runCommandWithTimeoutMock.mockResolvedValueOnce({

code: 1,

stdout: "",

stderr: "fatal: could not read Username for 'https://token:secret@github.com/acme/demo.git'",

stderr:

"fatal: could not read Username for 'https://token:secret@github.com/acme/demo.git' while retrying https://other:credential@github.com/acme/fallback.git",

});

const result = await installPluginFromGitSpec({

if (!result.ok) {

expect(result.error).toContain("failed to clone github.com/acme/demo");

expect(result.error).toContain("https://***:***@github.com/acme/demo.git");

expect(result.error).toContain("https://***:***@github.com/acme/fallback.git");

expect(result.error).not.toContain("token");

expect(result.error).not.toContain("secret");

expect(result.error).not.toContain("other");

expect(result.error).not.toContain("credential");

}

expect(installPluginFromInstalledPackageDirMock).not.toHaveBeenCalled();

});

);

});

it("redacts every URL-like userinfo occurrence in arbitrary text", () => {

expect(

redactSensitiveUrlLikeString(

"fatal https://a:b@github.com/one.git and https://c:d@github.com/two.git",

),

).toBe("fatal https://***:***@github.com/one.git and https://***:***@github.com/two.git");

});

it("redacts protocol URLs that are too malformed to parse", () => {

expect(

redactSensitiveUrlLikeString(

return redactedUrl;

}

return value

.replace(/\/\/([^@/?#]+)@/, "//***:***@")

.replace(/\/\/([^@/?#\s]+)@/g, "//***:***@")

.replace(/([?&])([^=&]+)=([^&]*)/g, (match, prefix: string, key: string) =>

isSensitiveUrlQueryParamName(key) ? `${prefix}${key}=***` : match,

);