crewforth 3.1.0 → 3.2.0-rc.1

package/kit/eval/lib/crew-map/parse.mjs

@@ -0,0 +1,305 @@
+// parse.mjs — the four readers the scanner needs, each one a SUBSET written for the files it reads, and each one
+// keeping the line every key came from so a fact can be cited. Node's standard library only.
+//
+// The rule that makes a subset safe: a construct the reader does not understand THROWS (Unsupported). It is never
+// read partly. The scanner turns the throw into a notMeasured entry with the reason, so an unread file is visible
+// instead of looking like a file that said nothing.
+
+export class Unsupported extends Error {}
+
+// ---- JSON with comments and trailing commas (package.json, tsconfig.json, appsettings*.json) ---------------
+// Returns { value, lines } where `lines` maps a key path (keys joined by '\u0000') to the 1-based line of the key.
+export function parseJsonc(text) {
+  let i = 0; let line = 1;
+  const lines = new Map();
+  const ws = () => {
+    for (;;) {
+      const c = text[i];
+      if (c === '\n') { line++; i++; }
+      else if (c === ' ' || c === '\t' || c === '\r' || c === '') i++;
+      else if (c === '/' && text[i + 1] === '/') { while (i < text.length && text[i] !== '\n') i++; }
+      else if (c === '/' && text[i + 1] === '*') {
+        const end = text.indexOf('*/', i + 2);
+        if (end === -1) throw new Unsupported(`unterminated comment at line ${line}`);
+        for (let k = i; k < end; k++) if (text[k] === '\n') line++;
+        i = end + 2;
+      } else return;
+    }
+  };
+  const str = () => {
+    let out = ''; i++;
+    for (;;) {
+      const c = text[i];
+      if (c === undefined || c === '\n') throw new Unsupported(`unterminated string at line ${line}`);
+      if (c === '"') { i++; return out; }
+      if (c === '\\') {
+        const e = text[i + 1];
+        if (e === 'u') { out += String.fromCharCode(parseInt(text.slice(i + 2, i + 6), 16)); i += 6; continue; }
+        out += { n: '\n', t: '\t', r: '\r', b: '\b', f: '\f' }[e] ?? e; i += 2; continue;
+      }
+      out += c; i++;
+    }
+  };
+  const val = (at) => {
+    ws();
+    const c = text[i];
+    if (c === '{') {
+      i++; const o = {};
+      for (;;) {
+        ws();
+        if (text[i] === '}') { i++; return o; }
+        if (text[i] !== '"') throw new Unsupported(`expected a key at line ${line}`);
+        const kl = line; const k = str();
+        lines.set([...at, k].join('\u0000'), kl);
+        ws(); if (text[i] !== ':') throw new Unsupported(`expected ':' at line ${line}`); i++;
+        o[k] = val([...at, k]);
+        ws(); if (text[i] === ',') { i++; continue; }
+        if (text[i] === '}') { i++; return o; }
+        throw new Unsupported(`expected ',' or '}' at line ${line}`);
+      }
+    }
+    if (c === '[') {
+      i++; const a = [];
+      for (;;) {
+        ws();
+        if (text[i] === ']') { i++; return a; }
+        lines.set([...at, String(a.length)].join('\u0000'), line);
+        a.push(val([...at, String(a.length)]));
+        ws(); if (text[i] === ',') { i++; continue; }
+        if (text[i] === ']') { i++; return a; }
+        throw new Unsupported(`expected ',' or ']' at line ${line}`);
+      }
+    }
+    if (c === '"') return str();
+    const m = /^(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/.exec(text.slice(i, i + 64));
+    if (!m) throw new Unsupported(`unexpected character at line ${line}`);
+    i += m[0].length;
+    return JSON.parse(m[0]);
+  };
+  const value = val([]);
+  ws();
+  if (i < text.length) throw new Unsupported(`trailing content at line ${line}`);
+  return { value, lines };
+}
+
+// ---- TOML subset (pyproject.toml) --------------------------------------------------------------------------
+// Tables, dotted table names, key = value with strings, numbers, booleans, arrays (one or many lines) and inline
+// tables of those. Returns a list of { table, key, value, line } in file order. Dates, multi-line strings and
+// array-of-tables are refused.
+export function parseToml(text) {
+  const out = []; let table = '';
+  const src = text.split('\n');
+  for (let n = 0; n < src.length; n++) {
+    let s = src[n].replace(/\r$/, '');
+    const t = s.trim();
+    if (t === '' || t.startsWith('#')) continue;
+    if (t.startsWith('[[')) throw new Unsupported(`array of tables at line ${n + 1}`);
+    const th = /^\[\s*([A-Za-z0-9_.\-"' ]+?)\s*\]\s*(#.*)?$/.exec(t);
+    if (th) { table = th[1].replace(/["' ]/g, ''); continue; }
+    const kv = /^([A-Za-z0-9_.\-"]+)\s*=\s*(.*)$/.exec(t);
+    if (!kv) throw new Unsupported(`unreadable line ${n + 1}`);
+    let rest = kv[2]; const line = n + 1;
+    // An array may continue over several lines: gather until the brackets balance outside strings.
+    while (depth(rest) > 0) {
+      n++;
+      if (n >= src.length) throw new Unsupported(`unterminated array from line ${line}`);
+      rest += '\n' + src[n].replace(/\r$/, '');
+    }
+    const p = { s: rest, i: 0 };
+    const value = tomlValue(p, line);
+    skipTomlWs(p);
+    if (p.i < p.s.length && p.s[p.i] !== '#') throw new Unsupported(`trailing content at line ${line}`);
+    out.push({ table, key: kv[1].replace(/"/g, ''), value, line });
+  }
+  return out;
+}
+function depth(s) {
+  let d = 0; let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) { if (c === '\\' && q === '"') i++; else if (c === q) q = null; continue; }
+    if (c === '"' || c === "'") { if (s.startsWith(c.repeat(3), i)) throw new Unsupported('multi-line string'); q = c; }
+    else if (c === '#') { const nl = s.indexOf('\n', i); if (nl === -1) break; i = nl; }
+    else if (c === '[' || c === '{') d++;
+    else if (c === ']' || c === '}') d--;
+  }
+  return d;
+}
+function skipTomlWs(p) {
+  for (;;) {
+    const c = p.s[p.i];
+    if (c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === ',') p.i++;
+    else if (c === '#' && p.s.slice(p.i).includes('\n')) p.i = p.s.indexOf('\n', p.i) + 1;
+    else return;
+  }
+}
+function tomlValue(p, line) {
+  while (p.s[p.i] === ' ' || p.s[p.i] === '\t') p.i++;
+  const c = p.s[p.i];
+  if (c === '"' || c === "'") {
+    let out = ''; p.i++;
+    for (;;) {
+      const d = p.s[p.i];
+      if (d === undefined || d === '\n') throw new Unsupported(`unterminated string at line ${line}`);
+      if (d === c) { p.i++; return out; }
+      if (d === '\\' && c === '"') { out += p.s[p.i + 1]; p.i += 2; continue; }
+      out += d; p.i++;
+    }
+  }
+  if (c === '[') {
+    p.i++; const a = [];
+    for (;;) { skipTomlWs(p); if (p.s[p.i] === ']') { p.i++; return a; } a.push(tomlValue(p, line)); }
+  }
+  if (c === '{') {
+    p.i++; const o = {};
+    for (;;) {
+      skipTomlWs(p);
+      if (p.s[p.i] === '}') { p.i++; return o; }
+      const m = /^([A-Za-z0-9_\-"]+)\s*=\s*/.exec(p.s.slice(p.i));
+      if (!m) throw new Unsupported(`unreadable inline table at line ${line}`);
+      p.i += m[0].length; o[m[1].replace(/"/g, '')] = tomlValue(p, line);
+    }
+  }
+  const m = /^(true|false|[+-]?\d[\d_]*(?:\.\d+)?)(?=[\s,\]}#]|$)/.exec(p.s.slice(p.i));
+  if (!m) throw new Unsupported(`unsupported value at line ${line}`);
+  p.i += m[0].length;
+  return m[1] === 'true' ? true : m[1] === 'false' ? false : Number(m[1].replace(/_/g, ''));
+}
+
+// ---- YAML subset (docker-compose*.yml, application*.yml) ---------------------------------------------------
+// Block maps and sequences by indentation, plain and quoted scalars, one-line flow sequences, comments. A block
+// scalar (| or >) is kept as an opaque value. Anchors, aliases, merge keys, tags and multi-document files are
+// refused: reading around them would invent structure.
+// A node is { t: 'map', e: [{ k, line, v }] } | { t: 'seq', e: [{ line, v }] } | { t: 'str', v, line }.
+export function parseYaml(text) {
+  const rows = [];
+  const src = text.split('\n');
+  for (let n = 0; n < src.length; n++) {
+    const raw = src[n].replace(/\r$/, '');
+    if (/^\s*(#.*)?$/.test(raw)) continue;
+    if (/^(---|\.\.\.)\s*$/.test(raw)) { if (rows.length) throw new Unsupported(`a second document at line ${n + 1}`); continue; }
+    if (/\t/.test(raw.match(/^\s*/)[0])) throw new Unsupported(`tab indentation at line ${n + 1}`);
+    rows.push({ ind: raw.match(/^ */)[0].length, s: stripComment(raw.trim()), line: n + 1 });
+  }
+  const p = { rows, i: 0 };
+  if (!rows.length) return { t: 'map', e: [] };
+  return yBlock(p, rows[0].ind);
+}
+function stripComment(s) {
+  let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) { if (c === q) q = null; continue; }
+    if (c === '"' || c === "'") { if (i === 0 || /[\s:[,{-]/.test(s[i - 1])) q = c; }
+    else if (c === '#' && (i === 0 || s[i - 1] === ' ')) return s.slice(0, i).trimEnd();
+  }
+  return s;
+}
+function yScalar(s, line) {
+  if (/^[&*!]/.test(s)) throw new Unsupported(`anchor, alias or tag at line ${line}`);
+  if (s.startsWith('[')) {
+    if (!s.endsWith(']')) throw new Unsupported(`multi-line flow sequence at line ${line}`);
+    const inner = s.slice(1, -1).trim();
+    return { t: 'seq', e: inner === '' ? [] : inner.split(',').map((x) => ({ line, v: yScalar(x.trim(), line) })) };
+  }
+  if (s.startsWith('{')) throw new Unsupported(`flow mapping at line ${line}`);
+  if ((s.startsWith('"') && s.endsWith('"') && s.length > 1) || (s.startsWith("'") && s.endsWith("'") && s.length > 1)) return { t: 'str', v: s.slice(1, -1), line };
+  return { t: 'str', v: s, line };
+}
+function keyOf(s) {
+  const m = /^("[^"]*"|'[^']*'|[^\s:"'][^:]*?)\s*:(?:\s+(.*)|$)/.exec(s);
+  if (!m) return null;
+  return { k: m[1].replace(/^["']|["']$/g, ''), rest: m[2] === undefined ? '' : m[2] };
+}
+function yBlock(p, ind) {
+  const first = p.rows[p.i];
+  if (first.s.startsWith('- ') || first.s === '-') {
+    const node = { t: 'seq', e: [] };
+    while (p.i < p.rows.length && p.rows[p.i].ind === ind && (p.rows[p.i].s.startsWith('- ') || p.rows[p.i].s === '-')) {
+      const r = p.rows[p.i]; const rest = r.s === '-' ? '' : r.s.slice(2).trim();
+      if (rest === '') { p.i++; node.e.push({ line: r.line, v: p.i < p.rows.length && p.rows[p.i].ind > ind ? yBlock(p, p.rows[p.i].ind) : { t: 'str', v: '', line: r.line } }); continue; }
+      const kv = keyOf(rest);
+      if (kv) {
+        // "- key: value" opens a map whose first entry sits on the dash line; the rest are indented to the key.
+        p.rows[p.i] = { ind: ind + 2, s: rest, line: r.line };
+        node.e.push({ line: r.line, v: yBlock(p, ind + 2) });
+        continue;
+      }
+      node.e.push({ line: r.line, v: yScalar(rest, r.line) }); p.i++;
+    }
+    return node;
+  }
+  const node = { t: 'map', e: [] };
+  while (p.i < p.rows.length && p.rows[p.i].ind === ind) {
+    const r = p.rows[p.i];
+    if (r.s.startsWith('- ')) break;
+    const kv = keyOf(r.s);
+    if (!kv) throw new Unsupported(`unreadable line ${r.line}`);
+    if (kv.k === '<<') throw new Unsupported(`merge key at line ${r.line}`);
+    p.i++;
+    let v;
+    if (kv.rest === '') {
+      v = p.i < p.rows.length && (p.rows[p.i].ind > ind || (p.rows[p.i].ind === ind && p.rows[p.i].s.startsWith('- ')))
+        ? yBlock(p, p.rows[p.i].ind) : { t: 'str', v: '', line: r.line };
+    } else if (/^[|>][+-]?\d*$/.test(kv.rest)) {
+      while (p.i < p.rows.length && p.rows[p.i].ind > ind) p.i++;
+      v = { t: 'str', v: '', line: r.line, opaque: true };
+    } else v = yScalar(kv.rest, r.line);
+    node.e.push({ k: kv.k, line: r.line, v });
+  }
+  if (p.i < p.rows.length && p.rows[p.i].ind > ind) throw new Unsupported(`unexpected indentation at line ${p.rows[p.i].line}`);
+  return node;
+}
+export const yGet = (node, k) => (node && node.t === 'map' ? node.e.find((x) => x.k === k) : undefined);
+
+// ---- XML, enough for *.csproj, *.props and pom.xml ----------------------------------------------------------
+// Elements with attributes, text and comments. Returns the root { name, attrs, line, children, text }.
+export function parseXml(text) {
+  let i = 0; let line = 1;
+  const root = { name: '#doc', attrs: {}, line: 1, children: [], text: '' };
+  const stack = [root];
+  const adv = (to) => { for (let k = i; k < to; k++) if (text[k] === '\n') line++; i = to; };
+  while (i < text.length) {
+    const lt = text.indexOf('<', i);
+    if (lt === -1) { stack[stack.length - 1].text += text.slice(i); adv(text.length); break; }
+    const top0 = stack[stack.length - 1]; const chunk = text.slice(i, lt);
+    if (top0.textLine === undefined && /\S/.test(chunk)) top0.textLine = line + (chunk.slice(0, chunk.search(/\S/)).match(/\n/g) || []).length;
+    top0.text += chunk; adv(lt);
+    if (text.startsWith('<!--', i)) { const e = text.indexOf('-->', i); if (e === -1) throw new Unsupported(`unterminated comment at line ${line}`); adv(e + 3); continue; }
+    if (text.startsWith('<?', i) || text.startsWith('<!', i)) { const e = text.indexOf('>', i); if (e === -1) throw new Unsupported(`unterminated declaration at line ${line}`); adv(e + 1); continue; }
+    const gt = text.indexOf('>', i);
+    if (gt === -1) throw new Unsupported(`unterminated tag at line ${line}`);
+    const tag = text.slice(i + 1, gt); const at = line;
+    adv(gt + 1);
+    if (tag.startsWith('/')) {
+      const name = tag.slice(1).trim();
+      const top = stack.pop();
+      if (!top || top.name !== name) throw new Unsupported(`</${name}> does not close <${top && top.name}> at line ${at}`);
+      continue;
+    }
+    const self = tag.endsWith('/');
+    const m = /^([\w:.-]+)([\s\S]*?)\/?$/.exec(tag);
+    if (!m) throw new Unsupported(`unreadable tag at line ${at}`);
+    // Each attribute keeps its own line: a tag may span several, and a citation must land where the value is.
+    const attrs = {}; const attrLines = {};
+    const off = 1 + m[1].length;
+    for (const a of m[2].matchAll(/([\w:.-]+)\s*=\s*("([^"]*)"|'([^']*)')/g)) {
+      attrs[a[1]] = a[3] ?? a[4];
+      attrLines[a[1]] = at + (tag.slice(0, off + a.index).match(/\n/g) || []).length;
+    }
+    const el = { name: m[1], attrs, attrLines, line: at, children: [], text: '' };
+    stack[stack.length - 1].children.push(el);
+    if (!self) stack.push(el);
+  }
+  if (stack.length !== 1) throw new Unsupported(`<${stack[stack.length - 1].name}> is never closed`);
+  return root;
+}
+export const xKids = (el, name) => (el ? el.children.filter((c) => c.name === name) : []);
+export const xKid = (el, name) => xKids(el, name)[0];
+export const xText = (el) => (el ? el.text.trim() : '');
+// The line an element's text is on (a value may sit on the line after its tag).
+export const xLine = (el) => (el ? (el.textLine ?? el.line) : 1);
+export function xFind(el, name, out = []) {
+  for (const c of el.children) { if (c.name === name) out.push(c); xFind(c, name, out); }
+  return out;
+}

package/kit/eval/lib/crew-map/project.mjs

@@ -0,0 +1,163 @@
+// project.mjs — what the scanner may read, how it reads it, and how a fact is cited.
+//
+// One listing per run: `git ls-files` when the root is in a work tree (it honours .gitignore, which is what the
+// project itself calls its source), a directory walk otherwise. Every other read happens inside Node, so the cost
+// of a scan does not grow with a process per file — on Git Bash a process is tens of milliseconds.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+// Directories that hold output, dependencies or tool state, never the project's own source. `.claude` is
+// Crewforth itself: its hooks read environment variables the project never defines, and would be reported as missing.
+export const SKIP_DIRS = new Set(['.git', '.hg', '.svn', 'node_modules', 'bower_components', 'bin', 'obj', 'dist', 'build',
+  'out', 'target', 'vendor', '.venv', 'venv', 'env', '__pycache__', '.mypy_cache', '.pytest_cache', '.tox', '.gradle',
+  '.idea', '.vs', '.vscode', '.next', '.nuxt', '.svelte-kit', 'coverage', '.crewforth', '.claude', '.terraform']);
+const MAX_BYTES = 2 * 1024 * 1024;
+
+// Every child process the scanner starts goes through here, so the gate can count them.
+export const spawned = { count: 0 };
+export function run(cmd, args, cwd) {
+  spawned.count++;
+  const r = spawnSync(cmd, args, { cwd, encoding: 'buffer', maxBuffer: 256 * 1024 * 1024, windowsHide: true,
+    env: { ...process.env, GIT_OPTIONAL_LOCKS: '0', LC_ALL: 'C' } });
+  return { ok: r.status === 0 && !r.error, out: r.stdout ? r.stdout.toString('utf8') : '' };
+}
+
+const skipped = (rel) => rel.split('/').some((seg) => SKIP_DIRS.has(seg));
+
+export function openProject(root) {
+  const real = fs.realpathSync(root);
+  let files = null; let commit = null;
+  const git = run('git', ['ls-files', '-co', '--exclude-standard', '-z'], real);
+  if (git.ok) {
+    files = git.out.split('\0').filter((f) => f && !skipped(f)).filter((f) => {
+      try { return fs.lstatSync(path.join(real, f)).isFile(); } catch { return false; }
+    });
+    const head = run('git', ['rev-parse', '--verify', '-q', 'HEAD'], real);
+    if (head.ok && /^[0-9a-f]{40,64}\s*$/.test(head.out)) commit = head.out.trim();
+  } else {
+    files = [];
+    const walk = (dir, rel) => {
+      let names; try { names = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+      for (const d of names) {
+        const r = rel ? `${rel}/${d.name}` : d.name;
+        if (d.isDirectory()) { if (!SKIP_DIRS.has(d.name)) walk(path.join(dir, d.name), r); }
+        else if (d.isFile()) files.push(r);
+      }
+    };
+    walk(real, '');
+  }
+  files = [...new Set(files)].sort();
+  const cache = new Map();
+  const tooBig = [];
+  // { text, lines } or null (unreadable, binary or over the size limit)
+  const read = (rel) => {
+    if (cache.has(rel)) return cache.get(rel);
+    let r = null;
+    try {
+      const abs = path.join(real, rel);
+      const st = fs.statSync(abs);
+      if (st.size > MAX_BYTES) tooBig.push(rel);
+      else {
+        const buf = fs.readFileSync(abs);
+        if (!buf.subarray(0, 8000).includes(0)) {
+          const text = buf.toString('utf8').replace(/^/, '');
+          r = { text, lines: text.split('\n').map((l) => l.replace(/\r$/, '')) };
+        }
+      }
+    } catch { r = null; }
+    cache.set(rel, r);
+    return r;
+  };
+  return { root: real, files, commit, read, tooBig, git: git.ok };
+}
+
+// A citation. `anchor` must be a piece of the cited line (the validator checks it, collapsing whitespace); the
+// scanner always cites the NAME it matched — a package, a key, a route — never a configuration value.
+export function ev(file, line, anchor) {
+  return { file, line, text: String(anchor) };
+}
+// A citation of a file as a whole: the first token of its first line that has something on it. Never the line
+// itself: line 1 of a requirements file is often `--extra-index-url https://user:pass@host`. null when the file
+// has no such line, and then there is nothing to cite.
+export function evFirst(file, lines) {
+  const i = lines.findIndex((l) => /[^\s]/.test(l));
+  if (i < 0) return null;
+  const tok = /^\s*([^\s:@/?#=]+)/.exec(lines[i]);
+  return ev(file, i + 1, tok ? tok[1] : lines[i].trim()[0]);
+}
+export const evKey = (e) => `${e.file}\u0000${String(e.line).padStart(9, '0')}\u0000${e.text}`;
+export function sortEv(list) {
+  const seen = new Set(); const out = [];
+  for (const e of [...list].sort((a, b) => (evKey(a) < evKey(b) ? -1 : evKey(a) > evKey(b) ? 1 : 0))) {
+    const k = evKey(e); if (!seen.has(k)) { seen.add(k); out.push(e); }
+  }
+  return out;
+}
+
+// The 1-based line of the first line in `lines` matching `re` (a RegExp), from `from` (0-based), or 0.
+export function lineOf(lines, re, from = 0) {
+  for (let i = from; i < lines.length; i++) if (re.test(lines[i])) return i + 1;
+  return 0;
+}
+
+// Files whose lines carry configuration VALUES. Their citations keep the key as the anchor and are never given
+// a sha256: a hash of a line like `DB_PASSWORD=hunter2` is an offline oracle for a weak password.
+export function bearsValues(rel) {
+  const b = rel.split('/').pop().toLowerCase();
+  return b.startsWith('.env') || /^appsettings.*\.json$/.test(b) || /^requirements[^/]*\.txt$/.test(b) || ['.npmrc', 'pip.conf', '.pypirc', 'setup.cfg'].includes(b) || /^application.*\.(properties|ya?ml)$/.test(b)
+    || /^(docker-)?compose.*\.ya?ml$/.test(b) || b === 'dockerfile' || b.endsWith('.dockerfile') || /^secrets?\./.test(b);
+}
+
+// A test, a fixture or an example: its routes, URLs and environment reads describe a fake system, not this one.
+export const isTestPath = (rel) => /(^|\/)(tests?|__tests__|spec|specs|fixtures?|e2e|testdata|examples?|[\w-]*-test)(\/|$)|\.(test|spec)\.[\w]+$|(^|\/)test_[^/]*\.py$|_test\.go$|Tests?\.cs$|Tests?\.(java|kt)$/i.test(rel);
+// A host that is this machine or a name reserved for tests and documentation is not an external resource.
+export const isLocalHost = (h) => !h || /^(localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|\[::1\]|::1)(:\d*)?$/.test(h) || /\.(invalid|example|test|localhost)(:\d*)?$/.test(h);
+
+// A line that must not be hashed and a quote that must be cut: credentials in a URL, or a secret pattern.
+export const CRED_URL = /[a-z][a-z0-9+.-]*:\/\/[^/\s@'"`]*@/i;
+const QUERY_SECRET = /[?&][\w.-]*(key|token|secret|sig|signature|password|pwd|auth)[\w.-]*=/i;
+export function risky(text, patterns) {
+  let at = -1;
+  for (const re of [CRED_URL, QUERY_SECRET, ...(patterns || [])]) {
+    const m = re.exec(text); if (m && (at < 0 || m.index < at)) at = m.index;
+  }
+  return at;
+}
+
+// ---- secret masking -----------------------------------------------------------------------------------------
+// A host is the only part of a connection string or URL the map keeps. Credentials are cut off first; then a host
+// that looks like a secret by Crewforth's own scanner patterns is replaced. Without those patterns every host is
+// replaced: a map with fewer names is a smaller loss than one that published a token.
+export function loadSecretPatterns(fromDir) {
+  for (const rel of ['../../../hooks/secret-blocklist.txt', '../../../../hooks/secret-blocklist.txt']) {
+    const f = path.join(fromDir, rel);
+    let text; try { text = fs.readFileSync(f, 'utf8'); } catch { continue; }
+    const out = [];
+    for (const raw of text.split('\n')) {
+      const l = raw.replace(/\r$/, '');
+      if (!l || l.startsWith('#')) continue;
+      const js = l.replace(/\[\[:alnum:\]\]/g, '[A-Za-z0-9]').replace(/\[:alnum:\]/g, 'A-Za-z0-9')
+        .replace(/\[:space:\]/g, '\\s').replace(/\[:alpha:\]/g, 'A-Za-z').replace(/\[:digit:\]/g, '0-9');
+      try { out.push(new RegExp(js)); } catch { /* a pattern JS cannot read is skipped; the rest still apply */ }
+    }
+    if (out.length) return out;
+  }
+  return null;
+}
+
+export const MASK = '[masked]';
+export function makeHostFilter(patterns) {
+  return (raw) => {
+    if (!raw) return null;
+    let h = String(raw).trim().toLowerCase();
+    h = h.replace(/^[a-z][a-z0-9+.-]*:\/\//, '');
+    // Userinfo first: a password may hold '/', '?' or '#', so the authority is only known after the last '@'.
+    if (h.includes('@')) h = h.slice(h.lastIndexOf('@') + 1);
+    h = h.split(/[/?#]/)[0].replace(/:$/, '');
+    if (!/^[a-z0-9.\-[\]]+(:\d+)?$/.test(h) || h === '') return MASK;
+    // Only the host is kept, so only the host is judged: a token elsewhere in the value is never stored.
+    return patterns.some((re) => re.test(h)) ? MASK : h;
+  };
+}

package/kit/eval/lib/crew-map/rules/names.json

@@ -0,0 +1,38 @@
+{
+  "about": "Names the detectors must not misread. Each list says why it exists; a name added here silences a detector for it everywhere, so add only what a platform or a framework provides on its own.",
+  "platformEnv": {
+    "about": "Environment variables a runtime, a shell, a bundler (Vite: MODE, DEV, PROD, SSR, BASE_URL) or a hosting platform sets. Reading one is not a missing configuration key.",
+    "names": ["BASE_URL", "CI", "DEV", "DOTNET_ENVIRONMENT", "ASPNETCORE_ENVIRONMENT", "ASPNETCORE_URLS", "GOPATH", "GOOS", "GOARCH", "HOME", "HOSTNAME",
+      "LANG", "MODE", "NODE_ENV", "PATH", "PORT", "PROD", "PWD", "PYTHONPATH", "SHELL", "SSR", "TEMP", "TMP", "TMPDIR", "TZ", "USER", "USERPROFILE"]
+  },
+  "frameworkConfig": {
+    "about": "Configuration keys (or key prefixes ending in ':' or '.') a framework reads by itself, so code never names them. Not reported as config-unread.",
+    "names": ["AllowedHosts", "Kestrel:", "Logging:", "Serilog:", "ConnectionStrings:", "spring.", "server.", "management.", "logging."]
+  },
+  "nodeBuiltins": {
+    "about": "Node's own modules: an import of one of these is never a dependency. Also matched with a node: prefix.",
+    "names": ["assert", "async_hooks", "buffer", "child_process", "cluster", "console", "constants", "crypto", "dgram", "diagnostics_channel",
+      "dns", "domain", "events", "fs", "http", "http2", "https", "inspector", "module", "net", "os", "path", "perf_hooks", "process",
+      "punycode", "querystring", "readline", "repl", "stream", "string_decoder", "sys", "test", "timers", "tls", "trace_events", "tty",
+      "url", "util", "v8", "vm", "wasi", "worker_threads", "zlib"]
+  },
+  "pythonImportNames": {
+    "about": "A distribution whose import name differs from its package name. Without this an installed package reads as unused and its import as undeclared.",
+    "map": {
+      "beautifulsoup4": "bs4", "pillow": "PIL", "pyyaml": "yaml", "psycopg2-binary": "psycopg2", "python-dotenv": "dotenv",
+      "scikit-learn": "sklearn", "opencv-python": "cv2", "pyjwt": "jwt", "python-dateutil": "dateutil", "mysqlclient": "MySQLdb",
+      "kafka-python": "kafka", "confluent-kafka": "confluent_kafka", "google-cloud-storage": "google", "azure-storage-blob": "azure",
+      "attrs": "attr", "protobuf": "google", "msgpack-python": "msgpack", "typing-extensions": "typing_extensions",
+      "pymupdf": "fitz", "faiss-cpu": "faiss", "faiss-gpu": "faiss", "ffmpeg-python": "ffmpeg", "openai-whisper": "whisper",
+      "python-magic": "magic", "python-docx": "docx", "python-pptx": "pptx", "python-json-logger": "pythonjsonlogger",
+      "pdfminer.six": "pdfminer", "markdown-it-py": "markdown_it", "odfpy": "odf", "lingua-language-detector": "lingua"
+    }
+  },
+  "neverImported": {
+    "about": "Packages that work without an import: a server started from the command line, a database driver named in a connection URL, a pytest plugin, a spaCy model loaded by name, a library another one loads (multipart forms, e-mail validation). Declared and never imported, they are not unused. A '*' matches any run of characters. A node entry names the package whose presence makes it so (react-dom under Next.js).",
+    "python": ["uvicorn", "gunicorn", "hypercorn", "daphne", "uvloop", "httptools", "watchfiles", "aiosqlite", "asyncpg", "psycopg2",
+      "psycopg2-binary", "psycopg-binary", "pymysql", "aiomysql", "mysqlclient", "greenlet", "python-multipart", "email-validator",
+      "pytest-*", "*-core-*-sm", "*-core-*-md", "*-core-*-lg", "*-core-*-trf"],
+    "node": { "react-dom": "next" }
+  }
+}

package/kit/eval/lib/crew-map/rules/packages.json

@@ -0,0 +1,142 @@
+{
+  "about": "A package whose presence in a manifest says the module talks to an external resource. One line per package: the ecosystem, the package name as the manifest spells it, the kind (db | cache | queue | http-api | storage | auth | other) and a label that names the resource. Adding a package is one line here; nothing in scan.mjs changes. Maven names are groupId:artifactId.",
+  "npm": {
+    "pg": ["db", "postgres"],
+    "postgres": ["db", "postgres"],
+    "mysql": ["db", "mysql"],
+    "mysql2": ["db", "mysql"],
+    "mongodb": ["db", "mongodb"],
+    "mongoose": ["db", "mongodb"],
+    "better-sqlite3": ["db", "sqlite"],
+    "sqlite3": ["db", "sqlite"],
+    "@prisma/client": ["db", "prisma"],
+    "redis": ["cache", "redis"],
+    "ioredis": ["cache", "redis"],
+    "memcached": ["cache", "memcached"],
+    "kafkajs": ["queue", "kafka"],
+    "amqplib": ["queue", "rabbitmq"],
+    "bullmq": ["queue", "redis"],
+    "@aws-sdk/client-s3": ["storage", "s3"],
+    "@aws-sdk/client-sqs": ["queue", "sqs"],
+    "@azure/storage-blob": ["storage", "azure-blob"],
+    "@google-cloud/storage": ["storage", "gcs"],
+    "@elastic/elasticsearch": ["db", "elasticsearch"],
+    "firebase-admin": ["auth", "firebase"],
+    "passport": ["auth", "passport"],
+    "jsonwebtoken": ["auth", "jwt"]
+  },
+  "nuget": {
+    "Npgsql": ["db", "postgres"],
+    "Npgsql.EntityFrameworkCore.PostgreSQL": ["db", "postgres"],
+    "Microsoft.EntityFrameworkCore.SqlServer": ["db", "sqlserver"],
+    "Microsoft.Data.SqlClient": ["db", "sqlserver"],
+    "System.Data.SqlClient": ["db", "sqlserver"],
+    "Microsoft.EntityFrameworkCore.Sqlite": ["db", "sqlite"],
+    "Pomelo.EntityFrameworkCore.MySql": ["db", "mysql"],
+    "MySqlConnector": ["db", "mysql"],
+    "MongoDB.Driver": ["db", "mongodb"],
+    "Oracle.ManagedDataAccess.Core": ["db", "oracle"],
+    "StackExchange.Redis": ["cache", "redis"],
+    "Microsoft.Extensions.Caching.StackExchangeRedis": ["cache", "redis"],
+    "Confluent.Kafka": ["queue", "kafka"],
+    "RabbitMQ.Client": ["queue", "rabbitmq"],
+    "MassTransit.RabbitMQ": ["queue", "rabbitmq"],
+    "Azure.Messaging.ServiceBus": ["queue", "azure-service-bus"],
+    "AWSSDK.S3": ["storage", "s3"],
+    "AWSSDK.SQS": ["queue", "sqs"],
+    "Azure.Storage.Blobs": ["storage", "azure-blob"],
+    "Elastic.Clients.Elasticsearch": ["db", "elasticsearch"],
+    "Microsoft.AspNetCore.Authentication.JwtBearer": ["auth", "jwt"],
+    "Microsoft.Identity.Web": ["auth", "entra-id"]
+  },
+  "pypi": {
+    "psycopg": ["db", "postgres"],
+    "psycopg2": ["db", "postgres"],
+    "psycopg2-binary": ["db", "postgres"],
+    "asyncpg": ["db", "postgres"],
+    "pymysql": ["db", "mysql"],
+    "mysqlclient": ["db", "mysql"],
+    "pymongo": ["db", "mongodb"],
+    "motor": ["db", "mongodb"],
+    "sqlalchemy": ["db", "sql"],
+    "redis": ["cache", "redis"],
+    "pymemcache": ["cache", "memcached"],
+    "kafka-python": ["queue", "kafka"],
+    "confluent-kafka": ["queue", "kafka"],
+    "pika": ["queue", "rabbitmq"],
+    "celery": ["queue", "celery"],
+    "boto3": ["storage", "aws"],
+    "azure-storage-blob": ["storage", "azure-blob"],
+    "google-cloud-storage": ["storage", "gcs"],
+    "elasticsearch": ["db", "elasticsearch"],
+    "pyjwt": ["auth", "jwt"]
+  },
+  "go": {
+    "github.com/jackc/pgx/v5": ["db", "postgres"],
+    "github.com/lib/pq": ["db", "postgres"],
+    "github.com/go-sql-driver/mysql": ["db", "mysql"],
+    "go.mongodb.org/mongo-driver": ["db", "mongodb"],
+    "github.com/mattn/go-sqlite3": ["db", "sqlite"],
+    "gorm.io/gorm": ["db", "sql"],
+    "github.com/redis/go-redis/v9": ["cache", "redis"],
+    "github.com/go-redis/redis/v8": ["cache", "redis"],
+    "github.com/segmentio/kafka-go": ["queue", "kafka"],
+    "github.com/IBM/sarama": ["queue", "kafka"],
+    "github.com/rabbitmq/amqp091-go": ["queue", "rabbitmq"],
+    "github.com/nats-io/nats.go": ["queue", "nats"],
+    "github.com/aws/aws-sdk-go-v2/service/s3": ["storage", "s3"],
+    "github.com/golang-jwt/jwt/v5": ["auth", "jwt"]
+  },
+  "maven": {
+    "org.postgresql:postgresql": ["db", "postgres"],
+    "com.mysql:mysql-connector-j": ["db", "mysql"],
+    "mysql:mysql-connector-java": ["db", "mysql"],
+    "com.microsoft.sqlserver:mssql-jdbc": ["db", "sqlserver"],
+    "org.mongodb:mongodb-driver-sync": ["db", "mongodb"],
+    "org.springframework.boot:spring-boot-starter-data-jpa": ["db", "sql"],
+    "org.springframework.boot:spring-boot-starter-data-mongodb": ["db", "mongodb"],
+    "org.springframework.boot:spring-boot-starter-data-redis": ["cache", "redis"],
+    "redis.clients:jedis": ["cache", "redis"],
+    "io.lettuce:lettuce-core": ["cache", "redis"],
+    "org.springframework.kafka:spring-kafka": ["queue", "kafka"],
+    "org.apache.kafka:kafka-clients": ["queue", "kafka"],
+    "org.springframework.boot:spring-boot-starter-amqp": ["queue", "rabbitmq"],
+    "com.rabbitmq:amqp-client": ["queue", "rabbitmq"],
+    "software.amazon.awssdk:s3": ["storage", "s3"],
+    "org.springframework.boot:spring-boot-starter-oauth2-resource-server": ["auth", "oauth2"]
+  },
+  "images": {
+    "about": "A container image (the name before ':' and without a registry) that IS an external resource.",
+    "postgres": ["db", "postgres"],
+    "mysql": ["db", "mysql"],
+    "mariadb": ["db", "mysql"],
+    "mongo": ["db", "mongodb"],
+    "mcr.microsoft.com/mssql/server": ["db", "sqlserver"],
+    "redis": ["cache", "redis"],
+    "memcached": ["cache", "memcached"],
+    "rabbitmq": ["queue", "rabbitmq"],
+    "confluentinc/cp-kafka": ["queue", "kafka"],
+    "bitnami/kafka": ["queue", "kafka"],
+    "nats": ["queue", "nats"],
+    "minio/minio": ["storage", "s3"],
+    "elasticsearch": ["db", "elasticsearch"],
+    "docker.elastic.co/elasticsearch/elasticsearch": ["db", "elasticsearch"],
+    "keycloak/keycloak": ["auth", "keycloak"],
+    "quay.io/keycloak/keycloak": ["auth", "keycloak"]
+  },
+  "schemes": {
+    "about": "The scheme of a connection string or URL value, read only to name the kind. The value itself is never stored.",
+    "postgres": ["db", "postgres"],
+    "postgresql": ["db", "postgres"],
+    "mysql": ["db", "mysql"],
+    "mongodb": ["db", "mongodb"],
+    "mongodb+srv": ["db", "mongodb"],
+    "redis": ["cache", "redis"],
+    "rediss": ["cache", "redis"],
+    "amqp": ["queue", "rabbitmq"],
+    "amqps": ["queue", "rabbitmq"],
+    "kafka": ["queue", "kafka"],
+    "nats": ["queue", "nats"],
+    "s3": ["storage", "s3"]
+  }
+}