claude-mem-lite 6.19.1 → 6.19.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.19.1",
+      "version": "6.19.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.1",
+  "version": "6.19.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-optimize.mjs

@@ -32,7 +32,7 @@ import { normalizeScope, SCOPE_PROMPT_LEGEND, insertObservationRow } from './lib
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 import { MEMORY_INPUT_GUARD } from './lib/memory-input-guard.mjs';
-import { MANUAL_SESSION_ID_PREFIX } from './lib/provenance.mjs';
+import { MANUAL_SESSION_ID_PREFIX, writerSessionId } from './lib/provenance.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
 // P1-14: same resolver as hook-shared.mjs — this was the second module that had never
@@ -583,12 +583,34 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
       // text over it, wide wrote back the pre-edit narrative it read before the call
       // (tests/verify-reenrich-race.test.mjs). It also stops two overlapping runs rewriting a
       // row twice.
+      //
+      // Narrow replaces title and narrative with model text, so an explicit save it rewrites (one
+      // whose save-time enrich failed) moves to the re-enrich writer's id, as a cluster-merge
+      // keeper does (D#146, D#138). Wide keeps the stored title and narrative (it fills the lesson
+      // and the side fields), so the row stays an explicit save. The writer's session row is
+      // best-effort.
+      let rewriteSessionId = null;
+      if (!isWide) {
+        const cur = db.prepare('SELECT memory_session_id FROM observations WHERE id = ?').get(cand.id);
+        if (cur?.memory_session_id?.startsWith(MANUAL_SESSION_ID_PREFIX)) {
+          const enrichSessionId = writerSessionId('enrich-', cand.project);
+          try {
+            db.prepare(
+              `INSERT OR IGNORE INTO sdk_sessions (content_session_id, memory_session_id, project, started_at, started_at_epoch, status)
+               VALUES (?, ?, ?, ?, ?, 'active')`,
+            ).run(enrichSessionId, enrichSessionId, cand.project, new Date().toISOString(), Date.now());
+            rewriteSessionId = enrichSessionId;
+          } catch (e) {
+            debugCatch(e, 'reenrich writer session');
+          }
+        }
+      }
       const res = db
         .prepare(
           `
         UPDATE observations SET type=?, title=?, narrative=?, concepts=?, facts=?,
           text=?, importance=?, lesson_learned=?, search_aliases=?, minhash_sig=?, optimized_at=?,
-          scope=COALESCE(?, scope)
+          scope=COALESCE(?, scope), memory_session_id = COALESCE(?, memory_session_id)
         WHERE id = ? AND ${liveObsFilterSql('')} AND optimized_at IS NULL
       `,
         )
@@ -608,6 +630,7 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
           // scope, or emits an off-enum value, must never blank an existing label —
           // and THIS update stamps optimized_at, so the loss would be permanent.
           normalizeScope(parsed.scope),
+          rewriteSessionId,
           cand.id,
         );
       if (res.changes === 0) {
@@ -1315,15 +1338,15 @@ Return ONLY valid JSON:
       // The keeper now holds model text. Search reads authorship from memory_session_id, so an
       // explicit save's `manual-` id would mark it as one (D#138); it moves to the compression
       // writer's id. A machine-written keeper keeps its id, and so does the snapshot above, which
-      // is the original save. The writer's session row is best-effort: sdk_sessions refuses an id
-      // shaped like a uuid, which `compress-<project>` is for a 27-character project shaped
-      // xxxx-xxxx-xxxx-xxxxxxxxxxxx, and that refusal must not fail the merge (v6.19.1 pre-tag F5a).
+      // is the original save. writerSessionId keeps the id out of the uuid shape sdk_sessions
+      // refuses (D#147); the row stays best-effort, so no refusal can fail the merge (v6.19.1
+      // pre-tag F5a).
       let rewriteSessionId = null;
       const keeperSession = db
         .prepare('SELECT memory_session_id FROM observations WHERE id = ?')
         .get(keeper.id);
       if (keeperSession?.memory_session_id?.startsWith(MANUAL_SESSION_ID_PREFIX)) {
-        const compressSessionId = `compress-${keeper.project}`;
+        const compressSessionId = writerSessionId('compress-', keeper.project);
         try {
           db.prepare(
             `INSERT OR IGNORE INTO sdk_sessions (content_session_id, memory_session_id, project, started_at, started_at_epoch, status)
@@ -1580,7 +1603,7 @@ export async function executeSmartCompressCluster(db, observations, project) {
       ) {
         return null;
       }
-      const sessionId = `compress-${project}`;
+      const sessionId = writerSessionId('compress-', project);
       const now = new Date();
       db.prepare(
         `INSERT OR IGNORE INTO sdk_sessions

package/lib/activity.mjs

@@ -7,6 +7,7 @@
 import { sanitizeFtsQuery } from '../utils.mjs';
 import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 import { saveObservation } from './save-observation.mjs';
+import { writerSessionId } from './provenance.mjs';
 // Pure title-only builder: this query runs on the EVENTS table, which has no
 // lesson_learned column — the lesson-escape variant would be a SQL error here.
 import { buildNotLowSignalSql } from './low-signal-patterns.mjs';
@@ -200,7 +201,7 @@ export function promoteInsightEvents(
       lesson_learned: ev.body.slice(0, 500),
       now: new Date(ev.created_at_epoch),
       // Event bodies are machine-written (episode summaries), so the row is not an explicit save.
-      sessionId: `promote-${ev.project}`,
+      sessionId: writerSessionId('promote-', ev.project),
     });
     mark.run(Date.now(), ev.id);
     return r;

package/lib/compress-core.mjs

@@ -17,6 +17,7 @@
 
 import { isoWeekKey, COMPRESSED_AUTO } from '../utils.mjs';
 import { scrubRecord } from './scrub-record.mjs';
+import { writerSessionId } from './provenance.mjs';
 
 /**
  * Low-value compression candidates: importance<=1, never accessed, older than
@@ -88,7 +89,7 @@ export function compressGroup(db, proj, obs) {
   const dominantType = Object.entries(types).sort((a, b) => b[1] - a[1])[0][0];
   const title = `Weekly summary: ${obs.length} ${dominantType} observations`;
   const narrative = obs.map((o) => `- ${o.title || '(untitled)'}`).join('\n');
-  const sessionId = `compress-${proj}`;
+  const sessionId = writerSessionId('compress-', proj);
 
   const sortedEpochs = obs.map((o) => o.created_at_epoch).sort((a, b) => a - b);
   const medianEpoch = sortedEpochs[Math.floor(sortedEpochs.length / 2)];

package/lib/provenance.mjs

@@ -1,8 +1,8 @@
 // Which writer produced an observation, read back from its memory_session_id. saveObservation
 // writes every explicit save under MANUAL_SESSION_ID_PREFIX. The hook capture (`hook-`),
 // transcript import (`import-`), compression summaries and cluster-merge keepers (`compress-`),
-// promoted events (`promote-`) and rows imported from older stores (a bare session uuid) are
-// machine-written.
+// rows narrow re-enrich rewrote (`enrich-`), promoted events (`promote-`) and rows imported from
+// older stores (a bare session uuid) are machine-written.
 //
 // Search and get mark the machine-written side, because explicit saves are the large majority
 // of a typical store and a mark on nearly every line would carry no information. An unknown id
@@ -10,6 +10,20 @@
 
 export const MANUAL_SESSION_ID_PREFIX = 'manual-';
 
+// sdk_sessions refuses a row whose two ids are equal and 36 characters long with dashes where a
+// uuid has them (schema.mjs, sdk_sessions_id_mix_check_ai). A writer row uses `<prefix><project>`
+// for both, which has that shape for one project length and dash layout (27 characters under
+// `compress-`, 29 under `manual-`), and the refusal failed every write in such a project (D#147).
+// That id gets one more character; every other id is unchanged. Counted in code points, as
+// SQLite's length() and LIKE's `_` count them.
+const UUID_SHAPED_RE = /^[\s\S]{8}-[\s\S]{4}-[\s\S]{4}-[\s\S]{4}-[\s\S]{12}$/u;
+
+/** The session id a non-hook writer (`manual-`, `compress-`, `enrich-`, `promote-`) stores for a project. */
+export function writerSessionId(prefix, project) {
+  const id = `${prefix}${project}`;
+  return UUID_SHAPED_RE.test(id) ? `${id}~` : id;
+}
+
 const AUTO_MARK = '🤖';
 const AUTO_TEXT = 'auto-written, not an explicit save';
 

package/lib/save-observation.mjs

@@ -22,7 +22,7 @@ import { liveObsFilterSql } from './inject-search-core.mjs';
 // Imported, not injected: `allowStatuses` below is the POLICY this function exists to hold,
 // and a caller free to pass its own resolver could reinstate the one-way gate D#195 closed.
 import { resolveDeferredIds, closeDeferredItems } from './deferred-work.mjs';
-import { MANUAL_SESSION_ID_PREFIX } from './provenance.mjs';
+import { MANUAL_SESSION_ID_PREFIX, writerSessionId } from './provenance.mjs';
 
 const DEDUP_WINDOW_MS = 5 * 60 * 1000;
 const DEDUP_RECENT_LIMIT = 50;
@@ -201,7 +201,7 @@ export function saveObservation(db, params) {
 
   // An explicit save by default; a caller storing machine-written text names its own writer
   // (lib/provenance.mjs reads authorship from this id).
-  const sessionId = params.sessionId || `${MANUAL_SESSION_ID_PREFIX}${project}`;
+  const sessionId = params.sessionId || writerSessionId(MANUAL_SESSION_ID_PREFIX, project);
 
   // Ensure session exists (FK constraint). INSERT OR IGNORE makes this safe
   // under concurrent calls.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.1",
+  "version": "6.19.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.19.1",
+      "version": "6.19.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.1",
+  "version": "6.19.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/secret-scrub.mjs

@@ -200,34 +200,19 @@ export const SECRET_PATTERNS = [
   // alternation missed; the block delimiters make FP impossible.
   // The body stops at the next `-----BEGIN ` (D#130): with `[\s\S]*?` every header with no END
   // scanned to the end of the text, on each of scrubSecrets' passes — quadratic, 8.3 s on 500k
-  // chars. A block whose END is missing is left to the next pattern.
+  // chars. A block whose END is missing is left to the next pattern. Nor does it cross a mark this
+  // scrubber wrote: on a later pass, a BEGIN that a scrubbed key used to block reached a far END
+  // and erased the prose between (v6.19.2 pre-tag defect review F5).
   [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY|\*\*\*PEM_KEY\*\*\*)[\s\S])*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
     '***PEM_KEY***',
   ],
-  // A cut-off key (`head id_rsa`, a tool output cut mid-key): the header and the WHOLE lines of
-  // base64 (or RFC 1421 headers) that follow it. Stored whole through v6.19.0 when no later key
-  // header followed. Whole lines only, so prose naming a header mid-sentence keeps its text
-  // (v6.19.0 round-3 P3-3: ending the block at the next key header erased the prose between two).
-  // A body line starts with 16+ base64 characters, and one shorter whole line may follow the last
-  // of them (a key's last line): a line of one word or number is prose (v6.19.1 pre-tag review F3),
-  // so the body needs a long line, and blank lines count only between long ones. A long line need
-  // not be whole, so a key cut mid-line loses the cut line too. A line break may be JSON-escaped
-  // (`\n` as two characters) and a quote may end the last line (v6.19.1 claims review F1). A header
-  // value may hold a backslash that does not start an escaped break (a Windows path), and it does
-  // not share its whitespace with a second quantifier, which was quadratic (delta review P1).
-  [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*(?:\r?\n|\\r\\n|\\n)(?=[ \t]*(?:\r?\n|\\r\\n|\\n)))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*(?:[A-Za-z0-9+/=]{16,}|(?:Proc-Type|DEK-Info|Version|Comment|Hash|Charset):(?:[^\r\n\\]|\\(?![rn]))*(?=\r?\n|\\[rn]|["']|$)))(?:(?:[ \t]*(?:\r?\n|\\r\\n|\\n)(?=[ \t]*(?:\r?\n|\\r\\n|\\n)))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*(?:[A-Za-z0-9+/=]{16,}|(?:Proc-Type|DEK-Info|Version|Comment|Hash|Charset):(?:[^\r\n\\]|\\(?![rn]))*(?=\r?\n|\\[rn]|["']|$))))*(?:[ \t]*(?:\r?\n|\\r\\n|\\n)[ \t]*[A-Za-z0-9+/=]{1,15}[ \t]*(?=\r?\n|\\[rn]|["']|$))?/g,
-    '***PEM_KEY***',
-  ],
-  // The other end (`tail key.pem`): whole base64 lines ending in a private-key END, the same line
-  // rule as above but with two shorter lines allowed before the END (an armored PGP key's last data
-  // line and its `=XXXX` checksum; delta review P2). A line may start after a quote. A run of lines
-  // that does not end there is consumed and returned unchanged, so no line starts a second scan.
-  [
-    /(?:(?<![^\n])|(?<=\\n|["']))(?:[ \t]*[A-Za-z0-9+/=]{16,}[ \t]*(?:\r?\n|\\r\\n|\\n))+(?:[ \t]*[A-Za-z0-9+/=]{1,15}[ \t]*(?:\r?\n|\\r\\n|\\n)){0,2}(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----)?/g,
-    (m) => (m.endsWith('-----') ? '***PEM_KEY***' : m),
-  ],
+  // A cut-off key (`head id_rsa`, a tool output cut mid-key) and a headerless key tail (`tail
+  // key.pem`). These are line scanners, not patterns (D#145): three rounds of review each found a
+  // line shape the regex versions misread, and each fix to one shape erased prose in another.
+  // See scrubCutOffKeys and scrubKeyTails below for the line rules.
+  [{ [Symbol.replace]: (text) => scrubCutOffKeys(text) }, null],
+  [{ [Symbol.replace]: (text) => scrubKeyTails(text) }, null],
   // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
   // `hash` deliberately excluded: `hash: <40hex>` / `hash=<md5>` are git SHAs and
   // checksums (real, preserved data in this hash-heavy repo), not credentials.
@@ -351,6 +336,463 @@ export const SECRET_PATTERNS = [
   // bare-token pattern here: don't — anchor it to a provider prefix instead.
 ];
 
+// ─── Cut-off private keys (D#145) ──────────────────────────────────────────
+// A key's text reaches the scrubber in many line shapes: plain LF/CRLF/CR lines, JSON-escaped
+// breaks (`\n` as two characters, or `\\n` when serialised twice), lines carrying a prefix (the
+// Read tool's `     2\t` or `2→`, grep's `id_rsa:`, a `> ` quote, a diff `-`), and lines inside a
+// quoted string. The scanners read the text as lines of ONE shape per key, decided at the key:
+//   - the break after the BEGIN line (or before the END line) says whether breaks are real or
+//     escaped, and at which depth; in real-break text a backslash is never a break, so a Windows
+//     path in a `Comment:` value no longer ends the header (v6.19.1 round-3 P3-E);
+//   - the text before the BEGIN (or END) on its line is the line prefix, and every other line
+//     loses a prefix of the same shape (digits may differ, `:` and `-` swap for grep context)
+//     before it is judged;
+//   - lines end at breaks only. A header value that runs on into the next JSON fields is still
+//     one header line, so it erases nothing without a base64 line under it (round-3 P3-C).
+// A body line is WHOLE base64: 16+ characters, or 1-15 for the last line. So a word under a key
+// body keeps its text (round-3 P3-A: `Don't` lost `Don`), as does a path or an identifier that
+// starts the next line (P3-B), and a body needs one long line, so a header followed by words is
+// not a key (F3). A string's closing quote, a backtick or a closing tag after the line is not part
+// of it. A line whose base64 run is followed by something else is a cut or annotated key line
+// when the run is 40+ characters or a truncation mark or delimiter follows it (`…`, `...`,
+// `[truncated]`, `<`): its base64 goes and the rest stays (delta review P3-2; v6.19.2 pre-tag
+// defect review F4). A shorter run followed by words starts a line of prose.
+
+const KEY_BEGIN_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g;
+const KEY_END_RE = /-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g;
+const KEY_END_LINE_RE = /^-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/;
+const B64_LONG_RE = /^[A-Za-z0-9+/=]{16,}$/;
+const B64_SHORT_RE = /^[A-Za-z0-9+/=]{1,15}$/;
+// Space-separated chunks, allowed only on the BEGIN line itself (a key pasted onto one line).
+const B64_CHUNKS_RE = /^[A-Za-z0-9+/=]+(?:[ \t]+[A-Za-z0-9+/=]+)*$/;
+const B64_RUN_RE = /^[A-Za-z0-9+/=]{16,}/;
+// What may follow a key line that was cut or annotated: a truncation mark or a delimiter. A quote
+// ends the string a key sits in (`…', 'rc': 0}`, `…","stderr":…`): the scanners do not track which
+// quote opened a string, since no character before a quote tells an opening quote from prose
+// (`Here's`, `Run 'head id_rsa'`, `b'…'`; v6.19.2 pre-tag reviews, delta F1 and round-3 F1/F2).
+// Two escapes deep a string ends at `\"` (round-4 F2). Five dashes are the next key's marker glued
+// to a cut line (`for i in …; do head -c 80 k; done`).
+const CUT_MARK_RE = /^(?: ?…| ?\.\.\.| ?\[| ?<|[`"']|\\+["']|-----)/;
+const PGP_CRC_RE = /^=[A-Za-z0-9+/]{4}$/;
+// How a key's base64 starts: a DER SEQUENCE (PKCS#1, PKCS#8, SEC1) or OpenSSH's `openssh-key-v1`;
+// under a PGP header, a secret-key packet in the old or new format (`lQ…`, `xc…`/`xV…`).
+const KEY_MAGIC_RE = /^(?:MII|MIG|MC4C|MHcC|b3BlbnNzaC1rZXktdjE)/;
+const PGP_MAGIC_RE = /^(?:lQ|x[cV])/;
+// RFC 1421 / RFC 4880 armor headers, before the body. Named, not any `Word:`: a `Note:` line is
+// prose, and taking it for a header made the lone base64 line under it a key.
+// RFC 1421's full set and tool-written `X-` headers count too (v6.19.2 pre-tag delta review F4:
+// `Content-Domain` or `X-Custom` before the body stored the whole key).
+const ARMOR_HEADER_RE =
+  /^(?:Proc-Type|DEK-Info|Content-Domain|Originator-ID-(?:Asymmetric|Symmetric)|Originator-Certificate|Issuer-Certificate|MIC-Info|Key-Info|Recipient-ID-(?:Asymmetric|Symmetric)|CRL|Version|Comment|Hash|Charset|MessageID|X-[A-Za-z0-9-]+)[ \t]*:/i;
+const MAX_ARMOR_HEADERS = 16;
+// A JS/Python string split across source lines: `…\n" +` then `"…` on the next line. Not a comma:
+// `'…\n',` then `'…'` is the next element of a list, and its first word is not the key's last line.
+// One whitespace quantifier on each side of the `+`: `[ \t]*\+?[ \t]*` split a run between two
+// and was quadratic when no break followed (v6.19.2 pre-tag defect review F1: 16-19 s at 200k).
+const CONCAT_AFTER_RE = /["'](?:[ \t]*\+)?[ \t]*(?:\r\n|\n|\r)[ \t]*["']/y;
+const CONCAT_BEFORE_RE = /(?:\\r)?\\n["'](?:[ \t]*\+)?[ \t]*(?:\r\n|\n|\r)[ \t]*["']$/;
+const PEM_MARK = '***PEM_KEY***';
+// After an END that ends its line: a closing quote or punctuation, then a break or the text end.
+// Closing tags may be nested (`END</code></pre>`; round-4 F3), and a string's closing quote, escaped
+// or not, ends the line whatever follows it: `…END-----","stderr":""` is `tail -n 2` in a tool
+// result (round-5 F3).
+const CLEAN_AFTER_END_RE = /(?:[ \t`,;)\]}]|<\/[A-Za-z][\w:.-]{0,40}>)*(?:\r|\n|\\+[nr]|\\*["']|$)/y;
+
+const BLANK = 0;
+const LONG = 1;
+const SHORT = 2;
+const END = 3;
+const ARMOR = 4;
+const CUT = 5;
+const OTHER = 6;
+
+function backslashesBefore(text, i, floor) {
+  let j = i;
+  while (j > floor && text[j - 1] === '\\') j--;
+  return i - j;
+}
+
+// Break depth `u`: 0 = real breaks only, 1 = `\n`, 2 = `\\n`, … A run of r backslashes then `n`
+// is a break at depth u when r % 2u === u (the backslashes before it are escaped backslashes).
+const isEscBreak = (r, u) => u > 0 && r % (2 * u) === u;
+// An unescaped quote at depth u ends the string: r % 2u < u.
+const isStringEnd = (r, u) => u > 0 && r % (2 * u) < u;
+
+/** The line starting at s: its end, and where the next line starts (-1 at the end of the text). */
+function nextLine(text, s, u) {
+  const n = text.length;
+  let i = s;
+  while (i < n) {
+    const ch = text[i];
+    if (ch === '\n') return { end: i, next: i + 1 };
+    if (ch === '\r') return { end: i, next: text[i + 1] === '\n' ? i + 2 : i + 1 };
+    if (u > 0 && ch === '\\') {
+      let j = i;
+      while (j < n && text[j] === '\\') j++;
+      const r = j - i;
+      const c = text[j];
+      if ((c === 'n' || c === 'r') && isEscBreak(r, u)) {
+        let next = j + 1;
+        if (c === 'r' && text.startsWith('\\'.repeat(u) + 'n', next)) next += u + 1;
+        if (u === 1) {
+          CONCAT_AFTER_RE.lastIndex = next;
+          const m = CONCAT_AFTER_RE.exec(text);
+          if (m) next += m[0].length;
+        }
+        return { end: j - u, next };
+      }
+      i = j + 1;
+      continue;
+    }
+    i++;
+  }
+  return { end: n, next: -1 };
+}
+
+/** The line that ends at the break before `ls`, or null when `ls` starts the text or string. */
+function prevLine(text, ls, u, floor) {
+  if (ls - 1 < floor) return null;
+  const c = text[ls - 1];
+  let bs = -1;
+  if (c === '\n') bs = ls - 2 >= floor && text[ls - 2] === '\r' ? ls - 2 : ls - 1;
+  else if (c === '\r') bs = ls - 1;
+  else if ((c === 'n' || c === 'r') && isEscBreak(backslashesBefore(text, ls - 1, floor), u)) {
+    bs = ls - 1 - u;
+    const r2 = bs - 1 >= floor && text[bs - 1] === 'r' ? backslashesBefore(text, bs - 1, floor) : 0;
+    if (c === 'n' && isEscBreak(r2, u)) bs -= u + 1;
+  } else if (u === 1 && (c === '"' || c === "'")) {
+    const m = CONCAT_BEFORE_RE.exec(text.slice(Math.max(floor, ls - 64), ls));
+    if (m) bs = ls - m[0].length;
+  }
+  if (bs === -1) return null;
+  let i = bs - 1;
+  while (i >= floor) {
+    const ch = text[i];
+    if (ch === '\n' || ch === '\r') break;
+    if (u > 0 && (ch === 'n' || ch === 'r') && isEscBreak(backslashesBefore(text, i, floor), u)) break;
+    if (u > 0 && (ch === '"' || ch === "'") && isStringEnd(backslashesBefore(text, i, floor), u)) break;
+    i--;
+  }
+  return { start: i + 1, end: bs };
+}
+
+/** A regex for the line prefix `prefix` has, with digits free and grep's `:`/`-` interchangeable. */
+function prefixShape(prefix) {
+  const body = prefix.replace(/^[ \t]+/, '');
+  if (!body || body.length > 256) return null;
+  if (body === '-' || body === '+') return /^[ \t]*[-+ ]/;
+  const src = body
+    .replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')
+    .replace(/\d+/g, '\\d+')
+    .replace(/[:-]/g, '[:-]');
+  return new RegExp(`^[ \\t]*${src}`);
+}
+
+/** The judged part of line [s, e): no prefix of the key's shape, no padding, no string quotes. */
+function lineCore(text, s, e, shape) {
+  let line = text.slice(s, e);
+  let off = s;
+  if (shape) {
+    const m = shape.exec(line);
+    if (m) {
+      line = line.slice(m[0].length);
+      off += m[0].length;
+    }
+  }
+  let a = 0;
+  let b = line.length;
+  while (a < b && (line[a] === ' ' || line[a] === '\t')) a++;
+  while (b > a && (line[b - 1] === ' ' || line[b - 1] === '\t')) b--;
+  if (a < b && (line[a] === '"' || line[a] === "'" || line[a] === '`')) a++;
+  // A closing quote or backtick with what may follow it (`",`, `" +`, `')`), or a closing tag
+  // (`</key>`), and escaped breaks before it. Read from the end: an unanchored
+  // `(?:\\+[rn])*["']…$` retried every start in a backslash run.
+  let q = b;
+  while (q > a && /[ \t+,;)\]}]/.test(line[q - 1])) q--;
+  const tag = q > a && line[q - 1] === '>' ? /<\/[A-Za-z][\w:.-]{0,40}>$/.exec(line.slice(a, q)) : null;
+  if (tag) b = q - tag[0].length;
+  else if (q > a && (line[q - 1] === '"' || line[q - 1] === "'" || line[q - 1] === '`')) {
+    q--;
+    for (;;) {
+      if (q - 1 <= a || (line[q - 1] !== 'n' && line[q - 1] !== 'r')) break;
+      let k = q - 1;
+      while (k > a && line[k - 1] === '\\') k--;
+      if (k === q - 1) break;
+      q = k;
+    }
+    b = q;
+  }
+  return { core: line.slice(a, b), start: off + a, end: off + b };
+}
+
+function classify(core) {
+  if (core === '') return BLANK;
+  if (B64_LONG_RE.test(core)) return LONG;
+  if (B64_SHORT_RE.test(core)) return SHORT;
+  if (KEY_END_LINE_RE.test(core)) return END;
+  if (ARMOR_HEADER_RE.test(core)) return ARMOR;
+  if (cutRun(core)) return CUT;
+  return OTHER;
+}
+
+/**
+ * The base64 run a cut or annotated key line starts with, or null: 16+ characters followed by a
+ * truncation mark or a delimiter (`…`, `...`, `[truncated]`, `<`, a backtick), or 40+ followed by
+ * anything (`<64> see above`). A shorter run followed by text is an identifier or a path starting
+ * a line of prose (`exportedArmoredPrivateKey = …`, round-3 P3-B), which stays.
+ */
+function cutRun(core) {
+  const m = B64_RUN_RE.exec(core);
+  if (!m) return null;
+  return m[0].length >= 40 || CUT_MARK_RE.test(core.slice(m[0].length)) ? m[0] : null;
+}
+
+/**
+ * Where the key that starts with the BEGIN at [b, be) ends, or -1 when no key material follows it.
+ * Header lines and blank lines may come first; then 16+-character base64 lines (blank lines only
+ * between them), one shorter last line (and a PGP `=XXXX` checksum after it), and the END if it
+ * is there. One base64 line alone is a key only when it is 40+ characters, starts the way a key
+ * encoding starts (DER `MII…`, OpenSSH `b3BlbnNzaC1rZXktdjE…`) or follows armor headers: a path
+ * or an identifier of 16-39 characters under a header is prose (delta review P3-5). A complete
+ * block never gets here; the block pattern above takes it first.
+ */
+function cutOffKeyEnd(text, b, be) {
+  // The rest of the BEGIN line: nothing, or base64 chunks, then a break that sets the depth.
+  let i = be;
+  while (i < text.length && /[A-Za-z0-9+/= \t]/.test(text[i])) i++;
+  const rest = text.slice(be, i).trim();
+  let u;
+  let next;
+  if (i >= text.length) return -1;
+  if (text[i] === '\n' || text[i] === '\r') {
+    u = 0;
+    next = text[i] === '\r' && text[i + 1] === '\n' ? i + 2 : i + 1;
+  } else if (text[i] === '\\') {
+    let j = i;
+    while (j < text.length && text[j] === '\\') j++;
+    const r = j - i;
+    if (text[j] !== 'n' && text[j] !== 'r') return -1;
+    u = r & -r;
+    if (r !== u) return -1; // a literal backslash on the BEGIN line: not a key line
+    ({ next } = nextLine(text, i, u));
+  } else return -1;
+  let longs = 0;
+  let longest = 0;
+  let first = '';
+  let end = -1;
+  if (rest) {
+    // A key pasted onto its BEGIN line: every chunk but the last is a full 16+ line. Words there
+    // are prose, even one of 16+ letters (v6.19.2 pre-tag defect review F9). A loop, not a spread:
+    // Math.max(...chunks) overflowed the stack past ~125k chunks (F2).
+    if (!B64_CHUNKS_RE.test(rest)) return -1;
+    const chunks = rest.split(/[ \t]+/);
+    for (let k = 0; k < chunks.length; k++) {
+      if (k < chunks.length - 1 && chunks[k].length < 16) return -1;
+      if (chunks[k].length > longest) longest = chunks[k].length;
+    }
+    if (longest < 16) return -1;
+    longs = 1;
+    first = chunks[0];
+    end = be + text.slice(be, i).trimEnd().length;
+  }
+  // The BEGIN line's prefix.
+  let ls = b;
+  while (ls > 0) {
+    const ch = text[ls - 1];
+    if (ch === '\n' || ch === '\r') break;
+    if (u > 0 && (ch === 'n' || ch === 'r') && isEscBreak(backslashesBefore(text, ls - 1, 0), u)) break;
+    if (u > 0 && (ch === '"' || ch === "'") && isStringEnd(backslashesBefore(text, ls - 1, 0), u)) break;
+    ls--;
+  }
+  // A 16+ base64 run glued to the BEGIN is the previous key's cut line, not a line prefix: taken
+  // for one, it stripped this key's identical body line and one copy of a repeated cut key went
+  // per pass (v6.19.2 pre-tag round-5 review F2).
+  let run = 0;
+  while (run < 16 && b - run > ls && /[A-Za-z0-9+/=]/.test(text[b - run - 1])) run++;
+  const shape = run >= 16 ? null : prefixShape(text.slice(ls, b));
+
+  let armors = 0;
+  let shorts = 0;
+  let pendingBlank = false;
+  while (next !== -1) {
+    const line = nextLine(text, next, u);
+    const { core, start, end: coreEnd } = lineCore(text, next, line.end, shape);
+    const kind = classify(core);
+    next = line.next;
+    if (kind === END) {
+      if (longs > 0) end = start + KEY_END_LINE_RE.exec(core)[0].length;
+      break;
+    }
+    if (kind === BLANK) {
+      if (shorts > 0) break;
+      pendingBlank = true;
+      continue;
+    }
+    if (longs === 0) {
+      if (kind === ARMOR && ++armors <= MAX_ARMOR_HEADERS) continue;
+      if (kind !== LONG && kind !== CUT) break;
+    }
+    if (kind === LONG && shorts === 0) {
+      if (longs++ === 0) first = core;
+      longest = Math.max(longest, core.length);
+      end = coreEnd;
+      pendingBlank = false;
+      continue;
+    }
+    // A cut line ends the key whatever came before it, blank lines included: a PGP or encrypted
+    // key has one before its body, and `head` of it in a JSON string ends in a cut line (round-4
+    // F1: checked after the blank-line stop, it was never read and the whole key was stored).
+    if (kind === CUT && shorts === 0) {
+      const run = cutRun(core);
+      if (longs++ === 0) first = run;
+      longest = Math.max(longest, run.length);
+      end = start + run.length;
+      break;
+    }
+    if (pendingBlank) break;
+    if (kind === SHORT && (shorts === 0 || (shorts === 1 && PGP_CRC_RE.test(core)))) {
+      shorts++;
+      end = coreEnd;
+      continue;
+    }
+    break;
+  }
+  if (longs === 0) return -1;
+  const magic = KEY_MAGIC_RE.test(first) || (text.slice(b, be).includes('PGP') && PGP_MAGIC_RE.test(first));
+  return longs >= 2 || armors > 0 || longest >= 40 || magic ? end : -1;
+}
+
+function scrubCutOffKeys(text) {
+  if (!text.includes('PRIVATE KEY')) return text;
+  KEY_BEGIN_RE.lastIndex = 0;
+  let out = '';
+  let last = 0;
+  let m;
+  while ((m = KEY_BEGIN_RE.exec(text))) {
+    const end = cutOffKeyEnd(text, m.index, m.index + m[0].length);
+    if (end === -1) continue;
+    out += text.slice(last, m.index) + PEM_MARK;
+    last = end;
+    KEY_BEGIN_RE.lastIndex = end;
+  }
+  return last === 0 ? text : out + text.slice(last);
+}
+
+/**
+ * The span [start, end) of the key tail that ends with the END at [e, ee), or null: whole base64
+ * lines of 16+ characters directly above it, with one shorter line before the END, or two when the
+ * one before the END is a PGP `=XXXX` checksum (delta review P2; two short words above an END are
+ * prose, round-3 P3-D). The span takes the END too, unless words precede the END on its line (a
+ * sentence naming it): then the lines above go and the sentence stays (F7). `floor` is the end of
+ * the previous END, so no line is read twice.
+ */
+function keyTailSpan(text, e, ee, floor) {
+  let ls = e;
+  let u = 0;
+  while (ls > floor) {
+    const ch = text[ls - 1];
+    if (ch === '\n' || ch === '\r') break;
+    if (ch === 'n' || ch === 'r') {
+      const r = backslashesBefore(text, ls - 1, floor);
+      if (r > 0) {
+        u = r & -r;
+        break;
+      }
+    }
+    ls--;
+  }
+  let longs = 0;
+  let shorts = 0;
+  let crc = false;
+  let top = -1;
+  let topCore = '';
+  let longest = 0;
+  let bottom = -1;
+  const take = (core, start, end) => {
+    if (!accept(core, start)) return false;
+    if (bottom === -1) bottom = end;
+    return true;
+  };
+  const accept = (core, start) => {
+    const kind = classify(core);
+    if (kind === LONG) {
+      longs++;
+      top = start;
+      topCore = core;
+      if (core.length > longest) longest = core.length;
+      return true;
+    }
+    if (longs > 0 || kind !== SHORT) return false;
+    if (shorts === 0) {
+      shorts = 1;
+      crc = PGP_CRC_RE.test(core);
+      return true;
+    }
+    if (shorts === 1 && crc) {
+      shorts = 2;
+      return true;
+    }
+    return false;
+  };
+  // The END line's own prefix: a line prefix, the key's last base64 run glued to the END, or words.
+  // Words with spaces are a line prefix when the line above starts the same way (`web-1  | `, a
+  // syslog stamp, `> > `; v6.19.2 pre-tag delta review F2), and a sentence naming the END if not.
+  const prefix = text.slice(ls, e);
+  const trimmed = prefix.trim();
+  let shape = null;
+  let sentence = false;
+  let prefixed = false;
+  if (/^[ \t]*[A-Za-z0-9+/=]+$/.test(prefix)) {
+    const at = ls + prefix.indexOf(trimmed);
+    if (!take(trimmed, at, at + trimmed.length)) return null;
+  } else {
+    shape = prefixShape(prefix);
+    const above = shape && prevLine(text, ls, u, floor);
+    prefixed = Boolean(above && shape.test(text.slice(above.start, above.end)));
+    if (/\S\s+\S/.test(trimmed) && !prefixed) {
+      sentence = true;
+      shape = null;
+    }
+  }
+  // An END alone on its line (after nothing but a line prefix, before nothing but a quote,
+  // punctuation or a closing tag) is evidence enough for one line over it that has a digit, a `+`
+  // or `=` padding: `tail -n 2` of a key whose last line is 16-39 characters (delta F3). A 16+
+  // run of random base64 almost always has one; a camelCase identifier or a path has none
+  // (round-3 F3). An END in a sentence or in inline code followed by words is not alone.
+  CLEAN_AFTER_END_RE.lastIndex = ee;
+  const clean = !sentence && (trimmed === '' || prefixed) && CLEAN_AFTER_END_RE.test(text);
+  let cur = ls;
+  for (let line; (line = prevLine(text, cur, u, floor)); cur = line.start) {
+    const { core, start, end } = lineCore(text, line.start, line.end, shape);
+    if (!take(core, start, end)) break;
+  }
+  // Otherwise the same evidence a cut-off key needs: one base64 line alone is a key tail only when
+  // it is 40+ characters, starts like a key encoding or sits over a PGP checksum; an identifier of
+  // 16-39 characters over an END named in prose is not (F7).
+  if (longs === 0) return null;
+  const b64ish = /[0-9+]|=$/.test(topCore);
+  if (!(longs >= 2 || longest >= 40 || crc || (clean && b64ish) || KEY_MAGIC_RE.test(topCore))) return null;
+  return [top, sentence ? bottom : ee];
+}
+
+function scrubKeyTails(text) {
+  if (!text.includes('PRIVATE KEY')) return text;
+  KEY_END_RE.lastIndex = 0;
+  let out = '';
+  let last = 0;
+  let floor = 0;
+  let m;
+  while ((m = KEY_END_RE.exec(text))) {
+    const span = keyTailSpan(text, m.index, m.index + m[0].length, Math.max(floor, last));
+    if (span) {
+      out += text.slice(last, span[0]) + PEM_MARK;
+      last = span[1];
+    }
+    floor = m.index + m[0].length;
+  }
+  return last === 0 ? text : out + text.slice(last);
+}
+
 /**
  * Scrub known secret patterns (API keys, tokens, credentials) from text.
  * Also strips user-marked `<private>...</private>` blocks first, so every