dsh-config-manager 0.1.39 → 0.1.41

package/lib/security/secret-scanner.js

@@ -7,10 +7,19 @@
  * 判定策略（两级，避免误伤/漏报）：
  *  - 字段名：规范化（小写、去 `_-. ` 分隔符）后做「精确命中 / 敏感后缀 / 敏感前缀」三级匹配；
  *    只剥离**字符串叶值**（对象/数组整体递归，不整块剥离——保证 `credentials: [...]` 状态数组存活）。
- *  - 引用豁免：`apiKeyEnv` 等「只存引用名」字段、以及形如 `DEEPSEEK_API_KEY` 的全大写环境变量名
- *    （`isEnvVarName`）一律保留——值是名字不是秘密。
+ *  - 引用豁免：`apiKeyEnv` 等「只存引用名」字段、形如 `DEEPSEEK_API_KEY` 的全大写环境变量名
+ *    （`isEnvVarName`）以及 `${VAR}` / `{{VAR}}` / `%VAR%` / `$VAR` 模板引用（`isTemplateReference`）
+ *    一律保留——值是名字不是秘密。
  *  - 值形状启发式（规范 §6「不能只根据固定字段判断」）：字段名未命中但值长得像 secret
- *    （sk- / JWT / AKIA / GitHub PAT / PEM 私钥 / Bearer）也剥离；高熵 base64 默认关（误伤率高）。
+ *    （sk- / JWT / AKIA / GitHub PAT / PEM 私钥 / Bearer）也剥离；**示例/占位形态**（含
+ *    your/example/xxx/test/<...> 等占位词的 `sk-your-*`、`Bearer example-*`、JWT 教学串）放行。
+ *  - 两种判定档位（2026-08-21 优化）：
+ *    * 保守档（默认，导出/同步脱敏用）：字段名敏感**即**剥离（值形状优先、引用/env 名豁免）；
+ *    * 宽松档（`literalValueOnly`，市场发布扫描用）：字段名敏感**且**值像真实字面量凭据
+ *      （非占位符 / 非类型词 / 非代码表达式 / 非模板引用 / 非短标识符）才命中——消除
+ *      `"token": "your-token"`、`"token": "${OPENAI_API_KEY}"`、`"Authorization": "Bearer <token>"`
+ *      等「值不是秘密」的误报。
+ *  - 高熵 base64 默认关（误伤率高）。
  *
  * 实现不变量：返回 sanitized 为**全新对象**（不改原数据）；迭代式显式栈（防爆栈）+ 深度上限；
  * 命中记录只含路径与字段名，**值永不外泄**。
@@ -55,6 +64,39 @@ export const SECRET_VALUE_PATTERNS = [
     { name: 'pem-private-key', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----/ },
     { name: 'bearer-token', re: /Bearer [A-Za-z0-9._~+/=-]{8,}/ },
 ];
+/**
+ * 值形状命中片段中的「示例/占位」词：匹配到的片段含其中任一 → 视为示例形态放行。
+ * 覆盖 `sk-your-*`、`sk-example-*`、`sk-test-*`、`Bearer example-*`、`AKIA...EXAMPLE`（AWS 官方示例）、
+ * JWT 教学串（第三段 signature）等；真实随机密钥串几乎不可能包含这些完整单词，安全不回退。
+ */
+const SECRET_SHAPE_PLACEHOLDER_WORDS = [
+    'your', 'their', 'example', 'sample', 'dummy', 'placeholder',
+    'test', 'demo', 'signature', 'secret', 'value', 'xxxx',
+];
+/** 值形状命中是否「示例/占位」形态（含占位词或尖括号包裹）→ 放行 */
+function isExampleSecretShape(matched) {
+    if (/<[^>]+>/.test(matched))
+        return true;
+    const lower = matched.toLowerCase();
+    return SECRET_SHAPE_PLACEHOLDER_WORDS.some((w) => lower.includes(w));
+}
+function matchSecretValuePatternHit(value) {
+    for (const p of SECRET_VALUE_PATTERNS) {
+        const m = p.re.exec(value);
+        if (m !== null)
+            return { name: p.name, matched: m[0] };
+    }
+    return null;
+}
+/** 值是否命中强模式 secret 形状（示例/占位形态 → null；返回命中模式名；未命中返回 null） */
+export function matchSecretValuePattern(value) {
+    const hit = matchSecretValuePatternHit(value);
+    if (hit === null)
+        return null;
+    if (isExampleSecretShape(hit.matched))
+        return null;
+    return hit.name;
+}
 /** 规范化字段名：小写 + 去 `_-. ` 分隔符（用于名单匹配） */
 export function normalizeFieldName(name) {
     return name.toLowerCase().replace(/[^a-z0-9]/g, '');
@@ -63,6 +105,29 @@ export function normalizeFieldName(name) {
 export function isEnvVarName(value) {
     return /^[A-Z][A-Z0-9_]{2,}$/.test(value);
 }
+/** 是否为模板/环境变量引用形态（${VAR} / {{VAR}} / %VAR% / $VAR）→ 值是名字不是秘密。
+ *  注意：文本扫描的 `field: value` 正则用 `[^\s,;}]` 取值，`${...}` / `{{...}}` 的右花括号
+ *  会被截断，因此除完整闭合形态外，也接受「以 ${ / {{ / % 开头、内容全为变量名字符」的截断形态。 */
+export function isTemplateReference(value) {
+    const v = value.trim();
+    // 完整闭合形态
+    if (/^\$\{[A-Za-z0-9_.]+\}$/.test(v))
+        return true;
+    if (/^\{\{[A-Za-z0-9_.]+\}\}$/.test(v))
+        return true;
+    if (/^%[A-Za-z0-9_.]+%$/.test(v))
+        return true;
+    if (/^\$[A-Z][A-Z0-9_]{2,}$/.test(v))
+        return true;
+    // 截断形态（右花括号被取值正则排除）：真实凭据不会以 ${ / {{ / % 开头，放行安全
+    if (/^\$\{[A-Za-z0-9_.]*$/.test(v))
+        return true;
+    if (/^\{\{[A-Za-z0-9_.]*$/.test(v))
+        return true;
+    if (/^%[A-Za-z0-9_.]*$/.test(v))
+        return true;
+    return false;
+}
 /** 字段名是否命中敏感名单（规范化后精确 / 敏感后缀 / 敏感前缀） */
 export function isSensitiveFieldName(field, extra = []) {
     const norm = normalizeFieldName(field);
@@ -79,14 +144,6 @@ export function isReferenceField(field, extra = []) {
     const norm = normalizeFieldName(field);
     return [...DEFAULT_REFERENCE_FIELDS, ...extra].includes(norm);
 }
-/** 值是否命中强模式 secret 形状（返回命中模式名；未命中返回 null） */
-export function matchSecretValuePattern(value) {
-    for (const p of SECRET_VALUE_PATTERNS) {
-        if (p.re.test(value))
-            return p.name;
-    }
-    return null;
-}
 /** 高熵启发式：长 base64/hex 串且 Shannon 熵高（默认关） */
 function isHighEntropySecret(value) {
     if (!/^[A-Za-z0-9+/=_-]{32,}$/.test(value))
@@ -103,11 +160,77 @@ function isHighEntropySecret(value) {
     }
     return entropy > 4.2;
 }
+/* ---------------- 值形态判定（结构化扫描与文本扫描共用） ---------------- */
+/** 占位符 / 示例形态：xxx、your-token、<...>、example、sample、dummy、placeholder、... */
+const PLACEHOLDER_RE = /^(x{3,}|your[-_ ]?[\w]+|their[-_ ]?[\w]+|<[^>]+>|example|examples?|sample|dummy|placeholder|som[e]thing|^\u2026)/i;
+/** 类型/关键字形态（代码声明，如 `authToken: string`、`token: null`） */
+const TYPE_KEYWORD_RE = /^(string|number|boolean|object|array|any|unknown|null|undefined|void|true|false|required|optional)$/i;
+/** 代码表达式/引用形态：值里出现调用/成员访问/引号/运算符/空白等 → 是代码而非字面量密钥 */
+function isCodeExpressionValue(value) {
+    // 方法调用 / 成员访问：data.token、process.env.X、wx.getStorageSync(...)、a.b(...)
+    if (/[.([\]'"`]/.test(value))
+        return true;
+    // 赋值/比较/模板：a=b、a&&b 等
+    if (/[=+*/%<>!&|?]+/.test(value))
+        return true;
+    // 含空白 → 短语/语句而非单个字面量
+    if (/\s/.test(value))
+        return true;
+    return false;
+}
+/** 混合字符长串是否「疑似真实凭据」：含数字、或含字母数字连字符下划线以外的符号、或大小写混合
+ *  （纯小写字母+连字符的示例值如 `abc-def-ghi-jkl` → 放行；`s3cretP@ssw0rd` / `abc123-def456` → 拦截） */
+function looksLikeCredential(value) {
+    if (value.length < 8)
+        return false;
+    if (/[0-9]/.test(value))
+        return true;
+    if (/[^A-Za-z0-9_-]/.test(value))
+        return true;
+    if (/[a-z]/.test(value) && /[A-Z]/.test(value))
+        return true;
+    return false;
+}
+/** 值是否为「字面量密钥」：既不是代码表达式，也不是占位符/类型词/短标识符/环境引用。
+ *  只有字段名敏感 **且** 值像真实字面量凭据时才报告 —— 消除技能文档中
+ *  `authToken: string`、`password: process.env.X`、`token: data.token` 等代码示例误报。 */
+function isLiteralSecretValue(value) {
+    if (value === '')
+        return false;
+    // 值形状强信号（sk- / ghp_ / AKIA / JWT / PEM / Bearer，示例/占位形态已降噪）—— 任何字段都视为真凭据
+    if (matchSecretValuePattern(value) !== null)
+        return true;
+    if (PLACEHOLDER_RE.test(value))
+        return false;
+    if (TYPE_KEYWORD_RE.test(value))
+        return false;
+    if (isCodeExpressionValue(value))
+        return false;
+    if (isEnvVarName(value))
+        return false;
+    if (isTemplateReference(value))
+        return false;
+    // 纯字母数字短标识符（变量名/普通词，如 authToken、data、key）→ 非密钥
+    if (/^[A-Za-z0-9_]+$/.test(value) && value.length < 20)
+        return false;
+    // 其余：混合字符串，仅当像真实凭据（含数字/符号/大小写混合）才疑似
+    return looksLikeCredential(value);
+}
 /** 判定单个「字段名 + 字符串值」：strip | keep（含引用豁免与值形状）
- * 顺序：值形状优先（AKIA 等全大写 secret 形状不能被 env 名豁免误放）→ 引用字段 → env 名 → 字段名。 */
+ * 顺序：值形状优先（AKIA 等全大写 secret 形状不能被 env 名豁免误放）→ 引用字段 → env 名 → 字段名。
+ * 宽松档（literalValueOnly，市场发布）：字段名命中还要求值像真实字面量凭据（非占位/引用/代码）。 */
 function judgeFieldValue(field, value, opts) {
     if (value === '')
         return false;
+    if (opts.literalValueOnly) {
+        // 宽松档（市场发布扫描）：值形状强信号字段无关必拦；字段名敏感 + 值像真实字面量凭据才拦
+        if (opts.valuePatterns && matchSecretValuePattern(value) !== null)
+            return true;
+        if (isSensitiveFieldName(field, opts.extraFieldNames) && isLiteralSecretValue(value))
+            return true;
+        return false;
+    }
+    // 保守档（导出/同步脱敏）：值形状优先 → 引用字段/env 名豁免 → 字段名敏感即剥
     if (opts.valuePatterns && matchSecretValuePattern(value) !== null)
         return true;
     if (isReferenceField(field, opts.extraReferenceFields))
@@ -128,6 +251,7 @@ export function scanAndRedact(data, opts = {}) {
         extraReferenceFields: opts.extraReferenceFields ?? [],
         valuePatterns: opts.valuePatterns ?? true,
         highEntropy: opts.highEntropy ?? false,
+        literalValueOnly: opts.literalValueOnly ?? false,
     };
     const hits = [];
     if (data === null || typeof data !== 'object')
@@ -201,7 +325,11 @@ const FIELD_VALUE_RE = [
     // field: value
     { re: /([A-Za-z0-9_.\-]+)\s*:\s*([^\s,;}]+)/g, json: false },
 ];
-/** 文本级扫描：逐行找「敏感字段名 = 值」与「值形状」命中（只报告，不修改文本） */
+/** 文本级扫描：逐行找「敏感字段名 + 疑似真实字面量凭据」与「值形状」命中（只报告，不修改文本）。
+ *  2026-08-20 优化：字段名命中不再是充分条件 —— 值必须是「非代码引用 / 非占位符 / 非类型词 /
+ *  非短标识符」的字面量，消除技能/代码文档中 `token:`/`password:` 等示例命名的误报；
+ *  2026-08-21 优化：值形状（sk-/ghp_/AKIA/JWT/PEM/Bearer）对示例/占位形态（含 your/example/
+ *  xxx/test/<...> 等占位词）放行；混合字符串需像真实凭据（含数字/符号/大小写混合）才报告。 */
 export function scanText(text, opts = {}) {
     const hits = [];
     const extra = opts.extraFieldNames ?? [];
@@ -219,17 +347,13 @@ export function scanText(text, opts = {}) {
                 const value = m[2];
                 if (!isSensitiveFieldName(field, extra))
                     continue;
-                if (json) {
-                    // JSON 形态下引号内值才报告（引用名豁免由调用方结合场景决定，这里保守报告）
-                    hits.push({ path: linePath, field });
+                // 值必须是「疑似字面量凭据」才报告（消除代码示例/占位符误报）
+                if (!isLiteralSecretValue(value))
                     continue;
-                }
-                if (isEnvVarName(value))
-                    continue; // 引用名不报告
                 hits.push({ path: linePath, field });
             }
         }
-        // 值形状（字段名无关）
+        // 值形状（字段名无关；整行 trim 后匹配 sk-/ghp_/JWT/PEM/Bearer 等强信号，示例形态已降噪）
         if (valuePatterns) {
             const trimmed = line.trim();
             const name = matchSecretValuePattern(trimmed);

package/lib/security/secret-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-scanner.js","sourceRoot":"","sources":["../../src/security/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,WAAW;IACX,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc;IAC5D,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ;IAC3D,YAAY,EAAE,cAAc;IAC5B,2BAA2B;IAC3B,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAC3D,YAAY,EAAE,QAAQ,EAAE,eAAe;CACxC,CAAC;AAEF,mCAAmC;AACnC,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,WAAW,EAAE,YAAY,EAAE,WAAW;IACtC,UAAU,EAAE,gBAAgB,EAAE,iBAAiB;IAC/C,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe;CAC/D,CAAC;AAEF,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAE5F,gDAAgD;AAChD,MAAM,kBAAkB,GAAG;IACzB,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;IACpD,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY;IAC3D,eAAe,EAAE,WAAW;CACpB,CAAC;AAIX,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,sBAAsB,EAAE;IACxD,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,+DAA+D,EAAE;IACpF,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE;IAClD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAC1D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,8BAA8B,EAAE;IAC1D,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,mEAAmE,EAAE;IACpG,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,+BAA+B,EAAE;CAC9D,CAAC;AAeF,uCAAuC;AACvC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,QAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC,GAAG,0BAA0B,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,QAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,wBAAwB,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,KAAK,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,aAAa;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,GAAG,CAAC;AACvB,CAAC;AAED;qEACqE;AACrE,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa,EAAE,IAAwH;IAC7K,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;IACzD,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,OAA6B,EAAE;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAuH;QAC9H,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;KACvC,CAAC;IACF,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,IAAI,YAAY,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEjE,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;IAE5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxC,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,KAAK,SAAS,QAAQ,EAAE,CAAC,CAAC;QACjF,IAAI,GAAG,YAAY,UAAU;YAAE,SAAS;QAExC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAgB,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;oBACtE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,GAAG,CAAC,CAAC;oBACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACf,MAAM,QAAQ,GAAY,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;gBACtE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,GAAG,CAAC,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,MAAM,QAAQ,GAAY,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,gEAAgE;AAEhE,MAAM,cAAc,GAAG;IACrB,iCAAiC;IACjC,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,IAAI,EAAE;IAC3D,cAAc;IACd,EAAE,EAAE,EAAE,sCAAsC,EAAE,IAAI,EAAE,KAAK,EAAE;IAC3D,eAAe;IACf,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,KAAK,EAAE;CACpD,CAAC;AAEX,8CAA8C;AAC9C,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAA6B,EAAE;IACpE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ;QACR,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;YAC1C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACjB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACpB,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,SAAS;gBAClD,IAAI,IAAI,EAAE,CAAC;oBACT,0CAA0C;oBAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrC,SAAS;gBACX,CAAC;gBACD,IAAI,YAAY,CAAC,KAAK,CAAC;oBAAE,SAAS,CAAC,SAAS;gBAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,aAAa;QACb,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,OAA6B,EAAE;IACjE,OAAO;QACL,aAAa,CAAC,IAAa;YACzB,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,QAAQ,CAAC,IAAY;YACnB,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"secret-scanner.js","sourceRoot":"","sources":["../../src/security/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,WAAW;IACX,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc;IAC5D,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ;IAC3D,YAAY,EAAE,cAAc;IAC5B,2BAA2B;IAC3B,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAC3D,YAAY,EAAE,QAAQ,EAAE,eAAe;CACxC,CAAC;AAEF,mCAAmC;AACnC,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,WAAW,EAAE,YAAY,EAAE,WAAW;IACtC,UAAU,EAAE,gBAAgB,EAAE,iBAAiB;IAC/C,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe;CAC/D,CAAC;AAEF,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAE5F,gDAAgD;AAChD,MAAM,kBAAkB,GAAG;IACzB,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;IACpD,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY;IAC3D,eAAe,EAAE,WAAW;CACpB,CAAC;AAIX,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,sBAAsB,EAAE;IACxD,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,+DAA+D,EAAE;IACpF,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE;IAClD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAC1D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,8BAA8B,EAAE;IAC1D,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,mEAAmE,EAAE;IACpG,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,+BAA+B,EAAE;CAC9D,CAAC;AAEF;;;;GAIG;AACH,MAAM,8BAA8B,GAAG;IACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa;IAC5D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;CAC9C,CAAC;AAEX,uCAAuC;AACvC,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAKD,SAAS,0BAA0B,CAAC,KAAa;IAC/C,KAAK,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAsBD,uCAAuC;AACvC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,SAAS;IACT,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,gDAAgD;IAChD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,QAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC,GAAG,0BAA0B,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,QAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,wBAAwB,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,4CAA4C;AAC5C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,aAAa;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,GAAG,CAAC;AACvB,CAAC;AAED,2DAA2D;AAE3D,2EAA2E;AAC3E,MAAM,cAAc,GAAG,mHAAmH,CAAC;AAE3I,yDAAyD;AACzD,MAAM,eAAe,GAAG,sGAAsG,CAAC;AAE/H,qDAAqD;AACrD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,uEAAuE;IACvE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,sBAAsB;IACtB,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,qBAAqB;IACrB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;sFACsF;AACtF,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;iFAEiF;AACjF,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,yEAAyE;IACzE,IAAI,uBAAuB,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,+CAA+C;IAC/C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACrE,oCAAoC;IACpC,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;8DAE8D;AAC9D,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa,EAAE,IAA6I;IAClM,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,+CAA+C;QAC/C,IAAI,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/E,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8CAA8C;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;IACzD,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,OAA6B,EAAE;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAA4I;QACnJ,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE;QACrD,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;QACtC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,KAAK;KACjD,CAAC;IACF,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,IAAI,YAAY,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEjE,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;IAE5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxC,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,KAAK,SAAS,QAAQ,EAAE,CAAC,CAAC;QACjF,IAAI,GAAG,YAAY,UAAU;YAAE,SAAS;QAExC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAgB,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;oBACtE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,GAAG,CAAC,CAAC;oBACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACf,MAAM,QAAQ,GAAY,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;gBACtE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,GAAG,CAAC,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,MAAM,QAAQ,GAAY,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,gEAAgE;AAEhE,MAAM,cAAc,GAAG;IACrB,iCAAiC;IACjC,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,IAAI,EAAE;IAC3D,cAAc;IACd,EAAE,EAAE,EAAE,sCAAsC,EAAE,IAAI,EAAE,KAAK,EAAE;IAC3D,eAAe;IACf,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,KAAK,EAAE;CACpD,CAAC;AAEX;;;;2DAI2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAA6B,EAAE;IACpE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ;QACR,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;YAC1C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACjB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACpB,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,SAAS;gBAClD,iCAAiC;gBACjC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,8DAA8D;QAC9D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,OAA6B,EAAE;IACjE,OAAO;QACL,aAAa,CAAC,IAAa;YACzB,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,QAAQ,CAAC,IAAY;YACnB,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-config-manager",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "DSH Config Manager — backup / export / import / migrate DSH configuration (dual-face Cordis plugin: host engine + web UI). Manifest shape mirrors @linxin666/dsh-ssh@0.1.12.",
   "keywords": [
     "dsh",

package/src/client/common/ConfirmDialog.tsx

@@ -0,0 +1,135 @@
+/**
+ * ConfirmDialog —— 确认弹窗（危险/重要操作的二次确认，DESIGN.md §8.11 / §14）。
+ *
+ * 背景（2026-08-20）：用户要求「删除按钮需要弹窗弹出二次确认」，替代原先的
+ * 「行内两步确认」（已从 DESIGN.md §14 移除，见 t8 设计）。本项目此前无任何
+ * modal / fixed / z-index 元素，本组件是首个浮动层 —— DESIGN.md §15 Anti-pattern #7
+ * 已登记豁免（z-index 100；浮动层必须先设计进 DESIGN.md 的流程满足）。
+ *
+ * 交互约定：
+ * - 受控组件：open=false 时不渲染；open=true 渲染遮罩 + 居中卡片；
+ * - 关闭三途径：遮罩点击（仅 e.target === currentTarget）、Esc 键、取消按钮；
+ * - busy=true（或 onConfirm 返回 Promise 的自管 busy）时禁用一切关闭途径与确认按钮，
+ *   防重复提交；
+ * - 初始焦点在取消按钮（危险确认不默认落破坏性按钮）；关闭后还原焦点到触发按钮
+ *   （open 前的 document.activeElement）；
+ * - 不做完整 focus trap（两按钮场景风险可接受，DESIGN.md §8.11 已注明）。
+ *
+ * 安全：message 由调用方传入（渲染前已 redact 兜底，与全站一致）；本组件不触碰任何凭据。
+ * 样式：全部走 --dsw-* token（遮罩 color-mix 半透明、卡片 bg-layer-2 + border-l1），
+ * 仅新增 dialogMask/dialogCard/dialogHeader/dialogBody 四个类（config-manager.module.css）。
+ */
+import { useEffect, useRef, useState } from 'react'
+import type { ReactNode } from 'react'
+import { Button } from './ui.tsx'
+import css from '../config-manager.module.css'
+
+export interface ConfirmDialogProps {
+  /** 是否打开（受控）；false 时不渲染 */
+  open: boolean
+  /** 标题（如「删除条目」） */
+  title: string
+  /** 正文说明（可选；限高 240px 内滚，长文本安全） */
+  message?: string
+  /** 确认按钮文案（缺省「确认」由调用方传，不设默认避免硬编码） */
+  confirmLabel?: string
+  /** 取消按钮文案（缺省同 confirmLabel 场景由调用方传；不设默认） */
+  cancelLabel?: string
+  /** 危险语义：确认按钮用 danger 样式（删除等不可恢复操作）；缺省 primary */
+  danger?: boolean
+  /** 外部控制 busy（进行中禁闭）；onConfirm 返回 Promise 时组件自管 */
+  busy?: boolean
+  /** 确认回调（返回 Promise 时组件自管 busy 直到完成/失败） */
+  onConfirm: () => void | Promise<void>
+  /** 取消/关闭回调 */
+  onCancel: () => void
+  /** 额外内容（可选；渲染在 message 之后、按钮区之前） */
+  children?: ReactNode
+}
+
+/**
+ * 确认弹窗：遮罩 + 居中卡片 + 标题/正文/按钮区。
+ * 自管 busy：onConfirm 返回 Promise 时置 busy 直到 resolve（reject 仍关闭 busy，错误由调用方处理）。
+ */
+export function ConfirmDialog({
+  open, title, message, confirmLabel, cancelLabel, danger, busy: busyProp, onConfirm, onCancel, children,
+}: ConfirmDialogProps) {
+  const [selfBusy, setSelfBusy] = useState(false)
+  const busy = busyProp === true || selfBusy
+  /** open 前的活动元素（关闭后还原焦点） */
+  const prevFocus = useRef<Element | null>(null)
+  /** 取消按钮 ref（初始焦点） */
+  const cancelRef = useRef<HTMLButtonElement | null>(null)
+
+  // 打开时记录触发元素 + 焦点落到取消按钮；关闭时还原焦点
+  useEffect(() => {
+    if (open) {
+      prevFocus.current = document.activeElement
+      // 下一帧聚焦取消按钮（等渲染完成）
+      requestAnimationFrame(() => { cancelRef.current?.focus() })
+      return
+    }
+    if (prevFocus.current !== null && prevFocus.current instanceof HTMLElement) {
+      prevFocus.current.focus()
+      prevFocus.current = null
+    }
+  }, [open])
+
+  // Esc 关闭（busy 时禁用）
+  useEffect(() => {
+    if (!open || busy) return
+    const onKey = (e: KeyboardEvent): void => {
+      if (e.key === 'Escape') onCancel()
+    }
+    window.addEventListener('keydown', onKey)
+    return () => { window.removeEventListener('keydown', onKey) }
+  }, [open, busy, onCancel])
+
+  if (!open) return null
+
+  const handleConfirm = (): void => {
+    if (busy) return
+    const result = onConfirm()
+    if (result instanceof Promise) {
+      setSelfBusy(true)
+      void result.finally(() => { setSelfBusy(false) })
+    }
+  }
+
+  return (
+    <div
+      className={css.dialogMask}
+      onMouseDown={(e) => {
+        // 仅遮罩自身点击关闭（目标 === 当前遮罩，卡片内的点击不冒泡关闭）
+        if (e.target === e.currentTarget && !busy) onCancel()
+      }}
+    >
+      <div className={css.dialogCard} role="dialog" aria-modal="true" aria-label={title}>
+        <div className={css.dialogHeader}>{title}</div>
+        <div className={css.dialogBody}>
+          {message !== undefined && message !== '' && <div>{message}</div>}
+          {children}
+        </div>
+        <div className={css.actionRow}>
+          <Button
+            variant={danger === true ? 'danger' : 'primary'}
+            disabled={busy}
+            onClick={() => { void handleConfirm() }}
+          >
+            {busy ? '…' : (confirmLabel ?? '')}
+          </Button>
+          {/* 取消按钮用原生 button + ghostButton 类（样式与 Button ghost 一致），以便 ref 聚焦 */}
+          <button
+            ref={cancelRef}
+            type="button"
+            className={css.ghostButton}
+            disabled={busy}
+            onClick={onCancel}
+          >
+            {cancelLabel ?? ''}
+          </button>
+        </div>
+      </div>
+    </div>
+  )
+}

package/src/client/config-manager.module.css

@@ -237,6 +237,16 @@
 
 /* ---------------- 表单 ---------------- */
 
+/* 向导卡片（一键上传 / 更新配置共用）：元素密集，间距比普通卡片略宽
+   （卡片内 10→14px、字段内 5→8px；取值见 DESIGN.md §4.2 spacing scale） */
+.wizardCard {
+  gap: 14px;
+}
+
+.wizardCard .field {
+  gap: 8px;
+}
+
 .field {
   display: flex;
   flex-direction: column;
@@ -998,3 +1008,94 @@
 .aboutAuthor:hover {
   background: var(--dsw-alias-interactive-bg-hover);
 }
+
+/* ---------------- 确认弹窗 ConfirmDialog（DESIGN.md §8.11；项目首个 fixed/z-index 浮动层，
+   §15 Anti-pattern #7 已登记豁免，z-index 100） ---------------- */
+
+/* 遮罩：全屏 fixed + 半透明背景（color-mix 调 token，禁硬编码 rgba）；
+   点击遮罩（非卡片）关闭由组件判断 e.target===currentTarget */
+.dialogMask {
+  position: fixed;
+  inset: 0;
+  z-index: 100;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: color-mix(in srgb, var(--dsw-alias-bg-base) 55%, transparent);
+  padding: 20px;
+}
+
+/* 卡片：与 .card 同 token 体系（bg-layer-2 + border-l1 + radius10），限宽 420px */
+.dialogCard {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  width: min(420px, 100%);
+  max-height: 80vh;
+  padding: 14px;
+  background: var(--dsw-alias-bg-layer-2);
+  border: 1px solid var(--dsw-alias-border-l1);
+  border-radius: 10px;
+  box-shadow: 0 8px 24px color-mix(in srgb, var(--dsw-alias-bg-base) 40%, transparent);
+}
+
+/* 标题：与 .groupLabel 同视觉层级 */
+.dialogHeader {
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+}
+
+/* 正文：限高内滚（长 message 安全，仿 .confirmScroll 模式） */
+.dialogBody {
+  max-height: 240px;
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  font-size: 13px;
+  line-height: 1.6;
+  color: var(--dsw-alias-label-primary);
+  white-space: pre-wrap;
+}
+
+/* ---------------- 操作弹窗（2026-08-21：上传/下载/装回本地搬进弹窗，DESIGN.md §8.12） ---------------- */
+
+/* 宽版卡片：与 .dialogCard 同 token 体系，放宽到 560px（表单/详情内容更长） */
+.dialogWide {
+  width: min(560px, 100%);
+}
+
+/* 弹窗正文（操作弹窗用）：70vh 限高内滚（详情/表单长内容安全，替代 240px 的短版） */
+.dialogBodyScroll {
+  max-height: 70vh;
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  font-size: 13px;
+  line-height: 1.6;
+  color: var(--dsw-alias-label-primary);
+  white-space: normal;
+}
+
+/* 弹窗头部行：标题 + 关闭按钮（操作弹窗） */
+.dialogHeaderRow {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+}
+
+/* 弹窗关闭按钮（×）：ghost 语义、紧凑 */
+.dialogClose {
+  background: none;
+  border: none;
+  padding: 2px 8px;
+  font-size: 16px;
+  line-height: 1;
+  color: var(--dsw-alias-label-secondary);
+  cursor: pointer;
+  border-radius: 6px;
+}
+
+.dialogClose:hover {
+  color: var(--dsw-alias-label-primary);
+  background: var(--dsw-alias-bg-hover);
+}