ycb_redis_c04589f90d714

what a new run launched now would send

Redis modules need a way to register commands that must not be usable or discoverable by ordinary clients, but must still work for privileged internal cluster traffic (and for AOF load / master→replica command application).

Implement support for such internal-only module commands and for promoting a connection to an internal connection, with behavior a teammate could verify up front:

1. Module command registration accepts an `internal` flag. Internal commands are denied from Lua/scripts. To a non-internal client they behave as if the command does not exist (unknown command), including via `COMMAND` family queries (listing/count/info/docs/getkeys) and via `MONITOR` for non-internal monitors. They remain visible in slow log, latency/command stats for observability.

2. A client can authenticate as internal with `AUTH "internal connection" <secret>` using the cluster’s internal secret. Wrong secret → WRONGPASS. Non-cluster instances reject this AUTH. No ACL username can collide with that name (spaces). Successful internal auth marks the connection internal, fully authenticated, and unrestricted (ACL checks bypassed for that connection). `CLIENT LIST` should show an `I` flag for internal connections.

3. Expose a module API that returns the cluster internal secret (length + bytes) so a module can AUTH to another shard as an internal connection.

4. Internal commands succeed when issued by an internal connection, during AOF loading, or from a master on the replication link; otherwise they fail as unknown. For `RM_Call`: with the run-as-user (`C`) flag, non-internal callers cannot invoke internal commands (unknown); without that flag they may; on an internal connection, run-as-user is ignored and the call runs unrestricted. A thread-safe/detached context must not inherit internalness from the creating client.

5. Provide a debug-only way to mark/unmark the current connection as internal for testing without going through AUTH.

Interface contract — the change must expose exactly this surface:
Module command flag string: "internal". New module API: RedisModule_GetInternalSecret(ctx, len) → const char* (also RedisModule_GetInternalSecret in redismodule.h / REGISTER_API). AUTH form: AUTH "internal connection" <internal_secret>. Debug: DEBUG MARK-INTERNAL-CLIENT and DEBUG MARK-INTERNAL-CLIENT UNMARK. CLIENT LIST flags include 'I' for internal connections. Non-internal callers see internal commands as unknown / hidden from COMMAND and non-internal MONITOR.

Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.

When you are done, leave your changes committed or in the working tree;
they are collected automatically.

Stay on this snapshot checkout (`task/ycb_redis_c04589f90d714`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.

Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.