auxilo-mcp 0.9.3 → 0.9.6

package/README.md

@@ -4,9 +4,9 @@
 [![npm downloads](https://img.shields.io/npm/dm/auxilo-mcp)](https://www.npmjs.com/package/auxilo-mcp)
 [![license](https://img.shields.io/npm/l/auxilo-mcp)](LICENSE)
 
-Auxilo is an MCP server that auto-extracts operational learnings from your coding agent's sessions, gives your agent its own learnings back free in every later session, and lists them in a marketplace where other agents pay to unlock them.
+Your agent already solved this. It found the fix, shipped, and lost it when the session ended. Next run it hits the same wall and burns the time and tokens you already paid for, while you sit and watch. Auxilo stops that. Your agent stops solving the same problem twice.
 
-Your agent stops solving the same problem twice. When another agent unlocks what yours figured out, you earn.
+Auxilo is an MCP server that auto-extracts operational learnings from your coding agent's sessions, gives your agent its own learnings back in every later session, and lists them in a marketplace where other agents pay to unlock them. Your agent's own learnings always come back at $0. When another agent unlocks what yours figured out, you earn.
 
 ## The problem
 
@@ -92,7 +92,7 @@ The same block works anywhere MCP configs are read. The installer also detects C
 
 ## Tools
 
-18 tools:
+17 tools:
 
 | Tool | What it does | Cost |
 |---|---|---|
@@ -105,7 +105,6 @@ The same block works anywhere MCP configs are read. The installer also detects C
 | `auxilo_skill` | Connection details, auth, and pricing for one skill | Free |
 | `auxilo_categories` | List categories with counts | Free |
 | `auxilo_stats` | Registry statistics | Free |
-| `get_stats` | Registry statistics, alias | Free |
 | `get_knowledge_stats` | Marketplace statistics | Free |
 | `auxilo_contributor` | Earnings for a contributor wallet | Free |
 | `auxilo_account_earnings` | Earnings and pending balance for your account | Free |
@@ -153,7 +152,7 @@ Unlocks (`GET /knowledge/:id`, minimum $0.05) are paid with [x402](https://www.x
 
 - OpenAPI spec: [auxilo.io/openapi.json](https://auxilo.io/openapi.json)
 - Agent discovery card: `https://auxilo.io/.well-known/agent.json`
-- Categories: data-processing, web-interaction, code-execution, communication, storage-state, content-generation, payment-financial, monitoring
+- Categories: data-processing, web-interaction, code-execution, storage-state, payment-financial, monitoring. Learnings are technical-only — `communication` and `content-generation` are retired labels the server refuses (`CATEGORY_OUT_OF_SCOPE`); technical email/messaging-API learnings belong under web-interaction or code-execution.
 
 ## Privacy
 

package/config/near-duplicate.json

@@ -0,0 +1,9 @@
+{
+  "SHINGLE_FLAG_THRESHOLD": 0.6,
+  "UNIGRAM_FLAG_THRESHOLD": 0.6,
+  "TF_COSINE_FLAG_THRESHOLD": 0.75,
+  "TITLE_FLAG_THRESHOLD": 0.6,
+  "COMPOSITE_FLAG_THRESHOLD": 0.6,
+  "CONTENT_WEIGHT": 0.75,
+  "TITLE_WEIGHT": 0.25
+}

package/lib/extraction-index.js

@@ -0,0 +1,462 @@
+'use strict';
+
+/**
+ * Client-side extraction memory for SPEC3-F2.
+ *
+ * The index is local, append-only, and advisory. Every read or write failure
+ * fails open: extraction/submission continues without prompt memory or lexical
+ * filtering. The only shared detector is lib/similarity.js.
+ */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { findNearDuplicate, scoreChannels } = require('./similarity.js');
+
+const DEFAULT_INDEX_PATH = path.join(os.homedir(), '.auxilo', 'extracted-index.jsonl');
+const HYDRATION_PAGE_SIZE = 500;
+const PROMPT_MEMORY_MAX_TOKENS = 1200;
+const PROMPT_MEMORY_MAX_ROWS = 40;
+const VALID_STATUSES = new Set(['approved', 'rejected', 'pending_review']);
+
+const MEMORY_INSTRUCTIONS = `PREVIOUSLY CAPTURED LESSONS
+The following lessons were already submitted by this account.
+A candidate that re-states any listed lesson — reworded, or a different facet of the same operational insight — is DROPPED, not relabeled and not "improved."
+Extract new facts about a listed lesson ONLY when the new fact would change what another agent does: it must create a behavioral difference, not merely a wording difference.
+Never discard a memory match invisibly. Put the complete candidate plus the matched lesson id/title in dedup_drops so the local runner can write its audit trail.`;
+
+const CATEGORY_HINTS = Object.freeze({
+  'data-processing': ['data', 'parse', 'parser', 'json', 'csv', 'transform', 'pipeline'],
+  'web-interaction': ['api', 'http', 'browser', 'gmail', 'webhook', 'request', 'response'],
+  'code-execution': ['code', 'script', 'python', 'node', 'shell', 'command', 'runtime'],
+  'storage-state': ['state', 'queue', 'database', 'storage', 'file', 'commit', 'cache'],
+  'payment-financial': ['payment', 'stripe', 'usdc', 'wallet', 'settlement', 'withdraw'],
+  monitoring: ['monitor', 'alert', 'health', 'log', 'metric', 'observability', 'incident'],
+});
+
+function loud(log, message) {
+  try {
+    (log || console.error)(`[extraction-index] ${message}`);
+  } catch {
+    // A broken logger must not turn advisory dedup into a submission blocker.
+  }
+}
+
+function normalizeTags(tags) {
+  return Array.isArray(tags) ? tags.slice(0, 8).map(String) : [];
+}
+
+function validIndexRow(row) {
+  return Boolean(
+    row &&
+    typeof row === 'object' &&
+    typeof row.title === 'string' &&
+    row.title.trim() &&
+    typeof row.category === 'string'
+  );
+}
+
+/**
+ * Read an append-only JSONL index. A malformed line is skipped and logged, but
+ * marks the read unusable so extraction fails open instead of trusting a
+ * partially corrupt memory/filter corpus.
+ */
+function readExtractionIndex(opts = {}) {
+  const indexPath = opts.indexPath || DEFAULT_INDEX_PATH;
+  const fsImpl = opts.fsImpl || fs;
+  let exists;
+  try {
+    exists = fsImpl.existsSync(indexPath);
+  } catch (error) {
+    loud(opts.log, `index existence check failed; dedup disabled for this run: ${error.message}`);
+    return { state: 'unreadable', usable: false, rows: [], bad_lines: 0 };
+  }
+  if (!exists) return { state: 'missing', usable: false, rows: [], bad_lines: 0 };
+
+  let raw;
+  try {
+    raw = fsImpl.readFileSync(indexPath, 'utf8');
+  } catch (error) {
+    loud(opts.log, `index read failed; dedup disabled for this run: ${error.message}`);
+    return { state: 'unreadable', usable: false, rows: [], bad_lines: 0 };
+  }
+
+  const rows = [];
+  let badLines = 0;
+  const lines = String(raw).split(/\r?\n/);
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index].trim();
+    if (!line) continue;
+    try {
+      const row = JSON.parse(line);
+      if (!validIndexRow(row)) throw new Error('missing title/category');
+      rows.push(row);
+    } catch (error) {
+      badLines += 1;
+      loud(opts.log, `skipping corrupt line ${index + 1} in ${indexPath}: ${error.message}`);
+    }
+  }
+
+  if (badLines > 0) {
+    loud(opts.log, `index contains ${badLines} corrupt line(s); prompt memory and lexical dedup are disabled for this run`);
+    return { state: 'corrupt', usable: false, rows, bad_lines: badLines };
+  }
+  return { state: 'ready', usable: true, rows, bad_lines: 0 };
+}
+
+function appendJsonlRows(rows, opts = {}) {
+  const indexPath = opts.indexPath || DEFAULT_INDEX_PATH;
+  const fsImpl = opts.fsImpl || fs;
+  try {
+    fsImpl.mkdirSync(path.dirname(indexPath), { recursive: true, mode: 0o700 });
+    if (!rows.length) {
+      const fd = fsImpl.openSync(indexPath, 'a', 0o600);
+      fsImpl.closeSync(fd);
+      return true;
+    }
+    const payload = rows.map((row) => JSON.stringify(row)).join('\n') + '\n';
+    fsImpl.appendFileSync(indexPath, payload, { encoding: 'utf8', mode: 0o600 });
+    return true;
+  } catch (error) {
+    loud(opts.log, `index append failed; extraction/submission continues: ${error.message}`);
+    return false;
+  }
+}
+
+function localIndexRow(learning, response = {}, opts = {}) {
+  const nowValue = typeof opts.now === 'function'
+    ? opts.now()
+    : (opts.now || new Date().toISOString());
+  const body = String(learning.body || '');
+  return {
+    title: String(learning.title || ''),
+    category: String(learning.category || ''),
+    tags: normalizeTags(learning.tags),
+    body_hash: crypto.createHash('sha256').update(body).digest('hex'),
+    body,
+    submitted_at: String(nowValue),
+    ...(typeof response.id === 'string' && response.id && { learning_id: response.id }),
+    ...(typeof response.status === 'string' && VALID_STATUSES.has(response.status) && {
+      status: response.status,
+    }),
+  };
+}
+
+/**
+ * Append only after POST /learn returns 2xx. A network/4xx failure remains
+ * retryable and is not allowed to poison the local dedup memory.
+ */
+function appendSubmittedLearning(learning, response = {}, opts = {}) {
+  if (!learning || typeof learning !== 'object') return false;
+  return appendJsonlRows([localIndexRow(learning, response, opts)], opts);
+}
+
+function hydratedIndexRow(learning) {
+  return {
+    title: String(learning.title || ''),
+    category: String(learning.category || ''),
+    tags: normalizeTags(learning.tags),
+    body_hash: null,
+    submitted_at: learning.created_at || null,
+    ...(typeof learning.id === 'string' && learning.id && { learning_id: learning.id }),
+    ...(typeof learning.status === 'string' && VALID_STATUSES.has(learning.status) && {
+      status: learning.status,
+    }),
+  };
+}
+
+/**
+ * Hydrate only a missing index from the caller's own metadata endpoint. The
+ * endpoint intentionally carries no body, so hydrated rows inform the prompt
+ * only; lexical filtering is limited to locally appended rows with a body.
+ */
+async function hydrateExtractionIndex(opts = {}) {
+  const indexPath = opts.indexPath || DEFAULT_INDEX_PATH;
+  const fsImpl = opts.fsImpl || fs;
+  try {
+    if (fsImpl.existsSync(indexPath)) return { hydrated: false, reason: 'not_fresh' };
+  } catch (error) {
+    loud(opts.log, `fresh-index check failed; hydration skipped: ${error.message}`);
+    return { hydrated: false, reason: 'unreadable' };
+  }
+
+  const fetchImpl = opts.fetchImpl || globalThis.fetch;
+  const baseUrl = String(opts.baseUrl || '').replace(/\/+$/, '');
+  const apiKey = opts.apiKey;
+  if (typeof fetchImpl !== 'function' || !baseUrl || !apiKey) {
+    loud(opts.log, 'fresh-machine hydration unavailable (missing fetch, base URL, or API key); extracting without memory');
+    return { hydrated: false, reason: 'unavailable' };
+  }
+
+  const hydratedRows = [];
+  let offset = 0;
+  try {
+    for (let page = 0; page < 10000; page += 1) {
+      const response = await fetchImpl(
+        `${baseUrl}/account/learnings?limit=${HYDRATION_PAGE_SIZE}&offset=${offset}`,
+        { headers: { 'X-API-Key': apiKey } }
+      );
+      if (!response || !response.ok) {
+        const status = response && Number.isFinite(response.status) ? response.status : 'unknown';
+        throw new Error(`GET /account/learnings returned ${status}`);
+      }
+      const payload = await response.json();
+      if (!payload || !Array.isArray(payload.learnings)) {
+        throw new Error('GET /account/learnings returned an invalid payload');
+      }
+      for (const row of payload.learnings) {
+        const hydrated = hydratedIndexRow(row);
+        if (!validIndexRow(hydrated)) {
+          loud(opts.log, 'skipping malformed hydration row from GET /account/learnings');
+          continue;
+        }
+        hydratedRows.push(hydrated);
+      }
+      offset += payload.learnings.length;
+      const total = Number.isFinite(payload.total) ? payload.total : null;
+      if (payload.learnings.length < HYDRATION_PAGE_SIZE ||
+          (total !== null && offset >= total)) break;
+      if (payload.learnings.length === 0) break;
+    }
+  } catch (error) {
+    loud(opts.log, `fresh-machine hydration failed; extracting without memory: ${error.message}`);
+    return { hydrated: false, reason: 'request_failed' };
+  }
+
+  if (!appendJsonlRows(hydratedRows, { indexPath, fsImpl, log: opts.log })) {
+    return { hydrated: false, reason: 'write_failed' };
+  }
+  loud(opts.log, `hydrated ${hydratedRows.length} own learning metadata row(s) into ${indexPath}`);
+  return { hydrated: true, count: hydratedRows.length };
+}
+
+async function loadIndexForExtraction(opts = {}) {
+  const first = readExtractionIndex(opts);
+  if (first.state !== 'missing') return first;
+  const hydration = await hydrateExtractionIndex(opts);
+  if (!hydration.hydrated) return first;
+  return readExtractionIndex(opts);
+}
+
+function estimatePromptTokens(text) {
+  return Math.ceil(Buffer.byteLength(String(text || ''), 'utf8') / 4);
+}
+
+function inferCategoryHints(transcript) {
+  const text = String(transcript || '').toLowerCase();
+  const scores = [];
+  for (const [category, words] of Object.entries(CATEGORY_HINTS)) {
+    let score = 0;
+    for (const word of words) {
+      const matches = text.match(new RegExp(`\\b${word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g'));
+      score += matches ? matches.length : 0;
+    }
+    if (score > 0) scores.push({ category, score });
+  }
+  scores.sort((a, b) => b.score - a.score || a.category.localeCompare(b.category));
+  if (!scores.length) return [];
+  const top = scores[0].score;
+  return scores.filter((entry) => entry.score === top).map((entry) => entry.category);
+}
+
+function submittedTime(row) {
+  const parsed = Date.parse(row.submitted_at || row.created_at || '');
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+function oneLineGist(row) {
+  if (typeof row.body === 'string' && row.body.trim()) {
+    const compact = row.body.replace(/\s+/g, ' ').trim();
+    const sentence = compact.match(/^(.{1,220}?[.!?])(?:\s|$)/);
+    return (sentence ? sentence[1] : compact.slice(0, 220)).trim();
+  }
+  const tags = normalizeTags(row.tags).filter(Boolean);
+  if (tags.length) return `Previously captured ${row.category} lesson tagged ${tags.join(', ')}.`;
+  return `Previously captured ${row.category} lesson.`;
+}
+
+function indexRowId(row, index = 0) {
+  return String(
+    row.learning_id ||
+    row.id ||
+    row.body_hash ||
+    `local-index-${index}`
+  );
+}
+
+function promptMemoryLine(row, index) {
+  const title = String(row.title || '').replace(/\s+/g, ' ').trim().slice(0, 180);
+  const gist = oneLineGist(row).slice(0, 240);
+  return `- [id:${indexRowId(row, index)} category:${row.category}] ${title} — ${gist}`;
+}
+
+/**
+ * Budget strategy: inferred same-category rows first, then most recent rows,
+ * with deterministic title/ID tie-breaking. The instruction header and rows
+ * together may never exceed maxTokens.
+ */
+function buildPromptMemory(rows, opts = {}) {
+  const maxTokens = Number.isFinite(opts.maxTokens)
+    ? Math.max(0, Math.floor(opts.maxTokens))
+    : PROMPT_MEMORY_MAX_TOKENS;
+  const maxRows = Number.isFinite(opts.maxRows)
+    ? Math.max(0, Math.floor(opts.maxRows))
+    : PROMPT_MEMORY_MAX_ROWS;
+  const hints = new Set(opts.categoryHints || inferCategoryHints(opts.transcript));
+  const eligible = (Array.isArray(rows) ? rows : [])
+    .filter(validIndexRow)
+    .slice()
+    .sort((a, b) => {
+      const aMatch = hints.has(a.category) ? 1 : 0;
+      const bMatch = hints.has(b.category) ? 1 : 0;
+      return bMatch - aMatch ||
+        submittedTime(b) - submittedTime(a) ||
+        String(a.title).localeCompare(String(b.title)) ||
+        String(a.learning_id || '').localeCompare(String(b.learning_id || ''));
+    });
+
+  if (!eligible.length || maxRows === 0 || estimatePromptTokens(MEMORY_INSTRUCTIONS) > maxTokens) {
+    return {
+      section: '',
+      estimated_tokens: 0,
+      included_count: 0,
+      included_rows: [],
+      category_hints: [...hints],
+    };
+  }
+
+  const lines = [];
+  const includedRows = [];
+  for (let index = 0; index < eligible.length; index += 1) {
+    const row = eligible[index];
+    if (lines.length >= maxRows) break;
+    const candidateLines = [...lines, promptMemoryLine(row, index)];
+    const candidate = `${MEMORY_INSTRUCTIONS}\n${candidateLines.join('\n')}\n\n`;
+    if (estimatePromptTokens(candidate) > maxTokens) break;
+    lines.push(candidateLines[candidateLines.length - 1]);
+    includedRows.push({
+      id: indexRowId(row, index),
+      title: row.title,
+      category: row.category,
+    });
+  }
+  if (!lines.length) {
+    return {
+      section: '',
+      estimated_tokens: 0,
+      included_count: 0,
+      included_rows: [],
+      category_hints: [...hints],
+    };
+  }
+  const section = `${MEMORY_INSTRUCTIONS}\n${lines.join('\n')}\n\n`;
+  return {
+    section,
+    estimated_tokens: estimatePromptTokens(section),
+    included_count: lines.length,
+    included_rows: includedRows,
+    category_hints: [...hints],
+  };
+}
+
+/**
+ * Rank index rows against one extracted candidate with the shared F1 scoring
+ * implementation. No flag threshold is applied: the score is used only for a
+ * deterministic candidate-anchored top-K list for the local judge.
+ */
+function rankIndexRowsForCandidate(candidate, rows, opts = {}) {
+  const topK = Number.isFinite(opts.topK)
+    ? Math.max(0, Math.floor(opts.topK))
+    : 10;
+  if (!candidate || topK === 0) return [];
+  return (Array.isArray(rows) ? rows : [])
+    .filter(validIndexRow)
+    .map((row, index) => {
+      const ranked = {
+        id: indexRowId(row, index),
+        title: row.title,
+        category: row.category,
+        body: typeof row.body === 'string' ? row.body : '',
+      };
+      const channels = scoreChannels(candidate, ranked);
+      return {
+        id: ranked.id,
+        title: ranked.title,
+        category: ranked.category,
+        similarity: channels.composite,
+        channels,
+      };
+    })
+    .sort((a, b) =>
+      b.similarity - a.similarity ||
+      a.id.localeCompare(b.id) ||
+      String(a.title).localeCompare(String(b.title))
+    )
+    .slice(0, topK);
+}
+
+/**
+ * Filter candidates against locally appended rows only. Hydrated metadata has
+ * no body and therefore never participates in lexical detection.
+ */
+function filterIndexedNearDuplicates(candidates, indexState, opts = {}) {
+  const input = Array.isArray(candidates) ? candidates : [];
+  if (!indexState || !indexState.usable) {
+    return { kept: input.slice(), dropped: [], disabled: true };
+  }
+  const localRows = indexState.rows
+    .filter((row) => typeof row.body === 'string' && row.body.trim())
+    .map((row, index) => ({
+      id: row.learning_id || `local-index-${index}`,
+      title: row.title,
+      body: row.body,
+      category: row.category,
+      status: row.status || null,
+    }));
+  if (!localRows.length) return { kept: input.slice(), dropped: [], disabled: false };
+
+  try {
+    const kept = [];
+    const dropped = [];
+    for (const candidate of input) {
+      const result = findNearDuplicate(candidate, localRows);
+      if (result.verdict === 'flag') {
+        const matchedRow = localRows.find((row) => row.id === result.match.id);
+        dropped.push({
+          candidate,
+          match: {
+            ...result.match,
+            title: matchedRow ? matchedRow.title : null,
+          },
+        });
+      } else {
+        kept.push(candidate);
+      }
+    }
+    return { kept, dropped, disabled: false };
+  } catch (error) {
+    loud(opts.log, `lexical dedup failed; keeping all extracted candidates: ${error.message}`);
+    return { kept: input.slice(), dropped: [], disabled: true };
+  }
+}
+
+module.exports = {
+  DEFAULT_INDEX_PATH,
+  HYDRATION_PAGE_SIZE,
+  PROMPT_MEMORY_MAX_TOKENS,
+  PROMPT_MEMORY_MAX_ROWS,
+  MEMORY_INSTRUCTIONS,
+  readExtractionIndex,
+  appendSubmittedLearning,
+  hydrateExtractionIndex,
+  loadIndexForExtraction,
+  buildPromptMemory,
+  estimatePromptTokens,
+  inferCategoryHints,
+  filterIndexedNearDuplicates,
+  rankIndexRowsForCandidate,
+  indexRowId,
+  localIndexRow,
+  hydratedIndexRow,
+};

package/lib/installer.js

@@ -73,6 +73,9 @@ const RUNNER_STACK = Object.freeze([
   ['scripts/review-notice.js', 'scripts/review-notice.js', 0o755],
   ...sourceAdapterRows(),
   ['lib/sensitivity-filter.js', 'lib/sensitivity-filter.js', 0o644],
+  ['lib/extraction-index.js', 'lib/extraction-index.js', 0o644],
+  ['lib/similarity.js', 'lib/similarity.js', 0o644],
+  ['config/near-duplicate.json', 'config/near-duplicate.json', 0o644],
 ]);
 
 // ─── Client registry + detection (spec §LW-12 step 1; UC-0 expansion) ───────

package/lib/sensitivity-filter.js

@@ -18,7 +18,9 @@
 // ─── Version ─────────────────────────────────────────────────────────────────
 // Bumped when patterns are added or behavior changes. Server rejects extractions
 // from clients older than N-1 (§7.6).
-const SENSITIVITY_FILTER_VERSION = '0.4.0';
+// 0.5.0 (task-#19, 2026-07-19): Google Drive/Docs/Sheets/Slides file-ID
+// patterns — a private Drive doc ID survived the scrubber in the wild.
+const SENSITIVITY_FILTER_VERSION = '0.5.0';
 
 // ─── Patterns ────────────────────────────────────────────────────────────────
 // Each pattern has a name, regex, and description for the rejection message.
@@ -165,6 +167,40 @@ const PATTERNS = [
     regex: /[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g,
     description: 'Discord bot token',
   },
+  // ── task-#19 (2026-07-19): Google Drive file IDs ──────────────────────────
+  // Found live: a private Google Drive doc ID survived the scrubber. A Drive
+  // ID is a capability reference — a link-shared doc is readable by ANYONE
+  // holding the ID — so it is credentials-class, not merely PII-class.
+  {
+    // The /d/<id>/ URL shapes across the editors + Drive, plus the id= and
+    // folders/ forms. Precise (requires the google.com host shape), so it
+    // fires unconditionally — a Drive URL in a public learning is never a
+    // false positive worth waving through.
+    name: 'google_drive_url',
+    regex: /(?:docs|drive|sheets|slides)\.google\.com\/(?:(?:document|spreadsheets|presentation|forms|drawings|file)\/(?:u\/\d+\/)?d\/[A-Za-z0-9_-]{20,}|open\?[^\s]*\bid=[A-Za-z0-9_-]{20,}|uc\?[^\s]*\bid=[A-Za-z0-9_-]{20,}|drive\/(?:u\/\d+\/)?folders\/[A-Za-z0-9_-]{20,}|folderview\?[^\s]*\bid=[A-Za-z0-9_-]{20,})/g,
+    description: 'Google Drive/Docs/Sheets/Slides URL exposing a file ID',
+  },
+  {
+    // Bare Drive-ID heuristic, GUARDED (this filter is a hard 422 at /learn,
+    // so a loose rule bounces legit content). Shape: modern IDs start with
+    // '1' (33/44 chars), legacy folder IDs with '0B'; charset base64url.
+    // Gate-A F3: the validate hook requires MIXED CASE + a digit beyond the
+    // prefix char. The original uppercase/-/_ guard still 422'd six real FP
+    // classes the reviewer probed: issue-numbered branch names
+    // (1234-fix-the-thing…), numeric-leading URL slugs (10-ways-to-…),
+    // digit-1-leading UUIDs (~6% of v4s), numeric-separator literals
+    // (1_000_000_…), kebab date-ranges (19-07-2026-to-…), and UPPERCASE
+    // 40-hex SHAs. Mixed-case+digit excludes every one (branch/slug/UUID/
+    // date-range have no uppercase; separator literals no lowercase;
+    // uppercase SHAs no lowercase) while keeping real Drive IDs: for 32
+    // random base64url chars P(no lowercase)≈P(no uppercase)≈6e-8 and
+    // P(no digit)≈(54/64)^32≈0.4% — the URL rule above still catches every
+    // linked form regardless.
+    name: 'google_drive_id',
+    regex: /(?<![A-Za-z0-9_-])(?:1|0B)[A-Za-z0-9_-]{24,63}(?![A-Za-z0-9_-])/g,
+    description: 'Bare Google Drive file ID (25+ char base64url, 1/0B prefix)',
+    validate: (m) => /[A-Z]/.test(m) && /[a-z]/.test(m) && /\d/.test(m.slice(1)),
+  },
 ];
 
 // ─── M-2: /g flag invariant assertion at module load ────────────────────────
@@ -220,6 +256,11 @@ function scanLearning(learning) {
           if (m[0].length <= 42) continue;
         }
 
+        // task-#19: optional per-pattern validate hook — a match the hook
+        // refuses is skipped (used to guard heuristic patterns whose raw
+        // regex would over-fire, e.g. the bare Drive-ID rule).
+        if (pattern.validate && !pattern.validate(m[0])) continue;
+
         matches.push({
           pattern: pattern.name,
           field: fieldName,
@@ -280,6 +321,9 @@ function getRedactionHint(patternName) {
     openai_project_key: '{OPENAI_KEY}',
     anthropic_key: '{ANTHROPIC_KEY}',
     discord_bot_token: '{DISCORD_TOKEN}',
+    // task-#19 patterns
+    google_drive_url: 'https://docs.google.com/document/d/{DRIVE_FILE_ID}/',
+    google_drive_id: '{DRIVE_FILE_ID}',
   };
   return hints[patternName] || '{REDACTED}';
 }
@@ -345,6 +389,9 @@ function scanText(text) {
       // Private key length check (same as scanLearning)
       if (pattern.name === 'private_key' && m[0].length <= 42) continue;
 
+      // task-#19: per-pattern validate hook (same semantics as scanLearning).
+      if (pattern.validate && !pattern.validate(m[0])) continue;
+
       matchList.push({
         pattern: pattern.name,
         match: redactMatch(m[0]),