@delorenj/pjangler 1.4.6 → 1.5.3

package/templates/hermes-agent/template/.scripts/providers/trello.sh

@@ -1,241 +0,0 @@
-#!/usr/bin/env sh
-# Trello ticket-provider adapter.
-#
-# Credentials:  TRELLO_KEY  TRELLO_TOKEN   (query-param auth)
-# Board binding (role.yaml `ticket_provider:`):
-#   name: trello
-#   board: <board-id>                 (set by create_board / 42-ticket-provider)
-#   state_map: { backlog:"Backlog", unstarted:"To Do", started:"In Progress",
-#                in_review:"Review", completed:"Done", cancelled:"Cancelled" }
-#                                              optional
-#
-# Trello model:  board = project & milestone, list = state, card = issue.
-# Trello has no milestone primitive, so active_milestone returns the board.
-#
-# NOTE: list names are matched case-insensitively against state_map; override
-# state_map in role.yaml if the board uses different column names.
-set -eu
-
-OP="${1:-}"; shift 2>/dev/null || true
-ROLE_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
-ROLE_YAML="$ROLE_DIR/role.yaml"
-API="https://api.trello.com/1"
-
-die() { echo "trello: $*" >&2; exit 1; }
-need_key() { [ -n "${TRELLO_KEY:-}" ] && [ -n "${TRELLO_TOKEN:-}" ] || die "TRELLO_KEY and TRELLO_TOKEN must be set"; }
-
-tp_cfg() {
-  [ -f "$ROLE_YAML" ] || return 0
-  python3 - "$ROLE_YAML" "$1" <<'PY'
-import sys, re, pathlib
-text = pathlib.Path(sys.argv[1]).read_text()
-m = re.search(r'(?ms)^ticket_provider:\s*$(.*?)(?=^\S)', text + "\n\x00")
-block = m.group(1) if m else ""
-mm = re.search(rf'(?m)^\s*{re.escape(sys.argv[2])}:\s*"?([^"\n]*)"?\s*$', block)
-print(mm.group(1).strip() if mm else "")
-PY
-}
-
-# pj_cfg KEY — read ticket_provider.<KEY> from the repo-root .project.json (the
-# SOT), walking up from the role dir. Preferred over role.yaml.
-pj_cfg() {
-  python3 - "$ROLE_DIR" "$1" <<'PY'
-import sys, json, pathlib
-start = pathlib.Path(sys.argv[1]).resolve(); key = sys.argv[2]
-for parent in [start, *start.parents]:
-    f = parent / ".project.json"
-    if f.is_file():
-        try: tp = (json.loads(f.read_text()).get("ticket_provider") or {})
-        except Exception: tp = {}
-        print(tp.get(key, "") if isinstance(tp, dict) else ""); break
-else:
-    print("")
-PY
-}
-
-BOARD="$(pj_cfg board_id)"; [ -n "$BOARD" ] || BOARD="$(tp_cfg board)"
-# Normalized -> Trello list name (overridable via role.yaml state_map keys).
-list_name_for() {
-  case "$1" in
-    backlog)   v="$(tp_cfg backlog)";   printf '%s' "${v:-Backlog}" ;;
-    unstarted) v="$(tp_cfg unstarted)"; printf '%s' "${v:-To Do}" ;;
-    started)   v="$(tp_cfg started)";   printf '%s' "${v:-In Progress}" ;;
-    in_review) v="$(tp_cfg in_review)"; printf '%s' "${v:-Review}" ;;
-    completed) v="$(tp_cfg completed)"; printf '%s' "${v:-Done}" ;;
-    cancelled) v="$(tp_cfg cancelled)"; printf '%s' "${v:-Cancelled}" ;;
-    *) die "invalid normalized state: $1" ;;
-  esac
-}
-
-# api METHOD PATH [extra-query] — call Trello, auth appended, print body.
-api() {
-  need_key
-  method="$1"; path="$2"; extra="${3:-}"
-  sep="?"; case "$path" in *\?*) sep="&" ;; esac
-  url="$API/$path${sep}key=$TRELLO_KEY&token=$TRELLO_TOKEN${extra:+&$extra}"
-  curl -fsS -X "$method" "$url"
-}
-
-# Resolve a list id on the board by (normalized) state.
-list_id_for() {
-  [ -n "$BOARD" ] || die "ticket_provider.board not set"
-  want="$(list_name_for "$1")"
-  api GET "boards/$BOARD/lists" | NM="$want" python3 -c 'import sys,json,os
-rows=json.load(sys.stdin); nm=os.environ["NM"].strip().casefold()
-matches=[row for row in rows if str(row.get("name") or "").strip().casefold()==nm]
-if len(matches) != 1:
-    raise SystemExit("trello: exact list name %r resolved %d lists; exactly one is required" % (os.environ["NM"], len(matches)))
-list_id=str(matches[0].get("id") or "")
-if not list_id:
-    raise SystemExit("trello: resolved list omitted its id")
-print(list_id)'
-}
-
-# All Trello ops require credentials; fail fast and clean before any pipe.
-need_key
-
-case "$OP" in
-  resolve)
-    [ -n "$BOARD" ] || die "board not set (run 42-ticket-provider.sh)"
-    api GET "boards/$BOARD" "fields=name,url" | python3 -c 'import sys,json
-b=json.load(sys.stdin); print(json.dumps({"provider":"trello","board_id":b.get("id",""),"board_url":b.get("url","")}))'
-    ;;
-
-  active_milestone)
-    [ -n "$BOARD" ] || die "board not set"
-    api GET "boards/$BOARD" "fields=name" | python3 -c 'import sys,json
-b=json.load(sys.stdin); print(json.dumps({"id":b.get("id",""),"name":b.get("name",""),"state":"active"}))'
-    ;;
-
-  list_issues)
-    [ -n "$BOARD" ] || die "board not set"
-    # cards + lists, then label each card with its list name as the state.
-    LISTS="$(api GET "boards/$BOARD/lists" "fields=name")"
-    CARDS="$(api GET "boards/$BOARD/cards" "fields=name,idList,dateLastActivity,url,shortLink")"
-    printf '%s\n%s\n' "$LISTS" "$CARDS" | python3 -c 'import sys,json
-parts=sys.stdin.read().split("\n",1)
-lists={l["id"]:l.get("name","") for l in json.loads(parts[0] or "[]")}
-out=[]
-for c in json.loads(parts[1] or "[]"):
-    nm=lists.get(c.get("idList",""),"")
-    out.append({"id":c.get("id",""),"key":c.get("shortLink",""),"title":c.get("name",""),
-                "state":nm,"state_type":nm.lower().replace(" ","_"),
-                "updated_at":c.get("dateLastActivity",""),"assignee":"","url":c.get("url","")})
-print(json.dumps(out))'
-    ;;
-
-  get_issue)
-    ID="${1:?usage: get_issue <id>}"
-    CARD="$(api GET "cards/$ID" "fields=name,desc,idList")"
-    COMM="$(api GET "cards/$ID/actions" "filter=commentCard")"
-    printf '%s\n%s\n' "$CARD" "$COMM" | python3 -c 'import sys,json
-parts=sys.stdin.read().split("\n",1)
-c=json.loads(parts[0] or "{}"); acts=json.loads(parts[1] or "[]")
-cs=[{"id":a.get("id",""),"body":(a.get("data") or {}).get("text",""),"author":(a.get("memberCreator") or {}).get("fullName","")} for a in acts]
-print(json.dumps({"id":c.get("id",""),"key":c.get("id",""),"title":c.get("name",""),
-                  "description":c.get("desc",""),"acceptance":c.get("desc",""),
-                  "state":"","state_type":"","comments":cs}))'
-    ;;
-
-  comment)
-    ID="${1:?usage: comment <id> <body>}"; BODY="${2:?}"
-    api POST "cards/$ID/actions/comments" "text=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$BODY")" \
-      | EXPECTED_ID="$ID" python3 -c 'import sys,json,os
-action=json.load(sys.stdin)
-if not isinstance(action,dict):
-    raise SystemExit("trello: comment response was not an action object")
-action_id=action.get("id")
-if not isinstance(action_id,str) or not action_id.strip():
-    raise SystemExit("trello: comment response omitted its action id")
-data=action.get("data")
-card=data.get("card") if isinstance(data,dict) else None
-if not isinstance(card,dict) or str(card.get("id") or "").strip()!=os.environ["EXPECTED_ID"]:
-    raise SystemExit("trello: comment response did not identify the requested card")
-print(action_id.strip())'
-    ;;
-
-  transition)
-    ID="${1:?usage: transition <id> <normalized-state>}"; TARGET="${2:?}"
-    LID="$(list_id_for "$TARGET")"
-    [ -n "$LID" ] || die "no Trello list mapped for normalized '$TARGET' (check state_map)"
-    api PUT "cards/$ID" "idList=$LID" >/dev/null
-    api GET "cards/$ID" "fields=id,idList" \
-      | EXPECTED_ID="$ID" EXPECTED_LIST_ID="$LID" python3 -c 'import sys,json,os
-card=json.load(sys.stdin)
-if str(card.get("id") or "") != os.environ["EXPECTED_ID"]:
-    raise SystemExit("trello: transition read-back did not identify the requested card")
-if str(card.get("idList") or "") != os.environ["EXPECTED_LIST_ID"]:
-    raise SystemExit("trello: transition read-back did not confirm the exact target list")
-print("ok " + str(card.get("id") or ""))'
-    ;;
-
-  describe_board)
-    # Read-only board lookup against an EXPLICIT workspace argument, mirroring
-    # the Plane op, so no ambient binding can send the query somewhere else.
-    # Trello mints NO project key, so `identifier` is ALWAYS empty here: an
-    # empty identifier is this provider's authoritative answer, not a lookup
-    # failure, and callers must never promote it to a confirmed value.
-    DWS="${1:?usage: describe_board <workspace> <board_id>}"
-    DBID="${2:?usage: describe_board <workspace> <board_id>}"
-    api GET "boards/$DBID" "fields=id,name,idOrganization" \
-      | WS="$DWS" BID="$DBID" python3 -c 'import sys, json, os
-b = json.load(sys.stdin)
-print(json.dumps({
-    "board_id": str(b.get("id") or os.environ["BID"]),
-    "identifier": "",
-    "workspace": str(b.get("idOrganization") or os.environ["WS"]),
-    "name": str(b.get("name") or ""),
-}))'
-    ;;
-
-  create_board)
-    NAME="${1:?usage: create_board <name> <ident> <desc>}"
-    EXIST="$(api GET "members/me/boards" "fields=name" | NM="$NAME" python3 -c 'import sys,json,os
-rows=json.load(sys.stdin); nm=os.environ["NM"].lower()
-print(next((b["id"] for b in rows if b.get("name","").lower()==nm), ""))')"
-    if [ -n "$EXIST" ]; then BID="$EXIST"; else
-      BID="$(api POST "boards/" "name=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$NAME")&defaultLists=true" \
-        | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
-    fi
-    [ -n "$BID" ] || die "create_board failed"
-    # Trello assigns no project key, so the caller's prefix IS the identity and
-    # this adapter is the only thing that can confirm it. Echo it back: the
-    # create_board envelope always carries the identifier the board is bound
-    # under, so no caller ever has to invent one.
-    api GET "boards/$BID" "fields=url" | BID="$BID" IDENT="${2:-}" python3 -c 'import sys,json,os
-b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url",""),"identifier":os.environ.get("IDENT","")}))'
-    ;;
-
-  create_issue)
-    # File a new card on the bound board. Board comes from resolved config,
-    # never from an argument. Deliberately NOT idempotent by default: two cards
-    # may legitimately share a title. Pass --if-absent to reuse a card whose
-    # name already matches exactly (case-insensitive) instead.
-    IF_ABSENT=0
-    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
-    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
-    [ -n "$BOARD" ] || die "board not set (run 42-ticket-provider.sh)"
-    CID=""; CREATED=true
-    if [ "$IF_ABSENT" = 1 ]; then
-      CID="$(api GET "boards/$BOARD/cards" "fields=name" | NM="$TITLE" python3 -c 'import sys,json,os
-rows=json.load(sys.stdin); nm=os.environ["NM"].strip().lower()
-print(next((c["id"] for c in rows if (c.get("name") or "").strip().lower()==nm), ""))')"
-      [ -z "$CID" ] || CREATED=false
-    fi
-    if [ -z "$CID" ]; then
-      # New cards land in the backlog list, falling back to the unstarted one.
-      LID="$(list_id_for backlog)"
-      [ -n "$LID" ] || LID="$(list_id_for unstarted)"
-      [ -n "$LID" ] || die "no Trello list mapped for 'backlog' or 'unstarted' (check state_map)"
-      CID="$(api POST "cards" "idList=$LID&name=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$TITLE")&desc=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$DESC")" \
-        | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
-    fi
-    [ -n "$CID" ] || die "create_issue failed"
-    api GET "cards/$CID" "fields=url,shortLink" | CID="$CID" CREATED="$CREATED" python3 -c 'import sys,json,os
-c=json.load(sys.stdin)
-print(json.dumps({"issue_id":os.environ["CID"],"key":c.get("shortLink",""),
-                  "issue_url":c.get("url",""),"created":os.environ["CREATED"]=="true"}))'
-    ;;
-
-  *) die "unknown op: $OP" ;;
-esac

package/templates/hermes-agent/template/.scripts/reporter-watchdog.py

@@ -1,242 +0,0 @@
-#!/usr/bin/env python3
-"""Gateway-independent health watchdog for a Hermes reporter profile.
-
-Defaults target the DeLoNET company reporter; override the REPORTER_* environment
-variables below to point it at another reporter deployment.
-"""
-
-from __future__ import annotations
-
-import argparse
-import datetime as dt
-import hashlib
-import json
-import os
-import re
-import subprocess
-import tempfile
-import urllib.request
-from pathlib import Path
-from zoneinfo import ZoneInfo
-
-# Deployment-specific constants. The defaults describe the DeLoNET company
-# reporter this watchdog was written for; every one is overridable so a second
-# reporter does not need a forked copy of this file.
-PROFILE_NAME = os.environ.get("REPORTER_PROFILE_NAME", "delonet-company-reporter")
-REPORT_SLUG = os.environ.get("REPORTER_REPORT_SLUG", "delonet-daily-report")
-JOB_PREFIX = os.environ.get("REPORTER_JOB_PREFIX", "ddr")
-EXPECTED_JOBS = {
-    job.strip()
-    for job in os.environ.get(
-        "REPORTER_EXPECTED_JOBS",
-        f"{JOB_PREFIX}:daily,"
-        f"{JOB_PREFIX}:journal:hermes-fleet-health,"
-        f"{JOB_PREFIX}:journal:nightly-pr-maintenance,"
-        f"{JOB_PREFIX}:journal:report-delivery-health",
-    ).split(",")
-    if job.strip()
-}
-REPORT_TIMEZONE = os.environ.get("REPORTER_TIMEZONE", "America/New_York")
-NTFY_URL = os.environ.get("REPORTER_NTFY_URL", "https://ntfy.delo.sh/bloodbank")
-NTFY_TOKEN_REF = os.environ.get(
-    "REPORTER_NTFY_TOKEN_REF", "op://DeLoSecrets/ntfy/add more/accessToken"
-)
-HOME = Path.home()
-PROFILE = HOME / ".hermes" / "profiles" / PROFILE_NAME
-CONFIG = HOME / ".config" / REPORT_SLUG / "report.json"
-STATE_DIR = HOME / ".local" / "state" / REPORT_SLUG / "watchdog"
-STATUS_PATH = STATE_DIR / "status.json"
-ALERT_PATH = STATE_DIR / "last-alert.json"
-TICK_MAX_AGE_SECONDS = 180
-
-
-def load_json(path: Path) -> object:
-    return json.loads(path.read_text(encoding="utf-8"))
-
-
-def atomic_json(path: Path, value: object) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(value, handle, indent=2, sort_keys=True)
-            handle.write("\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temporary, path)
-    finally:
-        try:
-            os.unlink(temporary)
-        except FileNotFoundError:
-            pass
-
-
-def gateway_homes() -> dict[str, list[str]]:
-    homes: dict[str, list[str]] = {}
-    for unit in (HOME / ".config" / "systemd" / "user").glob("hermes*gateway.service"):
-        text = unit.read_text(encoding="utf-8", errors="replace")
-        match = re.search(r"^Environment=HERMES_HOME=(.+)$", text, re.MULTILINE)
-        if not match:
-            continue
-        raw = match.group(1).strip().strip('"')
-        resolved = str(Path(os.path.expandvars(raw)).expanduser().resolve(strict=False))
-        homes.setdefault(resolved, []).append(unit.name)
-    return homes
-
-
-def alert_ntfy(codes: list[str]) -> str | None:
-    try:
-        token = subprocess.run(
-            ["op", "read", NTFY_TOKEN_REF],
-            check=True,
-            capture_output=True,
-            text=True,
-            timeout=15,
-        ).stdout.strip()
-        if not token:
-            return "ntfy access token unavailable"
-        body = (
-            f"Critical {PROFILE_NAME} health failure: "
-            + ", ".join(sorted(codes))
-            + ". Inspect the profile-scoped watchdog status."
-        ).encode()
-        request = urllib.request.Request(
-            NTFY_URL,
-            data=body,
-            method="POST",
-            headers={
-                "Authorization": f"Bearer {token}",
-                "Title": f"{PROFILE_NAME} critical",
-                "Priority": "urgent",
-                "Tags": "rotating_light",
-            },
-        )
-        with urllib.request.urlopen(request, timeout=15) as response:
-            if not 200 <= response.status < 300:
-                return f"ntfy returned HTTP {response.status}"
-    except Exception as exc:  # fail open; status captures the alert failure
-        return f"ntfy alert failed: {type(exc).__name__}"
-    return None
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--no-alert", action="store_true")
-    parser.add_argument("--tick-max-age", type=int, default=TICK_MAX_AGE_SECONDS)
-    args = parser.parse_args()
-
-    now = dt.datetime.now(dt.UTC)
-    eastern = now.astimezone(ZoneInfo(REPORT_TIMEZONE))
-    critical: list[dict[str, str]] = []
-    warnings: list[dict[str, str]] = []
-
-    target = PROFILE.resolve(strict=False)
-    if not PROFILE.is_symlink():
-        critical.append({"code": "profile_not_symlinked", "detail": str(PROFILE)})
-
-    jobs_path = PROFILE / "cron" / "jobs.json"
-    try:
-        raw_jobs = load_json(jobs_path)
-        jobs = raw_jobs.get("jobs", []) if isinstance(raw_jobs, dict) else []
-    except (OSError, json.JSONDecodeError):
-        jobs = []
-        critical.append({"code": "jobs_store_unreadable", "detail": str(jobs_path)})
-
-    names = [job.get("name") for job in jobs if isinstance(job, dict)]
-    duplicates = sorted({name for name in names if name and names.count(name) > 1})
-    missing = sorted(EXPECTED_JOBS - set(names))
-    unexpected = sorted({name for name in names if name and name.startswith(f"{JOB_PREFIX}:")} - EXPECTED_JOBS)
-    if duplicates:
-        critical.append({"code": "duplicate_managed_jobs", "detail": ",".join(duplicates)})
-    if missing:
-        critical.append({"code": "missing_managed_jobs", "detail": ",".join(missing)})
-    if unexpected:
-        warnings.append({"code": "unexpected_managed_jobs", "detail": ",".join(unexpected)})
-    paused = sorted(
-        job.get("name")
-        for job in jobs
-        if isinstance(job, dict)
-        and job.get("name") in EXPECTED_JOBS
-        and not job.get("enabled", False)
-    )
-    if paused:
-        warnings.append({"code": "managed_jobs_paused", "detail": ",".join(paused)})
-
-    tick_lock = PROFILE / "cron" / ".tick.lock"
-    tick_age = None
-    if tick_lock.exists():
-        tick_age = max(0, int(now.timestamp() - tick_lock.stat().st_mtime))
-        if tick_age > args.tick_max_age:
-            critical.append({"code": "stale_cron_tick", "detail": f"age_seconds={tick_age}"})
-    else:
-        critical.append({"code": "missing_cron_tick", "detail": str(tick_lock)})
-
-    daily = next((job for job in jobs if isinstance(job, dict) and job.get("name") == f"{JOB_PREFIX}:daily"), {})
-    state = str(daily.get("last_status") or daily.get("status") or "").lower()
-    if state in {"failed", "error"}:
-        critical.append({"code": "daily_job_failed", "detail": state})
-
-    try:
-        config = load_json(CONFIG)
-    except (OSError, json.JSONDecodeError):
-        config = {}
-        critical.append({"code": "config_unreadable", "detail": str(CONFIG)})
-    daily_config = (
-        config.get("daily", {}) if isinstance(config, dict) and isinstance(config.get("daily"), dict) else {}
-    )
-    deliver = (
-        daily_config.get("deliver")
-    )
-    if deliver != "telegram":
-        warnings.append({"code": "telegram_delivery_not_activated", "detail": str(deliver)})
-
-    archive_dir = Path(config.get("archive_dir", "")) if isinstance(config, dict) else Path()
-    current = archive_dir / eastern.strftime("%Y/%m/%Y-%m-%d/current.json")
-    if daily_config.get("enabled") and (eastern.hour, eastern.minute) >= (8, 15) and not current.is_file():
-        critical.append({"code": "daily_report_missed", "detail": str(current)})
-
-    homes = gateway_homes()
-    profile_units = sorted(homes.get(str(target), []))
-    if len(profile_units) > 1:
-        critical.append({"code": "reporter_gateway_duplicated", "detail": ",".join(profile_units)})
-    for home, units in sorted(homes.items()):
-        if len(units) > 1 and home != str(target):
-            warnings.append(
-                {"code": "fleet_gateway_home_duplicated", "detail": f"{home}: {','.join(sorted(units))}"}
-            )
-
-    codes = sorted(item["code"] for item in critical)
-    fingerprint = hashlib.sha256("\n".join(codes).encode()).hexdigest() if codes else ""
-    previous = {}
-    try:
-        previous = load_json(ALERT_PATH)
-    except (OSError, json.JSONDecodeError):
-        pass
-    alert_error = None
-    if codes and fingerprint != previous.get("fingerprint") and not args.no_alert:
-        alert_error = alert_ntfy(codes)
-        if alert_error is None:
-            atomic_json(ALERT_PATH, {"fingerprint": fingerprint, "sent_at": now.isoformat()})
-    elif not codes and previous.get("fingerprint"):
-        atomic_json(ALERT_PATH, {"fingerprint": "", "cleared_at": now.isoformat()})
-
-    status = {
-        "checked_at": now.isoformat(),
-        "profile": PROFILE_NAME,
-        "profile_home": str(PROFILE),
-        "profile_target": str(target),
-        "healthy": not critical,
-        "critical": critical,
-        "warnings": warnings,
-        "tick_age_seconds": tick_age,
-        "managed_jobs": sorted(name for name in names if name and name.startswith(f"{JOB_PREFIX}:")),
-        "delivery": deliver,
-        "alert_error": alert_error,
-    }
-    atomic_json(STATUS_PATH, status)
-    print(json.dumps(status, indent=2, sort_keys=True))
-    return 1 if critical else 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

package/templates/hermes-agent/template/.scripts/secret-scan.py

@@ -1,134 +0,0 @@
-#!/usr/bin/env python3
-"""Fail closed when a runtime tree contains likely credential material."""
-
-from __future__ import annotations
-
-import argparse
-import re
-from pathlib import Path
-
-KEY_VALUE = re.compile(
-    r"(?im)^\s*[\"']?(?P<key>api[_-]?key|token|secret|password|authorization|cookie|client[_-]?secret|private[_-]?key)[\"']?\s*[:=]\s*(?P<value>[^\r\n#]*)"
-)
-TOKEN = re.compile(
-    r"(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|tvly-[A-Za-z0-9_-]{10,}|fc-[A-Za-z0-9_-]{10,}|[0-9]{6,}:[A-Za-z0-9_-]{20,})"
-)
-PRIVATE_KEY = re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")
-SAFE_VALUES = {
-    "openrouter",
-    "openai",
-    "anthropic",
-    "auto",
-    "none",
-    "null",
-    "false",
-    "true",
-}
-SAFE_PREFIXES = ("${", "$", "op://", "env:", "[REDACTED]", "{{", "{%")
-COMPUTED_VALUE = re.compile(r"^[A-Za-z_][A-Za-z0-9_.]*\s*(?:\(|\[)")
-INTERPOLATED_VALUE = re.compile(
-    r"(?:\$\{[A-Za-z_][A-Za-z0-9_]*[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\{[A-Za-z_][A-Za-z0-9_.]*\})"
-)
-ENV_ASSIGNMENT = re.compile(
-    r"(?m)^\s*(?:export\s+)?(?P<key>[A-Za-z_][A-Za-z0-9_]*)\s*=\s*(?P<value>[^\r\n#]*)"
-)
-SENSITIVE_ENV_KEY = re.compile(
-    r"(?i)(?:^|_)(?:api_key|token|secret|password|authorization|cookie|client_secret|private_key)(?:_|$)"
-)
-ALLOWED_ENV_FILES = {".env.example", ".env.op"}
-SKIP_PARTS = {
-    ".cache",
-    ".direnv",
-    ".eggs",
-    ".git",
-    ".mypy_cache",
-    ".nox",
-    ".npm",
-    ".pnpm-store",
-    ".pytest_cache",
-    ".ruff_cache",
-    ".tox",
-    ".turbo",
-    ".uv-cache",
-    ".venv",
-    ".yarn",
-    "__pycache__",
-    "dist-packages",
-    "node_modules",
-    "site-packages",
-    "venv",
-}
-
-
-def safe_assignment(raw_value: str) -> bool:
-    """Return true only for an explicit reference, sentinel, or computation."""
-
-    value = raw_value.strip().rstrip(",").strip().strip("\"'")
-    if not value or value.lower() in SAFE_VALUES:
-        return True
-    if value.startswith(SAFE_PREFIXES) or value.endswith("_ENV"):
-        return True
-    if INTERPOLATED_VALUE.search(value):
-        return True
-    # Source code commonly binds credentials from a runtime provider. A bare
-    # literal does not have a call/index boundary and remains fail-closed.
-    return COMPUTED_VALUE.match(value) is not None
-
-
-def safe_env_reference(raw_value: str) -> bool:
-    """Keep a tracked .env.op declarative: sensitive values stay references."""
-
-    value = raw_value.strip().rstrip(",").strip().strip("\"'")
-    return not value or value.startswith(SAFE_PREFIXES)
-
-
-def findings(root: Path) -> list[str]:
-    result: list[str] = []
-    for path in root.rglob("*"):
-        relative = path.relative_to(root)
-        if not path.is_file() or any(part in SKIP_PARTS for part in relative.parts):
-            continue
-        if path.name == "secret-scan.py":
-            continue
-        if path.name.startswith(".env") and path.name not in ALLOWED_ENV_FILES:
-            result.append(f"forbidden secret file: {relative}")
-            continue
-        if path.name in {"auth.json", "auth.lock"} or path.suffix in {".pem", ".key"}:
-            result.append(f"forbidden credential file: {relative}")
-            continue
-        try:
-            text = path.read_text(encoding="utf-8")
-        except (UnicodeDecodeError, OSError):
-            continue
-        if TOKEN.search(text) or PRIVATE_KEY.search(text):
-            result.append(f"credential token pattern: {relative}")
-        if path.name == ".env.op":
-            for match in ENV_ASSIGNMENT.finditer(text):
-                if SENSITIVE_ENV_KEY.search(
-                    match.group("key")
-                ) and not safe_env_reference(match.group("value")):
-                    result.append(f"literal credential assignment: {relative}")
-                    break
-        for match in KEY_VALUE.finditer(text):
-            if safe_assignment(match.group("value")):
-                continue
-            result.append(f"literal credential assignment: {relative}")
-            break
-    return sorted(set(result))
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("root", type=Path)
-    args = parser.parse_args()
-    issues = findings(args.root.resolve())
-    if issues:
-        for issue in issues:
-            print(issue)
-        return 1
-    print("secret scan: clean")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())