install: resolve .npmrc credentials by path-segment ancestor

src/ast/lib.rs

@@ -1795,6 +1795,34 @@ impl Log {
         )
     }
 
+    /// `add_warning` with `AddErrorOptions`, formatted, plus a free-standing `note:` line.
+    /// `redact_sensitive_information` masks a credential value in the warned line's
+    /// source frame; the note carries no frame.
+    #[cold]
+    pub fn add_warning_fmt_opts_with_note(
+        &mut self,
+        args: fmt::Arguments<'_>,
+        note_args: fmt::Arguments<'_>,
+        opts: AddErrorOptions<'_>,
+    ) {
+        if !Kind::Warn.should_print(self.level) {
+            return;
+        }
+        let notes: Box<[Data]> = Box::new([range_data(None, Range::NONE, alloc_print(note_args))]);
+        let text = alloc_print(args);
+        self.add_formatted_msg(
+            Kind::Warn,
+            opts.source,
+            Range {
+                loc: opts.loc,
+                len: opts.len,
+            },
+            text,
+            notes,
+            opts.redact_sensitive_information,
+        )
+    }
+
     /// Use a bun.sys.Error's message in addition to some extra context.
     pub fn add_sys_error(&mut self, e: &bun_sys::Error, args: fmt::Arguments<'_>) {
         let Some((tag_name, sys_errno)) = e.get_error_code_tag_name() else {

src/bun_core/fmt.rs

@@ -1716,6 +1716,15 @@ impl RedactedKeywords {
             b"_auth" | b"_authToken" | b"token" | b"_password" | b"password" | b"email"
         )
     }
+
+    /// Whether `s` STARTS WITH a redacted keyword. The ini parser recognizes a
+    /// credential option by substring, so redaction must be at least as loose:
+    /// `_auth` covers `_authToken`, and trailing junk stays redacted.
+    pub(crate) fn has_prefix(s: &[u8]) -> bool {
+        [b"_auth".as_slice(), b"token", b"_password", b"email"]
+            .iter()
+            .any(|k| s.starts_with(k))
+    }
 }
 
 impl Display for QuickAndDirtyJavaScriptSyntaxHighlighter<'_> {
@@ -2027,6 +2036,22 @@ impl Display for QuickAndDirtyJavaScriptSyntaxHighlighter<'_> {
                                     text = &text[i..];
                                     continue 'outer;
                                 }
+
+                                // An ini credential key may be quoted:
+                                // `"//host/:_authToken"=secret`. The identifier path
+                                // never sees it, so arm the value redaction here, at
+                                // least as loosely as the ini parser matches options.
+                                // Runs after the value redactors above so a URL whose
+                                // userinfo happens to start with a keyword does not
+                                // carry an armed flag across `continue 'outer`.
+                                let mut rest: &[u8] = inner;
+                                while let Some(colon) = strings::index_of_char(rest, b':') {
+                                    rest = &rest[colon as usize + 1..];
+                                    if RedactedKeywords::has_prefix(rest) {
+                                        should_redact_value = true;
+                                        break;
+                                    }
+                                }
                             }
 
                             write!(