codex-multi-auth 2.17.2 → 2.17.3

package/dist/lib/account-policy.js

@@ -4,10 +4,9 @@ import { basename, join } from "node:path";
 import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { isRecord, sleep } from "./utils.js";
-import { tempPathFor } from "./temp-path.js";
+import { getJsonStoreFileMtimeMs, resetJsonStoreWriteQueuesForTests, stampUpdatedAt, withJsonStoreCasRetry, withJsonStoreFileLock, withJsonStoreWriteQueue, writeJsonStoreFileAtomicWithRetry, } from "./storage/json-store-lock.js";
 const ACCOUNT_POLICY_FILE_NAME = "account-policies.json";
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
-let writeQueue = Promise.resolve();
 function isRetryableFsError(error) {
     const code = error?.code;
     return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
@@ -113,45 +112,103 @@ export async function loadAccountPolicyStore() {
         return emptyStore();
     }
 }
-export async function saveAccountPolicyStore(store) {
-    const path = getAccountPolicyPath();
-    const payload = normalizeStore(store);
-    const task = async () => {
-        await fs.mkdir(getCodexMultiAuthDir(), { recursive: true, mode: 0o700 });
-        const tempPath = tempPathFor(path);
-        let moved = false;
-        try {
-            await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
-                encoding: "utf8",
-                mode: 0o600,
-            });
-            for (let attempt = 0; attempt < 5; attempt += 1) {
-                try {
-                    await fs.rename(tempPath, path);
-                    moved = true;
-                    return;
-                }
-                catch (error) {
-                    if (!isRetryableFsError(error) || attempt >= 4)
-                        throw error;
-                    await sleep(10 * 2 ** attempt);
-                }
+/**
+ * Per-key merge of the caller's normalized store over the freshest on-disk
+ * store. Policies are keyed by the account's hashed identity (`sha256:`) and
+ * carry `updatedAt`; the newer entry wins per key so a save built on a stale
+ * snapshot cannot resurrect an older policy over a concurrent process's
+ * newer one. Keys the caller does not carry are preserved (upsert-only store
+ * — nothing deletes entries), matching the config save's
+ * patch-over-fresh-read semantics.
+ *
+ * When `baseline` (the caller's pre-edit snapshot) is supplied, entries
+ * identical to it are untouched carried copies and skipped entirely, so a
+ * stale snapshot row can never be re-stamped over a raced write. Entries
+ * that differ are deliberate writes and must not lose purely on timestamp:
+ * the upsert-time floor stamps against the caller's snapshot, but a
+ * concurrent writer can land a still-newer entry before this merge runs, so
+ * the merge re-stamps against the freshest on-disk entry instead of
+ * silently dropping the edit. Without a baseline every supplied entry is a
+ * plain `updatedAt >=` upsert.
+ */
+function mergeAccountPolicies(current, incoming, baseline) {
+    const merged = {
+        version: 1,
+        accounts: { ...current.accounts },
+    };
+    const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    for (const [key, policy] of Object.entries(incoming.accounts)) {
+        const existing = merged.accounts[key];
+        if (!baseline) {
+            if (!existing || policy.updatedAt >= existing.updatedAt) {
+                merged.accounts[key] = policy;
             }
+            continue;
         }
-        finally {
-            if (!moved) {
-                try {
-                    await fs.unlink(tempPath);
-                }
-                catch {
-                    // Best-effort temp cleanup.
-                }
-            }
+        if (same(policy, baseline.accounts[key]))
+            continue;
+        policy.updatedAt = stampUpdatedAt(policy.updatedAt, existing?.updatedAt);
+        merged.accounts[key] = policy;
+    }
+    return merged;
+}
+export async function saveAccountPolicyStore(store, baseline) {
+    const path = getAccountPolicyPath();
+    const incoming = normalizeStore(store);
+    // Normalize at invocation like `incoming`: later caller-side mutation of
+    // `baseline` must not shift which entries the merge counts as deliberate.
+    const prior = baseline ? normalizeStore(baseline) : undefined;
+    // Per-path promise queue serializes writers inside THIS process; the
+    // lock directory closes the same window against OTHER processes. Inside the lock
+    // every attempt re-stats (CAS), re-reads the freshest on-disk store, and
+    // merges this call's entries over it — so a save that raced a concurrent
+    // write reloads-and-retries rather than blindly overwriting it.
+    await withJsonStoreWriteQueue(path, async () => {
+        await withJsonStoreFileLock(path, async () => {
+            await withJsonStoreCasRetry(async () => {
+                const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+                const current = await loadAccountPolicyStore();
+                const merged = mergeAccountPolicies(current, incoming, prior);
+                await fs.mkdir(getCodexMultiAuthDir(), {
+                    recursive: true,
+                    mode: 0o700,
+                });
+                await writeJsonStoreFileAtomicWithRetry(path, merged, {
+                    expectedMtimeMs,
+                    mode: 0o600,
+                });
+            });
+        });
+    });
+}
+/**
+ * Run a policy-store read→mutate→write inside the write queue (in-process
+ * serialization) AND the cross-process lock directory, with mtime CAS retry:
+ * every attempt re-reads the freshest on-disk store and re-applies `mutate`
+ * before writing — so two commands editing DIFFERENT fields of the same
+ * policy (e.g. `weight` vs `tags`) both land, which the whole-record
+ * `updatedAt` merge in {@link saveAccountPolicyStore} cannot guarantee: a
+ * stale snapshot's record would either clobber a newer record wholesale or be
+ * discarded entirely. `mutate` must be re-appliable across retries (apply
+ * precomputed work onto the store it is handed, don't capture mutated state).
+ * Prefer this over load→upsert→save whenever the caller is mutating rather
+ * than importing a foreign store.
+ */
+export async function updateAccountPolicyStore(mutate) {
+    const path = getAccountPolicyPath();
+    return withJsonStoreWriteQueue(path, () => withJsonStoreFileLock(path, () => withJsonStoreCasRetry(async () => {
+        const expectedMtimeMs = await getJsonStoreFileMtimeMs(path);
+        const store = await loadAccountPolicyStore();
+        const { result, dirty } = mutate(store);
+        if (dirty) {
+            await fs.mkdir(getCodexMultiAuthDir(), {
+                recursive: true,
+                mode: 0o700,
+            });
+            await writeJsonStoreFileAtomicWithRetry(path, normalizeStore(store), { expectedMtimeMs, mode: 0o600 });
         }
-    };
-    const queued = writeQueue.catch(() => undefined).then(task);
-    writeQueue = queued.then(() => undefined, () => undefined);
-    await queued;
+        return result;
+    })));
 }
 /** Tiers are integers 0-9; anything else (including legacy absence) is tier 1. */
 function normalizePriority(value) {
@@ -168,7 +225,7 @@ export function upsertAccountPolicy(store, accountKey, mutate, now = Date.now())
     next.weight = normalizeWeight(next.weight);
     next.priority = normalizePriority(next.priority);
     next.autoPrime = next.autoPrime === true;
-    next.updatedAt = now;
+    next.updatedAt = stampUpdatedAt(now, store.accounts[accountKey]?.updatedAt);
     store.accounts[accountKey] = next;
     return next;
 }
@@ -176,5 +233,5 @@ export function normalizeAccountPolicyTag(value) {
     return normalizeTag(value);
 }
 export function resetAccountPolicyWriteQueueForTests() {
-    writeQueue = Promise.resolve();
+    resetJsonStoreWriteQueuesForTests(getAccountPolicyPath());
 }

package/dist/lib/accounts/rate-limits.d.ts

@@ -27,4 +27,3 @@ export declare function clearAllRateLimits(entity: RateLimitedEntity): void;
 export declare function isRateLimitedForQuotaKey(entity: RateLimitedEntity, key: QuotaKey): boolean;
 export declare function isRateLimitedForFamily(entity: RateLimitedEntity, family: ModelFamily, model?: string | null): boolean;
 export declare function formatWaitTime(ms: number): string;
-//# sourceMappingURL=rate-limits.d.ts.map

package/dist/lib/accounts.d.ts

@@ -385,4 +385,3 @@ export declare function formatCooldown(account: {
     coolingDownUntil?: number;
     cooldownReason?: string;
 }, now?: number): string | null;
-//# sourceMappingURL=accounts.d.ts.map

package/dist/lib/accounts.js

@@ -922,16 +922,15 @@ export class AccountManager {
         if (shouldConsumeToken && !tokenTracker.tryConsume(trackerKey, quotaKey)) {
             return { ok: false, reason: "token-exhausted" };
         }
-        try {
-            getCircuitBreaker(getAccountCircuitKey(account)).canExecute();
-            return { ok: true };
-        }
-        catch {
+        // Non-throwing probe keeps circuit-open storms off the exception path.
+        const admission = getCircuitBreaker(getAccountCircuitKey(account)).tryCanExecute();
+        if (!admission.ok) {
             if (shouldConsumeToken) {
                 tokenTracker.refundToken(trackerKey, quotaKey);
             }
             return { ok: false, reason: "circuit-open" };
         }
+        return { ok: true };
     }
     /**
      * Refund a token consumed within the refund window (30 seconds).

package/dist/lib/api-route-store.d.ts

@@ -21,4 +21,3 @@ export declare function loadApiRoutes(path?: string): Promise<ApiRouteCredential
 export declare function saveApiRoutes(routes: ApiRouteCredential[], path?: string, expected?: ApiRouteCredential[]): Promise<void>;
 export declare function updateApiModelDiscovery(route: ApiRouteCredential, models: string[], path?: string): Promise<ApiRouteCredential>;
 export {};
-//# sourceMappingURL=api-route-store.d.ts.map

package/dist/lib/audit.d.ts

@@ -33,4 +33,3 @@ export declare function getAuditConfig(): AuditConfig;
 export declare function auditLog(action: AuditAction, actor: string, resource: string, outcome: AuditOutcome, metadata?: Record<string, unknown>): void;
 export declare function getAuditLogPath(): string;
 export declare function listAuditLogFiles(): string[];
-//# sourceMappingURL=audit.d.ts.map

package/dist/lib/audit.js

@@ -1,4 +1,4 @@
-import { writeFileSync, mkdirSync, existsSync, statSync, renameSync, readdirSync, unlinkSync } from "node:fs";
+import { writeFileSync, mkdirSync, existsSync, statSync, chmodSync, renameSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { getCorrelationId, maskEmail } from "./logger.js";
 import { getCodexLogDir } from "./runtime-paths.js";
@@ -49,11 +49,32 @@ function ensureLogDir() {
 function getLogFilePath() {
     return join(auditConfig.logDir, "audit.log");
 }
+// POSIX-only permission re-assertion. The append-mode `mode` option applies
+// only when the file is created, so an audit log that already exists with
+// permissive bits (a shared/custom logDir, or one written before this
+// hardening) would stay readable by other local users, and rotation would
+// carry those bits onto the backups. On Windows chmod cannot establish the
+// equivalent ACL — the logDir's ACLs govern access there — so this is skipped
+// on win32 rather than half-applied.
+function restrictLogPermissions(path, currentMode) {
+    if (process.platform === "win32")
+        return;
+    try {
+        const mode = currentMode ?? statSync(path).mode;
+        if ((mode & 0o777) !== 0o600) {
+            chmodSync(path, 0o600);
+        }
+    }
+    catch {
+        // Best-effort hardening: audit logging must never break the application.
+    }
+}
 function rotateLogsIfNeeded() {
     const logPath = getLogFilePath();
     if (!existsSync(logPath))
         return;
     const stats = statSync(logPath);
+    restrictLogPermissions(logPath, stats.mode);
     if (stats.size < auditConfig.maxFileSizeBytes)
         return;
     for (let i = auditConfig.maxFiles - 1; i >= 1; i--) {
@@ -64,26 +85,34 @@ function rotateLogsIfNeeded() {
         }
         if (existsSync(newer)) {
             renameSync(newer, older);
+            restrictLogPermissions(older);
         }
     }
 }
-function sanitizeActor(actor) {
-    if (actor.includes("@")) {
-        return maskEmail(actor);
-    }
-    return actor;
+// Same email shape logger.ts scrubs, applied as a SUBSTRING masker. Feeding
+// the whole value to maskEmail would treat any "@" as an email separator and
+// mangle non-email identifiers that legitimately carry one — "@scope/package",
+// "@user" handles, URLs with embedded credentials — leaving the audit entry
+// unable to identify the resource. Only real email-shaped spans are masked.
+const EMAIL_SUBSTRING_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+function maskAuditField(value) {
+    return value.replace(EMAIL_SUBSTRING_PATTERN, maskEmail);
 }
+// Substring markers matched against the lowercased metadata key. Covers
+// token/secret/password plus credential-carrying spellings: "authorization"
+// (raw headers), "api_key"/"api-key"/"apiKey" (api[-_]?key), and "credential".
+const SENSITIVE_KEY_PATTERN = /token|secret|password|authorization|api[-_]?key|credential/;
 function sanitizeMetadata(metadata) {
     if (!metadata)
         return undefined;
     const sanitized = {};
     for (const [key, value] of Object.entries(metadata)) {
         const lowerKey = key.toLowerCase();
-        if (lowerKey.includes("token") || lowerKey.includes("secret") || lowerKey.includes("password")) {
+        if (SENSITIVE_KEY_PATTERN.test(lowerKey)) {
             sanitized[key] = "***REDACTED***";
         }
-        else if (typeof value === "string" && value.includes("@")) {
-            sanitized[key] = maskEmail(value);
+        else if (typeof value === "string") {
+            sanitized[key] = maskAuditField(value);
         }
         else if (typeof value === "object" && value !== null) {
             sanitized[key] = sanitizeMetadata(value);
@@ -104,14 +133,16 @@ export function auditLog(action, actor, resource, outcome, metadata) {
             timestamp: new Date().toISOString(),
             correlationId: getCorrelationId(),
             action,
-            actor: sanitizeActor(actor),
-            resource,
+            actor: maskAuditField(actor),
+            resource: maskAuditField(resource),
             outcome,
             metadata: sanitizeMetadata(metadata),
         };
         const logPath = getLogFilePath();
         const line = JSON.stringify(entry) + "\n";
-        writeFileSync(logPath, line, { flag: "a" });
+        // mode applies only at creation; rotateLogsIfNeeded already re-asserted
+        // 0o600 on an existing file (and on every backup it renamed).
+        writeFileSync(logPath, line, { flag: "a", mode: 0o600 });
     }
     catch {
         // Audit logging should never break the application

package/dist/lib/auth/account-access.d.ts

@@ -112,4 +112,3 @@ export interface StoredAccountIdentity {
  * "manual" is an explicit `login --org` binding this must not override.
  */
 export declare function reboundUnauthorizedAccountIdentity(account: StoredAccountIdentity, accessToken: string, options?: FetchAuthorizedAccountsOptions): Promise<ConstrainedSelection | null>;
-//# sourceMappingURL=account-access.d.ts.map

package/dist/lib/auth/account-access.js

@@ -1,4 +1,5 @@
 import { CODEX_BASE_URL } from "../constants.js";
+import { combineSignals } from "../utils.js";
 const ACCOUNTS_CHECK_PATH = "/wham/accounts/check";
 const ACCOUNTS_CHECK_TIMEOUT_MS = 10_000;
 function readString(value) {
@@ -50,8 +51,11 @@ export async function fetchAuthorizedAccounts(accessToken, options = {}) {
         return null;
     const doFetch = options.fetch ?? globalThis.fetch;
     const timeout = AbortSignal.timeout(ACCOUNTS_CHECK_TIMEOUT_MS);
+    // combineSignals wraps AbortSignal.any (available since Node 18.17, the
+    // engines floor) with null-tolerance; the native composite also detaches
+    // from a long-lived caller signal once this request completes.
     const signal = options.signal
-        ? AbortSignal.any([options.signal, timeout])
+        ? combineSignals(options.signal, timeout)
         : timeout;
     try {
         const response = await doFetch(`${CODEX_BASE_URL}${ACCOUNTS_CHECK_PATH}`, {

package/dist/lib/auth/auth.d.ts

@@ -40,8 +40,10 @@ export declare const AUTH_REDIRECT: Readonly<{
  */
 export declare function sanitizeOAuthResponseBodyForLog(rawBody: string): string;
 /**
- * Redacts sensitive OAuth query parameters for safe logging.
- * Returns the original string when parsing fails.
+ * Redacts sensitive OAuth parameters for safe logging: query keys match
+ * case-insensitively, fragment and nested-URL params are covered, userinfo is
+ * masked, and unparseable input collapses to `<unparseable-url>` so the raw
+ * string can never reach a log verbatim.
  */
 export declare function redactOAuthUrlForLog(rawUrl: string): string;
 /**
@@ -92,4 +94,3 @@ export interface AuthorizationFlowOptions {
  */
 export declare function createAuthorizationFlow(options?: AuthorizationFlowOptions): Promise<AuthorizationFlow>;
 export {};
-//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth/auth.js

@@ -33,6 +33,26 @@ const OAUTH_SENSITIVE_QUERY_PARAMS = [
     "code",
     "code_challenge",
     "code_verifier",
+    "access_token",
+    "id_token",
+    "refresh_token",
+    "token",
+    "device_auth_id",
+    "user_code",
+    "authorization_code",
+    "client_secret",
+    "password",
+    // Credential-carrying names the logger's SENSITIVE_KEYS already masks:
+    // keep the query-key set aligned so they cannot reach a log either.
+    "api_key",
+    "apikey",
+    "authorization",
+    "credential",
+    "credentials",
+    "secret",
+    "assertion",
+    "client_assertion",
+    "id_token_hint",
 ];
 function getOAuthResponseLogMetadata(rawResponse) {
     if (Array.isArray(rawResponse)) {
@@ -55,13 +75,118 @@ const OAUTH_SENSITIVE_BODY_KEYS = [
     "id_token",
     "idToken",
     "codeVerifier",
+    "code_verifier",
+    "code_challenge",
+    "codeChallenge",
     "token",
     "code",
-    "code_verifier",
+    "state",
+    "device_auth_id",
+    "deviceAuthId",
+    "user_code",
+    "userCode",
+    "authorization_code",
+    "authorizationCode",
+    "client_secret",
+    "clientSecret",
+    "password",
+    // Credential-carrying names the logger's SENSITIVE_KEYS already masks:
+    // keep the body-key set aligned so they cannot reach a log either.
+    "api_key",
+    "apiKey",
+    "apikey",
+    "authorization",
+    "credential",
+    "credentials",
+    "secret",
+    "assertion",
+    "client_assertion",
+    "clientAssertion",
+    "id_token_hint",
+    "idTokenHint",
+];
+function normalizeOAuthSensitiveKey(key) {
+    return key.toLowerCase().replace(/[\s_-]/g, "");
+}
+const OAUTH_SENSITIVE_KEY_SET = new Set([...OAUTH_SENSITIVE_BODY_KEYS, ...OAUTH_SENSITIVE_QUERY_PARAMS].map(normalizeOAuthSensitiveKey));
+// A normalized key is also sensitive when it *ends* with a compound secret
+// name — `x-api-key`, `x-client-secret`, `my-refresh-token`,
+// `x-ms-token-aad-id-token` are still credentials. Bare `code`/`state`/`token`
+// are excluded so `error_code`, `csrf_token`, `session_state`, `valid_token`
+// and `api_keys` keep their documented over-redaction protection.
+const OAUTH_SENSITIVE_KEY_SUFFIXES = [
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "clientsecret",
+    "clientassertion",
+    "apikey",
+    "authorizationcode",
+    "codechallenge",
+    "codeverifier",
+    "deviceauthid",
+    "usercode",
+    "idtokenhint",
+    "authorization",
+    "credential",
+    "credentials",
+    "assertion",
+    "password",
+    "passwords",
+    "secret",
 ];
+function isOAuthSensitiveKey(key) {
+    const normalized = normalizeOAuthSensitiveKey(key);
+    return (OAUTH_SENSITIVE_KEY_SET.has(normalized) ||
+        OAUTH_SENSITIVE_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)));
+}
+// Separator inside a compound key spelling: whitespace, `_`, `-`, `+`, and the
+// percent-encoded space all collapse under normalizeOAuthSensitiveKey, so
+// "client-secret", "ACCESS TOKEN" and "access%20token" must match too.
+const OAUTH_KEY_SEPARATOR = "(?:[\\s_+-]|%20)*";
+// Free-text key shapes. `code`/`state`/`token` need a non-word boundary so
+// longer names like `error_code`/`device_code`/`csrf_token` are untouched.
+const OAUTH_TEXT_SECRET_KEY_PATTERN = [
+    `(?:refresh|access|id)${OAUTH_KEY_SEPARATOR}token`,
+    `code${OAUTH_KEY_SEPARATOR}(?:challenge|verifier)`,
+    `device${OAUTH_KEY_SEPARATOR}auth${OAUTH_KEY_SEPARATOR}id`,
+    `user${OAUTH_KEY_SEPARATOR}code`,
+    `authorization${OAUTH_KEY_SEPARATOR}code`,
+    `client${OAUTH_KEY_SEPARATOR}secret`,
+    `api${OAUTH_KEY_SEPARATOR}key`,
+    `client${OAUTH_KEY_SEPARATOR}assertion`,
+    `id${OAUTH_KEY_SEPARATOR}token${OAUTH_KEY_SEPARATOR}hint`,
+    "authorization",
+    "credentials?",
+    "assertion",
+    "password",
+    "secret",
+    "state",
+    "token",
+    "code",
+].join("|");
 function scrubTokenLikeSubstrings(value) {
-    let scrubbed = value.replace(/(\b(?:refresh|access|id)[_-]?token\s*[:=]\s*)([^\s,;"'}]{8,})/gi, (_match, prefix) => `${prefix}***REDACTED***`);
-    scrubbed = scrubbed.replace(/\b(?:RT|AT)_ch_[A-Za-z0-9_-]{20,}\b/g, "***REDACTED***");
+    // Bearer runs first: in a "key: Bearer <jwt>" shape the key pass below
+    // would otherwise consume the literal word "Bearer" as its value and
+    // strand the token behind it.
+    let scrubbed = value.replace(/\bBearer(?:[\s+]|%20)+[A-Za-z0-9._~+/=-]{8,4096}/gi, "Bearer ***REDACTED***");
+    // `key <sep> value` in free text. Quoted keys and encoded separator gaps
+    // (%20/%22/%27) are tolerated; percent-encoded `:`/`=` (%3A/%3D, plus the
+    // double-encoded %253A/%253D) count as separators, and a key directly
+    // behind a %XX escape still counts as boundary (the escape itself is the
+    // delimiter). `_`/`-` are deliberately absent from the gap classes so
+    // `error_code`/`csrf-token` style names still survive. Value length is
+    // capped so a megabyte-scale run cannot exhaust the regex backtrack
+    // stack; the entropy pass below absorbs any leftover tail.
+    scrubbed = scrubbed.replace(new RegExp(`((?:(?<![A-Za-z0-9_])|(?<=%[0-9a-zA-Z]{2}))(?:${OAUTH_TEXT_SECRET_KEY_PATTERN})(?:[\\s'"+]|%2[027])*(?:[:=]|%3[ad]|%253[ad])(?:[\\s'"+]|%2[027])*)([^\\s,;"'{}&=*()<>?]{4,4096})`, "gi"), (_match, prefix) => `${prefix}***REDACTED***`);
+    // Bare high-entropy slugs (32-512 chars of token charset) with no key
+    // context. No word boundaries: consecutive chunks of a giant run each
+    // match, so a huge homogeneous value is consumed piecewise instead of
+    // overflowing the backtrack stack on one giant quantified match.
+    scrubbed = scrubbed.replace(/[A-Za-z0-9_-]{32,512}/g, "***REDACTED***");
+    // ChatGPT opaque token shapes — catches shorter RT_/AT_ values the entropy
+    // rule misses. No leading boundary: they may be glued inside identifiers.
+    scrubbed = scrubbed.replace(/(?:RT|AT)_ch_[A-Za-z0-9_-]{20,512}/g, "***REDACTED***");
     return scrubbed;
 }
 function redactSensitiveFields(value) {
@@ -69,14 +194,17 @@ function redactSensitiveFields(value) {
         return value.map((item) => redactSensitiveFields(item));
     }
     if (value !== null && typeof value === "object") {
-        const out = {};
-        const sensitiveSet = new Set(OAUTH_SENSITIVE_BODY_KEYS);
+        // Null-prototype map so a `__proto__` key stays ordinary data instead of
+        // munging the output object's prototype.
+        const out = Object.create(null);
         for (const [k, v] of Object.entries(value)) {
-            if (sensitiveSet.has(k)) {
+            if (isOAuthSensitiveKey(k)) {
                 out[k] = "***REDACTED***";
             }
             else {
-                out[k] = redactSensitiveFields(v);
+                // The key name itself can smuggle a token (an error response that
+                // echoes request fields verbatim) — scrub token shapes from it.
+                out[scrubTokenLikeSubstrings(k)] = redactSensitiveFields(v);
             }
         }
         return out;
@@ -120,34 +248,98 @@ export function sanitizeOAuthResponseBodyForLog(rawBody) {
             // Fall through to regex scrub for malformed JSON.
         }
     }
+    // Single-pass alternation over the normalized key shapes so case- and
+    // separator-varied spellings ("client-secret", "ACCESS TOKEN",
+    // "access%20token") still match when the body is not parseable JSON.
     let scrubbed = rawBody;
-    for (const key of OAUTH_SENSITIVE_BODY_KEYS) {
-        // "key":"value" style (JSON-like text)
-        const jsonPattern = new RegExp(`("${key}"\\s*:\\s*)"[^"]*"`, "g");
-        scrubbed = scrubbed.replace(jsonPattern, `$1"***REDACTED***"`);
-        // key=value style (urlencoded / query-string)
-        const urlPattern = new RegExp(`(^|[?&\\s])(${key}=)[^&\\s]+`, "g");
-        scrubbed = scrubbed.replace(urlPattern, `$1$2***REDACTED***`);
+    // "key":"value" / 'key':'value' style (JSON-like text); a stray separator
+    // may sit before the closing quote ("access_token ":).
+    scrubbed = scrubbed.replace(new RegExp(`(["'](?:${OAUTH_TEXT_SECRET_KEY_PATTERN})${OAUTH_KEY_SEPARATOR}["']\\s*:\\s*)["'][^"']*["']`, "gi"), `$1"***REDACTED***"`);
+    // key<sep>value style (urlencoded / query-string). The boundary class
+    // excludes `_` and alphanumerics so `device_code`/`error_code`/
+    // `csrf_token`/`opcode` are not redacted; a leading %XX escape does count
+    // as a boundary since it decodes to a delimiter.
+    scrubbed = scrubbed.replace(new RegExp(`(^|[^A-Za-z0-9_]|%[0-9a-zA-Z]{2})((?:${OAUTH_TEXT_SECRET_KEY_PATTERN})${OAUTH_KEY_SEPARATOR}(?:[:=]|%3[ad]|%253[ad]))[^&\\s]+`, "gi"), "$1$2***REDACTED***");
+    return scrubTokenLikeSubstrings(scrubbed);
+}
+function redactUrlSearchParamsForLog(params, depth) {
+    for (const key of new Set(params.keys())) {
+        if (isOAuthSensitiveKey(key)) {
+            params.set(key, "<redacted>");
+            continue;
+        }
+        // Non-sensitive keys still get a free-text scrub at every depth:
+        // `msg=refresh_token%3D...` or `error_description=Bearer ...` would
+        // otherwise carry embedded secrets straight into the log. URL values
+        // recurse structurally while depth remains, then fall back to the
+        // flat scrub so deeper nesting still loses its secrets.
+        const values = params.getAll(key);
+        const redactedValues = values.map((value) => /^https?:\/\//i.test(value) && depth > 0
+            ? redactOAuthUrlForLogDepth(value, depth - 1)
+            : scrubTokenLikeSubstrings(value));
+        if (redactedValues.some((v, i) => v !== values[i])) {
+            params.delete(key);
+            for (const v of redactedValues)
+                params.append(key, v);
+        }
     }
-    return scrubbed;
 }
-/**
- * Redacts sensitive OAuth query parameters for safe logging.
- * Returns the original string when parsing fails.
- */
-export function redactOAuthUrlForLog(rawUrl) {
+function redactOAuthUrlForLogDepth(rawUrl, depth) {
+    let parsed;
     try {
-        const parsed = new URL(rawUrl);
-        for (const key of OAUTH_SENSITIVE_QUERY_PARAMS) {
-            if (parsed.searchParams.has(key)) {
-                parsed.searchParams.set(key, "<redacted>");
-            }
-        }
-        return parsed.toString();
+        parsed = new URL(rawUrl);
     }
     catch {
-        return rawUrl;
+        return "<unparseable-url>";
     }
+    redactUrlSearchParamsForLog(parsed.searchParams, depth);
+    // Fragment params (#access_token=...) live in `hash`, not `searchParams`.
+    // A route-style fragment (#/path?code=...) keeps its prefix, which is
+    // itself free text that can carry secrets like `#code=...?` — scrub it
+    // rather than copying it back verbatim. The body is decoded first so a
+    // fully percent-encoded fragment cannot hide `?`/`=` from the splitter.
+    let hashBody = parsed.hash.startsWith("#") ? parsed.hash.slice(1) : "";
+    if (hashBody.includes("%")) {
+        try {
+            hashBody = decodeURIComponent(hashBody);
+        }
+        catch {
+            // Malformed escape — keep the raw fragment body.
+        }
+    }
+    if (hashBody.includes("=")) {
+        const qIndex = hashBody.indexOf("?");
+        const fragPath = qIndex >= 0 ? hashBody.slice(0, qIndex + 1) : "";
+        const fragParams = qIndex >= 0 ? hashBody.slice(qIndex + 1) : hashBody;
+        const scrubbedPath = scrubTokenLikeSubstrings(fragPath);
+        const params = new URLSearchParams(fragParams);
+        redactUrlSearchParamsForLog(params, depth);
+        const rebuilt = params.toString();
+        if (rebuilt !== fragParams || scrubbedPath !== fragPath) {
+            parsed.hash = `${scrubbedPath}${rebuilt}`;
+        }
+    }
+    else if (hashBody.length > 0) {
+        parsed.hash = scrubTokenLikeSubstrings(hashBody);
+    }
+    if (parsed.username)
+        parsed.username = "***";
+    if (parsed.password)
+        parsed.password = "***";
+    const scrubbedHost = scrubTokenLikeSubstrings(parsed.hostname);
+    if (scrubbedHost !== parsed.hostname)
+        parsed.hostname = scrubbedHost;
+    parsed.pathname = scrubTokenLikeSubstrings(parsed.pathname);
+    return parsed.toString();
+}
+/**
+ * Redacts sensitive OAuth parameters for safe logging: query keys match
+ * case-insensitively, fragment and nested-URL params are covered, userinfo is
+ * masked, and unparseable input collapses to `<unparseable-url>` so the raw
+ * string can never reach a log verbatim.
+ */
+export function redactOAuthUrlForLog(rawUrl) {
+    return redactOAuthUrlForLogDepth(rawUrl, 1);
 }
 /**
  * Generate a random state value for OAuth flow