start-command 0.39.1 → 0.39.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # start-command
 
+## 0.39.2
+
+### Patch Changes
+
+- 328fa0c: Sanitize `--upload-log` logs and auto-reported issue text with `@link-foundation/sensitive-data-sanitizer` (#250) instead of start-command's own rules, which removed content that is not secret (#249). Before, `Authorization:` was masked to the end of the line, which dropped the rest of one-line JSON request bodies. Every URL with a port was masked, and `sk-` matched inside words such as `disk-baseline-`. Now only credentials are masked (`--credentials-only`): values of credential-named environment variables, the gh `hosts.yml` tokens, and `Authorization` schemes with their token. The rest of the line, account details and URLs with ports stay. The log streams through the library CLI from stdin into a private `0600` copy, and invalid UTF-8 bytes are kept. Any failure blocks the upload with a value-free code such as `Log sanitization failed (ERR_BINARY); upload blocked.` `START_SENSITIVE_DATA_SANITIZER` selects another CLI, and `--no-sanitize` is unchanged.
+
 ## 0.39.1
 
 ### Patch Changes

package/README.md

@@ -41,7 +41,8 @@ checked examples.
 
 `-h` also prints usage. Labels persist across Docker resumes. New detached
 containers support copy-free command handoff; legacy snapshots require capacity
-preflight. Log uploads are private and sanitized; manual `--no-sanitize` opts out.
+preflight. Log uploads are private and sanitized with the bundled
+`@link-foundation/sensitive-data-sanitizer`; manual `--no-sanitize` opts out.
 
 Snapshot resumes take `--snapshot-wait`, `--snapshot-disk-wait`,
 `--remove-original-after`, `--snapshot-size-hint` and `--snapshot-prepare`, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-command",
-  "version": "0.39.1",
+  "version": "0.39.2",
   "description": "Gamification of coding, execute any command with ability to auto-report issues on GitHub",
   "main": "src/bin/cli.js",
   "exports": {
@@ -68,6 +68,7 @@
     ]
   },
   "dependencies": {
+    "@link-foundation/sensitive-data-sanitizer": "^0.12.0",
     "command-stream": "^0.9.4",
     "lino-objects-codec": "^0.4.0"
   },

package/src/lib/failure-handler.js

@@ -9,7 +9,11 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { getTimestamp } = require('./isolation');
-const { sanitizeLogToTemp, StreamingSanitizer } = require('./log-sanitizer');
+const {
+  SanitizationError,
+  sanitizeLogToTemp,
+  sanitizeText,
+} = require('./log-sanitizer');
 
 /**
  * Handle command failure - detect repository, upload log, create issue
@@ -296,8 +300,12 @@ function uploadLog(logPath, options = {}) {
     }
 
     return null;
-  } catch {
-    console.log('Warning: Log preparation or upload failed; upload blocked.');
+  } catch (error) {
+    console.log(
+      error instanceof SanitizationError
+        ? `Warning: ${error.message}`
+        : 'Warning: Log preparation or upload failed; upload blocked.'
+    );
     return null;
   } finally {
     if (prepared) {
@@ -334,9 +342,7 @@ function canCreateIssue(owner, repo) {
  */
 function createIssue(repoInfo, fullCommand, exitCode, logUrl) {
   try {
-    fullCommand = new StreamingSanitizer()
-      .push(Buffer.from(fullCommand), true)
-      .toString();
+    fullCommand = sanitizeText(fullCommand);
     const title = `Command failed with exit code ${exitCode}: ${fullCommand.substring(0, 50)}${fullCommand.length > 50 ? '...' : ''}`;
 
     // Get runtime information

package/src/lib/log-sanitizer.js

@@ -1,267 +1,350 @@
-/** Bounded byte-wise sanitization for logs prepared for publication. */
+/**
+ * Prepares logs and issue text for publication with
+ * @link-foundation/sensitive-data-sanitizer, the sanitizer shared by
+ * start-command, gh-upload-log and hive-mind (issue #250).
+ *
+ * The library masks credentials only (--credentials-only), plus the values of
+ * credential-named environment variables (--env-secrets) and the tokens in the
+ * local gh hosts.yml (--gh-config). It streams the log from stdin, keeps
+ * invalid UTF-8 bytes and writes a new private file atomically (--output).
+ *
+ * One rule stays here: the library masks an unquoted or single-quoted
+ * `Authorization: <scheme> <value>` to the end of the line, which drops the
+ * rest of a logged one-line JSON prompt (issue #249). The pre-pass below masks
+ * only the scheme and its token first; the library keeps values that already
+ * start with [REDACTED]. Remove it with sensitive-data-sanitizer#45.
+ */
+
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
 const BLOCK_SIZE = 64 * 1024;
 const MARKER = '[REDACTED]';
-const SECRET_ENV_NAME =
-  /(?:^|_)(?:TOKEN|(?:API|ACCESS|PRIVATE)?KEY|SECRET|PASSWORD|PASSWD|CREDENTIALS?|AUTH|PAT)(?:_|$)/i;
+const PACKAGE = '@link-foundation/sensitive-data-sanitizer';
+const COMMAND = 'sensitive-data-sanitizer';
+const OVERRIDE = 'START_SENSITIVE_DATA_SANITIZER';
+const OPTIONS = ['--credentials-only', '--env-secrets', '--gh-config'];
 
-// Prefixes intentionally match even truncated tokens. Unbounded values retain a
-// continuation state, so a token or header larger than a block cannot leak its
-// suffix. Latin-1 provides a reversible byte mapping, including invalid UTF-8.
-const RULES = [
-  {
-    pattern:
-      /\b[A-Za-z0-9_-]{2,512}\.[A-Za-z0-9_-]{2,512}\.[A-Za-z0-9_-]{0,512}/g,
-    validate: (value) => {
-      try {
-        return (
-          typeof JSON.parse(
-            Buffer.from(value.split('.')[0], 'base64url').toString()
-          ).alg === 'string'
-        );
-      } catch {
-        return false;
-      }
-    },
-    continuation: /[A-Za-z0-9_.-]/,
-  },
-  {
-    pattern: /[A-Za-z0-9_-]{512,}[A-Za-z0-9_.-]*/g,
-    continuation: /[A-Za-z0-9_.-]/,
-  },
-  {
-    pattern: /(?:gh[pousr]_|github_pat_|sk-)[A-Za-z0-9_-]*/g,
-    continuation: /[A-Za-z0-9_-]/,
-  },
-  { pattern: /(?:AKIA|ASIA)[A-Z0-9]{16}/g },
-  { pattern: /eyJ[A-Za-z0-9_.-]*/g, continuation: /[A-Za-z0-9_.-]/ },
-  {
-    pattern: /(?:Proxy-)?Authorization[ \t]{0,32}:[^\r\n]*/gi,
-    continuation: /[^\r\n]/,
-  },
-  {
-    pattern:
-      /(?:AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)[ \t]{0,32}[=:][ \t]*["']?[^\s"';,]*/g,
-    continuation: /[^\s"';,]/,
-  },
-  {
-    pattern: /(?:https?|git|ssh):\/\/[^\s:/@]{1,256}:[^\s@]*/g,
-    continuation: /[^\s@]/,
-  },
-];
+// The longest header and scheme prefix is 122 bytes.
+const HOLDBACK = 160;
+const HEADER =
+  /((?:Proxy-)?Authorization[ \t]{0,32}:[ \t]{0,32})(?:Bearer|Basic|Digest|token)[ \t]{1,32}/gi;
+// Shell expressions, placeholders and masked values are not credentials.
+const NOT_A_VALUE = '$<[{';
 
-class StreamingSanitizer {
-  constructor(env = process.env) {
-    this.secrets = [
-      ...new Set(
-        Object.entries(env)
-          .filter(
-            ([name, value]) =>
-              SECRET_ENV_NAME.test(name) &&
-              typeof value === 'string' &&
-              value.length
-          )
-          .map(([, value]) => Buffer.from(value).toString('latin1'))
-      ),
-    ].sort((a, b) => b.length - a.length);
-    if (this.secrets.some((value) => value.length > BLOCK_SIZE)) {
-      throw new Error(
-        'Known environment secret is too large for bounded sanitization.'
-      );
-    }
-    this.holdback = this.secrets.reduce(
-      (size, value) => Math.max(size, value.length),
-      2048
-    );
-    this.pending = '';
-    this.continuation = null;
-    this.redactions = 0;
+function isValueByte(code) {
+  return (
+    code > 0x20 &&
+    code !== 0x22 &&
+    code !== 0x27 &&
+    code !== 0x2c &&
+    code !== 0x5c
+  );
+}
+
+function valueEnd(text, start) {
+  let end = start;
+  while (end < text.length && isValueByte(text.charCodeAt(end))) {
+    end++;
   }
+  return end;
+}
 
-  get pendingBytes() {
-    return this.pending.length;
+/**
+ * Masks `Authorization: <scheme> <token>` as `Authorization: [REDACTED]`.
+ * It works on bytes (latin1 maps each byte to one character), so invalid
+ * UTF-8 passes through unchanged, and holds at most HOLDBACK pending bytes.
+ */
+class AuthorizationHeaderMask {
+  constructor() {
+    this.pending = '';
+    this.inValue = false;
+    this.redactions = 0;
   }
 
-  findMatches(input) {
-    const matches = [];
-    for (const rule of RULES) {
-      rule.pattern.lastIndex = 0;
-      for (
-        let match = rule.pattern.exec(input);
-        match;
-        match = rule.pattern.exec(input)
-      ) {
-        if (!rule.validate || rule.validate(match[0])) {
-          matches.push({
-            index: match.index,
-            end: match.index + match[0].length,
-            continuation: rule.continuation,
-          });
-        }
+  push(block, final = false) {
+    const text = this.pending + block.toString('latin1');
+    this.pending = '';
+    let output = '';
+    let offset = 0;
+    if (this.inValue) {
+      offset = valueEnd(text, 0);
+      if (offset === text.length && !final) {
+        return Buffer.alloc(0);
       }
+      this.inValue = false;
     }
-    for (const secret of this.secrets) {
-      for (
-        let index = input.indexOf(secret);
-        index >= 0;
-        index = input.indexOf(secret, index + 1)
+    HEADER.lastIndex = offset;
+    let match;
+    while ((match = HEADER.exec(text))) {
+      const valueStart = match.index + match[0].length;
+      if (valueStart === text.length && !final) {
+        output += text.slice(offset, match.index);
+        this.pending = text.slice(match.index);
+        return Buffer.from(output, 'latin1');
+      }
+      if (
+        valueStart === text.length ||
+        !isValueByte(text.charCodeAt(valueStart)) ||
+        NOT_A_VALUE.includes(text[valueStart])
       ) {
-        matches.push({ index, end: index + secret.length });
+        continue;
       }
-    }
-    matches.sort((a, b) => a.index - b.index || b.end - a.end);
-    const merged = [];
-    for (const match of matches) {
-      const previous = merged[merged.length - 1];
-      if (previous && match.index <= previous.end) {
-        if (match.end > previous.end) {
-          previous.end = match.end;
-          previous.continuation = match.continuation;
-        } else if (match.end === previous.end && match.continuation) {
-          // Nested tokens must not narrow a containing header/URL's suffix.
-          const retained = previous.continuation;
-          const additional = match.continuation;
-          previous.continuation = retained
-            ? { test: (byte) => retained.test(byte) || additional.test(byte) }
-            : additional;
-        }
-      } else {
-        merged.push({ ...match });
+      output += text.slice(offset, match.index + match[1].length) + MARKER;
+      this.redactions++;
+      offset = valueEnd(text, valueStart);
+      if (offset === text.length && !final) {
+        this.inValue = true;
+        return Buffer.from(output, 'latin1');
       }
+      HEADER.lastIndex = offset;
     }
-    return merged;
+    const safeEnd = final
+      ? text.length
+      : Math.max(offset, text.length - HOLDBACK);
+    output += text.slice(offset, safeEnd);
+    this.pending = text.slice(safeEnd);
+    return Buffer.from(output, 'latin1');
   }
+}
 
-  push(block, final = false) {
-    let input = this.pending + block.toString('latin1');
-    this.pending = '';
-    if (this.continuation) {
-      let end = 0;
-      while (end < input.length && this.continuation.test(input[end])) {
-        end++;
-      }
-      input = input.slice(end);
-      if (!input.length && !final) {
-        return Buffer.alloc(0);
-      }
-      this.continuation = null;
+/** Value-free failure: `code` is a fixed ERR_* name, never log content. */
+class SanitizationError extends Error {
+  constructor(code, subject = 'Log') {
+    super(
+      `${subject} sanitization failed (${code}); ${subject === 'Log' ? 'upload' : 'publication'} blocked.`
+    );
+    this.code = code;
+  }
+}
+
+function isFile(filePath) {
+  try {
+    return fs.statSync(filePath).isFile();
+  } catch {
+    return false;
+  }
+}
+
+function findBundledCli() {
+  // Walk up node_modules directories the way require() does; the package
+  // exports only ESM, so require.resolve() cannot locate its files.
+  const relative = path.join(PACKAGE, 'bin', `${COMMAND}.js`);
+  let directory = __dirname;
+  for (;;) {
+    const candidate = path.join(directory, 'node_modules', relative);
+    if (isFile(candidate)) {
+      return candidate;
     }
-    const safeEnd = final
-      ? input.length
-      : Math.max(0, input.length - this.holdback);
-    let offset = 0;
-    const output = [];
-    for (const match of this.findMatches(input)) {
-      if (match.index >= safeEnd) {
-        break;
+    const parent = path.dirname(directory);
+    if (parent === directory) {
+      return null;
+    }
+    directory = parent;
+  }
+}
+
+/**
+ * Resolve the library CLI: START_SENSITIVE_DATA_SANITIZER, then the bundled
+ * dependency run by the current runtime, then sensitive-data-sanitizer on PATH.
+ * @returns {{command: string, args: string[]}|null}
+ */
+function resolveSanitizerCommand(env = process.env) {
+  if (env[OVERRIDE]) {
+    return { command: env[OVERRIDE], args: [] };
+  }
+  const bundled = findBundledCli();
+  if (bundled) {
+    return { command: process.execPath, args: [bundled] };
+  }
+  const { resolveCommand } = require('./log-uploader');
+  const command = resolveCommand(COMMAND);
+  return command ? { command, args: [] } : null;
+}
+
+function runSanitizer(args, options, subject) {
+  const env = options.env || process.env;
+  const resolved = resolveSanitizerCommand(env);
+  if (!resolved) {
+    throw new SanitizationError('ERR_UNAVAILABLE', subject);
+  }
+  const result = spawnSync(resolved.command, [...resolved.args, ...args], {
+    env,
+    input: options.input,
+    stdio: options.stdio || ['pipe', 'pipe', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+    shell:
+      process.platform === 'win32' && /\.(cmd|bat)$/i.test(resolved.command),
+    windowsHide: true,
+  });
+  if (result.error) {
+    throw new SanitizationError('ERR_UNAVAILABLE', subject);
+  }
+  if (result.status !== 0) {
+    // The library prints value-free messages; only their ERR_* code is kept.
+    const code = String(result.stderr || '').match(/\bERR_[A-Z_]+\b/);
+    throw new SanitizationError(code ? code[0] : 'ERR_SANITIZER', subject);
+  }
+  return result;
+}
+
+/**
+ * Sanitize a short text, such as the failing command quoted in an issue.
+ * @returns {string}
+ */
+function sanitizeText(text, options = {}) {
+  const input = new AuthorizationHeaderMask().push(Buffer.from(text), true);
+  const result = runSanitizer(
+    ['redact', '-', ...OPTIONS],
+    { ...options, input },
+    'Text'
+  );
+  return result.stdout.toString();
+}
+
+function countMarkers(filePath) {
+  const descriptor = fs.openSync(filePath, 'r');
+  const buffer = Buffer.alloc(BLOCK_SIZE);
+  let count = 0;
+  let carry = '';
+  try {
+    for (;;) {
+      const length = fs.readSync(descriptor, buffer, 0, BLOCK_SIZE, null);
+      const text = carry + buffer.toString('latin1', 0, length);
+      let index = text.indexOf(MARKER);
+      let next = 0;
+      while (index !== -1) {
+        count++;
+        next = index + MARKER.length;
+        index = text.indexOf(MARKER, next);
       }
-      output.push(input.slice(offset, match.index), MARKER);
-      this.redactions++;
-      offset = match.end;
-      if (offset === input.length && match.continuation && !final) {
-        this.continuation = match.continuation;
-        break;
+      if (length === 0) {
+        return count;
       }
+      carry = text.slice(Math.max(next, text.length - MARKER.length + 1));
     }
-    const end = Math.max(offset, safeEnd);
-    output.push(input.slice(offset, end));
-    this.pending = input.slice(end);
-    return Buffer.from(output.join(''), 'latin1');
+  } finally {
+    fs.closeSync(descriptor);
   }
 }
 
-/** Returns a private copy plus cleanup; every preparation error blocks upload. */
-function sanitizeLogToTemp(sourcePath, options = {}) {
-  let directory;
-  let source;
-  let destination;
-  let ready = false;
-  let stage = 'environment';
+function createPrivateFile(filePath) {
+  const descriptor = fs.openSync(filePath, 'wx', 0o600);
+  if (process.platform !== 'win32') {
+    fs.fchmodSync(descriptor, 0o600);
+  }
+  return descriptor;
+}
+
+function maskAuthorizationHeaders(sourcePath, stagePath) {
+  const source = fs.openSync(sourcePath, 'r');
+  let stage;
   try {
-    const sanitizer = new StreamingSanitizer(options.env || process.env);
-    stage = 'source';
-    source = fs.openSync(sourcePath, 'r');
     if (!fs.fstatSync(source).isFile()) {
-      throw new Error('Source must be a regular file.');
+      throw new SanitizationError('ERR_SOURCE');
     }
-    stage = 'private-file';
-    directory = fs.mkdtempSync(path.join(os.tmpdir(), 'start-sanitized-'));
-    fs.chmodSync(directory, 0o700);
-    const target = path.join(directory, 'execution.log');
-    destination = fs.openSync(target, 'wx', 0o600);
-    fs.fchmodSync(destination, 0o600);
+    stage = createPrivateFile(stagePath);
+    const mask = new AuthorizationHeaderMask();
     const buffer = Buffer.alloc(BLOCK_SIZE);
     let bytes = 0;
-    const write = (output) => {
-      stage = 'write';
-      let offset = 0;
-      while (offset < output.length) {
-        const written = fs.writeSync(
-          destination,
-          output,
-          offset,
-          output.length - offset
-        );
-        if (!written) {
-          throw new Error('No progress writing sanitized log.');
-        }
-        offset += written;
-      }
-    };
     for (;;) {
-      stage = 'read';
-      const length = fs.readSync(source, buffer, 0, buffer.length, null);
-      if (!length) {
+      const length = fs.readSync(source, buffer, 0, BLOCK_SIZE, null);
+      const output = mask.push(buffer.subarray(0, length), length === 0);
+      if (output.length) {
+        fs.writeSync(stage, output);
+      }
+      if (length === 0) {
         break;
       }
       bytes += length;
-      stage = 'scan';
-      write(sanitizer.push(buffer.subarray(0, length)));
     }
-    write(sanitizer.push(Buffer.alloc(0), true));
-    stage = 'sync';
-    fs.fsyncSync(destination);
-    fs.closeSync(destination);
-    destination = undefined;
+    fs.fsyncSync(stage);
+    return bytes;
+  } finally {
     fs.closeSync(source);
-    source = undefined;
+    if (stage !== undefined) {
+      fs.closeSync(stage);
+    }
+  }
+}
+
+/**
+ * Create a private sanitized copy of a log. The source is never modified;
+ * any failure removes the copy and throws a value-free SanitizationError.
+ * @returns {{path: string, cleanup: Function}}
+ */
+function sanitizeLogToTemp(sourcePath, options = {}) {
+  let directory;
+  let code = 'ERR_PRIVATE_FILE';
+  const cleanup = () => {
+    if (directory) {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  };
+  try {
+    directory = fs.mkdtempSync(path.join(os.tmpdir(), 'start-sanitized-'));
+    if (process.platform !== 'win32') {
+      fs.chmodSync(directory, 0o700);
+    }
+    const stagePath = path.join(directory, 'authorization-masked.log');
+    const target = path.join(directory, 'execution.log');
+    code = 'ERR_SOURCE';
+    const bytes = maskAuthorizationHeaders(sourcePath, stagePath);
+    code = 'ERR_PRIVATE_FILE';
+    const input = fs.openSync(stagePath, 'r');
+    try {
+      const size = Math.max(1, fs.fstatSync(input).size);
+      runSanitizer(
+        [
+          'redact',
+          '-',
+          '--stream',
+          ...OPTIONS,
+          '--max-bytes',
+          String(size),
+          '--output',
+          target,
+        ],
+        { env: options.env, stdio: [input, 'ignore', 'pipe'] }
+      );
+    } finally {
+      fs.closeSync(input);
+    }
+    code = 'ERR_OUTPUT';
+    const status = fs.lstatSync(target);
+    if (
+      !status.isFile() ||
+      (process.platform !== 'win32' && (status.mode & 0o077) !== 0)
+    ) {
+      throw new SanitizationError('ERR_OUTPUT');
+    }
     if (options.verbose) {
+      const redactions = countMarkers(target) - countMarkers(sourcePath);
       console.log(
-        `Prepared private sanitized log: ${bytes} bytes scanned, ${sanitizer.redactions} redactions.`
+        `Prepared private sanitized log: ${bytes} bytes scanned, ${Math.max(0, redactions)} redactions.`
       );
     }
-    ready = true;
-    return {
-      path: target,
-      cleanup: () => fs.rmSync(directory, { recursive: true, force: true }),
-    };
-  } catch {
+    fs.rmSync(stagePath, { force: true });
+    return { path: target, cleanup };
+  } catch (error) {
+    cleanup();
+    // Static messages keep paths and system error details out of the output.
+    const failure =
+      error instanceof SanitizationError ? error : new SanitizationError(code);
     if (options.verbose) {
-      console.log(`Log sanitization failed at stage: ${stage}.`);
-    }
-    // Do not echo error messages: paths and exception details can carry secrets.
-    throw new Error('Log sanitization failed; upload blocked.');
-  } finally {
-    for (const fd of [destination, source]) {
-      if (fd !== undefined) {
-        try {
-          fs.closeSync(fd);
-        } catch {
-          /* Best effort after failure. */
-        }
-      }
-    }
-    if (directory && !ready) {
-      try {
-        fs.rmSync(directory, { recursive: true, force: true });
-      } catch {
-        /* Upload remains blocked. */
-      }
+      console.error(failure.message);
     }
+    throw failure;
   }
 }
 
-module.exports = { StreamingSanitizer, sanitizeLogToTemp };
+module.exports = {
+  AuthorizationHeaderMask,
+  BLOCK_SIZE,
+  SanitizationError,
+  resolveSanitizerCommand,
+  sanitizeLogToTemp,
+  sanitizeText,
+};

package/src/lib/log-uploader.js

@@ -6,7 +6,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
-const { sanitizeLogToTemp } = require('./log-sanitizer');
+const { SanitizationError, sanitizeLogToTemp } = require('./log-sanitizer');
 
 function isExecutable(filePath) {
   try {
@@ -174,11 +174,14 @@ function uploadLogPath(logPath, options = {}) {
       };
     }
     return { success: true, exitCode: 0 };
-  } catch {
+  } catch (error) {
     return {
       success: false,
       exitCode: 1,
-      error: 'Log preparation or upload failed; upload blocked.',
+      error:
+        error instanceof SanitizationError
+          ? error.message
+          : 'Log preparation or upload failed; upload blocked.',
     };
   } finally {
     if (prepared) {

package/test/log-sanitizer.js

@@ -6,156 +6,238 @@ const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
 const {
+  AuthorizationHeaderMask,
+  SanitizationError,
+  resolveSanitizerCommand,
   sanitizeLogToTemp,
-  StreamingSanitizer,
+  sanitizeText,
 } = require('../src/lib/log-sanitizer');
 
+const GH_CONFIG_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-gh-'));
+
+// Only what the runtime needs, so the host's own credential-named variables
+// and gh login cannot change the expected output.
+function testEnv(extra = {}) {
+  const env = { GH_CONFIG_DIR };
+  for (const name of [
+    'PATH',
+    'Path',
+    'SystemRoot',
+    'SYSTEMROOT',
+    'TEMP',
+    'TMP',
+    'TMPDIR',
+    'HOME',
+    'USERPROFILE',
+  ]) {
+    if (process.env[name] !== undefined) {
+      env[name] = process.env[name];
+    }
+  }
+  return { ...env, ...extra };
+}
+
+function withLog(content, callback) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-test-'));
+  const source = path.join(dir, 'source.log');
+  fs.writeFileSync(source, content);
+  try {
+    return callback(source, dir);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function sanitizeFile(content, env = testEnv()) {
+  return withLog(content, (source) => {
+    const copy = sanitizeLogToTemp(source, { env });
+    try {
+      return fs.readFileSync(copy.path);
+    } finally {
+      copy.cleanup();
+    }
+  });
+}
+
+function mask(input, blockSize) {
+  const authorization = new AuthorizationHeaderMask();
+  const blocks = [];
+  for (let offset = 0; offset < input.length; offset += blockSize) {
+    blocks.push(authorization.push(input.subarray(offset, offset + blockSize)));
+    assert.ok(authorization.pending.length <= blockSize + 160);
+  }
+  blocks.push(authorization.push(Buffer.alloc(0), true));
+  return Buffer.concat(blocks).toString();
+}
+
+// The three lines from issue #249, which the old rules truncated.
+const ISSUE_249_LINES = [
+  "Command: gate='/tmp/hive-mind-disk-baseline-0ce9e170-e6d3-494d-91e1-0d820245d34b'",
+  '🧠 Formal AI: endpoint http://172.18.0.2:8080/api/openai/v1',
+  '{"bodyPreview":"{\\"messages\\":[{\\"content\\":\\"use: curl -L -H \\\\\\"Authorization: token $(gh auth token)\\\\\\" -o <filename> <url>\\\\n...the rest of a 100 KB prompt...\\"}]}"}',
+  'proxy http://myproxy:3128 and http://127.0.0.1:34271/session',
+  'Authorization: [REDACTED] stays as it is',
+  'account konard@example.com https://github.com/konard',
+];
+
 function credentials() {
   return [
     ...'pousr'.split('').map((kind) => `gh${kind}_${'a'.repeat(36)}`),
     `github_` + `pat_${'b'.repeat(82)}`,
     `sk-${'c'.repeat(48)}`,
     `sk-` + `proj-${'d'.repeat(90)}`,
-    `sk-` + `ant-api03-${'e'.repeat(90)}`,
     `AK` + `IA${'F'.repeat(16)}`,
     `AS` + `IA${'G'.repeat(16)}`,
     'ey' + 'JhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.signature',
-    'Authorization: Bearer arbitrary-credential',
-    'Proxy-Authorization: Basic encoded-credential',
-    'https://user:password@example.test/repo.git',
-    'AWS_SECRET_ACCESS_KEY=arbitrary-aws-secret',
+    'arbitrary-credential',
+    'encoded-credential',
+    'password',
+    'arbitrary-aws-secret',
     'custom-secret-value',
-    `${Buffer.from(' \n{"alg":"HS256"}').toString('base64url')}.${Buffer.from('{"sub":"x"}').toString('base64url')}.signature`,
   ];
 }
 
-function sanitize(input, blockSize) {
-  const sanitizer = new StreamingSanitizer({
-    START_TEST_SECRET: 'custom-secret-value',
+describe('log sanitization', () => {
+  it('keeps every line from issue #249 and public account details', () => {
+    const input = `${ISSUE_249_LINES.join('\n')}\n`;
+    assert.strictEqual(sanitizeFile(input).toString(), input);
   });
-  const blocks = [];
-  for (let offset = 0; offset < input.length; offset += blockSize) {
-    blocks.push(sanitizer.push(input.subarray(offset, offset + blockSize)));
-  }
-  blocks.push(sanitizer.push(Buffer.alloc(0), true));
-  return Buffer.concat(blocks);
-}
 
-describe('log sanitization', () => {
-  it('redacts required formats and environment values at every chunk boundary', () => {
-    const secrets = credentials();
-    for (const size of [1, 7, 31, 256, 1024, 65536]) {
-      const input = Buffer.from(
-        `ordinary utf8: café 😀\n${' '.repeat(Math.max(0, size - 43))}${secrets.join('\n')}\n${'padding\n'.repeat(400)}finished\n`
-      );
-      const output = sanitize(input, size).toString();
-      for (const secret of secrets) {
-        assert.ok(!output.includes(secret));
-      }
-      for (const value of [
-        'arbitrary-credential',
-        'encoded-credential',
-        'password',
-        'arbitrary-aws-secret',
-      ]) {
-        assert.ok(!output.includes(value));
-      }
-      assert.ok(output.startsWith('ordinary utf8: café 😀\n'));
-      assert.ok(output.endsWith('\nfinished\n'));
+  it('redacts credentials and credential-named environment values', () => {
+    const input = [
+      ...credentials().slice(0, 9),
+      'Authorization: Bearer arbitrary-credential',
+      'Proxy-Authorization: Basic encoded-credential',
+      'clone https://user:password@example.test/repo.git',
+      'AWS_SECRET_ACCESS_KEY=arbitrary-aws-secret',
+      'value custom-secret-value end',
+      'ordinary utf8: café 😀',
+      '',
+    ].join('\n');
+    const output = sanitizeFile(
+      input,
+      testEnv({ START_TEST_SECRET: 'custom-secret-value' })
+    ).toString();
+    for (const [index, secret] of credentials().entries()) {
+      assert.ok(!output.includes(secret), `leaked secret #${index}`);
+    }
+    for (const kept of [
+      'Authorization: [REDACTED]\n',
+      'Proxy-Authorization: [REDACTED]\n',
+      'clone https://[REDACTED]@example.test/repo.git\n',
+      'value [REDACTED] end\n',
+      'ordinary utf8: café 😀\n',
+    ]) {
+      assert.ok(output.includes(kept), `missing ${kept}`);
     }
   });
 
-  it('bounds memory for long tokens and authorization values without releasing suffixes', () => {
-    for (const prefix of ['gh' + 'p_', 'Authorization: Bearer ']) {
-      const sanitizer = new StreamingSanitizer({});
-      let output = sanitizer.push(Buffer.from(prefix));
-      for (let i = 0; i < 128; i++) {
-        output = Buffer.concat([
-          output,
-          sanitizer.push(Buffer.alloc(16384, 97)),
-        ]);
-        assert.ok(sanitizer.pendingBytes <= 65536);
-      }
-      output = Buffer.concat([
-        output,
-        sanitizer.push(Buffer.from('\nordinary\n'), true),
-      ]);
-      assert.strictEqual(output.toString(), '[REDACTED]\nordinary\n');
+  it('masks only the Authorization scheme and token, keeping the rest of the line (#249)', () => {
+    const cases = [
+      [
+        `curl -H 'Authorization: Basic dXNlcjpwYXNz' -o out.txt url`,
+        `curl -H 'Authorization: [REDACTED]' -o out.txt url`,
+      ],
+      [
+        'Authorization: Bearer abc rest of line',
+        'Authorization: [REDACTED] rest of line',
+      ],
+      [
+        'Authorization: token abc, other: keep',
+        'Authorization: [REDACTED], other: keep',
+      ],
+      [
+        '{"h":"Authorization: Bearer abc\\" tail","next":"keep"}',
+        '{"h":"Authorization: [REDACTED]\\" tail","next":"keep"}',
+      ],
+      [
+        'Authorization: token $(gh auth token) and ${GITHUB_TOKEN}',
+        'Authorization: token $(gh auth token) and ${GITHUB_TOKEN}',
+      ],
+      ['Authorization: Bearer <token>', 'Authorization: Bearer <token>'],
+    ];
+    const input = cases.map(([line]) => line).join('\n');
+    const expected = cases.map(([, line]) => line).join('\n');
+    for (const size of [1, 7, 31, 256, 65536]) {
+      assert.strictEqual(mask(Buffer.from(input), size), expected);
     }
+    // The library itself masks the scheme before a placeholder; nothing is lost.
+    assert.strictEqual(
+      sanitizeFile(input).toString(),
+      expected.replace('Bearer <token>', '[REDACTED] <token>')
+    );
   });
 
-  it('retains full header continuation when an inner token reaches the same block boundary', () => {
-    const sanitizer = new StreamingSanitizer({});
+  it('masks long Authorization tokens across blocks with bounded memory', () => {
     const input = Buffer.from(
-      `Authorization: Bearer gh${'p_'}${'a'.repeat(131072)} trailing-private-value\nordinary\n`
+      `Authorization: Bearer ${'a'.repeat(200000)} tail\nordinary\n`
     );
-    const output = [];
-    for (let offset = 0; offset < input.length; offset += 65536) {
-      output.push(sanitizer.push(input.subarray(offset, offset + 65536)));
-    }
-    output.push(sanitizer.push(Buffer.alloc(0), true));
     assert.strictEqual(
-      Buffer.concat(output).toString(),
-      '[REDACTED]\nordinary\n'
+      mask(input, 65536),
+      'Authorization: [REDACTED] tail\nordinary\n'
+    );
+    assert.strictEqual(
+      sanitizeFile(input).toString(),
+      'Authorization: [REDACTED] tail\nordinary\n'
     );
   });
 
-  it('redacts AWS assignment values enclosed in either quote style', () => {
-    const sanitizer = new StreamingSanitizer({});
-    const output = sanitizer
-      .push(
-        Buffer.from(
-          `AWS_SECRET_ACCESS_KEY="quoted-aws-secret"\nAWS_SESSION_TOKEN='quoted-session-value'\n`
-        ),
-        true
-      )
-      .toString();
-    assert.ok(!output.includes('quoted-aws-secret'));
-    assert.ok(!output.includes('quoted-session-value'));
-  });
-
-  it('redacts multiline and short known secrets, preserving unrelated bytes', () => {
-    const sanitizer = new StreamingSanitizer({
-      GH_TOKEN: 'abc\nxyz',
-      TEST_PASSWORD: '!',
-    });
-    const output = sanitizer
-      .push(Buffer.from('safe abc\nxyz value !'), true)
-      .toString();
-    assert.strictEqual(output, 'safe [REDACTED] value [REDACTED]');
+  it('preserves invalid UTF-8 bytes and line endings', () => {
+    const input = Buffer.concat([
+      Buffer.from('bad '),
+      Buffer.from([0xff, 0xfe, 0xc3]),
+      Buffer.from(` gh${'p_'}${'x'.repeat(36)}\r\nnext\rend`),
+    ]);
+    const expected = Buffer.concat([
+      Buffer.from('bad '),
+      Buffer.from([0xff, 0xfe, 0xc3]),
+      Buffer.from(' [REDACTED]\r\nnext\rend'),
+    ]);
+    assert.deepStrictEqual(sanitizeFile(input), expected);
+    assert.deepStrictEqual(sanitizeFile(Buffer.alloc(0)), Buffer.alloc(0));
   });
 
-  it('merges overlapping environment secrets and preserves ordinary domain names', () => {
-    const sanitizer = new StreamingSanitizer({
-      GH_TOKEN: 'abcde',
-      TEST_PASSWORD: 'cdefg',
-      GITHUB_PAT: 'opaque-known-pat',
-    });
+  it('sanitizes issue text with the same rules', () => {
+    const token = `gh${'p_'}${'a'.repeat(36)}`;
     assert.strictEqual(
-      sanitizer
-        .push(
-          Buffer.from('abcdefg opaque-known-pat example.test.invalid'),
-          true
-        )
-        .toString(),
-      '[REDACTED] [REDACTED] example.test.invalid'
+      sanitizeText(`echo ${token} 😀 'Authorization: token abc' -o x`, {
+        env: testEnv(),
+      }),
+      `echo [REDACTED] 😀 'Authorization: [REDACTED]' -o x`
     );
-    const short = new StreamingSanitizer({ GH_TOKEN: 'a' });
     assert.strictEqual(
-      short.push(Buffer.alloc(65536, 97), true).toString(),
-      '[REDACTED]'
+      sanitizeText('echo "quoted" $(id) `hostname`', { env: testEnv() }),
+      'echo "quoted" $(id) `hostname`'
+    );
+  });
+
+  it('resolves the override first and the bundled library otherwise', () => {
+    assert.deepStrictEqual(
+      resolveSanitizerCommand({ START_SENSITIVE_DATA_SANITIZER: '/x/sds' }),
+      { command: '/x/sds', args: [] }
+    );
+    const bundled = resolveSanitizerCommand({});
+    assert.strictEqual(bundled.command, process.execPath);
+    assert.ok(
+      bundled.args[0].endsWith(
+        path.join(
+          'sensitive-data-sanitizer',
+          'bin',
+          'sensitive-data-sanitizer.js'
+        )
+      )
     );
   });
 
   it('creates a private sanitized copy and removes it without changing the source', () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-test-'));
-    const source = path.join(dir, 'source.log');
     const input = `gh` + `p_${'x'.repeat(36)}`;
-    fs.writeFileSync(source, input);
-    try {
-      const copy = sanitizeLogToTemp(source, { env: {} });
+    withLog(input, (source) => {
+      const copy = sanitizeLogToTemp(source, { env: testEnv() });
       assert.notStrictEqual(copy.path, source);
       assert.strictEqual(fs.readFileSync(copy.path, 'utf8'), '[REDACTED]');
+      assert.deepStrictEqual(fs.readdirSync(path.dirname(copy.path)), [
+        'execution.log',
+      ]);
       if (process.platform !== 'win32') {
         assert.strictEqual(fs.statSync(copy.path).mode & 0o777, 0o600);
         assert.strictEqual(
@@ -165,23 +247,17 @@ describe('log sanitization', () => {
       }
       assert.strictEqual(fs.readFileSync(source, 'utf8'), input);
       copy.cleanup();
-      assert.ok(!fs.existsSync(copy.path));
-    } finally {
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
+      assert.ok(!fs.existsSync(path.dirname(copy.path)));
+    });
   });
 
-  it('enforces private permissions at creation even with a permissive umask', () => {
+  it('keeps private permissions even with a permissive umask', () => {
     if (process.platform === 'win32') {
       return;
     }
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sanitize-creation-'));
-    const source = path.join(dir, 'source.log');
-    fs.writeFileSync(source, 'ordinary output');
     const originalOpen = fs.openSync;
     const originalUmask = process.umask(0);
     let creationChecked = false;
-    let copy;
     fs.openSync = (...args) => {
       if (args[1] !== 'wx') {
         return originalOpen(...args);
@@ -196,26 +272,104 @@ describe('log sanitization', () => {
       return descriptor;
     };
     try {
-      copy = sanitizeLogToTemp(source, { env: {} });
-      assert.ok(creationChecked);
-      assert.strictEqual(fs.readFileSync(copy.path, 'utf8'), 'ordinary output');
+      withLog('ordinary output', (source) => {
+        const copy = sanitizeLogToTemp(source, { env: testEnv() });
+        try {
+          assert.ok(creationChecked);
+          assert.strictEqual(fs.statSync(copy.path).mode & 0o777, 0o600);
+          assert.strictEqual(
+            fs.readFileSync(copy.path, 'utf8'),
+            'ordinary output'
+          );
+        } finally {
+          copy.cleanup();
+        }
+      });
     } finally {
       fs.openSync = originalOpen;
       process.umask(originalUmask);
-      copy?.cleanup();
-      fs.rmSync(dir, { recursive: true, force: true });
     }
   });
 
-  it('fails closed on invalid source and excessive environment secret sizes', () => {
-    assert.throws(
-      () => sanitizeLogToTemp('/does-not-exist', { env: {} }),
-      /sanitization failed/i
-    );
+  it('reports scanned bytes and added redactions in verbose mode only', () => {
+    const messages = [];
+    const originalLog = console.log;
+    console.log = (message) => messages.push(message);
+    try {
+      withLog(`[REDACTED] gh${'p_'}${'x'.repeat(36)}\n`, (source) => {
+        sanitizeLogToTemp(source, { env: testEnv() }).cleanup();
+        sanitizeLogToTemp(source, { env: testEnv(), verbose: true }).cleanup();
+      });
+    } finally {
+      console.log = originalLog;
+    }
+    assert.deepStrictEqual(messages, [
+      'Prepared private sanitized log: 52 bytes scanned, 1 redactions.',
+    ]);
+  });
+
+  it('fails closed with value-free codes and leaves no copy behind', () => {
+    const before = fs
+      .readdirSync(os.tmpdir())
+      .filter((name) => name.startsWith('start-sanitized-')).length;
+    const attempt = (source, env = testEnv()) => {
+      try {
+        sanitizeLogToTemp(source, { env }).cleanup();
+      } catch (error) {
+        assert.ok(error instanceof SanitizationError);
+        return error;
+      }
+      assert.fail('sanitization must fail');
+    };
+    assert.match(attempt('/does-not-exist').message, /\(ERR_SOURCE\)/);
+    assert.match(attempt(os.tmpdir()).message, /\(ERR_SOURCE\)/);
+    withLog('secret\0binary', (source, dir) => {
+      // The library rejects NUL bytes rather than guessing at binary content.
+      assert.strictEqual(attempt(source).code, 'ERR_BINARY');
+      assert.strictEqual(
+        attempt(
+          source,
+          testEnv({
+            START_SENSITIVE_DATA_SANITIZER: path.join(dir, 'missing'),
+          })
+        ).code,
+        'ERR_UNAVAILABLE'
+      );
+      if (process.platform !== 'win32') {
+        const failing = path.join(dir, 'failing-sanitizer');
+        fs.writeFileSync(
+          failing,
+          '#!/bin/sh\necho "secret-from-stderr (ERR_WORKER)" >&2\nexit 2\n',
+          { mode: 0o755 }
+        );
+        const error = attempt(
+          source,
+          testEnv({ START_SENSITIVE_DATA_SANITIZER: failing })
+        );
+        assert.strictEqual(
+          error.message,
+          'Log sanitization failed (ERR_WORKER); upload blocked.'
+        );
+        // A sanitizer that succeeds without writing the output blocks too.
+        fs.writeFileSync(failing, '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+        assert.strictEqual(
+          attempt(source, testEnv({ START_SENSITIVE_DATA_SANITIZER: failing }))
+            .code,
+          'ERR_OUTPUT'
+        );
+      }
+    });
     assert.throws(
-      () => new StreamingSanitizer({ GH_TOKEN: 'a'.repeat(65537) }),
-      /too large/i
+      () =>
+        sanitizeText('x', {
+          env: testEnv({ START_SENSITIVE_DATA_SANITIZER: '/does-not-exist' }),
+        }),
+      /^Error: Text sanitization failed \(ERR_UNAVAILABLE\); publication blocked\.$/
     );
+    const after = fs
+      .readdirSync(os.tmpdir())
+      .filter((name) => name.startsWith('start-sanitized-')).length;
+    assert.ok(after <= before);
   });
 
   it('blocks both upload paths on read or write failure and does not expose exception text', () => {
@@ -234,7 +388,12 @@ describe('log sanitization', () => {
           throw new Error('sensitive error details');
         };
         try {
-          assert.strictEqual(uploadLogPath(source).success, false);
+          const result = uploadLogPath(source);
+          assert.strictEqual(result.success, false);
+          assert.strictEqual(
+            result.error,
+            'Log sanitization failed (ERR_SOURCE); upload blocked.'
+          );
           assert.strictEqual(uploadLog(source), null);
         } finally {
           fs[method] = original;
@@ -245,6 +404,11 @@ describe('log sanitization', () => {
           (message) => !message.includes('sensitive error details')
         )
       );
+      assert.ok(
+        messages.includes(
+          'Warning: Log sanitization failed (ERR_SOURCE); upload blocked.'
+        )
+      );
     } finally {
       console.log = originalLog;
       fs.rmSync(dir, { recursive: true, force: true });
@@ -257,7 +421,9 @@ describe('log sanitization', () => {
     }
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'upload-sanitize-test-'));
     const log = path.join(dir, 'source.log');
-    fs.writeFileSync(log, `gh` + `p_${'x'.repeat(36)}`);
+    const line =
+      "Command: gate='/tmp/hive-mind-disk-baseline-0ce9e170' http://172.18.0.2:8080/v1";
+    fs.writeFileSync(log, `${line} gh` + `p_${'x'.repeat(36)}`);
     fs.writeFileSync(
       path.join(dir, 'gh-upload-log'),
       '#!/bin/sh\nprintf "%s\\n" "$@" > "$CAPTURE_ARGS"\ncat "$1" > "$CAPTURE_LOG"\nls -ld "$1" | cut -c1-10 > "$CAPTURE_MODE"\necho https://gist.github.com/test/id\n',
@@ -270,15 +436,14 @@ describe('log sanitization', () => {
             ? `require(${JSON.stringify(require.resolve('../src/lib/failure-handler'))}).uploadLog(process.env.SOURCE_LOG)`
             : `require(${JSON.stringify(require.resolve('../src/lib/log-uploader'))}).uploadLogPath(process.env.SOURCE_LOG, { noSanitize: ${kind === 'optout'} })`;
         execFileSync(process.execPath, ['-e', script], {
-          env: {
-            ...process.env,
+          env: testEnv({
             PATH: `${dir}${path.delimiter}${process.env.PATH}`,
             SOURCE_LOG: log,
             CAPTURE_ARGS: path.join(dir, 'args'),
             CAPTURE_LOG: path.join(dir, 'uploaded'),
             CAPTURE_MODE: path.join(dir, 'mode'),
             GH_UPLOAD_PUBLIC: 'true',
-          },
+          }),
           stdio: 'pipe',
         });
         const args = fs
@@ -288,7 +453,9 @@ describe('log sanitization', () => {
         assert.strictEqual(args[1], '--private');
         assert.strictEqual(
           fs.readFileSync(path.join(dir, 'uploaded'), 'utf8'),
-          kind === 'optout' ? fs.readFileSync(log, 'utf8') : '[REDACTED]'
+          kind === 'optout'
+            ? fs.readFileSync(log, 'utf8')
+            : `${line} [REDACTED]`
         );
         if (kind !== 'optout') {
           assert.notStrictEqual(args[0], log);