fix(shared): redact repeated URL userinfo

src/plugins/git-install.test.ts

@@ -204,7 +204,8 @@ describe("installPluginFromGitSpec", () => {
     runCommandWithTimeoutMock.mockResolvedValueOnce({
       code: 1,
       stdout: "",
-      stderr: "fatal: could not read Username for 'https://token:secret@github.com/acme/demo.git'",
+      stderr:
+        "fatal: could not read Username for 'https://token:secret@github.com/acme/demo.git' while retrying https://other:credential@github.com/acme/fallback.git",
     });
 
     const result = await installPluginFromGitSpec({
@@ -215,8 +216,11 @@ describe("installPluginFromGitSpec", () => {
     if (!result.ok) {
       expect(result.error).toContain("failed to clone github.com/acme/demo");
       expect(result.error).toContain("https://***:***@github.com/acme/demo.git");
+      expect(result.error).toContain("https://***:***@github.com/acme/fallback.git");
       expect(result.error).not.toContain("token");
       expect(result.error).not.toContain("secret");
+      expect(result.error).not.toContain("other");
+      expect(result.error).not.toContain("credential");
     }
     expect(installPluginFromInstalledPackageDirMock).not.toHaveBeenCalled();
   });

src/shared/net/redact-sensitive-url.test.ts

@@ -35,6 +35,14 @@ describe("redactSensitiveUrlLikeString", () => {
     );
   });
 
+  it("redacts every URL-like userinfo occurrence in arbitrary text", () => {
+    expect(
+      redactSensitiveUrlLikeString(
+        "fatal https://a:b@github.com/one.git and https://c:d@github.com/two.git",
+      ),
+    ).toBe("fatal https://***:***@github.com/one.git and https://***:***@github.com/two.git");
+  });
+
   it("redacts protocol URLs that are too malformed to parse", () => {
     expect(
       redactSensitiveUrlLikeString(

src/shared/net/redact-sensitive-url.ts

@@ -70,7 +70,7 @@ export function redactSensitiveUrlLikeString(value: string): string {
     return redactedUrl;
   }
   return value
-    .replace(/\/\/([^@/?#]+)@/, "//***:***@")
+    .replace(/\/\/([^@/?#\s]+)@/g, "//***:***@")
     .replace(/([?&])([^=&]+)=([^&]*)/g, (match, prefix: string, key: string) =>
       isSensitiveUrlQueryParamName(key) ? `${prefix}${key}=***` : match,
     );