finitemonkey 0.1.0-next.18 → 0.1.0-next.19

package/README.es.md

@@ -146,6 +146,7 @@ Generado desde `src/core/footprint.ts`, la lista que los tests exigen al código
 | Escribe | `.finitemonkey/reports/` | Informes de error enmascarados que escribe `doctor --report`, solo cuando se pide. |
 | Envía | `api.github.com` | A través de `gh`, solo si está instalado y con sesión iniciada: el estado del pull request indicado en una tarea y tus pull requests abiertos para la línea de la sesión. El código nunca se sube. |
 | Envía | `127.0.0.1` | Una petición a tu propia app en el puerto que declara la comprobación `runtime`, después de arrancarla o encontrarla en marcha. Nada sale de esta máquina. |
+| Envía | `api.github.com`, `api.stripe.com`, `api.openai.com`, `api.anthropic.com`, `api.digitalocean.com`, `api.cloudflare.com`, `api.asaas.com` | A través de `curl`, solo cuando tú ejecutas `finitemonkey secrets live <proveedor> --env <VARIABLE> --send`: una petición con esa clave a la API del proveedor para ver si aún funciona. Apagado por defecto, nunca lo ejecuta un hook, y el host se muestra antes de enviar nada. |
 <!-- generated:footprint:end -->
 
 ## Preguntas frecuentes

package/README.md

@@ -146,6 +146,7 @@ Generated from `src/core/footprint.ts`, the list the tests hold the code to. No
 | Writes | `.finitemonkey/reports/` | Masked bug reports that `doctor --report` writes, only when asked. |
 | Sends | `api.github.com` | Through `gh`, only when it is installed and logged in: the state of the pull request named in a task, and your open pull requests for the session line. Code is never uploaded. |
 | Sends | `127.0.0.1` | One request to your own app on the port a `runtime` check declares, after starting it or finding it running. Nothing goes past this machine. |
+| Sends | `api.github.com`, `api.stripe.com`, `api.openai.com`, `api.anthropic.com`, `api.digitalocean.com`, `api.cloudflare.com`, `api.asaas.com` | Through `curl`, only when you run `finitemonkey secrets live <provider> --env <VARIABLE> --send` yourself: one request with that key to the provider's API to see whether it still works. Off by default, never run by a hook, and the host is printed before anything is sent. |
 <!-- generated:footprint:end -->
 
 ## FAQ

package/README.pt-BR.md

@@ -146,6 +146,7 @@ Gerado a partir de `src/core/footprint.ts`, a lista que os testes cobram do cód
 | Grava | `.finitemonkey/reports/` | Relatórios de bug mascarados que o `doctor --report` grava, só quando pedido. |
 | Envia | `api.github.com` | Pelo `gh`, só quando ele está instalado e logado: o estado do pull request citado numa tarefa e os seus pull requests abertos para a linha da sessão. Código nunca é enviado. |
 | Envia | `127.0.0.1` | Uma requisição ao seu próprio app na porta que a checagem `runtime` declara, depois de subir o app ou achá-lo rodando. Nada sai desta máquina. |
+| Envia | `api.github.com`, `api.stripe.com`, `api.openai.com`, `api.anthropic.com`, `api.digitalocean.com`, `api.cloudflare.com`, `api.asaas.com` | Pelo `curl`, só quando você roda `finitemonkey secrets live <provedor> --env <VARIAVEL> --send`: uma requisição com aquela chave para a API do provedor para ver se ela ainda funciona. Desligado por padrão, nunca roda por hook, e o host aparece antes de qualquer envio. |
 <!-- generated:footprint:end -->
 
 ## Perguntas frequentes

package/dist/finitemonkey.mjs

@@ -1156,8 +1156,8 @@ var isOwnHandler = (handler) => {
   if (args2.length === 0) return OWN_SHELL.test(`${command} `);
   const hookAt = args2.indexOf("hook");
   if (hookAt < 0) return false;
-  const target = hookAt === 0 ? command : args2[hookAt - 1] ?? "";
-  return OWN_SCRIPT.test(target);
+  const target2 = hookAt === 0 ? command : args2[hookAt - 1] ?? "";
+  return OWN_SCRIPT.test(target2);
 };
 
 // src/install/skill-template.ts
@@ -3356,8 +3356,8 @@ var readRedirect = (cursor, match) => {
   cursor.pos += match[0].length;
   skipBlank(cursor);
   const processSub = peek(cursor) === "(" && op === "<";
-  const target = processSub ? "" : readWord(cursor).text;
-  return { kind: "redirect", op, fd: match[1] ?? "", target, body: void 0 };
+  const target2 = processSub ? "" : readWord(cursor).text;
+  return { kind: "redirect", op, fd: match[1] ?? "", target: target2, body: void 0 };
 };
 var processSubstitution = (cursor) => {
   if (peek(cursor) !== "<" && peek(cursor) !== ">" || peek(cursor, 1) !== "(") return false;
@@ -3536,8 +3536,8 @@ var next = (cursor, tokens, cmd) => {
   if (redirect !== null) {
     cursor.pos += redirect[0].length;
     while (peek(cursor) === " ") cursor.pos += 1;
-    const target = redirect[3] ?? word(cursor, cmd).text;
-    tokens.push({ kind: "redirect", op: redirect[2] ?? ">", fd: redirect[1] ?? "", target, body: void 0 });
+    const target2 = redirect[3] ?? word(cursor, cmd).text;
+    tokens.push({ kind: "redirect", op: redirect[2] ?? ">", fd: redirect[1] ?? "", target: target2, body: void 0 });
     return;
   }
   const op = OPERATORS2.find((candidate) => cursor.text.startsWith(candidate, cursor.pos));
@@ -3759,8 +3759,8 @@ var PS_ENV = /^\$env:([A-Za-z_][A-Za-z0-9_]*)=?(.*)$/is;
 var CHANGES_DIR = /* @__PURE__ */ new Set(["cd", "pushd", "set-location", "push-location"]);
 var lex = (text6, language) => language === "bash" ? lexBash(text6) : lexPowerShell(text6, language === "cmd");
 var isWindowsAbsolute = (path) => /^[A-Za-z]:\//.test(path);
-var joinDir = (current2, target) => {
-  const next2 = toPosixPath(target);
+var joinDir = (current2, target2) => {
+  const next2 = toPosixPath(target2);
   if (next2.startsWith("/") || isWindowsAbsolute(next2) || next2.startsWith("~")) return next2;
   return current2 === void 0 ? posix.normalize(next2) : posix.join(current2, next2);
 };
@@ -3785,8 +3785,8 @@ var track = (words, language, context) => {
   if (assigned !== void 0) context.env = { ...context.env, ...assigned };
   const program = language === "bash" ? words[0] ?? "" : powershellProgram(words[0] ?? "");
   if (!CHANGES_DIR.has(program)) return;
-  const target = words.slice(1).find((word2) => !word2.startsWith("-"));
-  context.dir = target === void 0 || target === "-" ? "~" : joinDir(context.dir, target);
+  const target2 = words.slice(1).find((word2) => !word2.startsWith("-"));
+  context.dir = target2 === void 0 || target2 === "-" ? "~" : joinDir(context.dir, target2);
 };
 var emit = (stage, raw, language, context, collector) => {
   const first = stage.argv[0] ?? "";
@@ -4295,15 +4295,15 @@ var NOT_FROM_PERSON = [
   /\[Subagent hand-back\]/i
 ];
 var comesFromPerson = (prompt) => !NOT_FROM_PERSON.some((pattern) => pattern.test(prompt));
-var toMarker = (verb, target, rest) => {
-  if (!NAME.test(target)) return void 0;
-  if (verb === "trust") return { type: "trust", task: target };
+var toMarker = (verb, target2, rest) => {
+  if (!NAME.test(target2)) return void 0;
+  if (verb === "trust") return { type: "trust", task: target2 };
   if (verb === "allow") {
-    return rest.length >= 3 ? { type: "allow", guard: target.toLowerCase(), reason: rest } : void 0;
+    return rest.length >= 3 ? { type: "allow", guard: target2.toLowerCase(), reason: rest } : void 0;
   }
-  const slash = target.indexOf("/");
-  const task = slash < 0 ? void 0 : target.slice(0, slash);
-  const check2 = slash < 0 ? target : target.slice(slash + 1);
+  const slash = target2.indexOf("/");
+  const task = slash < 0 ? void 0 : target2.slice(0, slash);
+  const check2 = slash < 0 ? target2 : target2.slice(slash + 1);
   if (check2 === "") return void 0;
   return { type: "approve", check: check2, reason: rest, ...task === void 0 || task === "" ? {} : { task } };
 };
@@ -5191,9 +5191,9 @@ var prStatus = (runtime, git, paths, ttlMs = PR_CACHE_TTL_MS) => {
   return { kind: "found", branch, pr: status.pr, localHead: headSha(git) };
 };
 var conflictFiles = (git, base) => {
-  for (const target of [`origin/${base}`, base]) {
-    if (git.out(["rev-parse", "--verify", "-q", `${target}^{commit}`]) === void 0) continue;
-    const result = git.run(["merge-tree", "--write-tree", "--name-only", "--no-messages", target, "HEAD"]);
+  for (const target2 of [`origin/${base}`, base]) {
+    if (git.out(["rev-parse", "--verify", "-q", `${target2}^{commit}`]) === void 0) continue;
+    const result = git.run(["merge-tree", "--write-tree", "--name-only", "--no-messages", target2, "HEAD"]);
     if (result.found && result.exitCode === 1) return parseMergeTreeConflicts(result.stdout);
     if (result.found && result.exitCode === 0) return [];
   }
@@ -6196,7 +6196,17 @@ var en_default = {
   "pause.on": "Gate resumed.",
   "pause.report": "The gate did not check this stop: the person paused it with fm off at {since}.",
   "pause.no_session": "No Claude Code session is recorded for this project yet; start one, then run this again or type `fm off` there.",
-  "pause.error.person_only": "Only the person can pause or resume the gate, and this does not look like their terminal (no TTY, or running inside Claude Code)"
+  "pause.error.person_only": "Only the person can pause or resume the gate, and this does not look like their terminal (no TTY, or running inside Claude Code)",
+  "secrets.incident.runbook": "    runbook: {link}",
+  "secrets.command.live": "Check whether a key still works with its provider (off by default; sends only with --send, and prints the host first)",
+  "secrets.action.live": "send a key to its provider",
+  "secrets.live.dry": "Nothing was sent. With --send, the value of ${variable} would go to {host} ({url}) to check whether the {provider} key still works. Run it yourself, in your own terminal, with --send.",
+  "secrets.live.contacting": "Contacting {host} ({url}) with the key; the value is passed to curl on stdin, never as an argument.",
+  "secrets.live.live": "The key in ${variable} still works at {host} (HTTP {status}). Revoke it now: see the runbook in `finitemonkey secrets incident`.",
+  "secrets.live.rejected": "{host} rejected the key in ${variable} (HTTP {status}): it no longer works.",
+  "secrets.live.unknown": "{host} answered HTTP {status}; that does not say whether the key in ${variable} works. Check it in the provider's console.",
+  "secrets.live.unreachable": "Could not reach {host} with curl, so the key in ${variable} was not checked.",
+  "secrets.live.no_value": "${variable} is empty or not set in this terminal; export it first, nothing was sent"
 };
 
 // src/i18n/es.json
@@ -6757,7 +6767,17 @@ var es_default = {
   "pause.on": "Compuerta reanudada.",
   "pause.report": "La compuerta no revisó esta parada: la persona la pausó con fm off a las {since}.",
   "pause.no_session": "Todavía no hay una sesión de Claude Code registrada en este proyecto; abre una y vuelve a ejecutarlo, o escribe `fm off` allí.",
-  "pause.error.person_only": "Solo la persona puede pausar o reanudar la compuerta, y esto no parece su terminal (sin TTY, o dentro de Claude Code)"
+  "pause.error.person_only": "Solo la persona puede pausar o reanudar la compuerta, y esto no parece su terminal (sin TTY, o dentro de Claude Code)",
+  "secrets.incident.runbook": "    guía: {link}",
+  "secrets.command.live": "Comprueba si una clave aún funciona en su proveedor (apagado por defecto; solo envía con --send y muestra el host antes)",
+  "secrets.action.live": "enviar una clave a su proveedor",
+  "secrets.live.dry": "No se envió nada. Con --send, el valor de ${variable} iría a {host} ({url}) para comprobar si la clave de {provider} aún funciona. Ejecútalo tú, en tu terminal, con --send.",
+  "secrets.live.contacting": "Contactando {host} ({url}) con la clave; el valor va a curl por la entrada estándar, nunca como argumento.",
+  "secrets.live.live": "La clave en ${variable} aún funciona en {host} (HTTP {status}). Revócala ya: mira la guía en `finitemonkey secrets incident`.",
+  "secrets.live.rejected": "{host} rechazó la clave en ${variable} (HTTP {status}): ya no funciona.",
+  "secrets.live.unknown": "{host} respondió HTTP {status}; eso no dice si la clave en ${variable} funciona. Revísala en la consola del proveedor.",
+  "secrets.live.unreachable": "No se pudo llegar a {host} con curl, así que la clave en ${variable} no se comprobó.",
+  "secrets.live.no_value": "${variable} está vacía o no existe en esta terminal; expórtala antes, no se envió nada"
 };
 
 // src/i18n/pt-BR.json
@@ -7318,7 +7338,17 @@ var pt_BR_default = {
   "pause.on": "Portão retomado.",
   "pause.report": "O portão não conferiu esta parada: a pessoa pausou com fm off em {since}.",
   "pause.no_session": "Ainda não há sessão do Claude Code registrada neste projeto; abra uma e rode de novo, ou digite `fm off` nela.",
-  "pause.error.person_only": "Só a pessoa pode pausar ou retomar o portão, e isto não parece o terminal dela (sem TTY, ou rodando dentro do Claude Code)"
+  "pause.error.person_only": "Só a pessoa pode pausar ou retomar o portão, e isto não parece o terminal dela (sem TTY, ou rodando dentro do Claude Code)",
+  "secrets.incident.runbook": "    passo a passo: {link}",
+  "secrets.command.live": "Verifica se uma chave ainda funciona no provedor (desligado por padrão; só envia com --send e mostra o host antes)",
+  "secrets.action.live": "enviar uma chave ao provedor",
+  "secrets.live.dry": "Nada foi enviado. Com --send, o valor de ${variable} iria para {host} ({url}) para ver se a chave {provider} ainda funciona. Rode você mesmo, no seu terminal, com --send.",
+  "secrets.live.contacting": "Contatando {host} ({url}) com a chave; o valor vai para o curl pela entrada padrão, nunca como argumento.",
+  "secrets.live.live": "A chave em ${variable} ainda funciona em {host} (HTTP {status}). Revogue agora: veja o passo a passo em `finitemonkey secrets incident`.",
+  "secrets.live.rejected": "{host} recusou a chave em ${variable} (HTTP {status}): ela não funciona mais.",
+  "secrets.live.unknown": "{host} respondeu HTTP {status}; isso não diz se a chave em ${variable} funciona. Confira no painel do provedor.",
+  "secrets.live.unreachable": "Não deu para alcançar {host} com o curl, então a chave em ${variable} não foi verificada.",
+  "secrets.live.no_value": "${variable} está vazia ou não existe neste terminal; exporte antes, nada foi enviado"
 };
 
 // src/i18n/review.json
@@ -7880,7 +7910,17 @@ var review_default = {
     "pause.on": "machine",
     "pause.report": "machine",
     "pause.no_session": "machine",
-    "pause.error.person_only": "machine"
+    "pause.error.person_only": "machine",
+    "secrets.incident.runbook": "machine",
+    "secrets.command.live": "machine",
+    "secrets.action.live": "machine",
+    "secrets.live.dry": "machine",
+    "secrets.live.contacting": "machine",
+    "secrets.live.live": "machine",
+    "secrets.live.rejected": "machine",
+    "secrets.live.unknown": "machine",
+    "secrets.live.unreachable": "machine",
+    "secrets.live.no_value": "machine"
   },
   es: {
     "command.init.summary": "machine",
@@ -8439,7 +8479,17 @@ var review_default = {
     "pause.on": "machine",
     "pause.report": "machine",
     "pause.no_session": "machine",
-    "pause.error.person_only": "machine"
+    "pause.error.person_only": "machine",
+    "secrets.incident.runbook": "machine",
+    "secrets.command.live": "machine",
+    "secrets.action.live": "machine",
+    "secrets.live.dry": "machine",
+    "secrets.live.contacting": "machine",
+    "secrets.live.live": "machine",
+    "secrets.live.rejected": "machine",
+    "secrets.live.unknown": "machine",
+    "secrets.live.unreachable": "machine",
+    "secrets.live.no_value": "machine"
   }
 };
 
@@ -8736,8 +8786,8 @@ var callersRate = (runtime, paths) => {
     const parsed = line2.trim() === "" ? void 0 : parseJsonObject(line2);
     if (parsed === void 0 || !parsed.ok || !isRecord(parsed.value)) continue;
     const event = parsed.value["event"];
-    const target = event === FLAGGED_EVENT ? flagged : event === RELEASED_EVENT ? released2 : void 0;
-    if (target !== void 0) for (const pair of pairs(parsed.value)) target.add(pair);
+    const target2 = event === FLAGGED_EVENT ? flagged : event === RELEASED_EVENT ? released2 : void 0;
+    if (target2 !== void 0) for (const pair of pairs(parsed.value)) target2.add(pair);
   }
   const total = (/* @__PURE__ */ new Set([...flagged, ...released2])).size;
   const rate = total === 0 ? 0 : released2.size / total;
@@ -8759,13 +8809,13 @@ var JS_EXTENSION = /\.(?:[cm]?[jt]sx?)$/;
 var stripModule = (path) => path.replace(JS_EXTENSION, "").replace(/\/index$/, "");
 var jsSpecifiers = (text6) => [...text6.matchAll(JS_SPECIFIER)].map((match) => match[1] ?? "");
 var jsImports = (callerPath, callerText, origin) => {
-  const target = stripModule(origin);
+  const target2 = stripModule(origin);
   return jsSpecifiers(callerText).some((specifier) => {
     if (specifier.startsWith(".")) {
-      return stripModule(posix2.normalize(posix2.join(posix2.dirname(callerPath), specifier))) === target;
+      return stripModule(posix2.normalize(posix2.join(posix2.dirname(callerPath), specifier))) === target2;
     }
     const bare = stripModule(specifier.replace(/^[@~#]\//, ""));
-    return target === bare || target.endsWith(`/${bare}`);
+    return target2 === bare || target2.endsWith(`/${bare}`);
   });
 };
 var pyImports = (callerText, origin) => {
@@ -10283,13 +10333,13 @@ var MAX_FILE_BYTES = 2 * 1024 * 1024;
 var SKIPPED = /(?:^|\/)(?:\.git|node_modules|\.finitemonkey)\//;
 var DIFF_FLAGS = ["-U0", "--no-color", "--no-ext-diff", "--no-renames"];
 var binary = (text6) => text6.slice(0, 8e3).includes("\0");
-var listed2 = (runtime, root, target) => {
-  const git = runtime.git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", target], root);
+var listed2 = (runtime, root, target2) => {
+  const git = runtime.git(["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", target2], root);
   if (git.ok)
     return accept(
       git.stdout.split("\0").filter((name) => name !== "").map(toPosixPath)
     );
-  const base = toAbsolutePath(target, root);
+  const base = toAbsolutePath(target2, root);
   const walked = runtime.walkFiles(base);
   if (!walked.ok) return walked;
   return accept(walked.value.map((name) => toPosixPath(relative4(root, join20(base, toPosixPath(name))))));
@@ -10299,8 +10349,8 @@ var scanFile = (runtime, root, file) => {
   if (!text6.ok || text6.value.length > MAX_FILE_BYTES || binary(text6.value)) return [];
   return scanText(text6.value, { path: file }).map((finding3) => locate(finding3, file, finding3.line));
 };
-var scanPath = (runtime, root, target) => {
-  const files = listed2(runtime, root, target);
+var scanPath = (runtime, root, target2) => {
+  const files = listed2(runtime, root, target2);
   if (!files.ok) return files;
   return accept(files.value.filter((file) => !SKIPPED.test(file)).flatMap((file) => scanFile(runtime, root, file)));
 };
@@ -11320,7 +11370,7 @@ var integrationRefs = (runtime, root, defaultBranch) => [`refs/heads/${defaultBr
 var contained = (runtime, root, branch, targets2) => {
   const tip = line(runtime, root, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]);
   if (tip === void 0) return true;
-  return targets2.filter((target) => target !== `refs/heads/${branch}`).some((target) => runtime.git(["merge-base", "--is-ancestor", tip, target], root).ok);
+  return targets2.filter((target2) => target2 !== `refs/heads/${branch}`).some((target2) => runtime.git(["merge-base", "--is-ancestor", tip, target2], root).ok);
 };
 var shared = (runtime, root, upstream, base) => {
   if (upstream === void 0 || !refExists(runtime, root, upstream.remoteRef)) return false;
@@ -12069,7 +12119,7 @@ var loadProdTargets = (runtime, root, config) => {
 var isProdContext = (name, declared) => declared.includes(name) || /(?:^|[-_.:/])(?:prod|production)(?:$|[-_.:/])/i.test(name);
 
 // src/prod/classify.ts
-var hit2 = (effect, target, tool) => ({ effect, target, tool });
+var hit2 = (effect, target2, tool) => ({ effect, target: target2, tool });
 var sshHit = (command, isProd) => {
   const call = parseSsh(command);
   if (call === void 0 || !isProd(call.destination)) return void 0;
@@ -12105,9 +12155,9 @@ var dockerHit = (command, targets2, isProd) => {
     return hit2("effect", switching, "docker context");
   const prodHost = remote !== void 0 && isProd(remote) ? hostKey(remote) : void 0;
   const prodContext = context !== void 0 && isProdContext(context, targets2.dockerContexts) ? context : void 0;
-  const target = prodHost ?? prodContext;
-  if (target === void 0) return void 0;
-  return hit2(dockerReadOnly(command.args) ? "read" : "effect", target, "docker");
+  const target2 = prodHost ?? prodContext;
+  if (target2 === void 0) return void 0;
+  return hit2(dockerReadOnly(command.args) ? "read" : "effect", target2, "docker");
 };
 var kubeHit = (command, targets2) => {
   const context = valueAfter(command.args, "--context", "--kube-context");
@@ -12792,8 +12842,8 @@ var pushDestinations = (parsed, facts) => {
     return [facts.upstream(current2)?.branch ?? current2];
   }
   return refspecs.flatMap((refspec) => {
-    const target = refspecTarget(refspec, current2);
-    return target === void 0 ? [] : [target];
+    const target2 = refspecTarget(refspec, current2);
+    return target2 === void 0 ? [] : [target2];
   });
 };
 var leaseVerdict = (parsed, facts) => {
@@ -12973,8 +13023,8 @@ var guardGitCommand = (context, command, depth = 0) => {
   if (repo === void 0) return [];
   const facts = withChain(context.facts?.(repo) ?? repoFacts(context.runtime, repo), context.chain);
   const expanded = expandAlias(context.runtime, repo, invocation);
-  const target = switchTarget(expanded, facts);
-  if (target !== void 0 && context.chain !== void 0) context.chain.branch = target;
+  const target2 = switchTarget(expanded, facts);
+  if (target2 !== void 0 && context.chain !== void 0) context.chain.branch = target2;
   const nested = depth < MAX_ALIAS_DEPTH ? shellAliasCommands(expanded, context.runtime, repo).flatMap(
     (inner) => guardGitCommand(context, inner, depth + 1)
   ) : [];
@@ -13011,11 +13061,11 @@ var removalTargets = (command) => {
   if (command.program === "remove-item") return powershellTargets(command);
   return void 0;
 };
-var globBase = (target) => {
-  const at = target.search(GLOB2);
-  if (at < 0) return target;
-  const slash = target.lastIndexOf("/", at);
-  return slash < 0 ? "." : target.slice(0, slash) || "/";
+var globBase = (target2) => {
+  const at = target2.search(GLOB2);
+  if (at < 0) return target2;
+  const slash = target2.lastIndexOf("/", at);
+  return slash < 0 ? "." : target2.slice(0, slash) || "/";
 };
 var containsGitDir = (runtime, path) => runtime.stat(toAbsolutePath(resolveFrom(path, ".git"))) !== void 0;
 var targetVerdict = (runtime, context, command, raw) => {
@@ -13035,8 +13085,8 @@ var targetVerdict = (runtime, context, command, raw) => {
 var rmVerdict = (runtime, context, command) => {
   const targets2 = removalTargets(command);
   if (targets2 === void 0) return PASS;
-  for (const target of targets2) {
-    const verdict = targetVerdict(runtime, context, command, target);
+  for (const target2 of targets2) {
+    const verdict = targetVerdict(runtime, context, command, target2);
     if (verdict.kind === "block") return verdict;
   }
   return PASS;
@@ -13099,7 +13149,7 @@ var appendJournal = (runtime, root, entry2) => {
 
 // src/git/snapshot.ts
 var BACKUP_PREFIX = "refs/finitemonkey/backup/";
-var DEFAULT_SNAPSHOT_TIMEOUT_MS = 2500;
+var DEFAULT_SNAPSHOT_TIMEOUT_MS = 5e3;
 var stampOf = (iso) => iso.replace(/[:.]/g, "-");
 var slug = (op) => op.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "manual";
 var optionalLine = (runtime, repo, args2) => {
@@ -13574,12 +13624,12 @@ var sourceOf = (value, isFile, segment, heredocs) => {
   const piped = segment.args.map((arg) => heredocIn(arg, heredocs)).find((text6) => text6 !== void 0);
   return { kind: "inline", text: piped ?? "" };
 };
-var collect3 = (target, segment, args2, spec2, heredocs) => {
+var collect3 = (target2, segment, args2, spec2, heredocs) => {
   const values = flagValues(args2, spec2);
   if (values.length === 0) return void 0;
   const title = values.find((item) => spec2.title.includes(item.flag));
   const bodies = values.filter((item) => !spec2.title.includes(item.flag)).map((item) => sourceOf(item.value, spec2.file.includes(item.flag), segment, heredocs));
-  return { target, title: title === void 0 ? void 0 : sourceOf(title.value, false, segment, heredocs), bodies };
+  return { target: target2, title: title === void 0 ? void 0 : sourceOf(title.value, false, segment, heredocs), bodies };
 };
 var gitSubcommand = (args2) => {
   let index = 0;
@@ -13798,7 +13848,7 @@ var READERS = /* @__PURE__ */ new Set([
   "dotenv"
 ]);
 var SECRET_NAME = /(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PASS|PWD|CREDENTIAL)/i;
-var PERSON_ONLY = /\b(?:finitemonkey|fm)(?:\.mjs)?\s+secrets\s+(?:accept\b|incident\s+(?:rotated|close)\b)/;
+var PERSON_ONLY = /\b(?:finitemonkey|fm)(?:\.mjs)?\s+secrets\s+(?:accept\b|incident\s+(?:rotated|close)\b|live\b[^;&|\n]*\s--send\b)/;
 var LISTS_ENV = /* @__PURE__ */ new Set(["get-childitem", "gci", "dir", "ls"]);
 var onlyFlags = (args2) => args2.every((arg) => arg.startsWith("-"));
 var readTarget = (segment) => {
@@ -13824,8 +13874,8 @@ var bashFindings = (command, segments) => {
   const person = PERSON_ONLY.exec(command);
   if (person !== null) return [{ kind: "person-only", command: person[0] }];
   return segments.flatMap((segment) => {
-    const target = readTarget(segment);
-    if (target !== void 0) return [{ kind: "read", target }];
+    const target2 = readTarget(segment);
+    if (target2 !== void 0) return [{ kind: "read", target: target2 }];
     if (dumpsEnv(segment)) return [{ kind: "env-dump", command: [segment.program, ...segment.args].join(" ") }];
     return [];
   });
@@ -13916,9 +13966,9 @@ var bashDecision = (input) => {
 };
 var readDecision = (input) => {
   const inputs = toolInput2(input.payload);
-  const target = optionalString(inputs, "file_path") ?? optionalString(inputs, "path") ?? "";
-  if (target === "" || !isSensitivePath(target)) return ALLOW5;
-  return { kind: "block", reason: input.t("secrets.block.read", { target: relativeFile(input.cwd, target) }) };
+  const target2 = optionalString(inputs, "file_path") ?? optionalString(inputs, "path") ?? "";
+  if (target2 === "" || !isSensitivePath(target2)) return ALLOW5;
+  return { kind: "block", reason: input.t("secrets.block.read", { target: relativeFile(input.cwd, target2) }) };
 };
 var WRITERS2 = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 var SHELLS4 = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
@@ -16298,15 +16348,15 @@ var problem2 = (code, messageKey, params2) => ({
   exitCode: ExitCode.Usage
 });
 var underRoot = (root, path) => toPosixPath(relative8(root, path));
-var expand2 = (ctx, root, target) => {
-  const path = toAbsolutePath(target, ctx.cwd);
+var expand2 = (ctx, root, target2) => {
+  const path = toAbsolutePath(target2, ctx.cwd);
   const stat = ctx.runtime.stat(path);
   if (stat === void 0)
-    return reject(problem2("prose_unreadable", "prose.error.unreadable", { file: target, detail: "not found" }));
+    return reject(problem2("prose_unreadable", "prose.error.unreadable", { file: target2, detail: "not found" }));
   if (stat.kind === "file") return accept([underRoot(root, path)]);
   const walked = ctx.runtime.walkFiles(path);
   if (!walked.ok)
-    return reject(problem2("prose_unreadable", "prose.error.unreadable", { file: target, detail: walked.error }));
+    return reject(problem2("prose_unreadable", "prose.error.unreadable", { file: target2, detail: walked.error }));
   return accept(
     walked.value.map((name) => underRoot(root, toAbsolutePath(toPosixPath(name), path))).filter((name) => TEXT_FILE.test(name) && !/(?:^|\/)(?:node_modules|\.git)\//.test(name)).sort()
   );
@@ -16490,6 +16540,33 @@ var secretsAcceptCommand = {
   }
 };
 
+// src/secrets/runbooks.ts
+import { dirname as dirname9, join as join39 } from "node:path";
+var PROVIDER_OF_RULE = {
+  "aws-access-token": "aws",
+  "aws-secret-access-key": "aws",
+  "github-pat": "github",
+  "github-oauth": "github",
+  "github-app-token": "github",
+  "github-refresh-token": "github",
+  "github-fine-grained-pat": "github",
+  "stripe-access-token": "stripe",
+  "anthropic-api-key": "anthropic",
+  "openai-api-key": "openai",
+  "gcp-api-key": "google",
+  "asaas-api-key": "asaas",
+  "credential-in-url": "database",
+  "password-assignment": "database",
+  "secret-in-process-args": "database"
+};
+var RUNBOOKS_URL = "https://github.com/gabrielvieiraf/finitemonkey/blob/main/runbooks";
+var runbookProvider = (rule) => PROVIDER_OF_RULE[rule] ?? "generic";
+var runbookLink = (runtime, rule) => {
+  const file = `${runbookProvider(rule)}.md`;
+  const local = toAbsolutePath(join39(dirname9(dirname9(runtime.selfPath)), "runbooks", file));
+  return runtime.stat(local)?.kind === "file" ? local : `${RUNBOOKS_URL}/${file}`;
+};
+
 // src/commands/secrets-incident.ts
 var INCIDENT_ACTIONS = ["list", "rotated", "close", "purge"];
 var USAGE = "finitemonkey secrets incident [list | rotated <id> | close <id> | purge <id>]";
@@ -16515,9 +16592,19 @@ var itemLine = (ctx, incident) => ctx.t("secrets.incident.item", {
   where: incident.where,
   created: incident.createdAt.slice(0, 10)
 });
+var itemLines2 = (ctx, incident) => [
+  itemLine(ctx, incident),
+  ctx.t("secrets.incident.runbook", { link: incident.runbook })
+];
 var list2 = (ctx, root) => {
-  const incidents = listIncidents(ctx.runtime, root);
-  const human2 = incidents.length === 0 ? [ctx.t("secrets.incident.none")] : [ctx.t("secrets.incident.title", { count: incidents.length }), ...incidents.map((item) => itemLine(ctx, item))];
+  const incidents = listIncidents(ctx.runtime, root).map((incident) => ({
+    ...incident,
+    runbook: runbookLink(ctx.runtime, incident.rule)
+  }));
+  const human2 = incidents.length === 0 ? [ctx.t("secrets.incident.none")] : [
+    ctx.t("secrets.incident.title", { count: incidents.length }),
+    ...incidents.flatMap((item) => itemLines2(ctx, item))
+  ];
   return success({ schema: "finitemonkey/secrets-incidents@1", incidents }, human2);
 };
 var notRotated = (ctx, incident) => fail2(ctx, {
@@ -16584,6 +16671,133 @@ var secretsIncidentCommand = {
   }
 };
 
+// src/secrets/live.ts
+var bearer = (key) => [`Authorization: Bearer ${key}`];
+var LIVE_PROBES = {
+  github: {
+    host: "api.github.com",
+    path: "/user",
+    headers: (key) => [...bearer(key), "User-Agent: finitemonkey"]
+  },
+  stripe: { host: "api.stripe.com", path: "/v1/balance", headers: bearer },
+  openai: { host: "api.openai.com", path: "/v1/models", headers: bearer },
+  anthropic: {
+    host: "api.anthropic.com",
+    path: "/v1/models",
+    headers: (key) => [`x-api-key: ${key}`, "anthropic-version: 2023-06-01"]
+  },
+  digitalocean: { host: "api.digitalocean.com", path: "/v2/account", headers: bearer },
+  cloudflare: { host: "api.cloudflare.com", path: "/client/v4/user/tokens/verify", headers: bearer },
+  asaas: {
+    host: "api.asaas.com",
+    path: "/v3/finance/balance",
+    headers: (key) => [`access_token: ${key}`, "User-Agent: finitemonkey"]
+  }
+};
+var LIVE_PROVIDERS = Object.keys(LIVE_PROBES).filter((name) => name in LIVE_PROBES);
+var LIVE_HOSTS = LIVE_PROVIDERS.map((name) => LIVE_PROBES[name].host);
+var liveProvider = (name) => LIVE_PROVIDERS.find((provider) => provider === name);
+var LIVE_TIMEOUT_MS = 15e3;
+var liveRequest = (provider, key, cwd) => {
+  const probe = LIVE_PROBES[provider];
+  return {
+    command: "curl",
+    args: [
+      "--silent",
+      "--show-error",
+      "--proto",
+      "=https",
+      "--max-time",
+      "10",
+      "--header",
+      "@-",
+      "--write-out",
+      "\n%{http_code}",
+      `https://${probe.host}${probe.path}`
+    ],
+    cwd,
+    timeoutMs: LIVE_TIMEOUT_MS,
+    input: `${probe.headers(key).join("\n")}
+`
+  };
+};
+var liveOutcome = (result) => {
+  if (!result.found || result.exitCode !== 0) return { verdict: "unreachable" };
+  const status = Number.parseInt(result.stdout.trimEnd().split("\n").at(-1) ?? "", 10);
+  if (!Number.isInteger(status) || status === 0) return { verdict: "unreachable" };
+  if (status >= 200 && status < 300) return { verdict: "live", status };
+  if (status === 401 || status === 403) return { verdict: "rejected", status };
+  return { verdict: "unknown", status };
+};
+
+// src/commands/secrets-live.ts
+var SECRETS_LIVE_SCHEMA = "finitemonkey/secrets-live@1";
+var USAGE2 = `finitemonkey secrets live <${LIVE_PROVIDERS.join("|")}> --env <VARIABLE> [--send]`;
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var target = (provider) => {
+  const probe = LIVE_PROBES[provider];
+  return { host: probe.host, url: `https://${probe.host}${probe.path}` };
+};
+var dryRun = (ctx, provider, variable) => {
+  const { host, url: url2 } = target(provider);
+  const data = { schema: SECRETS_LIVE_SCHEMA, provider, host, url: url2, variable, sent: false };
+  return success(data, [ctx.t("secrets.live.dry", { host, url: url2, variable, provider })]);
+};
+var send = (ctx, provider, variable, key) => {
+  const { host, url: url2 } = target(provider);
+  ctx.io.stderr.write(`${ctx.t("secrets.live.contacting", { host, url: url2 })}
+`);
+  const outcome2 = liveOutcome(ctx.runtime.exec(liveRequest(provider, key, ctx.cwd)));
+  const data = { schema: SECRETS_LIVE_SCHEMA, provider, host, url: url2, variable, sent: true, ...outcome2 };
+  const line2 = ctx.t(`secrets.live.${outcome2.verdict}`, { host, status: outcome2.status ?? 0, variable });
+  if (outcome2.verdict !== "unreachable") return success(data, [line2]);
+  return failureFrom(ctx.t, {
+    code: "secrets_live_unreachable",
+    messageKey: "secrets.live.unreachable",
+    params: { host, status: 0, variable },
+    fix: "install curl or check the network, then run the command again",
+    exitCode: ExitCode.CheckFailed,
+    data
+  });
+};
+var secretsLiveCommand = {
+  path: ["secrets", "live"],
+  summaryKey: "secrets.command.live",
+  usage: USAGE2,
+  status: "ready",
+  maxPositionals: 1,
+  options: { env: { type: "string" }, send: { type: "boolean" } },
+  run: (ctx, args2) => {
+    const provider = liveProvider(args2.positionals[0]);
+    const variable = stringOption(args2.values, "env") ?? "";
+    if (provider === void 0 || !ENV_NAME.test(variable))
+      return Promise.resolve(
+        failureFrom(
+          ctx.t,
+          usageProblem("invalid_arguments", "error.invalid_arguments", USAGE2, {
+            detail: provider === void 0 ? args2.positionals[0] ?? "<provider>" : "--env <VARIABLE>"
+          })
+        )
+      );
+    if (args2.values["send"] !== true) return Promise.resolve(dryRun(ctx, provider, variable));
+    if (!isPerson(ctx))
+      return Promise.resolve(
+        failureFrom(
+          ctx.t,
+          needsPersonProblem("secrets.error.person_only", `${USAGE2.replace(" [--send]", "")} --send`, {
+            action: ctx.t("secrets.action.live")
+          })
+        )
+      );
+    const key = ctx.env[variable] ?? "";
+    if (key === "")
+      return Promise.resolve(
+        failureFrom(ctx.t, usageProblem("invalid_arguments", "secrets.live.no_value", USAGE2, { variable }))
+      );
+    return Promise.resolve(send(ctx, provider, variable, key));
+  }
+};
+
 // src/commands/secrets-scan.ts
 var SECRETS_SCAN_SCHEMA = "finitemonkey/secrets-scan@1";
 var view = (finding3, status) => ({
@@ -16604,15 +16818,15 @@ var modeOf3 = (values) => {
   if (chosen[0] === true) return "staged";
   return chosen[1] === true ? "history" : "path";
 };
-var normalizedTarget = (target) => target.replace(/\\/g, "/").replace(/^\.\/?/, "").replace(/\/$/, "");
-var scopeOf = (target) => {
-  const prefix = normalizedTarget(target);
+var normalizedTarget = (target2) => target2.replace(/\\/g, "/").replace(/^\.\/?/, "").replace(/\/$/, "");
+var scopeOf = (target2) => {
+  const prefix = normalizedTarget(target2);
   return (file) => prefix === "" || file === prefix || file.startsWith(`${prefix}/`);
 };
-var runScan = async (ctx, root, mode, target) => {
+var runScan = async (ctx, root, mode, target2) => {
   if (mode === "staged") return scanStaged(ctx.runtime, root);
   if (mode === "history") return scanHistory(ctx.runtime, root);
-  return scanPath(ctx.runtime, root, normalizedTarget(target) || ".");
+  return scanPath(ctx.runtime, root, normalizedTarget(target2) || ".");
 };
 var historyIncidents = (ctx, root, fresh3) => fresh3.flatMap((finding3) => {
   if (ruleById(finding3.ruleId)?.kind !== "credential") return [];
@@ -16693,8 +16907,8 @@ var secretsScanCommand = {
     const fix = "finitemonkey help secrets scan";
     if (mode === void 0) return failureFrom(ctx.t, usageProblem("invalid_arguments", "secrets.error.one_mode", fix));
     const root = projectRoot(ctx);
-    const target = stringOption(args2.values, "path") ?? ".";
-    const scanned = await runScan(ctx, root, mode, target);
+    const target2 = stringOption(args2.values, "path") ?? ".";
+    const scanned = await runScan(ctx, root, mode, target2);
     if (!scanned.ok) return failureFrom(ctx.t, gitUnavailable(scanned.error));
     const baseline = loadBaseline(ctx.runtime, root);
     if (!baseline.ok) return failureFrom(ctx.t, baselineInvalid(baseline.error));
@@ -16702,7 +16916,7 @@ var secretsScanCommand = {
       scanned.value,
       baseline.value,
       ctx.runtime.now(),
-      mode === "path" ? scopeOf(target) : void 0
+      mode === "path" ? scopeOf(target2) : void 0
     );
     if (mode === "path") prune(ctx, root, baseline.value, outcome2);
     const incidents = mode === "history" ? historyIncidents(ctx, root, outcome2.fresh) : [];
@@ -16711,7 +16925,7 @@ var secretsScanCommand = {
 };
 
 // src/task/create.ts
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 
 // src/core/yaml/write.ts
 var PLAIN_SAFE = /^[A-Za-z_./][A-Za-z0-9_./ ()-]*$/;
@@ -16800,10 +17014,10 @@ var explicitChecks = (draft) => [
 var draftChecks = (runtime, paths, draft) => {
   const disk = {
     read: (relative9) => {
-      const text6 = runtime.readText(toAbsolutePath(join39(paths.root, relative9)));
+      const text6 = runtime.readText(toAbsolutePath(join40(paths.root, relative9)));
       return text6.ok ? text6.value : void 0;
     },
-    exists: (relative9) => runtime.stat(toAbsolutePath(join39(paths.root, relative9))) !== void 0
+    exists: (relative9) => runtime.stat(toAbsolutePath(join40(paths.root, relative9))) !== void 0
   };
   const detected = detectChecks(disk);
   const base = draft.runs.length > 0 || draft.tests !== void 0 ? explicitChecks(draft) : detected;
@@ -16933,8 +17147,8 @@ var showTask = (ctx, id) => {
   const paths = projectOf(ctx);
   if (paths === void 0) return noRepo(ctx);
   const active = readState(ctx.runtime, paths).active;
-  const target = id ?? active;
-  const report2 = currentReport(ctx.runtime, paths, void 0, target);
+  const target2 = id ?? active;
+  const report2 = currentReport(ctx.runtime, paths, void 0, target2);
   if (report2 === void 0) {
     return failureFrom(
       ctx.t,
@@ -16942,7 +17156,7 @@ var showTask = (ctx, id) => {
         "task_not_found",
         "error.task_not_found",
         "finitemonkey task new <id> --goal <text>",
-        { task: target ?? "-" },
+        { task: target2 ?? "-" },
         ExitCode.NotConfigured
       )
     );
@@ -16952,7 +17166,7 @@ var showTask = (ctx, id) => {
 var doneTask = (ctx, id) => {
   const paths = projectOf(ctx);
   if (paths === void 0) return noRepo(ctx);
-  const target = id ?? readState(ctx.runtime, paths).active;
+  const target2 = id ?? readState(ctx.runtime, paths).active;
   const run4 = runGate({
     runtime: ctx.runtime,
     cwd: ctx.cwd,
@@ -16961,7 +17175,7 @@ var doneTask = (ctx, id) => {
     budgetMs: DEFAULT_GATE_BUDGET_MS,
     fast: false,
     noSkip: true,
-    ...target === void 0 ? {} : { taskId: target }
+    ...target2 === void 0 ? {} : { taskId: target2 }
   });
   const result = runResult(ctx, run4, true);
   if (!result.ok || run4.kind !== "done" || run4.report.implicit) return result;
@@ -17053,9 +17267,9 @@ var isEmptyDir = (project, relative9) => {
   return listed4.ok && listed4.value.length === 0;
 };
 var finish3 = (project, plan) => {
-  const target = plan.purge ? STATE_DIR : LOCK_FILE;
-  const removed = project.runtime.remove(project.abs(target));
-  if (!removed.ok) return reject({ path: target, detail: removed.error });
+  const target2 = plan.purge ? STATE_DIR : LOCK_FILE;
+  const removed = project.runtime.remove(project.abs(target2));
+  if (!removed.ok) return reject({ path: target2, detail: removed.error });
   for (const dir of plan.removeDirs) if (isEmptyDir(project, dir)) project.runtime.remove(project.abs(dir));
   return accept(void 0);
 };
@@ -17201,6 +17415,7 @@ var REGISTRY = [
   offCommand,
   onCommand,
   secretsIncidentCommand,
+  secretsLiveCommand,
   proseCheckCommand,
   snapshotCommand,
   undoCommand,
@@ -17212,7 +17427,7 @@ var REGISTRY = [
 ];
 
 // src/i18n/lang-settings.ts
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 var read3 = (runtime, path) => {
   const text6 = runtime.readText(toAbsolutePath(path));
   return text6.ok ? text6.value : void 0;
@@ -17227,14 +17442,14 @@ var languageIn = (text6) => {
   const value = parsed.ok && isRecord(parsed.value) ? parsed.value["language"] : void 0;
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 };
-var claudeDir = (runtime, env) => env["CLAUDE_CONFIG_DIR"] ?? join40(runtime.homeDir(), ".claude");
+var claudeDir = (runtime, env) => env["CLAUDE_CONFIG_DIR"] ?? join41(runtime.homeDir(), ".claude");
 var langSettings = (runtime, cwd, env, platform) => {
   const root = findGitRoot(cwd, runtime) ?? cwd;
-  const config = parseConfigYaml(read3(runtime, join40(root, CONFIG_FILE)) ?? "");
+  const config = parseConfigYaml(read3(runtime, join41(root, CONFIG_FILE)) ?? "");
   const claudeFiles = [
-    join40(root, ".claude", "settings.local.json"),
-    join40(root, ".claude", "settings.json"),
-    join40(claudeDir(runtime, env), "settings.json")
+    join41(root, ".claude", "settings.local.json"),
+    join41(root, ".claude", "settings.json"),
+    join41(claudeDir(runtime, env), "settings.json")
   ];
   return {
     config: configText(config, "lang"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "finitemonkey",
-  "version": "0.1.0-next.18",
+  "version": "0.1.0-next.19",
   "description": "Claude Code hooks that stop a coding agent from saying done before the tests pass: a machine-checked definition of done, plus guardrails for secrets, git safety and production. Pre-release.",
   "type": "module",
   "license": "Apache-2.0",
@@ -33,6 +33,7 @@
   },
   "files": [
     "dist",
+    "runbooks",
     "LICENSE",
     "NOTICE",
     "README.md"
@@ -55,7 +56,7 @@
     "i18n:check": "node dist/finitemonkey.mjs i18n check --dir src/i18n",
     "bench:startup": "node scripts/bench-startup.mjs",
     "smoke:install": "node scripts/smoke-install.mjs",
-    "check": "npm run typecheck && npm run lint && npm run format:check && npm run check:dist && npm test && npm run i18n:check && npm run plugin:validate && npm pack --dry-run && npm run llms:check && npm run schema:check && npm run docs:check",
+    "check": "npm run typecheck && npm run lint && npm run format:check && npm run check:dist && npm test && npm run i18n:check && npm run plugin:validate && npm pack --dry-run && npm run llms:check && npm run schema:check && npm run docs:check && npm run runbooks:check",
     "prepublishOnly": "npm run typecheck && npm run check:dist && npm test",
     "prepare": "husky",
     "gif": "tsc -p assets/scripts && node --experimental-strip-types assets/scripts/render.ts",
@@ -68,6 +69,7 @@
     "budgets": "tsx scripts/budgets.ts",
     "docs": "tsx scripts/build-docs.ts",
     "docs:check": "tsc -p scripts && tsx scripts/build-docs.ts --check",
+    "runbooks:check": "tsx scripts/check-runbooks.ts",
     "e2e:claude": "node --import tsx --test --test-concurrency=1 test/e2e/claude-stop.e2e.ts",
     "plugin:sync": "node scripts/plugin-sync.mjs",
     "plugin:validate": "node scripts/plugin-validate.mjs",

package/runbooks/anthropic.md

@@ -0,0 +1,31 @@
+# Anthropic API keys
+
+Applies to rule `anthropic-api-key`.
+
+## 1. Revoke
+
+In the Claude Console, open **Settings** > **API keys** and disable or delete the key. With an admin key, `POST /v1/organizations/api_keys/{api_key_id}` with `{"status": "inactive"}` does the same.
+
+## 2. Issue the new credential
+
+Create the new key in a workspace that holds only this application, with spend limits set on that workspace. Do not reuse one key across environments.
+
+## 3. Replace it in every consumer
+
+Update the secret store, CI secrets and every service that reads `ANTHROPIC_API_KEY`.
+
+## 4. Check for misuse in the exposure window
+
+Review usage and cost for the workspace in the window. Requests or spend you cannot explain mean the key was used by someone else.
+
+## 5. Delete the old credential after observation
+
+After a few days with no errors from consumers, archive or delete the disabled key.
+
+## 6. Notification duties
+
+Prompts and files sent with the key may hold personal data. If the key could read stored files or batches, assess notice duties.
+
+## Sources
+
+- https://platform.claude.com/docs/en/api/admin-api/apikeys/update-api-key (accessed 2026-10-26)

package/runbooks/asaas.md

@@ -0,0 +1,31 @@
+# Asaas API keys
+
+Applies to rule `asaas-api-key`.
+
+## 1. Revoke
+
+As an account administrator, open **Integrações** in the web interface and delete the exposed key. A deleted key cannot be restored. A parent account can also revoke a subaccount key through the API.
+
+## 2. Issue the new credential
+
+Create the new key in the same area. Use a separate key per subaccount and per environment, and never put a production key in a sandbox configuration.
+
+## 3. Replace it in every consumer
+
+Update the backend secret store, CI secrets and every worker that calls the API.
+
+## 4. Check for misuse in the exposure window
+
+Review charges, transfers, PIX keys, bank account changes and webhook settings for the window, in the account and in every subaccount the key could reach.
+
+## 5. Delete the old credential after observation
+
+If you created a temporary key during the switch, delete it after a few days without errors.
+
+## 6. Notification duties
+
+Asaas keys reach customer names, tax ids and payment data. If they were read, assess notice duties under the LGPD toward the ANPD and the people affected.
+
+## Sources
+
+- https://docs.asaas.com/docs/chaves-de-api (accessed 2026-10-26)

package/runbooks/aws.md

@@ -0,0 +1,32 @@
+# AWS access keys
+
+Applies to rules `aws-access-token` and `aws-secret-access-key`.
+
+## 1. Revoke
+
+In the IAM console, open the user, then **Security credentials** > **Access keys**, and set the exposed key to **Inactive** (`aws iam update-access-key --access-key-id <id> --status Inactive --user-name <user>`). Inactive keys stop signing requests at once and can still be turned back on if something critical breaks.
+
+## 2. Issue the new credential
+
+Prefer no long-lived key at all: an IAM role for EC2, ECS or Lambda, or OIDC federation for CI (GitHub Actions `aws-actions/configure-aws-credentials` with a role). If a key is unavoidable, create it on a user whose policy grants only what the consumer needs (`aws iam create-access-key --user-name <user>`).
+
+## 3. Replace it in every consumer
+
+Update the secret store, CI secrets, `.env` files outside git, and every host that had the old key. Restart the processes that read it at start.
+
+## 4. Check for misuse in the exposure window
+
+Run `aws iam get-access-key-last-used --access-key-id <id>` and search CloudTrail for the key id from the first exposure until it went inactive. Look for new IAM users, new keys, new regions, EC2 instances you did not start and S3 reads you do not recognize.
+
+## 5. Delete the old credential after observation
+
+After a few days with no errors from consumers and no use of the old id, delete it (`aws iam delete-access-key --access-key-id <id> --user-name <user>`).
+
+## 6. Notification duties
+
+If CloudTrail shows access to personal data, the data protection law that applies (LGPD, GDPR or a state law) may require notice to the regulator and to the people affected. Record what was reachable with the key and decide with whoever owns that duty.
+
+## Sources
+
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/id-credentials-access-keys-update.html (accessed 2026-10-26)
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html (accessed 2026-10-26)

package/runbooks/cloudflare.md

@@ -0,0 +1,31 @@
+# Cloudflare API tokens
+
+Applies to Cloudflare API tokens and global API keys found by the generic rules.
+
+## 1. Revoke
+
+Go to **My Profile** > **API Tokens**, open the menu next to the token and choose **Roll**. Rolling invalidates the old secret at once and keeps the same permissions. A global API key can be changed on the same page.
+
+## 2. Issue the new credential
+
+Prefer a scoped API token over the global API key: only the zones and permissions the consumer needs, with client IP filtering and a TTL when the consumer runs from known addresses.
+
+## 3. Replace it in every consumer
+
+Update CI secrets, Workers secrets, Terraform variables and any tool that calls the API.
+
+## 4. Check for misuse in the exposure window
+
+Read the account audit log for the window: DNS changes, new Workers or routes, page rules, firewall changes, new members and new tokens.
+
+## 5. Delete the old credential after observation
+
+Delete any extra token created during the change once consumers have run without errors for a few days.
+
+## 6. Notification duties
+
+DNS or Workers changes can redirect user traffic. If that happened, treat it as a breach of the affected service and assess notice duties.
+
+## Sources
+
+- https://developers.cloudflare.com/fundamentals/api/how-to/roll-token/ (accessed 2026-10-26)

package/runbooks/database.md

@@ -0,0 +1,32 @@
+# Database and Redis passwords
+
+Applies to rules `credential-in-url`, `password-assignment` and `secret-in-process-args` when the value is a database or Redis password.
+
+## 1. Revoke
+
+PostgreSQL: `ALTER ROLE <role> WITH PASSWORD NULL;` or `ALTER ROLE <role> NOLOGIN;` until the new password is in place. MySQL: `ALTER USER '<user>'@'<host>' ACCOUNT LOCK;`. Redis with ACLs: remove the password from the user (`ACL SETUSER <user> <<old-password>`), or with `requirepass` change it in the config and restart.
+
+## 2. Issue the new credential
+
+Generate a long random password (`ACL GENPASS` in Redis, `openssl rand -base64 32` elsewhere), or move to IAM database authentication or short-lived credentials from a secrets manager. Give each application its own role with only the grants it needs.
+
+## 3. Replace it in every consumer
+
+Update connection strings in the secret store, compose files (from a variable, never a literal argument), CI, migrations and backup jobs. Restart connection pools.
+
+## 4. Check for misuse in the exposure window
+
+Check the server log for logins from unknown addresses, `pg_stat_activity` or `SHOW PROCESSLIST` for unknown sessions, and look for new roles, changed grants, dropped tables or large reads. Check whether the port was reachable from the internet during the window.
+
+## 5. Delete the old credential after observation
+
+Remove temporary roles or extra Redis passwords added for the switch after the applications have run cleanly for a few days.
+
+## 6. Notification duties
+
+A database usually holds personal data. If anyone outside your team could have connected, treat it as a possible breach and assess notice duties toward the regulator and the people affected.
+
+## Sources
+
+- https://www.postgresql.org/docs/17/sql-alterrole.html (accessed 2026-10-26)
+- https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/ (accessed 2026-10-26)

package/runbooks/digitalocean.md

@@ -0,0 +1,31 @@
+# DigitalOcean API tokens
+
+Applies to DigitalOcean personal access tokens (`dop_v1_`) found by the generic rules.
+
+## 1. Revoke
+
+In the control panel, open **API** > **Tokens**, find the token and choose **Delete**, or **Regenerate** if consumers must keep the same name and scopes.
+
+## 2. Issue the new credential
+
+Create a token with custom scopes limited to the resources the consumer touches and an expiration date. Scopes cannot be edited later, so pick them now.
+
+## 3. Replace it in every consumer
+
+Update CI secrets, `doctl auth` contexts, Terraform variables and every host that used the old token.
+
+## 4. Check for misuse in the exposure window
+
+Review the account's security history and the resource list for the window: new Droplets, volumes, snapshots, firewall changes, new SSH keys and Spaces access keys you did not create.
+
+## 5. Delete the old credential after observation
+
+If you regenerated instead of deleting, confirm nothing still fails with the old value, then delete any leftover token created for the transition.
+
+## 6. Notification duties
+
+If Droplets or databases with personal data were reachable, assess notice duties under the law that applies to that data.
+
+## Sources
+
+- https://docs.digitalocean.com/reference/api/create-personal-access-token/ (accessed 2026-10-26)

package/runbooks/generic.md

@@ -0,0 +1,31 @@
+# Any other credential
+
+Applies to rules without a provider runbook: `generic-api-key`, `jwt`, `private-key`, `gitlab-pat`, `npm-access-token` and the Slack rules.
+
+## 1. Revoke
+
+Find the provider that issued the value and revoke or disable it there. For a private key, remove its public half from every place that trusts it (`authorized_keys`, deploy keys, certificates). For a JWT signing secret, rotate the secret, which invalidates every token it signed.
+
+## 2. Issue the new credential
+
+Prefer short-lived credentials (OIDC, roles, tokens with an expiry) over long-lived ones, and give the new value only the scope the consumer needs.
+
+## 3. Replace it in every consumer
+
+Update the secret store, CI secrets, `.env` files outside git and every host that had the old value.
+
+## 4. Check for misuse in the exposure window
+
+Read the provider's audit or access log from the first exposure until revocation and look for actions you did not take.
+
+## 5. Delete the old credential after observation
+
+Delete leftover records of the old value once consumers have run without errors for a few days.
+
+## 6. Notification duties
+
+If the credential reached personal data, assess notice duties under the law that applies.
+
+## Sources
+
+- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html (accessed 2026-10-26)

package/runbooks/github.md

@@ -0,0 +1,32 @@
+# GitHub tokens
+
+Applies to rules `github-pat`, `github-oauth`, `github-app-token`, `github-refresh-token` and `github-fine-grained-pat`.
+
+## 1. Revoke
+
+For a personal access token, go to **Settings** > **Developer settings** > **Personal access tokens** and delete it. For an OAuth or GitHub App token, revoke the authorization under **Settings** > **Applications**, or rotate the app's client secret. A revoked token cannot be restored.
+
+## 2. Issue the new credential
+
+Use the narrowest path that works: `GITHUB_TOKEN` inside Actions, a GitHub App installation token for automation, or a fine-grained personal access token limited to the repositories and permissions the consumer needs, with an expiration date.
+
+## 3. Replace it in every consumer
+
+Update repository and organization secrets, CI variables, local `gh auth` sessions, git remotes that carried the token in the URL (`git remote set-url`) and credential helpers.
+
+## 4. Check for misuse in the exposure window
+
+Check the security log (**Settings** > **Security log**, or the organization audit log) for the window: new deploy keys, new tokens, changed branch protection, pushes and releases you did not make, and repositories made public or transferred.
+
+## 5. Delete the old credential after observation
+
+A deleted token is already gone. If you only reduced an app's access, remove the old installation or secret after a few days without failures.
+
+## 6. Notification duties
+
+If private repositories with personal data or customer code were readable, tell the owners of that data and check contractual and legal duties to notify.
+
+## Sources
+
+- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation (accessed 2026-10-26)
+- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens (accessed 2026-10-26)

package/runbooks/google.md

@@ -0,0 +1,31 @@
+# Google OAuth client secrets and API keys
+
+Applies to rule `gcp-api-key` and to OAuth client secrets found by the generic rules.
+
+## 1. Revoke
+
+For an API key, open **APIs & Services** > **Credentials** and regenerate or delete the key. For an OAuth client secret, add a new secret to the client, then disable the exposed one.
+
+## 2. Issue the new credential
+
+Restrict a new API key to the APIs it calls and to the referrers, IPs or apps that use it. For OAuth, keep the client and rotate only the secret. For server-to-server access prefer workload identity federation over service account key files.
+
+## 3. Replace it in every consumer
+
+Update the backend configuration, CI secrets and any mobile or web build that embeds the key.
+
+## 4. Check for misuse in the exposure window
+
+Check API usage metrics and billing for the key's project in the window, and Cloud Audit Logs for calls you do not recognize.
+
+## 5. Delete the old credential after observation
+
+Delete the disabled OAuth secret once the new one has served traffic without errors.
+
+## 6. Notification duties
+
+If the client could read user data through granted scopes, assess notice duties toward those users and the regulator.
+
+## Sources
+
+- https://support.google.com/cloud/answer/6158849 (accessed 2026-10-26)

package/runbooks/mailgun.md

@@ -0,0 +1,31 @@
+# Mailgun API keys
+
+Applies to Mailgun keys found by the generic rules (for example a `MAILGUN_KEY` assignment).
+
+## 1. Revoke
+
+In the Mailgun control panel, open **API Security** and delete the exposed account key or domain sending key.
+
+## 2. Issue the new credential
+
+Prefer a domain sending key, which can only send mail for one domain, over an account key. Create an account key only for tools that manage the account, with the narrowest role.
+
+## 3. Replace it in every consumer
+
+Update the application configuration, CI secrets and any SMTP credentials that shared the leak.
+
+## 4. Check for misuse in the exposure window
+
+Review sending logs and events for the window: mail you did not send, new domains, new routes or webhooks, and spikes in bounces or complaints that point to spam sent in your name.
+
+## 5. Delete the old credential after observation
+
+Remove any temporary key created for the switch after a few days without delivery errors.
+
+## 6. Notification duties
+
+If message logs or mailing lists with personal data were readable, assess notice duties. If spam went out under your domain, warn the recipients' contact point and watch your domain reputation.
+
+## Sources
+
+- https://documentation.mailgun.com/docs/mailgun/user-manual/api-key-mgmt/rbac-mgmt (accessed 2026-10-26)

package/runbooks/openai.md

@@ -0,0 +1,31 @@
+# OpenAI API keys
+
+Applies to rule `openai-api-key`.
+
+## 1. Revoke
+
+On the API keys page of the OpenAI platform, revoke the exposed key. Revocation takes effect at once.
+
+## 2. Issue the new credential
+
+Create a project key or a service account key in a project that holds only this application, with spend limits and, where the organization allows it, a maximum key lifetime.
+
+## 3. Replace it in every consumer
+
+Update the secret store, CI secrets and every service that reads `OPENAI_API_KEY`.
+
+## 4. Check for misuse in the exposure window
+
+Review usage per project and per key in the window. Calls or spend you cannot explain mean the key was used by someone else.
+
+## 5. Delete the old credential after observation
+
+Remove any temporary key created for the switch once the new key has run cleanly for a few days.
+
+## 6. Notification duties
+
+If the key could reach stored files, assistants or fine-tuning data with personal data, assess notice duties.
+
+## Sources
+
+- https://developers.openai.com/api/docs/guides/production-best-practices (accessed 2026-10-26)

package/runbooks/stripe.md

@@ -0,0 +1,31 @@
+# Stripe secret and restricted keys
+
+Applies to rule `stripe-access-token`.
+
+## 1. Revoke
+
+On **Developers** > **API keys**, open the menu next to the key and choose **Roll key** with expiration **Now**, or **Expire key**. A rolled key with a later expiration keeps working until then, so choose **Now** for a leaked key.
+
+## 2. Issue the new credential
+
+Create a restricted key (`rk_live_`) with only the permissions the integration needs and attach an access policy (IP addresses or allowed networks) so the key works only from your servers.
+
+## 3. Replace it in every consumer
+
+Update the secret store or environment of every backend, worker and CI job. Webhook signing secrets are separate; roll them too if they were in the same file.
+
+## 4. Check for misuse in the exposure window
+
+Open the request logs for the old key in Workbench and review the window: refunds, payouts, transfers, changes to payout bank accounts, new webhook endpoints and customer data exports.
+
+## 5. Delete the old credential after observation
+
+If you rolled with a delay, confirm the old key's request volume stayed at zero, then let it expire or expire it now.
+
+## 6. Notification duties
+
+Card data never passes through your keys, but customer names, emails and addresses do. If they were read, assess notice duties under the law that applies and tell Stripe support about suspicious activity.
+
+## Sources
+
+- https://docs.stripe.com/keys (accessed 2026-10-26)