@mnemonik/cli 7.154.3 → 7.156.0

package/dist/runtime/signers.js

@@ -1090,6 +1090,7 @@ var init_secretPatterns = __esm({
 import { randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync as lstatSync2, mkdirSync as mkdirSync2, openSync, renameSync as renameSync2, statSync, unlinkSync as unlinkSync2, writeSync } from "node:fs";
 import { dirname as dirname3, join as join4 } from "node:path";
+import { open as openAsync, stat as statAsync } from "node:fs/promises";
 function hookTraceEnabled(env = process.env) {
   const value = env[HOOK_TRACE_ENV]?.trim().toLowerCase();
   return !value || !["off", "0", "false", "no", "disabled"].includes(value);
@@ -1279,7 +1280,88 @@ function startHookTrace(options) {
   trace.open();
   return trace;
 }
-var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV, MAX_FIELDS, MAX_CALLS, MAX_ERROR_CHARS, SAFE_ID, SAFE_NAME, SAFE_ENUM, preparedDirectories, STALE_LOCK_MS, isObject, HookTrace, active;
+async function summarizeRecentHookCalls(host, options = {}) {
+  const empty = { missed: 0, total: 0 };
+  const now = options.now ?? Date.now();
+  const since = now - (options.windowMs ?? HOOK_MISS_WINDOW_MS);
+  let text;
+  try {
+    const file = hookTraceFile(host, options.stateDir);
+    const size = (await statAsync(file)).size;
+    const handle = await openAsync(file, "r");
+    try {
+      const length = Math.min(size, HOOK_MISS_TAIL_BYTES);
+      const buffer = Buffer.alloc(length);
+      await handle.read(buffer, 0, length, size - length);
+      text = buffer.toString("utf8");
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return empty;
+  }
+  const started = /* @__PURE__ */ new Map();
+  const ended = /* @__PURE__ */ new Set();
+  let missed = 0;
+  let total = 0;
+  for (const line of text.split("\n")) {
+    let record2;
+    try {
+      record2 = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const at = Date.parse(record2.ts);
+    if (!(at >= since))
+      continue;
+    if (record2.phase === "start")
+      started.set(record2.id, at);
+    else if (record2.phase === "end") {
+      ended.add(record2.id);
+      const answeredByPath = /* @__PURE__ */ new Map();
+      for (const call of record2.calls ?? []) {
+        const status = call.status ?? 0;
+        const answered = call.error === void 0 && call.pending !== true && status > 0 && status < 500 && status !== 408 && status !== 429;
+        answeredByPath.set(call.path, (answeredByPath.get(call.path) ?? false) || answered);
+      }
+      for (const answered of answeredByPath.values()) {
+        total++;
+        if (!answered)
+          missed++;
+      }
+    }
+  }
+  for (const [id, at] of started) {
+    if (ended.has(id) || now - at < 6e4)
+      continue;
+    total++;
+    missed++;
+  }
+  return { missed, total };
+}
+function summaryFor(host, options) {
+  const key = `${host}\0${options.stateDir ?? ""}\0${options.now ?? ""}`;
+  const cached = summaries.get(key);
+  if (cached)
+    return cached;
+  const entry = {
+    read: Promise.resolve({})
+  };
+  entry.read = summarizeRecentHookCalls(host, options).then(({ missed, total }) => {
+    const value = total > 0 ? { [HOOK_MISSES_HEADER]: `${missed}/${total}` } : {};
+    entry.value = value;
+    return value;
+  });
+  summaries.set(key, entry);
+  return entry;
+}
+function hookMissesHeaders(host, options = {}) {
+  return summaryFor(host, options).read;
+}
+function hookMissesHeadersIfReady(host, options = {}) {
+  return summaryFor(host, options).value ?? {};
+}
+var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV, MAX_FIELDS, MAX_CALLS, MAX_ERROR_CHARS, SAFE_ID, SAFE_NAME, SAFE_ENUM, preparedDirectories, STALE_LOCK_MS, isObject, HookTrace, active, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES, HOOK_MISSES_HEADER, summaries;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1482,6 +1564,10 @@ var init_hookTrace = __esm({
         });
       }
     };
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
+    HOOK_MISSES_HEADER = "x-mnemonik-hook-misses";
+    summaries = /* @__PURE__ */ new Map();
   }
 });
 
@@ -2848,6 +2934,8 @@ __export(hookRuntime_exports, {
   GATE_OUTBOX_MAX_AGE_MS: () => GATE_OUTBOX_MAX_AGE_MS,
   GATE_OUTBOX_MAX_EVENTS: () => GATE_OUTBOX_MAX_EVENTS,
   GATE_OUTBOX_STRAY_MS: () => GATE_OUTBOX_STRAY_MS,
+  HOOK_MISSES_HEADER: () => HOOK_MISSES_HEADER,
+  HOOK_MISS_WINDOW_MS: () => HOOK_MISS_WINDOW_MS,
   HOOK_STDIN_MAX_BYTES: () => HOOK_STDIN_MAX_BYTES,
   HOOK_TRACE_ENV: () => HOOK_TRACE_ENV,
   HOOK_TRACE_MAX_BYTES: () => HOOK_TRACE_MAX_BYTES,
@@ -2876,6 +2964,8 @@ __export(hookRuntime_exports, {
   findProjectIdentityDetailed: () => findProjectIdentityDetailed,
   handoffProjectSetup: () => handoffProjectSetup,
   hash: () => hash,
+  hookMissesHeaders: () => hookMissesHeaders,
+  hookMissesHeadersIfReady: () => hookMissesHeadersIfReady,
   hookTraceDirectory: () => hookTraceDirectory,
   hookTraceEnabled: () => hookTraceEnabled,
   hookTraceFile: () => hookTraceFile,
@@ -2897,6 +2987,7 @@ __export(hookRuntime_exports, {
   setupResponse: () => setupResponse,
   startHookTrace: () => startHookTrace,
   summarizeHookOutput: () => summarizeHookOutput,
+  summarizeRecentHookCalls: () => summarizeRecentHookCalls,
   takeGateEvents: () => takeGateEvents,
   validHookSessionId: () => validHookSessionId,
   verifyMinisign: () => verifyMinisign,
@@ -3101,6 +3192,8 @@ export {
   GATE_OUTBOX_MAX_AGE_MS,
   GATE_OUTBOX_MAX_EVENTS,
   GATE_OUTBOX_STRAY_MS,
+  HOOK_MISSES_HEADER,
+  HOOK_MISS_WINDOW_MS,
   HOOK_STDIN_MAX_BYTES,
   HOOK_TRACE_ENV,
   HOOK_TRACE_MAX_BYTES,
@@ -3129,6 +3222,8 @@ export {
   findProjectIdentityDetailed,
   handoffProjectSetup,
   hash,
+  hookMissesHeaders,
+  hookMissesHeadersIfReady,
   hookTraceDirectory,
   hookTraceEnabled,
   hookTraceFile,
@@ -3150,6 +3245,7 @@ export {
   setupResponse,
   startHookTrace,
   summarizeHookOutput,
+  summarizeRecentHookCalls,
   takeGateEvents,
   validHookSessionId,
   verifyMinisign,

package/dist/runtime/store.js

@@ -446,7 +446,7 @@ var init_secretPatterns = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -454,6 +454,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 

package/dist/runtime/updateCheck.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1016,7 +1016,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1024,6 +1024,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2736,9 +2738,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6787,9 +6786,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7049,11 +7045,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7210,22 +7210,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/sbom.json

@@ -17,13 +17,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@mnemonik/cli@0.1.191",
+      "bom-ref": "@mnemonik/cli@0.1.195",
       "type": "library",
       "name": "@mnemonik/cli",
-      "version": "0.1.191",
+      "version": "0.1.195",
       "scope": "required",
       "description": "Mnemonik installer and local project helper",
-      "purl": "pkg:npm/%40mnemonik/cli@0.1.191",
+      "purl": "pkg:npm/%40mnemonik/cli@0.1.195",
       "properties": [],
       "externalReferences": [
         {
@@ -274,12 +274,12 @@
       ]
     },
     {
-      "bom-ref": "@mnemonik/credentials@0.1.191",
+      "bom-ref": "@mnemonik/credentials@0.1.195",
       "type": "library",
       "name": "@mnemonik/credentials",
-      "version": "0.1.191",
+      "version": "0.1.195",
       "scope": "required",
-      "purl": "pkg:npm/%40mnemonik/credentials@0.1.191",
+      "purl": "pkg:npm/%40mnemonik/credentials@0.1.195",
       "properties": [],
       "externalReferences": [
         {
@@ -289,12 +289,12 @@
       ]
     },
     {
-      "bom-ref": "@mnemonik/local-setup@0.1.191",
+      "bom-ref": "@mnemonik/local-setup@0.1.195",
       "type": "library",
       "name": "@mnemonik/local-setup",
-      "version": "0.1.191",
+      "version": "0.1.195",
       "scope": "required",
-      "purl": "pkg:npm/%40mnemonik/local-setup@0.1.191",
+      "purl": "pkg:npm/%40mnemonik/local-setup@0.1.195",
       "properties": [],
       "externalReferences": [
         {
@@ -304,14 +304,14 @@
       ]
     },
     {
-      "bom-ref": "@mnemonik/shared@7.154.3",
+      "bom-ref": "@mnemonik/shared@7.156.0",
       "type": "library",
       "name": "@mnemonik/shared",
-      "version": "7.154.3",
+      "version": "7.156.0",
       "scope": "required",
       "author": "Anthony",
       "description": "Shared constants and utilities for Mnemonik packages",
-      "purl": "pkg:npm/%40mnemonik/shared@7.154.3",
+      "purl": "pkg:npm/%40mnemonik/shared@7.156.0",
       "properties": [],
       "externalReferences": [
         {
@@ -1187,11 +1187,11 @@
   ],
   "dependencies": [
     {
-      "ref": "@mnemonik/cli@0.1.191",
+      "ref": "@mnemonik/cli@0.1.195",
       "dependsOn": [
-        "@mnemonik/credentials@0.1.191",
-        "@mnemonik/local-setup@0.1.191",
-        "@mnemonik/shared@7.154.3",
+        "@mnemonik/credentials@0.1.195",
+        "@mnemonik/local-setup@0.1.195",
+        "@mnemonik/shared@7.156.0",
         "smol-toml@1.9.0"
       ]
     },
@@ -1246,20 +1246,20 @@
       ]
     },
     {
-      "ref": "@mnemonik/credentials@0.1.191",
+      "ref": "@mnemonik/credentials@0.1.195",
       "dependsOn": [
-        "@mnemonik/local-setup@0.1.191"
+        "@mnemonik/local-setup@0.1.195"
       ]
     },
     {
-      "ref": "@mnemonik/local-setup@0.1.191",
+      "ref": "@mnemonik/local-setup@0.1.195",
       "dependsOn": [
-        "@mnemonik/shared@7.154.3",
+        "@mnemonik/shared@7.156.0",
         "proper-lockfile@4.1.2"
       ]
     },
     {
-      "ref": "@mnemonik/shared@7.154.3",
+      "ref": "@mnemonik/shared@7.156.0",
       "dependsOn": [
         "@vue/compiler-core@3.5.44",
         "@vue/compiler-sfc@3.5.44",

package/dist/scanner/control.js

@@ -43,6 +43,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
+  }
+});
+
 // node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/ignore/index.js"(exports, module2) {
@@ -885,17 +896,6 @@ var require_ignore = __commonJS({
   }
 });
 
-// packages/shared/dist/secretPatterns.js
-var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
-var init_secretPatterns = __esm({
-  "packages/shared/dist/secretPatterns.js"() {
-    "use strict";
-    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
-    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
-    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
-  }
-});
-
 // packages/shared/dist/protectedPaths.js
 var init_protectedPaths = __esm({
   "packages/shared/dist/protectedPaths.js"() {
@@ -1016,7 +1016,7 @@ var init_repositoryRoot = __esm({
 });
 
 // packages/shared/dist/hookTrace.js
-var HOOK_TRACE_MAX_BYTES;
+var HOOK_TRACE_MAX_BYTES, HOOK_MISS_WINDOW_MS, HOOK_MISS_TAIL_BYTES;
 var init_hookTrace = __esm({
   "packages/shared/dist/hookTrace.js"() {
     "use strict";
@@ -1024,6 +1024,8 @@ var init_hookTrace = __esm({
     init_runtimeSigners();
     init_secretPatterns();
     HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_MISS_WINDOW_MS = 30 * 60 * 1e3;
+    HOOK_MISS_TAIL_BYTES = 64 * 1024;
   }
 });
 
@@ -2732,9 +2734,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -6783,9 +6782,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -7045,11 +7041,15 @@ var PATTERNS = [
 
 // packages/shared/dist/sourceRedaction.js
 init_secretPatterns();
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
 
-// packages/shared/dist/codeScanner.js
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 init_protectedPaths();
 init_projectIdentityFile();
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -7206,22 +7206,35 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
 init_secretPatterns();
+
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
+// packages/shared/dist/index.js
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js

package/dist/scanner/data.js

@@ -907,9 +907,6 @@ function getMcpInstructions() {
 }
 var MCP_INSTRUCTIONS = getMcpInstructions();
 
-// packages/shared/dist/codeScanner.js
-var import_ignore = __toESM(require_ignore(), 1);
-
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -4958,9 +4955,6 @@ import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
-// packages/shared/dist/ast/astChunker.js
-var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
-
 // packages/shared/dist/redactCredentials.js
 var REDACTED = "<redacted credential>";
 var MAX_PEM_BODY_LENGTH = 8 * 1024;
@@ -5223,8 +5217,14 @@ var SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|creden
 var SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
 var LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
 
-// packages/shared/dist/codeScanner.js
-var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
+// packages/shared/dist/sourceRedaction.js
+var MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
+
+// packages/shared/dist/ast/astChunker.js
+var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
+
+// packages/shared/dist/fileSelection.js
+var import_ignore = __toESM(require_ignore(), 1);
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web
   "node_modules",
@@ -5381,20 +5381,31 @@ var DEFAULT_INCLUDE_EXTENSIONS = [
   ".nix",
   ".bzl"
 ];
+var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+var DEFAULT_IGNORE_PATTERNS = [
+  ...BUILT_IN_IGNORE_DIRS,
+  ...BUILT_IN_IGNORE_FILE_PATTERNS
+];
+
+// packages/shared/dist/codeScanner.js
+var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var DEFAULT_OPTIONS = {
   maxChunkSize: 8e3,
   // ~2000 tokens
   minChunkSize: 100,
-  ignorePatterns: [...BUILT_IN_IGNORE_DIRS, ...BUILT_IN_IGNORE_FILE_PATTERNS],
+  ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
   includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
   maxAstParseBytes: MAX_AST_PARSE_BYTES,
   protectedPaths: []
 };
-var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 
 // packages/shared/dist/indexJudge.js
 var import_ignore2 = __toESM(require_ignore(), 1);
 
+// packages/shared/dist/sourceRedactionPool.js
+var MB = 1024 * 1024;
+var LARGE_FILE_BYTES = 1 * MB;
+
 // packages/shared/dist/runtimeSigners.js
 var ttl = 10 * 6e4;