codictator 0.1.2 → 0.2.0

package/dist/features/packs/enforcers/gate-guards.js

@@ -1,6 +1,20 @@
-import { ok, parseJson } from "../../../kernel/index.js";
-import { bindRule, findingFor, readErrorFinding, selectFiles, tunableStringList, } from "./binding.js";
-import { baseEnforcer, loadScopeText, parseMarkerInt, scopeMarkerTexts, } from "./health-measures.js";
+import { ok } from "../../../kernel/index.js";
+import { bindRule, findingFor, tunableStringList, } from "./binding.js";
+import { baseEnforcer, parseMarkerInt, scopeMarkerTexts, } from "./health-measures.js";
+// The marker-driven guards below share one scope loop: bind the rule once,
+// walk the marker reports, and let each guard judge one file's markers. The
+// loop lives here so the resolvers hold only their own verdict and the
+// shared run the duplication gate flags stays in one place.
+function markerGuard(decl, rule, ports, judge) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
+            judge(binding, file, markers, findings);
+        }
+        return findings;
+    }));
+}
 // SPEC §4.6.6 core/agent-assets-present: every required helper must be
 // present; the tunable defaults to knowledge-graph and token-saver (§5.12).
 export function resolveAgentAssetsPresent(decl, rule, ports) {
@@ -9,162 +23,95 @@ export function resolveAgentAssetsPresent(decl, rule, ports) {
         "knowledge-graph",
         "token-saver",
     ];
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
-            const present = new Set((markers.get("helpers") ?? "")
-                .split(",")
-                .map((entry) => entry.trim())
-                .filter((entry) => entry !== ""));
-            const missing = required.filter((name) => !present.has(name));
-            if (missing.length > 0) {
-                findings.push(findingFor(binding, {
-                    path: file,
-                    message: `required helper assets missing: ${missing.join(", ")}`,
-                    vars: { path: file, detail: missing.join(", ") },
-                }));
-            }
+    return markerGuard(decl, rule, ports, (guard, file, markers, findings) => {
+        const present = new Set((markers.get("helpers") ?? "")
+            .split(",")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry !== ""));
+        const missing = required.filter((name) => !present.has(name));
+        if (missing.length > 0) {
+            findings.push(findingFor(guard, {
+                path: file,
+                message: `required helper assets missing: ${missing.join(", ")}`,
+                vars: { path: file, detail: missing.join(", ") },
+            }));
         }
-        return findings;
-    }));
+    });
 }
 // SPEC §9.3 core/perf-budgets: a measured p95 past the declared budget
 // flags; inside the budget stays quiet.
 export function resolvePerfBudgets(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
-            const rawP95 = markers.get("hook-p95-ms") ?? "";
-            const rawBudget = markers.get("budget-ms") ?? "";
-            const p95 = Number.parseFloat(rawP95);
-            const budget = Number.parseFloat(rawBudget);
-            if (Number.isFinite(p95) && Number.isFinite(budget) && p95 > budget) {
-                findings.push(findingFor(binding, {
+    return markerGuard(decl, rule, ports, (guard, file, markers, findings) => {
+        const rawP95 = markers.get("hook-p95-ms") ?? "";
+        const rawBudget = markers.get("budget-ms") ?? "";
+        const p95 = Number.parseFloat(rawP95);
+        const budget = Number.parseFloat(rawBudget);
+        if (Number.isFinite(p95) && Number.isFinite(budget) && p95 > budget) {
+            findings.push(findingFor(guard, {
+                path: file,
+                message: `hook p95 of ${rawP95}ms is over the ${rawBudget}ms budget`,
+                vars: {
                     path: file,
-                    message: `hook p95 of ${rawP95}ms is over the ${rawBudget}ms budget`,
-                    vars: {
-                        path: file,
-                        detail: `hook p95 ${rawP95}ms`,
-                        limit: `${rawBudget}ms`,
-                    },
-                }));
-            }
+                    detail: `hook p95 ${rawP95}ms`,
+                    limit: `${rawBudget}ms`,
+                },
+            }));
         }
-        return findings;
-    }));
+    });
 }
 // SPEC §4.14.2 core/guardrail-manifest: a missing manifest flags.
 export function resolveGuardrailManifest(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
-            const manifest = markers.get("manifest") ?? "";
-            if (manifest === "" || manifest === "missing") {
-                findings.push(findingFor(binding, {
-                    path: file,
-                    message: "guardrail manifest missing",
-                    vars: { path: file, detail: "the guardrail manifest" },
-                }));
-            }
+    return markerGuard(decl, rule, ports, (guard, file, markers, findings) => {
+        const manifest = markers.get("manifest") ?? "";
+        if (manifest === "" || manifest === "missing") {
+            findings.push(findingFor(guard, {
+                path: file,
+                message: "guardrail manifest missing",
+                vars: { path: file, detail: "the guardrail manifest" },
+            }));
         }
-        return findings;
-    }));
+    });
 }
 // SPEC §4.14.2 core/hooks-active: hooks not installed flags.
 export function resolveHooksActive(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
-            const hooks = markers.get("hooks") ?? "";
-            if (hooks === "" || hooks === "not installed") {
-                findings.push(findingFor(binding, {
-                    path: file,
-                    message: "git hooks not installed",
-                    vars: { path: file, detail: "the git hooks" },
-                }));
-            }
-        }
-        return findings;
-    }));
-}
-// SPEC §4.14.2 core/engine-version-match: the declared version must equal
-// the installed engine; a pack ahead of the engine flags.
-export function resolveEngineVersionMatch(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
-            if (file !== "engine.json" && !file.endsWith("/engine.json")) {
-                continue;
-            }
-            const text = await loadScopeText(ports, binding, file, findings);
-            if (text === undefined) {
-                continue;
-            }
-            const parsed = parseJson(text);
-            if (!parsed.ok) {
-                findings.push(readErrorFinding(binding, file, parsed.error, "parse"));
-                continue;
-            }
-            const record = (typeof parsed.value === "object" && parsed.value !== null
-                ? parsed.value
-                : {});
-            const engine = record.engine;
-            const pack = record.pack;
-            if (typeof engine !== "string" || typeof pack !== "string") {
-                continue;
-            }
-            if (engine !== pack) {
-                findings.push(findingFor(binding, {
-                    path: file,
-                    message: `pack version ${pack} does not match the engine ${engine}`,
-                    vars: { path: file, value: engine },
-                }));
-            }
+    return markerGuard(decl, rule, ports, (guard, file, markers, findings) => {
+        const hooks = markers.get("hooks") ?? "";
+        if (hooks === "" || hooks === "not installed") {
+            findings.push(findingFor(guard, {
+                path: file,
+                message: "git hooks not installed",
+                vars: { path: file, detail: "the git hooks" },
+            }));
         }
-        return findings;
-    }));
+    });
 }
 // SPEC §4.3.4 core/waivers-valid: a waiver past the pack's maxWaiverDays
 // (core: 90, §5.12) flags.
 export function resolveWaiversValid(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
-            const days = parseMarkerInt(markers, "waiver-days");
-            const max = parseMarkerInt(markers, "max") ?? 90;
-            if (days !== undefined && days > max) {
-                findings.push(findingFor(binding, {
-                    path: file,
-                    message: `waiver at ${String(days)} days is past the ${String(max)} day bound`,
-                    vars: { path: file, detail: `waiver at ${String(days)} days` },
-                }));
-            }
+    return markerGuard(decl, rule, ports, (guard, file, markers, findings) => {
+        const days = parseMarkerInt(markers, "waiver-days");
+        const max = parseMarkerInt(markers, "max") ?? 90;
+        if (days !== undefined && days > max) {
+            findings.push(findingFor(guard, {
+                path: file,
+                message: `waiver at ${String(days)} days is past the ${String(max)} day bound`,
+                vars: { path: file, detail: `waiver at ${String(days)} days` },
+            }));
         }
-        return findings;
-    }));
+    });
 }
 // SPEC §4.4.7 core/custom-pack-selftest: a changed custom pack whose
 // self-test did not pass flags.
 export function resolveCustomPackSelftest(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
-            const changed = markers.get("changed") ?? "";
-            const tested = markers.get("self-test") ?? "";
-            if (changed === "yes" && tested !== "passed") {
-                findings.push(findingFor(binding, {
-                    path: file,
-                    message: "changed custom pack with no passing self-test",
-                    vars: { path: file, detail: "the changed custom pack" },
-                }));
-            }
+    return markerGuard(decl, rule, ports, (guard, file, markers, findings) => {
+        const changed = markers.get("changed") ?? "";
+        const tested = markers.get("self-test") ?? "";
+        if (changed === "yes" && tested !== "passed") {
+            findings.push(findingFor(guard, {
+                path: file,
+                message: "changed custom pack with no passing self-test",
+                vars: { path: file, detail: "the changed custom pack" },
+            }));
         }
-        return findings;
-    }));
+    });
 }

package/dist/features/packs/enforcers/health-measures.d.ts

@@ -1,4 +1,5 @@
 import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
 import type { CheckContext, Enforcer, Finding } from "../../engine/index.ts";
 import type { PackRule } from "../index.ts";
 import type { EnforcerDecl } from "../manifest.ts";
@@ -16,6 +17,7 @@ export declare function scopeMarkerTexts(ports: Ports, binding: RuleBinding, ctx
     readonly markers: Map<string, string>;
 }>>;
 export declare function baseEnforcer(rule: PackRule, binding: RuleBinding, decl: EnforcerDecl, check: (ctx: CheckContext) => Promise<Array<Finding>>): Enforcer;
+export declare function checkEnforcer(decl: EnforcerDecl, rule: PackRule, check: (binding: RuleBinding, ctx: CheckContext) => Promise<Array<Finding>>): Result<Enforcer>;
 export declare function limitOf(binding: RuleBinding, name: string, fallback: number): number;
 export { isMarkerFile, parseMarkerInt, parseMarkers };
 export declare function isTsFile(path: string): boolean;

package/dist/features/packs/enforcers/health-measures.js

@@ -1,4 +1,5 @@
-import { readErrorFinding, readLossyText, selectFiles, tunableNumber, } from "./binding.js";
+import { ok } from "../../../kernel/index.js";
+import { bindRule, readErrorFinding, readLossyText, selectFiles, tunableNumber, } from "./binding.js";
 import { blankCode } from "./health-lex.js";
 import { extractLiteralSpecifiers } from "./health-lex-imports.js";
 import { isMarkerFile, parseMarkerInt, parseMarkers, } from "./health-markers.js";
@@ -155,6 +156,14 @@ export function baseEnforcer(rule, binding, decl, check) {
         check,
     };
 }
+// SPEC §5.6: the resolver preamble shared by the marker-driven enforcers:
+// one binding, one budget-carrying enforcer, one async check over it. The
+// check receives the binding, so resolvers keep no preamble of their own
+// and the shared run below the duplication floor stays in one place.
+export function checkEnforcer(decl, rule, check) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, (ctx) => check(binding, ctx)));
+}
 export function limitOf(binding, name, fallback) {
     return tunableNumber(binding, name) ?? fallback;
 }

package/dist/features/packs/enforcers/health-refs.d.ts

@@ -1,5 +1,4 @@
-import type { Ports } from "../../../kernel/index.ts";
-import { type Result } from "../../../kernel/index.ts";
+import type { Ports, Result } from "../../../kernel/index.ts";
 import type { Enforcer } from "../../engine/index.ts";
 import type { PackRule } from "../index.ts";
 import type { EnforcerDecl } from "../manifest.ts";

package/dist/features/packs/enforcers/health-refs.js

@@ -1,61 +1,76 @@
-import { ok } from "../../../kernel/index.js";
-import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { findingFor, selectFiles } from "./binding.js";
 import { blankCode } from "./health-lex.js";
-import { baseEnforcer, exportedNamesOf, fileImportsTarget, isEntryFile, isMarkerFile, isTsFile, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
-// SPEC §5.6 core/dead-code: no unused exports or members. The pack
-// measure is an exported name in a non-entry file with no importer.
-export function resolveDeadCode(decl, rule, ports) {
-    const binding = bindRule(rule);
-    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
-        const findings = [];
-        const files = selectFiles(ctx.scope.files, binding.scopeGlobs);
-        const texts = new Map();
-        for (const file of files) {
-            const text = await loadScopeText(ports, binding, file, findings);
-            if (text !== undefined) {
-                texts.set(file, text);
-            }
+import { checkEnforcer, exportedNamesOf, fileImportsTarget, isEntryFile, isMarkerFile, isTsFile, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
+async function loadScopeTexts(ports, binding, files, findings) {
+    const texts = new Map();
+    for (const file of files) {
+        const text = await loadScopeText(ports, binding, file, findings);
+        if (text !== undefined) {
+            texts.set(file, text);
         }
-        for (const file of files) {
-            const text = texts.get(file);
-            if (text === undefined) {
-                continue;
-            }
-            if (isMarkerFile(file)) {
-                const markers = parseMarkers(text);
-                const importers = parseMarkerInt(markers, "importers") ?? 1;
-                const exported = markers.get("exported") ?? "export";
-                if (importers === 0) {
-                    findings.push(findingFor(binding, {
-                        path: file,
-                        line: 1,
-                        message: `unused export ${exported} in ${file}`,
-                        vars: { path: file, line: "1", value: exported },
-                    }));
-                }
-                continue;
-            }
-            if (!isTsFile(file) || isEntryFile(file)) {
-                continue;
-            }
-            const exported = exportedNamesOf(blankCode(text));
-            if (exported.length === 0) {
-                continue;
-            }
-            const imported = [...texts.entries()].some(([other, otherText]) => other !== file &&
-                isTsFile(other) &&
-                fileImportsTarget(otherText, file));
-            if (!imported) {
-                for (const name of exported) {
-                    findings.push(findingFor(binding, {
-                        path: file,
-                        line: 1,
-                        message: `unused export ${name} in ${file}`,
-                        vars: { path: file, line: "1", value: name },
-                    }));
-                }
-            }
+    }
+    return texts;
+}
+function markerDeadCode(binding, file, text) {
+    const markers = parseMarkers(text);
+    const importers = parseMarkerInt(markers, "importers") ?? 1;
+    const exported = markers.get("exported") ?? "export";
+    if (importers !== 0) {
+        return [];
+    }
+    return [
+        findingFor(binding, {
+            path: file,
+            line: 1,
+            message: `unused export ${exported} in ${file}`,
+            vars: { path: file, line: "1", value: exported },
+        }),
+    ];
+}
+function fileIsImported(texts, file) {
+    for (const [other, otherText] of texts.entries()) {
+        if (other !== file &&
+            isTsFile(other) &&
+            fileImportsTarget(otherText, file)) {
+            return true;
         }
-        return findings;
+    }
+    return false;
+}
+function tsDeadCode(binding, file, text, texts) {
+    if (!isTsFile(file) || isEntryFile(file)) {
+        return [];
+    }
+    const exported = exportedNamesOf(blankCode(text));
+    if (exported.length === 0 || fileIsImported(texts, file)) {
+        return [];
+    }
+    return exported.map((name) => findingFor(binding, {
+        path: file,
+        line: 1,
+        message: `unused export ${name} in ${file}`,
+        vars: { path: file, line: "1", value: name },
     }));
 }
+async function deadCodeCheck(ports, binding, ctx) {
+    const findings = [];
+    const files = selectFiles(ctx.scope.files, binding.scopeGlobs);
+    const texts = await loadScopeTexts(ports, binding, files, findings);
+    for (const file of files) {
+        const text = texts.get(file);
+        if (text === undefined) {
+            continue;
+        }
+        if (isMarkerFile(file)) {
+            findings.push(...markerDeadCode(binding, file, text));
+            continue;
+        }
+        findings.push(...tsDeadCode(binding, file, text, texts));
+    }
+    return findings;
+}
+// SPEC §5.6 core/dead-code: no unused exports or members. The pack
+// measure is an exported name in a non-entry file with no importer.
+export function resolveDeadCode(decl, rule, ports) {
+    return checkEnforcer(decl, rule, (binding, ctx) => deadCodeCheck(ports, binding, ctx));
+}

package/dist/features/packs/enforcers/secret-scan.d.ts

@@ -1,22 +1,6 @@
-import { type Ports } from "../../../kernel/index.ts";
-import type { CheckContext, Finding } from "../../engine/index.ts";
+import { type Ports, type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
 import type { PackRule } from "../index.ts";
 import type { EnforcerDecl } from "../manifest.ts";
-export declare function resolveNoSecrets(decl: EnforcerDecl, rule: PackRule, ports: Ports): {
-    ok: true;
-    value: {
-        id: string;
-        kinds: readonly ("compact" | "post-tool" | "pre-tool" | "prompt" | "review" | "scheduled" | "startup")[];
-        budgetMs: number;
-        check: (ctx: CheckContext) => Promise<Array<Finding>>;
-    };
-};
-export declare function resolveNoSecretReads(decl: EnforcerDecl, rule: PackRule, ports: Ports): {
-    ok: true;
-    value: {
-        id: string;
-        kinds: readonly ("compact" | "post-tool" | "pre-tool" | "prompt" | "review" | "scheduled" | "startup")[];
-        budgetMs: number;
-        check: (ctx: CheckContext) => Promise<Array<Finding>>;
-    };
-};
+export declare function resolveNoSecrets(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveNoSecretReads(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/secret-scan.js

@@ -3,8 +3,9 @@
 // redactSecrets, skipping fixture globs; no-secret-reads blocks secret
 // paths themselves and `read:` lines naming one, plus secret reads inside
 // shell sources. Findings carry the rule id the self-test asserts.
-import { analyseShell, isFixturePath, isSecretReadPath, matchDangerousShell, redactSecrets, } from "../../../kernel/index.js";
+import { analyseShell, isFixturePath, isSecretReadPath, matchDangerousShell, ok, redactSecrets, } from "../../../kernel/index.js";
 import { bindRule, findingFor, readErrorFinding, readLossyText, selectFiles, } from "./binding.js";
+import { baseEnforcer } from "./health-measures.js";
 import { extractShellSources } from "./shell-analyse.js";
 function firstDiffLine(before, after) {
     const beforeLines = before.split("\n");
@@ -82,19 +83,11 @@ function scanToolInput(binding, scope) {
 }
 export function resolveNoSecrets(decl, rule, ports) {
     const binding = bindRule(rule);
-    return {
-        ok: true,
-        value: {
-            id: rule.id,
-            kinds: binding.triggers,
-            budgetMs: decl.budgetMs,
-            check: async (ctx) => {
-                const findings = await scanScopeFiles(ports, binding, ctx.scope);
-                findings.push(...scanToolInput(binding, ctx.scope));
-                return findings;
-            },
-        },
-    };
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = await scanScopeFiles(ports, binding, ctx.scope);
+        findings.push(...scanToolInput(binding, ctx.scope));
+        return findings;
+    }));
 }
 function readLineTarget(line) {
     const trimmed = line.trimStart();
@@ -121,59 +114,60 @@ function checkProposedSecretReads(binding, scope) {
     }
     return findings;
 }
+function scanReadLineTargets(binding, file, text, findings) {
+    for (const line of text.split("\n")) {
+        const target = readLineTarget(line);
+        if (target !== undefined && isSecretReadPath(target)) {
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `secret material must not reach the agent context: ${target}`,
+                vars: { path: file },
+            }));
+        }
+    }
+}
+function scanShellSecretReads(binding, file, text, findings) {
+    for (const source of extractShellSources(text, file)) {
+        const parsed = analyseShell(source);
+        if (!parsed.ok) {
+            continue;
+        }
+        for (const violation of matchDangerousShell(parsed.value)) {
+            if (violation.class !== "secret-read") {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `shell command reads secret material in ${file}: ${redactSecrets(violation.raw)}`,
+                vars: { path: file },
+            }));
+        }
+    }
+}
+async function scanFileSecretReads(ports, binding, file, findings) {
+    if (isSecretReadPath(file)) {
+        findings.push(findingFor(binding, {
+            path: file,
+            message: `secret material must not reach the agent context: ${file}`,
+            vars: { path: file },
+        }));
+    }
+    const loaded = await readLossyText(ports.fs, file);
+    if (!loaded.ok) {
+        findings.push(readErrorFinding(binding, file, loaded.error, "read"));
+        return;
+    }
+    scanReadLineTargets(binding, file, loaded.value.text, findings);
+    scanShellSecretReads(binding, file, loaded.value.text, findings);
+}
 export function resolveNoSecretReads(decl, rule, ports) {
     const binding = bindRule(rule);
-    return {
-        ok: true,
-        value: {
-            id: rule.id,
-            kinds: binding.triggers,
-            budgetMs: decl.budgetMs,
-            check: async (ctx) => {
-                const findings = [];
-                for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
-                    if (isSecretReadPath(file)) {
-                        findings.push(findingFor(binding, {
-                            path: file,
-                            message: `secret material must not reach the agent context: ${file}`,
-                            vars: { path: file },
-                        }));
-                    }
-                    const loaded = await readLossyText(ports.fs, file);
-                    if (!loaded.ok) {
-                        findings.push(readErrorFinding(binding, file, loaded.error, "read"));
-                        continue;
-                    }
-                    for (const line of loaded.value.text.split("\n")) {
-                        const target = readLineTarget(line);
-                        if (target !== undefined && isSecretReadPath(target)) {
-                            findings.push(findingFor(binding, {
-                                path: file,
-                                message: `secret material must not reach the agent context: ${target}`,
-                                vars: { path: file },
-                            }));
-                        }
-                    }
-                    for (const source of extractShellSources(loaded.value.text, file)) {
-                        const parsed = analyseShell(source);
-                        if (!parsed.ok) {
-                            continue;
-                        }
-                        for (const violation of matchDangerousShell(parsed.value)) {
-                            if (violation.class !== "secret-read") {
-                                continue;
-                            }
-                            findings.push(findingFor(binding, {
-                                path: file,
-                                message: `shell command reads secret material in ${file}: ${redactSecrets(violation.raw)}`,
-                                vars: { path: file },
-                            }));
-                        }
-                    }
-                }
-                findings.push(...checkProposedSecretReads(binding, ctx.scope));
-                return findings;
-            },
-        },
-    };
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            await scanFileSecretReads(ports, binding, file, findings);
+        }
+        findings.push(...checkProposedSecretReads(binding, ctx.scope));
+        return findings;
+    }));
 }