@mnemonik/cli 7.154.3 → 7.156.0

package/dist/project/records.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1016,7 +1016,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1024,6 +1024,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2737,9 +2739,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6788,9 +6787,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7050,11 +7046,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7211,22 +7211,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/project.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1487,7 +1487,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1495,6 +1495,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -3214,9 +3216,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -7265,9 +7264,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7527,11 +7523,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7688,22 +7688,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/router.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1351,7 +1351,7 @@ function hookTraceEnabled(env = process.env) {
   const value = env[HOOK_TRACE_ENV]?.trim().toLowerCase();
   return !value || !["off", "0", "false", "no", "disabled"].includes(value);
 }
-var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV;
+var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1360,6 +1360,8 @@ var init_hookTrace = __esm({
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
     HOOK_TRACE_ENV = "MNEMONIK_HOOK_TRACE";
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -3107,9 +3109,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -7158,9 +7157,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7420,11 +7416,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7581,22 +7581,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/runtime/releaseSource.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1046,7 +1046,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1054,6 +1054,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2768,9 +2770,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6819,9 +6818,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7081,11 +7077,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7242,22 +7242,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/runtime/selfUpdate.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1016,7 +1016,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1024,6 +1024,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2737,9 +2739,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6788,9 +6787,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7050,11 +7046,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7211,22 +7211,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js