install: resolve .npmrc credentials by path-segment ancestor

src/ast/lib.rs

@@ -2081,6 +2081,34 @@
         )
     }
 
+    /// `add_warning_opts`, formatted, plus a free-standing `note:` line. The frame
+    /// redaction applies to the warned line; the note carries no source frame.
+    #[cold]
+    pub fn add_warning_fmt_opts_with_note(
+        &mut self,
+        args: fmt::Arguments<'_>,
+        note_args: fmt::Arguments<'_>,
+        opts: AddErrorOptions<'_>,
+    ) {
+        if !Kind::Warn.should_print(self.level) {
+            return;
+        }
+        let notes: Box<[Data]> = Box::new([range_data(None, Range::NONE, alloc_print(note_args))]);
+        let text = alloc_print(args);
+        self.add_formatted_msg(
+            Kind::Warn,
+            opts.source,
+            Range {
+                loc: opts.loc,
+                len: opts.len,
+            },
+            text,
+            notes,
+            true,
+            opts.redact_sensitive_information,
+        )
+    }
+
     /// Use a bun.sys.Error's message in addition to some extra context.
     pub fn add_sys_error(&mut self, e: &bun_sys::Error, args: fmt::Arguments<'_>) {
         let Some((tag_name, sys_errno)) = e.get_error_code_tag_name() else {
@@ -2414,6 +2442,30 @@
         })
     }
 
+    /// `add_warning`, with `AddErrorOptions`. Use when the offending source line can
+    /// contain a credential: `redact_sensitive_information` masks the value in the frame.
+    #[cold]
+    pub fn add_warning_opts(&mut self, text: Str, opts: AddErrorOptions<'_>) {
+        if !Kind::Warn.should_print(self.level) {
+            return;
+        }
+        self.warnings += 1;
+        let data = self.tracked_range_data(
+            opts.source,
+            Range {
+                loc: opts.loc,
+                len: opts.len,
+            },
+            text,
+        );
+        self.add_msg(Msg {
+            kind: Kind::Warn,
+            data,
+            redact_sensitive_information: opts.redact_sensitive_information,
+            ..Default::default()
+        })
+    }
+
     // TODO(dylan-conway): rename and replace `addError`
     #[cold]
     pub fn add_error_opts(&mut self, text: Str, opts: AddErrorOptions<'_>) {

src/bun_core/fmt.rs

@@ -1738,6 +1738,15 @@ impl RedactedKeywords {
             b"_auth" | b"_authToken" | b"token" | b"_password" | b"email"
         )
     }
+
+    /// Whether `s` STARTS WITH a redacted keyword. The ini parser recognizes a
+    /// credential option by substring, so redaction must be at least as loose:
+    /// `_auth` covers `_authToken`, and trailing junk stays redacted.
+    pub fn has_prefix(s: &[u8]) -> bool {
+        [b"_auth".as_slice(), b"token", b"_password", b"email"]
+            .iter()
+            .any(|k| s.starts_with(k))
+    }
 }
 
 impl Display for QuickAndDirtyJavaScriptSyntaxHighlighter<'_> {
@@ -2013,6 +2022,19 @@ impl Display for QuickAndDirtyJavaScriptSyntaxHighlighter<'_> {
                                     break 'try_redact;
                                 }
 
+                                // An ini credential key may be quoted:
+                                // `"//host/:_authToken"=secret`. The identifier path
+                                // never sees it, so arm the value redaction here, at
+                                // least as loosely as the ini parser matches options.
+                                let mut rest: &[u8] = inner;
+                                while let Some(colon) = strings::index_of_char(rest, b':') {
+                                    rest = &rest[colon as usize + 1..];
+                                    if RedactedKeywords::has_prefix(rest) {
+                                        should_redact_value = true;
+                                        break;
+                                    }
+                                }
+
                                 if inner.len() == 36 && strings::is_uuid(inner) {
                                     write!(writer, "{}\x1b[32m{}", Output::RESET, char_ as char)?;
                                     splat_byte_all(writer, b'*', 36)?;