@dailephd/my-dev-kit-lab 0.9.2 → 0.9.4

package/dist/src/report/experiments/reportSectionRegistry.js

@@ -0,0 +1,79 @@
+// Shared, typed registry of specialized (experiment-family) report sections. Core report sections
+// (metadata, variants, cases, metrics, warnings, interpretation, artifacts) stay in the generic renderers.
+// The registry only selects, orders and dispatches specialized sections for the builder, text and HTML renderers.
+// It performs no calculation, no I/O, no dynamic import, and registers only in-process descriptors.
+const ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+function validate(descriptor) {
+    const label = typeof descriptor?.id === "string" ? descriptor.id : "<unknown>";
+    if (typeof descriptor?.id !== "string" || !ID_PATTERN.test(descriptor.id)) {
+        throw new Error(`Invalid report section registration ${label}: id must be a stable lowercase namespaced identifier.`);
+    }
+    if (!Number.isInteger(descriptor.order)) {
+        throw new Error(`Invalid report section registration ${label}: order must be an integer.`);
+    }
+    if (typeof descriptor.projectionKey !== "string" || descriptor.projectionKey.length === 0) {
+        throw new Error(`Invalid report section registration ${label}: projectionKey is required.`);
+    }
+    const pluginIds = descriptor.appliesTo?.pluginIds;
+    if (!Array.isArray(pluginIds) || pluginIds.length === 0 || pluginIds.some((id) => typeof id !== "string" || !id)) {
+        throw new Error(`Invalid report section registration ${label}: appliesTo.pluginIds must be a non-empty list of plugin ids.`);
+    }
+    for (const member of ["build", "renderText", "renderHtml"]) {
+        if (typeof descriptor[member] !== "function") {
+            throw new Error(`Invalid report section registration ${label}: ${member} must be a function.`);
+        }
+    }
+    if (descriptor.text?.whenAbsent !== "placeholder" && descriptor.text?.whenAbsent !== "omit") {
+        throw new Error(`Invalid report section registration ${label}: text.whenAbsent must be placeholder or omit.`);
+    }
+    if (descriptor.text.whenAbsent === "placeholder" && !descriptor.text.title) {
+        throw new Error(`Invalid report section registration ${label}: a placeholder text section requires a title.`);
+    }
+}
+/** Assembles an immutable registry. Duplicate ids, duplicate projection keys and invalid descriptors fail. */
+export function createReportSectionRegistry(input) {
+    const ids = new Set();
+    const keys = new Set();
+    const frozen = [];
+    for (const descriptor of input) {
+        validate(descriptor);
+        if (ids.has(descriptor.id)) {
+            throw new Error(`Duplicate report section registration: ${descriptor.id}.`);
+        }
+        if (keys.has(descriptor.projectionKey)) {
+            throw new Error(`Duplicate report section projection key ${descriptor.projectionKey} (section ${descriptor.id}).`);
+        }
+        ids.add(descriptor.id);
+        keys.add(descriptor.projectionKey);
+        frozen.push(Object.freeze({
+            ...descriptor,
+            appliesTo: Object.freeze({ pluginIds: Object.freeze([...descriptor.appliesTo.pluginIds]) }),
+            text: Object.freeze({ ...descriptor.text }),
+        }));
+    }
+    frozen.sort((a, b) => a.order - b.order || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const descriptors = Object.freeze(frozen);
+    const byId = new Map(descriptors.map((descriptor) => [descriptor.id, descriptor]));
+    const availabilityOf = (descriptor, report) => {
+        const projection = report[descriptor.projectionKey] ?? null;
+        if (projection !== null)
+            return "available";
+        return descriptor.appliesTo.pluginIds.includes(report.plugin.id) ? "unavailable" : "not-applicable";
+    };
+    return Object.freeze({
+        descriptors,
+        get: (id) => byId.get(id),
+        resolve: (report) => descriptors.map((descriptor) => ({
+            id: descriptor.id,
+            order: descriptor.order,
+            availability: availabilityOf(descriptor, report),
+            descriptor,
+        })),
+        resolveById: (id, report) => {
+            const descriptor = byId.get(id);
+            if (!descriptor)
+                return { id, order: Number.MAX_SAFE_INTEGER, availability: "unsupported", descriptor: null };
+            return { id, order: descriptor.order, availability: availabilityOf(descriptor, report), descriptor };
+        },
+    });
+}

package/dist/src/report/experiments/specializedReportSections.js

@@ -0,0 +1,142 @@
+// The registered specialized report families. Each descriptor adapts an existing family builder and
+// renderer; no builder or renderer is cloned here. Order values reproduce the established section order
+// (plugin families are mutually exclusive, so at most one family projection is present for a given run).
+import { AGENT_SUCCESS_RATE_PLUGIN_ID } from "../../experiments/plugins/agentSuccessRate/metadata.js";
+import { CONTEXT_PACK_GENERATION_PLUGIN_ID } from "../../experiments/plugins/contextPackGeneration/metadata.js";
+import { CONTEXT_WINDOW_SCALING_PLUGIN_ID } from "../../experiments/plugins/contextWindowScaling/metadata.js";
+import { INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID } from "../../experiments/plugins/incrementalChangeStaleness/plugin.js";
+import { RETRIEVAL_PRECISION_RECALL_PLUGIN_ID } from "../../experiments/plugins/retrievalPrecisionRecall/metadata.js";
+import { RETRIEVAL_QUERY_STRATEGY_COMPARISON_PLUGIN_ID } from "../../experiments/plugins/retrievalQueryStrategyComparison/metadata.js";
+import { buildAgentSuccessRateReport } from "./buildAgentSuccessRateReport.js";
+import { buildContextPackGenerationReport } from "./buildContextPackGenerationReport.js";
+import { buildContextStrategyComparisonV043Report } from "./buildContextStrategyComparisonV043Report.js";
+import { buildContextWindowScalingReport } from "./buildContextWindowScalingReport.js";
+import { buildIncrementalChangeStalenessPluginReport } from "./buildIncrementalChangeStalenessPluginReport.js";
+import { buildRetrievalPrecisionRecallReport } from "./buildRetrievalPrecisionRecallReport.js";
+import { buildRetrievalQueryStrategyComparisonReport } from "./buildRetrievalQueryStrategyComparisonReport.js";
+import { buildWarmIndexReuseReport } from "./buildWarmIndexReuseReport.js";
+import { renderAgentSuccessRateHtml } from "./renderAgentSuccessRateHtml.js";
+import { renderAgentSuccessRateTextLines } from "./renderAgentSuccessRateText.js";
+import { renderContextPackGenerationHtml } from "./renderContextPackGenerationHtml.js";
+import { renderContextPackGenerationTextLines } from "./renderContextPackGenerationText.js";
+import { renderContextStrategyComparisonV043Html } from "./renderContextStrategyComparisonV043Html.js";
+import { renderContextWindowScalingHtml } from "./renderContextWindowScalingHtml.js";
+import { renderContextWindowScalingTextLines } from "./renderContextWindowScalingText.js";
+import { renderIncrementalChangeStalenessHtml } from "./renderIncrementalChangeStalenessHtml.js";
+import { renderRetrievalPrecisionRecallHtml } from "./renderRetrievalPrecisionRecallHtml.js";
+import { renderRetrievalPrecisionRecallTextLines } from "./renderRetrievalPrecisionRecallText.js";
+import { renderRetrievalQueryStrategyComparisonHtml } from "./renderRetrievalQueryStrategyComparisonHtml.js";
+import { renderRetrievalQueryStrategyComparisonTextLines } from "./renderRetrievalQueryStrategyComparisonText.js";
+import { renderWarmIndexReuseHtml } from "./renderWarmIndexReuseHtml.js";
+import { renderIncrementalChangeStalenessSection, renderV043Section, renderWarmIndexReuseSection, } from "./renderSpecializedTextSections.js";
+import { createReportSectionRegistry, } from "./reportSectionRegistry.js";
+const WARM_INDEX_REUSE_PLUGIN_ID = "warm-index-reuse";
+const CONTEXT_STRATEGY_COMPARISON_PLUGIN_ID = "context-strategy-comparison";
+export const SPECIALIZED_REPORT_SECTION_DESCRIPTORS = [
+    {
+        id: "context-strategy.v043",
+        order: 10,
+        projectionKey: "contextStrategyComparisonV043",
+        appliesTo: { pluginIds: [CONTEXT_STRATEGY_COMPARISON_PLUGIN_ID] },
+        text: { title: "V0.4.3 Stage-Context Evidence", whenAbsent: "placeholder" },
+        build: ({ run }) => buildContextStrategyComparisonV043Report(run),
+        renderText: (lines, projection) => renderV043Section(lines, projection),
+        renderHtml: (projection) => renderContextStrategyComparisonV043Html(projection),
+    },
+    {
+        id: "warm-index.reuse",
+        order: 20,
+        projectionKey: "warmIndexReuse",
+        appliesTo: { pluginIds: [WARM_INDEX_REUSE_PLUGIN_ID] },
+        text: { title: "Warm Index Reuse Evidence", whenAbsent: "placeholder" },
+        build: ({ run }) => buildWarmIndexReuseReport(run),
+        renderText: (lines, projection) => renderWarmIndexReuseSection(lines, projection),
+        renderHtml: (projection) => renderWarmIndexReuseHtml(projection),
+    },
+    {
+        id: "incremental-change.staleness",
+        order: 30,
+        projectionKey: "incrementalChangeStaleness",
+        appliesTo: { pluginIds: [INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID] },
+        text: { title: "Incremental-Change And Staleness Evidence", whenAbsent: "placeholder" },
+        // The V1/V2 schema-version dispatch stays owned by the existing plugin report builder.
+        build: ({ run }) => buildIncrementalChangeStalenessPluginReport(run),
+        renderText: (lines, projection) => renderIncrementalChangeStalenessSection(lines, projection),
+        renderHtml: (projection) => renderIncrementalChangeStalenessHtml(projection),
+    },
+    {
+        id: "context-window.scaling",
+        order: 40,
+        projectionKey: "contextWindowScaling",
+        appliesTo: { pluginIds: [CONTEXT_WINDOW_SCALING_PLUGIN_ID] },
+        text: { title: "Context Window Scaling", whenAbsent: "placeholder" },
+        build: ({ run }) => buildContextWindowScalingReport(run),
+        renderText: (lines, projection) => {
+            lines.push(...renderContextWindowScalingTextLines(projection));
+        },
+        renderHtml: (projection) => renderContextWindowScalingHtml(projection),
+    },
+    {
+        id: "retrieval.precision-recall",
+        order: 50,
+        projectionKey: "retrievalPrecisionRecall",
+        appliesTo: { pluginIds: [RETRIEVAL_PRECISION_RECALL_PLUGIN_ID] },
+        text: { title: "Retrieval Precision/Recall", whenAbsent: "placeholder" },
+        build: ({ run }) => buildRetrievalPrecisionRecallReport(run),
+        renderText: (lines, projection) => {
+            lines.push(...renderRetrievalPrecisionRecallTextLines(projection));
+        },
+        renderHtml: (projection) => renderRetrievalPrecisionRecallHtml(projection ?? null),
+    },
+    {
+        id: "retrieval.query-strategy-comparison",
+        order: 60,
+        projectionKey: "retrievalQueryStrategyComparison",
+        appliesTo: { pluginIds: [RETRIEVAL_QUERY_STRATEGY_COMPARISON_PLUGIN_ID] },
+        text: { title: "Retrieval Query Strategy Comparison", whenAbsent: "placeholder" },
+        build: ({ run }) => buildRetrievalQueryStrategyComparisonReport(run),
+        renderText: (lines, projection) => {
+            lines.push(...renderRetrievalQueryStrategyComparisonTextLines(projection));
+        },
+        renderHtml: (projection) => renderRetrievalQueryStrategyComparisonHtml(projection ?? null),
+    },
+    {
+        id: "retrieval.context-pack-generation",
+        order: 70,
+        projectionKey: "contextPackGeneration",
+        appliesTo: { pluginIds: [CONTEXT_PACK_GENERATION_PLUGIN_ID] },
+        text: { title: "Context Pack Generation", whenAbsent: "omit" },
+        build: ({ run, contextPacks }) => buildContextPackGenerationReport(run, contextPacks),
+        renderText: (lines, projection) => {
+            lines.push(...renderContextPackGenerationTextLines(projection));
+        },
+        renderHtml: (projection) => renderContextPackGenerationHtml(projection ?? null),
+    },
+    {
+        id: "agent-success.rate",
+        order: 80,
+        projectionKey: "agentSuccessRate",
+        appliesTo: { pluginIds: [AGENT_SUCCESS_RATE_PLUGIN_ID] },
+        // The family renderer writes its own headings.
+        text: { title: null, whenAbsent: "omit" },
+        build: ({ run }) => buildAgentSuccessRateReport(run),
+        renderText: (lines, projection) => {
+            lines.push(...renderAgentSuccessRateTextLines(projection));
+        },
+        renderHtml: (projection) => renderAgentSuccessRateHtml(projection ?? null),
+    },
+];
+let defaultRegistry;
+/** The shared registry used by report generation. Assembled once; immutable afterwards. */
+export function getSpecializedReportSectionRegistry() {
+    defaultRegistry ??= createReportSectionRegistry(SPECIALIZED_REPORT_SECTION_DESCRIPTORS);
+    return defaultRegistry;
+}
+/** Builds every registered specialized projection once, in registry order, using the family builders. */
+export function buildSpecializedReportProjections(context) {
+    const projections = {};
+    for (const descriptor of getSpecializedReportSectionRegistry().descriptors) {
+        projections[descriptor.projectionKey] = descriptor.build(context);
+    }
+    return projections;
+}

package/dist/src/report/experiments/writePluginExperimentReports.js

@@ -2,6 +2,7 @@ import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { resolveWithinRoot } from "../../core/pathSafety.js";
 import { buildPluginExperimentReport } from "./buildPluginExperimentReport.js";
+import { collectMetricReportEvidence } from "./metricEvidence.js";
 import { loadContextPackArtifacts } from "./loadContextPackArtifacts.js";
 import { renderPluginExperimentReportHtml } from "./renderPluginExperimentReportHtml.js";
 import { renderPluginExperimentReportText } from "./renderPluginExperimentReportText.js";
@@ -33,8 +34,9 @@ export async function writePluginExperimentReports(args) {
         : outputPaths;
     const writeOptions = args.exclusive ? { encoding: "utf8", flag: "wx" } : "utf8";
     await writeFile(outputPaths.jsonPath, `${JSON.stringify({ report, outputPaths: serializedPaths }, null, 2)}\n`, writeOptions);
-    await writeFile(outputPaths.htmlPath, renderPluginExperimentReportHtml(report), writeOptions);
-    await writeFile(outputPaths.textPath, renderPluginExperimentReportText(report), writeOptions);
+    const evidence = collectMetricReportEvidence(args.run);
+    await writeFile(outputPaths.htmlPath, renderPluginExperimentReportHtml(report, evidence), writeOptions);
+    await writeFile(outputPaths.textPath, renderPluginExperimentReportText(report, evidence), writeOptions);
     return { report, outputPaths };
 }
 function readString(value) {

package/dist/src/securityValidation/attackScenarios/scenarios/secretLeakageScenario.js

@@ -26,88 +26,6 @@ function genericSecretFileMode(relativePath) {
         return "allow-unquoted";
     return "quoted-only";
 }
-// Deterministic line-by-line comment filter. Preserves the original string
-// length and every newline so line numbers computed from the filtered
-// content remain identical to the original file; comment content (line or
-// block) is replaced with spaces so it can never contribute to a match.
-// Quote-aware: a comment marker inside a single- or double-quoted literal
-// does not start a comment, and a backslash-escaped quote does not end one.
-function stripCodeCommentsPreservingLength(content) {
-    const result = new Array(content.length);
-    let index = 0;
-    let inLineComment = false;
-    let inBlockComment = false;
-    let inSingleQuote = false;
-    let inDoubleQuote = false;
-    while (index < content.length) {
-        const ch = content[index];
-        const next = index + 1 < content.length ? content[index + 1] : "";
-        if (inLineComment) {
-            if (ch === "\n") {
-                inLineComment = false;
-                result[index] = "\n";
-            }
-            else {
-                result[index] = " ";
-            }
-            index++;
-            continue;
-        }
-        if (inBlockComment) {
-            if (ch === "*" && next === "/") {
-                result[index] = " ";
-                result[index + 1] = " ";
-                inBlockComment = false;
-                index += 2;
-                continue;
-            }
-            result[index] = ch === "\n" ? "\n" : " ";
-            index++;
-            continue;
-        }
-        if (inSingleQuote || inDoubleQuote) {
-            result[index] = ch;
-            if (ch === "\\" && next !== "") {
-                result[index + 1] = next;
-                index += 2;
-                continue;
-            }
-            if ((inSingleQuote && ch === "'") || (inDoubleQuote && ch === '"')) {
-                inSingleQuote = false;
-                inDoubleQuote = false;
-            }
-            index++;
-            continue;
-        }
-        if (ch === "/" && next === "/") {
-            inLineComment = true;
-            result[index] = " ";
-            index++;
-            continue;
-        }
-        if (ch === "/" && next === "*") {
-            inBlockComment = true;
-            result[index] = " ";
-            index++;
-            continue;
-        }
-        if (ch === "'") {
-            inSingleQuote = true;
-            result[index] = ch;
-            index++;
-            continue;
-        }
-        if (ch === '"') {
-            inDoubleQuote = true;
-            result[index] = ch;
-            index++;
-            continue;
-        }
-        result[index] = ch;
-        index++;
-    }
-    return result.join("");
-}
 const GENERIC_SENSITIVE_SINGLE_WORDS = new Set(["password", "passwd", "secret", "token"]);
 function splitGenericIdentifierWords(identifier) {
     const unquoted = identifier.replace(/^['"]|['"]$/g, "");
@@ -159,65 +77,160 @@ function isDynamicUnquotedValue(rawValue) {
 const QUOTED_ASSIGNMENT_PATTERN = /(?<![A-Za-z0-9_$])(["']?)([A-Za-z_$][A-Za-z0-9_$]*)\1\s*[:=]\s*(["'])((?:\\.|(?!\3)[^\\\r\n])*)\3/g;
 const UNQUOTED_CONFIG_PATTERN = /^([A-Za-z_][A-Za-z0-9_.-]*)\s*[:=]\s*(\S.*?)\s*$/;
 const MIN_GENERIC_SECRET_LENGTH = 8;
-function scanGenericSecretAssignments(relativePath, content) {
+// A whole-value `${...}` reference is a template/interpolation reference, not
+// a literal credential, even when it appears inside a plain quoted string.
+const WHOLE_VALUE_INTERPOLATION = /^\$\{[^}]*\}$/;
+const IDENTIFIER_PART = /[A-Za-z0-9_$]/;
+function isCandidateSecretValue(identifier, rawValue) {
+    if (!isGenericSecretIdentifier(identifier))
+        return false;
+    if (rawValue.length < MIN_GENERIC_SECRET_LENGTH)
+        return false;
+    if (WHOLE_VALUE_INTERPOLATION.test(rawValue))
+        return false;
+    if (isPlaceholder(rawValue))
+        return false;
+    return true;
+}
+// Deterministic lexical-state scan for code files. Assignments are only
+// recognized in code state, so assignment-shaped text inside an enclosing
+// string literal, template-literal text, or a comment is never reported,
+// while `${...}` expressions inside templates are scanned as code again.
+// Offsets index the original content, so line numbers are exact. Single- and
+// double-quoted strings end at an unescaped newline, as in JavaScript, so an
+// unbalanced quote cannot swallow the rest of the file.
+function scanQuotedCodeAssignments(relativePath, content) {
     const findings = [];
-    const mode = genericSecretFileMode(relativePath);
-    const scannedContent = mode === "quoted-only" ? stripCodeCommentsPreservingLength(content) : content;
-    const lines = scannedContent.split("\n");
-    for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
-        const line = lines[lineIndex];
-        if (mode === "allow-unquoted") {
-            const trimmed = line.trim();
-            if (trimmed.length === 0 || trimmed.startsWith("#") || trimmed.startsWith(";"))
-                continue;
-            const unquotedMatch = UNQUOTED_CONFIG_PATTERN.exec(trimmed);
-            if (!unquotedMatch)
-                continue;
-            const identifier = unquotedMatch[1];
-            if (!isGenericSecretIdentifier(identifier))
-                continue;
-            const rawCandidate = unquotedMatch[2];
-            if (isDynamicUnquotedValue(rawCandidate))
-                continue;
-            const rawValue = stripSurroundingQuotes(rawCandidate);
-            if (rawValue.length < MIN_GENERIC_SECRET_LENGTH)
-                continue;
-            if (isPlaceholder(rawValue))
-                continue;
-            findings.push({
-                kind: "generic-secret-assignment",
-                file: relativePath,
-                line: lineIndex + 1,
-                matchedText: `${identifier} ${line.includes(":") ? ":" : "="} [REDACTED]`,
-                matchLength: rawValue.length,
-                severity: SEVERITY_FOR_KIND["generic-secret-assignment"],
-            });
-            continue;
+    const pattern = new RegExp(QUOTED_ASSIGNMENT_PATTERN.source, "y");
+    const length = content.length;
+    const skipString = (start) => {
+        const quote = content[start];
+        let i = start + 1;
+        while (i < length) {
+            const ch = content[i];
+            if (ch === "\\")
+                i += 2;
+            else if (ch === quote)
+                return i + 1;
+            else if (ch === "\n")
+                return i;
+            else
+                i++;
         }
-        QUOTED_ASSIGNMENT_PATTERN.lastIndex = 0;
-        let match;
-        while ((match = QUOTED_ASSIGNMENT_PATTERN.exec(line)) !== null) {
-            const identifier = match[2];
-            const rawValue = match[4];
-            if (match[0].length === 0) {
-                QUOTED_ASSIGNMENT_PATTERN.lastIndex += 1;
+        return length;
+    };
+    const lexTemplate = (start) => {
+        let i = start;
+        while (i < length) {
+            const ch = content[i];
+            if (ch === "\\")
+                i += 2;
+            else if (ch === "`")
+                return i + 1;
+            else if (ch === "$" && content[i + 1] === "{")
+                i = lexCode(i + 2, true);
+            else
+                i++;
+        }
+        return length;
+    };
+    const lexCode = (start, stopAtCloseBrace) => {
+        let i = start;
+        let depth = 0;
+        while (i < length) {
+            const ch = content[i];
+            const next = i + 1 < length ? content[i + 1] : "";
+            if (ch === "/" && next === "/") {
+                const end = content.indexOf("\n", i);
+                i = end === -1 ? length : end;
                 continue;
             }
-            if (!isGenericSecretIdentifier(identifier))
+            if (ch === "/" && next === "*") {
+                const end = content.indexOf("*/", i + 2);
+                i = end === -1 ? length : end + 2;
                 continue;
-            if (rawValue.length < MIN_GENERIC_SECRET_LENGTH)
+            }
+            if (ch === "`") {
+                i = lexTemplate(i + 1);
                 continue;
-            if (isPlaceholder(rawValue))
+            }
+            if (stopAtCloseBrace) {
+                if (ch === "{")
+                    depth++;
+                else if (ch === "}") {
+                    if (depth === 0)
+                        return i + 1;
+                    depth--;
+                }
+            }
+            const isQuote = ch === '"' || ch === "'";
+            if (isQuote || /[A-Za-z_$]/.test(ch)) {
+                pattern.lastIndex = i;
+                const match = pattern.exec(content);
+                if (match && match[0].length > 0) {
+                    if (isCandidateSecretValue(match[2], match[4])) {
+                        findings.push({
+                            kind: "generic-secret-assignment",
+                            file: relativePath,
+                            line: lineNumberAt(content, match.index),
+                            matchedText: `${match[2]} [REDACTED]`,
+                            matchLength: match[4].length,
+                            severity: SEVERITY_FOR_KIND["generic-secret-assignment"],
+                        });
+                    }
+                    i = match.index + match[0].length;
+                    continue;
+                }
+                if (isQuote) {
+                    i = skipString(i);
+                    continue;
+                }
+                let j = i + 1;
+                while (j < length && IDENTIFIER_PART.test(content[j]))
+                    j++;
+                i = j;
                 continue;
-            findings.push({
-                kind: "generic-secret-assignment",
-                file: relativePath,
-                line: lineIndex + 1,
-                matchedText: `${identifier} [REDACTED]`,
-                matchLength: rawValue.length,
-                severity: SEVERITY_FOR_KIND["generic-secret-assignment"],
-            });
+            }
+            i++;
         }
+        return length;
+    };
+    lexCode(0, false);
+    return findings;
+}
+function scanGenericSecretAssignments(relativePath, content) {
+    const mode = genericSecretFileMode(relativePath);
+    if (mode === "quoted-only")
+        return scanQuotedCodeAssignments(relativePath, content);
+    const findings = [];
+    const lines = content.split("\n");
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+        const line = lines[lineIndex];
+        const trimmed = line.trim();
+        if (trimmed.length === 0 || trimmed.startsWith("#") || trimmed.startsWith(";"))
+            continue;
+        const unquotedMatch = UNQUOTED_CONFIG_PATTERN.exec(trimmed);
+        if (!unquotedMatch)
+            continue;
+        const identifier = unquotedMatch[1];
+        if (!isGenericSecretIdentifier(identifier))
+            continue;
+        const rawCandidate = unquotedMatch[2];
+        if (isDynamicUnquotedValue(rawCandidate))
+            continue;
+        const rawValue = stripSurroundingQuotes(rawCandidate);
+        if (rawValue.length < MIN_GENERIC_SECRET_LENGTH)
+            continue;
+        if (isPlaceholder(rawValue))
+            continue;
+        findings.push({
+            kind: "generic-secret-assignment",
+            file: relativePath,
+            line: lineIndex + 1,
+            matchedText: `${identifier} ${line.includes(":") ? ":" : "="} [REDACTED]`,
+            matchLength: rawValue.length,
+            severity: SEVERITY_FOR_KIND["generic-secret-assignment"],
+        });
     }
     return findings;
 }