token-goat 2.6.32 → 2.6.33

package/dist/{token-goat-hook-chunk-DHW6SRHR.mjs → token-goat-hook-chunk-E6AIPKNF.mjs}

@@ -2,17 +2,13 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   registerReset
-} from "./token-goat-hook-chunk-J2ZK2FYW.mjs";
-import {
-  init_define_import_meta_env
-} from "./token-goat-hook-chunk-K33JMLL7.mjs";
+} from "./token-goat-hook-chunk-BUOCULAM.mjs";
 
 // src/version.ts
-init_define_import_meta_env();
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.32";
+    return "2.6.33";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -21,7 +17,6 @@ function resolveVersion() {
 var VERSION = resolveVersion();
 
 // src/constants.ts
-init_define_import_meta_env();
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -137,7 +132,6 @@ var ENV_KEYS = {
 var SYMBOL_BODY_CHAR_CAP = 128 * 1024;
 
 // src/bridges/registry.ts
-init_define_import_meta_env();
 var KNOWN_HARNESS_NAMES = /* @__PURE__ */ new Set([
   "claudecode",
   "codex",
@@ -149,6 +143,7 @@ var KNOWN_HARNESS_NAMES = /* @__PURE__ */ new Set([
   "copilot_cli",
   "grok",
   "qwen",
+  "kimi",
   "generic"
 ]);
 function detectHarness() {
@@ -199,7 +194,6 @@ function resetHarnessCache() {
 registerReset(resetHarnessCache);
 
 // src/paths.ts
-init_define_import_meta_env();
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
 var WSL_PATH_RE = /^\/mnt\/([a-zA-Z])\/(.*)$/s;
@@ -296,7 +290,6 @@ function safeJoin(base, ...parts) {
 }
 
 // src/util.ts
-init_define_import_meta_env();
 import { spawn, spawnSync } from "node:child_process";
 import { chmodSync as chmodSync2, closeSync, copyFileSync, existsSync, mkdirSync as mkdirSync2, openSync, readdirSync, readFileSync, renameSync, statSync as statSync2, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import * as path3 from "node:path";
@@ -910,7 +903,6 @@ function suggestPackageNames(query, names) {
 }
 
 // src/fingerprint.ts
-init_define_import_meta_env();
 import { createHash } from "node:crypto";
 import * as fs3 from "node:fs";
 function fingerprintContent(content) {
@@ -932,7 +924,6 @@ function fingerprintFile(filePath) {
 }
 
 // src/project.ts
-init_define_import_meta_env();
 import * as fs4 from "node:fs";
 import * as os2 from "node:os";
 import * as path4 from "node:path";
@@ -1146,24 +1137,10 @@ function isInsideRoot(target, root) {
 }
 
 // src/config.ts
-init_define_import_meta_env();
 import * as fs5 from "node:fs";
 import * as path5 from "node:path";
 
-// node_modules/smol-toml/dist/index.js
-init_define_import_meta_env();
-
-// node_modules/smol-toml/dist/parse.js
-init_define_import_meta_env();
-
-// node_modules/smol-toml/dist/struct.js
-init_define_import_meta_env();
-
-// node_modules/smol-toml/dist/primitive.js
-init_define_import_meta_env();
-
 // node_modules/smol-toml/dist/date.js
-init_define_import_meta_env();
 var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
 var TomlDate = class _TomlDate extends Date {
   #hasDate = false;
@@ -1256,7 +1233,6 @@ var TomlDate = class _TomlDate extends Date {
 };
 
 // node_modules/smol-toml/dist/error.js
-init_define_import_meta_env();
 function getLineColFromPtr(string, ptr) {
   let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
   return [lines.length, lines.pop().length + 1];
@@ -1455,11 +1431,7 @@ function parseValue(value, toml, ptr, integersAsBigInt) {
   return date;
 }
 
-// node_modules/smol-toml/dist/extract.js
-init_define_import_meta_env();
-
 // node_modules/smol-toml/dist/util.js
-init_define_import_meta_env();
 function indexOfNewline(str, start = 0, end = str.length) {
   let idx = str.indexOf("\n", start);
   if (str[idx - 1] === "\r")
@@ -1849,7 +1821,6 @@ function parse(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
 }
 
 // node_modules/smol-toml/dist/stringify.js
-init_define_import_meta_env();
 var BARE_KEY = /^[a-z0-9-_]+$/i;
 function extendedTypeOf(obj) {
   let type = typeof obj;
@@ -1991,7 +1962,6 @@ function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
 }
 
 // src/env.ts
-init_define_import_meta_env();
 var FALSY_ENV_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
 var TRUTHY_ENV_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 function envStr(key, defaultVal) {
@@ -3235,11 +3205,1051 @@ function saveConfig(config) {
   _cached2 = null;
 }
 
+// src/parser_types.ts
+import * as path6 from "node:path";
+var EXTENSION_LANGUAGE = /* @__PURE__ */ new Map([
+  [".py", "python"],
+  [".pyi", "python"],
+  [".ts", "typescript"],
+  [".tsx", "typescript"],
+  [".mts", "typescript"],
+  [".cts", "typescript"],
+  [".js", "javascript"],
+  [".jsx", "javascript"],
+  [".mjs", "javascript"],
+  [".cjs", "javascript"],
+  [".rs", "rust"],
+  [".go", "go"],
+  [".c", "c"],
+  [".h", "c"],
+  [".cpp", "cpp"],
+  [".cc", "cpp"],
+  [".cxx", "cpp"],
+  [".hpp", "cpp"],
+  [".hxx", "cpp"],
+  [".rb", "ruby"],
+  [".ruby", "ruby"],
+  // Rake task files (lib/tasks/foo.rake) are plain Ruby syntax (`task :foo do ... end`),
+  // parsed identically by the ruby tree-sitter grammar. Without this entry a `.rake` file
+  // fell through to 'unknown' and indexed zero symbols despite the grammar handling its
+  // content exactly like any other .rb file -- the same has-extractor-but-no-extension gap
+  // previously fixed for `.mk` (Makefile fragments).
+  [".rake", "ruby"],
+  [".java", "java"],
+  [".sh", "bash"],
+  [".bash", "bash"],
+  [".md", "markdown"],
+  [".markdown", "markdown"],
+  // MDX heading syntax is plain ATX and works with the existing markdown extractor as-is,
+  // unlike .rst which genuinely needs an underline-style heading parser this extractor doesn't
+  // implement (left as 'unknown' deliberately).
+  [".mdx", "markdown"],
+  [".toml", "toml"],
+  [".json", "json"],
+  [".yaml", "yaml"],
+  [".yml", "yaml"],
+  [".css", "css"],
+  [".scss", "css"],
+  [".sass", "css"],
+  [".less", "css"],
+  [".cs", "csharp"],
+  [".php", "php"],
+  [".html", "html"],
+  [".htm", "html"],
+  [".liquid", "liquid"],
+  [".kt", "kotlin"],
+  [".kts", "kotlin"],
+  [".swift", "swift"],
+  [".scala", "scala"],
+  [".sc", "scala"],
+  [".lua", "lua"],
+  [".ex", "elixir"],
+  [".exs", "elixir"],
+  [".dart", "dart"],
+  [".zig", "zig"],
+  [".r", "r"],
+  [".graphql", "graphql"],
+  [".gql", "graphql"],
+  [".sql", "sql"],
+  [".ini", "ini"],
+  [".cfg", "ini"],
+  [".conf", "ini"],
+  [".proto", "proto"],
+  // `.mk` is the idiomatic extension for included Makefile fragments (config.mk, rules.mk,
+  // common.mk); their syntax is identical to a bare `Makefile`, which FILENAME_LANGUAGE already
+  // maps. Without this entry a `.mk` fragment fell through to 'unknown' and was indexed with zero
+  // symbols despite extractMakefile handling its content fine -- the same has-extractor-but-no-
+  // extension gap previously seen for other adapters. (importsExtensionFor already treats bare
+  // Makefile basenames as `.mk` for the imports command, so extractImports' `.mk` branch was
+  // reachable while symbol indexing was not.)
+  [".mk", "makefile"],
+  [".tf", "terraform"],
+  [".tfvars", "terraform"],
+  [".hcl", "terraform"],
+  [".ps1", "powershell"],
+  [".psm1", "powershell"],
+  [".env", "env_file"],
+  [".cls", "apex"],
+  [".trigger", "apex"],
+  [".cmp", "salesforce_markup"],
+  [".app", "salesforce_markup"],
+  [".evt", "salesforce_markup"],
+  [".intf", "salesforce_markup"],
+  [".design", "salesforce_markup"],
+  [".auradoc", "salesforce_markup"],
+  [".tokens", "salesforce_markup"],
+  [".page", "salesforce_markup"],
+  [".component", "salesforce_markup"],
+  [".email", "salesforce_markup"],
+  [".vue", "vue"],
+  [".svelte", "svelte"],
+  [".astro", "astro"],
+  [".ipynb", "ipynb"]
+]);
+var FILENAME_LANGUAGE = /* @__PURE__ */ new Map([
+  ["dockerfile", "dockerfile"],
+  ["makefile", "makefile"],
+  ["gnumakefile", "makefile"],
+  ["bsdmakefile", "makefile"],
+  ["cargo.toml", "toml"],
+  ["pyproject.toml", "toml"],
+  ["package.json", "json"],
+  ["tsconfig.json", "json"],
+  [".envrc", "env_file"],
+  // Gemfile and Rakefile are plain Ruby syntax with no extension -- the dominant, idiomatic
+  // dependency-manifest and task-runner files in virtually every real Ruby project (analogous to
+  // package.json for Node or a bare Makefile). Without these entries both fell through to
+  // 'unknown' and indexed zero symbols despite the ruby tree-sitter grammar handling their
+  // content exactly like any other .rb file -- the same has-extractor-but-no-dispatch-entry gap
+  // already fixed for bare `Makefile` / `.mk` fragments above.
+  ["gemfile", "ruby"],
+  ["rakefile", "ruby"],
+  // Vagrantfile, Guardfile, Podfile, Capfile, Fastfile: same idiomatic extensionless-Ruby-DSL
+  // pattern as Gemfile/Rakefile above -- `Vagrant.configure(...) do ... end`, Guard's `guard
+  // 'rspec' do ... end`, CocoaPods' `Pod::Spec.new do |s| ... end`, Capistrano's `set :application`,
+  // and fastlane's `lane :build do ... end` are all plain Ruby, parsed identically by the ruby
+  // tree-sitter grammar. Without these entries each fell through to 'unknown' and indexed zero
+  // symbols despite the grammar handling their content exactly like any other .rb file.
+  ["vagrantfile", "ruby"],
+  ["guardfile", "ruby"],
+  ["podfile", "ruby"],
+  ["capfile", "ruby"],
+  ["fastfile", "ruby"],
+  // Brewfile: Homebrew Bundle's dependency manifest (`brew "wget"`, `cask "..."`, `tap "..."`)
+  // is ordinary Ruby method-call syntax, evaluated by Homebrew's own Ruby DSL -- the extensionless
+  // macOS-dev-environment analogue of Gemfile/package.json, and near-universal in dotfiles repos
+  // that use `brew bundle dump`/`brew bundle install`. Same has-extractor-but-no-dispatch-entry
+  // gap as the other extensionless Ruby DSL files above: without this entry it fell through to
+  // 'unknown' and indexed zero symbols despite the ruby tree-sitter grammar handling its content
+  // exactly like any other .rb file.
+  ["brewfile", "ruby"]
+]);
+var DOTENV_VARIANT_RE = /^\.env(\..+)?$/;
+function detectLanguage(filePath) {
+  const base = path6.basename(filePath).toLowerCase();
+  if (DOTENV_VARIANT_RE.test(base)) return "env_file";
+  const byName = FILENAME_LANGUAGE.get(base);
+  if (byName !== void 0) return byName;
+  if (base.endsWith("-meta.xml")) {
+    return "salesforce_metadata";
+  }
+  const ext = path6.extname(base).toLowerCase();
+  return EXTENSION_LANGUAGE.get(ext) ?? "unknown";
+}
+var UNSUPPORTED_LANGUAGE_EXTENSIONS = /* @__PURE__ */ new Map([]);
+function unsupportedLanguageName(filePath) {
+  const ext = path6.extname(filePath).toLowerCase();
+  return UNSUPPORTED_LANGUAGE_EXTENSIONS.get(ext);
+}
+
+// src/doc_comment.ts
+function precedingDocComment(lines, lineStart, style) {
+  const aboveIdx = lineStart - 2;
+  if (aboveIdx < 0 || aboveIdx >= lines.length) return "";
+  const aboveLine = lines[aboveIdx];
+  if (aboveLine === void 0) return "";
+  const aboveTrimmed = aboveLine.trim();
+  if (style === "hash") {
+    if (!aboveTrimmed.startsWith("#")) return "";
+    const collected = [];
+    let i = aboveIdx;
+    while (i >= 0) {
+      const line = lines[i];
+      if (line === void 0) break;
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("#")) break;
+      collected.unshift(trimmed.replace(/^#+\s?/, ""));
+      i--;
+    }
+    return collected.join("\n").trim();
+  }
+  if (aboveTrimmed.endsWith("*/")) {
+    let blockStart = aboveIdx;
+    while (blockStart >= 0) {
+      const l = lines[blockStart];
+      if (l === void 0) break;
+      if (l.trim().startsWith("/*")) break;
+      blockStart--;
+    }
+    if (blockStart < 0) return "";
+    const opener = lines[blockStart];
+    if (opener === void 0 || !opener.trim().startsWith("/*")) return "";
+    const region = lines.slice(blockStart, aboveIdx + 1);
+    const joined = region.join("\n").trimEnd();
+    if (joined.indexOf("*/") !== joined.length - 2) return "";
+    return region.map(
+      (l) => l.trim().replace(/^\/\*+/, "").replace(/\*+\/$/, "").replace(/^\*\s?/, "").trim()
+    ).filter((l) => l !== "").join("\n");
+  }
+  if (aboveTrimmed.startsWith("//")) {
+    const collected = [];
+    let i = aboveIdx;
+    while (i >= 0) {
+      const line = lines[i];
+      if (line === void 0) break;
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("//")) break;
+      collected.unshift(trimmed.replace(/^\/\/[/!]?\s?/, ""));
+      i--;
+    }
+    return collected.join("\n").trim();
+  }
+  return "";
+}
+
+// src/languages/common.ts
+function buildLineIndex(text) {
+  const idx = [0];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === "\n") idx.push(i + 1);
+  }
+  return idx;
+}
+function offsetToLine(lineIndex, offset) {
+  let lo = 0;
+  let hi = lineIndex.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    const lineStart = lineIndex[mid];
+    if (lineStart === void 0 || lineStart > offset) {
+      hi = mid - 1;
+    } else {
+      lo = mid;
+    }
+  }
+  return lo + 1;
+}
+function stripCstyleComments(text, lineCommentRe) {
+  const lines = text.split("\n");
+  let inComment = false;
+  const outLines = [];
+  for (const line of lines) {
+    const { code, inComment: nextInComment } = stripBlockCommentSpan(line, inComment);
+    outLines.push(code);
+    inComment = nextInComment;
+  }
+  let out = outLines.join("\n");
+  if (lineCommentRe !== void 0) {
+    out = out.replace(lineCommentRe, (m) => " ".repeat(m.length));
+  }
+  return out;
+}
+function stripXmlComments(text) {
+  const lines = text.split("\n");
+  let inComment = false;
+  const outLines = [];
+  for (const line of lines) {
+    let result = "";
+    let j = 0;
+    while (j < line.length) {
+      if (!inComment) {
+        const open = line.indexOf("<!--", j);
+        if (open === -1) {
+          result += line.slice(j);
+          break;
+        }
+        result += line.slice(j, open);
+        const close = line.indexOf("-->", open + 4);
+        if (close === -1) {
+          result += " ".repeat(line.length - open);
+          inComment = true;
+          break;
+        }
+        result += " ".repeat(close + 3 - open);
+        j = close + 3;
+        inComment = false;
+      } else {
+        const close = line.indexOf("-->", j);
+        if (close === -1) {
+          result += " ".repeat(line.length - j);
+          break;
+        }
+        result += " ".repeat(close + 3 - j);
+        j = close + 3;
+        inComment = false;
+      }
+    }
+    outLines.push(result);
+  }
+  return outLines.join("\n");
+}
+function scanQuotedStringEnd(content, start) {
+  const quote = content[start];
+  const n = content.length;
+  let j = start + 1;
+  while (j < n) {
+    if (content[j] === "\\" && j + 1 < n) {
+      j += 2;
+      continue;
+    }
+    if (content[j] === quote) {
+      j++;
+      break;
+    }
+    if (quote !== "`" && content[j] === "\n") {
+      j++;
+      break;
+    }
+    j++;
+  }
+  return j;
+}
+function stripJsComments(content) {
+  let out = "";
+  let i = 0;
+  const n = content.length;
+  while (i < n) {
+    const ch = content[i];
+    if (ch === "/" && content[i + 1] === "/") {
+      let j = i;
+      while (j < n && content[j] !== "\n") j++;
+      out += " ".repeat(j - i);
+      i = j;
+      continue;
+    }
+    if (ch === "/" && content[i + 1] === "*") {
+      let j = i + 2;
+      while (j < n && !(content[j] === "*" && content[j + 1] === "/")) j++;
+      const end = j < n ? j + 2 : n;
+      out += content.slice(i, end).replace(/[^\n]/g, " ");
+      i = end;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const j = scanQuotedStringEnd(content, i);
+      out += content.slice(i, j);
+      i = j;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function stripHashComments(text) {
+  return text.split("\n").map((line) => {
+    for (let i = 0; i < line.length; i++) {
+      if (line[i] === "#" && !isInsideStringLiteral(line, i)) {
+        return line.slice(0, i) + " ".repeat(line.length - i);
+      }
+    }
+    return line;
+  }).join("\n");
+}
+var HTML_COMMENT_RE = /<!--[\s\S]*?-->/g;
+var HTML_SCRIPT_BODY_RE = /(<script\b[^>]*>)([\s\S]*?)(<\/script\s*>)/gi;
+var HTML_CDATA_RE = /<!\[CDATA\[[\s\S]*?\]\]>/g;
+var LIQUID_COMMENT_RE = /{%-?\s*comment\s*-?%}[\s\S]*?{%-?\s*endcomment\s*-?%}/gi;
+function maskHtmlNoise(text) {
+  let out = text.replace(
+    HTML_SCRIPT_BODY_RE,
+    (_m, open, body, close) => open + body.replace(/[^\n]/g, " ") + close
+  );
+  out = out.replace(HTML_COMMENT_RE, (m) => m.replace(/[^\n]/g, " "));
+  out = out.replace(LIQUID_COMMENT_RE, (m) => m.replace(/[^\n]/g, " "));
+  out = out.replace(HTML_CDATA_RE, (m) => m.replace(/[^\n]/g, " "));
+  return out;
+}
+var HTML_HEADING_RE = /<h([1-6])[^>]*>(.*?)<\/h\1>/gis;
+var HTML_HEADING_TAG_STRIP_RE = /<[^>]+>/g;
+function findHtmlHeadingMatches(content) {
+  const masked = maskHtmlNoise(content);
+  const matches = [];
+  for (const m of masked.matchAll(HTML_HEADING_RE)) {
+    const level = parseInt(m[1] ?? "1", 10);
+    const raw = m[2] ?? "";
+    const heading = raw.replace(HTML_HEADING_TAG_STRIP_RE, "").trim();
+    matches.push({ level, heading, offset: m.index ?? 0, tag: m[0] ?? "" });
+  }
+  return matches;
+}
+function isInsideStringLiteral(line, index, from = 0) {
+  let openQuote = null;
+  let i = from;
+  while (i < index) {
+    const ch = line[i];
+    if (openQuote !== null && ch === "\\" && i + 1 < line.length) {
+      i += 2;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      if (openQuote === null) {
+        openQuote = ch;
+      } else if (openQuote === ch) {
+        openQuote = null;
+      }
+    }
+    i++;
+  }
+  return openQuote !== null;
+}
+function stripBlockCommentSpan(line, inComment) {
+  let code = "";
+  let j = 0;
+  let comment = inComment;
+  while (j < line.length) {
+    if (!comment) {
+      const lineCommentIdx = lineCommentStartIndex(line, ["//"], j);
+      let open = line.indexOf("/*", j);
+      while (open !== -1 && (isInsideStringLiteral(line, open, j) || lineCommentIdx !== -1 && open >= lineCommentIdx)) {
+        open = line.indexOf("/*", open + 1);
+      }
+      if (open === -1) {
+        code += line.slice(j);
+        break;
+      }
+      code += line.slice(j, open);
+      const close = line.indexOf("*/", open + 2);
+      if (close === -1) {
+        code += " ".repeat(line.length - open);
+        comment = true;
+        break;
+      }
+      code += " ".repeat(close + 2 - open);
+      j = close + 2;
+      comment = false;
+    } else {
+      const close = line.indexOf("*/", j);
+      if (close === -1) {
+        code += " ".repeat(line.length - j);
+        break;
+      }
+      code += " ".repeat(close + 2 - j);
+      j = close + 2;
+      comment = false;
+    }
+  }
+  return { code, inComment: comment };
+}
+function stripNestedBlockCommentSpan(line, depth) {
+  let code = "";
+  let j = 0;
+  let d = depth;
+  while (j < line.length) {
+    if (d === 0) {
+      const lineCommentIdx = lineCommentStartIndex(line, ["//"], j);
+      let open = line.indexOf("/*", j);
+      while (open !== -1 && (isInsideStringLiteral(line, open, j) || lineCommentIdx !== -1 && open >= lineCommentIdx)) {
+        open = line.indexOf("/*", open + 1);
+      }
+      if (open === -1) {
+        code += line.slice(j);
+        break;
+      }
+      code += line.slice(j, open);
+      code += "  ";
+      j = open + 2;
+      d = 1;
+    } else {
+      const open = line.indexOf("/*", j);
+      const close = line.indexOf("*/", j);
+      if (close === -1 && open === -1) {
+        code += " ".repeat(line.length - j);
+        break;
+      }
+      const next = close === -1 ? open : open === -1 ? close : Math.min(open, close);
+      code += " ".repeat(next + 2 - j);
+      d = Math.max(0, d + (next === open ? 1 : -1));
+      j = next + 2;
+    }
+  }
+  return { code, depth: d };
+}
+function stripLineComment(line, markers = ["//"]) {
+  const cutIdx = lineCommentStartIndex(line, markers);
+  return cutIdx === -1 ? line : line.slice(0, cutIdx);
+}
+function lineCommentStartIndex(line, markers, from = 0) {
+  let cutIdx = -1;
+  for (const marker of markers) {
+    let idx = line.indexOf(marker, from);
+    while (idx !== -1 && isInsideStringLiteral(line, idx, from)) {
+      idx = line.indexOf(marker, idx + 1);
+    }
+    if (idx !== -1 && (cutIdx === -1 || idx < cutIdx)) cutIdx = idx;
+  }
+  return cutIdx;
+}
+function stripStringLiterals(line) {
+  let out = "";
+  let i = 0;
+  const stack = [];
+  while (i < line.length) {
+    const ch = line[i];
+    if (ch === "\n") {
+      out += ch;
+      i++;
+      stack.length = 0;
+      continue;
+    }
+    const top = stack[stack.length - 1];
+    if (top === void 0) {
+      if (ch === '"' || ch === "'") {
+        const bareBraceHole = ch === '"' && i > 0 && line[i - 1] === "$";
+        stack.push({ kind: "string", quote: ch, bareBraceHole });
+        out += ch;
+        i++;
+        continue;
+      }
+      out += ch;
+      i++;
+      continue;
+    }
+    if (top.kind === "hole") {
+      if (ch === '"' || ch === "'") {
+        const bareBraceHole = ch === '"' && i > 0 && line[i - 1] === "$";
+        stack.push({ kind: "string", quote: ch, bareBraceHole });
+        out += ch;
+        i++;
+        continue;
+      }
+      if (ch === "{") {
+        top.depth++;
+        out += ch;
+        i++;
+        continue;
+      }
+      if (ch === "}") {
+        if (top.depth > 0) {
+          top.depth--;
+        } else {
+          stack.pop();
+        }
+        out += ch;
+        i++;
+        continue;
+      }
+      out += ch;
+      i++;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < line.length) {
+      out += "  ";
+      i += 2;
+      continue;
+    }
+    if (ch === top.quote) {
+      stack.pop();
+      out += ch;
+      i++;
+      continue;
+    }
+    if (top.quote === '"') {
+      if (top.bareBraceHole && ch === "{") {
+        if (line[i + 1] === "{") {
+          out += "  ";
+          i += 2;
+          continue;
+        }
+        stack.push({ kind: "hole", depth: 0 });
+        out += ch;
+        i++;
+        continue;
+      }
+      if (!top.bareBraceHole && ch === "$" && line[i + 1] === "{") {
+        stack.push({ kind: "hole", depth: 0 });
+        out += line.slice(i, i + 2);
+        i += 2;
+        continue;
+      }
+      if (!top.bareBraceHole && ch === "{" && line[i + 1] === "$") {
+        stack.push({ kind: "hole", depth: 0 });
+        out += ch;
+        i++;
+        continue;
+      }
+    }
+    out += " ";
+    i++;
+  }
+  return out;
+}
+function findMultilineCloser(line, from, state) {
+  switch (state.kind) {
+    case "heredoc":
+    case "nowdoc": {
+      const re = new RegExp(`^[ \\t]*${escapeRegExp(state.identifier)}\\b`);
+      const m = re.exec(line);
+      return m ? { maskEnd: m[0].length } : null;
+    }
+    case "tripleSingleQuote": {
+      const m = /'{3,}/.exec(line.slice(from));
+      return m === null ? null : { maskEnd: from + m.index + m[0].length };
+    }
+    case "tripleQuote": {
+      const n = state.identifier !== "" ? parseInt(state.identifier, 10) : 3;
+      const re = new RegExp(`"{${n},}`);
+      const m = re.exec(line.slice(from));
+      return m === null ? null : { maskEnd: from + m.index + m[0].length };
+    }
+    case "verbatim": {
+      if (!state.interpolated) {
+        let j2 = from;
+        while (j2 < line.length) {
+          if (line[j2] === '"') {
+            if (line[j2 + 1] === '"') {
+              j2 += 2;
+              continue;
+            }
+            return { maskEnd: j2 + 1 };
+          }
+          j2++;
+        }
+        return null;
+      }
+      let j = from;
+      let holeDepth = 0;
+      let nestedQuote = null;
+      while (j < line.length) {
+        const c = line[j];
+        if (nestedQuote !== null) {
+          if (c === "\\" && j + 1 < line.length) {
+            j += 2;
+            continue;
+          }
+          if (c === nestedQuote) {
+            nestedQuote = null;
+          }
+          j++;
+          continue;
+        }
+        if (holeDepth > 0) {
+          if (c === '"' || c === "'") {
+            nestedQuote = c;
+            j++;
+            continue;
+          }
+          if (c === "{") holeDepth++;
+          else if (c === "}") holeDepth--;
+          j++;
+          continue;
+        }
+        if (c === "{") {
+          holeDepth = 1;
+          j++;
+          continue;
+        }
+        if (c === '"') {
+          if (line[j + 1] === '"') {
+            j += 2;
+            continue;
+          }
+          return { maskEnd: j + 1 };
+        }
+        j++;
+      }
+      return null;
+    }
+    case "psHereDouble":
+      return line.startsWith('"@', from) ? { maskEnd: from + 2 } : null;
+    case "psHereSingle":
+      return line.startsWith("'@", from) ? { maskEnd: from + 2 } : null;
+    default:
+      return null;
+  }
+}
+var MULTILINE_OPENER_COMMENT_MARKERS = {
+  php: ["//", "#"],
+  kotlin: ["//"],
+  csharp: ["//"],
+  powershell: ["#"],
+  swift: ["//"],
+  elixir: ["#"]
+};
+var MULTILINE_OPENER_BLOCK_COMMENT_LANGS = /* @__PURE__ */ new Set(["php", "kotlin", "csharp", "swift"]);
+function isInsideSameLineBlockComment(line, idx, from = 0) {
+  let comment = false;
+  let j = from;
+  while (j < idx) {
+    if (!comment) {
+      const open = line.indexOf("/*", j);
+      if (open === -1 || open >= idx) return false;
+      if (isInsideStringLiteral(line, open, from)) {
+        j = open + 2;
+        continue;
+      }
+      comment = true;
+      j = open + 2;
+    } else {
+      const close = line.indexOf("*/", j);
+      if (close === -1 || close >= idx) return true;
+      comment = false;
+      j = close + 2;
+    }
+  }
+  return comment;
+}
+function findMultilineOpener(line, from, lang) {
+  const commentIdx = lineCommentStartIndex(line, MULTILINE_OPENER_COMMENT_MARKERS[lang], from);
+  const isCommented = (idx) => commentIdx !== -1 && idx >= commentIdx || MULTILINE_OPENER_BLOCK_COMMENT_LANGS.has(lang) && isInsideSameLineBlockComment(line, idx, from);
+  if (lang === "php") {
+    const re = /<<<\s*(['"]?)([A-Za-z_]\w*)\1/g;
+    re.lastIndex = from;
+    const m = re.exec(line);
+    if (!m || isInsideStringLiteral(line, m.index, from) || isCommented(m.index)) return null;
+    const identifier = m[2] ?? "";
+    const kind = m[1] === "'" ? "nowdoc" : "heredoc";
+    return { openStart: m.index, closesSameLine: null, state: { kind, identifier } };
+  }
+  if (lang === "kotlin") {
+    const idx = line.indexOf('"""', from);
+    if (idx === -1 || isInsideStringLiteral(line, idx, from) || isCommented(idx)) return null;
+    const closeIdx = line.indexOf('"""', idx + 3);
+    if (closeIdx !== -1) {
+      return { openStart: idx, closesSameLine: closeIdx + 3, state: { kind: "tripleQuote", identifier: "3" } };
+    }
+    return { openStart: idx, closesSameLine: null, state: { kind: "tripleQuote", identifier: "3" } };
+  }
+  if (lang === "swift") {
+    const idx = line.indexOf('"""', from);
+    if (idx === -1 || isInsideStringLiteral(line, idx, from) || isCommented(idx)) return null;
+    const closeIdx = line.indexOf('"""', idx + 3);
+    if (closeIdx !== -1) {
+      return { openStart: idx, closesSameLine: closeIdx + 3, state: { kind: "tripleQuote", identifier: "3" } };
+    }
+    return { openStart: idx, closesSameLine: null, state: { kind: "tripleQuote", identifier: "3" } };
+  }
+  if (lang === "elixir") {
+    const candidates = [];
+    const dq = line.indexOf('"""', from);
+    if (dq !== -1) candidates.push([dq, "tripleQuote", '"""']);
+    const sq = line.indexOf("'''", from);
+    if (sq !== -1) candidates.push([sq, "tripleSingleQuote", "'''"]);
+    candidates.sort((a, b) => a[0] - b[0]);
+    const first = candidates[0];
+    if (first === void 0) return null;
+    const [idx, kind, delim] = first;
+    if (isInsideStringLiteral(line, idx, from) || isCommented(idx)) return null;
+    const closeIdx = line.indexOf(delim, idx + 3);
+    const state = { kind, identifier: "3" };
+    if (closeIdx !== -1) return { openStart: idx, closesSameLine: closeIdx + 3, state };
+    return { openStart: idx, closesSameLine: null, state };
+  }
+  if (lang === "csharp") {
+    const tripleRe = /"{3,}/g;
+    tripleRe.lastIndex = from;
+    const tripleM = tripleRe.exec(line);
+    let tripleIdx = tripleM ? tripleM.index : -1;
+    const tripleLen = tripleM ? tripleM[0].length : 0;
+    if (tripleIdx !== -1 && (isInsideStringLiteral(line, tripleIdx, from) || isCommented(tripleIdx))) tripleIdx = -1;
+    const verbRe = /\$?@\$?"/g;
+    verbRe.lastIndex = from;
+    const verbM = verbRe.exec(line);
+    let verbIdx = verbM ? verbM.index : -1;
+    if (verbIdx !== -1 && isCommented(verbIdx)) verbIdx = -1;
+    if (verbIdx !== -1 && isInsideStringLiteral(line, verbIdx, from)) verbIdx = -1;
+    if (tripleIdx === -1 && verbIdx === -1) return null;
+    const useTriple = tripleIdx !== -1 && (verbIdx === -1 || tripleIdx < verbIdx);
+    if (useTriple) {
+      const closeRe = new RegExp(`"{${tripleLen},}`);
+      const closeM = closeRe.exec(line.slice(tripleIdx + tripleLen));
+      if (closeM !== null) {
+        const closeIdx = tripleIdx + tripleLen + closeM.index;
+        return { openStart: tripleIdx, closesSameLine: closeIdx + closeM[0].length, state: { kind: "tripleQuote", identifier: String(tripleLen) } };
+      }
+      return { openStart: tripleIdx, closesSameLine: null, state: { kind: "tripleQuote", identifier: String(tripleLen) } };
+    }
+    const quoteIdx = verbIdx + (verbM?.[0].length ?? 1) - 1;
+    const interpolated = (verbM?.[0] ?? "").includes("$");
+    const closer = findMultilineCloser(line, quoteIdx + 1, { kind: "verbatim", identifier: "", interpolated });
+    if (closer !== null) {
+      return { openStart: verbIdx, closesSameLine: closer.maskEnd, state: { kind: "verbatim", identifier: "", interpolated } };
+    }
+    return { openStart: verbIdx, closesSameLine: null, state: { kind: "verbatim", identifier: "", interpolated } };
+  }
+  if (lang === "powershell") {
+    const re = /@("|')\s*$/;
+    const tail = line.slice(from);
+    const m = re.exec(tail);
+    if (!m) return null;
+    const openStart = from + m.index;
+    if (isCommented(openStart)) return null;
+    if (isInsideStringLiteral(line, openStart, from)) return null;
+    const kind = m[1] === '"' ? "psHereDouble" : "psHereSingle";
+    return { openStart, closesSameLine: null, state: { kind, identifier: "" } };
+  }
+  return null;
+}
+function stripMultilineStringSpan(line, state, lang) {
+  let code = "";
+  let i = 0;
+  let cur = state;
+  while (i < line.length) {
+    if (cur !== null) {
+      const closed = findMultilineCloser(line, i, cur);
+      if (closed === null) {
+        code += " ".repeat(line.length - i);
+        i = line.length;
+        continue;
+      }
+      code += " ".repeat(closed.maskEnd - i);
+      i = closed.maskEnd;
+      cur = null;
+      continue;
+    }
+    const opened = findMultilineOpener(line, i, lang);
+    if (opened === null) {
+      code += line.slice(i);
+      break;
+    }
+    code += line.slice(i, opened.openStart);
+    if (opened.closesSameLine !== null) {
+      code += " ".repeat(opened.closesSameLine - opened.openStart);
+      i = opened.closesSameLine;
+      cur = null;
+    } else {
+      code += " ".repeat(line.length - opened.openStart);
+      i = line.length;
+      cur = opened.state;
+    }
+  }
+  return { code, state: cur };
+}
+function makeSpanSymbol(filePath, name, kind, span, parent = "", lines, style) {
+  return {
+    filePath,
+    name,
+    kind,
+    lineStart: span.startLine,
+    lineEnd: span.endLine,
+    body: span.body,
+    docstring: lines !== void 0 && style !== void 0 ? precedingDocComment(lines, span.startLine, style) : "",
+    parent
+  };
+}
+function makeLineSymbol(filePath, name, kind, line, sig, parent, lines, style) {
+  return {
+    filePath,
+    name,
+    kind,
+    lineStart: line,
+    lineEnd: line,
+    body: sig ?? "",
+    docstring: lines !== void 0 && style !== void 0 ? precedingDocComment(lines, line, style) : "",
+    parent: parent ?? ""
+  };
+}
+function makeSymbolEmitter(symbols, sections, seen, filePath, maxSymbols = 500, maxHeadingLen = 120) {
+  return function emit(name, kind, line) {
+    if (!name || name.length > maxHeadingLen) return;
+    if (symbols.length >= maxSymbols) return;
+    const key = `${name}\0${kind}\0${line}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    symbols.push({
+      filePath,
+      name,
+      kind,
+      lineStart: line,
+      lineEnd: line,
+      body: "",
+      docstring: "",
+      parent: ""
+    });
+    sections.push({ heading: name, level: 1, line, endLine: line });
+  };
+}
+function assignFlatEndLines(sections, totalLines) {
+  for (let i = 0; i < sections.length; i++) {
+    const next = sections[i + 1];
+    const s = sections[i];
+    if (s === void 0) continue;
+    const end = next !== void 0 ? next.line - 1 : totalLines;
+    s.endLine = end < s.line ? s.line : end;
+  }
+}
+function propagateEndLinesToSymbols(symbols, sections) {
+  const sectionMap = /* @__PURE__ */ new Map();
+  for (const sec of sections) {
+    const key = `${sec.heading}\0${sec.line}`;
+    const queue = sectionMap.get(key);
+    if (queue !== void 0) queue.push(sec.endLine);
+    else sectionMap.set(key, [sec.endLine]);
+  }
+  return symbols.map((sym) => {
+    const key = `${sym.name}\0${sym.lineStart}`;
+    const endLine = sectionMap.get(key)?.shift();
+    if (endLine !== void 0 && endLine !== sym.lineEnd) {
+      return { ...sym, lineEnd: endLine };
+    }
+    return sym;
+  });
+}
+function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex) {
+  let depth = 0;
+  let quote = null;
+  for (let i = openBraceIndex; i < content.length; i++) {
+    const ch = content[i];
+    if (quote !== null) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) {
+        return offsetToLine(lineIndex, i);
+      }
+    }
+  }
+  return totalLines;
+}
+
+// src/languages/ini_idx.ts
+var MAX_SECTIONS = 200;
+var MAX_HEADING_LEN = 200;
+var MAX_ENV_KEYS = 200;
+var HEADER_RE = /^\[([^\]\r\n]+)\]\s*(?:[;#].*)?$/;
+var ENV_KEY_RE = /^(?:export\s+)?([A-Za-z_][\w.-]*)\s*(?:=|:(?!\/\/))/;
+function extractIni(content, filePath) {
+  const symbols = [];
+  const sections = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lines = content.split(/\r?\n/);
+  const totalLines = lines.length;
+  for (let i = 0; i < lines.length; i++) {
+    if (symbols.length >= MAX_SECTIONS) break;
+    const line = lines[i] ?? "";
+    if (!line || line[0] !== "[") continue;
+    const m = HEADER_RE.exec(line);
+    if (m === null) continue;
+    const name = m[1]?.trim() ?? "";
+    if (!name || name.length > MAX_HEADING_LEN) continue;
+    const key = `${name}\0${i + 1}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    symbols.push(makeLineSymbol(filePath, name, "ini_section", i + 1));
+    sections.push({ heading: name, level: 1, line: i + 1, endLine: i + 1 });
+  }
+  sections.sort((a, b) => a.line - b.line);
+  assignFlatEndLines(sections, totalLines);
+  return propagateEndLinesToSymbols(symbols, sections);
+}
+function _isEscapedQuote(line, i, q) {
+  if (q === "'") return false;
+  let backslashes = 0;
+  let j = i - 1;
+  while (j >= 0 && line[j] === "\\") {
+    backslashes++;
+    j--;
+  }
+  return backslashes % 2 === 1;
+}
+function _lineClosesQuote(line, q) {
+  for (let i = 0; i < line.length; i++) {
+    if (line[i] === q && !_isEscapedQuote(line, i, q)) return true;
+  }
+  return false;
+}
+function _detectOpenQuote(value) {
+  const trimmed = value.replace(/^\s+/, "");
+  const q = trimmed[0];
+  if (q !== '"' && q !== "'") return null;
+  for (let i = 1; i < trimmed.length; i++) {
+    if (trimmed[i] === q && !_isEscapedQuote(trimmed, i, q)) return null;
+  }
+  return q;
+}
+function extractEnv(content, filePath) {
+  const symbols = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lines = content.split(/\r?\n/);
+  let openQuote = null;
+  for (let i = 0; i < lines.length; i++) {
+    if (symbols.length >= MAX_ENV_KEYS) break;
+    const line = lines[i] ?? "";
+    if (openQuote !== null) {
+      if (_lineClosesQuote(line, openQuote)) openQuote = null;
+      continue;
+    }
+    if (!line || line[0] === "#" || line[0] === ";" || line[0] === " " || line[0] === "	") continue;
+    const m = ENV_KEY_RE.exec(line);
+    if (m === null) continue;
+    const name = m[1]?.trim() ?? "";
+    if (!name || name.length > MAX_HEADING_LEN) continue;
+    const key = `${name}\0${i + 1}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    symbols.push(makeLineSymbol(filePath, name, "env_key", i + 1));
+    openQuote = _detectOpenQuote(line.slice(m[0].length));
+  }
+  return symbols;
+}
+
+// src/dotenv_redact.ts
+var DOTENV_VALUE_PLACEHOLDER = "[REDACTED:dotenv_value]";
+var ASSIGNMENT_RE = /^(\s*(?:export\s+)?[A-Za-z_][\w.-]*\s*(?:\+?=|:(?!\/\/)))/;
+var SAFE_LINE_RE = /^\s*(?:[#;].*)?$/;
+function isDotenvPath(filePath) {
+  return detectLanguage(filePath) === "env_file";
+}
+function redactDotenvValues(text) {
+  const lines = text.split("\n");
+  const out = [];
+  let openQuote = null;
+  for (const raw of lines) {
+    const hasCr = raw.endsWith("\r");
+    const line = hasCr ? raw.slice(0, -1) : raw;
+    const eol = hasCr ? "\r" : "";
+    const emit = (s) => {
+      out.push(`${s}${eol}`);
+    };
+    if (openQuote !== null) {
+      if (_lineClosesQuote(line, openQuote)) openQuote = null;
+      emit(DOTENV_VALUE_PLACEHOLDER);
+      continue;
+    }
+    if (SAFE_LINE_RE.test(line)) {
+      emit(line);
+      continue;
+    }
+    const m = ASSIGNMENT_RE.exec(line);
+    if (m === null || m[1] === void 0) {
+      emit(DOTENV_VALUE_PLACEHOLDER);
+      continue;
+    }
+    const prefix = m[1];
+    openQuote = _detectOpenQuote(line.slice(prefix.length));
+    emit(`${prefix}${DOTENV_VALUE_PLACEHOLDER}`);
+  }
+  return out.join("\n");
+}
+function redactIfDotenv(filePath, text) {
+  return isDotenvPath(filePath) ? redactDotenvValues(text) : text;
+}
+
 // src/db.ts
-init_define_import_meta_env();
 import * as fs6 from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import Database from "better-sqlite3";
 var _require = createRequire2(import.meta.url);
 var _connections = /* @__PURE__ */ new Map();
@@ -3491,7 +4501,7 @@ CREATE TRIGGER IF NOT EXISTS cache_recall_au AFTER UPDATE ON cache_recall BEGIN
   VALUES (new.row_id, new.label, new.content);
 END;
 `;
-var SCHEMA_VERSION = 10;
+var SCHEMA_VERSION = 11;
 function alterTableIdempotent(conn, sql) {
   try {
     conn.exec(sql);
@@ -3499,6 +4509,26 @@ function alterTableIdempotent(conn, sql) {
     if (!(err instanceof Error) || !/duplicate column/i.test(err.message)) throw err;
   }
 }
+function purgeDotenvEmbeddings(conn) {
+  let paths;
+  try {
+    paths = conn.prepare("SELECT DISTINCT file_path FROM chunks").all().map((r) => r.file_path).filter(isDotenvPath);
+  } catch {
+    return;
+  }
+  if (paths.length === 0) return;
+  for (const p of paths) {
+    try {
+      conn.prepare("DELETE FROM chunk_vectors WHERE rowid IN (SELECT id FROM chunks WHERE file_path = ?)").run(p);
+    } catch {
+    }
+    conn.prepare("DELETE FROM chunks WHERE file_path = ?").run(p);
+    try {
+      conn.prepare("UPDATE files SET embed_sha = NULL WHERE path = ?").run(p);
+    } catch {
+    }
+  }
+}
 var MIGRATIONS = {
   // v1 -> v2: adds files.embed_sha, tracked separately from files.sha so embedding freshness can be gated independently of parse freshness (see makeIndexer in worker.ts). A pre-existing v1 database's `files` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, so a genuine ALTER TABLE failure is never silently lost.
   1: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN embed_sha TEXT"),
@@ -3507,7 +4537,15 @@ var MIGRATIONS = {
   // v8 -> v9: adds symbols.parent (see SCHEMA_VERSION comment above for why). A pre-existing v8 database's `symbols` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 above.
   8: (conn) => alterTableIdempotent(conn, "ALTER TABLE symbols ADD COLUMN parent TEXT NOT NULL DEFAULT ''"),
   // v9 -> v10: adds hint_emissions.bytes_emitted (see SCHEMA_VERSION comment above for why). A pre-existing v9 database's `hint_emissions` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 / v8 -> v9 above.
-  9: (conn) => alterTableIdempotent(conn, "ALTER TABLE hint_emissions ADD COLUMN bytes_emitted INTEGER")
+  9: (conn) => alterTableIdempotent(conn, "ALTER TABLE hint_emissions ADD COLUMN bytes_emitted INTEGER"),
+  // v10 -> v11: purge chunks (and their vectors) for dotenv files. Until this version, a tracked
+  // `.env` was chunked and embedded verbatim on the git path, so `semantic` returned its values --
+  // see dotenv_redact.ts. Redacting from now on is not enough on its own: the embed-freshness gate
+  // (isEmbedFresh in parser.ts) skips a file whose bytes have not changed, so an already-indexed
+  // .env would have kept serving its pre-fix chunks indefinitely. Deleting the rows here both
+  // removes the stored secrets and, by clearing embed_sha, makes the next drain re-embed the file
+  // through the redacting path.
+  10: purgeDotenvEmbeddings
 };
 function runMigrations(conn, fromVersion, toVersion) {
   for (let v = fromVersion; v < toVersion; v++) {
@@ -3553,8 +4591,8 @@ function initConnection(conn) {
   }
 }
 function resolveDbPath(dbPath) {
-  if (path6.isAbsolute(dbPath)) return dbPath;
-  if (dbPath.includes("/") || dbPath.includes("\\")) return path6.resolve(dbPath);
+  if (path7.isAbsolute(dbPath)) return dbPath;
+  if (dbPath.includes("/") || dbPath.includes("\\")) return path7.resolve(dbPath);
   return safeJoin(dataDir(), dbPath);
 }
 function connectionKey(dbPath) {
@@ -3565,7 +4603,7 @@ function getDb(dbPath) {
   const { resolved, key } = connectionKey(dbPath);
   const existing = _connections.get(key);
   if (existing !== void 0) return existing;
-  const dir = path6.dirname(resolved);
+  const dir = path7.dirname(resolved);
   try {
     ensureDirSync(dir);
   } catch (e) {
@@ -3596,7 +4634,6 @@ function closeAllDbs() {
 registerReset(closeAllDbs);
 
 // src/render/ansi.ts
-init_define_import_meta_env();
 function _colorStream(isatty) {
   if (process.env["NO_COLOR"]) return false;
   return isatty;
@@ -3671,11 +4708,9 @@ var C = {
 };
 
 // src/stats.ts
-init_define_import_meta_env();
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 
 // src/render/stats_renderer.ts
-init_define_import_meta_env();
 var _STATS_MESSAGES_FALLBACK = {
   bytesModeOnlyNote: "tracks bytes, not vision tokens",
   sessionHintSplitNote: "session_hint shows realized savings; session_hint_overhead shows injected hint cost",
@@ -4565,7 +5600,7 @@ var _globalSchemaApplied = /* @__PURE__ */ new Set();
 registerReset(() => _globalSchemaApplied.clear());
 function getGlobalDb(homeDir) {
   const basePath = homeDir ? dataDirForHome(homeDir) : dataDir();
-  const dbPath = path7.join(basePath, "global.db");
+  const dbPath = path8.join(basePath, "global.db");
   const db = getDb(dbPath);
   if (!_globalSchemaApplied.has(dbPath)) {
     db.exec(GLOBAL_SCHEMA_SQL);
@@ -4803,7 +5838,6 @@ function renderStats2(opts) {
 }
 
 // src/secret_redact.ts
-init_define_import_meta_env();
 var SECRET_PATTERNS = [
   // Anthropic keys share OpenAI's "sk-" prefix but are more specific
   // ("sk-ant-"), so they're matched first — the generic OpenAI pattern's
@@ -4831,8 +5865,13 @@ var SECRET_PATTERNS = [
   // Redacts only the token itself, not the "Authorization: Bearer " prefix -- the lookbehind
   // anchors on the header name and scheme so the surrounding request-log line stays readable,
   // matching how AWS_ACCESS_KEY_ID=... above keeps its own prefix intact.
-  ["auth_bearer_token", /(?<=Authorization:\s*Bearer\s)[A-Za-z0-9\-._~+/]{10,}=*/gi],
-  ["auth_basic_token", /(?<=Authorization:\s*Basic\s)[A-Za-z0-9+/]{6,}=*/gi],
+  // The optional quotes on either side of the colon are what let this see a header carried in
+  // JSON rather than in raw wire format. Without them the lookbehind demanded the colon sit
+  // directly against the header name and the scheme directly against the space, so a body like
+  // {"Authorization": "Bearer <token>"} -- the shape any logged fetch or MCP result arrives in
+  // -- matched nothing and the token was cached verbatim.
+  ["auth_bearer_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Bearer[ \t])[A-Za-z0-9\-._~+/]{10,}=*/gi],
+  ["auth_basic_token", /(?<=Authorization["']?[ \t]{0,8}:[ \t]{0,8}["']?[ \t]{0,8}Basic[ \t])[A-Za-z0-9+/]{6,}=*/gi],
   // JWTs have no distinctive prefix of their own, but the base64url encoding of the smallest
   // realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical
   // anchor here -- each of the three dot-separated segments requires a minimum length to avoid
@@ -4851,6 +5890,13 @@ var SECRET_PATTERNS = [
   // are what make the short, generic 'sig' name safe to key on: a prose or code mention of "sig"
   // never sits directly after a query separator followed by that much opaque token.
   ["presigned_signature", /(?<=[?&](?:X-Amz-Signature|X-Goog-Signature|sig)=)[A-Za-z0-9%+/=_-]{16,}/gi],
+  // A password inside a connection url. `postgres://user:hunter2@db.internal` carries the
+  // credential in the authority section, where there is no `key=value` separator for the
+  // generic pattern below to anchor on, so a DATABASE_URL echoed by a failing migration or a
+  // psql error went through untouched. The anchors are what keep this narrow: a scheme's `://`,
+  // a userinfo segment, the colon, and a following `@`. `http://host:8080/path` has no `@` and
+  // is left alone; so is any url without credentials.
+  ["url_credentials", /(?<=:\/\/[^\s:@/]{1,64}:)[^\s:@/]{1,256}(?=@)/g],
   // Generic key=value assignments in .env-file and connection-string/query-string shape. The
   // lookbehind again redacts only the value, and the value's character class deliberately
   // excludes whitespace, '&', ';', '#', quote characters, and '[' ']' ':' -- that exclusion is
@@ -4866,13 +5912,19 @@ var SECRET_PATTERNS = [
   // this cannot backtrack catastrophically -- there is no nested or overlapping quantifier for
   // the engine to explore multiple ways of matching, so removing the upper bound does not
   // introduce a ReDoS risk.
+  // Quotes are permitted around the separator, but never inside the value class. A quoted value
+  // is the ordinary way secrets are written -- .env files, JSON, YAML, TOML all quote by default
+  // -- and the lookbehind used to stop dead at the opening quote, so `API_KEY="..."` passed
+  // through in full while the bare `API_KEY=...` was caught. The closing quote of the key name
+  // blocked it from the other side too, which is what kept every JSON body unredacted. Keeping
+  // quotes out of the value class is still what stops the match running past the closing quote.
   // The keyword may be a prefix of a longer key name rather than the whole of it, so the
   // trailing identifier class below is load-bearing: without it the lookbehind required the
   // keyword to sit immediately before the separator, and AWS_SECRET_ACCESS_KEY=,
   // SECRET_KEY=, and DB_PASSWORD_HASH= all passed through in full. That class matches
   // identifier characters only, so prose that merely mentions a keyword still never reaches
   // a separator and stays unredacted. api[_-]?key covers the apikey and api-key spellings too.
-  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key)[a-z0-9_-]*\s*[:=]\s*)[^\s&;#'"[\]:]{4,}/gi]
+  ["generic_secret_assignment", /(?<=(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token)[a-z0-9_-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["']?)(?:\\[^\n]|[^\s\\&;#'"[\],{}:]){4,}/gi]
 ];
 function redactSecrets(text) {
   let count = 0;
@@ -4887,7 +5939,6 @@ function redactSecrets(text) {
 }
 
 // src/filters.ts
-init_define_import_meta_env();
 var DROP = () => null;
 var FILTERS = [
   {
@@ -4948,7 +5999,6 @@ var FILTERS = [
 ];
 
 // src/bash_compress.ts
-init_define_import_meta_env();
 function stripAnsiCodes(text) {
   return stripAnsiEscapes(text);
 }
@@ -5042,6 +6092,36 @@ export {
   CONFIG_KEY_ENV_OVERRIDES,
   saveConfig,
   redactSecrets,
+  precedingDocComment,
+  buildLineIndex,
+  offsetToLine,
+  stripCstyleComments,
+  stripXmlComments,
+  scanQuotedStringEnd,
+  stripJsComments,
+  stripHashComments,
+  maskHtmlNoise,
+  findHtmlHeadingMatches,
+  isInsideStringLiteral,
+  stripBlockCommentSpan,
+  stripNestedBlockCommentSpan,
+  stripLineComment,
+  stripStringLiterals,
+  stripMultilineStringSpan,
+  makeSpanSymbol,
+  makeLineSymbol,
+  makeSymbolEmitter,
+  assignFlatEndLines,
+  propagateEndLinesToSymbols,
+  findMatchingBraceEndLine,
+  extractIni,
+  _lineClosesQuote,
+  _detectOpenQuote,
+  extractEnv,
+  detectLanguage,
+  unsupportedLanguageName,
+  isDotenvPath,
+  redactIfDotenv,
   getDb,
   colorStdout,
   RESET,