jinzd-ai-cli 0.4.241 → 0.4.243

package/dist/chunk-TY4FSEZS.js

@@ -0,0 +1,432 @@
+#!/usr/bin/env node
+import {
+  getGitRoot
+} from "./chunk-HOSJZMQS.js";
+import {
+  MEMORY_FILE_NAME,
+  MEMORY_MAX_CHARS,
+  MEMORY_STORE_FILE_NAME
+} from "./chunk-66CE3E6X.js";
+import {
+  DEFAULT_PATTERNS,
+  redactString
+} from "./chunk-B5TYJO7V.js";
+import {
+  atomicWriteFileSync
+} from "./chunk-IW3Q7AE5.js";
+
+// src/memory/persistent-memory.ts
+import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from "fs";
+import { randomUUID, createHash } from "crypto";
+import { dirname, join, resolve } from "path";
+function parseWritableScope(value) {
+  return value === "personal" || value === "project" ? value : void 0;
+}
+function memoryStorePath(configDir) {
+  return join(configDir, MEMORY_STORE_FILE_NAME);
+}
+function memoryMarkdownPath(configDir) {
+  return join(configDir, MEMORY_FILE_NAME);
+}
+function getProjectKey(cwd = process.cwd()) {
+  return resolve(getGitRoot(cwd) ?? cwd);
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function isValidScope(value) {
+  return value === "personal" || value === "project" || value === "session" || value === "team";
+}
+function isValidSensitivity(value) {
+  return value === "low" || value === "medium" || value === "high";
+}
+function isValidSource(value) {
+  return value === "tool" || value === "manual";
+}
+function normalizeEntry(value) {
+  if (!value || typeof value !== "object") return null;
+  const raw = value;
+  const content = typeof raw.content === "string" ? raw.content.trim() : "";
+  if (!content) return null;
+  const createdAt = typeof raw.createdAt === "string" ? raw.createdAt : nowIso();
+  return {
+    id: typeof raw.id === "string" && raw.id ? raw.id : randomUUID(),
+    content,
+    scope: isValidScope(raw.scope) ? raw.scope : "personal",
+    source: isValidSource(raw.source) ? raw.source : void 0,
+    sourceSession: typeof raw.sourceSession === "string" && raw.sourceSession ? raw.sourceSession : void 0,
+    sourceProject: typeof raw.sourceProject === "string" && raw.sourceProject ? raw.sourceProject : void 0,
+    createdAt,
+    updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : createdAt,
+    expiresAt: typeof raw.expiresAt === "string" && raw.expiresAt ? raw.expiresAt : void 0,
+    lastReferencedAt: typeof raw.lastReferencedAt === "string" && raw.lastReferencedAt ? raw.lastReferencedAt : void 0,
+    sensitivity: isValidSensitivity(raw.sensitivity) ? raw.sensitivity : "low",
+    approved: raw.approved === true,
+    redactedKinds: Array.isArray(raw.redactedKinds) ? raw.redactedKinds.filter((x) => typeof x === "string") : void 0
+  };
+}
+function legacyEntriesFromMarkdown(configDir) {
+  const file = memoryMarkdownPath(configDir);
+  if (!existsSync(file)) return [];
+  const content = readFileSync(file, "utf-8").trim();
+  if (!content) return [];
+  const parts = content.split(/\n(?=##\s+\d{4}-\d{2}-\d{2})/g);
+  const chunks = parts.length > 1 ? parts : [content];
+  return chunks.map((chunk, index) => {
+    const match = chunk.match(/^##\s+([^\n]+)\n([\s\S]*)$/);
+    const body = (match ? match[2] : chunk).trim();
+    const parsed = match ? Date.parse(match[1].replace(" ", "T")) : NaN;
+    const createdAt = Number.isFinite(parsed) ? new Date(parsed).toISOString() : nowIso();
+    const id = "legacy-" + createHash("sha1").update(`${index}
+${chunk}`).digest("hex").slice(0, 12);
+    return normalizeEntry({ id, content: body, scope: "personal", createdAt, updatedAt: createdAt, sensitivity: "low", approved: true });
+  }).filter((entry) => Boolean(entry));
+}
+function loadMemoryEntries(configDir) {
+  const file = memoryStorePath(configDir);
+  if (!existsSync(file)) return legacyEntriesFromMarkdown(configDir);
+  const text = readFileSync(file, "utf-8").trim();
+  if (!text) return [];
+  const entries = [];
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const entry = normalizeEntry(JSON.parse(trimmed));
+      if (entry) entries.push(entry);
+    } catch {
+    }
+  }
+  return entries;
+}
+function saveMemoryEntries(configDir, entries) {
+  mkdirSync(configDir, { recursive: true });
+  const jsonl = entries.map((entry) => JSON.stringify(entry)).join("\n");
+  atomicWriteFileSync(memoryStorePath(configDir), jsonl ? jsonl + "\n" : "");
+}
+function isMemoryExpired(entry, at = /* @__PURE__ */ new Date()) {
+  return Boolean(entry.expiresAt && Date.parse(entry.expiresAt) <= at.getTime());
+}
+function isMemoryVisibleInProject(entry, cwd = process.cwd()) {
+  if (entry.scope !== "project") return true;
+  return entry.sourceProject === getProjectKey(cwd);
+}
+function listMemoryEntries(configDir, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  return loadMemoryEntries(configDir).filter((entry) => options.includeRejected || entry.approved).filter((entry) => options.includeExpired || !isMemoryExpired(entry)).filter((entry) => isMemoryVisibleInProject(entry, cwd));
+}
+function addMemoryEntry(configDir, content, options = {}) {
+  const original = content.trim();
+  if (!original) throw new Error("memory content is required");
+  const redact = options.redact ?? true;
+  const redacted = redact ? redactString(original, { enabled: true, patterns: options.patterns ?? DEFAULT_PATTERNS, customRegexes: options.customPatterns }) : { redacted: original, hits: [] };
+  const sensitivity = options.sensitivity ?? (redacted.hits.length > 0 ? "high" : "low");
+  const approved = options.approved ?? (sensitivity === "low" && redacted.hits.length === 0 && options.source !== "tool");
+  const scope = options.scope ?? "personal";
+  const timestamp = nowIso();
+  const entry = {
+    id: randomUUID(),
+    content: redacted.redacted.trim(),
+    scope,
+    source: options.source,
+    sourceSession: options.sourceSession,
+    sourceProject: scope === "project" ? getProjectKey(options.cwd) : void 0,
+    createdAt: timestamp,
+    updatedAt: timestamp,
+    expiresAt: options.expiresAt,
+    sensitivity,
+    approved,
+    redactedKinds: [...new Set(redacted.hits.map((hit) => hit.kind))]
+  };
+  const entries = loadMemoryEntries(configDir);
+  entries.push(entry);
+  saveMemoryEntries(configDir, entries);
+  return entry;
+}
+function updateMemoryEntry(configDir, idPrefix, newContent, options = {}) {
+  const content = newContent.trim();
+  if (!content) throw new Error("memory content is required");
+  const entries = loadMemoryEntries(configDir);
+  const entry = findUnique(entries, idPrefix);
+  const redact = options.redact ?? true;
+  const redacted = redact ? redactString(content, { enabled: true, patterns: options.patterns ?? DEFAULT_PATTERNS, customRegexes: options.customPatterns }) : { redacted: content, hits: [] };
+  entry.content = redacted.redacted.trim();
+  entry.updatedAt = nowIso();
+  entry.redactedKinds = [...new Set(redacted.hits.map((hit) => hit.kind))];
+  if (redacted.hits.length > 0) {
+    entry.sensitivity = "high";
+    entry.approved = false;
+  } else if (options.source === "tool") {
+    entry.approved = false;
+  }
+  saveMemoryEntries(configDir, entries);
+  return entry;
+}
+function updateMemoryApproval(configDir, idPrefix, approved) {
+  const entries = loadMemoryEntries(configDir);
+  const entry = findUnique(entries, idPrefix);
+  entry.approved = approved;
+  entry.updatedAt = nowIso();
+  saveMemoryEntries(configDir, entries);
+  return entry;
+}
+function deleteMemoryEntry(configDir, idPrefix) {
+  const entries = loadMemoryEntries(configDir);
+  const entry = findUnique(entries, idPrefix);
+  saveMemoryEntries(configDir, entries.filter((candidate) => candidate.id !== entry.id));
+  return entry;
+}
+function expireMemoryEntry(configDir, idPrefix, expiresAt = nowIso()) {
+  const entries = loadMemoryEntries(configDir);
+  const entry = findUnique(entries, idPrefix);
+  entry.expiresAt = expiresAt;
+  entry.updatedAt = nowIso();
+  saveMemoryEntries(configDir, entries);
+  return entry;
+}
+function countPendingMemories(configDir) {
+  return loadMemoryEntries(configDir).filter((entry) => !entry.approved && !isMemoryExpired(entry)).length;
+}
+function clearMemoryEntries(configDir) {
+  const entries = loadMemoryEntries(configDir);
+  const storePath = memoryStorePath(configDir);
+  let backupPath = null;
+  if (entries.length > 0) {
+    const sourceFile = existsSync(storePath) ? storePath : memoryMarkdownPath(configDir);
+    if (existsSync(sourceFile)) {
+      backupPath = `${sourceFile}.bak.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+      copyFileSync(sourceFile, backupPath);
+    }
+  }
+  mkdirSync(configDir, { recursive: true });
+  atomicWriteFileSync(storePath, "");
+  atomicWriteFileSync(memoryMarkdownPath(configDir), "");
+  return { backupPath, cleared: entries.length };
+}
+function exportMemoryEntries(configDir, cwd = process.cwd(), format = "json") {
+  if (format === "md") {
+    const active = listMemoryEntries(configDir, { cwd }).filter((entry) => entry.approved && !isMemoryExpired(entry));
+    return renderMemoryMarkdown(active);
+  }
+  return JSON.stringify(listMemoryEntries(configDir, { cwd, includeExpired: true, includeRejected: true }), null, 2);
+}
+function findUnique(entries, idPrefix) {
+  const matches = entries.filter((entry) => entry.id.startsWith(idPrefix));
+  if (matches.length === 0) throw new Error(`memory id not found: ${idPrefix}`);
+  if (matches.length > 1) throw new Error(`memory id is ambiguous: ${idPrefix}`);
+  return matches[0];
+}
+function renderMemoryMarkdown(entries) {
+  return entries.map((entry) => {
+    const date = entry.createdAt.replace("T", " ").slice(0, 19);
+    const source = [
+      `id:${entry.id.slice(0, 8)}`,
+      `scope:${entry.scope}`,
+      entry.source ? `source:${entry.source}` : "",
+      entry.sourceSession ? `session:${entry.sourceSession.slice(0, 8)}` : "",
+      entry.sourceProject ? `project:${entry.sourceProject}` : "",
+      `sensitivity:${entry.sensitivity}`
+    ].filter(Boolean).join(" \xB7 ");
+    return `## ${date}
+<!-- ${source} -->
+${entry.content}
+`;
+  }).join("\n");
+}
+function syncLegacyMarkdown(configDir, entries = loadMemoryEntries(configDir)) {
+  mkdirSync(dirname(memoryMarkdownPath(configDir)), { recursive: true });
+  const active = entries.filter((entry) => entry.approved && !isMemoryExpired(entry));
+  atomicWriteFileSync(memoryMarkdownPath(configDir), renderMemoryMarkdown(active));
+}
+function formatMemoryForPrompt(configDir, cwd = process.cwd(), maxChars = MEMORY_MAX_CHARS) {
+  const entries = listMemoryEntries(configDir, { cwd }).filter((entry) => entry.approved && !isMemoryExpired(entry));
+  if (entries.length === 0) return null;
+  let content = entries.map((entry) => {
+    const meta = [
+      `id ${entry.id.slice(0, 8)}`,
+      entry.scope,
+      entry.source ?? "unknown",
+      entry.createdAt.slice(0, 10)
+    ].join(" \xB7 ");
+    return `## ${meta}
+${entry.content}`;
+  }).join("\n\n");
+  let entryCount = entries.length;
+  let truncated = false;
+  if (content.length > maxChars) {
+    truncated = true;
+    content = content.slice(-maxChars);
+    const firstEntry = content.indexOf("\n## ");
+    if (firstEntry !== -1) content = content.slice(firstEntry + 1);
+    entryCount = Math.max(1, (content.match(/^## /gm) ?? []).length);
+    content = `(Note: persistent memory exceeded the ${maxChars}-char budget \u2014 showing the newest ${entryCount} of ${entries.length} entries; older entries were dropped. The user can prune with /memory show and /memory delete <id>.)
+
+` + content;
+  }
+  return { content, entryCount, totalCount: entries.length, truncated };
+}
+function findSimilarMemory(entries, content) {
+  const normalize = (s) => s.toLowerCase().replace(/\s+/g, " ").trim();
+  const target = normalize(content);
+  if (target.length < 8) return null;
+  for (const entry of entries) {
+    const existing = normalize(entry.content);
+    if (existing === target || existing.includes(target) || target.includes(existing)) return entry;
+  }
+  return null;
+}
+function listOrphanedProjectMemories(configDir) {
+  return loadMemoryEntries(configDir).filter((entry) => entry.scope === "project" && entry.sourceProject !== void 0 && !existsSync(entry.sourceProject));
+}
+function rebindMemoryProject(configDir, idPrefix, newProjectPath) {
+  const entries = loadMemoryEntries(configDir);
+  const entry = findUnique(entries, idPrefix);
+  if (entry.scope !== "project") throw new Error(`memory ${entry.id.slice(0, 8)} is not project-scoped (scope: ${entry.scope})`);
+  entry.sourceProject = getProjectKey(resolve(newProjectPath));
+  entry.updatedAt = nowIso();
+  saveMemoryEntries(configDir, entries);
+  return entry;
+}
+function detectStaleLegacyMarkdownEdit(configDir) {
+  const jsonlPath = memoryStorePath(configDir);
+  const mdPath = memoryMarkdownPath(configDir);
+  if (!existsSync(jsonlPath) || !existsSync(mdPath)) return false;
+  try {
+    if (!readFileSync(mdPath, "utf-8").trim()) return false;
+    const jsonlMtime = statSync(jsonlPath).mtimeMs;
+    const mdMtime = statSync(mdPath).mtimeMs;
+    return mdMtime > jsonlMtime + 2e3;
+  } catch {
+    return false;
+  }
+}
+function touchMemoryReferences(configDir, ids) {
+  if (ids.length === 0) return;
+  const wanted = new Set(ids);
+  const entries = loadMemoryEntries(configDir);
+  let changed = false;
+  const ts = nowIso();
+  for (const entry of entries) {
+    if (wanted.has(entry.id)) {
+      entry.lastReferencedAt = ts;
+      changed = true;
+    }
+  }
+  if (changed) saveMemoryEntries(configDir, entries);
+}
+function isMemoryStale(entry, days, at = /* @__PURE__ */ new Date()) {
+  const reference = Date.parse(entry.lastReferencedAt ?? entry.updatedAt);
+  if (!Number.isFinite(reference)) return false;
+  return at.getTime() - reference > days * 864e5;
+}
+function tokenizeQuery(query) {
+  const tokens = [];
+  for (const word of query.toLowerCase().split(/\s+/).filter(Boolean)) {
+    const cjkRuns = word.match(/[一-鿿぀-ヿ가-힯]+/g) ?? [];
+    const nonCjk = word.replace(/[一-鿿぀-ヿ가-힯]+/g, " ").split(/\s+/).filter((t) => t.length >= 2);
+    tokens.push(...nonCjk);
+    for (const run of cjkRuns) {
+      if (run.length === 1) tokens.push(run);
+      for (let i = 0; i + 2 <= run.length; i++) tokens.push(run.slice(i, i + 2));
+    }
+  }
+  return [...new Set(tokens)];
+}
+function searchPersistentMemories(configDir, query, cwd = process.cwd(), limit = 3) {
+  const tokens = tokenizeQuery(query);
+  if (tokens.length === 0) return [];
+  const entries = listMemoryEntries(configDir, { cwd }).filter((entry) => entry.approved && !isMemoryExpired(entry));
+  const hits = [];
+  for (const entry of entries) {
+    const haystack = entry.content.toLowerCase();
+    const matched = tokens.filter((token) => haystack.includes(token)).length;
+    const score = matched / tokens.length;
+    if (score >= 0.34) hits.push({ entry, score });
+  }
+  return hits.sort((a, b) => b.score - a.score).slice(0, limit);
+}
+function backupMemoryStore(configDir, outPath) {
+  const entries = loadMemoryEntries(configDir);
+  if (entries.length === 0) throw new Error("memory is empty \u2014 nothing to back up");
+  const storePath = memoryStorePath(configDir);
+  if (!existsSync(storePath)) saveMemoryEntries(configDir, entries);
+  const backupPath = outPath ?? `${storePath}.bak.${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+  copyFileSync(storePath, backupPath);
+  return { backupPath, count: entries.length };
+}
+function restoreMemoryEntries(configDir, filePath) {
+  const text = readFileSync(filePath, "utf-8").trim();
+  if (!text) throw new Error(`restore file is empty: ${filePath}`);
+  let rawItems;
+  try {
+    const parsed = JSON.parse(text);
+    rawItems = Array.isArray(parsed) ? parsed : [parsed];
+  } catch {
+    rawItems = text.split("\n").map((line) => {
+      try {
+        return JSON.parse(line.trim());
+      } catch {
+        return null;
+      }
+    }).filter((x) => x !== null);
+  }
+  const candidates = rawItems.map((item) => normalizeEntry(item)).filter((entry) => Boolean(entry));
+  if (candidates.length === 0) throw new Error(`no valid memory entries found in ${filePath}`);
+  const existing = loadMemoryEntries(configDir);
+  const existingIds = new Set(existing.map((entry) => entry.id));
+  let backupPath = null;
+  if (existing.length > 0) {
+    backupPath = backupMemoryStore(configDir).backupPath;
+  }
+  let imported = 0;
+  let skipped = 0;
+  for (const candidate of candidates) {
+    if (existingIds.has(candidate.id)) {
+      skipped++;
+      continue;
+    }
+    const redacted = redactString(candidate.content, { enabled: true, patterns: DEFAULT_PATTERNS });
+    if (redacted.hits.length > 0) {
+      candidate.content = redacted.redacted.trim();
+      candidate.sensitivity = "high";
+      candidate.approved = false;
+      candidate.redactedKinds = [...new Set(redacted.hits.map((hit) => hit.kind))];
+    }
+    existing.push(candidate);
+    existingIds.add(candidate.id);
+    imported++;
+  }
+  saveMemoryEntries(configDir, existing);
+  return { imported, skipped, backupPath };
+}
+
+export {
+  parseWritableScope,
+  memoryStorePath,
+  memoryMarkdownPath,
+  getProjectKey,
+  loadMemoryEntries,
+  isMemoryExpired,
+  isMemoryVisibleInProject,
+  listMemoryEntries,
+  addMemoryEntry,
+  updateMemoryEntry,
+  updateMemoryApproval,
+  deleteMemoryEntry,
+  expireMemoryEntry,
+  countPendingMemories,
+  clearMemoryEntries,
+  exportMemoryEntries,
+  renderMemoryMarkdown,
+  syncLegacyMarkdown,
+  formatMemoryForPrompt,
+  findSimilarMemory,
+  listOrphanedProjectMemories,
+  rebindMemoryProject,
+  detectStaleLegacyMarkdownEdit,
+  touchMemoryReferences,
+  isMemoryStale,
+  searchPersistentMemories,
+  backupMemoryStore,
+  restoreMemoryEntries
+};

package/dist/{chunk-IV6GCDVR.js → chunk-X73Y4JZI.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-SMQHEJSH.js";
+} from "./chunk-66CE3E6X.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";
@@ -131,6 +131,12 @@ var ConfigSchema = z.object({
     projectDocMaxBytes: z.number().int().positive().default(32 * 1024),
     showLoadedContextSources: z.boolean().default(false)
   }).default({}),
+  // 持久记忆注入配置（MEM-005）
+  // maxChars: 注入 system prompt 的字符预算，超出丢最老条目并显式标注截断。
+  // 注意 CJK ≈ 1 字符/token——中文记忆的 token 开销约等于字符数。
+  memory: z.object({
+    maxChars: z.number().int().positive().max(2e5).default(1e4)
+  }).default({}),
   // Google Custom Search API 的 Search Engine ID (cx 参数)
   // API Key 通过 apiKeys['google-search'] 或 AICLI_API_KEY_GOOGLESEARCH 环境变量配置
   // CX 也可通过 AICLI_GOOGLE_CX 环境变量覆盖

package/dist/chunk-YVTASHS5.js

@@ -0,0 +1,121 @@
+// src/security/redactor.ts
+var DEFAULT_PATTERNS = [
+  // password: xxx / password = xxx / password="xxx"
+  // Covers YAML / JSON / shell-ish / env-file forms.
+  { kind: "password", regex: /\b(password|passwd|pwd)\s*[:=]\s*["']?([^\s"',;{}]{4,200})["']?/gi },
+  // PGPASSWORD=xxx (explicit bash env-var form, separate rule because no quotes usually)
+  { kind: "pgpassword-env", regex: /\b(PGPASSWORD)=([^\s"']{4,200})/g },
+  // JDBC/PG/MySQL/Mongo connection strings with inline credentials
+  // postgresql://user:pass@host/db → redact pass
+  { kind: "db-uri-password", regex: /(\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^:\s]+:)([^@\s]+)(@)/gi },
+  // Anthropic API keys
+  { kind: "anthropic-key", regex: /(sk-ant-[a-zA-Z0-9_-]{90,})/g },
+  // L6 (v0.4.108): Zhipu / GLM API keys — `<24+ hex/base64-ish>.<32+>`
+  // Two segments separated by a dot, each safely identifiable by length
+  // and char class. Conservative on the lower bound so we don't eat
+  // version strings like `1.0.0` or filenames.
+  { kind: "zhipu-key", regex: /\b([a-zA-Z0-9]{24,}\.[a-zA-Z0-9]{32,})\b/g },
+  // OpenAI / generic sk- keys — requires length ≥32 to avoid eating short identifiers
+  { kind: "openai-key", regex: /(sk-(?:proj-)?[a-zA-Z0-9_-]{32,})/g },
+  // GitHub personal access tokens
+  { kind: "github-pat", regex: /\b(ghp_[a-zA-Z0-9]{36})\b/g },
+  { kind: "github-oauth", regex: /\b(gho_[a-zA-Z0-9]{36})\b/g },
+  { kind: "github-install", regex: /\b(ghs_[a-zA-Z0-9]{36})\b/g },
+  // Slack tokens
+  { kind: "slack-bot", regex: /\b(xoxb-\d+-\d+-[a-zA-Z0-9]+)\b/g },
+  { kind: "slack-user", regex: /\b(xoxp-\d+-\d+-\d+-[a-zA-Z0-9]+)\b/g },
+  // AWS access key IDs (AKIA...) and secret access keys are context-dependent;
+  // we only catch the ID because secret key alone is indistinguishable from random base64.
+  { kind: "aws-access-key-id", regex: /\b(AKIA[0-9A-Z]{16})\b/g },
+  // Google API keys
+  { kind: "google-api-key", regex: /\b(AIza[0-9A-Za-z_-]{35})\b/g },
+  // Generic "api_key": "..." / "apiKey": "..." / api-key=xxx
+  { kind: "api-key", regex: /\b(api[_-]?key)\s*[:=]\s*["']?([a-zA-Z0-9_\-.]{16,200})["']?/gi },
+  // Generic token: xxx (only when value looks token-shaped; avoids eating human prose)
+  { kind: "token", regex: /\b(token|access[_-]?token|bearer[_-]?token)\s*[:=]\s*["']?([a-zA-Z0-9_\-.]{20,300})["']?/gi },
+  // Bearer <token> in Authorization headers
+  { kind: "bearer", regex: /\b(Authorization:\s*Bearer\s+)([a-zA-Z0-9_\-.=]{20,500})/g },
+  // Private key PEM blocks — catch the header+footer together
+  // P2-PERF-02: PEM bodies use strict Base64 + =\n — narrowed char class avoids backtracking
+  { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[ \t\n\r]*[A-Za-z0-9+/=\n\r-]*[ \t\n\r]*-----END [A-Z ]*PRIVATE KEY-----/g }
+];
+var MAX_CUSTOM = 32;
+var MAX_PATTERN_LEN = 500;
+var SUSPICIOUS_REDOS = /\([^)]*[+*][^)]*\)\s*[+*{]/;
+var MAX_REDACT_INPUT = 512e3;
+function render(placeholder, kind) {
+  return placeholder.replace("{kind}", kind);
+}
+function redactString(input, options) {
+  if (!options.enabled || !input) return { redacted: input, hits: [] };
+  if (input.length > MAX_REDACT_INPUT) return { redacted: input, hits: [] };
+  const placeholder = options.placeholder ?? "[REDACTED:{kind}]";
+  const customSrcs = (options.customRegexes ?? []).slice(0, MAX_CUSTOM);
+  const patterns = [
+    ...options.patterns ?? DEFAULT_PATTERNS,
+    ...customSrcs.flatMap((src, i) => {
+      if (typeof src !== "string" || src.length === 0 || src.length > MAX_PATTERN_LEN) return [];
+      try {
+        const flags = src.match(/^\/.*\/([gimsuy]*)$/)?.[1] ?? "";
+        const body = src.replace(/^\/(.*)\/[gimsuy]*$/, "$1");
+        if (SUSPICIOUS_REDOS.test(body)) return [];
+        const regex = new RegExp(body, flags.includes("g") ? flags : flags + "g");
+        return [{ kind: `custom-${i}`, regex }];
+      } catch {
+        return [];
+      }
+    })
+  ];
+  let redacted = input;
+  const hits = [];
+  for (const { kind, regex } of patterns) {
+    const rx = new RegExp(regex.source, regex.flags);
+    const captureCount = new RegExp(rx.source + "|").exec("").length - 1;
+    redacted = redacted.replace(rx, (...args) => {
+      const match = args[0];
+      const g1 = captureCount >= 1 ? args[1] : void 0;
+      const g2 = captureCount >= 2 ? args[2] : void 0;
+      const offset = args[1 + captureCount];
+      if (captureCount >= 2 && typeof g2 === "string") {
+        hits.push({ kind, start: offset + (g1?.length ?? 0), length: g2.length, secret: g2 });
+        return `${g1}${render(placeholder, kind)}`;
+      }
+      hits.push({ kind, start: offset, length: match.length, secret: g1 ?? match });
+      return render(placeholder, kind);
+    });
+  }
+  return { redacted, hits };
+}
+function redactJson(value, options) {
+  if (!options.enabled) return { value, hits: [] };
+  const allHits = [];
+  function walk(v) {
+    if (typeof v === "string") {
+      const r = redactString(v, options);
+      allHits.push(...r.hits);
+      return r.redacted;
+    }
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, vv] of Object.entries(v)) {
+        out[k] = walk(vv);
+      }
+      return out;
+    }
+    return v;
+  }
+  const redacted = walk(value);
+  return { value: redacted, hits: allHits };
+}
+function scanString(input, options) {
+  const { hits } = redactString(input, { ...options, enabled: true });
+  return hits;
+}
+
+export {
+  DEFAULT_PATTERNS,
+  redactString,
+  redactJson,
+  scanString
+};

package/dist/{ci-T2ABDMMQ.js → ci-3O3JR6FX.js}

@@ -3,14 +3,14 @@ import {
   CI_COMMENT_MARKER,
   countSeverity,
   runCi
-} from "./chunk-CHFFEVVT.js";
-import "./chunk-PGHTAKIA.js";
+} from "./chunk-QNK7GUUB.js";
+import "./chunk-DJGCG7SF.js";
 import "./chunk-HLWUDRBO.js";
 import "./chunk-QYQI7ZWK.js";
+import "./chunk-X73Y4JZI.js";
 import "./chunk-O3XSFPYH.js";
-import "./chunk-IV6GCDVR.js";
 import "./chunk-5ULLIOVC.js";
-import "./chunk-SMQHEJSH.js";
+import "./chunk-66CE3E6X.js";
 import "./chunk-IW3Q7AE5.js";
 export {
   CI_COMMENT_MARKER,

package/dist/{ci-format-S2PPU27O.js → ci-format-KGWF6KOU.js}

@@ -6,8 +6,8 @@ import {
   formatCiResult,
   formatCiSarif,
   normalizeCiThresholds
-} from "./chunk-PGHTAKIA.js";
-import "./chunk-SMQHEJSH.js";
+} from "./chunk-DJGCG7SF.js";
+import "./chunk-66CE3E6X.js";
 export {
   DEFAULT_CI_THRESHOLDS,
   detectCiGateSignals,

package/dist/{constants-RS7OUU7X.js → constants-NMFRZ5LW.js}

@@ -38,7 +38,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SMQHEJSH.js";
+} from "./chunk-66CE3E6X.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,

package/dist/{doctor-cli-TGAW6RAP.js → doctor-cli-4QUHTJZ4.js}

@@ -2,14 +2,14 @@
 import {
   formatDoctorReport,
   runDoctorCli
-} from "./chunk-3AIR7N5M.js";
+} from "./chunk-HNJX3N2V.js";
 import "./chunk-QYQI7ZWK.js";
-import "./chunk-2LLQOMMW.js";
+import "./chunk-X73Y4JZI.js";
+import "./chunk-EMFCHE2B.js";
 import "./chunk-O3XSFPYH.js";
-import "./chunk-IV6GCDVR.js";
 import "./chunk-5ULLIOVC.js";
 import "./chunk-HOSJZMQS.js";
-import "./chunk-SMQHEJSH.js";
+import "./chunk-66CE3E6X.js";
 import "./chunk-IW3Q7AE5.js";
 export {
   formatDoctorReport,