@aiguru/google-web-operations 0.6.4 → 0.6.5

package/.env.example

@@ -38,5 +38,7 @@ GWO_REPORT_TO=ai@aiguru.co.il
 # Fine-grained token: Contents write + Pull requests write on the site repos.
 GITHUB_TOKEN=
 
-# --- NPM JS ACCESS TOKEN - gwo-release --------------------
-NPM_TOKEN=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
+# --- Publishing ---------------------------------------------------------------
+# The npm publish token is NOT an environment variable of this system and must
+# never be written here or anywhere in the repository: this file is shipped
+# inside the package. It lives only in the GitHub repository secret NPM_TOKEN.

package/hosts/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "google-web-operations",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Google Web Operations: agent-run SEO and GEO operations for client websites. One core, one MCP server, two hosts (Claude Code, Codex).",
   "author": {
     "name": "AI Guru"

package/hosts/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "google-web-operations",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Google Web Operations: agent-run SEO and GEO operations for client websites. One core, one MCP server, two hosts (Claude Code, Codex).",
   "author": {
     "name": "AI Guru"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiguru/google-web-operations",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Google Web Operations: agent-run SEO and GEO operations for client websites. One core, one MCP server, two hosts (Claude Code, Codex).",
   "license": "UNLICENSED",
   "private": false,

package/tools/check-secrets.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * Refuse to build, test or release when a credential sits in a file that the
+ * package or the repository would carry.
+ *
+ * Scans every tracked file and every file the build copies (so .env.example,
+ * docs, policies, playbooks and hosts are all covered) for well-known token
+ * shapes and for non-empty secret-looking assignments in example env files.
+ * Runs inside `npm run check`, so CI and the release workflow fail before
+ * anything is packed or published.
+ *
+ *   node tools/check-secrets.ts
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { ROOT } from "../packages/core/src/paths.js";
+const PATTERNS = [
+    ['npm token', /\bnpm_[A-Za-z0-9]{30,}\b/],
+    ['GitHub token', /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}\b|\bgithub_pat_[A-Za-z0-9_]{40,}\b/],
+    ['Google API key', /\bAIza[0-9A-Za-z_-]{30,}\b/],
+    ['Google OAuth client secret', /\bGOCSPX-[0-9A-Za-z_-]{20,}\b/],
+    ['Resend key', /\bre_[A-Za-z0-9]{20,}\b/],
+    ['OpenAI-style key', /\bsk-[A-Za-z0-9_-]{30,}\b/],
+    ['private key block', /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
+];
+/** In *.example env files, any secret-looking variable must be empty. */
+const ENV_ASSIGN = /^\s*([A-Z0-9_]*(TOKEN|KEY|SECRET|PASSWORD)[A-Z0-9_]*)\s*=\s*(\S.*)$/;
+const SKIP = /^(package-lock\.json|.*\.(png|jpg|jpeg|gif|ico|wmf|woff2?|ttf|docx|pdf|tgz))$/i;
+const files = execFileSync('git', ['ls-files', '-z'], { cwd: ROOT, encoding: 'utf8' }).split('\0').filter(Boolean)
+    .filter((f) => !SKIP.test(f)).filter((f) => { try {
+    return statSync(path.join(ROOT, f)).isFile();
+}
+catch {
+    return false;
+} });
+const problems = [];
+for (const f of files) {
+    const text = readFileSync(path.join(ROOT, f), 'utf8');
+    for (const [name, re] of PATTERNS)
+        if (re.test(text))
+            problems.push(`${f}: looks like a ${name}`);
+    if (/\.env(\.example)?$|\.example\.yaml$/.test(f)) {
+        text.split('\n').forEach((line, i) => {
+            const m = line.match(ENV_ASSIGN);
+            if (m && !/^(GWO_[A-Z_]+|.*=\s*(<|\$\{|""|'')).*/.test(line) && !/^\s*#/.test(line)) {
+                // Allow documented placeholders such as ops@aiguru.co.il for non-secret names, refuse real-looking values for secret names.
+                if (!/^(GWO_TOKEN_STORE)$/.test(m[1]))
+                    problems.push(`${f}:${i + 1}: ${m[1]} has a value; example files must leave secrets empty`);
+            }
+        });
+    }
+}
+if (problems.length) {
+    console.error('check-secrets: refusing to continue.\n' + problems.map((p) => '  - ' + p).join('\n') +
+        '\nRemove the value, rotate the credential, and keep secrets in .env (gitignored), sites/*.secrets.yaml (gitignored) or GitHub repository secrets.');
+    process.exit(1);
+}
+console.log(`check-secrets: ${files.length} tracked files clean`);