pi-agent-browser-native 0.9.3 → 0.9.5

package/dist/extensions/agent-browser/lib/read-confirmation.js

@@ -1,99 +1,162 @@
 import { extractUpstreamCommandTokens } from "./argv-descriptor.js";
-import { extractExplicitSessionName, getAgentBrowserSessionIdentityKey, resolveAgentBrowserNamespace, scanUpstreamGlobalFlagOccurrences } from "./argv-grammar.js";
+import { extractExplicitSessionName, getAgentBrowserSessionIdentityKey, resolveAgentBrowserNamespace, scanUpstreamGlobalFlagOccurrences, } from "./argv-grammar.js";
 import { getExplicitReadUrl } from "./command-policy.js";
 import { isCloseCommand } from "./command-taxonomy.js";
-import { getExplicitNavigationTarget } from "./page-target-validation.js";
-import { isRecord } from "./parsing.js";
 import { getUpstreamEffectiveBatchSteps } from "./orchestration/batch-stdin.js";
-export function parseReadConfirmation(value) {
-    if (!isRecord(value) || (value.source !== "native-explicit-url-read" && value.source !== "native-guarded-action") || (value.state !== "pending" && value.state !== "cleared"))
-        return undefined;
-    if (typeof value.id !== "string" || !value.id || typeof value.sessionName !== "string" || !value.sessionName || (value.namespace !== undefined && typeof value.namespace !== "string"))
-        return undefined;
-    if (value.source === "native-guarded-action" && (typeof value.command !== "string" || !value.command || typeof value.action !== "string" || !value.action))
-        return undefined;
-    return { ...(value.source === "native-explicit-url-read" && isRecord(value.capabilities) && value.capabilities.readRequiresConfirmation === true ? { capabilities: { readRequiresConfirmation: true } } : {}), id: value.id, sessionName: value.sessionName, namespace: value.namespace, source: value.source, state: value.state,
-        ...(value.source === "native-guarded-action" ? { command: typeof value.command === "string" ? value.command : undefined, action: typeof value.action === "string" ? value.action : undefined } : {}),
-        ...(value.source === "native-guarded-action" && value.state === "cleared" && value.command === "snapshot" && value.action === "snapshot" && value.refSnapshotFresh === true ? { refSnapshotFresh: true } : {}) };
-}
+import { getConfirmedNativeResult, getNativePendingControl, } from "./native-confirmation.js";
+export { parseReadConfirmation, getNativeTabContinuationGuidance, isSuccessfulNativeConfirmedClose, } from "./native-confirmation.js";
 export function isBrowserIndependentConfirmation(value) {
-    return value?.source === "native-explicit-url-read" && value.capabilities?.readRequiresConfirmation === true;
+    return (value?.source === "native-explicit-url-read" &&
+        value.capabilities?.readRequiresConfirmation === true);
 }
 export function suppressConfirmationPageHelpers(value) {
-    return value?.state === "pending" && (value.source === "native-guarded-action" || isBrowserIndependentConfirmation(value));
-}
-export function isSuccessfulNativeConfirmedClose(commandTokens, data) {
-    return commandTokens[0] === "confirm" && commandTokens.length === 2 && isRecord(data) && data.confirmed === true
-        && data.action === "close" && isRecord(data.result) && data.result.success === true
-        && isRecord(data.result.data) && data.result.data.closed === true;
+    return (value?.state === "pending" &&
+        (value.source === "native-guarded-action" || isBrowserIndependentConfirmation(value)));
 }
-export function findReadConfirmation(args, confirmations, namespace, stdin) {
+export function findReadConfirmation(args, 
+// lib.es2015.iterable.d.ts exposes a mutable iterator cursor; only deeply readonly confirmation values are consumed.
+// oxlint-disable-next-line typescript/prefer-readonly-parameter-types
+confirmations, namespace, stdin) {
     const command = extractUpstreamCommandTokens(args);
-    const tokens = command[0] === "batch" ? getUpstreamEffectiveBatchSteps(command, stdin)[0] ?? [] : command;
-    if (tokens.length !== 2 || !["confirm", "deny"].includes(tokens[0]))
+    const tokens = command[0] === "batch" ? (getUpstreamEffectiveBatchSteps(command, stdin)[0] ?? []) : command;
+    if (tokens.length !== 2 || !["confirm", "deny"].includes(tokens[0])) {
         return undefined;
+    }
     const sessionName = extractExplicitSessionName(args);
     const effectiveNamespace = resolveAgentBrowserNamespace(args, namespace);
-    const matches = [...confirmations].filter(value => value.state === "pending" && value.id === tokens[1]
-        && (command[0] !== "batch" || value.source === "native-guarded-action")
-        && (sessionName === undefined || getAgentBrowserSessionIdentityKey(sessionName, value.namespace) === getAgentBrowserSessionIdentityKey(value.sessionName, value.namespace))
-        && (effectiveNamespace === undefined || getAgentBrowserSessionIdentityKey(value.sessionName, effectiveNamespace) === getAgentBrowserSessionIdentityKey(value.sessionName, value.namespace)));
+    const matches = [...confirmations].filter((value) => value.state === "pending" &&
+        value.id === tokens[1] &&
+        (command[0] !== "batch" || value.source === "native-guarded-action") &&
+        (sessionName === undefined ||
+            getAgentBrowserSessionIdentityKey(sessionName, value.namespace) ===
+                getAgentBrowserSessionIdentityKey(value.sessionName, value.namespace)) &&
+        (effectiveNamespace === undefined ||
+            getAgentBrowserSessionIdentityKey(value.sessionName, effectiveNamespace) ===
+                getAgentBrowserSessionIdentityKey(value.sessionName, value.namespace)));
     return matches.length === 1 ? matches[0] : undefined;
 }
 export function scopeReadConfirmationArgs(args, confirmation) {
     return [
-        ...(scanUpstreamGlobalFlagOccurrences(args, "--namespace").length === 0 ? ["--namespace", confirmation.namespace ?? ""] : []),
-        ...(extractExplicitSessionName(args) === undefined ? ["--session", confirmation.sessionName] : []),
+        ...(scanUpstreamGlobalFlagOccurrences(args, "--namespace").length === 0
+            ? ["--namespace", confirmation.namespace ?? ""]
+            : []),
+        ...(extractExplicitSessionName(args) === undefined
+            ? ["--session", confirmation.sessionName]
+            : []),
         ...args,
     ];
 }
-export function getNativeTabContinuationGuidance(commandTokens, data) {
-    if (commandTokens[0] !== "tab" || commandTokens[1] !== "new" || !isRecord(data)
-        || data.confirmation_required !== true || typeof data.confirmation_id !== "string" || !data.confirmation_id || data.action !== "tab_new"
-        || !Object.keys(data).every(key => ["confirmation_required", "confirmation_id", "action", "capabilities", "after_confirmation", "guidance"].includes(key))
-        || !Array.isArray(data.after_confirmation) || data.after_confirmation.length !== 2 || data.after_confirmation[0] !== "open"
-        || typeof data.after_confirmation[1] !== "string" || !data.after_confirmation[1]
-        || data.after_confirmation[1] !== getExplicitNavigationTarget(commandTokens)
-        || typeof data.guidance !== "string" || !data.guidance.trim())
+function isExplicitReadProvenance(pending, tokens, confirmed) {
+    return (pending.action === "read" &&
+        (typeof getExplicitReadUrl(tokens) === "string" ||
+            confirmed?.source === "native-explicit-url-read"));
+}
+function isOriginalGuardedAction(command) {
+    return command !== undefined && command.length > 0 && !["confirm", "deny"].includes(command);
+}
+function pendingConfirmation(pending, tokens, identity) {
+    if (isExplicitReadProvenance(pending, tokens, identity.confirmed)) {
+        return {
+            ...(pending.capabilities !== undefined ? { capabilities: pending.capabilities } : {}),
+            id: pending.id,
+            namespace: identity.namespace,
+            sessionName: identity.sessionName,
+            source: "native-explicit-url-read",
+            state: "pending",
+        };
+    }
+    const command = tokens.at(0);
+    if (isOriginalGuardedAction(command) || identity.confirmed?.source === "native-guarded-action") {
+        return {
+            id: pending.id,
+            namespace: identity.namespace,
+            sessionName: identity.sessionName,
+            source: "native-guarded-action",
+            command: identity.confirmed !== undefined ? identity.confirmed.command : command,
+            action: pending.action,
+            state: "pending",
+        };
+    }
+    return undefined;
+}
+function settlesPendingConfirmation(tokens, current) {
+    return (current?.state === "pending" &&
+        tokens.length === 2 &&
+        ["confirm", "deny"].includes(tokens[0]) &&
+        tokens[1] === current.id);
+}
+function confirmedDecisionResult(tokens, current, data) {
+    if (tokens[0] !== "confirm" ||
+        current === undefined ||
+        !settlesPendingConfirmation(tokens, current)) {
         return undefined;
-    // Transport prose only: approval creates the tab; the continuation is never stored or executed.
-    return data.guidance;
+    }
+    return getConfirmedNativeResult(data, current);
+}
+function clearedConfirmation(current, command, succeeded, settles) {
+    return succeeded && current?.state === "pending" && (settles || isCloseCommand(command))
+        ? { ...current, state: "cleared" }
+        : undefined;
 }
 export function nextReadConfirmation(options) {
     const { commandTokens: tokens, current } = options;
-    const settles = current?.state === "pending" && tokens.length === 2 && ["confirm", "deny"].includes(tokens[0]) && tokens[1] === current.id;
-    const confirmed = settles && tokens[0] === "confirm" && isRecord(options.data) && options.data.confirmed === true
-        && options.data.action === (current.source === "native-explicit-url-read" ? "read" : current.action) && isRecord(options.data.result);
-    const control = confirmed && isRecord(options.data) && isRecord(options.data.result) ? options.data.result.data : options.data;
-    // Only native control fields and a validated tab transport continuation. Page output is never provenance.
-    if (options.succeeded && isRecord(control) && !Array.isArray(control) && control.confirmation_required === true
-        && typeof control.confirmation_id === "string" && control.confirmation_id && typeof control.action === "string" && control.action
-        && (Object.keys(control).every(key => ["confirmation_required", "confirmation_id", "action", "capabilities"].includes(key))
-            || getNativeTabContinuationGuidance(tokens, control) !== undefined)) {
-        const explicitRead = control.action === "read" && (typeof getExplicitReadUrl(tokens) === "string" || confirmed && current.source === "native-explicit-url-read");
-        if (explicitRead)
-            return { ...(isRecord(control.capabilities) && control.capabilities.readRequiresConfirmation === true ? { capabilities: { readRequiresConfirmation: true } } : {}), id: control.confirmation_id, namespace: options.namespace, sessionName: options.sessionName, source: "native-explicit-url-read", state: "pending" };
-        if (tokens[0] && !["confirm", "deny"].includes(tokens[0]) || confirmed && current.source === "native-guarded-action") {
-            return { id: control.confirmation_id, namespace: options.namespace, sessionName: options.sessionName, source: "native-guarded-action", command: confirmed ? current.command : tokens[0], action: control.action, state: "pending" };
+    const settles = settlesPendingConfirmation(tokens, current);
+    const confirmedResult = confirmedDecisionResult(tokens, current, options.data);
+    const pending = options.succeeded
+        ? getNativePendingControl(tokens, confirmedResult !== undefined ? confirmedResult.data : options.data)
+        : undefined;
+    if (pending !== undefined) {
+        const next = pendingConfirmation(pending, tokens, {
+            namespace: options.namespace,
+            sessionName: options.sessionName,
+            confirmed: confirmedResult !== undefined ? current : undefined,
+        });
+        if (next !== undefined) {
+            return next;
         }
-        if (current?.state === "pending")
+        if (current?.state === "pending") {
             return { ...current, state: "cleared" };
+        }
     }
-    return options.succeeded && current?.state === "pending" && (settles || isCloseCommand(tokens[0])) ? { ...current, state: "cleared" } : undefined;
+    return clearedConfirmation(current, tokens[0], options.succeeded, settles);
+}
+function confirmationSafety(confirmation) {
+    if (isBrowserIndependentConfirmation(confirmation)) {
+        return "Review the requested read first. The native capability proves ID matching; no DOM confirmation is implied.";
+    }
+    return confirmation.source === "native-guarded-action"
+        ? "Review the original guarded action. Exact wrapper observation preserves its session and avoids overwriting helpers; native ID validation is not implied."
+        : "Native ID matching/browser independence is unproven. The exact native session is preserved, but this confirmation retains normal page checks.";
 }
 export function buildReadConfirmationNextActions(confirmation, pendingResponse) {
-    if (confirmation.state === "cleared")
+    if (confirmation.state === "cleared") {
         return [];
-    const prefix = ["--namespace", confirmation.namespace ?? "", "--session", confirmation.sessionName];
-    if (!pendingResponse)
-        return [{ id: "inspect-read-confirmation-session", tool: "agent_browser", params: { args: [...prefix, "session", "info"] }, reason: "Inspect the exact native session after the confirmation failed; rerun the original command if its ID expired.", safety: "Read-only status, without browser launch or tab changes. Do not substitute a different pending confirmation ID." }];
-    return ["confirm", "deny"].map(command => ({
-        id: command === "confirm" ? "approve-confirmation" : "deny-confirmation", tool: "agent_browser", params: { args: [...prefix, command, confirmation.id] },
-        reason: `${command === "confirm" ? "Approve" : "Deny"} the native confirmation for ${confirmation.source === "native-explicit-url-read" ? "this explicit URL read" : `${confirmation.command} (${confirmation.action})`}.`,
-        safety: isBrowserIndependentConfirmation(confirmation)
-            ? "Review the requested read first. The native capability proves ID matching; no DOM confirmation is implied."
-            : confirmation.source === "native-guarded-action"
-                ? "Review the original guarded action. Exact wrapper observation preserves its session and avoids overwriting helpers; native ID validation is not implied."
-                : "Native ID matching/browser independence is unproven. The exact native session is preserved, but this confirmation retains normal page checks.",
+    }
+    const prefix = [
+        "--namespace",
+        confirmation.namespace ?? "",
+        "--session",
+        confirmation.sessionName,
+    ];
+    if (!pendingResponse) {
+        return [
+            {
+                id: "inspect-read-confirmation-session",
+                tool: "agent_browser",
+                params: { args: [...prefix, "session", "info"] },
+                reason: "Inspect the exact native session after the confirmation failed; rerun the original command if its ID expired.",
+                safety: "Read-only status, without browser launch or tab changes. Do not substitute a different pending confirmation ID.",
+            },
+        ];
+    }
+    const subject = confirmation.source === "native-explicit-url-read"
+        ? "this explicit URL read"
+        : `${confirmation.command ?? ""} (${confirmation.action ?? ""})`;
+    return ["confirm", "deny"].map((command) => ({
+        id: command === "confirm" ? "approve-confirmation" : "deny-confirmation",
+        tool: "agent_browser",
+        params: { args: [...prefix, command, confirmation.id] },
+        reason: `${command === "confirm" ? "Approve" : "Deny"} the native confirmation for ${subject}.`,
+        safety: confirmationSafety(confirmation),
     }));
 }

package/dist/extensions/agent-browser/lib/recording-reservations.js

@@ -7,58 +7,96 @@ function getReservationKey(reservation) {
     return getAgentBrowserSessionIdentityKey(reservation.sessionName, reservation.namespace);
 }
 function getArtifactReservation(artifact) {
-    if (!artifact.session || artifact.command !== "record" || artifact.kind !== "video")
+    if (artifact.session === undefined ||
+        artifact.session.length === 0 ||
+        artifact.command !== "record" ||
+        artifact.kind !== "video") {
         return undefined;
+    }
     return {
         absolutePath: artifact.absolutePath,
         cwd: artifact.cwd ?? process.cwd(),
         namespace: artifact.namespace,
         path: artifact.path,
-        ...(artifact.recording?.recordingId ? { recordingId: artifact.recording.recordingId } : {}),
-        ...(artifact.recordingStartedAtMs !== undefined ? { startedAtMs: artifact.recordingStartedAtMs } : {}),
+        ...(typeof artifact.recording?.recordingId === "string" &&
+            artifact.recording.recordingId.length > 0
+            ? { recordingId: artifact.recording.recordingId }
+            : {}),
+        ...(artifact.recordingStartedAtMs !== undefined
+            ? { startedAtMs: artifact.recordingStartedAtMs }
+            : {}),
         sessionName: artifact.session,
     };
 }
-export function applyRecordingArtifactsToReservations(reservations, artifacts) {
+function artifactReservations(artifacts) {
     const pendingBySession = new Map();
     const terminalBySession = new Map();
     for (const artifact of artifacts) {
-        const reservation = getArtifactReservation(artifact);
-        if (!reservation)
+        let reservation = getArtifactReservation(artifact);
+        if (!reservation) {
             continue;
-        const sheet = artifacts.find((candidate) => candidate.command === "record" && candidate.kind === "image" && candidate.session === artifact.session && candidate.namespace === artifact.namespace && isPendingRecordingArtifact(candidate));
-        if (sheet)
-            reservation.contactSheetPath = sheet.absolutePath;
+        }
+        const sheet = artifacts.find((candidate) => candidate.command === "record" &&
+            candidate.kind === "image" &&
+            candidate.session === artifact.session &&
+            candidate.namespace === artifact.namespace &&
+            isPendingRecordingArtifact(candidate));
+        if (sheet) {
+            reservation = { ...reservation, contactSheetPath: sheet.absolutePath };
+        }
         const key = getReservationKey(reservation);
-        if (isPendingRecordingArtifact(artifact))
+        if (isPendingRecordingArtifact(artifact)) {
             pendingBySession.set(key, reservation);
-        else
+        }
+        else {
             terminalBySession.set(key, reservation);
+        }
     }
+    return { pendingBySession, terminalBySession };
+}
+function reservationChanged(existing, pending) {
+    return (!existing ||
+        existing.absolutePath !== pending.absolutePath ||
+        existing.cwd !== pending.cwd ||
+        existing.recordingId !== pending.recordingId ||
+        existing.startedAtMs !== pending.startedAtMs ||
+        existing.contactSheetPath !== pending.contactSheetPath);
+}
+export function applyRecordingArtifactsToReservations(
+// This mutator owns changes to the namespace/session reservation index, not to reservation values.
+// oxlint-disable-next-line typescript/prefer-readonly-parameter-types
+reservations, artifacts) {
+    const { pendingBySession, terminalBySession } = artifactReservations(artifacts);
     const transitions = [];
     for (const key of terminalBySession.keys()) {
-        if (pendingBySession.has(key))
+        if (pendingBySession.has(key)) {
             continue;
+        }
         const existing = reservations.get(key);
-        if (!existing)
+        if (!existing) {
             continue;
+        }
         reservations.delete(key);
         transitions.push({ reservation: existing, state: "closed" });
     }
     for (const [key, pending] of pendingBySession) {
         const existing = reservations.get(key);
         reservations.set(key, pending);
-        if (!existing || existing.absolutePath !== pending.absolutePath || existing.cwd !== pending.cwd || existing.recordingId !== pending.recordingId || existing.startedAtMs !== pending.startedAtMs || existing.contactSheetPath !== pending.contactSheetPath) {
+        if (reservationChanged(existing, pending)) {
             transitions.push({ reservation: pending, state: "active" });
         }
     }
     return transitions;
 }
-export function retireRecordingReservation(reservations, sessionName, namespace) {
+export function retireRecordingReservation(
+// This mutator owns changes to the namespace/session reservation index, not to reservation values.
+// oxlint-disable-next-line typescript/prefer-readonly-parameter-types
+reservations, sessionName, namespace) {
     const key = getAgentBrowserSessionIdentityKey(sessionName, namespace);
     const reservation = reservations.get(key);
-    if (reservation)
+    if (reservation) {
         reservations.delete(key);
+    }
     return reservation;
 }
 export function appendRecordingReservationTransition(pi, transition) {
@@ -76,51 +114,86 @@ export function appendRecordingReservationTransition(pi, transition) {
         version: 1,
     });
 }
-function parseReservationTransition(data) {
-    if (!isRecord(data) || data.version !== 1 || (data.state !== "active" && data.state !== "closed"))
+function optionalReservationMetadata(data) {
+    if (data.contactSheetPath !== undefined &&
+        (typeof data.contactSheetPath !== "string" || !isAbsolute(data.contactSheetPath))) {
+        return false;
+    }
+    if (data.recordingId !== undefined &&
+        (typeof data.recordingId !== "string" || data.recordingId.length === 0)) {
+        return false;
+    }
+    return (data.startedAtMs === undefined ||
+        (typeof data.startedAtMs === "number" && Number.isFinite(data.startedAtMs)));
+}
+function parseActiveReservation(data, identity) {
+    if (!optionalReservationMetadata(data)) {
+        return undefined;
+    }
+    if (typeof data.absolutePath !== "string" ||
+        !isAbsolute(data.absolutePath) ||
+        typeof data.cwd !== "string" ||
+        !isAbsolute(data.cwd) ||
+        typeof data.path !== "string") {
         return undefined;
-    if (typeof data.sessionName !== "string" || data.sessionName.length === 0)
+    }
+    return {
+        ...identity,
+        absolutePath: data.absolutePath,
+        cwd: data.cwd,
+        path: data.path,
+        ...(typeof data.contactSheetPath === "string"
+            ? { contactSheetPath: data.contactSheetPath }
+            : {}),
+        ...(typeof data.recordingId === "string" ? { recordingId: data.recordingId } : {}),
+        ...(typeof data.startedAtMs === "number" ? { startedAtMs: data.startedAtMs } : {}),
+    };
+}
+function hasReservationIdentity(data) {
+    return (typeof data.sessionName === "string" &&
+        data.sessionName.length > 0 &&
+        (data.namespace === undefined || typeof data.namespace === "string"));
+}
+function parseReservationTransition(data) {
+    if (!isRecord(data) ||
+        data.version !== 1 ||
+        (data.state !== "active" && data.state !== "closed")) {
         return undefined;
-    if (data.namespace !== undefined && typeof data.namespace !== "string")
+    }
+    if (!hasReservationIdentity(data)) {
         return undefined;
+    }
     if (data.state === "closed") {
         return {
-            reservation: { absolutePath: "", cwd: "", namespace: data.namespace, path: "", sessionName: data.sessionName },
+            reservation: {
+                absolutePath: "",
+                cwd: "",
+                namespace: data.namespace,
+                path: "",
+                sessionName: data.sessionName,
+            },
             state: "closed",
         };
     }
-    if (data.contactSheetPath !== undefined && (typeof data.contactSheetPath !== "string" || !isAbsolute(data.contactSheetPath)))
-        return undefined;
-    if (data.recordingId !== undefined && (typeof data.recordingId !== "string" || !data.recordingId))
-        return undefined;
-    if (data.startedAtMs !== undefined && (typeof data.startedAtMs !== "number" || !Number.isFinite(data.startedAtMs)))
-        return undefined;
-    if (typeof data.absolutePath !== "string" || !isAbsolute(data.absolutePath)
-        || typeof data.cwd !== "string" || !isAbsolute(data.cwd) || typeof data.path !== "string")
-        return undefined;
-    return {
-        reservation: {
-            absolutePath: data.absolutePath,
-            ...(typeof data.contactSheetPath === "string" ? { contactSheetPath: data.contactSheetPath } : {}),
-            cwd: data.cwd,
-            namespace: data.namespace,
-            path: data.path,
-            ...(typeof data.recordingId === "string" ? { recordingId: data.recordingId } : {}),
-            ...(typeof data.startedAtMs === "number" ? { startedAtMs: data.startedAtMs } : {}),
-            sessionName: data.sessionName,
-        },
-        state: "active",
-    };
+    const reservation = parseActiveReservation(data, {
+        sessionName: data.sessionName,
+        namespace: data.namespace,
+    });
+    return reservation ? { reservation, state: "active" } : undefined;
 }
 export function restoreRecordingReservationStateFromBranch(branch) {
     const reservations = new Map();
     const terminal = new Map();
     for (const entry of branch) {
-        if (!isRecord(entry) || entry.type !== "custom" || entry.customType !== RECORDING_RESERVATION_ENTRY_TYPE)
+        if (!isRecord(entry) ||
+            entry.type !== "custom" ||
+            entry.customType !== RECORDING_RESERVATION_ENTRY_TYPE) {
             continue;
+        }
         const transition = parseReservationTransition(entry.data);
-        if (!transition)
+        if (!transition) {
             continue;
+        }
         const key = getReservationKey(transition.reservation);
         if (transition.state === "active") {
             reservations.set(key, transition.reservation);

package/dist/extensions/agent-browser/lib/redaction-fields.js

@@ -0,0 +1,75 @@
+const SENSITIVE_FIELD_NAME_PATTERN = /^(?:[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|secret(?:[_-]?(?:key|access[_-]?key))?|token|password|passwd|credentials?|database[_-]?url|db[_-]?url|connection[_-]?string|mongo(?:db)?[_-]?uri|redis[_-]?url)|[A-Za-z0-9]*(?:apiKey|ApiKey|apikey|privateKey|PrivateKey|databaseUrl|DatabaseUrl|dbUrl|DbUrl|connectionString|ConnectionString|mongoUri|MongoUri|mongodbUri|MongodbUri|mongoDbUri|MongoDbUri|redisUrl|RedisUrl|Token|Secret|Password|Credential|Credentials)|auth(?:orization)?|bearer|client(?:_|-)?secret|cookie|id(?:_|-)?token|pass(?:word)?|proxy(?:_|-)?authorization|refresh(?:_|-)?token|sentry(?:_|-)?key|session(?:_|-)?id|set(?:_|-)?cookie|sig(?:nature)?|write(?:_|-)?key|x(?:_|-)?api(?:_|-)?key)$/i;
+const ENV_SECRET_ASSIGNMENT_PATTERN = /\b((?:export\s+)?([A-Za-z_][A-Za-z0-9_-]*)(\s*[:=]\s*))(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;]+)/g;
+export function isSensitiveFieldName(key) {
+    SENSITIVE_FIELD_NAME_PATTERN.lastIndex = 0;
+    return SENSITIVE_FIELD_NAME_PATTERN.test(key);
+}
+function isEnvSecretAssignmentKey(key) {
+    if (!isSensitiveFieldName(key)) {
+        return false;
+    }
+    if (key === "password" || key.includes("_") || key.includes("-") || key === key.toUpperCase()) {
+        return true;
+    }
+    return /(?:apiKey|ApiKey|privateKey|PrivateKey|databaseUrl|DatabaseUrl|dbUrl|DbUrl|connectionString|ConnectionString|mongoUri|MongoUri|mongodbUri|MongodbUri|mongoDbUri|MongoDbUri|redisUrl|RedisUrl|Token|Secret|Password|Credential|Credentials)$/.test(key);
+}
+function isLineBoundary(text, index) {
+    return index < 0 || index >= text.length || text[index] === "\n" || text[index] === "\r";
+}
+function redactPasswordAssignment(text, match, prefix, offset) {
+    // The loose matcher cannot safely distinguish inline punctuation from password characters.
+    const end = offset + match.length;
+    if (!isLineBoundary(text, offset - 1) ||
+        !isLineBoundary(text, end) ||
+        /^(?:\[REDACTED\]|%5Bredacted%5D)/i.test(match.slice(prefix.length))) {
+        return match;
+    }
+    const value = match.slice(prefix.length);
+    const boundary = value[0] === '"' || value[0] === "'" ? -1 : value.search(/[&#](?=[A-Za-z_][A-Za-z0-9_-]*\s*=)/);
+    return `${prefix}[REDACTED]${boundary < 0 ? "" : value.slice(boundary)}`;
+}
+export function redactEnvSecretAssignments(text) {
+    return text.replace(ENV_SECRET_ASSIGNMENT_PATTERN, 
+    // String.replace supplies match, three captures, then the source offset.
+    (match, prefix, key, _separator, offset) => {
+        if (!isEnvSecretAssignmentKey(key)) {
+            return match;
+        }
+        return key === "password"
+            ? redactPasswordAssignment(text, match, prefix, offset)
+            : `${prefix}[REDACTED]`;
+    });
+}
+function credentialTrailingPunctuation(credential) {
+    return credential.match(/[,.:;!?]+$/)?.[0] ?? "";
+}
+function formatRedactedCredential(label, credential, trailing = "") {
+    return `${label} [REDACTED]${credentialTrailingPunctuation(credential)}${trailing}`;
+}
+export function redactBearerCredentials(text) {
+    return text
+        .replace(/((?:\b([A-Za-z][A-Za-z0-9_-]*)\s*[:=]\s*|(?:^|\s)(?:-H\s*|--header(?:\s+|=)))["']?Bearer)\s+([^\s"',)[\]]+)([),.]?)/gi, 
+    // String.replace supplies the match followed by this expression's four captures.
+    (match, label, field, credential, trailing) => {
+        if (field !== undefined && field.length > 0 && !isSensitiveFieldName(field)) {
+            return match;
+        }
+        return formatRedactedCredential(label, credential, trailing);
+    })
+        .replace(/\b(Bearer)\s+([^\s\\"',)[\]]+)([),.]?)/gi, (match, label, credential, trailing) => {
+        // Require a bearer-token shape without a credential field/header, not prose, HTML or a URL.
+        const token = credential.slice(0, credential.length - credentialTrailingPunctuation(credential).length);
+        if (!/^[A-Za-z0-9._~+/-]+=*$/.test(token) || !/[0-9._~+/=-]/.test(token)) {
+            return match;
+        }
+        return formatRedactedCredential(label, credential, trailing);
+    });
+}
+export function redactStandaloneBasicCredential(text) {
+    return text.replace(/\b(Basic)\s+([A-Za-z0-9+/=]{12,})/gi, (match, label, credential) => {
+        if (!/[0-9+/=]/.test(credential)) {
+            return match;
+        }
+        return `${label} [REDACTED]`;
+    });
+}