From e3a43bed5a6078bf9c38e9ffd153916e2bdb0e25 Mon Sep 17 00:00:00 2001
From: "homeboy-ci[bot]" <266378653+homeboy-ci[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:35:09 +0000
Subject: [PATCH] fix: preserve ordinary prose during redaction

---
 packages/runtime-core/src/redaction.ts |  3 ++-
 tests/redaction.test.ts                | 24 ++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/packages/runtime-core/src/redaction.ts b/packages/runtime-core/src/redaction.ts
index 5f87e52e2..8603403d1 100644
--- a/packages/runtime-core/src/redaction.ts
+++ b/packages/runtime-core/src/redaction.ts
@@ -107,7 +107,8 @@ export function redactString(value: string, options: RedactStringOptions = {}):
     .replace(/https?:\/\/[^\s"'<>]+/gi, (match) => redactUrl(match, options))
     .replace(SECRET_LIKE_VALUE_GLOBAL_PATTERN, REDACTED_VALUE)
     .replace(/([?&][^=&#\s"'<>]+)=([^&#\s"'<>]+)/g, options.redactQueryAssignments ? `$1=${REDACTED_VALUE}` : "$&")
-    .replace(/((?:[A-Za-z0-9_-]*)(?:access[_-]?token|auth|bearer|code|cookie|credential|key|login|nonce|pass|password|secret|session|state|token)(?:[A-Za-z0-9_-]*)(?:["'\s:=]+))[^&#\s"'<>]+/gi, `$1${REDACTED_VALUE}`)
+    .replace(/\b(Bearer[ \t]+)[^&#\s"'<>]+/gi, `$1${REDACTED_VALUE}`)
+    .replace(/((?:[A-Za-z0-9_-]*)(?:access[_-]?token|auth|bearer|code|cookie|credential|key|login|nonce|pass|password|secret|session|state|token)(?:[A-Za-z0-9_-]*)(?:["'\s]*[:=]["'\s]*))[^&#\s"'<>]+/gi, `$1${REDACTED_VALUE}`)
 }
 
 export function redactError(error: unknown, options: RedactStringOptions = {}): Error {
diff --git a/tests/redaction.test.ts b/tests/redaction.test.ts
index 1e0c669c6..cb93fc741 100644
--- a/tests/redaction.test.ts
+++ b/tests/redaction.test.ts
@@ -29,6 +29,30 @@ assert.equal(containsSecretLikeValue("token sk-abcdefghijklmnopqrstuvwxyz"), tru
 assert.equal(containsSecretLikeValue("token [redacted]"), false)
 assert.equal(redactString("token sk-abcdefghijklmnopqrstuvwxyz"), "token [redacted]")
 
+const proseCases: Array<[string, string]> = [
+  ["Local wp-admin auth fixture user could not be loaded.", "Local wp-admin auth fixture user could not be loaded."],
+  ["The token validation fixture passed.", "The token validation fixture passed."],
+  ["Apply the cookie policy to this session state.", "Apply the cookie policy to this session state."],
+  ["    at <anonymous> (/workspace/auth-fixture.ts:7:21)", "    at <anonymous> (/workspace/auth-fixture.ts:7:21)"],
+]
+
+for (const [input, expected] of proseCases) {
+  assert.equal(redactString(input), expected, `ordinary prose should survive: ${input}`)
+}
+
+const secretContextCases: Array<[string, string]> = [
+  ["Local wp-admin auth: fixture-password user could not be loaded.", "Local wp-admin auth: [redacted] user could not be loaded."],
+  ["The token=fixture-token validation failed.", "The token=[redacted] validation failed."],
+  ["Authorization: Bearer fixture-auth-token", "Authorization: [redacted]"],
+  ["Bearer fixture-auth-token", "Bearer [redacted]"],
+  ["Cookie: wordpress_logged_in=fixture-cookie", "Cookie: [redacted]"],
+  ['{"username":"fixture","password":"fixture-password"}', '{"username":"fixture","password":"[redacted]"}'],
+]
+
+for (const [input, expected] of secretContextCases) {
+  assert.equal(redactString(input), expected, `secret context should redact: ${input}`)
+}
+
 assert.deepEqual(
   redactJsonValue({ token: "abc", nested: { api_key: "def", visible: "ok" }, list: [{ password: "secret" }] }, { redactStrings: false }),
   { token: "[redacted]", nested: { api_key: "[redacted]", visible: "ok" }, list: [{ password: "[redacted]" }] },