redac---n 0.0.1 → 0.0.2

package/README.md

@@ -7,7 +7,7 @@ up in the context sent to the provider, any router in between, and your logs. re
 text and replaces them with placeholders, and leaves alone the commit SHAs, digests, IDs and code the agent needs to
 keep working.
 
-TypeScript, no dependencies, no Node-only APIs (Node 20+, Bun, Deno).
+TypeScript, no dependencies, no Node-only APIs: it runs on Node 20+, Bun and in the browser.
 
 ```sh
 npm install redac---n

package/dist/commands.js

@@ -24,7 +24,7 @@ const SECRET_FILE = [
     /^\.?vault[_-]?pass(?:word)?(?:\.txt)?$/i,
     /(?:^|[_.-])(?:pass(?:word|wd|phrase|code)?|secret|token|pin(?:[_-]?code)?)(?:\.txt)?$/i,
     /^(?:pap|chap)-secrets(?:[-_.][\w-]+)?$/,
-    /^(_netrc|rclone\.conf|cookies\.txt|keystore\.properties|wp-config\.php|\.?htpasswd|redis\.conf|sentinel\.conf|keyfile|userlist\.txt)$/i,
+    /^(_netrc|rclone\.conf|cookies\.txt|keystore\.properties|wp-config\.php|\.?htpasswd|redis\.conf|sentinel\.conf|users\.acl|keyfile|userlist\.txt)$/i,
     /(^|[-_.])secrets?(\.[\w-]{1,40})?\.(json|ya?ml|toml|env|ini|properties)$/i,
     /\.(tfvars|tfstate)(\.json|\.backup)?$/,
     /^kubeconfig(\..+)?$|\.kubeconfig$/,
@@ -35,6 +35,8 @@ const SECRET_FILE = [
     /realm\.properties$/,
 ];
 const SECRET_DIR = /(^|\/)\.(aws|ssh|gnupg|docker|kube|azure)\/|(^|\/)\.config\/(gcloud|gh|rclone|sops)\/|(^|\/)\.?secrets\//;
+/** Secret files by their directory and name: Bundler's config, which holds gem servers' credentials (names.ts isBundlerHostName). */
+const SECRET_PATH = /(^|\/)\.bundle\/config$/;
 // (Also a key's public half by its name, `cache-pub-key.pem`, `server.pub.pem`, `public.key`; and a certificate's,
 // `fullchain.pem`, `cert.pem`, but not a private key's container named for its certificate, `cert.key`, `server.crt.p12`,
 // `cert-key.pem`.
@@ -46,7 +48,7 @@ export function isSecretFile(path) {
     const name = path.slice(path.lastIndexOf("/") + 1);
     if (!name || EXAMPLE_FILE.test(name) || NOT_SECRET_PATH.test(path))
         return false;
-    return SECRET_FILE.some((r) => r.test(name)) || SECRET_DIR.test(path);
+    return SECRET_FILE.some((r) => r.test(name)) || SECRET_DIR.test(path) || SECRET_PATH.test(path);
 }
 /**
  * Whether a value is the name of a file that is a secret file or its template, not a password: `.env.example`, `.env.local`,
@@ -708,6 +710,7 @@ const TOOLS = [
     [/^(?:supabase|altool)$/, { flags: new Set(["-p", "--password"]), next: "always", attached: false }],
     [/^mosquitto_(?:pub|sub|rr)$/, { flags: new Set(["-P", "--pw"]), next: "always", attached: false }],
     [/^beeline$/, { flags: new Set(["-p"]), next: "always", attached: false }],
+    [/^cypher-shell$/, { flags: new Set(["-p", "--password"]), next: "always", attached: false }],
     [/^az$/, { flags: new Set(["-p", "--password"]), next: "always", attached: false, subcommand: "login" }],
     [/^gh$/, { flags: new Set(["-b", "--body"]), next: "always", attached: false, subcommand: "secret" }],
     [/^(?:zip|unzip|zipcloak)$/, { flags: new Set(["-P", "--password"]), next: "always", attached: false }],

package/dist/index.js

@@ -21,7 +21,7 @@ import { findEncoded, findHexDumps } from "./encoded.js";
 import { jsonLiteralSpans, jsonStringLiterals, mayHoldJsonText, pythonReprLiterals } from "./json.js";
 import { repeats } from "./repeats.js";
 import { RedactionStream } from "./stream.js";
-import { covered, isLearnable, toWordEnd, trimmedToValue, merge, overlaps, secretValue, wrapped } from "./spans.js";
+import { covered, isLearnable, loginPassword, toWordEnd, trimmedToValue, merge, overlaps, secretValue, wrapped, } from "./spans.js";
 import { isGuess, isVouched, layerOf, needsJudging, PLACEHOLDER_RULE } from "./rules.js";
 import { lowerBound } from "./lines.js";
 import { findEmbeddedOutputs, findInSecretFile, findPrintedSecret, firstPrompt, secretFileSections, } from "./secretfile.js";
@@ -454,8 +454,12 @@ export class Redactor {
         const before = this.known.size;
         for (const f of this.detect(text, options)) {
             const value = secretValue(text, f);
-            if (isLearnable(f, value, options.minConfidence))
-                this.known.add(value, f.kind);
+            if (!isLearnable(f, value, options.minConfidence))
+                continue;
+            this.known.add(value, f.kind);
+            const password = loginPassword(f, value);
+            if (password)
+                this.known.add(password, f.kind);
         }
         return this.known.size - before;
     }

package/dist/names.d.ts

@@ -3,6 +3,18 @@ export declare const PASSWORD_SPELLINGS: string[];
 export declare const FOREIGN_PASSWORD_SPELLINGS: string[];
 /** The words of a name in upper case: `clientSecret` → CLIENT, SECRET; `x-api-key` → X, API, KEY. */
 export declare function words(name: string): string[];
+/**
+ * Whether a name names a session or its ID, whoever's session it is: `INSTAGRAM_SESSION_ID`, `LINKEDIN_SESSION`,
+ * `tiktokSessionId`; not a terminal's or a desktop's (LOCAL_SESSION_OWNERS). Read so only in a secret file, which says
+ * its values are secrets: elsewhere a session's ID under another's name is as often a checkout's or an agent's
+ * (`CHECKOUT_SESSION_ID`, `CLAUDE_SESSION_ID`), and only the names isSessionIdName knows are credentials.
+ */
+export declare function namesSession(name: string): boolean;
+/**
+ * Whether a name's value may be a login, `user:password` or `user/password` (spans.ts loginPassword): by a word of
+ * LOGIN_WORDS, or Bundler's name for a host.
+ */
+export declare function namesLogin(name: string): boolean;
 /** File names' extensions, so a file name that holds a credential word (`has_key_spec.rb`) isn't one; never a qualifier (`.prod`, `.old`, `.value`, `.test`). */
 export declare const FILE_EXTENSION: RegExp;
 export declare const VENDOR_CLIENTS: Set<string>;

package/dist/names.js

@@ -656,6 +656,74 @@ export function words(name) {
 const SESSION_COOKIE = /^_?(?!(?:tmux|screen|zellij|byobu|desktop|xdg|ssh|term|dbus|shell|login|vnc|x11)_)[a-z][a-z0-9]*_session$|^_session_id$|^ASP\.NET_SessionId$|^_gh_sess$/;
 const SESSION_ID = /^(?:x-)?(?:auth[_-]|user[_-]|web[_-]|app[_-])?(?:session|sess)[_-]?id$|^(?:auth|user|web|app)?[sS]essionId$|^(?:php)?sessid$|^connect\.sid$|^(?:__Secure-[13]P)?(?:SID|HSID|APISID|SAPISID|OSID|LSID|SIDTS|SIDCC)$/i;
 const isSessionIdName = (name) => (name !== "Session-ID" && SESSION_ID.test(name)) || SESSION_COOKIE.test(name);
+/**
+ * The owners of sessions that are no web login: a terminal's, a desktop's, a remote shell's (`ITERM_SESSION_ID`,
+ * `WT_SESSION`, `XDG_SESSION_ID`, `DESKTOP_SESSION`), as an environment's listing shows them.
+ */
+const LOCAL_SESSION_OWNERS = new Set([
+    "TMUX",
+    "SCREEN",
+    "ZELLIJ",
+    "BYOBU",
+    "DESKTOP",
+    "XDG",
+    "SSH",
+    "TERM",
+    "ITERM",
+    "TERMINAL",
+    "WT",
+    "KITTY",
+    "WEZTERM",
+    "KONSOLE",
+    "DBUS",
+    "SHELL",
+    "LOGIN",
+    "VNC",
+    "X11",
+]);
+/**
+ * Whether a name names a session or its ID, whoever's session it is: `INSTAGRAM_SESSION_ID`, `LINKEDIN_SESSION`,
+ * `tiktokSessionId`; not a terminal's or a desktop's (LOCAL_SESSION_OWNERS). Read so only in a secret file, which says
+ * its values are secrets: elsewhere a session's ID under another's name is as often a checkout's or an agent's
+ * (`CHECKOUT_SESSION_ID`, `CLAUDE_SESSION_ID`), and only the names isSessionIdName knows are credentials.
+ */
+export function namesSession(name) {
+    const w = words(name);
+    if (w.at(-1) === "ID")
+        w.pop();
+    return /^(?:SESSION|SESSIONID|SESS|SESSID)$/.test(w.at(-1) ?? "") && !w.some((x) => LOCAL_SESSION_OWNERS.has(x));
+}
+/**
+ * Words that name a login, a username and its password together: `NEO4J_AUTH`, `BASIC_AUTH`, `REGISTRY_CREDENTIALS`,
+ * `CURLOPT_USERPWD`.
+ */
+const LOGIN_WORDS = new Set([
+    "AUTH",
+    "BASICAUTH",
+    "CREDENTIAL",
+    "CREDENTIALS",
+    "CRED",
+    "CREDS",
+    "LOGIN",
+    "USERPASS",
+    "USERPWD",
+]);
+/**
+ * Whether a name's value may be a login, `user:password` or `user/password` (spans.ts loginPassword): by a word of
+ * LOGIN_WORDS, or Bundler's name for a host.
+ */
+export function namesLogin(name) {
+    return isBundlerHostName(name) || words(name).some((w) => LOGIN_WORDS.has(w));
+}
+/**
+ * Bundler's setting for a gem server's credentials, named by its host (`.` written `__`, `-` `___`):
+ * `BUNDLE_GEMS__CONTRIBSYS__COM`, `BUNDLE_RUBYGEMS__PKG__GITHUB__COM`. Its value is `user:password` or a token. Not
+ * Bundler's own settings that take a gem's or a URL's name the same way (`BUNDLE_BUILD__NOKOGIRI`, `BUNDLE_LOCAL__RACK`,
+ * `BUNDLE_MIRROR__…`, `BUNDLE_GEM__TEST`).
+ */
+function isBundlerHostName(name) {
+    return /^BUNDLE_(?!(?:BUILD|LOCAL|MIRROR|GEM)__)[A-Z0-9]+(?:_{2,3}[A-Z0-9]+)*__[A-Z]{2,6}$/.test(name);
+}
 /**
  * Data files' extensions: as a key, a data file's name maps to its checksum (`"data.csv": "<sha256>"` in a lockfile or a
  * registry). A config file's name maps to its contents (a Kubernetes Secret's `config.yaml`, `default_user.conf`).
@@ -1185,8 +1253,8 @@ function classify(name, w, core, last) {
     // (A bare file name is read below, after the PIN's: it may be a Kubernetes Secret's key, `pin.txt`.)
     if (name.includes("/") && isFileName(name))
         return "neutral";
-    // A vendor's name holds that vendor's key.
-    if (isVendorName(name))
+    // A vendor's name holds that vendor's key; Bundler's name for a gem server's host, that server's credentials.
+    if (isVendorName(name) || isBundlerHostName(name))
         return "credential";
     // Unity's serialized localization keys and names; a list item's key (Sanity's and React's `_key`); a generated
     // fixture's, numbered with zeros (`tagKey000003`); Postman's per-request UUID.

package/dist/repeats.js

@@ -2,7 +2,7 @@
 import { KeywordSet } from "./aho.js";
 import { continuesToken } from "./syntax.js";
 import { isBenignValue } from "./values.js";
-import { covered, secretValue } from "./spans.js";
+import { covered, loginPassword, secretValue } from "./spans.js";
 import { isGuess, layerOf, PLACEHOLDER_RULE, REPEATED_GUESS } from "./rules.js";
 /**
  * Other occurrences of confidently found values: a webhook token found in its URL is also hidden in
@@ -30,6 +30,10 @@ export function repeatable(text, found) {
             continue;
         const remembered = { kind: f.kind, value: v, ...(isGuess(f.rule) ? { guess: true } : {}) };
         values.set(v, remembered);
+        // (And a login's password, `NEO4J_AUTH=neo4j/<password>`, where it turns up alone.)
+        const password = loginPassword(f, v);
+        if (password && !isBenignValue(password) && !values.has(password))
+            values.set(password, { ...remembered, value: password });
         // (As it is written here too, when that's another form of it, and as a URL writes it: `Delta2018%26` in a URL,
         // `Delta2018&` in prose, and the other way round. Only for 8 or more printable characters and no blank: half a
         // surrogate pair has no URL form.)

package/dist/secretfile.js

@@ -8,7 +8,7 @@ import { commandsRun, holdsOnlySecrets, isConfigFileName, isSecretFile, printsSe
 import { allRedirects, LineIndex, programName, PROMPT, simpleCommand, wordSpan } from "./shell.js";
 import { naturalness } from "./charlm.js";
 import { isPlaceholder } from "./public.js";
-import { hasCredentialWord, isCredentialName, isSettingName, isVendorName, namesPasswordOrPin, words, } from "./names.js";
+import { hasCredentialWord, isCredentialName, isSettingName, isVendorName, namesPasswordOrPin, namesSession, words, } from "./names.js";
 import { lowerBound } from "./lines.js";
 import { COMMON_WORDS, hasThreeClasses, isBenignValue, isCode, isGeneratedSegment, isIdentifierShaped, isInert, isMadePassword, isPath, isPodName, isRandomToken, isWordy, readsAsWords, } from "./values.js";
 import { isSentenceWord } from "./named.js";
@@ -20,28 +20,33 @@ import { isSessionCookie } from "./structure.js";
 /**
  * Under a name the name rules didn't take, in a secret file: a value no setting has, under a vendor's bare word
  * (`STRIPE=<uuid>`, `OPENAI=Tiger1103#x`) or a name with a credential word that the in-text classifier reads otherwise
- * (`BASIC_AUTH=Harbor2291!`, `MY_SECRET_THING=…`): the file says its values are secrets. Not under a name a setting
- * has (`APP_URL`, `SSH_AUTH_SOCK`), nor a value that reads as a setting: words, numbers, versions, paths, hosts and URLs
- * (`DEBUG=true`, `REGION=us-east-1`). These findings still pass the decision stage (policy.ts), which keeps publishable
- * keys and other public values.
+ * (`BASIC_AUTH=Harbor2291!`, `MY_SECRET_THING=…`) or a session's (`INSTAGRAM_SESSION_ID`: names.ts namesSession): the
+ * file says its values are secrets. Not under a name a setting has (`APP_URL`, `SSH_AUTH_SOCK`), nor a value that reads
+ * as a setting: words, numbers, versions, paths, hosts and URLs (`DEBUG=true`, `REGION=us-east-1`). These findings
+ * still pass the decision stage (policy.ts), which keeps publishable keys and other public values.
  */
 function isOpaqueSetting(name, v, tokenUnderAnyName) {
-    if (isSettingName(name) || isPodName(v))
+    if (!mayHoldOpaque(name, tokenUnderAnyName) || isPodName(v))
         return false;
     // (Under a name that says nothing, `admin:` in `config/secrets.staging.yml`, only a generated token or a made password
     // is one, and only in a file that holds nothing else: `.env` has settings and public IDs (`GPG_KEY=<fingerprint>`).
     // Not one a word and a hyphen lead, `gradle-<hash>`: a cache's key.)
-    if (!(isBareVendorWord(name) || hasCredentialWord(name)))
-        return (tokenUnderAnyName &&
-            (isRandomToken(v, MIN_UNNAMED_TOKEN) || isMadePassword(v)) &&
-            !isSettingShaped(v) &&
-            !/^[a-z]{2,}-/i.test(v));
+    if (!(isBareVendorWord(name) || hasCredentialWord(name) || namesSession(name)))
+        return (isRandomToken(v, MIN_UNNAMED_TOKEN) || isMadePassword(v)) && !isSettingShaped(v) && !/^[a-z]{2,}-/i.test(v);
     if (/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(v))
         return true;
     // (Letters alone are a word, `livemode`, unless random, `XGxAdcVIefCUMAVsDhkYhErsQwPz`. Digits with symbols are a
     // password, `90210!@#`: a number a setting holds is setting-shaped.)
     return !isSettingShaped(v) && (/[\d\W]/.test(v.replace(/[-_.]/g, "")) || isRandomToken(v));
 }
+/**
+ * Whether isOpaqueSetting can take a value under `name`, by the name alone: a session's, whose `ID` is no setting's;
+ * or not a setting's, and either a vendor's or credential's word, or any name in a file that holds only secrets.
+ */
+function mayHoldOpaque(name, tokenUnderAnyName) {
+    return (namesSession(name) ||
+        (!isSettingName(name) && (tokenUnderAnyName || isBareVendorWord(name) || hasCredentialWord(name))));
+}
 /** The shortest generated token taken as a secret under a name that says nothing of one: a 128-bit hex ID is 32; a 96-bit one, 24. */
 const MIN_UNNAMED_TOKEN = 24;
 /** One upper-case word: `STRIPE`, `OPENAI`. */
@@ -207,6 +212,12 @@ function assignments(text, out, tokenUnderAnyName) {
         const comment = quoted ? -1 : value.search(/[ \t]#/);
         if (comment >= 0)
             value = value.slice(0, comment).trimEnd();
+        // (A vendor's name alone holds the vendor's key, or where the vendor is: `NGROK=abc123def456.ngrok.io` is a host.)
+        const credential = (isCredentialName(name) && !(isVendorName(name) && HOST.test(value))) || /^pass$/i.test(name);
+        // (The name first: most of a large file's lines, a state file's `"name": "svc-0"`, are settings by it alone, and the
+        // value's checks cost more.)
+        if (!credential && !mayHoldOpaque(name, tokenUnderAnyName))
+            continue;
         // (A reference in code, `password: process.env.DB_PASSWORD,` in a line `grep` found in source.)
         if (!value ||
             isNotSecret(value) ||
@@ -215,8 +226,6 @@ function assignments(text, out, tokenUnderAnyName) {
             /^[|>][-+]?$|^[{[]$|^(true|false|null)$/i.test(value) ||
             isSettingNumber(name, value))
             continue;
-        // (A vendor's name alone holds the vendor's key, or where the vendor is: `NGROK=abc123def456.ngrok.io` is a host.)
-        const credential = (isCredentialName(name) && !(isVendorName(name) && HOST.test(value))) || /^pass$/i.test(name);
         if (!credential && !isOpaqueSetting(name, value, tokenUnderAnyName))
             continue;
         const start = at(m, 4)[0] + (quoted ? 1 : 0);
@@ -296,6 +305,41 @@ function htpasswd(text, out) {
     for (const m of text.matchAll(/^[\w.@-]{1,100}:(\$[\w.+=-]{1,30}\$[\w$./+=-]{8,300}|\{SSHA\}[\w+/=]{10,200})[ \t]*$/dgm))
         out.push({ start: at(m, 1)[0], end: at(m, 1)[1], kind: "password hash", rule: "file:hash", confidence: 1 });
 }
+/**
+ * Redis's ACL rules, `user worker on >password ~jobs:* +@all` (redis.conf, an aclfile): a password given or taken away,
+ * `>pw` and `<pw`, and one given or taken away as its SHA-256, `#<hash>` and `!<hash>`.
+ */
+function redisUsers(text, out) {
+    for (const line of text.matchAll(/^[ \t]*user[ \t]+\S+[ \t]+[^\r\n]+/gm))
+        for (const m of line[0].matchAll(/[ \t](?:[<>](\S+)|[#!]([0-9a-f]{64})(?![^ \t]))/dg)) {
+            const g = m[1] !== undefined ? 1 : 2;
+            const [start, end] = at(m, g);
+            out.push({
+                start: line.index + start,
+                end: line.index + end,
+                kind: g === 1 ? "password" : "password hash",
+                rule: "file:redis-acl",
+                confidence: 1,
+            });
+        }
+}
+/**
+ * A string literal of escaped bytes: key material as code writes binary, Symfony's vault key (`prod.decrypt.private.php`
+ * holds `return "\x8E\x1Fq\xC4…";`), a Python or C byte string. Read from 16 escaped bytes, half the string or more: fewer
+ * are a setting's control characters (`PS1="\x1b[32m$ "`).
+ */
+function escapedBytes(text, out) {
+    if (!/\\(?:x[0-9A-Fa-f]{2}|[0-7]{3})/.test(text))
+        return;
+    for (const m of text.matchAll(/"((?:\\.|[^"\\\r\n]){16,8192})"|'((?:\\.|[^'\\\r\n]){16,8192})'/dg)) {
+        const g = m[1] !== undefined ? 1 : 2;
+        const escaped = m[g].match(/\\(?:x[0-9A-Fa-f]{2}|[0-7]{3})/g)?.length ?? 0;
+        const bytes = m[g].replace(/\\(?:x[0-9A-Fa-f]{2}|[0-7]{3}|.)/g, ".").length;
+        if (escaped < 16 || escaped * 2 < bytes)
+            continue;
+        out.push({ start: at(m, g)[0], end: at(m, g)[1], kind: "secret", rule: "file:bytes", confidence: 0.95 });
+    }
+}
 /**
  * Lines that are one token (a bare token file, `cut -d= -f2` output), after any line number a file viewer puts in
  * front (`cat -n`, an agent's Read tool `     3→`). Not a NAME, an assignment, a comment, a section or a rule, nor
@@ -337,6 +381,8 @@ const SECRET_FILE_READERS = [
     userlist,
     cookiesTxt,
     htpasswd,
+    redisUsers,
+    escapedBytes,
     bareTokens,
 ];
 /**

package/dist/spans.d.ts

@@ -6,6 +6,14 @@ import type { Finding } from "./types.ts";
  * (Hex stays learnable: real keys are hex, and a commit SHA taught as one is over-redaction only.)
  */
 export declare function isNeverSecretShape(value: string): boolean;
+/**
+ * The password of a finding that is a login: a username and a password in one value, `user:password` or
+ * `user/password`, under a name that says it holds one (names.ts namesLogin: `NEO4J_AUTH=neo4j/…`, Bundler's
+ * `BUNDLE_<HOST>: "user:…"`). Learned and repeated on its own too, as a client takes it (`cypher-shell -u neo4j -p
+ * <it>`). Not a `:` or `/` inside another secret (a signature's `abc:<id>`), nor a URL's (its password is read in the
+ * URL); before a `/`, only a user's lower-case name (`neo4j/…`, not a base64 key's `wJalrXUtnFEMI/K7MDENG…`).
+ */
+export declare function loginPassword(f: Finding, value: string): string | undefined;
 /**
  * Whether a finding is sure enough, and long enough, to be learned as a known value and hidden wherever it appears: one
  * a rule read by a name, a format, a structure or a file, not the unnamed layer's guess about one place; and whose

package/dist/spans.js

@@ -7,6 +7,8 @@ import { naturalness } from "./charlm.js";
 import { backslashesBefore, escapeLength, UNQUOTED_READ } from "./syntax.js";
 import { leadingUrl } from "./urls.js";
 import { isPath } from "./values.js";
+import { isReplaceable } from "./known.js";
+import { namesLogin } from "./names.js";
 import { continuesAcrossWraps, isGuess, isWholeLine, layerOf, PLACEHOLDER_RULE } from "./rules.js";
 /** An Amazon Resource Name: `arn:aws:iam::483920176654:role/deploy`, in any partition. */
 const ARN = /^arn:[a-z][a-z0-9-]*:[a-z0-9-]+:[a-z0-9-]*:\d*:[\w:/.@+=,*-]+$/;
@@ -28,6 +30,19 @@ export function isNeverSecretShape(value) {
         return false;
     return (!/^https?$/i.test(url.scheme) || (!/[?#]/.test(value) && url.segments.every((s) => s.end - s.start < TOKEN_SEGMENT)));
 }
+/**
+ * The password of a finding that is a login: a username and a password in one value, `user:password` or
+ * `user/password`, under a name that says it holds one (names.ts namesLogin: `NEO4J_AUTH=neo4j/…`, Bundler's
+ * `BUNDLE_<HOST>: "user:…"`). Learned and repeated on its own too, as a client takes it (`cypher-shell -u neo4j -p
+ * <it>`). Not a `:` or `/` inside another secret (a signature's `abc:<id>`), nor a URL's (its password is read in the
+ * URL); before a `/`, only a user's lower-case name (`neo4j/…`, not a base64 key's `wJalrXUtnFEMI/K7MDENG…`).
+ */
+export function loginPassword(f, value) {
+    if (!f.name || !namesLogin(f.name) || value.includes("://"))
+        return undefined;
+    const pair = /^(?:[\w.@+-]{1,64}:|[a-z][a-z0-9._-]{0,31}\/)([^\s/:]\S*)$/.exec(value);
+    return pair && isReplaceable(pair[1]) ? pair[1] : undefined;
+}
 /**
  * Whether a finding is sure enough, and long enough, to be learned as a known value and hidden wherever it appears: one
  * a rule read by a name, a format, a structure or a file, not the unnamed layer's guess about one place; and whose

package/dist/structure.js

@@ -689,8 +689,9 @@ function commandPasswords(words, add) {
 function toolPasswords(words, add) {
     // The command starts at its first word that names a tool or a wrapper: past a prompt, a timestamp or a CI log's
     // prefix (`$ `, `2025-…Z ##[group]Run`, `xcrun`); a path names one only as the first word (`find /var/lib/mysql`
-    // runs find). Then past wrappers and assignments (shell.ts simpleCommand).
-    const names = (w, i) => (i === 0 || !/[/\\]/.test(w.text)) &&
+    // runs find), or after a process listing's columns (`  73104 /usr/bin/redis-cli -a …`). Then past wrappers and
+    // assignments (shell.ts simpleCommand).
+    const names = (w, i) => (i === 0 || !/[/\\]/.test(w.text) || isProcessColumns(words.slice(0, i))) &&
         (isWrapper(w.text) ||
             /^(?:rabbitmqctl|htpasswd|https?|httpie|steamcmd|vault|lftp|pulumi|openssl|mkpasswd)$/.test(programName(w)) ||
             USER_PASSWORD.test(programName(w)) ||
@@ -838,6 +839,16 @@ function toolPasswords(words, add) {
             addWord(rest[i], w.slice(w.indexOf("%") + 1));
     }
 }
+/**
+ * A process listing's columns before its command (`ps -eo pid,args`, `ps aux`, `pgrep -a`): a PID, and maybe a user
+ * first, then CPU and memory figures, sizes, a terminal, a state, a start time and a CPU time (`root 73104 0.0 0.1 …
+ * pts/0 Ss+ Oct10 0:00`).
+ */
+function isProcessColumns(words) {
+    return (words.some((w) => /^\d+$/.test(w.text)) &&
+        words.every((w, j) => /^(?:\d[\d.:,]*[KMG]?|\?|(?:pts|tty)\/?\w*|[RSDTtZIWXP][<NLsl+]*|[A-Z][a-z]{2}\d{1,2})$/.test(w.text) ||
+            (j === 0 && /^[a-z_][\w.-]*\+?$/.test(w.text))));
+}
 /** Adds `value`, the end of a shell word's text, as a command-line password, at the span the word wrote it in. */
 function addTail(add, word, value, quoted, rule = "structure:cli-password") {
     const { start, end } = wordSpan(word, word.text.length - value.length);

package/dist/transcript.js

@@ -20,7 +20,7 @@ import { base64Binary } from "./base64.js";
 import { findFormats } from "./formats.js";
 import { parseJson, TOOL_COMMAND_KEYS, TOOL_CONTENT_KEYS, TOOL_PATH_KEYS } from "./json.js";
 import { shellLine } from "./shell.js";
-import { isLearnable, isNeverSecretShape, merge, secretValue } from "./spans.js";
+import { isLearnable, isNeverSecretShape, loginPassword, merge, secretValue } from "./spans.js";
 import { occurrences } from "./repeats.js";
 import { isCredentialName } from "./names.js";
 import { isNamedSecret } from "./named.js";
@@ -522,8 +522,12 @@ export function redactValue(redactor, value, options = {}) {
             learned.push([leaf.text, leaf.key]);
         for (const f of found(leaf).filter(keep)) {
             const secret = secretValue(leaf.text, f);
-            if (isLearnable(f, secret))
-                learned.push([secret, f.kind]);
+            if (!isLearnable(f, secret))
+                continue;
+            learned.push([secret, f.kind]);
+            const password = loginPassword(f, secret);
+            if (password)
+                learned.push([password, f.kind]);
         }
     }
     const remember = options.learn !== false;

package/docs/creddata.svg

@@ -24,7 +24,7 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <text x="16" y="76">and Nosey Parker, then detect-secrets (the other six). Hollow: CredSweeper, which CredData's lines partly come from and whose model is trained on its labels. √ scale across; up and left is better.</text>
 <text x="16" y="116" class="title">Dev split (the fixes were made on it)</text>
 <text x="16" y="606" class="title">Test split (never seen by the fixes)</text>
-<text x="56" y="148" class="panel">credential-shaped <tspan class="tick">4,560 true, 10,661 false</tspan></text>
+<text x="56" y="148" class="panel">credential-shaped <tspan class="tick">4,560 true, 10,669 false</tspan></text>
 <line class="grid" x1="56" x2="436" y1="490" y2="490"/><text class="tick" x="50" y="494" text-anchor="end">0%</text>
 <line class="grid" x1="56" x2="436" y1="407.5" y2="407.5"/><text class="tick" x="50" y="411.5" text-anchor="end">25%</text>
 <line class="grid" x1="56" x2="436" y1="325" y2="325"/><text class="tick" x="50" y="329" text-anchor="end">50%</text>
@@ -37,7 +37,7 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <line class="grid" x1="137.3817706875497" x2="137.3817706875497" y1="160" y2="490"/><text class="tick" x="137.3817706875497" y="504" text-anchor="middle">1%</text>
 <line class="grid" x1="56" x2="56" y1="160" y2="490"/><text class="tick" x="56" y="504" text-anchor="middle">0%</text>
 <polyline fill="none" class="chain" stroke-width="2" points="296.23485612070624,307.3421052631579 337.1070378925266,262.0394736842105 347.2020908546517,250.38815789473685 389.28204733667116,227.15789473684208"/>
-<polyline fill="none" class="accent-line" stroke-width="2" points="192.2899265227932,269.56578947368416 194.3259053847075,176.28289473684208 195.88895957820986,174.03947368421052"/>
+<polyline fill="none" class="accent-line" stroke-width="2" points="192.23881939564785,269.56578947368416 194.2740347893205,176.28289473684208 195.83650285579614,174.03947368421052"/>
 <circle cx="296.23485612070624" cy="307.3421052631579" r="4" class="other ring" stroke-width="1.5"><title>gitleaks: 55.4% caught, 8.7% lost</title></circle>
 <circle cx="317.88625179591025" cy="265.73026315789474" r="4" class="other ring" stroke-width="1.5"><title>Betterleaks: 68.0% caught, 10.4% lost</title></circle>
 <circle cx="118.0617486347827" cy="476.5394736842105" r="4" class="other ring" stroke-width="1.5"><title>Kingfisher: 4.1% caught, 0.6% lost</title></circle>
@@ -48,10 +48,10 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <circle cx="337.1070378925266" cy="262.0394736842105" r="4" class="other ring" stroke-width="1.5"><title>gitleaks + Betterleaks + Kingfisher: 69.1% caught, 11.9% lost</title></circle>
 <circle cx="347.2020908546517" cy="250.38815789473685" r="4" class="other ring" stroke-width="1.5"><title>the other five but detect-secrets: 72.6% caught, 12.8% lost</title></circle>
 <circle cx="389.28204733667116" cy="227.15789473684208" r="4" class="other ring" stroke-width="1.5"><title>the other six: 79.6% caught, 16.8% lost</title></circle>
-<circle cx="192.2899265227932" cy="269.56578947368416" r="5" class="accent ring" stroke-width="1.5"><title>guessing off: 66.8% caught, 2.8% lost</title></circle>
-<circle cx="194.3259053847075" cy="176.28289473684208" r="5" class="accent ring" stroke-width="1.5"><title>guessing confident: 95.1% caught, 2.9% lost</title></circle>
-<circle cx="195.88895957820986" cy="174.03947368421052" r="5" class="accent ring" stroke-width="1.5"><title>guessing eager: 95.7% caught, 3.0% lost</title></circle>
-<text x="202.3259053847075" y="180.28289473684208" text-anchor="start" class="ours" font-size="11">redac---n</text>
+<circle cx="192.23881939564785" cy="269.56578947368416" r="5" class="accent ring" stroke-width="1.5"><title>guessing off: 66.8% caught, 2.8% lost</title></circle>
+<circle cx="194.2740347893205" cy="176.28289473684208" r="5" class="accent ring" stroke-width="1.5"><title>guessing confident: 95.1% caught, 2.9% lost</title></circle>
+<circle cx="195.83650285579614" cy="174.03947368421052" r="5" class="accent ring" stroke-width="1.5"><title>guessing eager: 95.7% caught, 3.0% lost</title></circle>
+<text x="202.2740347893205" y="180.28289473684208" text-anchor="start" class="ours" font-size="11">redac---n</text>
 <line class="lead" x1="127.37318697497005" y1="172.39473684210526" x2="135.37318697497005" y2="187.39473684210526"/>
 <text x="135.37318697497005" y="197.39473684210526" text-anchor="start" font-size="11">CredSweeper (tuned on CredData)</text>
 <text x="381.28204733667116" y="219.15789473684208" text-anchor="end" font-size="11">the other six</text>
@@ -135,7 +135,7 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <text x="928" y="524" class="tick">Catch under 1%, not drawn (caught / lost):</text>
 <text x="928" y="538" class="tick">gitleaks 0.9% / 0.00%, Kingfisher 0.9% / 0.01%</text>
 <text x="928" y="552" class="tick">TruffleHog 0.1% / 0.16%</text>
-<text x="1364" y="148" class="panel">other <tspan class="tick">859 true, 12,428 false</tspan></text>
+<text x="1364" y="148" class="panel">other <tspan class="tick">859 true, 12,420 false</tspan></text>
 <line class="grid" x1="1364" x2="1744" y1="490" y2="490"/><text class="tick" x="1358" y="494" text-anchor="end">0%</text>
 <line class="grid" x1="1364" x2="1744" y1="407.5" y2="407.5"/><text class="tick" x="1358" y="411.5" text-anchor="end">25%</text>
 <line class="grid" x1="1364" x2="1744" y1="325" y2="325"/><text class="tick" x="1358" y="329" text-anchor="end">50%</text>
@@ -148,7 +148,7 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <line class="grid" x1="1433.1375440697743" x2="1433.1375440697743" y1="160" y2="490"/><text class="tick" x="1433.1375440697743" y="504" text-anchor="middle">0.5%</text>
 <line class="grid" x1="1364" x2="1364" y1="160" y2="490"/><text class="tick" x="1364" y="504" text-anchor="middle">0%</text>
 <polyline fill="none" class="chain" stroke-width="2" points="1440.9615288509585,460.034924330617 1570.4349403937827,453.8882421420256 1579.0134163971384,448.8940628637951 1697.282047336671,413.9348079161816"/>
-<polyline fill="none" class="accent-line" stroke-width="2" points="1434.7106781186549,291.7694994179278 1443.9037882995256,282.1653084982538 1443.9037882995256,267.5669383003492"/>
+<polyline fill="none" class="accent-line" stroke-width="2" points="1434.7334476179146,291.7694994179278 1443.929518066188,282.1653084982538 1443.929518066188,267.5669383003492"/>
 <circle cx="1440.9615288509585" cy="460.034924330617" r="4" class="other ring" stroke-width="1.5"><title>gitleaks: 9.1% caught, 0.6% lost</title></circle>
 <circle cx="1566.294530136326" cy="454.2724097788126" r="4" class="other ring" stroke-width="1.5"><title>Betterleaks: 10.8% caught, 4.3% lost</title></circle>
 <circle cx="1462.8394191060975" cy="481.9324796274738" r="4" class="other ring" stroke-width="1.5"><title>Nosey Parker: 2.4% caught, 1.0% lost</title></circle>
@@ -157,10 +157,10 @@ text { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; fill: #525
 <circle cx="1570.4349403937827" cy="453.8882421420256" r="4" class="other ring" stroke-width="1.5"><title>gitleaks + Betterleaks + Kingfisher: 10.9% caught, 4.5% lost</title></circle>
 <circle cx="1579.0134163971384" cy="448.8940628637951" r="4" class="other ring" stroke-width="1.5"><title>the other five but detect-secrets: 12.5% caught, 4.8% lost</title></circle>
 <circle cx="1697.282047336671" cy="413.9348079161816" r="4" class="other ring" stroke-width="1.5"><title>the other six: 23.1% caught, 11.6% lost</title></circle>
-<circle cx="1434.7106781186549" cy="291.7694994179278" r="5" class="accent ring" stroke-width="1.5"><title>guessing off: 60.1% caught, 0.5% lost</title></circle>
-<circle cx="1443.9037882995256" cy="282.1653084982538" r="5" class="accent ring" stroke-width="1.5"><title>guessing confident: 63.0% caught, 0.7% lost</title></circle>
-<circle cx="1443.9037882995256" cy="267.5669383003492" r="5" class="accent ring" stroke-width="1.5"><title>guessing eager: 67.4% caught, 0.7% lost</title></circle>
-<text x="1451.9037882995256" y="286.1653084982538" text-anchor="start" class="ours" font-size="11">redac---n</text>
+<circle cx="1434.7334476179146" cy="291.7694994179278" r="5" class="accent ring" stroke-width="1.5"><title>guessing off: 60.1% caught, 0.5% lost</title></circle>
+<circle cx="1443.929518066188" cy="282.1653084982538" r="5" class="accent ring" stroke-width="1.5"><title>guessing confident: 63.0% caught, 0.7% lost</title></circle>
+<circle cx="1443.929518066188" cy="267.5669383003492" r="5" class="accent ring" stroke-width="1.5"><title>guessing eager: 67.4% caught, 0.7% lost</title></circle>
+<text x="1451.929518066188" y="286.1653084982538" text-anchor="start" class="ours" font-size="11">redac---n</text>
 <text x="1425.3493565673837" y="194.73341094295694" text-anchor="start" font-size="11">CredSweeper (tuned on CredData)</text>
 <text x="1689.282047336671" y="405.9348079161816" text-anchor="end" font-size="11">the other six</text>
 <line class="lead" x1="1663.7434800728013" y1="430.22817229336437" x2="1671.7434800728013" y2="433.22817229336437"/>

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "redac---n",
-	"version": "0.0.1",
+	"version": "0.0.2",
 	"description": "Redact secrets from text and agent transcripts before they reach an untrusted model provider",
 	"keywords": [
 		"secrets",