hillclimb 0.9.10 → 0.9.11

package/dist/main.js

@@ -3537,6 +3537,7 @@ async function parseEnvFile(filePath) {
     const eqIndex = trimmed.indexOf("=");
     if (eqIndex === -1) continue;
     let value = trimmed.slice(eqIndex + 1).trim();
+    let raw = null;
     if (value.startsWith('"') || value.startsWith("'")) {
       const quote = value[0];
       let end = -1;
@@ -3551,7 +3552,8 @@ async function parseEnvFile(filePath) {
         }
       }
       if (end !== -1) {
-        value = value.slice(1, end).replace(/\\(.)/g, "$1");
+        raw = value.slice(1, end);
+        value = raw.replace(/\\(.)/g, "$1");
       } else {
         value = value.slice(1);
       }
@@ -3564,6 +3566,7 @@ async function parseEnvFile(filePath) {
     }
     if (!value) continue;
     values.push(value);
+    if (raw !== null && raw !== value) values.push(raw);
   }
   return values;
 }
@@ -3573,6 +3576,11 @@ function addWithVariants(set, value) {
   if (encoded !== value) {
     set.add(encoded);
   }
+  const escaped = JSON.stringify(value).slice(1, -1);
+  if (escaped !== value) {
+    set.add(escaped);
+    set.add(JSON.stringify(escaped).slice(1, -1));
+  }
   if (value.includes("://")) {
     try {
       const url = new URL(value);
@@ -13240,69 +13248,115 @@ var patterns_default = {
 // src/middleware/patterns-local.json
 var patterns_local_default = {
   patterns: [
+    {
+      name: "Private Key Block (any line prefixes)",
+      regex: "-{4,5}\\s{0,4}BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?\\s{0,4}-{4,5}[\\s\\S]{0,20000}?-{4,5}\\s{0,4}END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?\\s{0,4}-{4,5}",
+      confidence: "high",
+      validator: "pem-body",
+      precheck: ["private key"]
+    },
+    {
+      name: "Private Key Block (body required, END optional)",
+      regex: `-{4,5} ?BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)? ?-{4,5}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>"',+-]){0,16}[A-Z][A-Za-z-]{1,30}:[^\\n\\\\]{0,200}(?=[\\n\\\\]|$)){0,8}(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>"',+-]){0,16}(?=[A-Za-z0-9+/]{40})(?:[\\s\\S]{0,20000}?-{4,5} ?END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)? ?-{4,5}|(?:[A-Za-z0-9+/=]|\\[REDACTED\\]){16,}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>"',+-]){1,16}(?:[A-Za-z0-9+/=]|\\[REDACTED\\]){16,}){0,500}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>"',+-]){1,16}[A-Za-z0-9+/=]{1,15}(?=(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>"',+-]){0,16}-{4,5} ?END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)? ?-{4,5}))?(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>"',+-]){0,16}-{4,5} ?END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)? ?-{4,5})?)`,
+      confidence: "high",
+      precheck: ["private key"]
+    },
+    {
+      name: "Private Key Body Before END (no BEGIN)",
+      regex: "(?:(?<![A-Za-z0-9+/=\\\\])|(?<=\\\\[nrt]))(?<![A-Za-z0-9+/=]{16}(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>-]){1,16})(?=(?:[A-Za-z0-9+/=]{16,}(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>-]){1,16}){0,3}[A-Za-z0-9+/=]{40})(?:[A-Za-z0-9+/=]|\\[REDACTED\\]){16,}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>-]){1,16}(?:[A-Za-z0-9+/=]|\\[REDACTED\\]){16,}){0,500}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>-]){1,16}[A-Za-z0-9+/=]{1,15})?(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)|[|>-]){0,16}-{4,5} ?END[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)? ?-{4,5}",
+      confidence: "high",
+      precheck: ["private key"]
+    },
+    {
+      name: "Base64-Encoded PEM Private Key",
+      regex: "(?:(?<![A-Za-z0-9+/])|(?<=\\\\[nrt]))LS0tLS1CRUdJTi[A-Za-z0-9+/]{40,}={0,2}(?:(?:\\r?\\n|\\\\{1,8}[nr])[ \\t]{0,32}(?:\\d{1,6}(?:\\u2192|\\t|\\\\t)[ \\t]{0,32})?[A-Za-z0-9+/]{16,}={0,2})*",
+      confidence: "high",
+      validator: "b64-private-key",
+      precheck: ["ls0tls1crudjti"]
+    },
+    {
+      name: "PuTTY Private Key Lines",
+      regex: "Private-Lines: ?\\d{1,3}(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)){1,16}([A-Za-z0-9+/=]{16,}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)){1,16}[A-Za-z0-9+/=]{16,}){0,99}(?:(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)){1,16}[A-Za-z0-9+/=]{1,15}(?=(?:\\s|\\\\{1,8}[nrt]|(?:(?<![A-Za-z0-9+/=])|(?<=\\\\[nrt]))\\d{1,6}(?:\\u2192|\\t|\\\\t)){1,16}Private-MAC))?)",
+      confidence: "high",
+      precheck: ["private-lines"]
+    },
     {
       name: "Hugging Face User Access Token",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))hf_[A-Za-z0-9]{34,40}",
+      regex: "hf_(?:(?<![A-Za-z0-9]hf_)|(?<=\\\\[nrt]hf_))[A-Za-z0-9]{34,40}",
       confidence: "high",
       precheck: ["hf_"]
     },
     {
       name: "Hugging Face Organization API Token",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))api_org_[A-Za-z0-9]{34,40}",
+      regex: "api_org_(?:(?<![A-Za-z0-9]api_org_)|(?<=\\\\[nrt]api_org_))[A-Za-z0-9]{34,40}",
       confidence: "high",
       precheck: ["api_org_"]
     },
     {
       name: "OpenRouter API Key",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-or-v1-[a-fA-F0-9]{64}",
+      regex: "sk-or-v1-(?:(?<![A-Za-z0-9]sk-or-v1-)|(?<=\\\\[nrt]sk-or-v1-))[a-fA-F0-9]{64}",
       confidence: "high",
       precheck: ["sk-or-"]
     },
     {
       name: "OpenRouter API Key (generic)",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-or-[A-Za-z0-9-]{32,128}",
+      regex: "sk-or-(?:(?<![A-Za-z0-9]sk-or-)|(?<=\\\\[nrt]sk-or-))[A-Za-z0-9-]{32,128}",
       confidence: "high",
       precheck: ["sk-or-"]
     },
     {
       name: "Anthropic API Key",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-ant-[A-Za-z0-9_-]{32,256}",
+      regex: "sk-ant-(?:(?<![A-Za-z0-9]sk-ant-)|(?<=\\\\[nrt]sk-ant-))[A-Za-z0-9_-]{32,256}",
       confidence: "high",
       precheck: ["sk-ant-"]
     },
     {
       name: "OpenAI Project API Key",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-proj-[A-Za-z0-9_-]{32,256}",
+      regex: "sk-proj-(?:(?<![A-Za-z0-9]sk-proj-)|(?<=\\\\[nrt]sk-proj-))[A-Za-z0-9_-]{32,256}",
       confidence: "high",
       precheck: ["sk-proj-"]
     },
     {
       name: "OpenAI API Key (legacy)",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}",
+      regex: "sk-(?:(?<![A-Za-z0-9]sk-)|(?<=\\\\[nrt]sk-))[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}",
       confidence: "high",
       precheck: ["t3blbkfj"]
     },
     {
       name: "sshpass Command-Line Password",
-      regex: `sshpass\\s+-p\\s*(?:'[^']{1,128}'|"[^"]{1,128}"|[^\\s'"-][^\\s'"]{0,127})`,
+      regex: `sshpass\\s+-p\\s*(?:'[^']{1,128}'|"(?:[^"\\\\]|\\\\.){1,128}"|\\\\{1,7}"(?:(?!\\\\{1,7}").){1,128}\\\\{1,7}"|[^\\s'"\\\\-](?:[^\\s'"\\\\]|\\\\.){0,127})`,
       confidence: "high",
       precheck: ["sshpass"]
     },
     {
       name: "URL Userinfo Credentials",
-      regex: ":\\/\\/([^\\s:@\\/]{1,64}:[^\\s@\\/]{1,128})@",
+      regex: ":(?:\\/\\/|(?:\\\\{1,7}\\/){2})([^\\s:\\/]{0,64}:[^\\s\\/]{1,128})@",
+      confidence: "high",
+      precheck: ["://", ":\\"]
+    },
+    {
+      name: "URL Token Userinfo",
+      regex: ":(?:\\/\\/|(?:\\\\{1,7}\\/){2})([A-Za-z0-9_~.%+-]{16,256})@[A-Za-z0-9\\[]",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["://", ":\\"]
+    },
+    {
+      name: "DB URL Password With Slash",
+      regex: `(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\\+srv)?|rediss?|amqps?|mssql|sqlserver|clickhouse)(?:\\+\\w+)?:(?:\\/\\/|(?:\\\\{1,7}\\/){2})([^\\s:\\/]{0,64}:(?!\\d{1,5}\\/)[^\\s"'\\\\<>]{1,128})@`,
+      flags: "i",
       confidence: "high",
-      precheck: ["://"]
+      precheck: ["://", ":\\"]
     },
     {
       name: "SSH Root Host (rented GPU node)",
-      regex: "(?:(?<![A-Za-z0-9@._-])|(?<=\\\\[nrt]))root@(?:\\d{1,3}\\.){3}\\d{1,3}",
+      regex: "root(?:(?<![A-Za-z0-9@._-]root)|(?<=\\\\[nrt]root))@(?:\\d{1,3}\\.){3}\\d{1,3}",
       confidence: "high",
       precheck: ["root@"]
     },
     {
       name: "Tinker API Key",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))tml-([A-Za-z0-9_-]{32,128})",
+      regex: "tml-(?:(?<![A-Za-z0-9]tml-)|(?<=\\\\[nrt]tml-))([A-Za-z0-9_-]{32,128})",
       confidence: "high",
       validator: "credential-value",
       precheck: ["tml-"]
@@ -13316,32 +13370,523 @@ var patterns_local_default = {
     },
     {
       name: "Google API Key (mixed-case suffix)",
-      regex: "(?:(?<![A-Za-z0-9_-])|(?<=\\\\[nrt]))AIza[0-9A-Za-z_-]{35}",
+      regex: "AIza(?:(?<![A-Za-z0-9_-]AIza)|(?<=\\\\[nrt]AIza))[0-9A-Za-z_-]{35}",
       confidence: "high",
       precheck: ["aiza"]
     },
+    {
+      name: "AWS Secret Access Key (context)",
+      regex: `(?:aws[_.-]?)?secret[_.-]?(?:access[_.-]?)?key(?:\\\\{0,7}["'])?\\]?(?:\\s*[:=,]\\s*|\\s+)(?:\\\\{0,7}["'])?([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+=])`,
+      flags: "i",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["secret"]
+    },
+    {
+      name: "AWS Session Token (context)",
+      regex: `(?:aws_?session_?token|aws_?security_?token|sessiontoken|x-amz-security-token)(?:\\\\{0,7}["'])?\\]?(?:\\s*[:=,]\\s*|\\s+)(?:\\\\{0,7}["'])?([A-Za-z0-9%/+=]{100,4096})`,
+      flags: "i",
+      confidence: "high",
+      validator: "aws-session-token",
+      precheck: ["session", "security"]
+    },
+    {
+      name: "AWS STS Session Token",
+      regex: "(?:(?<![A-Za-z0-9+/])|(?<=\\\\[nrt]))(?:IQoJb3JpZ2luX2[A-Za-z0-9+/]|FwoGZXIvYXdz|FQoGZXIvYXdz)[A-Za-z0-9+/]{100,4096}={0,2}",
+      confidence: "high",
+      precheck: ["iqojb3jpz2lux2", "fwogzxivyxdz", "fqogzxivyxdz"]
+    },
+    {
+      name: "AWS Bedrock API Key",
+      regex: "ABSK(?:(?<![A-Za-z0-9+/]ABSK)|(?<=\\\\[nrt]ABSK))[A-Za-z0-9+/]{100,300}={0,2}|bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t[A-Za-z0-9+/=%]{20,4096}",
+      confidence: "high",
+      precheck: ["absk", "bedrock-api-key-"]
+    },
+    {
+      name: "GitHub Fine-Grained PAT",
+      regex: "github_pat_(?:(?<![A-Za-z0-9+/_-]github_pat_)|(?<=\\\\[nrt]github_pat_))[A-Za-z0-9_]{50,255}",
+      confidence: "high",
+      precheck: ["github_pat_"]
+    },
+    {
+      name: "RunPod API Key",
+      regex: "rpa_(?:(?<![A-Za-z0-9+/_-]rpa_)|(?<=\\\\[nrt]rpa_))[A-Za-z0-9]{30,64}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["rpa_"]
+    },
+    {
+      name: "Weights & Biases v1 Key",
+      regex: "wandb_v1_(?:(?<![A-Za-z0-9+/_-]wandb_v1_)|(?<=\\\\[nrt]wandb_v1_))[A-Za-z0-9_]{60,100}",
+      confidence: "high",
+      precheck: ["wandb_v1_"]
+    },
+    {
+      name: "Weights & Biases Local Key",
+      regex: "local-(?:(?<![A-Za-z0-9+/_-]local-)|(?<=\\\\[nrt]local-))[0-9a-f]{40}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["local-"]
+    },
+    {
+      name: "Resend API Key",
+      regex: "re_(?:(?<![A-Za-z0-9+/_-]re_)|(?<=\\\\[nrt]re_))[A-Za-z0-9]{8}_[A-Za-z0-9]{24,32}(?![A-Za-z0-9_])",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["re_"]
+    },
+    {
+      name: "Overleaf Git Token",
+      regex: "olp_(?:(?<![A-Za-z0-9+/_-]olp_)|(?<=\\\\[nrt]olp_))[A-Za-z0-9]{30,64}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["olp_"]
+    },
+    {
+      name: "GiveMeANode Token",
+      regex: "gmn(?:(?<![A-Za-z0-9+/_-]gmn)|(?<=\\\\[nrt]gmn))t?_[A-Za-z0-9_-]{16,256}",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["gmn"]
+    },
+    {
+      name: "GiveMeANode Capability URL",
+      regex: "(?:sbe|shr)-[a-z0-9]{5}-([a-z0-9]{16})(?![a-z0-9])",
+      confidence: "high",
+      precheck: ["sbe-", "shr-"]
+    },
+    {
+      name: "Beta9 Signing Key",
+      regex: "sk_(?:(?<![A-Za-z0-9+/_-]sk_)|(?<=\\\\[nrt]sk_))[A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=(?![A-Za-z0-9+/=])",
+      confidence: "high",
+      precheck: ["sk_"]
+    },
+    {
+      name: "Beta9 Token (88-char base64url)",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))[A-Za-z0-9_-]{85}[AQgw]==(?![A-Za-z0-9+/=_-])",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["a==", "q==", "g==", "w=="]
+    },
+    {
+      name: "Generic sk- API Key",
+      regex: "sk-(?:(?<![A-Za-z0-9+/_-]sk-)|(?<=\\\\[nrt]sk-))[A-Za-z0-9_-]{20,256}(?![A-Za-z0-9_-])",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["sk-"]
+    },
+    {
+      name: "Azure Key (JQQJ99 family)",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))[A-Za-z0-9]{52}JQQJ99[A-Za-z0-9][A-L][A-Za-z0-9]{24}(?:[A-Za-z0-9]{2}==)?",
+      confidence: "high",
+      precheck: ["jqqj99"]
+    },
+    {
+      name: "Azure AI Search Key",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))[A-Za-z0-9]{42}AzSe[A-D][A-Za-z0-9]{5}(?![A-Za-z0-9])",
+      confidence: "high",
+      precheck: ["azse"]
+    },
+    {
+      name: "Azure API Management Key",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))[A-Za-z0-9+/]{76}APIM[A-Za-z0-9+/]{5}[AQgw]==",
+      confidence: "high",
+      precheck: ["apim"]
+    },
+    {
+      name: "Cloudflare Scannable Token",
+      regex: "cf(?:(?<![A-Za-z0-9+/_-]cf)|(?<=\\\\[nrt]cf))(?:ut|at|k)_[A-Za-z0-9]{40}[a-f0-9]{8}(?![A-Za-z0-9])",
+      confidence: "high",
+      precheck: ["cfut_", "cfat_", "cfk_"]
+    },
+    {
+      name: "Cloudflare Origin CA Key",
+      regex: "v1(?:(?<![A-Za-z0-9+/_-]v1)|(?<=\\\\[nrt]v1))\\.0-[a-f0-9]{24}-[a-f0-9]{146}",
+      confidence: "high",
+      precheck: ["v1.0-"]
+    },
+    {
+      name: "ElevenLabs API Key",
+      regex: "sk_(?:(?<![A-Za-z0-9+/_-]sk_)|(?<=\\\\[nrt]sk_))[a-f0-9]{48}",
+      confidence: "high",
+      precheck: ["sk_"]
+    },
+    {
+      name: "Groq API Key",
+      regex: "gsk_(?:(?<![A-Za-z0-9+/_-]gsk_)|(?<=\\\\[nrt]gsk_))[A-Za-z0-9]{48,64}",
+      confidence: "high",
+      precheck: ["gsk_"]
+    },
+    {
+      name: "Replicate API Token",
+      regex: "r8_(?:(?<![A-Za-z0-9+/_-]r8_)|(?<=\\\\[nrt]r8_))[A-Za-z0-9_-]{37,40}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["r8_"]
+    },
+    {
+      name: "Together AI API Key",
+      regex: "tgp_v1_(?:(?<![A-Za-z0-9+/_-]tgp_v1_)|(?<=\\\\[nrt]tgp_v1_))[A-Za-z0-9_-]{30,80}",
+      confidence: "high",
+      precheck: ["tgp_v1_"]
+    },
+    {
+      name: "Fireworks API Key",
+      regex: "fw_(?:(?<![A-Za-z0-9+/_-]fw_)|(?<=\\\\[nrt]fw_))[A-Za-z0-9]{20,48}",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["fw_"]
+    },
+    {
+      name: "xAI API Key",
+      regex: "xai-(?:(?<![A-Za-z0-9+/_-]xai-)|(?<=\\\\[nrt]xai-))[A-Za-z0-9_]{60,100}",
+      confidence: "high",
+      precheck: ["xai-"]
+    },
+    {
+      name: "Perplexity API Key",
+      regex: "pplx-(?:(?<![A-Za-z0-9+/_-]pplx-)|(?<=\\\\[nrt]pplx-))[A-Za-z0-9]{40,64}",
+      confidence: "high",
+      precheck: ["pplx-"]
+    },
+    {
+      name: "Pinecone API Key",
+      regex: "pcsk_(?:(?<![A-Za-z0-9+/_-]pcsk_)|(?<=\\\\[nrt]pcsk_))[A-Za-z0-9]{4,8}_[A-Za-z0-9]{40,80}",
+      confidence: "high",
+      precheck: ["pcsk_"]
+    },
+    {
+      name: "LangSmith API Key",
+      regex: "lsv2_(?:(?<![A-Za-z0-9+/_-]lsv2_)|(?<=\\\\[nrt]lsv2_))(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{10}",
+      confidence: "high",
+      precheck: ["lsv2_"]
+    },
+    {
+      name: "Langfuse Secret Key",
+      regex: "sk-lf-(?:(?<![A-Za-z0-9+/_-]sk-lf-)|(?<=\\\\[nrt]sk-lf-))[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
+      confidence: "high",
+      precheck: ["sk-lf-"]
+    },
+    {
+      name: "Cerebras API Key",
+      regex: "csk-(?:(?<![A-Za-z0-9+/_-]csk-)|(?<=\\\\[nrt]csk-))[a-z0-9]{40,64}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["csk-"]
+    },
+    {
+      name: "NVIDIA API Key",
+      regex: "nvapi-(?:(?<![A-Za-z0-9+/_-]nvapi-)|(?<=\\\\[nrt]nvapi-))[A-Za-z0-9_-]{60,70}",
+      confidence: "high",
+      precheck: ["nvapi-"]
+    },
+    {
+      name: "Jina API Key",
+      regex: "jina_(?:(?<![A-Za-z0-9+/_-]jina_)|(?<=\\\\[nrt]jina_))[A-Za-z0-9_-]{60,100}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["jina_"]
+    },
+    {
+      name: "Tavily API Key",
+      regex: "tvly-(?:(?<![A-Za-z0-9+/_-]tvly-)|(?<=\\\\[nrt]tvly-))(?:dev-|prod-)?[A-Za-z0-9]{32}",
+      confidence: "high",
+      precheck: ["tvly-"]
+    },
+    {
+      name: "E2B API Key",
+      regex: "e2b_(?:(?<![A-Za-z0-9+/_-]e2b_)|(?<=\\\\[nrt]e2b_))[a-f0-9]{40}",
+      confidence: "high",
+      precheck: ["e2b_"]
+    },
+    {
+      name: "Daytona API Key",
+      regex: "dtn_(?:(?<![A-Za-z0-9+/_-]dtn_)|(?<=\\\\[nrt]dtn_))[a-f0-9]{64}",
+      confidence: "high",
+      precheck: ["dtn_"]
+    },
+    {
+      name: "Browserbase API Key",
+      regex: "bb_live_(?:(?<![A-Za-z0-9+/_-]bb_live_)|(?<=\\\\[nrt]bb_live_))[A-Za-z0-9_-]{20,64}",
+      confidence: "high",
+      precheck: ["bb_live_"]
+    },
+    {
+      name: "GitLab Token Family",
+      regex: "gl(?:(?<![A-Za-z0-9+/_-]gl)|(?<=\\\\[nrt]gl))(?:pat|dt|rt|ptt|cbt|ffct|ft|imt|agent|oas|soat)-[A-Za-z0-9_.=-]{20,300}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: [
+        "glpat-",
+        "gldt-",
+        "glrt-",
+        "glptt-",
+        "glcbt-",
+        "glffct-",
+        "glft-",
+        "glimt-",
+        "glagent-",
+        "gloas-",
+        "glsoat-"
+      ]
+    },
+    {
+      name: "GitLab Runner Registration Token",
+      regex: "GR1348941(?:(?<![A-Za-z0-9+/_-]GR1348941)|(?<=\\\\[nrt]GR1348941))[A-Za-z0-9_-]{20,}",
+      confidence: "high",
+      precheck: ["gr1348941"]
+    },
+    {
+      name: "npm Access Token",
+      regex: "npm_(?:(?<![A-Za-z0-9+/_-]npm_)|(?<=\\\\[nrt]npm_))[A-Za-z0-9]{36}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["npm_"]
+    },
+    {
+      name: "Docker Hub Token",
+      regex: "dckr_(?:(?<![A-Za-z0-9+/_-]dckr_)|(?<=\\\\[nrt]dckr_))(?:pat|oat)_[A-Za-z0-9_-]{20,64}",
+      confidence: "high",
+      precheck: ["dckr_"]
+    },
+    {
+      name: "Netlify Token",
+      regex: "nfp_(?:(?<![A-Za-z0-9+/_-]nfp_)|(?<=\\\\[nrt]nfp_))[A-Za-z0-9_]{30,64}",
+      confidence: "high",
+      precheck: ["nfp_"]
+    },
+    {
+      name: "Supabase Token",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))(?:sbp_[a-f0-9]{40}|sb_secret_[A-Za-z0-9_-]{20,80})",
+      confidence: "high",
+      precheck: ["sbp_", "sb_secret_"]
+    },
+    {
+      name: "Tailscale Key",
+      regex: "tskey-(?:(?<![A-Za-z0-9+/_-]tskey-)|(?<=\\\\[nrt]tskey-))[a-z]+-[A-Za-z0-9]{6,}-[A-Za-z0-9]{16,}",
+      confidence: "high",
+      precheck: ["tskey-"]
+    },
+    {
+      name: "PlanetScale Token",
+      regex: "pscale_(?:(?<![A-Za-z0-9+/_-]pscale_)|(?<=\\\\[nrt]pscale_))(?:tkn|pw|oauth)_[A-Za-z0-9_.-]{32,}",
+      confidence: "high",
+      precheck: ["pscale_"]
+    },
+    {
+      name: "Neon API Key",
+      regex: "napi_(?:(?<![A-Za-z0-9+/_-]napi_)|(?<=\\\\[nrt]napi_))[a-z0-9]{64}",
+      confidence: "high",
+      precheck: ["napi_"]
+    },
+    {
+      name: "Pulumi Access Token",
+      regex: "pul-(?:(?<![A-Za-z0-9+/_-]pul-)|(?<=\\\\[nrt]pul-))[a-f0-9]{40}",
+      confidence: "high",
+      precheck: ["pul-"]
+    },
+    {
+      name: "Terraform Cloud Token",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))[A-Za-z0-9]{14}\\.atlasv1\\.[A-Za-z0-9_=-]{60,}",
+      confidence: "high",
+      precheck: [".atlasv1."]
+    },
+    {
+      name: "Atlassian API Token",
+      regex: "ATATT3(?:(?<![A-Za-z0-9+/_-]ATATT3)|(?<=\\\\[nrt]ATATT3))[A-Za-z0-9_=-]{150,}",
+      confidence: "high",
+      precheck: ["atatt3"]
+    },
+    {
+      name: "HashiCorp Vault Token",
+      regex: "hv(?:(?<![A-Za-z0-9+/_-]hv)|(?<=\\\\[nrt]hv))[sbr]\\.[A-Za-z0-9_-]{24,300}",
+      confidence: "high",
+      precheck: ["hvs.", "hvb.", "hvr."]
+    },
+    {
+      name: "Grafana Cloud/Service Account Token",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))(?:glc_[A-Za-z0-9+/]{32,400}={0,3}|glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})",
+      confidence: "high",
+      precheck: ["glc_", "glsa_"]
+    },
+    {
+      name: "DigitalOcean Token",
+      regex: "do(?:(?<![A-Za-z0-9+/_-]do)|(?<=\\\\[nrt]do))[opr]_v1_[a-f0-9]{64}",
+      confidence: "high",
+      precheck: ["dop_v1_", "doo_v1_", "dor_v1_"]
+    },
+    {
+      name: "Heroku API Key v2",
+      regex: "HRKU-(?:(?<![A-Za-z0-9+/_-]HRKU-)|(?<=\\\\[nrt]HRKU-))[A-Za-z0-9_-]{30,80}",
+      confidence: "high",
+      precheck: ["hrku-"]
+    },
+    {
+      name: "Doppler Token",
+      regex: "dp(?:(?<![A-Za-z0-9+/_-]dp)|(?<=\\\\[nrt]dp))\\.(?:ct|pt|st(?:\\.[a-z0-9_-]{2,35})?|sa|scim|audit)\\.[A-Za-z0-9]{40,44}",
+      confidence: "high",
+      precheck: [
+        "dp.ct.",
+        "dp.pt.",
+        "dp.st.",
+        "dp.sa.",
+        "dp.scim.",
+        "dp.audit."
+      ]
+    },
+    {
+      name: "1Password Service Account Token",
+      regex: "ops_eyJ(?:(?<![A-Za-z0-9+/_-]ops_eyJ)|(?<=\\\\[nrt]ops_eyJ))[A-Za-z0-9+/_=-]{100,}",
+      confidence: "high",
+      precheck: ["ops_eyj"]
+    },
+    {
+      name: "1Password Secret Key",
+      regex: "A3-(?:(?<![A-Za-z0-9_-]A3-)|(?<=\\\\[nrt]A3-))[A-Z0-9]{6}-(?:[A-Z0-9]{11}|[A-Z0-9]{6}-[A-Z0-9]{5})-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b",
+      confidence: "high",
+      precheck: ["a3-"]
+    },
+    {
+      name: "age Secret Key",
+      regex: "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}",
+      confidence: "high",
+      precheck: ["age-secret-key-1"]
+    },
+    {
+      name: "Sentry Org/User Token",
+      regex: "sntry(?:(?<![A-Za-z0-9+/_-]sntry)|(?<=\\\\[nrt]sntry))[su]_[A-Za-z0-9+/=_-]{40,400}",
+      confidence: "high",
+      precheck: ["sntrys_", "sntryu_"]
+    },
+    {
+      name: "PostHog Personal API Key",
+      regex: "phx_(?:(?<![A-Za-z0-9+/_-]phx_)|(?<=\\\\[nrt]phx_))[A-Za-z0-9_]{40,50}",
+      confidence: "high",
+      precheck: ["phx_"]
+    },
+    {
+      name: "Linear OAuth Token",
+      regex: "lin_oauth_(?:(?<![A-Za-z0-9+/_-]lin_oauth_)|(?<=\\\\[nrt]lin_oauth_))[a-f0-9]{64}",
+      confidence: "high",
+      precheck: ["lin_oauth_"]
+    },
+    {
+      name: "Notion Token (ntn_)",
+      regex: "ntn_(?:(?<![A-Za-z0-9+/_-]ntn_)|(?<=\\\\[nrt]ntn_))[A-Za-z0-9]{40,50}",
+      confidence: "high",
+      precheck: ["ntn_"]
+    },
+    {
+      name: "Figma Token",
+      regex: "fig(?:(?<![A-Za-z0-9+/_-]fig)|(?<=\\\\[nrt]fig))[dpuo]_[A-Za-z0-9_=-]{38,60}",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: ["figd_", "figp_", "figu_", "figo_"]
+    },
+    {
+      name: "Slack App-Level Token",
+      regex: "xapp-(?:(?<![A-Za-z0-9+/_-]xapp-)|(?<=\\\\[nrt]xapp-))\\d-[A-Za-z0-9-]{20,250}",
+      confidence: "high",
+      precheck: ["xapp-"]
+    },
+    {
+      name: "Stripe/Svix Webhook Secret",
+      regex: "whsec_(?:(?<![A-Za-z0-9+/_-]whsec_)|(?<=\\\\[nrt]whsec_))[A-Za-z0-9+/=]{24,}",
+      confidence: "high",
+      precheck: ["whsec_"]
+    },
+    {
+      name: "Google OAuth Client Secret",
+      regex: "GOCSPX-(?:(?<![A-Za-z0-9+/_-]GOCSPX-)|(?<=\\\\[nrt]GOCSPX-))[A-Za-z0-9_-]{24,40}",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["gocspx-"]
+    },
+    {
+      name: "New Relic API Key",
+      regex: "NR(?:(?<![A-Za-z0-9_-]NR)|(?<=\\\\[nrt]NR))(?:AK|AA|II|IQ|JS)-[A-Z0-9]{27}(?![A-Za-z0-9])",
+      confidence: "high",
+      precheck: ["nrak-", "nraa-", "nrii-", "nriq-", "nrjs-"]
+    },
+    {
+      name: "Discord Webhook Token",
+      regex: "discord(?:app)?\\.com/api/webhooks/\\d{17,20}/([A-Za-z0-9_-]{60,80})",
+      confidence: "high",
+      precheck: ["discord"]
+    },
+    {
+      name: "Discord Bot Token (contextual)",
+      regex: "(?:(?<![A-Za-z0-9+/_-])|(?<=\\\\[nrt]))[MNO][A-Za-z0-9_-]{23,27}\\.[A-Za-z0-9_-]{6}\\.[A-Za-z0-9_-]{27,40}",
+      confidence: "high",
+      validator: "high-entropy",
+      context: "discord"
+    },
+    {
+      name: "Azure Storage/Service Bus Key",
+      regex: `(?:account|sharedaccess|access|primary|secondary|storage)[_-]?key(?:\\\\{0,7}["'])?\\s*[=:]\\s*(?:\\\\{0,7}["'])?([A-Za-z0-9+/]{40,88}={0,2})`,
+      flags: "i",
+      confidence: "high",
+      validator: "high-entropy",
+      precheck: [
+        "accountkey",
+        "account_key",
+        "account-key",
+        "accesskey",
+        "access_key",
+        "access-key",
+        "primarykey",
+        "primary_key",
+        "primary-key",
+        "secondarykey",
+        "secondary_key",
+        "secondary-key",
+        "storagekey",
+        "storage_key",
+        "storage-key"
+      ]
+    },
+    {
+      name: "Azure Storage Account Keys List",
+      regex: 'keyName\\\\{0,7}"\\s*:\\s*\\\\{0,7}"key[12]\\\\{0,7}"[\\s\\S]{0,200}?value\\\\{0,7}"\\s*:\\s*\\\\{0,7}"([A-Za-z0-9+/]{86}==)',
+      confidence: "high",
+      precheck: ["keyname"]
+    },
+    {
+      name: "Azure Entra Client Secret",
+      regex: "(?:(?<![A-Za-z0-9_~.-])|(?<=\\\\[nrt]))[A-Za-z0-9_~.]{3}\\dQ~[A-Za-z0-9_~.-]{31,34}(?![A-Za-z0-9_~.-])",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["q~"]
+    },
+    {
+      name: "Claude Code atis Token (key context)",
+      regex: "^(?:v\\d+\\.[A-Za-z0-9_.-]{40,}|[0-9a-f]{16})$",
+      confidence: "high",
+      context: "^atis$",
+      contextScope: "key"
+    },
     {
       name: "JSON Web Token",
-      regex: "(?:(?<![A-Za-z0-9_-])|(?<=\\\\[nrt]))eyJ[A-Za-z0-9_-]{12,}\\.[A-Za-z0-9_-]{12,}\\.[A-Za-z0-9_-]{16,}",
+      regex: "eyJ(?:(?<![A-Za-z0-9_-]eyJ)|(?<=\\\\[nrt]eyJ))[A-Za-z0-9_-]{12,}\\.[A-Za-z0-9_-]{12,}\\.[A-Za-z0-9_-]{16,}",
       confidence: "high",
       validator: "jwt",
       precheck: ["eyj"]
     },
     {
       name: "GitHub Token (escaped-newline boundary)",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))gh[oprsu]_[A-Za-z0-9]{36,255}",
+      regex: "gh(?:(?<![A-Za-z0-9]gh)|(?<=\\\\[nrt]gh))[oprsu]_[A-Za-z0-9]{36,255}",
       confidence: "high",
       precheck: ["gho_", "ghp_", "ghr_", "ghs_", "ghu_"]
     },
     {
       name: "Sourcegraph Access Token",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sgp_(?:local_)?(?:[A-Fa-f0-9]{16}_)?[A-Fa-f0-9]{40}",
+      regex: "sgp_(?:(?<![A-Za-z0-9]sgp_)|(?<=\\\\[nrt]sgp_))(?:local_)?(?:[A-Fa-f0-9]{16}_)?[A-Fa-f0-9]{40}",
       confidence: "high",
       precheck: ["sgp_"]
     },
     {
       name: "Sourcegraph Token Assignment",
-      regex: `(?:src[_-]?access[_-]?token|sourcegraph[a-z0-9_-]{0,24}token)["']?\\s*[:=]\\s*["']?([A-Fa-f0-9]{40,64})`,
+      regex: "(?:src[_-]?access[_-]?token|sourcegraph[a-z0-9_-]{0,24}token)(?:(?:\\\\{0,7}[\"'])?\\]?\\s*[:=]\\s*(?:\\\\{0,7}[\"'`])?|`\\]?\\s*[:=]\\s*`)([A-Fa-f0-9]{40,64})",
       flags: "i",
       confidence: "high"
     },
@@ -13354,7 +13899,7 @@ var patterns_local_default = {
     },
     {
       name: "Algolia API Key Assignment",
-      regex: `algolia[a-z0-9_-]{0,24}(?:key|token)["']?\\s*[:=]\\s*["']?([A-Za-z0-9]{20,64})`,
+      regex: "algolia[a-z0-9_-]{0,24}(?:key|token)(?:(?:\\\\{0,7}[\"'])?\\]?\\s*[:=]\\s*(?:\\\\{0,7}[\"'`])?|`\\]?\\s*[:=]\\s*`)([A-Za-z0-9]{20,64})",
       flags: "i",
       confidence: "high",
       validator: "credential-value"
@@ -13368,14 +13913,14 @@ var patterns_local_default = {
     },
     {
       name: "Slack Token (extended prefixes)",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))xox[a-z]-[A-Za-z0-9-]{10,250}",
+      regex: "xox(?:(?<![A-Za-z0-9]xox)|(?<=\\\\[nrt]xox))[a-z]-[A-Za-z0-9-]{10,250}",
       confidence: "high",
       validator: "credential-value",
       precheck: ["xox"]
     },
     {
       name: "Hugging Face Token (contextual)",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))hf_[A-Za-z0-9]{20,33}",
+      regex: "hf_(?:(?<![A-Za-z0-9]hf_)|(?<=\\\\[nrt]hf_))[A-Za-z0-9]{20,33}",
       context: "hugg|hf[_-]?(?:api[_-]?)?token|hf auth",
       confidence: "high",
       validator: "credential-value",
@@ -13383,7 +13928,7 @@ var patterns_local_default = {
     },
     {
       name: "Modal Token Pair",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))ak-[A-Za-z0-9]{10,64}[\\s:,;]{1,4}as-[A-Za-z0-9]{10,64}",
+      regex: "ak-(?:(?<![A-Za-z0-9]ak-)|(?<=\\\\[nrt]ak-))[A-Za-z0-9]{10,64}[\\s:,;]{1,4}as-[A-Za-z0-9]{10,64}",
       confidence: "high",
       precheck: ["ak-"]
     },
@@ -13397,7 +13942,7 @@ var patterns_local_default = {
     },
     {
       name: "Bearer Authorization Value",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))bearer\\s+([A-Za-z0-9_~+/.=-]{16,512})",
+      regex: "bearer(?:(?<![A-Za-z0-9]bearer)|(?<=\\\\[nrt]bearer))\\s+([A-Za-z0-9_~+/.=-]{16,4096})",
       flags: "i",
       confidence: "high",
       validator: "high-entropy",
@@ -13405,7 +13950,7 @@ var patterns_local_default = {
     },
     {
       name: "Basic Authorization Value",
-      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))basic\\s+([A-Za-z0-9+/=]{12,512})",
+      regex: "basic(?:(?<![A-Za-z0-9]basic)|(?<=\\\\[nrt]basic))\\s+([A-Za-z0-9+/=]{12,512})",
       flags: "i",
       confidence: "high",
       validator: "basic-auth",
@@ -13413,35 +13958,116 @@ var patterns_local_default = {
     },
     {
       name: "Authorization Header Token Scheme",
-      regex: `authorization["']?\\s*[:=]\\s*["']?(?:token|apikey|api-key)\\s+([A-Za-z0-9_~+/.=-]{8,512})`,
+      regex: "authorization(?:(?:\\\\{0,7}[\"'])?\\]?\\s*[:=]\\s*(?:\\\\{0,7}[\"'`])?|`\\]?\\s*[:=]\\s*`)(?:token|apikey|api-key)\\s+([A-Za-z0-9_~+/.=-]{8,512})",
       flags: "i",
       confidence: "high",
       validator: "credential-value"
     },
+    {
+      name: "Jupyter Server Token",
+      regex: "[0-9a-f]{48}(?:(?<=^[0-9a-f]{48})|(?<=[^0-9A-Za-z_-][0-9a-f]{48})|(?<=\\\\[nrt][0-9a-f]{48}))(?![0-9A-Za-z])",
+      confidence: "high",
+      validator: "high-entropy",
+      context: "jupyter|tkn|:8888"
+    },
+    {
+      name: "Weights & Biases Key Near Mention",
+      regex: `(?:wandb(?:[_-][a-z]{1,16}){0,3}|w&b|weights\\s*(?:&|and)\\s*biases)(?![A-Za-z0-9])(?:[^\\n\\\\]|\\\\{1,7}["']){0,80}?(?<![0-9A-Za-z])([0-9a-f]{40})(?![0-9A-Za-z])`,
+      flags: "i",
+      confidence: "high",
+      validator: "wandb-hex",
+      precheck: ["wandb", "w&b", "weights"]
+    },
+    {
+      name: "Provider CLI Login Key",
+      regex: `(?:wandb[ \\t]+login(?:[ \\t]+--?[a-z-]+(?:=[^\\s\\\\]+)?)*|vastai[ \\t]+set[ \\t]+api-key|aws[ \\t]+configure[ \\t]+set[ \\t]+[^\\s\\\\]*(?:secret|token)[^\\s\\\\]*|ngrok[ \\t]+(?:config[ \\t]+add-)?authtoken)[ \\t]+\\\\?["']?([^\\s"'\\\\]{8,4096})`,
+      flags: "i",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["wandb", "vastai", "configure", "authtoken"]
+    },
+    {
+      name: "Netrc Password",
+      regex: `machine(?:(?<![A-Za-z0-9_]machine)|(?<=\\\\[nrt]machine))(?:\\s|\\\\[nrt])+[^\\s\\\\]{1,253}(?:\\s|\\\\[nrt])+(?:login(?:\\s|\\\\[nrt])+[^\\s\\\\]{1,253}(?:\\s|\\\\[nrt])+)?password(?:\\s|\\\\[nrt])+([^\\s"'\\\\]{6,256})`,
+      confidence: "high",
+      validator: "netrc-password",
+      precheck: ["machine"]
+    },
+    {
+      name: "Key Keyword Argument",
+      regex: `(?:^|[^A-Za-z0-9_.]|\\\\[nrt])key\\s*=\\s*\\\\{0,7}["']([A-Za-z0-9_-]{32,128})\\\\{0,7}["']`,
+      confidence: "high",
+      validator: "opaque-token",
+      precheck: ["key"]
+    },
+    {
+      name: "VS Code Connection Token",
+      regex: `(?:connection[-_]token|vscode-tkn|[?&]tkn)(?:=|[ \\t]+)(?!-)\\\\?["']?([0-9A-Za-z_-]{16,128})`,
+      flags: "i",
+      confidence: "high",
+      validator: "credential-value",
+      precheck: ["connection", "tkn"]
+    },
+    {
+      name: "Jupyter Kernel HMAC Key",
+      regex: "(?<![0-9a-f-])[0-9a-f]{8}-[0-9a-f]{24}(?![0-9a-f-])",
+      confidence: "high",
+      validator: "high-entropy",
+      context: "hmac|signature_scheme|^key$"
+    },
+    {
+      name: "CLI Credential Flag",
+      regex: `(?:^|[^A-Za-z0-9_-]|\\\\[nrt])--?(?:[a-z0-9]{1,24}[-_]){0,4}(?:api[-_]?key|token|secret|passw(?:or)?d|access[-_]?key|secret[-_]?key|auth[-_]?token|access[-_]?token|client[-_]?secret|connection[-_]?token|account[-_]?key|storage[-_]?key)(?:=|[ \\t]+)(?!-)\\\\{0,7}["']?([^\\s"'\\\\;|&]{8,512})`,
+      flags: "i",
+      confidence: "high",
+      validator: "cli-credential",
+      precheck: ["key", "token", "secret", "passw"]
+    },
+    {
+      name: "Netrc Password (numbered view)",
+      regex: `(?:^|\\n|\\\\n)[ \\t+]*(?:\\d{1,7}(?:\u2192|\\t|\\\\t))?[ \\t]*password(?:[ \\t]|\\\\t)+([^\\s"'\\\\]{6,256})`,
+      confidence: "high",
+      validator: "netrc-password",
+      context: "(?:^|[^a-z]|\\\\[nrt])machine(?:\\s|\\\\[nrt])",
+      precheck: ["password"]
+    },
+    {
+      name: "PGP Private Key Block",
+      regex: "-----BEGIN PGP PRIVATE KEY BLOCK-----(?:(?:\\s|\\\\[nrt]){1,16}[A-Za-z0-9-]+: [^\\n\\\\]*)*(?:(?:\\s|\\\\[nrt]){1,16}[A-Za-z0-9+/=]{16,})+(?:(?:\\s|\\\\[nrt]){1,16}=[A-Za-z0-9+/]{4})?(?:(?:\\s|\\\\[nrt]){1,16}-----END PGP PRIVATE KEY BLOCK-----)?",
+      confidence: "high",
+      precheck: ["pgp private key block"]
+    },
+    {
+      name: "curl User Password",
+      regex: `curl\\b[^\\n|;&]{0,300}?\\s(?:-u|--user|--proxy-user)(?:[ \\t]+|=)\\\\?["']?[^\\s:'"\\\\]{0,64}:([^\\s'"\\\\]{6,256})`,
+      confidence: "high",
+      validator: "password-value",
+      precheck: ["curl"]
+    },
     {
       name: "Credential Header Value",
-      regex: `(?:x-api-key|api[-_]?key|x-auth-token|auth[-_]?token|x-access-token|private-token|x-goog-api-key|x-gitlab-token|x-amz-security-token|x-figma-token|x-vault-token|proxy-authorization|authorization)["']?\\s*[:=]\\s*["']?([A-Za-z0-9_~+/.=-]{8,512})`,
+      regex: "(?:x-api-key|api[-_]?key|x-auth-token|auth[-_]?token|x-access-token|private-token|x-goog-api-key|x-gitlab-token|x-amz-security-token|x-figma-token|x-vault-token|ocp-apim-subscription-key|x-auth-key|x-auth-user-service-key|proxy-authorization|authorization)(?:(?:\\\\{0,7}[\"'])?\\]?\\s*[:=]\\s*(?:\\\\{0,7}[\"'`])?|`\\]?\\s*[:=]\\s*`)([A-Za-z0-9_~%+/.=-]{8,4096})",
       flags: "i",
       confidence: "high",
       validator: "credential-value"
     },
     {
       name: "Credential Query Parameter",
-      regex: `[?&](?:access_token|refresh_token|id_token|api_key|apikey|auth_token|session_token|client_secret|private_token|signature|sig|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential)=([^&\\s"'\\\\]{8,512})`,
+      regex: `[?&](?:access_token|refresh_token|id_token|api_key|apikey|auth_token|session_token|client_secret|private_token|signature|sig|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential)=([^&\\s"'\\\\]{8,4096})`,
       flags: "i",
       confidence: "high",
       validator: "credential-value"
     },
     {
       name: "High-Entropy Query Parameter",
-      regex: `[?&](?:token|key|auth|session|sid|secret|password|passwd)=([^&\\s"'\\\\]{16,512})`,
+      regex: `[?&](?:token|key|auth|session|sid|secret|password|passwd)=([^&\\s"'\\\\]{16,4096})`,
       flags: "i",
       confidence: "high",
       validator: "session-value"
     },
     {
       name: "Auth Cookie or Token Assignment",
-      regex: `(?:session|sess_?(?:id|key|token)|auth(?!or)|token|jwt|csrf|xsrf|secret)[a-z0-9_-]{0,32}["']?\\s*[:=]\\s*["']?([A-Za-z0-9_%+/=.~-]{16,512})`,
+      regex: "(?:session|sess_?(?:id|key|token)|auth(?!or)|token|jwt|csrf|xsrf|secret)[a-z0-9_-]{0,32}(?:(?:\\\\{0,7}[\"'])?\\]?\\s*[:=]\\s*(?:\\\\{0,7}[\"'`])?|`\\]?\\s*[:=]\\s*`)([A-Za-z0-9_%+/=.~-]{16,4096})",
       flags: "i",
       confidence: "high",
       validator: "session-value",
@@ -13449,11 +14075,11 @@ var patterns_local_default = {
     },
     {
       name: "Password Assignment",
-      regex: `(?:password|passwd|passphrase)[a-z0-9_-]{0,32}["']?\\s*[:=]\\s*["']?([^\\s"'\\\\]{8,256})`,
+      regex: "(?:password|passwd|passphrase|sshpass(?![a-z0-9_-]))[a-z0-9_-]{0,32}(?:(?:\\\\{0,7}[\"'])?\\]?\\s*[:=]\\s*(?:\\\\{0,7}[\"'`])?|`\\]?\\s*[:=]\\s*`)([^\\s\"'\\\\]{8,256})",
       flags: "i",
       confidence: "high",
-      validator: "credential-value",
-      precheck: ["passw", "passphrase"]
+      validator: "password-value",
+      precheck: ["passw", "passphrase", "sshpass"]
     },
     {
       name: "Password Value (key context)",
@@ -13461,12 +14087,12 @@ var patterns_local_default = {
       context: "^[a-z0-9_-]{0,32}(?:password|passwd|passphrase)[a-z0-9_-]{0,32}$",
       contextScope: "key",
       confidence: "high",
-      validator: "credential-value"
+      validator: "password-value"
     },
     {
       name: "Credential Value (key context)",
       regex: "^[A-Za-z0-9_~%+/.=-]{8,1024}$",
-      context: "^[a-z0-9_-]{0,32}(?:api[_-]?key|apikey|auth[_-]?token|access[_-]?token|refresh[_-]?token|client[_-]?secret|secret[_-]?key|private[_-]?token|bearer[_-]?token|session[_-]?token|credential)s?[a-z0-9_-]{0,32}$|^(?:proxy[_-])?authorization$",
+      context: "^[a-z0-9_-]{0,32}(?:api[_-]?key|apikey|auth[_-]?token|access[_-]?token|refresh[_-]?token|client[_-]?secret|secret[_-]?key|secret[_-]?access[_-]?key|access[_-]?key[_-]?secret|private[_-]?token|bearer[_-]?token|session[_-]?token|security[_-]?token|account[_-]?key|shared[_-]?access[_-]?key|signing[_-]?(?:key|secret)|encryption[_-]?key|(?:webhook|consumer|app|shared|hmac|oauth)[_-]?secret|credential)s?[a-z0-9_-]{0,32}$|^(?:proxy[_-])?authorization$",
       contextScope: "key",
       confidence: "high",
       validator: "credential-value"
@@ -13484,9 +14110,13 @@ var PREFIX_RUNS = {
   "[\\w\\-]*sq0c[a-z]{2}-[0-9A-Za-z\\-_]{40,50}": "[\\w-]+",
   "[0-9]+:AA[0-9A-Za-z\\-_]{33}": "[0-9]+"
 };
+var DROPPED_UPSTREAM = /* @__PURE__ */ new Set(["Password in URL", "Privatekey"]);
+var BOUNDED_UPSTREAM = {
+  "key-[0-9a-zA-Z]{32}": "key-(?:(?<![A-Za-z0-9-]key-)|(?<=\\\\[nrt]key-))[0-9a-zA-Z]{32}"
+};
 var PLACEHOLDER_VALUE = /your[-_ ]|xxxxx|example|sample|dummy|placeholder|change[-_]?me|redacted|insert[-_ ]|fixme|1234567890|abcdefgh/i;
 var LEADING_TEMPLATE = /^[$%{<*#]/;
-var FILLER_RUN = /^(?:x+|\*+|-+|\.+)$/i;
+var FILLER_RUN = /^(?:x+|\*+|-+|\.+|=+)$/i;
 var DOTTED_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]{0,24}(?:\.[A-Za-z_$][A-Za-z0-9_$]{0,24}){1,6}$/;
 var TYPE_OR_LITERAL = /^(?:Optional|List|Dict|Union|Tuple|Set|Sequence|Mapping|Callable|Iterable|Any|str|string|int|integer|float|bool|boolean|bytes|None|True|False|null|true|false|undefined|nil|object|number)\b/;
 var URL_VALUE = /^[a-z][a-z0-9+.-]*:\/\//i;
@@ -13516,10 +14146,88 @@ function isCredentialShaped(secret) {
 var UUID_VALUE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var LONG_HEX_VALUE = /^[0-9a-f]{32,}$/i;
 var IDENTIFIER_NAME = /^[^:=]*(?:file|path|dir|sha\d*|hash|digest|checksum|hex|uuid|guid|rate|estimate|speed|bytes|count)[^:=]*[:=]/i;
-function isSessionSecret(secret, fullMatch) {
-  return isCredentialShaped(secret) && shannonEntropy(secret) >= 3.2 && !UUID_VALUE.test(secret) && !LONG_HEX_VALUE.test(secret) && !secret.includes("/") && // "=..." values come from ==version pins (tokenspeed-triton==0.1.2+cu121).
+function nameWords(secret, fullMatch, before) {
+  const lead = before.match(/[A-Za-z0-9_-]*$/)?.[0] ?? "";
+  const name = lead + fullMatch.slice(0, fullMatch.lastIndexOf(secret));
+  return name.split(/[^A-Za-z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).filter(Boolean);
+}
+var CREDENTIAL_WORD = /^(?:secret|key|apikey|password|passwd|passphrase|credentials?|token|auth|jwt|bearer)$/i;
+var ID_WORD = /^(?:sess|session|sid|request|trace|span|nonce|cursor|page|next|continuation|idempotency|correlation|id|ids)$/i;
+var PAGINATION_WORD = /^(?:request|next|continuation|page|cursor|pagination|starting|idempotency|cancellation|change|trace|span|correlation)$/i;
+function isIdShapeAllowed(words, secret) {
+  if (!UUID_VALUE.test(secret) && !LONG_HEX_VALUE.test(secret)) return true;
+  const last = words.at(-1) ?? "";
+  if (!CREDENTIAL_WORD.test(last)) return false;
+  return !/^token$/i.test(last) || !words.slice(0, -1).some((word) => ID_WORD.test(word));
+}
+function charKind(ch) {
+  if (/[a-z]/.test(ch)) return "l";
+  if (/[A-Z]/.test(ch)) return "u";
+  if (/[0-9]/.test(ch)) return "d";
+  return "o";
+}
+function isIdentifierLike(s) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(s)) return false;
+  if ((s.match(/[0-9]/g) ?? []).length > 2) return false;
+  const words = s.match(/[A-Z]?[a-z]{3,}|[A-Z]{3,}(?![a-z])/g) ?? [];
+  const covered = words.reduce((n, w) => n + w.length, 0);
+  let transitions = 0;
+  for (let i = 1; i < s.length; i++) {
+    const a = charKind(s[i - 1]);
+    const b = charKind(s[i]);
+    if (a !== b && !(a === "u" && b === "l") && a !== "o" && b !== "o") {
+      transitions++;
+    }
+  }
+  return covered / s.replace(/[_$]/g, "").length >= 0.6 && transitions / s.length <= 0.25;
+}
+function isSlashValueSecret(secret) {
+  if (!secret.includes("/")) return true;
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(secret)) return false;
+  if (secret.length < 16) return false;
+  if (charClassCount(secret) < 3) return false;
+  return !secret.split("/").filter(Boolean).every(
+    (seg) => seg.length < 6 || isIdentifierLike(seg) || /^\d+$/.test(seg)
+  );
+}
+function isMarkdownIdentifier(secret, fullMatch) {
+  return fullMatch.includes("`") && isIdentifierLike(secret);
+}
+function isSessionSecret(secret, fullMatch, before = "") {
+  const words = nameWords(secret, fullMatch, before);
+  const last = words.at(-1) ?? "";
+  if (/^token$/i.test(last) && words.slice(0, -1).some((word) => PAGINATION_WORD.test(word))) {
+    return false;
+  }
+  return isCredentialShaped(secret) && !isIdentifierLike(secret) && shannonEntropy(secret) >= 3.2 && isIdShapeAllowed(words, secret) && isSlashValueSecret(secret) && // "=..." values come from ==version pins (tokenspeed-triton==0.1.2+cu121).
   !secret.startsWith("=") && !IDENTIFIER_NAME.test(fullMatch);
 }
+var PASSWORD_STOP_WORD = /^(?:none|null|nil|true|false|undefined|required|optional|hidden|masked|prompt|empty|unknown|anonymous|string|str|secret|password|passwd|passphrase|default|value|input|changeme|notset|redacted|disabled|enabled|credentials|creds|hashed|encrypted|decrypted|plaintext|generated|provided|supplied|random|getpass|environ|settings|config|incorrect|invalid|wrong|expired|missing|protected|mismatch|reset)$/i;
+var PASSWORD_SETTING_NAME = /(?:file|path|dir|policy|length|min|max|reset|hash|field|input|label|hint|prompt|manager|strategy|rules?)$/i;
+function isPasswordValue(secret, fullMatch) {
+  if (isCredentialShaped(secret)) return true;
+  const value = secret.replace(/[;,)\]}]+$/, "");
+  if (value.length < 8 || isPlaceholder(value) || PASSWORD_STOP_WORD.test(value) || TYPE_OR_LITERAL.test(value) || URL_VALUE.test(value) || DOTTED_IDENTIFIER.test(value)) {
+    return false;
+  }
+  if (/^\d+$/.test(value) || /^[A-Z][A-Z0-9_]*$/.test(value)) return false;
+  if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+(?:\(|$)/.test(value)) {
+    return false;
+  }
+  if (/^[A-Za-z_]\w*\(/.test(value)) return false;
+  if (/^\[|\(\?|\\[dwsb]/.test(value)) return false;
+  if (/[[(){}?,<>|=:/]/.test(value)) return false;
+  const name = fullMatch.slice(0, fullMatch.length - secret.length);
+  if (name.includes("\n")) return false;
+  if (PASSWORD_SETTING_NAME.test(name.replace(/[^A-Za-z0-9]+$/, ""))) {
+    return false;
+  }
+  const snake = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/.test(value);
+  if (snake && /^[A-Z0-9_]+\s+=\s/.test(name)) return false;
+  const codeContext = !/^[A-Z0-9_]+=$/.test(name) && (value !== secret || /\s=\s/.test(name));
+  return !(codeContext && snake && !/[:=]\s*\\{0,7}["'`]/.test(fullMatch));
+}
+var NON_CREDENTIAL_FLAG = /[-_](?:client|next|starting|continuation|pagination|page|idempotency|max|min|cancel|resume|sync|num)[-_]token\b|--(?:no|with|without|use|skip|show|print|ask|prompt|save|store|read|from)[-_]/i;
 function isValidJwt(secret) {
   const parts = secret.split(".");
   if (parts.length !== 3) return false;
@@ -13537,12 +14245,41 @@ function isValidJwt(secret) {
 }
 function isBasicCredentials(secret) {
   const decoded = Buffer.from(secret, "base64").toString("utf8");
-  return /^[\x20-\x7e]{2,}:[\x20-\x7e]*$/.test(decoded);
+  return /^(?:[\x20-\x7e]{2,}:[\x20-\x7e]*|[\x20-\x7e]?:[\x20-\x7e]{6,})$/.test(
+    decoded
+  );
 }
 var VALIDATORS = {
-  "credential-value": isCredentialShaped,
+  "credential-value": (secret, fullMatch) => isCredentialShaped(secret) && !isMarkdownIdentifier(secret, fullMatch),
   "high-entropy": (secret) => isCredentialShaped(secret) && shannonEntropy(secret) >= 3.2,
   "session-value": isSessionSecret,
+  "password-value": isPasswordValue,
+  "aws-session-token": (secret) => charClassCount(secret) === 3 && shannonEntropy(secret) >= 4.5,
+  // A 40-hex value right after a W&B mention is an API key unless the text
+  // between them names it a commit, hash, or run id.
+  "wandb-hex": (secret, fullMatch) => shannonEntropy(secret) >= 3.3 && !/\b(?:sha\d*|commit|revision|rev|hash|digest|git|run[_ -]?id|artifact)\b/i.test(
+    fullMatch.slice(0, fullMatch.length - secret.length)
+  ),
+  // .netrc passwords: credential-shaped, or long and random. Prose like
+  // "machine learning password recommendations" is not.
+  "netrc-password": (secret) => isCredentialShaped(secret) || secret.length >= 16 && shannonEntropy(secret) >= 3.5 && !isPlaceholder(secret),
+  // --token X / --api-key=X: an opaque value, not a path, identifier, env
+  // name, or a pagination/boolean flag (--next-token, --no-password).
+  // Password flags take human passwords, as Password Assignment does.
+  "cli-credential": (secret, fullMatch) => !NON_CREDENTIAL_FLAG.test(fullMatch) && (/pass/i.test(fullMatch.slice(0, fullMatch.length - secret.length)) ? isPasswordValue(secret, fullMatch) : isCredentialShaped(secret) && shannonEntropy(secret) >= 3.2 && !isIdentifierLike(secret) && !/^[.~/]/.test(secret) && !/^[A-Z][A-Z0-9_]*$/.test(secret) && isSlashValueSecret(secret)),
+  // key="..." kwargs: an opaque token, not a snake/kebab-case cache key name.
+  "opaque-token": (secret) => isCredentialShaped(secret) && shannonEntropy(secret) >= 3.5 && !/^[a-z]+(?:[_-][a-z0-9]+)+$/i.test(secret),
+  // A base64-encoded PEM (kubeconfig client-key-data, k8s tls.key, a
+  // cert+key bundle) that decodes to a private key anywhere in it.
+  "b64-private-key": (secret) => /PRIVATE KEY/.test(
+    Buffer.from(
+      secret.replace(/\d{1,6}(?:\u2192|\t|\\t)|\\+[nrt]|\s/g, ""),
+      "base64"
+    ).toString("latin1")
+  ),
+  // A BEGIN..END private-key span with a body: at least two base64 runs of
+  // 40+ characters, so code that only names the markers is left alone.
+  "pem-body": (secret) => (secret.match(/[A-Za-z0-9+/=]{40,}/g) ?? []).length >= 2,
   jwt: isValidJwt,
   "basic-auth": isBasicCredentials
 };
@@ -13583,15 +14320,17 @@ function compilePatterns() {
   ];
   for (const p7 of allPatterns) {
     if (p7.confidence !== "high") continue;
+    if (DROPPED_UPSTREAM.has(p7.name)) continue;
     if (DELIMITER_SUFFIX.test(p7.regex)) continue;
     if (!HAS_VALUE_MATCHER.test(p7.regex)) continue;
     if (GREEDY_TAIL.test(p7.regex)) continue;
     if (p7.validator && !(p7.validator in VALIDATORS)) continue;
     try {
       const prefixRun = PREFIX_RUNS[p7.regex];
+      const source = BOUNDED_UPSTREAM[p7.regex] ?? p7.regex;
       patterns.push({
         name: p7.name,
-        regex: new RegExp(p7.regex, `g${prefixRun ? "y" : ""}${p7.flags ?? ""}`),
+        regex: new RegExp(source, `g${prefixRun ? "y" : ""}${p7.flags ?? ""}`),
         prefixRun: prefixRun ? new RegExp(prefixRun, `g${p7.flags ?? ""}`) : void 0,
         groupCount: countCaptureGroups(p7.regex),
         validate: p7.validator ? VALIDATORS[p7.validator] : void 0,
@@ -13604,6 +14343,8 @@ function compilePatterns() {
   }
   return patterns;
 }
+var TOKEN_CHAR = /[A-Za-z0-9_-]/;
+var MAX_TOKEN_EXTENSION = 4096;
 function applyPattern(content, regex, groupCount, validate, prefixRun) {
   let count = 0;
   let result = "";
@@ -13636,7 +14377,11 @@ function applyPattern(content, regex, groupCount, validate, prefixRun) {
         }
       }
     }
-    if (validate && !validate(longest.length > 0 ? longest : fullMatch, fullMatch)) {
+    if (validate && !validate(
+      longest.length > 0 ? longest : fullMatch,
+      fullMatch,
+      content.slice(Math.max(0, match.index - 48), match.index)
+    )) {
       result += content.slice(lastIndex, match.index) + fullMatch;
       lastIndex = match.index + fullMatch.length;
       if (fullMatch.length === 0) {
@@ -13647,14 +14392,23 @@ function applyPattern(content, regex, groupCount, validate, prefixRun) {
     }
     count++;
     let replacement = "[REDACTED]";
+    let redactsToEnd = true;
     if (longest.length > 0 && longest.length < fullMatch.length) {
       const pos = fullMatch.indexOf(longest);
       if (pos > 0) {
         replacement = fullMatch.slice(0, pos) + "[REDACTED]" + fullMatch.slice(pos + longest.length);
+        redactsToEnd = pos + longest.length === fullMatch.length;
       }
     }
     result += content.slice(lastIndex, match.index) + replacement;
     lastIndex = match.index + fullMatch.length;
+    if (redactsToEnd && fullMatch.length > 0 && TOKEN_CHAR.test(content[lastIndex - 1])) {
+      const cap = Math.min(content.length, lastIndex + MAX_TOKEN_EXTENSION);
+      let end = lastIndex;
+      while (end < cap && TOKEN_CHAR.test(content[end])) end++;
+      lastIndex = end;
+      if (regex.lastIndex < end) regex.lastIndex = end;
+    }
     if (fullMatch.length === 0) {
       regex.lastIndex++;
     }
@@ -13794,8 +14548,28 @@ function memoizedRedact(value, patterns, memo, owningKey) {
   }
   return result;
 }
-function walkAndRedactAll(value, patterns, memo, owningKey = null) {
+var BASE64_VALUE = /^[A-Za-z0-9+/]+={0,2}$/;
+var BASE64URL_VALUE = /^[A-Za-z0-9_-]+={0,2}$/;
+var BINARY_BASE64_PREFIX = /^(?:iVBORw0KGgoAAAANSUhEUg|\/9j\/|R0lGOD[dl]h|UklGR|JVBERi0)/;
+var BINARY_MEDIA_TYPE = /^(?:image|audio|video)\/|^application\/(?:pdf|octet-stream|zip)/;
+var DATA_IMAGE_URL = /^data:image\/[\w.+-]+;base64,[A-Za-z0-9+/]+={0,2}$/;
+function isOpaqueBlob(value, owningKey, parent) {
+  if (value.length < 256 || owningKey === null) return false;
+  if (DATA_IMAGE_URL.test(value)) return true;
+  if (BINARY_BASE64_PREFIX.test(value)) return BASE64_VALUE.test(value);
+  const type = typeof parent?.type === "string" ? parent.type : "";
+  const media = typeof parent?.media_type === "string" ? parent.media_type : typeof parent?.mimeType === "string" ? parent.mimeType : "";
+  if ((owningKey === "data" || owningKey === "base64" || owningKey === "blob") && (type === "base64" || type === "pdf" || BINARY_MEDIA_TYPE.test(type) || BINARY_MEDIA_TYPE.test(media))) {
+    return BASE64_VALUE.test(value);
+  }
+  if (owningKey === "signature" && type === "thinking" || owningKey === "data" && type === "redacted_thinking" || owningKey === "encrypted_content") {
+    return BASE64_VALUE.test(value) || BASE64URL_VALUE.test(value);
+  }
+  return false;
+}
+function walkAndRedactAll(value, patterns, memo, owningKey = null, parent = null) {
   if (typeof value === "string") {
+    if (isOpaqueBlob(value, owningKey, parent)) return { value, count: 0 };
     if (memo) {
       return memoizedRedact(value, patterns, memo, owningKey);
     }
@@ -13804,7 +14578,7 @@ function walkAndRedactAll(value, patterns, memo, owningKey = null) {
   if (Array.isArray(value)) {
     let total = 0;
     const arr = value.map((item) => {
-      const r = walkAndRedactAll(item, patterns, memo, owningKey);
+      const r = walkAndRedactAll(item, patterns, memo, owningKey, parent);
       total += r.count;
       return r.value;
     });
@@ -13815,7 +14589,13 @@ function walkAndRedactAll(value, patterns, memo, owningKey = null) {
     const obj = {};
     for (const [k, v] of Object.entries(value)) {
       const keyScan = memo ? memoizedRedact(k, patterns, memo, null) : redactString(k, patterns, null);
-      const r = walkAndRedactAll(v, patterns, memo, k);
+      const r = walkAndRedactAll(
+        v,
+        patterns,
+        memo,
+        k,
+        value
+      );
       obj[keyScan.value] = r.value;
       total += r.count + keyScan.count;
     }
@@ -14160,19 +14940,25 @@ var PatternRedactMiddleware = class {
 function escapeRegExp(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function walkAndRedact(value, regex) {
+var PLACEHOLDER = "[REDACTED]";
+function replaceSecrets(text2, regex) {
+  let count = 0;
+  const value = text2.replace(regex, (match) => {
+    if (match === PLACEHOLDER) return match;
+    count++;
+    return PLACEHOLDER;
+  });
+  return { value, count };
+}
+function walkAndRedact(value, regex, owningKey = null, parent = null) {
   if (typeof value === "string") {
-    let count = 0;
-    const replaced = value.replace(regex, () => {
-      count++;
-      return "[REDACTED]";
-    });
-    return { value: replaced, count };
+    if (isOpaqueBlob(value, owningKey, parent)) return { value, count: 0 };
+    return replaceSecrets(value, regex);
   }
   if (Array.isArray(value)) {
     let total = 0;
     const arr = value.map((item) => {
-      const r = walkAndRedact(item, regex);
+      const r = walkAndRedact(item, regex, owningKey, parent);
       total += r.count;
       return r.value;
     });
@@ -14182,14 +14968,10 @@ function walkAndRedact(value, regex) {
     let total = 0;
     const result = {};
     for (const [k, v] of Object.entries(value)) {
-      let keyCount = 0;
-      const newKey = k.replace(regex, () => {
-        keyCount++;
-        return "[REDACTED]";
-      });
-      const r = walkAndRedact(v, regex);
-      result[newKey] = r.value;
-      total += r.count + keyCount;
+      const keyScan = replaceSecrets(k, regex);
+      const r = walkAndRedact(v, regex, k, value);
+      result[keyScan.value] = r.value;
+      total += r.count + keyScan.count;
     }
     return { value: result, count: total };
   }
@@ -14211,7 +14993,7 @@ var RedactMiddleware = class {
   async process(group) {
     if (this.secrets.size === 0) return group;
     const sorted = [...this.secrets].sort((a, b) => b.length - a.length);
-    const pattern = sorted.map(escapeRegExp).join("|");
+    const pattern = [PLACEHOLDER, ...sorted].map(escapeRegExp).join("|");
     const regex = new RegExp(pattern, "g");
     const newFiles = [];
     for (const file of group.files) {
@@ -14295,17 +15077,28 @@ var RedactMiddleware = class {
     return { value: result, count };
   }
   redactString(content, regex) {
-    let count = 0;
-    const result = content.replace(regex, () => {
-      count++;
-      return "[REDACTED]";
-    });
-    return { result, count };
+    const { value, count } = replaceSecrets(content, regex);
+    return { result: value, count };
   }
 };
 
 // src/middleware/index.ts
 var middleware = [];
+function isUnambiguousSecret(value) {
+  if (/^-{3,}/.test(value)) return false;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) && !/^[a-z][a-z0-9+.-]*:\/\/[^/\s@]*@/i.test(value)) {
+    return false;
+  }
+  return value.length >= 32 || value.length >= 8 && /[^A-Za-z0-9_-]/.test(value);
+}
+function redactionChain(secrets) {
+  const chain = [];
+  const early = new Set([...secrets].filter(isUnambiguousSecret));
+  if (early.size > 0) chain.push(new RedactMiddleware(early));
+  chain.push(new PatternRedactMiddleware());
+  if (secrets.size > 0) chain.push(new RedactMiddleware(secrets));
+  return chain;
+}
 
 // src/outputs/platform.ts
 import fs14 from "fs";
@@ -15085,12 +15878,7 @@ async function buildMiddleware(repoRoot) {
   const envFileNames = await discoverEnvFiles(repoRoot);
   const envFilePaths = envFileNames.map((n) => path15.join(repoRoot, n));
   const secretResult = await collectSecrets(repoRoot, envFilePaths, []);
-  const middleware2 = [];
-  if (secretResult.values.size > 0) {
-    middleware2.push(new RedactMiddleware(secretResult.values));
-  }
-  middleware2.push(new PatternRedactMiddleware());
-  return middleware2;
+  return redactionChain(secretResult.values);
 }
 async function uploadDebugLog(ctx, state, sessionState, onContributionCreated) {
   const logPath = todayLogPath();
@@ -17975,7 +18763,7 @@ async function uploadArtifact(client, contributionId, filename, mimeType, buffer
 }
 
 // package.json
-var version = "0.9.10";
+var version = "0.9.11";
 
 // src/version.ts
 var CLI_VERSION = version;
@@ -18544,13 +19332,8 @@ async function buildRedactChain(repoRoot, capturedSecrets = []) {
     "secret-collection",
     () => collectSecrets(repoRoot, envFilePaths, [])
   );
-  const chain = [];
   for (const secret of capturedSecrets) secretResult.values.add(secret);
-  if (secretResult.values.size > 0) {
-    chain.push(new RedactMiddleware(secretResult.values));
-  }
-  chain.push(new PatternRedactMiddleware());
-  return chain;
+  return redactionChain(secretResult.values);
 }
 async function redactTail(tail, repoRoot, sourceTool, transcriptPath, redactChain) {
   let group = makeTranscriptGroup(repoRoot, sourceTool, transcriptPath, tail);
@@ -23296,14 +24079,8 @@ async function runInteractive() {
     envFilePaths,
     additionalFiles
   );
-  const mwChain = [...middleware];
-  let redactMw = null;
-  if (secretResult.values.size > 0) {
-    redactMw = new RedactMiddleware(secretResult.values);
-    mwChain.push(redactMw);
-  }
-  const patternMw = new PatternRedactMiddleware();
-  mwChain.push(patternMw);
+  const redactChain = redactionChain(secretResult.values);
+  const mwChain = [...middleware, ...redactChain];
   const output = await selectOutput(outputs);
   const confirmed = await confirmExport(filtered, output);
   if (!confirmed) {
@@ -23320,8 +24097,23 @@ async function runInteractive() {
     (stage) => s.message(stage)
   );
   s.stop(`Exported ${fileCount} files.`);
-  if (redactMw) reportRedactionStats("Redaction", redactMw.stats);
-  reportRedactionStats("Pattern redaction", patternMw.stats);
+  const exactPasses = redactChain.filter(
+    (mw) => mw instanceof RedactMiddleware
+  );
+  if (exactPasses.length > 0) {
+    const stat = (key) => exactPasses.map((mw) => mw.stats[key]);
+    reportRedactionStats("Redaction", {
+      filesRedacted: Math.max(...stat("filesRedacted")),
+      totalRedactions: stat("totalRedactions").reduce((a, b) => a + b, 0),
+      filesSkipped: Math.max(...stat("filesSkipped")),
+      binaryFiles: Math.max(...stat("binaryFiles"))
+    });
+  }
+  for (const mw of redactChain) {
+    if (mw instanceof PatternRedactMiddleware) {
+      reportRedactionStats("Pattern redaction", mw.stats);
+    }
+  }
   if (secretResult.skippedCount > 0) {
     p6.log.info(
       `${secretResult.skippedCount} secret value(s) skipped (too short or common).`