@kaydash9999/banker-plugins 0.23.3 → 0.24.1

package/skills/git-init/scripts/marker-block.mjs

@@ -0,0 +1,321 @@
+/**
+ * marker-block: puts one marked block of lines into a text file, replaces it or takes it out, and leaves every
+ * byte outside the block as it was.
+ *
+ * The canonical copy is skills/init-dir/scripts/marker-block.mjs. tune-tmux and git-init carry byte-identical
+ * copies, since Codex installs every skill folder on its own; scripts/sync-adapter.js mirrors and checks them.
+ * Edit the canonical copy only.
+ *
+ * Policy (one place for every skill that edits a user's file):
+ * - Markers are whole lines `<open> <id>:start <close>` and `<open> <id>:end <close>`, with the comment syntax
+ *   given (`#` or `<!-- -->`). A marker inside a sentence, an unpaired marker, an end before a start or a second
+ *   block is refused: nothing is cut on a guess.
+ * - Bytes outside the block stay as they were. CRLF files get CRLF blocks, a byte order mark stays in front.
+ *   A file that is not UTF-8 is refused.
+ * - A folder, FIFO, socket or device at the name is refused without being read.
+ * - A symbolic link is refused (refused: "symlink") unless followSymlink is set; then the file it leads to is
+ *   written and the link stays a link. A link to nothing is refused either way ("dangling").
+ * - A file with two or more hard links is refused ("hardlink"): the rename below would split them.
+ * - A file owned by another user is refused ("owner"). The permission bits of the file carry over to the new
+ *   file. Windows has no owner or permission bits to check.
+ * - Writes go to a temp file in the same folder and a rename. A failed write removes the temp file.
+ * - When the bytes change, the first original is kept in `<file>.<skill>.bak`; an existing backup is never
+ *   overwritten.
+ *
+ * Results are { ok, changed, refused?, message, path, file }. Callers map refused to exit status 1.
+ */
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  readlinkSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+
+/** Comment syntaxes. */
+export const HTML = Object.freeze({ open: "<!--", close: "-->" });
+export const HASH = Object.freeze({ open: "#", close: "" });
+
+const BOM = "\u{FEFF}";
+const UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+const MAX_BYTES = 32 * 1024 * 1024;
+const NEW_FILE_MODE = 0o644;
+const BACKUP_MODE = 0o600;
+
+/** The start and end marker lines for id in a comment syntax. */
+export function markers(comment, id) {
+  const tail = comment.close ? ` ${comment.close}` : "";
+  return { start: `${comment.open} ${id}:start${tail}`, end: `${comment.open} ${id}:end${tail}` };
+}
+
+const refusal = (code, message, path) => ({ ok: false, changed: false, refused: code, message, path });
+const bare = (line) => line.replace(/\r?\n$/, "").replace(/[ \t]+$/, "");
+const eolOf = (text) => (text.includes("\r\n") ? "\r\n" : "\n");
+const readlinkOr = (path) => {
+  try {
+    return readlinkSync(path);
+  } catch {
+    return "?";
+  }
+};
+const nativeReal = (path) => {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return resolve(path);
+  }
+};
+const realOrNull = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+};
+
+// Where the bytes live: the path itself, or with followSymlink the file a link leads to.
+function locate(path, follow) {
+  const lst = lstatSync(path, { throwIfNoEntry: false });
+  if (!lst) return { file: path, exists: false };
+  if (!lst.isSymbolicLink()) return { file: path, exists: true };
+  const target = readlinkOr(path);
+  if (!follow) return { refuse: refusal("symlink", `심볼릭 링크라 그대로 둠: ${path} -> ${target}`, path) };
+  const real = realOrNull(path);
+  if (real === null) return { refuse: refusal("dangling", `끊어진 링크라 그대로 둠: ${path} -> ${target}`, path) };
+  return { file: real, exists: true, link: path };
+}
+
+// Why the file at file may not be read or replaced, or null.
+function fileProblem(st, file, uid) {
+  if (!st.isFile()) return refusal("special", `일반 파일이 아니라 그대로 둠: ${file}`, file);
+  if (st.nlink > 1) return refusal("hardlink", `하드 링크가 ${st.nlink}개라 그대로 둠: ${file}`, file);
+  if (uid !== undefined && st.uid !== uid) return refusal("owner", `다른 사용자 소유라 그대로 둠: ${file}`, file);
+  if (st.size > MAX_BYTES) return refusal("too-big", `32MiB 보다 커서 그대로 둠: ${file}`, file);
+  return null;
+}
+
+// The file's stat and bytes, opened without blocking so a FIFO planted after the look never waits. id: the same
+// file's bigint stat for telling files apart (an NTFS file id passes 2^53, so as a Number two files can share one).
+function readChecked(file, uid) {
+  const first = statSync(file);
+  const problem = fileProblem(first, file, uid);
+  if (problem) return { refuse: problem };
+  const fd = openSync(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
+  try {
+    const st = fstatSync(fd);
+    const late = fileProblem(st, file, uid);
+    return late ? { refuse: late } : { st, id: fstatSync(fd, { bigint: true }), bytes: readFileSync(fd) };
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// What one line is: "start", "end", "inline" (a marker inside other text) or null.
+function kindOf(line, mk) {
+  const b = bare(line);
+  if (b === mk.start) return "start";
+  if (b === mk.end) return "end";
+  return line.includes(mk.start) || line.includes(mk.end) ? "inline" : null;
+}
+
+// Takes line i of kind into state; returns why the markers are broken, or null.
+function step(state, kind, i) {
+  if (kind === "inline") return `문장 안에 표지가 있음(${i + 1}행)`;
+  if (kind === "start") {
+    if (state.open !== -1 || state.found) return `표지 짝이 맞지 않거나 블록이 둘 이상(${i + 1}행)`;
+    state.open = i;
+  } else if (kind === "end") {
+    if (state.open === -1) return `끝 표지가 시작 표지보다 먼저(${i + 1}행)`;
+    state.found = { first: state.open, last: i };
+    state.open = -1;
+  }
+  return null;
+}
+
+/** The block's first and last line in lines, null when there is none, or { error } when markers are broken. */
+export function findBlock(lines, mk) {
+  const state = { open: -1, found: null };
+  for (let i = 0; i < lines.length; i++) {
+    const error = step(state, kindOf(lines[i], mk), i);
+    if (error) return { error };
+  }
+  if (state.open !== -1) return { error: `짝 없는 시작 표지(${state.open + 1}행)` };
+  return state.found;
+}
+
+// Whether line i sits inside an open wrap region (more wrap opens than closes before it).
+function insideWrap(lines, i, wrap) {
+  let depth = 0;
+  for (let j = 0; j < i; j++) {
+    const b = bare(lines[j]);
+    if (b === wrap.open) depth++;
+    else if (b === wrap.close && depth > 0) depth--;
+  }
+  return depth > 0;
+}
+
+// The span [first, last] widened to wrap lines directly around it, and whether new text must bring its own wrap.
+function spanOf(lines, found, wrap) {
+  if (!wrap) return { ...found, wrapNew: false };
+  const wrapped = found.first > 0 && bare(lines[found.first - 1]) === wrap.open && bare(lines[found.last + 1] ?? "") === wrap.close;
+  if (wrapped) return { first: found.first - 1, last: found.last + 1, wrapNew: true };
+  return { ...found, wrapNew: !insideWrap(lines, found.first, wrap) };
+}
+
+const blockText = (mk, body, wrap, eol) => {
+  const inner = [mk.start, ...body.replace(/\r\n/g, "\n").replace(/\n$/, "").split("\n"), mk.end];
+  return [...(wrap ? [wrap.open, ...inner, wrap.close] : inner), ""].join(eol);
+};
+
+// The text with the block put in, replaced or (body null) taken out. Appending puts one line break between the
+// text and the block; taking a block out at the end of the file takes that break back, so add then remove gives
+// the bytes from before.
+function render(text, found, o) {
+  const lines = text.split(/(?<=\n)/);
+  const eol = eolOf(text);
+  if (!found) {
+    if (o.body === null) return text;
+    return text === "" ? blockText(o.mk, o.body, o.wrap, eol) : text + eol + blockText(o.mk, o.body, o.wrap, eol);
+  }
+  const span = spanOf(lines, found, o.wrap);
+  const before = lines.slice(0, span.first).join("");
+  const after = lines.slice(span.last + 1).join("");
+  if (o.body !== null) return before + blockText(o.mk, o.body, span.wrapNew ? o.wrap : null, eol) + after;
+  return after === "" ? before.replace(/\r?\n$/, "") : before + after;
+}
+
+function checkBody(o) {
+  if (o.body === null) return;
+  const forbidden = [o.mk.start, o.mk.end, ...(o.wrap ? [o.wrap.open, o.wrap.close] : [])];
+  if (o.body.split(/\r?\n/).some((line) => forbidden.includes(bare(line)))) throw new Error("block body holds a marker line");
+}
+
+// The new bytes for the old ones, or { refuse } when the old ones may not be edited.
+function nextBytes(bytes, o, file) {
+  let text;
+  try {
+    text = UTF8.decode(bytes);
+  } catch {
+    return { refuse: refusal("encoding", `UTF-8 이 아니라 그대로 둠: ${file}`, file) };
+  }
+  const bom = text.startsWith(BOM) ? BOM : "";
+  const plain = text.slice(bom.length);
+  const found = findBlock(plain.split(/(?<=\n)/), o.mk);
+  if (found?.error) return { refuse: refusal("markers", `표지 손상이라 그대로 둠: ${file}: ${found.error}`, file) };
+  return { bytes: Buffer.from(bom + render(plain, found, o), "utf8") };
+}
+
+const options = (opts) => ({
+  mk: markers(opts.comment, opts.id),
+  body: opts.body ?? null,
+  wrap: opts.wrap ?? null,
+  skill: opts.skill,
+  follow: opts.followSymlink === true,
+  uid: "uid" in opts ? opts.uid : process.getuid?.(),
+});
+
+/**
+ * Works out what applyBlock would write, without writing: { ok, changed, refused?, message, path, file, key,
+ * before, after, mode }. key names the file (device and inode, or the path of a file not there yet).
+ */
+export function planBlock(path, opts) {
+  const o = options(opts);
+  checkBody(o);
+  const at = locate(path, o.follow);
+  if (at.refuse) return at.refuse;
+  if (!at.exists) {
+    const after = o.body === null ? null : Buffer.from(blockText(o.mk, o.body, o.wrap, "\n"), "utf8");
+    return { ok: true, changed: after !== null, path, file: at.file, key: `path:${resolve(at.file)}`, before: null, after, mode: NEW_FILE_MODE };
+  }
+  const read = readChecked(at.file, o.uid);
+  if (read.refuse) return read.refuse;
+  const next = nextBytes(read.bytes, o, at.file);
+  if (next.refuse) return next.refuse;
+  const changed = !next.bytes.equals(read.bytes);
+  // ino 0 (a file system without file ids) tells nothing apart: then the path as the file system spells it is the
+  // key (realpathSync.native gives one spelling for names that differ only in case where case is ignored).
+  const key = read.id.ino === 0n ? `path:${nativeReal(at.file)}` : `ino:${read.id.dev}:${read.id.ino}`;
+  return { ok: true, changed, path, file: at.file, key, before: read.bytes, after: next.bytes, mode: read.st.mode & 0o7777 };
+}
+
+// Writes data to a fresh temp file beside file and renames it over file.
+function writeAtomic(file, data, mode) {
+  const tmp = join(dirname(file), `.${basename(file)}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`);
+  let fd = openSync(tmp, "wx", mode);
+  try {
+    writeFileSync(fd, data);
+    closeSync(fd);
+    fd = null;
+    if (process.platform !== "win32") chmodSync(tmp, mode);
+    renameSync(tmp, file);
+  } catch (e) {
+    if (fd !== null) closeSync(fd);
+    rmSync(tmp, { force: true });
+    throw e;
+  }
+}
+
+// Keeps the first original: writes <file>.<skill>.bak only when nothing is at that name yet.
+function backup(file, skill, bytes) {
+  const bak = `${file}.${skill}.bak`;
+  if (lstatSync(bak, { throwIfNoEntry: false })) return null;
+  const fd = openSync(bak, "wx", BACKUP_MODE);
+  try {
+    writeFileSync(fd, bytes);
+  } finally {
+    closeSync(fd);
+  }
+  return bak;
+}
+
+/** Writes what planBlock worked out. A plan that changes nothing or was refused is returned as a result. */
+export function commitBlock(plan, skill) {
+  if (!plan.ok) return plan;
+  const result = { ok: true, changed: plan.changed, path: plan.path, file: plan.file };
+  if (!plan.changed) return { ...result, message: `변경 없음: ${plan.path}` };
+  if (plan.before === null && plan.after !== null) {
+    const fd = openSync(plan.file, "wx", plan.mode);
+    try {
+      writeFileSync(fd, plan.after);
+    } finally {
+      closeSync(fd);
+    }
+    return { ...result, created: true, message: `새로 만듦: ${plan.path}` };
+  }
+  const bak = backup(plan.file, skill, plan.before);
+  writeAtomic(plan.file, plan.after, plan.mode);
+  return { ...result, backup: bak, message: `바꿈: ${plan.path}` };
+}
+
+/** Puts in, replaces or (body null) takes out the block in one file. dryRun plans only. */
+export function applyBlock(path, opts) {
+  const plan = planBlock(path, opts);
+  if (opts.dryRun || !plan.ok) return plan;
+  return commitBlock(plan, opts.skill);
+}
+
+/**
+ * Applies blocks to several files, each entry { path, ...opts }. Every file is planned first: one refusal and
+ * none is written. Two entries naming one file (after links are followed) write it once, by the first entry.
+ */
+export function applyBlocks(entries, { dryRun = false } = {}) {
+  const plans = entries.map((e) => ({ entry: e, plan: planBlock(e.path, e) }));
+  const refused = plans.filter((p) => !p.plan.ok).map((p) => p.plan);
+  if (refused.length > 0) return { ok: false, refused, results: plans.map((p) => p.plan) };
+  const seen = new Map();
+  const results = plans.map(({ entry, plan }) => {
+    if (seen.has(plan.key)) return { ok: true, changed: false, path: plan.path, file: plan.file, sameAs: seen.get(plan.key), message: `같은 파일이라 한 번만 씀: ${plan.path}` };
+    seen.set(plan.key, plan.path);
+    return dryRun ? plan : commitBlock(plan, entry.skill);
+  });
+  return { ok: true, refused: [], results };
+}

package/skills/git-init/scripts/payload-scan.mjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+/**
+ * payload-scan: secret-like strings in a file that is about to go to an external CLI seat.
+ *
+ *   node payload-scan.mjs <file>
+ *
+ * Prints {"file", "count", "hits": [{"line", "kind"}]} and exits 0 when nothing was found,
+ * 1 when something was, 2 when the file cannot be read or scanned or the arguments are not one
+ * file. A private key hit also carries `end`, the line of its END marker (null when there is
+ * none): the whole block is the secret, not just the BEGIN line. The matched text itself is never
+ * printed, so the report cannot become the leak. The patterns cover common key and token
+ * formats, private key blocks (PGP too), secret assignments (quoted, or unquoted with letters
+ * and digits), passwords (quoted, with a symbol, alone on a config or env-file line, a KEY=value
+ * word after a space, a quote, `(` or `=` as in `env`, `docker -e`, `--from-literal=`, or after a Dockerfile
+ * `ENV KEY value`; the shell's own PWD or OLDPWD holding a path is no password),
+ * secrets given as command-line flags, curl's user and password flag,
+ * hex keys, Basic and Bearer credentials, credentials in URLs, a .netrc password (on its machine line or on a line
+ * of its own), a .pgpass line, docker's config.json "auth" (base64 of user:password) and
+ * long high-entropy strings (a lockfile's sha512- integrity hash and a Go or Terraform h1: hash
+ * aside); they do not prove a payload clean. A Docker secret file's path after a *_FILE key is
+ * not read as the password it points to, and a value masked as a whole `[REDACTED]` word (the mask
+ * SKILL.md asks for) is no value, so a masked payload scans clean; a mask glued to the rest of a value is not. Every repeat and lookahead is bounded (a run longer than
+ * 65536 characters is read in pieces) or anchored, so a long line takes linear time and cannot
+ * overflow the regex stack.
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const SECRET_KEY = String.raw`(?:api[_-]?key|secret|token|passw(?:or)?d|pwd|access[_-]?key|credential|비밀번호|패스워드)[\w-]{0,64}["']?\s*[:=]\s*`;
+// `pass` and `passphrase` count only as a word of their own (DB_PASS, "pass"), not inside bypass.
+const PASS_WORD = String.raw`(?:passw(?:or)?d|pwd|passcode|(?<![a-z])pass(?:phrase)?(?![a-z]))`;
+// An env-style key that holds a password word, up to its `=`, and a value that is no reference or whole placeholder
+// (`$X`, `<your-password>`, `{{ x }}`, `%(x)s`, `%X%`). A value that only starts with `<` or `{` is still read.
+const ENV_KEY = String.raw`[A-Za-z0-9_]{0,64}(?:passw(?:or)?d|pwd|passcode)[A-Za-z0-9_]{0,64}=(?!-|\$|<[^>\s]{1,64}>|\{\{|%\(|%[A-Za-z_][A-Za-z0-9_]{0,64}%)`;
+const PASSWORD_KEY = String.raw`(?:${PASS_WORD}|비밀번호|패스워드)[\w-]{0,64}["']?\s*[:=]\s*`;
+// An unquoted value that is not code: none of the characters an expression or a reference
+// holds, and at least one symbol (an identifier has none).
+const BARE = String.raw`[^\s;,"'().\[\]{}$<>]`;
+// at most 8 words before PRIVATE KEY (RSA, EC, OPENSSH, ENCRYPTED, PGP): an open nested repeat
+// overflows V8's regex stack on a key marker before millions of words
+const PRIVATE_KEY = String.raw`(?:[A-Z0-9]{1,32} ){0,8}PRIVATE KEY(?: BLOCK)?-----`;
+
+export const PATTERNS = [
+  ["aws-access-key", /(?<![A-Z0-9])(?:AKIA|ASIA)[A-Z0-9]{16}(?![A-Z0-9])/],
+  ["github-token", /(?<![A-Za-z0-9])(?:gh[pousr]_[A-Za-z0-9]{36,65536}|github_pat_[A-Za-z0-9_]{22,65536})/],
+  ["gitlab-token", /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,65536}/],
+  ["anthropic-key", /(?<![A-Za-z0-9])sk-ant-[A-Za-z0-9_-]{20,65536}/],
+  ["openai-key", /(?<![A-Za-z0-9-])sk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,65536}/],
+  ["stripe-key", /(?<![A-Za-z0-9])[rs]k_(?:live|test)_[A-Za-z0-9]{16,65536}/],
+  ["npm-token", /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}/],
+  ["huggingface-token", /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{30,65536}/],
+  ["google-api-key", /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}/],
+  ["slack-token", /(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{10,65536}/],
+  ["slack-webhook", /hooks\.slack\.com\/services\/T[A-Za-z0-9]+\/B[A-Za-z0-9]+\/[A-Za-z0-9]+/],
+  ["private-key", new RegExp(`-----BEGIN ${PRIVATE_KEY}`)],
+  ["jwt", /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,65536}\.eyJ[A-Za-z0-9_-]{10,65536}\.[A-Za-z0-9_-]{10,65536}/],
+  ["bearer-token", /\bbearer\s+[A-Za-z0-9._~+/-]{20,65536}/i],
+  ["basic-auth", /\bauthorization["']?\s*[:=]\s*["']?basic\s+[A-Za-z0-9+/=]{8,65536}/i],
+  ["url-credentials", /[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:@/]{0,256}:[^\s@/]{3,256}@/i],
+  // quoted: 12 characters or more, or 8 to 11 holding a digit (a word like "development" is not one)
+  ["assigned-secret", new RegExp(SECRET_KEY + String.raw`["'](?:[^"'\s]{12,256}|(?=[^"'\s]{0,10}\d)[^"'\s]{8,11})["']`, "i")],
+  ["assigned-secret-bare", new RegExp(SECRET_KEY + String.raw`(?=[^\s"']{0,256}\d)(?=[^\s"']{0,256}[A-Za-z])[^\s"'(\[{]{12,256}`, "i")],
+  ["assigned-password", new RegExp(PASSWORD_KEY + String.raw`(?:["'][^"'\s]{6,256}["']|(?=${BARE}{0,256}[^\w\s;,"'().\[\]{}$<>])${BARE}{6,256})`, "i")],
+  // at the head of a line, or as a word after a space, a quote, `(` or `=` (env, docker -e, --from-literal=, a subshell),
+  // its value ending the word
+  ["env-password", new RegExp(String.raw`^[+\- ]?\s*(?:export\s+)?${ENV_KEY}[^\s"']{6,256}|(?<=[\s"'(=])${ENV_KEY}[^\s"',;()\[\]{}]{6,256}(?=[\s"']|$)`, "i")],
+  // a password alone on a config line: YAML, compose lists, .properties, Dockerfile ENV, diff marks
+  ["config-password", new RegExp(String.raw`^[+\- ]?\s*(?:-\s+|export\s+|ENV\s+)?[\w.-]{0,64}${PASS_WORD}[\w.-]{0,64}["']?\s*[:=]\s*["']?(?![-$<{%])[^\s"',;()\[\]{}]{6,256}["']?\s*(?:#.*)?$`, "i")],
+  // a Dockerfile's legacy `ENV KEY value` form, the value alone after the space
+  ["dockerfile-env-password", new RegExp(String.raw`^[+\- ]?\s*ENV\s+[\w.-]{0,64}${PASS_WORD}[\w.-]{0,64}\s+["']?(?![-$<{%])[^\s"',;()\[\]{}=]{6,256}["']?\s*(?:#.*)?$`, "i")],
+  ["flag-secret", /--(?:password|passwd|pass|token|api-key|apikey|secret|client-secret)(?:=|\s+)(?![-$])[^\s"']{6,256}/i],
+  // curl's -u flag with a user and password pair, glued to it or not; a uid:gid (docker) that is
+  // the whole value, quoted or not, a host:/path (rsync), a date format (date -u +%H:%M) or an id
+  // substitution ($(id -u):$(id -g)) is no credential. A user:group of names is not told apart:
+  // that would let admin:admin through.
+  ["curl-user", /(?<!\S)(?:-u\s*|--user(?:\s+|=))(?!(["']?)\d{1,10}:\d{1,10}\1(?=["'`\s;|&)]|$))(?!["']?\+%|\))[^\s:=]{1,256}:(?!\/)\S{3,256}/],
+  ["assigned-hex", /(?:key|auth|token|secret)[\w-]{0,64}["']?\s*[:=]\s*["']?[0-9a-f]{32,65536}(?![0-9a-z])/i],
+  // .netrc: `machine <host> ... password <value>` on one line, or a `password <value>` line of its own (the file's
+  // other layout, one token pair a line); a value that is a reference or a placeholder is none
+  ["netrc-password", /^[+\- ]?\s*(?:(?:machine\s+\S{1,256}|default)(?:\s+\S{1,256}){0,16}?\s+password\s+(?![$<{%])\S|password\s+(?![$<{%])\S{1,256}\s*$)/],
+  // .pgpass: host:port:database:user:password, the port a number or *, no empty field. The host is not digits alone
+  // and the password holds no colon but an escaped one (\:), so a MAC of digits or a time (12:30:45:00) is no hit.
+  ["pgpass-line", /^[+\- ]?(?=[^\s:#]*[^\d\s:#])[^\s:#+\-][^\s:#]{0,255}:(?:\d{1,5}|\*):[^\s:]{1,256}:[^\s:]{1,256}:(?!\*?$)(?:\\.|[^\s:\\]){1,256}$/],
+  // docker's config.json: "auth" holds base64 of user:password (checked by decoding it, below)
+  ["docker-auth", /"auth"\s*:\s*"[A-Za-z0-9+/]{4,65536}={0,2}"/],
+];
+
+// A kind whose pattern alone reads too wide: the line counts only when this holds as well.
+const DOCKER_AUTH = /"auth"\s*:\s*"([A-Za-z0-9+/]{4,65536}={0,2})"/;
+const CONFIRM = {
+  "docker-auth": (line) => Buffer.from(DOCKER_AUTH.exec(line)[1], "base64").toString("latin1").includes(":"),
+};
+
+// Long runs of base64-like characters whose Shannon entropy is that of random data, as
+// lineage's redaction measures them (32 characters or more, 4.5 bits per character or more).
+const LONG_RUN = /[A-Za-z0-9+/=]{32,65536}/g;
+const ENTROPY_FLOOR = 4.5;
+
+export function entropy(s) {
+  const counts = new Map();
+  for (const c of s) counts.set(c, (counts.get(c) ?? 0) + 1);
+  let bits = 0;
+  for (const n of counts.values()) bits -= (n / s.length) * Math.log2(n / s.length);
+  return bits;
+}
+
+// A subresource-integrity hash (`sha512-<base64>`, as lockfiles hold) and a Go module or
+// Terraform lock hash (`h1:` and 43 base64 characters and `=`, as go.sum and .terraform.lock.hcl
+// hold) are public checksums.
+const SRI_PREFIX = /sha(?:256|384|512)-$/;
+const H1_PREFIX = /(?:^|[^A-Za-z0-9+/=])h1:$/;
+const publicHash = (line, m) => SRI_PREFIX.test(line.slice(Math.max(0, m.index - 7), m.index))
+  || (/^[A-Za-z0-9+/]{43}=$/.test(m[0]) && H1_PREFIX.test(line.slice(Math.max(0, m.index - 4), m.index)));
+const highEntropy = (line) => [...line.matchAll(LONG_RUN)].some((m) => !publicHash(line, m) && entropy(m[0]) >= ENTROPY_FLOOR);
+
+// A *_FILE key's absolute path, the Docker secret file official images take a password from, is
+// not that password: the kinds that read a value after a key name see a `-` there instead. The
+// other kinds still read the line as it is, so a key's own format shows wherever it sits.
+const SECRET_FILE_PATH = /(?<![\w.-])([\w.-]{0,128}_FILE["']?(?:[ \t]*[:=][ \t]*|[ \t]+)["']?)\/[\w.@-]{1,128}(?:\/[\w.@-]{1,128}){0,32}(?=["']?(?:[\s,;#]|$))/gi;
+// The shell's own working folder (PWD, OLDPWD, as `env`, `declare -x` or a JSON dump shows it) holding a plain path:
+// no password, though PWD reads like one. A key that only ends in PWD (MYSQL_PWD) and a value that is no plain path
+// stay. Taken out before the keyed patterns read the line, as lineage does.
+const SHELL_DIR = /(?<=^[+\- ]?|[\s"'$])((?:OLD)?PWD["']?[ \t]*[:=][ \t]*["']?)(?:~|\/|[A-Za-z]:[\\/])[^\s"'!#$%&*;|<>()[\]{}`^?=]{0,4096}(?=["']?(?:[\s,]|$))/g;
+const KEYED = new Set(["assigned-secret", "assigned-secret-bare", "assigned-password", "env-password", "config-password",
+  "dockerfile-env-password"]);
+
+const KEY_END = new RegExp(`-----END ${PRIVATE_KEY}`);
+// The mask SKILL.md asks for, as a word of its own. One glued to the rest of a value is no mask: what is left is read.
+const WHOLE_MASK = /(?<!\w)\[REDACTED\](?!\w)/g;
+
+const caught = (kind, re, plain, keyed) => re.test(KEYED.has(kind) ? keyed : plain) && (!CONFIRM[kind] || CONFIRM[kind](plain));
+
+// Each line's secret-like kinds, once per kind and line. A private key closes at the first END
+// marker at or after its line: the END lines are found once and walked with the lines, so many
+// BEGIN lines without an END still take linear time.
+export function scan(text) {
+  const hits = [];
+  const lines = String(text).split(/\r?\n/);
+  const ends = lines.flatMap((l, i) => (KEY_END.test(l) ? [i + 1] : []));
+  let next = 0;
+  lines.forEach((line, i) => {
+    while (next < ends.length && ends[next] < i + 1) next += 1;
+    const plain = line.replace(WHOLE_MASK, "-");
+    const keyed = plain.replace(SECRET_FILE_PATH, "$1-").replace(SHELL_DIR, "$1-");
+    for (const [kind, re] of PATTERNS) {
+      if (!caught(kind, re, plain, keyed)) continue;
+      hits.push(kind === "private-key" ? { line: i + 1, kind, end: ends[next] ?? null } : { line: i + 1, kind });
+    }
+    if (highEntropy(plain)) hits.push({ line: i + 1, kind: "high-entropy" });
+  });
+  return { count: hits.length, hits };
+}
+
+function main(argv) {
+  if (argv.length !== 1) {
+    process.stderr.write("usage: node payload-scan.mjs <file>  (exactly one file)\n");
+    return 2;
+  }
+  const file = argv[0];
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch (e) {
+    process.stderr.write(`payload-scan: cannot read ${file}: ${e.code ?? e.message}\n`);
+    return 2;
+  }
+  let result;
+  try {
+    result = scan(text);
+  } catch (e) {
+    process.stderr.write(`payload-scan: cannot scan ${file}: ${e.message}\n`);
+    return 2;
+  }
+  process.stdout.write(JSON.stringify({ file, ...result }, null, 2) + "\n");
+  return result.count === 0 ? 0 : 1;
+}
+
+const invokedDirectly = () => {
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+};
+
+if (invokedDirectly()) process.exitCode = main(process.argv.slice(2));