@starci/hfs 4.7.11 → 4.7.13

package/runtime/scripts/hfs/rules/doc-fresh.mjs

@@ -52,10 +52,15 @@ function resolvedPath(raw, file, tracked, link, generated, roots) {
   return candidates.some((candidate) => !candidate.startsWith('../') && (trackedPath(candidate, tracked) || generated.has(candidate)));
 }
 
+const ENV_NAME = /[A-Z][A-Z0-9_]*/.source;
+const INLINE_LINK = /\]\(\s*(?:<([^>]+)>|([^\s)]+))(?:\s+['"][^)]*)?\)/.source;
+const REFERENCE_LINK = /^\s*\[[^\]]+\]:\s*(?:<([^>]+)>|(\S+))/.source;
+const MARKDOWN_LINK = new RegExp(`${INLINE_LINK}|${REFERENCE_LINK}`, 'g');
+
 function pathReferences(line) {
   const refs = [];
   // Markdown inline and reference links, including image links. URLs and anchors are excluded later.
-  for (const match of line.matchAll(/\]\(\s*(?:<([^>]+)>|([^\s)]+))(?:\s+['"][^)]*)?\)|^\s*\[[^\]]+\]:\s*(?:<([^>]+)>|(\S+))/g)) {
+  for (const match of line.matchAll(MARKDOWN_LINK)) {
     refs.push({ target: match[1] ?? match[2] ?? match[3] ?? match[4], link: true });
   }
   const masked = line.replace(/\]\([^)]*\)/g, ']');
@@ -171,9 +176,14 @@ function importedFiles(file, text, tracked) {
   });
 }
 
+const READER_CALL = /\b(\w+)\s*\.\s*\w+\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/.source;
+const PROCESS_ENV_DOT = /\bprocess\.env\.([A-Z][A-Z0-9_]*)/.source;
+const PROCESS_ENV_INDEX = /\bprocess\.env\[['"]([A-Z][A-Z0-9_]*)['"]\]/.source;
+const ENV_READ = new RegExp(`${READER_CALL}|${PROCESS_ENV_DOT}|${PROCESS_ENV_INDEX}`, 'g');
+
 function addReaderKeys(text, keys) {
   const readers = new Set(['env', 'source', ...[...text.matchAll(/\b(\w+)\s*:\s*EnvSource\b/g)].map((match) => match[1])]);
-  for (const match of text.matchAll(/\b(\w+)\s*\.\s*\w+\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]|\bprocess\.env\.([A-Z][A-Z0-9_]*)|\bprocess\.env\[['"]([A-Z][A-Z0-9_]*)['"]\]/g)) {
+  for (const match of text.matchAll(ENV_READ)) {
     if (match[3] || match[4]) keys.add(match[3] ?? match[4]);
     else if (readers.has(match[1])) keys.add(match[2]);
   }
@@ -228,7 +238,7 @@ function injectionTokens(repoRoot, tracked) {
   const ts = loadTypescript(repoRoot, path.dirname(fileURLToPath(import.meta.url)));
   if (!ts) return tokens;
   for (const file of tracked) {
-    if (!/\.[cm]?[jt]sx?$/.test(file) || /(?:^|\/)(?:tests?|__tests__)\/|(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/.test(file)) continue;
+    if (!/\.[cm]?[jt]sx?$/.test(file) || /(?:(?:^|\/)(?:tests?|__tests__)\/)|(?:(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$)/.test(file)) continue;
     const text = readText(repoRoot, file) ?? '';
     declaredTokens(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), tokens);
   }
@@ -242,6 +252,11 @@ function unknownEnvironmentName(name, line, keys, codes, tokens, explicit) {
   return !keys.has(name) && !(name.endsWith('_FILE') && keys.has(name.slice(0, -5)));
 }
 
+const QUOTED_ENV_NAME = `\`(${ENV_NAME})\``;
+const REFERENCED_ENV_NAME = String.raw`\b(?:process\.env\.|\$\{?)(${ENV_NAME})`;
+const ASSIGNED_ENV_NAME = String.raw`\b(${ENV_NAME})\s*=`;
+const ENV_NAME_CITATION = new RegExp(`${QUOTED_ENV_NAME}|${REFERENCED_ENV_NAME}|${ASSIGNED_ENV_NAME}`, 'g');
+
 function nameFindings(file, lines, keys, rules, tokens) {
   const findings = [];
   const codes = new Set(rules.rules.flatMap((rule) => rule.failureCodes));
@@ -249,7 +264,7 @@ function nameFindings(file, lines, keys, rules, tokens) {
     for (const match of line.matchAll(/\bR\d+\b/g)) {
       if (!rules.rule(match[0])) findings.push(found(RULE_UNKNOWN, file, `${file} cites unknown rule ${match[0]}; use an id from the HFS rule catalog`, { line: index + 1, reference: match[0] }));
     }
-    for (const match of line.matchAll(/`([A-Z][A-Z0-9_]*)`|\b(?:process\.env\.|\$\{?)([A-Z][A-Z0-9_]*)|\b([A-Z][A-Z0-9_]*)\s*=/g)) {
+    for (const match of line.matchAll(ENV_NAME_CITATION)) {
       const name = match[1] ?? match[2] ?? match[3];
       if (!unknownEnvironmentName(name, line, keys, codes, tokens, !match[1])) continue;
       findings.push(found(ENV_UNKNOWN, file, `${file} cites unknown environment key ${name}; declare it in a typed environment reader or KEYS.md, or update the documentation`, { line: index + 1, reference: name }));

package/runtime/scripts/hfs/rules/docker-health.mjs

@@ -222,7 +222,10 @@ function masksProbeFailure(body) {
   for (let index = 0; index < body.length; index += 1) {
     const char = body[index];
     if (char === '\\') { index += 1; continue; }
-    if (quote) { if (char === quote) quote = null; continue; }
+    if (quote) {
+      if (char === quote) quote = null;
+      continue;
+    }
     if (char === '"' || char === "'") { quote = char; continue; }
     if (char === ';' || char === '|') return true;
   }

package/runtime/scripts/hfs/rules/env-parity.mjs

@@ -35,12 +35,10 @@ const APP_MAIN = /(?:^|\/)apps\/[^/]+\/src\/main\.ts$/u;
 const SEALED_MEMBER = /^\.starcistacks\/[^/]+\/secrets\/[^/]+\.enc$/u;
 const KEYS_ROSTER = /^\.starcistacks\/[^/]+\/runtime\/env\/KEYS\.md$/u;
 const STACK_YAML = /^\.starcistacks\/.+\.ya?ml$/u;
-const ENV_EXAMPLE = /\.env\.example$/u;
-const PUBLIC_PREFIX = /^NEXT_PUBLIC_/u;
 const KEY_NAME = /^[A-Za-z_]\w*$/u;
 const FILE_SUFFIX = /_FILE$/u;
 const EXAMPLE_LINE = /^[ \t]*(?:export[ \t]+)?([A-Za-z_]\w*)[ \t]*=(.*)$/u;
-const ROSTER_KEY = /`([A-Za-z_][A-Za-z0-9_]*)`/gu;
+const ROSTER_KEY = /`([A-Za-z_]\w*)`/gu;
 
 const REQUIRED_ALWAYS = new Set(['string', 'url', 'secret', 'enum']);
 const FALLBACK_OPTIONAL = new Set(['int', 'bool', 'duration']);
@@ -274,14 +272,17 @@ function declaredYamlEntry(key, value, add) {
 /** The env names one yaml node declares: `environment:`/`env:` keys or `K=V` entries, `runtimeSecrets`, `secrets` and `vars[].name`. */
 function declaredFromYaml(node, add) {
   if (!node || typeof node !== 'object') return;
-  if (Array.isArray(node)) { for (const item of node) declaredFromYaml(item, add); return; }
+  if (Array.isArray(node)) {
+    for (const item of node) declaredFromYaml(item, add);
+    return;
+  }
   for (const [key, value] of Object.entries(node)) declaredYamlEntry(key, value, add);
 }
 
 function addDeclaredKey(declared, name) {
   if (!KEY_NAME.test(name)) return;
   declared.add(name);
-  if (FILE_SUFFIX.test(name)) declared.add(name.replace(FILE_SUFFIX, ''));
+  if (name.endsWith('_FILE')) declared.add(name.replace(FILE_SUFFIX, ''));
 }
 
 function declareKeysFromText(file, text, add) {
@@ -314,7 +315,7 @@ function addRequiredFindings(reads, sealed, declared, findings) {
 
 function sealedMemberFinding(key, member, reads, declared) {
   // The specific public-custody code wins over the generic unread one for a NEXT_PUBLIC_* key.
-  if (PUBLIC_PREFIX.test(key)) {
+  if (key.startsWith('NEXT_PUBLIC_')) {
     return found(ENV_PUBLIC_SEALED, member, `${member} seals the public key ${key}; NEXT_PUBLIC_* values are public configuration and never enter custody`);
   }
   if (!reads.has(key) && !declared.has(key)) {
@@ -347,7 +348,7 @@ function addDuplicateFindings(key, members, findings) {
 }
 
 function addExampleFindings(repoRoot, all, reads, findings) {
-  for (const file of all.filter((rel) => ENV_EXAMPLE.test(rel))) {
+  for (const file of all.filter((rel) => rel.endsWith('.env.example'))) {
     const text = readText(repoRoot, file);
     if (text === null) continue;
     for (const { key } of envExampleEntries(text)) {

package/runtime/scripts/hfs/rules/env-value-shape.mjs

@@ -19,8 +19,6 @@ import { found, readText } from './read.mjs';
 export const ENV_VALUE_SHAPE = 'ENV_VALUE_SHAPE';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
-const FILE_SUFFIX = /_FILE$/u;
-const ENV_EXAMPLE = /\.env\.example$/u;
 const SKIP_DIRECTORY = new Set(['node_modules', 'dist', 'coverage', '.git']);
 
 const SHAPES = Object.freeze({
@@ -61,7 +59,7 @@ function listEnvSourceFiles(repoRoot) {
 function shapeViolations(reads, map) {
   const violations = [];
   for (const [key, value] of Object.entries(map)) {
-    if (FILE_SUFFIX.test(key)) continue;
+    if (key.endsWith('_FILE')) continue;
     const shape = reads.get(key)?.shape;
     if (shape && !shapeOk(shape, value)) violations.push({ key, expected: shapeText(shape) });
   }
@@ -71,7 +69,7 @@ function shapeViolations(reads, map) {
 /** The findings of R249 over the `*.env.example` files of an app judged at its root scope (both editions). */
 export function envValueShapeFindings({ repoRoot, all = [], isRoot }) {
   if (!isRoot) return [];
-  const examples = all.filter((file) => ENV_EXAMPLE.test(file));
+  const examples = all.filter((file) => file.endsWith('.env.example'));
   if (!examples.length) return [];
   const reads = collectEnvReads(repoRoot, all);
   if (reads === null) return [];

package/runtime/scripts/hfs/rules/fe-build-args.mjs

@@ -91,7 +91,7 @@ function requiredNames(root, files, app, ts) {
   const names = new Set();
   for (const file of files.filter(file => file.startsWith(prefix))) {
     const local = file.slice(prefix.length);
-    const source = SOURCE.test(local) && (local.startsWith('src/') || /^next\.config\./u.test(local) || SCHEMA.test(local));
+    const source = SOURCE.test(local) && (local.startsWith('src/') || local.startsWith('next.config.') || SCHEMA.test(local));
     const schema = SCHEMA.test(local) && /\.(?:json|ya?ml)$/u.test(local);
     if (!source && !schema) continue;
     const text = readText(root, file);

package/runtime/scripts/hfs/rules/frontend-tree.mjs

@@ -37,7 +37,7 @@ function wireSchemaDigest(repoRoot, snapshots) {
   for (const snapshot of [...snapshots].sort(byCodeUnit)) {
     let source;
     try { source = fs.readFileSync(path.join(repoRoot, snapshot), 'utf8'); } catch { return null; }
-    hash.update(`${snapshot}\0${source.replace(/\r\n/g, '\n')}\0`);
+    hash.update(`${snapshot}\0${source.replaceAll('\r\n', '\n')}\0`);
   }
   return hash.digest('hex');
 }

package/runtime/scripts/hfs/rules/release-provenance.mjs

@@ -13,7 +13,10 @@ import { found, readJson, readText } from './read.mjs';
 
 export const HFS_RELEASE_TAG_MISMATCH = 'HFS_RELEASE_TAG_MISMATCH';
 export const HFS_DB_DEPLOY_UNGUARDED = 'HFS_DB_DEPLOY_UNGUARDED';
-const SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const SEMVER_NUMBER = String.raw`(?:0|[1-9]\d*)`;
+const SEMVER_PRERELEASE_ID = String.raw`(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)`;
+const SEMVER_BUILD_ID = '[0-9A-Za-z-]+';
+const SEMVER = new RegExp(String.raw`^${SEMVER_NUMBER}\.${SEMVER_NUMBER}\.${SEMVER_NUMBER}(?:-${SEMVER_PRERELEASE_ID}(?:\.${SEMVER_PRERELEASE_ID})*)?(?:\+${SEMVER_BUILD_ID}(?:\.${SEMVER_BUILD_ID})*)?$`);
 const WORKFLOW = /^\.github\/workflows\/(images|db-deploy)\.ya?ml$/;
 const TAG = 1;
 const VERSION_PREFIX = 2;
@@ -42,7 +45,7 @@ function splitBoolean(expression, operator) {
   let start = 0, depth = 0, quote = '';
   for (let i = 0; i < expression.length; i += 1) {
     const char = expression[i];
-    if (quote) { if (char === quote) quote = ''; continue; }
+    if (quote) { if (char === quote) { quote = ''; } continue; }
     if (char === "'" || char === '"') { quote = char; continue; }
     if (char === '(') depth += 1;
     if (char === ')') depth -= 1;
@@ -56,7 +59,7 @@ function enclosingParentheses(text) {
   let depth = 0, quote = '';
   for (let i = 0; i < text.length - 1; i += 1) {
     const char = text[i];
-    if (quote) { if (char === quote) quote = ''; continue; }
+    if (quote) { if (char === quote) { quote = ''; } continue; }
     if (char === "'" || char === '"') { quote = char; continue; }
     if (char === '(') depth += 1;
     if (char === ')' && --depth === 0) return false;
@@ -79,7 +82,7 @@ function refProof(value) {
   if (typeof value !== 'string') return 0;
   const expression = unwrap(workflowExpression(value));
   const alternatives = splitBoolean(expression, '||');
-  if (alternatives.length > 1) return alternatives.map(refProof).reduce((a, b) => a & b);
+  if (alternatives.length > 1) return alternatives.map(refProof).reduce((a, b) => a & b, RELEASE_REF);
   const conjuncts = splitBoolean(expression, '&&');
   if (conjuncts.length > 1) return conjuncts.map(refProof).reduce((a, b) => a | b, 0);
   if (/^startsWith\(\s*github\.ref\s*,\s*(['"])refs\/tags\/v\1\s*\)$/.test(expression)) return RELEASE_REF;
@@ -109,7 +112,7 @@ function shellTagGuard(step) {
 }
 
 function checkoutPreservesRef(job) {
-  return (job.steps ?? []).filter((step) => /^actions\/checkout@/.test(step.uses ?? '')).every((step) => {
+  return (job.steps ?? []).filter((step) => (step.uses ?? '').startsWith('actions/checkout@')).every((step) => {
     const ref = step.with?.ref;
     return ref === undefined || /^\$\{\{\s*github\.(?:ref|ref_name|sha)\s*\}\}$/.test(String(ref));
   });
@@ -174,7 +177,7 @@ function imageFindings(file, workflow, version) {
   let builds = 0;
   for (const [name, job] of Object.entries(workflow.jobs ?? {})) {
     for (const step of job?.steps ?? []) {
-      if (!/^docker\/build-push-action@/.test(step.uses ?? '')) continue;
+      if (!(step.uses ?? '').startsWith('docker/build-push-action@')) continue;
       builds += 1;
       const guarded = tagOnlyTrigger(workflow) || refProof(job.if) === RELEASE_REF || refProof(step.if) === RELEASE_REF;
       if (!guarded || !checkoutPreservesRef(job) || !imageTagIsRelease(step.with?.tags, version)) findings.push(found(HFS_RELEASE_TAG_MISMATCH, file, `${file} job ${name} must build the checked-out release ref and tag every image with v<package.json version> or github.ref_name under a release-tag guard`, { job: name }));

package/runtime/scripts/hfs/rules/script-hygiene.mjs

@@ -7,16 +7,32 @@ const PLAINTEXT_LOAD = 'HFS_SCRIPT_PLAINTEXT_LOAD';
 const XTRACE = 'HFS_SCRIPT_XTRACE';
 const SERVICE_ROLE = 'HFS_SERVICE_ROLE_SCOPE';
 const SUPABASE_OWNER = 'be.integrations.supabase';
-const SECRET_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$))|\.enc$/iu;
+const SECRET_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/iu;
+const SECRET_NIVO_FILE = /(?:^|\/)\.nivo-lite(?:\/|$)/iu;
+const SECRET_ENC_FILE = /\.enc$/iu;
+const isSecretFile = (file) => SECRET_ENV_FILE.test(file) || SECRET_NIVO_FILE.test(file) || SECRET_ENC_FILE.test(file);
 const EXCLUDED_TREE = /(?:^|\/)(?:node_modules|\.git|\.claude|\.secrets|secrets|tests?|__tests__|docs|coverage|dist|build)(?:\/|$)/u;
 const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
 const SOURCE = /\.(?:[cm]?[jt]sx?|sh|bash|zsh|ksh|ps1|psm1|bat|cmd|py|rb|pl)$/iu;
 const WORKFLOW = /(?:^|\/)\.?(?:github\/)?workflows\/[^/]+\.ya?ml$/u;
 const DELIVERY = /(?:^|\/)(?:deploy|scripts|bin)\//u;
 const DOCKER = /(?:^|\/)(?:Dockerfile(?:\.[^/]*)?|(?:docker-)?compose(?:[.-][^/]*)?\.ya?ml)$/iu;
-const SECRET_REFERENCE = /(?:^|[\s/\\'"`(=])(?:secrets?\.env(?:\.[\w.-]+)?|\.env(?:\.[\w.-]+)?|\.nivo-lite(?:[/\\][\w./\\-]*)?)(?=$|[\s/\\'"`),;])/iu;
+const SECRET_REFERENCE_NAME = /(?:secrets?\.env|\.env)(?:\.[\w.-]+)?/;
+const SECRET_REFERENCE_NIVO = /\.nivo-lite(?:[/\\][\w./\\-]*)?/;
+const SECRET_REFERENCE_BEFORE = /(?:^|[\s/\\'"`(=])/;
+const SECRET_REFERENCE_AFTER = /(?=$|[\s/\\'"`),;])/;
+const SECRET_REFERENCE_SOURCE = `${SECRET_REFERENCE_BEFORE.source}(?:${SECRET_REFERENCE_NAME.source}|${SECRET_REFERENCE_NIVO.source})${SECRET_REFERENCE_AFTER.source}`;
+const SECRET_REFERENCE = new RegExp(SECRET_REFERENCE_SOURCE, 'iu');
 const EXAMPLE_REFERENCE = /(?:secrets?\.env|\.env)\.(?:example|sample|template)(?=$|[^\w.-])/giu;
-const LOAD = /(?:^|[\s;&|('"`])(?:source|cat|tac|less|more|head|tail|grep|egrep|fgrep|awk|gawk|sed|base64|Get-Content|gc|Import-DotEnv|env-cmd|load_dotenv|loadEnvFile|readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|dotenv\s*\.\s*(?:config|parse))\b|\b(?:File|IO)\s*\.\s*(?:read|readlines)\b|\.\s*read_(?:text|bytes)\s*\(|(?:^|[\s;&|])\.[\t ]+|(?<!<)<(?!<)/iu;
+const LOAD_SHELL_COMMAND = /(?:^|[\s;&|('"`])(?:source|cat|tac|less|more|head|tail|grep|egrep|fgrep|awk|gawk|sed|base64)\b/iu;
+const LOAD_WINDOWS_COMMAND = /(?:^|[\s;&|('"`])(?:Get-Content|gc|Import-DotEnv|env-cmd|load_dotenv|loadEnvFile)\b/iu;
+const LOAD_READ_CALL = /(?:^|[\s;&|('"`])(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|dotenv\s*\.\s*(?:config|parse))\b/iu;
+const LOAD_FILE_READ = /\b(?:File|IO)\s*\.\s*(?:read|readlines)\b/iu;
+const LOAD_PYTHON_READ = /\.\s*read_(?:text|bytes)\s*\(/iu;
+const LOAD_DOT_SOURCE = /(?:^|[\s;&|])\.[\t ]+/iu;
+const LOAD_REDIRECT = /(?<!<)<(?!<)/iu;
+const LOAD_PATTERNS = [LOAD_SHELL_COMMAND, LOAD_WINDOWS_COMMAND, LOAD_READ_CALL, LOAD_FILE_READ, LOAD_PYTHON_READ, LOAD_DOT_SOURCE, LOAD_REDIRECT];
+const isLoad = (line) => LOAD_PATTERNS.some((pattern) => pattern.test(line));
 const READ_CALL = /\b(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|load_dotenv|loadEnvFile|dotenv\s*\.\s*(?:config|parse))\s*\(/giu;
 const TRACE_COMMAND = /(?:^|[\s;&|('"`]|#!)(?:set|\/?(?:[\w.-]+\/)*(?:bash|sh|dash|zsh|ksh))\s+/giu;
 const SHELL_OPTIONS = /\bSHELLOPTS\s*=\s*['"]?([^\s;'"]*)/giu;
@@ -26,7 +42,7 @@ const SERVICE_ROLE_NAME = /(?:^|[^a-z0-9])(?:[a-z0-9]+[_-])*service[_-]?role(?:[
 function executableText(text) {
   return text.replace(/\/\*[\s\S]*?\*\//gu, '').split(/\r?\n/u)
     .filter((line) => !/^\s*(?:#(?!!)|\/\/)/u.test(line)).join('\n')
-    .replace(/(?:\\|`)\r?\n/gu, ' ');
+    .replace(/[\\`]\r?\n/gu, ' ');
 }
 
 const hasSecretReference = (text) => SECRET_REFERENCE.test(text.replace(EXAMPLE_REFERENCE, 'example-file'));
@@ -37,7 +53,7 @@ function callArguments(text, from) {
   for (let at = from; at < Math.min(text.length, from + 1024); at += 1) {
     const character = text[at];
     if (character === '\\') { at += 1; continue; }
-    if (quote) { if (character === quote) quote = ''; continue; }
+    if (quote) { if (character === quote) { quote = ''; } continue; }
     if (['\'', '"', '`'].includes(character)) { quote = character; continue; }
     if (character === '(') depth += 1;
     if (character === ')' && --depth === 0) return text.slice(from, at);
@@ -81,7 +97,7 @@ function plaintextLoad(text) {
   const lines = text.split(/\r?\n/u);
   const aliases = secretAliases(lines);
   const secretReference = (value) => hasSecretReference(value) || aliases.some((alias) => alias.test(value));
-  return lines.some((line) => LOAD.test(line) && secretReference(line)) || multilineLoad(text, secretReference) || pythonLoad(text);
+  return lines.some((line) => isLoad(line) && secretReference(line)) || multilineLoad(text, secretReference) || pythonLoad(text);
 }
 
 function tracingOptions(source) {
@@ -120,7 +136,7 @@ function integrationOwns(file, resolver) {
 }
 
 function isSource(file) {
-  if (SECRET_FILE.test(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
+  if (isSecretFile(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
   return SOURCE.test(file) || WORKFLOW.test(file) || DOCKER.test(file)
     || file.endsWith('/package.json') || file === 'package.json'
     || (DELIVERY.test(file) && !/\.[a-z0-9]+$/iu.test(file));

package/runtime/scripts/hfs/rules/stack-tooling.mjs

@@ -13,7 +13,10 @@ const SCRIPTS_DIR = /(?:^|\/)scripts\//;
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
 const SOURCE_FILE = /(?:^|\/)[^/.]+$|\.(?:sh|bash|zsh|mjs|cjs|js|ts|mts|py|ya?ml)$/;
 const TEST_FILE = /\.(?:spec|test)\.[cm]?[jt]s$/;
-const CREDENTIAL_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/)|\.enc$/i;
+const CREDENTIAL_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/i;
+const CREDENTIAL_SECRETS_DIR = /(?:^|\/)secrets\//i;
+const CREDENTIAL_ENC_FILE = /\.enc$/i;
+const isCredentialFile = (file) => CREDENTIAL_ENV_FILE.test(file) || CREDENTIAL_SECRETS_DIR.test(file) || CREDENTIAL_ENC_FILE.test(file);
 const VERB_FILE = /^(render|provision|converge|verify|prune|rollback|release|backup|prepare|doctor|jobs|public)\.(?:mjs|js|cjs|sh)$/;
 const COMMENT_LINE = /^[ \t]*(?:#|\/\/).*$/gm;
 const LINE_CONTINUATION = /\\\r?\n\s*/g;
@@ -57,7 +60,7 @@ function sourceText(file, raw) {
 }
 
 function deploySource(file) {
-  if (MANAGED_WORKFLOW.test(file) || CREDENTIAL_FILE.test(file) || TEST_FILE.test(file)) return false;
+  if (MANAGED_WORKFLOW.test(file) || isCredentialFile(file) || TEST_FILE.test(file)) return false;
   if (PACKAGE_JSON.test(file) || WORKFLOW.test(file)) return true;
   return (DEPLOY_DIR.test(file) || SCRIPTS_DIR.test(file)) && SOURCE_FILE.test(file);
 }

package/runtime/scripts/hfs/rules/stacks-release.mjs

@@ -26,7 +26,7 @@ const DECLARATION = '.starcistacks/application-stacks.yaml';
 const MAX_BYTES = 1024 * 1024;
 const SOURCE = /^(?:be\/)?(?:src|apps)\/.*\.[cm]?[jt]s$/;
 const TEST = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]s$|\/(?:tests|__tests__)\//;
-const SECRET = /(?:^|\/)(?:secrets|\.claude|\.aws|\.codex)(?:\/|$)|(?:^|\/)\.env(?:\.|$)|\.(?:enc|pem|key|p12|pfx)$/i;
+const SECRET = /(?:(?:^|\/)(?:secrets|\.claude|\.aws|\.codex)(?:\/|$))|(?:(?:^|\/)\.env(?:\.|$))|(?:\.(?:enc|pem|key|p12|pfx)$)/i;
 const CLI_ENTRY = /^(?:be\/)?dist\/apps\/cli\/[A-Za-z0-9_./-]+\.(?:js|mjs|cjs)$/;
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());

package/runtime/scripts/hfs/rules/stacks-swarm.mjs

@@ -14,9 +14,9 @@ import { stacksDeploymentFindings } from './stacks-runtime.mjs';
 
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
-const VERSION = /^[1-9][0-9]*$/;
-const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
-const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:^|_)key$/i;
+const VERSION = /^[1-9]\d*$/;
+const VERSIONED_SECRET = /-v[1-9]\d*$/;
+const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:(?:^|_)key$)/i;
 const SOURCE = /^be\/(?:apps|src)\/.*\.[cm]?[jt]sx?$/;
 const TEST_SOURCE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\/tests\//;
 const REALTIME_SOURCE = /^be\/src\/features\/realtime\/[^/]+\//;
@@ -124,7 +124,7 @@ function traefikHosts(rule) {
 function positiveHostCall(prefix) {
   const scopes = [false];
   let pending = false;
-  for (const token of prefix.match(/"[^"]*"|'[^']*'|`[^`]*`|[()!]|[A-Za-z_][A-Za-z_0-9]*|\S/g) ?? []) {
+  for (const token of prefix.match(/"[^"]*"|'[^']*'|`[^`]*`|[()!]|[A-Za-z_]\w*|\S/g) ?? []) {
     if (token === '!') { pending = !pending; continue; }
     if (token === '(') scopes.push(scopes.at(-1) !== pending);
     if (token === ')' && scopes.length > 1) scopes.pop();
@@ -139,7 +139,7 @@ function labelHosts(service, family) {
   if (family === 'traefik' && labels.some(([key, value]) => key === 'traefik.enable' && String(value) === 'false')) return hosts;
   for (const [key, value] of labels) {
     if (family === 'traefik' && key.startsWith('traefik.http.routers.') && key.endsWith('.rule')) hosts.push(...traefikHosts(value));
-    if (family === 'caddy-docker-proxy' && /^caddy(?:_[0-9]+)?$/.test(key)) hosts.push(...String(value).split(/[\s,]+/).map(hostOf).filter(Boolean));
+    if (family === 'caddy-docker-proxy' && /^caddy(?:_\d+)?$/.test(key)) hosts.push(...String(value).split(/[\s,]+/).map(hostOf).filter(Boolean));
   }
   return hosts;
 }
@@ -282,7 +282,7 @@ function positiveMonitor(value) {
   const units = value.match(/[a-z]+/g) ?? [], quantities = value.split(/[a-z]+/);
   if (quantities.pop() !== '' || !units.length) return false;
   return units.every(unit => ['ns', 'us', 'ms', 's', 'm', 'h'].includes(unit))
-    && quantities.every(quantity => /^[0-9]+(?:\.[0-9]+)?$/.test(quantity)) && /[1-9]/.test(value);
+    && quantities.every(quantity => /^\d+(?:\.\d+)?$/.test(quantity)) && /[1-9]/.test(value);
 }
 
 function updatePolicyIssues(id, service, add) {

package/runtime/scripts/hfs/rules/supply-chain.mjs

@@ -32,6 +32,7 @@ function appendShellCommand(commands, state, next) {
 }
 
 function shellLineCommands(line, commands) {
+  /** @type {{quote: string | null, command: string, separator: string | null}} */
   const state = { quote: null, command: '', separator: null };
   for (let i = 0; i < line.length; i++) {
     const char = line[i];
@@ -140,12 +141,12 @@ const provenanceEnabled = (value) => asserted(value) || typeof value === 'string
 
 function imageActionEvidence(step) {
   const action = step.uses ?? '';
-  if (/^docker\/build-push-action@/.test(action)) {
+  if (action.startsWith('docker/build-push-action@')) {
     return { sbom: asserted(step.with?.sbom), provenance: provenanceEnabled(step.with?.provenance) };
   }
   return {
-    sbom: /^actions\/attest-sbom@/.test(action) && Boolean(step.with?.['sbom-path']),
-    provenance: /^actions\/attest-build-provenance@/.test(action) && Boolean(step.with?.['subject-path'] || step.with?.['subject-digest']),
+    sbom: action.startsWith('actions/attest-sbom@') && Boolean(step.with?.['sbom-path']),
+    provenance: action.startsWith('actions/attest-build-provenance@') && Boolean(step.with?.['subject-path'] || step.with?.['subject-digest']),
   };
 }
 

package/runtime/scripts/hfs/rules/unused-symbol-properties.mjs

@@ -14,7 +14,7 @@ function mergeProperty(before, after) {
 /** Every possible spread owner must be known before its property provenance is admitted. */
 function spreadProperty(state, expression, name, seen, resolve) {
   const choices = resolve(state, expression, seen).map(owner => ownerProperty(state, owner, name, seen, resolve));
-  if (!choices.length || choices.some(choice => choice === null)) return null;
+  if (!choices.length || choices.includes(null)) return null;
   return { values: choices.flatMap(choice => choice.values), missing: choices.some(choice => choice.missing) };
 }
 

package/runtime/scripts/hfs/rules/unused-symbol.mjs

@@ -12,7 +12,10 @@ import { returnedExpressions, valuesOf } from './unused-symbol-flow.mjs';
 
 export const HFS_UNUSED_SYMBOL = 'HFS_UNUSED_SYMBOL';
 const SOURCE = /\.[cm]?[jt]sx?$/u;
-const EXCLUDED = /(?:^|\/)(?:node_modules|__generated__|_generated|dist|tests?|__tests__|test-support)\/|(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/u;
+const EXCLUDED_DIR = /(?:^|\/)(?:node_modules|__generated__|_generated|dist|tests?|__tests__|test-support)\//u;
+const EXCLUDED_TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
+const EXCLUDED_DECLARATION_FILE = /\.d\.[cm]?ts$/u;
+const isExcluded = (file) => EXCLUDED_DIR.test(file) || EXCLUDED_TEST_FILE.test(file) || EXCLUDED_DECLARATION_FILE.test(file);
 const CATALOG = /(?:\.messages|\.catalog)\.[cm]?[jt]s$/u;
 const JSON_CATALOG = /(?:^|\/)(?:messages|locales)\/[^/]+\.json$|\.catalog\.json$/u;
 const QUEUE_NAME = /(?:^QUEUE(?:_NAME)?$|_QUEUE(?:_NAME)?$)/u;
@@ -29,7 +32,7 @@ function compilerAt(repoRoot, supplied) {
 function sourceFiles(ts, repoRoot, files) {
   const sources = new Map();
   for (const file of files) {
-    if (!SOURCE.test(file) || EXCLUDED.test(file) || !/(?:^|\/)src\//u.test(file)) continue;
+    if (!SOURCE.test(file) || isExcluded(file) || !/(?:^|\/)src\//u.test(file)) continue;
     const text = readText(repoRoot, file);
     if (text !== null) sources.set(slash(path.resolve(repoRoot, file)), ts.createSourceFile(path.resolve(repoRoot, file), text, ts.ScriptTarget.Latest, true));
   }
@@ -259,7 +262,7 @@ function sourceReads(state, sources) {
 }
 
 function jsonCandidates(state, files) {
-  for (const file of files.filter(file => JSON_CATALOG.test(file) && !EXCLUDED.test(file))) {
+  for (const file of files.filter(file => JSON_CATALOG.test(file) && !isExcluded(file))) {
     let json;
     try { json = JSON.parse(readText(state.repoRoot, file)); } catch { continue; }
     const leaves = (value, prefix = '') => {
@@ -316,7 +319,8 @@ export function unusedSymbolFindings({ repoRoot, files, repo = {}, isRoot = fals
   const findings = new Map();
   for (const candidate of state.candidates) {
     if (candidate.used || candidate.kind === 'catalog key' && catalogRead(state, candidate, liveCodes) || !inScope(candidate.path)) continue;
-    const { used: _used, ...extra } = candidate;
+    const extra = { ...candidate };
+    delete extra.used;
     findings.set(`${candidate.path}:${candidate.name}`, found(HFS_UNUSED_SYMBOL, candidate.path, `${candidate.path} declares unused ${candidate.kind} ${candidate.name}; remove it or read it in production source (declarations, metadata maps and tests do not count).`, extra));
   }
   return [...findings.values(), ...ledgerFindings.filter(finding => inScope(finding.path))].sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.name.localeCompare(b.name));

package/runtime/scripts/hfs/rules/workflow-contexts.mjs

@@ -76,7 +76,7 @@ function expressions(value) {
 
 /** Source markers travel inside parsed scalar expressions, preserving flow maps, quoted keys and repeated values without matching comments. */
 export function workflowContextFindings({ path: file, text }) {
-  const marked = text.replace(/\$\{\{/g, (match, offset) => `${match} __hfs_context_line_${text.slice(0, offset).split('\n').length}__ `);
+  const marked = text.replaceAll('${{', (match, offset) => `${match} __hfs_context_line_${text.slice(0, offset).split('\n').length}__ `);
   const findings = [];
   function inspect(value, keys) {
     const allowed = allowedContexts(keys);

package/runtime/scripts/hfs/sealed-members.mjs

@@ -75,7 +75,7 @@ export function declaredSealedMembers(repoRoot) {
 
 function placeholderValue(key) {
   const generated = randomUUID();
-  if (/DB_URL$/u.test(key)) return `postgresql://app_be:${generated}@db.invalid:5432/app`;
+  if (key.endsWith('_URL') && key.slice(0, -4).endsWith('DB')) return `postgresql://app_be:${generated}@db.invalid:5432/app`;
   if (key.endsWith('_URL')) return `https://example.invalid/${generated}`;
   return generated;
 }

package/runtime/scripts/hfs/secret-bootstrap-crypto.mjs

@@ -22,7 +22,7 @@ function checksumStep(checksum, value) {
 function checksumWords(prefix, words) {
   const codes = [...prefix].map((character) => character.codePointAt(0));
   const expanded = [...codes.map((code) => code >>> 5), 0, ...codes.map((code) => code & 31)];
-  return [...expanded, ...words].reduce(checksumStep, 1);
+  return [...expanded, ...words].reduce((checksum, value) => checksumStep(checksum, value), 1);
 }
 
 function convertBits(input, from, to, pad) {
@@ -163,7 +163,7 @@ function bootstrapEntries(values) {
   const entries = Object.entries(values);
   if (!entries.length) throw new Error('Bootstrap requires at least one value');
   for (const [name, value] of entries) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || name.startsWith('sops_') || name.endsWith('_unencrypted')) {
+    if (!/^[A-Za-z_]\w*$/.test(name) || name.startsWith('sops_') || name.endsWith('_unencrypted')) {
       throw new Error('Bootstrap contains an invalid or reserved dotenv key');
     }
     if (typeof value !== 'string' || !value.length) throw new Error('Bootstrap values must be nonempty strings');

package/runtime/scripts/hfs/secret-files.mjs

@@ -61,7 +61,7 @@ export function privateDirectory(repoRoot, directory) {
   const missing = [];
   for (let at = directory; !fs.existsSync(at); at = path.dirname(at))
     missing.push(at);
-  for (const at of missing.reverse()) fs.mkdirSync(at, { mode: 0o700 });
+  for (const at of missing.toReversed()) fs.mkdirSync(at, { mode: 0o700 });
   for (let at = directory; ; at = path.dirname(at)) {
     const stat = fs.lstatSync(at);
     if (!stat.isDirectory() || stat.isSymbolicLink())

package/runtime/scripts/hfs/secret-sops.mjs

@@ -19,7 +19,7 @@ export function defaultSops(
   env = process.env,
   repoRoot = invocationDir(),
   platform = process.platform,
-  tools,
+  tools = undefined,
 ) {
   const { sops: binary } = publicStorage(() => secretTools(env, tools));
   const selectedEnv = ageIdentityEnv(repoRoot, env, tools);

package/runtime/scripts/hfs/stack-deploy-config.mjs

@@ -176,7 +176,10 @@ function configs(c, block, probe) {
     out.push({ name: entry.name, file: entry.file, env: entry.env });
   });
   const seen = new Set();
-  for (const entry of out) { if (seen.has(entry.name)) c.problem('deploy.configs', `config name ${entry.name} is declared twice`); seen.add(entry.name); }
+  for (const entry of out) {
+    if (seen.has(entry.name)) c.problem('deploy.configs', `config name ${entry.name} is declared twice`);
+    seen.add(entry.name);
+  }
   return out;
 }
 
@@ -242,7 +245,7 @@ function tasks(c, block, services) {
   return out;
 }
 
-const REGISTRY_HOST = /^[a-z0-9][a-z0-9.-]*(?::[0-9]{1,5})?$/u;
+const REGISTRY_HOST = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/u;
 const VISIBILITY = ['public', 'private'];
 
 /** The image registry: host (default ghcr.io) and the visibility the app's packages are meant to have (default public, the canon scaffold writes it and the app owns it afterwards). */

package/runtime/scripts/lib/env.mjs

@@ -15,6 +15,7 @@ export const isSpecRun = (env = process.env) => Boolean(env.NODE_TEST_CONTEXT);
  * would pass red specs from inside a test process. The runner marks the spec files it starts itself, so isSpecRun stays true inside them.
  */
 export function withoutTestRunner(env = process.env) {
-  const { NODE_TEST_CONTEXT: _enclosing, ...rest } = env;
+  const rest = { ...env };
+  delete rest.NODE_TEST_CONTEXT;
   return rest;
 }

package/runtime/scripts/lib/path-key.mjs

@@ -40,9 +40,11 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * `trim` blanks at the ends, `collapse` folds '//' runs to '/', `dot` drops a leading './',
  * `glob` strips a trailing glob ('star': '*'/'**' with their slash, 'double': a '/**' only),
  * `fold` lowercases. A trailing '/' always goes. Null reads as ''.
+ * @param {unknown} p
+ * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {
-  let s = String(p ?? '');
+  let s = p == null ? '' : String(p);
   if (trim) s = s.trim();
   s = slash(s);
   if (collapse) s = s.replace(/\/{2,}/g, '/');

package/runtime/scripts/lib/roots.mjs

@@ -17,10 +17,10 @@
 // directory or from the Work directory name outside this module.
 import fs from 'node:fs';
 import path from 'node:path';
-import { skillRoot, starciLocalRoot, starciSourceRoot } from '../../engine/runtime-root.mjs';
-import { tempRoot } from '../../engine/temp-root.mjs';
+import { skillRoot } from '../../engine/runtime-root.mjs';
 
-export { tempRoot, starciLocalRoot, starciSourceRoot };
+export { tempRoot } from '../../engine/temp-root.mjs';
+export { starciLocalRoot, starciSourceRoot } from '../../engine/runtime-root.mjs';
 
 /** The runtime tree this code runs from. */
 const runtimeTree = skillRoot;

package/runtime/scripts/lib/secret-patterns.mjs

@@ -161,7 +161,7 @@ function readmeBadgeText(text, manifestText) {
     let url;
     try { url = new URL(address); } catch { return image; }
     if (!hosts.has(url.host) || url.username || url.password) return image;
-    const badgePath = url.host === 'codecov.io' ? /\/graph\/badge\.svg$/.test(url.pathname) : url.pathname === '/api/project_badges/measure';
+    const badgePath = url.host === 'codecov.io' ? url.pathname.endsWith('/graph/badge.svg') : url.pathname === '/api/project_badges/measure';
     if (!badgePath) return image;
     const fragment = address.indexOf('#');
     const queryEnd = fragment < 0 ? address.length : fragment;
@@ -173,7 +173,7 @@ function readmeBadgeText(text, manifestText) {
 
 /** Whole-file secret judgement exempts only declared public badge values and preserves original line numbers and every provider shape. */
 export function secretHitsInFile(file, fullText, { manifestText } = {}) {
-  const normalized = file.replace(/\\/g, '/');
+  const normalized = file.replaceAll('\\', '/');
   let text = fullText;
   if (/(?:^|\/)\.starcistacks\/application-stacks\.yaml$/.test(normalized)) text = manifestBadgeText(text);
   if (/(?:^|\/)README\.md$/.test(normalized)) text = readmeBadgeText(text, manifestText);

package/runtime/scripts/lib/swarm-stack.mjs

@@ -4,8 +4,10 @@ import { composeEntries } from './compose-values.mjs';
 import { repositoryOf } from './stack-services.mjs';
 
 const PINNED_IMAGE = /@sha256:[a-f0-9]{64}$/i;
-const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
-const BACKING_IMAGE = /^(?:postgres(?:ql)?|postgresql-repmgr|redis(?:-stack(?:-server)?)?|(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq|mysql(?:-server)?|mongo(?:db)?|mongodb-community-server)$/i;
+const VERSIONED_SECRET = /-v[1-9]\d*$/;
+const BACKING_IMAGE_SQL_AND_CACHE = 'postgres(?:ql)?|postgresql-repmgr|redis(?:-stack(?:-server)?)?|mysql(?:-server)?|mongo(?:db)?|mongodb-community-server';
+const BACKING_IMAGE_BROKERS_AND_OTHERS = '(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq';
+const BACKING_IMAGE = new RegExp(`^(?:${BACKING_IMAGE_SQL_AND_CACHE}|${BACKING_IMAGE_BROKERS_AND_OTHERS})$`, 'i');
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
 const configured = value => Object.keys(mapping(value)).length > 0;