@pipemd-core/pipemd 1.0.0

package/scripts/C-CPP/project/cmake-targets.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# CMake target metadata — executables, libraries, and link dependencies
+source "$(dirname "$0")/../lib/limit.sh"
+
+if ! command -v python3 &>/dev/null; then
+  echo "python3 is required for CMake parsing"
+  exit 0
+fi
+
+out=""
+tmpfile=$(mktemp)
+
+find . -name "CMakeLists.txt" \
+  -not -path "*/build/*" -not -path "*/.git/*" \
+  -not -path "*/cmake-build-*/*" -not -path "*/_deps/*" \
+  2>/dev/null | head -20 | while IFS= read -r cmake_file; do
+  rel="${cmake_file#./}"
+  dir="$(dirname "$rel")"
+  [ "$dir" = "." ] && dir="(root)"
+
+  PMDFILE="$cmake_file" PMDDIR="$dir" python3 -c '
+import sys, re, os
+
+cmake_file = os.environ.get("PMDFILE", "")
+dir_label = os.environ.get("PMDDIR", "")
+
+try:
+    with open(cmake_file, "r", errors="replace") as f:
+        content = f.read()
+except Exception:
+    sys.exit(0)
+
+content = re.sub(r"#.*", "", content)
+content = content.replace("\\\n", " ")
+content = re.sub(r"\s+", " ", content)
+
+targets = []
+links = []
+
+for m in re.finditer(r"add_executable\s*\(\s*([A-Za-z_]\w*)", content):
+    targets.append(f"exe:{m.group(1)}")
+
+for m in re.finditer(r"add_library\s*\(\s*([A-Za-z_]\w*)\s+(STATIC|SHARED|MODULE|OBJECT|INTERFACE)", content):
+    targets.append(f"lib:{m.group(1)}({m.group(2)})")
+
+for m in re.finditer(r"target_link_libraries\s*\(\s*([A-Za-z_]\w*)\s+(PUBLIC|PRIVATE|INTERFACE)\s+(.*?)\)", content):
+    links.append(f"{m.group(1)} <- {m.group(2)}: {m.group(3).strip()}")
+
+if not targets and not links:
+    sys.exit(0)
+
+print(f"[dir] {dir_label}")
+for t in targets:
+    print(f"  + {t}")
+for l in links:
+    print(f"  - {l}")
+' >> "$tmpfile" 2>/dev/null
+done
+
+out=$(cat "$tmpfile")
+rm -f "$tmpfile"
+
+if [ -z "$out" ]; then
+  echo "No CMake targets found"
+  exit 0
+fi
+limit_output "$out" "$MAX_CMAKE" "$(echo "$out" | head -10 && echo "... and more CMake targets")"

package/scripts/C-CPP/project/deps.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# C/C++ dependency detection — Makefile, CMake, Conan, vcpkg
+source "$(dirname "$0")/../lib/limit.sh"
+
+if [ -f CMakeLists.txt ]; then
+  out=$(grep -E '^\s*find_package|^\s*FetchContent_Declare|^\s*target_link_libraries' CMakeLists.txt 2>/dev/null | head -"$MAX_DEPS")
+  if [ -n "$out" ]; then
+    echo "CMake dependencies:"
+    echo "$out"
+    exit 0
+  fi
+fi
+
+if [ -f Makefile ] || [ -f makefile ]; then
+  makefile="${makefile:-Makefile}"
+  [ -f makefile ] && makefile="makefile"
+  out=$(grep -E '^\s*(include|require|load|use)' "$makefile" 2>/dev/null | head -"$MAX_DEPS")
+  if [ -n "$out" ]; then
+    echo "Makefile dependencies:"
+    echo "$out"
+    exit 0
+  fi
+fi
+
+if [ -f conanfile.txt ]; then
+  out=$(grep -E '^\s*[a-zA-Z]' conanfile.txt 2>/dev/null | head -"$MAX_DEPS")
+  if [ -n "$out" ]; then
+    echo "Conan dependencies:"
+    echo "$out"
+    exit 0
+  fi
+fi
+
+if [ -f vcpkg.json ]; then
+  out=$(node -e "try{const p=require('./vcpkg.json');console.log((p.dependencies||[]).join('\n'))}catch{}" 2>/dev/null)
+  if [ -n "$out" ]; then
+    echo "vcpkg dependencies:"
+    echo "$out"
+    exit 0
+  fi
+fi
+
+echo "No recognized C/C++ dependency file found"

package/scripts/C-CPP/project/find-todos.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# Find TODO, FIXME, HACK in C/C++ source files
+source "$(dirname "$0")/../lib/limit.sh"
+out=$(grep -rn --include="*.c" --include="*.cpp" --include="*.cc" --include="*.cxx" --include="*.h" --include="*.hpp" --include="*.hxx" 'TODO\|FIXME\|HACK' . 2>/dev/null | grep -v '/.git/' | grep -v '/.pipemd/' | grep -v '/build/' | grep -v '/cmake-build-' | grep -v '/_deps/')
+limit_output "$out" "$MAX_TODOS" "$(echo "$out" | head -3 && echo "... and $(($(echo "$out" | wc -l) - 3)) more items")"

package/scripts/C-CPP/project/include-graph.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# Include graph — external and standard library header dependencies
+source "$(dirname "$0")/../lib/limit.sh"
+
+if ! command -v python3 &>/dev/null; then
+  echo "python3 is required for C++ include graph extraction"
+  exit 0
+fi
+
+SOURCES=$(find . -type f \( -name "*.cpp" -o -name "*.cc" -o -name "*.cxx" -o -name "*.h" -o -name "*.hpp" -o -name "*.hxx" \) \
+  -not -path "*/build/*" -not -path "*/.git/*" -not -path "*/cmake-build-*/*" \
+  -not -path "*/_deps/*" -not -path "*/third_party/*" -not -path "*/external/*" \
+  2>/dev/null | head -50)
+
+if [ -z "$SOURCES" ]; then
+  echo "No C/C++ source files found"
+  exit 0
+fi
+
+echo "$SOURCES" | PMDMAX="${MAX_INCLUDE:-20}" python3 -c "
+import sys, os, re
+from collections import defaultdict
+
+MAX = int(os.environ.get('PMDMAX', '20'))
+
+STANDARD_HEADERS = {
+    'algorithm', 'array', 'atomic', 'bitset', 'cassert', 'ccomplex',
+    'cctype', 'cerrno', 'cfenv', 'cfloat', 'chrono', 'cinttypes',
+    'ciso646', 'climits', 'clocale', 'cmath', 'codecvt', 'compare',
+    'complex', 'concepts', 'condition_variable', 'coroutine', 'csetjmp',
+    'csignal', 'cstdalign', 'cstdarg', 'cstdbool', 'cstddef', 'cstdint',
+    'cstdio', 'cstdlib', 'cstring', 'ctgmath', 'ctime', 'cuchar',
+    'cwchar', 'cwctype', 'deque', 'exception', 'execution', 'filesystem',
+    'format', 'forward_list', 'fstream', 'functional', 'future',
+    'initializer_list', 'iomanip', 'ios', 'iosfwd', 'iostream',
+    'istream', 'iterator', 'limits', 'list', 'locale', 'map', 'memory',
+    'memory_resource', 'mutex', 'new', 'numbers', 'numeric', 'optional',
+    'ostream', 'queue', 'random', 'ranges', 'ratio', 'regex', 'scoped_allocator',
+    'set', 'shared_mutex', 'span', 'sstream', 'stack', 'stdexcept',
+    'streambuf', 'string', 'string_view', 'syncstream', 'system_error',
+    'thread', 'tuple', 'type_traits', 'typeindex', 'typeinfo', 'unordered_map',
+    'unordered_set', 'utility', 'valarray', 'variant', 'vector', 'version',
+}
+
+KNOWN_LIBS = {'boost', 'gtest', 'gmock', 'fmt', 'spdlog', 'nlohmann', 'openssl', 'curl', 'zlib', 'pthread', 'dlfcn'}
+
+ext_re = re.compile(r'^\s*#\s*include\s*<([^>]+)>', re.MULTILINE)
+local_re = re.compile(r'^\s*#\s*include\s*\x22([^\x22]+)\x22', re.MULTILINE)
+
+ext_count = defaultdict(int)
+ext_includes = defaultdict(set)
+std_count = defaultdict(int)
+local_includes = defaultdict(set)
+
+for line in sys.stdin:
+    hdr = line.strip()
+    if not hdr or not os.path.isfile(hdr):
+        continue
+    try:
+        with open(hdr, 'r', errors='replace') as f:
+            content = f.read()
+    except Exception:
+        continue
+
+    basename = os.path.basename(hdr)
+
+    for m in ext_re.finditer(content):
+        header = m.group(1)
+        first_part = header.split('/')[0] if '/' in header else header
+        if header in STANDARD_HEADERS:
+            std_count[header] += 1
+        elif first_part in KNOWN_LIBS:
+            ext_count[first_part] += 1
+            ext_includes[first_part].add(header)
+        else:
+            ext_count[header] += 1
+            ext_includes[header].add(header)
+
+    for m in local_re.finditer(content):
+        inc = m.group(1)
+        local_includes[basename].add(inc)
+
+lines = []
+if std_count:
+    lines.append('Standard Library:')
+    for h in sorted(std_count, key=lambda x: -std_count[x])[:MAX]:
+        lines.append(f'  <{h}> ({std_count[h]} files)')
+
+if ext_count:
+    lines.append('')
+    lines.append('External Dependencies:')
+    for h in sorted(ext_count, key=lambda x: -ext_count[x])[:MAX]:
+        headers = ', '.join(sorted(ext_includes[h])[:3])
+        if len(ext_includes[h]) > 3:
+            headers += f' (+{len(ext_includes[h])-3} more)'
+        lines.append(f'  {h} ({ext_count[h]} refs): {headers}')
+
+if local_includes:
+    lines.append('')
+    lines.append('Internal Includes:')
+    sorted_local = sorted(local_includes.items(), key=lambda x: -len(x[1]))[:MAX]
+    for f, incs in sorted_local:
+        lines.append(f'  {f} -> {len(incs)} headers')
+
+if not std_count and not ext_count and not local_includes:
+    print('No includes found')
+else:
+    print('\n'.join(lines))
+"

package/scripts/C-CPP/project/interfaces.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# C++ interface extraction — pure virtual function signatures
+source "$(dirname "$0")/../lib/limit.sh"
+
+if ! command -v python3 &>/dev/null; then
+  echo "python3 is required for C++ interface extraction"
+  exit 0
+fi
+
+HEADERS=$(find . -type f \( -name "*.h" -o -name "*.hpp" -o -name "*.hxx" \) \
+  -not -path "*/build/*" -not -path "*/.git/*" -not -path "*/cmake-build-*/*" \
+  -not -path "*/_deps/*" -not -path "*/third_party/*" -not -path "*/external/*" \
+  2>/dev/null | head -30)
+
+if [ -z "$HEADERS" ]; then
+  echo "No C++ headers found"
+  exit 0
+fi
+
+echo "$HEADERS" | PMDMAX="${MAX_INTERFACE:-15}" python3 -c "
+import sys, os, re
+
+MAX = int(os.environ.get('PMDMAX', '15'))
+
+headers = []
+for line in sys.stdin:
+    line = line.strip()
+    if line and os.path.isfile(line):
+        headers.append(line)
+
+if not headers:
+    print('No C++ headers found')
+    sys.exit(0)
+
+iface_blocks = []
+class_re = re.compile(r'^\s*(?:class|struct)\s+([A-Za-z_]\w*)\s*(?::\s*(?:public|protected|private)\s+([A-Za-z_]\w*))?\s*\{', re.MULTILINE)
+virt_re = re.compile(r'virtual\s+([\w:]+(?:\s*<[^>]+>)?(?:\s*[*&])?)\s+(\w+)\s*\(([^)]*)\)\s*(const)?\s*=\s*0\s*;')
+
+for hdr in headers:
+    try:
+        with open(hdr, 'r', errors='replace') as f:
+            content = f.read()
+    except Exception:
+        continue
+
+    content = re.sub(r'//.*', '', content)
+    content = re.sub(r'/\*.*?\*/', '', content, flags=re.DOTALL)
+
+    pos = 0
+    while pos < len(content):
+        m = class_re.search(content, pos)
+        if not m:
+            break
+        cls_name = m.group(1)
+        start = m.end()
+        depth = 1
+        end = start
+        while end < len(content) and depth > 0:
+            if content[end] == '{':
+                depth += 1
+            elif content[end] == '}':
+                depth -= 1
+            end += 1
+
+        body = content[start:end]
+        found_methods = []
+        for vm in virt_re.finditer(body):
+            ret_type = vm.group(1).strip()
+            method_name = vm.group(2).strip()
+            params = vm.group(3).strip()
+            is_const = vm.group(4) is not None
+            if params:
+                params = re.sub(r'\s+', ' ', params)
+                param_types = []
+                for p in params.split(','):
+                    p = p.strip()
+                    if p:
+                        parts = p.rsplit(None, 1)
+                        if len(parts) == 2:
+                            param_types.append(parts[0])
+                        else:
+                            param_types.append(p)
+                param_str = ', '.join(param_types)
+                suffix = ' const' if is_const else ''
+                sig = f'{method_name}({param_str}){suffix} -> {ret_type}'
+            else:
+                suffix = ' const' if is_const else ''
+                sig = f'{method_name}(){suffix} -> {ret_type}'
+            found_methods.append(sig)
+
+        if found_methods:
+            iface_blocks.append((os.path.basename(hdr), cls_name, found_methods))
+        pos = end
+
+if not iface_blocks:
+    print('No pure virtual interfaces found')
+    sys.exit(0)
+
+count = 0
+for hdr, cls, methods in iface_blocks:
+    if count >= MAX:
+        break
+    print(f'[iface] {cls} ({hdr})')
+    for m in methods:
+        print(f'    {m}')
+    count += 1
+"

package/scripts/C-CPP/project/tree.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# C/C++ project tree — progressive depth fallback with build exclusions
+source "$(dirname "$0")/../lib/limit.sh"
+limit_tree "$MAX_TREE"

package/scripts/C-CPP/quality/lint.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# C/C++ lint — clang-tidy or cppcheck
+source "$(dirname "$0")/../lib/limit.sh"
+
+if command -v clang-tidy &>/dev/null; then
+  out=$(clang-tidy --checks='-*,bugprone-*,modernize-*,readability-*' -p build . 2>&1 | head -50)
+  limit_output "$out" "$MAX_LINT" "$(echo "$out" | head -3 && echo '... more clang-tidy warnings')"
+elif command -v cppcheck &>/dev/null; then
+  out=$(cppcheck --enable=all --suppress=missingInclude . 2>&1 | head -50)
+  limit_output "$out" "$MAX_LINT" "$(echo "$out" | head -3 && echo '... more cppcheck warnings')"
+else
+  echo "No C/C++ linter found (install clang-tidy or cppcheck)"
+fi

package/scripts/C-CPP/quality/test-summary.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# C/C++ test summary — ctest or make test
+source "$(dirname "$0")/../lib/limit.sh"
+
+if [ -f CMakeLists.txt ] && [ -d build ]; then
+  out=$(ctest --test-dir build --output-on-failure 2>&1 | tail -10)
+  if [ -n "$out" ]; then
+    limit_output "$out" "$MAX_TEST" "$(echo "$out" | head -3 && echo '... more test results')"
+    exit 0
+  fi
+fi
+
+if [ -f Makefile ] || [ -f makefile ]; then
+  out=$(make test 2>&1 | tail -10)
+  if [ -n "$out" ]; then
+    limit_output "$out" "$MAX_TEST" "$(echo "$out" | head -3 && echo '... more test results')"
+    exit 0
+  fi
+fi
+
+echo "No C/C++ test runner configured"

package/scripts/C-CPP/quality/type-check.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# C/C++ type check — compiler warnings
+source "$(dirname "$0")/../lib/limit.sh"
+
+if [ -f CMakeLists.txt ] && [ -d build ]; then
+  out=$(cmake --build build 2>&1 | grep -E 'warning:|error:' | head -30)
+  if [ -z "$out" ]; then
+    echo "No compiler warnings"
+    exit 0
+  fi
+  limit_output "$out" "$MAX_TYPECHECK" "$(echo "$out" | head -3 && echo '... more compiler warnings')"
+  exit 0
+fi
+
+if [ -f Makefile ] || [ -f makefile ]; then
+  out=$(make 2>&1 | grep -E 'warning:|error:' | head -30)
+  if [ -z "$out" ]; then
+    echo "No compiler warnings"
+    exit 0
+  fi
+  limit_output "$out" "$MAX_TYPECHECK" "$(echo "$out" | head -3 && echo '... more compiler warnings')"
+  exit 0
+fi
+
+echo "No C/C++ type checker configured (build the project first)"

package/scripts/DevOps/architecture/arch.sh

@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# Architecture map — DevOps service dependencies (Docker Compose, Dockerfiles, Terraform)
+source "$(dirname "$0")/../lib/limit.sh"
+
+: "${MAX_ARCH:=100}"
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+NORMALIZE="$SCRIPT_DIR/normalize.sh"
+[ -f "$NORMALIZE" ] || NORMALIZE="$SCRIPT_DIR/../../Shared/architecture/normalize.sh"
+
+(
+  if [ -f docker-compose.yml ] || [ -f docker-compose.yaml ]; then
+    COMPOSE_FILE="docker-compose.yml"
+    [ -f docker-compose.yaml ] && COMPOSE_FILE="docker-compose.yaml"
+
+    if command -v python3 &>/dev/null && python3 -c "import yaml" 2>/dev/null; then
+      python3 -c "
+import sys, yaml, os
+
+compose_file = os.environ.get('COMPOSE_FILE', 'docker-compose.yml')
+try:
+    with open(compose_file, 'r') as f:
+        data = yaml.safe_load(f) or {}
+except Exception:
+    sys.exit(0)
+
+services = data.get('services', {})
+if not services:
+    sys.exit(0)
+
+for svc, cfg in services.items():
+    if not isinstance(cfg, dict):
+        continue
+    image = cfg.get('image', '')
+    if image:
+        img_name = image.split(':')[0].split('/')[-1]
+        print(f'{svc}\text:{img_name}')
+    depends = cfg.get('depends_on', [])
+    if isinstance(depends, list):
+        for dep in depends:
+            print(f'{svc}\t{dep}')
+    elif isinstance(depends, dict):
+        for dep in depends:
+            print(f'{svc}\t{dep}')
+    links = cfg.get('links', [])
+    for link in links:
+        dep = link.split(':')[0] if ':' in link else link
+        print(f'{svc}\t{dep}')
+" COMPOSE_FILE="$COMPOSE_FILE" 2>/dev/null
+    else
+      awk '
+        /^[a-zA-Z0-9_-]+:/ && !/^[[:space:]]/ {
+          if (in_service && current_svc != "") {
+            services[current_svc] = 1
+          }
+          gsub(/:.*$/, "")
+          current_svc = $0
+          in_service = 1
+          next
+        }
+        in_service && /^[[:space:]]+depends_on:/ {
+          in_depends = 1
+          next
+        }
+        in_service && in_depends && /^[[:space:]]+-[[:space:]]*/ {
+          gsub(/^[[:space:]]+-[[:space:]]*/, "")
+          gsub(/:.*$/, "")
+          if (current_svc != "" && $0 != "") print current_svc "\t" $0
+          next
+        }
+        in_service && /^[[:space:]]+image:/ {
+          gsub(/^[[:space:]]+image:[[:space:]]*/, "")
+          gsub(/:.*$/, "")
+          img = $0
+          n = split(img, parts, "/")
+          short = parts[n]
+          if (current_svc != "" && short != "") print current_svc "\text:" short
+          next
+        }
+        /^[[:space:]]*$/ { in_depends = 0 }
+        /^[^[:space:]]/ && !/[a-zA-Z0-9_-]+:/ { in_service = 0 }
+        END { if (in_service && current_svc != "") services[current_svc] = 1 }
+      ' "$COMPOSE_FILE" 2>/dev/null
+    fi
+  fi
+
+  find . -name "Dockerfile" -not -path "*/.git/*" -not -path "*/.pipemd/*" 2>/dev/null | while IFS= read -r df; do
+    rel="${df#./}"
+    context_dir="$(dirname "$rel")"
+    [ "$context_dir" = "." ] && stage="main" || stage="$(basename "$context_dir")"
+
+    awk -v stage="$stage" '
+      /^FROM[[:space:]]/ {
+        img = $2
+        asname = ""
+        for (i = 3; i <= NF; i++) {
+          if ($i == "AS" || $i == "as" || $i == "As") {
+            asname = $(i+1)
+            break
+          }
+        }
+        gsub(/:.*$/, "", img)
+        base = img
+        n = split(base, parts, "/")
+        short = parts[n]
+        printf "%s\text:%s\n", stage, short
+        if (asname != "") printf "%s\t%s\n", stage, asname
+      }
+      /COPY[[:space:]]+--from=/ {
+        for (i = 1; i <= NF; i++) {
+          if ($i == "--from") {
+            src = $(i+1)
+            if (src !~ /^[0-9]+$/) {
+              printf "%s\t%s\n", stage, src
+            }
+          }
+        }
+      }
+    ' "$df" 2>/dev/null
+  done
+
+  find . -name "*.tf" -not -path "*/.git/*" -not -path "*/.pipemd/*" -not -path "*/.terraform/*" 2>/dev/null | head -30 | while IFS= read -r tf; do
+    rel="${tf#./}"
+    tf_dir="$(dirname "$rel")"
+    [ "$tf_dir" = "." ] && tf_ctx="main" || tf_ctx="$(basename "$tf_dir")"
+
+    awk -v ctx="$tf_ctx" '
+      /^module[[:space:]]+"?/ {
+        gsub(/^module[[:space:]]+"?/, "")
+        gsub(/".*/, "")
+        name = $0
+        gsub(/[[:space:]]+/, "", name)
+        if (name != "") print ctx "\ttf:" name
+      }
+      /^data[[:space:]]+"?[a-zA-Z]/ {
+        gsub(/^data[[:space:]]+"?/, "")
+        gsub(/".*/, "")
+        dtype = $1
+        gsub(/[[:space:]]+/, "", dtype)
+        if (dtype != "") print ctx "\ttf:data_" dtype
+      }
+      /^resource[[:space:]]+"?[a-zA-Z]/ {
+        gsub(/^resource[[:space:]]+"?/, "")
+        gsub(/".*/, "")
+        rtype = $1
+        gsub(/[[:space:]]+/, "", rtype)
+        if (rtype != "") print ctx "\ttf:" rtype
+      }
+      /^provider[[:space:]]+"?[a-zA-Z]/ {
+        gsub(/^provider[[:space:]]+"?/, "")
+        gsub(/".*/, "")
+        pname = $0
+        gsub(/[[:space:]]+/, "", pname)
+        if (pname != "") print ctx "\text:" pname
+      }
+    ' "$tf" 2>/dev/null
+  done
+
+  find . \( -name "*.yaml" -o -name "*.yml" \) -not -name "docker-compose.*" -not -path "*/.git/*" -not -path "*/.pipemd/*" 2>/dev/null | head -10 | while IFS= read -r kf; do
+    rel="${kf#./}"
+    kf_dir="$(dirname "$rel")"
+    [ "$kf_dir" = "." ] && kf_ctx="main" || kf_ctx="$(basename "$kf_dir")"
+    kf_base="$(basename "$rel" .yaml)"
+    [ "$kf_base" = "$(basename "$rel" .yml)" ] || kf_base="$(basename "$rel" .yml)"
+
+    if echo "$kf_base" | grep -qE '^(deploy|service|ingress|configmap|secret|daemonset|statefulset|deployment|cronjob|job|pod|hpa|pdb|namespace|pv|pvc)$'; then
+      awk -v ctx="$kf_ctx" '
+        /^[[:space:]]*name:/ {
+          gsub(/^[[:space:]]*name:[[:space:]]*/, "")
+          gsub(/"/, "")
+          gsub(/'"'"'/, "")
+          if ($0 != "") print ctx "\tk8s:" $0
+        }
+        /^[[:space:]]*image:/ {
+          gsub(/^[[:space:]]*image:[[:space:]]*/, "")
+          gsub(/:.*$/, "")
+          n = split($0, parts, "/")
+          short = parts[n]
+          if (short != "") print ctx "\text:" short
+        }
+      ' "$kf" 2>/dev/null
+    fi
+  done
+
+) | sort -u | MAX_ARCH="$MAX_ARCH" bash "$NORMALIZE"

package/scripts/DevOps/devops/aws-context.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# AWS caller identity — prevents account hallucination
+source "$(dirname "$0")/../lib/limit.sh"
+
+if ! command -v aws &>/dev/null; then
+  echo "> ℹ️  aws CLI is not installed or not in PATH"
+  exit 0
+fi
+
+identity=$(timeout 3s aws sts get-caller-identity --output json 2>/dev/null || true)
+
+if [ -z "$identity" ]; then
+  echo "> ℹ️  Could not retrieve AWS caller identity (no credentials or timeout)"
+  exit 0
+fi
+
+echo "## AWS Caller Identity"
+echo ""
+
+account=$(echo "$identity" | timeout 2s python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+account = d.get('Account', 'unknown')
+userid = d.get('UserId', 'unknown')
+arn    = d.get('Arn', 'unknown')
+print('| Field | Value |')
+print('|-------|-------|')
+print('| Account | {} |'.format(account))
+print('| UserID  | {} |'.format(userid))
+print('| ARN     | {} |'.format(arn))
+" 2>/dev/null || echo "> Could not parse STS response")
+
+echo "$account"

package/scripts/DevOps/devops/docker-stats.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -uo pipefail
+# Docker container health summary
+source "$(dirname "$0")/../lib/limit.sh"
+
+if ! command -v docker &>/dev/null; then
+  echo "> ℹ️  docker is not installed or not in PATH"
+  exit 0
+fi
+
+if ! timeout 3s docker info &>/dev/null; then
+  echo "> ℹ️  Docker daemon is not running"
+  exit 0
+fi
+
+echo "## Docker Containers"
+echo ""
+
+containers=$(timeout 5s docker ps -a \
+  --filter "status=running" \
+  --filter "status=exited" \
+  --format "{{.Names}}|{{.Status}}|{{.Ports}}" 2>/dev/null)
+
+if [ -z "$containers" ]; then
+  echo "> No running or recently exited containers found."
+  exit 0
+fi
+
+echo "| Name | Status | Ports |"
+echo "|------|--------|-------|"
+
+echo "$containers" | head -15 | while IFS='|' read -r name status ports; do
+  clean_ports="${ports//-/}"
+  if [ -z "$clean_ports" ]; then clean_ports="—"; fi
+  echo "| ${name} | ${status} | ${clean_ports} |"
+done
+
+total=$(echo "$containers" | wc -l)
+if [ "$total" -gt 15 ]; then
+  echo ""
+  echo "> Showing 15 of ${total} containers (truncated for token budget)"
+fi