redac---n 0.0.4 → 0.0.5

package/README.md

@@ -32,15 +32,15 @@ came from, and see what would be sent. The library runs in the page, so nothing
 
 ![Secrets caught against look-alike values destroyed, redac---n and seven open-source scanners](docs/holdout.svg)
 
-On a held-out set of realistic agent output (1,112 cases, never used for tuning), redac---n catches **93.0%** of
-secrets and destroys **3.0%** of the values that look like secrets but aren't. The best combination of existing
+On a held-out set of realistic agent output (1,112 cases, never used for tuning), redac---n catches **92.6%** of
+secrets and destroys **2.9%** of the values that look like secrets but aren't. The best combination of existing
 scanners we found catches 70.6% and destroys 2.2%; all seven together catch 84.2% but destroy 28.6% of the
 look-alikes.
 
 | | secrets caught | look-alikes destroyed |
 |---|---:|---:|
-| **redac---n** (default) | **93.0%** | **3.0%** |
-| redac---n, `guessing: "off"` | 90.9% | 1.1% |
+| **redac---n** (default) | **92.6%** | **2.9%** |
+| redac---n, `guessing: "off"` | 90.5% | 0.9% |
 | gitleaks + Betterleaks + Kingfisher | 70.6% | 2.2% |
 | all seven scanners combined | 84.2% | 28.6% |
 | CredSweeper, the best single scanner | 70.1% | 15.2% |
@@ -81,7 +81,7 @@ and then became development data. Secrets caught / look-alikes destroyed at that
 
 | set | redac---n | `guessing: "off"` | gitleaks + Betterleaks + Kingfisher | best single other scanner |
 |---|---:|---:|---:|---:|
-| Held-out 1: 1,112 cases over 104 kinds of output | 93.0 / 3.0 | 90.9 / 1.1 | 70.6 / 2.2 | CredSweeper 70.1 / 15.2 |
+| Held-out 1: 1,112 cases over 104 kinds of output | 92.6 / 2.9 | 90.5 / 0.9 | 70.6 / 2.2 | CredSweeper 70.1 / 15.2 |
 | Held-out 2: 848 cases from blind template writers | 86.8 / 5.7 | 78.3 / 3.7 | 60.3 / 5.1 | CredSweeper 65.7 / 20.1 |
 | Held-out 3: 450 cases, mobile, ML, IoT, enterprise stacks, other CI vendors | 85.5 / 7.4 | 78.5 / 3.2 | 64.0 / 4.8 | CredSweeper 69.4 / 21.0 |
 | Held-out 4: 478 everyday agent sessions, issue and PR threads | 90.4 / 1.9 | 86.7 / 0.7 | 66.2 / 3.6 | CredSweeper 74.1 / 20.4 |
@@ -89,6 +89,7 @@ and then became development data. Secrets caught / look-alikes destroyed at that
 | Held-out 6: 112 cases from regional clouds and payment APIs | 93.2 / 9.3 | 78.9 / 5.8 | 61.7 / 3.1 | CredSweeper 73.7 / 18.1 |
 | Held-out 7: 305 cases from databases, queues, observability, build tooling | 93.4 / 8.5 | 85.1 / 3.8 | 69.6 / 3.1 | CredSweeper 67.5 / 19.8 |
 | Held-out 8: 261 cases from data and analytics tooling | 89.0 / 1.5 | 83.7 / 0.8 | 67.9 / 1.8 | CredSweeper 72.4 / 16.7 |
+| Held-out 9: 300 cases from the AI and agent ecosystem, JVM and .NET business apps, and SaaS integrations | 94.0 / 7.9 | 89.8 / 4.0 | not run | not run |
 | [SlotGuard](https://github.com/illinoisdata/SlotGuard): 200 agent sessions, 852 planted values (652 credentials, and 200 email addresses this library leaves alone) | 62.6 / 0.0 | 53.1 / 0.0 | 29.2 / 0.0 | CredSweeper 46.9 / 0.0 |
 | [ProwlBench](https://github.com/Lercas/prowlbench): 7,491 secrets in code, tickets, logs and chat in eight languages; 7,375 "secret-free" snippets, some with values under credential names that this library hides by design | 89.4 / 12.5 | 78.6 / 7.8 | 59.1 / 8.7 | detect-secrets 63.8 / 19.1 |
 
@@ -96,9 +97,9 @@ Other measurements; where a set was first scored blind, that score comes first:
 
 | set | result |
 |---|---|
-| Development sets (4,250 cases, 6,424 secrets, 18,402 look-alikes; held-out 2–8 among them) | 95.4% caught, 1.4% destroyed; 95.4% and 1.4% when each case is wrapped in an Anthropic or OpenAI transcript and passed to `redactValue` |
-| [CredData](https://github.com/Samsung/CredData) test split (real lines from public repositories) | 82.8% caught and 3.2% of non-secret lines hit, blind; now 83.5% and 3.5%. On the dev split it was tuned on, 91.1% and 1.8%: the gap shows how much of the tuning doesn't carry over to new repositories |
-| Five more ordinary-text sets (new repositories, trajectory shards, donated agent sessions from [Trace Commons](https://huggingface.co/datasets/trace-commons/agent-traces), agent pull requests from [AIDev](https://huggingface.co/datasets/hao-li/AIDev), repositories that handle credentials) | 5.5, 4.1, 5.6, 22.5 and 17.0 redactions per million characters, blind (the last two hold AWS signatures in presigned URLs and recorded OAuth test runs with real tokens) |
+| Development sets (4,550 cases, 6,942 secrets, 18,932 look-alikes; held-out 2–9 among them) | 95.6% caught, 1.4% destroyed; 95.5% and 1.4% when each case is wrapped in an Anthropic or OpenAI transcript and passed to `redactValue` |
+| [CredData](https://github.com/Samsung/CredData) test split (real lines from public repositories) | 82.8% caught and 3.2% of non-secret lines hit, blind; now 83.9% and 3.5%. On the dev split it was tuned on, 91.4% and 1.8%: the gap shows how much of the tuning doesn't carry over to new repositories |
+| Six more ordinary-text sets (new repositories, trajectory shards, donated agent sessions from [Trace Commons](https://huggingface.co/datasets/trace-commons/agent-traces), agent pull requests from [AIDev](https://huggingface.co/datasets/hao-li/AIDev), repositories that handle credentials) | 5.5, 4.1, 5.6, 22.5, 17.0 and 4.8 redactions per million characters, blind (the last two hold AWS signatures in presigned URLs and recorded OAuth test runs with real tokens) |
 | [GitLab's secret-detection rules](https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-rules), each rule's examples | 81.4% of 2,038 caught and 23% of 168 negatives hit, blind; now 88.0% and 15% |
 | Credential-handling code with no credentials ([ICSME 2026](https://doi.org/10.5281/zenodo.22942243), 5,903 snippets) | 4.6% of snippets hit, blind; now 2.0%, mostly passwords written into the code |
 | [levainbot/fp-corpus](https://github.com/levainbot/fp-corpus): log and build output, 85 planted values | 79 caught and 3 of 116 clean sections hit, blind; now 81 (the four missed: an email address, two card numbers and one key) and 4 of 116 |
@@ -229,7 +230,7 @@ measures what each adds and what each costs.
 
 1. **Values you gave it**, in every encoding output turns them into: JSON-, URL-, shell-, SQL- and HTML-escaped,
    hex, base64 at any offset, and cut short.
-2. **536 vendor token formats**: 137 maintained here and 399 from
+2. **542 vendor token formats**: 143 maintained here and 399 from
    [Betterleaks](https://github.com/betterleaks/betterleaks)' catalog (some vendors are in both).
 3. **Structure:** private keys (by their DER, under any PEM label), URL passwords, Authorization headers, cookies,
    connection strings, signed URLs, Kubernetes Secrets, CI masks, sign-in links, `.netrc`, and passwords given to
@@ -296,7 +297,7 @@ it as a `known` value: known values are hidden whatever they look like, as long
 
 - **Behaviour tests** (`test/`, by topic): a few cases per rule or decision, cross-products of credential names,
   syntaxes and value shapes, and checks that long and repetitive inputs take linear time.
-- **The quality gate** (`pnpm check`) scores every development set and the 132 regression sets
+- **The quality gate** (`pnpm check`) scores every development set and the 138 regression sets
   (`eval/corpora/regress/README.md`: probes of each rule's edges) against a committed baseline
   (`eval/baseline.json.gz`), and fails on any case that newly leaks, is newly destroyed or is newly slow.
   `scripts/snap.ts` does the same with a sample of ordinary text from the external corpora added.

package/dist/calls.d.ts

@@ -53,6 +53,14 @@ export interface LiteralHead {
 export declare function literalHead(text: string, at: number, { keyword }?: {
     keyword?: boolean | undefined;
 }): LiteralHead | undefined;
+/**
+ * The literal a converter at `at` is given, the value it makes (CONVERTER), and where the converter's call closes.
+ * (Not a lookup's argument, a secret's name: Prefect's `Secret.load("db-password")`, `SecretStr.get(…)`; nor an
+ * encoding's name.)
+ */
+export declare function convertedLiteral(text: string, at: number): (Literal & {
+    close: number;
+}) | undefined;
 /** The string literal starting at `at` (after blanks), read as an argument would be: `"…"`, `b'…'`, `Some("…")`. */
 export declare function literalAt(text: string, at: number): Literal | undefined;
 export interface Call {

package/dist/calls.js

@@ -67,6 +67,9 @@ function matchBrackets(text, slashComments) {
         else if (c === "'" && isContraction(text, i)) {
             // (Prose's apostrophe, `don't connect(…) doesn't`, opens nothing.)
         }
+        else if (c === "`" && text.startsWith("``", i + 1)) {
+            i = fenceEnd(text, i);
+        }
         else if (c === '"' || c === "'" || c === "`") {
             // (A string that doesn't close ends every call around it: none of them is closed.)
             const stop = literalEnd(text, i, { max: MAX_CALL });
@@ -88,6 +91,16 @@ function matchBrackets(text, slashComments) {
     }
     return close;
 }
+/**
+ * The last backtick of the run of three or more that starts at `at`: a Markdown code fence (or inline code's), which opens
+ * no template literal. Read as one, a fence would hide everything up to the next one, the code it shows included.
+ */
+function fenceEnd(text, at) {
+    let i = at;
+    while (text[i + 1] === "`")
+        i++;
+    return i;
+}
 /** The arguments between `at` and the bracket at `close` that closes the call: separated by commas outside brackets and strings. */
 function splitArguments(text, at, close, slashComments) {
     const args = [];
@@ -222,10 +235,17 @@ export function literalEnd(text, at, { max = MAX_VALUE, shell = false } = {}) {
  */
 const LITERAL_HEAD = new RegExp(String.raw `^(?:([A-Za-z_$][\w$]*)[ \t]*(?:=(?![=>])|:(?!:))[ \t]*)?((?:Some|String::from|SecretStr|Secret)\([ \t]*)?(${STRING_PREFIX})?(["'\x60])`);
 /**
- * What may follow a literal and leave it the value: a Rust raw string's closing `#`s, the wrapper's `)`, a conversion
- * (`.to_string()`, `.encode()`).
+ * A method that converts the value it is called on and takes no other: `.to_string()`, `.encode("utf-8")`,
+ * `.getBytes(StandardCharsets.UTF_8)`, `.toCharArray()`, `.trim()`. Its argument, if any, is a constant (an encoding,
+ * a number, a name in capitals or with a dot), not a variable a method would combine the value with: `.concat(x)`,
+ * `", ".join(parts)`.
+ */
+const CONVERSION = String.raw `\.[A-Za-z_]\w{0,30}\([ \t]*(?:"[\w.-]{0,20}"|'[\w.-]{0,20}'|\d{1,5}|[A-Z][A-Z0-9_]{1,30}|[A-Za-z_]\w{0,30}(?:(?:\.|::)\w{1,30}){1,3})?[ \t]*\)`;
+/**
+ * What may follow a literal and leave it the value: a Rust raw string's closing `#`s, the wrapper's `)`, and up to
+ * three conversions (CONVERSION).
  */
-const LITERAL_TAIL = /^#*(?:[ \t]*\))?(?:\.(?:to_string|into|to_owned|encode|strip)\(\))?[ \t]*$/;
+const LITERAL_TAIL = new RegExp(String.raw `^#*(?:[ \t]*\))?(?:CONVERSION){0,3}[ \t]*$`.replace("CONVERSION", CONVERSION));
 const KEYWORD = /^([A-Za-z_$][\w$]*)[ \t]*(?:=(?![=>])|:(?!:))/;
 /** The literal head starting at `at`, or undefined. With `keyword`, a keyword before it is read too. */
 export function literalHead(text, at, { keyword = false } = {}) {
@@ -250,8 +270,45 @@ function argument(text, start, end) {
     const lit = head && literalOf(text, head);
     if (lit && LITERAL_TAIL.test(text.slice(lit.end + 1, end)))
         arg.literal = lit;
+    else if (!head) {
+        // A converter given the literal, the value it makes: `Buffer.from("…", "utf8")`, `Secret::new("…")`.
+        const converted = convertedLiteral(text, start + (keyword?.[0].length ?? 0));
+        if (converted && converted.close < end && LITERAL_TAIL.test(text.slice(converted.close + 1, end)))
+            arg.literal = converted;
+    }
     return arg;
 }
+/** An encoding's name, which a converter takes beside the value it converts: `Buffer.from(key, "base64")`. */
+const ENCODING = /^(?:utf-?8|utf-?16(?:le|be)?|latin-?1|ascii|iso-?8859-?\d+|cp\d+|base64|hex|binary|ucs-?2)$/i;
+/**
+ * A converter's callee, up to its `(`: one that makes a value of the string it is given, `hexStringToUint8Array(`,
+ * `bytes.fromhex(`, `Buffer.from(`, `new TextEncoder().encode(`, `Secret::new(`, `SecretString::from(`, Go's `[]byte(`;
+ * or a digest that is given a password to hash, `MD5(`, `crypt(`, `hashlib.sha256(`, whose input is the password still.
+ */
+const DIGEST = /^(?:[A-Za-z_]\w{0,30}(?:\.|::))?(?:md5|sha(?:1|2|224|256|384|512)?|crypt|digest|hashpw)[ \t]*\(/i;
+const CONVERTER = /^(?:new[ \t]+)?(?:\[\])?(?:[\w.]|::|\(\)){0,60}(?:hex|Hex|b64|base64|Base64|decode|Decode|fromhex|unhexlify|Buffer\.from|SecretStr|Secret|SecureString|getBytes|encode|bytes?|String|str|Uint8Array|parse|Parse)(?:[\w.]|::){0,40}\(/;
+/**
+ * The literal a converter at `at` is given, the value it makes (CONVERTER), and where the converter's call closes.
+ * (Not a lookup's argument, a secret's name: Prefect's `Secret.load("db-password")`, `SecretStr.get(…)`; nor an
+ * encoding's name.)
+ */
+export function convertedLiteral(text, at) {
+    const head = text.slice(at, at + 120);
+    const converter = CONVERTER.exec(head) ?? DIGEST.exec(head);
+    if (!converter ||
+        /(?:^(?:new[ \t]+)?|\.|::)(?:load|get|fetch|read|lookup|retrieve|resolve|access)\w*\($/i.test(converter[0]))
+        return undefined;
+    const open = at + converter[0].length;
+    // (It is given the value alone, or with an encoding or a constant: a constructor given two strings,
+    // `new ClientSecretKeyVaultCredential("<client id>", "<secret>")`, makes no value of the first.)
+    const args = callArguments(text, open);
+    const literal = args?.[0]?.literal;
+    if (args?.slice(1).some((a) => a.literal && !ENCODING.test(a.literal.value)))
+        return undefined;
+    return literal && literal.value.length >= 4 && !ENCODING.test(literal.value)
+        ? { ...literal, close: closingBracket(text, open) }
+        : undefined;
+}
 /** The string literal starting at `at` (after blanks), read as an argument would be: `"…"`, `b'…'`, `Some("…")`. */
 export function literalAt(text, at) {
     const start = at + /^[ \t]*/.exec(text.slice(at, at + 200))[0].length;

package/dist/checksums.js

@@ -40,10 +40,11 @@ function base58Check(t, alphabet) {
     return check.slice(0, 4).every((b, i) => b === bytes[payload.length + i]) ? payload : undefined;
 }
 /**
- * The human-readable parts that name a secret, not an address: Nostr's `nsec` and `ncryptsec`, and the `sk`, `sec` and
- * `priv` that chains and tools give a private key (`sk1…`, `priv1…`), whose checksum would verify as well.
+ * The human-readable parts that name a secret, not an address: Nostr's `nsec` and `ncryptsec`, the `sk` and `sec` that
+ * chains and tools give a private key (`sk1…`), and any that says private, secret or seed (`priv1…`, Sui's
+ * `suiprivkey1…`), whose checksum would verify as well.
  */
-const SECRET_HRP = /^(?:nsec|ncryptsec|sk|sec|priv)$/;
+const SECRET_HRP = /^(?:nsec|ncryptsec|sk|sec)$|priv|secret|seed/;
 /** A bech32 or bech32m address (`bc1…`, `cosmos1…`, `npub1…`) whose checksum verifies; never a secret's prefix (`nsec1`). All lower case or all upper case (BIP-173); not mixed. */
 export function isBech32Address(address) {
     const t = address === address.toUpperCase() ? address.toLowerCase() : address;

package/dist/commands.d.ts

@@ -35,6 +35,11 @@ export declare function printsSecretFile(command: string): boolean;
  * holds a value only where the cut didn't happen, a `NAME=value` line in it.
  */
 export declare function printsSecretFileNames(command: string): boolean;
+/**
+ * Whether what a command prints goes into the next command's input: by its own `|`, or by a group's around it, whatever
+ * follows it inside the group (`{ echo A=1; echo B=2; } | tee .env`).
+ */
+export declare function pipes(c: ShellCommand): boolean;
 /** Whether a command prints a credential: any of its pipelines (`openssl rand -hex 32 && echo ok`) whose stage that makes one reaches its output. */
 export declare function printsSecret(command: string): boolean;
 /** How a command-line tool takes a password. */

package/dist/commands.js

@@ -64,7 +64,7 @@ export function holdsOnlySecrets(path) {
         (/secret|credential|^auth\.json$|^\.(?:netrc|_netrc|pgpass|vault-token)$/i.test(path.slice(path.lastIndexOf("/") + 1)) ||
             /(^|\/)\.?secrets\//.test(path)));
 }
-const CONTENT_COMMANDS = /^(cat|tac|head|tail|less|more|bat|batcat|nl|sed|awk|grep|egrep|fgrep|zgrep|rg|ag|ack|Select-String|sls|cut|sort|uniq|strings|xxd|od|base64|tr|column|jq|yq|type|Get-Content|gc|diff|sops|op|dotenv|printenv|env|set|export|declare)$/;
+const CONTENT_COMMANDS = /^(cat|tac|head|tail|less|more|bat|batcat|nl|sed|awk|grep|egrep|fgrep|zgrep|rg|ag|ack|Select-String|sls|cut|sort|uniq|strings|xxd|od|base64|tr|column|jq|yq|type|Get-Content|gc|findstr|diff|sops|op|dotenv|printenv|env|set|export|declare)$/;
 /**
  * Commands whose whole output is a credential, by tool: each read from the program on (a commit message that mentions
  * `gh auth token` isn't one).
@@ -112,6 +112,8 @@ const SECRET_TOOLS = new RegExp(`^(?:${[
     /secret-tool\s+lookup\b/,
     /lpass\s+show\b.*--password\b/,
     /keepassxc-cli\s+show\b.*(?:-a|--attributes)\s+Password\b/,
+    // (PowerShell's SecretManagement; without `-AsPlainText` it prints `System.Security.SecureString`.)
+    /Get-Secret\b.*-AsPlainText\b/,
     // Generators.
     /openssl\s+rand\b/,
     /pwgen\b/,
@@ -123,16 +125,22 @@ const SECRET_TOOLS = new RegExp(`^(?:${[
     .map((r) => r.source)
     .join("|")})`);
 /** What a command reads or calls that is a secret, wherever it sits in the command: a random device, a language's generator. */
-const SECRET_SOURCES = /\/dev\/u?random\b|get_random_secret_key|secrets\.token_(?:hex|urlsafe|bytes)|SecureRandom\.(?:hex|base64|urlsafe_base64)|crypto\.randomBytes/;
+const SECRET_SOURCES = /\/dev\/u?random\b|get_random_secret_key|secrets\.token_(?:hex|urlsafe|bytes)|SecureRandom\.(?:hex|base64|urlsafe_base64)|crypto(?:["']\))?\.randomBytes/;
+/**
+ * Byte generators that make IDs, salts and test data as often as keys (`user = os.urandom(8).hex()`, a patch that
+ * changes `os.urandom(3)`): a secret only printed as made, `print(os.urandom(32).hex())`, `echo
+ * bin2hex(random_bytes(32));`.
+ */
+const PRINTED_SOURCE = /\b(?:print|puts|echo)\b[ \t(]*(?:[\w.]+\()*(?:os\.urandom\(|random_bytes\(|openssl_random_pseudo_bytes\()/;
 /** A shell's name: `bash`, `sh`, `zsh`. */
 export const SHELL = /^(?:ba|z|da|k)?sh$/;
 /** Commands whose whole output is a set of secrets, read like a secret file; each read from the program on. */
 const SECRET_DUMPS = new RegExp(String.raw `^(?:\bdoppler\s+secrets(?:\s+download)?\b(?![^\n]*\b(?:set|delete)\b)|\bsops\s+(?:-d|--decrypt)\b|\bansible-vault\s+(?:view|decrypt)\b|\b(?:bin\/)?rails\s+credentials:show\b|\binfisical\s+export\b|\bchamber\s+(?:export|read)\b|\bheroku\s+config(?:\s|$)(?!:)|\bvault\s+kv\s+get\b|\bop\s+inject\b|\baws\s+sts\s+(?:get-session-token|assume-role\S*|get-federation-token)\b|\baws\s+configure\s+export-credentials\b|\baz\s+ad\s+sp\s+(?:create-for-rbac|credential\s+reset)\b|\bkubectl\s+config\s+view\b[^\n]*--raw\b|\bterraform\s+output\s+-json\b|\bgit\s+credential\s+fill\b|\b(?:gh|glab)\s+auth\s+status\b[^\n]*(?:--show-token|\s-t\b))`);
 /**
  * A line written for PowerShell or cmd, where a backslash separates a path (`.\.env`, `C:\Users\me\.aws\credentials`,
- * `$env:USERPROFILE\.ssh\id_rsa`): read without POSIX escapes.
+ * `$env:USERPROFILE\.ssh\id_rsa`, `%USERPROFILE%\.ssh`): read without POSIX escapes.
  */
-const WINDOWS_LINE = /(?:^|[\s'"=(])(?:[A-Za-z]:\\|\.{1,2}\\[\w.$-]|~\\|\$(?:HOME|env:\w+)\\)|^[ \t]*(?:Get-\w+|Select-String|gc|type|pwsh|powershell|cmd)(?:\.exe)?[ \t]/i;
+const WINDOWS_LINE = /(?:^|[\s'"=(])(?:[A-Za-z]:\\|\.{1,2}\\[\w.$-]|~\\|\$(?:HOME|env:\w+)\\|%\w+%\\)|^[ \t]*(?:Get-\w+|Select-String|gc|type|findstr|pwsh|powershell|cmd)(?:\.exe)?[ \t]/i;
 /**
  * The simple commands a command line runs, in order, read through what runs a command of its own: a shell (`bash -lc
  * "cat .env"`, `sudo sh -c '…'`, a heredoc or here-string fed to one: `ssh host <<'EOF'`), PowerShell (`pwsh -Command
@@ -165,7 +173,7 @@ export function commandsRun(text, { at = 0, oneLine = false, lines, depth = 0, }
             out.push(c);
             continue;
         }
-        const wrapper = { kind: programName(simpleCommand(c.words)[0]), redirects: c.redirects };
+        const wrapper = { kind: programName(simpleCommand(c.words)[0]), redirects: c.redirects, then: c.then };
         for (const r of run)
             r.groups = [...r.groups, wrapper, ...c.groups];
         run[run.length - 1].then = c.then;
@@ -194,7 +202,9 @@ function commandLine(text, at, { oneLine = false, lines } = {}) {
         : prose
             ? at + prose[0].length - (prose[1] ? 1 : 0)
             : at;
-    const backslash = !WINDOWS_LINE.test(text.slice(from, lineEnd(text, from, 4000)));
+    // (After PowerShell's prompt or cmd's, `PS C:\app> `, `C:\app>`, the line is theirs.)
+    const backslash = !(prompt && /^[ \t]*(?:PS\b|[A-Za-z]:\\)/.test(prompt[0])) &&
+        !WINDOWS_LINE.test(text.slice(from, lineEnd(text, from, 4000)));
     return shellCommands(text, 0, { at: from, oneLine, lines, backslash });
 }
 /** A command read out of `source`'s string, with its positions where the source puts them in `text`. */
@@ -308,6 +318,14 @@ function innerCommand(c, text) {
         const k = words.findIndex((w) => /^\/[ck]$/i.test(w.text));
         return k > 0 ? from(words, k + 1) : undefined;
     }
+    // `su - app -c 'cat .env'`, and runuser's twin of it, `runuser -l app -c …` (no `-u`, so no wrapper): the command
+    // string `-c` (`--command`) gives, as a shell's.
+    const runuser = programName(c.words.find((w) => !/^[A-Za-z_]\w*=/.test(w.text))) === "runuser";
+    if (program === "su" || runuser) {
+        const own = program === "su" ? words : c.words;
+        const k = own.findIndex((w) => /^(?:-c|--command)$/.test(w.text));
+        return k > 0 ? own[k + 1] && wordSource(own[k + 1]) : undefined;
+    }
     const sub = subcommand(words);
     if (/^(?:kubectl|oc)$/.test(program) && sub[0]?.text === "exec") {
         const dashes = sub.findIndex((w) => w.text === "--");
@@ -392,13 +410,17 @@ function imageName(image) {
 const ECHOES = /^(?:echo|printf|Write-Output|Write-Host)$/;
 /** Whether a command prints the contents of a secret file (`cat .env`, `grep KEY .env.local`, `cat < .env`, `git show HEAD:.env`). */
 export function printsSecretFile(command) {
+    // (A member of what a command gives prints that member, not the file or the listing: `(Get-Item Env:HOM*).Name`.)
+    if (EXPRESSION.test(command) &&
+        /\)(?:\.[A-Za-z_]\w*(?:\(\))?)*\.(?!value\b)[A-Za-z_]\w*(?:\(\))?[ \t]*$/i.test(command))
+        return false;
     return printsWhatItReads(command, readsSecretFile, isSecretFile) || printsIndirectly(command);
 }
 /**
  * A file printed by a name the pipeline reader doesn't see: `find … -exec cat {}`, `xargs cat`, a printer given a
  * variable or a substitution (`cat "$f"`, `cat $(find …)`, `echo "$line"`), a script's `open(…).read()`.
  */
-const PRINTER = /-exec[ \t]+(?:cat|tac|head|tail|less|more|bat|nl)\b|\bxargs[ \t]+(?:-\S+[ \t]+)*(?:cat|tac|head|tail|less|more|bat|nl)\b|(?:^|[\s;|&(])(?:cat|tac|head|tail|less|more|bat|nl|echo|printf|print)\b[^;|&\n]*\$[{(\w"]|\.read\(\)|readlines\(\)/;
+const PRINTER = /(?:-exec|\bxargs\b[^|&\n]*?|\bfd(?:find)?\b[^|;&\n]*[ \t]-[xX])[ \t'"]+(?:cat|tac|head|tail|less|more|bat|nl|sort|strings|awk|(?:e?grep|rg)\b(?![^;|&\n]*[ \t]-[A-Za-z]*[lLcq])|sed\b(?![^;|&\n]*[ \t]-(?:[A-Za-z]*i|-in-place)))\b|(?:^|[\s;|&(])(?:cat|tac|head|tail|less|more|bat|nl|echo|printf|print)\b[^;|&\n]*\$[{(\w"]|\.read\(\)|readlines\(\)|\b(?:print|puts|console\.log|echo)\b[^;\n]{0,80}?(?:readFileSync\(|\.read_text\(|\bFile\.read\(|file_get_contents\()/;
 /**
  * A secret file printed by a route the pipeline reader doesn't follow: named to `find … -exec cat {}`, `xargs cat`, a
  * loop's variable, a substitution, a script's `open('.env').read()`, a `while read` loop's `< .env`. Taken as printed
@@ -485,6 +507,13 @@ function readsSecretFile(c) {
     const xargs = xargsInput(c, words);
     if (xargs !== undefined && (program === "xargs" || ECHOES.test(program)))
         return isSecretFile(xargs);
+    // (PowerShell's `Get-ChildItem Env:` and `Get-Item Env:NAME` print the variables as a table of names and values: all
+    // of them, or those a wildcard matches; one variable named in full is judged by its name, `Env:AZURE_TENANT_ID`.)
+    const drive = /^(?:Get-ChildItem|gci|dir|ls|Get-Item|gi)$/.test(program)
+        ? rest.find((t) => /^env:/i.test(t))
+        : undefined;
+    if (drive !== undefined)
+        return !/^env:\\?\w+$/i.test(drive) || isCredentialName(drive.replace(/^env:\\?/i, ""));
     if (!CONTENT_COMMANDS.test(program) || printsNamesOnly(words) || editsInPlace(words))
         return false;
     // (`env` here runs no command: simpleCommand reads past it to the one it runs. `env -0` prints the environment too;
@@ -502,9 +531,12 @@ function readsSecretFile(c) {
     // (Counting, listing and testing print none of what grep reads: `grep -c`, `grep -l`, `grep -q`.)
     if (/^(?:grep|egrep|fgrep|rg|ag|ack|zgrep)$/.test(program) && rest.some((t) => countsMatches(program, t)))
         return false;
+    // (A word with backslashes is read as written, a Windows path whatever else the line holds: PowerShell's `cat
+    // apps\web\.env.local`.)
+    const args = words.slice(1).map((w) => (/\\/.test(w.raw) && !/['"$`]/.test(w.raw) ? w.raw : w.text));
     const files = /^(?:grep|egrep|fgrep|rg|ag|ack|zgrep|Select-String|sls)$/.test(program)
-        ? searchedFiles(rest)
-        : rest.filter((t) => !t.startsWith("-"));
+        ? searchedFiles(args)
+        : args.filter((t) => !t.startsWith("-"));
     return files.some((t) => isSecretFile(t));
 }
 /**
@@ -603,6 +635,13 @@ function printsWhatItReads(command, reads, source) {
     }
     return false;
 }
+/**
+ * Whether what a command prints goes into the next command's input: by its own `|`, or by a group's around it, whatever
+ * follows it inside the group (`{ echo A=1; echo B=2; } | tee .env`).
+ */
+export function pipes(c) {
+    return [c.then, ...c.groups.map((g) => g.then)].some((then) => then === "|" || then === "|&");
+}
 /** Devices that are what's shown: a tool's captured output holds stdout and stderr, and a terminal shows both. */
 const SHOWN = /^\/dev\/(?:stdout|stderr|tty|fd\/[12])$/;
 /** The file a command's output goes to, not to what's shown: `> out`, `>> log`, `&> /dev/null`, `>& out` (not `2>`, `>&2`, `> /dev/stderr`). */
@@ -646,7 +685,34 @@ function consumesInput(command) {
 }
 /** Whether a command prints a credential: any of its pipelines (`openssl rand -hex 32 && echo ok`) whose stage that makes one reaches its output. */
 export function printsSecret(command) {
-    return printsWhatItReads(command, printsCredential);
+    return printsExpression(command) || printsWhatItReads(command, printsCredential);
+}
+/**
+ * A command line that is one expression, which PowerShell prints (as a REPL does; a POSIX shell runs a variable's value
+ * as a command and prints it in its error): a variable, `$env:NAME`, its members (`$cred.GetNetworkCredential().Password`),
+ * or a command's in parentheses (`(Get-Item Env:TOKEN).Value`).
+ */
+const EXPRESSION = /^[ \t]*(?:\$\{?(?:env:)?[A-Za-z_]\w*\}?|\([^()\n]{1,200}\))(?:\.[A-Za-z_]\w*(?:\(\))?)*[ \t]*$/i;
+/**
+ * Whether a command line is an expression (EXPRESSION) that prints a credential: by its last member's name, or with
+ * none, or a `Value` (an entry's), by its variables' (`$cred.UserName` is a name; `$env:TOKEN`, `(Get-Item
+ * Env:TOKEN).Value` are the token).
+ */
+function printsExpression(command) {
+    if (!EXPRESSION.test(command))
+        return false;
+    const member = /\.([A-Za-z_]\w*)(?:\(\))?[ \t]*$/.exec(command)?.[1];
+    // (A dictionary's keys are its names, `$hash.Keys`, `(Get-Command x).Parameters.Keys`, and an entry's `$_.Key`.)
+    if (member !== undefined && !/^value$/i.test(member))
+        return !/^(?:all)?keys?$/i.test(member) && isCredentialName(member);
+    return variablesIn(command).some(isCredentialName);
+}
+/**
+ * The variables a text reads, by their names, in any shell's syntax: `$NAME`, `${NAME}`, PowerShell's `$env:NAME`,
+ * `${env:NAME}` and its drive's `Env:NAME`, cmd's `%NAME%`.
+ */
+function variablesIn(text) {
+    return [...text.matchAll(/\$\{?(?:env:)?([A-Za-z_]\w*)|%([A-Za-z_]\w*)%|\benv:([A-Za-z_]\w*)/gi)].map((m) => m[1] ?? m[2] ?? m[3]);
 }
 function passesThrough(c) {
     const words = simpleCommand(c.words);
@@ -670,13 +736,17 @@ function printsCredential(c) {
     const words = simpleCommand(c.words);
     // (Read from the program's own name on: `/usr/bin/gh auth token` is `gh auth token`.)
     const line = [programName(words[0]), ...words.slice(1).map((w) => w.text)].join(" ").slice(0, MAX_TOOL_LINE);
-    if (SECRET_TOOLS.test(line) || SECRET_SOURCES.test(line))
+    if (SECRET_TOOLS.test(line) || SECRET_SOURCES.test(line) || PRINTED_SOURCE.test(line))
         return true;
     const program = programName(words[0]);
     const args = words.slice(1);
     if (program === "printenv")
         return args.length === 1 && isCredentialName(args[0].text);
-    if (program !== "echo" && program !== "printf")
+    // (A script given on the command line that prints a credential's variable: `python3 -c "print(os.environ['TOKEN'])"`,
+    // `node -e "console.log(process.env.TOKEN)"`.)
+    if (INTERPRETER.test(program))
+        return [...line.matchAll(PRINTED_ENV_READ)].some((m) => isCredentialName(m[1] ?? m[2]));
+    if (program !== "echo" && program !== "printf" && !/^write-(?:host|output)$/i.test(program))
         return false;
     // (printf prints its format and its operands alike, `printf "Token: %s\n" "$TOKEN"`, `printf "$TOKEN"`; but `-v NAME`
     // assigns what it would print and prints nothing.)
@@ -685,9 +755,18 @@ function printsCredential(c) {
         : args[0]?.text === "-v"
             ? []
             : args.filter((w) => w.text !== "--");
-    // (A credential's variable printed alone, `echo $DB_PASSWORD`, or inside its words, `echo "token: $GITHUB_TOKEN"`.)
-    return values.some((v) => !v.literalEnd && [...v.text.matchAll(/\$\{?([A-Za-z_]\w*)\}?/g)].some((m) => isCredentialName(m[1])));
+    // (A credential's variable printed alone, `echo $DB_PASSWORD`, `echo %DB_PASSWORD%`, or inside its words, `echo
+    // "token: $GITHUB_TOKEN"`.)
+    return values.some((v) => !v.literalEnd && variablesIn(v.text).some(isCredentialName));
 }
+/** Interpreters that run a script given on their command line. */
+const INTERPRETER = /^(?:python[\d.]*|node|deno|bun|ruby|perl|php)$/;
+/**
+ * A read of an environment variable in those scripts, by its name, that their print takes: `print(os.environ['TOKEN'])`,
+ * `console.log("token", process.env.TOKEN)`. (A script that reads one to use it prints what it does with it: a login
+ * script's `type(process.env.PW)` and its `console.log("submitted")`.)
+ */
+const PRINTED_ENV_READ = /\b(?:print|puts|console\.log|echo|say|process\.stdout\.write)\b[^;\n]{0,80}?(?:(?:os\.environ(?:\.get)?|os\.getenv|\bENV(?:\.fetch)?|\bgetenv|\$_ENV|\$ENV)\s*[[({]\s*["']([A-Za-z_]\w*)["']|process\.env\.([A-Za-z_]\w*))/g;
 /** Tools by name, and how each takes a password (structure.ts reads them). */
 const TOOLS = [
     [

package/dist/context.d.ts

@@ -34,7 +34,7 @@ export declare class Doc {
      * as pem.ts reads a block (to its END, or where its material stops when output is cut short: `head -3 cert.pem`).
      */
     inPublicArmor(at: number): boolean;
-    /** The cell of an SQL `INSERT` row whose value holds `[start, end)`, read as sql.ts reads rows. */
+    /** The cell of an SQL row (`INSERT`, `COPY`) whose value holds `[start, end)`, read as sql.ts reads rows. */
     sqlCell(start: number, end: number): SqlCell | undefined;
     /**
      * The first line of the comma-separated block that line `i` is in: the lines above it with as many cells, up to
@@ -64,7 +64,10 @@ export interface Context {
      * on the line: "your new API key for the git server: <t>".
      */
     hashPhrase: boolean;
-    /** The previous URL path segment, for `/hooks/<token>`, `/webhook/<token>`. */
+    /**
+     * The previous URL path segment, for `/hooks/<token>`, `/webhook/<token>`; in a URL, or a request's target after its
+     * method (`POST /hooks/<token> HTTP/1.1`).
+     */
     pathParent: string;
     /** A phrase that hands over a value: "here's your key", "Token created:", "use this one". */
     handover: boolean;

package/dist/context.js

@@ -7,7 +7,7 @@ import { lastText, lowerBound } from "./lines.js";
 import { isGenericName, mentionsCredential, nameClass, phraseBefore, readPhrase } from "./names.js";
 import { inJwk } from "./json.js";
 import { publicBlocks } from "./publickeys.js";
-import { insertCells } from "./sql.js";
+import { sqlCells } from "./sql.js";
 import { backslashesBefore, delimitedCells, isEscapedBreak, PAIR_VALUE, PIPE_RULE, pipeCells, siblingName, STRING_PREFIX, } from "./syntax.js";
 import { PARAM_NAME, PARAM_START, urlAround } from "./urls.js";
 /** How far a line is read either side of a token, and the longest line read whole for its structure (tables, blobs). */
@@ -90,11 +90,11 @@ export class Doc {
         const k = lowerBound(this.armor.begins, at + 1) - 1;
         return k >= 0 && at < this.armor.ends[k];
     }
-    /** The cell of an SQL `INSERT` row whose value holds `[start, end)`, read as sql.ts reads rows. */
+    /** The cell of an SQL row (`INSERT`, `COPY`) whose value holds `[start, end)`, read as sql.ts reads rows. */
     sqlCell(start, end) {
         if (!this.cells) {
             // (Values in the order they appear, so their starts are sorted.)
-            this.cells = [...insertCells(this.text)].sort((a, b) => a.value.start - b.value.start);
+            this.cells = [...sqlCells(this.text)].sort((a, b) => a.value.start - b.value.start);
             this.cellStarts = this.cells.map((c) => c.value.start);
         }
         const cell = this.cells[lowerBound(this.cellStarts, start + 1) - 1];
@@ -156,7 +156,15 @@ const XML_ATTR = /\b([\w:.-]{1,80})=["']$/;
 const CALL = new RegExp(String.raw `(?<![\w$.])([A-Za-z_$][\w$]{0,60}(?:\.[A-Za-z_$][\w$]{0,60}){0,4})[ \t]{0,2}\((?:[^()]{0,200}?,)?[ \t]{0,4}(?:[A-Za-z_]\w{0,30}[ \t]{0,2}=[ \t]{0,2})?(?:(?:${STRING_PREFIX})?["'\x60])?$`);
 const PROSE = /\b([A-Za-z][\w-]{0,30})(?:[ \t]{1,3}(?:is|was|=|:)[ \t]{0,3}|:[ \t]{1,3}|[ \t]{1,3}(?:of|for)[ \t][^:]{0,40}:[ \t]{0,3})["'`*]{0,2}$/;
 const TABLE = /^[ \t│|]{0,10}([A-Za-z_][\w.-]{0,80})(?:[ \t]{2,80}|[ \t]{0,80}[│|][ \t]{0,10})$/;
-const HASH_PREFIX = /(?:^|[\s;])bh=$|pin-sha256="?$|(?<![A-Za-z0-9])(?:sha(?:1|224|256|384|512)|md5|blake2b?|blake3|crc32|h1|integrity|xxh\d*)[:=\-][ \t]?$|@sha256:$|\bsha(?:1|256|512)sum\b.{0,40}$|\b(?:commit|tree|parent|object|blob|merge)[ \t]$|\bcherry picked from commit $|\bindex $|(?:^|\n)Index: [^\s=:]{1,100}$/i;
+/** A hash algorithm's name: `sha256`, `sha-256` (HTTP's), `md5`, `blake3`. */
+const HASH_ALGORITHM = String.raw `(?:sha-?(?:1|224|256|384|512)|md5|blake2b?|blake3|crc32|xxh\d*)`;
+/**
+ * A hash's or a digest's name right before the token. (HTTP's digest fields, RFC 9530, write the digest as a structured
+ * field's byte sequence, `Content-Digest: sha-256=:<base64>:`; tools write the algorithm or the encoding in brackets
+ * after a label, `Hash (sha256): `, `Checksum (base64): `; BSD's checksum tools the file's name after the algorithm,
+ * `SHA256 (app.tar.gz) = `.)
+ */
+const HASH_PREFIX = new RegExp(String.raw `(?:^|[\s;])bh=$|pin-sha256="?$|(?<![A-Za-z0-9])(?:${HASH_ALGORITHM}|h1|integrity)[:=\-]:?[ \t]?$|(?<![A-Za-z0-9])(?:hash|checksum|digest|${HASH_ALGORITHM})[ \t]*\([^()\n]{1,100}\)[ \t]?[:=][ \t]?$|@sha256:$|\bsha(?:1|256|512)sum\b.{0,40}$|\b(?:commit|tree|parent|object|blob|merge)[ \t]$|\bcherry picked from commit $|\bindex $|(?:^|\n)Index: [^\s=:]{1,100}$`, "i");
 /** The text before the last `name` in `left` (none when the name came from elsewhere, a sibling or a header). */
 function textBefore(left, name) {
     const at = left.lastIndexOf(name);
@@ -194,6 +202,18 @@ function isBlobLine(doc, start, end, i) {
     }
     return true;
 }
+/** A line holding one token alone, or as a list's item: `- Kx9mQ2…`. */
+const LONE_TOKEN_LINE = /^[ \t]*(?:[-*•][ \t]+)?["'`]?[A-Za-z0-9+/=_.-]{16,}["'`]?[ \t]*\r?$/;
+/**
+ * The line above line `i`, or above the lines of lone tokens line `i` ends (keys handed over one per line: "Here are
+ * your new API keys:" over three of them).
+ */
+function listHead(doc, i, above) {
+    let k = i - 1;
+    while (k > 0 && k >= i - 20 && LONE_TOKEN_LINE.test(doc.line(k)))
+        k--;
+    return k < i - 1 ? doc.line(k) : above;
+}
 /**
  * The name the list that line `i` is an item of sits under (`api_keys:` above `- …` lines, `"keys": [` above `"…",`
  * lines), read over its other items, blank lines and comments; undefined if none. (A line that only names: `Your API
@@ -300,8 +320,10 @@ function nameFromLeft(left, url) {
     const trimmed = left.trimStart();
     if (trimmed === "" || /^[-*•>+][ \t]*["'`]?$/.test(trimmed) || /^["'`]$/.test(trimmed))
         return { name: "", syntax: /^[-*•]/.test(trimmed) ? "list" : "bare" };
-    // `Authorization: Bearer <token>`: the scheme word sits between name and value.
-    if ((m = /^[ \t]{0,8}([A-Za-z][\w-]{1,60}):[ \t]{1,4}(?:[A-Za-z][\w-]{0,20}[ \t]{1,3})?$/.exec(left)))
+    // `Authorization: Bearer <token>`: the scheme word sits between name and value; or parameters and version tags do,
+    // `webhook-signature: v1,<sig>`, `Stripe-Signature: t=…,v1=<sig>`.
+    if ((m =
+        /^[ \t]{0,8}([A-Za-z][\w-]{1,60}):[ \t]{1,4}(?:[A-Za-z][\w-]{0,20}[ \t]{1,3}|(?:[\w-]{1,20}(?:=[^\s,;]{0,40})?[,;][ \t]*)+(?:[\w-]{1,20}=)?)?$/.exec(left)))
         return { name: m[1], syntax: /^[A-Z]/.test(m[1]) || /-/.test(m[1]) ? "header" : "assign" };
     if ((m = FLAG.exec(left)))
         return { name: m[1].replace(/^-+/, ""), syntax: "flag" };
@@ -358,6 +380,9 @@ export function contextOf(doc, start, end) {
     // An item of a list under a name (`api_keys:` then `- <key>` lines): the list's name.
     if (!name && /^[ \t]*(?:[-*•][ \t]*["'`]?|["'`])$/.test(left))
         name = listName(doc, i) ?? "";
+    // A request's target after its method, as access logs and HTTP dumps print it (`"POST /hooks/<token> HTTP/1.1"`): a
+    // URL's path, not a file's.
+    const requestPath = !inUrl && /\b(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)[ \t]+\/[^\s"]*$/.test(left);
     const fsPath = !inUrl &&
         (/(?:^|[\s"'`=:(,\[])(?:~|\.{1,2}|[A-Za-z]:)?(?:[\\/][\w.@+-]{1,80}){1,30}[\\/]$/.test(left) ||
             (/[\\/]$/.test(left) && /^[\\/][\w.-]/.test(right)));
@@ -436,8 +461,10 @@ export function contextOf(doc, start, end) {
         const before = phraseBefore(textBefore(left, name), 4);
         ({ name, class: cls } = readPhrase(before, name));
     }
-    const pathParent = inUrl ? (/\/([^/\s?#]{1,60})\/$/.exec(left)?.[1] ?? "") : "";
-    const leftAndAbove = identifierWords(`${above}\n${left}`);
+    const pathParent = inUrl || requestPath ? (/\/([^/\s?#]{1,60})\/$/.exec(left)?.[1] ?? "") : "";
+    // (A query parameter's credential words are its own name's: `?api_key=…&profile=<id>` says nothing of the profile.)
+    const ownLeft = syntax === "query" && name ? left.replace(/[?&][^?&\s"'=]+=[^&\s"']*(?=&[^&]*$)/g, "") : left;
+    const leftAndAbove = identifierWords(`${above}\n${ownLeft}`);
     return {
         name,
         nameClass: cls,
@@ -452,7 +479,7 @@ export function contextOf(doc, start, end) {
         pathParent,
         sqlCell,
         handover: HANDOVER.test(identifierWords(left.slice(-200))) ||
-            (left.trim() === "" && HANDOVER.test(identifierWords(above.slice(-200)))),
+            (left.trim() === "" && HANDOVER.test(identifierWords(listHead(doc, i, above).slice(-200)))),
         inUrl,
         fsPath,
         armored: armoredAt(doc, start, left),

package/dist/encoded.js

@@ -8,6 +8,7 @@ import { naturalness } from "./charlm.js";
 import { lineEnd, lineStart } from "./lines.js";
 import { asciiSet, longRuns } from "./runs.js";
 import { keepReason } from "./policy.js";
+import { isJsonDocument } from "./secretfile.js";
 import { hasThreeClasses } from "./values.js";
 const UTF8 = new TextDecoder("utf-8");
 /** The share of characters that must be printable for bytes to count as text, and of zero bytes for UTF-16. */
@@ -132,6 +133,10 @@ function isGeneratedToken(token) {
         /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token) ||
         /^[\w.-]+@[\w.-]+$|^https?:/.test(token))
         return false;
+    // (Nor a JSON object or array, which its quotes and braces give three classes: a JWT's header on a line of its own,
+    // `cut -d. -f1` of a token, is `{"alg":"HS256","typ":"JWT"}`.)
+    if (isJsonDocument(token))
+        return false;
     if (keepReason(token, { start: 0, end: token.length, kind: "random token", rule: "unnamed", confidence: 0.8 }) !==
         undefined)
         return false;
@@ -245,10 +250,11 @@ function isLineAlone(text, start, end) {
  */
 export function findHexDumps(text, inner) {
     const out = [];
-    if (!/[0-9a-f]{4}/i.test(text))
+    if (!/[0-9a-f]{4}|[0-9a-f]{2}[ \t][0-9a-f]{2}[ \t][0-9a-f]{2}/i.test(text))
         return out;
-    // Offset-prefixed dumps: runs of lines `<offset>[:] <hex groups> [ascii]`.
-    for (const m of text.matchAll(/(?:^[0-9a-f]{6,8}:?(?:[ \t]{1,4}[0-9a-f]{2,4}){1,16}[^\n]{0,80}(?:\n|$)){1,100000}/gim)) {
+    // Offset-prefixed dumps: runs of lines `<offset>[:] <hex groups> [ascii]`. (Groups of any whole number of bytes up to
+    // 16, and any number of them with an ASCII column of any width: `xxd -g 8`, `xxd -c 32 -g1`.)
+    for (const m of text.matchAll(/(?:^[0-9a-f]{6,8}:?(?:[ \t]{1,4}(?:[0-9a-f]{2}){1,16})[^\n]*(?:\n|$)){1,100000}/gim)) {
         const words = [];
         let bytes = "";
         const lines = m[0].split("\n").filter((l) => l);
@@ -260,7 +266,7 @@ export function findHexDumps(text, inner) {
             const body = line.replace(/^[0-9a-f]{6,8}:?[ \t]+/i, "");
             let digits = 0;
             for (const t of body.split(/[ \t]+/)) {
-                if (!/^(?:[0-9a-f]{2}|[0-9a-f]{4}|[0-9a-f]{8})$/i.test(t) || digits + t.length > step * 2)
+                if (!/^(?:[0-9a-f]{2}){1,16}$/i.test(t) || digits + t.length > step * 2)
                     break;
                 if (t.length === 4)
                     words.push(t.slice(2) + t.slice(0, 2));
@@ -306,14 +312,15 @@ export function findHexDumps(text, inner) {
         runStart = -1;
         lines = 0;
     };
-    for (const m of text.matchAll(/^(?:[0-9a-f]{2}){1,100}\r?$/gim)) {
+    // (Also bytes apart, with no offsets: `od -An -tx1`'s ` 44 42 5f …`.)
+    for (const m of text.matchAll(/^[ \t]*(?:[0-9a-f]{2}[ \t]?){1,100}\r?$/gim)) {
         if (runStart >= 0 && m.index === runEnd + 1) {
             runEnd = m.index + m[0].length;
             lines++;
         }
         else {
             flush();
-            if (m[0].trimEnd().length < 16)
+            if (m[0].replace(/\s+/g, "").length < 16)
                 continue;
             runStart = m.index;
             runEnd = m.index + m[0].length;