redac---n 0.0.3 → 0.0.5

package/dist/secretfile.d.ts

@@ -16,6 +16,11 @@ export declare function findInSecretFile(text: string, { part, path }?: {
  * `--output text` rows of AWS's.
  */
 export declare function findPrintedSecret(text: string): Finding[];
+/**
+ * Whether a line is a JSON document whole: an object, an array, or a string that holds one (output encoded once more,
+ * `--query SecretString`'s `"{\"password\": …}"`). A string that holds anything else is a value (jsonString).
+ */
+export declare function isJsonDocument(line: string): boolean;
 /**
  * Where the first prompt line inside a command's output starts (a later command), or its length if none. (Not a `!`
  * line: in a command's output that is a value or an option file's directive, not a notebook's command.)

package/dist/secretfile.js

@@ -4,7 +4,7 @@
  * output under a prompt in a pasted session; and the places a secret file's content sits inside other text (a
  * diff's hunks, a heredoc that writes one, `echo … > ~/.vault_pass`).
  */
-import { commandsRun, holdsOnlySecrets, isConfigFileName, isSecretFile, printsSecret, printsSecretFile, } from "./commands.js";
+import { commandsRun, holdsOnlySecrets, isConfigFileName, isSecretFile, pipes, printsSecret, printsSecretFile, } from "./commands.js";
 import { allRedirects, LineIndex, programName, PROMPT, simpleCommand, wordSpan } from "./shell.js";
 import { naturalness } from "./charlm.js";
 import { isPlaceholder } from "./public.js";
@@ -53,6 +53,11 @@ const MIN_UNNAMED_TOKEN = 24;
 function isBareVendorWord(name) {
     return /^[A-Z][A-Z0-9]{2,30}$/.test(name);
 }
+/**
+ * What a setting names in numbers and lower-case words: a platform (`linux/amd64`, `linux/arm64/v8`), a size
+ * (`1920x1080`), a port and its protocol (`8080/tcp`, `5000-5010/udp`).
+ */
+const PLATFORM_OR_MEASURE = /^[a-z][a-z0-9_.-]{0,30}(?:\/[a-z0-9][a-z0-9_.-]{0,30}){1,3}$|^\d+x\d+$|^\d+(?:-\d+)?\/(?:tcp|udp|sctp)$/;
 /** A host's name, and its port: `db.internal:5432`, `abc123def456.ngrok.io`. */
 const HOST = /^[\w-]+(?:\.[a-z][\w-]*)+(?::\d+)?$/;
 /**
@@ -65,6 +70,7 @@ function isSettingShaped(v) {
         isPasswordlessUrl(v) ||
         /^[\w.+-]+@[\w-]+(?:\.[\w-]+)+$/.test(v) ||
         /^v?\d+(?:[.:-]\d+)*$/.test(v) ||
+        PLATFORM_OR_MEASURE.test(v) ||
         HOST.test(v) ||
         isWordySetting(v) ||
         isIdentifierShaped(v) ||
@@ -168,9 +174,10 @@ function isOneValueLine(line) {
     const nameShaped = named !== undefined && /^(?:[a-z_][a-z0-9_.-]*|[A-Z_][A-Z0-9_.-]*|[a-z]+(?:[A-Z][a-z]+)+)$/.test(named);
     if (line.length > 1000 || /[=:]\s|:\/\//.test(line) || nameShaped)
         return false;
-    // One token in brackets is the value, brackets and all: `{Kd8pQ2zX9mL}`.
-    if (/^(?:\[[^\s\]]*\]|\{[^\s}]*\}|<[^\s>]*>)$/.test(line) && !/[:,=]/.test(line))
-        return true;
+    // One token in brackets is the value, brackets and all: `{Kd8pQ2zX9mL}`. (Not an empty document, `{}`, `[]`, nor an
+    // INI file's section, `[default]`, `[core]`: its name reads as a setting's.)
+    if (/^(?:\[[^\s\]]+\]|\{[^\s}]+\}|<[^\s>]+>)$/.test(line) && !/[:,=]/.test(line))
+        return !(line.startsWith("[") && isSettingShaped(line.slice(1, -1)));
     // (A netrc entry is read by its keywords, spacedKeywords: `machine github.com login x password ${GITHUB_TOKEN}`.)
     const structured = /^#[ \t!#]|^\[[^\]]*\]$|^\{[\s\S]*\}$|^<[\s\S]*>$|^["{[][\s\S]*[:,]|^(?:machine[ \t]+\S+|default)[ \t]+(?:login|password|account)[ \t]/.test(line);
     // (Nor a keyword and a reference: `requirepass ${REDIS_PASSWORD}`, its value read elsewhere.)
@@ -245,7 +252,10 @@ const TABLE_WORD = /^(?:true|false|null|n\/a|-+|values?|data|type|description)$/
 function tableRows(text, out) {
     for (const m of text.matchAll(/^(?:[ \t]*[│|┃║][ \t]*|[ \t]*)([\w.\-/@]{1,200})(?:[ \t]{2,}|[ \t]*[│|┃║][ \t]*)([^\s│|┃║](?:[^│|┃║\r\n]{0,4000}?[^\s│|┃║])?)[ \t]*(?:[│|┃║][^\r\n]*)?\r?$/dgm)) {
         const [, name, value] = m;
-        if (!isCredentialName(name) ||
+        // (A value that starts with `=` or a `:` is a padded assignment's, `db_password    = "…"` in a tfvars file: the
+        // assignments' reader reads it whole.)
+        if (/^(?:=|:(?!\/\/))/.test(value) ||
+            !isCredentialName(name) ||
             isNotSecret(value) ||
             isPlaceholder(value) ||
             TABLE_WORD.test(value) ||
@@ -300,9 +310,9 @@ function cookiesTxt(text, out) {
             out.push({ start: at(m, 2)[0], end: at(m, 2)[1], kind: "cookie", rule: "file:cookies", confidence: 0.95 });
     }
 }
-/** htpasswd: `user:<hash>`, a crypt hash's `$id$` (`$apr1$…`, `$2y$…`) or `{SSHA}`. (Not `admin:$ADMIN_PASSWORD`: a variable.) */
+/** htpasswd: `user:<hash>`, a crypt hash's `$id$` (`$apr1$…`, `$2y$…`) or LDAP's `{SSHA}…`. (Not `admin:$ADMIN_PASSWORD`.) */
 function htpasswd(text, out) {
-    for (const m of text.matchAll(/^[\w.@-]{1,100}:(\$[\w.+=-]{1,30}\$[\w$./+=-]{8,300}|\{SSHA\}[\w+/=]{10,200})[ \t]*$/dgm))
+    for (const m of text.matchAll(/^[\w.@-]{1,100}:(\$[\w.+=-]{1,30}\$[\w$./+=-]{8,300}|\{[A-Z][A-Z\d-]{1,20}\}[\w+/=.$-]{10,300})[ \t]*$/dgm))
         out.push({ start: at(m, 1)[0], end: at(m, 1)[1], kind: "password hash", rule: "file:hash", confidence: 1 });
 }
 /**
@@ -431,13 +441,19 @@ function firstLine(text) {
 export function findPrintedSecret(text) {
     const out = [];
     const add = (start, end) => out.push({ start, end, kind: "credential", rule: "command:prints-secret", confidence: 1 });
-    // `--output text` rows: SSM's value follows its type, Secrets Manager's is the fourth field.
-    for (const m of text.matchAll(/^(?:PARAMETER\t[^\n]*?\t(?:SecureString|String|StringList)\t([^\t\n]+)\t\d+|arn:aws:secretsmanager:[^\t\n]+\t[^\t\n]*\t[^\t\n]*\t([^\t\n]+)(?:\t[^\n]*)?)\r?$/dgm)) {
+    // `--output text` rows: SSM's value follows its type (a `PARAMETER` row, or `get-parameters`' `PARAMETERS`), Secrets
+    // Manager's is the fourth field.
+    for (const m of text.matchAll(/^(?:PARAMETERS?\t[^\n]*?\t(?:SecureString|String|StringList)\t([^\t\n]+)\t\d+|arn:aws:secretsmanager:[^\t\n]+\t[^\t\n]*\t[^\t\n]*\t([^\t\n]+)(?:\t[^\n]*)?)\r?$/dgm)) {
         const [start, end] = at(m, m[1] !== undefined ? 1 : 2);
         add(start, end);
     }
     if (out.length)
         return out;
+    // Output in an env file's lines (`heroku config:get -s`, `netlify env:list --plain`, a pulled `.env` read back): read
+    // as that file, each value by its name, so a `NEXT_PUBLIC_…` setting stays.
+    const lines = text.split("\n").filter((l) => l.trim());
+    if (lines.length && lines.every((l) => /^[ \t]*(?:export[ \t]+)?[A-Za-z_][\w.]*=/.test(l)))
+        return findInSecretFile(text, {});
     // (A path is where a credential is, not one: `GOOGLE_APPLICATION_CREDENTIALS=/workspace/secrets/sa.json`.)
     const notSecret = (line) => isInert(line) ||
         isPath(line.replace(/^[A-Za-z_][\w.-]*=/, "")) ||
@@ -451,13 +467,23 @@ export function findPrintedSecret(text) {
     const quote = firstValue === first.value ? 0 : 1;
     if (firstValue && !notSecret(firstValue) && !/^[{[]$/.test(firstValue) && readsAsValue(firstValue))
         add(first.start + quote, first.start + first.value.length - quote);
-    for (const m of text.slice(firstEnd).matchAll(/^[ \t]*(\S{6,})[ \t]*\r?$/dgm)) {
-        const value = jsonString(m[1]) ?? m[1];
-        const q = value === m[1] ? 0 : 1;
-        // (A message's tokens are not values; `[`/`{` start a JSON document's lines.)
-        if (isMessageToken(value) || /^[{[]/.test(value) || notSecret(value))
+    // (Up to a blank line: what follows one is no longer the command's output, `Perfect!` from whoever ran it. A markup
+    // tag's closer ends the output too, `</tool_result>`, on its own line or after the last one, `honeybear</output>`; an
+    // opener, `<output>`, is the harness's wrapper, not a value.)
+    const blank = /\n[ \t]*\r?\n/.exec(text.slice(firstEnd));
+    const rest = text.slice(firstEnd, blank ? firstEnd + blank.index : text.length);
+    for (const m of rest.matchAll(/^[ \t]*(\S{6,})[ \t]*\r?$/dgm)) {
+        const closed = /<\/[A-Za-z][\w:.-]*>$/.exec(m[1]);
+        const token = closed ? m[1].slice(0, closed.index) : m[1];
+        if (/^<[A-Za-z][\w:.-]*>$/.test(token))
             continue;
-        add(firstEnd + at(m, 1)[0] + q, firstEnd + at(m, 1)[1] - q);
+        const value = jsonString(token) ?? token;
+        const q = value === token ? 0 : 1;
+        // (A message's tokens are not values; `[`/`{` start a JSON document's lines.)
+        if (value.length >= 6 && !isMessageToken(value) && !/^[{[]/.test(value) && !notSecret(value))
+            add(firstEnd + at(m, 1)[0] + q, firstEnd + at(m, 1)[0] + token.length - q);
+        if (closed)
+            break;
     }
     return out;
 }
@@ -491,7 +517,7 @@ function readsAsValue(line) {
  * Whether a line is a JSON document whole: an object, an array, or a string that holds one (output encoded once more,
  * `--query SecretString`'s `"{\"password\": …}"`). A string that holds anything else is a value (jsonString).
  */
-function isJsonDocument(line) {
+export function isJsonDocument(line) {
     if (!/^(?:[{[].*[}\]]|".*")$/.test(line))
         return false;
     try {
@@ -677,7 +703,7 @@ function writtenToSecretFile(commands) {
     for (let k = 0; k < commands.length; k++) {
         const c = commands[k];
         pipeline.push(c);
-        if ((c.then === "|" || c.then === "|&") && commands[k + 1]?.host === c.host)
+        if (pipes(c) && commands[k + 1]?.host === c.host)
             continue;
         // Where it writes: a redirection's file (`>`, `>>`, `>|`, `&>`, `>&`), its groups' included, and `tee`'s.
         // (A descriptor, `2>&1`, `>&-`, is no secret file's name.)
@@ -706,9 +732,12 @@ function writtenToSecretFile(commands) {
                     if (r.op === "<<<" && r.target)
                         sections.push({ ...wordSpan(r.target), part });
             }
-            const first = simpleCommand(pipeline[0].words);
-            const program = programName(first[0]);
-            if (program === "echo" || program === "printf") {
+            // (Each of the echoes that start it, a group's several: `{ echo A=1; echo B=2; } | tee .env`.)
+            for (const p of pipeline) {
+                const first = simpleCommand(p.words);
+                const program = programName(first[0]);
+                if (program !== "echo" && program !== "printf")
+                    break;
                 const args = first.slice(1).filter((w) => !/^-[neE]+$/.test(w.text));
                 const operands = program === "printf" && args.length > 1 ? args.slice(1) : args;
                 for (const w of operands)

package/dist/shell.d.ts

@@ -45,6 +45,8 @@ export interface Heredoc {
 export interface ShellGroup {
     kind: string;
     redirects: ShellRedirect[];
+    /** The operator after the group: `|` pipes what every command in it prints (`{ echo A=1; echo B=2; } | tee .env`). */
+    then?: ShellOperator;
 }
 type ShellOperator = "|" | "|&" | "||" | "&&" | ";" | "&" | "\n" | "";
 export interface ShellCommand {
@@ -110,13 +112,20 @@ export declare function wordSpan(word: ShellWord, from?: number): {
 /** The command line an argument vector stands for, each word quoted as a shell needs it: `["bash", "-lc", "cat .env"]` → `bash -lc 'cat .env'`. */
 export declare function shellLine(argv: string[]): string;
 /**
- * A terminal prompt at the start of a line, before a command: a shell's `$ `, `user@host:~$ `, PowerShell's
- * `PS C:\> `, a notebook's `In [3]: !` or a cell's bare `!` before a command. Group 1 is the command.
+ * A terminal prompt at the start of a line, before a command. Group 1 is the command. A POSIX shell's, after a
+ * virtualenv's or conda's `(venv) `: `$ `, `user@host:~/app$ `, `root@3f2a9c1d:/app# `, RHEL's `[ec2-user@ip-10-0-1-5
+ * app]$ `, macOS zsh's `user@host app % `, a bare shell's `bash-5.1$ ` and `sh-4.2# `, busybox's `/app # `. PowerShell's
+ * `PS C:\> ` and `PS> `, cmd's `C:\app>` (no blank after it), a notebook's `In [3]: !` or a cell's bare `!` before a
+ * command. (Not root's bare `# `: a comment or a Markdown heading is written so.)
  */
 export declare const PROMPT: RegExp;
 /** Whether a word names a wrapper, a command that runs the command after it. */
 export declare function isWrapper(word: string): boolean;
-/** A program's name without its directory and Windows' `.exe`: `/usr/bin/grep` → `grep`, `.\\steamcmd.exe` → `steamcmd`. */
+/**
+ * A program's name without its directory and Windows' `.exe`: `/usr/bin/grep` → `grep`, `.\\steamcmd.exe` → `steamcmd`.
+ * PowerShell's and cmd's commands in the case the readers know them by, as both shells take any case (`get-content`,
+ * `TYPE`, `Select-string`).
+ */
 export declare function programName(word: ShellWord | undefined): string;
 /**
  * A simple command's words from the program it runs: past assignments (`FOO=1`), reserved words (`!`, `then`, `do`)

package/dist/shell.js

@@ -408,6 +408,7 @@ export function shellCommands(text, offset = 0, { backslash = true, oneLine = fa
         if (closed && !words.length) {
             // The redirections and the operator after a group's closer are the group's.
             closed.group.redirects.push(...redirects);
+            closed.group.then = then;
             const last = out.at(-1);
             if (last && out.length > closed.from)
                 last.then = then;
@@ -608,7 +609,10 @@ export function wordSpan(word, from = 0) {
     let start = word.map[from];
     let end = word.ends.at(-1);
     const raw = (k) => word.raw[k - word.start];
-    if (word.raw.slice(start - word.start, end - word.start) !== word.text.slice(from)) {
+    // (A span that starts and ends in the same quotes, or outside any, keeps the word's quotes about it as they were: the
+    // `'\''` a single-quoted password writes its quote with, `'admin:pa'\''ss'`, leaves the closing quote out.)
+    if (word.raw.slice(start - word.start, end - word.start) !== word.text.slice(from) &&
+        quoteAt(word.raw, start - word.start) !== quoteAt(word.raw, end - word.start)) {
         while (start > word.start && /["'$]/.test(raw(start - 1)))
             start--;
         while (end < word.end && /["']/.test(raw(end)))
@@ -616,15 +620,30 @@ export function wordSpan(word, from = 0) {
     }
     return { start, end };
 }
+/** The quote a shell word's raw text is inside at `at`: `'`, `"`, or "" outside quotes. */
+function quoteAt(raw, at) {
+    let quote = "";
+    for (let k = 0; k < at; k++) {
+        const c = raw[k];
+        if (c === "\\" && quote !== "'")
+            k++;
+        else if (quote ? c === quote : c === "'" || c === '"')
+            quote = quote ? "" : c;
+    }
+    return quote;
+}
 /** The command line an argument vector stands for, each word quoted as a shell needs it: `["bash", "-lc", "cat .env"]` → `bash -lc 'cat .env'`. */
 export function shellLine(argv) {
     return argv.map((w) => (/^[\w@%+=:,./-]+$/.test(w) ? w : `'${w.replace(/'/g, "'\\''")}'`)).join(" ");
 }
 /**
- * A terminal prompt at the start of a line, before a command: a shell's `$ `, `user@host:~$ `, PowerShell's
- * `PS C:\> `, a notebook's `In [3]: !` or a cell's bare `!` before a command. Group 1 is the command.
+ * A terminal prompt at the start of a line, before a command. Group 1 is the command. A POSIX shell's, after a
+ * virtualenv's or conda's `(venv) `: `$ `, `user@host:~/app$ `, `root@3f2a9c1d:/app# `, RHEL's `[ec2-user@ip-10-0-1-5
+ * app]$ `, macOS zsh's `user@host app % `, a bare shell's `bash-5.1$ ` and `sh-4.2# `, busybox's `/app # `. PowerShell's
+ * `PS C:\> ` and `PS> `, cmd's `C:\app>` (no blank after it), a notebook's `In [3]: !` or a cell's bare `!` before a
+ * command. (Not root's bare `# `: a comment or a Markdown heading is written so.)
  */
-export const PROMPT = /^[ \t]*(?:\$ |In \[\d*\]:[ \t]*!|PS [^>\n]{0,200}> |[\w.-]+@[\w.-]+:[^\n$#]{0,200}[$#] |!(?=[a-z]))[ \t]*(\S[^\n]{0,2000})/;
+export const PROMPT = /^[ \t]*(?:(?:\([\w.-]{1,40}\)[ \t]+)?(?:\$ |[\w.-]+@[\w.-]+:[^\n$#]{0,200}[$#] |\[[\w.-]+@[\w.-]+(?:[ \t][^\]\n]{0,200})?\][$#] |[\w.-]+@[\w.-]+[ \t]\S{1,200}[ \t][%$#] |[a-z]+-\d+(?:\.\d+)*[$#] |[~/][\w./~-]{0,200}[ \t]#[ \t])|In \[\d*\]:[ \t]*!|PS(?: [^>\n]{0,200})?> |[A-Za-z]:\\[^<>|"\n]{0,200}>|!(?=[a-z]))[ \t]*(\S[^\n]{0,2000})/;
 /** Words before a simple command's own (`!` negates it); `then`, `do`, `else` open a group's commands. */
 const RESERVED = new Set(["!", "if", "then", "else", "elif", "do", "while", "until"]);
 /**
@@ -637,7 +656,8 @@ const WRAPPERS = new Map([
         { values: "ugCDhprtTUR", long: /^--(?:user|group|chdir|host|prompt|role|type|close-from|other-user|chroot)$/ },
     ],
     ["doas", { values: "uC" }],
-    ["runuser", { values: "ugl", long: /^--(?:user|group)$/ }],
+    // (`runuser -u app cmd`; with no `-u` it is su's twin, `runuser -l app -c 'cmd'`, and its `-l` is `--login`.)
+    ["runuser", { values: "ug", long: /^--(?:user|group)$/ }],
     ["env", { values: "uCS", long: /^--(?:unset|chdir|split-string)$/ }],
     ["timeout", { values: "sk", long: /^--(?:signal|kill-after)$/, operands: 1 }],
     ["nice", { values: "n", long: /^--adjustment$/ }],
@@ -661,10 +681,34 @@ const WRAPPERS = new Map([
 export function isWrapper(word) {
     return WRAPPERS.has(word);
 }
-/** A program's name without its directory and Windows' `.exe`: `/usr/bin/grep` → `grep`, `.\\steamcmd.exe` → `steamcmd`. */
+/**
+ * A program's name without its directory and Windows' `.exe`: `/usr/bin/grep` → `grep`, `.\\steamcmd.exe` → `steamcmd`.
+ * PowerShell's and cmd's commands in the case the readers know them by, as both shells take any case (`get-content`,
+ * `TYPE`, `Select-string`).
+ */
 export function programName(word) {
-    return (word?.text ?? "").replace(/^.*[/\\]/, "").replace(/\.exe$/i, "");
+    const name = (word?.text ?? "").replace(/^.*[/\\]/, "").replace(/\.exe$/i, "");
+    return WINDOWS_COMMANDS.get(name.toLowerCase()) ?? name;
 }
+/** PowerShell's cmdlets and aliases and cmd's builtins that the readers name, by their names in lower case. */
+const WINDOWS_COMMANDS = new Map([
+    "Get-Content",
+    "Select-String",
+    "Write-Output",
+    "Write-Host",
+    "Get-Item",
+    "Get-ChildItem",
+    "Get-Secret",
+    "gc",
+    "sls",
+    "gci",
+    "gi",
+    "type",
+    "findstr",
+    "pwsh",
+    "powershell",
+    "cmd",
+].map((name) => [name.toLowerCase(), name]));
 /**
  * A simple command's words from the program it runs: past assignments (`FOO=1`), reserved words (`!`, `then`, `do`)
  * and wrappers with their options and operands (`sudo -iu app`, `env -i`, `timeout 5`, `nice -n 10`, `xargs -I{}`).

package/dist/spans.d.ts

@@ -24,9 +24,10 @@ export declare function isLearnable(f: Finding, value: string, minConfidence?: n
  * The secret a finding covers, as the program reads it, so one secret written two ways gets one tag and is learned
  * once: its recorded value (a known value whichever way it was written, a literal split in pieces joined, a JSON
  * escape decoded); or the text it spans, read through a URL's percent-encoding (a userinfo's `Harbor2291%21x`, a
- * query's `%26`, `+` a blank), a double-quoted string's escapes (`"Ab\"cd9"`, `\u0041`), or a shell's backslashes
- * outside quotes (`Harbor2291\!x`). (Not a single-quoted string's: a shell's has no escapes, a SQL one doubles its
- * quote, and `'a''b'` is `ab` to a shell.)
+ * query's `%26`, `+` a blank), a double-quoted string's escapes (JSON's, `"Ab\"cd9"`, `\u0041`, or else a shell's,
+ * `"Ab\$cd9"`), a single-quoted one's quote written inside it (YAML's and SQL's `'Ab''cd9'`, a shell's `'Ab'\''cd9'`,
+ * JavaScript's and Python's `'Ab\'cd9'`), or a shell's backslashes outside quotes (`Harbor2291\!x`, `Ab\ cd9`).
+ * (A single-quoted string's other backslashes stay: a shell's has no escapes.)
  */
 export declare function secretValue(text: string, f: {
     start: number;

package/dist/spans.js

@@ -59,9 +59,10 @@ export function isLearnable(f, value, minConfidence = 0.9) {
  * The secret a finding covers, as the program reads it, so one secret written two ways gets one tag and is learned
  * once: its recorded value (a known value whichever way it was written, a literal split in pieces joined, a JSON
  * escape decoded); or the text it spans, read through a URL's percent-encoding (a userinfo's `Harbor2291%21x`, a
- * query's `%26`, `+` a blank), a double-quoted string's escapes (`"Ab\"cd9"`, `\u0041`), or a shell's backslashes
- * outside quotes (`Harbor2291\!x`). (Not a single-quoted string's: a shell's has no escapes, a SQL one doubles its
- * quote, and `'a''b'` is `ab` to a shell.)
+ * query's `%26`, `+` a blank), a double-quoted string's escapes (JSON's, `"Ab\"cd9"`, `\u0041`, or else a shell's,
+ * `"Ab\$cd9"`), a single-quoted one's quote written inside it (YAML's and SQL's `'Ab''cd9'`, a shell's `'Ab'\''cd9'`,
+ * JavaScript's and Python's `'Ab\'cd9'`), or a shell's backslashes outside quotes (`Harbor2291\!x`, `Ab\ cd9`).
+ * (A single-quoted string's other backslashes stay: a shell's has no escapes.)
  */
 export function secretValue(text, f) {
     if (f.value !== undefined)
@@ -81,10 +82,19 @@ export function secretValue(text, f) {
         try {
             return JSON.parse(`"${raw}"`);
         }
-        catch { } // not JSON's escapes: the text as it is
+        catch { } // not JSON's escapes: a shell's, or the text as it is
+        return raw.replace(/\\([$`"\\])/g, "$1");
     }
-    if (/\\[^\w\s]/.test(raw) && !/["'`]$/.test(before))
-        return raw.replace(/\\([^\w\s])/g, "$1");
+    if (/'$/.test(before) && raw.includes("'")) {
+        // (`\'` is no shell's, whose single quotes hold no escapes: a language's that has them, `\\` included.)
+        if (/'\\''/.test(raw))
+            return raw.replace(/'\\''/g, "'");
+        if (/\\'/.test(raw))
+            return raw.replace(/\\(['\\])/g, "$1");
+        return raw.replace(/''/g, "'");
+    }
+    if (/\\[^\w\n]/.test(raw) && !/["'`]$/.test(before))
+        return raw.replace(/\\([^\w\n])/g, "$1");
     return raw;
 }
 /** The escape sequence covering position `i` (after its backslash), as [backslash, end), if `i` is inside one. */
@@ -154,8 +164,28 @@ function preferNarrower(findings) {
         return true;
     });
 }
+/**
+ * A token's character, where a format that stops before it may have been cut and its tail is still secret: a
+ * percent-encoded one too (a session token's `%2B` in a URL); a dot only inside a token (`hvs.…`), not a sentence's
+ * full stop.
+ */
+const TOKEN_CHAR = /^(?:[\w+/=~-]|\.\w|%[0-9A-Fa-f])/;
+/**
+ * Whether `f`, starting with or inside a format's token `token`, runs past it only by reading on into what follows it
+ * (`ghp_…;git push`, `ghp_…&q=foo`, `ghp_…#top`): an unquoted value read to the next blank. The format's regex bounds
+ * the token, so the rest is the text after it, not more of the secret. (A finding that starts before the token, a
+ * quote or a prefix, or a token that stops before a token character, may have been cut: those widen.)
+ */
+function runsPastToken(text, token, f) {
+    return (text !== undefined &&
+        layerOf(token.rule) === "format" &&
+        token.confidence > f.confidence &&
+        f.start >= token.start &&
+        f.end > token.end &&
+        !TOKEN_CHAR.test(text.slice(token.end, token.end + 3)));
+}
 /** Overlapping findings as one span each, every field but the span the most confident one's. */
-function union(findings) {
+function union(findings, text) {
     const sorted = [...findings].sort((a, b) => a.start - b.start || b.end - a.end);
     const out = [];
     for (const f of sorted) {
@@ -166,6 +196,12 @@ function union(findings) {
             out.push({ ...f });
             continue;
         }
+        if (runsPastToken(text, last, f))
+            continue;
+        if (runsPastToken(text, f, last)) {
+            out[out.length - 1] = { ...f };
+            continue;
+        }
         const end = Math.max(last.end, f.end);
         const winner = f.confidence > last.confidence ? f : last;
         // (A value goes with its own span only: `last` may start earlier or `f` end later than the winner.)
@@ -223,11 +259,46 @@ export function trimmedToValue(text, f) {
     }
     if (end - start > 1 && /[,;]/.test(text[end - 1]) && /^[ \t]+[A-Za-z_][\w.-]*=/.test(text.slice(end, end + 80)))
         end--;
+    else if (layerOf(f.rule) === "named" && !/["'`]/.test(q ?? ""))
+        end = start + nextSetting(text.slice(start, end));
     return start === f.start && end === f.end ? f : { ...f, start, end };
 }
+/**
+ * Settings that end an unquoted value read to the next blank: `;`, `,` or `&`, a name of a word's shape (lower case,
+ * upper case or camel case, at least two letters), `=` and a plain value, to the end (`;username=bob`,
+ * `,DB_HOST=db,DB_PORT=5432`, `&page=2&sort=desc`). A password's own punctuation seldom reads that way to its end
+ * (`86)68/C{,C=wyhJH9`, `Nakp&nDiqWJ-K=nW`).
+ */
+const SETTINGS_AFTER = /[;,&](?=[\w.-]*[A-Za-z][\w.-]*[A-Za-z])(?:[a-z][a-z0-9]*(?:[_.-][a-z0-9]+)*|[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*|[a-z]+(?:[A-Z][a-z0-9]+)+)=[\w.:/@+-]*(?=[;,&]|$)/y;
+/**
+ * Where an unquoted value read to the next blank ends at the settings after it of a list it is in, with no blank
+ * between (`password=Kx9…;username=bob`, `A=…,B=db`): the value's length up to there, or all of it. Not in a value that
+ * is itself a list of settings or a URL (an `=` or `?` before), whose own separators these are (`DSN=host=db;password=…`),
+ * and not after a value too short to be one.
+ */
+const readsAsName = (setting) => naturalness(setting
+    .slice(1, setting.indexOf("="))
+    .replace(/[_.-]+/g, " ")
+    .toLowerCase()) > 0;
+function nextSetting(value) {
+    const list = value.search(/=+[^=;,&]|\?|:\/\//);
+    const separators = /[;,&]/g;
+    for (let m; (m = separators.exec(value)) && (list < 0 || m.index < list);) {
+        if (m.index < 6)
+            continue;
+        let at = m.index;
+        SETTINGS_AFTER.lastIndex = at;
+        // (A setting's name reads as words, `username`, `DB_HOST`; a random password's `;jAnr=` or `;uKj=` doesn't.)
+        for (let s; at < value.length && (s = SETTINGS_AFTER.exec(value)) && readsAsName(s[0]);)
+            at = SETTINGS_AFTER.lastIndex;
+        if (at === value.length)
+            return m.index;
+    }
+    return value.length;
+}
 /** Findings merged into one span each, sorted; with `text`, kept off escape sequences. (The inputs aren't changed.) */
 export function merge(findings, text) {
-    return union(preferNarrower(text ? findings.map((f) => onEscapes(text, f)) : findings));
+    return union(preferNarrower(text ? findings.map((f) => onEscapes(text, f)) : findings), text);
 }
 /** The first of `sorted` (merged, sorted by start) that ends after `start`, by binary search. */
 function firstEndingAfter(sorted, start) {

package/dist/sql.d.ts

@@ -1,8 +1,9 @@
 /**
- * SQL `INSERT … VALUES` statements read into cells: each row's values under their table and column. One reader for
- * every rule that asks what a value in a row is: the name layer hides a credential column's values (named.ts sqlRows),
- * the random layer keeps the other columns' IDs and data (context.ts, `sqlCell`). A statement without a column list
- * (`INSERT INTO t VALUES …`, as mysqldump writes by default) names no column, so it isn't read.
+ * SQL rows read into cells: each value of an `INSERT … VALUES` statement, or of a `COPY … FROM stdin` block as
+ * pg_dump writes its data, under its table and column. One reader for every rule that asks what a value in a row is:
+ * the name layer hides a credential column's values (named.ts sqlRows), the random layer keeps the other columns'
+ * IDs and data (context.ts, `sqlCell`). A statement without a column list (`INSERT INTO t VALUES …`, as mysqldump
+ * writes by default) names no column, so it isn't read.
  */
 import { type Argument } from "./calls.ts";
 export interface SqlCell {
@@ -10,11 +11,14 @@ export interface SqlCell {
     table: string;
     /** The column, without quotes: `password` in `"password"`, `` `password` ``, `[password]`. */
     column: string;
-    /** The value as an argument of the row: a string literal's content is its `literal`. */
+    /** The value as an argument of the row: the string it gives the column is its `literal` (sqlLiteral). */
     value: Argument;
+    /** The row's columns and values, the cell's among them: what a key/value table's value is named by. */
+    columns: readonly string[];
+    row: readonly Argument[];
 }
 /**
- * The cells of every `INSERT` in `text`, row by row (up to 10,000 rows a statement); with `wants`, only of the
- * statements whose table and columns it accepts (so a dump's other tables cost no reading).
+ * The cells of every `INSERT` and `COPY` in `text`, row by row (up to 10,000 rows a statement); with `wants`, only of
+ * the statements whose table and columns it accepts (so a dump's other tables cost no reading).
  */
-export declare function insertCells(text: string, wants?: (table: string, columns: string[]) => boolean): Generator<SqlCell>;
+export declare function sqlCells(text: string, wants?: (table: string, columns: string[]) => boolean): Generator<SqlCell>;

package/dist/sql.js

@@ -1,27 +1,36 @@
 /**
- * SQL `INSERT … VALUES` statements read into cells: each row's values under their table and column. One reader for
- * every rule that asks what a value in a row is: the name layer hides a credential column's values (named.ts sqlRows),
- * the random layer keeps the other columns' IDs and data (context.ts, `sqlCell`). A statement without a column list
- * (`INSERT INTO t VALUES …`, as mysqldump writes by default) names no column, so it isn't read.
+ * SQL rows read into cells: each value of an `INSERT … VALUES` statement, or of a `COPY … FROM stdin` block as
+ * pg_dump writes its data, under its table and column. One reader for every rule that asks what a value in a row is:
+ * the name layer hides a credential column's values (named.ts sqlRows), the random layer keeps the other columns'
+ * IDs and data (context.ts, `sqlCell`). A statement without a column list (`INSERT INTO t VALUES …`, as mysqldump
+ * writes by default) names no column, so it isn't read.
  */
-import { callArguments, closingBracket } from "./calls.js";
+import { callArguments, closingBracket, literalAt } from "./calls.js";
 import { delimitedCells } from "./syntax.js";
 /** An identifier as SQL dialects quote it: `"name"`, `` `name` ``, `[name]`. */
 const unquote = (name) => name.trim().replace(/^["`[]|["`\]]$/g, "");
+/** A table's name as any dialect quotes it: `"my table"`, `` `app`.`users` ``, `[dbo].[users]`. */
+const TABLE = String.raw `((?:"[^"\n]{1,100}"|\x60[^\x60\n]{1,100}\x60|\[[^\]\n]{1,100}\]|[\w.]){1,200})`;
 /**
  * `INSERT [INTO] <table> (<columns>) VALUES`, and the dialects' other forms (`INSERT IGNORE`, `INSERT OR REPLACE`,
- * `REPLACE INTO`), the table quoted as any dialect quotes it (`"my table"`, `` `app`.`users` ``, `[dbo].[users]`).
+ * `REPLACE INTO`).
  */
-const INSERT = /\b(?:INSERT(?:\s+IGNORE|\s+OR\s+(?:REPLACE|IGNORE|ABORT|FAIL|ROLLBACK))?|REPLACE)\s+(?:INTO\s+)?((?:"[^"\n]{1,100}"|`[^`\n]{1,100}`|\[[^\]\n]{1,100}\]|[\w.]){1,200})\s*\(([^()]{1,2000})\)\s*VALUES\s*/gi;
+const INSERT = new RegExp(String.raw `\b(?:INSERT(?:\s+IGNORE|\s+OR\s+(?:REPLACE|IGNORE|ABORT|FAIL|ROLLBACK))?|REPLACE)\s+(?:INTO\s+)?${TABLE}\s*\(([^()]{1,2000})\)\s*VALUES\s*`, "gi");
+/** `COPY <table> (<columns>) FROM stdin;` and its line break: pg_dump's data, one tab-separated row a line after it. */
+const COPY = new RegExp(String.raw `(?:^|\n)COPY\s+${TABLE}\s*\(([^()]{1,2000})\)\s+FROM\s+stdin\b[^;\n]{0,200};[ \t]*\r?\n`, "gi");
 /** What may stand between two rows: blanks, comments and one comma. */
 const BETWEEN_ROWS = /(?:\s|--[^\n]*|\/\*[\s\S]{0,2000}?\*\/)*,?(?:\s|--[^\n]*|\/\*[\s\S]{0,2000}?\*\/)*/y;
 /**
- * The cells of every `INSERT` in `text`, row by row (up to 10,000 rows a statement); with `wants`, only of the
- * statements whose table and columns it accepts (so a dump's other tables cost no reading).
+ * The cells of every `INSERT` and `COPY` in `text`, row by row (up to 10,000 rows a statement); with `wants`, only of
+ * the statements whose table and columns it accepts (so a dump's other tables cost no reading).
  */
-export function* insertCells(text, wants) {
-    if (!/\b(?:INSERT|REPLACE)\b/i.test(text))
-        return;
+export function* sqlCells(text, wants) {
+    if (/\b(?:INSERT|REPLACE)\b/i.test(text))
+        yield* insertCells(text, wants);
+    if (/\bCOPY\b/i.test(text))
+        yield* copyCells(text, wants);
+}
+function* insertCells(text, wants) {
     for (const m of text.matchAll(INSERT)) {
         const table = unquote(m[1].split(".").at(-1));
         const columns = delimitedCells(m[2], ",").map((c) => unquote(c.text));
@@ -33,8 +42,10 @@ export function* insertCells(text, wants) {
         if (text[at] === "(" && closingBracket(text, at + 1) < 0) {
             const end = text.indexOf("\n", at);
             const line = text.slice(m.index, end < 0 ? undefined : end);
-            for (const cell of rowCells(line, at - m.index, table, columns))
-                yield { ...cell, value: shifted(cell.value, m.index) };
+            for (const cell of rowCells(line, at - m.index, table, columns)) {
+                const row = cell.row.map((a) => shifted(a, m.index));
+                yield { ...cell, value: row[cell.row.indexOf(cell.value)], row };
+            }
         }
         else
             yield* rowCells(text, at, table, columns);
@@ -44,17 +55,84 @@ export function* insertCells(text, wants) {
 function* rowCells(text, at, table, columns) {
     for (let row = 0; row < 10_000 && text[at] === "("; row++) {
         // (A row cut short, a dump's `head`, ends the rows. callArguments reads to the bracket closingBracket finds.)
-        const values = callArguments(text, at + 1);
+        const values = callArguments(text, at + 1)?.map((value) => withLiteral(text, value));
         if (!values)
             break;
         const close = closingBracket(text, at + 1);
         for (const [k, value] of values.entries())
             if (columns[k])
-                yield { table, column: columns[k], value };
+                yield { table, column: columns[k], value, columns, row: values };
         BETWEEN_ROWS.lastIndex = close + 1;
         at = close + 1 + BETWEEN_ROWS.exec(text)[0].length;
     }
 }
+/**
+ * The cells of `COPY … FROM stdin` blocks: tab-separated rows up to the `\.` line, each value as written (a `\N` is
+ * NULL, no value). (Up to 10,000 rows a block, as for an INSERT's.)
+ */
+function* copyCells(text, wants) {
+    for (const m of text.matchAll(COPY)) {
+        const table = unquote(m[1].split(".").at(-1));
+        const columns = delimitedCells(m[2], ",").map((c) => unquote(c.text));
+        if (wants && !wants(table, columns))
+            continue;
+        let at = m.index + m[0].length;
+        for (let n = 0; n < 10_000 && at < text.length; n++) {
+            const stop = text.indexOf("\n", at);
+            const end = stop < 0 ? text.length : stop;
+            const line = text.slice(at, end).replace(/\r$/, "");
+            if (line === "\\." || !line.includes("\t"))
+                break;
+            const row = [];
+            let start = at;
+            for (const value of line.split("\t")) {
+                const span = { value, start, end: start + value.length };
+                row.push({
+                    text: value,
+                    start,
+                    end: span.end,
+                    ...(value === "\\N" ? {} : { literal: { ...span, quote: "" } }),
+                });
+                start = span.end + 1;
+            }
+            for (const [k, value] of row.entries())
+                if (columns[k])
+                    yield { table, column: columns[k], value, columns, row };
+            at = end + 1;
+        }
+    }
+}
+/**
+ * The string a row's value gives its column, read through SQL's own ways of writing one: a prefix (`N'…'`, `E'…'`,
+ * calls.ts reads those), dollar quoting (`$$…$$`, `$body$…$body$`), a cast (`'…'::text`) and the functions a value is
+ * stored through (`crypt('…', gen_salt('bf'))`, `MD5('…')`, `encode(digest('…', 'sha256'), 'hex')`), which are given it
+ * first. Undefined for any other expression, and for a number.
+ */
+function sqlLiteral(text, value, depth = 0) {
+    if (value.literal)
+        return value.literal;
+    const literal = literalAt(text, value.start);
+    if (literal && literal.end < value.end) {
+        const rest = text.slice(literal.end + 1, value.end);
+        return CAST_TAIL.test(rest) ? literal : undefined;
+    }
+    // (A function's first argument, read the same way, not too deep to stay cheap: the functions a value is stored
+    // through, `encode(digest('…', 'sha256'), 'hex')`, are given it first.)
+    const call = /^[A-Za-z_][\w.]{0,60}[ \t]*\(/.exec(value.text);
+    if (!call ||
+        depth >= 3 ||
+        !CAST_TAIL.test(text.slice(closingBracket(text, value.start + call[0].length) + 1, value.end)))
+        return undefined;
+    const first = callArguments(text, value.start + call[0].length)?.[0];
+    return first && sqlLiteral(text, first, depth + 1);
+}
+/** What may follow a string and leave it the value: Postgres' casts, `::text`, `::character varying(255)`, `::bytea[]`. */
+const CAST_TAIL = /^(?:[ \t]*::[ \t]*[A-Za-z_][\w ."]{0,60}?(?:\([\d, ]{1,12}\))?(?:\[\])?)*[ \t]*$/;
+/** A row's value with the string it gives its column as its literal (sqlLiteral). */
+function withLiteral(text, value) {
+    const literal = sqlLiteral(text, value);
+    return literal && !value.literal ? { ...value, literal } : value;
+}
 /** An argument read from a piece of a text, placed where the piece starts in it. */
 function shifted(a, by) {
     return {