codiedev 0.10.0-beta.13 → 0.10.0-beta.15

package/dist/cli.js

@@ -44,7 +44,6 @@ const ask_1 = require("./commands/ask");
 const ping_1 = require("./commands/ping");
 const inbox_1 = require("./commands/inbox");
 const note_1 = require("./commands/note");
-const createTicket_1 = require("./commands/createTicket");
 const doctor_1 = require("./commands/doctor");
 const search_1 = require("./commands/search");
 const library_1 = require("./commands/library");
@@ -90,14 +89,6 @@ Artifacts:
                                          team's collective memory. Returns an
                                          LLM-synthesized answer with citations
                                          pointing at sessions + artifacts.
-  codiedev create-ticket [<prompt>]      Forward-write a scoped ticket plan.
-                                         Claude investigates the codebase, asks
-                                         "single repo or multiple? where?", then
-                                         emits a plan with N+1 split. Lands in
-                                         /portal/research/<id>; push to Jira from there.
-  codiedev create-ticket --submit <path|->
-                                         Internal: Claude calls this itself with
-                                         a plan JSON to submit. Use - for stdin.
 
 Messaging:
   codiedev ping <user> "<msg>" [--with <key>]
@@ -337,25 +328,6 @@ codiedev note — capture a passing thought, linked to your session
     unignore: IGNORE_HELP,
     ignored: IGNORE_HELP,
     capture: IGNORE_HELP,
-    "create-ticket": `
-codiedev create-ticket — forward-write a scoped ticket plan
-
-  Default path:
-    codiedev create-ticket "I want to add SSO with Google"
-
-  Bare mode (no --submit) prints skill instructions for Claude to follow.
-  Claude asks where your repos live, investigates them locally, and emits a
-  plan as JSON. The CLI then re-invokes itself with --submit to upload it.
-
-  The plan lands at /portal/research/<id> as a ready-state research session.
-  Single ticket renders as one ticket; multi-ticket renders as a folder/group.
-  Push to Jira from the portal.
-
-  Examples:
-    codiedev create-ticket
-    codiedev create-ticket "I want to add Google SSO"
-    codiedev create-ticket --submit /tmp/plan.json   # internal, called by Claude
-`.trim(),
 };
 const DOCS = `
 Codiedev — usage guide
@@ -466,8 +438,10 @@ Run 'codiedev help <command>' for each, or see the quick list:
 `.trim();
 const REMOVED_COMMANDS = {
     promote: "Share an auto-saved spec with 'Promote to team' in the portal's My artifacts list.",
-    "reverse-ticket": "Use 'codiedev create-ticket' to draft Jira tickets.",
-    reverseTicket: "Use 'codiedev create-ticket' to draft Jira tickets.",
+    "reverse-ticket": "Ask your agent to file tickets with your team's own Jira or Linear tooling.",
+    reverseTicket: "Ask your agent to file tickets with your team's own Jira or Linear tooling.",
+    "create-ticket": "Ask your agent to file tickets with your team's own Jira or Linear tooling.",
+    createTicket: "Ask your agent to file tickets with your team's own Jira or Linear tooling.",
     react: "React to feed posts in the portal.",
 };
 function removedCommand(command) {
@@ -591,11 +565,9 @@ async function main() {
             case "reverse-ticket":
             case "reverseTicket":
             case "react":
-                removedCommand(command);
-                return;
             case "create-ticket":
             case "createTicket":
-                await (0, createTicket_1.runCreateTicket)(rest);
+                removedCommand(command);
                 return;
             case "search":
                 await (0, search_1.runSearch)(rest);

package/dist/commands/scrub.js

@@ -21,6 +21,14 @@ themselves never leave this machine.
   --path <file>      Only this file (repeatable)
   --session <id>     With --path <opencode.db>: only this OpenCode/Codie session
   --min-age <min>    Skip files changed in the last <min> minutes (default 60)
+
+The hourly background run can also remove your own secrets (values from
+your credential files and .env files) if your admin allows it. It reads
+~/.aws/credentials, ~/.npmrc, ~/.pypirc, ~/.netrc, ~/.git-credentials,
+~/.config/gh/hosts.yml, ~/.docker/config.json, ~/.config/hub,
+~/.gem/credentials, ~/.config/openai/credentials, and .env / .env.* in the
+repos your sessions start in. Values stay on this machine; only if your admin
+chose to check uploaded sessions too is a keyed fingerprint of each sent.
 `;
 function parseScrubArgs(args) {
     let dryRun = false;

package/dist/hook.js

@@ -445,8 +445,8 @@ async function main() {
     }
     if (process.argv[2] === "local-scrub") {
         try {
-            const { runAndReport } = await Promise.resolve().then(() => __importStar(require("./localScrub")));
-            await runAndReport();
+            const { runScheduledScrub } = await Promise.resolve().then(() => __importStar(require("./localScrub")));
+            await runScheduledScrub();
         }
         catch {
         }
@@ -500,7 +500,7 @@ async function main() {
         if (source === "codex")
             (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
         if (source === "codex")
-            (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()) });
+            (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
         if (source !== "copilot")
             await runDiscover(hookInput.prompt);
         return;
@@ -542,7 +542,7 @@ async function main() {
         process.argv[2] === "session-start-opencode" ||
         process.argv[2] === "session-start-pi") {
         (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
-        (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()) });
+        (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
         const packNag = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi" ? null : (0, sync_1.packNagLine)();
         if (packNag && process.argv[2] === "session-start")
             process.stdout.write(`${packNag}\n`);

package/dist/knownSecrets.js

@@ -0,0 +1,214 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hintOf = exports.CREDENTIAL_FILES = void 0;
+exports.worthMatching = worthMatching;
+exports.parseAssignments = parseAssignments;
+exports.credentialFiles = credentialFiles;
+exports.collectKnownSecrets = collectKnownSecrets;
+exports.knownSecretRule = knownSecretRule;
+exports.knownHash = knownHash;
+exports.fingerprints = fingerprints;
+exports.uploadKnownSecrets = uploadKnownSecrets;
+exports.rememberCwd = rememberCwd;
+exports.recentCwds = recentCwds;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const rules_1 = require("./scrub/rules");
+const MAX_SECRETS = 500;
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_CWDS = 30;
+function worthMatching(v) {
+    if (v.length < 16 || v.length > 512)
+        return false;
+    if (/\s/.test(v) || /^[a-z][a-z0-9+.-]*:\/\//i.test(v))
+        return false;
+    if (/^(?:true|false|null|undefined|localhost)$/i.test(v) || /^[\d.]+$/.test(v))
+        return false;
+    if (/^[~./]/.test(v) || /\$\{|\$\(/.test(v))
+        return false;
+    if ((0, rules_1.looksLikeTestValue)(v))
+        return false;
+    return (0, rules_1.shannonEntropy)(v) >= 3.5;
+}
+const unquote = (v) => v.trim().replace(/^(['"])(.*)\1$/, "$2");
+const short = (p) => p.split(path.sep).filter(Boolean).slice(-2).join("/");
+function parseAssignments(text) {
+    const out = [];
+    for (const line of text.split(/\r?\n/)) {
+        const m = line.match(/^\s*(?:export\s+)?([A-Za-z_./:@-][\w./:@-]*)\s*[=:]\s*(.+?)\s*$/);
+        if (!m || line.trim().startsWith("#") || line.trim().startsWith(";"))
+            continue;
+        out.push({ name: m[1].replace(/^\/\/[^:]*:/, ""), value: unquote(m[2].replace(/\s+#.*$/, "")) });
+    }
+    return out;
+}
+function read(file) {
+    try {
+        const st = fs.statSync(file);
+        if (!st.isFile() || st.size > MAX_FILE_BYTES)
+            return null;
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+exports.CREDENTIAL_FILES = [
+    ".aws/credentials", ".npmrc", ".pypirc", ".netrc", ".git-credentials", ".config/gh/hosts.yml",
+    ".docker/config.json", ".config/hub", ".gem/credentials", ".config/openai/credentials",
+];
+function credentialFiles(home, cwds) {
+    const global = exports.CREDENTIAL_FILES.map((p) => path.join(home, p));
+    const envs = [];
+    for (const cwd of cwds) {
+        let entries = [];
+        try {
+            entries = fs.readdirSync(cwd);
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            if (/^\.env(?:\.[\w-]+)?$/.test(e) && !/\.(?:example|sample|template|dist|defaults?)$/i.test(e))
+                envs.push(path.join(cwd, e));
+        }
+    }
+    return [...global, ...envs];
+}
+function collectKnownSecrets(home = os.homedir(), cwds = []) {
+    const seen = new Map();
+    const add = (value, file, name) => {
+        if (seen.size >= MAX_SECRETS || !worthMatching(value) || seen.has(value))
+            return;
+        seen.set(value, { value, file: short(file), ...(name ? { name: name.slice(0, 64) } : {}) });
+    };
+    for (const file of credentialFiles(home, cwds)) {
+        const text = read(file);
+        if (!text)
+            continue;
+        const base = path.basename(file);
+        if (base === "config.json") {
+            try {
+                const auths = JSON.parse(text).auths ?? {};
+                for (const [host, a] of Object.entries(auths)) {
+                    if (a.auth)
+                        add(a.auth, file, `docker ${host}`);
+                    if (a.identitytoken)
+                        add(a.identitytoken, file, `docker ${host}`);
+                }
+            }
+            catch { }
+            continue;
+        }
+        if (base === ".git-credentials") {
+            for (const m of text.matchAll(/^https?:\/\/[^:\s]+:([^@\s]+)@(\S+)$/gm))
+                add(decodeURIComponent(m[1]), file, `git ${m[2]}`);
+            continue;
+        }
+        if (base === ".netrc") {
+            for (const m of text.matchAll(/\bpassword\s+(\S+)/g))
+                add(m[1], file, "netrc password");
+            continue;
+        }
+        for (const { name, value } of parseAssignments(text))
+            add(value, file, name);
+    }
+    return [...seen.values()];
+}
+function knownSecretRule(secrets) {
+    if (secrets.length === 0)
+        return null;
+    const forms = new Set();
+    for (const s of secrets) {
+        forms.add(s.value);
+        const escaped = JSON.stringify(s.value).slice(1, -1);
+        if (escaped !== s.value)
+            forms.add(escaped);
+    }
+    const alt = [...forms].sort((a, b) => b.length - a.length).map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    return { name: "known-secret", re: new RegExp(`(?<![A-Za-z0-9])(?:${alt})(?![A-Za-z0-9])`, "g") };
+}
+function knownHash(keyHex, value) {
+    return crypto.createHmac("sha256", Buffer.from(keyHex, "hex")).update(value).digest("hex").slice(0, 32);
+}
+const hintOf = (value) => value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
+exports.hintOf = hintOf;
+function fingerprints(keyHex, secrets) {
+    return secrets.map((s) => ({ hash: knownHash(keyHex, s.value), hint: (0, exports.hintOf)(s.value), ...(s.name ? { name: s.name } : {}), file: s.file }));
+}
+async function uploadKnownSecrets(config, keyHex, secrets, fetchImpl = fetch) {
+    if (!config?.backendUrl || !config.token || !/^[0-9a-f]{64}$/.test(keyHex))
+        return false;
+    try {
+        const res = await fetchImpl(`${config.backendUrl}/api/cli/knownSecrets`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${config.token}` },
+            body: JSON.stringify({ secrets: fingerprints(keyHex, secrets) }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+function rememberCwd(stateDir, cwd) {
+    if (!cwd || !path.isAbsolute(cwd))
+        return;
+    try {
+        const file = path.join(stateDir, "cwds.json");
+        let list = [];
+        try {
+            list = JSON.parse(fs.readFileSync(file, "utf8"));
+        }
+        catch { }
+        list = [cwd, ...list.filter((c) => c !== cwd)].slice(0, MAX_CWDS);
+        fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(file, JSON.stringify(list), { mode: 0o600 });
+    }
+    catch { }
+}
+function recentCwds(stateDir) {
+    try {
+        const list = JSON.parse(fs.readFileSync(path.join(stateDir, "cwds.json"), "utf8"));
+        return Array.isArray(list) ? list.filter((c) => typeof c === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/localScrub.js

@@ -47,12 +47,17 @@ exports.cleanOpenCodeDb = cleanOpenCodeDb;
 exports.countCursorDb = countCursorDb;
 exports.runLocalScrub = runLocalScrub;
 exports.runAndReport = runAndReport;
+exports.scrubPolicy = scrubPolicy;
+exports.scrubAllowed = scrubAllowed;
+exports.formatRules = formatRules;
+exports.runScheduledScrub = runScheduledScrub;
 exports.maybeSpawnLocalScrub = maybeSpawnLocalScrub;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
-const rules_1 = require("./scrub/rules");
+const extraRules_1 = require("./scrub/extraRules");
+const knownSecrets_1 = require("./knownSecrets");
 const harnessDirs_1 = require("./harnessDirs");
 const copilotHooks_1 = require("./copilotHooks");
 const configDir_1 = require("./configDir");
@@ -116,7 +121,7 @@ function cursorIdeDb(env = process.env, home = os.homedir(), platform = process.
 }
 function cleanValue(value, count) {
     if (typeof value === "string") {
-        const r = (0, rules_1.scrubSecrets)(value);
+        const r = (0, extraRules_1.scrub)(value);
         count.n += r.redactions.length;
         return r.text;
     }
@@ -140,7 +145,7 @@ function parses(text) {
     }
 }
 function cleanJson(text) {
-    const raw = (0, rules_1.scrubSecrets)(text);
+    const raw = (0, extraRules_1.scrub)(text);
     if (raw.redactions.length === 0)
         return { text, redactions: 0 };
     if (parses(raw.text) || !parses(text))
@@ -167,13 +172,13 @@ function cleanJsonl(text) {
     return redactions === 0 ? { text, redactions: 0 } : { text: lines.join("\n"), redactions };
 }
 function cleanText(text) {
-    const r = (0, rules_1.scrubSecrets)(text);
+    const r = (0, extraRules_1.scrub)(text);
     return { text: r.text, redactions: r.redactions.length };
 }
 function cleanYaml(text) {
     let redactions = 0;
     const lines = text.split("\n").map((line) => {
-        const r = (0, rules_1.scrubSecrets)(line);
+        const r = (0, extraRules_1.scrub)(line);
         if (r.redactions.length === 0)
             return line;
         redactions += r.redactions.length;
@@ -332,7 +337,7 @@ function cleanOpenCodeDb(file, deps) {
             for (const [id, d] of sessions) {
                 const row = get.all(id)[0];
                 if (typeof row?.title === "string")
-                    d.title = (0, rules_1.scrubSecrets)(row.title).text.slice(0, 80);
+                    d.title = (0, extraRules_1.scrub)(row.title).text.slice(0, 80);
                 if (typeof row?.directory === "string")
                     d.cwd = row.directory;
             }
@@ -415,7 +420,7 @@ function countCursorDb(file, kind) {
         const details = [...chats].map(([chat, keys]) => ({
             harness: "cursor",
             sessionKey: chat,
-            ...(titles.get(chat) ? { title: (0, rules_1.scrubSecrets)(titles.get(chat)).text.slice(0, 80) } : {}),
+            ...(titles.get(chat) ? { title: (0, extraRules_1.scrub)(titles.get(chat)).text.slice(0, 80) } : {}),
             keys,
             status: "not_removed",
             reason: "cursor_chat_store",
@@ -656,6 +661,66 @@ async function runAndReport(opts = {}) {
     }
     return { ...summary, reported };
 }
+const defaultConfig = () => {
+    const { readConfig } = require("./utils");
+    return readConfig();
+};
+const OFF = { enabled: false, formats: [], ownSecrets: "off" };
+async function scrubPolicy(fetchImpl = fetch, getConfig = defaultConfig) {
+    try {
+        const config = getConfig();
+        if (!config?.token || !config.backendUrl)
+            return OFF;
+        const res = await fetchImpl(`${config.backendUrl}/api/cli/localScrubPolicy`, {
+            headers: { Authorization: `Bearer ${config.token}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok)
+            return OFF;
+        const body = (await res.json());
+        const formats = Array.isArray(body.formats)
+            ? body.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string" && f.source.length <= 300).slice(0, 50)
+            : [];
+        const ownSecrets = body.ownSecrets === "off" || body.ownSecrets === "server" ? body.ownSecrets : "laptop";
+        const key = typeof body.fingerprintKey === "string" && /^[0-9a-f]{64}$/.test(body.fingerprintKey) ? body.fingerprintKey : undefined;
+        return { enabled: body.enabled === true, formats, ownSecrets, ...(key ? { fingerprintKey: key } : {}) };
+    }
+    catch {
+        return OFF;
+    }
+}
+async function scrubAllowed(fetchImpl = fetch, getConfig = defaultConfig) {
+    return (await scrubPolicy(fetchImpl, getConfig)).enabled;
+}
+function formatRules(formats) {
+    const out = [];
+    for (const f of formats) {
+        try {
+            out.push({ name: `custom:${f.name}`, re: new RegExp(`(?<![A-Za-z0-9])${f.source}(?![A-Za-z0-9_-])`, "g"), ...(f.keyword ? { keywords: [f.keyword] } : {}) });
+        }
+        catch { }
+    }
+    return out;
+}
+async function runScheduledScrub(opts = {}) {
+    const getConfig = opts.getConfig ?? defaultConfig;
+    const policy = await scrubPolicy(opts.fetchImpl ?? fetch, getConfig);
+    if (!policy.enabled)
+        return false;
+    const stateDir = opts.stateDir ?? (0, configDir_1.codiedevStateDir)();
+    const known = policy.ownSecrets === "off" ? [] : (0, knownSecrets_1.collectKnownSecrets)(opts.home ?? os.homedir(), (0, knownSecrets_1.recentCwds)(scrubDir(stateDir)));
+    if (policy.ownSecrets === "server" && policy.fingerprintKey)
+        await (0, knownSecrets_1.uploadKnownSecrets)(getConfig(), policy.fingerprintKey, known, opts.fetchImpl ?? fetch);
+    const knownRule = (0, knownSecrets_1.knownSecretRule)(known);
+    (0, extraRules_1.setExtraRules)([...formatRules(policy.formats), ...(knownRule ? [knownRule] : [])]);
+    try {
+        await runAndReport({ stateDir });
+    }
+    finally {
+        (0, extraRules_1.setExtraRules)([]);
+    }
+    return true;
+}
 function maybeSpawnLocalScrub(opts = {}) {
     try {
         const env = opts.env ?? process.env;
@@ -663,6 +728,7 @@ function maybeSpawnLocalScrub(opts = {}) {
             return "disabled";
         const now = opts.now ?? Date.now();
         const dir = scrubDir(opts.stateDir ?? (0, configDir_1.codiedevStateDir)());
+        (0, knownSecrets_1.rememberCwd)(dir, opts.cwd);
         const stamp = path.join(dir, "last-run");
         try {
             const last = fs.statSync(stamp).mtimeMs;

package/dist/localScrubReport.js

@@ -46,11 +46,12 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const rules_1 = require("./scrub/rules");
+const extraRules_1 = require("./scrub/extraRules");
 const captureExclusions_1 = require("./captureExclusions");
 const MAX_KEYS_PER_SESSION = 20;
 const TITLE_LEN = 80;
 function keysIn(text) {
-    const { redactions } = (0, rules_1.scrubSecrets)(text);
+    const { redactions } = (0, extraRules_1.scrub)(text);
     if (redactions.length === 0)
         return [];
     const hints = new Map();

package/dist/scrub/extraRules.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setExtraRules = setExtraRules;
+exports.scrub = scrub;
+const rules_1 = require("./rules");
+let extra = [];
+function setExtraRules(rules) {
+    extra = rules;
+}
+function scrub(text) {
+    return extra.length ? (0, rules_1.scrubSecrets)(text, { extraRules: extra }) : (0, rules_1.scrubSecrets)(text);
+}

package/dist/scrub/rules.js

@@ -1,9 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERIC_RULES = void 0;
+exports.shannonEntropy = shannonEntropy;
 exports.scrubSecrets = scrubSecrets;
+exports.redactSpans = redactSpans;
+exports.looksLikeTestValue = looksLikeTestValue;
 exports.secretFindings = secretFindings;
 exports.possibleSecrets = possibleSecrets;
 exports.redactPossible = redactPossible;
+const scrubProviderRules_1 = require("./scrubProviderRules");
+function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const counts = new Map();
+    for (const ch of s)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const n of counts.values()) {
+        const p = n / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
 const SECRET_REF_KEY = /_(?:NAME|ID|ARN|FILE|PATH|URL|URI|HOST|REGION|BUCKET|PREFIX|ENABLED|TYPE|VERSION|COUNT)$/i;
 function looksSecret(v) {
     if (v.includes("<") || v.includes(">"))
@@ -34,6 +52,7 @@ function looksSecret(v) {
 }
 const PLACEHOLDER = /x{6,}|\.\.\.|your|example|placeholder|changeme|redacted|dummy|fake|<|\$\{|\*{4,}/i;
 const notPlaceholder = (v) => !PLACEHOLDER.test(v);
+const notTestValue = (v) => notPlaceholder(v) && !looksLikeTestValue(v);
 const URL_PASSWORD_PLACEHOLDER = /^(?:pass(?:word)?|secret|pwd|test|admin|root|guest)$/i;
 const RULES = [
     {
@@ -82,19 +101,61 @@ const RULES = [
             m.input[m.index - 1] !== ":" &&
             looksSecret(v),
     },
+    { name: "supabase-token", re: /\bsbp_[a-f0-9]{40}\b/g, validate: notTestValue },
+    { name: "groq-key", re: /\bgsk_[A-Za-z0-9]{48,56}\b/g, validate: notTestValue },
+    { name: "xai-key", re: /\bxai-[A-Za-z0-9]{70,90}\b/g, validate: notTestValue },
+    { name: "replicate-token", re: /\br8_[A-Za-z0-9]{37}\b/g, validate: notTestValue },
+    ...scrubProviderRules_1.PROVIDER_RULES.map((r) => ({
+        name: r.name,
+        re: r.re,
+        ...(r.group !== undefined ? { group: r.group } : {}),
+        ...(r.firstGroup ? { firstGroup: true } : {}),
+        keywords: r.keywords,
+        fallback: true,
+        validate: (v) => notTestValue(v) && (r.entropy === undefined || shannonEntropy(v) >= r.entropy),
+    })),
 ];
-function scrubSecrets(input) {
+const ALL_KEYWORDS = [...new Set(RULES.flatMap((r) => r.keywords ?? []))].sort((a, b) => b.length - a.length);
+const KEYWORD_RE = new RegExp(ALL_KEYWORDS.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "gi");
+const KEYWORD_PARTS = new Map(ALL_KEYWORDS.map((k) => [k, ALL_KEYWORDS.filter((p) => k.includes(p))]));
+function keywordsIn(input) {
+    const found = new Set();
+    if (!ALL_KEYWORDS.length)
+        return found;
+    KEYWORD_RE.lastIndex = 0;
+    let m;
+    while ((m = KEYWORD_RE.exec(input)) !== null) {
+        for (const k of KEYWORD_PARTS.get(m[0].toLowerCase()) ?? [])
+            found.add(k);
+        if (found.size === ALL_KEYWORDS.length)
+            break;
+    }
+    return found;
+}
+function scrubSecrets(input, opts = {}) {
     if (!input)
         return { text: input, redactions: [] };
     const candidates = [];
-    for (const rule of RULES) {
+    const fallbacks = [];
+    const generic = [];
+    const extra = (opts.extraRules ?? []).map((r) => ({ name: r.name, re: new RegExp(r.re.source, r.re.flags.includes("g") ? r.re.flags : r.re.flags + "g"), validate: notTestValue }));
+    const present = keywordsIn(input);
+    for (const rule of extra.length ? [...RULES, ...extra] : RULES) {
+        if (rule.keywords?.length && !rule.keywords.some((k) => present.has(k)))
+            continue;
         rule.re.lastIndex = 0;
         let m;
         while ((m = rule.re.exec(input)) !== null) {
             let start = m.index;
             let end = m.index + m[0].length;
-            if (rule.group !== undefined) {
-                const gv = m[rule.group];
+            const groupIndex = rule.firstGroup ? m.findIndex((g, i) => i > 0 && g) : rule.group;
+            if (rule.firstGroup && groupIndex === -1) {
+                if (m[0].length === 0)
+                    rule.re.lastIndex++;
+                continue;
+            }
+            if (groupIndex !== undefined && groupIndex > 0) {
+                const gv = m[groupIndex];
                 if (gv === undefined || gv === "")
                     continue;
                 if (rule.validate && !rule.validate(gv, m))
@@ -111,30 +172,90 @@ function scrubSecrets(input) {
                 continue;
             }
             if (end > start)
-                candidates.push({ rule: rule.name, start, end });
+                (rule.fallback ? fallbacks : exports.GENERIC_RULES.has(rule.name) ? generic : candidates).push({ rule: rule.name, start, end });
             if (m[0].length === 0)
                 rule.re.lastIndex++;
         }
     }
-    if (candidates.length === 0)
+    if (candidates.length === 0 && fallbacks.length === 0 && generic.length === 0)
         return { text: input, redactions: [] };
-    candidates.sort((a, b) => a.start - b.start || b.end - a.end);
-    const chosen = [];
-    let cursor = -1;
-    for (const c of candidates) {
-        if (c.start >= cursor) {
-            chosen.push(c);
+    const pick = (list, taken) => {
+        list.sort((a, b) => a.start - b.start || b.end - a.end);
+        const out = [];
+        let cursor = -1;
+        let t = 0;
+        for (const c of list) {
+            if (c.start < cursor)
+                continue;
+            while (t < taken.length && taken[t].end <= c.start)
+                t++;
+            if (t < taken.length && taken[t].start < c.end)
+                continue;
+            out.push(c);
             cursor = c.end;
         }
+        return out;
+    };
+    let chosen = pick(candidates, []);
+    for (const tier of [fallbacks, generic]) {
+        if (tier.length)
+            chosen = [...chosen, ...pick(tier, chosen)].sort((a, b) => a.start - b.start);
     }
+    return { text: redactSpans(input, chosen), redactions: chosen };
+}
+function redactSpans(input, spans) {
     const parts = [];
     let last = 0;
-    for (const c of chosen) {
+    for (const c of spans) {
         parts.push(input.slice(last, c.start), `[REDACTED:${c.rule}]`);
         last = c.end;
     }
     parts.push(input.slice(last));
-    return { text: parts.join(""), redactions: chosen };
+    return parts.join("");
+}
+exports.GENERIC_RULES = new Set(["secret-assignment", "bearer-token", "jwt"]);
+const SEQUENTIAL = /0123456|1234567|2345678|3456789|abcdefg|bcdefgh|qwertyu/i;
+const WORDISH = /^[A-Za-z]{2,}$/;
+function looksLikeTestValue(value) {
+    if (SEQUENTIAL.test(value))
+        return true;
+    if (/(.)\1{9,}$/.test(value))
+        return true;
+    const parts = value.split(/[_-]+/).filter(Boolean);
+    if (parts.length < 3)
+        return false;
+    const words = parts.filter((p) => WORDISH.test(p)).length;
+    const filler = parts.filter((p) => /^\d+$/.test(p) || /^(.)\1*$/.test(p)).length;
+    return words >= 2 && words + filler === parts.length;
+}
+const TEST_FILE = /(?:\.test\.|\.spec\.|__tests__|(?:^|\/)tests?\/|fixtures?\/|__mocks__)/i;
+const NAME_BEFORE = /([A-Za-z_][A-Za-z0-9_.-]{0,63})\??["']?\s*[:=]\s*\??["']?(?:Bearer\s+)?$/;
+function nameBefore(input, start, lineStart) {
+    const window = input.slice(Math.max(lineStart, start - 160), start).replace(/\\[nrt]/g, " ");
+    const m = window.match(NAME_BEFORE)?.[1];
+    if (!m || /^(?:https?|Bearer|Authorization)$/i.test(m))
+        return m === "Authorization" ? m : undefined;
+    return m;
+}
+const FILE_PATH_FIELD = /"(?:file_path|filePath|path|target_file)"\s*:\s*"([^"]{1,400})"/g;
+const REDIRECT = /(?:>>?|\btee(?:\s+-a)?)\s*['"]?([^\s'"<>|;&()]{2,300})/g;
+const CONFIG_FILE = /((?:[\w.~-]+\/)*\.env(?:\.[\w-]+)?|(?:[\w.~-]+\/)*[\w.-]+\.(?:env|ya?ml|toml|ini|cfg|conf|properties|tfvars|npmrc|netrc|pgpass))(?![\w/])/g;
+const lastTwo = (p) => p.replace(/\\\//g, "/").split("/").filter(Boolean).slice(-2).join("/");
+function lastMatch(re, text) {
+    let last;
+    for (const m of text.matchAll(re))
+        last = m[1];
+    return last;
+}
+function fileOf(input, start, lineStart) {
+    const lineEnd = input.indexOf("\n", start);
+    const line = input.slice(lineStart, lineEnd === -1 ? input.length : lineEnd);
+    const before = input.slice(Math.max(lineStart, start - 400), start);
+    const hit = lastMatch(FILE_PATH_FIELD, line) ?? lastMatch(REDIRECT, before) ?? lastMatch(CONFIG_FILE, before);
+    if (!hit || hit.startsWith("/dev/") || hit === "&1" || hit === "&2")
+        return undefined;
+    const short = lastTwo(hit);
+    return short && short.length <= 120 ? short : undefined;
 }
 const TOOL_CALL_TYPE = /^(?:tool_use|function_call|custom_tool_call|tool_call|toolCall|tool_request|tool\.execution_start|server_tool_use|mcp_tool_use)$/;
 const TOOL_OUTPUT_TYPE = /^(?:tool_result|function_call_output|custom_tool_call_output|tool_output|toolResult|tool\.execution_complete|mcp_tool_result)$/;
@@ -203,7 +324,7 @@ function locate(input, r, cache) {
     return { where: "unknown" };
 }
 const MAX_LOCATIONS = 8;
-function secretFindings(input, redactions) {
+function secretFindings(input, redactions, opts = {}) {
     const seen = new Map();
     const cache = new Map();
     for (const r of redactions) {
@@ -213,8 +334,21 @@ function secretFindings(input, redactions) {
         const hint = value.replace(/[^A-Za-z0-9]/g, "").slice(-4);
         if (!hint)
             continue;
+        const lineStart = input.lastIndexOf("\n", r.start - 1) + 1;
+        const name = nameBefore(input, r.start, lineStart);
+        const file = fileOf(input, r.start, lineStart);
+        if (looksLikeTestValue(value))
+            continue;
+        if (exports.GENERIC_RULES.has(r.rule) && file && TEST_FILE.test(file))
+            continue;
+        if (opts.skip?.({ rule: r.rule, value, ...(name ? { name } : {}), ...(file ? { file } : {}) }))
+            continue;
         const key = `${r.rule}\u0000${hint}`;
         const finding = seen.get(key) ?? { rule: r.rule, hint, locations: [] };
+        if (name && !finding.name)
+            finding.name = name;
+        if (file && !finding.file)
+            finding.file = file;
         seen.set(key, finding);
         const loc = locate(input, r, cache);
         if (finding.locations.length < MAX_LOCATIONS && !finding.locations.some((l) => l.where === loc.where && l.tool === loc.tool)) {

package/dist/scrub/scrubProviderRules.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_RULE_LABELS = exports.PROVIDER_RULES = void 0;
+exports.PROVIDER_RULES = [
+    { name: "1password-secret-key", re: new RegExp("\\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})|(?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b", "g"), entropy: 3.8, keywords: ["a3-"] },
+    { name: "1password-service-account-token", re: new RegExp("ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}", "g"), entropy: 4, keywords: ["ops_"] },
+    { name: "adobe-client-secret", re: new RegExp("\\b(p8e-[a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["p8e-"] },
+    { name: "age-secret-key", re: new RegExp("AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}", "g"), keywords: ["age-secret-key-1"] },
+    { name: "airtable-personnal-access-token", re: new RegExp("\\b(pat[A-Za-z0-9]{14}\\.[a-f0-9]{64})\\b", "g"), firstGroup: true, keywords: ["airtable"] },
+    { name: "alibaba-access-key-id", re: new RegExp("\\b(LTAI[a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["ltai"] },
+    { name: "artifactory-api-key", re: new RegExp("\\bAKCp[A-Za-z0-9]{69}\\b", "g"), entropy: 4.5, keywords: ["akcp"] },
+    { name: "artifactory-reference-token", re: new RegExp("\\bcmVmd[A-Za-z0-9]{59}\\b", "g"), entropy: 4.5, keywords: ["cmvmd"] },
+    { name: "clickhouse-cloud-api-secret-key", re: new RegExp("\\b(4b1d[A-Za-z0-9]{38})\\b", "g"), firstGroup: true, entropy: 3, keywords: ["4b1d"] },
+    { name: "clojars-api-token", re: new RegExp("CLOJARS_[a-z0-9]{60}", "gi"), entropy: 2, keywords: ["clojars_"] },
+    { name: "cloudflare-origin-ca-key", re: new RegExp("\\b(v1\\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["cloudflare", "v1.0-"] },
+    { name: "curl-auth-header", re: new RegExp("\\bcurl\\b(?:.*?|.*?(?:[\\r\\n]{1,2}.*?){1,5})[ \\t\\n\\r](?:-H|--header)(?:=|[ \\t]{0,5})(?:\"(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))\"|'(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))')(?:\\B|\\s|$)", "gi"), firstGroup: true, entropy: 2.75, keywords: ["curl"] },
+    { name: "curl-auth-user", re: new RegExp("\\bcurl\\b(?:.*|.*(?:[\\r\\n]{1,2}.*){1,5})[ \\t\\n\\r](?:-u|--user)(?:=|[ \\t]{0,5})(\"(:[^\"]{3,}|[^:\"]{3,}:|[^:\"]{3,}:[^\"]{3,})\"|'([^:']{3,}:[^']{3,})'|((?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w$@.-]+):(?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w${}@.-]+)))(?:\\s|$)", "g"), firstGroup: true, entropy: 2, keywords: ["curl"] },
+    { name: "databricks-api-token", re: new RegExp("\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["dapi"] },
+    { name: "digitalocean-access-token", re: new RegExp("\\b(doo_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["doo_v1_"] },
+    { name: "digitalocean-pat", re: new RegExp("\\b(dop_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["dop_v1_"] },
+    { name: "digitalocean-refresh-token", re: new RegExp("\\b(dor_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, keywords: ["dor_v1_"] },
+    { name: "doppler-api-token", re: new RegExp("dp\\.pt\\.[a-z0-9]{43}", "gi"), entropy: 2, keywords: ["dp.pt."] },
+    { name: "duffel-api-token", re: new RegExp("duffel_(?:test|live)_[a-z0-9_\\-=]{43}", "gi"), entropy: 2, keywords: ["duffel_"] },
+    { name: "dynatrace-api-token", re: new RegExp("dt0c01\\.[a-z0-9]{24}\\.[a-z0-9]{64}", "gi"), entropy: 4, keywords: ["dt0c01."] },
+    { name: "easypost-api-token", re: new RegExp("\\bEZAK[a-z0-9]{54}\\b", "gi"), entropy: 2, keywords: ["ezak"] },
+    { name: "easypost-test-api-token", re: new RegExp("\\bEZTK[a-z0-9]{54}\\b", "gi"), entropy: 2, keywords: ["eztk"] },
+    { name: "facebook-access-token", re: new RegExp("\\b(\\d{15,16}(\\||%)[0-9a-z\\-_]{27,40})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["facebook"] },
+    { name: "facebook-page-access-token", re: new RegExp("\\b(EAA[MC][a-z0-9]{100,})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 4, keywords: ["eaam", "eaac"] },
+    { name: "flutterwave-encryption-key", re: new RegExp("FLWSECK_TEST-[a-h0-9]{12}", "gi"), entropy: 2, keywords: ["flwseck_test"] },
+    { name: "flutterwave-secret-key", re: new RegExp("FLWSECK_TEST-[a-h0-9]{32}-X", "gi"), entropy: 2, keywords: ["flwseck_test"] },
+    { name: "flyio-access-token", re: new RegExp("\\b((?:fo1_[\\w-]{43}|fm1[ar]_[a-zA-Z0-9+\\/]{100,}={0,3}|fm2_[a-zA-Z0-9+\\/]{100,}={0,3}))(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["fo1_", "fm1", "fm2_"] },
+    { name: "frameio-api-token", re: new RegExp("fio-u-[a-z0-9\\-_=]{64}", "gi"), keywords: ["fio-u-"] },
+    { name: "grafana-api-key", re: new RegExp("\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["eyjrijoi"] },
+    { name: "grafana-cloud-api-token", re: new RegExp("\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["glc_"] },
+    { name: "grafana-service-account-token", re: new RegExp("\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["glsa_"] },
+    { name: "harness-api-key", re: new RegExp("(?:pat|sat)\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}", "g"), keywords: ["pat.", "sat."] },
+    { name: "heroku-api-key-v2", re: new RegExp("\\b((HRKU-AA[0-9a-zA-Z_-]{58}))(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["hrku-aa"] },
+    { name: "huggingface-access-token", re: new RegExp("\\b(hf_(?:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["hf_"] },
+    { name: "huggingface-organization-api-token", re: new RegExp("\\b(api_org_(?:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["api_org_"] },
+    { name: "infracost-api-token", re: new RegExp("\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["ico-"] },
+    { name: "intra42-client-secret", re: new RegExp("\\b(s-s4t2(?:ud|af)-[abcdef0123456789]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["intra", "s-s4t2ud-", "s-s4t2af-"] },
+    { name: "maxmind-license-key", re: new RegExp("\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["_mmk"] },
+    { name: "microsoft-teams-webhook", re: new RegExp("https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}", "g"), firstGroup: true, keywords: ["webhook.office.com", "webhookb2", "incomingwebhook"] },
+    { name: "notion-api-token", re: new RegExp("\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["ntn_"] },
+    { name: "octopus-deploy-api-key", re: new RegExp("\\b(API-[A-Z0-9]{26})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["api-"] },
+    { name: "openshift-user-token", re: new RegExp("\\b(sha256~[\\w-]{43})(?:[^\\w-]|$)", "g"), firstGroup: true, entropy: 3.5, keywords: ["sha256~"] },
+    { name: "perplexity-api-key", re: new RegExp("\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'\"\\s;]|\\\\|$|\\b)", "g"), firstGroup: true, entropy: 4, keywords: ["pplx-"] },
+    { name: "planetscale-api-token", re: new RegExp("\\b(pscale_tkn_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pscale_tkn_"] },
+    { name: "planetscale-oauth-token", re: new RegExp("\\b(pscale_oauth_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["pscale_oauth_"] },
+    { name: "planetscale-password", re: new RegExp("\\b(pscale_pw_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pscale_pw_"] },
+    { name: "postman-api-token", re: new RegExp("\\b(PMAK-[a-f0-9]{24}\\-[a-f0-9]{34})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 3, keywords: ["pmak-"] },
+    { name: "prefect-api-token", re: new RegExp("\\b(pnu_[a-zA-Z0-9]{36})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["pnu_"] },
+    { name: "pulumi-api-token", re: new RegExp("\\b(pul-[a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["pul-"] },
+    { name: "pypi-upload-token", re: new RegExp("pypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}", "g"), entropy: 3, keywords: ["pypi-ageichlwas5vcmc"] },
+    { name: "readme-api-token", re: new RegExp("\\b(rdme_[a-z0-9]{70})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["rdme_"] },
+    { name: "rubygems-api-token", re: new RegExp("\\b(rubygems_[a-f0-9]{48})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["rubygems_"] },
+    { name: "scalingo-api-token", re: new RegExp("\\b(tk-us-[\\w-]{48})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["tk-us-"] },
+    { name: "sendinblue-api-token", re: new RegExp("\\b(xkeysib-[a-f0-9]{64}\\-[a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "gi"), firstGroup: true, entropy: 2, keywords: ["xkeysib-"] },
+    { name: "sentry-org-token", re: new RegExp("\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}(?:[^a-zA-Z0-9+/]|$)", "g"), entropy: 4.5, keywords: ["sntrys_eyjpyxqio"] },
+    { name: "sentry-user-token", re: new RegExp("\\b(sntryu_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3.5, keywords: ["sntryu_"] },
+    { name: "settlemint-application-access-token", re: new RegExp("\\b(sm_aat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_aat"] },
+    { name: "settlemint-personal-access-token", re: new RegExp("\\b(sm_pat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_pat"] },
+    { name: "settlemint-service-access-token", re: new RegExp("\\b(sm_sat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 3, keywords: ["sm_sat"] },
+    { name: "shippo-api-token", re: new RegExp("\\b(shippo_(?:live|test)_[a-fA-F0-9]{40})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["shippo_"] },
+    { name: "shopify-access-token", re: new RegExp("shpat_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpat_"] },
+    { name: "shopify-custom-access-token", re: new RegExp("shpca_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpca_"] },
+    { name: "shopify-private-app-access-token", re: new RegExp("shppa_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shppa_"] },
+    { name: "shopify-shared-secret", re: new RegExp("shpss_[a-fA-F0-9]{32}", "g"), entropy: 2, keywords: ["shpss_"] },
+    { name: "sidekiq-sensitive-url", re: new RegExp("\\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\\/|\\#|\\?|:]|$)", "gi"), firstGroup: true, keywords: ["gems.contribsys.com", "enterprise.contribsys.com"] },
+    { name: "sourcegraph-access-token", re: new RegExp("\\b(sgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}|sgp_[a-fA-F0-9]{40})\\b", "g"), firstGroup: true, entropy: 3, keywords: ["sgp_", "sourcegraph"] },
+    { name: "square-access-token", re: new RegExp("\\b((?:EAAA|sq0atp-)[\\w-]{22,60})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 2, keywords: ["sq0atp-", "eaaa"] },
+    { name: "vault-batch-token", re: new RegExp("\\b(hvb\\.[\\w-]{138,300})(?:[\\x60'\"\\s;]|\\\\|$)", "g"), firstGroup: true, entropy: 4, keywords: ["hvb."] },
+    { name: "vault-service-token", re: new RegExp("\\b(hvs\\.[\\w-]{90,120})", "g"), firstGroup: true, entropy: 3.5, keywords: ["hvs."] },
+];
+exports.PROVIDER_RULE_LABELS = {
+    "1password-secret-key": "1password secret key",
+    "1password-service-account-token": "1password service account token",
+    "adobe-client-secret": "Adobe client secret",
+    "age-secret-key": "Age secret key",
+    "airtable-personnal-access-token": "Airtable personnal access token",
+    "alibaba-access-key-id": "Alibaba access key id",
+    "artifactory-api-key": "Artifactory api key",
+    "artifactory-reference-token": "Artifactory reference token",
+    "clickhouse-cloud-api-secret-key": "Clickhouse cloud api secret key",
+    "clojars-api-token": "Clojars api token",
+    "cloudflare-origin-ca-key": "Cloudflare origin ca key",
+    "curl-auth-header": "Curl auth header",
+    "curl-auth-user": "Curl auth user",
+    "databricks-api-token": "Databricks api token",
+    "digitalocean-access-token": "Digitalocean access token",
+    "digitalocean-pat": "Digitalocean pat",
+    "digitalocean-refresh-token": "Digitalocean refresh token",
+    "doppler-api-token": "Doppler api token",
+    "duffel-api-token": "Duffel api token",
+    "dynatrace-api-token": "Dynatrace api token",
+    "easypost-api-token": "Easypost api token",
+    "easypost-test-api-token": "Easypost test api token",
+    "facebook-access-token": "Facebook access token",
+    "facebook-page-access-token": "Facebook page access token",
+    "flutterwave-encryption-key": "Flutterwave encryption key",
+    "flutterwave-secret-key": "Flutterwave secret key",
+    "flyio-access-token": "Flyio access token",
+    "frameio-api-token": "Frameio api token",
+    "grafana-api-key": "Grafana api key",
+    "grafana-cloud-api-token": "Grafana cloud api token",
+    "grafana-service-account-token": "Grafana service account token",
+    "harness-api-key": "Harness api key",
+    "heroku-api-key-v2": "Heroku api key v2",
+    "huggingface-access-token": "Huggingface access token",
+    "huggingface-organization-api-token": "Huggingface organization api token",
+    "infracost-api-token": "Infracost api token",
+    "intra42-client-secret": "Intra42 client secret",
+    "maxmind-license-key": "Maxmind license key",
+    "microsoft-teams-webhook": "Microsoft teams webhook",
+    "notion-api-token": "Notion api token",
+    "octopus-deploy-api-key": "Octopus deploy api key",
+    "openshift-user-token": "Openshift user token",
+    "perplexity-api-key": "Perplexity api key",
+    "planetscale-api-token": "Planetscale api token",
+    "planetscale-oauth-token": "Planetscale oauth token",
+    "planetscale-password": "Planetscale password",
+    "postman-api-token": "Postman api token",
+    "prefect-api-token": "Prefect api token",
+    "pulumi-api-token": "Pulumi api token",
+    "pypi-upload-token": "Pypi upload token",
+    "readme-api-token": "Readme api token",
+    "rubygems-api-token": "Rubygems api token",
+    "scalingo-api-token": "Scalingo api token",
+    "sendinblue-api-token": "Sendinblue api token",
+    "sentry-org-token": "Sentry org token",
+    "sentry-user-token": "Sentry user token",
+    "settlemint-application-access-token": "Settlemint application access token",
+    "settlemint-personal-access-token": "Settlemint personal access token",
+    "settlemint-service-access-token": "Settlemint service access token",
+    "shippo-api-token": "Shippo api token",
+    "shopify-access-token": "Shopify access token",
+    "shopify-custom-access-token": "Shopify custom access token",
+    "shopify-private-app-access-token": "Shopify private app access token",
+    "shopify-shared-secret": "Shopify shared secret",
+    "sidekiq-sensitive-url": "Sidekiq sensitive url",
+    "sourcegraph-access-token": "Sourcegraph access token",
+    "square-access-token": "Square access token",
+    "vault-batch-token": "Vault batch token",
+    "vault-service-token": "Vault service token",
+};

package/dist/utils.js

@@ -1421,7 +1421,6 @@ but does not install a global \`codiedev\` executable.
 | "any messages?" / "check my inbox" / "what did a teammate say?" | \`codiedev inbox\` |
 | "read that reply" / "mark that ping read" | \`codiedev read <ping-id>\` |
 | "note that X is a follow-up" / "remember X" | \`codiedev note "<text>"\` |
-| "create a ticket" / "scope this into tickets" / "ticket this for me" | \`codiedev create-ticket [optional-inline-prompt]\` |
 | "share with a teammate" / "give someone access" (no notification) | \`codiedev share <key> <name> [--role read\\|edit]\` |
 | "send this to a teammate" / "ask someone to look at this" | \`codiedev send <key> <name> ["<msg>"]\` |
 | "find something about X" / "has anyone solved Y?" | \`codiedev search "<query>" [--limit N]\` |
@@ -1470,11 +1469,6 @@ iterate rather than duplicating.
 notification). \`codiedev send\` both grants access AND pings the
 recipient. Use send when the user is actively looping someone in.
 
-**\`create-ticket\` flow:** when invoked without \`--submit\`, the CLI prints
-skill instructions you should follow. Step 1 is asking the user about repos.
-Step 4 calls \`codiedev create-ticket --submit <path>\` with the plan JSON.
-Tell the user the portal URL when the submit returns.
-
 **Errors:**
 - "not connected" → user needs to run \`npx codiedev connect\` with their
   API token from https://codiedev.com/portal/integrations/claude-code

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codiedev",
-  "version": "0.10.0-beta.13",
+  "version": "0.10.0-beta.15",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness",
   "bin": {
     "codiedev": "dist/cli.js",
@@ -12,12 +12,12 @@
     "dev": "tsc --watch",
     "prepublishOnly": "tsc",
     "test": "vitest run",
-    "test:functional": "vitest run src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
-    "test:harness-parity": "vitest run src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:functional": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
+    "test:harness-parity": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/piCapture.functional.test.ts",
     "test:harness-binaries": "node scripts/checkHarnessBinaries.mjs",
     "test:opencode-attribution": "vitest run src/__tests__/repoResolver.test.ts src/__tests__/openCodeCapture.test.ts src/__tests__/openCodePluginGitRefs.test.ts src/__tests__/capturePayloadFinal.test.ts src/__tests__/captureDirectUpload.test.ts src/__tests__/resolveCaptureFinal.test.ts && tsc",
     "test:watch": "vitest",
-    "test:metadata-parity": "vitest run src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts",
+    "test:metadata-parity": "vitest run src/__tests__/localScrub.functional.test.ts src/__tests__/sourceMetadataMatrix.test.ts src/__tests__/copilotCapture.functional.test.ts src/__tests__/copilotCapture.test.ts src/__tests__/piCapture.functional.test.ts src/__tests__/piHooks.test.ts src/__tests__/cursorParity.functional.test.ts src/__tests__/nativeSourceParity.test.ts src/__tests__/harnessParity.functional.test.ts src/__tests__/subagents.test.ts src/__tests__/transcriptModels.test.ts src/__tests__/captureRetry.test.ts src/__tests__/limitEvent.functional.test.ts src/__tests__/captureExclusions.test.ts",
     "test:local-scrub-live": "npm run build && node scripts/localScrubLive.mjs"
   },
   "files": [

package/dist/commands/createTicket.js

@@ -1,182 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.substitutePrompt = substitutePrompt;
-exports.validatePlanHasRepo = validatePlanHasRepo;
-exports.resolveRepoIds = resolveRepoIds;
-exports.parseCreateTicketArgs = parseCreateTicketArgs;
-exports.runCreateTicket = runCreateTicket;
-exports.runBare = runBare;
-exports.runSubmit = runSubmit;
-exports.readSubmitInput = readSubmitInput;
-const fs = __importStar(require("node:fs"));
-const shared_1 = require("./shared");
-const PROMPT_PLACEHOLDER = "{{USER_PROMPT}}";
-const MISSING_PROMPT_FALLBACK = "(not yet provided — ask the user a single combined question that covers both the intent AND repo locations: \"What are you working on, and is this in a single repo or multiple? If multiple, give me the paths.\" Skip Step 1 since you've folded it into this question. Then proceed to Step 2.)";
-function substitutePrompt(protocol, prompt) {
-    return protocol.replace(PROMPT_PLACEHOLDER, prompt && prompt.length > 0 ? prompt : MISSING_PROMPT_FALLBACK);
-}
-function validatePlanHasRepo(parsedPlan) {
-    const fullNames = Array.isArray(parsedPlan?.repoFullNames) ? parsedPlan.repoFullNames : [];
-    const explicitIds = Array.isArray(parsedPlan?.repoIds) ? parsedPlan.repoIds : [];
-    if (fullNames.length === 0 && explicitIds.length === 0) {
-        return "Plan must include at least one repo (repoFullNames: ['owner/name'] or repoIds: [...])";
-    }
-    return null;
-}
-function resolveRepoIds(fullNames, repos) {
-    const lookup = new Map();
-    for (const r of repos) {
-        lookup.set(r.fullName.toLowerCase(), r.repoId);
-    }
-    const ids = [];
-    for (const fn of fullNames) {
-        const id = lookup.get(fn.toLowerCase());
-        if (!id) {
-            throw new Error(`Repo "${fn}" is not connected to your Codiedev account. Run \`codiedev connect\` to refresh, or push the missing repo through Settings.`);
-        }
-        ids.push(id);
-    }
-    return ids;
-}
-function parseCreateTicketArgs(args) {
-    let mode = "bare";
-    let prompt;
-    let submitSource;
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a === "--submit" && i + 1 < args.length) {
-            mode = "submit";
-            const next = args[++i];
-            submitSource = next === "-" ? "stdin" : next;
-        }
-        else if (a.startsWith("--submit=")) {
-            mode = "submit";
-            const v = a.slice("--submit=".length);
-            submitSource = v === "-" ? "stdin" : v;
-        }
-        else if (!a.startsWith("--") && !prompt && mode === "bare") {
-            prompt = a;
-        }
-    }
-    return { mode, prompt, submitSource };
-}
-async function runCreateTicket(args) {
-    const parsed = parseCreateTicketArgs(args);
-    if (parsed.mode === "bare") {
-        const config = (0, shared_1.requireConfig)();
-        await runBare(config, parsed.prompt);
-        return;
-    }
-    if (!parsed.submitSource) {
-        console.error("--submit requires a path or '-' for stdin");
-        process.exit(1);
-    }
-    const config = (0, shared_1.requireConfig)();
-    let raw;
-    try {
-        raw = readSubmitInput(parsed.submitSource);
-    }
-    catch (err) {
-        console.error(`Failed to read plan: ${err.message}`);
-        process.exit(1);
-    }
-    let parsedPlan;
-    try {
-        parsedPlan = JSON.parse(raw);
-    }
-    catch (err) {
-        console.error(`Plan JSON did not parse: ${err.message}`);
-        process.exit(1);
-    }
-    const validationError = validatePlanHasRepo(parsedPlan);
-    if (validationError) {
-        console.error(validationError);
-        process.exit(1);
-    }
-    const fullNames = Array.isArray(parsedPlan.repoFullNames) ? parsedPlan.repoFullNames : [];
-    const explicitIds = Array.isArray(parsedPlan.repoIds) ? parsedPlan.repoIds : [];
-    if (fullNames.length > 0 && explicitIds.length === 0) {
-        parsedPlan.repoIds = resolveRepoIds(fullNames, config.repos);
-    }
-    for (const t of parsedPlan.plan?.tickets ?? []) {
-        if (t.targetRepoFullName && !t.targetRepoId) {
-            const ids = resolveRepoIds([t.targetRepoFullName], config.repos);
-            t.targetRepoId = ids[0];
-        }
-    }
-    await runSubmit(config, JSON.stringify(parsedPlan));
-}
-async function runBare(config, prompt) {
-    let res;
-    try {
-        res = await (0, shared_1.apiRequest)("GET", "/api/cli/createTicketProtocol", { config });
-    }
-    catch (err) {
-        console.error(`Failed to fetch create-ticket protocol: ${err.message}. Check your network connection and re-run.`);
-        process.exit(1);
-    }
-    process.stdout.write(substitutePrompt(res.protocol, prompt));
-}
-async function runSubmit(config, rawJson) {
-    let payload;
-    try {
-        payload = JSON.parse(rawJson);
-    }
-    catch (err) {
-        throw new Error(`Plan JSON did not parse — emit valid JSON matching the schema printed by \`codiedev create-ticket\`. Original error: ${err.message}`);
-    }
-    if (!payload.plan || !payload.prompt || !payload.repoIds) {
-        throw new Error("Plan JSON missing one of: plan, prompt, repoIds");
-    }
-    const res = await (0, shared_1.withTelemetry)(config, "codiedev_create_ticket", () => (0, shared_1.apiRequest)("POST", "/api/cli/createPlan", {
-        config,
-        body: payload,
-    }));
-    const portalHost = (process.env.CODIEDEV_PORTAL_URL || "https://codiedev.com").replace(/\/$/, "");
-    const portalLink = res.portalUrl.startsWith("http")
-        ? res.portalUrl
-        : `${portalHost}${res.portalUrl}`;
-    console.log(`✓ Created ${res.ticketCount} ticket(s).`);
-    console.log(`  portal: ${portalLink}`);
-    console.log("");
-    console.log("Open in your portal to review and push to Jira.");
-}
-function readSubmitInput(source) {
-    if (source === "stdin") {
-        return fs.readFileSync(0, "utf8");
-    }
-    return fs.readFileSync(source, "utf8");
-}