@f4bioo/berry-shield 2026.3.17 → 2026.3.20

package/dist/index.js

@@ -509,16 +509,652 @@ var init_generated = __esm({
   }
 });
 
+// src/patterns/constants.ts
+var NAMESPACES, CATEGORIES, PREFIXES;
+var init_constants = __esm({
+  "src/patterns/constants.ts"() {
+    "use strict";
+    NAMESPACES = {
+      /** Native Berry Shield logic and core patterns */
+      BERRY: "berry",
+      /** Automated community patterns sourced from Gitleaks baseline */
+      GITLEAKS: "gitleaks"
+    };
+    CATEGORIES = {
+      SECRET: "secret",
+      PII: "pii",
+      FILE: "file",
+      COMMAND: "command"
+    };
+    PREFIXES = {
+      BERRY_SECRET: `${NAMESPACES.BERRY}:${CATEGORIES.SECRET}`,
+      GITLEAKS_SECRET: `${NAMESPACES.GITLEAKS}:${CATEGORIES.SECRET}`,
+      BERRY_PII: `${NAMESPACES.BERRY}:${CATEGORIES.PII}`,
+      BERRY_FILE: `${NAMESPACES.BERRY}:${CATEGORIES.FILE}`,
+      BERRY_COMMAND: `${NAMESPACES.BERRY}:${CATEGORIES.COMMAND}`
+    };
+  }
+});
+
+// src/patterns/extended.ts
+var INTERNAL_SECRET_PATTERNS, INTERNAL_PII_PATTERNS, INTERNAL_SENSITIVE_FILE_PATTERNS, INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS;
+var init_extended = __esm({
+  "src/patterns/extended.ts"() {
+    "use strict";
+    init_constants();
+    INTERNAL_SECRET_PATTERNS = [
+      {
+        id: `${PREFIXES.BERRY_SECRET}:aws-access-key`,
+        name: "AWS Access Key",
+        category: CATEGORIES.SECRET,
+        pattern: /AKIA[0-9A-Z]{16}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:aws-secret-key`,
+        name: "AWS Secret Key",
+        category: CATEGORIES.SECRET,
+        pattern: /aws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{40}/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:stripe-key`,
+        name: "Stripe Key",
+        category: CATEGORIES.SECRET,
+        pattern: /[sr]k[-_](?:live|test)[-_][a-zA-Z0-9]{20,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:github-token`,
+        name: "GitHub Token",
+        category: CATEGORIES.SECRET,
+        pattern: /gh[pousr]_[a-zA-Z0-9]{36}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:github-pat`,
+        name: "GitHub PAT",
+        category: CATEGORIES.SECRET,
+        pattern: /github_pat_[a-zA-Z0-9_]{22,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:openai-key`,
+        name: "OpenAI Key",
+        category: CATEGORIES.SECRET,
+        pattern: /sk-[a-zA-Z0-9]{20,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:anthropic-key`,
+        name: "Anthropic Key",
+        category: CATEGORIES.SECRET,
+        pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:slack-token`,
+        name: "Slack Token",
+        category: CATEGORIES.SECRET,
+        pattern: /xox[bpras]-[a-zA-Z0-9-]{10,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:sendgrid-key`,
+        name: "SendGrid Key",
+        category: CATEGORIES.SECRET,
+        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:npm-token`,
+        name: "NPM Token",
+        category: CATEGORIES.SECRET,
+        pattern: /npm_[a-zA-Z0-9]{36,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:telegram-bot-token`,
+        name: "Telegram Bot Token",
+        category: CATEGORIES.SECRET,
+        pattern: /[0-9]{8,10}:[a-zA-Z0-9_-]{35,}/g,
+        includeHash: true,
+        // Context-awareness: 8-10 digits + colon + 35 alphanum can collide with
+        // composite log identifiers, timestamps:tokens, and similar formats.
+        isContextRequired: true,
+        contextWords: ["telegram", "bot", "token", "tg", "chat_id", "sendMessage"],
+        contextWindow: { before: 30, after: 15 }
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:google-api-key`,
+        name: "Google API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /AIza[0-9A-Za-z_-]{35}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:google-cloud-service-account`,
+        name: "GCP Service Account",
+        category: CATEGORIES.SECRET,
+        pattern: /"type"\s*:\s*"service_account"/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:azure-openai-key`,
+        name: "Azure OpenAI Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:azure|openai)[_-]?(?:api)?[_-]?key\s*[:=]\s*["']?[a-fA-F0-9]{32}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:huggingface-token`,
+        name: "HuggingFace Token",
+        category: CATEGORIES.SECRET,
+        pattern: /hf_[a-zA-Z0-9]{34,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:replicate-token`,
+        name: "Replicate Token",
+        category: CATEGORIES.SECRET,
+        pattern: /r8_[a-zA-Z0-9]{36,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:cohere-api-key`,
+        name: "Cohere API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:cohere|co[-_]?api)[-_]?key\s*[:=]\s*["']?[a-zA-Z0-9_-]{40,}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:together-ai-key`,
+        name: "Together AI Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:together|together[-_]?ai)[-_]?(?:api)?[-_]?key\s*[:=]\s*["']?[a-zA-Z0-9_-]{40,}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:mistral-api-key`,
+        name: "Mistral API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /mistral[-_]?(?:api)?[-_]?key\s*[:=]\s*["']?[a-zA-Z0-9_-]{32,}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:groq-api-key`,
+        name: "Groq API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /gsk_[a-zA-Z0-9_]{48,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:deepseek-api-key`,
+        name: "DeepSeek API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /deepseek[-_]?(?:api)?[-_]?key\s*[:=]\s*["']?sk-[a-zA-Z0-9]{48,}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:coinbase-api-key`,
+        name: "Coinbase API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:coinbase)[_-]?(?:api)?[_-]?(?:key|secret)\s*[:=]\s*["']?[a-zA-Z0-9_-]{20,}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:binance-api-key`,
+        name: "Binance API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:binance)[_-]?(?:api)?[_-]?(?:key|secret)\s*[:=]\s*["']?[a-zA-Z0-9]{64}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:alpaca-api-key`,
+        name: "Alpaca API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:AK|PK)[a-zA-Z0-9]{20}/g,
+        includeHash: true,
+        // Context-awareness required: "AK"/"PK" + 20 alphanum is extremely common
+        // in package names, base64 fragments, and generic identifiers.
+        isContextRequired: true,
+        contextWords: ["alpaca", "trading", "brokerage", "api", "key", "secret", "market"],
+        contextWindow: { before: 30, after: 15 }
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:trading-api-key`,
+        name: "Trading API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:trading|brokerage|alpaca|tradier|interactive[-_]?brokers)[-_]?(?:api)?[-_]?(?:key|secret|token)\s*[:=]\s*["']?[a-zA-Z0-9_-]{20,}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:slack-webhook`,
+        name: "Slack Webhook",
+        category: CATEGORIES.SECRET,
+        pattern: /hooks\.slack\.com\/services\/T[a-zA-Z0-9_]+\/B[a-zA-Z0-9_]+\/[a-zA-Z0-9_]+/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:twilio-api-key`,
+        name: "Twilio API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /SK[0-9a-fA-F]{32}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:mailgun-api-key`,
+        name: "Mailgun API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /key-[a-zA-Z0-9]{32}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:vault-token`,
+        name: "Vault Token",
+        category: CATEGORIES.SECRET,
+        pattern: /hvs\.[a-zA-Z0-9_-]{24,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:database-url`,
+        name: "Database URL",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?):\/\/[^\s]{10,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:redis-url`,
+        name: "Redis URL",
+        category: CATEGORIES.SECRET,
+        pattern: /rediss?:\/\/[^\s]{10,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:supabase-key`,
+        name: "Supabase Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:supabase|SUPABASE)[-_]?(?:anon|service[-_]?role)?[-_]?key\s*[:=]\s*["']?eyJ[a-zA-Z0-9_-]{20,}["']?/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:vercel-token`,
+        name: "Vercel Token",
+        category: CATEGORIES.SECRET,
+        pattern: /vercel_[a-zA-Z0-9_-]{24,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:heroku-api-key`,
+        name: "Heroku API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /heroku[-_]?(?:api)?[-_]?key\s*[:=]\s*["']?[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:digitalocean-token`,
+        name: "DigitalOcean Token",
+        category: CATEGORIES.SECRET,
+        pattern: /dop_v1_[a-fA-F0-9]{64}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:cloudflare-api-token`,
+        name: "Cloudflare API Token",
+        category: CATEGORIES.SECRET,
+        pattern: /cf_[a-zA-Z0-9_-]{40,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:firebase-key`,
+        name: "Firebase Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:firebase|FIREBASE)[-_]?(?:api)?[-_]?(?:key|secret|token)\s*[:=]\s*["']?[a-zA-Z0-9_-]{20,}["']?/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:datadog-api-key`,
+        name: "Datadog API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:datadog|DD)[-_]?(?:api)?[-_]?key\s*[:=]\s*["']?[a-fA-F0-9]{32}["']?/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:sentry-dsn`,
+        name: "Sentry DSN",
+        category: CATEGORIES.SECRET,
+        pattern: /https:\/\/[a-f0-9]{32}@[a-z0-9.]+sentry[a-z.]*\/[0-9]+/g,
+        includeHash: true
+      },
+      // --- High Collision Potential (Raw Formats) ---
+      {
+        id: `${PREFIXES.BERRY_SECRET}:eth-private-key`,
+        name: "ETH Private Key",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:^|[\s"'`=])(?:0x)?[0-9a-fA-F]{64}(?=\s|$|["'])/g,
+        includeHash: true,
+        // Context-awareness required: raw 64-char hex collides with SHA-256 hashes,
+        // git commit hashes, and other common hex strings.
+        // Self-contained vendor patterns (Binance, Coinbase) take priority via selectWinner.
+        isContextRequired: true,
+        contextWords: ["eth", "ethereum", "private", "wallet", "key", "0x", "web3", "crypto", "mnemonic", "keystore"],
+        contextWindow: { before: 40, after: 20 }
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:mnemonic-seed`,
+        name: "Crypto Seed",
+        category: CATEGORIES.SECRET,
+        pattern: /(?:mnemonic|seed\s*phrase|recovery\s*phrase|backup\s*phrase)\s*[:=]?\s*["']?(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}["']?/gi,
+        includeHash: true
+        // Already self-validating: pattern includes "mnemonic"/"seed phrase" in regex
+        // No additional context needed
+      },
+      // --- Generic & Catch-all (Final Fallback) ---
+      {
+        id: `${PREFIXES.BERRY_SECRET}:private-key`,
+        name: "Private Key",
+        category: CATEGORIES.SECRET,
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:jwt`,
+        name: "JWT",
+        category: CATEGORIES.SECRET,
+        pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:bearer-token`,
+        name: "Bearer Token",
+        category: CATEGORIES.SECRET,
+        pattern: /Authorization\s*[:=]\s*Bearer\s+[a-zA-Z0-9_.\-/+=]{20,}/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:generic-api-key`,
+        name: "Generic API Key",
+        category: CATEGORIES.SECRET,
+        pattern: /api[-_]?key\s*[:=]\s*[a-zA-Z0-9_.\-/+=]{20,}/gi,
+        includeHash: true
+        // Self-contained pattern: regex already requires "api_key" literal
+        // Context-awareness not needed - the pattern itself IS the context
+      },
+      {
+        id: `${PREFIXES.BERRY_SECRET}:generic-json-secret`,
+        name: "Generic JSON Secret",
+        category: CATEGORIES.SECRET,
+        pattern: /"(?:apiKey|token|secret|auth|password|passwd)"\s*:\s*"([^"]+)"/gi,
+        placeholder: '"key": "[GENERIC_SECRET_REDACTED]"'
+      }
+    ];
+    INTERNAL_PII_PATTERNS = [
+      {
+        id: `${PREFIXES.BERRY_PII}:email`,
+        name: "Email",
+        category: CATEGORIES.PII,
+        pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:ssn-us`,
+        name: "SSN (USA)",
+        category: CATEGORIES.PII,
+        pattern: /\b(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:credit-card`,
+        name: "Credit Card",
+        category: CATEGORIES.PII,
+        pattern: /\b[3-6]\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{1,7}\b/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:iban`,
+        name: "IBAN",
+        category: CATEGORIES.PII,
+        pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}[A-Z0-9]{0,23}\b/g,
+        includeHash: true
+      },
+      // --- Brazilian PII (BEFORE phone patterns to enable context evaluation) ---
+      {
+        id: `${PREFIXES.BERRY_PII}:cpf-br`,
+        name: "CPF (Brazil)",
+        category: CATEGORIES.PII,
+        pattern: /\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,
+        includeHash: true,
+        // Context-awareness: Prevents false positives (11-digit phone numbers)
+        isContextRequired: true,
+        contextWords: ["cpf", "cadastro", "documento", "contribuinte", "fiscal", "tax"],
+        contextWindow: { before: 30, after: 15 }
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:cnpj-br`,
+        name: "CNPJ (Brazil)",
+        category: CATEGORIES.PII,
+        pattern: /\b\d{2}\.?\d{3}\.?\d{3}\/?\d{4}-?\d{2}\b/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:cnh-br`,
+        name: "CNH (Brazil)",
+        category: CATEGORIES.PII,
+        pattern: /\b\d{11}\b/g,
+        includeHash: true,
+        // Context-awareness: Prevents false positives (timestamps, IDs)
+        isContextRequired: true,
+        contextWords: ["cnh", "habilita\xE7\xE3o", "habilitacao", "carteira", "motorista", "driver", "license"],
+        contextWindow: { before: 40, after: 10 }
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:rg-br`,
+        name: "RG (Brazil)",
+        category: CATEGORIES.PII,
+        pattern: /\b\d{1,2}\.?\d{3}\.?\d{3}-?\d{1}\b/g,
+        includeHash: true,
+        // Context-awareness: Prevents false positives (IDs, counters)
+        isContextRequired: true,
+        contextWords: ["rg", "identidade", "documento", "carteira", "identity", "card"],
+        contextWindow: { before: 30, after: 15 }
+      },
+      // --- Chinese PII ---
+      {
+        id: `${PREFIXES.BERRY_PII}:id-cn`,
+        name: "Citizen ID (China)",
+        category: CATEGORIES.PII,
+        pattern: /\b[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]\b/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:cn-phone`,
+        name: "Chinese Phone",
+        category: CATEGORIES.PII,
+        pattern: /\b1[3-9]\d{9}\b/g,
+        includeHash: true,
+        // Context-awareness: Prevents collision with Brazilian phones (also 11 digits starting with 1)
+        isContextRequired: true,
+        contextWords: ["\u624B\u673A", "\u7535\u8BDD", "phone", "mobile", "contact", "tel"],
+        contextWindow: { before: 25, after: 10 }
+      },
+      // --- Generic Passport (international) ---
+      {
+        id: `${PREFIXES.BERRY_PII}:passport`,
+        name: "Passport",
+        category: CATEGORIES.PII,
+        pattern: /\b(?:passport|护照)[-_\s]*(?:no|number|号)?[-_\s:]*[A-Z0-9]{5,12}\b/gi,
+        includeHash: true
+      },
+      // --- Phone patterns (AFTER context-aware BR/CN to avoid false positives) ---
+      {
+        id: `${PREFIXES.BERRY_PII}:phone-us`,
+        name: "US Phone",
+        category: CATEGORIES.PII,
+        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?[2-9]\d{2}\)?[-.\s]?)[2-9]\d{2}[-.\s]?\d{4}\b/g,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_PII}:phone-intl`,
+        name: "International Phone",
+        category: CATEGORIES.PII,
+        pattern: /(\+[2-9]\d{0,2}[-.\s]?\d{2,4}[-.\s]?\d{3,4}[-.\s]?\d{3,4})\b/g,
+        includeHash: true
+      }
+    ];
+    INTERNAL_SENSITIVE_FILE_PATTERNS = [
+      { id: `${PREFIXES.BERRY_FILE}:env`, name: "Environment File", category: CATEGORIES.FILE, pattern: /\.env(?:\.|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:credentials-json`, name: "Credentials JSON", category: CATEGORIES.FILE, pattern: /credentials\.json$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:pem`, name: "PEM Key", category: CATEGORIES.FILE, pattern: /\.pem$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:key`, name: "Private Key File", category: CATEGORIES.FILE, pattern: /\.key$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:p12`, name: "PKCS#12 File", category: CATEGORIES.FILE, pattern: /\.p12$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:pfx`, name: "PFX Certificate", category: CATEGORIES.FILE, pattern: /\.pfx$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:ssh-private-keys`, name: "SSH Private Key", category: CATEGORIES.FILE, pattern: /id_(?:rsa|ed25519|ecdsa|dsa)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:ssh-known-hosts`, name: "SSH Known Hosts", category: CATEGORIES.FILE, pattern: /known_hosts$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:ssh-config`, name: "SSH Config", category: CATEGORIES.FILE, pattern: /\.ssh[\\/]config$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:netrc`, name: "NETRC Config", category: CATEGORIES.FILE, pattern: /\.netrc$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:npmrc`, name: "NPMRC Config", category: CATEGORIES.FILE, pattern: /\.npmrc$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:secret-files`, name: "Generic Secret File", category: CATEGORIES.FILE, pattern: /secrets?\.(?:ya?ml|json|toml)$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:aws-credentials`, name: "AWS Credentials", category: CATEGORIES.FILE, pattern: /\.aws[\\/]credentials$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:aws-config`, name: "AWS Config", category: CATEGORIES.FILE, pattern: /\.aws[\\/]config$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:kube-config`, name: "Kube Config", category: CATEGORIES.FILE, pattern: /\.kube[\\/]config$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:ssh-host-keys`, name: "SSH Host Key", category: CATEGORIES.FILE, pattern: /\/etc\/ssh\/ssh_host_(?:rsa|ed25519|ecdsa)_key$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:docker-config`, name: "Docker Config", category: CATEGORIES.FILE, pattern: /\.docker[\\/]config\.json$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:gnupg-keys`, name: "GnuPG Private Key", category: CATEGORIES.FILE, pattern: /\.gnupg[\\/]private-keys-v1\.d(?:[\\/]|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:vault-token`, name: "Vault Token", category: CATEGORIES.FILE, pattern: /\.vault-token$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:terraform-credentials`, name: "Terraform Credentials", category: CATEGORIES.FILE, pattern: /\.terraform\.d[\\/]credentials\.tfrc\.json$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:rclone-conf`, name: "Rclone Config", category: CATEGORIES.FILE, pattern: /\.config[\\/]rclone[\\/]rclone\.conf$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:sops-age-keys`, name: "SOPS Age Keys", category: CATEGORIES.FILE, pattern: /\.config[\\/]sops[\\/]age[\\/]keys\.txt$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:age-keys`, name: "Age Keys", category: CATEGORIES.FILE, pattern: /\.config[\\/]age[\\/]keys\.txt$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:pypirc`, name: "PyPI Config", category: CATEGORIES.FILE, pattern: /\.pypirc$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:gh-hosts`, name: "GitHub CLI Hosts", category: CATEGORIES.FILE, pattern: /\.config[\\/]gh[\\/]hosts\.yml$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:gcloud-credentials-db`, name: "GCloud Credentials", category: CATEGORIES.FILE, pattern: /\.config[\\/]gcloud[\\/]credentials\.db$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:gcloud-access-tokens`, name: "GCloud Access Tokens", category: CATEGORIES.FILE, pattern: /\.config[\\/]gcloud[\\/]access_tokens\.db$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:gcloud-legacy-credentials`, name: "GCloud Legacy Credentials", category: CATEGORIES.FILE, pattern: /\.config[\\/]gcloud[\\/]legacy_credentials(?:[\\/]|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:azure-access-tokens`, name: "Azure Access Tokens", category: CATEGORIES.FILE, pattern: /\.config[\\/]azure[\\/]accessTokens\.json$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:helm-registry-config`, name: "Helm Registry Config", category: CATEGORIES.FILE, pattern: /\.config[\\/]helm[\\/]registry[\\/]config\.json$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:poetry-auth`, name: "Poetry Auth", category: CATEGORIES.FILE, pattern: /\.config[\\/]pypoetry[\\/]auth\.toml$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:linux-keyrings`, name: "Linux Keyrings", category: CATEGORIES.FILE, pattern: /\.local[\\/]share[\\/]keyrings(?:[\\/]|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:windows-roaming-credentials`, name: "Windows Roaming Credentials", category: CATEGORIES.FILE, pattern: /(?:^|[\\/])AppData[\\/]Roaming[\\/]Microsoft[\\/]Credentials(?:[\\/]|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:windows-local-credentials`, name: "Windows Local Credentials", category: CATEGORIES.FILE, pattern: /(?:^|[\\/])AppData[\\/]Local[\\/]Microsoft[\\/]Credentials(?:[\\/]|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:mac-keychains`, name: "Mac Keychains", category: CATEGORIES.FILE, pattern: /(?:^|[\\/])Library[\\/]Keychains(?:[\\/]|$)/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:linux-shadow`, name: "Linux Shadow File", category: CATEGORIES.FILE, pattern: /\/etc\/shadow$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:linux-passwd`, name: "Linux Passwd File", category: CATEGORIES.FILE, pattern: /\/etc\/passwd$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:linux-gshadow`, name: "Linux Gshadow File", category: CATEGORIES.FILE, pattern: /\/etc\/gshadow$/i, includeHash: true },
+      { id: `${PREFIXES.BERRY_FILE}:openclaw-json`, name: "OpenClaw Config File", category: CATEGORIES.FILE, pattern: /openclaw\.json$/i, includeHash: true }
+    ];
+    INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS = [
+      // GROUP A: Filesystem (Flags-First)
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:filesystem-rm`,
+        name: "Destructive RM",
+        category: CATEGORIES.COMMAND,
+        pattern: /rm\s+-(?:[rf]{1,2}|-recursive|-force)\b/gi,
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:fs-disk`,
+        name: "Filesystem Danger (Disk/Format)",
+        category: CATEGORIES.COMMAND,
+        pattern: /\b(format|mkfs|dd|rmdir)\b/i,
+        isContextRequired: true,
+        contextWords: ["dev", "disk", "sda", "sdb", "nvme", "if=", "of=", "sudo"],
+        contextWindow: { before: 30, after: 30 },
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:fs-delete-utils`,
+        name: "Filesystem Danger (Utils)",
+        category: CATEGORIES.COMMAND,
+        pattern: /\b(unlink|del)\b/i,
+        isContextRequired: true,
+        contextWords: ["sudo", "root", "force", "all", "quiet"],
+        contextWindow: { before: 10, after: 10 },
+        includeHash: true
+      },
+      // GROUP B: Database (Semantic Context)
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:db-destructive`,
+        name: "Database Danger",
+        category: CATEGORIES.COMMAND,
+        pattern: /\b(DROP\s+(?:TABLE|DATABASE)|TRUNCATE\s+TABLE|DELETE\s+FROM)\b/i,
+        isContextRequired: true,
+        contextWords: ["sql", "query", "database", "production", "db", "master", "main"],
+        contextWindow: { before: 20, after: 20 },
+        includeHash: true
+      },
+      // GROUP C: DevOps & Cloud
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:devops-k8s`,
+        name: "DevOps Danger (K8s)",
+        category: CATEGORIES.COMMAND,
+        pattern: /\bkubectl\s+delete\b/i,
+        isContextRequired: true,
+        contextWords: ["namespace", "pod", "all", "force", "cluster", "production", "prod"],
+        contextWindow: { before: 20, after: 20 },
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:devops-docker`,
+        name: "DevOps Danger (Docker)",
+        category: CATEGORIES.COMMAND,
+        pattern: /\bdocker\s+(?:rm|rmi|system\s+prune)\b/i,
+        isContextRequired: true,
+        contextWords: ["all", "force", "image", "container", "volume", "prune"],
+        contextWindow: { before: 20, after: 20 },
+        includeHash: true
+      },
+      // GROUP D: Network & System
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:sys-network`,
+        name: "System/Network Danger",
+        category: CATEGORIES.COMMAND,
+        pattern: /\b(iptables\s+-F|systemctl\s+stop)\b/i,
+        isContextRequired: true,
+        contextWords: ["sudo", "root", "firewall", "service", "daemon", "stop"],
+        contextWindow: { before: 15, after: 15 },
+        includeHash: true
+      },
+      // GROUP E: Git & Permissions
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:git-force`,
+        name: "Git Danger (Force)",
+        category: CATEGORIES.COMMAND,
+        pattern: /\bgit\s+push\b/i,
+        isContextRequired: true,
+        contextWords: ["--force", "-f", "master", "main", "production"],
+        contextWindow: { before: 10, after: 30 },
+        includeHash: true
+      },
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:git-reset`,
+        name: "Git Danger (Reset)",
+        category: CATEGORIES.COMMAND,
+        pattern: /\bgit\s+reset\s+--hard\b/i,
+        includeHash: true
+        // Self-contained dangerous command
+      },
+      {
+        id: `${PREFIXES.BERRY_COMMAND}:permissions-777`,
+        name: "Insecure Permissions (777)",
+        category: CATEGORIES.COMMAND,
+        pattern: /chmod\s+777\b/gi,
+        includeHash: true
+      }
+    ];
+  }
+});
+
 // src/patterns/index.ts
 var patterns_exports = {};
 __export(patterns_exports, {
   DESTRUCTIVE_COMMAND_PATTERNS: () => DESTRUCTIVE_COMMAND_PATTERNS,
   INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS: () => INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS,
+  INTERNAL_PII_PATTERNS: () => INTERNAL_PII_PATTERNS,
+  INTERNAL_SECRET_PATTERNS: () => INTERNAL_SECRET_PATTERNS,
   INTERNAL_SENSITIVE_FILE_PATTERNS: () => INTERNAL_SENSITIVE_FILE_PATTERNS,
   PII_PATTERNS: () => PII_PATTERNS,
   SECRET_PATTERNS: () => SECRET_PATTERNS,
   SENSITIVE_FILE_PATTERNS: () => SENSITIVE_FILE_PATTERNS,
-  clearPatternCache: () => clearPatternCache,
   getAllDestructiveCommandPatterns: () => getAllDestructiveCommandPatterns,
   getAllRedactionPatterns: () => getAllRedactionPatterns,
   getAllSensitiveFilePatterns: () => getAllSensitiveFilePatterns,
@@ -566,7 +1202,13 @@ function compileCustomPatterns(customRules, disabledBuiltInIds) {
   const activeFiles = INTERNAL_SENSITIVE_FILE_PATTERNS.filter((p) => !disabledIds.has(p.id)).map((p) => p.pattern);
   const activeCmds = INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS.filter((p) => !disabledIds.has(p.id)).map((p) => p.pattern);
   return {
-    redactionPatterns: [...activeSecrets, ...customSecrets, ...activePII],
+    redactionPatterns: [
+      ...activeSecrets,
+      ...customSecrets,
+      ...activePII,
+      ...INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS.filter((p) => !disabledIds.has(p.id)),
+      ...INTERNAL_SENSITIVE_FILE_PATTERNS.filter((p) => !disabledIds.has(p.id))
+    ],
     filePatterns: [...activeFiles, ...customFiles],
     commandPatterns: [...activeCmds, ...customCmds]
   };
@@ -604,246 +1246,35 @@ function getAllSensitiveFilePatterns() {
 function getAllDestructiveCommandPatterns() {
   return _cache.commandPatterns;
 }
-function clearPatternCache() {
-  _cache = {
-    redactionPatterns: [...SECRET_PATTERNS, ...PII_PATTERNS],
-    filePatterns: [...SENSITIVE_FILE_PATTERNS],
-    commandPatterns: [...DESTRUCTIVE_COMMAND_PATTERNS]
-  };
-}
-var SECRET_PATTERNS, PII_PATTERNS, INTERNAL_SENSITIVE_FILE_PATTERNS, SENSITIVE_FILE_PATTERNS, INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS, DESTRUCTIVE_COMMAND_PATTERNS, _cache;
+var SECRET_PATTERNS, PII_PATTERNS, SENSITIVE_FILE_PATTERNS, DESTRUCTIVE_COMMAND_PATTERNS, _cache;
 var init_patterns = __esm({
   "src/patterns/index.ts"() {
     "use strict";
     init_generated();
+    init_constants();
+    init_extended();
+    init_extended();
     SECRET_PATTERNS = [
-      {
-        id: "secret:aws-access-key",
-        name: "AWS Access Key",
-        category: "secret",
-        pattern: /AKIA[0-9A-Z]{16}/g,
-        placeholder: "[AWS_KEY_REDACTED]"
-      },
-      {
-        id: "secret:aws-secret-key",
-        name: "AWS Secret Key",
-        category: "secret",
-        pattern: /aws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{40}/gi,
-        placeholder: "[AWS_SECRET_REDACTED]"
-      },
-      {
-        id: "secret:stripe-key",
-        name: "Stripe Key",
-        category: "secret",
-        pattern: /[sr]k[-_](?:live|test)[-_][a-zA-Z0-9]{20,}/g,
-        placeholder: "[STRIPE_KEY_REDACTED]"
-      },
-      {
-        id: "secret:github-token",
-        name: "GitHub Token",
-        category: "secret",
-        pattern: /gh[pousr]_[a-zA-Z0-9]{36}/g,
-        placeholder: "[GITHUB_TOKEN_REDACTED]"
-      },
-      {
-        id: "secret:github-pat",
-        name: "GitHub PAT",
-        category: "secret",
-        pattern: /github_pat_[a-zA-Z0-9_]{22,}/g,
-        placeholder: "[GITHUB_PAT_REDACTED]"
-      },
-      {
-        id: "secret:openai-key",
-        name: "OpenAI Key",
-        category: "secret",
-        pattern: /sk-[a-zA-Z0-9]{20,}/g,
-        placeholder: "[OPENAI_KEY_REDACTED]"
-      },
-      {
-        id: "secret:anthropic-key",
-        name: "Anthropic Key",
-        category: "secret",
-        pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/g,
-        placeholder: "[ANTHROPIC_KEY_REDACTED]"
-      },
-      {
-        id: "secret:slack-token",
-        name: "Slack Token",
-        category: "secret",
-        pattern: /xox[bpras]-[a-zA-Z0-9-]{10,}/g,
-        placeholder: "[SLACK_TOKEN_REDACTED]"
-      },
-      {
-        id: "secret:sendgrid-key",
-        name: "SendGrid Key",
-        category: "secret",
-        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
-        placeholder: "[SENDGRID_KEY_REDACTED]"
-      },
-      {
-        id: "secret:npm-token",
-        name: "NPM Token",
-        category: "secret",
-        pattern: /npm_[a-zA-Z0-9]{36,}/g,
-        placeholder: "[NPM_TOKEN_REDACTED]"
-      },
-      {
-        id: "secret:private-key",
-        name: "Private Key",
-        category: "secret",
-        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
-        placeholder: "[PRIVATE_KEY_REDACTED]"
-      },
-      {
-        id: "secret:jwt",
-        name: "JWT",
-        category: "secret",
-        pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g,
-        placeholder: "[JWT_REDACTED]"
-      },
-      {
-        id: "secret:bearer-token",
-        name: "Bearer Token",
-        category: "secret",
-        pattern: /Authorization\s*[:=]\s*Bearer\s+[a-zA-Z0-9_.\-/+=]{20,}/gi,
-        placeholder: "[BEARER_TOKEN_REDACTED]"
-      },
-      {
-        id: "secret:generic-api-key",
-        name: "Generic API Key",
-        category: "secret",
-        pattern: /api[-_]?key\s*[:=]\s*[a-zA-Z0-9_.\-/+=]{20,}/gi,
-        placeholder: "[API_KEY_REDACTED]"
-      },
-      {
-        id: "secret:telegram-bot-token",
-        name: "Telegram Bot Token",
-        category: "secret",
-        pattern: /[0-9]{8,10}:[a-zA-Z0-9_-]{35,}/g,
-        placeholder: "[TELEGRAM_TOKEN_REDACTED]"
-      },
-      {
-        id: "secret:generic-json-secret",
-        name: "Generic JSON Secret",
-        category: "secret",
-        pattern: /"(?:apiKey|token|secret|auth|password|passwd)"\s*:\s*"([^"]+)"/gi,
-        placeholder: '"key": "[GENERIC_SECRET_REDACTED]"'
-      },
-      ...GITLEAKS_PATTERNS.map((rule) => ({
-        id: `secret:gitleaks:${rule.id.toLowerCase()}`,
-        name: rule.id,
-        category: "secret",
-        pattern: new RegExp(rule.pattern, "g"),
-        placeholder: `[${rule.id.toUpperCase().replace(/-/g, "_")}_REDACTED]`
+      ...INTERNAL_SECRET_PATTERNS,
+      ...GITLEAKS_PATTERNS.map((entry) => ({
+        id: `${PREFIXES.GITLEAKS_SECRET}:${entry.id.toLowerCase()}`,
+        name: entry.id,
+        category: CATEGORIES.SECRET,
+        pattern: new RegExp(entry.pattern, "g"),
+        placeholder: `[${entry.id.toUpperCase().replace(/-/g, "_")}_REDACTED]`
       }))
     ];
     PII_PATTERNS = [
-      {
-        id: "pii:email",
-        name: "Email",
-        category: "pii",
-        pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
-        placeholder: "[EMAIL_REDACTED]"
-      },
-      {
-        id: "pii:ssn-us",
-        name: "SSN (USA)",
-        category: "pii",
-        pattern: /\b(?!000|666|9\d{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g,
-        placeholder: "[SSN_REDACTED]"
-      },
-      {
-        id: "pii:credit-card",
-        name: "Credit Card",
-        category: "pii",
-        pattern: /\b[3-6]\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{1,7}\b/g,
-        placeholder: "[CARD_REDACTED]"
-      },
-      {
-        id: "pii:phone-us",
-        name: "US Phone",
-        category: "pii",
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?[2-9]\d{2}\)?[-.\s]?)[2-9]\d{2}[-.\s]?\d{4}\b/g,
-        placeholder: "[PHONE_REDACTED]"
-      },
-      {
-        id: "pii:phone-intl",
-        name: "International Phone",
-        category: "pii",
-        pattern: /(\+[2-9]\d{0,2}[-.\s]?\d{2,4}[-.\s]?\d{3,4}[-.\s]?\d{3,4})\b/g,
-        placeholder: "[PHONE_REDACTED]"
-      },
-      {
-        id: "pii:iban",
-        name: "IBAN",
-        category: "pii",
-        pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}[A-Z0-9]{0,23}\b/g,
-        placeholder: "[IBAN_REDACTED]"
-      },
-      {
-        id: "pii:cpf-br",
-        name: "CPF (Brazil)",
-        category: "pii",
-        pattern: /\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,
-        placeholder: "[CPF_REDACTED]"
-      },
-      {
-        id: "pii:cnpj-br",
-        name: "CNPJ (Brazil)",
-        category: "pii",
-        pattern: /\b\d{2}\.?\d{3}\.?\d{3}\/?\d{4}-?\d{2}\b/g,
-        placeholder: "[CNPJ_REDACTED]"
-      }
+      ...INTERNAL_PII_PATTERNS
     ];
-    INTERNAL_SENSITIVE_FILE_PATTERNS = [
-      { id: "file:env", pattern: /\.env(?:\.|$)/i },
-      { id: "file:credentials-json", pattern: /credentials\.json$/i },
-      { id: "file:pem", pattern: /\.pem$/i },
-      { id: "file:key", pattern: /\.key$/i },
-      { id: "file:p12", pattern: /\.p12$/i },
-      { id: "file:pfx", pattern: /\.pfx$/i },
-      { id: "file:ssh-private-keys", pattern: /id_(?:rsa|ed25519|ecdsa|dsa)/i },
-      { id: "file:ssh-known-hosts", pattern: /known_hosts$/i },
-      { id: "file:ssh-config", pattern: /\.ssh[\\/]config$/i },
-      { id: "file:netrc", pattern: /\.netrc$/i },
-      { id: "file:npmrc", pattern: /\.npmrc$/i },
-      { id: "file:secret-files", pattern: /secrets?\.(?:ya?ml|json|toml)$/i },
-      { id: "file:aws-credentials", pattern: /\.aws[\\/]credentials$/i },
-      { id: "file:aws-config", pattern: /\.aws[\\/]config$/i },
-      { id: "file:kube-config", pattern: /\.kube[\\/]config$/i },
-      { id: "file:ssh-host-keys", pattern: /\/etc\/ssh\/ssh_host_(?:rsa|ed25519|ecdsa)_key$/i },
-      { id: "file:docker-config", pattern: /\.docker[\\/]config\.json$/i },
-      { id: "file:gnupg-keys", pattern: /\.gnupg[\\/]private-keys-v1\.d(?:[\\/]|$)/i },
-      { id: "file:vault-token", pattern: /\.vault-token$/i },
-      { id: "file:terraform-credentials", pattern: /\.terraform\.d[\\/]credentials\.tfrc\.json$/i },
-      { id: "file:rclone-conf", pattern: /\.config[\\/]rclone[\\/]rclone\.conf$/i },
-      { id: "file:sops-age-keys", pattern: /\.config[\\/]sops[\\/]age[\\/]keys\.txt$/i },
-      { id: "file:age-keys", pattern: /\.config[\\/]age[\\/]keys\.txt$/i },
-      { id: "file:pypirc", pattern: /\.pypirc$/i },
-      { id: "file:gh-hosts", pattern: /\.config[\\/]gh[\\/]hosts\.yml$/i },
-      { id: "file:gcloud-credentials-db", pattern: /\.config[\\/]gcloud[\\/]credentials\.db$/i },
-      { id: "file:gcloud-access-tokens", pattern: /\.config[\\/]gcloud[\\/]access_tokens\.db$/i },
-      { id: "file:gcloud-legacy-credentials", pattern: /\.config[\\/]gcloud[\\/]legacy_credentials(?:[\\/]|$)/i },
-      { id: "file:azure-access-tokens", pattern: /\.config[\\/]azure[\\/]accessTokens\.json$/i },
-      { id: "file:helm-registry-config", pattern: /\.config[\\/]helm[\\/]registry[\\/]config\.json$/i },
-      { id: "file:poetry-auth", pattern: /\.config[\\/]pypoetry[\\/]auth\.toml$/i },
-      { id: "file:linux-keyrings", pattern: /\.local[\\/]share[\\/]keyrings(?:[\\/]|$)/i },
-      { id: "file:windows-roaming-credentials", pattern: /(?:^|[\\/])AppData[\\/]Roaming[\\/]Microsoft[\\/]Credentials(?:[\\/]|$)/i },
-      { id: "file:windows-local-credentials", pattern: /(?:^|[\\/])AppData[\\/]Local[\\/]Microsoft[\\/]Credentials(?:[\\/]|$)/i },
-      { id: "file:mac-keychains", pattern: /(?:^|[\\/])Library[\\/]Keychains(?:[\\/]|$)/i },
-      { id: "file:linux-shadow", pattern: /\/etc\/shadow$/i },
-      { id: "file:linux-passwd", pattern: /\/etc\/passwd$/i },
-      { id: "file:linux-gshadow", pattern: /\/etc\/gshadow$/i },
-      { id: "file:openclaw-json", pattern: /openclaw\.json$/i }
+    SENSITIVE_FILE_PATTERNS = [
+      ...INTERNAL_SENSITIVE_FILE_PATTERNS.map((entry) => entry.pattern)
     ];
-    SENSITIVE_FILE_PATTERNS = INTERNAL_SENSITIVE_FILE_PATTERNS.map((p) => p.pattern);
-    INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS = [
-      { id: "command:rm-family", pattern: /\b(rm|rmdir|unlink|del|format|mkfs)\b/i },
-      { id: "command:dd", pattern: /\bdd\s+if=/i }
+    DESTRUCTIVE_COMMAND_PATTERNS = [
+      ...INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS.map((entry) => entry.pattern)
     ];
-    DESTRUCTIVE_COMMAND_PATTERNS = INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS.map((p) => p.pattern);
     _cache = {
-      redactionPatterns: [...SECRET_PATTERNS, ...PII_PATTERNS],
+      redactionPatterns: [...SECRET_PATTERNS, ...PII_PATTERNS, ...INTERNAL_DESTRUCTIVE_COMMAND_PATTERNS, ...INTERNAL_SENSITIVE_FILE_PATTERNS],
       filePatterns: [...SENSITIVE_FILE_PATTERNS],
       commandPatterns: [...DESTRUCTIVE_COMMAND_PATTERNS]
     };
@@ -909,7 +1340,7 @@ var require_src = __commonJS({
 // src/constants.ts
 var PLUGIN_ID = "berry-shield";
 var BRAND_SYMBOL = "\u{1F353}";
-var VERSION = "2026.3.17";
+var VERSION = "2026.3.20";
 var ENV_VARS = {
   OPENCLAW_BIN: "OPENCLAW_BIN",
   OPENCLAW_EXECUTABLE: "OPENCLAW_EXECUTABLE"
@@ -926,7 +1357,9 @@ var SENSITIVE_KEY_EXACT = /* @__PURE__ */ new Set([
   "auth",
   "credential",
   "cred",
-  "secret"
+  "secret",
+  "mnemonic",
+  "seed"
 ]);
 var SENSITIVE_KEY_SUFFIXES = [
   "token",
@@ -1873,7 +2306,7 @@ function registerBerryRoot(api, config) {
     },
     { priority: 200 }
   );
-  berryLog(api.logger, BERRY_LOG_CATEGORY.RUNTIME_EVENT, "Berry.Root layer registered (Prompt Guard)");
+  berryLog(api.logger, BERRY_LOG_CATEGORY.LAYER_TRACE, "Berry.Root layer registered (Prompt Guard)");
 }
 
 // src/types/audit-event.ts
@@ -1992,6 +2425,25 @@ init_patterns();
 
 // src/utils/redaction.ts
 init_patterns();
+import { createHash, randomBytes } from "crypto";
+var SESSION_SALT = randomBytes(16).toString("hex");
+function generatePlaceholder(pattern, originalValue) {
+  let baseName = pattern.placeholder;
+  if (!baseName) {
+    const idParts = pattern.id.split(":");
+    const namespacePart = idParts[0].toUpperCase();
+    const namePart = idParts.slice(1).join("_").toUpperCase().replace(/[-]/g, "_");
+    baseName = `[${namespacePart}:${namePart}]`;
+  }
+  if (pattern.includeHash) {
+    const hash = createHash("sha256").update(originalValue + SESSION_SALT).digest("hex").substring(0, 6).toUpperCase();
+    if (baseName.endsWith("]")) {
+      return `${baseName.slice(0, -1)}#${hash}]`;
+    }
+    return `${baseName}#${hash}`;
+  }
+  return baseName;
+}
 function unescapeString(text) {
   if (!text.includes("\\") && !text.includes("%")) return text;
   try {
@@ -2003,28 +2455,351 @@ function unescapeString(text) {
     return text;
   }
 }
-function redactString(text, patterns) {
-  const unescaped = unescapeString(text);
-  let redactionCount = 0;
-  const redactedTypes = [];
-  let currentResult = unescaped;
-  for (const pattern of patterns) {
-    pattern.pattern.lastIndex = 0;
-    const matches = currentResult.match(pattern.pattern);
-    if (matches && matches.length > 0) {
-      currentResult = currentResult.replace(pattern.pattern, pattern.placeholder);
-      redactionCount += matches.length;
-      if (!redactedTypes.includes(pattern.name)) {
-        redactedTypes.push(pattern.name);
+var MAX_COMPOSITE_SOURCE_LENGTH = 6e4;
+var ENGINE_CACHE = /* @__PURE__ */ new WeakMap();
+var PATH_SCAN_HINT = /[\\/]|(?:\.[a-z_][a-z0-9_-]{0,15}\b)|\b(?:appdata|library|credentials|keychains?|known_hosts|id_rsa|id_ed25519|\.env|openclaw\.json)\b/i;
+function hasPotentialCatastrophicBacktracking(source) {
+  return /\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)[+*{]/.test(source);
+}
+function assertPatternSafety(pattern) {
+  if (typeof pattern.id !== "string") {
+    return;
+  }
+  const isUserSuppliedOrTestPattern = pattern.id.startsWith("custom:") || pattern.id.startsWith("test:");
+  if (!isUserSuppliedOrTestPattern) {
+    return;
+  }
+  if (hasPotentialCatastrophicBacktracking(pattern.pattern.source)) {
+    throw new Error(`unsafe_regex_pattern:${pattern.id}`);
+  }
+}
+function countCapturingGroups(source) {
+  let count = 0;
+  let escaped = false;
+  let inCharClass = false;
+  for (let i = 0; i < source.length; i++) {
+    const char = source[i];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === "[" && !inCharClass) {
+      inCharClass = true;
+      continue;
+    }
+    if (char === "]" && inCharClass) {
+      inCharClass = false;
+      continue;
+    }
+    if (inCharClass || char !== "(") {
+      continue;
+    }
+    const next = source[i + 1];
+    if (next !== "?") {
+      count++;
+      continue;
+    }
+    const type = source[i + 2];
+    const nextAfterType = source[i + 3];
+    const isNonCapturing = type === ":" || type === "=" || type === "!" || type === "<" && (nextAfterType === "=" || nextAfterType === "!");
+    if (!isNonCapturing) {
+      count++;
+    }
+  }
+  return count;
+}
+function normalizeCompositeFlags(flags) {
+  const baseOrder = ["i", "m", "s", "u", "d", "v"];
+  const seen = /* @__PURE__ */ new Set();
+  for (const flag of flags) {
+    if (flag === "g" || flag === "y") continue;
+    seen.add(flag);
+  }
+  const normalized = baseOrder.filter((flag) => seen.has(flag)).join("");
+  return `${normalized}g`;
+}
+function normalizeProbeFlags(flags) {
+  const baseOrder = ["i", "m", "s", "u", "d", "v"];
+  const seen = /* @__PURE__ */ new Set();
+  for (const flag of flags) {
+    if (flag === "g" || flag === "y") continue;
+    seen.add(flag);
+  }
+  const normalized = baseOrder.filter((flag) => seen.has(flag)).join("");
+  return `${normalized}y`;
+}
+function isLikelyPathPattern(pattern) {
+  if (pattern.category === "file") {
+    return true;
+  }
+  const source = pattern.pattern.source.toLowerCase();
+  return source.includes("[\\\\/]") || source.includes("\\/") || source.includes("/etc/") || source.includes("appdata") || source.includes("keychain") || source.includes("known_hosts") || source.includes("\\.env") || source.includes("openclaw\\.json");
+}
+function compileCompositeBucket(entries, flags) {
+  const shouldProbeAllAlternatives = entries.some((entry) => entry.pattern.isContextRequired) || entries.length <= 24;
+  const orderedEntries = shouldProbeAllAlternatives ? entries : [...entries].sort((a, b) => {
+    const bySourceLength = b.pattern.pattern.source.length - a.pattern.pattern.source.length;
+    if (bySourceLength !== 0) {
+      return bySourceLength;
+    }
+    return a.originalIndex - b.originalIndex;
+  });
+  const alternatives = [];
+  const outerGroupIndexes = [];
+  let groupCursor = 1;
+  for (const entry of orderedEntries) {
+    const source = entry.pattern.pattern.source;
+    alternatives.push(`(${source})`);
+    outerGroupIndexes.push(groupCursor);
+    groupCursor += 1 + countCapturingGroups(source);
+  }
+  const compositeSource = alternatives.join("|");
+  if (compositeSource.length > MAX_COMPOSITE_SOURCE_LENGTH) {
+    throw new Error("composite_regex_too_large");
+  }
+  return {
+    regex: new RegExp(compositeSource, flags),
+    entries: orderedEntries,
+    outerGroupIndexes,
+    shouldProbeAllAlternatives
+  };
+}
+function resolveBucketEntry(match, bucket) {
+  for (let i = 0; i < bucket.outerGroupIndexes.length; i++) {
+    const groupIndex = bucket.outerGroupIndexes[i];
+    if (match[groupIndex] !== void 0) {
+      return bucket.entries[i];
+    }
+  }
+  return null;
+}
+function collectCandidatesFromBucket(text, bucket, candidates) {
+  bucket.regex.lastIndex = 0;
+  let match;
+  while ((match = bucket.regex.exec(text)) !== null) {
+    const entry = resolveBucketEntry(match, bucket);
+    const start = match.index;
+    if (entry) {
+      candidates.push({
+        pattern: entry.pattern,
+        matchText: match[0],
+        start,
+        end: start + match[0].length
+      });
+    }
+    if (bucket.shouldProbeAllAlternatives) {
+      for (const sibling of bucket.entries) {
+        if (entry && sibling.pattern.id === entry.pattern.id) {
+          continue;
+        }
+        sibling.probeRegex.lastIndex = start;
+        const siblingMatch = sibling.probeRegex.exec(text);
+        if (!siblingMatch) {
+          continue;
+        }
+        candidates.push({
+          pattern: sibling.pattern,
+          matchText: siblingMatch[0],
+          start,
+          end: start + siblingMatch[0].length
+        });
       }
     }
+    if (match.index === bucket.regex.lastIndex) {
+      bucket.regex.lastIndex++;
+    }
+  }
+}
+function collectCandidatesFallback(text, entries, candidates) {
+  for (const entry of entries) {
+    const pattern = entry.pattern;
+    const regex = new RegExp(pattern.pattern.source, normalizeCompositeFlags(pattern.pattern.flags));
+    let match;
+    while ((match = regex.exec(text)) !== null) {
+      candidates.push({
+        pattern,
+        matchText: match[0],
+        start: match.index,
+        end: match.index + match[0].length
+      });
+      if (match.index === regex.lastIndex) {
+        regex.lastIndex++;
+      }
+    }
+  }
+}
+function compileRedactionEngine(patterns) {
+  const entries = patterns.map((pattern, originalIndex) => {
+    assertPatternSafety(pattern);
+    return {
+      pattern,
+      originalIndex,
+      compositeFlags: normalizeCompositeFlags(pattern.pattern.flags),
+      isPathLike: isLikelyPathPattern(pattern),
+      probeRegex: new RegExp(pattern.pattern.source, normalizeProbeFlags(pattern.pattern.flags))
+    };
+  });
+  const pathEntries = entries.filter((entry) => entry.isPathLike);
+  const generalEntries = entries.filter((entry) => !entry.isPathLike);
+  const compileBuckets = (bucketEntries) => {
+    const byFlags = /* @__PURE__ */ new Map();
+    for (const entry of bucketEntries) {
+      const current = byFlags.get(entry.compositeFlags);
+      if (current) {
+        current.push(entry);
+      } else {
+        byFlags.set(entry.compositeFlags, [entry]);
+      }
+    }
+    const buckets = [];
+    const fallbackEntries = [];
+    for (const [flags, group] of byFlags.entries()) {
+      try {
+        buckets.push(compileCompositeBucket(group, flags));
+      } catch {
+        fallbackEntries.push(...group);
+      }
+    }
+    return { buckets, fallbackEntries };
+  };
+  const generalCompilation = compileBuckets(generalEntries);
+  const pathCompilation = compileBuckets(pathEntries);
+  return {
+    generalBuckets: generalCompilation.buckets,
+    pathBuckets: pathCompilation.buckets,
+    fallbackGeneralEntries: generalCompilation.fallbackEntries,
+    fallbackPathEntries: pathCompilation.fallbackEntries
+  };
+}
+function getOrCreateEngine(patterns) {
+  const cached = ENGINE_CACHE.get(patterns);
+  if (cached) {
+    return cached;
   }
+  const compiled = compileRedactionEngine(patterns);
+  ENGINE_CACHE.set(patterns, compiled);
+  return compiled;
+}
+function shouldScanPathLikePatterns(text) {
+  return PATH_SCAN_HINT.test(text);
+}
+function applyResolvedRedactions(originalText, resolved) {
+  const parts = [];
+  const redactedTypeSet = /* @__PURE__ */ new Set();
+  let redactionCount = 0;
+  let cursor = 0;
+  for (const candidate of resolved) {
+    const placeholder = generatePlaceholder(candidate.pattern, candidate.matchText);
+    parts.push(originalText.slice(cursor, candidate.start));
+    parts.push(placeholder);
+    cursor = candidate.end;
+    redactionCount++;
+    redactedTypeSet.add(candidate.pattern.id);
+  }
+  parts.push(originalText.slice(cursor));
   return {
-    content: redactionCount > 0 ? currentResult : text,
+    content: parts.join(""),
     redactionCount,
-    redactedTypes
+    redactedTypes: Array.from(redactedTypeSet)
   };
 }
+function evaluateContext(text, match, pattern) {
+  if (!pattern.isContextRequired) {
+    return true;
+  }
+  if (!pattern.contextWords || pattern.contextWords.length === 0) {
+    return false;
+  }
+  const window = pattern.contextWindow || { before: 30, after: 15 };
+  const contextStart = Math.max(0, match.start - window.before);
+  const contextEnd = Math.min(text.length, match.end + window.after);
+  const beforeSlice = text.slice(contextStart, match.start).toLowerCase();
+  const afterSlice = text.slice(match.end, contextEnd).toLowerCase();
+  return pattern.contextWords.some(
+    (word) => beforeSlice.includes(word.toLowerCase()) || afterSlice.includes(word.toLowerCase())
+  );
+}
+function selectWinner(a, b) {
+  const categoryPriority = {
+    command: 5,
+    secret: 4,
+    credential: 3,
+    pii: 2,
+    network: 1,
+    other: 0
+  };
+  const priorityA = categoryPriority[a.pattern.category] || 0;
+  const priorityB = categoryPriority[b.pattern.category] || 0;
+  if (priorityA !== priorityB) {
+    return priorityA > priorityB ? a : b;
+  }
+  const lengthA = a.end - a.start;
+  const lengthB = b.end - b.start;
+  if (lengthA !== lengthB) {
+    return lengthA > lengthB ? a : b;
+  }
+  const isBerryA = a.pattern.id.startsWith("berry:");
+  const isBerryB = b.pattern.id.startsWith("berry:");
+  if (isBerryA && !isBerryB) return a;
+  if (!isBerryA && isBerryB) return b;
+  return b;
+}
+function resolveOverlaps(candidates) {
+  if (candidates.length === 0) return [];
+  candidates.sort((a, b) => a.start - b.start);
+  const result = [];
+  let lastEnd = -1;
+  for (let i = 0; i < candidates.length; i++) {
+    const current = candidates[i];
+    if (current.start >= lastEnd) {
+      result.push(current);
+      lastEnd = current.end;
+      continue;
+    }
+    const last = result[result.length - 1];
+    const winner = selectWinner(current, last);
+    if (winner === current) {
+      result[result.length - 1] = current;
+      lastEnd = current.end;
+    }
+  }
+  return result;
+}
+function redactString(text, patterns) {
+  const unescaped = unescapeString(text);
+  const engine = getOrCreateEngine(patterns);
+  const candidates = [];
+  for (const bucket of engine.generalBuckets) {
+    collectCandidatesFromBucket(unescaped, bucket, candidates);
+  }
+  collectCandidatesFallback(unescaped, engine.fallbackGeneralEntries, candidates);
+  if (shouldScanPathLikePatterns(unescaped)) {
+    for (const bucket of engine.pathBuckets) {
+      collectCandidatesFromBucket(unescaped, bucket, candidates);
+    }
+    collectCandidatesFallback(unescaped, engine.fallbackPathEntries, candidates);
+  }
+  if (candidates.length === 0) {
+    return { content: text, redactionCount: 0, redactedTypes: [] };
+  }
+  const validated = candidates.filter((candidate) => {
+    if (!candidate.pattern.isContextRequired) return true;
+    return evaluateContext(
+      unescaped,
+      { start: candidate.start, end: candidate.end, value: candidate.matchText },
+      candidate.pattern
+    );
+  });
+  if (validated.length === 0) {
+    return { content: text, redactionCount: 0, redactedTypes: [] };
+  }
+  const resolved = resolveOverlaps(validated);
+  return applyResolvedRedactions(unescaped, resolved);
+}
 function isSensitiveKey(key) {
   const lower = key.toLowerCase();
   if (SENSITIVE_KEY_EXACT.has(lower)) return true;
@@ -2116,16 +2891,35 @@ function walkAndRedact(obj, patterns, seen = /* @__PURE__ */ new WeakSet()) {
 }
 function findMatches(obj, patterns, seen = /* @__PURE__ */ new WeakSet()) {
   const matchedNames = /* @__PURE__ */ new Set();
+  const securityPatterns = isSecurityPatternArray(patterns) ? patterns : null;
+  const regexPatterns = securityPatterns ? null : patterns;
+  const engine = securityPatterns ? getOrCreateEngine(securityPatterns) : null;
+  const collectCompiledMatchNames = (text, compiledEngine) => {
+    const candidates = [];
+    for (const bucket of compiledEngine.generalBuckets) {
+      collectCandidatesFromBucket(text, bucket, candidates);
+    }
+    collectCandidatesFallback(text, compiledEngine.fallbackGeneralEntries, candidates);
+    for (const bucket of compiledEngine.pathBuckets) {
+      collectCandidatesFromBucket(text, bucket, candidates);
+    }
+    collectCandidatesFallback(text, compiledEngine.fallbackPathEntries, candidates);
+    for (const candidate of candidates) {
+      matchedNames.add(candidate.pattern.name);
+    }
+  };
   const walk = (current) => {
     if (!current) return;
     if (typeof current === "string") {
       const unescaped = unescapeString(current);
-      for (const p of patterns) {
-        const regex = p instanceof RegExp ? p : p.pattern;
-        const name = p instanceof RegExp ? "Sensitive Pattern" : p.name;
-        regex.lastIndex = 0;
-        if (regex.test(unescaped)) {
-          matchedNames.add(name);
+      if (engine) {
+        collectCompiledMatchNames(unescaped, engine);
+      } else {
+        for (const regex of regexPatterns ?? []) {
+          regex.lastIndex = 0;
+          if (regex.test(unescaped)) {
+            matchedNames.add("Sensitive Pattern");
+          }
         }
       }
       return;
@@ -2147,6 +2941,12 @@ function findMatches(obj, patterns, seen = /* @__PURE__ */ new WeakSet()) {
   walk(obj);
   return Array.from(matchedNames);
 }
+function isSecurityPatternArray(patterns) {
+  if (patterns.length === 0) {
+    return false;
+  }
+  return !(patterns[0] instanceof RegExp);
+}
 
 // src/layers/pulp.ts
 function registerBerryPulp(api, config) {
@@ -2250,7 +3050,7 @@ function registerBerryPulp(api, config) {
     },
     { priority: 200 }
   );
-  berryLog(api.logger, BERRY_LOG_CATEGORY.RUNTIME_EVENT, "Berry.Pulp layer registered (Output Scanner)");
+  berryLog(api.logger, BERRY_LOG_CATEGORY.LAYER_TRACE, "Berry.Pulp layer registered (Output Scanner)");
 }
 
 // src/ui/decision-card/format-text.ts
@@ -2552,7 +3352,7 @@ function registerBerryThorn(api, config) {
     { priority: 200 }
     // High priority - security runs first
   );
-  berryLog(api.logger, BERRY_LOG_CATEGORY.RUNTIME_EVENT, "Berry.Thorn layer registered (Tool Blocker)");
+  berryLog(api.logger, BERRY_LOG_CATEGORY.LAYER_TRACE, "Berry.Thorn layer registered (Tool Blocker)");
 }
 
 // src/layers/leaf.ts
@@ -2572,7 +3372,7 @@ function registerBerryLeaf(api, config) {
       const sessionKey = context.conversationId;
       if (!message) return;
       const { redactedTypes } = walkAndRedact(message, patterns);
-      const matchedPatterns = patterns.filter((p) => redactedTypes.includes(p.name));
+      const matchedPatterns = patterns.filter((p) => redactedTypes.includes(p.id));
       const containsSecrets = matchedPatterns.some((p) => p.category === "secret");
       const containsPII = matchedPatterns.some((p) => p.category === "pii");
       const auditEntry = {
@@ -2596,7 +3396,7 @@ function registerBerryLeaf(api, config) {
     { priority: 50 }
     // Lower priority - audit runs after security checks
   );
-  berryLog(api.logger, BERRY_LOG_CATEGORY.RUNTIME_EVENT, "Berry.Leaf layer registered (Input Audit)");
+  berryLog(api.logger, BERRY_LOG_CATEGORY.LAYER_TRACE, "Berry.Leaf layer registered (Input Audit)");
 }
 
 // src/layers/stem.ts
@@ -2820,10 +3620,10 @@ function getSharedVineStateManager(retention) {
 }
 
 // src/vine/confirm-state.ts
-import { createHash as createHash2, randomInt, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash as createHash3, randomInt, randomUUID, timingSafeEqual } from "node:crypto";
 
 // src/vine/vine-intent.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function sortCapabilities(capabilities) {
   return [...new Set(capabilities)].sort();
 }
@@ -2885,7 +3685,7 @@ function createIntentKind(capabilities) {
   return normalizedCapabilities.join("+");
 }
 function createIntentSignature(intent) {
-  return createHash("sha256").update(JSON.stringify(toSignatureShape(intent))).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(toSignatureShape(intent))).digest("hex");
 }
 function isEquivalentApprovedIntent(approved, requested) {
   if (createIntentSignature(approved) === createIntentSignature(requested)) {
@@ -2915,7 +3715,7 @@ function normalizeTarget(target) {
   return target.trim().replace(/\s+/g, " ");
 }
 function signTarget(operation, target) {
-  return createHash2("sha256").update(`${operation}
+  return createHash3("sha256").update(`${operation}
 ${normalizeTarget(target)}`).digest("hex");
 }
 function buildLegacyIntent(operation, target, rawTarget) {
@@ -4170,6 +4970,7 @@ function maybeEscalateFromStem(api, sessionKey, escalationTurns, allowGlobalEsca
 }
 function isDestructiveCommand3(command, customPatterns) {
   for (const pattern of getAllDestructiveCommandPatterns()) {
+    pattern.lastIndex = 0;
     if (pattern.test(command)) {
       return true;
     }
@@ -4188,6 +4989,7 @@ function isDestructiveCommand3(command, customPatterns) {
 function isSensitiveFile2(filePath, customPatterns) {
   const normalizedPath = filePath.replace(/\\/g, "/");
   for (const pattern of getAllSensitiveFilePatterns()) {
+    pattern.lastIndex = 0;
     if (pattern.test(normalizedPath)) {
       return true;
     }
@@ -4789,7 +5591,7 @@ function registerBerryStem(api, config) {
       };
     }
   });
-  berryLog(api.logger, BERRY_LOG_CATEGORY.RUNTIME_EVENT, "Berry.Stem layer registered (Security Gate)");
+  berryLog(api.logger, BERRY_LOG_CATEGORY.LAYER_TRACE, "Berry.Stem layer registered (Security Gate)");
 }
 
 // src/layers/vine.ts
@@ -5244,7 +6046,7 @@ function registerBerryVine(api, config) {
     },
     { priority: 190 }
   );
-  berryLog(api.logger, BERRY_LOG_CATEGORY.RUNTIME_EVENT, "Berry.Vine layer registered (External Content Guard)");
+  berryLog(api.logger, BERRY_LOG_CATEGORY.LAYER_TRACE, "Berry.Vine layer registered (External Content Guard)");
 }
 
 // src/config/wrapper.ts
@@ -5390,8 +6192,9 @@ var symbols = {
 
 // src/patterns/id-aliases.ts
 var BASELINE_ID_ALIASES = {
-  // Upstream naming drift example: old short name -> current explicit name.
-  "secret:gitleaks:gitlab-runner-token": "secret:gitleaks:gitlab-runner-authentication-token"
+  // Proof of Concept (POC) - Example of drift in Gitleaks
+  // If an external pattern ID changes in the future, map it here to maintain compatibility.
+  "secret:gitleaks:gitlab-runner-token": "gitleaks:secret:gitlab-runner-authentication-token"
 };
 function remapDisabledBuiltInIds(ids, aliases = BASELINE_ID_ALIASES) {
   const out = /* @__PURE__ */ new Set();
@@ -5601,7 +6404,7 @@ async function disableBuiltInRule(id) {
   const normalizedId = id.toLowerCase();
   const knownBuiltInIds = await loadKnownBuiltInIds();
   if (!knownBuiltInIds.has(normalizedId)) {
-    return { success: false, error: `Unknown built-in rule id: ${id}` };
+    return { success: false, error: `Unknown baseline rule id: ${id}` };
   }
   if (!rules.disabledBuiltInIds.includes(normalizedId)) {
     rules.disabledBuiltInIds.push(normalizedId);
@@ -5629,7 +6432,7 @@ var MAX_PATTERN_LENGTH = 512;
 function normalizeName3(value) {
   return value.trim().toLowerCase();
 }
-function generatePlaceholder(name) {
+function generatePlaceholder2(name) {
   const sanitized = name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
   return `[${sanitized}_REDACTED]`;
 }
@@ -5736,7 +6539,7 @@ async function addCustomRuleToConfig(wrapper, type, options) {
     const rule2 = {
       name: name.trim(),
       pattern,
-      placeholder: placeholder ?? generatePlaceholder(name),
+      placeholder: placeholder ?? generatePlaceholder2(name),
       enabled: true
     };
     customRules.secrets.push(rule2);
@@ -7228,9 +8031,10 @@ async function testCommand(input, _config, logger, wrapper) {
       s.divider(24);
       for (const match of matches) {
         s.row(match.source.toUpperCase(), match.name);
-        s.row("Redaction", match.placeholder);
+        s.row("Redaction", match.placeholder || theme.dim("(dynamic placeholder)"));
         s.divider(24);
       }
+      s.divider(24);
     }
   });
 }
@@ -8885,7 +9689,7 @@ Examples:
         })
       );
       attachSubcommandHelp(
-        bshield.command("reset <target>").description("Reset defaults (builtins or full scope)").option("--scope <scope>", "Reset scope (builtins | all)").option("--yes", "Skip confirmation prompt").action(async (target, options) => {
+        bshield.command("reset <target>").description("Reset defaults (baseline or full scope)").option("--scope <scope>", "Reset scope (baseline | all)").option("--yes", "Skip confirmation prompt").action(async (target, options) => {
           await resetCommand(target, options, context, wrapper);
         })
       );