gina 0.3.16-alpha.1 → 0.3.16-alpha.2

package/framework/v0.3.16-alpha.2/VERSION

@@ -0,0 +1 @@
+0.3.16-alpha.2

package/framework/{v0.3.16-alpha.1 → v0.3.16-alpha.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.3.16-alpha.1",
+  "version": "0.3.16-alpha.2",
   "dependencies": {
     "@rhinostone/swig": "^2.4.0",
     "intl-messageformat": "^11.2.4",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.3.16-alpha.1/core/gna');
+var _gna = require('./framework/v0.3.16-alpha.2/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.3.16-alpha.1/core/controller');
-var EntitySuper     = require('./framework/v0.3.16-alpha.1/core/model/entity');
+var SuperController = require('./framework/v0.3.16-alpha.2/core/controller');
+var EntitySuper     = require('./framework/v0.3.16-alpha.2/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.3.16-alpha.1/lib/uuid');
+var uuid = require('./framework/v0.3.16-alpha.2/lib/uuid');
 
 module.exports = {
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.3.16-alpha.1",
+  "version": "0.3.16-alpha.2",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -72,7 +72,7 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.3.16-alpha.1/core/gna",
+  "main": "./framework/v0.3.16-alpha.2/core/gna",
   "types": "./types/index.d.ts",
   "typesVersions": {
     "*": {

package/script/check_no_local_leak.js

@@ -16,13 +16,20 @@
  * the publish if the pack listing is dirty on either of two axes:
  *
  *   1. Path-level: any local-tool configuration file or directory.
- *   2. Content-level: any text file containing a private-token pattern
- *      (phone, private email, private address, private domain). The
- *      co-author's legal name is allowed in authoring/contributing files
- *      (README, AUTHORS, GOVERNANCE, CONTRIBUTING, package.json
- *      contributors, scaffolding template, framework AUTHORS, framework
- *      plugin package.json authors) — see `ATTRIBUTION_PATHS` in
- *      `_load_private_tokens.js`.
+ *   2. Content-level (two sub-axes per scanned text file):
+ *      (a) Private-token pattern (phone, private email, private address,
+ *          private domain). The co-author's legal name is allowed in
+ *          authoring/contributing files (README, AUTHORS, GOVERNANCE,
+ *          CONTRIBUTING, package.json contributors, scaffolding template,
+ *          framework AUTHORS, framework plugin package.json authors) —
+ *          see `ATTRIBUTION_PATHS` in `_load_private_tokens.js`.
+ *      (b) AI-attribution leak (#R5, 2026-05-19): file content embedding
+ *          local-tool path literals (`CLAUDE.md`, `.claude/...`),
+ *          attribution footers (Co-Authored-By Claude/Anthropic, Generated
+ *          by Claude), AI-tool URLs (claude.ai, claude.com/claude-code).
+ *          Vendor-functionality references (protocol identifiers, vendor
+ *          SDK names, env-var names) are stripped before the check so the
+ *          AI connector code and provider tables don't false-positive.
  *
  * Plus a third gate that fires BEFORE the scan starts:
  *
@@ -63,6 +70,28 @@ var PATH_PATTERN = /(^|\/)(CLAUDE\.md|\.claude[a-z]*)/i;
 // regex stays in one place.
 var CONTENT_TOKENS = loadPrivateTokens();
 
+// AI-attribution leak (#R5) — content-level pattern set matching the
+// global HARD RULE forbidden surface. Catches the 0.3.15 leak shape
+// where a tarball file's NAME was clean but its CONTENT embedded
+// forbidden strings (the gitignored sidecar `script/.local-sync-targets.json`
+// listed `CLAUDE.md` + `.claude/conventions.md` as literal paths; the
+// PATH_PATTERN scan above missed it because the sidecar's own filename
+// is neutral). Pattern covers: bare `CLAUDE.md` literal, `.claude*`
+// directory/file paths, AI-tool URLs (claude.ai, claude.com/claude-code),
+// attribution footers (Co-Authored-By Claude/Anthropic, Generated by
+// Claude, noreply@anthropic.com, 🤖-prefixed Claude mentions).
+var ATTRIBUTION_LEAK_RE = /\bCLAUDE\.md\b|\.claude[a-z]*|claude\.ai|claude\.com\/claude-code|Co-Authored-By:?\s*[^\n]{0,30}(?:Claude|Anthropic)|noreply@anthropic\.com|Generated (?:by|with)\s+\[?Claude|🤖[^\n]{0,30}Claude/i;
+
+// Vendor-functionality references — stripped from content BEFORE the
+// leak check so the AI connector and provider tables don't false-
+// positive on legitimate vendor mentions. Matches the "Allowed
+// exceptions — product functionality (not attribution)" block in the
+// global HARD RULE: AI-connector protocol identifiers, vendor SDK
+// package names, canonical env-var names. Any token here is replaced
+// with empty string in a one-shot copy of the content before
+// ATTRIBUTION_LEAK_RE.test() runs.
+var ATTRIBUTION_EXCEPTION_RE = /anthropic:\/\/|openai:\/\/|deepseek:\/\/|qwen:\/\/|groq:\/\/|mistral:\/\/|gemini:\/\/|xai:\/\/|perplexity:\/\/|ollama:\/\/|@anthropic-ai\/sdk|ANTHROPIC_API_KEY|OPENAI_API_KEY/gi;
+
 // Heuristic: only read files that are likely text. Saves time on binary
 // assets (images, compiled JARs, compressed .br/.gz) and prevents
 // pattern matches from random byte sequences.
@@ -71,9 +100,13 @@ var TEXT_BASENAME = /^(AUTHORS|LICENSE|COPYING|CHANGELOG|README|NOTICE|CONTRIBUT
 
 // Scanner scripts contain the token patterns themselves — skip them to
 // avoid self-matches. Future maintainers: add any new scanner files here.
+// `_load_private_tokens.js` joined the list with #R5 because its JSDoc
+// references the HARD-RULE patterns (`CLAUDE.md / .claude*`) literally,
+// which would otherwise trip ATTRIBUTION_LEAK_RE.
 var SELF_EXCLUDE = {
-    'script/check_no_local_leak.js': true,
-    'script/prepare_version.js':     true
+    'script/check_no_local_leak.js':  true,
+    'script/prepare_version.js':      true,
+    'script/_load_private_tokens.js': true
 };
 // Files larger than this are skipped — production binaries and bundles
 // don't warrant a byte-by-byte scan.
@@ -101,6 +134,16 @@ function scanContent(filePath) {
             hits.push(CONTENT_TOKENS[i].name);
         }
     }
+
+    // AI-attribution leak (#R5). Strip vendor-functionality references
+    // from a one-shot copy of the content so legitimate AI-connector
+    // code and provider tables don't false-positive; then test the
+    // remaining content against ATTRIBUTION_LEAK_RE. Single boolean
+    // hit — caller surfaces the offending path + the marker.
+    var stripped = content.replace(ATTRIBUTION_EXCEPTION_RE, '');
+    if (ATTRIBUTION_LEAK_RE.test(stripped)) {
+        hits.push('AI-attribution leak');
+    }
     return hits;
 }
 
@@ -164,7 +207,7 @@ try {
 
     if (contentMatches.length > 0) {
         if (failed) console.error('');
-        console.error('[prepack] ERROR: Private tokens in pack contents:');
+        console.error('[prepack] ERROR: Leaks in pack contents:');
         for (var b = 0; b < contentMatches.length; b++) {
             console.error('  - ' + contentMatches[b]);
         }

package/.github/FUNDING.yml

@@ -1 +0,0 @@
-github: gina-automator

package/.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,35 +0,0 @@
----
-name: Bug report
-about: Report a bug or unexpected behaviour
-labels: bug
----
-
-## Environment
-
-| Field | Value |
-| --- | --- |
-| Node.js version (`node --version`) | |
-| Gina version (`gina --version`) | |
-| OS | |
-
-## Description
-
-<!-- A clear description of the bug -->
-
-## Steps to reproduce
-
-1.
-2.
-3.
-
-## Expected behaviour
-
-<!-- What you expected to happen -->
-
-## Actual behaviour
-
-<!-- What actually happened — include error output, stack trace, or logs if available -->
-
-## Additional context
-
-<!-- Any other relevant information (bundle config, connectors.json snippet, etc.) -->

package/.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,21 +0,0 @@
----
-name: Feature request
-about: Propose a new feature or improvement
-labels: enhancement
----
-
-## Use case
-
-<!-- What problem does this solve? Who benefits and in what context? -->
-
-## Proposed solution
-
-<!-- Describe the feature, API shape, or behaviour change you have in mind -->
-
-## Alternatives considered
-
-<!-- Other approaches you considered and why you preferred this one -->
-
-## Additional context
-
-<!-- Relevant prior art, links to related issues, or implementation notes -->

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,19 +0,0 @@
-## Summary
-
-<!-- What does this PR do? One or two sentences. -->
-
-## Related issue
-
-<!-- Closes #NNN or "No related issue" -->
-
-## Checklist
-
-- [ ] Tests pass — `node --test test/**/*.test.js`
-- [ ] New behaviour is covered by a test (or justification provided below)
-- [ ] `changie new` entry added for any user-facing change
-- [ ] Commit messages follow the project style (imperative/gerund, no AI references)
-- [ ] Docs updated if public API, CLI, or config schema changed
-
-## Notes
-
-<!-- Anything the reviewer should pay attention to — design trade-offs, known gaps, follow-up items -->

package/.github/dependabot.yml

@@ -1,12 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    ignore:
-      # Vendored dependencies under framework/v*/ are managed manually.
-      # They are not installed via npm — do not auto-update them.
-      - dependency-name: "*"
-        update-types: ["version-update:semver-patch"]
-    open-pull-requests-limit: 5

package/.github/scripts/scan-vendored-cves.js

@@ -1,188 +0,0 @@
-#!/usr/bin/env node
-/*
- * This file is part of the gina package.
- * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-/**
- * OSV-based CVE scan for vendored deps.
- *
- * Walks every `package.json` under `framework/v*\/core/deps/`, extracts
- * `(name, version)` pairs, queries `api.osv.dev`, and exits non-zero if
- * any vulnerability is matched.
- *
- * Pinning convention (see internal architecture docs): the
- * vendored `package.json` stays byte-identical to upstream until
- * patched; on patch, `version` is bumped to `<upstream>-rhinostone.N`
- * (e.g. `1.6.0-rhinostone.1`). This script strips the
- * `-rhinostone.N` suffix before querying so OSV still matches the base
- * upstream version.
- *
- * Exit codes:
- *   0 — clean, no CVEs matched
- *   1 — at least one vulnerability matched (build fails)
- *   2 — scan error (malformed package.json, network failure)
- *
- * @module .github/scripts/scan-vendored-cves
- */
-
-'use strict';
-
-var fs    = require('fs');
-var path  = require('path');
-var https = require('https');
-
-var ROOT = path.resolve(__dirname, '..', '..');
-
-/**
- * Walk every `framework/v*\/core/deps/<dep>/package.json` and return the
- * list of absolute paths.
- *
- * @returns {string[]}
- */
-function walkDepsPackageJsons() {
-    var frameworkDir = path.join(ROOT, 'framework');
-    if (!fs.existsSync(frameworkDir)) return [];
-    var results = [];
-    var fws = fs.readdirSync(frameworkDir);
-    for (var i = 0; i < fws.length; i++) {
-        var depsDir = path.join(frameworkDir, fws[i], 'core', 'deps');
-        if (!fs.existsSync(depsDir)) continue;
-        if (!fs.statSync(depsDir).isDirectory()) continue;
-        var deps = fs.readdirSync(depsDir);
-        for (var j = 0; j < deps.length; j++) {
-            var pkgPath = path.join(depsDir, deps[j], 'package.json');
-            if (fs.existsSync(pkgPath)) results.push(pkgPath);
-        }
-    }
-    return results;
-}
-
-/**
- * Strip the local-patch suffix (`-rhinostone.N`) so OSV sees the base
- * upstream version. If the version has no such suffix, returned as-is.
- *
- * @param {string} v
- * @returns {string}
- */
-function normalizeVersion(v) {
-    return String(v).replace(/-rhinostone\.\d+$/, '');
-}
-
-/**
- * POST a single `(name, version)` query to api.osv.dev/v1/query.
- * Resolves with the parsed JSON response (which may carry `{vulns: [...]}`
- * or be empty `{}` on a clean match).
- *
- * @param {string} name
- * @param {string} version
- * @returns {Promise<object>}
- */
-function queryOSV(name, version) {
-    return new Promise(function (resolve, reject) {
-        var body = JSON.stringify({
-            package: { name: name, ecosystem: 'npm' },
-            version: version
-        });
-        var req = https.request({
-            method:   'POST',
-            hostname: 'api.osv.dev',
-            path:     '/v1/query',
-            headers: {
-                'Content-Type':   'application/json',
-                'Content-Length': Buffer.byteLength(body)
-            }
-        }, function (res) {
-            var data = '';
-            res.on('data', function (chunk) { data += chunk; });
-            res.on('end', function () {
-                if (res.statusCode !== 200) {
-                    return reject(new Error('OSV HTTP ' + res.statusCode + ': ' + data));
-                }
-                try {
-                    resolve(JSON.parse(data));
-                } catch (e) {
-                    reject(e);
-                }
-            });
-        });
-        req.on('error', reject);
-        req.write(body);
-        req.end();
-    });
-}
-
-/**
- * Scan driver. Walks the target package.jsons, queries OSV for each,
- * prints a one-line status per dep, exits with the appropriate code.
- *
- * @returns {Promise<number>} exit code
- */
-async function main() {
-    var pkgs = walkDepsPackageJsons();
-    if (pkgs.length === 0) {
-        console.log('[osv] no vendored package.json files found under framework/v*/core/deps/');
-        return 0;
-    }
-
-    var failures = 0;
-    var scanned  = 0;
-    for (var i = 0; i < pkgs.length; i++) {
-        var pkgPath = pkgs[i];
-        var rel     = path.relative(ROOT, pkgPath);
-        var pkg;
-        try {
-            pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-        } catch (e) {
-            console.error('[osv] ' + rel + ': cannot parse (' + e.message + ')');
-            return 2;
-        }
-        if (!pkg.name || !pkg.version) {
-            console.log('[osv] SKIP ' + rel + ': missing name or version');
-            continue;
-        }
-
-        var baseVersion = normalizeVersion(pkg.version);
-        var suffix      = (pkg.version !== baseVersion) ? ' (patched: ' + pkg.version + ')' : '';
-        var result;
-        try {
-            result = await queryOSV(pkg.name, baseVersion);
-        } catch (e) {
-            console.error('[osv] ' + rel + ': query failed — ' + e.message);
-            return 2;
-        }
-
-        scanned++;
-        var vulns = result.vulns || [];
-        if (vulns.length > 0) {
-            failures++;
-            console.error('[osv] VULNERABLE ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
-            for (var v = 0; v < vulns.length; v++) {
-                var entry   = vulns[v];
-                var aliases = (entry.aliases || []).join(', ');
-                var summary = (entry.summary || entry.details || '').replace(/\s+/g, ' ').slice(0, 140);
-                console.error('       ' + entry.id + (aliases ? ' (' + aliases + ')' : '') + ' — ' + summary);
-            }
-        } else {
-            console.log('[osv] OK ' + pkg.name + '@' + baseVersion + suffix + ' (' + rel + ')');
-        }
-    }
-
-    console.log('');
-    if (failures > 0) {
-        console.error('[osv] ' + failures + ' vendored dep(s) with matching CVEs — failing the build.');
-        return 1;
-    }
-    console.log('[osv] clean — no CVEs matched across ' + scanned + ' vendored dep(s).');
-    return 0;
-}
-
-main().then(function (code) {
-    process.exit(code);
-}).catch(function (err) {
-    console.error('[osv] uncaught:', err);
-    process.exit(2);
-});

package/.github/workflows/bundle-freshness.yml

@@ -1,116 +0,0 @@
-name: Bundle Freshness
-
-# Verifies that the committed dist/vendor/gina/ bundle matches what would
-# be produced by rebuilding from the current source.  Catches the
-# source-committed-without-rebuild gap that .githooks/pre-commit (cheap,
-# "did you stage dist?") cannot detect — i.e. a stale dist was staged
-# alongside a fresh source change.
-#
-# Precedent: #SCS1e (commit 48b8fd26) shipped four validator walker
-# replacements as source-only.  The bundle was not rebuilt until commit
-# 69fb32fc picked it up as a side effect of toolbar removal.  Any browser
-# loading gina.min.js between those two commits still ran the original
-# eval('data.' + localValue).  See llms.txt §72.
-
-on:
-  push:
-    branches: [develop, master]
-  pull_request:
-    branches: [develop, master]
-  workflow_dispatch:
-
-# Cancel any in-flight check for the same ref when a newer one kicks off.
-concurrency:
-  group: bundle-freshness-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  freshness:
-    name: Verify dist matches source
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '22'
-
-      - name: Set up Java (for Closure Compiler)
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: '21'
-
-      - name: Install build prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y brotli
-
-      - name: Install dev dependencies
-        run: |
-          # `npm ci` (not `npm install`) — strictly respects package-lock.json
-          # so devDeps like engine.io-client (which gets baked into the bundle
-          # via build.json) don't drift between local rebuilds and CI rebuilds.
-          # See llms.txt §72 / 2026-04-24 incident.
-          npm ci --ignore-scripts
-          ln -sf $(pwd) node_modules/gina
-
-      - name: Prepare framework dependencies
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          FW_DIR="framework/v${VERSION}"
-          if [ ! -f "${FW_DIR}/package.json" ]; then
-            cat > "${FW_DIR}/package.json" <<EOF
-          {
-            "name": "gina-framework",
-            "version": "${VERSION}",
-            "dependencies": {
-              "@rhinostone/swig": "^1.6.0"
-            }
-          }
-          EOF
-          fi
-          (cd "${FW_DIR}" && npm install --ignore-scripts)
-
-      - name: Install Closure Compiler JARs
-        run: bash framework/v*/core/asset/plugin/lib/js/install-closure-compiler.sh
-
-      - name: Rebuild bundle
-        run: |
-          bash framework/v*/core/asset/plugin/build --env=prod \
-            --sass-bin="$PWD/node_modules/.bin/sass" \
-            --csso-bin="$PWD/node_modules/.bin/csso" \
-            --rjs-bin="$PWD/node_modules/.bin/r.js"
-
-      - name: Verify dist is in sync with source
-        run: |
-          # *.gz files are excluded: gzip output is platform-specific (Apple
-          # gzip on the maintainer's Mac vs GNU gzip on Linux runners produce
-          # different deflate bytes for the same input — even Node's zlib
-          # disagrees Mac↔Linux because it links the system zlib). Brotli IS
-          # cross-platform deterministic (single canonical reference impl),
-          # so the .br files remain checked. If a .css/.js/.html source
-          # changes without a rebuild, the .br diff catches it; the .gz
-          # divergence would have been a false positive.
-          if ! git diff --exit-code -- \
-                  'framework/v*/core/asset/plugin/dist/vendor/gina/' \
-                  ':(exclude)framework/v*/core/asset/plugin/dist/vendor/gina/**/*.gz'; then
-            echo ""
-            echo "::error::Bundle is out of sync with source."
-            echo "::error::A source file under one of the AMD-aliased paths in build.json"
-            echo "::error::was modified without a corresponding rebuilt dist staged."
-            echo "::error::"
-            echo "::error::Locally:"
-            echo "::error::  bash framework/v*/core/asset/plugin/build --env=prod"
-            echo "::error::  git add framework/v*/core/asset/plugin/dist/vendor/gina/"
-            echo "::error::"
-            echo "::error::See llms.txt §72 for the rebuild-gate discipline."
-            exit 1
-          fi
-          echo "Bundle is fresh — dist matches source (excluding *.gz, which is platform-divergent)."

package/.github/workflows/security.yml

@@ -1,84 +0,0 @@
-name: Security
-
-on:
-  push:
-    branches: [develop, master]
-  pull_request:
-    branches: [develop, master]
-
-jobs:
-  local-leak-check:
-    name: Local-tool leak scan
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-
-      # #S6 — Backs up the local pre-commit hook (#S5) and the publish-boundary
-      # gate in prepare_version.js (#S3). Fails the build if any tracked path
-      # matches local-tool configuration paths. Also retroactively catches
-      # leaks that landed before the active defenses were wired.
-      - name: Scan tracked files for local-tool paths
-        run: |
-          matches=$(git ls-files | grep -iE '(^|/)(CLAUDE\.md|\.claude[a-z]*)' || true)
-          if [ -n "$matches" ]; then
-            echo "::error::local-tool paths detected in git index:"
-            echo "$matches" | sed 's/^/  - /'
-            echo ""
-            echo "These paths must never be tracked. Remove with: git rm --cached <path>"
-            echo "If pushed already, scrub history with git filter-repo."
-            exit 1
-          fi
-          echo "OK: no local-tool paths in git index."
-
-  ai-attribution-content-scan:
-    name: AI-attribution content scan
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-
-      # #S7 — CI mirror of the pre-commit hook's content-scan section.
-      # While #S6 catches LOCAL-TOOL PATHS (file names), #S7 catches
-      # AI-ATTRIBUTION SUBSTRINGS in tracked file CONTENT. Pattern must
-      # stay in sync with .githooks/pre-commit. Documented exceptions:
-      #   - Protocol identifiers used by the AI connector (anthropic://,
-      #     openai://, deepseek://, qwen://, groq://, mistral://, gemini://,
-      #     xai://, perplexity://, ollama://)
-      #   - Vendor SDK package names (@anthropic-ai/sdk, openai npm package)
-      #   - Canonical env-var names (ANTHROPIC_API_KEY, OPENAI_API_KEY)
-      # Files where these patterns appear by design (this workflow, the
-      # local hook, the prepack scanner) and auto-generated dist artefacts
-      # (browser bundles, minified output, source maps) are excluded — the
-      # source-side scan catches the leak before it reaches dist.
-      - name: Scan tracked content for AI-attribution leaks
-        run: |
-          LEAK_RE='\.claude/|\.claudeignore|claude\.ai|claude\.com/claude-code|Co-Authored-By:?[^\n]{0,30}(Claude|Anthropic)|Generated (by|with)[^\n]{0,30}Claude|🤖[^\n]{0,30}Claude'
-          EXCEPTION_RE='anthropic://|openai://|deepseek://|qwen://|groq://|mistral://|gemini://|xai://|perplexity://|ollama://|@anthropic-ai/sdk|ANTHROPIC_API_KEY|OPENAI_API_KEY'
-          EXCLUDED='^(\.githooks/pre-commit|\.github/workflows/security\.yml|script/check_no_local_leak\.js|script/prepare_version\.js|\.gitignore|\.npmignore|framework/v[^/]+/core/asset/plugin/dist/.*|.*\.(min\.(js|css)(\.br|\.gz)?|map))$'
-
-          found=0
-          while IFS= read -r f; do
-              if echo "$f" | grep -qE "$EXCLUDED"; then continue; fi
-              case "$f" in
-                  *.png|*.jpg|*.jpeg|*.gif|*.svg|*.woff|*.woff2|*.ttf|*.ico|*.jar|*.zip|*.tar|*.gz|*.br|*.afdesign|*.pdf|*.mp3|*.mp4|*.heic|*.webp) continue ;;
-              esac
-              size=$(stat -c%s "$f" 2>/dev/null || stat -f%z "$f" 2>/dev/null || echo 0)
-              if [ "$size" -gt 2097152 ]; then continue; fi
-              stripped=$(sed -E "s#$EXCEPTION_RE##gI" "$f" 2>/dev/null || true)
-              if printf '%s' "$stripped" | grep -qiE "$LEAK_RE"; then
-                  echo "::error file=$f::AI-attribution leak in tracked content"
-                  printf '%s' "$stripped" | grep -niE "$LEAK_RE" | head -3 | sed 's/^/    /'
-                  found=1
-              fi
-          done < <(git ls-files)
-
-          if [ "$found" = "1" ]; then
-              echo ""
-              echo "These mentions must not reach a public surface."
-              echo "Allowed exceptions (already filtered): protocol identifiers (anthropic://"
-              echo "and siblings), vendor SDK package names (@anthropic-ai/sdk, openai),"
-              echo "canonical env-var names (ANTHROPIC_API_KEY, OPENAI_API_KEY)."
-              exit 1
-          fi
-          echo "OK: no AI-attribution leaks in tracked content."