diff --git a/src/lib/diagnostics.js b/src/lib/diagnostics.js
index 99c7862..f7859cf 100644
--- a/src/lib/diagnostics.js
+++ b/src/lib/diagnostics.js
@@ -2,8 +2,6 @@
 
 // AI CLI 失敗診斷與機密遮罩工具：供 review 流程記錄安全、限長的一行錯誤摘要。
 
-// 遮罩前先截去的輸入上限，避免對數 MB 失敗輸出跑整份 O(k*n) 正規掃描。
-const AGENT_DIAGNOSTIC_INPUT_LIMIT = 2_000;
 // 每段診斷片段（stderr／stdout）寫入日誌的字元上限。
 const AGENT_DIAGNOSTIC_OUTPUT_LIMIT = 500;
 
@@ -24,6 +22,9 @@ function redactSecrets(text) {
     .replace(/(authorization\s*[:=]\s*)(?:bearer\s+)?\S+/gi, '$1***')
     .replace(/((?:api[_-]?key|token|password|secret|bearer)\s*[:=]\s*)\S+/gi, '$1***')
     .replace(/(https?:\/\/)[^\s/:@]+:[^\s/@]+@/gi, '$1***:***@')
+    .replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '***')
+    .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '***')
+    .replace(/-----BEGIN [^-]+ PRIVATE KEY-----[\s\S]*?-----END [^-]+ PRIVATE KEY-----/g, '***')
     .replace(/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g, '***')
     .replace(/\b[A-Za-z0-9_-]{40,}\b/g, '***')
     .trim();
@@ -38,8 +39,8 @@ function redactSecrets(text) {
  * @returns {void}
  */
 function appendRedactedOutput(parts, label, value) {
-  const redacted = redactSecrets(String(value || '').slice(0, AGENT_DIAGNOSTIC_INPUT_LIMIT));
-  if (redacted) parts.push(`${label}：${redacted.slice(0, AGENT_DIAGNOSTIC_OUTPUT_LIMIT)}`);
+  const redacted = redactSecrets(String(value || '').slice(0, AGENT_DIAGNOSTIC_OUTPUT_LIMIT));
+  if (redacted) parts.push(`${label}：${redacted}`);
 }
 
 /**
@@ -75,7 +76,6 @@ function agentFailureDetail(agentResult) {
 }
 
 module.exports = {
-  AGENT_DIAGNOSTIC_INPUT_LIMIT,
   AGENT_DIAGNOSTIC_OUTPUT_LIMIT,
   redactSecrets,
   agentFailureDetail,