@moda-ai/cli 1.55.12 → 1.55.14

package/dist/{cli-m0fa54ny.js → cli-k9nae6t9.js}

@@ -10304,7 +10304,7 @@ var require_typescript = __commonJS((exports, module) => {
       identity: () => identity2,
       identitySourceMapConsumer: () => identitySourceMapConsumer,
       ignoreSourceNewlines: () => ignoreSourceNewlines,
-      ignoredPaths: () => ignoredPaths,
+      ignoredPaths: () => ignoredPaths2,
       importFromModuleSpecifier: () => importFromModuleSpecifier,
       importSyntaxAffectsModuleResolution: () => importSyntaxAffectsModuleResolution,
       indexOfAnyCharCode: () => indexOfAnyCharCode,
@@ -16689,7 +16689,7 @@ ${lanes.join(`
     function getFileWatcherEventKind(oldTime, newTime) {
       return oldTime === 0 ? 0 : newTime === 0 ? 2 : 1;
     }
-    var ignoredPaths = ["/node_modules/.", "/.git", "/.#"];
+    var ignoredPaths2 = ["/node_modules/.", "/.git", "/.#"];
     var curSysLog = noop;
     function sysLog(s) {
       return curSysLog(s);
@@ -16907,7 +16907,7 @@ ${lanes.join(`
         }
       }
       function isIgnoredPath(path, options) {
-        return some(ignoredPaths, (searchPath) => isInPath(path, searchPath)) || isIgnoredByWatchOptions(path, options, useCaseSensitiveFileNames2, getCurrentDirectory);
+        return some(ignoredPaths2, (searchPath) => isInPath(path, searchPath)) || isIgnoredByWatchOptions(path, options, useCaseSensitiveFileNames2, getCurrentDirectory);
       }
       function isInPath(path, searchPath) {
         if (path.includes(searchPath))
@@ -31305,7 +31305,7 @@ ${lanes.join(`
       }
     }
     function containsIgnoredPath(path) {
-      return some(ignoredPaths, (p2) => path.includes(p2));
+      return some(ignoredPaths2, (p2) => path.includes(p2));
     }
     function getContainingNodeArray(node) {
       if (!node.parent)
@@ -75258,11 +75258,11 @@ ${lanes.join(`
         const resolved = resolveStructuredTypeMembers(type);
         return !!(resolved.callSignatures.length || resolved.constructSignatures.length || resolved.members.get("bind") && isTypeSubtypeOf(type, globalFunctionType));
       }
-      function getTypeFacts(type, mask2) {
-        return getTypeFactsWorker(type, mask2) & mask2;
+      function getTypeFacts(type, mask22) {
+        return getTypeFactsWorker(type, mask22) & mask22;
       }
-      function hasTypeFacts(type, mask2) {
-        return getTypeFacts(type, mask2) !== 0;
+      function hasTypeFacts(type, mask22) {
+        return getTypeFacts(type, mask22) !== 0;
       }
       function getTypeFactsWorker(type, callerOnlyNeeds) {
         if (type.flags & (2097152 | 465829888)) {
@@ -110604,14 +110604,14 @@ ${lanes.join(`
         return factory2.createModifiersFromModifierFlags(newFlags);
       }
       function ensureModifierFlags(node) {
-        let mask2 = 131071 ^ (1 | 1024 | 16);
+        let mask22 = 131071 ^ (1 | 1024 | 16);
         let additions = needsDeclare && !isAlwaysType(node) ? 128 : 0;
         const parentIsFile = node.parent.kind === 308;
         if (!parentIsFile || isBundledEmit && parentIsFile && isExternalModule(node.parent)) {
-          mask2 ^= 128;
+          mask22 ^= 128;
           additions = 0;
         }
-        return maskModifierFlags(node, mask2, additions);
+        return maskModifierFlags(node, mask22, additions);
       }
       function transformHeritageClauses(nodes) {
         return factory2.createNodeArray(filter(map(nodes, (clause) => factory2.updateHeritageClause(clause, visitNodes2(factory2.createNodeArray(filter(clause.types, (t) => {
@@ -121243,7 +121243,7 @@ ${lanes.join(`
       if (endsWith(path, "/node_modules/.staging")) {
         return removeSuffix(path, "/.staging");
       }
-      return some(ignoredPaths, (searchPath) => path.includes(searchPath)) ? undefined : path;
+      return some(ignoredPaths2, (searchPath) => path.includes(searchPath)) ? undefined : path;
     }
     function perceivedOsRootLengthForWatching(pathComponents2, length2) {
       if (length2 <= 1)
@@ -163646,20 +163646,20 @@ ${options.prefix}` : `
       return rulesMapCache;
     }
     function getRuleActionExclusion(ruleAction) {
-      let mask2 = 0;
+      let mask22 = 0;
       if (ruleAction & 1) {
-        mask2 |= 28;
+        mask22 |= 28;
       }
       if (ruleAction & 2) {
-        mask2 |= 96;
+        mask22 |= 96;
       }
       if (ruleAction & 28) {
-        mask2 |= 28;
+        mask22 |= 28;
       }
       if (ruleAction & 96) {
-        mask2 |= 96;
+        mask22 |= 96;
       }
-      return mask2;
+      return mask22;
     }
     function createRulesMap(rules) {
       const map2 = buildMap(rules);
@@ -163704,7 +163704,7 @@ ${options.prefix}` : `
       return row * mapRowLength + column;
     }
     var maskBitSize = 5;
-    var mask = 31;
+    var mask2 = 31;
     var mapRowLength = 166 + 1;
     var RulesPosition = ((RulesPosition2) => {
       RulesPosition2[RulesPosition2["StopRulesSpecific"] = 0] = "StopRulesSpecific";
@@ -163724,15 +163724,15 @@ ${options.prefix}` : `
     function getInsertionIndex(indexBitmap, maskPosition) {
       let index = 0;
       for (let pos = 0;pos <= maskPosition; pos += maskBitSize) {
-        index += indexBitmap & mask;
+        index += indexBitmap & mask2;
         indexBitmap >>= maskBitSize;
       }
       return index;
     }
     function increaseInsertionIndex(indexBitmap, maskPosition) {
-      const value = (indexBitmap >> maskPosition & mask) + 1;
-      Debug.assert((value & mask) === value, "Adding more rules into the sub-bucket than allowed. Maximum allowed is 32 rules.");
-      return indexBitmap & ~(mask << maskPosition) | value << maskPosition;
+      const value = (indexBitmap >> maskPosition & mask2) + 1;
+      Debug.assert((value & mask2) === value, "Adding more rules into the sub-bucket than allowed. Maximum allowed is 32 rules.");
+      return indexBitmap & ~(mask2 << maskPosition) | value << maskPosition;
     }
     function createTextRangeWithKind(pos, end, kind) {
       const textRangeWithKind = { pos, end, kind };
@@ -166304,7 +166304,7 @@ ${options.prefix}` : `
       identity: () => identity2,
       identitySourceMapConsumer: () => identitySourceMapConsumer,
       ignoreSourceNewlines: () => ignoreSourceNewlines,
-      ignoredPaths: () => ignoredPaths,
+      ignoredPaths: () => ignoredPaths2,
       importFromModuleSpecifier: () => importFromModuleSpecifier,
       importSyntaxAffectsModuleResolution: () => importSyntaxAffectsModuleResolution,
       indexOfAnyCharCode: () => indexOfAnyCharCode,
@@ -177901,7 +177901,7 @@ import {
   lstatSync as lstatSync10,
   mkdtempSync as mkdtempSync2,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync16,
   readdirSync as readdirSync4,
   writeFileSync as writeFileSync6,
   rmSync as rmSync4
@@ -180097,7 +180097,7 @@ async function remoteAnalyzeFetch(url, apiKey, init, timeoutMs) {
 
 // src/harness-register/register.ts
 import * as fs from "node:fs";
-import { mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync3 } from "node:fs";
+import { mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync3 } from "node:fs";
 import { Readable as Readable2 } from "node:stream";
 import { tmpdir } from "node:os";
 import { basename as basename4, join as join8, resolve as resolve4 } from "node:path";
@@ -180105,7 +180105,7 @@ import { basename as basename4, join as join8, resolve as resolve4 } from "node:
 // src/harness-register/collect-adapter.ts
 import { createHash as createHash4 } from "node:crypto";
 import { execFileSync } from "node:child_process";
-import { copyFileSync, createReadStream, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync4, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { copyFileSync, createReadStream, existsSync as existsSync6, mkdirSync as mkdirSync4, realpathSync as realpathSync4, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname5, join as join7 } from "node:path";
 
 // ../../packages/harness-bundle/src/contract.ts
@@ -185388,15 +185388,16 @@ var CACHE_FILE_PATTERNS = [
   [/^\.yarn-integrity$/, "yarn_integrity"],
   [/^install-state\.gz$/, "yarn_install_state"]
 ];
-var ENV_EXAMPLE_SUFFIXES = new Set(["example", "sample", "template", "dist", "defaults.example", "tpl"]);
+var ENV_TEMPLATE_WORDS = new Set(["example", "examples", "sample", "template", "dist", "tpl", "default", "defaults"]);
 function isEnvExampleName(name) {
   const lower = name.toLowerCase();
-  for (const prefix of [".env.", ".dev.vars.", "env."]) {
-    if (lower.startsWith(prefix) && ENV_EXAMPLE_SUFFIXES.has(lower.slice(prefix.length)))
-      return true;
-  }
-  return /^(example|sample|template)\.env$/.test(lower) || /\.env\.(example|sample|template)$/.test(lower);
+  const base = /^(\.env|\.dev\.vars|env)\./.exec(lower);
+  if (base)
+    return lower.slice(base[0].length).split(".").some((part) => ENV_TEMPLATE_WORDS.has(part));
+  const named = /^(.+)\.env$/.exec(lower);
+  return named !== null && named[1].split(".").some((part) => ENV_TEMPLATE_WORDS.has(part));
 }
+var ENV_VALUE_FILE_RULES = new Set(["dotenv", "direnv", "wrangler_dev_vars"]);
 function secretPathRule(path) {
   const name = basenameOf(path);
   const lower = name.toLowerCase();
@@ -185417,7 +185418,7 @@ function secretPathRule(path) {
     return "key_material_file";
   if (/^id_(rsa|dsa|ecdsa|ed25519)/.test(lower))
     return "ssh_key";
-  if (lower === "credentials.json" || lower === "credentials" || lower === "credentials.yml" || lower === "credentials.yaml") {
+  if (/^credentials(\.(json|ya?ml|toml|conf|cfg|ini|txt|env|properties|xml|csv))?$/.test(lower) || /\.credentials$/.test(lower)) {
     return "credentials_file";
   }
   if (/(^|\/)\.aws\/(credentials|config)$/.test(lowerPath))
@@ -185453,34 +185454,58 @@ function secretPathRule(path) {
     return "secrets_file";
   return null;
 }
-function registryAuthRule(path, text) {
+var PROVIDER_MARKER = /^(?:sk-ant-(?:api|admin|oat)\d{2}-|sk-or-v1-|sk-(?:proj|svcacct|admin)-|sk-|(?:sk|rk)_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|xox[abposr]-|whsec_|gsk_|hf_|xai-|npm_|pypi-|do[opr]_v1_|shp(?:at|ca|pa|ss)_|moda_(?:sk|ct)_)/;
+function registryAuthFindings(path, text) {
   const name = basenameOf(path).toLowerCase();
   const literal = (value) => value.trim() !== "" && !/^["']?\$\{?[A-Za-z_]/.test(value.trim());
-  if (name === ".npmrc") {
-    for (const match of text.matchAll(/(?:_authToken|_auth|_password)\s*=\s*(.*)/g)) {
-      if (literal(match[1] ?? ""))
-        return "npmrc_auth_token";
-    }
-  }
-  if (name === ".yarnrc.yml" || name === ".yarnrc") {
-    for (const match of text.matchAll(/npmAuth(?:Token|Ident)\s*:\s*(.*)/g)) {
-      if (literal(match[1] ?? ""))
-        return "yarnrc_auth_token";
-    }
-  }
-  if (name === ".pypirc") {
-    for (const match of text.matchAll(/^\s*password\s*[=:]\s*(.*)$/gm)) {
-      if (literal(match[1] ?? ""))
-        return "pypirc_password";
+  const out = [];
+  const scan = (pattern, rule2, check, yaml = false) => {
+    for (const match of text.matchAll(pattern)) {
+      if (!check(match[1] ?? ""))
+        continue;
+      const [from] = match.indices[1];
+      let raw = match[1];
+      if (yaml) {
+        const quoted = /^\s*(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\n]|'')*')/.exec(raw);
+        raw = quoted ? quoted[0] : raw.replace(/\s+#.*$/, "");
+      }
+      const lead = raw.length - raw.replace(/^[\s"']+/, "").length;
+      const value = raw.replace(/[\s"']+$/, "");
+      if (value.length <= lead)
+        continue;
+      out.push({ rule: rule2, line: 0, start: from + lead, end: from + value.length });
     }
-  }
+  };
+  if (name === ".npmrc")
+    scan(/(?:_authToken|_auth|_password)\s*=\s*(.*)/dg, "npmrc_auth_token", literal);
+  if (name === ".yarnrc.yml" || name === ".yarnrc")
+    scan(/npmAuth(?:Token|Ident)\s*:\s*(.*)/dg, "yarnrc_auth_token", literal, name === ".yarnrc.yml");
+  if (name === ".pypirc")
+    scan(/^\s*password\s*[=:]\s*(.*)$/dgm, "pypirc_password", literal);
   if (name === "pip.conf" || name === "pip.ini" || name === "poetry.toml" || name === "bunfig.toml" || name === ".condarc") {
-    if (/https?:\/\/[^\s/:@]+:[^\s/@$]+@/.test(text))
-      return "registry_url_credentials";
+    scan(/https?:\/\/[^\s/:@]+:([^\s/?#]+)@[^\s/?#@]+/dg, "registry_url_credentials", (value) => !value.startsWith("$"));
+  }
+  if (name === "settings.xml")
+    scan(/<password>(?!\s*\$\{)([^<]+)<\/password>/dg, "maven_settings_password", () => true);
+  out.sort((a, b) => a.start - b.start);
+  let line = 1;
+  let cursor = 0;
+  for (const finding of out) {
+    for (;cursor < finding.start; cursor += 1)
+      if (text.charCodeAt(cursor) === 10)
+        line += 1;
+    finding.line = line;
   }
-  if (name === "settings.xml" && /<password>(?!\s*\$\{)[^<]+<\/password>/.test(text))
-    return "maven_settings_password";
-  return null;
+  return out;
+}
+function registryAuthRule(path, text) {
+  return registryAuthFindings(path, text)[0]?.rule ?? null;
+}
+var LOG_DIRS = new Set(["logs", ".logs"]);
+function runtimeLogRule(path, status) {
+  if (status === "tracked")
+    return null;
+  return /\.log(\.\d+)?$/i.test(basenameOf(path)) ? { reason: "regenerable_output", rule: "runtime_log" } : null;
 }
 function dirRule(dirPath, status) {
   const name = basenameOf(dirPath);
@@ -185491,6 +185516,8 @@ function dirRule(dirPath, status) {
   }
   if (status === "tracked")
     return null;
+  if (LOG_DIRS.has(name))
+    return { reason: "regenerable_output", rule: "runtime_log" };
   if (DEPENDENCY_DIRS.has(name) || DEPENDENCY_DIR_SUFFIXES.some((s) => hasSuffix(dirPath, s))) {
     return { reason: "dependency_install", rule: name };
   }
@@ -186222,12 +186249,21 @@ class EnvCollector {
     }
   }
   scanDotenv(path, lines) {
+    let open = null;
     lines.forEach((line, index) => {
+      if (open) {
+        if (closesQuote(line, open, 0))
+          open = null;
+        return;
+      }
       const m = line.match(new RegExp(`^\\s*(?:export\\s+)?(${NAME})\\s*=\\s*(.*)$`));
       if (!m)
         return;
-      const value = stripInlineValue(m[2] ?? "");
-      this.add(m[1], `${path}:${index + 1}`, value !== "");
+      this.add(m[1], `${path}:${index + 1}`, false);
+      const value = m[2] ?? "";
+      const quote = value[0];
+      if ((quote === '"' || quote === "'" || quote === "`") && !closesQuote(value, quote, 1))
+        open = quote;
     });
   }
   scanDestructuring(path, line, lineNo) {
@@ -186468,6 +186504,15 @@ function shellExpandable(line) {
   }
   return out;
 }
+function closesQuote(text, quote, from) {
+  for (let i = from;i < text.length; i += 1) {
+    if (text[i] === "\\" && quote !== "'")
+      i += 1;
+    else if (text[i] === quote)
+      return true;
+  }
+  return false;
+}
 function stripInlineValue(raw) {
   let value = raw.trim();
   if (/^["']/.test(value)) {
@@ -186587,6 +186632,24 @@ function lsFiles(root, args) {
     throw new Error(`git ls-files ${args.join(" ")} failed in ${root}`);
   return result.stdout.split("\x00").filter((entry) => entry !== "");
 }
+function ignoredPaths(root) {
+  const result = git(root, ["status", "--porcelain=v1", "-z", "--ignored=matching", "--untracked-files=all"]);
+  if (!result.ok)
+    throw new Error(`git status --ignored failed in ${root}`);
+  const out = [];
+  const fields = result.stdout.split("\x00");
+  for (let i = 0;i < fields.length; i += 1) {
+    const field = fields[i];
+    if (field.length < 4)
+      continue;
+    const code = field.slice(0, 2);
+    if (code === "!!")
+      out.push(field.slice(3));
+    else if (code[0] === "R" || code[0] === "C")
+      i += 1;
+  }
+  return out;
+}
 function gitMetadata(root) {
   const commit = git(root, ["rev-parse", "--verify", "-q", "HEAD"]);
   const branch = git(root, ["symbolic-ref", "--short", "-q", "HEAD"]);
@@ -186877,7 +186940,6 @@ function shannonEntropy(value) {
   return entropy;
 }
 var notPlaceholder = (value) => !looksLikePlaceholder(value);
-var LOCAL_HOSTS = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|::1|host\.docker\.internal|[a-z0-9_-]+)(:\d+)?$/i;
 var WEAK_PASSWORDS = new Set([
   "password",
   "pass",
@@ -186903,9 +186965,20 @@ var WEAK_PASSWORDS = new Set([
 var SECRET_RULES = [
   {
     name: "private_key_block",
-    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?:\r?\n|(?:\\r)?\\n)[A-Za-z][A-Za-z0-9-]*:[^\r\n\\]*)*(?:\\n|\\r|\s)+([A-Za-z0-9+/=]{32,})/g,
+    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?:\r?\n|(?:\\r)?\\n)[A-Za-z][A-Za-z0-9-]*:[^\r\n\\]*)*(?:\\n|\\r|\s)+([A-Za-z0-9+/=]{32,8192})/g,
     group: 1,
-    accept: notPlaceholder
+    accept: notPlaceholder,
+    withholdFile: true
+  },
+  {
+    name: "private_key_block",
+    pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----([^-]{1,8192}?)-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g,
+    group: 1,
+    accept: (body) => {
+      const compact = body.replace(/\\[rn]|\s/g, "");
+      return compact.length >= 16 && /^[A-Za-z0-9+/=:,-]+$/.test(compact) && !/x{4,}|X{4,}|\.\.\./.test(compact);
+    },
+    withholdFile: true
   },
   {
     name: "aws_access_key_id",
@@ -186919,57 +186992,60 @@ var SECRET_RULES = [
     group: 1,
     accept: (value) => !/EXAMPLE/.test(value) && notPlaceholder(value)
   },
-  { name: "anthropic_api_key", pattern: /\bsk-ant-(?:api|admin|oat)\d{2}-([A-Za-z0-9_-]{32,})/g, group: 1, accept: (v) => randomLooking(v, 32) },
-  { name: "openrouter_api_key", pattern: /\bsk-or-v1-[a-f0-9]{48,}\b/g, accept: notPlaceholder },
+  { name: "anthropic_api_key", pattern: /\bsk-ant-(?:api|admin|oat)\d{2}-([A-Za-z0-9_-]{32,512})(?![A-Za-z0-9_-])/g, group: 1, accept: (v) => randomLooking(v, 32) },
+  { name: "openrouter_api_key", pattern: /\bsk-or-v1-[a-f0-9]{48,512}\b/g, accept: notPlaceholder },
   {
     name: "openai_api_key",
-    pattern: /\bsk-(?!ant-|or-)(?:proj-|svcacct-|admin-|None-)?([A-Za-z0-9_-]{32,})/g,
+    pattern: /\bsk-(?!ant-|or-)(?:proj-|svcacct-|admin-|None-)?([A-Za-z0-9_-]{32,512})(?![A-Za-z0-9_-])/g,
     group: 1,
     accept: (value) => randomLooking(value, 32)
   },
-  { name: "groq_api_key", pattern: /\bgsk_[A-Za-z0-9]{40,}\b/g, accept: notPlaceholder },
+  { name: "groq_api_key", pattern: /\bgsk_[A-Za-z0-9]{40,512}\b/g, accept: notPlaceholder },
   { name: "google_api_key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g, accept: notPlaceholder },
-  { name: "huggingface_token", pattern: /\bhf_[A-Za-z0-9]{30,}\b/g, accept: notPlaceholder },
-  { name: "xai_api_key", pattern: /\bxai-[A-Za-z0-9]{40,}\b/g, accept: notPlaceholder },
-  { name: "github_token", pattern: /\b(?:gh[pousr]_([A-Za-z0-9]{36,})|github_pat_([A-Za-z0-9_]{60,}))\b/g, accept: (_v, m) => randomLooking(m[1] ?? m[2] ?? "", 36) },
-  { name: "gitlab_token", pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, accept: notPlaceholder },
-  { name: "slack_token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}/g, accept: notPlaceholder },
+  { name: "huggingface_token", pattern: /\bhf_[A-Za-z0-9]{30,512}\b/g, accept: notPlaceholder },
+  { name: "xai_api_key", pattern: /\bxai-[A-Za-z0-9]{40,512}\b/g, accept: notPlaceholder },
+  { name: "github_token", pattern: /\b(?:gh[pousr]_([A-Za-z0-9]{36,512})|github_pat_([A-Za-z0-9_]{60,512}))\b/g, accept: (_v, m) => randomLooking(m[1] ?? m[2] ?? "", 36) },
+  { name: "gitlab_token", pattern: /\bglpat-[A-Za-z0-9_-]{20,512}\b/g, accept: notPlaceholder },
+  { name: "slack_token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,512}(?![A-Za-z0-9-])/g, accept: notPlaceholder },
   {
     name: "slack_webhook",
-    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{16,}/g,
+    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{16,512}/g,
     accept: notPlaceholder
   },
-  { name: "stripe_secret_key", pattern: /\b(?:sk|rk)_(?:live|test)_([A-Za-z0-9]{20,})\b/g, group: 1, accept: (v) => randomLooking(v, 20) },
-  { name: "stripe_webhook_secret", pattern: /\bwhsec_[A-Za-z0-9]{24,}\b/g, accept: notPlaceholder },
+  { name: "stripe_secret_key", pattern: /\b(?:sk|rk)_(?:live|test)_([A-Za-z0-9]{20,512})\b/g, group: 1, accept: (v) => randomLooking(v, 20) },
+  { name: "stripe_webhook_secret", pattern: /\bwhsec_[A-Za-z0-9]{24,512}\b/g, accept: notPlaceholder },
   { name: "sendgrid_api_key", pattern: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, accept: notPlaceholder },
   { name: "npm_token", pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, accept: notPlaceholder },
-  { name: "pypi_token", pattern: /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}/g, accept: notPlaceholder },
+  { name: "pypi_token", pattern: /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,512}(?![A-Za-z0-9_-])/g, accept: notPlaceholder },
   { name: "digitalocean_token", pattern: /\bdo[opr]_v1_[a-f0-9]{64}\b/g, accept: notPlaceholder },
   { name: "shopify_token", pattern: /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/g, accept: notPlaceholder },
   { name: "databricks_token", pattern: /\bdapi[a-f0-9]{32}\b/g, accept: notPlaceholder },
-  { name: "moda_api_key", pattern: /\bmoda_(?:sk|ct)_([A-Za-z0-9_-]{32,})/g, group: 1, accept: (v) => randomLooking(v, 32) },
+  { name: "moda_api_key", pattern: /\bmoda_(?:sk|ct)_([A-Za-z0-9_-]{32,512})(?![A-Za-z0-9_-])/g, group: 1, accept: (v) => randomLooking(v, 32) },
   {
     name: "jwt",
-    pattern: /\b(eyJ[A-Za-z0-9_-]{10,})\.eyJ[A-Za-z0-9_-]{10,}\.([A-Za-z0-9_-]{16,})/g,
+    pattern: /\b(eyJ[A-Za-z0-9_-]{10,1024})\.eyJ[A-Za-z0-9_-]{10,65536}\.([A-Za-z0-9_-]{16,1024})(?![A-Za-z0-9_-])/g,
     accept: (_v, m) => isJwtHeader(m[1] ?? "") && !KNOWN_SAMPLE_JWT_SIGNATURES.has(m[2] ?? "") && notPlaceholder(m[2] ?? "")
   },
+  {
+    name: "bearer_token",
+    pattern: /\bBearer[ \t]+([A-Za-z0-9._~+/=-]{20,65536})(?![A-Za-z0-9._~+/=-])/g,
+    group: 1,
+    accept: (value) => !looksLikePlaceholder(value) && /[0-9]/.test(value) && /[A-Za-z]/.test(value)
+  },
   {
     name: "url_embedded_credentials",
-    pattern: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?|mssql|sqlserver|clickhouse|https?):\/\/([^:\s/@'"]+):([^@\s/'"]{3,})@([^/\s'"?#]+)/g,
+    pattern: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?|mssql|sqlserver|clickhouse|https?):\/\/([^:\s/@'"]{1,256}):([^\s/?#'"]{3,65536})@([^/\s'"?#@]+)/g,
     group: 2,
-    accept: (password, match) => {
-      const host = match[3] ?? "";
+    accept: (password) => {
       if (WEAK_PASSWORDS.has(password.toLowerCase()))
         return false;
-      if (looksLikePlaceholder(password) || /^[$%:]/.test(password))
-        return false;
-      return !LOCAL_HOSTS.test(host);
+      return !looksLikePlaceholder(password) && !/^[$%:{]/.test(password);
     }
   },
   {
     name: "generic_secret_assignment",
     heuristic: true,
-    pattern: /\b([A-Za-z][A-Za-z0-9_-]*)["']?\s*[:=]\s*(["'`])([A-Za-z0-9+/=_\-.~]{16,})\2/g,
+    pattern: /\b([A-Za-z][A-Za-z0-9_-]{0,127})["']?[ \t]*[:=][ \t]*(["'`])([A-Za-z0-9+/=_\-.~]{16,})\2/g,
     group: 3,
     accept: (value, match) => isSecretName(match[1] ?? "") && isSecretLikeValue(value)
   },
@@ -186977,7 +187053,7 @@ var SECRET_RULES = [
     name: "generic_secret_assignment",
     heuristic: true,
     configOnly: true,
-    pattern: /^\s*(?:export\s+)?([A-Za-z][A-Za-z0-9_-]*)\s*[:=]\s*([A-Za-z0-9+/=_\-.~]{16,})\s*(?:#.*)?$/gm,
+    pattern: /^[ \t]*(?:export[ \t]+)?([A-Za-z][A-Za-z0-9_-]{0,127})[ \t]*[:=][ \t]*([A-Za-z0-9+/=_\-.~]{16,512})[ \t]*(?:#.*)?$/gm,
     group: 2,
     accept: (value, match) => isSecretName(match[1] ?? "") && isSecretLikeValue(value)
   }
@@ -187035,6 +187111,842 @@ function scanForSecrets(text, opts) {
   }
   return null;
 }
+var INDEXED = new Map;
+function withIndices(pattern) {
+  let indexed = INDEXED.get(pattern);
+  if (!indexed) {
+    indexed = new RegExp(pattern.source, `${pattern.flags.replace("d", "")}d`);
+    INDEXED.set(pattern, indexed);
+  }
+  return indexed;
+}
+function findSecretSpans(text, opts) {
+  const spans = [];
+  for (const rule2 of SECRET_RULES) {
+    if (rule2.heuristic && !opts.heuristics)
+      continue;
+    if (rule2.configOnly && !opts.config)
+      continue;
+    const pattern = withIndices(rule2.pattern);
+    pattern.lastIndex = 0;
+    for (const match of text.matchAll(pattern)) {
+      const group = rule2.group ?? 0;
+      const value = match[group] ?? "";
+      if (rule2.accept && !rule2.accept(value, match))
+        continue;
+      const range = match.indices?.[group] ?? [match.index ?? 0, (match.index ?? 0) + match[0].length];
+      spans.push({ rule: rule2.name, start: range[0], end: range[1], withholdFile: rule2.withholdFile === true });
+    }
+  }
+  return spans;
+}
+
+// ../../packages/harness-bundle/src/collect/redact.ts
+var CONFIG_EXT = /\.(ya?ml|toml|json|jsonc|json5|properties|ini|cfg|conf|env|tfvars|hcl|cnf|nix)$/i;
+var CONFIG_NAMES = /^(\.npmrc|\.yarnrc|\.yarnrc\.yml|\.pypirc|pip\.conf|pip\.ini|\.condarc|\.netrc|\.envrc|\.dev\.vars.*|\.env.*|[^/]*\.env|dockerfile.*|containerfile.*|.*\.dockerfile|procfile|settings\.xml)$/i;
+function isConfigLike(path) {
+  const name = basenameOf(path);
+  return CONFIG_EXT.test(name) || CONFIG_NAMES.test(name);
+}
+var CREDENTIAL_WORDS = new Set([
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "credential",
+  "credentials",
+  "dsn",
+  "apikey"
+]);
+var NOT_CREDENTIAL_WORDS = new Set([
+  "public",
+  "publishable",
+  "anon",
+  "primary",
+  "foreign",
+  "sort",
+  "partition",
+  "cache",
+  "idempotency",
+  "dedup",
+  "lookup",
+  "index",
+  "hash",
+  "column",
+  "cursor",
+  "row",
+  "composite",
+  "unique",
+  "map",
+  "dict"
+]);
+var KEY_QUALIFIERS = new Set([
+  "api",
+  "access",
+  "secret",
+  "private",
+  "signing",
+  "encryption",
+  "enc",
+  "master",
+  "service",
+  "auth",
+  "client",
+  "license",
+  "app",
+  "webhook",
+  "session",
+  "jwt",
+  "hmac",
+  "admin",
+  "bearer",
+  "account",
+  "subscription",
+  "crypto",
+  "cipher",
+  "root",
+  "role",
+  "write",
+  "read",
+  "deploy",
+  "gateway",
+  "aes",
+  "creds",
+  "credential",
+  "credentials",
+  "pat",
+  "sas",
+  "shared"
+]);
+var IDENTIFIER_KEY_WORDS = new Set([
+  "s3",
+  "r2",
+  "gcs",
+  "blob",
+  "object",
+  "output",
+  "path",
+  "plugin",
+  "file",
+  "prompt",
+  "config",
+  "json",
+  "user",
+  "storage",
+  "routing",
+  "shard",
+  "message",
+  "event",
+  "bucket",
+  "record",
+  "i18n",
+  "translation",
+  "metric",
+  "label",
+  "group",
+  "state",
+  "query",
+  "field",
+  "attribute",
+  "property",
+  "tag",
+  "header",
+  "item",
+  "table",
+  "range",
+  "prefix",
+  "ssh",
+  "gpg",
+  "pgp",
+  "idem",
+  "sort",
+  "partition",
+  "cache",
+  "lookup",
+  "index",
+  "hash",
+  "column",
+  "row",
+  "map",
+  "dict",
+  "composite",
+  "unique"
+]);
+function isCredentialName(rawName) {
+  const name = rawName.split(/[./:\\]/).filter(Boolean).pop() ?? rawName;
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").split(/[_\-\s]+/).filter(Boolean).map((w) => w.toLowerCase());
+  const last = words[words.length - 1];
+  const previous = words[words.length - 2];
+  if (!last || words.slice(0, -1).some((w) => NOT_CREDENTIAL_WORDS.has(w)))
+    return false;
+  if (CREDENTIAL_WORDS.has(last))
+    return true;
+  if (/^_auth$/i.test(name) || last === "ident" && previous === "auth")
+    return true;
+  if (last !== "key" || !previous)
+    return false;
+  if (KEY_QUALIFIERS.has(previous))
+    return true;
+  return /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/.test(name) && !IDENTIFIER_KEY_WORDS.has(previous);
+}
+function isCredentialValue(raw) {
+  const value = raw.trim();
+  if (value.length < 4 || /[\s\p{C}]/u.test(value))
+    return false;
+  if (/^(true|false|null|none|nil|undefined|yes|no|on|off|~)$/i.test(value))
+    return false;
+  if (/^\$\{?[A-Za-z_]/.test(value) || /\$\{\{|\{\{|%\(|^\$\(/.test(value))
+    return false;
+  if (/^(?:os\.environ(?:\.get)?|os\.getenv|process\.env|import\.meta\.env|Deno\.env\.get|System\.getenv|getenv|ENV)(?:\(.*\)|\[.*\]|\.[A-Za-z_]\w*)$/.test(value))
+    return false;
+  if (/^(env|secret|vault|op|arn|ssm|awssecretsmanager|azurekeyvault|sm|gcpsm|projects)[:(/]/i.test(value) || /^@Microsoft\.KeyVault/i.test(value))
+    return false;
+  if (/^<.*>$/.test(value) || /^#\//.test(value))
+    return false;
+  if (/^(\/|\.\.?\/|~\/|[A-Za-z]:\\)/.test(value))
+    return false;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) && !/^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i.test(value))
+    return false;
+  if (/^[-+]?\d*\.?\d+(e[-+]?\d+)?$/i.test(value))
+    return false;
+  if (/^[\^~<>=v]*\d+(\.(\d+|x|\*)){0,3}([-+.][\w.-]+)?$/i.test(value))
+    return false;
+  if (/^(workspace|npm|file|link|portal|patch|catalog|git\+\w+|github|gitlab):/i.test(value) || /^(latest|next|canary|beta|\*)$/i.test(value))
+    return false;
+  if (WEAK_PASSWORDS.has(value.toLowerCase()))
+    return false;
+  if (/^(.)\1+$/.test(value) || sequentialRuns(value) >= 2)
+    return false;
+  if (/x{4,}|X{4,}|\*{3,}|\.\.\.|(^|[-_.])your[-_.]|changeme|change[-_]me|placeholder|example|replace[-_]?me|redacted|dummy|(^|[-_.])(fake|mock|sample|test|demo)([-_.]|$)/i.test(value))
+    return false;
+  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) => re.test(value)).length;
+  return /[0-9]/.test(value) || value.length >= 20 && classes >= 3;
+}
+var PREFIX = String.raw`[ \t]*(?:-[ \t]+)?(?:export[ \t]+|ENV[ \t]+|ARG[ \t]+)?`;
+var EQUALS_LINE = new RegExp(String.raw`^(${PREFIX})(["']?)([A-Za-z_@/][\w.\-/:@]*)\2[ \t]*=[ \t]*(.*)$`, "gm");
+var COLON_LINE = new RegExp(String.raw`^(${PREFIX})(["']?)([A-Za-z_@][\w.\-/@]*)\2[ \t]*:(?:[ \t]+|(?=["']))(.*)$`, "gm");
+function closingQuote(text, open, lineEnd) {
+  const quote = text[open];
+  for (let i = open + 1;i < lineEnd; i += 1) {
+    if (text[i] === "\\" && quote === '"') {
+      i += 1;
+      continue;
+    }
+    if (quote === "'" && text[i] === quote && text[i + 1] === quote) {
+      i += 1;
+      continue;
+    }
+    if (text[i] === quote)
+      return i;
+  }
+  return -1;
+}
+function isDockerfile(path) {
+  const name = basenameOf(path);
+  return /^(dockerfile|containerfile)/i.test(name) || /\.dockerfile$/i.test(name);
+}
+function valueEnds(path, envFile) {
+  const chars = isDockerfile(path) ? "\\s" : envFile ? "\\s;" : "\\s,;)\\]}";
+  return { terminator: new RegExp(`[${chars}]`), segmentEnd: new RegExp(`[${chars}"'\`]`) };
+}
+function dockerfileEnvSpans(source, detected) {
+  const directives = /^(?:[ \t]*#[ \t]*[A-Za-z]+[ \t]*=[^\n]*\n)*/.exec(source)[0];
+  const backtick = /^[ \t]*#[ \t]*escape[ \t]*=[ \t]*`[ \t]*\r?$/im.test(directives);
+  const text = backtick ? source.replace(/[`\\]/g, (ch) => ch === "`" ? "\\" : "`") : source;
+  const spans = [];
+  const known = [...detected].sort((a, b) => a.start - b.start);
+  let nextKnown = 0;
+  let knownEnd = -1;
+  let covered = -1;
+  const skipIgnored = (from) => {
+    let q = from;
+    while (q < text.length) {
+      const lineEnd = text.indexOf(`
+`, q) === -1 ? text.length : text.indexOf(`
+`, q);
+      if (!/^[ \t]*(?:#.*)?\r?$/.test(text.slice(q, lineEnd)) || lineEnd === text.length)
+        break;
+      q = lineEnd + 1;
+    }
+    return q;
+  };
+  for (const m of text.matchAll(/^[ \t]*(ENV|ARG)[ \t]+/gim)) {
+    if (m.index < covered)
+      continue;
+    let p2 = m.index + m[0].length;
+    let instructionEnd = text.indexOf(`
+`, p2);
+    while (instructionEnd !== -1) {
+      let slash = instructionEnd - (text[instructionEnd - 1] === "\r" ? 1 : 0);
+      const end = slash;
+      while (slash > p2 && text[slash - 1] === "\\")
+        slash -= 1;
+      if ((end - slash) % 2 === 0)
+        break;
+      instructionEnd = text.indexOf(`
+`, skipIgnored(instructionEnd + 1));
+    }
+    if (instructionEnd === -1)
+      instructionEnd = text.length;
+    covered = instructionEnd;
+    let first = true;
+    for (;; ) {
+      for (;; ) {
+        if (text[p2] === " " || text[p2] === "\t" || text[p2] === "\r")
+          p2 += 1;
+        else if (text.startsWith("\\\n", p2))
+          p2 = skipIgnored(p2 + 2);
+        else if (text.startsWith(`\\\r
+`, p2))
+          p2 = skipIgnored(p2 + 3);
+        else
+          break;
+      }
+      const rest = text.slice(p2, Math.min(p2 + 256, instructionEnd));
+      let name = /^(["']?)([A-Za-z_][\w.-]*)\1=/.exec(rest);
+      const legacy = !name && first && m[1].toUpperCase() === "ENV";
+      if (legacy)
+        name = /^(["']?)([A-Za-z_][\w.-]*)\1[ \t]+/.exec(rest);
+      if (!name)
+        break;
+      first = false;
+      p2 += name[0].length;
+      const valueStart = p2;
+      const parts = [];
+      const addPart = (start, end) => {
+        let from = start;
+        for (const continuation of text.slice(start, end).matchAll(/\\\r?\n/g)) {
+          const stop = start + continuation.index;
+          if (stop > from)
+            parts.push({ start: from, end: stop, rule: "credential_assignment" });
+          from = stop + continuation[0].length;
+        }
+        if (end > from)
+          parts.push({ start: from, end, rule: "credential_assignment" });
+      };
+      let literal = "";
+      while (p2 < instructionEnd && (legacy || !/\s/.test(text[p2]))) {
+        const q = text[p2];
+        if (q === '"' || q === "'") {
+          const close = closingQuote(text, p2, instructionEnd);
+          const end = close === -1 ? instructionEnd : close;
+          addPart(p2 + 1, end);
+          literal += text.slice(p2 + 1, end);
+          p2 = close === -1 ? instructionEnd : close + 1;
+        } else {
+          let e = p2;
+          while (e < instructionEnd && !(legacy ? /["']/ : /[\s"']/).test(text[e])) {
+            if (text[e] === "\\" && e + 1 < instructionEnd)
+              e += text.startsWith(`\\\r
+`, e) ? 3 : 2;
+            else
+              e += 1;
+          }
+          addPart(p2, e);
+          literal += text.slice(p2, e);
+          p2 = e;
+        }
+      }
+      while (nextKnown < known.length && known[nextKnown].start < valueStart) {
+        knownEnd = Math.max(knownEnd, known[nextKnown++].end);
+      }
+      const hasSecret = knownEnd > valueStart || nextKnown < known.length && known[nextKnown].start < p2;
+      const value = literal.replace(/\\\r?\n/g, "").replace(/\\(.)/g, "$1").trim();
+      if (isCredentialName(name[2]) && (hasSecret || value.split(/[ \t]+/).some(isCredentialValue)))
+        for (const part of parts)
+          spans.push(part);
+      if (legacy)
+        break;
+    }
+  }
+  return spans;
+}
+function assignmentSpans(text, everyValue, path, ends) {
+  const toml = /\.toml$/i.test(path);
+  const spans = [];
+  const seenLines = new Set;
+  for (const pattern of [EQUALS_LINE, COLON_LINE]) {
+    pattern.lastIndex = 0;
+    for (const m of text.matchAll(pattern)) {
+      const lineStart = m.index ?? 0;
+      if (seenLines.has(lineStart))
+        continue;
+      seenLines.add(lineStart);
+      const name = m[3];
+      const rest = m[4];
+      const restStart = lineStart + m[0].length - rest.length;
+      let value = valueBounds(rest, everyValue, toml) ?? multilineQuoted(text, restStart, toml);
+      if (!value && everyValue && rest.trim() !== "")
+        value = { start: 0, end: rest.replace(/[ \t]+$/, "").length };
+      if (!value)
+        continue;
+      const extra = [];
+      if (value.start > 0) {
+        const lineEnd = text.indexOf(`
+`, restStart + value.end) === -1 ? text.length : text.indexOf(`
+`, restStart + value.end);
+        let p2 = restStart + value.end + value.start;
+        while (p2 < lineEnd && !ends.terminator.test(text[p2])) {
+          const q = text[p2];
+          if (q === '"' || q === "'" || q === "`") {
+            const close = closingQuote(text, p2, lineEnd);
+            const contentEnd = close === -1 ? lineEnd : close;
+            if (contentEnd > p2 + 1)
+              extra.push({ start: p2 + 1, end: contentEnd, rule: "" });
+            p2 = close === -1 ? lineEnd : close + 1;
+          } else {
+            let e = p2;
+            while (e < lineEnd && !ends.segmentEnd.test(text[e]))
+              e += 1;
+            extra.push({ start: p2, end: e, rule: "" });
+            p2 = e;
+          }
+        }
+        if (everyValue && p2 < lineEnd) {
+          const line = text.slice(p2, lineEnd);
+          const comment = line.search(/[ \t]+#/);
+          const body = (comment === -1 ? line : line.slice(0, comment)).replace(/[ \t\r]+$/, "");
+          const lead = body.length - body.replace(/^[\s,;)\]}]+/, "").length;
+          if (body.length > lead)
+            extra.push({ start: p2 + lead, end: p2 + body.length, rule: "" });
+        }
+      }
+      const joined = extra.length > 0;
+      const rule2 = everyValue ? "env_value" : "credential_assignment";
+      const literal = rest.slice(value.start, Math.min(value.end, rest.length)) + (value.end > rest.length ? text.slice(restStart + rest.length, restStart + value.end) : "");
+      if (!everyValue && /\.(hcl|tfvars)$/i.test(path) && value.start === 0 && /^[A-Za-z_]\w*(?:\.|\[|\()/.test(literal))
+        continue;
+      if (everyValue ? literal.trim() === "" : !(isCredentialName(name) && (joined || isCredentialValue(literal))))
+        continue;
+      spans.push({ start: restStart + value.start, end: restStart + value.end, rule: rule2 });
+      for (const span of extra)
+        spans.push({ ...span, rule: rule2 });
+    }
+  }
+  return spans;
+}
+function unparsedEnvLines(text, covered) {
+  const out = [];
+  const assignment = new RegExp(String.raw`^${PREFIX}(["']?)[A-Za-z_@/][\w.\-/:@]*\1[ \t]*[=:]`);
+  const spans = [...covered].sort((a, b) => a.start - b.start);
+  let next = 0;
+  let reach = -1;
+  let offset = 0;
+  for (const line of text.split(`
+`)) {
+    const start = offset;
+    const end = start + Math.max(line.length, 1);
+    offset += line.length + 1;
+    while (next < spans.length && spans[next].start < end)
+      reach = Math.max(reach, spans[next++].end);
+    if (reach > start)
+      continue;
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#") || assignment.test(line))
+      continue;
+    const lead = line.length - line.trimStart().length;
+    out.push({ start: start + lead, end: start + line.replace(/[ \t\r]+$/, "").length, rule: "env_value" });
+  }
+  return out;
+}
+function tripleQuoted(text, from) {
+  const delim = text.slice(from, from + 3);
+  if (delim !== '"""' && delim !== "'''")
+    return null;
+  for (let i = from + 3;i < text.length; i += 1) {
+    if (text[i] === "\\" && delim === '"""') {
+      i += 1;
+      continue;
+    }
+    if (text.startsWith(delim, i)) {
+      let close = i;
+      while (close - i < 2 && text[close + 3] === delim[0])
+        close += 1;
+      return close > from + 3 ? { start: 3, end: close - from } : null;
+    }
+  }
+  return null;
+}
+function multilineQuoted(text, restStart, toml) {
+  const quote = text[restStart];
+  if (quote !== '"' && quote !== "'" && quote !== "`")
+    return null;
+  if (toml && quote !== "`" && text.startsWith(quote.repeat(3), restStart))
+    return tripleQuoted(text, restStart);
+  for (let i = restStart + 1;i < text.length; i += 1) {
+    if (text[i] === "\\" && quote !== "'") {
+      i += 1;
+      continue;
+    }
+    if (quote === "'" && text[i] === quote && text[i + 1] === quote) {
+      i += 1;
+      continue;
+    }
+    if (text[i] === quote)
+      return i > restStart + 1 ? { start: 1, end: i - restStart } : null;
+  }
+  return null;
+}
+function valueBounds(rest, envFile, toml) {
+  if (rest === "" || /^[{[|>]/.test(rest))
+    return null;
+  const quote = rest[0];
+  if (quote === '"' || quote === "'" || quote === "`") {
+    if (toml && quote !== "`" && rest.startsWith(quote.repeat(3)))
+      return tripleQuoted(rest, 0);
+    for (let i = 1;i < rest.length; i += 1) {
+      if (rest[i] === "\\" && quote === '"') {
+        i += 1;
+        continue;
+      }
+      if (quote === "'" && rest[i] === quote && rest[i + 1] === quote) {
+        i += 1;
+        continue;
+      }
+      if (rest[i] === quote)
+        return i > 1 ? { start: 1, end: i } : null;
+    }
+    return null;
+  }
+  let end = rest.length;
+  const comment = rest.search(envFile ? /[ \t]+#/ : /[ \t]+[#;]/);
+  if (comment !== -1)
+    end = comment;
+  const trimmed = rest.slice(0, end).replace(envFile ? /[ \t]+$/ : /[ \t,]+$/, "");
+  return trimmed === "" ? null : { start: 0, end: trimmed.length };
+}
+function xmlSpans(text) {
+  const spans = [];
+  for (const m of text.matchAll(/<(password|passphrase|privateKey|secret|token|apiKey|accessKey|secretKey)>([^<]+)<\/\1>/dgi)) {
+    const value = m[2].trim();
+    if (value === "" || /^\$\{/.test(value))
+      continue;
+    const [start, end] = m.indices[2];
+    spans.push({ start, end, rule: "credential_assignment" });
+  }
+  return spans;
+}
+function inlinePairSpans(text, path) {
+  const cComments = /\.json5$/i.test(path);
+  const toml = /\.toml$/i.test(path);
+  const yaml = /\.ya?ml$/i.test(path);
+  const spans = [];
+  const tomlKey = /[ \t]*(["']?)([A-Za-z_@][\w.\-/@]{0,127})\1[ \t]*=[ \t]*("""|''')/y;
+  const pair = /[ \t]*(["']?)([A-Za-z_@][\w.\-/@]{0,127})\1[ \t]*[:=][ \t]*(?:"((?:[^"\\\n]|\\.)*)"|'((?:[^'\n]|'')*)'|([^,{}[\]\s"'][^,{}\n]*))/dy;
+  let depth = 0;
+  let quote = "";
+  let previous = `
+`;
+  let expectKey = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === "\\" && quote === '"')
+        i += 1;
+      else if (quote === "'" && ch === "'" && text[i + 1] === "'")
+        i += 1;
+      else if (ch === quote || ch === `
+` && !yaml)
+        quote = "";
+      continue;
+    }
+    if (ch === " " || ch === "\t" || ch === "\r")
+      continue;
+    if (ch === `
+`) {
+      previous = ch;
+      continue;
+    }
+    if (cComments && ch === "/" && (text[i + 1] === "/" || text[i + 1] === "*") && /[\s{,[]/.test(text[i - 1] ?? `
+`)) {
+      const close = text[i + 1] === "*" ? text.indexOf("*/", i + 2) : text.indexOf(`
+`, i);
+      i = close === -1 ? text.length : text[i + 1] === "*" ? close + 1 : close - 1;
+      continue;
+    }
+    if (ch === "#" && /\s/.test(text[i - 1] ?? `
+`)) {
+      const lineEnd = text.indexOf(`
+`, i);
+      i = (lineEnd === -1 ? text.length : lineEnd) - 1;
+      continue;
+    }
+    if (expectKey) {
+      expectKey = false;
+      if (toml) {
+        tomlKey.lastIndex = i;
+        const k = tomlKey.exec(text);
+        if (k) {
+          const open = k.index + k[0].length - 3;
+          const bounds = tripleQuoted(text, open);
+          if (!bounds) {
+            const close = text.indexOf(k[3], open + 3);
+            i = close === -1 ? text.length - 1 : close + 2;
+          } else {
+            const from = open + bounds.start;
+            const to = open + bounds.end;
+            if (isCredentialName(k[2]) && text.slice(from, to).trim().split(/\s+/).some(isCredentialValue)) {
+              spans.push({ start: from, end: to, rule: "credential_assignment" });
+            }
+            i = to + 2;
+            while (text[i + 1] === k[3][0])
+              i += 1;
+          }
+          previous = text[i];
+          continue;
+        }
+      }
+      pair.lastIndex = i;
+      const m = pair.exec(text);
+      if (m) {
+        const group = m[3] !== undefined ? 3 : m[4] !== undefined ? 4 : 5;
+        const value = m[group];
+        if (isCredentialName(m[2]) && isCredentialValue(value)) {
+          const [from] = m.indices[group];
+          spans.push({ start: from, end: from + value.replace(/[ \t]+$/, "").length, rule: "credential_assignment" });
+        }
+        i = m.index + m[0].length - 1;
+        previous = text[i];
+        continue;
+      }
+    }
+    if ((ch === '"' || ch === "'") && /[\n:=,{[(]/.test(previous)) {
+      if (toml && text.startsWith(ch.repeat(3), i)) {
+        const close = tripleQuoted(text, i);
+        const end = close === null ? text.indexOf(ch.repeat(3), i + 3) : i + close.end;
+        i = end === -1 ? text.length : end + 2;
+        while (text[i + 1] === ch)
+          i += 1;
+        previous = ch;
+        continue;
+      }
+      quote = ch;
+      previous = ch;
+      continue;
+    }
+    previous = ch;
+    if (ch === "{")
+      depth += 1;
+    else if (ch === "}" && depth > 0)
+      depth -= 1;
+    if ((ch === "{" || ch === ",") && depth > 0)
+      expectKey = true;
+  }
+  return spans;
+}
+function jsonSpans(text) {
+  const spans = [];
+  for (const m of text.matchAll(/"([^"\\\n]{1,128})"\s*:\s*"((?:[^"\\\n]|\\.)*)"/dg)) {
+    if (!isCredentialName(m[1]) || !isCredentialValue(m[2]))
+      continue;
+    const [start, end] = m.indices[2];
+    spans.push({ start, end, rule: "credential_assignment" });
+  }
+  return spans;
+}
+var GENERIC_RULES = new Set(["generic_secret_assignment", "credential_assignment", "env_value", "url_embedded_credentials", "bearer_token"]);
+var SEPARATOR2 = /[-_./:@+=,;]/;
+function mask(value) {
+  const marker = PROVIDER_MARKER.exec(value)?.[0] ?? "";
+  const keep = marker.length <= value.length - 8 ? marker : "";
+  const body = value.slice(keep.length);
+  const hasContent = /[\p{L}\p{N}]/u.test(body);
+  let out = "";
+  for (let i = 0;i < body.length; i += 1) {
+    const ch = body[i];
+    if (ch === "\\" && i + 1 < body.length && body[i + 1] !== `
+` && body[i + 1] !== "\r") {
+      out += "xx";
+      i += 1;
+      continue;
+    }
+    if (ch === `
+` || ch === "\r")
+      out += ch;
+    else if (hasContent && SEPARATOR2.test(ch))
+      out += ch;
+    else
+      out += "x";
+  }
+  return keep + out;
+}
+function propertiesContinuations(text, spans) {
+  const out = [];
+  const visited = new Set;
+  const lineEndAt = (i) => text.indexOf(`
+`, i) === -1 ? text.length : text.indexOf(`
+`, i);
+  const continuation = (from, end) => {
+    let contentEnd = end;
+    if (text[contentEnd - 1] === "\r")
+      contentEnd -= 1;
+    let run = contentEnd;
+    while (run > from && text[run - 1] === "\\")
+      run -= 1;
+    return (contentEnd - run) % 2 === 1 ? contentEnd - 1 : -1;
+  };
+  const comments = new Set;
+  let continued = false;
+  for (let from = 0;from < text.length; ) {
+    const end = lineEndAt(from);
+    const comment = !continued && /^[ \t\f]*[#!]/.test(text.slice(from, end));
+    if (comment)
+      comments.add(end);
+    continued = !comment && continuation(from, end) !== -1;
+    from = end + 1;
+  }
+  for (const span of spans) {
+    let end = lineEndAt(span.start);
+    if (comments.has(end))
+      continue;
+    let slash = continuation(span.start, end);
+    if (slash === -1)
+      continue;
+    if (span.end > slash)
+      span.end = slash;
+    while (slash !== -1 && end < text.length && !visited.has(end)) {
+      visited.add(end);
+      const from = end + 1;
+      end = lineEndAt(from);
+      let start = from;
+      while (start < end && (text[start] === " " || text[start] === "\t"))
+        start += 1;
+      slash = continuation(start, end);
+      const stop = slash === -1 ? text[end - 1] === "\r" ? end - 1 : end : slash;
+      if (stop > start)
+        out.push({ start, end: stop, rule: span.rule });
+    }
+  }
+  return out;
+}
+function yamlValueSpans(text, spans, everyValue) {
+  if (spans.length === 0) {
+    let candidate = false;
+    COLON_LINE.lastIndex = 0;
+    for (const match of text.matchAll(COLON_LINE)) {
+      if (!isCredentialName(match[3]))
+        continue;
+      const rest = match[4].replace(/\r$/, "");
+      const lineEnd = match.index + match[0].length;
+      const nextLine = /^\n([ \t]*)\S/.exec(text.slice(lineEnd, lineEnd + 512));
+      const indent = /^[ \t]*/.exec(match[0])[0].length;
+      if (/^[&!]/.test(rest) || /(?:^|[ \t])[|>][-+1-9]*[ \t]*(?:#.*)?$/.test(rest) || /^"(?:[^"\\]|\\.)*$/.test(rest) || /^'(?:[^']|'')*$/.test(rest) || rest.trim() !== "" && !/^["'{[]/.test(rest) && nextLine !== null && nextLine[1].length > indent) {
+        candidate = true;
+        break;
+      }
+    }
+    if (!candidate)
+      return [];
+  } else if (!/[|>&!]/.test(text) && !/[\r\n][^\r\n]/.test(text))
+    return [];
+  const out = [];
+  const sorted = [...spans].sort((a, b) => a.start - b.start);
+  let next = 0;
+  let reach = -1;
+  let reachRule = "";
+  for (const doc of $parseAllDocuments(text, { keepSourceTokens: true, prettyErrors: false })) {
+    if (doc.errors.length > 0)
+      throw new Error("YAML value bounds are unavailable");
+    $visit(doc, (_key, node, path) => {
+      if (!$isScalar(node) || !node.srcToken || !("source" in node.srcToken) || !node.range)
+        return;
+      const block = node.srcToken.type === "block-scalar";
+      const quoted = node.type === "QUOTE_SINGLE" || node.type === "QUOTE_DOUBLE";
+      const raw = node.srcToken.source;
+      if (!block && !node.anchor && !node.tag && !/[\r\n]/.test(raw))
+        return;
+      const source = quoted ? raw.slice(1, -1) : raw;
+      const to = node.range[1] - (quoted ? 1 : 0);
+      const from = to - source.length;
+      const parent = path[path.length - 1];
+      const name = $isPair(parent) && $isScalar(parent.key) ? String(parent.key.value) : "";
+      while (next < sorted.length && sorted[next].start < from) {
+        if (sorted[next].end > reach)
+          [reach, reachRule] = [sorted[next].end, sorted[next].rule];
+        next += 1;
+      }
+      const inside = reach > from ? reachRule : next < sorted.length && sorted[next].start < to ? sorted[next].rule : "";
+      const credential = isCredentialName(name) && String(node.value).trim().split(/[ \t\r\n]+/).some(isCredentialValue);
+      if (!inside && !everyValue && !credential)
+        return;
+      const rule2 = inside || (everyValue ? "env_value" : "credential_assignment");
+      for (const line of source.matchAll(/[^\r\n]+/g)) {
+        const lead = /^[ \t]*/.exec(line[0])[0].length;
+        if (lead < line[0].length)
+          out.push({ start: from + line.index + lead, end: from + line.index + line[0].length, rule: rule2 });
+      }
+    });
+  }
+  return out;
+}
+function redactText(path, text, categories, opts) {
+  const heuristics = !categories.includes("lockfile") && !/\.min\.(js|css)$|\.map$/.test(path);
+  const config = isConfigLike(path);
+  const found = findSecretSpans(text, { heuristics, config: !categories.includes("source") });
+  const withhold = found.find((s) => s.withholdFile);
+  if (withhold)
+    return { text, redactions: [], ranges: [], withholdRule: withhold.rule };
+  const spans = found.map(({ start, end, rule: rule2 }) => ({ start, end, rule: rule2 }));
+  const lockfile = categories.includes("lockfile");
+  if (opts.envFile) {
+    spans.push(...assignmentSpans(text, true, path, valueEnds(path, true)));
+    spans.push(...unparsedEnvLines(text, spans));
+  } else if (config && !lockfile && !isDockerfile(path))
+    spans.push(...assignmentSpans(text, false, path, valueEnds(path, false)));
+  if (isDockerfile(path))
+    for (const span of dockerfileEnvSpans(text, spans))
+      spans.push(span);
+  if (config && !lockfile && /\.json[c5]?$/i.test(path))
+    spans.push(...jsonSpans(text));
+  if (config && !lockfile && !opts.envFile && !/\.jsonc?$/i.test(path))
+    spans.push(...inlinePairSpans(text, path));
+  if (!lockfile && /\.xml$/i.test(path))
+    spans.push(...xmlSpans(text));
+  if (/\.properties$/i.test(path))
+    spans.push(...propertiesContinuations(text, spans));
+  if (/\.ya?ml$/i.test(path)) {
+    try {
+      spans.push(...yamlValueSpans(text, spans, opts.envFile));
+    } catch {
+      return { text, redactions: [], ranges: [], withholdRule: "credential_assignment" };
+    }
+  }
+  if (spans.length === 0)
+    return { text, redactions: [], ranges: [] };
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const merged = [];
+  for (const span of spans) {
+    if (span.end <= span.start)
+      continue;
+    const last = merged[merged.length - 1];
+    if (last && span.start < last.end) {
+      last.end = Math.max(last.end, span.end);
+      if (GENERIC_RULES.has(last.rule) && !GENERIC_RULES.has(span.rule))
+        last.rule = span.rule;
+    } else {
+      merged.push({ ...span });
+    }
+  }
+  let out = "";
+  let cursor = 0;
+  let lineNo = 1;
+  let lineCursor = 0;
+  const redactions = [];
+  for (const span of merged) {
+    for (let i = lineCursor;i < span.start; i += 1)
+      if (text.charCodeAt(i) === 10)
+        lineNo += 1;
+    lineCursor = span.start;
+    const value = text.slice(span.start, span.end);
+    out += text.slice(cursor, span.start) + mask(value);
+    cursor = span.end;
+    redactions.push({ line: lineNo, rule: span.rule, length: value.length });
+  }
+  out += text.slice(cursor);
+  return { text: out, redactions, ranges: merged.map((span) => [span.start, span.end]) };
+}
 
 // ../../packages/harness-bundle/src/collect/toolchain.ts
 function isToolchainFile(path) {
@@ -187735,6 +188647,7 @@ class Collector {
   texts = new Map;
   env = new EnvCollector;
   parentCache = new Map;
+  redactions = [];
   listedArtifacts = new Map;
   constructor(repoRoot, opts) {
     this.opts = opts;
@@ -187793,7 +188706,7 @@ class Collector {
     const withPrefix = (p2) => prefix === "" ? p2 : `${prefix}/${p2}`;
     const tracked = [...new Set(lsFiles(dir, ["--cached"]))].sort().map(withPrefix);
     const untracked = lsFiles(dir, ["--others", "--exclude-standard"]).sort().map(withPrefix);
-    const ignored = lsFiles(dir, ["--others", "--ignored", "--exclude-standard", "--directory", "--no-empty-directory"]).sort().map(withPrefix);
+    const ignored = ignoredPaths(dir).sort().map(withPrefix);
     const ignoredDirs = ignored.filter((p2) => p2.endsWith("/"));
     const ignoredRuleFiles = lsFiles(dir, ["--others", "--ignored", "--exclude-standard", "--", ":(glob)**/.modaignore"]).map(withPrefix).filter((p2) => !ignoredDirs.some((d) => p2.startsWith(d))).filter((p2) => {
       const excluded = this.ancestorMatch(p2, "ignored");
@@ -187962,13 +188875,14 @@ class Collector {
       this.addToAggregate(ancestor.dir, ancestor.rule, path, isDir);
       return;
     }
+    const collectAll = this.opts.collectIgnored !== false;
     if (isDir) {
       const rule3 = this.dirMatch(path, "ignored");
       if (rule3) {
         this.recordDirOrFile(path, rule3);
         return;
       }
-      if (this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, true)) {
+      if (collectAll || this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, true)) {
         this.walk(path, "ignored", null);
         return;
       }
@@ -187988,7 +188902,7 @@ class Collector {
       this.excludeFile(path, "user_exclude", "modaignore", this.sizeOf(path));
       return;
     }
-    if (this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, false)) {
+    if (collectAll || this.includeIgnoredRules.size > 0 && this.includeIgnoredRules.matchesWithAncestors(path, false)) {
       this.consider(path, "ignored");
       return;
     }
@@ -188074,8 +188988,9 @@ class Collector {
       }
       return;
     }
-    const pathRule = fileRule(path);
-    if (pathRule) {
+    const pathRule = fileRule(path) ?? runtimeLogRule(path, status);
+    const envValueFile = pathRule?.reason === "secret_path" && ENV_VALUE_FILE_RULES.has(pathRule.rule) && status === "tracked";
+    if (pathRule && !envValueFile) {
       this.excludeFile(path, pathRule.reason, pathRule.rule, st.size);
       return;
     }
@@ -188106,20 +189021,48 @@ class Collector {
     const text = encoding === "text" ? buf.toString("utf8") : undefined;
     const categoryText = text !== undefined && /^(package\.json|pyproject\.toml|Cargo\.toml)$/.test(basenameOf(path)) ? text : undefined;
     const categories = categorize({ path, encoding, head: text?.slice(0, 1024), text: categoryText });
-    const finding = contentSecretFinding(path, buf, text, categories);
-    if (finding) {
-      this.excludeFile(path, finding.reason, finding.rule, buf.length);
-      return;
+    if (envValueFile && !categories.includes("env_example"))
+      categories.push("env_example");
+    const envFile = envValueFile || categories.includes("env_example");
+    let shipped = buf;
+    if (text !== undefined) {
+      const redacted = redactText(path, text, categories, { envFile });
+      if (redacted.withholdRule) {
+        this.excludeFile(path, "secret_content", redacted.withholdRule, buf.length);
+        return;
+      }
+      const credential = redacted.redactions.find((r) => r.rule !== "env_value");
+      if (credential && status !== "tracked" && !categories.includes("env_example")) {
+        this.excludeFile(path, "secret_content", credential.rule, buf.length);
+        return;
+      }
+      const unmasked = registryAuthFindings(path, text).find((finding) => !rangeCovered(redacted.ranges, finding.start, finding.end));
+      if (unmasked) {
+        this.excludeFile(path, "secret_path", unmasked.rule, buf.length);
+        return;
+      }
+      if (redacted.redactions.length > 0) {
+        shipped = Buffer.from(redacted.text, "utf8");
+        for (const r of redacted.redactions)
+          this.redactions.push({ path, ...r });
+      }
+    } else {
+      const finding = contentSecretFinding(path, buf, text, categories);
+      if (finding) {
+        this.excludeFile(path, finding.reason, finding.rule, buf.length);
+        return;
+      }
     }
     this.included.set(path, {
       path,
-      bytes: buf.length,
-      sha256: sha256(buf),
+      bytes: shipped.length,
+      sha256: sha256(shipped),
       executable: (st.mode & 73) !== 0,
       encoding,
-      categories,
+      categories: [...categories].sort(),
       git: status,
-      absolutePath: abs
+      absolutePath: abs,
+      ...shipped !== buf ? { redaction: { envFile }, sourceSha256: sha256(buf) } : {}
     });
     if (text !== undefined) {
       if (isToolchainFile(path))
@@ -188304,7 +189247,15 @@ class Collector {
     ].sort((a, b) => compare(a.path, b.path) || compare(a.reason, b.reason));
     const textOf = (path) => this.texts.get(path);
     const toolchain = detectToolchain(files.map((f) => f.path), textOf, harnessRel);
-    const manifestFiles = files.map(({ absolutePath: _absolutePath, linkTargetOnDisk: _linkTargetOnDisk, ...file }) => file);
+    const manifestFiles = files.map(({
+      absolutePath: _absolutePath,
+      linkTargetOnDisk: _linkTargetOnDisk,
+      redaction: _redaction,
+      sourceSha256: _sourceSha256,
+      ...file
+    }) => file);
+    const shippedPaths = new Set(manifestFiles.map((f) => f.path));
+    const redactions = this.redactions.filter((r) => shippedPaths.has(r.path)).sort((a, b) => compare(a.path, b.path) || a.line - b.line);
     const bytes = manifestFiles.reduce((sum, f) => sum + f.bytes, 0);
     const manifest = {
       schema: HARNESS_BUNDLE_SCHEMA,
@@ -188326,6 +189277,7 @@ class Collector {
       totals: { files: manifestFiles.length, bytes, excluded: excluded.length },
       files: manifestFiles,
       excluded,
+      ...redactions.length > 0 ? { redactions } : {},
       ignoredPresent: this.collapseIgnored(),
       toolchain,
       env: this.env.finalize(new Set(manifestFiles.map((f) => f.path))),
@@ -188471,6 +189423,19 @@ function isOutside(rel2) {
 function stripUndefined(value) {
   return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
 }
+function rangeCovered(ranges, start, end) {
+  let at = start;
+  for (const [s, e] of ranges) {
+    if (e <= at)
+      continue;
+    if (s > at)
+      return false;
+    at = e;
+    if (at >= end)
+      return true;
+  }
+  return at >= end;
+}
 // ../../packages/harness-bundle/src/collect/write.ts
 import { createHash as createHash3, randomUUID } from "node:crypto";
 import { createWriteStream, existsSync as existsSync5, lstatSync as lstatSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync3, renameSync, rmSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -188634,6 +189599,14 @@ function replaceTogether(moves, token) {
   for (const [backup] of backups)
     rmSync(backup, { force: true });
 }
+function shippedBody(file, disk = readFileSync5(file.absolutePath)) {
+  if (!file.redaction)
+    return disk;
+  const body = Buffer.from(redactText(file.path, disk.toString("utf8"), file.categories, file.redaction).text, "utf8");
+  if (sha256(body) !== file.sha256)
+    throw new Error(`${file.path} changed after collection; re-run the collector`);
+  return body;
+}
 function* tarChunks(files) {
   const sorted = [...files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   for (const file of sorted) {
@@ -188652,10 +189625,10 @@ function* tarChunks(files) {
     } else {
       const body = readFileSync5(file.absolutePath);
       const executableNow = (statSync(file.absolutePath).mode & 73) !== 0;
-      if (sha256(body) !== file.sha256 || executableNow !== file.executable) {
+      if (sha256(body) !== (file.sourceSha256 ?? file.sha256) || executableNow !== file.executable) {
         throw new Error(`${file.path} changed after collection; re-run the collector`);
       }
-      entry = { path: file.path, type: "file", mode: file.executable ? 493 : 420, body };
+      entry = { path: file.path, type: "file", mode: file.executable ? 493 : 420, body: shippedBody(file, body) };
     }
     yield* encodeEntry(entry);
   }
@@ -188689,7 +189662,6 @@ async function collectRegistration(request) {
     throw new Error(`Git could not list this checkout, so the bundle would ignore .gitignore; nothing was collected. ${gitFailure ?? "Check that git works here (safe.directory, a readable index)."}`);
   }
   const deployArtifacts = request.imageRef ? [{ producedBy: "customer", kind: "oci_image", digest: request.imageRef.slice(request.imageRef.lastIndexOf("@") + 1), imageRef: request.imageRef }] : [];
-  redactEnvExamples(result, join7(request.outDir, "redacted"));
   const written = await writeBundle(result, request.outDir, { deployArtifacts: async () => deployArtifacts });
   const stage = join7(request.outDir, "stage");
   let dependencyMap;
@@ -188701,6 +189673,7 @@ async function collectRegistration(request) {
   } finally {
     rmSync2(stage, { recursive: true, force: true });
   }
+  keepRedactedExamplesFalse(dependencyMap, written.manifest);
   const mapPath = join7(request.outDir, "dependency-map.json");
   writeFileSync4(mapPath, `${JSON.stringify(dependencyMap, null, 2)}
 `);
@@ -188713,64 +189686,20 @@ async function collectRegistration(request) {
     dependencyMapFile: await digestFile(mapPath)
   };
 }
-var MAX_ENV_RESCAN_BYTES = 2 * 1024 * 1024;
-function redactEnvExamples(result, dir) {
-  const byPath = new Map(result.manifest.files.map((file) => [file.path, file]));
-  let redacted = false;
-  for (const file of result.files) {
-    if (!file.categories.includes("env_example") || file.symlinkTarget !== undefined)
-      continue;
-    redacted = true;
-    const body = Buffer.from(envNamesOnly(readFileSync6(file.absolutePath, "utf8")));
-    const target = join7(dir, file.path);
-    mkdirSync4(dirname5(target), { recursive: true });
-    writeFileSync4(target, body, { mode: file.executable ? 493 : 420 });
-    const sha2562 = createHash4("sha256").update(body).digest("hex");
-    Object.assign(file, { absolutePath: target, sha256: sha2562, bytes: body.byteLength });
-    const listed = byPath.get(file.path);
-    if (listed)
-      Object.assign(listed, { sha256: sha2562, bytes: body.byteLength });
-  }
-  result.manifest.totals.bytes = result.manifest.files.reduce((sum, file) => sum + file.bytes, 0);
-  if (redacted) {
-    const env = new EnvCollector;
-    for (const file of result.files) {
-      if (file.encoding !== "text" || file.symlinkTarget !== undefined || file.bytes > MAX_ENV_RESCAN_BYTES)
-        continue;
-      env.scanFile(file.path, readFileSync6(file.absolutePath, "utf8"), file.categories);
-    }
-    result.manifest.env = env.finalize(new Set(result.files.map((file) => file.path)));
-  }
-}
-function envNamesOnly(text) {
-  const names = [];
-  let open = null;
-  for (const line of text.split(`
-`)) {
-    if (open) {
-      if (closes(line, open, 0))
-        open = null;
-      continue;
-    }
-    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-    if (!match)
+function keepRedactedExamplesFalse(map, manifest) {
+  const redactedPaths = new Set((manifest.redactions ?? []).map((r) => r.path));
+  const redactedEnvFiles = new Set(manifest.files.filter((file) => file.categories.includes("env_example") && redactedPaths.has(file.path)).map((file) => file.path));
+  if (redactedEnvFiles.size === 0)
+    return;
+  const collected = new Map(manifest.env.map((ref) => [ref.name, ref]));
+  const sourcePath = (source) => source.replace(/:\d+$/, "");
+  for (const ref of map.env) {
+    const seen = collected.get(ref.name);
+    if (!seen || seen.hasExampleValue || !ref.hasExampleValue)
       continue;
-    names.push(match[1]);
-    const quote = match[2][0];
-    if ((quote === '"' || quote === "'" || quote === "`") && !closes(match[2], quote, 1))
-      open = quote;
-  }
-  return names.map((name) => `${name}=
-`).join("");
-}
-function closes(text, quote, from) {
-  for (let i = from;i < text.length; i++) {
-    if (text[i] === "\\" && quote !== "'")
-      i++;
-    else if (text[i] === quote)
-      return true;
+    if (seen.sources.some((source) => redactedEnvFiles.has(sourcePath(source))))
+      ref.hasExampleValue = false;
   }
-  return false;
 }
 function insideCheckout(dir) {
   for (let current = realpathSync4(dir);; current = dirname5(current)) {
@@ -188983,7 +189912,7 @@ function parseRegisterOptions(context, argv) {
 }
 function defaultHarnessName(root) {
   try {
-    const name = JSON.parse(readFileSync7(join8(root, "package.json"), "utf8")).name;
+    const name = JSON.parse(readFileSync6(join8(root, "package.json"), "utf8")).name;
     if (typeof name === "string" && name)
       return sanitizeName(name.replace(/^@[^/]+\//, ""));
   } catch {}
@@ -189019,6 +189948,7 @@ function buildRegisterReport(collected) {
       byCategory: [...byCategory].map(([category, entry]) => ({ category, ...entry })).sort((a, b) => b.bytes - a.bytes)
     },
     excluded: manifest.excluded,
+    redactions: manifest.redactions ?? [],
     ignoredPresent: manifest.ignoredPresent,
     env,
     toolchain: manifest.toolchain,
@@ -189133,6 +190063,15 @@ function renderRegisterReport(report, registration) {
     const rule2 = item.rule ? `, rule ${item.rule}` : "";
     lines.push(`  ${pad(item.path, 40)} ${item.reason}: ${EXCLUSION_REASONS[item.reason] ?? item.reason}${rule2}${size}`);
   }
+  if (report.redactions.length > 0) {
+    lines.push("");
+    lines.push(`Redacted: ${report.redactions.length} value(s) masked in place. The files ship; the values never leave this machine.`);
+    for (const item of report.redactions.slice(0, 40)) {
+      lines.push(`  ${pad(`${item.path}:${item.line}`, 40)} ${item.rule} (${item.length} chars)`);
+    }
+    if (report.redactions.length > 40)
+      lines.push(`  ... ${report.redactions.length - 40} more (see the manifest)`);
+  }
   if (report.ignoredPresent.length > 0) {
     lines.push("");
     lines.push(`Git-ignored but present, not uploaded (names only): ${report.ignoredPresent.length}`);
@@ -189239,7 +190178,7 @@ function formatBytes(bytes) {
 }
 
 // src/harness-artifact-bodies.ts
-import { existsSync as existsSync7, lstatSync as lstatSync5, readFileSync as readFileSync8, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync5, readFileSync as readFileSync7, realpathSync as realpathSync5 } from "node:fs";
 import { basename as basename5, dirname as dirname6, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5 } from "node:path";
 var MAX_SCANNED_FILE_BYTES2 = 512 * 1024;
 var SNAPSHOT_BUDGET_SKIP_REASONS = new Set([
@@ -189303,7 +190242,7 @@ function readBoundedRepoText(absPath, rootDir) {
     return;
   }
   try {
-    return readFileSync8(absPath, "utf8");
+    return readFileSync7(absPath, "utf8");
   } catch {
     return;
   }
@@ -189854,9 +190793,9 @@ function detectPromptLiterals(file, out) {
     });
   };
   if (ext === ".py") {
-    const tripleQuoted = /("""|''')([\s\S]*?)\1/g;
+    const tripleQuoted2 = /("""|''')([\s\S]*?)\1/g;
     let match;
-    while ((match = tripleQuoted.exec(file.text)) !== null) {
+    while ((match = tripleQuoted2.exec(file.text)) !== null) {
       record(match.index, match.index + match[0].length - 1, match[2], "python.triple_quoted_string");
     }
     return;
@@ -190036,7 +190975,7 @@ import { extname as extname8 } from "node:path";
 // src/prompt-sources.ts
 var import_typescript2 = __toESM(require_typescript(), 1);
 import { createHash as createHash5 } from "node:crypto";
-import { lstatSync as lstatSync7, readFileSync as readFileSync11, realpathSync as realpathSync8 } from "node:fs";
+import { lstatSync as lstatSync7, readFileSync as readFileSync10, realpathSync as realpathSync8 } from "node:fs";
 import { extname as extname3, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve9 } from "node:path";
 
 // src/prompt-frameworks.ts
@@ -190058,7 +190997,7 @@ var TYPESCRIPT_AGENT_MODULES = [
 
 // src/prompt-source-code.ts
 var import_typescript = __toESM(require_typescript(), 1);
-import { existsSync as existsSync8, lstatSync as lstatSync6, readFileSync as readFileSync9, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync8, lstatSync as lstatSync6, readFileSync as readFileSync8, realpathSync as realpathSync6 } from "node:fs";
 import { dirname as dirname8, extname as extname2, join as join9, resolve as resolve7 } from "node:path";
 var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var MAX_BYTES = 2 * 1024 * 1024;
@@ -190099,7 +191038,7 @@ function parseFile(filePath, state) {
   const cached = state.parsed.get(path);
   if (cached)
     return cached;
-  const text = readFileSync9(path, "utf8");
+  const text = readFileSync8(path, "utf8");
   state.bytesRead += Buffer.byteLength(text);
   state.files.push(path);
   const scriptKind = extname2(path) === ".json" ? import_typescript.default.ScriptKind.JSON : /\.tsx?$/.test(extname2(path)) ? import_typescript.default.ScriptKind.TSX : import_typescript.default.ScriptKind.JSX;
@@ -190537,7 +191476,7 @@ function referenceNames(node) {
 
 // src/prompt-source-python.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { readFileSync as readFileSync10, realpathSync as realpathSync7 } from "node:fs";
+import { readFileSync as readFileSync9, realpathSync as realpathSync7 } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 var PYTHON_AGENT_MODULES_LITERAL = JSON.stringify(PYTHON_AGENT_MODULES);
 var SELECTOR_HELPER = String.raw`import ast,json,os,sys
@@ -191004,7 +191943,7 @@ except Exception as e:
 function extractPythonSource(rootDir, sourcePath, symbol, _forceDependencyGraph = false) {
   let raw = "";
   try {
-    raw = readFileSync10(sourcePath, "utf8");
+    raw = readFileSync9(sourcePath, "utf8");
   } catch {}
   const result = spawnSync2("python3", ["-I", "-c", HELPER], {
     input: JSON.stringify({ root: rootDir, path: sourcePath, symbol, force: _forceDependencyGraph }),
@@ -191098,7 +192037,7 @@ function resolvePromptSource(rootDir, source) {
   } else if (source.selector?.symbol) {
     throw new Error(`${sourcePath}: symbol selectors require a JavaScript, TypeScript, or Python source file`);
   } else if (ext === ".json" || ext === ".yaml" || ext === ".yml" || hasPointer || source.kind === "messages") {
-    const parsed = parseStructured(readFileSync11(sourceAbs, "utf8"), sourcePath, ext);
+    const parsed = parseStructured(readFileSync10(sourceAbs, "utf8"), sourcePath, ext);
     const selected = hasPointer ? jsonPointer(parsed, source.selector.pointer, sourcePath) : parsed;
     const selectedField = source.selector?.pointer?.split("/").at(-1)?.replaceAll("~1", "/").replaceAll("~0", "~");
     const inferredKind = !source.kind && selectedField && /^(?:template|system_template|instance_template)$/.test(selectedField) ? "template" : source.kind;
@@ -191108,7 +192047,7 @@ function resolvePromptSource(rootDir, source) {
     messages = structured.messages;
     kind = structured.kind;
   } else {
-    const raw = readFileSync11(sourceAbs, "utf8");
+    const raw = readFileSync10(sourceAbs, "utf8");
     if (ext === ".md" && /\.prompt\.md$/i.test(sourcePath)) {
       const legacy = parseLegacyMarkdown(raw);
       content = legacy.content;
@@ -191131,7 +192070,7 @@ function resolvePromptSource(rootDir, source) {
       const depAbs = safePath(root, dependency.path);
       files.add(depAbs);
       if (typeof dependency.selector?.pointer === "string") {
-        const parsed = parseStructured(readFileSync11(depAbs, "utf8"), dependency.path, extname3(depAbs).toLowerCase());
+        const parsed = parseStructured(readFileSync10(depAbs, "utf8"), dependency.path, extname3(depAbs).toLowerCase());
         jsonPointer(parsed, dependency.selector.pointer, dependency.path);
       } else if (dependency.selector?.symbol && CODE_EXTENSIONS2.has(extname3(depAbs).toLowerCase())) {
         const dep = extname3(depAbs).toLowerCase() === ".py" ? extractPythonSource(root, depAbs, dependency.selector.symbol) : extractCodeSource(root, depAbs, dependency.selector.symbol);
@@ -191154,7 +192093,7 @@ function resolvePromptSource(rootDir, source) {
     assertSafeMaterializedContent(content, sourcePath);
   else
     assertSafeMaterializedContent(materialized, sourcePath);
-  const dependencies = [...files].sort().map((path) => ({ path: relative5(root, path).replaceAll("\\", "/"), contentHash: sha2562(readFileSync11(path)) }));
+  const dependencies = [...files].sort().map((path) => ({ path: relative5(root, path).replaceAll("\\", "/"), contentHash: sha2562(readFileSync10(path)) }));
   const sourceHash = sha2562(JSON.stringify({ kind, content, systemPrompt: systemPrompt ?? null, messages: messages ?? null }));
   const sourceDefinition = {
     schemaVersion: 1,
@@ -191224,7 +192163,7 @@ function discoverStructuredPromptSources(rootDir, sourcePath) {
   const ext = extname3(file).toLowerCase();
   if (![".json", ".yaml", ".yml"].includes(ext))
     return [];
-  const value = parseStructured(readFileSync11(file, "utf8"), sourcePath, ext);
+  const value = parseStructured(readFileSync10(file, "utf8"), sourcePath, ext);
   const sources = [];
   const base = sourcePath.replace(/\.[^.]+$/, "").replace(/[^A-Za-z0-9_.-]+/g, ".");
   const dedicatedPath = /(^|\/)prompts?(?:\/|\.[^/]+$)|\.prompt\.[^.]+$/i.test(sourcePath);
@@ -191300,14 +192239,14 @@ function discoverCodePromptCandidates(rootDir, sourcePath) {
       addName(candidate.symbol, candidate.knownBuilder === true);
       modelInputs.add(candidate.symbol);
     }
-    for (const match of readFileSync11(file, "utf8").matchAll(/^(?:(?:async\s+)?def\s+([A-Za-z_]\w*)|([A-Za-z_]\w*)\s*=\s*([^\n#]+))/gm)) {
+    for (const match of readFileSync10(file, "utf8").matchAll(/^(?:(?:async\s+)?def\s+([A-Za-z_]\w*)|([A-Za-z_]\w*)\s*=\s*([^\n#]+))/gm)) {
       const name = match[1] ?? match[2];
       const rhs = match[3] ?? "";
       if (name && isPromptName2(name) && (match[1] || /['"`\[({+]/.test(rhs) || /^[A-Za-z_]\w*\s*$/.test(rhs)))
         addName(name, Boolean(match[1]));
     }
   } else {
-    const sf = import_typescript2.default.createSourceFile(file, readFileSync11(file, "utf8"), import_typescript2.default.ScriptTarget.Latest, true, import_typescript2.default.ScriptKind.TSX);
+    const sf = import_typescript2.default.createSourceFile(file, readFileSync10(file, "utf8"), import_typescript2.default.ScriptTarget.Latest, true, import_typescript2.default.ScriptKind.TSX);
     const agentConstructors = new Set;
     for (const statement of sf.statements) {
       if (!import_typescript2.default.isImportDeclaration(statement) || !import_typescript2.default.isStringLiteral(statement.moduleSpecifier) || !TYPESCRIPT_AGENT_MODULES.includes(statement.moduleSpecifier.text))
@@ -191541,7 +192480,7 @@ function sha2562(input) {
 }
 
 // src/prompt-source-verification/index.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { z } from "zod";
 
 // src/prompt-source-validation.ts
@@ -191630,7 +192569,7 @@ function isPromptDefinitionPath(path) {
 }
 
 // src/prompt-source-verification/evidence.ts
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { extname as extname7 } from "node:path";
 
 // src/prompt-source-verification/paths.ts
@@ -191660,14 +192599,14 @@ function safePromptEvidencePath(rootDir, path) {
 var import_typescript3 = __toESM(require_typescript(), 1);
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { extname as extname5 } from "node:path";
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 function proveSink(root, sink) {
   const file = safePromptEvidencePath(root, sink.path);
   const cache = new Map;
   if (!cache.has(file)) {
     if (extname5(file) === ".py") {
       try {
-        const rows = JSON.parse(execFileSync2("python3", ["-I", "-c", PYTHON_PROOF], { input: readFileSync12(file, "utf8"), encoding: "utf8", timeout: 1e4, maxBuffer: 2 * 1024 * 1024 }));
+        const rows = JSON.parse(execFileSync2("python3", ["-I", "-c", PYTHON_PROOF], { input: readFileSync11(file, "utf8"), encoding: "utf8", timeout: 1e4, maxBuffer: 2 * 1024 * 1024 }));
         cache.set(file, new Map(Object.entries(rows).map(([line, proof]) => [Number(line), proof])));
       } catch {
         cache.set(file, new Map);
@@ -191834,7 +192773,7 @@ print(json.dumps(rows))
 `;
 
 // src/prompt-source-location.ts
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import { extname as extname6 } from "node:path";
 function structuredExcerpt(text, source) {
   if (source.selector?.pointer === undefined)
@@ -191888,7 +192827,7 @@ function promptDefinitionExcerpt(rootDir, source) {
       return;
     return { ...extraction.range, text: extraction.sourceText, ...extraction.declarationKind ? { declarationKind: extraction.declarationKind } : {} };
   }
-  const text = readFileSync13(file, "utf8");
+  const text = readFileSync12(file, "utf8");
   return structuredExcerpt(text, source);
 }
 function promptDefinitionRange(rootDir, source) {
@@ -191915,7 +192854,7 @@ function reviewEvidence(rootDir, source, evidence) {
     for (const item of evidence) {
       let text;
       try {
-        text = readFileSync14(safePromptEvidencePath(rootDir, item.path), "utf8");
+        text = readFileSync13(safePromptEvidencePath(rootDir, item.path), "utf8");
       } catch (error) {
         if (item.kind === "model_endpoint")
           return { valid: false, endpointVerified: false, reason: error instanceof Error ? error.message : String(error) };
@@ -192030,7 +192969,7 @@ async function independentlyVerifyPromptSource(rootDir, source, verifier) {
   let priorJudgment;
   try {
     const before = JSON.stringify(checked.resolved.sourceDefinition);
-    const sourceBytes = readFileSync15(safePromptEvidencePath(rootDir, source.path), "utf8");
+    const sourceBytes = readFileSync14(safePromptEvidencePath(rootDir, source.path), "utf8");
     const instruction = promptVerificationInstruction(checked.source, checked.sourceHash, promptDefinitionExcerpt(rootDir, checked.source));
     for (let attempt = 0;attempt < 2; attempt++) {
       const repair = attempt ? `
@@ -192061,7 +193000,7 @@ ${output}` : "";
     }
     if (reviewed.truncated || reviewed.sourceHash !== checked.sourceHash)
       return pending("Verifier output is truncated or cites a different source hash", reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
-    if (before !== snapshot() || readFileSync15(safePromptEvidencePath(rootDir, source.path), "utf8") !== sourceBytes)
+    if (before !== snapshot() || readFileSync14(safePromptEvidencePath(rootDir, source.path), "utf8") !== sourceBytes)
       return pending("Source changed during verification", reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
     if (reviewed.role === "non_prompt")
       return { status: "rejected", reason: reviewed.reason, evidence: reviewed.evidence, sourceHash: checked.sourceHash, role: reviewed.role, usage: normalizeUsage(undefined, false) };
@@ -192421,7 +193360,7 @@ function applyPromptDiscovery(graph, discovery) {
 }
 
 // src/harness-candidate-promotion.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 var PROMOTED_CONFIDENCE = {
   high: 0.85,
@@ -192452,7 +193391,7 @@ function readFileLines(rootDir, path, cache) {
     return cached;
   let lines;
   try {
-    lines = readFileSync16(resolve12(rootDir, path), "utf8").split(/\r?\n/);
+    lines = readFileSync15(resolve12(rootDir, path), "utf8").split(/\r?\n/);
   } catch {
     lines = null;
   }
@@ -193996,7 +194935,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-nph5t2s7.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-tmy3gqwa.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -194330,7 +195269,7 @@ async function runPromptConcernAnalysis(context, rootDir, scanPlan, tenant) {
   const manifest = join10(rootDir, ".moda/prompts.yml");
   let existing = [];
   if (existsSync10(manifest)) {
-    const document = $parseDocument(readFileSync17(manifest, "utf8"));
+    const document = $parseDocument(readFileSync16(manifest, "utf8"));
     if (document.errors.length)
       throw new CliInputError("Invalid prompt manifest.", document.errors[0].message);
     existing = document.toJS({ maxAliasCount: 20 })?.sources ?? [];
@@ -194801,7 +195740,7 @@ function repairCitationLines(report, rootDir) {
       continue;
     let text;
     try {
-      text = readFileSync17(candidatePath, "utf8");
+      text = readFileSync16(candidatePath, "utf8");
     } catch {
       continue;
     }
@@ -196018,7 +196957,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
     let text = "";
     if (isTextFile(path)) {
       try {
-        text = readFileSync17(current, "utf8");
+        text = readFileSync16(current, "utf8");
         inventoryTextBytes += Buffer.byteLength(text, "utf8");
       } catch {
         return;
@@ -196258,7 +197197,7 @@ function readHarnessSyncState(rootDir) {
   if (!existsSync10(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync17(path, "utf8"));
+    const parsed = JSON.parse(readFileSync16(path, "utf8"));
     if (!isRecord4(parsed) || parsed.schemaVersion !== "sync_state.v0.1") {
       return;
     }
@@ -196392,7 +197331,7 @@ function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
   writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
-  return JSON.parse(readFileSync17(manifestPath, "utf8"));
+  return JSON.parse(readFileSync16(manifestPath, "utf8"));
 }
 function writeHarnessArtifacts(graph, rootDir, options = {}) {
   const modaDir = join10(rootDir, MODA_DIR);
@@ -196631,7 +197570,7 @@ function inventoryFiles(rootDir, skipped, options = {}) {
         recordSkipped(skipped, { path: rel2, reason: "scan text budget exceeded" });
       } else {
         try {
-          item.text = readFileSync17(current, "utf8");
+          item.text = readFileSync16(current, "utf8");
           textBytes += Buffer.byteLength(item.text, "utf8");
         } catch {
           recordSkipped(skipped, { path: rel2, reason: "text read failed" });
@@ -196938,7 +197877,7 @@ function maybeAddPromptArtifact(graph, file) {
   if (!isPrompt)
     return;
   const id = stableId2("prompt", file.path);
-  const text = file.text ?? readFileSync17(file.absPath, "utf8");
+  const text = file.text ?? readFileSync16(file.absPath, "utf8");
   upsertArtifact(graph, {
     id,
     type: "prompt",
@@ -197519,7 +198458,7 @@ function detectProviderPackagesInManifests(rootDir) {
   const packageJsonPath = join10(rootDir, "package.json");
   if (existsSync10(packageJsonPath)) {
     try {
-      const deps = packageDependencyNames(readFileSync17(packageJsonPath, "utf8"));
+      const deps = packageDependencyNames(readFileSync16(packageJsonPath, "utf8"));
       for (const provider of PROVIDER_CATALOG) {
         for (const name of provider.packageNames) {
           if (deps.has(name))
@@ -197531,7 +198470,7 @@ function detectProviderPackagesInManifests(rootDir) {
   const pyprojectPath = join10(rootDir, "pyproject.toml");
   if (existsSync10(pyprojectPath)) {
     try {
-      const deps = pyprojectDependencyNames(readFileSync17(pyprojectPath, "utf8"));
+      const deps = pyprojectDependencyNames(readFileSync16(pyprojectPath, "utf8"));
       for (const provider of PROVIDER_CATALOG) {
         for (const name of provider.packageNames) {
           if (deps.has(name.toLowerCase()))
@@ -197948,7 +198887,7 @@ function readSmallTextFileForHash(absPath, rootDir) {
   if (!isTextFile(rel2))
     return;
   try {
-    return readFileSync17(absPath, "utf8");
+    return readFileSync16(absPath, "utf8");
   } catch {
     return;
   }