Dict tool I/O is JSON-encoded before scrubbing, so a newline before a bare
GitHub token or AWS key id became a literal \n and the leading \b never
matched. Replace it with a lookbehind that also accepts a preceding JSON
escape (\b \f \n \r \t or \uXXXX).
Capture truncation (5000 chars, 2000 in the parse-error fallback) can cut
a DSN right before its '@', which defeated the (?=@) password lookahead.
Let the password run to end of string, except a bare trailing host:port.
Applied to both matcher copies. Regression tests cover structured output
with tokens after escaped whitespace and DSNs cut before '@' on the
string, structured input/output and fallback paths. Refresh registryDigest.
Signed-off-by: Wen <jwcastillo@gmail.com>
Wen
64f28b6096