@mnemonik/shared 7.154.2 → 7.155.2

package/src/hookTrace.ts

@@ -38,6 +38,7 @@ import {
   writeSync,
 } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { open as openAsync, stat as statAsync } from 'node:fs/promises';
 import { mnemonikStateDirectory } from './protectedPaths.js';
 import { ensureWindowsPrivateDirectorySync } from './runtimeSigners.js';
 import { scrubSecrets } from './secretPatterns.js';
@@ -586,3 +587,145 @@ export function startHookTrace(options: HookTraceOptions): HookTrace {
   trace.open();
   return trace;
 }
+
+/** The trace window a hook reports its recent misses over. */
+export const HOOK_MISS_WINDOW_MS = 30 * 60 * 1000;
+/**
+ * How much of the trace file's end is read for that summary, asynchronously
+ * and once per hook process (it used to read 256 KB synchronously on every
+ * call). About a hundred hook runs: the recent ones are what the count is for.
+ */
+const HOOK_MISS_TAIL_BYTES = 64 * 1024;
+/** Sent on the main hook call: `<missed>/<total>` server calls over the window. */
+export const HOOK_MISSES_HEADER = 'x-mnemonik-hook-misses';
+
+/**
+ * How many of this host's recent calls to the server did not get an answer
+ * in time: a timeout, a connection error, a gateway or server error, a call
+ * still pending at exit, or a whole run the editor killed at its own hook
+ * timeout. Each of these is silent where it happens (the hook fails open, by
+ * design), so the main hook call carries the count to the server, and
+ * machine health tells the agent when a machine is losing memory this way
+ * (limits audit #2-#3: the hook budget chain fails silently).
+ *
+ * Reads only the end of the trace file, and never throws.
+ */
+export async function summarizeRecentHookCalls(
+  host: HookTraceHost,
+  options: { stateDir?: string; now?: number; windowMs?: number } = {}
+): Promise<{ missed: number; total: number }> {
+  // With the recorder off there is no file, which reads as nothing to report.
+  const empty = { missed: 0, total: 0 };
+  const now = options.now ?? Date.now();
+  const since = now - (options.windowMs ?? HOOK_MISS_WINDOW_MS);
+  let text: string;
+  try {
+    const file = hookTraceFile(host, options.stateDir);
+    const size = (await statAsync(file)).size;
+    const handle = await openAsync(file, 'r');
+    try {
+      const length = Math.min(size, HOOK_MISS_TAIL_BYTES);
+      const buffer = Buffer.alloc(length);
+      await handle.read(buffer, 0, length, size - length);
+      text = buffer.toString('utf8');
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return empty;
+  }
+  const started = new Map<string, number>();
+  const ended = new Set<string>();
+  let missed = 0;
+  let total = 0;
+  for (const line of text.split('\n')) {
+    let record: HookTraceRecord;
+    try {
+      record = JSON.parse(line) as HookTraceRecord;
+    } catch {
+      continue; // the first line of the tail is usually cut
+    }
+    const at = Date.parse(record.ts);
+    if (!(at >= since)) continue;
+    if (record.phase === 'start') started.set(record.id, at);
+    else if (record.phase === 'end') {
+      ended.add(record.id);
+      // One logical call per path in a run: a hedged request's aborted
+      // loser, or a first attempt whose retry was answered, is not a miss.
+      // Only a call none of whose requests got an answer is.
+      const answeredByPath = new Map<string, boolean>();
+      for (const call of record.calls ?? []) {
+        const status = call.status ?? 0;
+        const answered =
+          call.error === undefined &&
+          call.pending !== true &&
+          status > 0 &&
+          status < 500 &&
+          status !== 408 &&
+          status !== 429;
+        answeredByPath.set(call.path, (answeredByPath.get(call.path) ?? false) || answered);
+      }
+      for (const answered of answeredByPath.values()) {
+        total++;
+        if (!answered) missed++;
+      }
+    }
+  }
+  // A run with a start and no end was ended by the editor at its timeout.
+  for (const [id, at] of started) {
+    if (ended.has(id) || now - at < 60_000) continue;
+    total++;
+    missed++;
+  }
+  return { missed, total };
+}
+
+const summaries = new Map<
+  string,
+  { read: Promise<Record<string, string>>; value?: Record<string, string> }
+>();
+
+function summaryFor(
+  host: HookTraceHost,
+  options: { stateDir?: string; now?: number }
+): { read: Promise<Record<string, string>>; value?: Record<string, string> } {
+  const key = `${host}\0${options.stateDir ?? ''}\0${options.now ?? ''}`;
+  const cached = summaries.get(key);
+  if (cached) return cached;
+  const entry: { read: Promise<Record<string, string>>; value?: Record<string, string> } = {
+    read: Promise.resolve({}),
+  };
+  entry.read = summarizeRecentHookCalls(host, options).then(
+    ({ missed, total }): Record<string, string> => {
+      const value: Record<string, string> =
+        total > 0 ? { [HOOK_MISSES_HEADER]: `${missed}/${total}` } : {};
+      entry.value = value;
+      return value;
+    }
+  );
+  summaries.set(key, entry);
+  return entry;
+}
+
+/**
+ * The header the main hook call carries, or none when nothing was called
+ * recently. Read once per hook process, without blocking it.
+ */
+export function hookMissesHeaders(
+  host: HookTraceHost,
+  options: { stateDir?: string; now?: number } = {}
+): Promise<Record<string, string>> {
+  return summaryFor(host, options).read;
+}
+
+/**
+ * The header if the read has finished, else none, and never a wait: the
+ * count only feeds machine health, so it must never delay a hook request
+ * (the hook starts the read when it loads, so it is normally ready).
+ */
+export function hookMissesHeadersIfReady(
+  host: HookTraceHost,
+  options: { stateDir?: string; now?: number } = {}
+): Record<string, string> {
+  return summaryFor(host, options).value ?? {};
+}

package/src/index.ts

@@ -20,7 +20,10 @@ export {
   isGitBoundary,
   isProjectBoundary,
   rootProjectId,
-  SCANNER_MAX_DEPTH,
+  SCRUB_VERSION,
+  fileOp,
+  statTuple,
+  type FileStatTuple,
   isLinkedWorktreeCheckout,
   FIXTURE_PATH_RE,
   isFixturePath,
@@ -97,7 +100,33 @@ export {
   scrubSecrets,
   redactHighEntropyTokens,
 } from './secretPatterns.js';
-export { scrubSourceSecrets } from './sourceRedaction.js';
+export {
+  scrubSourceSecrets,
+  scrubSourceSecretsInProcess,
+  installSourceRedactor,
+  MAX_SOURCE_REDACTION_BYTES,
+  type SourceRedactor,
+  type SourceRedactionOptions,
+} from './sourceRedaction.js';
+export {
+  SourceRedactionPool,
+  redactionWorkerThread,
+  STRIKE_REASONS,
+  type RedactionChild,
+  runSourceRedactionWorker,
+  redactionHeapMb,
+  cgroupMemory,
+  containerMemoryProbe,
+  scannerMemoryProbe,
+  processCpuSeconds,
+  CPU_CEILING_SECONDS,
+  SCANNER_TOTAL_MEMORY_MB,
+  type MemoryProbe,
+  type MemoryReading,
+  type RedactionPriority,
+  LARGE_FILE_BYTES as LARGE_SOURCE_REDACTION_BYTES,
+  type SourceRedactionPoolOptions,
+} from './sourceRedactionPool.js';
 export {
   redactCredentials,
   credentialValues,

package/src/runtimeAssets.ts

@@ -0,0 +1,49 @@
+/**
+ * Never use bytes from the packaged scanner's extracted runtime unchecked
+ * (review of 26 Oct 2026). JavaScript is checked as it loads
+ * (packages/scanner/src/verifiedLoader.cts); this covers what is read with fs
+ * and then run or parsed as code: the grammar WebAssembly, web-tree-sitter's
+ * own runtime WebAssembly and the tag queries. The caller passes the buffer it
+ * is about to use, so the bytes checked are the bytes used.
+ *
+ * The packaged executable's entry point publishes the embedded assets' hashes
+ * on globalThis (and runtimeWorker.ts in each worker). Anywhere else, in
+ * development, tests and on the server, there is nothing to check against and
+ * this does nothing.
+ */
+import { createHash } from 'node:crypto';
+import { relative, sep } from 'node:path';
+
+interface VerifiedRuntime {
+  root: string;
+  hashes: ReadonlyMap<string, string>;
+}
+
+const RUNTIME = Symbol.for('mnemonik.sea.verifiedLoader');
+
+/** Bytes that are not the embedded asset they must be. */
+export class RuntimeAssetError extends Error {}
+
+function runtime(): VerifiedRuntime | undefined {
+  return (globalThis as { [RUNTIME]?: VerifiedRuntime })[RUNTIME];
+}
+
+/** Whether this process runs from the packaged executable's verified runtime. */
+export function inVerifiedRuntime(): boolean {
+  return runtime() !== undefined;
+}
+
+/**
+ * Check bytes read from `path` against the embedded asset they must equal.
+ * Throws `mnemonik_asset_integrity` when they differ and
+ * `mnemonik_unverified_asset` for a path that is not an embedded asset.
+ */
+export function verifyRuntimeAsset(path: string, bytes: Uint8Array): void {
+  const verified = runtime();
+  if (!verified) return;
+  const key = relative(verified.root, path).split(sep).join('/');
+  const expected = key.startsWith('../') || key === '..' ? undefined : verified.hashes.get(key);
+  if (!expected) throw new RuntimeAssetError(`mnemonik_unverified_asset: ${path}`);
+  if (createHash('sha256').update(bytes).digest('hex') !== expected)
+    throw new RuntimeAssetError(`mnemonik_asset_integrity: ${key}`);
+}

package/src/runtimeReader.ts

@@ -90,6 +90,63 @@ export const versionName = (v: string): string => {
   return v;
 };
 
+/**
+ * Filesystem operations one runtime verification keeps in flight. Each file
+ * costs a few round trips (lstat, open, read, close); awaited one at a time, a
+ * 2,000-file hook runtime took 6.6 s to verify (26 Oct 2026). Every check is
+ * still made, for every file.
+ */
+export const VERIFY_CONCURRENCY = 16;
+
+/** Runs `work` with at most `limit` calls in flight; nested calls must not share a limiter. */
+function limiter(limit: number) {
+  let active = 0;
+  const waiting: Array<() => void> = [];
+  return async <T>(work: () => Promise<T>): Promise<T> => {
+    if (active >= limit) await new Promise<void>((release) => waiting.push(release));
+    active += 1;
+    try {
+      return await work();
+    } finally {
+      active -= 1;
+      waiting.shift()?.();
+    }
+  };
+}
+
+/**
+ * A runtime file's bytes, read from the file that was opened: it must be a
+ * regular file (not followed through a link), this user's, with exactly the
+ * mode its manifest entry implies. POSIX only.
+ */
+async function ownedFileBytes(path: string, mode: number): Promise<Buffer> {
+  const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch((error: unknown) => {
+    // O_NOFOLLOW refuses a link with ELOOP: a link is not an owned file.
+    throw (error as NodeJS.ErrnoException).code === 'ELOOP'
+      ? new RuntimeError('permission')
+      : error;
+  });
+  try {
+    const stat = await fd.stat();
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== mode)
+      throw new RuntimeError('permission');
+    return await fd.readFile();
+  } finally {
+    await fd.close();
+  }
+}
+
+/**
+ * Waits for every promise, then throws the first rejection in order: nothing a
+ * failed verification started is still running when it reports.
+ */
+async function settleAll(work: Promise<unknown>[]): Promise<void> {
+  const failed = (await Promise.allSettled(work)).find(
+    (result): result is PromiseRejectedResult => result.status === 'rejected'
+  );
+  if (failed) throw failed.reason;
+}
+
 const statIdentity = (stat: Stats): string =>
   [stat.dev, stat.ino, stat.mode, stat.uid, stat.size, stat.mtimeMs, stat.ctimeMs].join(':');
 
@@ -237,17 +294,30 @@ export class RuntimeReader {
       );
     }
   }
+  /**
+   * `proven` (one verification's own set, POSIX only) holds directories this
+   * verification has already inspected in full: their components are not
+   * inspected again for every file beneath them, and directories proven here
+   * are added to it.
+   */
   async inspect(
     path: string,
     directory = false,
     allowMissing = false,
-    replacing = false
+    replacing = false,
+    proven?: Set<string>
   ): Promise<void> {
     const absolute = this.guardedPath(path);
     const windowsPaths: string[] = [];
-    let part = parse(absolute).root;
-    for (const name of absolute.slice(part.length).split(sep)) {
+    const remembered = process.platform === 'win32' ? undefined : proven;
+    const checkedDirectories: string[] = [];
+    // Directories proven by this verification are skipped; when the parent is
+    // proven, so is every directory above it.
+    const parent = dirname(absolute);
+    let part = remembered?.has(parent) ? parent : parse(absolute).root;
+    for (const name of absolute.slice(part.length).split(sep).filter(Boolean)) {
       part = join(part, name);
+      if (part !== absolute && remembered?.has(part)) continue;
       const stat = await lstat(part).catch((e) => {
         if (allowMissing && missing(e)) return null;
         throw e;
@@ -295,7 +365,9 @@ export class RuntimeReader {
         windowsPaths.push(part);
       } else if (stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
         throw new RuntimeError('permission');
+      if (stat.isDirectory()) checkedDirectories.push(part);
     }
+    if (remembered) for (const checked of checkedDirectories) remembered.add(checked);
     await this.audit(windowsPaths);
     for (const part of windowsPaths) {
       const verdict = this.windowsAudit.get(part)?.verdict;
@@ -321,8 +393,8 @@ export class RuntimeReader {
     this.windowsAudit.delete(absolute);
     this.windowsStats.delete(absolute);
   }
-  async bytes(path: string): Promise<Buffer> {
-    await this.inspect(path);
+  async bytes(path: string, proven?: Set<string>): Promise<Buffer> {
+    await this.inspect(path, false, false, false, proven);
     const fd = await open(
       path,
       constants.O_RDONLY | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW)
@@ -417,25 +489,41 @@ export class RuntimeReader {
       throw new RuntimeError('unsigned');
     if (process.platform === 'win32')
       await this.audit(Object.keys(m.files).map((name) => join(directory, safePath(name))));
+    // Every directory and file is inspected (type, owner, private mode) and
+    // every file is read and hashed, as before; up to VERIFY_CONCURRENCY at a
+    // time, and each directory's own components only once.
     const actual: string[] = [];
+    const proven = new Set<string>();
+    // Windows keeps one at a time: its ACL audit shares caches across calls.
+    const limit = limiter(process.platform === 'win32' ? 1 : VERIFY_CONCURRENCY);
     const walk = async (dir: string, prefix = ''): Promise<void> => {
-      await this.inspect(dir, true);
-      for (const name of await readdir(dir)) {
-        const key = prefix + name;
-        if (!prefix && name === 'manifest.json') continue;
-        const path = join(dir, name);
-        if ((await lstat(path)).isDirectory()) await walk(path, key + '/');
-        else {
-          await this.inspect(path);
-          actual.push(key);
-        }
-      }
+      const entries = await limit(async () => {
+        await this.inspect(dir, true, false, false, proven);
+        return readdir(dir, { withFileTypes: true });
+      });
+      await settleAll(
+        entries.map(async (entry) => {
+          const key = prefix + entry.name;
+          if (!prefix && entry.name === 'manifest.json') return;
+          const path = join(dir, entry.name);
+          if (entry.isDirectory()) await walk(path, key + '/');
+          else {
+            // POSIX: a link or anything else that is not a regular file is
+            // refused here, and every listed file's type, owner and exact mode
+            // are checked on the file itself when it is read below. Windows
+            // inspects each file for its ACL audit.
+            if (process.platform === 'win32')
+              await limit(() => this.inspect(path, false, false, false, proven));
+            else if (!entry.isFile()) throw new RuntimeError('permission');
+            actual.push(key);
+          }
+        })
+      );
     };
     await walk(directory);
     if (actual.sort().join('\n') !== Object.keys(m.files).sort().join('\n'))
       throw new RuntimeError('digest_mismatch');
-    let total = 0;
-    for (const [name, expected] of Object.entries(m.files)) {
+    for (const expected of Object.values(m.files))
       if (
         !expected ||
         !/^[a-f0-9]{64}$/.test(expected.sha256) ||
@@ -444,17 +532,21 @@ export class RuntimeReader {
         typeof expected.executable !== 'boolean'
       )
         throw new RuntimeError('digest_mismatch');
-      const path = join(directory, safePath(name));
-      const contents = await this.bytes(path);
-      if (hash(contents) !== expected.sha256 || contents.length !== expected.size)
-        throw new RuntimeError('digest_mismatch');
-      if (
-        process.platform !== 'win32' &&
-        ((await lstat(path)).mode & 0o777) !== (expected.executable ? 0o700 : 0o600)
+    let total = 0;
+    await settleAll(
+      Object.entries(m.files).map(([name, expected]) =>
+        limit(async () => {
+          const path = join(directory, safePath(name));
+          const contents =
+            process.platform === 'win32'
+              ? await this.bytes(path, proven)
+              : await ownedFileBytes(path, expected.executable ? 0o700 : 0o600);
+          if (hash(contents) !== expected.sha256 || contents.length !== expected.size)
+            throw new RuntimeError('digest_mismatch');
+          total += contents.length;
+        })
       )
-        throw new RuntimeError('permission');
-      total += contents.length;
-    }
+    );
     if (total !== m.totalSize) throw new RuntimeError('digest_mismatch');
     if (m.signer) {
       const signer =

package/src/sourceRedaction.ts

@@ -2,7 +2,6 @@ import { parseVueSource, walkVueTemplate, VUE_FIDELITY_MARKER } from './vueSourc
 import { basename, extname } from 'node:path';
 import { Parser, type Node, type Tree } from 'web-tree-sitter';
 import { loadGrammar, objcppSyntaxIssue, type AstLanguageId } from './ast/grammars.js';
-import { MAX_AST_PARSE_BYTES } from './ast/astChunker.js';
 import { commandLineCredentialRanges, redactCredentials } from './redactCredentials.js';
 import {
   redactHighEntropyTokens,
@@ -15,8 +14,52 @@ function scrubPayload(text: string): string {
   return redactCredentials(scrubSecrets(text), { commandLineOnly: true }).text;
 }
 
+/**
+ * The largest source redacted with its syntax tree: the scanner's own file
+ * ceiling (MAX_SCANNED_FILE_BYTES, 10 MB; repeated here because codeScanner.ts
+ * imports this module). It was 2 MiB, sized from "the largest file in this
+ * repository", and above it every file took the text fallback: PowerShell,
+ * CMake, Groovy, Nix, Terraform and the bundled languages were stamped
+ * "source-fidelity-unavailable", so connected code refused every such file
+ * over 2 MiB, and other languages could keep structural [REDACTED] the
+ * extractors refuse (streams F1/F2, 25 October 2026). Memory for a large
+ * parse is bounded by running it in a child process sized from the file
+ * (installSourceRedactor below; sourceRedactionPool.ts), not by refusing it.
+ */
+export const MAX_SOURCE_REDACTION_BYTES = 10 * 1024 * 1024;
+
+/**
+ * Where a process sends source it should not parse in its own memory: the
+ * server sends Swift and every file of a megabyte or more to a Liftoff-only
+ * child sized from the file; the scanner sends large files to its own
+ * child. Unset (tests, small tools), everything is redacted in process.
+ */
+export interface SourceRedactionOptions {
+  /** 'interactive' when an agent is waiting on this file (file_push). */
+  priority?: 'interactive' | 'background';
+}
+export interface SourceRedactor {
+  routes(filePath: string, bytes: number): boolean;
+  redact(text: string, filePath: string, options?: SourceRedactionOptions): Promise<string>;
+}
+let outOfProcess: SourceRedactor | null = null;
+export function installSourceRedactor(redactor: SourceRedactor | null): void {
+  outOfProcess = redactor;
+}
+
 /** Source syntax stays executable; unsupported or incomplete input uses the conservative scrubber. */
-export async function scrubSourceSecrets(text: string, filePath: string): Promise<string> {
+export async function scrubSourceSecrets(
+  text: string,
+  filePath: string,
+  options?: SourceRedactionOptions
+): Promise<string> {
+  if (outOfProcess && text && outOfProcess.routes(filePath, Buffer.byteLength(text, 'utf8')))
+    return outOfProcess.redact(text, filePath, options);
+  return scrubSourceSecretsInProcess(text, filePath);
+}
+
+/** The redaction itself, in this process. The out-of-process worker calls this. */
+export async function scrubSourceSecretsInProcess(text: string, filePath: string): Promise<string> {
   const extension = extname(filePath).toLowerCase();
   if (extension === '.vue') return scrubVueSource(text);
   if (extension === '.svelte') return scrubSvelteSource(text);
@@ -136,7 +179,7 @@ export async function scrubSourceSecrets(text: string, filePath: string): Promis
       ? marker + clean
       : clean;
   };
-  if (!text || !language || Buffer.byteLength(text, 'utf8') > MAX_AST_PARSE_BYTES) {
+  if (!text || !language || Buffer.byteLength(text, 'utf8') > MAX_SOURCE_REDACTION_BYTES) {
     return fallback();
   }
   let parser: Parser | undefined;
@@ -1833,6 +1876,32 @@ function redactNode(node: Node, sensitive = false): string {
 }
 
 /** Sanitize parser-owned payload spans; no SFC boundary is inferred from text matching. */
+/**
+ * Apply replacement spans to `text` in one pass, or null when two overlap
+ * (or a span is malformed).
+ * The result equals applying them one at a time from the last start to the
+ * first (spans that start together: the one added later lands first), which
+ * is what the Vue scrubber did with a slice-and-concatenate per edit; that
+ * copied the whole file for every edit, about 40 s for a 1 MB component.
+ */
+export function applySpanEdits(
+  text: string,
+  edits: ReadonlyArray<{ start: number; end: number; clean: string }>
+): string | null {
+  // Stable sort, then reversed: ascending start, and among equal starts the
+  // later-added edit first, exactly as the one-at-a-time order placed them.
+  const ordered = [...edits].sort((a, b) => b.start - a.start).reverse();
+  const pieces: string[] = [];
+  let offset = 0;
+  for (const e of ordered) {
+    if (e.start < offset || e.end < e.start || e.end > text.length) return null;
+    pieces.push(text.slice(offset, e.start), e.clean);
+    offset = e.end;
+  }
+  pieces.push(text.slice(offset));
+  return pieces.join('');
+}
+
 async function scrubVueSource(text: string): Promise<string> {
   if (!text) return text;
   const parsed = await parseVueSource(text, true);
@@ -1973,14 +2042,8 @@ async function scrubVueSource(text: string): Promise<string> {
     const cleanTail = scrubPayload(tail);
     if (cleanTail !== tail) faithful = false;
     edit(gapStart, text.length, cleanTail);
-    edits.sort((a, b) => b.start - a.start);
-    let clean = text;
-    let boundary = text.length;
-    for (const e of edits) {
-      if (e.end > boundary) return fallback();
-      clean = clean.slice(0, e.start) + e.clean + clean.slice(e.end);
-      boundary = e.start;
-    }
+    const clean = applySpanEdits(text, edits);
+    if (clean === null) return fallback();
     if ('reason' in (await parseVueSource(clean))) faithful = false;
     return faithful || clean.startsWith(VUE_FIDELITY_MARKER) ? clean : VUE_FIDELITY_MARKER + clean;
   } catch {
@@ -1996,29 +2059,33 @@ async function scrubSvelteSource(text: string): Promise<string> {
   const fallback = (): string => (text.startsWith(marker) ? '' : marker) + scrubPayload(text);
   if (!text) return text;
   if (text.includes('mnemonik:svelte-source-fidelity-unavailable')) return fallback();
-  if (Buffer.byteLength(text, 'utf8') > MAX_AST_PARSE_BYTES) return fallback();
+  if (Buffer.byteLength(text, 'utf8') > MAX_SOURCE_REDACTION_BYTES) return fallback();
   let parser: Parser | undefined;
   try {
-    const deadline = performance.now() + 4_000;
+    // No clock and no node count decide this file: both refused large
+    // components outright (a 4 s deadline and 200,000 nodes). Memory is
+    // bounded by the process the parse runs in (installSourceRedactor).
     const { parse } = await import('svelte/compiler');
     const ast = parse(text, { modern: true });
     const edits: Array<{ start: number; end: number; clean: string }> = [];
     let faithful = true;
-    parser = new Parser();
+    // Grammars first: loading one initializes tree-sitter, and a Parser
+    // constructed before that throws. In a fresh process (a redaction child,
+    // or a scanner whose first file is a component) that made every Svelte
+    // file take the unfaithful fallback.
     const js = await loadGrammar('javascript');
     const ts = await loadGrammar('typescript');
     if ('unavailable' in js || 'unavailable' in ts) return fallback();
+    parser = new Parser();
     parser.setLanguage(js.ok.language);
     const activeParser = parser;
     const syntax = (source: string, expression = false, sensitive = false): string => {
       const prefix = expression ? `const ${sensitive ? 'password' : '__mnemonik_svelte'} = (` : '';
       const suffix = expression ? '\n);' : '';
       const full = prefix + source + suffix;
-      const tree = activeParser.parse(full, null, {
-        progressCallback: () => performance.now() > deadline,
-      });
+      const tree = activeParser.parse(full);
       try {
-        if (!tree || tree.rootNode.hasError || tree.rootNode.descendantCount > 200_000) {
+        if (!tree || tree.rootNode.hasError) {
           faithful = false;
           return sensitive ? literalPayload(source, true) : scrubPayload(source);
         }
@@ -2062,9 +2129,7 @@ async function scrubSvelteSource(text: string): Promise<string> {
     const pending: Array<{ value: unknown; sensitive: boolean }> = [
       { value: ast.fragment, sensitive: false },
     ];
-    let count = 0;
     while (pending.length) {
-      if (++count > 200_000 || performance.now() > deadline) return fallback();
       const entry = pending.pop();
       if (!entry || !entry.value || typeof entry.value !== 'object') continue;
       if (Array.isArray(entry.value)) {