hilos-agent 0.10.1 → 0.11.2

package/src/queue.mjs

@@ -71,21 +71,37 @@ export function looksLikeCancel(text) {
  *   (optional) dedupes against the active + queued jobs.
  * - cancelActive(reason) aborts ONLY the in-flight job's AbortSignal; queued jobs
  *   are untouched.
+ * - shutdown(reason) closes intake, discards queued jobs, aborts active work,
+ *   and resolves only after that work has completed its teardown.
  * - idle() resolves when nothing is active or queued (used to drain on --once).
  */
 /**
  * @param {{
  *   runJob: (job: any, ctx: { signal: AbortSignal }) => Promise<void> | void,
+ *   afterJob?: (job: any) => Promise<boolean | void> | boolean | void,
+ *   afterJobRetryDelay?: () => Promise<void>,
  *   concurrency?: number,
  * }} [opts]
  */
 export function createQueue(opts = {}) {
-  const { runJob, concurrency = 1 } = opts;
+  const {
+    runJob,
+    afterJob,
+    afterJobRetryDelay = () => new Promise((resolve) => setTimeout(resolve, 1000)),
+    concurrency = 1,
+  } = opts;
   void concurrency; // single-slot in v1; documented in the ticket.
   const queued = [];
   let active = null; // { job, controller }
   let draining = false;
+  let closed = false;
+  let betweenJobs = false;
   let idleResolvers = [];
+  let resolveClosed;
+  const closedPromise = new Promise((resolve) => {
+    resolveClosed = resolve;
+  });
+  const CLOSED = Symbol("queue-closed");
 
   function has(key) {
     if (key == null) return false;
@@ -99,7 +115,7 @@ export function createQueue(opts = {}) {
   async function drain() {
     if (draining) return;
     draining = true;
-    while (queued.length) {
+    while (!closed && queued.length) {
       const job = queued.shift();
       const controller = new AbortController();
       active = { job, controller };
@@ -108,6 +124,30 @@ export function createQueue(opts = {}) {
       } catch {
         // runJob is expected to handle its own errors; never break the loop.
       }
+      if (afterJob) {
+        // A completed handler may have left durable ownership state behind.
+        // Keep this job active and fence the next FIFO entry until the hook
+        // proves that state safe. Intake can continue appending behind the
+        // fence, so a poll response is never acknowledged and then dropped.
+        betweenJobs = true;
+        let safe = false;
+        while (!safe && !closed) {
+          const check = Promise.resolve()
+            .then(() => afterJob(job))
+            .then((result) => result !== false)
+            .catch(() => false);
+          const outcome = await Promise.race([
+            check,
+            closedPromise.then(() => CLOSED),
+          ]);
+          if (outcome === CLOSED) break;
+          safe = outcome;
+          if (!safe && !closed) {
+            await Promise.race([afterJobRetryDelay(), closedPromise]);
+          }
+        }
+        betweenJobs = false;
+      }
       active = null;
     }
     draining = false;
@@ -117,6 +157,15 @@ export function createQueue(opts = {}) {
   }
 
   function enqueue(job) {
+    if (closed) {
+      return {
+        accepted: false,
+        deduped: false,
+        shutdown: true,
+        position: 0,
+        startedImmediately: false,
+      };
+    }
     if (job && job.key != null && has(job.key)) {
       return { accepted: false, deduped: true, position: 0, startedImmediately: false };
     }
@@ -140,10 +189,28 @@ export function createQueue(opts = {}) {
   function activeCount() {
     return active ? 1 : 0;
   }
+  function blocked() {
+    return betweenJobs;
+  }
   function idle() {
     if (!active && queued.length === 0) return Promise.resolve();
     return new Promise((r) => idleResolvers.push(r));
   }
 
-  return { enqueue, cancelActive, has, size, active: activeCount, idle };
+  function shutdown(reason) {
+    // Set the fence before abort dispatch: an abort listener (or any other
+    // synchronous callback) can try to enqueue, and must observe a closed
+    // queue. Clearing pending jobs in the same turn ensures drain() can never
+    // advance to one after the active handler's teardown completes.
+    closed = true;
+    resolveClosed();
+    queued.splice(0, queued.length);
+    if (active) {
+      active.cancelled = true;
+      active.controller.abort(reason || "queue shutdown");
+    }
+    return idle();
+  }
+
+  return { enqueue, cancelActive, shutdown, has, size, active: activeCount, blocked, idle };
 }

package/src/redact.mjs

@@ -3,8 +3,14 @@
 // redact CLI output before it is returned, logged, or attached to a report.
 
 const PEM_BLOCK = /-----BEGIN [A-Z0-9 ]*?(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----[\s\S]*?-----END [A-Z0-9 ]*?(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----/g;
+// A bounded caller may intentionally provide only the front of a long log.
+// Once a private-key header appears, fail closed even if its END marker fell
+// beyond that caller's scan window.
+const UNTERMINATED_PEM = /-----BEGIN [A-Z0-9 ]*?(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----[\s\S]*$/g;
 const JWT = /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}(?:\.[A-Za-z0-9_-]{6,})?\b/g;
+const UNTERMINATED_JWT = /\beyJ[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]*)?$/g;
 const URL_CREDENTIALS = /(\b[a-z][a-z0-9+.-]*:\/\/)([^\/\s:@"']+):([^\/\s@"']+)@/gi;
+const UNTERMINATED_URL_CREDENTIALS = /(\b[a-z][a-z0-9+.-]*:\/\/)([^\/\s:@"']+):([^\/\s@"']{8,})$/gi;
 const PROVIDER_TOKENS = new RegExp(
   [
     "sk-ant-[A-Za-z0-9_-]{8,}",
@@ -25,23 +31,370 @@ const PROVIDER_TOKENS = new RegExp(
   ].join("|"),
   "g",
 );
-const BEARER = /(\b[Bb]earer["']?[\s:=]+["']?)[A-Za-z0-9._~+/=-]{12,}/g;
-const ASSIGNMENT =
-  /((?:api[_-]?key|access[_-]?key|secret[_-]?access[_-]?key|client[_-]?secret|private[_-]?key|service[_-]?role[_-]?key|auth[_-]?token|refresh[_-]?token|session[_-]?token|apikey|token|secret|password|passwd|credential)["']?\s*[:=]+\s*["']?)(?!\[redacted:)([A-Za-z0-9_~.+/-]{8,})/gi;
+const BEARER = /(\b[Bb]earer["']?[\s:=]+["']?)[A-Za-z0-9._~+/=-]+/g;
+const SENSITIVE_HEADER = /(\b(?:proxy-authorization|authorization|set-cookie|cookie)\s*[:=])([^\r\n]*)/gi;
+// Structured keys canonicalize punctuation before classification. Accept a
+// bounded run of the same non-alphanumeric separators in serialized/form keys
+// (`api[key]`, `api@key`) without allowing the scan to cross an assignment,
+// quote, or physical line boundary.
+const ASSIGNMENT_KEY_SEPARATOR =
+  "[\\t !#$%&()*+,./?@\\[\\]\\\\^_`{|}~-]{0,8}";
+const GENERIC_SENSITIVE_ASSIGNMENT_KEY = [
+  `api${ASSIGNMENT_KEY_SEPARATOR}(?:keys?|tokens?)`,
+  `access${ASSIGNMENT_KEY_SEPARATOR}(?:keys?(?:${ASSIGNMENT_KEY_SEPARATOR}id)?|tokens?)`,
+  `secret(?:(?:${ASSIGNMENT_KEY_SEPARATOR}access)?${ASSIGNMENT_KEY_SEPARATOR}keys?)?`,
+  `client${ASSIGNMENT_KEY_SEPARATOR}secret`,
+  `private${ASSIGNMENT_KEY_SEPARATOR}key`,
+  `service${ASSIGNMENT_KEY_SEPARATOR}role${ASSIGNMENT_KEY_SEPARATOR}key`,
+  `(?:auth|refresh|session|oauth|id)${ASSIGNMENT_KEY_SEPARATOR}tokens?`,
+  "tokens?",
+  `authorization(?:${ASSIGNMENT_KEY_SEPARATOR}header)?`,
+  `proxy${ASSIGNMENT_KEY_SEPARATOR}authorization`,
+  `cookie(?:${ASSIGNMENT_KEY_SEPARATOR}header)?`,
+  `set${ASSIGNMENT_KEY_SEPARATOR}cookie`,
+  "password",
+  "passwd",
+  "credentials?",
+].join("|");
+// Once a credential root is identified, consume a bounded serializer suffix
+// as one character-class run. Digits, punctuation, and the letters in `value`
+// cover arbitrary `[n].value` depth without nested regex repetition. Excluding
+// other letters prevents prose such as `token is [redacted:jwt]` from being
+// reinterpreted as one enormous assignment key.
+const SENSITIVE_ASSIGNMENT_SUFFIX =
+  "[ \\t._/@\\[\\](){}0-9vVaAlLuUeE-]{0,160}";
+const SENSITIVE_ASSIGNMENT_KEY =
+  `(?:${GENERIC_SENSITIVE_ASSIGNMENT_KEY})${SENSITIVE_ASSIGNMENT_SUFFIX}`;
+const EXCESSIVE_ESCAPE_RUN = /\\{33}/;
+const SENSITIVE_CANONICAL_KEY_SUFFIX = /(?:api_?(?:keys?|tokens?)|access_?(?:keys?(?:_?id)?|tokens?)|secret(?:_?access_?keys?|_?keys?)?|client_?secret|private_?key|service_?role_?key|(?:auth|refresh|session|oauth|id)_?tokens?|tokens?|authorization(?:_?header)?|proxy_?authorization|cookie(?:_?header)?|set_?cookie|password|passwd|credentials?)(?:(?:_value)|(?:_\d{1,6}))*$/;
+// Start of a quoted credential assignment. The value is scanned below instead
+// of captured by a regular expression: an escaped quote inside a password is
+// content, not the closing delimiter, and nested serialized JSON represents
+// each delimiter with the same run of backslashes.
+const QUOTED_ASSIGNMENT_START = new RegExp(
+  `((?:(?:\\\\{1,32})?["']?${SENSITIVE_ASSIGNMENT_KEY}(?:\\\\{1,32})?["']?)[ \\t]*[:=]+[ \\t]*)(\\$?)(\\\\{0,32})(["'])`,
+  "gi",
+);
+const YAML_MULTILINE_ASSIGNMENT_LINE = new RegExp(
+  `^(([ \\t]*(?:-[ \\t]+)?)(?:(?:![^ \\t\\r\\n]+|&[^ \\t\\r\\n]+)[ \\t]+)*(?:(?:\\\\{1,32})?["']?${SENSITIVE_ASSIGNMENT_KEY}(?:\\\\{1,32})?["']?)[ \\t]*:[ \\t]*)([^\\r\\n]*)(\\r?\\n|$)`,
+  "gim",
+);
+const YAML_EXPLICIT_MULTILINE_ASSIGNMENT_LINE = new RegExp(
+  `^(([ \\t]*(?:-[ \\t]+)?)\\?[ \\t]+(?:(?:![^ \\t\\r\\n]+|&[^ \\t\\r\\n]+)[ \\t]+)*(?:(?:\\\\{1,32})?["']?${SENSITIVE_ASSIGNMENT_KEY}(?:\\\\{1,32})?["']?)[ \\t]*(?:#[^\\r\\n]*)?\\r?\\n(?:[ \\t]*(?:#[^\\r\\n]*)?\\r?\\n)*[ \\t]*:[ \\t]*)([^\\r\\n]*)(\\r?\\n|$)`,
+  "gim",
+);
+const YAML_SPLIT_EXPLICIT_MULTILINE_ASSIGNMENT_LINE = new RegExp(
+  `^(([ \\t]*(?:-[ \\t]+)?)\\?[ \\t]*(?:(?:![^ \\t\\r\\n]+|&[^ \\t\\r\\n]+)[ \\t]*)*(?:#[^\\r\\n]*)?\\r?\\n(?:[ \\t]*(?:#[^\\r\\n]*)?\\r?\\n)*(?:[ \\t]+(?:(?:![^ \\t\\r\\n]+|&[^ \\t\\r\\n]+)[ \\t]*)+(?:#[^\\r\\n]*)?\\r?\\n(?:[ \\t]*(?:#[^\\r\\n]*)?\\r?\\n)*)*[ \\t]+(?:(?:![^ \\t\\r\\n]+|&[^ \\t\\r\\n]+)[ \\t]+)*(?:(?:\\\\{1,32})?["']?${SENSITIVE_ASSIGNMENT_KEY}(?:\\\\{1,32})?["']?)[ \\t]*(?:#[^\\r\\n]*)?\\r?\\n(?:[ \\t]*(?:#[^\\r\\n]*)?\\r?\\n)*[ \\t]*:[ \\t]*)([^\\r\\n]*)(\\r?\\n|$)`,
+  "gim",
+);
+const SHELL_MULTILINE_ASSIGNMENT = new RegExp(
+  `(${SENSITIVE_ASSIGNMENT_KEY}[ \\t]*[:=]+[ \\t]*)(?:\\$?\\(|[<>]\\(|\\$\\{|\\$\\[|\\x60)[\\s\\S]*`,
+  "gi",
+);
+const JSON_UNQUOTED_ASSIGNMENT = new RegExp(
+  `(((?:\\\\{1,32})?["']${SENSITIVE_ASSIGNMENT_KEY}(?:\\\\{1,32})?["'])[ \\t]*[:=]+[ \\t]*)(?!(?:\\\\{1,32})?["'])([^,;}\\]\\r\\n]+)`,
+  "gi",
+);
+const UNQUOTED_ASSIGNMENT = new RegExp(
+  `(${SENSITIVE_ASSIGNMENT_KEY}[ \\t]*[:=]+[ \\t]*)(?!(?:\\$?)(?:\\\\{1,32})?["'])((?:\\\\(?:\\r?\\n|;)|[^;\\r\\n])+)`,
+  "gi",
+);
+
+function redactAssignment(match, prefix, value, suffix = "", allowSyntaxLiterals = true) {
+  const normalized = value.trim();
+  if (
+    !normalized ||
+    /^\[redacted:[^\]]+\]$/i.test(normalized) ||
+    (allowSyntaxLiterals && /^(?:null|true|false|undefined|bearer)$/i.test(normalized)) ||
+    (allowSyntaxLiterals && /^(?:null|true|false|undefined)[ \t]+\\{33,}$/i.test(normalized)) ||
+    /^bearer\s+\[redacted:[^\]]+\]["']?$/i.test(normalized)
+  ) {
+    return match;
+  }
+  return `${prefix}[redacted:value]${suffix}`;
+}
+
+function closingQuote(text, start, quote, delimiterSlashes) {
+  for (let i = start; i < text.length; i += 1) {
+    if (text[i] !== quote) continue;
+    let slashCount = 0;
+    for (let j = i - 1; j >= start && text[j] === "\\"; j -= 1) slashCount += 1;
+    if (delimiterSlashes === 0 ? slashCount % 2 === 0 : slashCount === delimiterSlashes) {
+      return { quoteIndex: i, tokenStart: i - slashCount };
+    }
+  }
+  return null;
+}
+
+/** Redact escape-aware quoted assignments without ever exposing a suffix. */
+function redactQuotedAssignments(text) {
+  QUOTED_ASSIGNMENT_START.lastIndex = 0;
+  let cursor = 0;
+  let out = "";
+  let match;
+  while ((match = QUOTED_ASSIGNMENT_START.exec(text)) !== null) {
+    const prefix = match[1];
+    const sigil = match[2];
+    const slashes = match[3];
+    const quote = match[4];
+    const valueStart = QUOTED_ASSIGNMENT_START.lastIndex;
+    const closing = closingQuote(text, valueStart, quote, slashes.length);
+    // A malformed/unterminated credential value fails closed through the rest
+    // of the bounded input. Stopping at a newline would expose every following
+    // continuation line while still claiming redaction was applied.
+    const valueEnd = closing ? closing.tokenStart : text.length;
+    const quotedEnd = closing ? closing.quoteIndex + 1 : text.length;
+    let segmentEnd = quotedEnd;
+    if (closing) {
+      // Shell assignments may concatenate quoted and unquoted word fragments:
+      // PASSWORD="secret"tail is one credential, not a secret plus safe text.
+      // Consume the attached fragment through the assignment terminator.
+      const quotedKey = /(?:\\+)?["'][^"'\r\n]+(?:\\+)?["']\s*[:=]+\s*$/.test(prefix);
+      const terminator = quotedKey ? /[\s,;}\]]/ : /[\s;]/;
+      while (segmentEnd < text.length) {
+        if (!quotedKey && text[segmentEnd] === "\\" && segmentEnd + 1 < text.length) {
+          segmentEnd += text[segmentEnd + 1] === "\r" && text[segmentEnd + 2] === "\n" ? 3 : 2;
+          continue;
+        }
+        if (terminator.test(text[segmentEnd])) break;
+        segmentEnd += 1;
+      }
+    }
+    const value = text.slice(valueStart, valueEnd) + text.slice(quotedEnd, segmentEnd);
+    const opener = `${sigil}${slashes}${quote}`;
+    const suffix = closing ? `${slashes}${quote}` : "";
+    const whole = text.slice(match.index, segmentEnd);
+
+    out += text.slice(cursor, match.index);
+    out += redactAssignment(whole, `${prefix}${opener}`, value, suffix, false);
+    cursor = segmentEnd;
+    QUOTED_ASSIGNMENT_START.lastIndex = segmentEnd;
+  }
+  return out + text.slice(cursor);
+}
+
+function redactYamlMatches(text, assignmentLine, redactSameLineValue = false) {
+  assignmentLine.lastIndex = 0;
+  let cursor = 0;
+  let out = "";
+  let match;
+  while ((match = assignmentLine.exec(text)) !== null) {
+    const prefix = match[1];
+    const keyIndent = match[2].length;
+    const firstValue = match[3];
+    const firstLineBreak = match[4];
+    const uncommentedFirstValue = firstValue
+      .replace(/(?:^|[ \t]+)#.*$/, "")
+      .trim();
+    const blockScalar =
+      /^(?:(?:![^ \t]+|&[^ \t]+)[ \t]+)*[|>][+\-0-9]*(?:[ \t]+#.*)?$/.test(
+        firstValue.trim(),
+      );
+    const allowsIndentlessSequence =
+      /^(?:(?:![^ \t]+|&[^ \t]+)[ \t]*)*$/.test(uncommentedFirstValue);
+    const hasSensitiveSameLineValue =
+      redactSameLineValue &&
+      Boolean(uncommentedFirstValue) &&
+      !/^(?:null|true|false|undefined)$/i.test(uncommentedFirstValue);
+    if (!firstLineBreak && !hasSensitiveSameLineValue) continue;
+
+    let scan = assignmentLine.lastIndex;
+    let lastConsumed = scan;
+    let sawIndentedContent = false;
+    while (scan < text.length) {
+      const newline = text.indexOf("\n", scan);
+      const next = newline === -1 ? text.length : newline + 1;
+      const rawLine = text.slice(scan, newline === -1 ? text.length : newline);
+      const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+      if (line.trim().length === 0 || (!blockScalar && /^[ \t]*#/.test(line))) {
+        scan = next;
+        continue;
+      }
+      const indentation = /^[ \t]*/.exec(line)?.[0].length ?? 0;
+      const indentlessSequence =
+        allowsIndentlessSequence &&
+        indentation === keyIndent &&
+        /^-(?:[ \t]|$)/.test(line.slice(indentation));
+      if (indentation <= keyIndent && !indentlessSequence) break;
+      sawIndentedContent = true;
+      lastConsumed = next;
+      scan = next;
+    }
+    if (!sawIndentedContent && !hasSensitiveSameLineValue) continue;
+
+    out += text.slice(cursor, match.index);
+    out += `${prefix}${/[ \\t]$/.test(prefix) ? "" : " "}[redacted:value]`;
+    if (lastConsumed < text.length) out += firstLineBreak;
+    cursor = lastConsumed;
+    assignmentLine.lastIndex = lastConsumed;
+  }
+  return out + text.slice(cursor);
+}
+
+/** Redact YAML scalar bodies while preserving keys at the same or lower indent. */
+function redactYamlMultilineAssignments(text) {
+  return redactYamlMatches(
+    redactYamlMatches(
+      redactYamlMatches(text, YAML_SPLIT_EXPLICIT_MULTILINE_ASSIGNMENT_LINE, true),
+      YAML_EXPLICIT_MULTILINE_ASSIGNMENT_LINE,
+      true,
+    ),
+    YAML_MULTILINE_ASSIGNMENT_LINE,
+  );
+}
+
+function decodeJsonKeyEscapes(value) {
+  const simple = {
+    b: "\b",
+    f: "\f",
+    n: "\n",
+    r: "\r",
+    t: "\t",
+    "\"": "\"",
+    "\\": "\\",
+    "/": "/",
+  };
+  const text = String(value || "");
+  if (!text.includes("\\")) return text;
+  const output = [];
+  let cursor = 0;
+  let index = 0;
+  while (index < text.length) {
+    if (text[index] !== "\\") {
+      index += 1;
+      continue;
+    }
+    let escapeAt = index;
+    while (escapeAt < text.length && text[escapeAt] === "\\") escapeAt += 1;
+    const escape = text[escapeAt];
+    let replacement;
+    let consumed = escapeAt + 1;
+    if (
+      escape?.toLowerCase() === "u" &&
+      /^[0-9a-f]{4}$/i.test(text.slice(escapeAt + 1, escapeAt + 5))
+    ) {
+      replacement = String.fromCharCode(
+        Number.parseInt(text.slice(escapeAt + 1, escapeAt + 5), 16),
+      );
+      consumed = escapeAt + 5;
+    } else if (Object.hasOwn(simple, escape)) {
+      replacement = simple[escape];
+    }
+    if (replacement === undefined) {
+      index = escapeAt + (escape ? 1 : 0);
+      continue;
+    }
+    output.push(text.slice(cursor, index), replacement);
+    cursor = consumed;
+    index = consumed;
+  }
+  if (output.length === 0) return text;
+  output.push(text.slice(cursor));
+  return output.join("");
+}
+
+function isSensitiveAssignmentCandidate(value) {
+  const canonical = decodeJsonKeyEscapes(value)
+    .slice(-200)
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .replace(/([A-Za-z])(\d)/g, "$1_$2")
+    .replace(/(\d)([A-Za-z])/g, "$1_$2")
+    .replace(/([A-Za-z0-9])(value)/gi, "$1_$2")
+    .replace(/[^A-Za-z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "")
+    .toLowerCase();
+  return SENSITIVE_CANONICAL_KEY_SUFFIX.test(canonical);
+}
+
+function isBenignAssignmentValue(value) {
+  const normalized = value.trimStart().replace(/^\$?[\\"']+/, "");
+  return /^(?:null|true|false|undefined)(?=$|[\s,;}\]])/i.test(normalized) ||
+    /^\[redacted:[^\]]+\][\\"']*(?=$|[\s,;}\]])/i.test(normalized) ||
+    /^bearer\s+\[redacted:[^\]]+\][\\"']*(?=$|[\s,;}\]])/i.test(normalized);
+}
+
+/** Find a credential-shaped key before any plausible assignment delimiter.
+ * Manual bounded suffix classification keeps arbitrary punctuation aligned
+ * with structured object keys without a separator-depth regex bypass. */
+function hasSensitiveAssignment(text, allowEmptyValue = false) {
+  let lineStart = 0;
+  while (lineStart <= text.length) {
+    let lineEnd = lineStart;
+    while (lineEnd < text.length && !/[\r\n\u2028\u2029\v\f]/.test(text[lineEnd])) {
+      lineEnd += 1;
+    }
+    for (let delimiter = lineStart; delimiter < lineEnd; delimiter += 1) {
+      if (text[delimiter] !== ":" && text[delimiter] !== "=") continue;
+      let end = delimiter;
+      while (end > lineStart && /[ \t]/.test(text[end - 1])) end -= 1;
+      const keyLength = end - lineStart;
+      const candidate = text.slice(Math.max(lineStart, end - 200), end);
+      if (keyLength <= 160 && !isSensitiveAssignmentCandidate(candidate)) continue;
+      let valueStart = delimiter + 1;
+      while (valueStart < lineEnd && /[ \t]/.test(text[valueStart])) valueStart += 1;
+      const value = text.slice(valueStart, Math.min(lineEnd, valueStart + 256));
+      if (isBenignAssignmentValue(value)) continue;
+      if (value || allowEmptyValue) return true;
+    }
+    if (lineEnd >= text.length) break;
+    lineStart = text[lineEnd] === "\r" && text[lineEnd + 1] === "\n"
+      ? lineEnd + 2
+      : lineEnd + 1;
+  }
+  return false;
+}
+
+function hasDeeplyEscapedSensitiveAssignment(text) {
+  if (!EXCESSIVE_ESCAPE_RUN.test(text)) return false;
+  const collapsed = decodeJsonKeyEscapes(text).replace(/[\\"']/g, "");
+  return hasSensitiveAssignment(collapsed, true);
+}
 
 /** Replace credential-shaped content with typed markers. Idempotent. */
 export function redactSecrets(text) {
   if (!text) return text;
-  return text
+  if (hasDeeplyEscapedSensitiveAssignment(text)) {
+    return "[redacted:deeply-escaped]";
+  }
+  // Detect multiline value syntax before the header pass. Otherwise a key
+  // such as `authorization: |` is rewritten as a one-line header first and the
+  // block marker disappears while its secret body remains.
+  const structuralRedacted = redactYamlMultilineAssignments(text)
+    .replace(SHELL_MULTILINE_ASSIGNMENT, (_match, prefix) => `${prefix}[redacted:value]`);
+  const redacted = structuralRedacted
     .replace(PEM_BLOCK, "[redacted:pem]")
+    .replace(UNTERMINATED_PEM, "[redacted:pem]")
     .replace(JWT, "[redacted:jwt]")
+    .replace(UNTERMINATED_JWT, "[redacted:jwt]")
     .replace(URL_CREDENTIALS, "$1[redacted:url-credentials]@")
+    .replace(UNTERMINATED_URL_CREDENTIALS, "$1[redacted:url-credentials]")
     .replace(PROVIDER_TOKENS, "[redacted:token]")
     .replace(BEARER, "$1[redacted:token]")
-    .replace(ASSIGNMENT, (match, prefix, _value, offset, source) => {
-      if (source[offset + match.length] === "(") return match;
-      return `${prefix}[redacted:value]`;
+    .replace(SENSITIVE_HEADER, (match, prefix, rawValue) => {
+      const value = rawValue.trimStart();
+      if (
+        !value ||
+        /^\[redacted:[^\]]+\]$/i.test(value) ||
+        /^Bearer\s+\[redacted:[^\]]+\]["']?$/i.test(value)
+      ) {
+        return match;
+      }
+      return `${prefix}${rawValue.slice(0, rawValue.length - value.length)}[redacted:value]`;
     });
+  const assignmentsRedacted = redactQuotedAssignments(redacted)
+    .replace(JSON_UNQUOTED_ASSIGNMENT, (match, prefix, _key, value) =>
+      redactAssignment(match, prefix, value),
+    )
+    .replace(UNQUOTED_ASSIGNMENT, (match, prefix, value) =>
+      redactAssignment(match, prefix, value),
+    );
+  // A runtime may serialize a structured key with punctuation the regex-safe
+  // fast path deliberately does not enumerate (`api:key`, nine separators).
+  // Withhold that rare field rather than let a different adapter's spelling
+  // become a credential bypass.
+  return hasSensitiveAssignment(assignmentsRedacted)
+    ? "[redacted:credential-assignment]"
+    : assignmentsRedacted;
 }
 
 /**