@mnemonik/cli 7.154.2 → 7.155.2

package/dist/runtime/signers.js

@@ -1090,6 +1090,7 @@ var init_secretPatterns = __esm({
 import { randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync as lstatSync2, mkdirSync as mkdirSync2, openSync, renameSync as renameSync2, statSync, unlinkSync as unlinkSync2, writeSync } from "node:fs";
 import { dirname as dirname3, join as join4 } from "node:path";
+import { open as openAsync, stat as statAsync } from "node:fs/promises";
 function hookTraceEnabled(env = process.env) {
   const value = env[HOOK_TRACE_ENV]?.trim().toLowerCase();
   return !value || !["off", "0", "false", "no", "disabled"].includes(value);
@@ -1279,7 +1280,88 @@ function startHookTrace(options) {
   trace.open();
   return trace;
 }
-var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV, MAX_FIELDS, MAX_CALLS, MAX_ERROR_CHARS, SAFE_ID, SAFE_NAME, SAFE_ENUM, preparedDirectories, STALE_LOCK_MS, isObject, HookTrace, active;
+async function summarizeRecentHookCalls(host, options = {}) {
+  const empty = { missed: 0, total: 0 };
+  const now = options.now ?? Date.now();
+  const since = now - (options.windowMs ?? HOOK_MISS_WINDOW_MS);
+  let text;
+  try {
+    const file = hookTraceFile(host, options.stateDir);
+    const size = (await statAsync(file)).size;
+    const handle = await openAsync(file, "r");
+    try {
+      const length = Math.min(size, HOOK_MISS_TAIL_BYTES);
+      const buffer = Buffer.alloc(length);
+      await handle.read(buffer, 0, length, size - length);
+      text = buffer.toString("utf8");
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return empty;
+  }
+  const started = /* @__PURE__ */ new Map();
+  const ended = /* @__PURE__ */ new Set();
+  let missed = 0;
+  let total = 0;
+  for (const line of text.split("\n")) {
+    let record2;
+    try {
+      record2 = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const at = Date.parse(record2.ts);
+    if (!(at >= since))
+      continue;
+    if (record2.phase === "start")
+      started.set(record2.id, at);
+    else if (record2.phase === "end") {
+      ended.add(record2.id);
+      const answeredByPath = /* @__PURE__ */ new Map();
+      for (const call of record2.calls ?? []) {
+        const status = call.status ?? 0;
+        const answered = call.error === void 0 && call.pending !== true && status > 0 && status < 500 && status !== 408 && status !== 429;
+        answeredByPath.set(call.path, (answeredByPath.get(call.path) ?? false) || answered);
+      }
+      for (const answered of answeredByPath.values()) {
+        total++;
+        if (!answered)
+          missed++;
+      }
+    }
+  }
+  for (const [id, at] of started) {
+    if (ended.has(id) || now - at < 6e4)
+      continue;
+    total++;
+    missed++;
+  }
+  return { missed, total };
+}
+function summaryFor(host, options) {
+  const key = `${host}\0${options.stateDir ?? ""}\0${options.now ?? ""}`;
+  const cached = summaries.get(key);
+  if (cached)
+    return cached;
+  const entry = {
+    read: Promise.resolve({})
+  };
+  entry.read = summarizeRecentHookCalls(host, options).then(({ missed, total }) => {
+    const value = total > 0 ? { [HOOK_MISSES_HEADER]: `${missed}/${total}` } : {};
+    entry.value = value;
+    return value;
+  });
+  summaries.set(key, entry);
+  return entry;
+}
+function hookMissesHeaders(host, options = {}) {
+  return summaryFor(host, options).read;
+}
+function hookMissesHeadersIfReady(host, options = {}) {
+  return summaryFor(host, options).value ?? {};
+}
+var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV, MAX_FIELDS, MAX_CALLS, MAX_ERROR_CHARS, SAFE_ID, SAFE_NAME, SAFE_ENUM, preparedDirectories, STALE_LOCK_MS, isObject, HookTrace, active, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES, HOOK_MISSES_HEADER, summaries;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1482,6 +1564,10 @@ var init_hookTrace = __esm({
         });
       }
     };
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
+    HOOK_MISSES_HEADER = "x-mnemonik-hook-misses";
+    summaries = /* @__PURE__ */ new Map();
   }
 });
 
@@ -1495,7 +1581,40 @@ function safePath(path) {
     throw new RuntimeError("permission");
   return path;
 }
-var RuntimeError, hash, missing, versionName, statIdentity, RuntimeReader;
+function limiter(limit) {
+  let active3 = 0;
+  const waiting = [];
+  return async (work) => {
+    if (active3 >= limit)
+      await new Promise((release) => waiting.push(release));
+    active3 += 1;
+    try {
+      return await work();
+    } finally {
+      active3 -= 1;
+      waiting.shift()?.();
+    }
+  };
+}
+async function ownedFileBytes(path, mode) {
+  const fd = await open(path, constants2.O_RDONLY | constants2.O_NOFOLLOW).catch((error) => {
+    throw error.code === "ELOOP" ? new RuntimeError("permission") : error;
+  });
+  try {
+    const stat2 = await fd.stat();
+    if (!stat2.isFile() || stat2.uid !== process.getuid?.() || (stat2.mode & 511) !== mode)
+      throw new RuntimeError("permission");
+    return await fd.readFile();
+  } finally {
+    await fd.close();
+  }
+}
+async function settleAll(work) {
+  const failed = (await Promise.allSettled(work)).find((result) => result.status === "rejected");
+  if (failed)
+    throw failed.reason;
+}
+var RuntimeError, hash, missing, versionName, VERIFY_CONCURRENCY, statIdentity, RuntimeReader;
 var init_runtimeReader = __esm({
   "packages/shared/dist/runtimeReader.js"() {
     "use strict";
@@ -1516,6 +1635,7 @@ var init_runtimeReader = __esm({
         throw new RuntimeError("permission");
       return v;
     };
+    VERIFY_CONCURRENCY = 16;
     statIdentity = (stat2) => [stat2.dev, stat2.ino, stat2.mode, stat2.uid, stat2.size, stat2.mtimeMs, stat2.ctimeMs].join(":");
     RuntimeReader = class _RuntimeReader {
       run;
@@ -1634,12 +1754,23 @@ var init_runtimeReader = __esm({
           throw new RuntimeError(error instanceof Error && error.message === "acl_permissions" ? "permission" : "acl_unavailable");
         }
       }
-      async inspect(path, directory = false, allowMissing = false, replacing = false) {
+      /**
+       * `proven` (one verification's own set, POSIX only) holds directories this
+       * verification has already inspected in full: their components are not
+       * inspected again for every file beneath them, and directories proven here
+       * are added to it.
+       */
+      async inspect(path, directory = false, allowMissing = false, replacing = false, proven) {
         const absolute = this.guardedPath(path);
         const windowsPaths = [];
-        let part = parse(absolute).root;
-        for (const name of absolute.slice(part.length).split(sep2)) {
+        const remembered = process.platform === "win32" ? void 0 : proven;
+        const checkedDirectories = [];
+        const parent = dirname4(absolute);
+        let part = remembered?.has(parent) ? parent : parse(absolute).root;
+        for (const name of absolute.slice(part.length).split(sep2).filter(Boolean)) {
           part = join5(part, name);
+          if (part !== absolute && remembered?.has(part))
+            continue;
           const stat2 = await lstat3(part).catch((e) => {
             if (allowMissing && missing(e))
               return null;
@@ -1680,7 +1811,12 @@ var init_runtimeReader = __esm({
             windowsPaths.push(part);
           } else if (stat2.uid !== process.getuid?.() || (stat2.mode & 63) !== 0)
             throw new RuntimeError("permission");
+          if (stat2.isDirectory())
+            checkedDirectories.push(part);
         }
+        if (remembered)
+          for (const checked of checkedDirectories)
+            remembered.add(checked);
         await this.audit(windowsPaths);
         for (const part2 of windowsPaths) {
           const verdict = this.windowsAudit.get(part2)?.verdict;
@@ -1701,8 +1837,8 @@ var init_runtimeReader = __esm({
         this.windowsAudit.delete(absolute);
         this.windowsStats.delete(absolute);
       }
-      async bytes(path) {
-        await this.inspect(path);
+      async bytes(path, proven) {
+        await this.inspect(path, false, false, false, proven);
         const fd = await open(path, constants2.O_RDONLY | (process.platform === "win32" ? 0 : constants2.O_NOFOLLOW));
         try {
           return await fd.readFile();
@@ -1774,36 +1910,43 @@ var init_runtimeReader = __esm({
         if (process.platform === "win32")
           await this.audit(Object.keys(m.files).map((name) => join5(directory, safePath(name))));
         const actual = [];
+        const proven = /* @__PURE__ */ new Set();
+        const limit = limiter(process.platform === "win32" ? 1 : VERIFY_CONCURRENCY);
         const walk = async (dir, prefix = "") => {
-          await this.inspect(dir, true);
-          for (const name of await readdir(dir)) {
-            const key = prefix + name;
-            if (!prefix && name === "manifest.json")
-              continue;
-            const path = join5(dir, name);
-            if ((await lstat3(path)).isDirectory())
+          const entries = await limit(async () => {
+            await this.inspect(dir, true, false, false, proven);
+            return readdir(dir, { withFileTypes: true });
+          });
+          await settleAll(entries.map(async (entry) => {
+            const key = prefix + entry.name;
+            if (!prefix && entry.name === "manifest.json")
+              return;
+            const path = join5(dir, entry.name);
+            if (entry.isDirectory())
               await walk(path, key + "/");
             else {
-              await this.inspect(path);
+              if (process.platform === "win32")
+                await limit(() => this.inspect(path, false, false, false, proven));
+              else if (!entry.isFile())
+                throw new RuntimeError("permission");
               actual.push(key);
             }
-          }
+          }));
         };
         await walk(directory);
         if (actual.sort().join("\n") !== Object.keys(m.files).sort().join("\n"))
           throw new RuntimeError("digest_mismatch");
-        let total = 0;
-        for (const [name, expected] of Object.entries(m.files)) {
+        for (const expected of Object.values(m.files))
           if (!expected || !/^[a-f0-9]{64}$/.test(expected.sha256) || !Number.isSafeInteger(expected.size) || expected.size < 0 || typeof expected.executable !== "boolean")
             throw new RuntimeError("digest_mismatch");
+        let total = 0;
+        await settleAll(Object.entries(m.files).map(([name, expected]) => limit(async () => {
           const path = join5(directory, safePath(name));
-          const contents = await this.bytes(path);
+          const contents = process.platform === "win32" ? await this.bytes(path, proven) : await ownedFileBytes(path, expected.executable ? 448 : 384);
           if (hash(contents) !== expected.sha256 || contents.length !== expected.size)
             throw new RuntimeError("digest_mismatch");
-          if (process.platform !== "win32" && ((await lstat3(path)).mode & 511) !== (expected.executable ? 448 : 384))
-            throw new RuntimeError("permission");
           total += contents.length;
-        }
+        })));
         if (total !== m.totalSize)
           throw new RuntimeError("digest_mismatch");
         if (m.signer) {
@@ -2791,6 +2934,8 @@ __export(hookRuntime_exports, {
   GATE_OUTBOX_MAX_AGE_MS: () => GATE_OUTBOX_MAX_AGE_MS,
   GATE_OUTBOX_MAX_EVENTS: () => GATE_OUTBOX_MAX_EVENTS,
   GATE_OUTBOX_STRAY_MS: () => GATE_OUTBOX_STRAY_MS,
+  HOOK_MISSES_HEADER: () => HOOK_MISSES_HEADER,
+  HOOK_MISS_WINDOW_MS: () => HOOK_MISS_WINDOW_MS,
   HOOK_STDIN_MAX_BYTES: () => HOOK_STDIN_MAX_BYTES,
   HOOK_TRACE_ENV: () => HOOK_TRACE_ENV,
   HOOK_TRACE_MAX_BYTES: () => HOOK_TRACE_MAX_BYTES,
@@ -2802,6 +2947,7 @@ __export(hookRuntime_exports, {
   RELEASE_MINISIGN_PUBLIC_KEY: () => RELEASE_MINISIGN_PUBLIC_KEY,
   RuntimeError: () => RuntimeError,
   RuntimeReader: () => RuntimeReader,
+  VERIFY_CONCURRENCY: () => VERIFY_CONCURRENCY,
   aclRecords: () => aclRecords,
   adoptHookConversation: () => adoptHookConversation,
   appendHookTraceLine: () => appendHookTraceLine,
@@ -2818,6 +2964,8 @@ __export(hookRuntime_exports, {
   findProjectIdentityDetailed: () => findProjectIdentityDetailed,
   handoffProjectSetup: () => handoffProjectSetup,
   hash: () => hash,
+  hookMissesHeaders: () => hookMissesHeaders,
+  hookMissesHeadersIfReady: () => hookMissesHeadersIfReady,
   hookTraceDirectory: () => hookTraceDirectory,
   hookTraceEnabled: () => hookTraceEnabled,
   hookTraceFile: () => hookTraceFile,
@@ -2839,6 +2987,7 @@ __export(hookRuntime_exports, {
   setupResponse: () => setupResponse,
   startHookTrace: () => startHookTrace,
   summarizeHookOutput: () => summarizeHookOutput,
+  summarizeRecentHookCalls: () => summarizeRecentHookCalls,
   takeGateEvents: () => takeGateEvents,
   validHookSessionId: () => validHookSessionId,
   verifyMinisign: () => verifyMinisign,
@@ -3043,6 +3192,8 @@ export {
   GATE_OUTBOX_MAX_AGE_MS,
   GATE_OUTBOX_MAX_EVENTS,
   GATE_OUTBOX_STRAY_MS,
+  HOOK_MISSES_HEADER,
+  HOOK_MISS_WINDOW_MS,
   HOOK_STDIN_MAX_BYTES,
   HOOK_TRACE_ENV,
   HOOK_TRACE_MAX_BYTES,
@@ -3054,6 +3205,7 @@ export {
   RELEASE_MINISIGN_PUBLIC_KEY,
   RuntimeError,
   RuntimeReader,
+  VERIFY_CONCURRENCY,
   aclRecords,
   adoptHookConversation,
   appendHookTraceLine,
@@ -3070,6 +3222,8 @@ export {
   findProjectIdentityDetailed,
   handoffProjectSetup,
   hash,
+  hookMissesHeaders,
+  hookMissesHeadersIfReady,
   hookTraceDirectory,
   hookTraceEnabled,
   hookTraceFile,
@@ -3091,6 +3245,7 @@ export {
   setupResponse,
   startHookTrace,
   summarizeHookOutput,
+  summarizeRecentHookCalls,
   takeGateEvents,
   validHookSessionId,
   verifyMinisign,

package/dist/runtime/store.js

@@ -446,7 +446,7 @@ var init_secretPatterns = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -454,6 +454,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -467,7 +469,40 @@ function safePath(path) {
     throw new RuntimeError("permission");
   return path;
 }
-var RuntimeError, hash, missing, versionName, statIdentity, RuntimeReader;
+function limiter(limit) {
+  let active = 0;
+  const waiting = [];
+  return async (work) => {
+    if (active >= limit)
+      await new Promise((release) => waiting.push(release));
+    active += 1;
+    try {
+      return await work();
+    } finally {
+      active -= 1;
+      waiting.shift()?.();
+    }
+  };
+}
+async function ownedFileBytes(path, mode) {
+  const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch((error) => {
+    throw error.code === "ELOOP" ? new RuntimeError("permission") : error;
+  });
+  try {
+    const stat = await fd.stat();
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 511) !== mode)
+      throw new RuntimeError("permission");
+    return await fd.readFile();
+  } finally {
+    await fd.close();
+  }
+}
+async function settleAll(work) {
+  const failed = (await Promise.allSettled(work)).find((result) => result.status === "rejected");
+  if (failed)
+    throw failed.reason;
+}
+var RuntimeError, hash, missing, versionName, VERIFY_CONCURRENCY, statIdentity, RuntimeReader;
 var init_runtimeReader = __esm({
   "packages/shared/dist/runtimeReader.js"() {
     "use strict";
@@ -488,6 +523,7 @@ var init_runtimeReader = __esm({
         throw new RuntimeError("permission");
       return v;
     };
+    VERIFY_CONCURRENCY = 16;
     statIdentity = (stat) => [stat.dev, stat.ino, stat.mode, stat.uid, stat.size, stat.mtimeMs, stat.ctimeMs].join(":");
     RuntimeReader = class _RuntimeReader {
       run;
@@ -606,12 +642,23 @@ var init_runtimeReader = __esm({
           throw new RuntimeError(error instanceof Error && error.message === "acl_permissions" ? "permission" : "acl_unavailable");
         }
       }
-      async inspect(path, directory = false, allowMissing = false, replacing = false) {
+      /**
+       * `proven` (one verification's own set, POSIX only) holds directories this
+       * verification has already inspected in full: their components are not
+       * inspected again for every file beneath them, and directories proven here
+       * are added to it.
+       */
+      async inspect(path, directory = false, allowMissing = false, replacing = false, proven) {
         const absolute = this.guardedPath(path);
         const windowsPaths = [];
-        let part = parse(absolute).root;
-        for (const name of absolute.slice(part.length).split(sep2)) {
+        const remembered = process.platform === "win32" ? void 0 : proven;
+        const checkedDirectories = [];
+        const parent = dirname2(absolute);
+        let part = remembered?.has(parent) ? parent : parse(absolute).root;
+        for (const name of absolute.slice(part.length).split(sep2).filter(Boolean)) {
           part = join2(part, name);
+          if (part !== absolute && remembered?.has(part))
+            continue;
           const stat = await lstat(part).catch((e) => {
             if (allowMissing && missing(e))
               return null;
@@ -652,7 +699,12 @@ var init_runtimeReader = __esm({
             windowsPaths.push(part);
           } else if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
             throw new RuntimeError("permission");
+          if (stat.isDirectory())
+            checkedDirectories.push(part);
         }
+        if (remembered)
+          for (const checked of checkedDirectories)
+            remembered.add(checked);
         await this.audit(windowsPaths);
         for (const part2 of windowsPaths) {
           const verdict = this.windowsAudit.get(part2)?.verdict;
@@ -673,8 +725,8 @@ var init_runtimeReader = __esm({
         this.windowsAudit.delete(absolute);
         this.windowsStats.delete(absolute);
       }
-      async bytes(path) {
-        await this.inspect(path);
+      async bytes(path, proven) {
+        await this.inspect(path, false, false, false, proven);
         const fd = await open(path, constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW));
         try {
           return await fd.readFile();
@@ -746,36 +798,43 @@ var init_runtimeReader = __esm({
         if (process.platform === "win32")
           await this.audit(Object.keys(m.files).map((name) => join2(directory, safePath(name))));
         const actual = [];
+        const proven = /* @__PURE__ */ new Set();
+        const limit = limiter(process.platform === "win32" ? 1 : VERIFY_CONCURRENCY);
         const walk = async (dir, prefix = "") => {
-          await this.inspect(dir, true);
-          for (const name of await readdir(dir)) {
-            const key = prefix + name;
-            if (!prefix && name === "manifest.json")
-              continue;
-            const path = join2(dir, name);
-            if ((await lstat(path)).isDirectory())
+          const entries = await limit(async () => {
+            await this.inspect(dir, true, false, false, proven);
+            return readdir(dir, { withFileTypes: true });
+          });
+          await settleAll(entries.map(async (entry) => {
+            const key = prefix + entry.name;
+            if (!prefix && entry.name === "manifest.json")
+              return;
+            const path = join2(dir, entry.name);
+            if (entry.isDirectory())
               await walk(path, key + "/");
             else {
-              await this.inspect(path);
+              if (process.platform === "win32")
+                await limit(() => this.inspect(path, false, false, false, proven));
+              else if (!entry.isFile())
+                throw new RuntimeError("permission");
               actual.push(key);
             }
-          }
+          }));
         };
         await walk(directory);
         if (actual.sort().join("\n") !== Object.keys(m.files).sort().join("\n"))
           throw new RuntimeError("digest_mismatch");
-        let total = 0;
-        for (const [name, expected] of Object.entries(m.files)) {
+        for (const expected of Object.values(m.files))
           if (!expected || !/^[a-f0-9]{64}$/.test(expected.sha256) || !Number.isSafeInteger(expected.size) || expected.size < 0 || typeof expected.executable !== "boolean")
             throw new RuntimeError("digest_mismatch");
+        let total = 0;
+        await settleAll(Object.entries(m.files).map(([name, expected]) => limit(async () => {
           const path = join2(directory, safePath(name));
-          const contents = await this.bytes(path);
+          const contents = process.platform === "win32" ? await this.bytes(path, proven) : await ownedFileBytes(path, expected.executable ? 448 : 384);
           if (hash(contents) !== expected.sha256 || contents.length !== expected.size)
             throw new RuntimeError("digest_mismatch");
-          if (process.platform !== "win32" && ((await lstat(path)).mode & 511) !== (expected.executable ? 448 : 384))
-            throw new RuntimeError("permission");
           total += contents.length;
-        }
+        })));
         if (total !== m.totalSize)
           throw new RuntimeError("digest_mismatch");
         if (m.signer) {

package/dist/runtime/updateCheck.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1016,7 +1016,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1024,6 +1024,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2736,9 +2738,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6787,9 +6786,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7049,11 +7045,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7210,22 +7210,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js