From 396510dd8f4151af7ac78092431f90fa28f656a1 Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Wed, 1 Apr 2026 10:31:32 +0000
Subject: [PATCH 1/6] fix(security): redact secret patterns from CLI log and
 error output

---
 bin/lib/runner.js   |  50 +++++++++++++--
 test/runner.test.js | 146 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 192 insertions(+), 4 deletions(-)

diff --git a/bin/lib/runner.js b/bin/lib/runner.js
index 3b09e4fb8ba..a400517f796 100644
--- a/bin/lib/runner.js
+++ b/bin/lib/runner.js
@@ -22,7 +22,7 @@ function run(cmd, opts = {}) {
     env: { ...process.env, ...opts.env },
   });
   if (result.status !== 0 && !opts.ignoreError) {
-    console.error(`  Command failed (exit ${result.status}): ${cmd.slice(0, 80)}`);
+    console.error(`  Command failed (exit ${result.status}): ${redact(cmd).slice(0, 80)}`);
     process.exit(result.status || 1);
   }
   return result;
@@ -37,7 +37,7 @@ function runInteractive(cmd, opts = {}) {
     env: { ...process.env, ...opts.env },
   });
   if (result.status !== 0 && !opts.ignoreError) {
-    console.error(`  Command failed (exit ${result.status}): ${cmd.slice(0, 80)}`);
+    console.error(`  Command failed (exit ${result.status}): ${redact(cmd).slice(0, 80)}`);
     process.exit(result.status || 1);
   }
   return result;
@@ -54,10 +54,52 @@ function runCapture(cmd, opts = {}) {
     }).trim();
   } catch (err) {
     if (opts.ignoreError) return "";
-    throw err;
+    throw redactError(err);
   }
 }
 
+/**
+ * Redact known secret patterns from a string to prevent accidental leaks
+ * in CLI log and error output. Covers NVIDIA API keys, bearer tokens,
+ * generic API key assignments, and base64-style long tokens.
+ */
+const SECRET_PATTERNS = [
+  /nvapi-[A-Za-z0-9_-]{10,}/g,
+  /nvcf-[A-Za-z0-9_-]{10,}/g,
+  /ghp_[A-Za-z0-9_-]{10,}/g,
+  /(?<=Bearer\s+)[A-Za-z0-9_.+/=-]{10,}/gi,
+  /(?<=(?:_KEY|API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)[=: ]['"]?)[A-Za-z0-9_.+/=-]{10,}/gi,
+];
+
+function redact(str) {
+  if (typeof str !== "string") return str;
+  let out = str;
+  for (const pat of SECRET_PATTERNS) {
+    out = out.replace(pat, (match) => match.slice(0, 4) + "*".repeat(Math.min(match.length - 4, 20)));
+  }
+  return out;
+}
+
+/**
+ * Redact sensitive fields on an error object before surfacing it to callers.
+ * NOTE: this mutates the original error instance in place.
+ */
+function redactError(err) {
+  if (!err || typeof err !== "object") return err;
+  const originalMessage = typeof err.message === "string" ? err.message : null;
+  if (typeof err.message === "string") err.message = redact(err.message);
+  if (typeof err.cmd === "string") err.cmd = redact(err.cmd);
+  if (typeof err.stdout === "string") err.stdout = redact(err.stdout);
+  if (typeof err.stderr === "string") err.stderr = redact(err.stderr);
+  if (Array.isArray(err.output)) {
+    err.output = err.output.map((value) => (typeof value === "string" ? redact(value) : value));
+  }
+  if (originalMessage && typeof err.stack === "string") {
+    err.stack = err.stack.replaceAll(originalMessage, err.message);
+  }
+  return err;
+}
+
 /**
  * Shell-quote a value for safe interpolation into bash -c strings.
  * Wraps in single quotes and escapes embedded single quotes.
@@ -85,4 +127,4 @@ function validateName(name, label = "name") {
   return name;
 }
 
-module.exports = { ROOT, SCRIPTS, run, runCapture, runInteractive, shellQuote, validateName };
+module.exports = { ROOT, SCRIPTS, redact, run, runCapture, runInteractive, shellQuote, validateName };
diff --git a/test/runner.test.js b/test/runner.test.js
index 7ef65911078..6b0470dde75 100644
--- a/test/runner.test.js
+++ b/test/runner.test.js
@@ -170,7 +170,153 @@ describe("validateName", () => {
   });
 });
 
+describe("redact", () => {
+  it("masks NVIDIA API keys", () => {
+    const { redact } = require(runnerPath);
+    expect(redact("key is nvapi-abc123XYZ_def456")).toBe("key is nvap******************");
+  });
+
+  it("masks NVCF keys", () => {
+    const { redact } = require(runnerPath);
+    expect(redact("nvcf-abcdef1234567890")).toBe("nvcf*****************");
+  });
+
+  it("masks bearer tokens", () => {
+    const { redact } = require(runnerPath);
+    expect(redact("Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.payload")).toBe(
+      "Authorization: Bearer eyJh********************"
+    );
+  });
+
+  it("masks key assignments in commands", () => {
+    const { redact } = require(runnerPath);
+    expect(redact("export NVIDIA_API_KEY=nvapi-realkey12345")).toContain("nvap");
+    expect(redact("export NVIDIA_API_KEY=nvapi-realkey12345")).not.toContain("realkey12345");
+  });
+
+  it("masks variables ending in _KEY", () => {
+    const { redact } = require(runnerPath);
+    const output = redact('export SERVICE_KEY="supersecretvalue12345"');
+    expect(output).not.toContain("supersecretvalue12345");
+    expect(output).toContain('export SERVICE_KEY="supe');
+  });
+
+  it("masks bare GitHub personal access tokens", () => {
+    const { redact } = require(runnerPath);
+    const output = redact("token ghp_abcdefghijklmnopqrstuvwxyz1234567890");
+    expect(output).toContain("ghp_");
+    expect(output).not.toContain("abcdefghijklmnopqrstuvwxyz1234567890");
+  });
+
+  it("masks bearer tokens case-insensitively", () => {
+    const { redact } = require(runnerPath);
+    expect(redact("authorization: bearer someBearerToken")).toContain("some****");
+    expect(redact("authorization: bearer someBearerToken")).not.toContain("someBearerToken");
+    expect(redact("AUTHORIZATION: BEARER someBearerToken")).toContain("some****");
+    expect(redact("AUTHORIZATION: BEARER someBearerToken")).not.toContain("someBearerToken");
+  });
+
+  it("masks bearer tokens with repeated spacing", () => {
+    const { redact } = require(runnerPath);
+    const output = redact("Authorization: Bearer   someBearerToken");
+    expect(output).toContain("some****");
+    expect(output).not.toContain("someBearerToken");
+  });
+
+  it("masks quoted assignment values", () => {
+    const { redact } = require(runnerPath);
+    const output = redact('API_KEY="secret123abc"');
+    expect(output).not.toContain("secret123abc");
+    expect(output).toContain('API_KEY="sec');
+  });
+
+  it("masks multiple secrets in one string", () => {
+    const { redact } = require(runnerPath);
+    const output = redact("nvapi-firstkey12345 nvapi-secondkey67890");
+    expect(output).not.toContain("firstkey12345");
+    expect(output).not.toContain("secondkey67890");
+    expect(output).toContain("nvap******************");
+  });
+
+  it("leaves non-secret strings untouched", () => {
+    const { redact } = require(runnerPath);
+    expect(redact("docker run --name my-sandbox")).toBe("docker run --name my-sandbox");
+    expect(redact("openshell sandbox list")).toBe("openshell sandbox list");
+  });
+
+  it("handles non-string input gracefully", () => {
+    const { redact } = require(runnerPath);
+    expect(redact(null)).toBe(null);
+    expect(redact(undefined)).toBe(undefined);
+    expect(redact(42)).toBe(42);
+  });
+});
+
 describe("regression guards", () => {
+  it("runCapture redacts secrets before rethrowing errors", () => {
+    const originalExecSync = childProcess.execSync;
+    childProcess.execSync = () => {
+      throw new Error(
+        'command failed: export SERVICE_KEY="supersecretvalue12345" ghp_abcdefghijklmnopqrstuvwxyz1234567890'
+      );
+    };
+
+    try {
+      delete require.cache[require.resolve(runnerPath)];
+      const { runCapture } = require(runnerPath);
+
+      let error;
+      try {
+        runCapture("echo nope");
+      } catch (err) {
+        error = err;
+      }
+
+      expect(error).toBeInstanceOf(Error);
+      expect(error.message).toContain("ghp_");
+      expect(error.message).not.toContain("supersecretvalue12345");
+      expect(error.message).not.toContain("abcdefghijklmnopqrstuvwxyz1234567890");
+    } finally {
+      childProcess.execSync = originalExecSync;
+      delete require.cache[require.resolve(runnerPath)];
+    }
+  });
+
+  it("runCapture redacts execSync error cmd/output fields", () => {
+    const originalExecSync = childProcess.execSync;
+    childProcess.execSync = () => {
+      const err = new Error("command failed");
+      err.cmd = "echo nvapi-aaaabbbbcccc1111 && echo ghp_abcdefghijklmnopqrstuvwxyz123456";
+      err.output = ["stdout: nvapi-aaaabbbbcccc1111", "stderr: PASSWORD=secret123456"];
+      throw err;
+    };
+
+    try {
+      delete require.cache[require.resolve(runnerPath)];
+      const { runCapture } = require(runnerPath);
+
+      let error;
+      try {
+        runCapture("echo nope");
+      } catch (err) {
+        error = err;
+      }
+
+      expect(error).toBeDefined();
+      expect(error).toBeInstanceOf(Error);
+      expect(error.cmd).not.toContain("nvapi-aaaabbbbcccc1111");
+      expect(error.cmd).not.toContain("ghp_abcdefghijklmnopqrstuvwxyz123456");
+      expect(Array.isArray(error.output)).toBe(true);
+      expect(error.output[0]).not.toContain("nvapi-aaaabbbbcccc1111");
+      expect(error.output[1]).not.toContain("secret123456");
+      expect(error.output[0]).toContain("****");
+      expect(error.output[1]).toContain("****");
+    } finally {
+      childProcess.execSync = originalExecSync;
+      delete require.cache[require.resolve(runnerPath)];
+    }
+  });
+
   it("nemoclaw.js does not use execSync", () => {
     const src = fs.readFileSync(
       path.join(import.meta.dirname, "..", "bin", "nemoclaw.js"),

From 128b46a2f499f4128e7dae225acc56ca8b07872f Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Wed, 1 Apr 2026 10:35:24 +0000
Subject: [PATCH 2/6] test(security): relax multi-secret redaction assertion

---
 test/runner.test.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/runner.test.js b/test/runner.test.js
index 6b0470dde75..6c93a3d020a 100644
--- a/test/runner.test.js
+++ b/test/runner.test.js
@@ -235,7 +235,8 @@ describe("redact", () => {
     const output = redact("nvapi-firstkey12345 nvapi-secondkey67890");
     expect(output).not.toContain("firstkey12345");
     expect(output).not.toContain("secondkey67890");
-    expect(output).toContain("nvap******************");
+    expect(output).toContain("nvap");
+    expect(output).toContain(" ");
   });
 
   it("leaves non-secret strings untouched", () => {

From 0f3febb6d1413a5668013f6ccc3b2fbdb6eeb0ec Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Wed, 1 Apr 2026 11:14:29 +0000
Subject: [PATCH 3/6] fix(cli): redact runner child output and auth URLs

---
 bin/lib/runner.js   | 42 +++++++++++++++++++--
 test/runner.test.js | 89 ++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 122 insertions(+), 9 deletions(-)

diff --git a/bin/lib/runner.js b/bin/lib/runner.js
index a400517f796..e6224b1cd7b 100644
--- a/bin/lib/runner.js
+++ b/bin/lib/runner.js
@@ -14,13 +14,14 @@ if (dockerHost) {
 }
 
 function run(cmd, opts = {}) {
-  const stdio = opts.stdio ?? ["ignore", "inherit", "inherit"];
+  const stdio = opts.stdio ?? ["ignore", "pipe", "pipe"];
   const result = spawnSync("bash", ["-c", cmd], {
     ...opts,
     stdio,
     cwd: ROOT,
     env: { ...process.env, ...opts.env },
   });
+  writeRedactedResult(result, stdio);
   if (result.status !== 0 && !opts.ignoreError) {
     console.error(`  Command failed (exit ${result.status}): ${redact(cmd).slice(0, 80)}`);
     process.exit(result.status || 1);
@@ -29,13 +30,14 @@ function run(cmd, opts = {}) {
 }
 
 function runInteractive(cmd, opts = {}) {
-  const stdio = opts.stdio ?? "inherit";
+  const stdio = opts.stdio ?? ["inherit", "pipe", "pipe"];
   const result = spawnSync("bash", ["-c", cmd], {
     ...opts,
     stdio,
     cwd: ROOT,
     env: { ...process.env, ...opts.env },
   });
+  writeRedactedResult(result, stdio);
   if (result.status !== 0 && !opts.ignoreError) {
     console.error(`  Command failed (exit ${result.status}): ${redact(cmd).slice(0, 80)}`);
     process.exit(result.status || 1);
@@ -71,11 +73,33 @@ const SECRET_PATTERNS = [
   /(?<=(?:_KEY|API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)[=: ]['"]?)[A-Za-z0-9_.+/=-]{10,}/gi,
 ];
 
+function redactMatch(match) {
+  return match.slice(0, 4) + "*".repeat(Math.min(match.length - 4, 20));
+}
+
+function redactUrl(value) {
+  if (typeof value !== "string" || value.length === 0) return value;
+  try {
+    const url = new URL(value);
+    if (url.password) {
+      url.password = "****";
+    }
+    for (const key of [...url.searchParams.keys()]) {
+      if (/(^|[-_])(?:signature|sig|token|auth|access_token)$/i.test(key)) {
+        url.searchParams.set(key, "****");
+      }
+    }
+    return url.toString();
+  } catch {
+    return value;
+  }
+}
+
 function redact(str) {
   if (typeof str !== "string") return str;
-  let out = str;
+  let out = str.replace(/https?:\/\/[^\s'"]+/g, redactUrl);
   for (const pat of SECRET_PATTERNS) {
-    out = out.replace(pat, (match) => match.slice(0, 4) + "*".repeat(Math.min(match.length - 4, 20)));
+    out = out.replace(pat, redactMatch);
   }
   return out;
 }
@@ -100,6 +124,16 @@ function redactError(err) {
   return err;
 }
 
+function writeRedactedResult(result, stdio) {
+  if (!result || stdio === "inherit" || !Array.isArray(stdio)) return;
+  if (stdio[1] === "pipe" && result.stdout) {
+    process.stdout.write(redact(result.stdout.toString()));
+  }
+  if (stdio[2] === "pipe" && result.stderr) {
+    process.stderr.write(redact(result.stderr.toString()));
+  }
+}
+
 /**
  * Shell-quote a value for safe interpolation into bash -c strings.
  * Wraps in single quotes and escapes embedded single quotes.
diff --git a/test/runner.test.js b/test/runner.test.js
index 6c93a3d020a..4914767a04e 100644
--- a/test/runner.test.js
+++ b/test/runner.test.js
@@ -6,7 +6,7 @@ import childProcess from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
 import { runCapture } from "../bin/lib/runner";
 
@@ -39,7 +39,7 @@ describe("runner helpers", () => {
     // @ts-expect-error — intentional partial mock for testing
     childProcess.spawnSync = (...args) => {
       calls.push(args);
-      return { status: 0 };
+      return { status: 0, stdout: "", stderr: "" };
     };
 
     try {
@@ -53,8 +53,8 @@ describe("runner helpers", () => {
     }
 
     expect(calls).toHaveLength(2);
-    expect(calls[0][2].stdio).toEqual(["ignore", "inherit", "inherit"]);
-    expect(calls[1][2].stdio).toBe("inherit");
+    expect(calls[0][2].stdio).toEqual(["ignore", "pipe", "pipe"]);
+    expect(calls[1][2].stdio).toEqual(["inherit", "pipe", "pipe"]);
   });
 });
 
@@ -83,7 +83,7 @@ describe("runner env merging", () => {
     // @ts-expect-error — intentional partial mock for testing
     childProcess.spawnSync = (...args) => {
       calls.push(args);
-      return { status: 0 };
+      return { status: 0, stdout: "", stderr: "" };
     };
 
     try {
@@ -239,6 +239,20 @@ describe("redact", () => {
     expect(output).toContain(" ");
   });
 
+  it("masks URL credentials and auth query parameters", () => {
+    const { redact } = require(runnerPath);
+    const output = redact(
+      "https://alice:secret@example.com/v1/models?auth=abc123456789&sig=def987654321&keep=yes"
+    );
+    expect(output).toBe("https://alice:****@example.com/v1/models?auth=****&sig=****&keep=yes");
+  });
+
+  it("masks auth-style query parameters case-insensitively", () => {
+    const { redact } = require(runnerPath);
+    const output = redact("https://example.com?Signature=secret123456&AUTH=anothersecret123");
+    expect(output).toBe("https://example.com/?Signature=****&AUTH=****");
+  });
+
   it("leaves non-secret strings untouched", () => {
     const { redact } = require(runnerPath);
     expect(redact("docker run --name my-sandbox")).toBe("docker run --name my-sandbox");
@@ -318,6 +332,71 @@ describe("regression guards", () => {
     }
   });
 
+  it("run redacts captured child output before printing on failure", () => {
+    const originalSpawnSync = childProcess.spawnSync;
+    const originalExit = process.exit;
+    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    const stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    // @ts-expect-error — intentional partial mock for testing
+    childProcess.spawnSync = () => ({
+      status: 1,
+      stdout: "token ghp_abcdefghijklmnopqrstuvwxyz1234567890\n",
+      stderr: 'export SERVICE_KEY="supersecretvalue12345"\n',
+    });
+    process.exit = ((code) => {
+      throw new Error(`exit:${code}`);
+    });
+
+    try {
+      delete require.cache[require.resolve(runnerPath)];
+      const { run } = require(runnerPath);
+      expect(() => run("echo fail")).toThrow("exit:1");
+      expect(stdoutSpy).toHaveBeenCalledWith("token ghp_********************\n");
+      expect(stderrSpy).toHaveBeenCalledWith('export SERVICE_KEY="supe*****************"\n');
+      expect(errorSpy).toHaveBeenCalledWith("  Command failed (exit 1): echo fail");
+    } finally {
+      childProcess.spawnSync = originalSpawnSync;
+      process.exit = originalExit;
+      stdoutSpy.mockRestore();
+      stderrSpy.mockRestore();
+      errorSpy.mockRestore();
+      delete require.cache[require.resolve(runnerPath)];
+    }
+  });
+
+  it("runInteractive keeps stdin inherited while redacting captured output", () => {
+    const originalSpawnSync = childProcess.spawnSync;
+    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    const stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const calls = [];
+
+    // @ts-expect-error — intentional partial mock for testing
+    childProcess.spawnSync = (...args) => {
+      calls.push(args);
+      return {
+        status: 0,
+        stdout: "visit https://alice:secret@example.com/?token=abc123456789\n",
+        stderr: "",
+      };
+    };
+
+    try {
+      delete require.cache[require.resolve(runnerPath)];
+      const { runInteractive } = require(runnerPath);
+      runInteractive("echo interactive");
+      expect(calls[0][2].stdio).toEqual(["inherit", "pipe", "pipe"]);
+      expect(stdoutSpy).toHaveBeenCalledWith("visit https://alice:****@example.com/?token=****\n");
+      expect(stderrSpy).not.toHaveBeenCalled();
+    } finally {
+      childProcess.spawnSync = originalSpawnSync;
+      stdoutSpy.mockRestore();
+      stderrSpy.mockRestore();
+      delete require.cache[require.resolve(runnerPath)];
+    }
+  });
+
   it("nemoclaw.js does not use execSync", () => {
     const src = fs.readFileSync(
       path.join(import.meta.dirname, "..", "bin", "nemoclaw.js"),

From 2df8e26b8bc74c0a530ea24ed2cedb09ee19a7b2 Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Wed, 1 Apr 2026 11:39:26 +0000
Subject: [PATCH 4/6] docs: add JSDoc to all runner.js functions for docstring
 coverage

Adds JSDoc comments to run(), runInteractive(), runCapture(),
redactMatch(), redactUrl(), redact(), and writeRedactedResult()
to bring docstring coverage above the 80% threshold.
---
 bin/lib/runner.js | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/bin/lib/runner.js b/bin/lib/runner.js
index e6224b1cd7b..72ec6e2b93d 100644
--- a/bin/lib/runner.js
+++ b/bin/lib/runner.js
@@ -13,6 +13,7 @@ if (dockerHost) {
   process.env.DOCKER_HOST = dockerHost.dockerHost;
 }
 
+/** Run a shell command via bash, streaming stdout/stderr (redacted) to the terminal. Exits the process on failure unless opts.ignoreError is true. */
 function run(cmd, opts = {}) {
   const stdio = opts.stdio ?? ["ignore", "pipe", "pipe"];
   const result = spawnSync("bash", ["-c", cmd], {
@@ -29,6 +30,7 @@ function run(cmd, opts = {}) {
   return result;
 }
 
+/** Run a shell command interactively (stdin inherited) while capturing and redacting stdout/stderr. Exits the process on failure unless opts.ignoreError is true. */
 function runInteractive(cmd, opts = {}) {
   const stdio = opts.stdio ?? ["inherit", "pipe", "pipe"];
   const result = spawnSync("bash", ["-c", cmd], {
@@ -45,6 +47,7 @@ function runInteractive(cmd, opts = {}) {
   return result;
 }
 
+/** Run a shell command and return its stdout as a trimmed string. Throws a redacted error on failure, or returns '' when opts.ignoreError is true. */
 function runCapture(cmd, opts = {}) {
   try {
     return execSync(cmd, {
@@ -73,10 +76,12 @@ const SECRET_PATTERNS = [
   /(?<=(?:_KEY|API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)[=: ]['"]?)[A-Za-z0-9_.+/=-]{10,}/gi,
 ];
 
+/** Partially redact a matched secret string: keep the first 4 chars and replace the rest with asterisks (up to 20). */
 function redactMatch(match) {
   return match.slice(0, 4) + "*".repeat(Math.min(match.length - 4, 20));
 }
 
+/** Redact credentials from a URL string: clears url.password and blanks known auth-style query params (auth, sig, signature, token, access_token). */
 function redactUrl(value) {
   if (typeof value !== "string" || value.length === 0) return value;
   try {
@@ -95,6 +100,10 @@ function redactUrl(value) {
   }
 }
 
+/**
+ * Redact known secret patterns and authenticated URLs from a string.
+ * Non-string values are returned unchanged.
+ */
 function redact(str) {
   if (typeof str !== "string") return str;
   let out = str.replace(/https?:\/\/[^\s'"]+/g, redactUrl);
@@ -124,6 +133,7 @@ function redactError(err) {
   return err;
 }
 
+/** Write redacted stdout/stderr from a spawnSync result to the parent process streams. No-op when stdio is 'inherit' or not an array. */
 function writeRedactedResult(result, stdio) {
   if (!result || stdio === "inherit" || !Array.isArray(stdio)) return;
   if (stdio[1] === "pipe" && result.stdout) {
@@ -161,4 +171,13 @@ function validateName(name, label = "name") {
   return name;
 }
 
-module.exports = { ROOT, SCRIPTS, redact, run, runCapture, runInteractive, shellQuote, validateName };
+module.exports = {
+  ROOT,
+  SCRIPTS,
+  redact,
+  run,
+  runCapture,
+  runInteractive,
+  shellQuote,
+  validateName,
+};

From 388a3196ccc9432a9f0d797b25cbdf52bbdfa860 Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Wed, 1 Apr 2026 11:40:58 +0000
Subject: [PATCH 5/6] docs: expand inline JSDoc to multi-line format for
 docstring coverage tools

---
 bin/lib/runner.js | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/bin/lib/runner.js b/bin/lib/runner.js
index 72ec6e2b93d..7ce41fc0c90 100644
--- a/bin/lib/runner.js
+++ b/bin/lib/runner.js
@@ -13,7 +13,10 @@ if (dockerHost) {
   process.env.DOCKER_HOST = dockerHost.dockerHost;
 }
 
-/** Run a shell command via bash, streaming stdout/stderr (redacted) to the terminal. Exits the process on failure unless opts.ignoreError is true. */
+/**
+ * Run a shell command via bash, streaming stdout/stderr (redacted) to the terminal.
+ * Exits the process on failure unless opts.ignoreError is true.
+ */
 function run(cmd, opts = {}) {
   const stdio = opts.stdio ?? ["ignore", "pipe", "pipe"];
   const result = spawnSync("bash", ["-c", cmd], {
@@ -30,7 +33,10 @@ function run(cmd, opts = {}) {
   return result;
 }
 
-/** Run a shell command interactively (stdin inherited) while capturing and redacting stdout/stderr. Exits the process on failure unless opts.ignoreError is true. */
+/**
+ * Run a shell command interactively (stdin inherited) while capturing and redacting stdout/stderr.
+ * Exits the process on failure unless opts.ignoreError is true.
+ */
 function runInteractive(cmd, opts = {}) {
   const stdio = opts.stdio ?? ["inherit", "pipe", "pipe"];
   const result = spawnSync("bash", ["-c", cmd], {
@@ -47,7 +53,10 @@ function runInteractive(cmd, opts = {}) {
   return result;
 }
 
-/** Run a shell command and return its stdout as a trimmed string. Throws a redacted error on failure, or returns '' when opts.ignoreError is true. */
+/**
+ * Run a shell command and return its stdout as a trimmed string.
+ * Throws a redacted error on failure, or returns '' when opts.ignoreError is true.
+ */
 function runCapture(cmd, opts = {}) {
   try {
     return execSync(cmd, {
@@ -76,12 +85,19 @@ const SECRET_PATTERNS = [
   /(?<=(?:_KEY|API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)[=: ]['"]?)[A-Za-z0-9_.+/=-]{10,}/gi,
 ];
 
-/** Partially redact a matched secret string: keep the first 4 chars and replace the rest with asterisks (up to 20). */
+/**
+ * Partially redact a matched secret string: keep the first 4 chars and replace
+ * the rest with asterisks (capped at 20 asterisks).
+ */
 function redactMatch(match) {
   return match.slice(0, 4) + "*".repeat(Math.min(match.length - 4, 20));
 }
 
-/** Redact credentials from a URL string: clears url.password and blanks known auth-style query params (auth, sig, signature, token, access_token). */
+/**
+ * Redact credentials from a URL string: clears url.password and blanks
+ * known auth-style query params (auth, sig, signature, token, access_token).
+ * Returns the original value unchanged if it cannot be parsed as a URL.
+ */
 function redactUrl(value) {
   if (typeof value !== "string" || value.length === 0) return value;
   try {
@@ -133,7 +149,10 @@ function redactError(err) {
   return err;
 }
 
-/** Write redacted stdout/stderr from a spawnSync result to the parent process streams. No-op when stdio is 'inherit' or not an array. */
+/**
+ * Write redacted stdout/stderr from a spawnSync result to the parent process streams.
+ * No-op when stdio is 'inherit' or not an array.
+ */
 function writeRedactedResult(result, stdio) {
   if (!result || stdio === "inherit" || !Array.isArray(stdio)) return;
   if (stdio[1] === "pipe" && result.stdout) {

From 950cac37b3e69021d583e847fa536940ca8e374a Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Wed, 1 Apr 2026 19:29:58 +0000
Subject: [PATCH 6/6] fix(test): add JSDoc type casts for extended Error
 properties in runner tests

TypeScript check was failing with TS2339 because Error type does not
include .cmd and .output properties. Using @type {any} JSDoc casts to
tell the type checker these are intentionally extended error objects
(as produced by Node's execSync on failure).

Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com>
---
 test/runner.test.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/test/runner.test.js b/test/runner.test.js
index 4914767a04e..13b2dd4c6ec 100644
--- a/test/runner.test.js
+++ b/test/runner.test.js
@@ -184,7 +184,7 @@ describe("redact", () => {
   it("masks bearer tokens", () => {
     const { redact } = require(runnerPath);
     expect(redact("Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.payload")).toBe(
-      "Authorization: Bearer eyJh********************"
+      "Authorization: Bearer eyJh********************",
     );
   });
 
@@ -242,7 +242,7 @@ describe("redact", () => {
   it("masks URL credentials and auth query parameters", () => {
     const { redact } = require(runnerPath);
     const output = redact(
-      "https://alice:secret@example.com/v1/models?auth=abc123456789&sig=def987654321&keep=yes"
+      "https://alice:secret@example.com/v1/models?auth=abc123456789&sig=def987654321&keep=yes",
     );
     expect(output).toBe("https://alice:****@example.com/v1/models?auth=****&sig=****&keep=yes");
   });
@@ -272,7 +272,7 @@ describe("regression guards", () => {
     const originalExecSync = childProcess.execSync;
     childProcess.execSync = () => {
       throw new Error(
-        'command failed: export SERVICE_KEY="supersecretvalue12345" ghp_abcdefghijklmnopqrstuvwxyz1234567890'
+        'command failed: export SERVICE_KEY="supersecretvalue12345" ghp_abcdefghijklmnopqrstuvwxyz1234567890',
       );
     };
 
@@ -300,7 +300,7 @@ describe("regression guards", () => {
   it("runCapture redacts execSync error cmd/output fields", () => {
     const originalExecSync = childProcess.execSync;
     childProcess.execSync = () => {
-      const err = new Error("command failed");
+      const err = /** @type {any} */ (new Error("command failed"));
       err.cmd = "echo nvapi-aaaabbbbcccc1111 && echo ghp_abcdefghijklmnopqrstuvwxyz123456";
       err.output = ["stdout: nvapi-aaaabbbbcccc1111", "stderr: PASSWORD=secret123456"];
       throw err;
@@ -314,7 +314,7 @@ describe("regression guards", () => {
       try {
         runCapture("echo nope");
       } catch (err) {
-        error = err;
+        error = /** @type {any} */ (err);
       }
 
       expect(error).toBeDefined();
@@ -345,9 +345,9 @@ describe("regression guards", () => {
       stdout: "token ghp_abcdefghijklmnopqrstuvwxyz1234567890\n",
       stderr: 'export SERVICE_KEY="supersecretvalue12345"\n',
     });
-    process.exit = ((code) => {
+    process.exit = (code) => {
       throw new Error(`exit:${code}`);
-    });
+    };
 
     try {
       delete require.cache[require.resolve(runnerPath)];