@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/src/runtime/lifecycle/retention.js

@@ -9,18 +9,17 @@
  * joined by any event that names more than one, and a unit goes only as a whole: when every item in
  * it is settled in the fold (a follow-up done or dismissed, a goal done) and its newest event is
  * older than the window. A unit whose removal would change anything else the fold shows (another
- * item, a feature, a release, a conflict) is kept.
+ * item, a feature, a release, a conflict) is kept, and so is a unit that an event of a type this
+ * version does not know (written by a newer DoFlow) names by id.
  *
- * `parseWindow` remains pure. `retentionWindow` composes its unset case with the declared storage
- * default and the project's prune setting; explicit environment values retain their existing meaning.
+ * `parseWindow` remains pure. `retentionWindow` composes the resolver-owned default with the project's
+ * prune setting; explicit values retain their existing meaning while pruning is off.
  */
 
 const nodeFs = require('node:fs');
 const { isDeepStrictEqual } = require('node:util');
-const { REPO_ROOT } = require('../../helper/repo-root.js');
-const { loadStorageRegistry } = require('../storage/registry.js');
-const { resolveRoots, readPruneSetting } = require('../storage/roots.js');
-const { foldInto, finalize } = require('./fold.js');
+const { loadSettings } = require('../settings/resolve.js');
+const { foldInto, finalize, EVENT_TYPES } = require('./fold.js');
 
 const HOUR_MS = 3600000;
 
@@ -35,23 +34,46 @@ function parseWindow(env                                     = process.env)
   return { state: 'invalid', raw: String(raw) };
 }
 
-/** Composes IC-013's explicit environment override with the declared lifecycle default. */
-function retentionWindow({ env = process.env, projectRoot, registry, fsImpl = nodeFs }      = {})      {
+function invalidRaw(resolved     , env                                    )         {
+  for (let i = resolved.candidates.length - 1; i >= 0; i -= 1) {
+    const candidate = resolved.candidates[i];
+    if (candidate.status !== 'invalid') continue;
+    if (candidate.layer === 'env') return String(env.DOFLOW_RETENTION_HOURS ?? '');
+    try {
+      const raw = JSON.parse(candidate.display);
+      if (typeof raw === 'string' || typeof raw === 'number') return String(raw);
+    } catch { /* a malformed whole-file candidate has no display value */ }
+    return candidate.display || candidate.reason || candidate.code || '';
+  }
+  return '';
+}
+
+/** Composes the retention setting and prune gate through the shared settings resolver. */
+function retentionWindow({ env = process.env, projectRoot, fsImpl = nodeFs }      = {})      {
   const parsed = parseWindow(env);
   if (parsed.state === 'invalid') return parsed;
-  if (parsed.state === 'on') return { ...parsed, source: 'env' };
-  let activeRegistry     ;
   try {
-    activeRegistry = registry || loadStorageRegistry({ repoRoot: REPO_ROOT, fsImpl });
+    let settingsRegistry;
+    if (fsImpl !== nodeFs) {
+      const { loadSettingsRegistry } = require('../settings/registry.js');
+      const loaded = loadSettingsRegistry({ fsImpl });
+      if (!loaded.ok) throw new Error(loaded.detail);
+      settingsRegistry = loaded.registry;
+    }
+    const view = loadSettings({ projectRoot, env, fsImpl, ...(settingsRegistry ? { registry: settingsRegistry } : {}) });
+    const retention = view.get('storage.retentionHours', 'project');
+    if (retention.state === 'invalid') return { state: 'invalid', raw: invalidRaw(retention, env) };
+    if (retention.explicit) {
+      const hours = retention.value;
+      return { state: 'on', hours, ms: hours * HOUR_MS, source: retention.origin.layer };
+    }
+    if (view.get('storage.prune', 'project').value !== 'on') return { state: 'off' };
+    const hours = retention.value;
+    return { state: 'on', hours, ms: hours * HOUR_MS, source: 'default' };
   } catch {
-    return { state: 'off' };
+    // Preserve an explicit environment window when the resolver registry is unavailable.
+    return parsed.state === 'on' ? { ...parsed, source: 'env' } : { state: 'off' };
   }
-  const roots = resolveRoots({ registry: activeRegistry, projectRoot, env });
-  if (readPruneSetting({ registry: activeRegistry, roots, rootId: 'project-state', fsImpl }).setting !== 'on') return { state: 'off' };
-  const lifecycleStore = activeRegistry.stores.find((store     ) => store.id === 'lifecycle-events');
-  if (!lifecycleStore) throw new Error('Storage registry has no lifecycle-events store');
-  const hours = lifecycleStore.bound.defaultHours;
-  return { state: 'on', hours, ms: hours * HOUR_MS, source: 'default' };
 }
 
 function isText(value     )          { return typeof value === 'string' && value.trim() !== ''; }
@@ -113,6 +135,34 @@ function unitsOf(events       , shouldStop                )               {
   return [...units.values()];
 }
 
+/**
+ * Every string value and every object key in the data of the events whose type this version's fold
+ * does not know (a newer DoFlow wrote them). The fold ignores them, so retention cannot tell what they change; a unit that
+ * one of them names by id is kept whole rather than deleted from under it. Exact matches only:
+ * keeping too little is a lost record, keeping too much only a file that stays.
+ * @returns {Set<string>|null} null when `shouldStop` fired
+ */
+function unknownTypeStrings(events       , shouldStop                )                     {
+  const known = new Set        (EVENT_TYPES);
+  const found = new Set        ();
+  for (const event of events) {
+    if (shouldStop?.()) return null;
+    if (known.has(event.type)) continue;
+    const pending        = [event.data];
+    while (pending.length > 0) {
+      if (shouldStop?.()) return null;
+      const value = pending.pop();
+      if (typeof value === 'string') found.add(value);
+      else if (Array.isArray(value)) pending.push(...value);
+      else if (value && typeof value === 'object') {
+        for (const key of Object.keys(value)) found.add(key);
+        pending.push(...Object.values(value));
+      }
+    }
+  }
+  return found;
+}
+
 function isSettled(state     , key        )          {
   const [kind, id] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
   if (kind === 'followup') {
@@ -173,6 +223,12 @@ function selectExpired(events       , { now, windowMs, shouldStop }      = {})
   }
   const named = unitsOf(events, shouldStop);
   if (!named || shouldStop?.()) return incomplete();
+  const mentioned = unknownTypeStrings(events, shouldStop);
+  if (!mentioned || shouldStop?.()) return incomplete();
+  // Selected exactly as 5bc9407b did (every settled, expired, unserved unit is a candidate), and only
+  // then are the units an unknown-type event names dropped. Protection removes units from that
+  // selection; it never changes which of the others are picked, so what is deleted is always a subset
+  // of what base would delete on the same events.
   const candidates        = [];
   for (const unit of named) {
     if (shouldStop?.()) return incomplete();
@@ -186,20 +242,28 @@ function selectExpired(events       , { now, windowMs, shouldStop }      = {})
     if (eligible) candidates.push({ ...unit, newestAt: newest });
   }
   const full = finalize(state);
-  let selected = candidates;
-  const allSafe = refoldEqual(events, full, candidates, now, shouldStop);
-  if (allSafe === null || shouldStop?.()) return incomplete();
-  if (!allSafe) {
-    selected = [];
-    const ordered = [...candidates].sort((a     , b     ) => Date.parse(a.newestAt) - Date.parse(b.newestAt));
-    if (shouldStop?.()) return incomplete();
+  /** The refold-safe subset of `list`: all of it when that holds, else the oldest-first greedy pass. */
+  const safeSubset = (list       )               => {
+    const allSafe = refoldEqual(events, full, list, now, shouldStop);
+    if (allSafe === null || shouldStop?.()) return null;
+    if (allSafe) return list;
+    const chosen        = [];
+    const ordered = [...list].sort((a     , b     ) => Date.parse(a.newestAt) - Date.parse(b.newestAt));
+    if (shouldStop?.()) return null;
     for (const unit of ordered) {
-      if (shouldStop?.()) return incomplete();
-      const safe = refoldEqual(events, full, [...selected, unit], now, shouldStop);
-      if (safe === null) return incomplete();
-      if (safe) selected.push(unit);
+      if (shouldStop?.()) return null;
+      const safe = refoldEqual(events, full, [...chosen, unit], now, shouldStop);
+      if (safe === null) return null;
+      if (safe) chosen.push(unit);
     }
-  }
+    return chosen;
+  };
+  const baseSelected = safeSubset(candidates);
+  if (!baseSelected) return incomplete();
+  const unprotected = baseSelected.filter((unit     ) => ![...unit.items].some((key        ) => mentioned.has(key.slice(key.indexOf(':') + 1))));
+  // Dropping units can leave a set the refold no longer accepts; check it again, inside the subset.
+  const selected = unprotected.length === baseSelected.length ? baseSelected : safeSubset(unprotected);
+  if (!selected) return incomplete();
   const units        = [];
   for (const unit of selected) {
     if (shouldStop?.()) return incomplete();

package/src/runtime/lifecycle/root.js

@@ -10,6 +10,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
+const { memoGit } = require('../git-memo.js');
 
                                                                           
 
@@ -61,11 +62,18 @@ function showToplevel(cwd        )                {
  * @returns {string} an absolute, real path
  */
 function projectRoot(cwd         = process.cwd())         {
+  // Inside a call scope (git-memo.ts) the answer git gave for this path is kept for the call. The
+  // fallback `real(cwd)` is not git's answer, so it is never kept: the path may become a repository.
+  return memoGit(`projectRoot:${path.resolve(cwd)}`, () => gitProjectRoot(cwd)) ?? real(cwd);
+}
+
+/** The root git names for `cwd`, or undefined when git names none (outside a repository). */
+function gitProjectRoot(cwd        )                     {
   let entries                  = [];
   try { entries = worktreeEntries(git(cwd, ['worktree', 'list', '--porcelain'])); } catch { /* not a repository */ }
   const first = entries[0];
   if (first && !first.bare && isRealWorkTree(first)) return real(first.path);
-  return showToplevel(cwd) || real(cwd);
+  return showToplevel(cwd) || undefined;
 }
 
 module.exports = { projectRoot, worktreeEntries };

package/src/runtime/lifecycle/status.js

@@ -11,19 +11,20 @@
  * the release tags and the base tag) come from `do-git-state.sh --lifecycle`, so bash and Node never
  * derive them twice. The rest is a fixed number of plain `git` calls, however many features are
  * tracked: one `rev-parse` pins the ref, one `for-each-ref` lists the branches, one
- * `git log --first-parent --merges` lists the merges, one `git tag --list` (tagged mode) gives the
- * release tags' commits, and one `git rev-list --parents` reads the commit graph of the pinned ref
- * and those tags. Every ancestry question (which merge brought a branch tip in, which tag contains a
- * merge) is then answered from that graph in memory, not by a git call per feature.
+ * `git log --first-parent --merges` lists the merges and their `DoFlow-Row` trailers, one
+ * `git tag --list` (tagged mode) gives the release tags' commits, and one `git rev-list --parents`
+ * reads the commit graph of the pinned ref and those tags. Every ancestry question (which merge
+ * brought a branch tip in, which tag contains a merge) is then answered from that graph in memory,
+ * not by a git call per feature.
  *
  * Nothing here writes, fetches or reaches a network.
  *
  * Accepted ceilings, stated rather than hidden: a feature's merge evidence is only as good as the
- * merge commit's subject and the branch name (a squash, a rebase and a fast-forward leave none,
- * so they reach the user through `notDetected` and `lifecycle --action merged`); the merge log and
- * the graph are read in full, without `--since` or a lower cut (a skewed clock must not hide a
- * merge), so their cost grows with the history of the integration ref, once per call; git dates
- * have one-second resolution, so the lower bound is floored to the second.
+ * merge commit's `DoFlow-Row` trailer or subject and the branch name (a squash, a rebase and a
+ * fast-forward leave none, so they reach the user through `notDetected` and `lifecycle --action
+ * merged`); the merge log and the graph are read in full, without `--since` or a lower cut (a skewed
+ * clock must not hide a merge), so their cost grows with the history of the integration ref, once
+ * per call; git dates have one-second resolution, so the lower bound is floored to the second.
  */
 
 const fs = require('node:fs');
@@ -69,13 +70,18 @@ function subjectNames(subject        , slug        )          {
   return new RegExp(`(?:^|[^a-z0-9-])${escapeRegExp(slug)}(?:$|[^a-z0-9-])`).test(subject);
 }
 
-/** First-parent merges of `ref`, oldest first. */
-function readMerges(root        , ref        )                                                                         {
-  const out = git(root, ['log', '--first-parent', '--merges', '--format=%H%x09%P%x09%ct%x09%s', ref]);
-  return out.split('\n').filter(Boolean).map((line) => {
-    const [sha, parents, ct, ...subject] = line.split('\t');
-    return { sha, parents: parents.split(' ').filter(Boolean), ct: Number(ct), subject: subject.join('\t') };
-  }).reverse();
+/** First-parent merges of `ref`, oldest first, with any `DoFlow-Row` trailer. */
+function readMerges(root        , ref        )                                                                                             {
+  const out = git(root, ['log', '--first-parent', '--merges', '--format=%H%x00%P%x00%ct%x00%s%x00%(trailers:key=DoFlow-Row,separator=%x1f)%x00', ref]);
+  const fields = out.split('\0');
+  const merges                                                                                             = [];
+  for (let i = 0; i + 4 < fields.length; i += 5) {
+    const [rawSha, parents, ct, subject, rowTrailer] = fields.slice(i, i + 5);
+    const sha = rawSha.trim();
+    if (!sha) continue;
+    merges.push({ sha, parents: parents.split(' ').filter(Boolean), ct: Number(ct), subject, rowTrailer: rowTrailer.trim() });
+  }
+  return merges.reverse();
 }
 
 /** Branch refs by short name (`feat/x`, `origin/feat/x`) with their tips; local branches first. */
@@ -221,7 +227,18 @@ function findEvidence({ slug, lowerBound, merges, mergeBySha, newestCt, history,
     if (merge) return { kind: 'branch', ref: tip.short, commit: merge.sha };
   }
   for (let i = merges.length - 1; i >= 0; i -= 1) {
-    if (merges[i].ct >= lowerBound && subjectNames(merges[i].subject, slug)) return { kind: 'merge-subject', ref: merges[i].sha.slice(0, 7), commit: merges[i].sha };
+    const merge = merges[i];
+    if (merge.ct < lowerBound) continue;
+    if (merge.rowTrailer) {
+      // A present DoFlow-Row is authoritative: it can match only on an exact two-parent merge,
+      // and a mismatch must not fall through to a subject that names a different row.
+      const match = /^DoFlow-Row:\s*(.*?)\s*$/i.exec(merge.rowTrailer);
+      if (merge.parents.length === 2 && match && match[1] === slug) {
+        return { kind: 'trailer', ref: merge.sha.slice(0, 7), commit: merge.sha };
+      }
+      continue;
+    }
+    if (subjectNames(merge.subject, slug)) return { kind: 'merge-subject', ref: merge.sha.slice(0, 7), commit: merge.sha };
   }
   if (confirmed) return { kind: 'confirmed', ref: null, commit: null };
   return null;

package/src/runtime/lifecycle/store-upkeep.js

@@ -36,8 +36,18 @@ const LEGACY_EVENTS_REL = path.join(LEGACY_LIFECYCLE_REL, 'events');
 const MARKER_REL = path.join(LIFECYCLE_REL, 'migrated.json');
 const MIGRATING_PREFIX = 'events.migrating-';
 const NOTICE = 'note: the lifecycle store is now .doflow/state/lifecycle/events; agent-docs/lifecycle/ is no longer read and can be deleted';
-const removedLine = (count     , hours     ) => `retention: removed ${count} event files older than ${hours} h`;
-const invalidLine = (raw     ) => `warning: DOFLOW_RETENTION_HOURS='${raw}' is not a positive whole number of hours; ignored, nothing removed`;
+const removedLine = (count     , hours     ) => `retention: removed ${count} event ${count === 1 ? 'file' : 'files'} older than ${hours} h`;
+// A leading zero is rejected on purpose (`024` could be read as octal); the warning names it.
+const invalidLine = (raw     ) => `warning: DOFLOW_RETENTION_HOURS='${raw}' is not a positive whole number of hours${/^0[0-9]+$/.test(String(raw)) ? ' (no leading zeros)' : ''}; ignored, nothing removed`;
+/**
+ * What `writeAtomic` leaves behind when a verb dies between creating its temp file and renaming it:
+ * `.retention-<pid>-<chars>.tmp` (the journal) and `.migrated-<pid>-<chars>.tmp` (the marker), in the
+ * lifecycle folder. The storage engine's work-store sweep matches `<name>.json.<pid>.tmp` inside
+ * record stores only, so nothing else ever removes them.
+ */
+const WRITE_TMP = /^\.(?:retention|migrated)-[0-9]+-[A-Za-z0-9]+\.tmp$/;
+/** The age past which such a file is abandoned; the storage engine passes `settings.staleTmpHours`, and a test pins this to it. */
+const STALE_TMP_MS = 24 * 3600000;
 /** Bounds one pass, so its journal stays far below the reader's cap and its lock is held briefly. */
 const MAX_PASS_FILES = 20000;
 /** Unlinks between two refreshes of the lock's age. */
@@ -100,7 +110,8 @@ function fsyncCopy(fsImpl     , file     ) {
 function fsyncFolder(fsImpl     , dir     ) {
   let fd;
   try { fd = fsImpl.openSync(dir, 'r'); } catch { return; }
-  try { fsImpl.fsyncSync(fd); } finally { fsImpl.closeSync(fd); }
+  // Windows opens a folder but refuses to flush it (EPERM); there is nothing to flush there.
+  try { fsImpl.fsyncSync(fd); } catch (error     ) { if (!['EPERM', 'EINVAL', 'EISDIR', 'ENOTSUP'].includes(error?.code)) throw error; } finally { fsImpl.closeSync(fd); }
 }
 
 const migrationFailed = (code     ) => ({
@@ -208,6 +219,30 @@ function refreshLock(fsImpl     , root     ) {
   try { fsImpl.utimesSync(`${lockTarget(root)}.lock`, now, now); } catch { /* the lock folder is ours; a failed touch only shortens its life */ }
 }
 
+/**
+ * Removes temp files a crashed writer left in the lifecycle folder, once they are older than
+ * `staleMs`. Runs under the store lock, which every writer of these files holds, so none of them
+ * belongs to a live pass unless its lock was taken over as stale. Best effort: a file that cannot
+ * be removed is left for the next pass. `shouldStop` is checked before each unlink and each unlink
+ * counts against `maxFiles`, so a bounded caller's budget and stop hold here too.
+ * @returns {{removed: number, partial: boolean}} partial: stopped or out of budget with files left
+ */
+function sweepStaleTmp(fsImpl     , root     , now     , staleMs         = STALE_TMP_MS, { maxFiles = Infinity, shouldStop }      = {}) {
+  const dir = path.join(root, LIFECYCLE_REL);
+  let list          ;
+  try { list = namesIn(fsImpl, dir); } catch { return { removed: 0, partial: false }; }
+  let removed = 0;
+  for (const name of list) {
+    if (!WRITE_TMP.test(name)) continue;
+    const file = path.join(dir, name);
+    const st = lstatOrNull(fsImpl, file);
+    if (!st || !st.isFile() || now.getTime() - st.mtimeMs <= staleMs) continue;
+    if (shouldStop?.() || removed >= maxFiles) return { removed, partial: true };
+    try { fsImpl.unlinkSync(file); removed += 1; } catch { /* left for the next pass */ }
+  }
+  return { removed, partial: false };
+}
+
 /** Unlinks pending event files without clearing the journal until every hidden name is finished. */
 function removePending(fsImpl     , root     , names     , onRemoved = () => {}, { maxFiles = Infinity, shouldStop }      = {}) {
   const dir = path.join(root, EVENTS_REL);
@@ -294,7 +329,7 @@ function retain(fsImpl     , root     , window     , now     , { maxFiles = MAX_
 
 /** Runs a bounded lifecycle retention pass under a non-waiting store lock for the storage engine. */
 function retainLocked(root     , options      = {}) {
-  const { window, now = new Date(), fsImpl = nodeFs, maxFiles = MAX_PASS_FILES, shouldStop } = options;
+  const { window, now = new Date(), fsImpl = nodeFs, maxFiles = MAX_PASS_FILES, shouldStop, staleTmpMs = STALE_TMP_MS } = options;
   const bounded = Object.hasOwn(options, 'maxFiles') || Object.hasOwn(options, 'shouldStop');
   const outcome = (removed     , warning     , partial = false, selected      = [], code      ) => bounded
     ? { removed, warning, partial, selected, ...(code ? { code } : {}) }
@@ -306,7 +341,9 @@ function retainLocked(root     , options      = {}) {
   const release = tryAcquireLock(fsImpl, lockTarget(root));
   if (!release) return outcome(0, [], true);
   try {
-    const result = retain(fsImpl, root, window, now, { maxFiles, shouldStop });
+    const swept = sweepStaleTmp(fsImpl, root, now, staleTmpMs, { maxFiles, shouldStop });
+    if (swept.partial) return outcome(0, [], true);
+    const result = retain(fsImpl, root, window, now, { maxFiles: Math.max(0, maxFiles - swept.removed), shouldStop });
     return outcome(result.removedCount, result.warning, result.partial, result.selected, result.code);
   } finally {
     release();
@@ -326,7 +363,7 @@ function needsPrune(fsImpl     , root     , window     , now     ) {
  * @param {string} root projectRoot() result
  * @param {{env?: Object, now?: Date, fsImpl?: Object}} [options] defaults process.env, new Date(), node:fs
  * @returns {{ok: true, lines: string[]}
- *   | {ok: false, finding: 'store-migration-failed'|'store-locked', message: string, lines: string[]}}
+ *   | {ok: false, finding: 'store-migration-pending'|'store-migration-failed'|'store-locked', message: string, lines: string[]}}
  *   `lines` are for stderr, without the verb prefix.
  * @throws {StoreUnsafeError} a symlinked new store folder, or a symlinked old folder when a copy must read it
  */
@@ -345,6 +382,17 @@ function prepareStore(root        , { env = process.env, now = new Date(), fsImp
       try { migrate = legacyEventFiles(fsImpl, root).length > 0; } catch (error     ) { return legacyUnreadable(error.code || error.message); }
     }
   }
+  if (env.DOFLOW_UPKEEP === 'off') {
+    if (migrate) {
+      return {
+        ok: false,
+        finding: 'store-migration-pending',
+        message: 'the lifecycle store has not been copied yet; run any followup, lifecycle or goal command once without DOFLOW_UPKEEP=off. Nothing was written.',
+        lines: [],
+      };
+    }
+    return { ok: true, lines: [...notice, ...invalid] };
+  }
   const retentionDue = readJournal(root, fsImpl).pending.length > 0 || needsPrune(fsImpl, root, window, now);
   if (!migrate && !markerDue && !retentionDue) return { ok: true, lines: [...notice, ...invalid] };
   if (migrate) refuseLinks(fsImpl, root, [LEGACY_LIFECYCLE_REL, LEGACY_EVENTS_REL]);
@@ -367,6 +415,7 @@ function prepareStore(root        , { env = process.env, now = new Date(), fsImp
     throw error;
   }
   try {
+    sweepStaleTmp(fsImpl, root, now);
     // Decided again under the lock: another verb may have finished the copy while this one waited.
     let marked = hasMarker(fsImpl, root);
     if (!marked && storeHasEvents(fsImpl, root)) {
@@ -390,4 +439,4 @@ function prepareStore(root        , { env = process.env, now = new Date(), fsImp
   }
 }
 
-module.exports = { prepareStore, retainLocked, LEGACY_LIFECYCLE_REL, LEGACY_EVENTS_REL, MARKER_REL };
+module.exports = { prepareStore, retainLocked, removedLine, STALE_TMP_MS, LEGACY_LIFECYCLE_REL, LEGACY_EVENTS_REL, MARKER_REL };

package/src/runtime/mask.js

@@ -8,7 +8,7 @@
  * the project store. Masking only narrows what a statement or an excerpt can carry.
  *
  * Two profiles. The line profile is for one-line statements and failure messages; the body profile
- * is for report bodies and excerpts and runs every line rule plus the body-only rules 7 to 9.
+ * is for report bodies and excerpts and runs every line rule plus the body-only rules 7 to 9 and 14 to 17.
  * Rules run in the table's order. Normalisation (rules 10 to 13) is a separate step applied to
  * failure messages only, after masking.
  *
@@ -36,7 +36,9 @@ const TOKEN_SHAPES = [
   /xox[abprs]-[A-Za-z0-9-]{10,}/g,
   /npm_[A-Za-z0-9]{24,}/g,
   /AIza[0-9A-Za-z_-]{35}/g,
-  /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+  // Left-anchored (DEC-069): without it every `eyJ` inside a long dotless run starts a scan to the
+  // run's end, which makes masking one line quadratic in its length.
+  /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
 ];
 
 const PEM = /-----BEGIN [^\n-]*-----(?:[\s\S]*?-----END [^\n-]*-----|[\s\S]*$)/g;
@@ -52,13 +54,107 @@ const KEY_VALUE_BODY = new RegExp(`(${KEY_NAME}["']?[ \\t]*[=:][ \\t]*)("[^"\\r\
 const AUTH_HEADER = /((?:Proxy-)?Authorization:)[ \t]*([^\r\n]*)/gi;
 const SECRET_FLAG = /(--(?:password|passwd|token|secret|api-key|client-secret)(?:=|[ \t]+))("[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+)/gi;
 
+// Rules 14 to 17 (body profile only, FU-ht8b3r). Command shapes that carry a secret without a key
+// word: `curl -u user:pw` (also glued, `-uuser:pw`), `mysql -psecret` (value glued to the flag; a bare
+// `-p` prompts and carries none), and the phrase `password hunter2`. The flags are masked by one
+// left-to-right scan (rules 14 and 15, `maskCommandFlags`) that knows which command it is in, so every
+// flag of a command is masked and `sort -u`, `git push -u` and `mysql -P 3306` stay as written.
+// A command word counts only at command position (see `maskCommandFlags`), and quoted text is scanned,
+// not skipped. Alternatives, in order: a quote, a command break (`|`, `;`, `&`, parentheses, a
+// backtick, a line end), curl's `--user` and `-u` (the short one may be glued to its value), mysql's
+// `-p` glued to its value, any other word.
+const COMMAND_SCAN = /(?<quote>["'])|(?<brk>[|;&()`\r\n])|(?<=[ \t])(?:(?<long>--user)(?:=|[ \t]+)|(?<short>-u)(?:=|[ \t]*)(?=[^\s|;&]))|(?<=[ \t])(?<pass>-p)(?=[^\s|;&-])|(?<word>[^\s|;&()`"']+)/g;
+// The closing quote of a quoted span, on the same line.
+const QUOTE_CLOSE                         = { '"': /[^"\r\n]*"/y, "'": /[^'\r\n]*'/y };
+// A word that is the command: bare or as a path (never a URL, which holds `:`).
+const COMMAND_WORD = /^(?:(?:\.{0,2}|~)?\/(?:[^\s:]*\/)?)?(?:(curl)|(mysql(?:dump|admin|pump|import)?))$/;
+// Words after which the next word is the command: wrappers, remote and container runners, shell keywords.
+const WRAPPER_WORDS = new Set(['sudo', 'doas', 'su', 'env', 'exec', 'nohup', 'time', 'timeout', 'nice', 'ionice', 'xargs', 'watch',
+  'command', 'builtin', 'eval', 'setsid', 'stdbuf', 'flock', 'chroot', 'ssh', 'docker', 'podman', 'kubectl', 'sh', 'bash', 'zsh', 'dash', 'ksh',
+  'if', 'then', 'else', 'elif', 'do', 'while', 'until', '!', '{']);
+// A first word that does not use up the command position: a prompt mark, a variable assignment or a
+// label such as `Running:`.
+const PROMPT_OR_ASSIGNMENT = /^(?:[$#%>+]+|[A-Za-z_][A-Za-z0-9_]*=[^=]*|[A-Za-z][A-Za-z0-9_-]*:)$/;
+// A flag value: quoted, or unquoted up to a space, quote or command break.
+const COMMAND_FLAG_VALUE = /"[^"\r\n]*"|'[^'\r\n]*'|[^\s"'|;&]+/y;
+// The value after the phrase must hold a non-letter, as in rule 4, so ordinary prose ("the password is
+// required") survives; a plain-letter value after a bare `password ` is a known gap, and so is a
+// password of one to three digits (`reset password 2 times` is prose).
+const PASSWORD_PHRASE = /(?<![A-Za-z0-9_.-])((?:password|passwd)[ \t]+)(?!<masked>|[=:])([^\s,;&"'`)\]}]+)/gi;
+// Another user's home directory (the running user's is rule 0). `Shared` is not a person and `runner`
+// is the CI runner account (`/Users/runner/work/...`), so neither is masked.
+const OTHER_USER_HOME = /(?<![A-Za-z0-9_.-])\/Users\/(?!(?:Shared|runner)(?![^/\s"'`<>:;,()[\]{}])|<)[^/\s"'`<>:;,()[\]{}]+/g;
+
+/**
+ * Rules 14 and 15. Scans left to right and masks the value of every `-u`/`--user` of a curl command
+ * and every `-p<value>` of a mysql command. A command word (`curl`, `mysql*`) is the command of its
+ * segment only at command position: the first word of the text, of a line or of a segment after a
+ * break (`|`, `;`, `&`, a parenthesis, a backtick), of a quoted span, or after a wrapper word
+ * (`sudo`, `env`, `ssh`, `docker`, `sh`, `bash`, ...) at the start of the segment. A word that holds `:`
+ * (a URL) or is followed by more of its token (`mysql-8`) is not the command. A segment has one
+ * command. Quoted text is scanned: its start is a command position, and a break inside it ends only
+ * the command inside it, so `curl -H "a|b" -u x:y` keeps its command. One pass; every step consumes
+ * at least one character and a closing quote is searched on its own line, so the cost is linear.
+ */
+function maskCommandFlags(text        )         {
+  let out = '';
+  let copied = 0;
+  let command                          = null;
+  let atStart = true;       // the next word is the first of its segment
+  let wrapped = false;      // the segment began with a wrapper word
+  const spans                                                                                                 = [];
+  COMMAND_SCAN.lastIndex = 0;
+  let found                        ;
+  while ((found = COMMAND_SCAN.exec(text)) !== null) {
+    const groups = found.groups || {};
+    const end = found.index + found[0].length;
+    if (groups.quote) {
+      const top = spans[spans.length - 1];
+      if (top && top.quote === groups.quote) {
+        spans.pop();
+        ({ command, atStart, wrapped } = top);
+        atStart = false;
+      } else {
+        const close = QUOTE_CLOSE[groups.quote];
+        close.lastIndex = end;
+        if (close.test(text)) {
+          spans.push({ quote: groups.quote, command, atStart, wrapped });
+          command = null; atStart = true; wrapped = false;
+        }
+      }
+    } else if (groups.brk) {
+      if (!(groups.brk === '&' && /[<>]/.test(text[found.index - 1] || ''))) { command = null; atStart = true; wrapped = false; }
+    } else if (groups.word) {
+      const word = groups.word;
+      if (atStart && PROMPT_OR_ASSIGNMENT.test(word)) continue;
+      const named = COMMAND_WORD.exec(word);
+      if (command === null && (atStart || wrapped) && named) command = named[1] ? 'curl' : 'mysql';
+      else if (atStart) wrapped = WRAPPER_WORDS.has(word.slice(word.lastIndexOf('/') + 1));
+      atStart = false;
+    } else if (((groups.long || groups.short) && command === 'curl') || (groups.pass && command === 'mysql')) {
+      atStart = false;
+      COMMAND_FLAG_VALUE.lastIndex = end;
+      const value = COMMAND_FLAG_VALUE.exec(text);
+      if (value && !isMasked(value[0]) && !(command === 'mysql' && value[0].startsWith(MASKED))) {
+        out += text.slice(copied, end) + MASKED;
+        copied = end + value[0].length;
+        COMMAND_SCAN.lastIndex = copied;
+      }
+    } else {
+      atStart = false;                // another command's flag: rescan what follows it
+      COMMAND_SCAN.lastIndex = end;
+    }
+  }
+  return out + text.slice(copied);
+}
+
 function escapeRegExp(text        )         { return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); }
 
 /** The home directory to abbreviate: an absolute path other than the file system root. */
 function homeOf(options      )                {
   const raw = options && 'home' in options ? options.home : process.env.HOME;
-  if (typeof raw !== 'string' || !raw.startsWith('/')) return null;
-  const home = raw.replace(/\/+$/, '');
+  if (typeof raw !== 'string' || !(raw.startsWith('/') || /^[A-Za-z]:[\\/]/.test(raw))) return null;
+  const home = raw.replace(/[\\/]+$/, '');
   return home.length > 1 ? home : null;
 }
 
@@ -89,6 +185,30 @@ function mask40(run        , before                    )         {
     looksLikeSecretRun(value, 1) && !isPathRun(value, index === 0 ? before : run[index - 1]) ? MASKED : value));
 }
 
+const TS_TYPE_NAMES                      = new Set([
+  'string', 'number', 'boolean', 'any', 'unknown', 'void',
+  'never', 'null', 'undefined', 'symbol', 'bigint',
+]);
+
+function isCodePreserved(head        , value        , offset        , fullString        )          {
+  if (value.startsWith('"') || value.startsWith("'")) return false;
+  const isColon = /:[ \t]*$/.test(head);
+  if (isColon) {
+    const baseType = value.replace(/\[\s*\]?$|\[$/, '');
+    if (TS_TYPE_NAMES.has(baseType)) return true;
+    if (/^[A-Z]|^\[/.test(value)) return true;
+    if (/^(?:new\s|[A-Za-z0-9_$]+\s*\(|[A-Za-z0-9_$]+\.[A-Za-z0-9_$]+)/.test(value)) return true;
+  }
+  const isEquals = /=[ \t]*$/.test(head);
+  if (isEquals) {
+    const before = fullString.slice(Math.max(0, offset - 30), offset);
+    if (/(?:const|let|var|readonly)\s+$/.test(before)) return true;
+    if (/\bnew\s|[A-Za-z0-9_$]+\.[A-Za-z0-9_$]+|\(/.test(value)) return true;
+    if (/^[\[{]/.test(value)) return true;
+  }
+  return false;
+}
+
 function isMasked(value        )          { return value.replace(/^["']|["']$/g, '') === MASKED; }
 
 function count(text        , token        )         { return text.split(token).length - 1; }
@@ -119,8 +239,8 @@ function mask(text     , profile                 , options      = {})
   // 3. Bearer tokens and URL credentials.
   out = out.replace(BEARER, `$1$2${MASKED}`).replace(URL_CREDENTIALS, `://${MASKED}@`);
   // 4. Key=value, unquoted, when the value is not plain letters.
-  out = out.replace(KEY_VALUE_LINE, (match        , key        , separator        , value        ) => (
-    isMasked(value) || value.startsWith(MASKED) || !/[^A-Za-z]/.test(value) ? match : `${key}${separator}${MASKED}`));
+  out = out.replace(KEY_VALUE_LINE, (match        , key        , separator        , value        , offset        , fullString        ) => (
+    isMasked(value) || value.startsWith(MASKED) || !/[^A-Za-z]/.test(value) || isCodePreserved(key + separator, value, offset, fullString) ? match : `${key}${separator}${MASKED}`));
   // 5. Long secret-looking runs that are not paths.
   out = out.replace(LONG_RUN, (run        , offset        ) => (
     looksLikeSecretRun(run, 2) && !isPathRun(run, out[offset - 1]) ? MASKED : mask40(run, out[offset - 1])));
@@ -129,8 +249,9 @@ function mask(text     , profile                 , options      = {})
 
   if (profile === 'body') {
     // 7. Key and value, quoted or not, whatever the value looks like.
-    out = out.replace(KEY_VALUE_BODY, (match        , head        , value        ) => {
+    out = out.replace(KEY_VALUE_BODY, (match        , head        , value        , offset        , fullString        ) => {
       if (isMasked(value) || value.startsWith(MASKED)) return match;
+      if (isCodePreserved(head, value, offset, fullString)) return match;
       const quote = value[0] === '"' || value[0] === "'" ? value[0] : '';
       return `${head}${quote}${MASKED}${quote}`;
     });
@@ -138,6 +259,12 @@ function mask(text     , profile                 , options      = {})
     out = out.replace(AUTH_HEADER, (match        , name        , rest        ) => (rest === '' || rest === MASKED ? match : `${name} ${MASKED}`));
     // 9. Secret-bearing command-line flags.
     out = out.replace(SECRET_FLAG, (match        , flag        , value        ) => (isMasked(value) ? match : `${flag}${MASKED}`));
+    // 14 and 15. `curl -u user:pw`, `curl --user user:pw`, `curl -uuser:pw` and `mysql -psecret`, every flag of a command.
+    out = maskCommandFlags(out);
+    // 16. `password hunter2`: the key word, a space and a value with a non-letter in it.
+    out = out.replace(PASSWORD_PHRASE, (match        , head        , value        ) => (/[^A-Za-z]/.test(value) && !/^[0-9]{1,3}$/.test(value) ? `${head}${MASKED}` : match));
+    // 17. Another user's home directory: `/Users/<name>` becomes `/Users/<masked>`.
+    out = out.replace(OTHER_USER_HOME, `/Users/${MASKED}`);
   }
 
   const masked = Math.max(0, [MASKED, EMAIL, IP].reduce((sum, token) => sum + count(out, token) - count(input, token), 0));