magpie-plugin-msmoli 0.2.0 → 0.3.0

package/bin/sync.mjs

@@ -1,22 +1,28 @@
 #!/usr/bin/env node
-// magpie-plugin-msmoli — 把 magpie 里已有的 ModelScope 令牌同步给签到插件，或反过来。
+// magpie-plugin-msmoli — sync the ModelScope token magpie already has to the
+// check-in plugin, or the other way round.
 //
-// 为什么有这个工具：magpie 的内置 ModelScope 预设（providers.json）和本插件
-// 的登录态（plugin-auth.json）是两处独立存储，同一把 ms- 令牌要配两次。
-// 这个工具读一次、写一次，输出里不留令牌。
+// Why this tool exists: magpie's built-in ModelScope preset (providers.json)
+// and this plugin's login state (plugin-auth.json) are two separate stores, so
+// one ms- token has to be configured twice. This tool reads once, writes once,
+// and never leaves the token in its output.
 //
-// 安全边界（改这里之前先想清楚）：
-// - 只读 magpie 的两个文件；写入一律交给 magpie 自己的 CLI
-//   （provider key / plugin login），不裸写任何 magpie 的文件——锁、备份、
-//   .bak 回退、事件通知都归 magpie 管。
-// - 令牌只走 stdin 和进程参数（provider key 的接口如此），日志里只出现
-//   掩码（前 4 + … + 后 4，与 magpie 自己的显示一致）。
-// - 宿主按令牌分账号：同一把令牌重复 login 是幂等的；换一把会新增第二个
-//   账号；logout 会登出该 provider 的全部账号。所以「两边不同」时默认
-//   拒绝改动，只有显式 --force 且插件只有一个账号时才替换。
+// Security boundaries (think these through before changing anything here):
+// - It only reads magpie's two files; every write goes through magpie's own
+//   CLI (provider key / plugin login), never by writing magpie's files
+//   directly — locks, backups, .bak rollback and event notifications are all
+//   magpie's business.
+// - The token only travels over stdin and process arguments (that is the
+//   provider key interface), and the log only shows a mask (first 4 + … + last
+//   4, matching magpie's own display).
+// - The host keys accounts by token: logging in again with the same token is
+//   idempotent; a different token adds a second account; logout signs out
+//   every account of that provider. So when the two sides differ, it refuses
+//   to change anything by default, and only replaces with an explicit --force
+//   and only one account in the plugin.
 
 import { spawnSync } from "node:child_process"
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs"
+import { closeSync, existsSync, openSync, readFileSync, readSync, realpathSync, statSync } from "node:fs"
 import { homedir, platform } from "node:os"
 import { dirname, isAbsolute, join, sep } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
@@ -24,6 +30,20 @@ import { fileURLToPath, pathToFileURL } from "node:url"
 const ID = "msmoli"
 const PRESET = "modelscope"
 const HOST = "api-inference.modelscope.cn"
+// the only site the built-in preset and the vendors this tool recognises serve
+const CN_SITE = "https://modelscope.cn"
+
+// VERSION is what --version answers. Read from the package's own manifest so
+// the two can never drift — a published tarball carries package.json beside
+// bin/, and so does a clone. An unreadable manifest is not a reason to fail a
+// version question: the answer is just unknown.
+const VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8")).version ?? "unknown"
+  } catch {
+    return "unknown"
+  }
+})()
 
 const USAGE = `magpie-plugin-msmoli — 把 magpie 里已有的 ModelScope 令牌同步给签到插件
 
@@ -40,29 +60,39 @@ const USAGE = `magpie-plugin-msmoli — 把 magpie 里已有的 ModelScope 令
   --status      只报告，不执行
   --dry-run     打印将要执行的命令，不执行
   -h, --help    这一页
+  -v, --version 打印版本号
 
 令牌不会出现在输出里。写入一律走 magpie 自己的 CLI。`
 
 function parseArgs(argv) {
-  const out = { dir: "", magpie: "", from: "", to: "", force: false, dryRun: false, status: false, help: false }
+  const out = { dir: "", magpie: "", from: "", to: "", force: false, dryRun: false, status: false, help: false, version: false }
   // help wins over everything else on the line: `--help --nope` and
-  // `--nope --help` should show the page, not an error about --nope
+  // `--nope --help` should show the page, not an error about --nope. Version
+  // is the same courtesy one step down: it is how a packaged CLI answers
+  // "which one am I running", and a stray argument beside it should not turn
+  // that into an error.
   if (argv.includes("-h") || argv.includes("--help")) return { ...out, help: true }
+  if (argv.includes("-v") || argv.includes("--version")) return { ...out, version: true }
   // A flag is not a value. `--dir --dry-run` would otherwise take "--dry-run"
   // as the folder and then fail somewhere far from the mistake, and
   // `--dir ""` would read as "not given" and silently fall back to the
   // machine's own magpie — writing a credential to a target nobody named.
-  const take = (i) => {
+  const take = (i, flag) => {
     const v = argv[i]
     // A single "-h" or "-x" is a flag too: `--dir -h` must not put "-h" in
     // the folder position and silently look there.
-    if (v === undefined || v.trim() === "" || v.startsWith("-")) throw new Error(`缺少值：${argv[i - 1]} 后面要跟一个参数`)
+    if (v === undefined || v.trim() === "" || v.startsWith("-")) throw new Error(`缺少值：${flag} 后面要跟一个参数`)
     return v
   }
   // A value flag given twice is refused, as the two directions are: the
   // second silently winning dropped the first, and `--magpie A --magpie B`
   // wrote through B with nothing said. `--dir=x` is read as `--dir x`.
   const VALUE = { "--dir": "dir", "--magpie": "magpie", "--from": "from" }
+  // hasOwn, not `VALUE[a]`: a plain object literal answers for "constructor",
+  // "toString", "__proto__" and the rest of Object's own names, so those were
+  // taken as value flags and silently accepted while every other unknown
+  // argument was refused.
+  const isValue = (k) => Object.hasOwn(VALUE, k)
   const seen = new Set()
   const set = (flag, v) => {
     if (seen.has(flag)) throw new Error(`${flag} 只能给一次`)
@@ -73,13 +103,14 @@ function parseArgs(argv) {
     const a = argv[i]
     const eq = a.indexOf("=")
     const flag = eq > 0 ? a.slice(0, eq) : ""
-    if (flag && VALUE[flag]) {
+    if (flag && isValue(flag)) {
       const v = a.slice(eq + 1)
       if (v.trim() === "" || v.startsWith("-")) throw new Error(`缺少值：${flag}= 后面要跟一个参数`)
       set(flag, v)
-    } else if (VALUE[a]) set(a, take(++i))
+    } else if (isValue(a)) set(a, take(++i, a))
     else if (a === "--to-plugin" || a === "--to-preset") {
-      // 两个方向同时给时后者静默获胜，等于悄悄丢掉前一个：说清楚比择一好
+      // When both directions are given, the later one silently wins and the
+      // earlier is quietly dropped: saying so is better than picking one
       const want = a === "--to-plugin" ? "plugin" : "preset"
       if (out.to && out.to !== want) throw new Error("--to-plugin 与 --to-preset 只能给一个")
       out.to = want
@@ -92,8 +123,9 @@ function parseArgs(argv) {
   return out
 }
 
-// ---- 探测：与 magpie 的 appdir 对齐。便携版认可执行文件旁的 data/ 或
-// .portable；安装版认 $XDG_CONFIG_HOME/magpie，否则 ~/.config/magpie。
+// ---- discovery: aligned with magpie's appdir. The portable build accepts a
+// data/ folder or a .portable file beside the executable; the installed build
+// accepts $XDG_CONFIG_HOME/magpie, otherwise ~/.config/magpie.
 
 export function findMagpieBin({ env = process.env, os = platform(), exists = existsSync, home = homedir() } = {}) {
   const cands = []
@@ -287,7 +319,8 @@ export function findConfigDir({
   return looksLikeMagpie(d, exists) ? d : ""
 }
 
-// ---- 读：只读，剥 BOM（magpie 自己也这么做），读不动就当没有
+// ---- reading: read-only, strips the BOM (magpie does the same), and treats
+// an unreadable file as absent
 
 // readJson returns undefined for "not there", null for "there but unreadable".
 // The two are not the same decision: a file that exists and doesn't parse may
@@ -302,7 +335,7 @@ export function readJson(file, exists = existsSync) {
   }
 }
 
-// ---- 领域逻辑（纯函数，导出给测试）
+// ---- domain logic (pure functions, exported for the tests)
 
 // mask reveals only the ends. Under 12 characters there is no middle worth
 // hiding and no tail worth showing: 8 characters would print the whole thing
@@ -318,30 +351,60 @@ export const mask = (t) => {
   return `${show(t.slice(0, 4))}…${show(t.slice(-4))}`
 }
 
-// 内置侧的候选：默认先认 id/preset=modelscope（magpie 预设的正规路径），没有
-// 再按推理域名认用户自建的 vendor。--from 是消歧手段，必须只认 id——默认搜索
-// 按 preset 匹配才产生歧义，消歧若还按 preset 就永远解不开（演练抓出的 bug）。
-// 多于一个候选时工具不猜。
+// The preset-side candidates: by default it accepts id/preset=modelscope first
+// (magpie's proper preset path), and otherwise recognises a user-built vendor
+// by its inference hostname. --from disambiguates and must match by id only —
+// the default search matching by preset is what creates the ambiguity, and a
+// disambiguation that also matched by preset could never resolve it (a bug the
+// rehearsal caught). With more than one candidate the tool does not guess.
 //
-// 域名按 hostname 精确比较，不是子串：includes() 对
-// "api-inference.modelscope.cn.evil.tld" 也为真，而那会把真令牌写进一个
-// chat 指向第三方的 provider（--to-preset）或把第三方的 key 当 cookie 发给
-// modelscope.cn（--to-plugin）。
+// The hostname is compared exactly, not as a substring: includes() is also
+// true for "api-inference.modelscope.cn.evil.tld", and that would write the
+// real token into a provider whose chat points at a third party (--to-preset)
+// or send a third party's key as a cookie to modelscope.cn (--to-plugin).
 //
-// --from 只在这道校验**之内**挑一个：它先是「内置侧」的候选，然后才是消歧。
-// 早先它短路在域名校验之前，于是 `--from openai` 会把 OpenAI 的 key 登录给
-// 插件、或用 ms 令牌覆盖掉那个第三方 provider —— 两个方向都静默写错凭据。
-export function presetCandidates(providers, from = "") {
+// --from picks one **inside** that check: it is a "preset-side" candidate
+// first, and only then a disambiguation. It used to short-circuit before the
+// hostname check, so `--from openai` would log OpenAI's key into the plugin,
+// or overwrite that third-party provider with an ms token — both directions
+// silently writing the wrong credential.
+// The key is a source-side requirement (--to-plugin needs a token to hand
+// over), not a destination-side one: a provider that is ours but has an empty
+// key is exactly what --to-preset is meant to fill. `keyed` is that switch;
+// main passes false for the reverse direction. With --from the same rule
+// holds — an id the user named that is ours is a destination even without a
+// key, while --to-plugin must still refuse one that has no token.
+export function presetCandidates(providers, from = "", keyed = true) {
   const list = Array.isArray(providers) ? providers : []
   // the key is trimmed where it is read: a token pasted with a trailing
   // newline is the same token, and every comparison and every stdin below
   // must see that one — the check-in plugin trims it too (tokenOf), so the
   // two halves of the tool otherwise disagree about the same credential
-  const out = (ps) => ps.map((p) => ({ ...p, key: p.key.trim() }))
-  if (from) return out(list.filter((p) => keyedOf(p) && p.id === from && oursOf(p)))
-  const byId = list.filter((p) => keyedOf(p) && (p.id === PRESET || p.preset === PRESET))
+  // keyRaw keeps the type as written. key is the string the rest of the tool
+  // compares with, but normalizing a non-string to "" here made every
+  // downstream type check read "an empty slot with nothing to lose" — the
+  // refusal in planToPreset could not be reached from the command line, and
+  // --to-plugin's own check was skipped too.
+  const out = (ps) =>
+    ps.map((p) => ({
+      ...p,
+      key: typeof p.key === "string" ? p.key.trim() : "",
+      // only a key of another type carries its raw value: a string's own
+      // spelling is `key`, trimmed
+      ...(typeof p.key === "string" ? {} : { keyRaw: p.key }),
+    }))
+  // An entry that is not an object (a null in the list, a string) is not a
+  // provider: it is dropped before anything reads p.id, and dropping it
+  // filters it here the way keyedOf does for --to-plugin, rather than leaving
+  // --to-preset (keyed=false) to dereference the null and crash with a raw
+  // TypeError the refusal that stands over every other malformed file never
+  // gets to say
+  const entry = (p) => p !== null && typeof p === "object" && !Array.isArray(p)
+  const usable = (p) => entry(p) && (!keyed || keyedOf(p))
+  if (from) return out(list.filter((p) => usable(p) && p.id === from && oursOf(p)))
+  const byId = list.filter((p) => usable(p) && (p.id === PRESET || p.preset === PRESET))
   if (byId.length) return out(byId)
-  return out(list.filter((p) => keyedOf(p) && hostOf(p.chat) === HOST))
+  return out(list.filter((p) => usable(p) && hostOf(p.chat) === HOST))
 }
 
 // show is what goes to the terminal: a provider id or a file's path comes
@@ -359,11 +422,175 @@ export function presetCandidates(providers, from = "") {
 // two, each piece under the floor, and both were printed whole. A line break
 // still ends a run — a token never spans one.
 const INV = String.raw`(?:(?![\n\r])[\p{Cc}\p{Cf}])`
-const invisible = (c) => /[\p{Cc}\p{Cf}]/u.test(c)
-const tokenShaped = new RegExp(String.raw`m${INV}*s${INV}*-(?:${INV}*[\x21-\x7e]){11,}`, "gu")
+const tokenShaped = new RegExp(String.raw`m${INV}*s${INV}*-(?:${INV}*[\x21-\x7e]){11,}`, "giu")
+// A key cut into pieces by whitespace is still one key, and the key starts
+// where the ms- front does. The value may carry anything before it: the flag
+// it was pasted behind ("--token=ms-01234 56789abc …"), a path (--dir
+// "/tmp/ms-01234 56789abc …"), an account id ("msmoli#ms-…"), or a sentence a
+// child printed around it ("no key ms-… for provider"). Masking the whole
+// value hid the flag or the folder the user meant to see; not joining across
+// the cut left the tail in pieces each under every floor, and the longest of
+// them (15 characters) was printed whole. So the key is everything from its
+// front to the end of the value, and what came before it keeps its shape.
+// how a cut arrives: a space, tab or line break, a no-break or ideographic
+// space, a middot or a bullet, or a slash. One or two in a row is a cut;
+// three or more ("a   b") is a frame, and ends the run. A piece is a stretch
+// between cuts; control and format characters are not a cut's spelling, and a
+// value carrying one is left to the per-word pass.
+const CUT_RUN = /[ \t\r\n\u00a0\u3000·•∙‧・/]+/g
+const CUT_ONE = /^[ \t\r\n\u00a0\u3000·•∙‧・/]+/
+const PIECE = /[^ \t\r\n\u00a0\u3000·•∙‧・/]+/g
+const KEYCHARS = /^[A-Za-z0-9+/=_.-]+$/
+// RUNCUT is the length at which a run is long enough to be a key: the floor
+// every reading asks for, and all a mask needs to show
+const RUNCUT = 20
+
+// spacedKey reads one value as a key cut into pieces by whitespace (or a
+// middot, a slash): from the key's front to the first piece that is not key
+// material. The front is found in the value with its cuts taken out, so it is
+// found cut anywhere ("m s - 0 1 …", "ghp·_12…"), and what came before it and
+// after the key keeps its shape. Exactly one front: a value carrying two is
+// two keys already, and the per-word pass masks each.
+//
+// A piece of four or more letters is prose and ends the run, unless it is a
+// bare piece of a front ("ghp" then "_12" is a cut, and "sk-a nt-a pi03" is a
+// key whose body is all its pieces) or the body so far already reads as a key.
+// A piece of three or more digits with no digit before it is a version
+// ("ms-access 2019"), not key material. A run already RUNCUT long is not
+// extended by prose: the mask covers 20 characters as well as 40.
+const VERNUM = /^\d{3,}$/
+const PROSE = /^[A-Za-z]{3,}$/
+const FRONT_PIECE = /^(?:m|s|k|ms|sk|s-|g|h|p|u|r|o|x|ox|a|i|l|ali|as|akia|aida|ghp|gho|ghu|ghs|ghr|xox|asia)$/i
+
+function spacedKey(s) {
+  // a control or format character is not a cut's spelling (a key with one in
+  // it is one word); a line break is, and is read like a space
+  if (/(?:(?![\n\r])[\p{Cc}\p{Cf}])/u.test(s)) return null
+  // the pieces, and where each starts in the value
+  const pieces = []
+  for (const m of s.matchAll(PIECE)) pieces.push({ text: m[0], at: m.index })
+  if (pieces.length < 2) return null
+  const joined = pieces.map((p) => p.text).join("")
+  const at = joined.search(/ms-/i)
+  const sk = joined.search(/sk-/i)
+  const frontAt = at >= 0 ? at : sk
+  if (frontAt < 0) return null
+  // exactly one front of its kind: two is two keys already
+  const mine = at >= 0 ? /ms-/gi : /sk-/gi
+  if ([...joined.matchAll(mine)].length !== 1) return null
+  // where in the value the front starts (the index in the joined string, not
+  // an index in the value: the pieces keep the gaps between them)
+  let cum = 0
+  let start = -1
+  let idx = -1
+  for (let k = 0; k < pieces.length; k += 1) {
+    if (frontAt >= cum && frontAt < cum + pieces[k].text.length) {
+      start = pieces[k].at + (frontAt - cum)
+      idx = k
+      break
+    }
+    cum += pieces[k].text.length
+  }
+  if (start < 0) return null
+  // the key's own characters from the front; a digit is what separates a key
+  // cut into pieces from a name with a version after it
+  const bodyFrom = (i) => s.slice(start, i).replace(CUT_RUN, "")
+  // the key's own span, not the rest of the line: a bracket, a comma or a
+  // Chinese character abutting the key's end is the text's, and judging the
+  // whole remainder as key material refused a valid key ("(sk-ant-…vTuH)")
+  const headSpan = /^[A-Za-z0-9+/=_.-]*/.exec(joined.slice(frontAt + 3))[0]
+  if (headSpan.length < 11 || !/\d/.test(headSpan)) return null
+  // walk forward: a piece is part of the key while it is key characters and
+  // not prose; a gap joins them only when it is a cut (one or two characters).
+  // The walk starts at the end of the piece the front's own characters sit in:
+  // the rest of that piece ("--ms-01234567") is the key's first body, not a
+  // gap
+  if (idx < 0) return null
+  // the front's own characters, then whatever of its piece follows them with
+  // no gap ("ms-aaaa1111", "--ms-01234"): the key begins right after its
+  // front, so the rest of that piece is key material, not filler
+  let end = start + 3
+  while (end < s.length && !CUT_ONE.test(s[end]) && KEYCHARS.test(s[end])) end += 1
+  // how long the front is ("ms-", "sk-", "ghp_"), for the walk's prose rule
+  const frontLen = (joined.slice(frontAt).match(/^(?:ms-|sk-|gh[pousr]_|xox[abposr]-|akia|asia|aida)/i)?.[0] ?? "").length
+  let bare = false
+  let strong = false
+  for (let guard = 0; guard < 512 && idx < pieces.length - 1; guard += 1) {
+    // whether the body read so far already reads as a key. Asked before the gap
+    // is judged, not after: the readings that step over a frame (a bracket in
+    // the cut, a punctuation-marked cut) are worth taking only once it does, and
+    // asking at the end of the loop meant the first cut was judged with the
+    // answer still false — "…KbwtX9( ZqLmNeR2vTuH" lost its second half there
+    strong = strong || isKey(bodyFrom(end))
+    // the gap before the next piece: one cut joins, a short run of cuts joins
+    // too (the card's own separator is a middot with a space either side,
+    // " · ", three characters, and a key cut by one is still one key), and a
+    // long run is a frame; any other character ("--ms-", "#ms-", "/tmp/ms-",
+    // a path segment) is the same filler, once the body reads as a key
+    // a gap longer than three joins only after the body reads as a key, and
+    // then only a middot's spelling ("a····b"): a run of cuts that is no
+    // separator ("a---b") is the frame a display draws instead of a hidden
+    // piece, and the pieces after it are printed as written
+    let gap = CUT_ONE.exec(s.slice(end))
+    // a key cut by a space with a closing frame in the cut ("…KbwtX9( ZqLmNeR2vTuH")
+    // is still one key: the bracket is the cut's, and stopping at it left the
+    // second half on the terminal. Read across only once the body already reads
+    // as a key, so a sentence's bracket is not a cut
+    if (!gap && strong) {
+      const bridged = /^[^\sA-Za-z0-9]{1,2}[ \t\r\n\u00a0\u3000]+/.exec(s.slice(end))
+      if (bridged) gap = bridged
+    }
+    if (!gap) break
+    if (gap[0].length > 3 && (!strong || gap[0].length > 5)) break
+    idx += 1
+    // the piece's own key span: what follows it inside the piece ("vTuH)" ,
+    // "abc," , "…无效") is the text's frame, not the key
+    // a bracket opened inside the cut ("…Kbwt (X9ZqLmNeR2vTuH") is the cut's
+    // too, once the body reads as a key; the piece's key span starts after it
+    const lead = strong ? (/^[^\sA-Za-z0-9]{1,2}/.exec(pieces[idx].text)?.[0].length ?? 0) : 0
+    const piece = /^[A-Za-z0-9+/=_.-]*/.exec(pieces[idx].text.slice(lead))[0]
+    if (!piece) break
+    if (VERNUM.test(piece) && !/\d/.test(bodyFrom(end))) break
+    // a piece of three or more letters is prose and ends the run ("no key
+    // ms-… for provider" keeps its frame), unless it is the piece a bare
+    // front was cut into ("sk" then "ant" is a cut, not a word)
+    // prose ends the run even after a bare front: "sk-preset-20261031 is a
+    // provider id" is a sentence, and a key whose pieces are letters is read
+    // by the reading that masks the whole body ("sk-a nt-a pi03", below)
+    // a front's own letters ("ant", "sk", "ghp") are not prose: the walk
+    // reads past them while the front has not been completed yet
+    if (PROSE.test(piece) && (frontLen === 0 || bodyFrom(end).length >= frontLen)) break
+    end = pieces[idx].at + lead + piece.length
+    bare = bare || FRONT_PIECE.test(piece)
+  }
+  const body = bodyFrom(end)
+  if (body.length <= 3 || !/\d/.test(body)) return null
+  // a vendor front that carries more than a front ("sk-preset-20261031") is a
+  // provider id, not a key cut up: the per-word and cut readings judge it
+  if (!/^ms-/i.test(body) && !isKey(body)) return null
+  return { pre: s.slice(0, start), body, post: s.slice(end) }
+}
+const keyish = (x) => isKey(x) || /^(?:ms-|sk-)/i.test(x)
+
+// msBody is whether what follows an ms- front reads as key material, the same
+// question the card's keyBody asks: an ordinary word after the front ("The
+// ms-interviewing feature is unavailable") is not a key, and the CLI masked it
+// while the card kept it. A ModelScope key is hex or base64 with a digit in it.
+const msBody = /(?:[0-9a-f]{11,}(?![0-9a-z])|(?=[\x21-\x7e]{11,})(?!\w)[\x21-\x7e]*\d)/
+// msKey is whether an ms- run is a key, and the two shapes that are one
+// whatever their body says: a run in capitals (a child that upper-cases its
+// output) and a value that is nothing but the run (a token pasted into a
+// provider id — "ms-abcdefghijklmnop" is a credential there, not a word).
+// Everything else is asked of its body, as the card asks.
+// a version's dotted groups are not key material ("ms-cli 2026.11.9" is a
+// program and its version, as the card reads it)
+const msKey = (m, whole) => whole || m === m.toUpperCase() || (!m.includes(".") && msBody.test(m))
 const show = (s) =>
   String(s ?? "")
-    .replace(tokenShaped, (m) => mask(m.replace(/[\p{Cc}\p{Cf}]/gu, "")))
+    .replace(tokenShaped, (m) => (msKey(m, String(s).trim() === m) ? mask(m.replace(/[\p{Cc}\p{Cf}]/gu, "")) : m))
+    // an upper-cased vendor key is the same key, and its pieces are too short
+    // for the per-word floors ("SK-ANT-API03-EYAI1PKJRF_KBWT")
+    .replace(/[^\s]+/g, (w) => (isKey(w) && VENDOR.test(w) && w === w.toUpperCase()) || (w.startsWith("--") && w.includes("=") && isKey(w.slice(w.indexOf("=") + 1))) ? mask(w) : w)
     .replace(/[\p{Cc}\p{Cf}]/gu, " ")
 
 // arg is show() for a value the user typed: --from, a stray argument, a bare
@@ -474,7 +701,51 @@ const alternates = (word) => (word.match(/[a-z][A-Z]/g) ?? []).length >= 2
 // so there is no whitespace in it and no value of nothing but spaces to answer
 // for. It was written for a whole value once, and a value with a trailing space
 // in it answered "not a key": that is the frame this round closed
-const isKey = (word) => {
+// a run with no vowels and plenty of digits is a generated key with no
+// separator at all ("5gli9zadx8zg9jez"): the card judges this shape and the
+// CLI did not. A word followed by its numeral ("file1file2file3") is a list,
+// the card's own exclusion.
+const VOWELS = /[aeiouy]/g
+const randomish = (r) => {
+  if (r.length < 12 || r.length > 40 || !/[a-z]/.test(r)) return false
+  // a short letter lead and then nothing but digits is a build number or a
+  // serial ("v202610310001"): the vowels a letter has are all in that lead,
+  // and the share below is kind to a long run of digits. A generated key
+  // spreads its letters through the run ("5gli9zadx8zg9jez"), which is what
+  // the transitions below are for
+  if (/^[a-z]{1,3}\d{8,}$/.test(r)) return false
+  if ((r.match(VOWELS) ?? []).length / r.length >= 0.2) return false
+  const digits = (r.match(/\d/g) ?? []).length
+  const transitions = (r.match(/[a-z][0-9]|[0-9][a-z]/g) ?? []).length
+  return transitions >= 2 || digits >= 4
+}
+const LISTY = /^(?:[A-Za-z]+\d+)+$/
+// isKey judges one word as it was written. A word the readings cut and join
+// back together is asked with runs = false: it was never one word, and the
+// vowel-less arm below reads a run of numerals as a key ("no 42 20261031"
+// joined to "no4220261031"). Its own pieces were each judged where they were
+// written, so a join that masks nothing on its own loses nothing that a piece
+// already masked; a join holding one key-shaped piece (a key an invisible
+// character cut) is still a key by its run arm.
+const isKey = (word, runs = true) => {
+  // an upper-cased vendor key is the same key, and its pieces are too short
+  // for the run floors ("SK-ANT-API03-EYAI1PKJRF_KBWT"); the rhythm a key has
+  // (a capital beside a digit) tells it from a sentence in capitals
+  if (VENDOR.test(word) && word === word.toUpperCase() && /[0-9]/.test(word) && !/[A-Z]{6,}/.test(word.replace(/^[A-Z]+_[A-Z]+_/, ""))) return true
+  // a vendor front and a body whose piece mixes case and carries a digit is a
+  // key even when every piece is short of the run floors: "ghp_Abcd1234Ef" (a
+  // token copied with its tail cut off) went out whole, and no word of prose
+  // carries a vendor front. A provider id behind the same front keeps its name
+  // ("sk-preset-20261031"): its pieces are a word and a number, and neither
+  // mixes case
+  if (
+    runs &&
+    !word.includes("…") &&
+    VENDOR.test(word) &&
+    /[0-9]/.test(word) &&
+    word.split(/[-_.]/).some((p) => /[a-z]/.test(p) && /[A-Z]/.test(p) && /[0-9]/.test(p))
+  ) return true
+  if (runs && /^[a-z0-9]+$/.test(word) && !(LISTY.test(word) && /[A-Za-z]{3,}/.test(word)) && randomish(word)) return true
   if (!/[\\/]/.test(word)) {
     // no separator: the whole word is one key, and one key-like run in it is
     // enough (a generated key has no separator at all). PATHY's leading "." is
@@ -507,8 +778,38 @@ const isKey = (word) => {
   // without taking the folder away. Two segments of 12+ characters mixing
   // cases is the whole of this arm, and it is what keeps
   // /Users/mison/Documents/SomeLongDirectoryName a path
-  const segs = word.split(/[\\/]/).filter((seg) => seg.length >= 12 && /[a-z]/.test(seg) && /[A-Z]/.test(seg))
-  return !PATHY.test(word) && segs.length >= 2
+  const pieces = word.split(/[\\/]/)
+  const segs = pieces.filter((seg) => seg.length >= 12 && /[a-z]/.test(seg) && /[A-Z]/.test(seg))
+  if (!PATHY.test(word) && segs.length >= 2) return true
+  // an AWS secret written in capitals is the same secret: a word with no
+  // lower-case letter at all whose slashes cut it into two or more pieces of
+  // 12+ capitals ("WJALRXUTNFEMI/K7MDENG/BPXRFICYEXAMPLEKEY" — measured, all
+  // 40 characters reached the terminal, and the README says upper-cased keys
+  // are masked). A path in capitals is not: /USERS/MISON/DOCUMENTS is a path
+  // (PATHY) and its pieces are short anyway, and a word with a lower-case
+  // letter in it is the case-mix arm's business, not this one
+  // a key cut into pieces by slashes ("ghp_1234Ab/Cd5678EfGh/9012IjKl34/…"):
+  // many parts, each key material rather than a word, and the whole reads as a
+  // key with the slashes taken out. A path's parts carry lower-case words
+  // ("SomeLongDirName" is a name). A key behind a frame starts at its front
+  const frontAt = word.search(/ms-|sk-|gh[pousr]_|xox[abposr]-|akia|asia|aida/i)
+  const sub = frontAt > 0 ? word.slice(frontAt) : word
+  if (!PATHY.test(sub) && !/^[\\/]/.test(sub)) {
+    const core = sub.replace(/[^A-Za-z0-9]+$/, "")
+    const coreSegs = core.split(/[\\/]/).filter((seg) => seg !== "")
+    const frontLen = (core.match(/^(?:ms-|sk-|gh[pousr]_|xox[abposr]-|akia|asia|aida)/i)?.[0] ?? "").length
+    const wordy = (seg, i) => /[a-z]{2,}/.test(i === 0 ? seg.slice(frontLen) : seg)
+    if (
+      coreSegs.length >= 3 &&
+      coreSegs.every((seg) => /^[A-Za-z0-9_+=.-]+$/.test(seg)) &&
+      !coreSegs.some((seg, i) => wordy(seg, i)) &&
+      isKey(compact(core))
+    )
+      return true
+  }
+  if (/[a-z]/.test(word)) return false
+  const caps = pieces.filter((seg) => seg.length >= 12 && /^[A-Z0-9]+$/.test(seg) && /[A-Z]/.test(seg))
+  return !PATHY.test(word) && caps.length >= 2
 }
 const UUID_ANY = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
 // A key of another shape pasted with an invisible character inside it — a
@@ -524,10 +825,766 @@ const UUID_ANY = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g
 // each lookaround, so it is a linear pass, not the kind of scan that backtracked
 // to minutes on a body of control characters.
 const GLUE = new RegExp(String.raw`(?<=[A-Za-z0-9+\/=_.-])${INV}(?=[A-Za-z0-9+\/=_.-])`, "gu")
-const arg = (v) =>
-  show(String(v ?? "").replace(GLUE, "")).replace(/[^\s]+/g, (w) =>
-    isKey(w) ? mask(w) : w.replace(RUN, (r) => (keyRun(r) ? mask(r) : r)).replace(UUID_ANY, (m) => mask(m)),
-  )
+// VENDOR and MASKED are index.mjs's, to the letter: a key's front that is no
+// key on its own, and the ellipsis a mask carries.
+const VENDOR = /^(?:sk-|sk_(?:live|test)_|gh[pousr]_|xox[abposr]-|akia|asia|aida|aliyun|ssh-rsa|-----begin)/i
+const MASKED = "…"
+// keyAt: a word is the front of a key when it is key-shaped on its own or
+// carries a vendor's front. A front like "ghp_" or "sk-" is under every word
+// floor, and a key cut by whitespace leaves it as a word of its own.
+// keyAt: a word is the front of a key when it carries a vendor's front
+// ("ghp_", "sk-", "ms-") or is key-shaped on its own
+const keyAt = (w) => VENDOR.test(w) || /^ms-/i.test(w) || isKey(w)
+// a body of a vendor key cut by whitespace keeps its prefix together — "ghp_"
+// on one line and 1234 on the next is ghp_ 1234 — and nothing else is joined:
+// a key-shaped word next to a prose word is a key's end (its own pass masks
+// it by its own ends), and joining the prose would move the ends
+const PREFIX = /^(?:sk_(?:live|test)_|sk-|gh[pousr]_|github_pat_|xox[abposr]-|akia|asia|aida)/i
+// a word after the front continues it when it is key material the floors miss
+// on its own: a digit in it, or a short piece with a capital
+const continues = (w) => (/[0-9]/.test(w) || /[A-Z]/.test(w)) && !VENDOR.test(w)
+const glued = (ws) => ws.map((w) => w[0]).join("")
+// startProse: a run's first word is a word of prose — all lower-case letters,
+// two or more of them — and a run that starts with one is no key's head.
+const startProse = (w) => /^[a-z]{4,}$/.test(w) && !VENDOR.test(w) && !/^ms-/.test(w)
+// a word of English written in capitals, three or more letters
+const WORDS = /^[A-Z]{3,}$/
+// splitKey is spacedKey's reading for the keys that carry no front: a UUID, a
+// ghp_ token, a digest, an ms- key cut where the front's own walk does not
+// reach. spacedKey begins at an ms-/sk- front and reads on from there; a value
+// with no such front was printed piece by piece, each under every floor on its
+// own — measured: "123e4567-e89b-12d3-a45 6-426614174000" and
+// "ghp_Abcd1234Efgh 5678Ijkl9012Mnop 3456Qrst" both went out as written.
+//
+// The reading is the same walk: pieces joined across a cut, and the moment the
+// join reads as a key the run has found it. A piece that is a word ends the
+// search, so a sentence's words are never glued into a key that is not there,
+// and the join is only taken when it carries a digit — a key does, and the
+// lists and prose a message carries do not.
+function splitKey(s) {
+  // a page of one- and two-character pieces is the worst case for a walk that
+  // starts at every piece, and no value a person types or a child prints this
+  // long is one key cut up: past this the other readings still run
+  if (s.length > 8 * 1024) return null
+  if (/(?:(?![\n\r])[\p{Cc}\p{Cf}])/u.test(s)) return null
+  const pieces = [...s.matchAll(PIECE)].map((m) => ({ text: m[0], at: m.index }))
+  if (pieces.length < 2) return null
+  // a piece the cut left: key characters, under the width a cut's piece has
+  // (a whole key is one piece, and spacedKey's business), and not a word
+  // a piece of capitals is key material, not a word ("AKIAIOSF · ODNN7EXAMPLE"
+  // is one key cut in two): the run reading exempts capitals for the same reason
+  // a piece of letters that alternates case is key material too ("wJalrXUtnFEMI"
+  // is the front of an AWS secret cut by its slashes and a space): a word
+  // capitalises once ("McDonald"), and the run is only taken when the join
+  // reads as a key, so a sentence's words are still never glued. A 16+
+  // mixed-case run is key material whatever its transitions ("MNOPqrstUVWXZZZZ"
+  // is a token's back half cut at the middle, one l-to-M capitalisation and
+  // nothing more) — the same shape keyRun masks when the half stands alone
+  const piece = (t) =>
+    t.length <= 48 &&
+    KEYCHARS.test(t) &&
+    !(PROSE.test(t) && !/^[A-Z]+$/.test(t) && !keyedBody(t) && !((t.match(RUN) ?? []).some(keyRun)))
+  // a frame's punctuation ("key=…", "(…)") is read by maskCut, whose head
+  // begins after it; joining from the piece's own first character would take
+  // the frame for key material ("key=AKIA…" masked from the "k")
+  const framed = (t) => !/^[A-Za-z0-9]/.test(t) || /[=:([{,"']/.test(t)
+  const MID = /[·•∙‧・]/
+  const GAP = /^[ \t\r\n 　·•∙‧・]{1,3}$/
+  // the slash is a key's own separator (an AWS secret: wJalr…/K7MDENG/…), so a
+  // slash gap reads on like a space does — but only when the value does not
+  // start like a path. "/var/folders/hq/q19jry…/T/…" joins into one key-ish
+  // read (the segment carries digits and case), and a path must keep its shape.
+  const SLASH = /^\/{1,3}$/
+  const pathLed = PATHY.test(s) || /^[\\/]/.test(s)
+  for (let from = 0; from < pieces.length - 1; from += 1) {
+    if (!piece(pieces[from].text) || framed(pieces[from].text)) continue
+    // a middot before the piece is a cut the other readings own: their walk
+    // starts at the key's front, and starting a second one here took the
+    // front's pieces for the text ("key=g·hp_1·23·…" came out
+    // "key=g·hp_1…7890")
+    if (from > 0 && MID.test(s.slice(pieces[from - 1].at + pieces[from - 1].text.length, pieces[from].at))) continue
+    let joined = pieces[from].text
+    let best = -1
+    // a capitalised word either side of a middot is the card's own separator
+    // between two captions ("Qwen3-Max · Qwen3-Coder"), not one key's cut. A
+    // key's front is exempt ("Ghp_Abcd1234" is capitalised like a caption)
+    const caption = (t) => /^[A-Z][a-z]{2,}/.test(t) && !VENDOR.test(t)
+    for (let k = from + 1; k < pieces.length && k - from <= 48 && joined.length < 96; k += 1) {
+      const gapHere = s.slice(pieces[k - 1].at + pieces[k - 1].text.length, pieces[k].at)
+      if (!GAP.test(gapHere) && !(SLASH.test(gapHere) && !pathLed)) break
+      if (MID.test(gapHere) && !VENDOR.test(pieces[from].text) && caption(pieces[k - 1].text) && caption(pieces[k].text)) break
+      // a piece that opens its own front is a second key, not the first one's body:
+      // joining them hid both ends behind one mask ("ms-a…5555")
+      if (/^(?:ms-|sk-)/i.test(pieces[k].text)) break
+      if (!piece(pieces[k].text)) {
+        // a display cuts a key one piece at a time, and its last piece can be a
+        // short word of capitals ("Ghp_…·Qrst", "…·789·0"): once the join reads
+        // as a key, a piece of at most four letters behind a middot is its end.
+        // A space is the text's ("no key ms-… for provider").
+        if (best === k - 1 && MID.test(gapHere) && pieces[k].text.length <= 4 && /^[A-Za-z]+$/.test(pieces[k].text)) best = k
+        break
+      }
+      // a long numeral after the key is a count or a year, not the key's own
+      if (VERNUM.test(pieces[k].text) && !/\d/.test(joined)) break
+      joined += pieces[k].text
+      if (joined.length < 12) continue
+      if (/\d/.test(joined) && isKey(joined, false)) best = k
+    }
+    // the run's longest reading is the key: a key cut into three pieces reads
+    // as one at the second of them too, and masking there left the last piece
+    // to the per-word pass ("ghp_…9012·IjKl…7890")
+    if (best > 0) {
+      const last = pieces[best]
+      return { pre: s.slice(0, pieces[from].at), body: pieces.slice(from, best + 1).map((p) => p.text).join(""), post: s.slice(last.at + last.text.length) }
+    }
+  }
+  return null
+}
+
+// a run of capitals and digits is a key written without its spaces
+// ("AKIAIOSF", "AKIAIOSFODNN7EXA")
+const capsPiece = (w) => /^[A-Z0-9]{4,}$/.test(w) && /[A-Z]/.test(w)
+// tokenShaped is a /g pattern (used with replace); test() on it would carry
+// lastIndex from one call to the next and answer false on the second look
+const tokenShaped1 = new RegExp(tokenShaped.source, "iu")
+const keyedBody = (body) => (body.match(/[a-z][A-Z]/g) ?? []).length >= 2 && /[A-Z]/.test(body) && /[a-z]/.test(body)
+const maskCut = (s) => {
+  if (s.length > 32 * 1024) return s
+  // a middot or a bullet splits words here: it is one of the spellings a cut
+  // arrives in ("ms-a·b·c"), and one word with middots inside it is a shape no
+  // reading below can take apart
+  const words = [...s.matchAll(/[^\s·•∙‧・]+/g)]
+  if (words.length < 2) return s
+  const at = (i) => words[i].index
+  const end = (i) => words[i].index + words[i][0].length
+  const gap = (i) => s.slice(end(i - 1), at(i))
+  // a middot or a bullet between pieces is a cut's other spelling
+  // ("ms-a·b·c") when the run starts at a key's front or at one-character
+  // pieces, or the join already reads as a key; a card's or a log's own
+  // separators do not start at either
+  const run = (i, k) => glued(words.slice(i, k + 1)).replace(MASKED, "")
+  // a vendor front may itself be cut ("xox b-1 234 …"): the head's leading
+  // letters and the next word's together carry it
+  const frontSplit = (i) => i + 1 < words.length && /^[A-Za-z]+$/.test(words[i][0]) && words[i][0].length <= 5 && VENDOR.test(words[i][0] + words[i + 1][0])
+  const MIDDOT_GAP = /^(?:[ \t\u00a0\u3000]?[·•∙‧・]){1,2}[ \t\u00a0\u3000]?$/
+  const wordLike = (w) => /^[A-Za-z]+$/.test(w) && /[a-z]/.test(w) && /[aeiouy]/i.test(w)
+  // (the join's own reading is asked once a body of key length is on the
+  // table: asking it at every middot re-read the run to its square)
+  // a capitalised word is a caption, not a piece of a key, and two of them
+  // either side of a middot are a list the card keeps ("Qwen3-Max ·
+  // Qwen3-Coder"). A key's own front is exempt: "Ghp_Abcd1234" is capitalised
+  // like a caption and is still the key's first piece
+  const caption = (w) => /^[A-Z][a-z]{2,}/.test(w)
+  const middotGap = (k, w0, i) => MIDDOT_GAP.test(gap(k)) && !(caption(words[i][0]) && caption(words[k][0]) && !VENDOR.test(words[i][0]) && !VENDOR.test(words[k][0])) && (w0.length <= 2 || VENDOR.test(w0) || /^ms-/i.test(w0) || frontSplit(i) || !wordLike(words[i][0]) || !wordLike(words[k][0]) || (end(k) - at(i) >= 20 && isKey(run(i, k - 1))))
+  // a character cut: every piece one character ("A· K· I· A· …"), or a
+  // vendor front cut in two and then one character at a time ("G· H· P· _· 1· 2· …")
+  // — a shape the run below cannot read, because its prose test ends a run at
+  // the first lower-case piece. Read here, on the pieces' own alphabet
+  const cutGap = (k) => /^[ \t\u00a0\u3000\r\n]+$/.test(gap(k)) || MIDDOT_GAP.test(gap(k))
+  // the key material of a word: what follows a frame's punctuation ("key=AK",
+  // "(AK"), the word itself when it carries none. The frame stays as printed
+  const frameAt = (w) => {
+    // a path is not a frame: its words are the per-word pass's
+    if (/[\\/]/.test(w)) return { mat: w }
+    const lead = w.replace(/^[^A-Za-z0-9]+/, "")
+    // a vendor's front carries its own hyphens ("sk-ant-"), so it is kept
+    // whole; anything else is the letters and digits it ends with ("key=123e")
+    const sep = Math.max(...'=:([{,"\''.split("").map((c) => lead.lastIndexOf(c)))
+    const tail = sep >= 0 ? lead.slice(sep + 1) : lead
+    // a piece of a digest is hex and its hyphens ("…=[123e4567-")
+    // (a word with a middot in it is the cut's: its material is the word, so
+    // the frame keeps no copy of key text — "123e4567-e89·b-" used to leave
+    // "123e4567" in the frame and again in the mask)
+    const cutMid = /[·•∙‧・]/.test(tail)
+    // the word's trailing letters and digits are its material ("key=AK",
+    // "NickName=[ghp_…"). A bare short numeral is not: "字ＡＢＣ12" ends in
+    // "12", and taking that for a head made every word of a page one, each
+    // with a 48-word scan behind it (measured: 25 KB took 19 s before this
+    // floor). A key behind a frame is never two digits long
+    const trailing = tail.match(/[A-Za-z0-9]+$/)?.[0] ?? ""
+    // a piece of a digest is four characters at least, or carries a letter
+    // (a hex run of "12" is no key's front, and reading it as one made every
+    // word of a page a head)
+    const digestTail = /^[0-9a-f-]+$/i.test(tail) && (tail.length >= 4 || /[A-Za-z]/.test(tail))
+    return { mat: VENDOR.test(tail) || /^ms-/i.test(tail) || digestTail || cutMid ? tail : trailing.length >= 4 || /[A-Za-z]/.test(trailing) ? trailing : "" }
+  }
+  // a piece's own spelling may carry the text's punctuation ("0.", "1,")
+  // a single hyphen a key was cut at ("… 7·-·e …") is a piece too
+  const one = (w) => w.replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, "").length === 1 || /^[^A-Za-z0-9]$/.test(w)
+  // a key written one character per word is at most a few hundred pieces; a
+  // page of them is not a key typed out, and reading every start of it is
+  // quadratic (measured: 32 KiB of "A A A …" took 2 s)
+  const out = []
+  let from = 0
+  for (let i = 0; i < words.length; i += 1) {
+    // a pair either side of a line break — the break of a wrapped copy, where
+    // nothing in between is prose — read joined: the second half of a key
+    // behind its front ("ghp_\n1234AbCd…", "no key ghp_\n1234…"). The front
+    // is a bare prefix ("ghp_", "sk-", "AKIA"), a word no key floor keeps.
+    const brk = i > 0 && /^\r?\n$/.test(gap(i))
+    const bare = i > 0 && (PREFIX.test(words[i - 1][0]) || (!keyAt(words[i - 1][0]) && words[i - 1][0].length < 12))
+    if (brk && bare && continues(words[i][0]) && end(i) - at(i - 1) >= 20) {
+      const pair = glued([words[i - 1], words[i]])
+      if (!pair.includes(MASKED) && isKey(pair, false)) {
+        out.push(s.slice(from, at(i - 1)), mask(pair))
+        from = end(i)
+        i += 1
+        continue
+      }
+    }
+    // a run is read from a head: a word carrying a vendor's front or the ms-
+    // shape written with its body cut off ("ms-f"), or a run of capitals and
+    // digits (a key written without its spaces), or a piece of a key written
+    // one character per word. Anything else is the per-word pass's
+    // ("spawnSync /tmp/…" is a sentence, not a cut).
+    const w0 = words[i][0]
+    // a key written one character per word runs five or more such pieces
+    // together ("s k - a n t") — a single short word beside a long one is not
+    // a head, and asking after it at every position is what made a body of
+    // them quadratic
+    const tiny = w0.length <= 2 && words[i + 4] !== undefined && words.slice(i, i + 5).every((x) => x[0].length <= 2)
+    const msHead = /^ms-/i.test(w0) && !isKey(w0) && !/^ms-[\x21-\x7e]{11,}$/i.test(w0)
+    // a key cut inside a mixed-case word ("wJal rXUt nFEM …" is an AWS
+    // secret): the join has to be a key of its own, which a sentence's first
+    // word after a path is not
+    const mixedHead = w0.length <= 16 && /[a-z]/.test(w0) && /[A-Z]/.test(w0)
+    // a vendor front itself cut in two ("xox b-1 234 …", "ghp _1234 …"): the
+    // front is not a word any floor keeps, and the cut falls inside it
+    const frontish =
+      w0.length <= 5 &&
+      /^[A-Za-z]+$/.test(w0) &&
+      i + 1 < words.length &&
+      (VENDOR.test(w0 + words[i + 1][0]) || VENDOR.test(w0 + words[i + 1][0].slice(0, 2)))
+    // a piece of a digest ("9f8e 7d6c …", "9f8e·7d6c·…", "123e4567-e"): hex
+    // with a digit in it, which no word of prose is, and the hyphens a UUID's
+    // pieces carry. The card reads the same run
+    const digestPiece = (w) => /[0-9]/.test(w) && /^[0-9a-f-]+$/i.test(w) && !/^-+$/.test(w)
+    const hexHead = digestPiece(w0)
+    // a key written in one lower-case alphabet ("abcd1234efgh 5678ijkl9012
+    // mnop3456"): the card takes the same run, and no head reading above does
+    // — a piece of it is no vendor front, carries no capital, is no digest and
+    // is longer than a front's. The run still has to read as one key joined
+    // below, so a page of words with numerals is not taken
+    const lcHead = w0.length >= 4 && /^[a-z0-9]+$/.test(w0) && /[0-9]/.test(w0) && /[a-z]/.test(w0)
+    // a head behind a frame's punctuation ("key=AK IA…", a JSON quote, a
+    // bracket): the key material is what follows the frame, and the frame
+    // itself is kept as printed. Two characters of it at least — a single
+    // letter behind a frame is the per-word pass's ("NickName=[A") — and the
+    // run still has to read as a key below
+    const { mat } = frameAt(w0)
+    // a word with no frame may carry the key's head inside it ("no key
+    // ms-aaaa…"): its part that reads as a digest. A path is not read that
+    // way ("/tmp/ms-ZZZZ…" is masked as the token it is, by the per-word pass)
+    // (a bare short numeral is no key's band either: "字ＡＢＣ12" carries a
+    // "12", and reading that as a head made every word of a page one. A key
+    // behind a frame is four characters at least, or carries a letter)
+    const band = /[\\/]/.test(w0) ? undefined : (w0.match(/[A-Za-z0-9]+/g) ?? []).find((b) => digestPiece(b) && (b.length >= 4 || /[A-Za-z]/.test(b)))
+    // (a word that opens with a vendor front is the key's from its first
+    // character: a digest band inside it — the "12" of "ghp_12" — is not a
+    // frame, and the four characters the mask shows would be that band)
+    const t0 = mat !== w0 && mat.length >= 2 ? mat : band && band.length >= 2 && !VENDOR.test(w0) && !/^ms-/i.test(w0) ? band : w0
+    // the head's key material with its frame kept outside the mask
+    const tailHead = t0 !== w0
+    // (a frame whose material is one character is no head's: "NickName=[1,"
+    // read the name into the key and masked a list of ones. The word's own
+    // shape can still start a run — a whole key-shaped word is the key
+    // whatever stands in front of it — but being a mixed-case word behind a
+    // frame is not enough)
+    const framedOne = mat !== w0 && mat.length < 2
+    if (!VENDOR.test(w0) && !capsPiece(w0) && !msHead && !tiny && !mixedHead && !frontish && !hexHead && !tailHead && !lcHead) continue
+    if (framedOne && !VENDOR.test(w0) && !capsPiece(w0) && !msHead && !frontish && !hexHead && !lcHead) continue
+    // two key-shaped words are two keys: one mask for both would hide the
+    // second's front ("ms-aaaa… ms-zzzz…" is not one key)
+    const pairOfKeys = i + 1 < words.length && /^[ \t\u00a0\u3000]+$/.test(gap(i + 1)) && keyAt(words[i][0]) && keyAt(words[i + 1][0])
+    let j = i
+    let head = i
+    // the last word a run read, and whether anything in it was key material:
+    // a start that found neither hands the scan on to there ("A A A …" is one
+    // pass, not one run per word), while a run that saw a digit or a front may
+    // still hold a key's head further on and is read word by word
+    let last = i
+    let sawKey = false
+    let body = t0
+    let sawHard = /[A-Z]/.test(t0) || /\d/.test(t0)
+    // the pieces read so far, kept as they are read: slicing them out of the
+    // word list at every piece is what made a page of tiny words take seconds
+    const pieces = [t0]
+    // the questions below asked of the pieces, kept as they are read (asking
+    // each of them again at every piece read a page of tiny words to the square)
+    // A run of pieces of nothing but digits is no key whatever follows it
+    // (the cut test says so), and a page of short words with digits in them
+    // made every word a head with a 48-word scan behind it: asked per piece,
+    // that was quadratic (measured: 25 KB of them took 1.1 s). Kept as they
+    // are read, and the scan below leaves the run as soon as it cannot be a
+    // key.
+    let allNumeric = /^[0-9]*$/.test(t0)
+    let proseCount = 0
+    const notePiece = (w) => {
+      if (!/^[0-9]*$/.test(w)) allNumeric = false
+      if (w.length >= 4 && /^[a-z]{4,}$/.test(w) && !VENDOR.test(w)) proseCount += 1
+    }
+    if (!/^[0-9]*$/.test(t0)) allNumeric = false
+    let allAlphabet = /^[A-Za-z0-9+/=_.-]*$/.test(t0)
+    let anyDigit = /[0-9]/.test(t0)
+    let anyCap = /[A-Z]/.test(t0)
+    // (a key is shorter than 128 characters, and every reading below is asked
+    // of the body joined so far: a page of short words that each looked like a
+    // head read bodies of 300 characters 48 times apiece, which was quadratic
+    // in the page — measured, 25 KB took 5 s. The bound is not reached by a
+    // key, and it stops the walk instead of reading a body that cannot be one)
+    for (let k = i + 1; !pairOfKeys && k < words.length && k - i <= 48 && body.length < 128 && (/^[ \t\u00a0\u3000\r\n]+$/.test(gap(k)) || middotGap(k, w0, i)); k += 1) {
+      const x = words[k][0]
+      // a short word of the text's ends the run once a cut has been read
+      // ("no key abcd… mnop3456 for provider" keeps its "for"): the pieces of
+      // a key that are one to three letters are read before the cut is found
+      // (the "a" of "sk-a nt-a pi03"), and a word after it is the text's.
+      // (a run whose body already reads as a key is complete: the word after
+      // it is the frame's — "ghp_…Qrst, for provider" read "for" into the
+      // mask, and the mask ended ",for")
+      if (/^[a-z]{1,3}$/.test(x) && !VENDOR.test(x) && (j > i || isKey(body))) break
+      last = k
+      if (/[0-9]/.test(x) || VENDOR.test(x)) sawKey = true
+      // every piece is short enough or a vendor front; a word of a sentence in
+      // between ("the log said") goes on only when what follows is key-shaped
+      // again and the body has a capital or a digit — an echo's own words
+      // ("aaabbb… x aaaccc… 1234", one piece between two of the key's)
+      if (x.length > 16 && !VENDOR.test(x) && !(/^[0-9a-f-]+$/i.test(x) && /[0-9]/.test(x))) break
+      // a piece of capitals and digits is key material ("xox b-1 234 567 890
+      // 12- …" is one key cut into threes): a key is written in capitals and
+      // digits more often than a word of prose is
+      // the cut of a vendor front into capitals and digits ("xox b-1 234 567
+      // 890 12- …"): the piece after the front starts with a digit, the pieces
+      // are short, and none is a capitalised word ("Release", "Notes")
+      const capsy = i + 1 < words.length && /^-?[0-9]/.test(words[i + 1][0]) && x.length <= 16 && /[A-Z0-9]/.test(x)
+      body += x
+      pieces.push(x)
+      notePiece(x)
+      if (allAlphabet && !/^[A-Za-z0-9+/=_.-]*$/.test(x)) allAlphabet = false
+      if (!sawHard && (/[A-Z]/.test(x) || /\d/.test(x))) sawHard = true
+      if (!anyDigit && /[0-9]/.test(x)) anyDigit = true
+      if (!anyCap && /[A-Z]/.test(x)) anyCap = true
+      // the head is not a word of the run's own: "xoxb -123 4567 …" begins at
+      // a front cut in two, and reading the front as prose ended the run
+      // a piece joined by a middot or a bullet is key material whether or not
+      // it reads as a word ("ms-f·orei·gn-0·…"): the card's separators are the
+      // ones with a word on both sides, and those a run started at a key's
+      // front can still be checked against the key below
+      const mid = MIDDOT_GAP.test(gap(k))
+      const prose = !mid && proseCount > 0
+      // (the head's own material counts: "abcd1234efgh 5678ijkl9012 mnop3456"
+      // read its first piece as prose and ended the run there, and the key
+      // stayed on the terminal whole)
+      if (prose && !(/^ms-/i.test(w0) && tokenShaped1.test(body) && msKey(body, false)) && !(keyAt(x) && sawHard)) continue
+      // the body of a key cut by spaces: 20+, a key-shaped run in the head —
+      // the front, or the word after it ("ghp_ 1234 AbCd…"; "sk-a nt-a pi03…"
+      // is a vendor key whose body is all its pieces, and the head's run is
+      // no key on its own: sk / ant / a are all short)
+      // the body is a key when it reads as one written: joined it reads as the
+      // ms- shape with its body intact ("ms-f orei gn-0 1234 …"), or the key it
+      // writes joined is one word ("sk-a nt-a pi03…" is
+      // sk-ant-api03-Eyai1pkJrF_Kbwt), or — from a vendor front — the head
+      // flips case inside itself. A word after the first piece is prose
+      // ("sk-preset-20261031 is a provider id")
+      // ("sk-a" is not a vendor front, and the vendor front of "sk-preset" is
+      // the whole word; either way the words after the first piece are prose)
+      // a lower-case run of four or more letters after the head is prose, or
+      // a path's word ("/tmp/ms-ZZZZ…"): a key's pieces carry capitals or
+      // digits
+      const plain = x.length > 4 && /^[a-z]{4,}$/.test(x) && !VENDOR.test(x)
+      // a bare front (ghp_, sk-, xoxb-) is a word no key floor keeps, and the
+      // pieces after it are the key; a vendor-like word that carries more than
+      // the front ("sk-preset-20261031") is a provider id, and its run only
+      // counts when the join is a key of its own
+      const bareFront = VENDOR.test(pieces[0]) && pieces[0].length <= 8
+      // a front cut in two leaves a shorter body than the floor reads: the
+      // front itself is half of it ("xoxb-12345678901" is 16 characters), and
+      // the front's own evidence stands in for the missing four
+      const capMixed = anyDigit && anyCap
+      const capFront = /^[a-z]{1,5}$/.test(pieces[0]) && /[0-9]/.test(pieces[1]) && /[A-Za-z]/.test(pieces[1])
+      const shortFront = frontish && pieces.length >= 3 && anyDigit
+      // a body of digits only is no key's: the run cannot become one by
+      // reading on, and every reading below would be asked at every piece
+      if (allNumeric) continue
+      const cut =
+        /\d/.test(body) &&
+        body.length >= (frontish ? 16 : 20) &&
+        !body.includes(MASKED) &&
+        // a middot or a bullet is a cut's spelling too, and the key it writes
+        // is the characters joined without them
+        // (a body of nothing but digits is no key's, and some of the readings
+        // below re-read it at every piece: asked once, at the floor)
+        (anyCap || !/^\d+$/.test(body)) &&
+        !/^\d+$/.test(body.replace(/[^A-Za-z0-9]/g, "")) &&
+        // (a body whose letters are one word — "NickName=[1, 1, …]" — is a
+        // frame, not a key's front: a key carries other marks with its letters)
+        (/[\d]/.test(body.replace(/[^A-Za-z0-9]/g, "").replace(/^[A-Za-z]+/, "")) || !isKey(body.replace(/[^A-Za-z]/g, ""), false)) &&
+          (isKey(body, false) ||
+          // the key the pieces write when the card's own separators — the
+          // middots and the hyphens a UUID is drawn with — are left out
+          (mid && isKey(body.replace(/[·•∙‧・]/g, ""), false)) ||
+          (mid && isKey(body.replace(/[·•∙‧・-]/g, ""), false)) ||
+          (msHead && tokenShaped1.test(body) && msKey(body, false) && !pieces.some((w) => /^[A-Za-z]{2,}$/.test(w) && !VENDOR.test(w) && w !== w0)) ||
+          (bareFront && !plain && (pieces[0] + pieces[1]).match(/[A-Za-z0-9]+/g) ? (pieces[0] + pieces[1]).match(/[A-Za-z0-9]+/g).some((r) => keyRun(r) || r.length >= 4 || keyedBody(body)) : false) ||
+          (capsy && (capMixed || capFront) && !pieces.some((w) => /^[A-Z][a-z]{3,}$/.test(w))) ||
+          (shortFront && !pieces.some((w) => /^[A-Z][a-z]{3,}$/.test(w)))) &&
+        (k - i >= 2 || !bareFront)
+      if (!cut) continue
+      j = k
+    }
+    if (j === i) {
+      if (!sawKey && last > i) i = last
+      continue
+    }
+    // the head's frame is kept as printed and only its key material goes into
+    // the mask ("key=AK IA…", "no key ms-aaaa…" loses none of its "no key")
+    // a word read whole starts its key material where its material does: the
+    // frame in front of it ("(ghp_…") is kept, and the four characters the
+    // mask shows are the key's, not the frame's leftovers
+    const keep = s.slice(at(i), at(i) + w0.length).indexOf(t0)
+    const parts = [t0, ...words.slice(i + 1, j + 1).map((w) => w[0])]
+    // a word of nothing but punctuation is the frame's ("(… )"), not the
+    // key's: the mask's last four characters are the key's own
+    let tailP = ""
+    if (parts.length > 1 && !/[A-Za-z0-9]/.test(parts[parts.length - 1])) tailP = parts.pop().replace(/^[A-Za-z0-9]+/, "")
+    const keyText = parts.join("").replace(MASKED, "")
+    out.push(s.slice(from, at(i) + keep), mask(keyText.replaceAll(MASKED, "")), tailP)
+    from = end(j)
+    i = j
+  }
+  // the character runs are read after the runs above, on the text they left:
+  // a key typed one character at a time is the last shape to look for, and a
+  // page of such pieces is not a key typed out
+
+  const singles = words.reduce((n, w) => n + (w[0].length === 1 ? 1 : 0), 0)
+  const chars = []
+  let cfrom = 0
+  for (let i = 0; i < words.length && singles <= 512; i += 1) {
+    // a piece inside a run already read is not a head
+    if (words[i][0].length === 1 && i > 0 && MIDDOT_GAP.test(gap(i)) && words[i - 1][0].length === 1) continue
+    // a piece that stands behind a frame's punctuation ("key=1·2·3·…") is
+    // the first of the run: the frame is kept as printed
+    const piece = words[i][0]
+    const { mat } = frameAt(piece)
+    const pieceOk = piece.length === 1 || (mat.length === 1 && piece.endsWith(mat))
+    if (!(pieceOk || (/^[A-Za-z]{1,3}$/.test(piece) && i + 1 < words.length && one(words[i + 1][0]) && cutGap(i + 1)))) continue
+    let k = i
+    while (k + 1 < words.length && k - i <= 96 && cutGap(k + 1) && one(words[k + 1][0])) k += 1
+    // the last piece's trailing punctuation is the text's own ("… 0."), not
+    // key material: the mask stops before it
+    const last = words[k][0].replace(/[^A-Za-z0-9]+$/, "")
+    const got = (piece.length === 1 ? piece : mat) + glued(words.slice(i + 1, k)) + last
+    if (k > i && got.length >= 20 && isKey(got, false)) {
+      const keep = piece.length - (piece.length === 1 ? 1 : mat.length)
+      chars.push(s.slice(cfrom, at(i) + keep), mask(got))
+      cfrom = at(k) + last.length
+      i = k
+    }
+  }
+  // what the character runs left is read by the same pass again, on the
+  // text it produced (a second pass finds no character runs to read)
+  if (chars.length) return maskCut(chars.join("") + s.slice(cfrom))
+  return out.join("") + s.slice(from)
+}
+
+// maskCaps is the vendor key written without its spaces, a run of capitals and
+// digits ("AKIAIOSF ODNN7EXA MPLE"): a whole word is the general pass's, and
+// this reading joins a run of pieces of capitals and digits when they add up
+// to an AWS key id or a long run of capitals.
+const capsRun = (s) => {
+  if (s.length > 32 * 1024 || !/[A-Z]/.test(s)) return s
+  const words = [...s.matchAll(/[\x21-\x7e]+/g)]
+  const out = []
+  let from = 0
+  for (let i = 0; i < words.length; i += 1) {
+    // three characters is a key's piece too ("AKI AIO SFO …" is a key cut
+    // into threes); the join still has to be long enough to be one, so a
+    // sentence of two capitals is not read
+    if (!/^[A-Z0-9]{3,}$/.test(words[i][0]) || !/[A-Z0-9]/.test(words[i][0])) continue
+    let j = i
+    let body = words[i][0]
+    // a piece carries the card's own separator on its end ("AKIAIO· SFODNN·…")
+    const piece = (w) => w.replace(/[·•∙‧・]+$/, "")
+    // the join stops at four times RUNCUT: a key is never longer, and a body
+    // of tiny words ("1A1 1A1 …") is otherwise re-read from every start
+    while (j + 1 < words.length && body.length < 4 * RUNCUT && s.slice(words[j].index + words[j][0].length, words[j + 1].index).length <= 2 && /^[A-Z0-9]{2,}$/.test(piece(words[j + 1][0]))) {
+      j += 1
+      body += piece(words[j][0])
+    }
+    if (j === i) continue
+    const aws = /^AKIA[0-9A-Z]{16}$/.test(body)
+    const long = body.length >= 16 && !/[a-z]/.test(body)
+    if (!aws && !long) continue
+    // a run of English words in capitals ("SEE ALSO THE DOCUMENTATION")
+    // joins to one: a sentence is longer than any key this reads, and its
+    // words are three letters or more
+    if (!aws && body.length > 40) {
+      // a sentence of capitals: no key starts inside it (a key's suffix
+      // inside a long run would have been a body over the limit too), and the
+      // next start is the end of what was read, less the length a key can be
+      i = Math.max(i, j - 13)
+      continue
+    }
+    // the same rhythm rule as the card's capitals reading: an all-capitals
+    // run needs a capital beside a digit ("AKIA…7"), or it is prose in caps
+    if (!aws && !/[A-Z][0-9]/.test(body) && !/[0-9][A-Z]/.test(body)) {
+      if (j > i) i = Math.max(i, j - 13)
+      continue
+    }
+    out.push(s.slice(from, words[i].index), mask(body))
+    from = words[j].index + words[j][0].length
+    i = j
+  }
+  return out.join("") + s.slice(from)
+}
+
+// joinedKey is the whole-value judgement the full-width reading needs: every
+// word joined back up begins at one ms- front and the rest reads as key
+// material. Unlike spacedKey's walk it does not stop at a word of letters: a
+// key cut into four-character groups has such pieces ("qmjh") in it, and the
+// walk was the full-width reading's only path to a mask — a full-width space
+// between the groups then went out with every piece printed. The mask covers
+// the whole value, so a trailing frame is hidden with it, which is what the
+// full-width reading has always done (the same value with ASCII spaces keeps
+// its frame: spacedKey finds the span there).
+const joinedKey = (s) => {
+  const words = s.trim().split(/\s+/)
+  if (words.length < 2) return false
+  const joined = words.join("")
+  const at = joined.search(/ms-/i)
+  // only punctuation may precede the front: a letter or digit before it means
+  // the "ms-" is part of a word ("Microsoftms-access…" is not a key)
+  if (at < 0 || /[A-Za-z0-9]/.test(joined.slice(0, at))) return false
+  if (joined.slice(at + 3).search(/ms-/i) >= 0) return false
+  const rest = joined.slice(at + 3)
+  return rest.length >= 11 && /\d/.test(rest) && /^[A-Za-z0-9+/=_.-]+$/.test(rest)
+}
+
+export function arg(v) {
+  const orig = String(v ?? "")
+  // the ms- front has its own joiner for pieces of any width (one to a
+  // character), and it reads the value as it was typed
+  const cut = spacedKey(orig.replace(GLUE, ""))
+  // the body spans the gaps the pieces were cut with; the key is the
+  // characters themselves, and mask() keeps its first and last four — a
+  // three-character last piece ("… nop3 456") otherwise shows the gap in the
+  // mask ("ms-a… 456")
+  // (the join is only a key when the body reads as one: "ms-cli 2026.11.9"
+  // is a program and its version, and the card keeps it)
+  if (cut && msKey(cut.body, false)) return argRun(cut.pre) + mask(cut.body.replace(/\s+/g, "")) + argRun(cut.post)
+  // a key with no ms-/sk- front, cut the same way: the pieces are joined and
+  // asked whether they read as one key (splitKey)
+  const split = splitKey(orig.replace(GLUE, ""))
+  if (split) return argRun(split.pre) + mask(split.body.replace(/\s+/g, "")) + arg(split.post)
+  // full-width pieces fold to a key; an ellipsis folds to three dots and would
+  // read as key material ("ms-a…5555" → "ms-a...5555"), so a value that
+  // already carries a mask is not asked again
+  const raw = orig.replace(GLUE, "")
+  if (!raw.includes("…")) {
+    const folded = foldedSpans(raw)
+    if (folded) return folded
+  }
+  return argRun(raw)
+}
+
+// foldedSpans reads the words that fold (a full-width key, its spaces), and
+// nothing else. The readings above have no ASCII to work on for one — it
+// carries no path, no front, no lowercase run — so their NFKC copy (case kept,
+// which is what the card judges) is read. Two things that reading must not do,
+// and both were measured:
+//  * it must not mask the value whole. "Key ＡＫＩＡ…ＰＬＥ is invalid, please
+//    retry." went out as "KeyＡ…try.": the sentence around a bad key is the
+//    user's, and what the tool read has to stay readable around what it hid.
+//  * it must not read the whole value through the cut readings. Every word of
+//    a page written in full width folds, each became a head with a scan behind
+//    it, and 25 KB of them took seconds (the reading is quadratic in the
+//    words); the cost has to be paid per span, not per page.
+// A span is a run of words joined by spaces or wide spaces, none of them prose
+// (a key is split by spaces, never by the words of a sentence), and it has to
+// fold to something a key could be: a key's front and its body, or a run long
+// enough and shaped like key material. The span as typed is masked, and the
+// text around it goes through the ordinary readings.
+const FOLDABLE = /[^\x00-\x7f]/
+const foldedSpans = (raw) => {
+  const parts = []
+  let at = 0
+  let hit = false
+  const words = []
+  for (const m of raw.matchAll(/[^\s]+/g)) words.push({ text: m[0], at: m.index })
+  // a full-width word folds; the wide space between two of them is a cut, not
+  // a sentence's space, and joins them ("ＡＫＩＡ… ＯＤＮＮ…" is one key)
+  const folds = (w) => FOLDABLE.test(w) && w.normalize("NFKC") !== w
+  // a key is shorter than 96 characters and a page of them is not a value a
+  // person typed: the span stops there, and at 128 spans, so the whole reading
+  // is linear in the value (a Chinese paragraph whose every word carries a
+  // full-width comma folds word by word, and one span over all of it was the
+  // quadratic reading this replaced)
+  const MAX_SPAN = 96
+  // a word of key material after the folded span continues the key: a
+  // full-width front ("ＡＫＩＡＩＯＳＦ") with its ASCII body ("ODNN7EXAMPLE") is
+  // one key cut by the copy, and the body does not fold, so the fold-only span
+  // stopped at the front and the body reached the terminal. Joining is gated by
+  // the same keyish test below, and a word that starts with a lowercase letter
+  // is the sentence's ("… ODNN7EXAMPLE is invalid"), not the key's, so a
+  // sentence's words are never taken.
+  const isCutGap = (g) => /^[ \t\r\n 　]+$/.test(g)
+  // a word that continues the key: key characters and carrying a digit or a
+  // capital. A word of lower-case letters is the sentence's ("… is invalid"),
+  // and "aaa1111-bbbb-…" (a body written in ASCII) carries digits, so it is.
+  const keyMat = (t) => KEYCHARS.test(t) && (/\d/.test(t) || /[A-Z]/.test(t)) && !(PROSE.test(t) && !/^[A-Z]+$/.test(t) && !keyedBody(t))
+  const endAt = (w) => w.at + w.text.length
+  let spans = 0
+  for (let i = 0; i < words.length && spans < 128; i += 1) {
+    if (!folds(words[i].text)) continue
+    let j = i
+    while (j + 1 < words.length && folds(words[j + 1].text) && endAt(words[j + 1]) - words[i].at <= MAX_SPAN) j += 1
+    const keyishOf = (k) => {
+      const folded = raw.slice(words[i].at, endAt(words[k])).normalize("NFKC")
+      return joinedKey(folded.toLowerCase()) || (folded.length >= 12 && /\d/.test(folded) && argRun(folded) !== folded)
+    }
+    // read on over the key-material words that follow the folded front (a cut
+    // is a space or a wide space), and take the longest join that reads as a
+    // key; the fold-only span is the floor
+    for (let k = j + 1; k < words.length && k - i <= 48 && endAt(words[k]) - words[i].at <= MAX_SPAN; k += 1) {
+      if (!isCutGap(raw.slice(endAt(words[k - 1]), words[k].at)) || !keyMat(words[k].text)) break
+      if (keyishOf(k)) j = k
+    }
+    // the same reading backward: an ASCII key front ("ms-a") with a full-width
+    // body is one key too, and the front does not fold. A front of a vendor's
+    // shape ("ms-", "sk-") is key material whatever its length.
+    const keyFront = (t) => keyMat(t) || VENDOR.test(t) || /^ms-/i.test(t)
+    let s0 = i
+    for (let k = i - 1; k >= 0 && i - k <= 48 && endAt(words[j]) - words[k].at <= MAX_SPAN; k -= 1) {
+      if (!isCutGap(raw.slice(endAt(words[k]), words[k + 1].at)) || !keyFront(words[k].text)) break
+      const folded = raw.slice(words[k].at, endAt(words[j])).normalize("NFKC")
+      if (!(joinedKey(folded.toLowerCase()) || (folded.length >= 12 && /\d/.test(folded) && argRun(folded) !== folded))) break
+      s0 = k
+    }
+    const start = words[s0].at
+    const stop = endAt(words[j])
+    const text = raw.slice(start, stop)
+    const folded = text.normalize("NFKC")
+    // the joined copy is the key the fold makes: the whole-value judgement
+    // (a front and its body across the pieces), or the cut readings on the
+    // span alone (a full-width vendor key: sk-ant-… is a word of its own)
+    const keyish = joinedKey(folded.toLowerCase()) || (folded.length >= 12 && /\d/.test(folded) && argRun(folded) !== folded)
+    if (keyish) {
+      parts.push(raw.slice(at, start), mask(text.replace(/\s+/g, "").trim()))
+      at = stop
+      hit = true
+      spans += 1
+    }
+    i = j
+  }
+  if (!hit) return ""
+  parts.push(raw.slice(at))
+  return parts.map((p) => (p.includes("…") ? p : argRun(p))).join("")
+}
+
+// argRun is the whitespace routes of one value, tried until none finds more
+// ("ghp_ 1234 AbCd 5678…" is one body only from 1234 on, and the front is
+// part of a key-shaped piece by then): a run of words; a line break (or a
+// wide space a full-width copy left) between two words; then the per-word
+// judgement. Each route masks strictly more, so the walk ends.
+function argRun(text) {
+  // a body of many KiB of one-character words (a pretty-printed page) costs
+  // far more reading than the masking is worth here: past 32 KiB the cut
+  // reading is skipped and the per-word pass (linear) still runs
+  if (text.length > 32 * 1024) return argWords(text)
+  // The two readings the body has are applied together, until neither finds
+  // anything: the whitespace routes (maskCut, and capsRun for a vendor key
+  // written without its spaces, "AKIAIOSF ODNN7EXA MPLE") each mask what they
+  // join, and argWords then judges every word the join did not take. One
+  // pass of each per round, so a round over ordinary text is a couple of
+  // scans, not a dozen.
+  let s = text
+  for (let n = 0; n < 4; n += 1) {
+    const next = argWords(maskCut(capsRun(s)))
+    if (next === s) break
+    s = next
+  }
+  return s
+}
+
+// frameSpan is the key's own span of a word a frame was written round:
+// "(ghp_…)" is the key and two brackets, not a key of the brackets' making.
+// The mask spends four characters at each end on the key's own characters, so
+// the frame has to stay outside it. Only punctuation is a frame here: a word
+// in front of the bracket ("x(ghp_…") is the text's, and its own reading
+// already masks the key it carries. A path is no frame either.
+const frameSpan = (w) => {
+  if (/[\\/]/.test(w)) return null
+  let a = 0
+  while (a < w.length && !/[A-Za-z0-9]/.test(w[a])) a += 1
+  let b = w.length
+  while (b > a && !/[A-Za-z0-9]/.test(w[b - 1])) b -= 1
+  if (a === 0 && b === w.length) return null
+  const body = w.slice(a, b)
+  return body ? { lead: w.slice(0, a), body, tail: w.slice(b) } : null
+}
+
+// argWords is the per-word judgement: one word key-shaped is masked whole,
+// and inside a word that is not, its key-like runs and UUIDs are masked. The
+// word in the other spellings a key is printed in — full-width characters,
+// mostly — is judged by its folded copy and masked as written.
+const argWords = (x) =>
+  show(x).replace(/[^\s]+/g, (w) => {
+    const f = w.normalize("NFKC").toLowerCase()
+    // the word as written and its fold. The capitals need no third call: a
+    // word that is already all capitals is judged whole by isKey (its slashed
+    // arm), and upper-casing a lower-case word to ask the question would read
+    // every long provider id with a date in it as a key (modelscope20261031)
+    // (what is masked is the key's own span: a word quoted in a frame —
+    // "(ghp_…)", "[ghp_…]", '"ghp_…"' — is judged whole, and masking the whole
+    // word gave the frame's punctuation the two characters the mask spends on
+    // the key's own ends: "(ghp_…Qrst)" printed "(ghp…rst)")
+    const inFrame = frameSpan(w)
+    // NAME=value: an identifier on the left of "=" or ":" and a key on the
+    // right is the variable and its value, and only the value is the secret.
+    // Judged before the whole word, because isKey reads "token=ghp_…" as one
+    // key (its compact is 20+ and alternates) and masked the variable's name
+    // too: a short "token=ghp_Abcd1234Ef" kept its name and a long one did
+    // not, so the same shape went out two ways. The left side has to read as a
+    // name (letters, digits, underscores, two or more letters) so "retry=true"
+    // and "code=ENOENT" are left alone, and the value is still a key on its own.
+    const eq = Math.max(w.indexOf("="), w.indexOf(":"))
+    if (eq > 0 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(w.slice(0, eq)) && (w.slice(0, eq).match(/[A-Za-z]/g) ?? []).length >= 2) {
+      const value = w.slice(eq + 1)
+      if (!value.includes("…") && isKey(value)) return `${w.slice(0, eq + 1)}${mask(value)}`
+    }
+    // the word as written and its lowercase fold; a full-width key with no
+    // ASCII at all is the whole-value NFKC reading's business (above), which
+    // sees it as one value rather than word by word
+    if (isKey(w) || isKey(f)) return inFrame ? inFrame.lead + mask(inFrame.body) + inFrame.tail : mask(w)
+    // the frame's own punctuation is not key material, and judging the word
+    // with it still on failed a key quoted in brackets: "(5gli9zadx8zg9jez)"
+    // went out whole — the parentheses are characters isKey's run never reads,
+    // and the word without them is a key
+    if (inFrame && isKey(inFrame.body)) return inFrame.lead + mask(inFrame.body) + inFrame.tail
+    // a value behind a flag or a frame ("--bad=SK-ANT-…", "NickName=[ghp_…")
+    // is judged by what the frame encloses
+    const kAt = w.search(/[A-Za-z]/)
+    if (kAt > 0 && !/[\\/]/.test(w.slice(0, kAt)) && isKey(w.slice(kAt))) return inFrame ? inFrame.lead + mask(inFrame.body) + inFrame.tail : mask(w)
+    // a key behind a flag or a header ("token=ghp_…", "Authorization: ghp_…")
+    // is judged by what follows the separator: it names a vendor, and a value
+    // that short is under every run floor, so nothing else here would read it
+    const sep = Math.max(w.lastIndexOf("="), w.lastIndexOf(":"))
+    if (sep > 0 && sep < w.length - 1) {
+      const value = w.slice(sep + 1)
+      if (!value.includes("…") && VENDOR.test(value) && isKey(value)) return `${w.slice(0, sep + 1)}${mask(value)}`
+    }
+    const marks = (y) => y.replace(RUN, (r) => (keyRun(r) ? mask(r) : r)).replace(UUID_ANY, (m) => mask(m))
+    const out = marks(w)
+    // the folded copy can be key-shaped where the original is not — a token
+    // written in full width has no ASCII runs and no ASCII path prefix, so the
+    // passes above saw a word of ordinary text. When the folded copy would be
+    // masked, the word is masked whole: mapping the mask back onto the
+    // original spelling is not something NFKC can promise, and the whole word
+    // is what the user typed anyway. A key already masked ("ms-a…5555") is left
+    // as it is: it is a short string of letters now, and the token shape no
+    // longer matches it — but its mask is not a word to be judged again.
+    if (out === w && (marks(f) !== f || (f.match(tokenShaped) ?? []).some((m) => msKey(m, x.trim() === w))) && !w.includes("…")) return mask(w)
+    return out
+  })
 
 // SENDABLE is the plugin's own test (index.mjs's tokenOf): a key with
 // anything but visible ASCII in it goes out in a Cookie/Authorization header
@@ -554,33 +1611,50 @@ function hostOf(chat) {
 const oursOf = (p) => p?.id === PRESET || p?.preset === PRESET || hostOf(p?.chat) === HOST
 const keyedOf = (p) => typeof p?.key === "string" && Boolean(p.key.trim())
 
-// 插件侧的账号：主键 msmoli 与 msmoli#xxxxxx，按令牌区分。
+// The plugin-side accounts: the primary key msmoli plus msmoli#xxxxxx, told
+// apart by token.
 //
-// 令牌只从 type === "api" 的条目上读——和插件自己（index.mjs 的 rawKey）同一条
-// 规则。少这一条时，一份把 key 放错位置或类型写歪的 plugin-auth.json，会让本
-// 工具说「插件已用同一把令牌、无需操作」，而插件读不到令牌、卡片永远显示未登录：
-// 一个静默的错误状态，比报错更难发现。
+// The token is only read from entries with type === "api" — the same rule the
+// plugin itself uses (rawKey in index.mjs). Without that rule, a
+// plugin-auth.json that puts the key in the wrong place or writes the wrong
+// type would make this tool say the plugin already uses the same token and
+// nothing needs doing, while the plugin cannot read the token and the card
+// always shows signed out: a silent wrong state is harder to notice than an
+// error.
+// site is the origin the plugin recorded for the account after its own probe
+// ("https://modelscope.ai" for an international one, cleared for a domestic
+// one). It is empty when the account has never been probed, and an empty site
+// is not evidence of either.
 export function pluginAccounts(auth) {
   const obj = auth && typeof auth === "object" && !Array.isArray(auth) ? auth : {}
   return Object.entries(obj)
     .filter(([k]) => k === ID || k.startsWith(`${ID}#`))
-    .map(([name, v]) => ({ name, token: v?.type === "api" && typeof v.key === "string" ? v.key.trim() : "" }))
+    .map(([name, v]) => ({
+      name,
+      token: v?.type === "api" && typeof v.key === "string" ? v.key.trim() : "",
+      site: typeof v?.site === "string" ? v.site : "",
+    }))
 }
 
 // { action: "noop" | "run" | "refuse", lines: string[], cmds: [{ argv, stdin? }] }
 export function planToPlugin({ preset, accounts, force }) {
   const lines = []
-  const same = accounts.find((a) => a.token === preset.key)
-  if (same) {
-    lines.push(`✓ 插件已用同一把令牌（${mask(preset.key)}），无需操作。`)
-    return { action: "noop", lines, cmds: [] }
+  // A key field of the wrong type is a source this tool cannot read, not an
+  // empty one: SENDABLE.test() would coerce 12345 to "12345" and plan a login
+  // with it. Refused here for the same reason planToPreset refuses it.
+  // keyRaw is what presetCandidates kept for a non-string field; a caller
+  // that hands the raw entry over directly has none, and its `key` still
+  // holds the original value.
+  const rawKey = "keyRaw" in preset ? preset.keyRaw : preset.key
+  if (rawKey !== undefined && typeof rawKey !== "string") {
+    lines.push(`✗ 内置预设 ${arg(preset.id)} 的 key 不是字符串（${rawKey === null ? "null" : typeof rawKey}），读不出它现在是什么。`)
+    lines.push(`  先修好 providers.json 里那一项（或删掉它），再重跑：magpie provider key ${arg(preset.id)} <key>。`)
+    return { action: "refuse", lines, cmds: [] }
   }
-  // The plugin refuses a key with anything but visible ASCII in it (tokenOf:
-  // it would go out in a Cookie header), so logging one in would report a
-  // success that leaves every check-in saying "令牌内容无法识别".
-  // planToPreset has the same guard for the same reason; this direction was
-  // missing it, and a key with a zero-width character in it — invisible in
-  // every terminal and in this tool's own mask — went through.
+  // The SENDABLE guard runs before the "already the same" check: two files
+  // holding the same key with a space in it are "the same" and unusable, and
+  // reporting noop would tell the user everything is fine while every
+  // check-in reports a token it cannot recognise.
   if (!SENDABLE.test(preset.key)) {
     lines.push(`✗ 内置预设的 key 含空格、换行或非 ASCII 字符，插件发不出去，不登录。`)
     // the provider the user actually has, not the preset's default id: a
@@ -590,14 +1664,20 @@ export function planToPlugin({ preset, accounts, force }) {
     lines.push(`  先修好内置那边的 key（magpie provider key ${arg(preset.id)} <key>）。`)
     return { action: "refuse", lines, cmds: [] }
   }
+  const same = accounts.find((a) => a.token === preset.key)
+  if (same) {
+    lines.push(`✓ 插件已用同一把令牌（${mask(preset.key)}），无需操作。`)
+    return { action: "noop", lines, cmds: [] }
+  }
   if (accounts.length === 0) {
     lines.push(`→ 将把内置预设（${arg(preset.id)}）的令牌登录给插件：magpie plugin login ${ID}（令牌走 stdin）`)
     return { action: "run", lines, cmds: [{ argv: ["plugin", "login", ID], stdin: `${preset.key}\n`, secret: preset.key }] }
   }
   // Every entry is there but none carries a token the plugin itself would read
-  // (a msmoli entry of the wrong type, or a key that is not a string). "两边
-  // 令牌不同" is a claim we cannot make here — we never read the plugin's side —
-  // and --force would not help: the file is the problem, not the choice.
+  // (a msmoli entry of the wrong type, or a key that is not a string). "The
+  // tokens differ on the two sides" is a claim we cannot make here — we never
+  // read the plugin's side — and --force would not help: the file is the
+  // problem, not the choice.
   if (accounts.every((a) => !a.token)) {
     lines.push(`✗ 插件里 ${ID} 的条目读不出令牌（type 不是 api，或 key 不是字符串）。`)
     lines.push(`  magpie 也不会把它算作登录。${arg(accounts[0].name)} 那个条目请先删掉或重新登录，再重跑。`)
@@ -621,25 +1701,47 @@ export function planToPlugin({ preset, accounts, force }) {
     action: "run",
     lines,
     cmds: [
-      // logout 也带 secret：被换掉的那把是真实凭据，magpie 的报错若回显
-      // 账号（"no key ms-… for provider"）不该把整串放上终端
+      // logout carries the secret too: the key being replaced is a real
+      // credential, and a magpie error that echoes the account ("no key ms-…
+      // for provider") must not put the whole string on the terminal
       { argv: ["plugin", "logout", ID], stdin: "", secret: accounts[0].token },
       { argv: ["plugin", "login", ID], stdin: `${preset.key}\n`, secret: preset.key },
     ],
   }
 }
 
-// provider key 是整条替换主 key，聊天请求正在用它——所以默认也要求 --force。
+// provider key replaces the whole main key and chat requests are using it — so
+// this direction demands --force by default too.
 export function planToPreset({ preset, accounts, force }) {
   const lines = []
   const main = accounts.find((a) => a.name === ID)
+  // An entry that is there but carries no token the plugin would read (a
+  // msmoli entry of the wrong type, or a key that is not a string) is not a
+  // missing login: telling the user to log in sends them nowhere, and the
+  // `--to-plugin` advice the message below carries refuses the same file. The
+  // forward direction already says it this way.
+  if (main && !main.token) {
+    lines.push(`✗ 插件里 ${arg(main.name)} 的条目读不出令牌（type 不是 api，或 key 不是字符串）。`)
+    lines.push(`  magpie 也不会把它算作登录。请先删掉这个条目或重新登录（magpie plugin login ${ID}），再重跑。`)
+    return { action: "refuse", lines, cmds: [] }
+  }
   if (!main?.token) {
     // A second account holding the token the preset already has is the state
     // a forced replace leaves behind (or a re-login after a nickname write).
-    // There is nothing to sync, and "主账号没有登录" would read as "your
-    // plugin is signed out" while --to-plugin answers "无需操作" for the very
-    // same pair of files.
+    // There is nothing to sync, and "the main account is not signed in" would
+    // read as "your plugin is signed out" while --to-plugin answers "nothing
+    // to do" for the very same pair of files.
     const same = preset && accounts.find((a) => a.token && a.token === preset.key)
+    // SENDABLE runs before the noop, here as in planToPlugin: two sides that
+    // hold the same unusable key are "the same", and noop would call that
+    // healthy. A key with a space in it cannot be sent at all, whichever side
+    // it came from — this is the reverse direction's only early exit, and the
+    // main-account and forward paths refuse it.
+    if (same && preset && !SENDABLE.test(preset.key)) {
+      lines.push(`✗ 两边是同一把令牌，但它含空格、换行或非 ASCII 字符，发不出去。`)
+      lines.push(`  先修好内置那边的 key（magpie provider key ${arg(preset.id)} <key>），或重新登录插件。`)
+      return { action: "refuse", lines, cmds: [] }
+    }
     if (same) {
       lines.push(`✓ 插件的 ${arg(same.name)} 已与内置预设用同一把令牌（${mask(same.token)}），无需操作。`)
       return { action: "noop", lines, cmds: [] }
@@ -653,27 +1755,62 @@ export function planToPreset({ preset, accounts, force }) {
     lines.push(`  要加的话：magpie provider add ${PRESET} <key>（工具不代建 provider）。`)
     return { action: "refuse", lines, cmds: [] }
   }
-  if (preset.key === main.token) {
-    lines.push(`✓ 内置预设已用同一把令牌（${mask(main.token)}），无需操作。`)
-    return { action: "noop", lines, cmds: [] }
+  // A key field that is there but is not a string is not an empty slot. keyedOf
+  // answers "no key" for any other type, and this direction treats that as a
+  // preset with nothing to lose — so {"key": null} was written over without
+  // --force, and {"key": 12345} was announced as "现有 key（（不可用））会被整条
+  // 替换". Either way the user's replacement decision was skipped or unreadable.
+  // Absent and "" are the two spellings of a slot with nothing to lose, and
+  // both have a type of "string" (or undefined): the test is the type alone.
+  const rawKey = "keyRaw" in preset ? preset.keyRaw : preset.key
+  if (rawKey !== undefined && typeof rawKey !== "string") {
+    lines.push(`✗ 内置预设 ${arg(preset.id)} 的 key 不是字符串（${rawKey === null ? "null" : typeof rawKey}），读不出它现在是什么。`)
+    lines.push(`  请先修好 providers.json 里那一项（或删掉它），再重跑：magpie provider key ${arg(preset.id)} <key>。`)
+    return { action: "refuse", lines, cmds: [] }
   }
-  lines.push(`  插件主账号：${ID}（${mask(main.token)}）`)
-  lines.push(`  内置预设：${arg(preset.id)}，现有 key（${mask(preset.key)}）会被整条替换。`)
   // The plugin refuses a key with anything but visible ASCII in it (tokenOf,
   // it would go out in an Authorization header). Writing such a key into the
-  // preset would break chat requests while this tool reported success.
+  // preset would break chat requests while this tool reported success — and
+  // "both sides already hold this key" is not a healthy state to call done.
   if (!SENDABLE.test(main.token)) {
     lines.push(`✗ 插件里那把令牌含空格、换行或非 ASCII 字符，发不出去，不写进内置预设。`)
     lines.push(`  先修好插件那边的登录（magpie plugin login ${ID}）。`)
     return { action: "refuse", lines, cmds: [] }
   }
-  // provider key 的第一个参数是 id：一个以 "-" 开头的 id 会被 magpie 的 CLI
-  // 当成 flag（`provider key --help <token>` 只打印帮助、不写 key）。
+  // An ms- token answers 401 on the site it did not come from, and the plugin
+  // records which site an account belongs to after its own probe. The preset
+  // this direction writes into chats with api-inference.modelscope.cn only, so
+  // an international token there would 401 on every request while this tool
+  // said ✓. Measured before the check: `--to-preset --force` wrote it and
+  // answered rc=0.
+  if (main.site && main.site !== CN_SITE) {
+    lines.push(`✗ 插件主账号是国际站（${arg(main.site)}）的令牌，内置预设只对国内站有效，写进去聊天会 401。`)
+    lines.push(`  国际站账号请在 magpie 里单独加一个 provider（chat 指向 api-inference.modelscope.ai）。`)
+    return { action: "refuse", lines, cmds: [] }
+  }
+  if (preset.key === main.token) {
+    lines.push(`✓ 内置预设已用同一把令牌（${mask(main.token)}），无需操作。`)
+    return { action: "noop", lines, cmds: [] }
+  }
+  lines.push(`  插件主账号：${ID}（${mask(main.token)}）`)
+  // an empty key is a preset with nothing to lose: this is the write that
+  // fills it, and the wording should not claim a key is being replaced
+  lines.push(
+    preset.key
+      ? `  内置预设：${arg(preset.id)}，现有 key（${mask(preset.key)}）会被整条替换。`
+      : `  内置预设：${arg(preset.id)}，现在没有 key，会被填上。`,
+  )
+  // The first argument of provider key is the id: an id starting with "-"
+  // would be taken as a flag by magpie's CLI (`provider key --help <token>`
+  // only prints help and writes no key).
   if (typeof preset.id !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(preset.id)) {
     lines.push(`✗ 这个 provider id 不是 magpie 接受的形状（${arg(preset.id)}），不能用 provider key 写入。`)
     return { action: "refuse", lines, cmds: [] }
   }
-  if (!force) {
+  // --force is the permission to *replace* a key chat may be using. A preset
+  // with no key has nothing to replace: filling it is the whole point, and
+  // asking for --force there was a refusal the README never promised.
+  if (!force && preset.key) {
     lines.push(`✗ 内置这把 key 是聊天请求正在用的，替换会让那边跟着换。确认的话加 --force 重跑。`)
     return { action: "refuse", lines, cmds: [] }
   }
@@ -685,10 +1822,11 @@ export function planToPreset({ preset, accounts, force }) {
   return { action: "run", lines, cmds: [{ argv: ["provider", "key", preset.id, main.token], secret: main.token, also: preset.key }] }
 }
 
-// ---- 执行
+// ---- execution
 
-// 多步序列（--force 的 logout→login）中途失败：logout 已经发生了，用户此刻
-// 是被登出的状态。超时（r.error）与退出码非零（r.status）都要说这句话。
+// A multi-step sequence (--force's logout→login) failing midway: the logout
+// has already happened, so the user is signed out at this moment. Both a
+// timeout (r.error) and a nonzero exit code (r.status) must say this.
 const RECOVER = `注意：前面的步骤已经执行，现有登录已被登出。重新运行同一条命令即可继续（此时插件没有账号，会直接登录，无需 --force）。`
 
 function hidden(argv, secret, log) {
@@ -707,25 +1845,46 @@ function hidden(argv, secret, log) {
 // the text that is a contiguous substring of the secret, at least MIN_ECHO
 // characters long — below that a coincidence is likelier than an echo. It is
 // the same rule index.mjs's cardText carries, and the same reason.
-const MIN_ECHO = 12
+// the same floor as index.mjs's card mask: a piece of the secret this long is
+// an echo, and the scan starts one character past a shorter run
+const MIN_ECHO = 10
+// An echo is compared folded: NFKC (full-width look-alikes are the same
+// credential) and lower case (upper-casing a log does not make it another
+// key), letters and digits only. Comparing byte for byte let either change
+// print the whole secret.
+const fold = (s) => (typeof s === "string" ? s.normalize("NFKC").toLowerCase().replace(/[^a-z0-9]/g, "") : "")
 function maskEchoes(s, secret) {
-  if (typeof secret !== "string" || secret.length < MIN_ECHO) return s
-  // a control or format character inside the echo is stepped over, for the
-  // reason show()'s shape steps over one — a line break too: this is a piece
-  // of the real secret, and one broken across two lines is still the secret
+  if (typeof secret !== "string") return s
+  // The secret's own alphanumeric run is what the scan compares against.
+  // Collecting "the characters the secret is made of" instead let a character
+  // the secret genuinely holds be used as a cutter: a hyphen every 11
+  // characters (every ms- key carries hyphens) split the echo into runs each
+  // under MIN_ECHO. Punctuation is a separator whether the secret holds it or
+  // not; only its letters and digits say "this is the secret". Anything else —
+  // a control character, a space, a comma, a piece of punctuation a child
+  // wrapped the echo in — is stepped over and the pieces on either side joined
+  // for the comparison. It is the same rule index.mjs's cardText carries (a
+  // whitelist of separators cannot cover an open set), and here it is what
+  // keeps a secret broken across a line, or printed under a prefix, whole.
   //
-  // The matching runs over the visible characters alone, in one pass, and the
-  // spans are put back afterwards. Stepping over a character as the scan went
-  // — and restarting one position later when the run came up short — cost a
-  // run of them its own length at every position it held: a child's output of
-  // 20 000 control characters took 79 seconds.
+  // The matching runs over those characters alone, in one pass, and the spans
+  // are put back afterwards. Stepping over a character as the scan went — and
+  // restarting one position later when the run came up short — cost a run of
+  // them its own length at every position it held: a child's output of 20 000
+  // control characters took 79 seconds.
+  const flat = fold(secret)
+  if (flat.length < MIN_ECHO) return s
   const vis = []
   const at = []
+  const end = []
   for (let i = 0; i < s.length; ) {
     const c = String.fromCodePoint(s.codePointAt(i))
-    if (!invisible(c)) {
-      vis.push(c)
-      at.push(i)
+    for (const f of c.normalize("NFKC").toLowerCase()) {
+      if (f >= "a" && f <= "z" || f >= "0" && f <= "9") {
+        vis.push(f)
+        at.push(i)
+        end.push(i + c.length)
+      }
     }
     i += c.length
   }
@@ -734,17 +1893,51 @@ function maskEchoes(s, secret) {
   for (let k = 0; k < vis.length; ) {
     let piece = ""
     let v = k
-    while (v < vis.length && secret.includes(piece + vis[v])) {
-      piece += vis[v]
-      v++
+    let fillers = 0
+    while (v < vis.length) {
+      if (flat.includes(piece + vis[v])) {
+        piece += vis[v]
+        v++
+        continue
+      }
+      // characters the secret does not hold here, between two pieces of it: a
+      // child that prints "01234567x 89abcdefx …" writes pieces under MIN_ECHO
+      // with one letter between them, and the pieces together are the key. Up
+      // to as many as the run has already matched are stepped over — an echo
+      // is mostly the secret — and the run resumes at the first that continues
+      // it. Only inside a run: skipping a leading character before anything
+      // matched swallows the word in front of the key. The same rule, and the
+      // same reason, as index.mjs's card mask.
+      if (piece.length === 0) break
+      // one character is stepped over however little has matched; more than
+      // one only when the run is already long enough to be an echo on its own
+      // (MIN_ECHO, the same floor the mask applies). Without that second half,
+      // "said: aaaa1111-b" matched the last s of "said" and then skipped "id"
+      // to join the piece, and a 9-character slice that the floor is meant to
+      // leave alone was masked as if it were longer. Here the source text
+      // after the cut is "01234 56789…", and "234 56789" are not a piece to
+      // bridge.
+      if (piece.length < MIN_ECHO) break
+      const stop = Math.min(vis.length, v + 1 + (piece.length - fillers))
+      let hit = -1
+      for (let j = v + 1; j < stop; j += 1) if (flat.includes(piece + vis[j])) { hit = j; break }
+      if (hit < 0) break
+      fillers += hit - v
+      v = hit
     }
+    // the floor counts the secret's own characters, not the punctuation the
+    // echo wrote them in — the same rule, and the same reason, as index.mjs's
+    // card mask
     if (piece.length >= MIN_ECHO) {
+      // what sat between the last character written and the run's first one is
+      // written out first, so masking does not swallow the words around it
+      out += s.slice(from, at[k])
       out += mask(secret)
-      from = at[v - 1] + vis[v - 1].length
+      from = end[v - 1]
       k = v
     } else {
-      out += s.slice(from, at[k] + vis[k].length)
-      from = at[k] + vis[k].length
+      out += s.slice(from, end[k])
+      from = end[k]
       k++
     }
   }
@@ -766,15 +1959,33 @@ function maskEchoes(s, secret) {
 // escape sequence in the child's output cannot reach the terminal either.
 // scrub() alone, with only the known secrets, was the leak the failing path
 // had.
-function scrub(out, ...secrets) {
+export function scrub(out, ...secrets) {
+  // the known secrets first: maskEchoes finds a piece of one whatever cut it
+  // into and prints it as that key's own mask ("ms-a…5555"), which says more
+  // than the shape pass can. Run the other way round, a key echo cut by
+  // spaces was already masked as an anonymous run ("aaaa…5555") and the
+  // better reading never saw it.
   let s = out
   for (const secret of secrets) {
     if (secret) s = maskEchoes(s.split(secret).join(mask(secret)), secret)
   }
-  // arg() per line, not over the whole text: its control-character pass turns
-  // "\n" into a space too, and both callers split on the line breaks to echo
-  // (or quote) the child's answer. A token never spans a line, so the shape
-  // pass loses nothing by running per line either.
+  if (s.length <= 32 * 1024) s = maskCut(s)
+  // arg() over the whole text first: its run reading covers a key cut by a
+  // line break or by spaces across the child's lines (a wrapped page, a
+  // pretty-printed error), which a line at a time cannot see. Then per line,
+  // as before: the control-character pass turns "\n" into a space, and both
+  // callers split on the line breaks to echo (or quote) the child's answer.
+  // a key the child wrapped is one key across the line break: the join is
+  // read over the whole text here, before the lines are split. Measured: a UUID
+  // cut at a line break went out whole, because each line held a piece under
+  // every floor.
+  for (const join of [spacedKey, splitKey]) {
+    const cut = join(s)
+    if (cut && msKey(cut.body, false)) {
+      s = cut.pre + mask(cut.body.replace(/\s+/g, "")) + cut.post
+      break
+    }
+  }
   return s.replace(/\r\n?/g, "\n").split("\n").map(arg).join("\n")
 }
 
@@ -812,17 +2023,19 @@ function run(cmds, bin, { dryRun, log, spawn = spawnSync, timeout = 120_000 }) {
       throw e
     }
     if (r.status !== 0) {
-      // a child killed by a signal has status null; "退出码 null" tells nobody anything
+      // a child killed by a signal has status null; "exit code null" tells nobody anything
       const why = r.status === null && r.signal ? `被信号 ${r.signal} 终止` : `退出码 ${r.status}`
       const said = scrub(out, secret, ...secrets).split("\n").filter(Boolean).slice(-3).join("\n")
       const e = new Error(`magpie 命令失败（${why}）${said ? `：\n${said}` : ""}`)
-      // 多步序列（--force 的 logout→login）中途失败：logout 已经发生了，
-      // 用户此刻是被登出的状态。说清楚，并告诉他重跑即可续上——
-      // 此时插件已无账号，重跑走的是全新登录那条路，不再需要 --force。
+      // A multi-step sequence (--force's logout→login) failing midway: the
+      // logout has already happened, so the user is signed out at this moment.
+      // Say so, and tell them a rerun simply continues — with no account left
+      // in the plugin, the rerun takes the fresh-login path and needs no --force.
       if (i > 0) e.recover = RECOVER
       throw e
     }
-    // magpie 自己就把令牌显示成掩码；将来若变，这里兜底再滤一遍
+    // magpie itself already displays the token masked; should that ever change,
+    // this filters it again as a backstop
     for (const line of scrub(out, secret, ...secrets).split("\n")) if (line.trim()) log(`  ${line}`)
   }
 }
@@ -844,6 +2057,148 @@ function unreadableAfter(name, dir, want, log, where = "插件列表") {
 const runnable = (bin, os, exists) =>
   exists(bin) || (os === "win32" && !/\.[^\\/.]+$/.test(bin) && [".com", ".exe"].some((x) => exists(bin + x)))
 
+// wrapperTarget follows a launcher script to the binary it finally runs.
+// appdir.Resolve judges the executable as the process really is — what
+// os.Executable() answers after an exec chain is the final binary, not the
+// shim — so the folder magpie keeps its config in is the exec target's, and a
+// shim with a data/ folder beside it must not win the --dir guard: the guard
+// passed while the write landed in the wrapped binary's own config, and the
+// read-back then blamed "magpie 是否在正常运行". "" means "not a launcher, or
+// a launcher whose target we cannot name"; a caller that needs to tell the two
+// apart asks isWrapper as well. A chain is followed hop by hop while each
+// target is itself a script, bounded and cycle-checked: eight is well past any
+// launcher chain a real install builds. The bound is what the result depends
+// on — a cycle also ends on it, so removing the cycle check changes nothing a
+// caller can see (pinned by the chain test; the check is here to keep a
+// longer bound from walking one file forever). Two shapes are deliberately
+// left unresolved rather than guessed: a target preceded by a flag
+// (`exec -a name /path`), and a target that is not a literal path
+// (`exec "$(command -v magpie)"`). A line that only looks like an exec — a
+// usage string, a heredoc body — is followed as if it were one; the guard
+// still refuses a mismatch and the read-back still says a wrapper was
+// involved, so the mistake lands on the side of asking.
+const wrapperTarget = (bin) => {
+  let path = bin
+  const seen = new Set()
+  for (let hop = 0; hop < 8; hop++) {
+    if (seen.has(path)) return ""
+    seen.add(path)
+    let fd
+    try {
+      fd = openSync(path, "r")
+      const head = Buffer.alloc(4096)
+      const n = readSync(fd, head, 0, head.length, 0)
+      const text = head.subarray(0, n).toString("utf8")
+      if (!text.startsWith("#!")) return hop === 0 ? "" : path
+      // an `exec` line a launcher writes: "exec /path/magpie \"$@\"", with an
+      // optional env assignment in front and an optional quote round the path.
+      // The first one whose target exists is taken; a target that is not a
+      // plain path ("$(command -v magpie)") never exists as one and is passed
+      // over, which is what leaves a dynamic launcher unresolved.
+      // A shebang that names another program (#!/usr/bin/env node, #!/usr/bin/python3)
+      // is not a shell launcher: the file is what runs, and its body is that
+      // program's source — a source with a shift ("1 << 16") is not a
+      // here-document, and reading it as one refused a launcher whose target is
+      // a node entry point.
+      if (!/^#![^\n]*\b(?:sh|bash|zsh|dash|ksh|ash)\b/.test(text)) return hop === 0 ? "" : path
+      // A here-document is text, not the script: its body is skipped and the
+      // exec line after it is the target (a script that prints usage before it
+      // starts is an ordinary shape). The word "exec" inside a body only matters
+      // when the body is the only place one appears — a script whose sole exec
+      // is inside a usage block starts something the text does not name, and
+      // that is unresolved rather than guessed.
+      const lines = text.split("\n")
+      const live = []
+      let heredocExec = false
+      for (let li = 0; li < lines.length; li += 1) {
+        live.push(lines[li])
+        const open = /<<-?\s*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/.exec(lines[li])
+        if (!open) continue
+        const word = open[1] ?? open[2] ?? open[3]
+        const stripTabs = /^<<-/.test(open[0])
+        for (li += 1; li < lines.length; li += 1) {
+          const body = stripTabs ? lines[li].replace(/^\t+/, "") : lines[li]
+          if (body === word) break
+          // the word may sit anywhere in the body ("usage: exec /usr/bin/x")
+          if (/\bexec\s+\S/.test(lines[li])) heredocExec = true
+        }
+      }
+
+      let next = ""
+      let sawExec = false
+      let unsettled = false
+      const targets = new Set()
+      for (const line of live) {
+        const m = /^\s*exec\s+(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(line)
+        if (!m) continue
+        sawExec = true
+        const target = m[1] ?? m[2] ?? m[3] ?? ""
+        if (!target || target.startsWith("-")) continue
+        // a relative target is resolved against the shell's working folder,
+        // not the script's: what lies beside the script is a guess, and this
+        // program has no business writing a credential into a guess. It also
+        // spoils the whole launcher: a script with one absolute exec and one
+        // relative is two branches, and the branch that runs is not in the
+        // text — dropping the one we could not read and calling the rest
+        // settled was the same mistake as following the wrong branch.
+        if (!isAbsolute(target)) {
+          unsettled = true
+          continue
+        }
+        targets.add(target)
+        if (existsSync(target)) next = target
+      }
+      if (!sawExec && heredocExec) return ""
+      if (unsettled) return ""
+      // Two different exec lines are two possible targets — an if/else, a
+      // fallback chain — and which one runs is not something a text read can
+      // settle. Unresolved beats following the wrong branch.
+      if (targets.size > 1) return ""
+      // no exec line at all: this file is the bottom of the chain, the binary
+      // the chain finally runs. One that execs a target which exists nowhere
+      // claims to run something we cannot find — that launcher stays
+      // unresolved, and a write is refused rather than guessed.
+      if (!next) return sawExec ? "" : path
+      path = next
+    } catch {
+      return ""
+    } finally {
+      if (fd !== undefined) {
+        try {
+          closeSync(fd)
+        } catch {}
+      }
+    }
+  }
+  return ""
+}
+
+// isWrapper is a path that is really a launcher — a file that begins with "#!".
+// Two bytes are enough, and a binary that cannot be read is not a wrapper.
+const isWrapper = (bin) => {
+  let fd
+  try {
+    fd = openSync(bin, "r")
+    const head = Buffer.alloc(2)
+    return readSync(fd, head, 0, 2, 0) === 2 && head[0] === 0x23 && head[1] === 0x21
+  } catch {
+    return false
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd)
+      } catch {}
+    }
+  }
+}
+
+// wrapperNote is the read-back suffix for a launcher we could not follow: the
+// guard asked about the script's own folder, so a write that went to the
+// wrapped binary's folder instead shows up exactly here, as a token that is
+// missing.
+const wrapperNote = (bin) =>
+  isWrapper(bin) && !wrapperTarget(bin) ? "；--magpie 是包装脚本，它最终启动的 magpie 定位不到，写入可能落在别的目录里" : ""
+
 // showPath is a file inside the folder the user typed. The folder goes through
 // arg() — a token pasted into --dir must not ride along inside the joined path
 // — and the file's own name is ours, printed as is.
@@ -870,6 +2225,10 @@ export async function main({
     log(USAGE)
     return 0
   }
+  if (args.version) {
+    log(`magpie-plugin-msmoli ${VERSION}`)
+    return 0
+  }
 
   // No PATH fallback: `magpie` resolved through PATH can be a file the user
   // never installed — npx puts the project's node_modules/.bin first, so a
@@ -889,7 +2248,9 @@ export async function main({
     return 1
   }
   const bin = args.magpie || findMagpieBin({ env, os, exists, home })
-  const dir = args.dir || findConfigDir({ env, home, os, exists, binPath: bin })
+  // The folder is the one the binary that actually runs keeps its config in:
+  // for a launcher script that is the exec target, not the script's own folder.
+  const dir = args.dir || findConfigDir({ env, home, os, exists, binPath: wrapperTarget(bin) || bin })
   if (!dir) {
     log(`✗ 没找到 magpie 的配置目录。`)
     log(`  试过 $XDG_CONFIG_HOME/magpie 和 ~/.config/magpie。便携版请用 --dir 指定它的 data 目录。`)
@@ -933,9 +2294,12 @@ export async function main({
     return 1
   }
   const accounts = pluginAccounts(authRaw)
-  const cands = presetCandidates(providers, args.from)
+  // --to-preset writes into the provider, so one that is there but has no key
+  // is a destination, not "unconfigured"; --to-plugin needs a key to read.
+  const cands = presetCandidates(providers, args.from, args.to !== "preset")
 
-  log(`  内置 ModelScope：${cands.length === 1 ? `${arg(cands[0].id)}（${mask(cands[0].key)}）` : cands.length ? "多个候选" : "未配置"}`)
+  const shownPreset = (p) => `${arg(p.id)}（${keyedOf(p) ? mask(p.key) : "还没有 key"}）`
+  log(`  内置 ModelScope：${cands.length === 1 ? shownPreset(cands[0]) : cands.length ? "多个候选" : "未配置"}`)
   log(`  签到插件 msmoli：${accounts.length ? accounts.map((a) => `${arg(a.name)}（${mask(a.token)}）`).join("、") : "未登录"}`)
 
   if (cands.length > 1) {
@@ -951,8 +2315,9 @@ export async function main({
     return 1
   }
   const preset = cands[0] ?? null
-  // 无预设时两条方向都该给指引：--to-preset 也有自己的话术（planToPreset 里），
-  // 但这里先统一拦住，免得 null 一路传到 plan 里崩栈
+  // With no preset, both directions deserve guidance: --to-preset has its own
+  // wording (in planToPreset), but it is stopped here first so a null does not
+  // travel all the way into plan and blow the stack
   if (!preset) {
     const all = Array.isArray(providers) ? providers : []
     // A candidate needs a key, and a provider that is ours but has none is not
@@ -989,15 +2354,24 @@ export async function main({
 
   const plan = args.to === "preset" ? planToPreset({ preset, accounts, force: args.force }) : planToPlugin({ preset, accounts, force: args.force })
   for (const line of plan.lines) log(line)
-  if (plan.action !== "run") return plan.action === "noop" ? 0 : 1
+  // --status promises "report only", and the annotation is what says so. It has
+  // to cover the noop and refuse answers too: they are conclusions, not plans,
+  // and a reader scripting the output could not otherwise tell a report from a
+  // run that had happened. The exit code still carries the verdict.
+  if (plan.action !== "run") {
+    if (args.status) log(`(--status：以上是计划，未执行)`)
+    return plan.action === "noop" ? 0 : 1
+  }
 
-  // --status 是「只报告」，先于方向判断：只给 --status 时该说「这是计划」，
-  // 而不是提示用户去指定方向——他要的就是报告
+  // --status means "report only", and it comes before the direction check: with
+  // only --status it should say "this is the plan", not tell the user to pick
+  // a direction — a report is exactly what they asked for
   if (args.status) {
     log(`(--status：以上是计划，未执行)`)
     return 0
   }
-  // 不带 --to-* 时只报计划：裸跑 npx 不该静默写入一个凭据
+  // Without --to-* it only reports the plan: a bare npx run must not silently
+  // write a credential
   if (!args.to) {
     log(`(要执行请显式指定方向：--to-plugin 或 --to-preset)`)
     if (args.dryRun) log(`(--dry-run：未执行)`)
@@ -1021,8 +2395,26 @@ export async function main({
   // the magpie.exe beside it, and a check gated on exists(bin) alone skipped
   // itself there — a fixture's --dir was read while the real magpie wrote its
   // own folder.
+  // The refusal comes first, outside the --dir guard: a run that lets the
+  // folder be inferred writes just the same, and an unnameable launcher may
+  // write anywhere — the folder it was inferred from is the script's, and the
+  // script is not what runs.
+  if (!args.dryRun && bin && runnable(bin, os, exists) && isWrapper(bin) && !wrapperTarget(bin)) {
+    log(`✗ --magpie 是包装脚本（${arg(bin)}），但看不出它最终启动哪个 magpie，写入会落在它自己的目录里——那可能不是这里读的目录。`)
+    log(`  读的是：${arg(dir)}`)
+    log(`  请把 --magpie 指到真正的 magpie 二进制（不是启动脚本），或去掉 --magpie 让它自动探测。`)
+    return 1
+  }
   if (!args.dryRun && args.dir && bin && runnable(bin, os, exists)) {
-    const binDir = findConfigDir({ env, home, os, exists, binPath: bin })
+    // A launcher script writes wherever the binary it execs keeps its config,
+    // and that folder is not the one this path implies: a shim beside a data/
+    // folder passed this guard while the write landed in the wrapped binary's
+    // own config, and the read-back then blamed "magpie 是否在正常运行". The
+    // exec target is read out of the script when it names one; a script that
+    // names none has no folder of its own either way, and the guard still asks
+    // about the path as before.
+    const wrapped = wrapperTarget(bin)
+    const binDir = findConfigDir({ env, home, os, exists, binPath: wrapped || bin })
     // "" is a mismatch too: the binary has no magpie folder of ours to write
     // to, so it would make one — and that one is not the folder named. Compared
     // by folder identity, not by string: a shell completes a directory with a
@@ -1047,9 +2439,11 @@ export async function main({
     return 0
   }
 
-  // 回读验证，别只信退出码（方向判断与上面 plan 那行保持一致）。
-  // 回读读不动（null）是另一回事：把它报成「没找到令牌」会把人推去查
-  // magpie 是否在运行，而写入其实成功了——两种失败要分开说。
+  // Verify by reading back, do not trust only the exit code (the direction
+  // check matches the plan line above). An unreadable read-back (null) is a
+  // different matter: reporting it as "the token was not found" sends people
+  // to check whether magpie is running, when the write actually succeeded —
+  // the two failures must be told apart.
   const want = plan.cmds.at(-1).secret
   if (want) {
     if (args.to === "preset") {
@@ -1057,23 +2451,25 @@ export async function main({
       if (raw === null || !shaped(raw)) return unreadableAfter("providers.json", dir, want, log, "供应商列表")
       const after = presetCandidates(raw?.providers, preset.id)
       if (!after.some((p) => p.key === want)) {
-        log(`✗ 写入后回读没找到目标 key（${mask(want)}）——检查 magpie 是否在正常运行。`)
+        log(`✗ 写入后回读没找到目标 key（${mask(want)}）——检查 magpie 是否在正常运行${wrapperNote(bin)}。`)
         return 1
       }
     } else {
       const raw = readJson(join(dir, "plugin-auth.json"), exists)
       if (raw === null || !shaped(raw)) return unreadableAfter("plugin-auth.json", dir, want, log)
       const after = pluginAccounts(raw)
-      // 回读要数账号：logout 没真删（退出码 0 却没动手）时，login 会把新
-      // 令牌加成第二个账号，而「有一个账号拿着目标令牌」照样成立——那正是
-      // planToPlugin 明说 --force 不适用、工具却亲手造出来的状态。
+      // The read-back must count accounts: when logout did not really delete
+      // (exit code 0 but no action), login adds the new token as a second
+      // account, and "one account holds the target token" still holds — exactly
+      // the state planToPlugin says --force does not apply to and the tool
+      // would have created itself.
       if (plan.cmds.length > 1 && after.length > 1) {
         log(`✗ 回读发现插件现在有 ${after.length} 个账号（${after.map((a) => arg(a.name)).join("、")}）。`)
         log(`  旧账号没被登出，login 追加了一个。请在 magpie 里删掉多余账号后重试。`)
         return 1
       }
       if (!after.some((a) => a.token === want)) {
-        log(`✗ 写入后回读没找到目标令牌（${mask(want)}）——检查 magpie 是否在正常运行。`)
+        log(`✗ 写入后回读没找到目标令牌（${mask(want)}）——检查 magpie 是否正在正常运行${wrapperNote(bin)}。`)
         return 1
       }
     }
@@ -1082,22 +2478,28 @@ export async function main({
   return 0
 }
 
-// npm 和 npx 通过符号链接调用 bin：argv[1] 是链接的路径，而 import.meta.url
-// 是解析后的真实路径，直接比较字符串会漏掉「作为命令运行」的场景（测试里用
-// node bin/sync.mjs 直跑恰好相等，掩盖了这个 bug）。先把 argv[1] 也 realpath
-// 成真实路径再比。
+// npm and npx invoke bin through a symlink: argv[1] is the link's path while
+// import.meta.url is the resolved real path, so comparing the strings directly
+// misses the "run as a command" case (running `node bin/sync.mjs` directly in
+// the tests happened to be equal and hid this bug). So realpath argv[1] too
+// before comparing.
 //
-// href 还不够的地方有两处，都不涉及大小写：node --preserve-symlinks-main 让
-// import.meta.url 保留链接路径，而 realpathSync 仍把它解开；Windows 的 8.3 短
-// 名（C:\Users\RUNNER~1\…）在 pathToFileURL 里不展开、realpathSync 里展开。
-// 这两种都靠 inode 兜——那是文件的身份，与拼写无关。
+// href falls short in two places, neither about letter case:
+// node --preserve-symlinks-main makes import.meta.url keep the link path while
+// realpathSync still resolves it; Windows 8.3 short names
+// (C:\Users\RUNNER~1\…) are not expanded by pathToFileURL but are by
+// realpathSync. Both fall back to the inode — the file's identity, independent
+// of spelling.
 //
-// 报 ino=0 的卷（exFAT/FAT 的 U 盘、部分 SMB 共享与 subst 映射）没有身份可比，
-// 这时退回比 realpath 之后的字符串：它能覆盖上面两种 href 失配，唯一丢掉的
-// 是大小写翻转，而那个场景 href 本来就命中。不这样做的话 isMain 恒 false，
-// 整个文件被跳过——不打印任何东西、退出码 0，用户会以为同步成功了。
+// A volume that reports ino=0 (exFAT/FAT USB sticks, some SMB shares and subst
+// mappings) has no identity to compare, so it falls back to comparing the
+// realpath-ed strings: that covers the two href mismatches above, and the only
+// thing lost is a letter-case flip, where href matched anyway. Without this,
+// isMain would always be false and the whole file would be skipped — printing
+// nothing and exiting 0, so the user would think the sync succeeded.
 //
-// `stat` 与 `real` 可注入：ino=0 的卷在本机造不出来，测试只能把手伸到这里。
+// `stat` and `real` are injectable: an ino=0 volume cannot be conjured up on
+// this machine, so the tests can only reach in here.
 export function isMain(entry = process.argv[1], self = import.meta.url, stat = statSync, real = realpathSync) {
   if (!entry) return false
   try {
@@ -1113,6 +2515,25 @@ export function isMain(entry = process.argv[1], self = import.meta.url, stat = s
 }
 
 if (isMain()) {
+  // `sync --status | head -1` closes the pipe after the first line: without a
+  // handler the EPIPE arrives as an unhandled error event and the crash trace
+  // — not the plan — is what the user sees. Exiting quietly is what a shell
+  // pipeline means; head's own exit code carries the verdict.
+  process.stdout.on("error", (e) => {
+    if (e && e.code === "EPIPE") process.exit(0)
+    throw e
+  })
+  // A Ctrl-C or a TERM during a --force sequence can land between the logout
+  // and the login: the logout has run and the account is signed out. The
+  // child is left to finish on its own (spawnSync cannot be interrupted
+  // mid-wait), but the run says so before it goes, so the shell is not left
+  // showing a silent 130/143 and a signed-out account.
+  for (const [sig, code] of [["SIGINT", 130], ["SIGTERM", 143]]) {
+    process.on(sig, () => {
+      process.stderr.write(`\nmagpie-plugin-msmoli: 被 ${sig} 中断。如果正在 --force 的登出→登录之间，现有登录可能已被登出；\n${RECOVER}\n`)
+      process.exit(code)
+    })
+  }
   // process.exit() while stdout is a pipe drops whatever is still buffered:
   // a long plan or a big `--status` list would lose its tail — including the
   // ✓ line — and still exit 0. Setting the exit code lets the loop drain the