fpasoterm 1.6.0

package/scripts/generate-icon.js

@@ -0,0 +1,251 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const zlib = require('node:zlib');
+
+const root = path.resolve(__dirname, '..');
+const sourceSize = 256;
+const pixels = Buffer.alloc(sourceSize * sourceSize * 4);
+
+// Writes one RGBA pixel into the source icon buffer.
+function setPixel(x, y, r, g, b, a = 255) {
+  const offset = (y * sourceSize + x) * 4;
+  pixels[offset] = r;
+  pixels[offset + 1] = g;
+  pixels[offset + 2] = b;
+  pixels[offset + 3] = a;
+}
+
+// Fills an axis-aligned rectangle in the source icon buffer.
+function fillRect(x, y, width, height, color) {
+  for (let row = y; row < y + height; row += 1) {
+    for (let col = x; col < x + width; col += 1) {
+      setPixel(col, row, ...color);
+    }
+  }
+}
+
+// Fills a rectangle with rounded corners for the terminal-window shape.
+function fillRoundedRect(x, y, width, height, radius, color) {
+  for (let row = y; row < y + height; row += 1) {
+    for (let col = x; col < x + width; col += 1) {
+      const dx = Math.max(x - col + radius, 0, col - (x + width - radius - 1));
+      const dy = Math.max(y - row + radius, 0, row - (y + height - radius - 1));
+      if ((dx * dx) + (dy * dy) <= radius * radius) {
+        setPixel(col, row, ...color);
+      }
+    }
+  }
+}
+
+// Draws a rectangular outline by filling four thin rectangles.
+function strokeRect(x, y, width, height, thickness, color) {
+  fillRect(x, y, width, thickness, color);
+  fillRect(x, y + height - thickness, width, thickness, color);
+  fillRect(x, y, thickness, height, color);
+  fillRect(x + width - thickness, y, thickness, height, color);
+}
+
+// Draws a thick line using small rounded rectangles along a Bresenham path.
+function line(x0, y0, x1, y1, thickness, color) {
+  const dx = Math.abs(x1 - x0);
+  const dy = Math.abs(y1 - y0);
+  const sx = x0 < x1 ? 1 : -1;
+  const sy = y0 < y1 ? 1 : -1;
+  let err = dx - dy;
+  let x = x0;
+  let y = y0;
+
+  while (true) {
+    fillRoundedRect(x - thickness, y - thickness, thickness * 2, thickness * 2, thickness, color);
+    if (x === x1 && y === y1) {
+      break;
+    }
+    const e2 = err * 2;
+    if (e2 > -dy) {
+      err -= dy;
+      x += sx;
+    }
+    if (e2 < dx) {
+      err += dx;
+      y += sy;
+    }
+  }
+}
+
+// Computes PNG chunk checksums.
+function crc32(buffer) {
+  let crc = 0xffffffff;
+  for (const byte of buffer) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+    }
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+// Creates a single PNG chunk with length, type, data, and CRC.
+function chunk(type, data) {
+  const typeBuffer = Buffer.from(type);
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(data.length);
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(Buffer.concat([typeBuffer, data])));
+  return Buffer.concat([length, typeBuffer, data, crc]);
+}
+
+// Encodes raw RGBA pixels into a minimal PNG file.
+function encodePng(imageSize, imagePixels) {
+  const raw = Buffer.alloc((imageSize * 4 + 1) * imageSize);
+  for (let y = 0; y < imageSize; y += 1) {
+    const rowStart = y * (imageSize * 4 + 1);
+    raw[rowStart] = 0;
+    imagePixels.copy(raw, rowStart + 1, y * imageSize * 4, (y + 1) * imageSize * 4);
+  }
+
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(imageSize, 0);
+  ihdr.writeUInt32BE(imageSize, 4);
+  ihdr[8] = 8;
+  ihdr[9] = 6;
+  ihdr[10] = 0;
+  ihdr[11] = 0;
+  ihdr[12] = 0;
+
+  return Buffer.concat([
+    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+    chunk('IHDR', ihdr),
+    chunk('IDAT', zlib.deflateSync(raw, { level: 9 })),
+    chunk('IEND', Buffer.alloc(0)),
+  ]);
+}
+
+// Encodes one macOS icon chunk from a PNG payload.
+function iconChunk(type, pngData) {
+  const chunkHeader = Buffer.alloc(8);
+  chunkHeader.write(type, 0, 4, 'ascii');
+  chunkHeader.writeUInt32BE(pngData.length + 8, 4);
+  return Buffer.concat([chunkHeader, pngData]);
+}
+
+// Encodes a macOS .icns file with PNG-backed icon representations.
+function encodeIcns(iconEntries) {
+  const body = Buffer.concat(iconEntries.map(({ type, pngData }) => iconChunk(type, pngData)));
+  const header = Buffer.alloc(8);
+  header.write('icns', 0, 4, 'ascii');
+  header.writeUInt32BE(body.length + 8, 4);
+  return Buffer.concat([header, body]);
+}
+
+// Writes a Windows .ico file that embeds PNG icon images.
+function encodeIco(iconEntries) {
+  const imageCount = iconEntries.length;
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 0);
+  header.writeUInt16LE(1, 2);
+  header.writeUInt16LE(imageCount, 4);
+
+  const directory = Buffer.alloc(imageCount * 16);
+  let offset = 6 + imageCount * 16;
+  const images = [];
+
+  iconEntries.forEach(({ size, pngData }, index) => {
+    const entryOffset = index * 16;
+    directory[entryOffset] = size >= 256 ? 0 : size;
+    directory[entryOffset + 1] = size >= 256 ? 0 : size;
+    directory[entryOffset + 2] = 0;
+    directory[entryOffset + 3] = 0;
+    directory.writeUInt16LE(1, entryOffset + 4);
+    directory.writeUInt16LE(32, entryOffset + 6);
+    directory.writeUInt32LE(pngData.length, entryOffset + 8);
+    directory.writeUInt32LE(offset, entryOffset + 12);
+    offset += pngData.length;
+    images.push(pngData);
+  });
+
+  return Buffer.concat([header, directory, ...images]);
+}
+
+// Resizes the source icon using nearest-neighbor sampling for crisp small icons.
+function resizePixels(targetSize) {
+  if (targetSize === sourceSize) {
+    return Buffer.from(pixels);
+  }
+
+  const resized = Buffer.alloc(targetSize * targetSize * 4);
+  for (let y = 0; y < targetSize; y += 1) {
+    for (let x = 0; x < targetSize; x += 1) {
+      const sourceX = Math.min(sourceSize - 1, Math.floor((x * sourceSize) / targetSize));
+      const sourceY = Math.min(sourceSize - 1, Math.floor((y * sourceSize) / targetSize));
+      const sourceOffset = (sourceY * sourceSize + sourceX) * 4;
+      const targetOffset = (y * targetSize + x) * 4;
+      pixels.copy(resized, targetOffset, sourceOffset, sourceOffset + 4);
+    }
+  }
+  return resized;
+}
+
+// Writes one icon file at the requested size.
+function writeIcon(relativePath, imageSize) {
+  const outputPath = path.join(root, relativePath);
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.writeFileSync(outputPath, encodePng(imageSize, resizePixels(imageSize)));
+  console.log(outputPath);
+}
+
+for (let y = 0; y < sourceSize; y += 1) {
+  for (let x = 0; x < sourceSize; x += 1) {
+    const shade = Math.round(18 + (x + y) * 0.08);
+    setPixel(x, y, shade, shade + 8, shade + 18);
+  }
+}
+
+fillRoundedRect(32, 48, 192, 152, 18, [10, 16, 24, 255]);
+strokeRect(32, 48, 192, 152, 7, [61, 75, 95, 255]);
+fillRoundedRect(48, 64, 160, 24, 6, [26, 34, 48, 255]);
+fillRoundedRect(61, 71, 10, 10, 5, [255, 107, 107, 255]);
+fillRoundedRect(81, 71, 10, 10, 5, [245, 215, 110, 255]);
+fillRoundedRect(101, 71, 10, 10, 5, [139, 209, 124, 255]);
+line(67, 119, 94, 140, 5, [143, 211, 255, 255]);
+line(94, 140, 67, 161, 5, [143, 211, 255, 255]);
+fillRoundedRect(108, 156, 56, 14, 7, [232, 237, 242, 255]);
+fillRoundedRect(145, 105, 60, 48, 12, [245, 215, 110, 255]);
+fillRoundedRect(158, 118, 34, 10, 5, [16, 21, 29, 255]);
+fillRoundedRect(158, 135, 34, 10, 5, [16, 21, 29, 255]);
+fillRoundedRect(64, 216, 128, 8, 4, [245, 215, 110, 255]);
+
+writeIcon('extra/logo/fpasoterm.png', 256);
+
+for (const iconSize of [16, 32, 48, 64, 128, 192, 256, 512]) {
+  writeIcon(`extra/linux/icons/hicolor/${iconSize}x${iconSize}/apps/fpasoterm.png`, iconSize);
+}
+
+const macIconEntries = [
+  { type: 'icp4', size: 16 },
+  { type: 'icp5', size: 32 },
+  { type: 'icp6', size: 64 },
+  { type: 'ic07', size: 128 },
+  { type: 'ic08', size: 256 },
+  { type: 'ic09', size: 512 },
+  { type: 'ic10', size: 1024 },
+].map(({ type, size }) => ({
+  type,
+  pngData: encodePng(size, resizePixels(size)),
+}));
+
+const macIcnsPath = path.join(root, 'extra', 'macos', 'fpasoterm.icns');
+fs.mkdirSync(path.dirname(macIcnsPath), { recursive: true });
+fs.writeFileSync(macIcnsPath, encodeIcns(macIconEntries));
+console.log(macIcnsPath);
+
+const windowsIconEntries = [
+  16, 32, 48, 64, 128, 256,
+].map((size) => ({
+  size,
+  pngData: encodePng(size, resizePixels(size)),
+}));
+
+const windowsIcoPath = path.join(root, 'extra', 'windows', 'fpasoterm.ico');
+fs.mkdirSync(path.dirname(windowsIcoPath), { recursive: true });
+fs.writeFileSync(windowsIcoPath, encodeIco(windowsIconEntries));
+console.log(windowsIcoPath);

package/scripts/init-jj-empty-main

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -eu
+
+if ! command -v jj >/dev/null 2>&1; then
+  echo "jj is not installed. Install jj first, then rerun this script." >&2
+  exit 127
+fi
+
+if [ -d .jj ] || [ -d .git ]; then
+  echo "This directory already looks initialized. Refusing to overwrite repository metadata." >&2
+  exit 1
+fi
+
+tmpdir=$(mktemp -d)
+restore_needed=1
+cleanup() {
+  status=$?
+  if [ "$restore_needed" = 1 ] && [ -d "$tmpdir" ]; then
+    find "$tmpdir" -mindepth 1 -maxdepth 1 -exec mv {} . \;
+  fi
+  if [ "$status" = 0 ]; then
+    rm -rf "$tmpdir"
+  else
+    echo "Initialization failed. Project files were restored; temporary directory left at: $tmpdir" >&2
+  fi
+  exit "$status"
+}
+trap cleanup EXIT INT TERM
+
+find . -mindepth 1 -maxdepth 1 ! -name .jj ! -name .git -exec mv {} "$tmpdir"/ \;
+
+jj git init --colocate .
+jj describe -m "empty main"
+jj bookmark create main -r @
+
+jj new main -m "Initial fpasoterm terminal app"
+find "$tmpdir" -mindepth 1 -maxdepth 1 -exec mv {} . \;
+restore_needed=0
+
+jj file track .
+jj status

package/scripts/install-linux-desktop.js

@@ -0,0 +1,238 @@
+const childProcess = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+// This script installs a Linux desktop entry and icon theme assets. Windows
+// packages own their shortcuts, so do not create an unusable Unix wrapper.
+if (process.platform === 'win32') {
+  console.log('update:desktop is only needed for Linux/ChromeOS desktop integration; use the Windows MSI or EXE instead.');
+  process.exit(0);
+}
+
+const root = path.resolve(__dirname, '..');
+const dataHome = process.env.XDG_DATA_HOME || path.join(os.homedir(), '.local', 'share');
+const binHome = process.env.XDG_BIN_HOME || path.join(os.homedir(), '.local', 'bin');
+const applicationsDir = path.join(dataHome, 'applications');
+const iconsDir = path.join(dataHome, 'icons', 'hicolor');
+const iconSizes = [16, 32, 48, 64, 128, 192, 256, 512];
+const buildStampPath = path.join(root, 'src-tauri', 'target', 'debug', '.fpasoterm-normal-build.json');
+
+// Builds a current local Tauri binary so launcher icon starts do not fall back
+// to `tauri dev`, which runs Cargo watch and looks like a failed GUI launch.
+function buildLocalBinary() {
+  if (process.env.FPASOTERM_SKIP_DESKTOP_BUILD === '1') {
+    console.log('skipping local Tauri build because FPASOTERM_SKIP_DESKTOP_BUILD=1');
+    return;
+  }
+
+  // Tauri's frontend assets are embedded at compile time. Cleaning only this
+  // crate makes update:desktop rebuild renderer-only changes as well.
+  const cleanResult = childProcess.spawnSync(
+    'cargo',
+    ['clean', '--manifest-path', path.join(root, 'src-tauri', 'Cargo.toml'), '-p', 'fpasoterm'],
+    { stdio: 'inherit' },
+  );
+  if (cleanResult.error && cleanResult.error.code === 'ENOENT') {
+    console.warn('cargo is not available; launcher may fall back to an older local binary');
+    return;
+  }
+  if (cleanResult.error) {
+    throw cleanResult.error;
+  }
+  if (cleanResult.status !== 0) {
+    throw new Error(`cargo clean failed with exit code ${cleanResult.status}`);
+  }
+
+  const result = childProcess.spawnSync(
+    'cargo',
+    ['build', '--manifest-path', path.join(root, 'src-tauri', 'Cargo.toml')],
+    { stdio: 'inherit' },
+  );
+  if (result.error && result.error.code === 'ENOENT') {
+    console.warn('cargo is not available; launcher may fall back to Tauri dev until a binary is built');
+    return;
+  }
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`cargo build failed with exit code ${result.status}`);
+  }
+  writeBuildStamp(path.join(root, 'src-tauri', 'target', 'debug', process.platform === 'win32' ? 'fpasoterm.exe' : 'fpasoterm'));
+}
+
+// Tracks source files that require rebuilding the local Tauri binary.
+function latestRuntimeSourceMtime() {
+  return [
+    'src-tauri/src/main.rs',
+    'src-tauri/Cargo.toml',
+    'src-tauri/Cargo.lock',
+    'src-tauri/build.rs',
+    'src-tauri/default-config.toml',
+    'src-tauri/tauri.conf.json',
+    'src-tauri/capabilities',
+    'src/renderer',
+    'extra/logo/fpasoterm.png',
+    'package.json',
+  ]
+    .map((relativePath) => path.join(root, relativePath))
+    .reduce((latest, sourcePath) => Math.max(latest, latestPathMtime(sourcePath)), 0);
+}
+
+// Returns the newest mtime in a file or source directory recursively.
+function latestPathMtime(sourcePath) {
+  try {
+    const stat = fs.statSync(sourcePath);
+    if (!stat.isDirectory()) {
+      return stat.mtimeMs;
+    }
+    return fs.readdirSync(sourcePath, { withFileTypes: true })
+      .reduce((latest, entry) => Math.max(latest, latestPathMtime(path.join(sourcePath, entry.name))), stat.mtimeMs);
+  } catch {
+    return 0;
+  }
+}
+
+// Writes the same normal-build stamp used by bin/fpasoterm to skip rebuilds.
+function writeBuildStamp(binary) {
+  if (!fs.existsSync(binary)) {
+    return;
+  }
+  fs.writeFileSync(buildStampPath, JSON.stringify({
+    binary,
+    binaryMtime: fs.statSync(binary).mtimeMs,
+    sourceMtime: latestRuntimeSourceMtime(),
+  }, null, 2));
+}
+
+// Copies one desktop or icon file, creating the target directory first.
+function copyFile(source, target) {
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(source, target);
+  console.log(`${source} -> ${target}`);
+}
+
+// Runs optional desktop cache refresh commands when they exist on the host.
+function runOptional(command, args) {
+  const result = childProcess.spawnSync(command, args, { stdio: 'inherit' });
+  if (result.error && result.error.code !== 'ENOENT') {
+    throw result.error;
+  }
+}
+
+// Removes legacy files created by older fpasoterm versions.
+function removeFile(target) {
+  if (fs.existsSync(target)) {
+    fs.rmSync(target, { force: true });
+    console.log(`removed old file: ${target}`);
+  }
+}
+
+// Quotes paths safely for the generated shell wrapper.
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+// Returns the Node.js executable used to run this installer when it is stable.
+function currentNodePath() {
+  return path.isAbsolute(process.execPath) && fs.existsSync(process.execPath) ? process.execPath : '';
+}
+
+// Formats the Exec command path for a desktop entry. ChromeOS Linux launchers
+// are more reliable with a plain absolute path when the wrapper path has no
+// spaces.
+function desktopExec(value) {
+  if (/[\s"'\\]/.test(value)) {
+    return `"${value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
+  }
+  return value;
+}
+
+// Installs a desktop entry that points at the absolute wrapper path.
+function installDesktopEntry(commandPath) {
+  const source = path.join(root, 'extra', 'linux', 'io.github.oyoguhito.fpasoterm.desktop');
+  const target = path.join(applicationsDir, 'io.github.oyoguhito.fpasoterm.desktop');
+  const shortTarget = path.join(applicationsDir, 'fpasoterm.desktop');
+  const desktop = fs.readFileSync(source, 'utf8')
+    .replace(/^Exec=.*$/m, `Exec=${desktopExec(commandPath)}`)
+    .replace(/^Icon=.*$/m, 'Icon=io.github.oyoguhito.fpasoterm');
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, desktop);
+  fs.writeFileSync(shortTarget, desktop);
+  console.log(`${source} -> ${target}`);
+  console.log(`${source} -> ${shortTarget}`);
+}
+
+// Installs the local fpasoterm command wrapper into the user's bin directory.
+function installCommand() {
+  fs.mkdirSync(binHome, { recursive: true });
+  const commandPath = path.join(binHome, 'fpasoterm');
+  const nodePath = currentNodePath();
+const script = `#!/bin/sh
+set -eu
+
+APP_ROOT=${shellQuote(root)}
+INSTALL_NODE=${nodePath ? shellQuote(nodePath) : "''"}
+LOG_DIR="\${XDG_CACHE_HOME:-$HOME/.cache}/fpasoterm"
+LOG_FILE="$LOG_DIR/launcher.log"
+PATH="$HOME/.cargo/bin:$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH"
+FPASOTERM_LAUNCHER_LOG="$LOG_FILE"
+export PATH FPASOTERM_LAUNCHER_LOG
+mkdir -p "$LOG_DIR" 2>/dev/null || true
+{
+  printf '%s\\n' "--- fpasoterm launcher $(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || true) ---"
+  printf 'argv=%s\\n' "$*"
+  printf 'pwd=%s\\n' "$(pwd 2>/dev/null || true)"
+  printf 'PATH=%s\\n' "\${PATH:-}"
+  printf 'DISPLAY=%s\\n' "\${DISPLAY:-}"
+  printf 'WAYLAND_DISPLAY=%s\\n' "\${WAYLAND_DISPLAY:-}"
+  printf 'XDG_RUNTIME_DIR=%s\\n' "\${XDG_RUNTIME_DIR:-}"
+  printf 'APP_ROOT=%s\\n' "$APP_ROOT"
+  printf 'INSTALL_NODE=%s\\n' "$INSTALL_NODE"
+} >>"$LOG_FILE" 2>/dev/null || true
+cd "$APP_ROOT"
+
+if [ -n "$INSTALL_NODE" ] && [ -x "$INSTALL_NODE" ]; then
+  printf 'exec=%s\\n' "$INSTALL_NODE" >>"$LOG_FILE" 2>/dev/null || true
+  exec "$INSTALL_NODE" "$APP_ROOT/bin/fpasoterm" "$@"
+fi
+
+if command -v node >/dev/null 2>&1; then
+  printf 'exec=%s\\n' "$(command -v node)" >>"$LOG_FILE" 2>/dev/null || true
+  exec node "$APP_ROOT/bin/fpasoterm" "$@"
+fi
+
+for candidate in /usr/bin/node /usr/local/bin/node "$HOME/.local/bin/node"; do
+  if [ -x "$candidate" ]; then
+    printf 'exec=%s\\n' "$candidate" >>"$LOG_FILE" 2>/dev/null || true
+    exec "$candidate" "$APP_ROOT/bin/fpasoterm" "$@"
+  fi
+done
+
+echo "node is not available. Install Node.js and run npm run update:desktop again." >&2
+printf 'error=node is not available\\n' >>"$LOG_FILE" 2>/dev/null || true
+exit 127
+`;
+  fs.writeFileSync(commandPath, script, { mode: 0o755 });
+  fs.chmodSync(commandPath, 0o755);
+  console.log(`fpasoterm command -> ${commandPath}`);
+  return commandPath;
+}
+
+buildLocalBinary();
+
+const commandPath = installCommand();
+
+installDesktopEntry(commandPath);
+removeFile(path.join(applicationsDir, 'io.github.oyoguhito.FpasoTerm.desktop'));
+
+for (const size of iconSizes) {
+  const sourceIcon = path.join(root, 'extra', 'linux', 'icons', 'hicolor', `${size}x${size}`, 'apps', 'fpasoterm.png');
+  const targetIconDir = path.join(iconsDir, `${size}x${size}`, 'apps');
+  copyFile(sourceIcon, path.join(targetIconDir, 'fpasoterm.png'));
+  copyFile(sourceIcon, path.join(targetIconDir, 'io.github.oyoguhito.fpasoterm.png'));
+}
+
+runOptional('update-desktop-database', [applicationsDir]);
+runOptional('gtk-update-icon-cache', ['-q', iconsDir]);

package/scripts/run

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$SCRIPT_DIR"
+
+if command -v node >/dev/null 2>&1; then
+  exec node ./bin/fpasoterm "$@"
+fi
+
+if command -v mise >/dev/null 2>&1; then
+  exec mise exec node -- node ./bin/fpasoterm "$@"
+fi
+
+echo "node is not available. Install Node.js or enable mise's Node toolchain." >&2
+exit 127

package/scripts/security/scan-secrets.js

@@ -0,0 +1,89 @@
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.resolve(__dirname, '..', '..');
+const ignoredDirs = new Set([
+  '.git',
+  '.jj',
+  'artifacts',
+  'node_modules',
+  'diagnostics',
+  'target',
+  'gen',
+]);
+
+const ignoredFiles = new Set([
+  'package-lock.json',
+]);
+
+const patterns = [
+  ['AWS access key', /AKIA[0-9A-Z]{16}/],
+  ['GitHub token', /gh[pousr]_[A-Za-z0-9_]{36,}/],
+  ['npm token', /npm_[A-Za-z0-9]{36,}/],
+  ['Slack token', /xox[baprs]-[A-Za-z0-9-]{10,}/],
+  ['Google API key', /AIza[0-9A-Za-z_-]{35}/],
+  ['Private key header', /-----BEGIN (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/],
+  ['Generic assigned secret', /\b(?:api[_-]?key|secret|token|password|passwd|pwd)\b\s*[:=]\s*['"][^'"]{12,}['"]/i],
+];
+
+// Recursively returns repository files that should be scanned.
+function walk(dir) {
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    if (ignoredDirs.has(entry.name)) {
+      continue;
+    }
+
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walk(fullPath));
+      continue;
+    }
+
+    if (entry.isFile()) {
+      files.push(fullPath);
+    }
+  }
+
+  return files;
+}
+
+// Heuristically skips binary files to avoid noisy text scanning.
+function isBinary(buffer) {
+  return buffer.includes(0);
+}
+
+const findings = [];
+
+for (const file of walk(root)) {
+  const relative = path.relative(root, file);
+  if (ignoredFiles.has(relative)) {
+    continue;
+  }
+
+  const buffer = fs.readFileSync(file);
+  if (isBinary(buffer)) {
+    continue;
+  }
+
+  const lines = buffer.toString('utf8').split(/\r?\n/);
+  for (const [index, line] of lines.entries()) {
+    for (const [name, pattern] of patterns) {
+      if (pattern.test(line)) {
+        findings.push(`${relative}:${index + 1}: possible ${name}`);
+      }
+    }
+  }
+}
+
+if (findings.length > 0) {
+  console.error('Potential credentials found:');
+  for (const finding of findings) {
+    console.error(`- ${finding}`);
+  }
+  process.exit(1);
+}
+
+console.log('secret scan passed');