clinkx 1.0.0 → 1.1.1

package/clinkx-workflows/dist/dashboard/session-log-redaction.js

@@ -3,28 +3,208 @@ const REDACTION_MARKER = "[REDACTED]";
 const MAX_EVENT_TEXT_CHARS = 32_768;
 const MAX_EVENT_SUMMARY_CHARS = 4_096;
 const MAX_REDACTIONS = 10_000;
-const BEARER_PATTERN = /\bBearer\s+(?!\[REDACTED\])[^\s,;]+/gi;
-const BASIC_AUTHORIZATION_PATTERN = /(\b(?:Proxy-)?Authorization\s*:\s*Basic\s+)(?!\[REDACTED\])([A-Za-z0-9+/=._~-]+)/gi;
+const MAX_ARGUMENT_BYTES = 32_768;
+const MAX_ARGUMENT_INPUT_BYTES = 1024 * 1024;
+const MAX_ARGUMENT_DEPTH = 64;
+const MAX_ARGUMENT_NODES = 10_000;
+const SENSITIVE_KEY_SOURCE = "api[-_]?key|apikey|access[-_]?token|auth[-_]?token|token|secret|client[-_]?secret|password|authorization|proxy[-_]?authorization|cookie|set[-_]?cookie|private[-_]?key";
+const SENSITIVE_KEY_PATTERN = new RegExp(`^(?:${SENSITIVE_KEY_SOURCE}|pgpassword)$`, "i");
+const BEARER_PATTERN = /\bBearer\s+(?!\[REDACTED\])[^\s,;"']+/gi;
 const PRIVATE_KEY_SIGNAL_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/i;
-const SENSITIVE_QUERY_PATTERN = /([?&](?:api[-_]?key|access[-_]?token|auth[-_]?token|token|secret|password|client[-_]?secret|signature|sig|key)=)(?!\[REDACTED\])([^&#\s]+)/gi;
-const QUOTED_ASSIGNMENT_PATTERN = /(\b(?:api[-_]?key|apikey|access[-_]?token|auth[-_]?token|token|secret|client[-_]?secret|password)\b\s*[:=]\s*)(["'])(?!\[REDACTED\])([^\r\n]*?)\2/gi;
-const BARE_ASSIGNMENT_PATTERN = /(\b(?:api[-_]?key|apikey|access[-_]?token|auth[-_]?token|token|secret|client[-_]?secret|password)\b\s*[:=]\s*)(?!["']|\[REDACTED\])([^\s,;&#}\]]+)/gi;
-const VENDOR_TOKEN_PATTERN = /\b(?:sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{12,}|github_pat_[A-Za-z0-9_]{12,}|gh[pousr]_[A-Za-z0-9]{12,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+const SENSITIVE_QUERY_PATTERN = /([?&](?:api[-_]?key|access[-_]?token|auth[-_]?token|token|secret|password|client[-_]?secret|signature|sig|key)=)(?!\[REDACTED\])([^&#\s"']+)/gi;
+const ASSIGNMENT_PATTERN = /(^|[^A-Za-z0-9_])([A-Za-z_][A-Za-z0-9_]{0,127})([ \t]*[=:][ \t]*)/g;
+const VENDOR_TOKEN_PATTERN = /\b(?:sk-(?:ant-|proj-|svcacct-)?[A-Za-z0-9_-]{12,}|(?:sk|pk|github_pat|cxel|cxmsg|npm)_[A-Za-z0-9_:-]{12,}|gh[pousr]_[A-Za-z0-9]{12,}|xox[baprs]-[A-Za-z0-9-]{10,}|glpat-[A-Za-z0-9_-]{12,}|(?:AKIA|ASIA)[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35})\b/g;
+const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{1,4096}\.[A-Za-z0-9_-]{1,4096}\.[A-Za-z0-9_-]{1,4096}(?![A-Za-z0-9_.-])/g;
+const HEADER_PATTERN = /^(Proxy-Authorization|Authorization|Set-Cookie|Cookie)([ \t]*:[ \t]*)(.*)$/i;
+const SHELL_DELIMITER_PATTERN = /[\s;|&]/;
 const POSIX_USER_HOME_PATTERN = /\/(?:Users|home)\/[^/\s"'`<>]+/g;
 const ROOT_USER_HOME_PATTERN = /\/root(?=\/|[\s"'`<>]|$)/g;
 const WINDOWS_USER_HOME_PATTERN = /\b[A-Za-z]:\\Users\\[^\\/\s"'`<>]+/gi;
-const SENSITIVE_ASSIGNMENT_PREFIX_PATTERN = /\b(?:api[-_]?key|apikey|access[-_]?token|auth[-_]?token|token|secret|client[-_]?secret|password)\b\s*[:=]\s*/gi;
-export function prepareSessionLogEventV1(input) {
+function isSensitiveKey(key) {
+    const normalized = key.toLowerCase().replace(/[-_ ]+/g, "_");
+    return SENSITIVE_KEY_PATTERN.test(normalized) || /(?:^|_)(?:token|secret|password|api_key|secret_access_key)$/.test(normalized);
+}
+const preparationHistory = new WeakMap();
+export function prepareSessionLogEventV1(input, options) {
+    const prior = input !== null && typeof input === "object"
+        ? preparationHistory.get(input)
+        : undefined;
+    if (prior !== undefined) {
+        if (options?.coverage === undefined || options.coverage === prior.redaction.coverage)
+            return prior;
+        const result = Object.freeze({ ...prior, redaction: Object.freeze({ ...prior.redaction, coverage: options.coverage }) });
+        preparationHistory.set(prior.event, result);
+        return result;
+    }
     const normalized = validateNormalizedEvent(input);
     const prepared = redactEvent(normalized);
     assertTextWithinContract(prepared.event);
+    if (prepared.event.kind === "tool_call" && prepared.event.arguments !== undefined) {
+        Object.freeze(prepared.event.arguments);
+    }
     const event = Object.freeze(prepared.event);
+    const count = Math.min(MAX_REDACTIONS, prepared.count);
     const redaction = Object.freeze({
         ran: true,
-        status: prepared.count === 0 ? "no_matches" : "redacted",
-        count: prepared.count,
+        status: count === 0 ? "no_matches" : "redacted",
+        count,
+        ...(options?.coverage === undefined ? {} : { coverage: options.coverage }),
+    });
+    const result = Object.freeze({
+        event,
+        redaction,
+        ...(prepared.truncated ? { truncated: true } : {}),
+        ...(event.kind === "tool_call" && event.arguments !== undefined && event.arguments.omission !== "none"
+            ? { omitted: true } : {}),
+    });
+    preparationHistory.set(event, result);
+    return result;
+}
+class ArgumentAdmissionError extends Error {
+    reason;
+    constructor(reason) {
+        super("argument admission failed");
+        this.reason = reason;
+    }
+}
+export function prepareSessionLogToolCallV1(event, value, options) {
+    const args = sanitizeArguments(value);
+    const candidate = { ...event, summary: args.summary ?? event.summary, arguments: args.detail };
+    const prepared = prepareSessionLogEventV1(candidate, options);
+    const count = Math.min(MAX_REDACTIONS, args.count + prepared.redaction.count);
+    const result = Object.freeze({
+        ...prepared,
+        redaction: Object.freeze({ ...prepared.redaction, status: count > 0 ? "redacted" : "no_matches", count }),
     });
-    return Object.freeze({ event, redaction });
+    preparationHistory.set(result.event, result);
+    return result;
+}
+function sanitizeArgumentDetail(detail) {
+    if (detail.omission !== "none")
+        return { detail: { ...detail }, count: 0 };
+    if (detail.content.length > MAX_ARGUMENT_INPUT_BYTES || Buffer.byteLength(detail.content, "utf8") > MAX_ARGUMENT_INPUT_BYTES) {
+        return { detail: { content: "", omission: "size_limit" }, count: 0 };
+    }
+    try {
+        return sanitizeArguments(JSON.parse(detail.content));
+    }
+    catch {
+        return { detail: { content: "", omission: "invalid" }, count: 0 };
+    }
+}
+function sanitizeArguments(input, baseDepth = 0) {
+    let nodes = 0;
+    let bytes = 0;
+    let count = 0;
+    const active = new Set();
+    const charge = (text) => {
+        if (text.length > MAX_ARGUMENT_INPUT_BYTES)
+            throw new ArgumentAdmissionError("size_limit");
+        bytes += Buffer.byteLength(JSON.stringify(text), "utf8");
+        if (bytes > MAX_ARGUMENT_INPUT_BYTES)
+            throw new ArgumentAdmissionError("size_limit");
+    };
+    const visit = (value, depth) => {
+        if (++nodes > MAX_ARGUMENT_NODES || depth > MAX_ARGUMENT_DEPTH)
+            throw new ArgumentAdmissionError("structure_limit");
+        if (value === null || typeof value === "boolean")
+            return value;
+        if (typeof value === "number") {
+            if (!Number.isFinite(value))
+                throw new ArgumentAdmissionError("invalid");
+            return value;
+        }
+        if (typeof value === "string") {
+            charge(value);
+            const trimmed = value.trimStart();
+            if (/^[{["]/.test(trimmed)) {
+                let decoded;
+                let valid = false;
+                try {
+                    decoded = JSON.parse(value);
+                    valid = true;
+                }
+                catch {
+                    valid = false;
+                }
+                if (valid)
+                    return JSON.stringify(visit(decoded, depth + 1));
+            }
+            const redacted = redactText(value, Number.POSITIVE_INFINITY, depth + 1);
+            count += redacted.count;
+            return redacted.text;
+        }
+        if (typeof value !== "object" || value === undefined)
+            throw new ArgumentAdmissionError("invalid");
+        if (active.has(value))
+            throw new ArgumentAdmissionError("invalid");
+        active.add(value);
+        try {
+            if (Array.isArray(value)) {
+                if (value.length + nodes > MAX_ARGUMENT_NODES)
+                    throw new ArgumentAdmissionError("structure_limit");
+                const result = [];
+                for (let index = 0; index < value.length; index += 1) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                    if (descriptor === undefined || !("value" in descriptor))
+                        throw new ArgumentAdmissionError("invalid");
+                    result.push(visit(descriptor.value, depth + 1));
+                }
+                return result;
+            }
+            if (!isPlainRecord(value))
+                throw new ArgumentAdmissionError("invalid");
+            const keys = Object.keys(value);
+            if (keys.length + nodes > MAX_ARGUMENT_NODES)
+                throw new ArgumentAdmissionError("structure_limit");
+            const result = Object.create(null);
+            const sensitiveHeaderPair = typeof value["name"] === "string" && isSensitiveKey(value["name"]);
+            for (const key of keys) {
+                charge(key);
+                const child = visit(value[key], depth + 1);
+                const redactedKey = redactText(key);
+                count += redactedKey.count;
+                const retainedKey = redactedKey.count === 0 ? key
+                    : `redacted_key_${createHash("sha256").update(key).digest("hex")}`;
+                if (isSensitiveKey(key) || (key === "value" && sensitiveHeaderPair)) {
+                    if (value[key] !== REDACTION_MARKER)
+                        count += 1;
+                    result[retainedKey] = REDACTION_MARKER;
+                }
+                else {
+                    if (Object.hasOwn(result, retainedKey))
+                        throw new ArgumentAdmissionError("invalid");
+                    result[retainedKey] = child;
+                }
+            }
+            return result;
+        }
+        finally {
+            active.delete(value);
+        }
+    };
+    try {
+        const value = visit(input, baseDepth);
+        const content = JSON.stringify(value);
+        let summary;
+        if (isPlainRecord(value)) {
+            for (const key of ["command", "cmd", "CommandLine", "file_path", "path", "pattern", "query"]) {
+                if (typeof value[key] === "string" && value[key].length > 0) {
+                    summary = value[key];
+                    break;
+                }
+            }
+        }
+        return {
+            detail: Buffer.byteLength(content, "utf8") > MAX_ARGUMENT_BYTES
+                ? { content: "", omission: "size_limit" } : { content, omission: "none" },
+            ...(summary === undefined ? {} : { summary }),
+            count,
+        };
+    }
+    catch (error) {
+        return { detail: { content: "", omission: error instanceof ArgumentAdmissionError ? error.reason : "invalid" }, count };
+    }
 }
 function assertTextWithinContract(event) {
     let text;
@@ -60,27 +240,31 @@ function redactEvent(event) {
     switch (event.kind) {
         case "user":
         case "assistant": {
-            const redacted = redactText(event.content, MAX_EVENT_TEXT_CHARS);
-            return { event: { ...event, content: redacted.text }, count: redacted.count };
+            const redacted = redactText(event.content, MAX_EVENT_TEXT_CHARS, 0, "prose");
+            return { event: { ...event, content: redacted.text }, count: redacted.count,
+                ...(redacted.truncated ? { truncated: true } : {}) };
         }
         case "tool_call": {
             const toolName = redactIdentifier(event.toolName);
             const callId = redactIdentifier(event.callId);
-            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS);
+            const args = event.arguments === undefined ? undefined : sanitizeArgumentDetail(event.arguments);
+            const redacted = redactText(args?.summary ?? event.summary, MAX_EVENT_SUMMARY_CHARS);
             return {
                 event: {
                     ...event,
                     toolName: toolName.value,
                     callId: callId.value,
                     summary: redacted.text,
+                    ...(args === undefined ? {} : { arguments: args.detail }),
                 },
-                count: toolName.count + callId.count + redacted.count,
+                count: toolName.count + callId.count + redacted.count + (args?.count ?? 0),
+                ...(redacted.truncated ? { truncated: true } : {}),
             };
         }
         case "tool_result": {
             const toolName = redactIdentifier(event.toolName);
             const callId = redactIdentifier(event.callId);
-            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS);
+            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS, 0, "prose");
             return {
                 event: {
                     ...event,
@@ -89,6 +273,7 @@ function redactEvent(event) {
                     summary: redacted.text,
                 },
                 count: toolName.count + callId.count + redacted.count,
+                ...(redacted.truncated ? { truncated: true } : {}),
             };
         }
         case "approval_request": {
@@ -97,6 +282,7 @@ function redactEvent(event) {
             return {
                 event: { ...event, approvalId: approvalId.value, action: redacted.text },
                 count: approvalId.count + redacted.count,
+                ...(redacted.truncated ? { truncated: true } : {}),
             };
         }
         case "approval_resolution": {
@@ -108,22 +294,25 @@ function redactEvent(event) {
         }
         case "error": {
             const code = redactIdentifier(event.code);
-            const redacted = redactText(event.message, MAX_EVENT_SUMMARY_CHARS);
+            const redacted = redactText(event.message, MAX_EVENT_SUMMARY_CHARS, 0, "prose");
             return {
                 event: { ...event, code: code.value, message: redacted.text },
                 count: code.count + redacted.count,
+                ...(redacted.truncated ? { truncated: true } : {}),
             };
         }
         case "reasoning": {
-            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS);
-            return { event: { ...event, summary: redacted.text }, count: redacted.count };
+            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS, 0, "prose");
+            return { event: { ...event, summary: redacted.text }, count: redacted.count,
+                ...(redacted.truncated ? { truncated: true } : {}) };
         }
         case "unknown": {
             const originalKind = redactIdentifier(event.originalKind);
-            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS);
+            const redacted = redactText(event.summary, MAX_EVENT_SUMMARY_CHARS, 0, "prose");
             return {
                 event: { ...event, originalKind: originalKind.value, summary: redacted.text },
                 count: originalKind.count + redacted.count,
+                ...(redacted.truncated ? { truncated: true } : {}),
             };
         }
         case "lifecycle":
@@ -141,58 +330,594 @@ function redactIdentifier(value) {
         .slice(0, 16);
     return { value: `redacted_${digest}`, count: 1 };
 }
-function redactText(value, maxChars = Number.POSITIVE_INFINITY) {
-    if (PRIVATE_KEY_SIGNAL_PATTERN.test(value)) {
-        return { text: REDACTION_MARKER, count: 1 };
-    }
-    let text = value;
+function applyTextEdits(text, edits) {
+    const parts = [];
+    let end = 0;
     let count = 0;
+    for (const edit of edits) {
+        parts.push(text.slice(end, edit.start), edit.text);
+        end = edit.end;
+        count += edit.count;
+    }
+    parts.push(text.slice(end));
+    return { text: parts.join(""), count };
+}
+function redactEmbeddedJson(text, depth) {
+    const edits = [];
+    for (let start = 0; start < text.length; start += 1) {
+        if (text[start] !== "{" && text[start] !== "[")
+            continue;
+        let shellEscaped = false;
+        const stack = [];
+        const decoded = [];
+        let quoted = false;
+        let escaped = false;
+        let end = start;
+        for (; end < text.length; end += 1) {
+            let char = text[end];
+            if (!quoted && char === "\\" && text[end + 1] === '"')
+                shellEscaped = true;
+            if (shellEscaped && char === "\\" && (text[end + 1] === "\\" || text[end + 1] === '"'))
+                char = text[++end];
+            decoded.push(char);
+            if (quoted) {
+                if (escaped)
+                    escaped = false;
+                else if (char === "\\")
+                    escaped = true;
+                else if (char === '"')
+                    quoted = false;
+            }
+            else if (char === '"')
+                quoted = true;
+            else if (char === "{" || char === "[")
+                stack.push(char);
+            else if (char === "}" || char === "]") {
+                const open = stack.pop();
+                if ((char === "}" && open !== "{") || (char === "]" && open !== "["))
+                    break;
+                if (stack.length === 0) {
+                    end += 1;
+                    break;
+                }
+            }
+        }
+        const source = decoded.join("");
+        try {
+            const parsed = JSON.parse(source);
+            const sanitized = sanitizeArguments(parsed, depth + 1);
+            if (sanitized.detail.omission !== "none") {
+                edits.push({ start, end, text: REDACTION_MARKER, count: Math.max(1, sanitized.count) });
+            }
+            else if (sanitized.count > 0) {
+                const replacement = shellEscaped ? sanitized.detail.content.replace(/[\\"]/g, "\\$&") : sanitized.detail.content;
+                edits.push({ start, end, text: replacement, count: sanitized.count });
+            }
+        }
+        catch {
+            const keyPattern = /"((?:\\.|[^"\\]){1,512})"\s*:/g;
+            let match;
+            while ((match = keyPattern.exec(source)) !== null) {
+                let key;
+                try {
+                    key = JSON.parse(`"${match[1]}"`);
+                }
+                catch {
+                    continue;
+                }
+                if (typeof key === "string" && isSensitiveKey(key)) {
+                    return { text: REDACTION_MARKER, count: 1 };
+                }
+            }
+        }
+        start = Math.max(start, end - 1);
+    }
+    return applyTextEdits(text, edits);
+}
+function isWordApostrophe(text, index) {
+    const attachedFlag = index >= 2 && /^-[uab]$/.test(text.slice(index - 2, index))
+        && (index === 2 || SHELL_DELIMITER_PATTERN.test(text[index - 3]));
+    return text[index] === "'"
+        && !attachedFlag
+        && /(?:\p{L}|\p{N})$/u.test(text.slice(Math.max(0, index - 2), index))
+        && /^\p{L}/u.test(text.slice(index + 1, index + 3));
+}
+function shellTokens(text, mode = "command") {
+    const tokens = [];
+    for (let index = 0; index < text.length;) {
+        const start = index;
+        if (SHELL_DELIMITER_PATTERN.test(text[index])) {
+            index += 1;
+            if (/[;|&\n]/.test(text[start]))
+                tokens.push({ start, end: index, value: text[start], quoted: false });
+            continue;
+        }
+        let quote;
+        let quoted = false;
+        const parts = [];
+        while (index < text.length) {
+            const char = text[index];
+            if (quote === undefined && SHELL_DELIMITER_PATTERN.test(char))
+                break;
+            const wordApostrophe = mode === "prose" && quote === undefined && isWordApostrophe(text, index);
+            index += 1;
+            if (wordApostrophe)
+                parts.push(char);
+            else if (quote === undefined && (char === "'" || char === '"')) {
+                quote = char;
+                quoted = true;
+            }
+            else if (char === quote)
+                quote = undefined;
+            else if (char === "\\" && quote !== "'" && index < text.length) {
+                if (text[index] === "\n")
+                    index += 1;
+                else if (text[index] === "\r" && text[index + 1] === "\n")
+                    index += 2;
+                else
+                    parts.push(text[index++]);
+            }
+            else
+                parts.push(char);
+        }
+        if (index <= start) {
+            index = start + 1;
+            continue;
+        }
+        if (parts.length > 0 || quoted)
+            tokens.push({ start, end: index, value: parts.join(""), quoted });
+    }
+    return tokens;
+}
+function redactHeader(value) {
+    const match = HEADER_PATTERN.exec(value);
+    if (match === null)
+        return { text: value, count: 0 };
+    const body = match[3].trim();
+    const scheme = /authorization/i.test(match[1]) ? /^(?:Bearer|Basic)[ \t]+/i.exec(body)?.[0] ?? "" : "";
+    if (body === "" || body === REDACTION_MARKER || body === `${scheme}${REDACTION_MARKER}`)
+        return { text: value, count: 0 };
+    return { text: `${match[1]}${match[2]}${scheme}${REDACTION_MARKER}`, count: 1 };
+}
+function isMysqlCredential(value) {
+    return value.startsWith("-p") && value.length > 2
+        && !/^(?:(?:\d{1,3}\.){3}\d{1,3}:|\[[0-9A-Fa-f:]+\]:)?\d+(?::\d+)?(?:\/\w+)?$/.test(value.slice(2));
+}
+function credentialOption(tokens, index) {
+    const token = tokens[index];
+    const match = /^(--[\w-]+)(?:=([\s\S]*))?$|^(-[uab])=?([\s\S]*)$/.exec(token.value);
+    if (match === null)
+        return undefined;
+    const flag = match[1] ?? match[3];
+    const attached = match[2] !== undefined || (match[3] !== undefined && token.value.length > 2);
+    const operand = attached ? token : tokens[index + 1];
+    const value = attached ? match[2] ?? match[4] : operand?.value ?? "";
+    const colon = value.indexOf(":");
+    const sensitive = ["-u", "--user", "--proxy-user", "--http-user", "-a", "--auth"].includes(flag) ? colon >= 0 && colon < value.length - 1
+        : ["-b", "--cookie"].includes(flag) ? value.includes("=")
+            : ["--password", "--http-password", "--proxy-password", "--passwd"].includes(flag);
+    return sensitive && operand !== undefined && !(!operand.quoted && /^[;|&\n]$/.test(value))
+        ? { flag, attached, operand, value } : undefined;
+}
+function proseOperandWord(line, start, enclosingEnd) {
+    if (start >= line.length || SHELL_DELIMITER_PATTERN.test(line[start]))
+        return undefined;
+    let quote;
+    let quoted = false;
+    const parts = [];
+    let end = start;
+    while (end < line.length) {
+        if (quote === undefined && SHELL_DELIMITER_PATTERN.test(line[end]))
+            break;
+        const char = line[end++];
+        if (quote === undefined && (char === "'" || char === '"')) {
+            quote = char;
+            quoted = true;
+        }
+        else if (char === quote)
+            quote = undefined;
+        else if (char === "\\" && quote !== "'" && end < line.length)
+            parts.push(line[end++]);
+        else
+            parts.push(char);
+    }
+    if (quote !== undefined && enclosingEnd !== undefined && enclosingEnd > start && enclosingEnd < end) {
+        return proseOperandWord(line.slice(0, enclosingEnd), start);
+    }
+    return { start, end, value: parts.join(""), quoted };
+}
+function recoveredProseCredentialOption(line, tokens, index, enclosingEnd) {
+    const token = tokens[index];
+    const attached = /^(--[\w-]+=|-[uab]=?)(?=\S)/.exec(line.slice(token.start, token.end));
+    if (attached === null && !/^(?:--[\w-]+|-[uab])$/.test(token.value))
+        return undefined;
+    const start = attached === null ? tokens[index + 1]?.start : token.start + attached[0].length;
+    if (start === undefined)
+        return undefined;
+    const operand = proseOperandWord(line, start, enclosingEnd);
+    if (operand === undefined)
+        return undefined;
+    const flag = attached === null ? token : { ...token, end: operand.end, value: attached[0] + operand.value };
+    const credential = credentialOption([flag, operand], 0);
+    return credential?.value === REDACTION_MARKER ? undefined : credential;
+}
+function proseEvidenceTokens(text) {
+    return Array.from(text.matchAll(/[^\s;|&]+|[;|&\n]/g), (word) => ({
+        start: word.index, end: word.index + word[0].length, value: word[0].replace(/["']/g, ""), quoted: false,
+    }));
+}
+function redactMultilineProseTokens(text) {
+    if (!text.includes("\n"))
+        return { text, count: 0 };
+    // Recover only credential-owned words; preceding prose quotes cannot own later lines.
+    const tokens = proseEvidenceTokens(text);
+    const edits = [];
+    let mysql = false;
+    let enclosingEnd;
+    for (let index = 0; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (enclosingEnd !== undefined && token.start >= enclosingEnd)
+            enclosingEnd = undefined;
+        if (/^[;|&\n]$/.test(token.value)) {
+            mysql = false;
+            continue;
+        }
+        if (["mysql", "mariadb"].includes(token.value.split(/[\\/]/).at(-1)))
+            mysql = true;
+        const assignment = /^["']?([A-Za-z_][A-Za-z0-9_]{0,127})([ \t]*[=:][ \t]*)/.exec(text.slice(token.start));
+        const sensitiveAssignment = assignment !== null && isSensitiveKey(assignment[1])
+            && !(assignment[2].includes(":") && /authorization|cookie/i.test(assignment[1]));
+        const spacedAssignment = sensitiveAssignment && /[ \t]/.test(assignment[2]);
+        const credential = recoveredProseCredentialOption(text, tokens, index, enclosingEnd);
+        const mysqlOperand = mysql && isMysqlCredential(token.value) && token.value !== `-p${REDACTION_MARKER}`;
+        const headerPrefix = token.value.startsWith("--header=") ? "--header=" : token.value.startsWith("-H") ? "-H" : "";
+        const headerOperand = headerPrefix !== "" || ["-H", "--header"].includes(tokens[index - 1]?.value ?? "");
+        const wrapper = tokens[index - 1]?.value.split(/[\\/]/).at(-1);
+        const commandFlag = (["sh", "bash", "zsh"].includes(wrapper ?? "") && /^-[A-Za-z]*c[A-Za-z]*$/.test(token.value))
+            || (wrapper === "env" && ["-S", "--split-string"].includes(token.value));
+        const operand = credential?.operand ?? (commandFlag ? proseOperandWord(text, tokens[index + 1]?.start ?? text.length, enclosingEnd)
+            : sensitiveAssignment || mysqlOperand || headerOperand ? proseOperandWord(text, spacedAssignment ? token.start + assignment[0].length : token.start + headerPrefix.length, enclosingEnd) : undefined);
+        if (operand === undefined) {
+            const quote = text[token.start];
+            if (quote === "'" || quote === '"') {
+                const enclosing = proseOperandWord(text, token.start);
+                if (text.slice(token.start, enclosing.end).includes("\n") && text[enclosing.end - 1] === quote)
+                    enclosingEnd = enclosing.end - 1;
+            }
+            continue;
+        }
+        const source = text.slice(operand.start, operand.end);
+        if (source.includes("\n") || operand.end === enclosingEnd) {
+            let replacement;
+            if (spacedAssignment) {
+                const quote = source[0];
+                replacement = (quote === "'" || quote === '"') && source.endsWith(quote)
+                    ? `${quote}${REDACTION_MARKER}${quote}` : REDACTION_MARKER;
+            }
+            else if (sensitiveAssignment) {
+                const prefix = `${assignment[1]}${assignment[2]}`;
+                if (operand.value.slice(prefix.length) !== REDACTION_MARKER) {
+                    replacement = REDACTION_MARKER;
+                    const quote = source[0];
+                    if ((quote === "'" || quote === '"') && source === `${quote}${operand.value}${quote}`) {
+                        replacement = `${quote}${prefix}${REDACTION_MARKER}${quote}`;
+                    }
+                    else if (source.startsWith(prefix)) {
+                        const rawValue = source.slice(prefix.length);
+                        const quote = rawValue[0];
+                        if (quote !== "'" && quote !== '"')
+                            replacement = prefix + REDACTION_MARKER;
+                        else if (rawValue === `${quote}${operand.value.slice(prefix.length)}${quote}`) {
+                            replacement = `${prefix}${quote}${REDACTION_MARKER}${quote}`;
+                        }
+                    }
+                }
+            }
+            else if (credential !== undefined) {
+                replacement = (credential.attached ? credential.flag + (token.value[credential.flag.length] === "=" ? "=" : "") : "") + REDACTION_MARKER;
+            }
+            else if (mysqlOperand)
+                replacement = `-p${REDACTION_MARKER}`;
+            else if (headerOperand && redactHeader(operand.value.replace(/\r?\n/g, " ")).count > 0)
+                replacement = REDACTION_MARKER;
+            else if (commandFlag && firstProseCredentialEvidence(operand.value.replace(/\r?\n/g, " ")) !== undefined)
+                replacement = REDACTION_MARKER;
+            if (replacement !== undefined)
+                edits.push({
+                    start: operand.start, end: operand.end + (sensitiveAssignment && operand.end === enclosingEnd ? 1 : 0), text: replacement, count: 1,
+                });
+        }
+        // A locally decoded word owns its quote fragments, even when no edit is needed.
+        while (tokens[index + 1] !== undefined && tokens[index + 1].start < operand.end)
+            index += 1;
+    }
+    return applyTextEdits(text, edits);
+}
+function firstProseCredentialEvidence(line) {
+    let first = Number.POSITIVE_INFINITY;
+    ASSIGNMENT_PATTERN.lastIndex = 0;
+    let match;
+    while ((match = ASSIGNMENT_PATTERN.exec(line)) !== null) {
+        const valueStart = ASSIGNMENT_PATTERN.lastIndex;
+        // Leave trailing space available as the boundary of a following assignment.
+        ASSIGNMENT_PATTERN.lastIndex -= /[ \t]+$/.exec(match[3])?.[0].length ?? 0;
+        if (match[1] === "-" && line[match.index - 1] === "-" && match[3].startsWith("=")
+            && /^(?:user|proxy-user|http-user|auth|cookie|password|http-password|proxy-password|passwd)$/.test(match[2])
+            && (match.index === 1 || /[\s;|&"']/.test(line[match.index - 2])))
+            continue;
+        if (isSensitiveKey(match[2]) && !(match[3].includes(":") && /authorization|cookie/i.test(match[2]))) {
+            if (/^["']?\[REDACTED\]["']?(?=$|[\s;|&,])/.test(line.slice(valueStart)))
+                continue;
+            const operand = proseOperandWord(line, valueStart);
+            if (operand !== undefined && operand.value !== REDACTION_MARKER) {
+                first = match.index + match[1].length;
+                break;
+            }
+        }
+    }
+    // Ignore quote grouping only for locating evidence in an already ambiguous line.
+    const tokens = proseEvidenceTokens(line);
+    let mysql = false;
+    for (let index = 0; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (token.start >= first)
+            break;
+        if (/^[;|&]$/.test(token.value)) {
+            mysql = false;
+            continue;
+        }
+        const credential = credentialOption(tokens, index);
+        if ((credential !== undefined && credential.value !== REDACTION_MARKER) || recoveredProseCredentialOption(line, tokens, index) !== undefined
+            || (mysql && isMysqlCredential(token.value) && token.value !== `-p${REDACTION_MARKER}`)) {
+            first = Math.min(first, token.start);
+        }
+        const headerPrefix = token.value.startsWith("--header=") ? "--header=" : token.value.startsWith("-H") ? "-H" : "";
+        if (HEADER_PATTERN.test(token.value.slice(headerPrefix.length))) {
+            const headerStart = token.start + headerPrefix.length;
+            const quoted = line[headerStart] === "'" || line[headerStart] === '"';
+            const value = (quoted ? proseOperandWord(line, headerStart)?.value : undefined) ?? line.slice(headerStart).replace(/["']/g, "");
+            const header = HEADER_PATTERN.exec(value);
+            if (header !== null && redactHeader(value).count > 0) {
+                const previous = tokens[index - 1];
+                const start = previous !== undefined && ["-H", "--header"].includes(previous.value) ? previous.start : token.start;
+                first = Math.min(first, start);
+            }
+        }
+        if (["mysql", "mariadb"].includes(token.value.split(/[\\/]/).at(-1)))
+            mysql = true;
+    }
+    const url = redactUrlUserinfo(line);
+    if (url.firstStart !== undefined)
+        first = Math.min(first, url.firstStart);
+    for (const pattern of [VENDOR_TOKEN_PATTERN, JWT_PATTERN, BEARER_PATTERN]) {
+        pattern.lastIndex = 0;
+        const evidence = pattern.exec(line);
+        if (evidence !== null)
+            first = Math.min(first, evidence.index);
+    }
+    return Number.isFinite(first) ? first : undefined;
+}
+function redactProseCommandsAndHeaders(text) {
+    const multiline = redactMultilineProseTokens(text);
+    let count = multiline.count;
+    const lines = multiline.text.split("\n").map((source) => {
+        const cr = source.endsWith("\r") ? "\r" : "";
+        const line = cr === "" ? source : source.slice(0, -1);
+        let single = 0;
+        let double = 0;
+        for (let index = 0; index < line.length; index += 1) {
+            if (line[index] === "\\") {
+                index += 1;
+                continue;
+            }
+            if (line[index] === "'" && !isWordApostrophe(line, index))
+                single += 1;
+            if (line[index] === '"')
+                double += 1;
+        }
+        const assignments = redactAssignments(line);
+        if (single % 2 !== 0 || double % 2 !== 0 || (assignments.text === REDACTION_MARKER && assignments.count > 0)) {
+            const first = firstProseCredentialEvidence(line);
+            if (first === undefined)
+                return source;
+            count += 1;
+            return line.slice(0, first) + REDACTION_MARKER + cr;
+        }
+        const redacted = redactCommandsAndHeaders(line, 0, false, "prose");
+        count += redacted.count;
+        return redacted.text + cr;
+    });
+    return { text: lines.join("\n"), count };
+}
+function redactCommandsAndHeaders(text, depth = 0, evidenceOnly = false, mode = "command") {
+    const lines = text.split("\n");
+    let lineCount = 0;
+    text = lines.map((line) => {
+        const indent = /^[ \t]*/.exec(line)[0];
+        const redacted = redactHeader(line.slice(indent.length));
+        lineCount += redacted.count;
+        return indent + redacted.text;
+    }).join("\n");
+    const tokens = shellTokens(text, mode);
+    const edits = [];
+    let mysql = false;
+    for (let index = 0; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (/^[;|&\n]$/.test(token.value) && !token.quoted) {
+            mysql = false;
+            continue;
+        }
+        const source = text.slice(token.start, token.end);
+        const previous = tokens[index - 1];
+        const wrapper = tokens[index - 2]?.value.split(/[\\/]/).at(-1);
+        const quotedCommand = token.quoted && previous !== undefined && !previous.quoted && ((["sh", "bash", "zsh"].includes(wrapper ?? "") && /^-[A-Za-z]*c[A-Za-z]*$/.test(previous.value))
+            || (wrapper === "env" && ["-S", "--split-string"].includes(previous.value)));
+        const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=/.exec(token.value);
+        if (assignment !== null && isSensitiveKey(assignment[1]) && !quotedCommand) {
+            // Spaced prose values are handled by redactAssignments, including existing markers.
+            if (mode === "prose" && token.value === assignment[0] && /[ \t]/.test(text[token.end] ?? ""))
+                continue;
+            if (!source.startsWith(assignment[0])) {
+                const quote = source[0];
+                const mapped = (quote === '"' || quote === "'") && source === `${quote}${token.value}${quote}`;
+                const replacement = mapped ? `${quote}${assignment[0]}${REDACTION_MARKER}${quote}` : REDACTION_MARKER;
+                if (source !== replacement)
+                    edits.push({ start: token.start, end: token.end, text: replacement, count: 1 });
+                continue;
+            }
+            const start = token.start + assignment[0].length;
+            const quote = text[start] === '"' || text[start] === "'" ? text[start] : "";
+            if (quote !== "" && (text.slice(start, token.end).includes("\n") || text[token.end - 1] !== quote)) {
+                return { text: REDACTION_MARKER, count: 1 };
+            }
+            const replacement = `${quote}${REDACTION_MARKER}${quote}${quote === "" && source.endsWith(",") ? "," : ""}`;
+            if (text.slice(start, token.end) !== replacement)
+                edits.push({ start, end: token.end, text: replacement, count: 1 });
+            continue;
+        }
+        const headerPrefix = token.value.startsWith("--header=") ? "--header=" : token.value.startsWith("-H") ? "-H" : "";
+        const header = headerPrefix !== "" || token.quoted || tokens[index - 1]?.value === "-H" || tokens[index - 1]?.value === "--header"
+            ? redactHeader(token.value.slice(headerPrefix.length)) : { text: token.value, count: 0 };
+        if (header.count > 0) {
+            edits.push({ start: token.start, end: token.end, text: headerPrefix + JSON.stringify(header.text), count: 1 });
+            continue;
+        }
+        if (mysql && isMysqlCredential(token.value)) {
+            if (token.value.slice(2) !== REDACTION_MARKER)
+                edits.push({ start: token.start, end: token.end, text: `-p${REDACTION_MARKER}`, count: 1 });
+            continue;
+        }
+        if (!token.quoted && ["mysql", "mariadb"].includes(token.value.split(/[\\/]/).at(-1)))
+            mysql = true;
+        const credential = credentialOption(tokens, index);
+        if (credential !== undefined) {
+            const { flag, attached, operand, value } = credential;
+            const prefix = attached ? flag + (token.value[flag.length] === "=" ? "=" : "") : "";
+            if (value !== REDACTION_MARKER)
+                edits.push({ start: operand.start, end: operand.end, text: prefix + REDACTION_MARKER, count: 1 });
+            if (!attached)
+                index += 1;
+            continue;
+        }
+        if (token.quoted && (quotedCommand || /\s/.test(token.value)) && !evidenceOnly) {
+            const nested = redactCommandsAndHeaders(token.value, 1, depth > 0);
+            const count = nested.count + (depth === 0 ? 0 : redactAssignments(token.value).count + redactUrlUserinfo(token.value).count
+                + Number(Boolean(token.value.match(VENDOR_TOKEN_PATTERN) || token.value.match(JWT_PATTERN) || token.value.match(BEARER_PATTERN))));
+            if (count > 0) {
+                const quote = source[0];
+                const mapped = (quote === '"' || quote === "'") && source === `${quote}${token.value}${quote}`;
+                edits.push({ start: token.start, end: token.end, text: mapped && depth === 0 ? `${quote}${nested.text}${quote}` : REDACTION_MARKER, count: depth === 0 ? count : 1 });
+            }
+        }
+    }
+    const result = applyTextEdits(text, edits);
+    return { text: result.text, count: result.count + lineCount };
+}
+function redactAssignments(text) {
+    const edits = [];
+    ASSIGNMENT_PATTERN.lastIndex = 0;
+    let match;
+    while ((match = ASSIGNMENT_PATTERN.exec(text)) !== null) {
+        if (!isSensitiveKey(match[2]))
+            continue;
+        if (match[1] === "-" && text[match.index - 1] === "-" && match[3].startsWith("=")
+            && /^(?:user|proxy-user|http-user|auth|cookie|password|http-password|proxy-password|passwd)$/.test(match[2])
+            && (match.index === 1 || /[\s;|&"']/.test(text[match.index - 2])))
+            continue;
+        if (match[3].includes(":") && /authorization|cookie/i.test(match[2]))
+            continue;
+        const start = ASSIGNMENT_PATTERN.lastIndex;
+        const quote = text[start] === '"' || text[start] === "'" ? text[start] : undefined;
+        let end = start + (quote === undefined ? 0 : 1);
+        if (quote === undefined && text.startsWith(REDACTION_MARKER, start))
+            end += REDACTION_MARKER.length;
+        for (; end < text.length; end += 1) {
+            const char = text[end];
+            if (quote === undefined && (/[\s,;&#}\]]/.test(char) || ((match[1] === '"' || match[1] === "'") && char === match[1])))
+                break;
+            if (quote !== undefined && char === "\n")
+                return { text: REDACTION_MARKER, count: 1 };
+            if (quote !== undefined && char === "\\")
+                end += 1;
+            else if (quote !== undefined && char === quote) {
+                end += 1;
+                break;
+            }
+        }
+        const replacement = quote === undefined ? REDACTION_MARKER : `${quote}${REDACTION_MARKER}${quote}`;
+        if (text.slice(start, end) === replacement || end === start)
+            continue;
+        if (quote !== undefined && text[end - 1] !== quote)
+            return { text: REDACTION_MARKER, count: 1 };
+        if (quote !== undefined && end < text.length && !/[\s,;&#}\]]/.test(text[end]))
+            return { text: REDACTION_MARKER, count: 1 };
+        edits.push({ start, end, text: replacement, count: 1 });
+        ASSIGNMENT_PATTERN.lastIndex = end;
+    }
+    return applyTextEdits(text, edits);
+}
+function redactUrlUserinfo(text) {
+    const schemePattern = /\b[A-Za-z][A-Za-z0-9+.-]{0,63}:\/\//g;
+    const edits = [];
+    let firstStart;
+    let match;
+    while ((match = schemePattern.exec(text)) !== null) {
+        const start = schemePattern.lastIndex;
+        let end = start;
+        let colon = -1;
+        let at = -1;
+        for (; end < text.length && !/[\s/?#"'<>`]/.test(text[end]); end += 1) {
+            if (text[end] === ":" && colon < 0)
+                colon = end;
+            if (text[end] === "@")
+                at = end;
+        }
+        if (colon >= start && at > colon) {
+            firstStart ??= match.index;
+            edits.push({ start, end: at, text: REDACTION_MARKER, count: 1 });
+        }
+        schemePattern.lastIndex = end;
+    }
+    return { ...applyTextEdits(text, edits), firstStart };
+}
+function redactText(value, maxChars = Number.POSITIVE_INFINITY, depth = 0, mode = "command") {
+    if (PRIVATE_KEY_SIGNAL_PATTERN.test(value))
+        return { text: REDACTION_MARKER, count: 1 };
+    const embedded = redactEmbeddedJson(value, depth);
+    const commands = mode === "prose" ? redactProseCommandsAndHeaders(embedded.text) : redactCommandsAndHeaders(embedded.text);
+    let text = commands.text;
+    let count = embedded.count + commands.count;
     const replace = (pattern, replacement) => {
         text = text.replace(pattern, (...args) => {
             count += 1;
             return replacement(...args.slice(0, -2).map(String));
         });
     };
-    replace(BASIC_AUTHORIZATION_PATTERN, (_match, prefix) => `${prefix}${REDACTION_MARKER}`);
     replace(BEARER_PATTERN, (match) => `${match.slice(0, match.search(/\s/))} ${REDACTION_MARKER}`);
     replace(SENSITIVE_QUERY_PATTERN, (_match, prefix) => `${prefix}${REDACTION_MARKER}`);
-    replace(QUOTED_ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTION_MARKER}${quote}`);
-    replace(BARE_ASSIGNMENT_PATTERN, (_match, prefix) => `${prefix}${REDACTION_MARKER}`);
+    const assignments = redactAssignments(text);
+    text = assignments.text;
+    count += assignments.count;
+    const urls = redactUrlUserinfo(text);
+    text = urls.text;
+    count += urls.count;
     replace(VENDOR_TOKEN_PATTERN, () => REDACTION_MARKER);
+    replace(JWT_PATTERN, () => REDACTION_MARKER);
     replace(POSIX_USER_HOME_PATTERN, () => REDACTION_MARKER);
     replace(ROOT_USER_HOME_PATTERN, () => REDACTION_MARKER);
     replace(WINDOWS_USER_HOME_PATTERN, () => REDACTION_MARKER);
-    if (count > MAX_REDACTIONS ||
-        text.length > maxChars ||
-        hasSensitiveAssignmentResidual(text)) {
+    if (count > MAX_REDACTIONS)
         return { text: REDACTION_MARKER, count: 1 };
-    }
-    return { text, count };
-}
-function hasSensitiveAssignmentResidual(text) {
-    SENSITIVE_ASSIGNMENT_PREFIX_PATTERN.lastIndex = 0;
-    let match;
-    while ((match = SENSITIVE_ASSIGNMENT_PREFIX_PATTERN.exec(text)) !== null) {
-        const tail = text.slice(SENSITIVE_ASSIGNMENT_PREFIX_PATTERN.lastIndex);
-        if (tail.length === 0 || /^[&;,}\]\r\n]/.test(tail))
-            continue;
-        if (tail.startsWith(REDACTION_MARKER)) {
-            const next = tail[REDACTION_MARKER.length];
-            if (next === undefined || /[\s&;,}\]]/.test(next))
-                continue;
-        }
-        const quote = tail[0];
-        if (quote === "\"" || quote === "'") {
-            const safeQuoted = `${quote}${REDACTION_MARKER}${quote}`;
-            if (tail.startsWith(safeQuoted)) {
-                const next = tail[safeQuoted.length];
-                if (next === undefined || /[\s&;,}\]]/.test(next))
-                    continue;
-            }
-        }
-        return true;
-    }
-    return false;
+    if (text.length <= maxChars)
+        return { text, count };
+    let end = maxChars;
+    const markerStart = text.lastIndexOf(REDACTION_MARKER, end - 1);
+    if (markerStart >= 0 && markerStart + REDACTION_MARKER.length > end)
+        end = markerStart;
+    const code = text.charCodeAt(end - 1);
+    if (code >= 0xd800 && code <= 0xdbff)
+        end -= 1;
+    return { text: text.slice(0, end), count, truncated: true };
 }
 function validateNormalizedEvent(value) {
     if (!isPlainRecord(value) || typeof value["kind"] !== "string")
@@ -205,7 +930,7 @@ function validateNormalizedEvent(value) {
             }
             return { kind: value["kind"], content: value["content"] };
         case "tool_call":
-            if (!hasExactKeys(value, ["kind", "toolName", "callId", "summary"]) ||
+            if (!hasExactKeys(value, ["kind", "toolName", "callId", "summary", ...(Object.hasOwn(value, "arguments") ? ["arguments"] : [])]) ||
                 !isAdmissibleIdentifier(value["toolName"]) ||
                 !isAdmissibleIdentifier(value["callId"]) ||
                 typeof value["summary"] !== "string")
@@ -215,6 +940,7 @@ function validateNormalizedEvent(value) {
                 toolName: value["toolName"],
                 callId: value["callId"],
                 summary: value["summary"],
+                ...(Object.hasOwn(value, "arguments") ? { arguments: validateArgumentDetail(value["arguments"]) } : {}),
             };
         case "tool_result":
             if (!hasExactKeys(value, ["kind", "toolName", "callId", "outcome", "summary"]) ||
@@ -325,6 +1051,14 @@ function validateNormalizedEvent(value) {
             return invalidEvent();
     }
 }
+function validateArgumentDetail(value) {
+    if (!isPlainRecord(value) || !hasExactKeys(value, ["content", "omission"]) ||
+        typeof value["content"] !== "string" ||
+        !isOneOf(value["omission"], ["none", "size_limit", "structure_limit", "invalid"]) ||
+        (value["omission"] !== "none" && value["content"] !== ""))
+        return invalidEvent();
+    return { content: value["content"], omission: value["omission"] };
+}
 function invalidEvent() {
     throw new TypeError("unsupported session-log-v1 normalized event");
 }