@kenkaiiii/ggcoder-eyes 0.1.0

package/probes/visual/detect.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Emits JSON to stdout describing which visual impls make sense for this project.
+#   { "candidates": ["playwright","adb","simctl","window","godot","unity","generic"], "primary": "<first>" }
+# Multi-stack projects (e.g. React Native) return multiple candidates — install all that apply.
+set -euo pipefail
+
+ROOT="${EYES_PROJECT_ROOT:-$PWD}"
+CANDIDATES=()
+
+add() {
+  case " ${CANDIDATES[*]:-} " in *" $1 "*) return;; esac
+  CANDIDATES+=("$1")
+}
+
+# --- Web ---
+if [ -f "$ROOT/package.json" ]; then
+  if grep -qE '"(next|vite|@sveltejs/kit|astro|remix|nuxt|gatsby|@angular/core|vue|svelte|solid-js|qwik|@builder\.io/qwik|react-dom)"' "$ROOT/package.json" 2>/dev/null; then
+    add playwright
+  fi
+fi
+if [ -f "$ROOT/index.html" ] || [ -f "$ROOT/public/index.html" ] || [ -f "$ROOT/dist/index.html" ]; then
+  add playwright
+fi
+# Rails / Django / Laravel / Phoenix / etc. — any project with server-rendered HTML and a dev server
+if [ -f "$ROOT/Gemfile" ] && grep -q 'rails' "$ROOT/Gemfile" 2>/dev/null; then add playwright; fi
+if [ -f "$ROOT/manage.py" ] || { [ -f "$ROOT/pyproject.toml" ] && grep -qE 'django|flask|fastapi|starlette' "$ROOT/pyproject.toml" 2>/dev/null; }; then add playwright; fi
+if [ -f "$ROOT/artisan" ]; then add playwright; fi
+if [ -f "$ROOT/mix.exs" ] && grep -q 'phoenix' "$ROOT/mix.exs" 2>/dev/null; then add playwright; fi
+
+# --- Mobile ---
+# Android
+if [ -d "$ROOT/android" ] \
+   || [ -f "$ROOT/AndroidManifest.xml" ] \
+   || find "$ROOT" -maxdepth 3 -name "AndroidManifest.xml" 2>/dev/null | head -1 | grep -q . \
+   || { find "$ROOT" -maxdepth 3 -name "build.gradle*" 2>/dev/null | xargs grep -l 'com.android' 2>/dev/null | head -1 | grep -q .; }; then
+  add adb
+fi
+# iOS
+if [ -d "$ROOT/ios" ] \
+   || find "$ROOT" -maxdepth 2 -name "*.xcodeproj" 2>/dev/null | head -1 | grep -q . \
+   || find "$ROOT" -maxdepth 2 -name "*.xcworkspace" 2>/dev/null | head -1 | grep -q . \
+   || [ -f "$ROOT/Podfile" ]; then
+  add simctl
+fi
+# Flutter — has both ios/ and android/ dirs under project root; already covered.
+
+# --- Desktop ---
+if [ -f "$ROOT/src-tauri/tauri.conf.json" ] \
+   || { [ -f "$ROOT/package.json" ] && grep -qE '"(electron|@electron/|nwjs|neutralinojs)"' "$ROOT/package.json" 2>/dev/null; }; then
+  add window
+fi
+# GTK / Qt / wxWidgets
+if find "$ROOT" -maxdepth 2 -name "*.pro" -o -name "CMakeLists.txt" 2>/dev/null | xargs grep -l 'Qt\|gtk\|wx' 2>/dev/null | head -1 | grep -q .; then
+  add window
+fi
+
+# --- Games ---
+[ -f "$ROOT/project.godot" ] && add godot
+if [ -d "$ROOT/Assets" ] && [ -d "$ROOT/ProjectSettings" ]; then add unity; fi
+# Unreal
+if find "$ROOT" -maxdepth 2 -name "*.uproject" 2>/dev/null | head -1 | grep -q .; then add unreal; fi
+# LÖVE / Pygame / Bevy / custom — fall through to window capture
+if [ -f "$ROOT/main.lua" ] || { [ -f "$ROOT/Cargo.toml" ] && grep -q 'bevy' "$ROOT/Cargo.toml" 2>/dev/null; }; then
+  add window
+fi
+
+# --- Fallback ---
+if [ ${#CANDIDATES[@]} -eq 0 ]; then add generic; fi
+
+# --- Emit JSON ---
+printf '{"candidates":['
+first=1
+for c in "${CANDIDATES[@]}"; do
+  [ $first -eq 0 ] && printf ','
+  printf '"%s"' "$c"
+  first=0
+done
+printf '],"primary":"%s"}\n' "${CANDIDATES[0]}"

package/probes/visual/impl/adb.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# impl: adb
+# Android screenshot — works for native Android, React Native, Flutter, Capacitor,
+# any project that lands on an Android device/emulator.
+#
+# Usage:
+#   visual-android.sh [device-serial]
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/_lib.sh"
+
+eyes_require adb
+
+DEVICE="${1:-}"
+ARGS=()
+[ -n "$DEVICE" ] && ARGS+=(-s "$DEVICE")
+
+# Fail clearly if no device
+if ! adb "${ARGS[@]}" get-state >/dev/null 2>&1; then
+  eyes_die "no android device/emulator available. run 'adb devices' to list; start an emulator or connect a device."
+fi
+
+OUT="$(eyes_out_dir)/screenshot-android-$(eyes_timestamp).png"
+# exec-out pipes binary PNG cleanly (no CRLF translation on Windows)
+eyes_timeout 15 adb "${ARGS[@]}" exec-out screencap -p > "$OUT" \
+  || eyes_die "adb screencap failed"
+[ -s "$OUT" ] || eyes_die "screenshot empty"
+echo "$OUT"

package/probes/visual/impl/generic.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# impl: generic
+# No-op for projects with no user-visible UI (libraries, pure backends, CLIs).
+# Exits non-zero to make it loud if an agent installs this and then tries to use it.
+echo "visual: this project has no visible UI to capture (library / backend / CLI)." >&2
+echo "Consider: http (API probe), cli_io (CLI probe), runtime_logs, test, or build." >&2
+exit 2

package/probes/visual/impl/playwright.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# impl: playwright
+# Screenshot any URL. Works for any web framework (Next/Vite/Rails/Django/etc.) —
+# it only needs an HTTP server.
+#
+# Usage:
+#   visual.sh <url> [viewport WxH] [--selector <css>] [--wait-for-selector <css>] [--full-page|--viewport-only]
+#
+# Prints the absolute PNG path to stdout.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/_lib.sh"
+
+URL="${1:-}"
+[ -z "$URL" ] && eyes_die "usage: visual.sh <url> [WxH] [--selector css] [--wait-for-selector css] [--full-page|--viewport-only]"
+shift
+
+VIEWPORT="1280,800"
+FULLPAGE="--full-page"
+SELECTOR=""
+WAIT_SELECTOR=""
+
+# Accept either WxH or W,H as second positional arg
+if [ "$#" -gt 0 ] && [[ "$1" =~ ^[0-9]+[x,][0-9]+$ ]]; then
+  VIEWPORT="${1/x/,}"
+  shift
+fi
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --selector) SELECTOR="$2"; shift 2;;
+    --wait-for-selector) WAIT_SELECTOR="$2"; shift 2;;
+    --full-page) FULLPAGE="--full-page"; shift;;
+    --viewport-only) FULLPAGE=""; shift;;
+    *) eyes_die "unknown arg: $1";;
+  esac
+done
+
+eyes_require npx
+
+OUT="$(eyes_out_dir)/screenshot-$(eyes_timestamp).png"
+ARGS=(playwright screenshot --browser=chromium --viewport-size="$VIEWPORT" --wait-for-timeout=1500)
+[ -n "$FULLPAGE" ] && ARGS+=("$FULLPAGE")
+[ -n "$WAIT_SELECTOR" ] && ARGS+=(--wait-for-selector "$WAIT_SELECTOR")
+
+# --selector limits to one element
+if [ -n "$SELECTOR" ]; then
+  # Playwright CLI doesn't take a CSS selector for element-only screenshots,
+  # so when --selector is used we fall back to a tiny node script.
+  eyes_timeout 45 npx --yes -p playwright@latest node -e '
+    const { chromium } = require("playwright");
+    const [,, url, viewport, selector, out] = process.argv;
+    const [w, h] = viewport.split(",").map(Number);
+    (async () => {
+      const b = await chromium.launch();
+      const ctx = await b.newContext({ viewport: { width: w, height: h } });
+      const p = await ctx.newPage();
+      await p.goto(url, { waitUntil: "networkidle", timeout: 20000 });
+      const el = await p.waitForSelector(selector, { timeout: 15000 });
+      await el.screenshot({ path: out });
+      await b.close();
+    })().catch(e => { console.error(e.message); process.exit(1); });
+  ' "$URL" "$VIEWPORT" "$SELECTOR" "$OUT" >&2 || eyes_die "playwright element screenshot failed"
+else
+  eyes_timeout 45 npx --yes -p playwright@latest playwright "${ARGS[@]}" "$URL" "$OUT" >&2 \
+    || eyes_die "playwright screenshot failed (is the server running at $URL?)"
+fi
+
+[ -s "$OUT" ] || eyes_die "screenshot empty: $OUT"
+echo "$OUT"

package/probes/visual/impl/simctl.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# impl: simctl
+# iOS Simulator screenshot — works for native iOS, React Native, Flutter,
+# Capacitor, any project that lands on an iOS simulator.
+#
+# Usage:
+#   visual-ios.sh [device-udid]
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/_lib.sh"
+
+eyes_require xcrun
+
+DEVICE="${1:-booted}"
+
+# Verify the target exists and is booted
+if [ "$DEVICE" = "booted" ]; then
+  xcrun simctl list devices booted 2>/dev/null | grep -q Booted \
+    || eyes_die "no iOS simulator booted. boot one: 'xcrun simctl boot <udid>' or open Simulator.app"
+else
+  xcrun simctl list devices 2>/dev/null | grep -q "$DEVICE" \
+    || eyes_die "simulator not found: $DEVICE"
+fi
+
+OUT="$(eyes_out_dir)/screenshot-ios-$(eyes_timestamp).png"
+eyes_timeout 15 xcrun simctl io "$DEVICE" screenshot "$OUT" >&2 \
+  || eyes_die "simctl screenshot failed"
+[ -s "$OUT" ] || eyes_die "screenshot empty"
+echo "$OUT"

package/probes/visual/impl/window.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# impl: window
+# Desktop window/screen capture — Tauri, Electron, native Qt/GTK, games running
+# in a window. macOS uses screencapture; Linux dispatches to grim (Wayland),
+# scrot (X11), or ImageMagick's import.
+#
+# Usage:
+#   visual-window.sh [--app <bundle-or-name>]   (macOS only: captures the named app's frontmost window)
+#   visual-window.sh                            (captures the frontmost window / full screen as fallback)
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/_lib.sh"
+
+APP=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --app) APP="$2"; shift 2;;
+    *) eyes_die "unknown arg: $1";;
+  esac
+done
+
+OUT="$(eyes_out_dir)/screenshot-window-$(eyes_timestamp).png"
+
+case "$(eyes_os)" in
+  darwin)
+    eyes_require screencapture
+    if [ -n "$APP" ]; then
+      # Get windowid for the named app's frontmost window via AppleScript.
+      WID="$(osascript -e "tell application \"System Events\" to tell (first process whose name is \"$APP\" or bundle identifier is \"$APP\") to id of front window" 2>/dev/null || true)"
+      if [ -n "$WID" ]; then
+        screencapture -o -x -l "$WID" "$OUT" >/dev/null 2>&1 || eyes_die "screencapture of window $WID failed"
+      else
+        eyes_die "could not find frontmost window of app: $APP"
+      fi
+    else
+      # Frontmost window of whichever app is active.
+      screencapture -o -x -w "$OUT" >/dev/null 2>&1 \
+        || screencapture -o -x "$OUT" >/dev/null 2>&1 \
+        || eyes_die "screencapture failed"
+    fi
+    ;;
+  linux)
+    if [ -n "${WAYLAND_DISPLAY:-}" ] && command -v grim >/dev/null 2>&1; then
+      grim "$OUT" || eyes_die "grim failed"
+    elif command -v scrot >/dev/null 2>&1; then
+      scrot -u "$OUT" 2>/dev/null || scrot "$OUT" || eyes_die "scrot failed"
+    elif command -v import >/dev/null 2>&1; then
+      import -window root "$OUT" || eyes_die "import failed"
+    else
+      eyes_die "no screen-capture tool found (tried: grim, scrot, import)"
+    fi
+    ;;
+  *)
+    eyes_die "window capture not implemented for $(eyes_os)"
+    ;;
+esac
+
+[ -s "$OUT" ] || eyes_die "screenshot empty: $OUT"
+echo "$OUT"

package/probes/visual/install.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# install.sh <impl> [--as <name>]
+# Installs deps for <impl>, copies impl/<impl>.sh into .gg/eyes/<name>.sh (default "visual").
+# Multi-impl projects install once per impl with distinct --as names,
+# e.g. visual-ios / visual-android.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$HERE/../../shared/_lib.sh"
+
+IMPL="${1:-}"
+[ -z "$IMPL" ] && eyes_die "usage: install.sh <impl> [--as <name>]"
+shift
+
+NAME="visual"
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --as) NAME="$2"; shift 2;;
+    *) eyes_die "unknown arg: $1";;
+  esac
+done
+
+IMPL_FILE="$HERE/impl/$IMPL.sh"
+if [ ! -f "$IMPL_FILE" ]; then
+  echo "no impl '$IMPL'. available:" >&2
+  ls "$HERE/impl/" | sed 's/\.sh$//' | sed 's/^/  - /' >&2
+  exit 1
+fi
+
+# Per-impl dep install
+case "$IMPL" in
+  playwright)
+    eyes_require npx
+    eyes_require node
+    # Browser install is the big/slow part. 5min budget.
+    echo "installing chromium for playwright..." >&2
+    eyes_timeout 300 npx --yes -p playwright@latest playwright install chromium --with-deps 2>&1 \
+      | tail -20 >&2 \
+      || eyes_die "playwright install failed"
+    ;;
+  adb)
+    eyes_require adb
+    adb devices | tail -n +2 | grep -q device \
+      || echo "warning: no android device/emulator currently connected (adb devices is empty). probe will fail until one is." >&2
+    ;;
+  simctl)
+    [ "$(eyes_os)" = "darwin" ] || eyes_die "simctl only works on macOS (iOS simulator requires Xcode)"
+    eyes_require xcrun
+    xcrun simctl list devices booted 2>/dev/null | grep -q Booted \
+      || echo "warning: no iOS simulator currently booted. probe will fail until one is." >&2
+    ;;
+  window)
+    case "$(eyes_os)" in
+      darwin) eyes_require screencapture;;
+      linux)
+        if ! command -v grim >/dev/null 2>&1 \
+           && ! command -v scrot >/dev/null 2>&1 \
+           && ! command -v import >/dev/null 2>&1; then
+          eyes_die "need one of: grim (wayland), scrot (x11), or import (imagemagick)"
+        fi
+        ;;
+      *) eyes_die "window capture not supported on $(eyes_os)";;
+    esac
+    ;;
+  godot)
+    command -v godot >/dev/null 2>&1 \
+      || echo "warning: godot not on PATH. install Godot and ensure 'godot' is callable." >&2
+    ;;
+  unity|unreal)
+    echo "note: $IMPL headless capture requires an editor CLI. probe is best-effort; see script comments." >&2
+    ;;
+  generic)
+    : ;;
+  *)
+    eyes_die "unknown impl: $IMPL"
+    ;;
+esac
+
+DEST="$(eyes_root)/$NAME.sh"
+mkdir -p "$(dirname "$DEST")"
+cp "$IMPL_FILE" "$DEST"
+chmod +x "$DEST"
+cp "$HERE/../../shared/_lib.sh" "$(eyes_root)/_lib.sh"
+cp "$HERE/../../shared/_redact.sh" "$(eyes_root)/_redact.sh"
+chmod +x "$(eyes_root)/_redact.sh"
+
+echo "installed: $DEST (impl=$IMPL)" >&2

package/probes/visual/test.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# test.sh [name]
+# End-to-end self-test: invoke the installed probe against a real target, verify
+# the artifact is a non-empty PNG. For impls with no always-available target
+# (adb, simctl), degrade to "can the tool talk to a device?" — still real, just
+# less coverage.
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$HERE/../../shared/_lib.sh"
+
+NAME="${1:-visual}"
+PROBE="$(eyes_root)/$NAME.sh"
+[ -x "$PROBE" ] || eyes_die "probe not installed: $PROBE"
+
+# Infer impl from the first-line comment or script contents
+IMPL_HINT="$(grep -m1 '^# impl:' "$PROBE" | awk '{print $3}' || true)"
+[ -z "$IMPL_HINT" ] && IMPL_HINT="$(basename "$PROBE" .sh)"
+
+case "$IMPL_HINT" in
+  playwright|visual)
+    # Spin up a temp static server on a free port, screenshot it.
+    PORT="$(eyes_free_port)"
+    TMPDIR="$(mktemp -d)"
+    trap 'rm -rf "$TMPDIR"; [ -n "${SRV_PID:-}" ] && kill "$SRV_PID" 2>/dev/null || true' EXIT
+    cat > "$TMPDIR/index.html" <<'HTML'
+<!doctype html><html><head><title>eyes-test</title></head>
+<body style="background:#222;color:#0f0;font:48px monospace;padding:2em">
+  EYES PROBE OK
+</body></html>
+HTML
+    ( cd "$TMPDIR" && python3 -m http.server "$PORT" >/dev/null 2>&1 ) & SRV_PID=$!
+    # Wait for server
+    for _ in 1 2 3 4 5 6 7 8 9 10; do
+      curl -sf "http://127.0.0.1:$PORT/" >/dev/null 2>&1 && break
+      sleep 0.3
+    done
+    OUT="$("$PROBE" "http://127.0.0.1:$PORT/")"
+    [ -f "$OUT" ] && [ -s "$OUT" ] || eyes_die "probe produced no artifact: $OUT"
+    echo "ok: $OUT"
+    ;;
+  adb)
+    adb devices | tail -n +2 | grep -q device || eyes_die "no android device connected; skipping e2e — install succeeded but cannot verify"
+    OUT="$("$PROBE")"
+    [ -s "$OUT" ] || eyes_die "adb probe produced empty artifact"
+    echo "ok: $OUT"
+    ;;
+  simctl)
+    xcrun simctl list devices booted 2>/dev/null | grep -q Booted || eyes_die "no iOS simulator booted; cannot verify"
+    OUT="$("$PROBE")"
+    [ -s "$OUT" ] || eyes_die "simctl probe produced empty artifact"
+    echo "ok: $OUT"
+    ;;
+  window|godot|unity|unreal|generic)
+    # Best-effort: just run the probe; 'generic' exits non-zero by design.
+    set +e
+    OUT="$("$PROBE" 2>&1)"; rc=$?
+    set -e
+    if [ "$IMPL_HINT" = "generic" ]; then
+      [ "$rc" -ne 0 ] || eyes_die "generic probe should exit non-zero"
+      echo "ok (generic: no-op)"
+    else
+      [ "$rc" -eq 0 ] || eyes_die "probe failed: $OUT"
+      echo "ok: $OUT"
+    fi
+    ;;
+  *)
+    eyes_die "unknown impl hint: $IMPL_HINT"
+    ;;
+esac

package/shared/_lib.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# _lib.sh — shared helpers for all probes.
+# Probes source this AFTER being copied into .gg/eyes/ as .gg/eyes/_lib.sh.
+# Usage at top of probe:
+#   SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+#   source "$SCRIPT_DIR/_lib.sh"
+
+eyes_project_root() {
+  if [ -n "${EYES_PROJECT_ROOT:-}" ]; then echo "$EYES_PROJECT_ROOT"; return; fi
+  local d="$PWD"
+  while [ "$d" != "/" ]; do
+    if [ -d "$d/.gg" ]; then echo "$d"; return; fi
+    d="$(dirname "$d")"
+  done
+  echo "$PWD"
+}
+
+eyes_root()      { echo "$(eyes_project_root)/.gg/eyes"; }
+eyes_out_dir()   { local d; d="$(eyes_root)/out";   mkdir -p "$d"; echo "$d"; }
+eyes_state_dir() { local d; d="$(eyes_root)/state"; mkdir -p "$d"; echo "$d"; }
+eyes_bin_dir()   { local d; d="$(eyes_root)/bin";   mkdir -p "$d"; echo "$d"; }
+
+eyes_timestamp() { date -u +"%Y%m%dT%H%M%SZ"; }
+
+eyes_die() {
+  printf 'eyes: %s\n' "$*" >&2
+  exit 1
+}
+
+eyes_require() {
+  command -v "$1" >/dev/null 2>&1 || eyes_die "missing required command: $1"
+}
+
+eyes_os() {
+  case "$(uname -s)" in
+    Darwin) echo "darwin";;
+    Linux)  echo "linux";;
+    MINGW*|MSYS*|CYGWIN*) echo "windows";;
+    *) echo "unknown";;
+  esac
+}
+
+eyes_arch() {
+  case "$(uname -m)" in
+    x86_64|amd64) echo "amd64";;
+    arm64|aarch64) echo "arm64";;
+    *) echo "unknown";;
+  esac
+}
+
+eyes_free_port() {
+  python3 -c 'import socket; s=socket.socket(); s.bind(("",0)); print(s.getsockname()[1]); s.close()' 2>/dev/null \
+    || node -e 'const s=require("net").createServer(); s.listen(0,()=>{console.log(s.address().port); s.close();})' 2>/dev/null \
+    || eyes_die "need python3 or node to pick a free port"
+}
+
+eyes_state_get() {
+  local f; f="$(eyes_state_dir)/$1"
+  if [ -f "$f" ]; then cat "$f"; else echo ""; fi
+}
+
+eyes_state_set() {
+  local f; f="$(eyes_state_dir)/$1"
+  printf '%s' "$2" > "$f"
+}
+
+eyes_redact() {
+  # Pipe through: cmd | eyes_redact > out
+  local r; r="$(eyes_root)/_redact.sh"
+  if [ -x "$r" ]; then "$r"; else cat; fi
+}
+
+# With-timeout wrapper that works on macOS (no `timeout` by default) and Linux.
+eyes_timeout() {
+  local secs="$1"; shift
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$secs" "$@"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout "$secs" "$@"
+  else
+    # Fallback: run in background, kill after secs
+    ( "$@" ) & local pid=$!
+    ( sleep "$secs" && kill -TERM "$pid" 2>/dev/null ) & local killer=$!
+    wait "$pid" 2>/dev/null; local rc=$?
+    kill -TERM "$killer" 2>/dev/null || true
+    return $rc
+  fi
+}

package/shared/_redact.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# _redact.sh — stdin → stdout, strip obvious secrets from text artifacts.
+# Caveat: does nothing for binary artifacts (screenshots, PDFs, audio). Image
+# redaction of auth'd UIs is a gap the probe author must handle at capture time
+# (e.g. Playwright --mask selectors).
+set -eu
+
+exec perl -pe '
+  # JWTs
+  s/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/[REDACTED_JWT]/g;
+
+  # Provider-specific API keys
+  s/\b(sk-ant-api\d+-[A-Za-z0-9_-]+)/[REDACTED_ANTHROPIC]/g;
+  s/\b(sk-proj-[A-Za-z0-9_-]+)/[REDACTED_OPENAI]/g;
+  s/\b(sk-[A-Za-z0-9]{32,})/[REDACTED_OPENAI]/g;
+  s/\b(gh[pousr]_[A-Za-z0-9]{30,})/[REDACTED_GITHUB]/g;
+  s/\b(AKIA[0-9A-Z]{16})/[REDACTED_AWS]/g;
+  s/\b(xox[abpors]-[A-Za-z0-9-]{10,})/[REDACTED_SLACK]/g;
+
+  # Bearer / Basic tokens in headers
+  s/(?i)(authorization\s*:\s*bearer\s+)[A-Za-z0-9_.\-]+/$1[REDACTED]/g;
+  s/(?i)(authorization\s*:\s*basic\s+)[A-Za-z0-9+\/=]+/$1[REDACTED]/g;
+
+  # Env-style assignments for anything whose name looks secret-y
+  s/(\w*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|PRIVATE)\w*)\s*[=:]\s*[^\s;,&"\x27]+/$1=[REDACTED]/gi;
+
+  # Cookie: whole value
+  s/(?i)(cookie\s*:\s*)[^\r\n]+/$1[REDACTED_COOKIE]/g;
+'