY_USER", "JF_USER",
+    "FASTLANE_SESSION", "MATCH_GIT_BASIC_AUTHORIZATION", "SONAR_TOKEN", "SONARQUBE_SCANNER_PARAMS",
+    "SONAR_SCANNER_JSON_PARAMS", "SLACK_WEBHOOK_URL", "SLACK_WEBHOOK", "DISCORD_WEBHOOK", "DISCORD_WEBHOOK_URL",
+    "TEAMS_WEBHOOK_URL", "MS_TEAMS_WEBHOOK_URI", "ANTHROPIC_IDENTITY_TOKEN", "ANTHROPIC_IDENTITY_TOKEN_FILE",
+    "CLOUDSDK_AUTH_ACCESS_TOKEN_FILE", "CLOUDSDK_AUTH_AUTHORIZATION_TOKEN_FILE", "AZURE_AUTH_LOCATION",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN", "ACTIONS_ID_TOKEN_REQUEST_URL", "ACTIONS_RUNTIME_TOKEN", "ACTIONS_RUNTIME_URL",
+    "ALL_INPUTS", "VSS_NUGET_EXTERNAL_FEED_ENDPOINTS", "ARTIFACTS_CREDENTIALPROVIDER_EXTERNAL_FEED_ENDPOINTS",
+    "VSS_NUGET_ACCESSTOKEN", "ARTIFACTS_CREDENTIALPROVIDER_ACCESSTOKEN", "COMPOSER_AUTH", "OVERRIDE_GITHUB_TOKEN",
+    "DEFAULT_WORKFLOW_TOKEN", "SSH_SIGNING_KEY"
+].flatMap((name) => [name, `INPUT_${name}`]));
+const OTEL_ENV_RE = /^(?:INPUT_)?OTEL_/i;
+const COUNTED_TOKENS = "(?<!(?:^|_)(?:MAX|OUTPUT|INPUT|THINKING|NUM|TOTAL)_)TOKENS";
+const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?(?:KEY|KEYS|TOKEN|${COUNTED_TOKENS}|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY)(?:_|$)`, "is");
+const LEADING_WORDS = [
+    "TOKEN", "SECRET", "PASSWORD", "PASSWD", "PASSPHRASE", "KEY", "AUTH", "COOKIE", "PAT", "DSN", "WEBHOOK", "CREDENTIAL",
+    "CREDENTIALS", "CREDS", "APIKEY", "ACCESSKEY", "SECRETKEY", "ACCOUNTKEY", "PRIVATEKEY", "AUTHKEY", "SSHKEY",
+    "SIGNINGKEY", "MASTERKEY", "DEPLOYKEY", "ENCRYPTIONKEY", "PGPASSWORD", "SSHPASS",
+];
+const PLURAL_WORDS = ["KEY", "SECRET", "PASSWORD", "CREDENTIAL"];
+const SEPARATED_WORDS = ["PWD", "PASS", "JWT"];
+const EMBEDDED_WORDS = ["TOKEN", "SECRET", "PASSWORD", "PASSWD", "PASSPHRASE"];
+const CREDENTIAL_WORD_RE = new RegExp(`((^|_)(${LEADING_WORDS.join("|")}|(${PLURAL_WORDS.join("|")})S|${COUNTED_TOKENS})|_(${SEPARATED_WORDS.join("|")})|(${EMBEDDED_WORDS.join("|")}))(?=$|[_0-9])`, "i");
+const CONNECTION_STRING_RE = /CONN(ECT(ION)?)?_?STR(ING)?S?(?=$|[_0-9])/i;
+const BUNDLER_SETTINGS = ["BUILD", "LOCAL", "MIRROR", "PATH", "WITH", "WITHOUT", "CACHE", "DISABLE", "IGNORE", "ONLY"];
+const BUNDLER_HOST = "(?:[A-Za-z0-9]+(?:___[A-Za-z0-9]+)*__)+[A-Za-z]{2,}";
+const BUNDLER_CREDENTIAL_RE = new RegExp(`^(?:INPUT_)?BUNDLE_(?!(?:${BUNDLER_SETTINGS.join("|")})__(?!${BUNDLER_HOST}$))\\w*__`, "i");
+const GIT_CONFIG_KEY_NAME_RE = /^GIT_CONFIG_KEY_[0-9][A-Za-z0-9_]*$/;
+const PUBLISHER_PREFIX_RE = /^(?:INPUT_|ORG_GRADLE_PROJECT_|POETRY_PYPI_TOKEN_|POETRY_HTTP_BASIC_|CARGO_REGISTRIES_|CONAN_LOGIN_USERNAME_|CONAN_PASSWORD_)/i;
+const PUBLISHER_LOGIN_PREFIX_RE = /^(?:INPUT_)?(?:POETRY_HTTP_BASIC_|CONAN_LOGIN_USERNAME_)/i;
+const USER_NAME_TAIL_RE = /USER(?:_?NAME)?_?[0-9]*$/i;
+function splitCamelCase(name) {
+    return ["OAuth", "NextAuth"]
+        .reduce((text, word) => text.replaceAll(word, word[0] + word.slice(1).toLowerCase()), name)
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .replace(/([A-Z])([A-Z][a-z])/g, "$1_$2");
+}
+function nameShapeHolds(name) {
+    const words = name.replace(/^AUTH0_/i, "").replace(/-/g, "_");
+    const split = splitCamelCase(words);
+    const shaped = CREDENTIAL_WORD_RE.test(words) || CREDENTIAL_WORD_RE.test(split) || CONNECTION_STRING_RE.test(words) || CONNECTION_STRING_RE.test(split) || BUNDLER_CREDENTIAL_RE.test(words);
+    return shaped && !GIT_CONFIG_KEY_NAME_RE.test(name);
+}
+function nameIsCredentialShaped(name) {
+    if (BUNDLER_CREDENTIAL_RE.test(name) || nameShapeHolds(name))
+        return true;
+    const words = name.replace(/-/g, "_");
+    return PUBLISHER_PREFIX_RE.test(words) && (PUBLISHER_LOGIN_PREFIX_RE.test(words) || USER_NAME_TAIL_RE.test(words) || nameShapeHolds(words));
+}
 const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "PARTITION_KEY", "SORT_KEY", "RANGE_KEY", "IDEMPOTENCY_KEY", "CACHE_KEY", "ROUTING_KEY",
     "DB_FOREIGN_KEYS", "JSON_SORT_KEYS",
@@ -20,593 +74,102 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
     "PROMPT_TOKENS", "CONTEXT_TOKENS",
 ]);
-const SSH_LOGIN_ONLY_URL_RE = /^(?:ssh|git\+ssh|git):\/\/[A-Za-z0-9._-]+@[^@]*$/;
-const GIT_KEY_SECTION_RE = /^[A-Za-z0-9-]+\./;
-function carriesUrlUserinfo(text, url) {
-    const scheme = text.indexOf(":/");
-    if (scheme === -1)
-        return false;
-    if (text.indexOf("@", scheme + 2) === -1 && text.indexOf("%40", scheme + 2) === -1)
+const VALUE_SCAN_LIMIT = 8192;
+function looksLikeToken(user) {
+    return /^(?:gh[opusr]_|github_pat_|glpat-|xox[abpr]-|sk-|pk-|AKIA|eyJ|ya29\.|npm_)/.test(user) || (user.length >= 20 && /[0-9]/.test(user) && /[a-z]/i.test(user));
+}
+const HOST_RE = /^(?:localhost|[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.(?=[a-z0-9-]*[a-z])[a-z0-9-]+|[a-z0-9_.-]+(?=:\d+(?:[/?#]|$))|\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-f:.]+\])(?::\d+)?(?:[/?#]|$)/i;
+const HOSTLIKE_RE = /^(?:(?=[a-z0-9._-]*[a-z])[a-z0-9._-]+|\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-f:.]+\])(?::\d+)?(?:[/?#]|$)/i;
+function isHostPortPathBeforeAt(before, after) {
+    const hostPort = /^([a-z0-9_-]+(?:\.[a-z0-9_-]+)*):\d+([/?#].*)$/is.exec(before);
+    if (!hostPort)
         return false;
-    return url === undefined || url.includes("%40") || !SSH_LOGIN_ONLY_URL_RE.test(url);
-}
-const HEADER_LINE_BREAK_RE = /\r\n|\r|\n/;
-const AUTHORIZATION_HEADER_NAME_RE = /^[ \t]*(?:(?:proxy-)?authorization|cookie)[ \t]*:/i;
-const HEADER_CONTENT_RE = /[^ \t\f\v]/;
-function carriesAuthorizationHeader(value) {
-    let logical;
-    const judge = () => logical !== undefined && AUTHORIZATION_HEADER_NAME_RE.test(logical) && HEADER_CONTENT_RE.test(logical.slice(logical.indexOf(":") + 1));
-    for (const physical of value.split(HEADER_LINE_BREAK_RE)) {
-        if (logical !== undefined && (physical.startsWith(" ") || physical.startsWith("\t"))) {
-            logical += " " + physical;
-            continue;
-        }
-        if (judge())
-            return true;
-        logical = physical;
-    }
-    return judge();
-}
-const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..*)?|remote\..*)\.proxy$/is;
-const proxyValueCarriesUserinfo = (value) => value.includes("@") || value.includes("%40");
-const GIT_SECRET_VARIABLE_NAMES = new Set(["pass", "password", "smtppass", "dbpass", "token", "secret"]);
-const GIT_USER_NAMED_VARIABLE_KEY_RE = /^(?:alias|pretty|remotes|pager)\.[^.]*$/is;
-const GIT_EXTRA_HEADER_KEY_RE = /^http\.(?:.*\.)?extraheader$/is;
-const gitKeyHoldsCredential = (key) => (!GIT_USER_NAMED_VARIABLE_KEY_RE.test(key) && GIT_SECRET_VARIABLE_NAMES.has(key.slice(key.lastIndexOf(".") + 1).toLowerCase())) || GIT_EXTRA_HEADER_KEY_RE.test(key);
-const GIT_COMMAND_KEY_RE = /^core\.(?:sshcommand|gitproxy)$/i;
-const GIT_ALIAS_KEY_RE = /^alias\.(?:[^.]*|.*\.command)$/is;
-const GIT_CREDENTIAL_HELPER_KEY_RE = /^credential\.(?:.*\.)?helper$/is;
-function gitShellCommandOf(key, value) {
-    if (GIT_COMMAND_KEY_RE.test(key))
-        return value;
-    if (GIT_CREDENTIAL_HELPER_KEY_RE.test(key))
-        return value.startsWith("!") ? value.slice(1) : value;
-    if (!GIT_ALIAS_KEY_RE.test(key))
-        return undefined;
-    return value.startsWith("!") ? value.slice(1) : `git ${value}`;
-}
-const EXPANSION_OPEN = "\u0002";
-const EXPANSION_CLOSE = "\u0003";
-const EXPANSION_RE = /\u0002([^\u0003]*)\u0003/g;
-function decodeCEscapes(text, octal) {
-    if (!text.includes("\\"))
-        return text;
-    const simple = ANSI_C_ESCAPES;
-    const run = (re, from, max) => {
-        let j = from;
-        while (j < text.length && j - from < max && re.test(text.charAt(j)))
-            j++;
-        return text.slice(from, j);
-    };
-    let out = "";
-    for (let i = 0; i < text.length; i++) {
-        const c = text.charAt(i);
-        if (c !== "\\" || i + 1 >= text.length) {
-            out += c;
-            continue;
-        }
-        const e = text.charAt(i + 1);
-        let digits;
-        if (simple[e] !== undefined) {
-            out += simple[e];
-            i++;
-        }
-        else if (e === "c" && i + 2 < text.length) {
-            out += String.fromCharCode(text.charCodeAt(i + 2) & 0x1f);
-            i += 2;
-        }
-        else if ((e === "x" || e === "u" || e === "U") && (digits = run(/[0-9A-Fa-f]/, i + 2, e === "x" ? 2 : e === "u" ? 4 : 8)) !== "") {
-            out += String.fromCodePoint(Math.min(parseInt(digits, 16), 0x10ffff));
-            i += 1 + digits.length;
-        }
-        else if (/[0-7]/.test(e)) {
-            const from = octal === "echo" && e === "0" ? i + 2 : i + 1;
-            digits = run(/[0-7]/, from, 3);
-            out += digits === "" ? "\0" : String.fromCharCode(parseInt(digits, 8) & 0xff);
-            i = from + digits.length - 1;
-        }
-        else
-            out += c;
-    }
-    return out;
-}
-function markedText(word, source) {
-    let out = "";
-    for (const piece of word.pieces) {
-        if (piece.literal !== undefined)
-            out += piece.literal;
-        else if (piece.expansion !== undefined) {
-            const { kind, name, body = "" } = piece.expansion;
-            const written = kind === "parameter" ? /^[A-Za-z_][A-Za-z0-9_]*:?[-=](.+)$/s.exec(body)?.[1] : undefined;
-            out += written ?? EXPANSION_OPEN + (kind === "parameter" && name !== undefined && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : "") + EXPANSION_CLOSE;
-        }
-        else {
-            const text = source.slice(piece.span[0], piece.span[1]);
-            out += decodeCEscapes(/^\$'.*'$/s.test(text) ? text.slice(2, -1) : text, "printf");
-        }
-    }
-    return out;
-}
-const SECRET_OPTION_WORDS = new Set(["token", "password", "passwd", "pass", "passphrase", "secret", "pw", "auth", "oauth", "apikey", "credential"]);
-const ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
-const PRINTF_CONVERSION_RE = /%(?:%|[-+ #0']*(\*|[0-9]*)(?:\.(\*|[0-9]*))?[A-Za-z])/g;
-function printfFormatIn(words) {
-    const program = words.findIndex((w) => w.slice(w.lastIndexOf("/") + 1) === "printf");
-    if (program === -1)
-        return undefined;
-    let at = program + 1;
-    while (words[at] === "-v" || words[at] === "--")
-        at += words[at] === "-v" ? 2 : 1;
-    const format = words[at];
-    if (format === undefined)
-        return undefined;
-    let count = 0;
-    const marked = format.replace(PRINTF_CONVERSION_RE, (conversion, width, precision) => {
-        if (conversion === "%%")
-            return "%";
-        count += (width === "*" ? 1 : 0) + (precision === "*" ? 1 : 0);
-        return `${EXPANSION_OPEN}#${count++}${EXPANSION_CLOSE}`;
-    });
-    return { at, marked: decodeCEscapes(marked, "printf"), count };
-}
-const SHELL_PROGRAMS = new Set(["sh", "bash", "dash", "zsh", "ksh", "mksh", "ash"]);
-const SSH_ARGUMENT_OPTIONS = "BbcDEeFIiJLlmOoPpQRSWw";
-const SSH_COMMAND_OPTION_RE = /^(?:proxy|local|knownhosts|remote)command(?:\s*=\s*|\s+)(.*)$/is;
-function commandCarriesCredential(command, depth = 0, inherited = new Set()) {
-    const source = depth === 0 ? command.replace(/[\u0002\u0003]/g, "\ufffd") : command;
-    const lexed = lexShell(source);
-    if ("parseFailure" in lexed)
-        return true;
-    const segments = lexed.segments.map((segment) => argvOf(segment).map((word) => markedText(word, source)));
-    const formats = segments.map((words) => {
-        const format = printfFormatIn(words);
-        if (format !== undefined)
-            words[format.at] = format.marked;
-        return format;
-    });
-    const bodies = [];
-    const lines = [];
-    for (const segment of lexed.segments) {
-        for (const token of segment.tokens) {
-            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
-            for (const piece of word?.expansions ?? [])
-                if ((piece.expansion?.kind === "command" || piece.expansion?.kind === "process") && piece.expansion.body !== undefined)
-                    bodies.push(piece.expansion.body);
-            if (token.kind !== "heredoc")
-                continue;
-            lines.push(...token.body.split(/[\n\r]/));
-            if (!token.quoted)
-                bodies.push(...(substitutionsInHeredocBody(token.body) ?? []).filter((s) => s.kind === "command").map((s) => s.body));
-        }
-    }
-    const words = segments.flat();
-    const shapeText = (text) => text.replace(EXPANSION_RE, ";").replace(/[\n\r]/g, ";");
-    if (carriesSecretShape(`${words.map(shapeText).join(" ")};${lines.map(shapeText).join(";")}`))
+    if (/[?#&]/.test(hostPort[2] ?? ""))
         return true;
-    const literalNames = new Set(inherited);
-    const dependents = new Map();
-    const reached = [...inherited];
-    for (const word of words) {
-        const assigned = ASSIGNMENT_RE.exec(word);
-        if (assigned === null)
-            continue;
-        const [, name = "", value = ""] = assigned;
-        if (value.replace(EXPANSION_RE, "") !== "") {
-            if (!literalNames.has(name))
-                reached.push(name);
-            literalNames.add(name);
-        }
-        else {
-            for (const [, ref = ""] of value.matchAll(EXPANSION_RE)) {
-                const list = dependents.get(ref);
-                if (list === undefined)
-                    dependents.set(ref, [name]);
-                else
-                    list.push(name);
-            }
-        }
-    }
-    for (let q = 0; q < reached.length; q++) {
-        for (const name of dependents.get(reached[q] ?? "") ?? []) {
-            if (!literalNames.has(name))
-                reached.push(name);
-            literalNames.add(name);
-        }
-    }
-    const written = (text) => text.replace(EXPANSION_RE, "") !== "" || [...text.matchAll(EXPANSION_RE)].some((m) => literalNames.has(m[1] ?? ""));
-    const runs = (line) => depth < 3 && commandCarriesCredential(line, depth + 1, literalNames);
-    const secretLine = (line) => {
-        const assigned = ASSIGNMENT_RE.exec(line);
-        return assigned !== null && written(assigned[2] ?? "") && classifySecretEnvKey(assigned[1] ?? "") !== undefined;
-    };
-    if (lines.some(secretLine))
-        return true;
-    const printfCarries = (format, words) => {
-        const argument = (n) => words[format.at + 1 + n] ?? "";
-        const firstPass = format.marked.replace(EXPANSION_RE, (mark, ref) => {
-            const conversion = /^#([0-9]+)$/.exec(ref);
-            return conversion === null ? mark : argument(Number(conversion[1]));
-        });
-        if (firstPass.split(/[\n\r]/).some(secretLine))
-            return true;
-        for (const line of format.marked.split(/[\n\r]/)) {
-            const assigned = ASSIGNMENT_RE.exec(line);
-            if (assigned === null || classifySecretEnvKey(assigned[1] ?? "") === undefined)
-                continue;
-            for (const [, ref = ""] of (assigned[2] ?? "").matchAll(EXPANSION_RE)) {
-                const conversion = /^#([0-9]+)$/.exec(ref);
-                if (conversion === null)
-                    continue;
-                for (let n = Number(conversion[1]) + format.count; format.count > 0 && format.at + 1 + n < words.length; n += format.count)
-                    if (written(argument(n)))
-                        return true;
-            }
-        }
+    if (HOST_RE.test(after))
         return false;
-    };
-    if (segments.some((words, i) => formats[i] !== undefined && printfCarries(formats[i], words)))
+    if (before.endsWith("/"))
         return true;
-    for (const [segment, segmentWords] of segments.entries()) {
-        const formatAt = formats[segment]?.at;
-        let sshpassOptions = false;
-        let shellOptions = false;
-        let sshOptions = false;
-        let gitOptions = false;
-        let pending;
-        for (const [position, word] of segmentWords.entries()) {
-            const waiting = pending;
-            pending = undefined;
-            if (waiting === "skip")
-                continue;
-            if (waiting === "command" && runs(word))
-                return true;
-            if (waiting === "ssh-option") {
-                const run = SSH_COMMAND_OPTION_RE.exec(word);
-                if (run !== null && runs(run[1] ?? ""))
-                    return true;
-                continue;
-            }
-            if (waiting === "git-config") {
-                const eq = word.indexOf("=");
-                if (depth < 3 && eq > 0 && gitConfigEntryCarriesCredential({ key: word.slice(0, eq), value: word.slice(eq + 1) }, depth + 1))
-                    return true;
-                continue;
-            }
-            if (waiting === "sshpass-password") {
-                if (written(word))
-                    return true;
-                continue;
-            }
-            if (waiting === "option-value" && !word.startsWith("-")) {
-                if (written(word))
-                    return true;
-                continue;
-            }
-            for (const view of position === formatAt ? [word] : [word, decodeCEscapes(word, "printf"), decodeCEscapes(word, "echo")]) {
-                if (view.split(/[\n\r]/).some(secretLine))
-                    return true;
-            }
-            if (sshpassOptions) {
-                if (word === "--") {
-                    sshpassOptions = false;
-                    continue;
-                }
-                if (word.startsWith("--")) {
-                    if (word === "--password")
-                        pending = "sshpass-password";
-                    else if (word.startsWith("--password=") && written(word.slice("--password=".length)))
-                        return true;
-                    continue;
-                }
-                if (word.startsWith("-") && word.length > 1) {
-                    for (let k = 1; k < word.length; k++) {
-                        const letter = word.charAt(k);
-                        if (letter === "p") {
-                            if (k === word.length - 1)
-                                pending = "sshpass-password";
-                            else if (written(word.slice(k + 1)))
-                                return true;
-                            break;
-                        }
-                        if (letter === "f" || letter === "d" || letter === "P") {
-                            if (k === word.length - 1)
-                                pending = "skip";
-                            break;
-                        }
-                    }
-                    continue;
-                }
-                sshpassOptions = false;
-            }
-            if (shellOptions) {
-                if (/^--[A-Za-z-]+$/.test(word))
-                    continue;
-                if (/^[-+][A-Za-z]+$/.test(word)) {
-                    if (word.startsWith("-") && word.includes("c"))
-                        pending = "command";
-                    else if (/o$/.test(word))
-                        pending = "skip";
-                    continue;
-                }
-                shellOptions = false;
-            }
-            if (gitOptions) {
-                if (word === "-c") {
-                    pending = "git-config";
-                    continue;
-                }
-                if (word.startsWith("-")) {
-                    if (["-C", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env", "--super-prefix", "--list-cmds", "--attr-source"].includes(word))
-                        pending = "skip";
-                    continue;
-                }
-                gitOptions = false;
-            }
-            if (sshOptions) {
-                if (/^-[A-Za-z0-9]+/.test(word) && !word.startsWith("--")) {
-                    for (let k = 1; k < word.length; k++) {
-                        const letter = word.charAt(k);
-                        if (!SSH_ARGUMENT_OPTIONS.includes(letter))
-                            continue;
-                        const attached = word.slice(k + 1);
-                        if (letter === "o") {
-                            if (attached === "")
-                                pending = "ssh-option";
-                            else {
-                                const run = SSH_COMMAND_OPTION_RE.exec(attached);
-                                if (run !== null && runs(run[1] ?? ""))
-                                    return true;
-                            }
-                        }
-                        else if (attached === "")
-                            pending = "skip";
-                        break;
-                    }
-                    continue;
-                }
-                sshOptions = false;
-            }
-            const option = /^--?([A-Za-z0-9][A-Za-z0-9_-]*)(?:=(.*))?$/s.exec(word);
-            if (option !== null && SECRET_OPTION_WORDS.has((option[1] ?? "").toLowerCase().split(/[-_]/).pop() ?? "")) {
-                if (option[2] === undefined)
-                    pending = "option-value";
-                else if (written(option[2]))
-                    return true;
-            }
-            const program = word.slice(word.lastIndexOf("/") + 1).replace(/\.exe$/i, "");
-            if (program === "sshpass")
-                sshpassOptions = true;
-            else if (SHELL_PROGRAMS.has(program))
-                shellOptions = true;
-            else if (program === "ssh")
-                sshOptions = true;
-            else if (program === "git")
-                gitOptions = true;
-            else if (program === "eval" || word.toLowerCase() === "-proxycmd")
-                pending = "command";
-        }
-    }
-    return bodies.some((body) => runs(body));
+    if (/^(?:v?\d|sha\d*:)/i.test(after))
+        return true;
+    return !HOSTLIKE_RE.test(after);
 }
-const GIT_REF_VALUE_KEY_RE = /^(?:remote\..*\.(?:fetch|push)|branch\..*\.merge)$/is;
-function carriesSecretShape(value) {
-    const view = value.replaceAll(":", "\u0001");
-    return redactSecrets(view) !== view;
+function authorityCarriesCredential(rest) {
+    const blank = rest.search(/\s/);
+    const word = blank === -1 ? rest : rest.slice(0, blank);
+    const at = word.lastIndexOf("@");
+    if (at === -1)
+        return false;
+    const userinfo = word.slice(0, at);
+    if (isHostPortPathBeforeAt(userinfo, word.slice(at + 1)))
+        return false;
+    return userinfo.includes(":") || (!/[/?#]/.test(userinfo) && looksLikeToken(userinfo));
 }
-function gitConfigEntryCarriesCredential(entry, depth = 0) {
-    const key = entry.key?.trim();
-    const value = entry.value;
-    if (key !== undefined) {
-        const section = GIT_KEY_SECTION_RE.exec(key);
-        if (carriesUrlUserinfo(key, section === null ? undefined : key.slice(section[0].length)))
+const PACKAGE_REFERENCE_RE = /^(?:[\w.-]+(?::[\w.-]+)?@sha(?:256|384|512):[0-9a-f]{32,}|npm:(?:@[\w.-]+\/)?[\w.-]+@[\w.^~<>=*|+-]*|[a-z_][\w.-]*:[\w.-]+:v?\d[\w.+\[\](),-]*@(?:jar|war|ear|aar|apk|aab|pom|zip|tar|tgz|module|klib|exe|dll|so|dylib)?)$/i;
+function carriesSchemelessUserinfo(text) {
+    if (!/^[^\s/@:]+:(?!\/\/)(?![\\/])[^\s@]*@[^\s/@]+/.test(text) || /^[a-z]:[\\/]/i.test(text) || PACKAGE_REFERENCE_RE.test(text))
+        return false;
+    const at = text.lastIndexOf("@", text.search(/\s|$/));
+    return !isHostPortPathBeforeAt(text.slice(0, at), text.slice(at + 1)) && !/^(?:mailto|sips?|xmpp|im|acct):/i.test(text);
+}
+const CREDENTIAL_ASSIGNMENT_RE = /(?:(?:^|[;&?#,{]|\/:)\s*|\s)["']?(?!-*jobserver-auth\s*[=:])(?:[a-z0-9_.-]{0,64}(?:password|passwd|pwd|secret|token|(?:account|access|api|private|subscription)[-_]?key|signature|sig|credential)|[a-z0-9_.-]{0,63}[_.-]auth)["']?\s*[=:]\s*["']?(?!(?:true|false|none|null|yes|no|on|off|enabled|disabled|required|optional)(?:$|[;&,\s"']))[^;&,\s"']+/i;
+const WEBHOOK_URL_RE = /https:\/\/(?:hooks\.slack\.com\/(?:services|workflows|triggers)\/|(?:ptb\.|canary\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/|[\w.-]+\.webhook\.office\.com\/webhookb2\/)[\w\/@.~-]{16,}/i;
+const SONAR_LOGIN_RE = /["']?sonar\.login["']?\s*[:=]\s*["']?[^\s"',}]{8,}/;
+const PRIVATE_KEY_HEADER_RE = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+const AUTHORIZATION_HEADER_RE = /\bauthorization\s*[:=]\s*["']?[a-z][a-z0-9_-]*\s+[A-Za-z0-9._~+\/=-]{8,}/i;
+const TOKEN_WORD_RE = /\b(?:[Tt]oken|TOKEN)\s+(?=[A-Za-z0-9_~+=-]*[0-9])(?=[A-Za-z0-9_~+=-]*[A-Z])(?=([A-Za-z0-9_~+=-]{20,}))\1(?![\/.])/;
+const BEARER_BASIC_RE = /\b(?:Bearer|Basic)\s+(?=[A-Za-z._~+\/=-]*[0-9]|(?:[A-Za-z0-9._~+\/=-]*?[a-z][A-Z](?![a-z])){2}|[A-Za-z0-9.-]*[_~+\/=])[A-Za-z0-9._~+\/=-]{8,}/;
+function valueCarriesCredential(value) {
+    const text = value.length > VALUE_SCAN_LIMIT ? value.slice(0, VALUE_SCAN_LIMIT) : value;
+    for (let at = text.indexOf("://"); at !== -1; at = text.indexOf("://", at + 3)) {
+        if (at > 0 && /[a-z0-9+.-]/i.test(text[at - 1] ?? "") && authorityCarriesCredential(text.slice(at + 3)))
             return true;
     }
-    if (value === undefined || value === "")
-        return false;
-    if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value, value))
-        return true;
-    if (key === undefined)
-        return carriesSecretShape(value);
-    if (gitKeyHoldsCredential(key))
+    if (text.startsWith("//") && authorityCarriesCredential(text.slice(2)))
         return true;
-    const command = gitShellCommandOf(key, value);
-    if (command !== undefined)
-        return commandCarriesCredential(command, depth);
-    if (!GIT_REF_VALUE_KEY_RE.test(key) && carriesSecretShape(value))
-        return true;
-    return GIT_PROXY_CONFIG_KEY_RE.test(key) && proxyValueCarriesUserinfo(value);
-}
-const PROXY_ENV_NAMES = new Set(["HTTP_PROXY", "HTTPS_PROXY", "FTP_PROXY", "ALL_PROXY", "NPM_CONFIG_PROXY", "NPM_CONFIG_HTTPS_PROXY"]);
-const GIT_COMMAND_ENV_KEYS = new Map([["GIT_SSH_COMMAND", "core.sshCommand"], ["GIT_PROXY_COMMAND", "core.gitProxy"]]);
-const GIT_BLANK = /[ \t\n\r]/;
-export function readGitConfigParameters(text) {
-    const entries = [];
-    let at = 0;
-    const quoted = () => {
-        if (text[at] !== "'")
-            return undefined;
-        let word = "";
-        for (let i = at + 1; i < text.length; i++) {
-            if (text[i] !== "'")
-                word += text[i];
-            else if (text[i + 1] === "\\" && (text[i + 2] === "'" || text[i + 2] === "!") && text[i + 3] === "'") {
-                word += text[i + 2];
-                i += 3;
-            }
-            else {
-                at = i + 1;
-                return word;
-            }
-        }
-        return undefined;
-    };
-    const endsItem = () => at === text.length || GIT_BLANK.test(text.charAt(at));
-    while (at < text.length) {
-        const key = quoted();
-        if (key === undefined)
-            return undefined;
-        if (endsItem()) {
-            const eq = key.indexOf("=");
-            entries.push(eq === -1 ? { key } : { key: key.slice(0, eq), value: key.slice(eq + 1) });
-        }
-        else if (text[at] === "=") {
-            at++;
-            if (endsItem())
-                entries.push({ key });
-            else {
-                const value = quoted();
-                if (value === undefined || !endsItem())
-                    return undefined;
-                entries.push({ key, value });
-            }
-        }
-        else
-            return undefined;
-        while (at < text.length && GIT_BLANK.test(text.charAt(at)))
-            at++;
-    }
-    return entries;
-}
-function gitConfigVariableCarriesCredential(upperName, value) {
-    if (upperName === "GIT_CONFIG_PARAMETERS")
-        return readGitConfigParameters(value)?.some((entry) => gitConfigEntryCarriesCredential(entry)) ?? true;
-    const key = PROXY_ENV_NAMES.has(upperName) ? "http.proxy" : GIT_COMMAND_ENV_KEYS.get(upperName);
-    return key !== undefined && gitConfigEntryCarriesCredential({ key, value });
-}
-const GIT_CONFIG_COUNT_NAME = "GIT_CONFIG_COUNT";
-const GIT_CONFIG_MEMBER_RE = /^GIT_CONFIG_(KEY|VALUE)_(.*)$/s;
-const GIT_CONFIG_INDEX_RE = /^(?:0|[1-9][0-9]*)$/;
-const GIT_CONFIG_COUNT_RE = /^[ \t\n\v\f\r]*([+-]?)([0-9]+)$/;
-function readGitConfigCount(value, platform) {
-    if (value === "")
-        return 0n;
-    const number = GIT_CONFIG_COUNT_RE.exec(value);
-    if (number === null)
-        return undefined;
-    const [, sign, digits = ""] = number;
-    const significant = digits.replace(/^0+/, "");
-    const unsignedLongMax = platform === "win32" ? 2n ** 32n - 1n : 2n ** 64n - 1n;
-    const magnitude = significant.length > 20 ? unsignedLongMax : BigInt(significant === "" ? "0" : significant);
-    const read = magnitude > unsignedLongMax ? unsignedLongMax : sign === "-" ? (unsignedLongMax + 1n - magnitude) % (unsignedLongMax + 1n) : magnitude;
-    return read <= 2n ** 31n - 1n ? read : undefined;
-}
-const GIT_CONFIG_PLACEHOLDER = { key: "sema.withheld", value: "" };
-function readGitEnvConfigRecord(env, platform) {
-    const withheld = new Map();
-    const kept = new Set();
-    const countNames = [];
-    const indexed = new Map();
-    const loose = new Map();
-    for (const [name, text] of Object.entries(env)) {
-        if (text === undefined)
-            continue;
-        const upper = name.toUpperCase();
-        const lookedUp = platform === "win32" ? upper : name;
-        if (lookedUp === GIT_CONFIG_COUNT_NAME) {
-            countNames.push(name);
-            continue;
-        }
-        const member = GIT_CONFIG_MEMBER_RE.exec(upper);
-        if (member === null)
-            continue;
-        const [, role, suffix = ""] = member;
-        const half = role === "KEY" ? "key" : "value";
-        const groups = GIT_CONFIG_MEMBER_RE.test(lookedUp) && GIT_CONFIG_INDEX_RE.test(suffix) ? indexed : loose;
-        const group = groups.get(suffix) ?? { members: [], twice: false };
-        groups.set(suffix, group);
-        group.members.push([name, half]);
-        if (group[half] !== undefined)
-            group.twice = true;
-        group[half] = text;
-    }
-    const withhold = (g, standIn) => {
-        for (const [n, half] of g.members)
-            withheld.set(n, standIn ? GIT_CONFIG_PLACEHOLDER[half] : undefined);
-    };
-    for (const g of loose.values()) {
-        if (g.twice || gitConfigEntryCarriesCredential(g))
-            withhold(g, false);
-        else if (g.members.some(([n]) => classifySecretEnvKey(n) !== undefined)) {
-            for (const [n] of g.members)
-                if (classifySecretEnvKey(n) === undefined)
-                    withheld.set(n, undefined);
-        }
-    }
-    const record = [...indexed].map(([suffix, g]) => [BigInt(suffix), g]);
-    const [countName, secondCountName] = countNames;
-    if (secondCountName !== undefined || record.some(([, g]) => g.twice)) {
-        for (const n of countNames)
-            withheld.set(n, undefined);
-        for (const [, g] of record)
-            withhold(g, false);
-        return { withheld, kept };
-    }
-    const count = countName === undefined ? 0n : readGitConfigCount(env[countName] ?? "", platform);
-    for (const n of countNames)
-        kept.add(n);
-    for (const [index, g] of record) {
-        if (gitConfigEntryCarriesCredential(g))
-            withhold(g, count === undefined || index < count);
-        else
-            for (const [n] of g.members)
-                kept.add(n);
-    }
-    return { withheld, kept };
+    return (carriesSchemelessUserinfo(text) ||
+        CREDENTIAL_ASSIGNMENT_RE.test(text) ||
+        WEBHOOK_URL_RE.test(text) ||
+        SONAR_LOGIN_RE.test(text) ||
+        PRIVATE_KEY_HEADER_RE.test(text) ||
+        AUTHORIZATION_HEADER_RE.test(text) ||
+        TOKEN_WORD_RE.test(text) ||
+        BEARER_BASIC_RE.test(text));
 }
 const SECRET_ENV_KIND_CONFIDENCE = {
     "exact-name": "high",
-    "suffix-rule": "medium",
+    "prefix-rule": "high",
+    "value-rule": "high",
+    "name-rule": "medium",
     "namespace-rule": "medium",
-    "family-rule": "high",
 };
-export function classifyExactEnvName(key, credentialNames, exemptNames) {
-    const upper = key.toUpperCase();
-    if (credentialNames.has(upper))
-        return "credential";
-    if (exemptNames.has(upper))
-        return "exempt";
-    return "unknown";
-}
-function classifySecretEnvKey(key) {
-    const byExactName = classifyExactEnvName(key, SECRET_ENV_EXACT_NAMES, NON_SECRET_ENV_EXACT_NAMES);
-    if (byExactName === "credential")
-        return "exact-name";
-    if (byExactName === "exempt")
-        return undefined;
-    if (SECRET_ENV_RE.test(key))
-        return "suffix-rule";
-    return SEMA_NAMESPACE_SECRET_RE.test(key) ? "namespace-rule" : undefined;
-}
-function classifyEnvEntry(key, value, record) {
-    if (record.withheld.has(key))
-        return "family-rule";
-    if (record.kept.has(key))
+function classifySecretEnvEntry(name, value) {
+    if (isExemptEnvName(name))
         return undefined;
-    if (value !== undefined && gitConfigVariableCarriesCredential(key.toUpperCase(), value))
-        return "family-rule";
-    return classifySecretEnvKey(key);
-}
-export function isSecretEnvKey(key, value, env, platform = process.platform) {
-    const record = readGitEnvConfigRecord(value === undefined ? {} : { ...env, [key]: value }, platform);
-    return classifyEnvEntry(key, value, record) !== undefined;
-}
-export function scrubSecretEnv(env, findings, platform = process.platform) {
-    const record = readGitEnvConfigRecord(env, platform);
-    const out = {};
-    for (const k of Object.keys(env)) {
-        const kind = classifyEnvEntry(k, env[k], record);
-        if (kind === undefined) {
-            out[k] = env[k];
-            continue;
-        }
-        const standIn = record.withheld.get(k);
-        if (standIn !== undefined)
-            out[k] = standIn;
-        if (findings !== undefined) {
-            findings.push({ key: k, kind, confidence: SECRET_ENV_KIND_CONFIDENCE[kind], source: "secret-env" });
-        }
+    if (CREDENTIAL_ENV_NAMES.has(name.toUpperCase().replace(/-/g, "_")))
+        return "exact-name";
+    if (OTEL_ENV_RE.test(name))
+        return "prefix-rule";
+    if (SEMA_NAMESPACE_SECRET_RE.test(name))
+        return "namespace-rule";
+    if (!NON_SECRET_ENV_EXACT_NAMES.has(name.toUpperCase()) && nameIsCredentialShaped(name))
+        return "name-rule";
+    return value !== undefined && valueCarriesCredential(typeof value === "string" ? value : String(value)) ? "value-rule" : undefined;
+}
+export function isSecretEnvKey(key, value) {
+    return classifySecretEnvEntry(key, value) !== undefined;
+}
+export function scrubSecretEnv(env, findings) {
+    const kept = [];
+    for (const key of Object.keys(env)) {
+        const value = env[key];
+        const kind = classifySecretEnvEntry(key, value);
+        if (kind === undefined)
+            kept.push([key, value]);
+        else
+            findings?.push({ key, kind, confidence: SECRET_ENV_KIND_CONFIDENCE[kind], source: "secret-env" });
     }
-    return out;
+    return Object.fromEntries(kept);
 }
 export function inheritedHostEnv(policy, findings) {
     if (policy === "all")
@@ -618,7 +181,7 @@ export function inheritedHostEnv(policy, findings) {
                 picked[k] = process.env[k];
         return picked;
     }
-    return scrubSecretEnv(process.env, findings, process.platform);
+    return scrubSecretEnv(process.env, findings);
 }
 export function inheritEnvPolicyProblem(value) {
     if (value === undefined || value === "all" || value === "scrub")