dd-trace 6.13.0 → 6.15.0

package/packages/datadog-plugin-undici/src/index.js

@@ -16,6 +16,8 @@ const {
   HTTP_RESPONSE_HEADERS,
 } = tags
 
+const UPGRADE_CHANNEL = 'apm:undici:request:upgrade'
+
 // WeakMap to store span context for native undici request objects
 const requestContexts = new WeakMap()
 
@@ -33,6 +35,7 @@ class UndiciPlugin extends HttpClientPlugin {
     this.addSub('undici:request:headers', this.#onNativeRequestHeaders.bind(this))
     this.addSub('undici:request:trailers', this.#onNativeRequestTrailers.bind(this))
     this.addSub('undici:request:error', this.#onNativeRequestError.bind(this))
+    this.addSub(UPGRADE_CHANNEL, this.#onNativeRequestUpgrade.bind(this))
   }
 
   // ===========================================
@@ -112,30 +115,15 @@ class UndiciPlugin extends HttpClientPlugin {
     // Store span context for request for later retrieval
     requestContexts.set(request, {
       span,
-      store,
-      uri,
       method,
     })
-
-    // Enter the span context
-    storage('legacy').enterWith({ ...store, span })
   }
 
   #onNativeRequestBodySent ({ request }) {
     const ctx = requestContexts.get(request)
     if (!ctx || ctx.method !== 'CONNECT') return
 
-    const { span, store } = ctx
-
-    this.config.hooks.request(span, null, null)
-
-    span.finish()
-
-    requestContexts.delete(request)
-
-    if (store) {
-      storage('legacy').enterWith(store)
-    }
+    this.#finishNativeRequest(request)
   }
 
   #onNativeRequestHeaders ({ request, response }) {
@@ -160,50 +148,48 @@ class UndiciPlugin extends HttpClientPlugin {
   }
 
   #onNativeRequestTrailers ({ request }) {
-    const ctx = requestContexts.get(request)
-    if (!ctx) return
-
-    const { span, store } = ctx
-
-    // Call the request hook if configured
-    this.config.hooks.request(span, null, null)
-
-    // Finish the span
-    span.finish()
+    this.#finishNativeRequest(request)
+  }
 
-    // Clean up
-    requestContexts.delete(request)
+  #onNativeRequestError ({ request, error }) {
+    this.#finishNativeRequest(request, error)
+  }
 
-    // Restore parent store
-    if (store) {
-      storage('legacy').enterWith(store)
-    }
+  /**
+   * @param {{ error?: Error, headers: unknown, request: object, statusCode: number }} context
+   */
+  #onNativeRequestUpgrade ({ error, headers, request, statusCode }) {
+    this.#onNativeRequestHeaders({ request, response: { headers, statusCode } })
+    this.#finishNativeRequest(request, error)
   }
 
-  #onNativeRequestError ({ request, error }) {
+  /**
+   * @param {object} request
+   * @param {Error} [error]
+   */
+  #finishNativeRequest (request, error) {
     const ctx = requestContexts.get(request)
     if (!ctx) return
 
-    const { span, store } = ctx
+    const { span } = ctx
 
     // Don't record AbortError as an error - it's user-initiated cancellation
     if (error && error.name !== 'AbortError') {
       span.setTag('error', error)
     }
 
-    // Call the request hook if configured
-    this.config.hooks.request(span, null, null)
+    const requestHook = this.config.hooks.request
+    if (requestHook !== noop) {
+      this.tracer.scope().activate(span, () => {
+        requestHook(span, null, null)
+      })
+    }
 
     // Finish the span
     span.finish()
 
     // Clean up
     requestContexts.delete(request)
-
-    // Restore parent store
-    if (store) {
-      storage('legacy').enterWith(store)
-    }
   }
 
   // ===========================================

package/packages/datadog-plugin-vitest/src/index.js

@@ -361,13 +361,13 @@ class VitestPlugin extends CiPlugin {
         [TEST_SOURCE_START]: testStartLine || 1,
         [TEST_STATUS]: 'skip',
         [TEST_FINAL_STATUS]: 'skip',
-        ...(isAttemptToFix ? { [TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX]: 'true' } : {}),
-        ...(isDisabled ? { [TEST_MANAGEMENT_IS_DISABLED]: 'true' } : {}),
-        ...(isQuarantined ? { [TEST_MANAGEMENT_IS_QUARANTINED]: 'true' } : {}),
-        ...(isNew ? { [TEST_IS_NEW]: 'true' } : {}),
-        ...(isRumActive ? { [TEST_IS_RUM_ACTIVE]: 'true' } : {}),
-        ...(isTestFrameworkWorker ? { [TEST_IS_TEST_FRAMEWORK_WORKER]: 'true' } : {}),
       }
+      if (isAttemptToFix) extraTags[TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX] = 'true'
+      if (isDisabled) extraTags[TEST_MANAGEMENT_IS_DISABLED] = 'true'
+      if (isQuarantined) extraTags[TEST_MANAGEMENT_IS_QUARANTINED] = 'true'
+      if (isNew) extraTags[TEST_IS_NEW] = 'true'
+      if (isRumActive) extraTags[TEST_IS_RUM_ACTIVE] = 'true'
+      if (isTestFrameworkWorker) extraTags[TEST_IS_TEST_FRAMEWORK_WORKER] = 'true'
       setBrowserTags(extraTags, {
         browserDriver,
         browserName,
@@ -523,7 +523,6 @@ class VitestPlugin extends CiPlugin {
           this.telemetry.ciVisEvent(TELEMETRY_CODE_COVERAGE_FINISHED, 'suite', { library: coverageLibrary })
           this.telemetry.distribution(TELEMETRY_CODE_COVERAGE_NUM_FILES, {}, relativeFiles.length)
         }
-        this.tracer._exporter.deferTestSuiteSpan?.(testSuiteSpan)
         testSuiteSpan.finish()
         finishAllTraceSpans(testSuiteSpan)
       }
@@ -567,7 +566,6 @@ class VitestPlugin extends CiPlugin {
     this.addSub('ci:vitest:session:finish', ({
       status,
       error,
-      isTestSessionFinalizationError,
       testCodeCoverageLinesTotal,
       isEarlyFlakeDetectionEnabled,
       isEarlyFlakeDetectionFaulty,
@@ -590,9 +588,6 @@ class VitestPlugin extends CiPlugin {
       this.testSessionSpan.setTag(TEST_STATUS, status)
       this.testModuleSpan.setTag(TEST_STATUS, status)
       if (error) {
-        if (isTestSessionFinalizationError) {
-          this.tracer._exporter.setDeferredTestSuiteError?.(error)
-        }
         this.testModuleSpan.setTag('error', error)
         this.testSessionSpan.setTag('error', error)
       }
@@ -622,7 +617,6 @@ class VitestPlugin extends CiPlugin {
       if (vitestPool) {
         this.testSessionSpan.setTag(VITEST_POOL, vitestPool)
       }
-      this.tracer._exporter.exportDeferredTestSuiteSpans?.()
       this.testModuleSpan.finish()
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'module')
       this.testSessionSpan.finish()

package/packages/dd-trace/src/aiguard/evaluation.js

@@ -1,7 +1,8 @@
 'use strict'
 
 const { HTTP_CLIENT_IP, HTTP_USERAGENT, NETWORK_CLIENT_IP } = require('../../../../ext/tags')
-const clone = require('../../../../vendor/dist/rfdc')({ proto: false, circles: false })
+const createRfdc = require('../../../../vendor/dist/rfdc')
+const clone = createRfdc({ proto: false, circles: false })
 const { USER_ID, USER_SESSION_ID } = require('../appsec/addresses')
 const { getActiveRequest } = require('../appsec/store')
 const { keepTrace } = require('../priority_sampler')

package/packages/dd-trace/src/aiguard/messages/anthropic.js

@@ -208,7 +208,14 @@ function walkContentBlocks (blocks) {
 function partsToContent (parts, hasImages) {
   if (!parts.length) return
   if (hasImages) return parts
-  return parts.map(p => p.text).join('\n')
+  let content = ''
+  let isFirstPart = true
+  for (const part of parts) {
+    if (!isFirstPart) content += '\n'
+    content += part.text
+    isFirstPart = false
+  }
+  return content
 }
 
 /**

package/packages/dd-trace/src/aiguard/messages/openai.js

@@ -322,7 +322,14 @@ function openAIResponseContentToMessageContent (content) {
 
   if (!parts.length) return
   if (hasImages) return parts
-  return parts.map(part => part.text).join('\n')
+  let textContent = ''
+  let isFirstPart = true
+  for (const part of parts) {
+    if (!isFirstPart) textContent += '\n'
+    textContent += part.text
+    isFirstPart = false
+  }
+  return textContent
 }
 
 /**

package/packages/dd-trace/src/aiguard/messages/vercel-ai.js

@@ -62,19 +62,26 @@ function convertVercelPromptToMessages (prompt) {
         if (hasImages) {
           messages.push({ role: 'user', content: contentParts })
         } else {
-          messages.push({ role: 'user', content: contentParts.map(p => p.text).join('\n') })
+          let content = ''
+          let isFirstPart = true
+          for (const part of contentParts) {
+            if (!isFirstPart) content += '\n'
+            content += part.text
+            isFirstPart = false
+          }
+          messages.push({ role: 'user', content })
         }
         break
       }
 
       case 'assistant': {
-        const textParts = []
+        let text
         const toolCalls = []
         if (!Array.isArray(msg.content)) break
 
         for (const part of msg.content) {
           if (part.type === 'text') {
-            textParts.push(part.text)
+            text = text === undefined ? part.text : `${text}\n${part.text}`
           } else if (part.type === 'tool-call') {
             toolCalls.push({
               id: part.toolCallId,
@@ -88,8 +95,8 @@ function convertVercelPromptToMessages (prompt) {
 
         if (toolCalls.length > 0) {
           messages.push({ role: 'assistant', tool_calls: toolCalls })
-        } else if (textParts.length > 0) {
-          messages.push({ role: 'assistant', content: textParts.join('\n') })
+        } else if (text !== undefined) {
+          messages.push({ role: 'assistant', content: text })
         }
         break
       }
@@ -161,7 +168,14 @@ function buildTextOutputMessages (inputMessages, text) {
 function buildOutputMessages (inputMessages, content) {
   const toolCalls = content.filter(c => c.type === 'tool-call')
   if (toolCalls.length) return buildToolCallOutputMessages(inputMessages, toolCalls)
-  const text = content.filter(c => c.type === 'text').map(c => c.text).join('\n')
+  let text = ''
+  let isFirstTextPart = true
+  for (const part of content) {
+    if (part.type !== 'text') continue
+    if (!isFirstTextPart) text += '\n'
+    text += part.text
+    isFirstTextPart = false
+  }
   if (text) return buildTextOutputMessages(inputMessages, text)
   return []
 }

package/packages/dd-trace/src/appsec/api_security/index.js

@@ -5,6 +5,8 @@ const { isSchemaAttribute } = require('../reporter')
 const appsecTelemetry = require('../telemetry')
 const sampler = require('./sampler')
 
+/** @typedef {import('../../opentracing/span')} DatadogSpan */
+
 /**
  * Map a sampling decision into the corresponding API Security telemetry metric.
  *
@@ -13,14 +15,14 @@ const sampler = require('./sampler')
  *   - MISSING_ROUTE: missing_route
  *   - SKIP: no metric emitted
  *
- * @param {import('http').IncomingMessage} req
+ * @param {DatadogSpan} rootSpan Span the sampling decision was attached to
  * @param {'sample' | 'missing_route' | 'skip'} samplingDecision Sampler decision
  * @param {{ attributes?: Record<string, unknown> } | undefined} wafResult WAF run result
  */
-function reportRequest (req, samplingDecision, wafResult) {
+function reportRootSpanRequest (rootSpan, samplingDecision, wafResult) {
   switch (samplingDecision) {
     case sampler.SamplingDecision.SAMPLE: {
-      const framework = getFramework(req)
+      const framework = getFramework(rootSpan)
       if (hasSchemaAttributes(wafResult?.attributes)) {
         appsecTelemetry.incrementApiSecRequestSchemaMetric(framework)
       } else {
@@ -29,13 +31,26 @@ function reportRequest (req, samplingDecision, wafResult) {
       break
     }
     case sampler.SamplingDecision.MISSING_ROUTE:
-      appsecTelemetry.incrementApiSecMissingRouteMetric(getFramework(req))
+      appsecTelemetry.incrementApiSecMissingRouteMetric(getFramework(rootSpan))
       break
   }
 }
 
-function getFramework (req) {
-  return web.root(req)?.context()?.getTag?.('component')
+/**
+ * Node HTTP adapter over {@link reportRootSpanRequest}.
+ *
+ * @param {import('http').IncomingMessage} req
+ * @param {'sample' | 'missing_route' | 'skip'} samplingDecision Sampler decision
+ * @param {{ attributes?: Record<string, unknown> } | undefined} wafResult WAF run result
+ */
+function reportRequest (req, samplingDecision, wafResult) {
+  if (samplingDecision === sampler.SamplingDecision.SKIP) return
+
+  reportRootSpanRequest(web.root(req), samplingDecision, wafResult)
+}
+
+function getFramework (rootSpan) {
+  return rootSpan?.context?.()?.getTag?.('component')
 }
 
 function hasSchemaAttributes (attributes) {
@@ -50,6 +65,8 @@ module.exports = {
   configure: sampler.configure,
   disable: sampler.disable,
   sampleRequest: sampler.sampleRequest,
+  sampleRootSpanRequest: sampler.sampleRootSpanRequest,
   reportRequest,
+  reportRootSpanRequest,
   SamplingDecision: sampler.SamplingDecision,
 }

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -8,6 +8,8 @@ const { keepTrace } = require('../../priority_sampler')
 const { ASM } = require('../../standalone/product')
 const { isBlocked } = require('../blocking')
 
+/** @typedef {import('../../opentracing/span')} DatadogSpan */
+
 const MAX_SIZE = 4096
 
 const SamplingDecision = Object.freeze({
@@ -44,77 +46,113 @@ function disable () {
 }
 
 /**
- * @param {import('http').IncomingMessage} req
- * @param {import('http').ServerResponse} res
+ * @param {DatadogSpan} rootSpan Span the sampling decision is attached to
+ * @param {object} request
+ * @param {string} request.method
+ * @param {number|string} request.statusCode
+ * @param {string|undefined} request.route Tri-state: a route string, an empty string (still a
+ *   valid route — dd-trace-js represents the express root path '/' as an empty path segment), or
+ *   `undefined` meaning no route information at all.
+ * @param {boolean} [request.blocked] Whether the response was blocked by ASM
  * @param {boolean} record When true and the decision is SAMPLE, records the endpoint in the TTL cache
  * @returns {'sample' | 'missing_route' | 'skip'}
  */
-function sampleRequest (req, res, record = false) {
+function sampleRootSpanRequest (rootSpan, request, record = false) {
   if (!enabled) return SamplingDecision.SKIP
 
-  const rootSpan = web.root(req)
   if (!rootSpan) return SamplingDecision.SKIP
 
-  if (!asmStandaloneEnabled) {
-    let priority = getSpanPriority(rootSpan)
-    if (!priority) {
-      rootSpan._prioritySampler?.sample(rootSpan)
-      priority = getSpanPriority(rootSpan)
-    }
+  const { method, statusCode, route, blocked = false } = request ?? {}
 
-    if (priority === AUTO_REJECT || priority === USER_REJECT) {
-      return SamplingDecision.SKIP
-    }
+  if (!method || !statusCode) {
+    log.warn('[ASM] Unsupported groupkey for API security')
+    return SamplingDecision.SKIP
   }
 
-  const resolved = resolveSamplingKey(req, res)
-  if (!resolved) return SamplingDecision.SKIP
+  if (isRejected(rootSpan)) return SamplingDecision.SKIP
 
-  if (record && resolved.route === null) {
-    if (resolved.status === 404 || isBlocked(res)) return SamplingDecision.SKIP
+  if (isRoutelessRecord(route, record)) {
+    if (isNotFound(statusCode) || blocked) return SamplingDecision.SKIP
     return SamplingDecision.MISSING_ROUTE
   }
 
-  if (sampledRequests.has(resolved.key)) return SamplingDecision.SKIP
+  const key = buildSamplingKey(method, route, statusCode)
+  if (sampledRequests.has(key)) return SamplingDecision.SKIP
 
   if (asmStandaloneEnabled) {
     keepTrace(rootSpan, ASM)
   }
 
   if (record) {
-    sampledRequests.set(resolved.key, undefined)
+    sampledRequests.set(key, undefined)
   }
 
   return SamplingDecision.SAMPLE
 }
 
 /**
+ * Node HTTP adapter over {@link sampleRootSpanRequest}.
+ *
  * @param {import('http').IncomingMessage} req
  * @param {import('http').ServerResponse} res
- * @returns {boolean} Whether this request's endpoint is currently recorded in the TTL cache.
+ * @param {boolean} record When true and the decision is SAMPLE, records the endpoint in the TTL cache
+ * @returns {'sample' | 'missing_route' | 'skip'}
  */
-function wasSampled (req, res) {
-  const resolved = resolveSamplingKey(req, res)
-  return resolved !== null && sampledRequests.has(resolved.key)
-}
+function sampleRequest (req, res, record = false) {
+  if (!enabled) return SamplingDecision.SKIP
 
-function resolveSamplingKey (req, res) {
-  const method = req.method
-  const status = res.statusCode
+  const rootSpan = web.root(req)
+  if (!rootSpan) return SamplingDecision.SKIP
 
-  if (!method || !status) {
-    log.warn('[ASM] Unsupported groupkey for API security')
-    return null
-  }
+  if (isRejected(rootSpan)) return SamplingDecision.SKIP
+
+  const statusCode = res.statusCode
+  const route = getRouteOrEndpoint(web.getContext(req), statusCode)
+
+  return sampleRootSpanRequest(rootSpan, {
+    method: req.method,
+    statusCode,
+    route,
+    blocked: isRoutelessRecord(route, record) && !isNotFound(statusCode) ? isBlocked(res) : false,
+  }, record)
+}
 
-  const context = web.getContext(req)
-  const route = getRouteOrEndpoint(context, status)
+/**
+ * Whether this is a request with no route information
+ *
+ * @param {string|undefined} route
+ * @param {boolean} record
+ * @returns {boolean}
+ */
+function isRoutelessRecord (route, record) {
+  return record && route === undefined
+}
 
-  // route === null signals "no route information at all". An empty string is still a valid
-  // route (dd-trace-js represents the express root path '/' as an empty path segment).
-  return { method, status, route, key: method + (route ?? '') + status }
+/**
+ * @param {number|string} statusCode
+ * @returns {boolean}
+ */
+function isNotFound (statusCode) {
+  return Number(statusCode) === 404
+}
+
+/**
+ * @param {string} method
+ * @param {string|undefined} route A route string, an empty string (still a valid route), or
+ *   `undefined`
+ * @param {number|string} statusCode
+ * @returns {string}
+ */
+function buildSamplingKey (method, route, statusCode) {
+  return method + (route ?? '') + statusCode
 }
 
+/**
+ * @param {{ paths?: string[], span?: object }} [context] Web context of the request
+ * @param {number|string} statusCode
+ * @returns {string|undefined} A route string, an empty string (still a valid route), or
+ *   `undefined` when no route information is available.
+ */
 function getRouteOrEndpoint (context, statusCode) {
   // The router plugin populates `context.paths` whenever the framework matched something.
   // For express's root '/' route the matched path is normalized to '' (see datadog-plugin-router),
@@ -125,23 +163,44 @@ function getRouteOrEndpoint (context, statusCode) {
     return paths.join('')
   }
 
-  if (statusCode === 404) return null
+  if (isNotFound(statusCode)) return
 
   const endpoint = context?.span?.context()?.getTag?.('http.endpoint')
   if (endpoint) return endpoint
+}
 
-  return null
+/**
+ * Whether the span's trace is dropped, forcing the sampling decision if none was made yet.
+ *
+ * Always false under ASM standalone: there the trace is kept via `keepTrace(rootSpan, ASM)`
+ * regardless of the APM sampling decision.
+ *
+ * @param {DatadogSpan} rootSpan
+ * @returns {boolean}
+ */
+function isRejected (rootSpan) {
+  if (asmStandaloneEnabled) return false
+
+  let priority = getSpanPriority(rootSpan)
+  if (priority == null) {
+    rootSpan._prioritySampler?.sample(rootSpan)
+    priority = getSpanPriority(rootSpan)
+  }
+
+  return priority === AUTO_REJECT || priority === USER_REJECT
 }
 
 function getSpanPriority (span) {
   const spanContext = span.context?.()
-  return spanContext._sampling?.priority
+  const priority = spanContext?._sampling?.priority
+
+  return priority == null ? priority : Number(priority)
 }
 
 module.exports = {
   configure,
   disable,
   sampleRequest,
-  wasSampled,
+  sampleRootSpanRequest,
   SamplingDecision,
 }

package/packages/dd-trace/src/appsec/graphql.js

@@ -32,11 +32,15 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolver ({ abortController, resolverInfo }) {
+/**
+ * @param {{ createResolverInfo?: (data: object) => object | null }} data
+ */
+function onGraphqlStartResolver (data) {
   const req = getActiveRequest()
 
   if (!req) return
 
+  const resolverInfo = data.createResolverInfo?.(data)
   if (!resolverInfo || typeof resolverInfo !== 'object') return
 
   const result = waf.run({ ephemeral: { [addresses.HTTP_INCOMING_GRAPHQL_RESOLVER]: resolverInfo } }, req)
@@ -46,7 +50,7 @@ function onGraphqlStartResolver ({ abortController, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      abortController?.abort()
+      data.abortController?.abort()
     }
   }
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -178,12 +178,12 @@ class TaintTrackingPlugin extends SourceIastPlugin {
   addGraphQLSubscriptions () {
     this.addSub(
       { channelName: 'apm:graphql:resolve:start', tag: HTTP_REQUEST_BODY },
-      (data) => {
+      ({ rootCtx, args }) => {
         const iastContext = getIastContext(storage('legacy').getStore())
-        const source = data.rootCtx?.source
+        const source = rootCtx?.source
         const ranges = source && getRanges(iastContext, source)
         if (ranges?.length) {
-          this._taintTrackingHandler(ranges[0].iinfo.type, data.args, null, iastContext)
+          this._taintTrackingHandler(ranges[0].iinfo.type, args, null, iastContext)
         }
       }
     )

package/packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js

@@ -242,7 +242,8 @@ function lodashTaintTrackingHandler (message) {
     const context = getContextDefault()
     const transactionId = getTransactionId(context)
     if (transactionId) {
-      message.result = getLodashTaintedUtilFn(message.operation)(transactionId, message.result, ...message.arguments)
+      const taintResult = getLodashTaintedUtilFn(message.operation)
+      message.result = taintResult(transactionId, message.result, ...message.arguments)
     }
   } catch (e) {
     log.error('[ASM] Error invoking CSI lodash %s', message.operation, e)

package/packages/dd-trace/src/appsec/iast/telemetry/span-tags.js

@@ -46,8 +46,14 @@ function filterTags (tags) {
 }
 
 function processTagValue (tags) {
-  return tags.map(tag => tag.includes(':') ? getSegment(tag, ':', 1) : tag)
-    .join('_').replaceAll('.', '_')
+  let processedTags = ''
+  let isFirstTag = true
+  for (const tag of tags) {
+    if (!isFirstTag) processedTags += '_'
+    processedTags += tag.includes(':') ? getSegment(tag, ':', 1) : tag
+    isFirstTag = false
+  }
+  return processedTags.replaceAll('.', '_')
 }
 
 module.exports = {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js

@@ -2,7 +2,9 @@
 
 const log = require('../../../../../log')
 
-const COMMAND_PATTERN = String.raw`^(?:\s*(?:sudo|doas)\s+)?\b\S+\b\s(.*)`
+// `\S+\s` accepts command tokens that end in punctuation. The optional prefix uses horizontal
+// whitespace so multiline matching cannot start inside a line-terminator run.
+const COMMAND_PATTERN = String.raw`^(?:[ \t]*(?:sudo|doas)[ \t]+)?\S+\s([\s\S]*)`
 const pattern = new RegExp(COMMAND_PATTERN, 'gmi')
 
 module.exports = function extractSensitiveRanges (evidence) {