@tekmidian/pai 1.0.5 → 1.0.7

package/dist/hooks/supervision-banner.mjs

@@ -7351,7 +7351,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse2(src, reviver, options) {
+    function parse3(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -7392,7 +7392,7 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document5.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse2;
+    exports.parse = parse3;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument5;
     exports.stringify = stringify;
@@ -7777,27 +7777,6 @@ var init_scope = __esm({
   }
 });
 
-// src/workers/chatui.ts
-var init_chatui = __esm({
-  "src/workers/chatui.ts"() {
-    "use strict";
-  }
-});
-
-// src/workers/deadline.ts
-var init_deadline = __esm({
-  "src/workers/deadline.ts"() {
-    "use strict";
-  }
-});
-
-// src/workers/active-time.ts
-var init_active_time = __esm({
-  "src/workers/active-time.ts"() {
-    "use strict";
-  }
-});
-
 // src/workers/stagger.ts
 var init_stagger = __esm({
   "src/workers/stagger.ts"() {
@@ -7806,6 +7785,14 @@ var init_stagger = __esm({
   }
 });
 
+// src/workers/waiting.ts
+var init_waiting = __esm({
+  "src/workers/waiting.ts"() {
+    "use strict";
+    init_args();
+  }
+});
+
 // src/workers/capacity.ts
 var DEFAULT_CAPACITY;
 var init_capacity = __esm({
@@ -7813,23 +7800,37 @@ var init_capacity = __esm({
     "use strict";
     init_stagger();
     init_config3();
+    init_waiting();
     init_status();
     DEFAULT_CAPACITY = { enabled: true, localDefaultCap: 1, uncappedQueueCap: 3, maxTotalWaitMs: 2 * 36e5, heartbeatMs: 6e4, agingMs: 15 * 6e4 };
   }
 });
 
-// src/workers/denials.ts
-var init_denials = __esm({
-  "src/workers/denials.ts"() {
+// src/workers/chatui.ts
+var init_chatui = __esm({
+  "src/workers/chatui.ts"() {
     "use strict";
   }
 });
 
-// src/workers/waiting.ts
-var init_waiting = __esm({
-  "src/workers/waiting.ts"() {
+// src/workers/deadline.ts
+var init_deadline = __esm({
+  "src/workers/deadline.ts"() {
+    "use strict";
+  }
+});
+
+// src/workers/active-time.ts
+var init_active_time = __esm({
+  "src/workers/active-time.ts"() {
+    "use strict";
+  }
+});
+
+// src/workers/denials.ts
+var init_denials = __esm({
+  "src/workers/denials.ts"() {
     "use strict";
-    init_args();
   }
 });
 
@@ -8072,6 +8073,7 @@ var init_worktree = __esm({
     init_paths();
     init_pending();
     init_pool();
+    init_config2();
   }
 });
 
@@ -8095,6 +8097,189 @@ var init_endreason = __esm({
   }
 });
 
+// src/workers/ps-table.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+function truncateLines(text, max = PS_MAX_LINE) {
+  return text.split("\n").map((l) => l.length > max ? l.slice(0, max) : l).join("\n");
+}
+function psTable(format, run = realRunner, maxLine = PS_MAX_LINE) {
+  return truncateLines(run(["-axo", format]), maxLine);
+}
+var PS_MAX_BUFFER, PS_MAX_LINE, realRunner;
+var init_ps_table = __esm({
+  "src/workers/ps-table.ts"() {
+    "use strict";
+    PS_MAX_BUFFER = 64 * 1024 * 1024;
+    PS_MAX_LINE = 1024;
+    realRunner = (args) => execFileSync2("ps", args, { encoding: "utf8", env: { ...process.env, LC_ALL: "C" }, maxBuffer: PS_MAX_BUFFER, timeout: 15e3 });
+  }
+});
+
+// src/workers/hang-probe.ts
+var init_hang_probe = __esm({
+  "src/workers/hang-probe.ts"() {
+    "use strict";
+    init_ps_table();
+  }
+});
+
+// src/utils/redact.ts
+var REDACTED, REDACTED_RE, KEY_WORDS, PROSE, VAL, REDACT_RULES, LINE_RULES, LONG_RUN, LONG_RUN_MAX_LINE, KEY_LINE;
+var init_redact = __esm({
+  "src/utils/redact.ts"() {
+    "use strict";
+    REDACTED = "[REDACTED]";
+    REDACTED_RE = String.raw`\[REDACTED\]`;
+    KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+    PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
+    VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+    REDACT_RULES = [
+      {
+        // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+        id: "authorization",
+        re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
+        replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+      },
+      {
+        // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+        id: "cookie",
+        re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+        replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+      },
+      {
+        // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+        // the word must be a whole key segment, so `monkeys=` stays untouched.
+        // The separator may start with the key's closing quote (JSON); it is kept.
+        id: "key-value",
+        re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+        replace: (m, key, sep, val) => {
+          if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+          const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+          return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+        }
+      },
+      {
+        // npmrc `//registry/:_authToken=xxx`
+        id: "npm-auth-token",
+        re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `curl -u user:pass` / `--user user:pass` — keep the user
+        id: "curl-user",
+        re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+        id: "mysql-p",
+        re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+        id: "env-style",
+        re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+        id: "cli-flag",
+        re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `scheme://user:pass@host` — redact the password, keep user and host
+        id: "url-credentials",
+        re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+        replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+      },
+      {
+        // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+        // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+        id: "token-prefix",
+        re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+        replace: REDACTED
+      },
+      {
+        // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+        id: "long-run",
+        re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
+        // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+        replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+      }
+    ];
+    LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+    LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+    LONG_RUN_MAX_LINE = 64 * 1024;
+    KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+  }
+});
+
+// src/hooks/ts/lib/build-gate.ts
+var init_build_gate = __esm({
+  "src/hooks/ts/lib/build-gate.ts"() {
+    "use strict";
+  }
+});
+
+// src/hooks/ts/lib/loop-guard.ts
+var LOOP_MAX_REPEATS, LOOP_READ_STREAK, SELF, LOOP_DENY_REASON, WAIT_CAP_MS, FP_FULL_READ_BYTES, FP_TOTAL_BYTES;
+var init_loop_guard = __esm({
+  "src/hooks/ts/lib/loop-guard.ts"() {
+    "use strict";
+    init_hang_probe();
+    init_redact();
+    init_build_gate();
+    LOOP_MAX_REPEATS = 4;
+    LOOP_READ_STREAK = Number(process.env.PAI_LOOP_READ_STREAK) > 0 ? Number(process.env.PAI_LOOP_READ_STREAK) : 15;
+    SELF = "If your part is done, commit and write your R report. If you are stuck, report the blocker in R x= (or use pai worker help if available).";
+    LOOP_DENY_REASON = `loop guard: you ran this command ${LOOP_MAX_REPEATS} times with the same result and nothing changed. Stop repeating it. ${SELF}`;
+    WAIT_CAP_MS = 45 * 6e4;
+    FP_FULL_READ_BYTES = 256 * 1024;
+    FP_TOTAL_BYTES = 4 * 1024 * 1024;
+  }
+});
+
+// src/audit/scan.ts
+var MAX_TEXT_BYTES;
+var init_scan = __esm({
+  "src/audit/scan.ts"() {
+    "use strict";
+    init_loop_guard();
+    MAX_TEXT_BYTES = 256 * 1024;
+  }
+});
+
+// src/hooks/ts/lib/rules/builtin.generated.ts
+var init_builtin_generated = __esm({
+  "src/hooks/ts/lib/rules/builtin.generated.ts"() {
+    "use strict";
+  }
+});
+
+// src/hooks/ts/lib/rules/load.ts
+var import_yaml6;
+var init_load = __esm({
+  "src/hooks/ts/lib/rules/load.ts"() {
+    "use strict";
+    import_yaml6 = __toESM(require_dist(), 1);
+    init_pai_home();
+    init_builtin_generated();
+  }
+});
+
+// src/workers/scan.ts
+var init_scan2 = __esm({
+  "src/workers/scan.ts"() {
+    "use strict";
+    init_scan();
+    init_load();
+    init_paths();
+    init_status();
+  }
+});
+
 // src/workers/render.ts
 var init_render = __esm({
   "src/workers/render.ts"() {
@@ -8114,6 +8299,7 @@ var init_render = __esm({
     init_scope();
     init_endreason();
     init_report();
+    init_scan2();
   }
 });
 
@@ -8170,6 +8356,8 @@ var init_pane_bar = __esm({
     "use strict";
     init_chatui();
     init_render();
+    init_capacity();
+    init_pane_exec();
     init_pane_policy();
   }
 });
@@ -8179,29 +8367,12 @@ var init_pane_exec = __esm({
   "src/workers/pane-exec.ts"() {
     "use strict";
     init_pai_home();
+    init_capacity();
     init_pane_bar();
     init_pane_policy();
   }
 });
 
-// src/workers/ps-table.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-function truncateLines(text, max = PS_MAX_LINE) {
-  return text.split("\n").map((l) => l.length > max ? l.slice(0, max) : l).join("\n");
-}
-function psTable(format, run = realRunner, maxLine = PS_MAX_LINE) {
-  return truncateLines(run(["-axo", format]), maxLine);
-}
-var PS_MAX_BUFFER, PS_MAX_LINE, realRunner;
-var init_ps_table = __esm({
-  "src/workers/ps-table.ts"() {
-    "use strict";
-    PS_MAX_BUFFER = 64 * 1024 * 1024;
-    PS_MAX_LINE = 1024;
-    realRunner = (args) => execFileSync2("ps", args, { encoding: "utf8", env: { ...process.env, LC_ALL: "C" }, maxBuffer: PS_MAX_BUFFER, timeout: 15e3 });
-  }
-});
-
 // src/workers/pane-title.ts
 var init_pane_title = __esm({
   "src/workers/pane-title.ts"() {

package/dist/hooks/worker-edit-repair.mjs

@@ -8177,6 +8177,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8771,6 +8772,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8907,6 +8915,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/worker-guard.mjs

@@ -8180,6 +8180,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8774,6 +8775,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8910,6 +8918,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,
@@ -9254,7 +9263,7 @@ function ownsPid(status) {
       env: { ...process.env, LC_ALL: "C" }
     }).trim();
     const psStart = Date.parse(out);
-    const started = spawnTimeOf(status) ?? Date.parse(status.started.replace(" ", "T"));
+    const started = status.procStart ?? spawnTimeOf(status) ?? Date.parse(status.started.replace(" ", "T"));
     if (Number.isNaN(psStart) || Number.isNaN(started)) return alive(status.pid);
     return Math.abs(psStart - started) <= 12e4;
   } catch {
@@ -10408,6 +10417,93 @@ function wrapTestCommand(command) {
   return `${WRAP} --cmd-b64 ${Buffer.from(command, "utf8").toString("base64")}`;
 }
 
+// src/utils/redact.ts
+var REDACTED = "[REDACTED]";
+var REDACTED_RE = String.raw`\[REDACTED\]`;
+var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
+var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+var REDACT_RULES = [
+  {
+    // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+    id: "authorization",
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
+    replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+  },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
+  {
+    // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
+    id: "key-value",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+    id: "env-style",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+    id: "cli-flag",
+    re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `scheme://user:pass@host` — redact the password, keep user and host
+    id: "url-credentials",
+    re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+    replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+  },
+  {
+    // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+    // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+    id: "token-prefix",
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    replace: REDACTED
+  },
+  {
+    // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+    id: "long-run",
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
+    // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+    replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+  }
+];
+var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
+var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+
 // src/hooks/ts/lib/build-gate.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { existsSync as existsSync12, readFileSync as readFileSync12, realpathSync as realpathSync2 } from "node:fs";

package/dist/hooks/worker-note.mjs

@@ -8177,6 +8177,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8771,6 +8772,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8907,6 +8915,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,
@@ -9243,6 +9252,104 @@ function currentWorkerId(env = process.env, logDir) {
 // src/workers/ps-table.ts
 var PS_MAX_BUFFER = 64 * 1024 * 1024;
 
+// src/utils/redact.ts
+var REDACTED = "[REDACTED]";
+var REDACTED_RE = String.raw`\[REDACTED\]`;
+var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
+var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+var REDACT_RULES = [
+  {
+    // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+    id: "authorization",
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
+    replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+  },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
+  {
+    // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
+    id: "key-value",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+    id: "env-style",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+    id: "cli-flag",
+    re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `scheme://user:pass@host` — redact the password, keep user and host
+    id: "url-credentials",
+    re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+    replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+  },
+  {
+    // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+    // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+    id: "token-prefix",
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    replace: REDACTED
+  },
+  {
+    // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+    id: "long-run",
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
+    // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+    replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+  }
+];
+var PEM_BLOCK = /-----BEGIN[^-\n]*PRIVATE KEY-----[\s\S]*?(?:-----END[^-\n]*PRIVATE KEY-----|$)/g;
+var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
+var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+function redactLine(line) {
+  let out = line;
+  for (const r of LINE_RULES) out = out.replace(r.re, r.replace);
+  if (out.length <= LONG_RUN_MAX_LINE && KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
+  return out;
+}
+function redactSecrets(text) {
+  const withPem = text.replace(PEM_BLOCK, `-----BEGIN PRIVATE KEY----- ${REDACTED}`);
+  return withPem.split("\n").map(redactLine).join("\n");
+}
+
 // src/hooks/ts/lib/loop-guard.ts
 var LOOP_MAX_REPEATS = 4;
 var LOOP_READ_STREAK = Number(process.env.PAI_LOOP_READ_STREAK) > 0 ? Number(process.env.PAI_LOOP_READ_STREAK) : 15;
@@ -9360,10 +9467,8 @@ ${typeof r.stderr === "string" ? r.stderr : ""}`;
   text = text.replace(TMP_PATH, "TMP").replace(/\s+/g, " ").trim();
   return text.length > RESULT_CHARS ? `${text.slice(0, RESULT_CHARS / 2)} ${text.slice(-RESULT_CHARS / 2)}` : text;
 }
-var SECRET_LINE = /pass(?:word|wd)|secret|token|api[_-]?key|credential|authorization|bearer|private key|^\s*(?:export\s+)?[A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=|\b(?:sk|ghp|gho|xox[bap])[-_][A-Za-z0-9_-]{16,}|\b[A-Za-z0-9+]{40,}={0,2}(?![\w/])|\b[a-z][a-z0-9+.-]*:\/\/[^\s\/:@]+:[^\s\/@]+@|\b(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}\b|\bgh[pousr]_[A-Za-z0-9]{20,}/i;
-var MASKED_LINE = "[line masked: looks like a secret]";
 function maskSecrets(text) {
-  return text.split("\n").map((l) => SECRET_LINE.test(l) ? MASKED_LINE : l).join("\n");
+  return redactSecrets(text);
 }
 function rawText(response) {
   if (typeof response === "string") return response;