@ankurhalder/codebase-snapshot 4.0.0 → 4.0.1

package/dist/index.cjs

@@ -2218,11 +2218,19 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
-function findSecretInPath(relativePath) {
+var activeSecretRules = null;
+function setActiveSecretRules(rules) {
+  activeSecretRules = rules === null ? null : [...rules];
+}
+function pathScanRules(extraRules) {
+  const fallback = extraRules ?? activeSecretRules ?? [];
+  return [...DEFAULT_SECRET_PATTERNS, ...fallback];
+}
+function findSecretInPath(relativePath, extraRules) {
   const posixPath = relativePath.replace(/\\/g, "/");
   const spans = [];
   const rules = [];
-  for (const { rule, pattern } of DEFAULT_SECRET_PATTERNS) {
+  for (const { rule, pattern } of pathScanRules(extraRules)) {
     const scan = new RegExp(pattern.source, `${pattern.flags.replace(/[gy]/g, "")}g`);
     let match;
     while ((match = scan.exec(posixPath)) !== null) {
@@ -2230,24 +2238,34 @@ function findSecretInPath(relativePath) {
         scan.lastIndex += 1;
         continue;
       }
-      spans.push({ start: match.index, end: match.index + match[0].length, rule });
+      spans.push({ start: match.index, end: match.index + match[0].length });
       if (!rules.includes(rule)) rules.push(rule);
     }
   }
   if (spans.length === 0) return null;
   spans.sort((a, b) => a.start - b.start || a.end - b.end);
+  const merged = [];
+  for (const span of spans) {
+    const last = merged[merged.length - 1];
+    if (last && span.start <= last.end) last.end = Math.max(last.end, span.end);
+    else merged.push({ start: span.start, end: span.end });
+  }
   let out = "";
   let cursor = 0;
-  for (const span of spans) {
-    if (span.end <= cursor) continue;
-    const start = Math.max(span.start, cursor);
-    out += posixPath.slice(cursor, start);
+  for (const span of merged) {
+    out += posixPath.slice(cursor, span.start);
     out += REDACTION_MARKER;
-    cursor = Math.min(span.end, posixPath.length);
+    cursor = span.end;
   }
   out += posixPath.slice(cursor);
   return { rules, masked: out };
 }
+function maskSkipPaths(records, extraRules) {
+  return records.map((record) => {
+    const hit = findSecretInPath(record.path, extraRules);
+    return hit ? { ...record, path: hit.masked } : record;
+  });
+}
 function globToRegExp(glob) {
   const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
   const anchored = normalized.startsWith("/");
@@ -2478,6 +2496,7 @@ function collectFiles(cwd, options = {}) {
   const includePatterns = options.includePatterns ?? [];
   const excludePatterns = options.excludePatterns ?? [];
   const includeSensitiveFiles = options.includeSensitiveFiles ?? false;
+  const pathRules = options.secretRules;
   const isToolOwned = makeToolOwnedDecider(cwd);
   let candidates;
   const skipped = [];
@@ -2513,7 +2532,7 @@ function collectFiles(cwd, options = {}) {
       }
     }
   } catch {
-    const walked = walkDirectory(cwd, cwd, /* @__PURE__ */ new Set(), true);
+    const walked = walkDirectory(cwd, cwd, rootRealFor(cwd), /* @__PURE__ */ new Set(), true);
     candidates = walked.files;
     skipped.push(...walked.skipped);
   }
@@ -2551,7 +2570,7 @@ function collectFiles(cwd, options = {}) {
       });
       return false;
     }
-    const secret = findSecretInPath(file);
+    const secret = findSecretInPath(file, pathRules);
     if (secret) {
       skipped.push({
         path: secret.masked,
@@ -2562,30 +2581,29 @@ function collectFiles(cwd, options = {}) {
     }
     return true;
   }).sort();
-  return { files, skipped };
+  return { files, skipped: maskSkipPaths(skipped, pathRules) };
 }
-function walkDirectory(dir, baseDir, visited, isRoot = false) {
-  const results = { files: [], skipped: [] };
-  let realDir;
-  try {
-    realDir = fs9__namespace.realpathSync(dir);
-  } catch {
-    realDir = dir;
-  }
-  if (visited.has(realDir)) return results;
-  visited.add(realDir);
-  let rootReal;
+function rootRealFor(root) {
   try {
-    rootReal = fs9__namespace.realpathSync(baseDir);
+    return fs9__namespace.realpathSync(root);
   } catch {
-    rootReal = baseDir;
+    return root;
   }
+}
+function walkDirectory(dir, baseDir, rootReal, visited, isRoot = false) {
+  const results = { files: [], skipped: [] };
+  if (visited.has(dir)) return results;
+  visited.add(dir);
   const ignoredByGitignore = isRoot ? readGitignoreMatcher(baseDir) : () => false;
   let entries;
   try {
     entries = fs9__namespace.readdirSync(dir, { withFileTypes: true });
   } catch {
-    results.skipped.push({ path: dir, reason: "read-error", detail: "directory unreadable" });
+    results.skipped.push({
+      path: path10__namespace.relative(baseDir, dir).replace(/\\/g, "/") || ".",
+      reason: "read-error",
+      detail: "directory unreadable"
+    });
     return results;
   }
   for (const entry of entries) {
@@ -2664,7 +2682,7 @@ function walkDirectory(dir, baseDir, visited, isRoot = false) {
       isFile = true;
     }
     if (isDirectory) {
-      const nested = walkDirectory(fullPath, baseDir, visited);
+      const nested = walkDirectory(fullPath, baseDir, rootReal, visited);
       results.files.push(...nested.files);
       results.skipped.push(...nested.skipped);
     } else if (isFile) {
@@ -3256,6 +3274,7 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     ...aliasedRules ?? []
   ]);
   const secretRules = disableDefaultPatterns ? compiledCustomRules : [...compileSecretRules(DEFAULT_SECRET_PATTERNS), ...compiledCustomRules];
+  setActiveSecretRules(secretRules);
   const cliMonolith = cliOptions?.includeMonolith;
   const includeMonolith = cliMonolith ?? strictBoolean(userConfig?.includeMonolith, false, "`includeMonolith`");
   const artifacts = resolveArtifacts(
@@ -3363,7 +3382,8 @@ function defineConfig(config) {
 }
 
 // src/generator/audit.ts
-function generateAuditReport(manifest, secretFindings) {
+function generateAuditReport(manifest, secretFindings, secretRules) {
+  const mask = (value) => findSecretInPath(value, secretRules)?.masked ?? value;
   const lines = [
     "# Codebase Health & Security Audit",
     "",
@@ -3398,7 +3418,7 @@ function generateAuditReport(manifest, secretFindings) {
       "| :--- | :--- | :--- |"
     );
     for (const finding of secretFindings) {
-      lines.push(`| \`${finding.path ?? "unknown"}\` | ${finding.line} | \`${finding.rule}\` |`);
+      lines.push(`| \`${mask(finding.path ?? "unknown")}\` | ${finding.line} | \`${finding.rule}\` |`);
     }
     lines.push("", "### Matches by rule", "", "| Rule | Matches |", "| :--- | :--- |");
     for (const [rule, count] of Array.from(byRule.entries()).sort((a, b) => b[1] - a[1])) {
@@ -3420,7 +3440,7 @@ function generateAuditReport(manifest, secretFindings) {
     for (const file of largeFiles) {
       const sizeKb = (file.sizeBytes / 1024).toFixed(1);
       const status = file.isPreviewTruncated ? "Truncated Head/Tail" : "Full";
-      lines.push(`| \`${file.relativePath}\` | ${sizeKb} KB | ${file.lines} | ${status} |`);
+      lines.push(`| \`${mask(file.relativePath)}\` | ${sizeKb} KB | ${file.lines} | ${status} |`);
     }
     lines.push("");
   }
@@ -3462,7 +3482,7 @@ function generateAuditReport(manifest, secretFindings) {
       "| :--- | :--- | :--- |"
     );
     for (const skip of manifest.skipped) {
-      lines.push(`| \`${skip.path}\` | \`${skip.reason}\` | ${skip.detail ?? "-"} |`);
+      lines.push(`| \`${mask(skip.path)}\` | \`${skip.reason}\` | ${skip.detail ?? "-"} |`);
     }
     lines.push("");
   }
@@ -4124,6 +4144,9 @@ function detectLanguage(filePath) {
   const ext = path10__namespace.posix.extname(base).toLowerCase();
   return LANGUAGE_BY_EXTENSION[ext] ?? "text";
 }
+function maskedPath(value, secretRules) {
+  return findSecretInPath(value, secretRules)?.masked ?? value;
+}
 function emptyDrift() {
   return {
     missingInSnapshot: [],
@@ -4194,15 +4217,20 @@ function validateSnapshot(configInput) {
   const skippedSet = new Set(
     manifest.skipped.filter((entry) => entry && typeof entry.path === "string").map((entry) => entry.path)
   );
+  const isSkippedOnDisk = (diskFile) => {
+    if (skippedSet.has(diskFile)) return true;
+    return skippedSet.has(maskedPath(diskFile, config.secretRules));
+  };
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   for (const diskFile of collection.files) {
     const snapshotHash = manifestFileMap.get(diskFile);
     if (!snapshotHash) {
-      if (skippedSet.has(diskFile) && !wouldNowBeIncluded(config.cwd, diskFile)) continue;
+      if (isSkippedOnDisk(diskFile) && !wouldNowBeIncluded(config.cwd, diskFile)) continue;
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
@@ -4471,10 +4499,19 @@ function validateSnapshot(configInput) {
       `${drift.configMismatches.length} configuration mismatch(es) between the manifest and this run.`
     );
   }
+  const maskedDrift = {
+    ...drift,
+    missingInSnapshot: drift.missingInSnapshot.map((value) => maskedPath(value, config.secretRules)),
+    missingOnDisk: drift.missingOnDisk.map((value) => maskedPath(value, config.secretRules)),
+    hashMismatches: drift.hashMismatches.map((mismatch) => ({
+      ...mismatch,
+      path: maskedPath(mismatch.path, config.secretRules)
+    }))
+  };
   return {
     valid: errors.length === 0,
     manifestPresent: true,
-    drift,
+    drift: maskedDrift,
     errors,
     warnings
   };
@@ -4509,18 +4546,22 @@ function readManifest2(config) {
 function explainPath(config, target) {
   const relative4 = normalizeTarget(config.cwd, target);
   const absolute = path10__namespace.join(config.cwd, relative4);
+  const maskedPath2 = findSecretInPath(relative4, config.secretRules)?.masked ?? relative4;
   const result = {
-    path: relative4,
+    path: maskedPath2,
     exists: fs9__namespace.existsSync(absolute),
     included: false
   };
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   if (!collection.files.includes(relative4)) {
-    const record = collection.skipped.find((entry2) => entry2.path === relative4);
+    const record = collection.skipped.find(
+      (entry2) => entry2.path === relative4 || entry2.path === maskedPath2
+    );
     if (record) {
       result.reason = record.reason;
       result.detail = record.detail;
@@ -4557,7 +4598,7 @@ function explainPath(config, target) {
     result.secrets = findings.slice(0, 20).map((finding) => ({ rule: finding.rule, line: finding.line }));
   }
   const manifest = readManifest2(config);
-  const entry = manifest?.files.find((file) => file.relativePath === relative4);
+  const entry = Array.isArray(manifest?.files) ? manifest.files.find((file) => file.relativePath === relative4) : void 0;
   result.part = entry?.part ?? null;
   result.inclusionMode = entry?.inclusionMode;
   return result;
@@ -4662,12 +4703,13 @@ function compareManifests(before, after) {
     if (!right.has(filePath)) removed.push(filePath);
   }
   const sort = (values) => values.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const mask = (values) => values.map((value) => findSecretInPath(value)?.masked ?? value);
   return {
     before: side(before),
     after: side(after),
-    added: sort(added),
-    removed: sort(removed),
-    changed: sort(changed),
+    added: mask(sort(added)),
+    removed: mask(sort(removed)),
+    changed: mask(sort(changed)),
     unchanged
   };
 }
@@ -5392,7 +5434,7 @@ async function runInit(options) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.0";
+var GENERATOR_VERSION = "4.0.1";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto__namespace.createHash("sha256").update(input).digest("hex");
@@ -5429,7 +5471,6 @@ function bump(counts, key) {
 }
 var RELATIVE_SPECIFIER = /^\.{1,2}\//;
 var IMPORT_CANDIDATE_SUFFIXES = [
-  "",
   ".ts",
   ".tsx",
   ".mts",
@@ -5443,23 +5484,59 @@ var IMPORT_CANDIDATE_SUFFIXES = [
   "/index.js",
   "/index.mjs"
 ];
-function resolveSpecifier(fromFile, specifier, knownFiles) {
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+function buildImportResolver(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  const byPathFolded = /* @__PURE__ */ new Map();
+  const byStem = /* @__PURE__ */ new Map();
+  const byStemFolded = /* @__PURE__ */ new Map();
+  const remember = (map, key, value) => {
+    if (!map.has(key)) map.set(key, value);
+  };
+  for (const file of files) {
+    const relativePath = file.relativePath;
+    remember(byPath, relativePath, relativePath);
+    remember(byPathFolded, relativePath.toLowerCase(), relativePath);
+    const extension = path10__namespace.posix.extname(relativePath);
+    if (!SOURCE_EXTENSIONS.has(extension)) continue;
+    const stem = relativePath.slice(0, -extension.length);
+    remember(byStem, stem, relativePath);
+    remember(byStemFolded, stem.toLowerCase(), relativePath);
+    if (path10__namespace.posix.basename(stem) === "index") {
+      const directory = path10__namespace.posix.dirname(stem);
+      remember(byStem, directory, relativePath);
+      remember(byStemFolded, directory.toLowerCase(), relativePath);
+    }
+  }
+  return { byPath, byPathFolded, byStem, byStemFolded };
+}
+function resolveSpecifier(fromFile, specifier, resolver) {
   if (!RELATIVE_SPECIFIER.test(specifier)) return null;
-  const baseDir = path10__namespace.posix.dirname(fromFile);
-  const joined = path10__namespace.posix.normalize(path10__namespace.posix.join(baseDir, specifier));
-  const candidate = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const joined = path10__namespace.posix.normalize(
+    path10__namespace.posix.join(path10__namespace.posix.dirname(fromFile), specifier)
+  );
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const direct = exact(joined);
+  if (direct) return direct;
   for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
-    const withSuffix = `${joined}${suffix}`;
-    if (knownFiles.has(withSuffix)) return withSuffix;
-  }
-  const extensionSwap = new RegExp(`${candidate}\\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$`);
-  for (const file of knownFiles) {
-    if (extensionSwap.test(file)) return file;
+    const hit = exact(`${joined}${suffix}`);
+    if (hit) return hit;
   }
-  return null;
+  const stem = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const byStem = (key) => resolver.byStem.get(key) ?? resolver.byStemFolded.get(key.toLowerCase()) ?? null;
+  return byStem(joined) ?? byStem(stem);
 }
 function buildIndexes(files) {
-  const knownFiles = new Set(files.map((file) => file.relativePath));
+  const resolver = buildImportResolver(files);
   const importerCounts = /* @__PURE__ */ new Map();
   const byFile = files.filter((file) => isSourceSummary(file.summary)).map((file) => {
     const summary = file.summary;
@@ -5471,7 +5548,7 @@ function buildIndexes(files) {
   });
   for (const entry of byFile) {
     for (const specifier of entry.imports) {
-      const resolved = resolveSpecifier(entry.path, specifier, knownFiles);
+      const resolved = resolveSpecifier(entry.path, specifier, resolver);
       if (resolved) importerCounts.set(resolved, (importerCounts.get(resolved) ?? 0) + 1);
     }
   }
@@ -5562,15 +5639,22 @@ function resolveSafeOutputDirs(config) {
   return { outDir, tmpDir };
 }
 var PLACEHOLDER_ENTRIES = /* @__PURE__ */ new Set([".gitkeep", ".gitignore", ".DS_Store"]);
-var STAGING_ENTRIES = /* @__PURE__ */ new Set([
-  ".codebase-snapshot",
-  "manifest.json",
-  "README.md",
-  "parts",
-  "reports",
-  "full-codebase.json",
-  "full-codebase.md"
-]);
+var RUN_DIR_PREFIX = "run-";
+var STALE_RUN_MS = 60 * 60 * 1e3;
+function maskPathText(value, secretRules) {
+  return findSecretInPath(value, secretRules)?.masked ?? value;
+}
+function maskSkipRecords(records, secretRules) {
+  return maskSkipPaths(records, secretRules);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code !== "ESRCH";
+  }
+}
 var OWNERSHIP_MARKER = ".codebase-snapshot";
 var SUPPORTED_MARKER_SCHEMAS = /* @__PURE__ */ new Set([SCHEMA_VERSION]);
 var SNAPSHOT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -5600,6 +5684,7 @@ function markerPayload(dir, state, id, createdAt) {
     createdAt,
     state,
     id,
+    pid: process.pid,
     entries: listEntries(dir)
   };
   const manifestPath = path10__namespace.join(dir, "manifest.json");
@@ -5663,6 +5748,7 @@ function readOwnershipMarker(dir) {
       createdAt: typeof candidate.createdAt === "string" ? candidate.createdAt : "unknown",
       state: candidate.state,
       id: candidate.id,
+      pid: typeof candidate.pid === "number" ? candidate.pid : void 0,
       manifestSha256: typeof candidate.manifestSha256 === "string" ? candidate.manifestSha256 : void 0,
       entries: Array.isArray(candidate.entries) && candidate.entries.every((entry) => typeof entry === "string") ? candidate.entries : void 0
     },
@@ -5770,7 +5856,7 @@ function describeEntries(entries, limit = 5) {
   const shown = entries.slice(0, limit).join(", ");
   return entries.length > limit ? `${shown}, and ${entries.length - limit} more` : shown;
 }
-function assertReplaceable(target, label) {
+function assertReplaceable(target, label, secretRules) {
   if (!fs9__namespace.existsSync(target)) return;
   if (!fs9__namespace.statSync(target).isDirectory()) {
     throw new Error(
@@ -5779,34 +5865,89 @@ function assertReplaceable(target, label) {
   }
   const entries = fs9__namespace.readdirSync(target);
   if (entries.length === 0) return;
-  if (label === "outDir" && entries.every((name) => PLACEHOLDER_ENTRIES.has(name))) return;
-  const { marker: marker2, problem } = readOwnershipMarker(target);
-  if (label === "tmpDir") {
-    if (!marker2) {
-      throw new Error(
-        `Refusing to replace tmpDir ${target}: ${problem ?? "it does not carry this generator's marker"}. This generator only clears a staging directory it wrote. Point tmpDir at a new or empty directory, or remove ${target} yourself.`
-      );
-    }
-    const unexpected = entries.filter((name) => !STAGING_ENTRIES.has(name));
-    if (unexpected.length > 0) {
-      throw new Error(
-        `Refusing to replace tmpDir ${target}: it holds ${describeEntries(unexpected)}, which this generator did not write. Point tmpDir at a new or empty directory, or remove those files yourself.`
-      );
-    }
-    return;
-  }
+  if (entries.every((name) => PLACEHOLDER_ENTRIES.has(name))) return;
+  const { problem } = readOwnershipMarker(target);
   const verdict = assessSnapshotDirectory(target);
   if (verdict.owned) return;
+  const shownForeign = verdict.foreignEntries.map((name) => maskPathText(name, secretRules));
+  const shownEntries = entries.map((name) => maskPathText(name, secretRules));
   if (verdict.foreignEntries.length > 0) {
     throw new Error(
-      `Refusing to replace ${label} ${target}: it carries this generator's ownership marker, but these entries are not part of the snapshot it recorded: ${describeEntries(verdict.foreignEntries)}. Remove them yourself, or point ${label} at a new or empty directory.`
+      `Refusing to replace ${label} ${target}: it carries this generator's ownership marker, but these entries are not part of the snapshot it recorded: ${describeEntries(shownForeign)}. Remove them yourself, or point ${label} at a new or empty directory.`
     );
   }
   const reason = verdict.problem ?? problem ?? "it does not look like a snapshot this generator wrote";
   throw new Error(
-    `Refusing to replace ${label} ${target}: ${reason} (found ${describeEntries(entries)}). Remove the directory yourself, or point ${label} at a new or empty directory.`
+    `Refusing to replace ${label} ${target}: ${reason} (found ${describeEntries(shownEntries)}). Remove the directory yourself, or point ${label} at a new or empty directory.`
   );
 }
+function assertStagingRootUsable(tmpDir, secretRules) {
+  if (!fs9__namespace.existsSync(tmpDir)) return;
+  if (!fs9__namespace.statSync(tmpDir).isDirectory()) {
+    throw new Error(`Refusing to write into tmpDir ${tmpDir}: it exists but is not a directory.`);
+  }
+  const entries = fs9__namespace.readdirSync(tmpDir);
+  if (entries.length === 0) return;
+  const foreign = entries.filter((name) => {
+    const full = path10__namespace.join(tmpDir, name);
+    if (!name.startsWith(RUN_DIR_PREFIX)) return true;
+    let stats;
+    try {
+      stats = fs9__namespace.statSync(full);
+    } catch {
+      return true;
+    }
+    if (!stats.isDirectory()) return true;
+    const { marker: marker2 } = readOwnershipMarker(full);
+    if (marker2) return false;
+    try {
+      return fs9__namespace.readdirSync(full).length > 0;
+    } catch {
+      return true;
+    }
+  });
+  if (foreign.length > 0) {
+    const shown = describeEntries(foreign.map((name) => maskPathText(name, secretRules)));
+    throw new Error(
+      `Refusing to replace tmpDir ${tmpDir}: it holds ${shown}, which this generator did not write. Point tmpDir at a new or empty directory, or remove those files yourself.`
+    );
+  }
+}
+function cleanStaleRunDirs(tmpDir) {
+  let entries;
+  try {
+    entries = fs9__namespace.readdirSync(tmpDir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.startsWith(RUN_DIR_PREFIX)) continue;
+    const full = path10__namespace.join(tmpDir, name);
+    const { marker: marker2 } = readOwnershipMarker(full);
+    if (marker2) {
+      const created = Date.parse(marker2.createdAt);
+      const aged = !Number.isFinite(created) || Date.now() - created > STALE_RUN_MS;
+      const abandoned = typeof marker2.pid === "number" && !isProcessAlive(marker2.pid);
+      if (aged || abandoned) {
+        try {
+          fs9__namespace.rmSync(full, { recursive: true, force: true });
+        } catch {
+        }
+      }
+      continue;
+    }
+    try {
+      if (fs9__namespace.readdirSync(full).length === 0) fs9__namespace.rmSync(full, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function removeIfEmpty(dir) {
+  try {
+    if (fs9__namespace.readdirSync(dir).length === 0) fs9__namespace.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
 function ensureParentDirectory(target, label) {
   const parent = path10__namespace.dirname(target);
   if (fs9__namespace.existsSync(parent) && !fs9__namespace.statSync(parent).isDirectory()) {
@@ -5822,14 +5963,12 @@ function ensureParentDirectory(target, label) {
     );
   }
 }
-function acquireRunLock(outDir) {
-  const lockPath = path10__namespace.join(
-    os__namespace.tmpdir(),
-    `codebase-snapshot-${sha256Hex2(outDir).slice(0, 16)}.lock`
-  );
+function acquireRunLock(stagingRoot) {
+  const key = lockKeyFor(stagingRoot);
+  const lockPath = path10__namespace.join(os__namespace.tmpdir(), `codebase-snapshot-${key}.lock`);
   const payload = `${JSON.stringify({
     pid: process.pid,
-    outDir,
+    stagingRoot,
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   })}
 `;
@@ -5854,11 +5993,20 @@ function acquireRunLock(outDir) {
         continue;
       }
       throw new Error(
-        `Another generate run is already writing ${outDir}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
+        `Another generate run is already using the staging directory ${stagingRoot}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
       );
     }
   }
-  throw new Error(`Could not acquire the generate lock for ${outDir}.`);
+  throw new Error(`Could not acquire the generate lock for ${stagingRoot}.`);
+}
+function lockKeyFor(stagingRoot) {
+  let key = stagingRoot;
+  try {
+    key = fs9__namespace.realpathSync(stagingRoot);
+  } catch {
+  }
+  if (process.platform === "win32" || process.platform === "darwin") key = key.toLowerCase();
+  return sha256Hex2(key).slice(0, 16);
 }
 function lockOwnerIsGone(lockPath) {
   let raw;
@@ -5894,18 +6042,32 @@ function writeManifestAtomically(manifestPath, manifest) {
     throw err;
   }
 }
-function swapIntoPlace(tmpDir, outDir) {
+function swapIntoPlace(stagingDir, outDir) {
   ensureParentDirectory(outDir, "outDir");
+  const deadline = Date.now() + 3e3;
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      swapOnce(stagingDir, outDir);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const racy = code === "ENOENT" || code === "ENOTEMPTY" || code === "EEXIST" || code === "EPERM";
+      if (!racy || attempt >= 10 || Date.now() > deadline) throw err;
+      sleepSync(50);
+    }
+  }
+}
+function swapOnce(stagingDir, outDir) {
   const backupDir = `${outDir}.backup-${process.pid}-${Date.now()}`;
   const hadPrevious = fs9__namespace.existsSync(outDir);
   if (hadPrevious) fs9__namespace.renameSync(outDir, backupDir);
   try {
     try {
-      fs9__namespace.renameSync(tmpDir, outDir);
+      fs9__namespace.renameSync(stagingDir, outDir);
     } catch (err) {
       if (err.code === "EXDEV") {
-        fs9__namespace.cpSync(tmpDir, outDir, { recursive: true });
-        fs9__namespace.rmSync(tmpDir, { recursive: true, force: true });
+        fs9__namespace.cpSync(stagingDir, outDir, { recursive: true });
+        fs9__namespace.rmSync(stagingDir, { recursive: true, force: true });
       } else {
         throw err;
       }
@@ -5919,6 +6081,10 @@ function swapIntoPlace(tmpDir, outDir) {
     throw err;
   }
 }
+function sleepSync(milliseconds) {
+  const buffer = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(buffer, 0, 0, milliseconds);
+}
 function artifactWarnings(artifacts) {
   const messages = [];
   if (!artifacts.manifest) {
@@ -5981,11 +6147,12 @@ function generateSnapshot(configInput, options) {
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   const files = [];
   const monolithBodies = /* @__PURE__ */ new Map();
-  const skipped = [...collection.skipped];
+  const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
   const secretFindings = [];
   const warnings = [];
   const layerCounts = {};
@@ -6059,12 +6226,12 @@ function generateSnapshot(configInput, options) {
       summaryQuality = outcome?.quality;
       if (isSourceSummary(summary) && summary.parseErrors) {
         warnings.push(
-          `Parse errors in ${relativePath} (${summary.parseErrors}); its summary is incomplete.`
+          `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
         );
       }
     } catch (err) {
       warnings.push(
-        `Summary skipped for ${relativePath}: ${err.message}`.replace(/\s+/g, " ")
+        `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(/\s+/g, " ")
       );
     }
     files.push({
@@ -6173,12 +6340,12 @@ function generateSnapshot(configInput, options) {
       const { content: _content, ...rest } = file;
       return rest;
     }),
-    skipped,
+    skipped: maskSkipRecords(skipped, config.secretRules),
     warnings
   };
   manifest.warnings = [
     ...warnings,
-    ...secretFindings.map((finding) => `${finding.rule} at ${finding.path ?? "unknown"}:${finding.line}`)
+    ...secretFindings.map((finding) => `${finding.rule} at ${maskPathText(finding.path ?? "unknown", config.secretRules)}:${finding.line}`)
   ];
   manifest.totals.warningCount = manifest.warnings.length;
   let monolithJson = null;
@@ -6224,31 +6391,33 @@ function generateSnapshot(configInput, options) {
   manifest.totals.warningCount = manifest.warnings.length;
   const { outDir, tmpDir } = resolveSafeOutputDirs(config);
   const { artifacts } = config;
-  assertReplaceable(tmpDir, "tmpDir");
-  assertReplaceable(outDir, "outDir");
+  assertReplaceable(outDir, "outDir", config.secretRules);
+  assertStagingRootUsable(tmpDir, config.secretRules);
   if (dryRun) {
     runAfterGenerate(config, manifest);
     return manifest;
   }
-  const releaseLock = acquireRunLock(outDir);
-  let stagingStarted = false;
+  const releaseLock = acquireRunLock(tmpDir);
+  let stagingDir = null;
   try {
     ensureParentDirectory(outDir, "outDir");
-    fs9__namespace.rmSync(tmpDir, { recursive: true, force: true });
     fs9__namespace.mkdirSync(tmpDir, { recursive: true });
-    stagingStarted = true;
+    cleanStaleRunDirs(tmpDir);
     const snapshotId = crypto__namespace.randomUUID();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-    writeOwnershipMarker(tmpDir, {
+    stagingDir = path10__namespace.join(tmpDir, `${RUN_DIR_PREFIX}${process.pid}-${snapshotId.slice(0, 8)}`);
+    fs9__namespace.mkdirSync(stagingDir);
+    writeOwnershipMarker(stagingDir, {
       generator: GENERATOR_NAME,
       version: GENERATOR_VERSION,
       schemaVersion: SCHEMA_VERSION,
       createdAt,
       state: "staging",
-      id: snapshotId
+      id: snapshotId,
+      pid: process.pid
     });
-    const partsDir = path10__namespace.join(tmpDir, "parts");
-    const reportsDir = path10__namespace.join(tmpDir, "reports");
+    const partsDir = path10__namespace.join(stagingDir, "parts");
+    const reportsDir = path10__namespace.join(stagingDir, "reports");
     if (artifacts.parts) fs9__namespace.mkdirSync(partsDir, { recursive: true });
     if (artifacts.navigation || artifacts.projectTree || artifacts.audit) {
       fs9__namespace.mkdirSync(reportsDir, { recursive: true });
@@ -6268,25 +6437,25 @@ function generateSnapshot(configInput, options) {
     if (artifacts.audit) {
       fs9__namespace.writeFileSync(
         path10__namespace.join(reportsDir, "audit.md"),
-        generateAuditReport(manifest, secretFindings),
+        generateAuditReport(manifest, secretFindings, config.secretRules),
         "utf8"
       );
     }
     if (artifacts.readme) {
-      fs9__namespace.writeFileSync(path10__namespace.join(tmpDir, "README.md"), generateReadme(manifest), "utf8");
+      fs9__namespace.writeFileSync(path10__namespace.join(stagingDir, "README.md"), generateReadme(manifest), "utf8");
     }
     if (artifacts.manifest) {
-      fs9__namespace.writeFileSync(path10__namespace.join(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+      fs9__namespace.writeFileSync(path10__namespace.join(stagingDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
     }
     if (monolithJson !== null) {
-      fs9__namespace.writeFileSync(path10__namespace.join(tmpDir, "full-codebase.json"), monolithJson, "utf8");
+      fs9__namespace.writeFileSync(path10__namespace.join(stagingDir, "full-codebase.json"), monolithJson, "utf8");
     }
     if (monolithMarkdown !== null) {
-      fs9__namespace.writeFileSync(path10__namespace.join(tmpDir, "full-codebase.md"), monolithMarkdown, "utf8");
+      fs9__namespace.writeFileSync(path10__namespace.join(stagingDir, "full-codebase.md"), monolithMarkdown, "utf8");
     }
-    writeOwnershipMarker(tmpDir, markerPayload(tmpDir, "complete", snapshotId, createdAt));
-    swapIntoPlace(tmpDir, outDir);
-    stagingStarted = false;
+    writeOwnershipMarker(stagingDir, markerPayload(stagingDir, "complete", snapshotId, createdAt));
+    swapIntoPlace(stagingDir, outDir);
+    stagingDir = null;
     const warningsBeforeHook = manifest.warnings.length;
     runAfterGenerate(config, manifest);
     if (artifacts.manifest && manifest.warnings.length !== warningsBeforeHook) {
@@ -6295,14 +6464,15 @@ function generateSnapshot(configInput, options) {
     writeOwnershipMarker(outDir, markerPayload(outDir, "complete", snapshotId, createdAt));
     return manifest;
   } catch (err) {
-    if (stagingStarted) {
+    if (stagingDir !== null) {
       try {
-        fs9__namespace.rmSync(tmpDir, { recursive: true, force: true });
+        fs9__namespace.rmSync(stagingDir, { recursive: true, force: true });
       } catch {
       }
     }
     throw err;
   } finally {
+    removeIfEmpty(tmpDir);
     releaseLock();
   }
 }