vibefortress 0.1.32 → 0.1.52

package/.claude-plugin/plugin.json

@@ -1,4 +1,4 @@
 {
   "name": "vibefortress",
-  "version": "0.1.32"
+  "version": "0.1.52"
 }

package/dist/MANIFEST.sha256

@@ -1,7 +1,7 @@
 43acc2492adebae8e98d838a0f0b4b6e8e1d12073385b67306c123287a6051ad  THIRD_PARTY_LICENSES.txt
-45a1ef03ac75000857c354793859a816e8d315bb084aa2603f53f32b84512057  cli.js
-dbedd28219ffba9330854b3f4ba94a5939c8687d965f904f897e9e25d95eed1c  hook.js
-6209434629050e761c4542d8ac95d5cd674365b9faa7582116020c8f8e9783e1  panel.html
+f1f23262dcf2fe49120dcc50d8d5c228d3c4ccd34976931c06bb9b1ec1ad44d2  cli.js
+b5647dd61e739195912a5132d55b671dba78e1a100de72af11951ba8a0983306  hook.js
+501dc52451ad036d7345b1cdf152b0e9ab6ecaaee718b13459983356f97ce43f  panel.html
 cb454e01aa8690db6a4589c97d9d683b866d93fae4163b516951ae1cc27774a8  rules/vibefort.yaml
 86821fb93d339d54a9a5a1488128ec2bb313d04ec0213a6b88a58f9d6e94068c  scanners.lock.json
-fe5e74742162915b779a4370c80a45ff238f54ff2c50dce91481688c3d59dcb9  server.js
+9d9301fe27919ce338c60d78568155888f305da98fa04b1e45ddb350426b36c6  server.js

package/dist/cli.js

@@ -245,11 +245,13 @@ var init_clients = __esm({
           command(e, "remove the hosted service", ["claude", "mcp", "remove", "--scope", "user", REMOTE_NAME], hasRemote, true)
         ];
         const a = [];
+        const pluginBringsRemote = o.local && mcpUrl(e.env) === DEFAULT_MCP_URL;
+        if (pluginBringsRemote && hasRemote()) a.push(command(e, "remove the separate hosted-service entry (the plugin includes it now)", ["claude", "mcp", "remove", "--scope", "user", REMOTE_NAME], hasRemote, true));
         if (o.local) a.push(
           command(e, "add the Vibe Fortress marketplace", ["claude", "plugin", "marketplace", "add", source], hasMarket),
-          command(e, "install the plugin (local scanner, skills, hooks)", ["claude", "plugin", "install", plugin, "--scope", "user"], hasPlugin)
+          command(e, `install the plugin (local scanner, ${pluginBringsRemote ? "hosted service, " : ""}skills, hooks)`, ["claude", "plugin", "install", plugin, "--scope", "user"], hasPlugin)
         );
-        if (o.remote) a.push(command(e, "add the hosted service", ["claude", "mcp", "add", "--transport", "http", "--scope", "user", REMOTE_NAME, mcpUrl(e.env)], hasRemote));
+        if (o.remote && !pluginBringsRemote) a.push(command(e, "add the hosted service", ["claude", "mcp", "add", "--transport", "http", "--scope", "user", REMOTE_NAME, mcpUrl(e.env)], hasRemote));
         return a;
       }
     };
@@ -467,6 +469,12 @@ var HELP = `Vibe Fortress: security that keeps up with vibe coding.
 Usage:
   npx vibefortress                 find your AI tools and install Vibe Fortress in them
   npx vibefortress uninstall       remove what the installer added
+  npx vibefortress collect --scan <id> --code <code>
+  npx vibefortress check --scan <id> --code <code>
+                                   first step of a deep scan: describe the checked-out commit (file list from git,
+                                   packages from the lockfile), run the local tools and send the results (never code)
+                                   to Vibe Fortress. Options: --path <folder>, --base <commit>, --server <address>,
+                                   --dry-run (print what would be sent, send nothing)
 
 Options:
   --yes, -y          do not ask, install in every tool found
@@ -505,6 +513,17 @@ async function main(argv) {
     const r = spawnSync2(process.execPath, [hook, rest[0]], { stdio: "inherit" });
     return r.status ?? 0;
   }
+  if (cmd === "collect" || cmd === "check") {
+    const built = join3(here, "server.js"), entry = existsSync4(built) ? built : join3(here, "..", "local", "index.ts");
+    if (!existsSync4(entry)) {
+      console.error("vibefortress: server.js is missing from this install.");
+      return 1;
+    }
+    process.env.VIBEFORT_ENTRY = cmd;
+    process.env.VIBEFORT_COLLECT_ARGS = JSON.stringify(rest);
+    await import(pathToFileURL(entry).href);
+    return -1;
+  }
   const { runInstaller: runInstaller2, parseArgs: parseArgs2, realEnv: realEnv2 } = await Promise.resolve().then(() => (init_run(), run_exports));
   const parsed = parseArgs2(cmd === "install" || cmd === "uninstall" ? rest : argv, cmd === "uninstall" ? "uninstall" : "install");
   if ("error" in parsed) {

package/dist/hook.js

@@ -19749,12 +19749,28 @@ var env = external_exports.object({
   APP_SECRET: external_exports.string().min(16).optional(),
   GITHUB_CLIENT_ID: external_exports.string().optional(),
   GITHUB_CLIENT_SECRET: external_exports.string().optional(),
+  CONTACT_EMAIL: external_exports.string().email().optional(),
+  REVIEWER_LOGIN: external_exports.enum(["0", "1"]).default("0"),
+  REVIEWER_LOGIN_SECRET: external_exports.string().optional(),
+  REVIEWER_LOGIN_UNTIL: external_exports.string().optional(),
+  SIGNIN_LOCKED: external_exports.enum(["0", "1"]).default("0"),
+  SERVE_SITE: external_exports.enum(["0", "1"]).default("0"),
+  GITLAB_CLIENT_ID: external_exports.string().optional(),
+  GITLAB_CLIENT_SECRET: external_exports.string().optional(),
+  GITLAB_BASE_URL: external_exports.string().default("https://gitlab.com"),
+  GOOGLE_CLIENT_ID: external_exports.string().optional(),
+  GOOGLE_CLIENT_SECRET: external_exports.string().optional(),
+  APPLE_CLIENT_ID: external_exports.string().optional(),
+  APPLE_TEAM_ID: external_exports.string().optional(),
+  APPLE_KEY_ID: external_exports.string().optional(),
+  APPLE_PRIVATE_KEY: external_exports.string().optional(),
   BILLING_MODE: external_exports.enum(["fake", "stripe"]).default("fake"),
   STRIPE_SECRET_KEY: external_exports.string().optional(),
   STRIPE_WEBHOOK_SECRET: external_exports.string().optional(),
   STRIPE_PRICE_ID: external_exports.string().optional(),
   STRIPE_PRICE_MONTH: external_exports.string().optional(),
   STRIPE_PRICE_YEAR: external_exports.string().optional(),
+  STRIPE_API_VERSION: external_exports.string().default("2025-09-30.clover"),
   MANTIS_DIR: external_exports.string().default("vendor/mantis"),
   OSV_MODE: external_exports.enum(["real", "fake"]).default("real"),
   FREE_REPOS: num(1),
@@ -19770,18 +19786,38 @@ var env = external_exports.object({
   TRIAL_DAYS: num(30),
   PERIOD_GRACE_DAYS: num(3),
   SKILL_TOKEN_BUDGET: num(12e3),
+  ANSWER_CHAR_BUDGET: external_exports.coerce.number().min(12e3).default(3e4),
   MAX_RESEARCH_TASKS: num(12),
   MAX_INVESTIGATIONS: num(8),
   SWEEP: external_exports.enum(["on", "off"]).default("on"),
   SWEEP_FILES_PER_TASK: num(10),
   SPOT_CHECKS: num(3),
+  SPOT_CHECKS_MAX: num(6),
+  RISK_STEPS_MAX: num(20),
+  STEP_FILES: num(8),
+  STEP_KB: num(120),
+  SWEEP_FILES_MAX: num(80),
+  LARGE_FILE_KB: num(40),
+  MAX_INVESTIGATIONS_CEILING: num(16),
   INVENTORY_MAX: num(2e3),
+  INVENTORY_OMITTED_MAX: num(400),
+  TREE_MODE: external_exports.enum(["real", "fake", "off"]).default("real"),
+  TREE_TIMEOUT_MS: num(8e3),
+  DEPS_PER_REPORT: num(1e3),
+  COLLECT_CODE_TTL_MIN: num(60),
+  COLLECT_MAX_BYTES: num(8e6),
+  FULL_COVERAGE: external_exports.enum(["on", "off"]).default("on"),
+  STEP_LINES: num(1500),
+  COVER_STEP_FILES: num(12),
+  PROOF_CHECK: external_exports.enum(["on", "off"]).default("on"),
+  PROOF_CODE_TTL_MIN: num(60),
+  REVIEW_REOPEN_MAX: num(2),
   ATTACK_CLASSES: external_exports.enum(["on", "off"]).default("off"),
   ATTACK_CLASS_BUDGET: num(3e3),
   TEAM_SEATS: num(5),
   INVITE_TTL_DAYS: num(7),
   LAPSE_READONLY_DAYS: num(30),
-  TEAM_WORKSPACES_PER_OWNER: num(1),
+  TEAM_WORKSPACES_PER_OWNER: num(10),
   INVITE_CREATE_PER_DAY: num(20),
   INVITEE_RETENTION_DAYS: num(30),
   INVITE_DELIVERY: external_exports.enum(["dev"]).default("dev"),
@@ -19811,6 +19847,12 @@ var config2 = {
   host: env.HOST,
   /** Gated private beta (feature 032, D-264): allows AUTH_MODE=dev and BILLING_MODE=fake in production, only with DEV_ACCESS_TOKEN. */
   privateBeta: env.PRIVATE_BETA === "1",
+  /** The owner's contact address shown on the legal pages (043, D-399). */
+  contactEmail: env.CONTACT_EMAIL,
+  /** Temporary review account for app directory reviewers (043, D-396). Off unless all three values are set and valid: see src/auth/reviewer.ts. */
+  reviewer: { flag: env.REVIEWER_LOGIN === "1", secret: env.REVIEWER_LOGIN_SECRET ?? "", until: env.REVIEWER_LOGIN_UNTIL ?? "" },
+  /** Serve the marketing site (site/dist) from this server, and send other host names of the domain to PUBLIC_URL (D-303). */
+  serveSite: env.SERVE_SITE === "1",
   publicUrl: env.PUBLIC_URL.replace(/\/$/, ""),
   databaseUrl: env.DATABASE_URL,
   pgliteDir: env.PGLITE_DIR,
@@ -19818,18 +19860,45 @@ var config2 = {
   devAccessToken: env.DEV_ACCESS_TOKEN,
   appSecret: env.APP_SECRET ?? randomBytes(32).toString("hex"),
   github: { clientId: env.GITHUB_CLIENT_ID, clientSecret: env.GITHUB_CLIENT_SECRET },
+  /** Website sign-in providers (feature 035, D-300). A provider is offered only when every value it needs is set. Secrets are never logged or returned. */
+  signIn: {
+    gitlab: { baseUrl: env.GITLAB_BASE_URL.replace(/\/$/, ""), clientId: env.GITLAB_CLIENT_ID, clientSecret: env.GITLAB_CLIENT_SECRET },
+    google: { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET },
+    apple: { clientId: env.APPLE_CLIENT_ID, teamId: env.APPLE_TEAM_ID, keyId: env.APPLE_KEY_ID, privateKey: env.APPLE_PRIVATE_KEY },
+    emailLinkMinutes: 15,
+    /** Public launch before any provider exists (D-303): every method is listed as "coming soon" and none can start. */
+    locked: env.SIGNIN_LOCKED === "1"
+  },
   billingMode: env.BILLING_MODE,
-  stripe: { secretKey: env.STRIPE_SECRET_KEY, webhookSecret: env.STRIPE_WEBHOOK_SECRET, priceMonth: env.STRIPE_PRICE_MONTH ?? env.STRIPE_PRICE_ID, priceYear: env.STRIPE_PRICE_YEAR },
+  stripe: { secretKey: env.STRIPE_SECRET_KEY, webhookSecret: env.STRIPE_WEBHOOK_SECRET, priceMonth: env.STRIPE_PRICE_MONTH ?? env.STRIPE_PRICE_ID, priceYear: env.STRIPE_PRICE_YEAR, apiVersion: env.STRIPE_API_VERSION },
   mantisDir: env.MANTIS_DIR,
   osvMode: env.OSV_MODE,
   skillTokenBudget: env.SKILL_TOKEN_BUDGET,
-  /** Largest next_task answer, in characters, per channel (text block, and structuredContent as JSON). About 15K tokens: under Claude Code's 25K-token tool-result limit with room to spare (D-189). */
-  answerCharBudget: 6e4,
+  /** Largest tool answer, in characters, per channel (text block, and structuredContent as JSON). A host that forwards both channels sees twice this, so 30,000 keeps the worst case at about 15K tokens, under Claude Code's 25K-token tool-result limit (D-189, D-308). Skills that do not fit are served in parts (D-309). */
+  answerCharBudget: env.ANSWER_CHAR_BUDGET,
+  /** One limit for the threat-model text: stage contract, tool schema and refusal message (036, FR-029). */
+  threatModelMaxChars: 6e3,
   maxResearchTasks: env.MAX_RESEARCH_TASKS,
   maxInvestigations: env.MAX_INVESTIGATIONS,
   sweep: { enabled: env.SWEEP === "on", filesPerTask: Math.max(1, env.SWEEP_FILES_PER_TASK) },
   spotChecks: Math.max(0, env.SPOT_CHECKS),
+  spotChecksMax: Math.max(0, env.SPOT_CHECKS_MAX),
+  /** Coverage engine budgets (037, D-320): they grow with the reviewable files and stop at these ceilings. */
+  coverage: { riskStepsMax: Math.max(0, env.RISK_STEPS_MAX), stepFiles: Math.max(1, env.STEP_FILES), stepKb: Math.max(10, env.STEP_KB), sweepFilesMax: Math.max(0, env.SWEEP_FILES_MAX), largeFileKb: Math.max(1, env.LARGE_FILE_KB), investigationsCeiling: Math.max(1, env.MAX_INVESTIGATIONS_CEILING) },
   inventoryMax: Math.max(1, env.INVENTORY_MAX),
+  inventoryOmittedMax: Math.max(1, env.INVENTORY_OMITTED_MAX),
+  /** File list fetched by the server from GitHub for public repositories, metadata only, no token (038, D-330). "fake" serves registered trees only (tests, local runs), "off" never fetches. */
+  tree: { mode: env.TREE_MODE, timeoutMs: Math.max(500, env.TREE_TIMEOUT_MS) },
+  /** Largest number of packages in one dependency report (038, D-332). */
+  depsPerReport: Math.max(50, env.DEPS_PER_REPORT),
+  /** Collector upload of a deep scan (039): one-time code lifetime and the size limit of a bundle. Count limits live with the bundle schema. */
+  collect: { codeTtlMin: Math.max(1, env.COLLECT_CODE_TTL_MIN), maxBytes: Math.max(1e4, env.COLLECT_MAX_BYTES) },
+  /** Every file that needs review gets a step (039, D-342, D-348). "off" restores the size-based budgets of 037. Steps are sized by lines when the collector counted them. */
+  fullCoverage: { enabled: env.FULL_COVERAGE === "on", stepLines: Math.max(100, env.STEP_LINES), stepFiles: Math.max(1, env.COVER_STEP_FILES) },
+  /** The check on the user's machine after triage (041, D-364): on when the scan has a collector upload; its one-time code lifetime. */
+  proof: { enabled: env.PROOF_CHECK === "on", codeTtlMin: Math.max(1, env.PROOF_CODE_TTL_MIN) },
+  /** How often a review step reopens for files left unread without an accepted reason (041, D-369); 0 restores the 039 behaviour. */
+  reviewReopenMax: Math.max(0, env.REVIEW_REOPEN_MAX),
   /** Local scanning (feature 013). Which engines run per plan is configuration (FR-017); safety basics stay on for every plan. */
   localScans: {
     engines: { secrets: true, deps: true, code: true, config: true },
@@ -19879,17 +19948,67 @@ var config2 = {
 var SERVICES = ["supabase", "firebase", "vercel", "neon", "stripe", "clerk", "auth0", "cloudflare", "netlify", "railway", "render", "upstash", "aws", "azure", "gcloud", "kubernetes"];
 
 // src/domain/mask.ts
-var KNOWN_TOKENS = /AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{3,}|sk_(?:live|test)_[A-Za-z0-9]{8,}|sk-[A-Za-z0-9_-]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|SG\.[A-Za-z0-9_-]{10,}|glpat-[A-Za-z0-9_-]{16,}|npm_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{16,}|r[ks]_(?:live|test)_[A-Za-z0-9]{8,}|pk_live_[A-Za-z0-9]{8,}|AIza[0-9A-Za-z_-]{30,}|(?<![A-Za-z0-9_])[a-z]{30,}(?![A-Za-z0-9_])/g;
+var M = "\u2026[masked]";
+var cut = (t, n = 4) => `${t.slice(0, n)}${M}`;
+var TECH = /^(?:(?:sha(?:1|224|256|384|512)|base(?:32|58|64)|oauth2|ed25519|x25519|x509|utf(?:8|16)|md5|argon2|pbkdf2|bcrypt|scrypt|http[23]|ipv[46]|aes(?:128|192|256)|rsa(?:2048|3072|4096)|pkcs\d{1,2}|i18n|l10n|a11y|k8s|e2e|es20\d\d|[hrep]s(?:256|384|512))[a-z]{0,12}|utf8mb4|s3|ec2|es\d|tls1|v\d{1,3}|p\d{2,3}|\d{1,6}|\d{1,3}[a-z]{1,2})$/i;
+var SEP = /[-_.+=/:@]+/;
+var CRED_PREFIX = /^(?:whsec|sk|pk|rk|gh[pousr]|github_pat|glpat|xox[baprs]|npm|AKIA|ASIA|AIza|SG|eyJ)[_\-.]/;
+function camelWordy(s) {
+  if (!/^[A-Za-z]+$/.test(s)) return false;
+  if (s === s.toLowerCase() || s === s.toUpperCase()) return true;
+  const words = s.match(/[A-Z]?[a-z]+|[A-Z]+(?![a-z])/g) ?? [];
+  return words.filter((w) => w.length === 1).length <= 1 && words.length <= Math.max(1, Math.floor(s.length / 3));
+}
+function wordy(t) {
+  if (CRED_PREFIX.test(t)) return false;
+  const segs = t.split(SEP).filter(Boolean);
+  return segs.length > 0 && segs.every((s) => TECH.test(s) || camelWordy(s));
+}
+function pinnedId(t, off, str) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(t)) return /\bfinding(?:\s+id)?\s*[:#]?\s*[`'"]?$/i.test(str.slice(Math.max(0, off - 16), off));
+  if (!/^[0-9a-f]{7,64}$/.test(t)) return false;
+  return /(?:@|sha(?:256|512):|\b(?:commit|sha|digest|blob|tree|revision|rev|pinned to|pin to|pin)\s*[:=]?\s*[`'"]?)$/i.test(str.slice(Math.max(0, off - 24), off));
+}
+function valueLike(v) {
+  if (v.includes(M)) return false;
+  if (/\d/.test(v) && /[A-Za-z]/.test(v)) return !wordy(v);
+  if (/[!#$%^&*~@]/.test(v) && !/^[\w.+-]+@[\w-]+\.[\w.-]+$/.test(v)) return true;
+  if (/^[A-Za-z]{12,}$/.test(v)) return !camelWordy(v);
+  return v.length >= 20 && !wordy(v);
+}
+var KNOWN_TOKENS = /(?<![A-Za-z0-9])(?:AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{3,}|sk_(?:live|test)_[A-Za-z0-9]{8,}|sk-[A-Za-z0-9_-]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|SG\.[A-Za-z0-9_-]{10,}|glpat-[A-Za-z0-9_-]{16,}|npm_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{16,}|r[ks]_(?:live|test)_[A-Za-z0-9]{8,}|pk_live_[A-Za-z0-9]{8,}|AIza[0-9A-Za-z_-]{30,})|(?<![A-Za-z0-9_])[a-z]{30,}(?![A-Za-z0-9_])/g;
+var KEYWORD = /^(?:string|number|boolean|bool|int|str|true|false|null|undefined|none|nil|any|unknown|void|never|required|optional|missing|value|values|redacted|\*{2,}|\d{1,7})$/i;
+var CODE_REF = /^[A-Za-z_$][\w$]*(?:\??\.[\w$]+)+\(?$|[([<{]|^\$/;
 function maskAlways(s) {
-  return s.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "-----BEGIN PRIVATE KEY-----\u2026[masked]-----END PRIVATE KEY-----").replace(/\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+\/=-]{8,}/gi, (_m, a) => `${a} \u2026[masked]`).replace(/\b(passw(?:or)?d|passphrase|secret|token|api[ _-]?key|key)\s+(?:is|was)\s+["'`]?([^\s"'`,;)]{4,})/gi, (_m, a) => `${a} is \u2026[masked]`).replace(/\b(secret|password|passphrase|token|pw)\s+(?=[^\s"'`,;)]*\d)([^\s"'`,;)]{6,})/gi, (_m, a) => `${a} \u2026[masked]`).replace(KNOWN_TOKENS, (t) => `${t.slice(0, 4)}\u2026[masked]`).replace(/(:\/\/[^\/\s:@]+:)([^@\s\/]+)(@)/g, (_m, a, _v, c) => `${a}\u2026[masked]${c}`).replace(/((?:key|secret|passw(?:or)?d|pwd|pw|pass|token|credential)[A-Za-z0-9_]*["']?\s*[:=]\s*)("[^"\n]*"|'[^'\n]*'|`[^`\n]*`|[^\s"'`,;)}]{3,})/gi, (_m, a, v) => {
-    const q2 = /^["'`]/.test(v) ? v[0] : "";
-    return `${a}${q2}${v.replace(/^["'`]|["'`]$/g, "").slice(0, 2)}\u2026[masked]${q2}`;
-  }).replace(/(?<![A-Za-z0-9_\/.+])(?=[A-Za-z0-9\/+]*[A-Z])(?=[A-Za-z0-9\/+]*[a-z])(?=[A-Za-z0-9\/+]*[\d\/+])[A-Za-z0-9\/+]{40}(?![A-Za-z0-9_\/.+])/g, (t) => `${t.slice(0, 4)}\u2026[masked]`).replace(/(?<![A-Za-z0-9_\-])[A-Z0-9]{4,}(?:-[A-Z0-9]{4,}){2,}(?![A-Za-z0-9_\-])/g, (t) => `${t.slice(0, 4)}\u2026[masked]`).replace(/(?<![A-Za-z0-9_\-+=/.])(?=[A-Za-z0-9_+=]*\d)(?=[A-Za-z0-9_+=]*[A-Za-z])[A-Za-z0-9_+=]{16,19}(?![A-Za-z0-9_\-+=/.])/g, (t) => `${t.slice(0, 4)}\u2026[masked]`).replace(/(?<![A-Za-z0-9_\-+=/.])(?=[A-Za-z0-9_\-+=]*\d)(?=[A-Za-z0-9_\-+=]*[A-Za-z])[A-Za-z0-9_\-+=]{20,}(?![A-Za-z0-9_\-+=/.])/g, (t) => `${t.slice(0, 4)}\u2026[masked]`).replace(/(?<![A-Za-z0-9_\-+=/.:@])(?=[A-Za-z0-9_]*\d)(?=[A-Za-z0-9_]*[A-Za-z])[A-Za-z0-9_]{8,}(?![A-Za-z0-9_\-+=/.:@]|…)/g, (t) => /^[0-9a-f]{8,19}$/.test(t) ? t : `${t.slice(0, 2)}\u2026[masked]`);
+  return s.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "-----BEGIN PRIVATE KEY-----\u2026[masked]-----END PRIVATE KEY-----").replace(/\b(Bearer|Basic|Token)\s+([A-Za-z0-9._~+\/=-]{8,})/gi, (m, a, v) => valueLike(v) ? `${a} ${M}` : m).replace(/\b(passw(?:or)?d|passphrase|secret|token|api[ _-]?key|key)\s+(?:is|was)\s+(["'`]?)([^\s"'`,;)]{4,})/gi, (m, a, q2, v) => valueLike(v) || q2 && (/^pass/i.test(a) || !wordy(v)) ? `${a} is ${M}` : m).replace(/\b(secret|password|passphrase|token|pw)\s+(?=[^\s"'`,;)]*\d)([^\s"'`,;)]{6,})/gi, (m, a, v) => wordy(v) || /^\d{1,4}(?:[-/.:]\d{1,4})+$/.test(v) ? m : `${a} ${M}`).replace(KNOWN_TOKENS, (t) => cut(t)).replace(/(:\/\/[^\/\s:@]+:)([^@\s\/]+)(@)/g, (_m, a, _v, c) => `${a}${M}${c}`).replace(/((?:key|secret|passw(?:or)?d|pwd|pw|pass|token|credential)[A-Za-z0-9_]{0,80}["']?\s{0,20}(?:[=!]==?|[:=])\s{0,20})("[^"\n]*"|'[^'\n]*'|`[^`\n]*`|[^\s"'`,;)}]{3,})/gi, (m, a, v, off, str) => {
+    const q2 = /^["'`]/.test(v) ? v[0] : "", inner = q2 ? v.slice(1, -1) : v;
+    if (inner.includes(M)) return m;
+    if (!q2 && (KEYWORD.test(inner.replace(/\.+$/, "")) || CODE_REF.test(inner))) return m;
+    const word = a.match(/^[A-Za-z0-9_]+/)?.[0] ?? "", pre = str.slice(0, off).slice(-1);
+    const inIdentifier = /[_0-9]/.test(pre) || /[a-z]/.test(pre) && /^[A-Z]/.test(word) || /[A-Z]/.test(pre) && word === word.toUpperCase();
+    const loneWord = /^(?:keys?|pass)$/i.test(word) && !inIdentifier;
+    if (loneWord && !valueLike(inner)) return m;
+    return `${a}${q2}${inner.slice(0, 2)}${M}${q2}`;
+  }).replace(/(?<![A-Za-z0-9_\/.+])(?=[A-Za-z0-9\/+]*[A-Z])(?=[A-Za-z0-9\/+]*[a-z])(?=[A-Za-z0-9\/+]*[\d\/+])[A-Za-z0-9\/+]{40}(?![A-Za-z0-9_\/.+])/g, (t) => wordy(t) ? t : cut(t)).replace(/(?<![A-Za-z0-9_\-])[A-Z0-9]{4,}(?:-[A-Z0-9]{4,}){2,}(?![A-Za-z0-9_\-])/g, (t, off, str) => {
+    const g = t.split("-");
+    if (/\d/.test(t)) return g.every((x) => x.length === g[0].length) || !wordy(t) ? cut(t) : t;
+    return /\b(?:secret|key|token|passw(?:or)?d|licen[cs]e|serial|credential)s?\W{0,3}(?:is\W{0,2})?$/i.test(str.slice(Math.max(0, off - 24), off)) ? cut(t) : t;
+  }).replace(/(?<![A-Za-z0-9_\-+=/.])(?=[A-Za-z0-9_+=]*\d)(?=[A-Za-z0-9_+=]*[A-Za-z])[A-Za-z0-9_+=]{16,19}(?![A-Za-z0-9_\-+=/.])/g, (t, off, str) => wordy(t) || pinnedId(t, off, str) ? t : cut(t)).replace(/(?<![A-Za-z0-9_\-+=/.])(?=[A-Za-z0-9_\-+=]*\d)(?=[A-Za-z0-9_\-+=]*[A-Za-z])[A-Za-z0-9_\-+=]{20,}(?![A-Za-z0-9_\-+=/.])/g, (t, off, str) => wordy(t) || pinnedId(t, off, str) ? t : cut(t)).replace(/(?<![A-Za-z0-9_\-+=/.:@])(?=[A-Za-z0-9_]*\d)(?=[A-Za-z0-9_]*[A-Za-z])[A-Za-z0-9_]{8,}(?![A-Za-z0-9_\-+=/.:@]|…)/g, (t, off, str) => /^[0-9a-f]{8,19}$/.test(t) || wordy(t) || pinnedId(t, off, str) ? t : `${t.slice(0, 2)}${M}`);
+}
+function nameLike(v) {
+  const words = v.replace(/\$\{\{[^}]*\}\}|\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\$\d+|\?/g, " ").trim().split(/[\s=,;()*<>]+/).map((w) => w.replace(/^[([{<]+|[)\]}>.,:;!?]+$/g, "")).filter(Boolean);
+  return words.every((w) => wordy(w));
 }
 function maskExcerpt(s) {
   return maskAlways(s).split("\n").map((line) => {
     const secretLine = /key|secret|pass|pwd|token|cred|auth/i.test(line);
-    return line.replace(/(["'`])([^"'`\n]*)\1/g, (m, q2, v) => secretLine && v.length >= 3 || /^\S{12,}$/.test(v) && !/[\/.]/.test(v) && !v.includes("\u2026[masked]") ? `${q2}${v.slice(0, 2)}\u2026[masked]${q2}` : m);
+    return line.replace(/(["'`])([^"'`\n]*)\1/g, (m, q2, v, off, str) => {
+      if (v.includes(M) || v.length < 3) return m;
+      const SECRET_ID = "[\\w.$\\]\\[]*(?:passw(?:or)?d|passphrase|pwd|pw|pass|secret|token|key|credential)\\w*";
+      const compared = new RegExp(`${SECRET_ID}\\s*(?:[=!]==?)\\s*$`, "i").test(str.slice(0, off)) || new RegExp(`^\\s*(?:[=!]==?)\\s*${SECRET_ID}`, "i").test(str.slice(off + m.length));
+      const hit = secretLine ? compared || !nameLike(v) : /^\S{12,}$/.test(v) && !/[\/.]/.test(v) && !nameLike(v);
+      return hit ? `${q2}${v.slice(0, 2)}${M}${q2}` : m;
+    });
   }).join("\n");
 }
 
@@ -20944,39 +21063,45 @@ var sev = (s) => {
   const v = (s ?? "").toUpperCase();
   return v === "CRITICAL" ? "CRITICAL" : v === "HIGH" ? "HIGH" : v === "LOW" ? "LOW" : "MEDIUM";
 };
-var osvSource = {
-  async lookup(deps) {
-    const out = /* @__PURE__ */ new Map();
-    const list = deps.slice(0, 300);
-    const res2 = await fetch("https://api.osv.dev/v1/querybatch", {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      signal: AbortSignal.timeout(15e3),
-      body: JSON.stringify({ queries: list.map((d) => ({ package: { name: d.name, ecosystem: d.ecosystem ?? "npm" }, version: d.version })) })
-    });
-    if (!res2.ok) throw new Error(`OSV ${res2.status}`);
-    const body = await res2.json();
-    let budget = 25;
-    for (let i = 0; i < list.length; i++) {
-      const vulns = [];
-      for (const { id } of (body.results[i]?.vulns ?? []).slice(0, 3)) {
-        if (budget-- <= 0) {
-          vulns.push({ id, summary: "Known vulnerability", severity: "MEDIUM" });
-          continue;
-        }
-        try {
-          const d = await (await fetch(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(8e3) })).json();
-          const fixed = d.affected?.flatMap((a) => a.ranges?.flatMap((r) => r.events?.map((e) => e.fixed).filter(Boolean) ?? []) ?? [])[0];
-          vulns.push({ id, summary: String(d.summary ?? d.details ?? "Known vulnerability").slice(0, 200), severity: sev(d.database_specific?.severity), fixedIn: fixed });
-        } catch {
-          vulns.push({ id, summary: "Known vulnerability", severity: "MEDIUM" });
+var OSV_BATCH = 1e3;
+function osvSourceWith(fetchFn = fetch) {
+  return {
+    async lookup(deps) {
+      const out = /* @__PURE__ */ new Map();
+      let budget = 25;
+      for (let at = 0; at < deps.length; at += OSV_BATCH) {
+        const list = deps.slice(at, at + OSV_BATCH);
+        const res2 = await fetchFn("https://api.osv.dev/v1/querybatch", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          signal: AbortSignal.timeout(2e4),
+          body: JSON.stringify({ queries: list.map((d) => ({ package: { name: d.name, ecosystem: d.ecosystem ?? "npm" }, version: d.version })) })
+        });
+        if (!res2.ok) throw new Error(`OSV ${res2.status}`);
+        const body = await res2.json();
+        for (let i = 0; i < list.length; i++) {
+          const vulns = [];
+          for (const { id } of (body.results[i]?.vulns ?? []).slice(0, 3)) {
+            if (budget-- <= 0) {
+              vulns.push({ id, summary: "Known vulnerability", severity: "MEDIUM" });
+              continue;
+            }
+            try {
+              const d = await (await fetchFn(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(8e3) })).json();
+              const fixed = d.affected?.flatMap((a) => a.ranges?.flatMap((r) => r.events?.map((e) => e.fixed).filter(Boolean) ?? []) ?? [])[0];
+              vulns.push({ id, summary: String(d.summary ?? d.details ?? "Known vulnerability").slice(0, 200), severity: sev(d.database_specific?.severity), fixedIn: fixed });
+            } catch {
+              vulns.push({ id, summary: "Known vulnerability", severity: "MEDIUM" });
+            }
+          }
+          if (vulns.length) out.set(depKey(list[i]), vulns);
         }
       }
-      if (vulns.length) out.set(depKey(list[i]), vulns);
+      return out;
     }
-    return out;
-  }
-};
+  };
+}
+var osvSource = osvSourceWith();
 var fakeVulnSource = {
   async lookup(deps) {
     const out = /* @__PURE__ */ new Map();