@mnemonik/cli 7.154.2 → 7.155.2

package/dist/auth/credentials.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1145,7 +1145,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1153,6 +1153,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2866,9 +2868,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6917,9 +6916,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7179,11 +7175,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7340,22 +7340,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/auth/index.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1016,7 +1016,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1024,6 +1024,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2732,9 +2734,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6783,9 +6782,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7045,11 +7041,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7206,22 +7206,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/auth/installSession.js

@@ -907,9 +907,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -4958,9 +4955,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -5223,8 +5217,14 @@ var SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|creden
 var SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
 var LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
 
-// packages/shared/dist/codeScanner.js
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
+// packages/shared/dist/sourceRedaction.js
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
+
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -5381,20 +5381,31 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
 // packages/shared/dist/runtimeSigners.js
 var ttl = 10 * 6e4;
 

package/dist/auth/status.js

@@ -907,9 +907,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -4958,9 +4955,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -5223,8 +5217,14 @@ var SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|creden
 var SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
 var LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
 
-// packages/shared/dist/codeScanner.js
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
+// packages/shared/dist/sourceRedaction.js
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
+
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -5381,20 +5381,31 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
 // packages/shared/dist/runtimeSigners.js
 var ttl = 10 * 6e4;
 

package/dist/authorizationWords.js

@@ -907,9 +907,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -4958,9 +4955,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -5223,8 +5217,14 @@ var SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|creden
 var SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
 var LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
 
-// packages/shared/dist/codeScanner.js
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
+// packages/shared/dist/sourceRedaction.js
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
+
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -5381,20 +5381,31 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
 // packages/shared/dist/runtimeSigners.js
 var ttl = 10 * 6e4;
 

package/dist/diagnostics.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1145,7 +1145,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1153,6 +1153,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2872,9 +2874,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6923,9 +6922,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7185,11 +7181,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7346,22 +7346,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js