@wix/pathgrade 1.0.38 → 1.0.39

package/dist/sdk/agent.js

@@ -20,6 +20,8 @@ import { collectOpenCodeMcpToolNames } from '../agents/opencode/contract.js';
 import { collectSensitiveEnvValues } from '../tool-event-results.js';
 import { createAskUserHandler } from './ask-bus/handler.js';
 import { resolveAgentRuntimeOptions } from './agent-runtime-options.js';
+import { extractToolEventsFromLog } from '../tool-events.js';
+import { clearToolEventRuntimeMetadata } from './tool-event-secrets.js';
 /**
  * Test-only injection point: override the sink used by the next emitter
  * built inside `createAgent`. Pass `null` to restore the default (stderr).
@@ -392,7 +394,14 @@ class AgentImpl {
             }
         }
         finally {
-            await this.ws.dispose();
+            try {
+                await this.ws.dispose();
+            }
+            finally {
+                for (const event of extractToolEventsFromLog(this._log)) {
+                    clearToolEventRuntimeMetadata(event);
+                }
+            }
         }
     }
 }

package/dist/sdk/evaluate.js

@@ -7,6 +7,9 @@ import { runScorer } from './run-scorer.js';
 import { createLLMClient } from '../utils/llm.js';
 import { sandboxExec } from '../providers/sandbox-exec.js';
 import { buildTranscript, loadRunSnapshot, WorkspaceMissingError } from './snapshots.js';
+import { sanitizePersistenceValue } from '../tool-event-results.js';
+import { getOriginalMcpInput } from './mcp-event-input.js';
+import { cloneToolEventWithRuntimeMetadata, collectToolEventSensitiveValues, } from './tool-event-secrets.js';
 import fs from 'fs-extra';
 import path from 'path';
 import { summarizeFlow } from './agent-flow.js';
@@ -154,6 +157,9 @@ export function evaluateStepScorers(agent, scorers, opts) {
     return evaluateAgent(agent, scorers, opts, false);
 }
 async function fromSnapshot(snapshotPath, scorers, opts) {
+    if (opts?.deterministicToolEvidence === 'live') {
+        throw new TypeError("evaluate.fromSnapshot() does not support deterministicToolEvidence: 'live'");
+    }
     const snapshot = await loadRunSnapshot(snapshotPath);
     const trackedLLM = opts?.llm ?? createLLMClient({ adapters: [{
                 name: 'runtime', isAvailable: async () => true,
@@ -201,6 +207,9 @@ async function evaluateWithContext(ctx, scorers, opts) {
                 call: (prompt, callOpts) => getRuntime().llm.call(prompt, callOpts),
             }] });
     const onScorerError = opts?.onScorerError ?? 'skip';
+    const deterministicCtx = opts?.deterministicToolEvidence === 'live'
+        ? createLiveDeterministicContext(ctx)
+        : ctx;
     const phase1 = [];
     const phase2 = [];
     const phase3 = [];
@@ -219,7 +228,7 @@ async function evaluateWithContext(ctx, scorers, opts) {
         }
     }
     const results = [];
-    const phase1Results = await Promise.all(phase1.map((g) => runScorer(g, ctx)));
+    const phase1Results = await Promise.all(phase1.map((g) => runScorer(g, deterministicCtx)));
     results.push(...phase1Results);
     const anyCheckFailed = failFast && phase1Results.some((r) => r.type === 'check' && r.status !== 'error' && r.score === 0);
     if (anyCheckFailed) {
@@ -230,7 +239,7 @@ async function evaluateWithContext(ctx, scorers, opts) {
     else {
         const judgeResults = await runJudgePipeline(phase2, ctx, { llm: trackedLLM });
         results.push(...judgeResults);
-        const phase3Results = await Promise.all(phase3.map((g) => runScorer(g, ctx)));
+        const phase3Results = await Promise.all(phase3.map((g) => runScorer(g, deterministicCtx)));
         results.push(...phase3Results);
     }
     const tokenUsage = trackedLLM.tokenUsage ?? { inputTokens: 0, outputTokens: 0 };
@@ -240,12 +249,58 @@ async function evaluateWithContext(ctx, scorers, opts) {
     const totalWeight = scoringResults.reduce((sum, r) => sum + r.weight, 0);
     const weightedSum = scoringResults.reduce((sum, r) => sum + r.score * r.weight, 0);
     const score = totalWeight > 0 ? weightedSum / totalWeight : 0;
-    return {
+    return sanitizePersistenceValue({
         score,
         scorers: results,
         tokenUsage,
+    }, collectToolEventSensitiveValues(ctx.toolEvents));
+}
+function createLiveDeterministicContext(ctx) {
+    return {
+        ...ctx,
+        toolEvents: ctx.toolEvents.map((event) => {
+            const originalInput = event.action === 'mcp_tool_call'
+                ? getOriginalMcpInput(event)
+                : undefined;
+            const mcp = normalizedMcpClassification(event);
+            return originalInput
+                ? cloneToolEventWithRuntimeMetadata(event, { arguments: {
+                        ...event.arguments,
+                        server: event.arguments?.server,
+                        tool: event.arguments?.tool,
+                        status: event.arguments?.status,
+                        ...structuredClone(originalInput),
+                    }, ...(mcp ? { mcp } : {}) })
+                : event;
+        }),
     };
 }
+function normalizedMcpClassification(event) {
+    if (event.mcp)
+        return event.mcp;
+    const args = event.arguments ?? {};
+    const separator = event.providerToolName.indexOf('.');
+    const serverName = typeof args.server === 'string' ? args.server
+        : separator > 0 ? event.providerToolName.slice(0, separator) : undefined;
+    const toolName = typeof args.tool === 'string' ? args.tool
+        : separator > 0 && separator < event.providerToolName.length - 1
+            ? event.providerToolName.slice(separator + 1) : undefined;
+    const status = event.status ?? args.status;
+    if (!serverName || !toolName)
+        return undefined;
+    if (status === 'completed')
+        return { serverName, toolName, invocation: 'confirmed', outcome: 'completed' };
+    if (status === 'error' || status === 'failed') {
+        return { serverName, toolName, invocation: 'confirmed', outcome: 'tool_error' };
+    }
+    if (status === 'user_denied' || status === 'policy_denied') {
+        return { serverName, toolName, invocation: 'not_invoked', outcome: status };
+    }
+    if (status === 'protocol_error') {
+        return { serverName, toolName, invocation: 'unknown', outcome: 'protocol_error' };
+    }
+    return undefined;
+}
 function maybeThrowOnScorerErrors(result, mode) {
     if (mode !== 'fail')
         return;

package/dist/sdk/judge-prompt-builder.js

@@ -1,13 +1,15 @@
 import { sanitizePersistenceValue } from '../tool-event-results.js';
-import { getToolEventSensitiveValues } from './tool-event-secrets.js';
+import { collectToolEventSensitiveValues, } from './tool-event-secrets.js';
 export function buildJudgePrompt(scorer, ctx, input) {
     const sections = [];
-    sections.push(`## Session Transcript\n${ctx.transcript}`);
+    const sensitiveValues = collectToolEventSensitiveValues(ctx.toolEvents);
+    sections.push(`## Session Transcript\n${sanitizePersistenceValue(ctx.transcript, sensitiveValues)}`);
     if (scorer.includeToolEvents && ctx.toolEvents.length > 0) {
         sections.push(`## Tool Events\n${formatToolEvents(ctx)}`);
     }
     if (input) {
-        for (const [key, value] of Object.entries(input)) {
+        const sanitizedInput = sanitizePersistenceValue(input, sensitiveValues);
+        for (const [key, value] of Object.entries(sanitizedInput)) {
             const body = typeof value === 'string' ? value : JSON.stringify(value, null, 2);
             sections.push(`## ${key}\n${body}`);
         }
@@ -22,10 +24,10 @@ ${scorer.rubric}
 Respond with ONLY a JSON object: {"score": <number>, "details": "<brief explanation>"}`;
 }
 function formatToolEvents(ctx) {
+    const sensitiveValues = collectToolEventSensitiveValues(ctx.toolEvents);
     return ctx.toolEvents
         .map((event) => {
         const turn = event.turnNumber ? `turn ${event.turnNumber}` : 'instruction';
-        const sensitiveValues = getToolEventSensitiveValues(event);
         const details = [
             event.status ? `  status: ${event.status}` : undefined,
             event.mcp ? `  mcp: ${JSON.stringify(event.mcp)}` : undefined,
@@ -41,7 +43,8 @@ function formatToolEvents(ctx) {
 }
 export function buildBatchedJudgePrompt(judges, ctx, inputs) {
     const sections = [];
-    sections.push(`## Session Transcript\n${ctx.transcript}`);
+    const sensitiveValues = collectToolEventSensitiveValues(ctx.toolEvents);
+    sections.push(`## Session Transcript\n${sanitizePersistenceValue(ctx.transcript, sensitiveValues)}`);
     if (judges.some((j) => j.includeToolEvents) && ctx.toolEvents.length > 0) {
         sections.push(`## Tool Events\n${formatToolEvents(ctx)}`);
     }
@@ -49,7 +52,8 @@ export function buildBatchedJudgePrompt(judges, ctx, inputs) {
         const parts = [`### Rubric ${i + 1}: "${j.name}"\n${j.rubric}`];
         const input = inputs[i];
         if (input) {
-            for (const [key, value] of Object.entries(input)) {
+            const sanitizedInput = sanitizePersistenceValue(input, sensitiveValues);
+            for (const [key, value] of Object.entries(sanitizedInput)) {
                 const body = typeof value === 'string' ? value : JSON.stringify(value, null, 2);
                 parts.push(`#### ${key}\n${body}`);
             }
@@ -77,7 +81,7 @@ export function buildToolUseJudgePrompt(scorer, ctx) {
     ].join('\n');
     const parts = [];
     parts.push('## Session Transcript');
-    parts.push(ctx.transcript);
+    parts.push(sanitizePersistenceValue(ctx.transcript, collectToolEventSensitiveValues(ctx.toolEvents)));
     if (scorer.includeToolEvents && ctx.toolEvents.length > 0) {
         parts.push('## Tool Events');
         parts.push(formatToolEvents(ctx));

package/dist/sdk/mcp-event-input.d.ts

@@ -1,3 +1,4 @@
 import type { ToolEvent } from '../tool-events.js';
 export declare function attachOriginalMcpInput(event: ToolEvent, input: Record<string, unknown>): ToolEvent;
 export declare function getOriginalMcpInput(event: ToolEvent): Record<string, unknown> | undefined;
+export declare function clearOriginalMcpInput(event: ToolEvent): void;

package/dist/sdk/mcp-event-input.js

@@ -6,3 +6,6 @@ export function attachOriginalMcpInput(event, input) {
 export function getOriginalMcpInput(event) {
     return originalInputs.get(event);
 }
+export function clearOriginalMcpInput(event) {
+    originalInputs.delete(event);
+}

package/dist/sdk/mcp-evidence.js

@@ -2,9 +2,12 @@ export function getMcpToolCall(event) {
     if (event.action !== 'mcp_tool_call')
         return undefined;
     const args = event.arguments ?? {};
-    const serverName = typeof args.server === 'string' ? args.server : undefined;
-    const toolName = typeof args.tool === 'string' ? args.tool : undefined;
-    const status = typeof args.status === 'string' ? args.status : undefined;
+    const serverName = event.mcp?.serverName
+        ?? (typeof args.server === 'string' ? args.server : undefined);
+    const toolName = event.mcp?.toolName
+        ?? (typeof args.tool === 'string' ? args.tool : undefined);
+    const argumentStatus = typeof args.status === 'string' ? args.status : undefined;
+    const status = mcpClassificationStatus(event.mcp, argumentStatus) ?? argumentStatus;
     if (!serverName || !toolName || !status)
         return undefined;
     return {
@@ -15,6 +18,16 @@ export function getMcpToolCall(event) {
         event,
     };
 }
+function mcpClassificationStatus(mcp, argumentStatus) {
+    if (!mcp)
+        return undefined;
+    if (mcp.invocation === 'confirmed') {
+        if (mcp.outcome === 'completed')
+            return 'completed';
+        return argumentStatus === 'failed' || argumentStatus === 'error' ? argumentStatus : 'error';
+    }
+    return mcp.outcome;
+}
 export function isMcpToolCall(event, expected = {}) {
     const call = getMcpToolCall(event);
     return call !== undefined && matchesMcpToolCall(call, expected);

package/dist/sdk/mcp-safety.js

@@ -1,4 +1,4 @@
-import { sanitizePersistenceValue } from '../tool-event-results.js';
+import { sanitizeUntrustedPersistenceValue } from '../tool-event-results.js';
 export function decideMcpToolCall(options, request) {
     const runMode = options?.runMode ?? 'mock';
     if (runMode === 'mock')
@@ -31,7 +31,7 @@ export function decideMcpToolCall(options, request) {
     return { action: 'allow' };
 }
 export function redactMcpSecrets(value) {
-    return sanitizePersistenceValue(value);
+    return sanitizeUntrustedPersistenceValue(value);
 }
 function ruleMatches(rule, request) {
     if (rule.serverName !== undefined && rule.serverName !== request.serverName)

package/dist/sdk/scripted-mcp-events.js

@@ -1,4 +1,5 @@
 import { redactMcpSecrets } from './mcp-safety.js';
+import { attachLiveMcpInput } from './tool-event-secrets.js';
 export function buildScriptedMcpApprovalEvent(opts) {
     const providerToolName = `${opts.serverName}.${opts.toolName}`;
     return {
@@ -18,7 +19,7 @@ export function buildScriptedMcpApprovalEvent(opts) {
 export function buildScriptedMcpDeniedCallEvent(opts) {
     const providerToolName = `${opts.serverName}.${opts.toolName}`;
     const args = redactMcpSecrets(opts.args);
-    return {
+    return attachLiveMcpInput({
         action: 'mcp_tool_call', provider: opts.provider, providerToolName,
         toolUseId: opts.toolUseId, turnNumber: opts.turnNumber, status: 'error',
         mcp: { serverName: opts.serverName, toolName: opts.toolName, invocation: 'not_invoked', outcome: opts.outcome },
@@ -26,5 +27,5 @@ export function buildScriptedMcpDeniedCallEvent(opts) {
         summary: `MCP tool ${providerToolName} ${opts.outcome}`,
         confidence: 'high',
         rawSnippet: JSON.stringify({ status: opts.outcome }),
-    };
+    }, opts.args);
 }

package/dist/sdk/tool-event-log.js

@@ -1,7 +1,22 @@
-import { sanitizePersistenceValue } from '../tool-event-results.js';
-import { getToolEventSensitiveValues } from './tool-event-secrets.js';
+import { collectStructuredSensitiveValues, isSensitiveValueScanLimitError, sanitizePersistenceValue, } from '../tool-event-results.js';
+import { attachToolEventSensitiveValues, cloneToolEventWithRuntimeMetadata, getToolEventSensitiveValues, redactToolEventPayload, } from './tool-event-secrets.js';
 export function buildToolEventLogEntry(toolEvent, fallbackTimestamp) {
-    const persistedEvent = sanitizePersistenceValue(toolEvent, getToolEventSensitiveValues(toolEvent));
+    let event = toolEvent;
+    let discoveredValues;
+    try {
+        discoveredValues = collectStructuredSensitiveValues(event);
+    }
+    catch (error) {
+        if (!isSensitiveValueScanLimitError(error))
+            throw error;
+        event = redactToolEventPayload(event);
+        discoveredValues = [];
+    }
+    const sensitiveValues = [...new Set([
+            ...getToolEventSensitiveValues(toolEvent),
+            ...discoveredValues,
+        ])];
+    const persistedEvent = attachToolEventSensitiveValues(cloneToolEventWithRuntimeMetadata(event, sanitizePersistenceValue(event, sensitiveValues)), sensitiveValues);
     return {
         type: 'tool_event',
         timestamp: persistedEvent.startedAt ?? fallbackTimestamp,

package/dist/sdk/tool-event-secrets.d.ts

@@ -1,4 +1,8 @@
 import type { ToolEvent } from '../tool-events.js';
 export declare function attachToolEventSensitiveValues(event: ToolEvent, sensitiveValues: readonly string[]): ToolEvent;
 export declare function getToolEventSensitiveValues(event: ToolEvent): readonly string[];
+export declare function attachLiveMcpInput(event: ToolEvent, input: Record<string, unknown>): ToolEvent;
+export declare function redactToolEventPayload(event: ToolEvent): ToolEvent;
+export declare function collectToolEventSensitiveValues(events: readonly ToolEvent[]): string[];
+export declare function clearToolEventRuntimeMetadata(event: ToolEvent): void;
 export declare function cloneToolEventWithRuntimeMetadata(source: ToolEvent, overrides: Partial<ToolEvent>): ToolEvent;

package/dist/sdk/tool-event-secrets.js

@@ -1,12 +1,43 @@
-import { attachOriginalMcpInput, getOriginalMcpInput } from './mcp-event-input.js';
+import { collectStructuredSensitiveValues, isSensitiveValueScanLimitError } from '../tool-event-results.js';
+import { attachOriginalMcpInput, clearOriginalMcpInput, getOriginalMcpInput, } from './mcp-event-input.js';
 const sensitiveValuesByEvent = new WeakMap();
 export function attachToolEventSensitiveValues(event, sensitiveValues) {
-    sensitiveValuesByEvent.set(event, [...sensitiveValues]);
+    sensitiveValuesByEvent.set(event, [...new Set([
+            ...getToolEventSensitiveValues(event),
+            ...sensitiveValues,
+        ])]);
     return event;
 }
 export function getToolEventSensitiveValues(event) {
     return sensitiveValuesByEvent.get(event) ?? [];
 }
+export function attachLiveMcpInput(event, input) {
+    let sensitiveValues;
+    try {
+        sensitiveValues = collectStructuredSensitiveValues(input);
+    }
+    catch (error) {
+        if (!isSensitiveValueScanLimitError(error))
+            throw error;
+        return redactToolEventPayload(event);
+    }
+    return attachToolEventSensitiveValues(attachOriginalMcpInput(event, input), sensitiveValues);
+}
+export function redactToolEventPayload(event) {
+    return {
+        ...event,
+        arguments: { redacted: true },
+        summary: `${event.action} via ${event.providerToolName}`,
+        rawSnippet: '<redacted>',
+    };
+}
+export function collectToolEventSensitiveValues(events) {
+    return [...new Set(events.flatMap((event) => getToolEventSensitiveValues(event)))];
+}
+export function clearToolEventRuntimeMetadata(event) {
+    sensitiveValuesByEvent.delete(event);
+    clearOriginalMcpInput(event);
+}
 export function cloneToolEventWithRuntimeMetadata(source, overrides) {
     const clone = attachToolEventSensitiveValues({ ...source, ...overrides }, getToolEventSensitiveValues(source));
     const originalInput = getOriginalMcpInput(source);

package/dist/sdk/types.d.ts

@@ -360,6 +360,8 @@ export interface EvaluateOptions {
     failFast?: boolean;
     llm?: LLMPort;
     onScorerError?: 'skip' | 'zero' | 'fail';
+    /** Evidence visible to deterministic scorers. Live mode is unavailable for snapshot replay. */
+    deterministicToolEvidence?: 'persisted' | 'live';
     /** Stable identity for this evaluation definition across separate runs. */
     evaluationDefinitionKey?: string;
 }

package/dist/tool-event-results.d.ts

@@ -7,4 +7,7 @@ export declare function collectSensitiveEnvValues(env?: Readonly<Record<string,
  * is important for summaries, snippets, traces, and provider error text.
  */
 export declare function sanitizePersistenceValue<T>(source: T, explicitSensitiveValues?: readonly string[]): T;
+export declare function sanitizeUntrustedPersistenceValue<T>(source: T, explicitSensitiveValues?: readonly string[]): T;
+export declare function isSensitiveValueScanLimitError(error: unknown): boolean;
 export declare function sanitizeToolEventResult(source: Readonly<ToolEventResult>, sensitiveValues: readonly string[]): ToolEventResult;
+export declare function collectStructuredSensitiveValues(source: unknown): string[];

package/dist/tool-event-results.js

@@ -24,6 +24,10 @@ const SECRET_KEY_NAMES = [
     'connectionstring',
     'credentials',
     'credential',
+    'grant',
+    'capability',
+    'capabilityurl',
+    'cursor',
     'svsession',
     'smsession',
     'wixsession',
@@ -32,6 +36,10 @@ const SECRET_KEY_NAMES = [
 const EXACT_ONLY_SECRET_KEY_NAMES = new Set([
     'auth',
     'token',
+    'grant',
+    'capability',
+    'capabilityurl',
+    'cursor',
     'svsession',
     'smsession',
     'wixsession',
@@ -39,6 +47,9 @@ const EXACT_ONLY_SECRET_KEY_NAMES = new Set([
 ]);
 const NON_SECRET_ENVIRONMENT_KEY_NAMES = new Set(['tokencount', 'tokenizersparallelism', 'tokenusage']);
 const BOUNDARY_ONLY_SENSITIVE_VALUE_MAX_LENGTH = 1;
+const MAX_SANITIZE_DEPTH = 64;
+const MAX_SENSITIVE_SCAN_NODES = 100_000;
+const MAX_SENSITIVE_JSON_CHARS = 1024 * 1024;
 export function collectSensitiveEnvValues(env) {
     return [...new Set(Object.entries(env ?? {})
             .filter((entry) => typeof entry[1] === 'string')
@@ -60,15 +71,36 @@ export function sanitizePersistenceValue(source, explicitSensitiveValues = []) {
         ])].sort((a, b) => b.length - a.length);
     return sanitizeValue(source, '', sensitiveValues, new Set(explicitValues));
 }
+export function sanitizeUntrustedPersistenceValue(source, explicitSensitiveValues = []) {
+    try {
+        return sanitizePersistenceValue(source, explicitSensitiveValues);
+    }
+    catch (error) {
+        if (!isSensitiveValueScanLimitError(error))
+            throw error;
+        if (Array.isArray(source))
+            return [];
+        if (isRecord(source))
+            return { redacted: true };
+        return '<redacted>';
+    }
+}
+export function isSensitiveValueScanLimitError(error) {
+    return error instanceof Error && error.message.startsWith('Sensitive-value scan exceeded');
+}
 export function sanitizeToolEventResult(source, sensitiveValues) {
     const result = {};
     let truncated = source.truncated === true;
     const addBounded = (key, value) => {
         if (typeof value !== 'string')
             return;
-        const bounded = boundText(sanitizePersistenceValue(value, sensitiveValues));
-        result[key] = bounded.value;
-        truncated ||= bounded.truncated;
+        const explicitValues = [...new Set(sensitiveValues.filter((entry) => entry.length > 0))];
+        const overlap = explicitValues.reduce((max, entry) => Math.max(max, entry.length), 0);
+        const prefix = value.slice(0, TOOL_RESULT_MAX_CHARS + Math.max(overlap, 1));
+        const bounded = boundText(redactSensitiveValues(prefix, explicitValues, new Set(explicitValues)));
+        const sanitized = boundText(sanitizePersistenceValue(bounded.value, sensitiveValues));
+        result[key] = sanitized.value;
+        truncated ||= value.length > prefix.length || bounded.truncated || sanitized.truncated;
     };
     addBounded('content', source.content);
     addBounded('stdout', source.stdout);
@@ -96,56 +128,93 @@ function redactSensitiveValues(value, sensitiveValues, explicitSensitiveValues)
     }
     return redacted;
 }
-function collectStructuredSensitiveValues(source) {
+export function collectStructuredSensitiveValues(source) {
     const values = new Set();
-    const visit = (value, key) => {
-        if (typeof value === 'string' && !isNumericTokenTelemetry(key, value)
-            && isSecretKey(key) && value.length > 0) {
-            values.add(value);
-            return;
+    let scannedNodes = 0;
+    let parsedJsonChars = 0;
+    const pending = [
+        { value: source, key: '' },
+    ];
+    while (pending.length > 0) {
+        if (++scannedNodes > MAX_SENSITIVE_SCAN_NODES) {
+            throw new Error('Sensitive-value scan exceeded the input node limit');
+        }
+        const { value, key } = pending.pop();
+        if (typeof value === 'string') {
+            if (value.length > 0 && !isNumericTokenTelemetry(key, value) && isSecretKey(key)) {
+                values.add(value);
+            }
+            for (const match of value.matchAll(/[?&](?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|token|secret|auth|password|passwd|session(?:id)?|cookie)=([^&#\s]+)/gi)) {
+                if (match[1])
+                    values.add(match[1]);
+            }
+            for (const sensitiveValue of collectCredentialShapeSensitiveValues(value)) {
+                values.add(sensitiveValue);
+            }
+            const trimmed = value.trim();
+            const looksStructured = (trimmed.startsWith('{') && trimmed.endsWith('}'))
+                || (trimmed.startsWith('[') && trimmed.endsWith(']'));
+            if (looksStructured && (parsedJsonChars += value.length) > MAX_SENSITIVE_JSON_CHARS) {
+                throw new Error('Sensitive-value scan exceeded the nested JSON limit');
+            }
+            const structured = looksStructured ? parseStructuredJson(value) : undefined;
+            if (structured !== undefined)
+                pending.push({ value: structured, key });
+            continue;
+        }
+        if ((typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint')
+            && !isNumericTokenTelemetry(key, value) && isSecretKey(key)) {
+            values.add(String(value));
+            continue;
         }
         if (Array.isArray(value)) {
             for (const entry of value)
-                visit(entry, key);
-            return;
+                pending.push({ value: entry, key });
+            continue;
         }
         if (isRecord(value)) {
-            for (const [entryKey, entryValue] of Object.entries(value))
-                visit(entryValue, entryKey);
+            for (const [entryKey, entryValue] of Object.entries(value)) {
+                pending.push({ value: entryValue, key: entryKey });
+            }
         }
-    };
-    visit(source, '');
+    }
     return [...values];
 }
-function sanitizeValue(value, key, sensitiveValues, explicitSensitiveValues) {
+function sanitizeValue(value, key, sensitiveValues, explicitSensitiveValues, depth = 0) {
     if (!isNumericTokenTelemetry(key, value) && isSecretKey(key))
         return '<redacted>';
     if (typeof value === 'string') {
-        return redactCredentialShapes(redactSensitiveValues(value, sensitiveValues, explicitSensitiveValues), sensitiveValues, explicitSensitiveValues);
+        return redactCredentialShapes(redactSensitiveValues(value, sensitiveValues, explicitSensitiveValues), sensitiveValues, explicitSensitiveValues, depth);
     }
+    if (depth >= MAX_SANITIZE_DEPTH && (Array.isArray(value) || isRecord(value)))
+        return '<redacted>';
     if (Array.isArray(value)) {
-        return value.map((entry) => sanitizeValue(entry, key, sensitiveValues, explicitSensitiveValues));
+        return value.map((entry) => sanitizeValue(entry, key, sensitiveValues, explicitSensitiveValues, depth + 1));
     }
     if (isRecord(value)) {
         return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [
             entryKey,
-            sanitizeValue(entryValue, entryKey, sensitiveValues, explicitSensitiveValues),
+            sanitizeValue(entryValue, entryKey, sensitiveValues, explicitSensitiveValues, depth + 1),
         ]));
     }
     return value;
 }
-function redactCredentialShapes(value, sensitiveValues, explicitSensitiveValues) {
+function redactCredentialShapes(value, sensitiveValues, explicitSensitiveValues, depth) {
     let redacted = value;
+    const credentialShapeValues = collectCredentialShapeSensitiveValues(redacted);
+    redacted = redactSensitiveValues(redacted, credentialShapeValues, new Set(credentialShapeValues));
     const structured = parseStructuredJson(redacted);
     if (structured !== undefined) {
         const nestedSensitiveValues = [...new Set([
                 ...sensitiveValues,
                 ...collectStructuredSensitiveValues(structured),
             ])].sort((a, b) => b.length - a.length);
-        redacted = JSON.stringify(sanitizeValue(structured, '', nestedSensitiveValues, explicitSensitiveValues));
+        redacted = JSON.stringify(sanitizeValue(structured, '', nestedSensitiveValues, explicitSensitiveValues, depth + 1));
     }
     if (redacted.includes('PRIVATE KEY-----')) {
-        redacted = redacted.replace(/-----BEGIN [^-\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\n]*PRIVATE KEY-----/g, '<redacted>');
+        for (const block of findPrivateKeyBlocks(redacted).reverse()) {
+            redacted = `${redacted.slice(0, block.start)}<redacted>${redacted.slice(block.end)}`;
+        }
     }
     if (/\b(?:bearer|basic)\s/i.test(redacted)) {
         redacted = redacted.replace(/(\b(?:bearer|basic)\s+)[^\s,;"']+/gi, '$1<redacted>');
@@ -154,10 +223,71 @@ function redactCredentialShapes(value, sensitiveValues, explicitSensitiveValues)
         redacted = redacted.replace(/([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s/@]+(@)/gi, '$1<redacted>$2');
     }
     if (redacted.includes('=') || redacted.includes(':')) {
-        redacted = redacted.replace(/(\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|token|secret|auth|password|passwd|session(?:id)?|cookie)\s*[=:]\s*)[^\s,;"'}]+/gi, '$1<redacted>');
+        redacted = redacted.replace(/((?:^|[\s{[(,;])["']?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|token|secret|auth|password|passwd|session(?:id)?|cookie)["']?\s*[=:]\s*["']?)[^\s,;"'}]+/gi, '$1<redacted>');
+        redacted = redacted.replace(/((?:^|[\s{[(,;])["'](?:grant|capability|capabilityurl|cursor)["']\s*:\s*["']?)[^\s,;"'}]+/gi, '$1<redacted>');
     }
     return redacted;
 }
+function collectCredentialShapeSensitiveValues(value) {
+    const values = new Set();
+    for (const match of value.matchAll(/https?:\/\/[^\s,;"']+\/(?:cap|capability)\/[^\s,;"']+/gi)) {
+        values.add(match[0]);
+    }
+    if (value.includes('PRIVATE KEY-----')) {
+        for (const block of findPrivateKeyBlocks(value)) {
+            values.add(value.slice(block.start, block.end));
+            if (block.body)
+                values.add(block.body);
+        }
+    }
+    if (/\b(?:bearer|basic)\s/i.test(value)) {
+        for (const match of value.matchAll(/\b(?:bearer|basic)\s+([^\s,;"']+)/gi)) {
+            if (match[1])
+                values.add(match[1]);
+        }
+    }
+    if (value.includes('://')) {
+        for (const match of value.matchAll(/[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:([^\s/@]+)@/gi)) {
+            if (match[1])
+                values.add(match[1]);
+        }
+    }
+    if (value.includes('=') || value.includes(':')) {
+        for (const match of value.matchAll(/(?:^|[\s{[(,;])["']?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|token|secret|auth|password|passwd|session(?:id)?|cookie)["']?\s*[=:]\s*["']?([^\s,;"'}]+)/gi)) {
+            if (match[1])
+                values.add(match[1]);
+        }
+        for (const match of value.matchAll(/(?:^|[\s{[(,;])["'](?:grant|capability|capabilityurl|cursor)["']\s*:\s*["']?([^\s,;"'}]+)/gi)) {
+            if (match[1])
+                values.add(match[1]);
+        }
+    }
+    return [...values].sort((a, b) => b.length - a.length);
+}
+function findPrivateKeyBlocks(value) {
+    const blocks = [];
+    let open;
+    let cursor = 0;
+    while (cursor < value.length) {
+        const start = value.indexOf('-----', cursor);
+        if (start < 0)
+            break;
+        const end = value.indexOf('-----', start + 5);
+        if (end < 0)
+            break;
+        const markerEnd = end + 5;
+        const marker = value.slice(start, markerEnd);
+        if (!open && marker.startsWith('-----BEGIN ') && marker.endsWith('PRIVATE KEY-----')) {
+            open = { start, bodyStart: markerEnd };
+        }
+        else if (open && marker.startsWith('-----END ') && marker.endsWith('PRIVATE KEY-----')) {
+            blocks.push({ start: open.start, end: markerEnd, body: value.slice(open.bodyStart, start).trim() });
+            open = undefined;
+        }
+        cursor = markerEnd;
+    }
+    return blocks;
+}
 function isSecretKey(key) {
     const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
     if (normalized === 'tokens')