@starci/eslint-canon-be 3.0.9 → 3.1.0

package/runtime/scripts/hfs/trailing-slashes.mjs

@@ -0,0 +1,8 @@
+// Trailing-slash trimming for slot paths and generated roots, linear in the length of the text.
+
+/** `text` without its trailing `/` characters. */
+export function trimTrailingSlashes(text) {
+  let end = text.length;
+  while (end > 0 && text.codePointAt(end - 1) === 47) end -= 1;
+  return text.slice(0, end);
+}

package/runtime/scripts/hfs/typescript-programs.mjs

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { createRequire } from 'node:module';
 import path from 'node:path';
+import { byCodeUnit } from '../lib/list.mjs';
 
 // One TypeScript program per (compiler, root names, compiler options, project references) inside a program run, and
 // one value per (kind, compiler, input) for what callers derive from those programs (the architecture context).
@@ -27,7 +27,7 @@ function keyOf(value) {
   }
   if (typeof value !== 'object' || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)) return null;
   const entries = [];
-  for (const name of Object.keys(value).sort()) {
+  for (const name of Object.keys(value).sort(byCodeUnit)) {
     const item = keyOf(value[name]);
     if (item === null) return null;
     entries.push(`${JSON.stringify(name)}:${item}`);
@@ -44,7 +44,10 @@ export function sharedInProgramRun(kind, ts, input, build) {
   const key = values ? keyOf(input) : null;
   if (key === null) return build();
   let byKey = values.get(ts);
-  if (!byKey) values.set(ts, byKey = new Map());
+  if (!byKey) {
+    byKey = new Map();
+    values.set(ts, byKey);
+  }
   const id = `${kind}\0${key}`;
   if (!byKey.has(id)) byKey.set(id, build());
   return byKey.get(id);
@@ -74,4 +77,3 @@ export function typeScriptProjectReferencePath(ts, reference) {
 export function resolveTypeScriptModule(ts, specifier, from, options, host = ts.sys) {
   return ts.resolveModuleName(specifier, from, options, host).resolvedModule?.resolvedFileName;
 }
-

package/runtime/scripts/hfs/view.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { allowsFile } from './allows.mjs';
 import { openHfs } from './slots.mjs';
 
-const posix = (p) => String(p).replace(/\\/g, '/');
+const posix = (p) => String(p).replaceAll('\\', '/');
 const isAbsoluteAny = (text) => path.isAbsolute(text) || /^[A-Za-z]:\//.test(text);
 
 /**

package/runtime/scripts/lib/dockerfile.mjs

@@ -58,8 +58,8 @@ export function shellCommands(body) {
     } else if (char === '"' || char === "'") {
       quote = char;
       current += char;
-    } else if (char === ';' || char === '|' || (char === '&' && body[i + 1] === '&')) {
-      if (char !== ';' && body[i + 1] === char) i += 1;
+    } else if (isCommandSeparator(body, i, char)) {
+      i += commandSeparatorAdvance(body, i, char);
       flush();
     } else if (char === '\\' && body[i + 1] === '\n') {
       i += 1;
@@ -71,43 +71,17 @@ export function shellCommands(body) {
   return commands;
 }
 
+const isCommandSeparator = (body, index, char) => char === ';' || char === '|' || (char === '&' && body[index + 1] === '&');
+const commandSeparatorAdvance = (body, index, char) => char !== ';' && body[index + 1] === char ? 1 : 0;
+
 /**
  * Parse a Dockerfile: { instructions: [{ keyword, text, line, stage }], stages: [{ index, name, image, line, instructions }],
  * comments: [{ text, line }], preamble: [instruction before the first FROM (ARG)] }. `keyword` is upper-case; `text` is the
  * argument text of the logical line; `stage` is the index of the stage the instruction belongs to (-1 before the first FROM).
  */
 export function parseDockerfile(source) {
-  const lines = String(source).replace(/\r\n/g, '\n').split('\n');
-  const instructions = [];
-  const comments = [];
-  let escape = '\\';
-  let directives = true;
-  for (let i = 0; i < lines.length; i += 1) {
-    const raw = lines[i];
-    const trimmed = raw.trim();
-    if (trimmed === '') { directives = false; continue; }
-    if (trimmed.startsWith('#')) {
-      const body = trimmed.slice(1).trim();
-      const directive = directives ? /^(syntax|escape|check)\s*=\s*(\S+)$/i.exec(body) : null;
-      if (directive) { if (directive[1].toLowerCase() === 'escape') escape = directive[2]; continue; }
-      directives = false;
-      comments.push({ text: body, line: i + 1 });
-      continue;
-    }
-    directives = false;
-    const start = i + 1;
-    let logical = trimmed;
-    while (logical.endsWith(escape) && i + 1 < lines.length) {
-      logical = logical.slice(0, -1).trimEnd();
-      i += 1;
-      while (i < lines.length && lines[i].trim().startsWith('#')) i += 1;
-      if (i >= lines.length) break;
-      logical = `${logical} ${lines[i].trim()}`;
-    }
-    const split = logical.search(/\s/);
-    const keyword = (split < 0 ? logical : logical.slice(0, split)).toUpperCase();
-    instructions.push({ keyword, text: split < 0 ? '' : logical.slice(split).trim(), line: start, stage: -1 });
-  }
+  const lines = String(source).replaceAll('\r\n', '\n').split('\n');
+  const { instructions, comments } = parseInstructions(lines);
   const stages = [];
   const preamble = [];
   for (const instruction of instructions) {
@@ -122,3 +96,52 @@ export function parseDockerfile(source) {
   }
   return { instructions, stages, comments, preamble };
 }
+
+function parseInstructions(lines) {
+  const instructions = [];
+  const comments = [];
+  const state = { escape: '\\', directives: true };
+  let i = 0;
+  while (i < lines.length) {
+    const parsed = parseInstructionLine(lines, i, state);
+    if (parsed.comment) comments.push(parsed.comment);
+    if (parsed.instruction) instructions.push(parsed.instruction);
+    i = parsed.nextLine + 1;
+  }
+  return { instructions, comments };
+}
+
+function parseInstructionLine(lines, index, state) {
+  const trimmed = lines[index].trim();
+  if (trimmed === '') { state.directives = false; return { nextLine: index }; }
+  if (trimmed.startsWith('#')) return parseCommentLine(trimmed, index, state);
+  state.directives = false;
+  const { logical, nextLine } = logicalInstructionOf(lines, index, state.escape);
+  const split = logical.search(/\s/);
+  const keyword = (split < 0 ? logical : logical.slice(0, split)).toUpperCase();
+  return { nextLine, instruction: { keyword, text: split < 0 ? '' : logical.slice(split).trim(), line: index + 1, stage: -1 } };
+}
+
+function parseCommentLine(trimmed, index, state) {
+  const body = trimmed.slice(1).trim();
+  const directive = state.directives ? /^(syntax|escape|check)\s*=\s*(\S+)$/i.exec(body) : null;
+  if (directive) {
+    if (directive[1].toLowerCase() === 'escape') state.escape = directive[2];
+    return { nextLine: index };
+  }
+  state.directives = false;
+  return { nextLine: index, comment: { text: body, line: index + 1 } };
+}
+
+function logicalInstructionOf(lines, index, escape) {
+  let logical = lines[index].trim();
+  let nextLine = index;
+  while (logical.endsWith(escape) && nextLine + 1 < lines.length) {
+    logical = logical.slice(0, -1).trimEnd();
+    nextLine += 1;
+    while (nextLine < lines.length && lines[nextLine].trim().startsWith('#')) nextLine += 1;
+    if (nextLine >= lines.length) break;
+    logical = `${logical} ${lines[nextLine].trim()}`;
+  }
+  return { logical, nextLine };
+}

package/runtime/scripts/lib/git.mjs

@@ -7,13 +7,13 @@
  */
 export const unquoteDiffPath = (value) =>
   /^".*"$/.test(value)
-    ? JSON.parse(value.replace(/\\([0-7]{3})/g, (_, octal) => `\\u00${Number.parseInt(octal, 8).toString(16).padStart(2, '0')}`))
+    ? JSON.parse(value.replace(/\\([0-7]{3})/g, (_, octal) => String.raw`\u00${Number.parseInt(octal, 8).toString(16).padStart(2, '0')}`))
     : value;
 
 // git's repository-local variables (git rev-parse --local-env-vars). A hook or alias run in a linked worktree exports
 // GIT_DIR=<main>/.git/worktrees/<wt>; a spec inheriting it pointed every fixture git at the LIVE .claude repo and re-inited
 // it core.bare=true (2026-09-29, a6f60352c). tests/setup/isolated-registry.mjs drops the same list.
-export const GIT_LOCAL_ENV_VARS = ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_IMPLICIT_WORK_TREE', 'GIT_PREFIX', 'GIT_CONFIG', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG_COUNT', 'GIT_GRAFT_FILE', 'GIT_NO_REPLACE_OBJECTS', 'GIT_REPLACE_REF_BASE', 'GIT_SHALLOW_FILE'];
+export const GIT_LOCAL_ENV_VARS = ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_IMPLICIT_WORK_TREE', 'GIT_PREFIX', 'GIT_CONFIG', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG_COUNT', 'GIT_GRAFT_FILE', 'GIT_NO_REPLACE_OBJECTS', 'GIT_REPLACE_REF_BASE', 'GIT_SHALLOW_FILE', 'GIT_INTERNAL_SUPER_PREFIX'];
 /** `parent` (the caller's env) without git's repository-local variables (GIT_CONFIG_KEY_n/VALUE_n go with GIT_CONFIG_COUNT). Pure. */
 export function withoutGitLocalEnv(parent) {
   const env = { ...parent };

package/runtime/scripts/lib/i18n.mjs

@@ -11,6 +11,7 @@
 // A placeholder is `{name}`; the English and the Vietnamese of one entry carry exactly the same placeholders
 // (scripts/checks/check-i18n-catalog.mjs). An English source with no entry is returned as is: a missing translation degrades
 // to English, never to a blank.
+import { byCodeUnit } from './list.mjs';
 import { escapeRegExp } from './regex.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -19,7 +20,7 @@ import { parseYaml } from '../../engine/yaml.mjs';
 import { DEFAULT_OWNER_LANGUAGE, loadConfig } from '../../engine/config.mjs';
 
 export const CATALOG_DIR = 'modules/i18n/messages';
-export const PLACEHOLDER = /\{([A-Za-z_][\w]*)\}/g;
+export const PLACEHOLDER = /\{([A-Za-z_]\w*)\}/g;
 
 const cache = new Map();
 
@@ -54,7 +55,7 @@ export const resetCatalogCache = () => cache.clear();
 /** The names each `pattern` match captures (group 1) in `text`, in match order (`sort` sorts them). */
 export const captureNames = (text, pattern, { sort = false } = {}) => {
   const names = [...String(text).matchAll(pattern)].map((m) => m[1]);
-  return sort ? names.sort() : names;
+  return sort ? names.sort(byCodeUnit) : names;
 };
 
 /** The names of the placeholders of a message. */

package/runtime/scripts/lib/jsdoc.mjs

@@ -0,0 +1,35 @@
+/**
+ * The description form shared by runtime and product public-documentation checks.
+ * This proves local form; responsibility, accuracy and important decision rationale remain review.
+ */
+
+/** Whether AST-selected description text contains a letter or number; language and meaning remain review. */
+export const hasJsdocDescription = (description) => typeof description === "string" && /[\p{L}\p{N}]/u.test(description);
+
+/**
+ * Read description text before block tags; file-level headers do not describe a declaration.
+ * Tag payloads and punctuation cannot make an empty API description pass.
+ */
+export const jsdocDescription = (comment) => {
+  if (comment?.type !== "Block" || !comment.value.startsWith("*")) return "";
+  const prose = comment.value.replace(/^\*/, "").split(/\r?\n/u)
+    .map((line) => line.replace(/^\s*\*(?: ?)/u, "")).join("\n");
+  if (/(?:^|\s)@(?:file|fileoverview|overview|license|copyright)\b/u.test(prose)) return "";
+  const description = prose.split(/(?:^|\s)@[A-Za-z][\w-]*(?=\s|$)/u, 1)[0].trim();
+  return hasJsdocDescription(description) ? description : "";
+};
+
+/**
+ * Return the final adjacent JSDoc only when it describes this declaration.
+ * Decorated classes document the export after its decorators; member docs precede their decorators.
+ */
+export const jsdocBefore = (sourceCode, node) => {
+  const exported = node.type === "ExportNamedDeclaration" || node.type === "ExportDefaultDeclaration";
+  const anchor = exported
+    ? sourceCode.getTokens(node).find((token) => token.type === "Keyword" && token.value === "export")
+    : node.decorators?.[0] ?? node;
+  if (!anchor) return null;
+  const comment = sourceCode.getCommentsBefore(anchor).at(-1);
+  if (!jsdocDescription(comment)) return null;
+  return /^\s*$/u.test(sourceCode.getText().slice(comment.range[1], anchor.range[0])) ? comment : null;
+};

package/runtime/scripts/lib/language.mjs

@@ -50,13 +50,13 @@ export const DECLARED_VIETNAMESE_FIELDS = Object.freeze({
   'modules/ops/_labels.yaml': Object.freeze({ flowFields: Object.freeze(['vi']) }),
   'modules/goal/archetypes.yaml': Object.freeze({
     fields: Object.freeze([
-      'buildIntent', 'canonIntent', 'e2eIntent', 'uatIntent', 'proofNegation', 'integrationIntent', 'integrationNegation', 'brandIntent',
+      'buildIntent', 'canonIntent', 'e2eIntent', 'uatIntent', 'proofNegation', 'proofStateCue', 'integrationIntent', 'brandIntent',
       'phrases', 'requires', 'excludes', 'backend', 'frontend', 'package',
     ]),
   }),
   'modules/goal/source-phrases.yaml': Object.freeze({
     fields: Object.freeze([
-      'prefer', 'avoid', 'negation', 'refused', 'accept', 'golden',
+      'prefer', 'avoid', 'only', 'negation', 'refused', 'accept', 'golden',
       'missingPaths', 'grantTooNarrow', 'toolTimeout', 'testGap', 'checkerUnavailable',
       'supervisorVerbs', 'ownerWord', 'orWord', 'beyondAuthority', 'ownerOnly', 'workerDied', 'contractConflict', 'decision',
       'product', 'grammar', 'knowledge', 'sourceLabel', 'internalVocabulary', 'actor', 'success',
@@ -124,7 +124,7 @@ export function documentLanguageHits(rel, text) {
     if (declared.fields?.includes(keys[hit.line - 1])) return false;
     if (!declared.flowFields) return true;
     // an inline flow map: drop the declared fields' values and judge what is left of the line
-    const rest = declared.flowFields.reduce((line, field) => line.replace(new RegExp(`\\b${field}\\s*:\\s*(?:"(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*'|[^,}]*)`, 'g'), ''), lines[hit.line - 1]);
+    const rest = declared.flowFields.reduce((line, field) => line.replace(new RegExp(String.raw`\b${field}\s*:\s*(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^,}]*)`, 'g'), ''), lines[hit.line - 1]);
     return hasSecondLanguage(rest);
   });
 }

package/runtime/scripts/lib/list.mjs

@@ -4,7 +4,11 @@
 export const list = (v) => (Array.isArray(v) ? v : []);
 
 /** `v` as an array: itself when already one, [] for null/undefined, else [v]. */
-export const asList = (v) => (Array.isArray(v) ? v : v == null ? [] : [v]);
+export const asList = (v) => {
+  if (Array.isArray(v)) return v;
+  if (v == null) return [];
+  return [v];
+};
 
 /** The object entries of `v` (a non-array reads as []). */
 export const objectList = (v) => (Array.isArray(v) ? v : []).filter((item) => item && typeof item === 'object');
@@ -18,3 +22,6 @@ export const splitList = (v, { sep = ',', dedupe = false } = {}) => {
   const items = String(v ?? '').split(sep).map((s) => s.trim()).filter(Boolean);
   return dedupe ? [...new Set(items)] : items;
 };
+
+// The comparator of a bare `sort()` (UTF-16 code-unit order) is owned by the engine, which cannot import scripts/lib.
+export { byCodeUnit } from '../../engine/by-code-unit.mjs';

package/runtime/scripts/lib/mutation-fence.mjs

@@ -0,0 +1,15 @@
+// mutation-fence.mjs — ephemeral admission carried through awaited work, never a state store.
+import { AsyncLocalStorage } from 'node:async_hooks';
+const scope = new AsyncLocalStorage();
+
+/** Run one admitted call; the checker is synchronous and reads its existing durable owners again. */
+export const withMutationFence = (check, authority, fn) => scope.run({ check, authority, checking: false }, fn);
+/** Recheck after the actual transaction lock or immediately before a native effect. */
+export function assertMutationFence(boundary) {
+  const current = scope.getStore();
+  if (!current || current.checking) return;
+  current.checking = true;
+  try { current.check(boundary); } finally { current.checking = false; }
+}
+/** Identity stamped by existing write owners, never accepted from a command argument. */
+export const mutationAuthority = () => scope.getStore()?.authority ?? null;

package/runtime/scripts/lib/path-key.mjs

@@ -6,6 +6,17 @@ const WIN = process.platform === 'win32';
 
 /** `p` with every backslash turned into a forward slash; null and undefined read as ''. */
 export const slash = (p) => String(p ?? '').replaceAll('\\', '/');
+/** `text` without its trailing '/' run (a loop: a trailing-run pattern backtracks super-linearly). */
+export const trimTrailingSlashes = (text) => {
+  for (let end = text.length; ; end -= 1) if (end === 0 || text[end - 1] !== '/') return text.slice(0, end);
+};
+// A trailing '*' run with the one '/' before it (the glob suffix of 'dir/**'); text without a trailing '*' is unchanged.
+const stripTrailingStars = (text) => {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === '*') end -= 1;
+  if (end === text.length) return text;
+  return text.slice(0, end > 0 && text[end - 1] === '/' ? end - 1 : end);
+};
 /** A relative path in git's spelling: forward slashes, no leading './'. */
 export const posixPath = (p) => slash(p).replace(/^\.\//, '');
 /** Whether posix `file` is `prefix` itself or under it (`file === prefix || file` starts with `prefix/`). */
@@ -19,7 +30,7 @@ export const samePath = (a, b) => foldCase(a) === foldCase(b);
  * `fold: true` folds case on every platform (a comparison against a lowercase-stored root needs it).
  */
 export const pathKey = (p, { fold = WIN } = {}) => {
-  const key = slash(path.resolve(p)).replace(/\/+$/, '');
+  const key = trimTrailingSlashes(slash(path.resolve(p)));
   return fold ? key.toLowerCase() : key;
 };
 /** `a` is `b` or under it, or the reverse: two path spellings whose trees touch. */
@@ -36,37 +47,59 @@ export const normPath = (p, { trim = false, collapse = false, dot = false, glob
   s = slash(s);
   if (collapse) s = s.replace(/\/{2,}/g, '/');
   if (dot) s = s.replace(/^\.\//, '');
-  if (glob === 'star') s = s.replace(/\/?\*+$/, '');
+  if (glob === 'star') s = stripTrailingStars(s);
   else if (glob === 'double') s = s.replace(/\/\*\*$/, '');
-  s = s.replace(/\/+$/, '');
+  s = trimTrailingSlashes(s);
   return fold ? s.toLowerCase() : s;
 };
 /** A work-relative path in one spelling: forward slashes, no leading ./, no trailing slash. */
-export const normWork = (p) => String(p ?? '').trim().replaceAll('\\', '/').replace(/^\.\/+/, '').replace(/\/+$/, '');
+export const normWork = (p) => trimTrailingSlashes(String(p ?? '').trim().replaceAll('\\', '/').replace(/^\.\/+/, ''));
 
 /** `p` resolved and dereferenced (realpath where the path exists) — the canonical spelling of a checkout dir. */
 export const realPath = (p) => {
   const resolved = path.resolve(p);
   try { return fs.realpathSync.native(resolved); } catch { return resolved; }
 };
+/** `p` with its nearest existing ancestor dereferenced and the not-yet-created rest appended: a root's canonical spelling before it exists. */
+export const canonicalPath = (p) => {
+  const rest = [];
+  for (let at = path.resolve(p); ; at = path.dirname(at)) {
+    try { return path.join(fs.realpathSync.native(at), ...rest); } catch { /* not created yet */ }
+    if (path.dirname(at) === at) return path.resolve(p);
+    rest.unshift(path.basename(at));
+  }
+};
 /** `p` resolved and case-folded where the filesystem ignores case — the Map key of an absolute path. */
 export const resolvedKey = (p) => foldCase(path.resolve(p));
 /** Whether `a` and `b` resolve to the same path (always case-folded, so differently-cased spellings count). */
 export const sameResolvedPath = (a, b) => pathKey(a, { fold: true }) === pathKey(b, { fold: true });
 /**
- * Whether `file` sits strictly under `root`. `key` normalizes both sides first (e.g. the registry's
- * realpath-folded treeKey) when the callers' spellings need it.
+ * Whether `file` sits under `root`; `includeSelf` also admits the root itself. `key` normalizes
+ * both sides first (e.g. the registry's realpath-folded treeKey) when their spellings need it.
  */
-export const insidePath = (root, file, { key = (p) => p } = {}) => {
+export const insidePath = (root, file, { key = (p) => p, includeSelf = false } = {}) => {
   const rel = path.relative(key(root), key(file));
-  return Boolean(rel) && !rel.startsWith('..') && !path.isAbsolute(rel);
+  return (includeSelf || Boolean(rel)) && !rel.startsWith('..') && !path.isAbsolute(rel);
+};
+/**
+ * `candidate` (absolute, or relative to `base`) resolved and dereferenced, required to sit under `base` (or be it):
+ * the boundary check for a path an operator, an agent or another process hands in. `base` is canonicalised once and the
+ * candidate is judged below it, so `..` segments and links leading out are refused; returns the canonical path, or throws
+ * a PATH_OUTSIDE_BASE refusal (`label` names the argument in the message).
+ */
+export const containedPath = (base, candidate, { label = 'path' } = {}) => {
+  const root = canonicalPath(base);
+  const resolved = canonicalPath(path.resolve(root, String(candidate ?? '')));
+  const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+  if (!insidePath(root, resolved, { includeSelf: true }) || (resolved !== root && !resolved.startsWith(prefix))) throw Object.assign(new Error(`${label} ${String(candidate)} is outside ${root} [PATH_OUTSIDE_BASE]`), { code: 'PATH_OUTSIDE_BASE' });
+  return resolved;
 };
 /**
  * A path-ish value (a string or a {path} entry) in relative compare form: trimmed, forward slashes,
  * no trailing '/**' glob or slashes, no leading './'; `fold` lowercases for a case-insensitive key.
  */
 export const normRel = (p, { fold = false } = {}) => {
-  const s = String(typeof p === 'string' ? p : p?.path ?? '').trim().replace(/\\/g, '/').replace(/\/\*\*$/, '').replace(/\/+$/, '').replace(/^\.\//, '');
+  const s = trimTrailingSlashes(String(typeof p === 'string' ? p : p?.path ?? '').trim().replaceAll('\\', '/').replace(/\/\*\*$/, '')).replace(/^\.\//, '');
   return fold ? s.toLowerCase() : s;
 };
 /** Whether `file` equals or sits under one of `prefixes` (posix spellings; `dot` counts a '.' prefix as covering all). */

package/runtime/scripts/lib/regex.mjs

@@ -1,4 +1,4 @@
 // regex.mjs - building a RegExp from text.
 
 /** `text` with every regular-expression metacharacter escaped, so it matches itself literally. */
-export const escapeRegExp = (text) => String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+export const escapeRegExp = (text) => String(text).replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);

package/runtime/scripts/lib/secret-patterns.mjs

@@ -15,7 +15,7 @@ export const FORBIDDEN_FILES = [
 export const SECRET_PATTERNS = [
   { name: 'private-key-block', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
   { name: 'aws-access-key', re: /\bAKIA[0-9A-Z]{16}\b/ },
-  { name: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{50,}\b/ },
+  { name: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b|\bgithub_pat_\w{50,}\b/ },
   { name: 'anthropic-key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
   { name: 'openai-key', re: /\bsk-(?:proj-)?[A-Za-z0-9]{32,}\b/ },
   { name: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/ },
@@ -28,7 +28,11 @@ export const SECRET_PATTERNS = [
   // candidate; only this heuristic takes the exemption, never a provider-shaped token above.
   // A spec file's keyword-assigned values are test inputs (a spec's sign-in
   // form password and a mocked accessToken once refused a push): the heuristic skips spec files too.
-  { name: 'assigned-secret', re: /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|client[_-]?secret)\b\s*[:=]\s*['"](?!env\([A-Z_][A-Z0-9_]*\)['"])([^'"\s$<{]{12,})['"]/i, placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
+  { name: 'assigned-secret', re: new RegExp([
+    String.raw`\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|client[_-]?secret)`,
+    String.raw`\b\s*[:=]\s*['"](?!env\([A-Z_][A-Z0-9_]*\)['"])([^'"\s$<{]{12,})`,
+    `['"]`,
+  ].join(''), 'i'), placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
     skipFile: /\.(?:spec|test|e2e-spec)\.[cm]?[jt]sx?$/ },
 ];