@tekmidian/pai 1.0.6 → 1.0.7

package/dist/{embed-pass-CN1D8MXl.mjs → embed-pass-DdTMn4DH.mjs}

@@ -1,8 +1,8 @@
 import { _ as paiHomePath } from "./runtime-paths-twfV23YL.mjs";
 import { t as writeFileAtomic } from "./atomic-file-BorMa4T3.mjs";
-import { M as readWorkersSection, m as isLocalProvider } from "./config-Bz8pAU5Q.mjs";
-import { u as workersLogDir } from "./paths-CypxFTfn.mjs";
-import { g as isLive, y as loadStatuses } from "./status-Cecau8Ps.mjs";
+import { M as readWorkersSection, m as isLocalProvider } from "./config-DGV64YJa.mjs";
+import { u as workersLogDir } from "./paths-BwfwHOvN.mjs";
+import { g as isLive, y as loadStatuses } from "./status-DTMT5lyn.mjs";
 import { readFileSync } from "node:fs";
 import { loadavg } from "node:os";
 
@@ -161,4 +161,4 @@ async function runEmbedCycle(d) {
 
 //#endregion
 export { EMBED_PASS_BATCH_SIZE as a, liveYieldCheck as c, runEmbedCycle as d, DEFAULT_EMBED_RESUME_MINUTES as i, readEmbedPasses as l, DEFAULT_EMBED_MAX_LOAD as n, formatEmbedStatus as o, DEFAULT_EMBED_MAX_MINUTES as r, lastRecordedEmbedPass as s, DEFAULT_EMBED_CYCLE_MAX_MINUTES as t, recordEmbedPass as u };
-//# sourceMappingURL=embed-pass-CN1D8MXl.mjs.map
+//# sourceMappingURL=embed-pass-DdTMn4DH.mjs.map

package/dist/{endreason-C2-hYK0_.mjs → endreason-BjPom527.mjs}

@@ -1,7 +1,7 @@
 import { t as writeFileAtomic } from "./atomic-file-BorMa4T3.mjs";
-import { Et as appendLedger } from "./config-Bz8pAU5Q.mjs";
-import { r as eventsPath } from "./paths-CypxFTfn.mjs";
-import { D as pidAlive } from "./status-Cecau8Ps.mjs";
+import { Et as appendLedger } from "./config-DGV64YJa.mjs";
+import { r as eventsPath } from "./paths-BwfwHOvN.mjs";
+import { D as pidAlive } from "./status-DTMT5lyn.mjs";
 import { appendFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -151,4 +151,4 @@ function appendStopEvent(logDir, id, stop) {
 
 //#endregion
 export { endLabel as a, endFields as i, callerDescription as n, parentInfo as o, decideEndReason as r, requestKill as s, appendStopEvent as t };
-//# sourceMappingURL=endreason-C2-hYK0_.mjs.map
+//# sourceMappingURL=endreason-BjPom527.mjs.map

package/dist/{fallback-CwPSCrX8.mjs → fallback-CQ8_CuVu.mjs}

@@ -1,8 +1,8 @@
 import { l as claudeHomeDir, t as aibrokerHomeDir } from "./runtime-paths-twfV23YL.mjs";
-import { F as resolveProviderKey, L as writeWorkersSection, M as readWorkersSection, P as resolveModelCapability, c as WorkersConfigError } from "./config-Bz8pAU5Q.mjs";
+import { F as resolveProviderKey, L as writeWorkersSection, M as readWorkersSection, P as resolveModelCapability, c as WorkersConfigError } from "./config-DGV64YJa.mjs";
 import { O as readJsonStrict, k as writeJsonAtomic } from "./config-SlZ-Z52i.mjs";
-import { u as workersLogDir } from "./paths-CypxFTfn.mjs";
-import { _ as resolveTarget } from "./routing-aJKMIagQ.mjs";
+import { u as workersLogDir } from "./paths-BwfwHOvN.mjs";
+import { _ as resolveTarget } from "./routing-CF0wlR-_.mjs";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -272,4 +272,4 @@ function fallbackStatusText(s) {
 
 //#endregion
 export { fallbackStatusText as i, fallbackOn as n, fallbackStatus as r, fallbackOff as t };
-//# sourceMappingURL=fallback-CwPSCrX8.mjs.map
+//# sourceMappingURL=fallback-CQ8_CuVu.mjs.map

package/dist/{health-D0mUAVdw.mjs → health-Bb2U4PNK.mjs}

@@ -1,7 +1,7 @@
 import { _ as paiHomePath } from "./runtime-paths-twfV23YL.mjs";
-import { t as ANTHROPIC_NATIVE } from "./config-Bz8pAU5Q.mjs";
-import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall } from "./routing-aJKMIagQ.mjs";
-import { n as tierProviderNames, t as isLocalCandidate } from "./local-candidate-DFd4pp-w.mjs";
+import { t as ANTHROPIC_NATIVE } from "./config-DGV64YJa.mjs";
+import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall } from "./routing-CF0wlR-_.mjs";
+import { n as tierProviderNames, t as isLocalCandidate } from "./local-candidate-C2FGhf54.mjs";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { Chalk } from "chalk";
 
@@ -311,4 +311,4 @@ function saveBudgetSnapshot(map, now = Date.now()) {
 
 //#endregion
 export { colorEnabled as a, renderCommandHelp as c, renderOverview as d, renderTable as f, saveBudgetSnapshot as i, renderMarkdown as l, usageLine as m, readBudget as n, makeStyle as o, suggest as p, readBudgetSnapshot as r, mdCommand as s, providerHealth as t, renderMore as u };
-//# sourceMappingURL=health-D0mUAVdw.mjs.map
+//# sourceMappingURL=health-Bb2U4PNK.mjs.map

package/dist/hooks/block-sleep-poll.mjs

@@ -8174,6 +8174,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8768,6 +8769,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8904,6 +8912,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/capture-all-events.mjs

@@ -7728,20 +7728,50 @@ var PS_MAX_BUFFER = 64 * 1024 * 1024;
 var REDACTED = "[REDACTED]";
 var REDACTED_RE = String.raw`\[REDACTED\]`;
 var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
 var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
 var REDACT_RULES = [
   {
     // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
     id: "authorization",
-    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
     replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
   },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
   {
     // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
-    // the word must be a whole key segment, so `monkeys=` stays untouched
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
     id: "key-value",
-    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
-    replace: (_m, key, sep2) => `${key}${sep2}${REDACTED}`
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep2, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep2[0] === '"' || sep2[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep2}${q}${REDACTED}${q}` : `${key}${sep2}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
   },
   {
     // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
@@ -7765,13 +7795,13 @@ var REDACT_RULES = [
     // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
     // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
     id: "token-prefix",
-    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
     replace: REDACTED
   },
   {
     // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
     id: "long-run",
-    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
     // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
     replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
   }
@@ -7779,11 +7809,12 @@ var REDACT_RULES = [
 var PEM_BLOCK = /-----BEGIN[^-\n]*PRIVATE KEY-----[\s\S]*?(?:-----END[^-\n]*PRIVATE KEY-----|$)/g;
 var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
 var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
 var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
 function redactLine(line) {
   let out = line;
   for (const r of LINE_RULES) out = out.replace(r.re, r.replace);
-  if (KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
+  if (out.length <= LONG_RUN_MAX_LINE && KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
   return out;
 }
 function redactSecrets(text) {

package/dist/hooks/capture-tool-output.mjs

@@ -145,20 +145,50 @@ var PS_MAX_BUFFER = 64 * 1024 * 1024;
 var REDACTED = "[REDACTED]";
 var REDACTED_RE = String.raw`\[REDACTED\]`;
 var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
 var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
 var REDACT_RULES = [
   {
     // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
     id: "authorization",
-    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
     replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
   },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
   {
     // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
-    // the word must be a whole key segment, so `monkeys=` stays untouched
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
     id: "key-value",
-    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
-    replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
   },
   {
     // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
@@ -182,13 +212,13 @@ var REDACT_RULES = [
     // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
     // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
     id: "token-prefix",
-    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
     replace: REDACTED
   },
   {
     // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
     id: "long-run",
-    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
     // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
     replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
   }
@@ -196,11 +226,12 @@ var REDACT_RULES = [
 var PEM_BLOCK = /-----BEGIN[^-\n]*PRIVATE KEY-----[\s\S]*?(?:-----END[^-\n]*PRIVATE KEY-----|$)/g;
 var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
 var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
 var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
 function redactLine(line) {
   let out = line;
   for (const r of LINE_RULES) out = out.replace(r.re, r.replace);
-  if (KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
+  if (out.length <= LONG_RUN_MAX_LINE && KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
   return out;
 }
 function redactSecrets(text) {

package/dist/hooks/handoff-link.mjs

@@ -14,20 +14,50 @@ var PS_MAX_BUFFER = 64 * 1024 * 1024;
 var REDACTED = "[REDACTED]";
 var REDACTED_RE = String.raw`\[REDACTED\]`;
 var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
 var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
 var REDACT_RULES = [
   {
     // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
     id: "authorization",
-    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
     replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
   },
+  {
+    // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+    id: "cookie",
+    re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+    replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+  },
   {
     // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
-    // the word must be a whole key segment, so `monkeys=` stays untouched
+    // the word must be a whole key segment, so `monkeys=` stays untouched.
+    // The separator may start with the key's closing quote (JSON); it is kept.
     id: "key-value",
-    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
-    replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+    replace: (m, key, sep, val) => {
+      if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+      const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+      return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+    }
+  },
+  {
+    // npmrc `//registry/:_authToken=xxx`
+    id: "npm-auth-token",
+    re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `curl -u user:pass` / `--user user:pass` — keep the user
+    id: "curl-user",
+    re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+    id: "mysql-p",
+    re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+    replace: (_m, head) => `${head}${REDACTED}`
   },
   {
     // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
@@ -51,19 +81,20 @@ var REDACT_RULES = [
     // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
     // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
     id: "token-prefix",
-    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
     replace: REDACTED
   },
   {
     // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
     id: "long-run",
-    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
     // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
     replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
   }
 ];
 var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
 var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var LONG_RUN_MAX_LINE = 64 * 1024;
 var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
 
 // src/hooks/ts/lib/loop-guard.ts

package/dist/hooks/load-project-context.mjs

@@ -8177,6 +8177,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8771,6 +8772,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8907,6 +8915,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/local-model-hint.mjs

@@ -8191,6 +8191,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8785,6 +8786,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8921,6 +8929,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/route-agents-to-worker.mjs

@@ -8194,6 +8194,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8788,6 +8789,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8924,6 +8932,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,