second-read 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dean Verleger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,216 @@
-# Temporary Holding Version
+# second-read
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+_A privacy check on agent-written commits, issues, PRs and comments, for any coding agent._
+
+Coding agents write a lot of prose on your behalf: commit messages, issue and PR bodies, review comments. Some of it
+mentions things about you that you'd never post yourself, such as a path on your machine, the name of a private
+project, or a detail about your accounts. Nobody can read every line an agent posts, and a rule in a prompt is
+followed most of the time, not every time. Once a slip is posted, it's hard to take back: edit histories keep old
+revisions, and a commit is public until the history is rewritten.
+
+second-read reads what's about to go out and stops it when it finds something private. It doesn't rewrite your text.
+It refuses, names what it found, and leaves the fix to you or your agent.
+
+> **Status:** early. The check, the git and `gh` guards and the Claude Code plugin run; the model check, other agent
+> adapters and the sweep are planned.
+> [PLAN.md](./PLAN.md) is the design.
+
+## What it checks
+
+- **Paths on your machine:** anything under your home folder, temporary and scratch folders.
+- **Who you are on this machine:** your account name, your machine's name and email addresses, apart from the
+  ones you allow (such as GitHub's `noreply` address). Your own address, git's `user.email`, is checked whatever a
+  repository allows.
+- **Money and accounts:** plans, billing, payments, spending, usage limits, what you will or won't pay for, and
+  credentials.
+- **Your own list of private words:** project, folder, character or client names, in a file on your machine that is
+  never checked in anywhere.
+- **What you told the agent in private**, where an agent tool can run a model check. That means your reasons,
+  feelings, frustrations and preferences, and your life outside the work, quoted or paraphrased. A post should say
+  what changed, not why you personally decided it, unless that reason is about the work.
+- **Other paraphrases**, by the same model check: "your disk is nearly full", a description of your accounts or
+  your setup.
+
+It isn't a secrets scanner. Tools like gitleaks find keys and tokens, and second-read is meant to run beside one.
+
+## Where it runs
+
+- **git hooks:** commit messages, and the lines a push adds.
+- **A `gh` shim:** the text of issues, pull requests, comments, releases, gists, labels and repositories, and the
+  names they're given, before the real `gh` sends it.
+- **Agent adapters**, for posts that don't go through `git` or `gh`, such as a GitHub tool an agent calls directly.
+  Claude Code comes first. Other agents follow, each written from its tool's own hook docs.
+- **A sweep** of what's already posted to a repository, edit histories included.
+
+The check runs on your machine, and the text it reads goes nowhere else.
+
+## Install
+
+second-read needs Node 22 or newer.
+
+```sh
+npm install -g second-read
+second-read init
+```
+
+`init` writes your config file and says how to add your private terms. To update later, run
+`npm install -g second-read` again.
+
+## Using the check
+
+```sh
+second-read init                                  # writes your config file, with no terms in it
+echo "$MESSAGE" | second-read check --kind commit
+```
+
+`check` exits `0` when the text is clean, `1` with findings and `2` when the check itself fails, so a guard can
+refuse on anything but `0`. The report names each finding's category, line and text, and is printed only on your
+machine.
+
+Your config file is `~/.config/second-read/config.toml` (`$XDG_CONFIG_HOME`, or `%APPDATA%` on Windows):
+
+```toml
+terms = ["example-private-project"]       # never posted; see below
+allowed_words = ["billing"]               # money words that are fine to post
+allowed_emails = ["*@example.com"]
+allowed_paths = ["~/.config/some-tool"]
+allowed_names = ["juniper"]               # your account or machine name, when it's an ordinary word
+```
+
+A term matches in any case, with or without accents, in fullwidth forms, with invisible characters inside it, and
+with its words joined by spaces, hyphens or nothing. It doesn't catch misspellings.
+
+The machine name isn't flagged when it's one a system gives by default, such as `MacBook-Pro`, `raspberrypi` or
+`penguin`, or a word for the kind of computer, such as `laptop`. Any other name is, even an ordinary word, since a
+name someone chose can say who they are. If yours is a word that's fine to post, put it in `allowed_names`, and
+the same goes for an account name. Paths with your account name in them are still flagged.
+
+A repository can check in a `.second-read.toml` with the same `allowed_*` keys, but for `allowed_names`: naming
+your machine there would post it. It can't hold `terms`, and it's an error if it names one of your private terms.
+Since anyone who can change the repository can change it, it also can't switch a whole check off: `allowed_paths`
+can't take in all of `~` or a temp folder, and each `allowed_emails` pattern needs a fixed domain (`*@example.com`
+or `*@*.example.com`, not `*@*` or `*@*.com`). Your own file has none of these limits.
+
+A pattern with a fixed domain can still take in a lot, such as `*@*.co.uk`, or `*@gmail.com` and everyone there. So
+your own addresses, each `user.email` git uses where the check runs, are checked whatever a repository allows,
+unless one is a noreply address. Your own file allows one only by naming it exactly, as `git commit -s` needs: a
+pattern such as `*@gmail.com` is for other people's addresses, and doesn't take in yours.
+
+A repository whose code or tests hold paths, emails or money words on purpose can list those files in its
+`.second-read.toml`:
+
+```toml
+exempt_files = ["src/**/*.test.ts", "fixtures/"]
+```
+
+`pre-push` checks the lines a push adds to them for your private terms only. Each glob is a path from the top of the
+repository: `*` and `?` stay within one folder, `**` takes in any number of them, and a trailing `/` takes in a
+whole folder. A glob made only of wildcards and dots, such as `**` or `**/*.*`, is an error, since it takes in nearly
+every file; one for dotfiles, such as `**/.*`, is fine. Commit and tag messages, branch and tag names, and everything
+the `gh` shim sends are still checked in full, a gist's files included: a gist is a post of its own.
+
+## The guards
+
+```sh
+second-read hooks install    # in a repository: adds the commit-msg and pre-push hooks
+second-read shim install     # writes a gh shim, and says which folder to put ahead of gh on PATH
+```
+
+- **`commit-msg`** checks the message git is about to commit.
+- **`pre-push`** checks the message and the added lines of every commit the remote doesn't have yet (for a merge, the
+  lines in none of its parents, such as a conflict resolution's), and the name each branch and tag gets on the remote,
+  with the same checks as a message: a branch called `fix-billing-page` or `paid-plan` is refused for the money words
+  unless the allowlist lets them through. An annotated tag's own name is checked too, since it goes with the tag
+  whatever the remote calls it. Deleting a branch or tag is never refused, since that's how a leaked name is taken
+  back. It also refuses a push that changes a `.second-read.toml`, and prints an id for each change: the new version's
+  blob, or the commit that deletes the file. Once you've read the change, push again with
+  `SECOND_READ_ALLOWLIST_REVIEWED="<id>"`. An id covers only that change, so a later one is refused again.
+- **The `gh` shim** checks `--title`, `--body`, `--body-file` and a body read from stdin, for `gh issue` and
+  `gh pr` `create`, `edit` and `comment`, and `gh pr review`. It also checks the `--comment` that `close` and
+  `reopen` leave, and the `--subject` and body of `gh pr merge`'s merge commit. It checks a release's title,
+  notes and tag, a gist's description and the files it uploads, stdin included, with the name each is uploaded
+  under, a label's name and description, and a repository's name and description, on `gh repo rename` too. A name
+  is checked as a branch name is, and only the new one, so a leaked name can be renamed away. Then it runs the real
+  `gh` with the same arguments and input. Every other command, `gh api` included, passes straight through.
+
+Each guard refuses on a finding, and also when the check itself fails. A hook that was already in place is set aside
+and still runs after the check; `second-read hooks uninstall` removes only second-read's hooks and puts it back. The
+repository's `.second-read.toml` is read from the repository the hook runs in, or from the folder the shim runs in.
+
+When `core.hooksPath` points at a checked-in folder, the hooks go into a folder inside `.git` instead, and this
+clone's `core.hooksPath` points there. The repository's hooks still run, including ones added later: each hook
+githooks(5) lists, except `push-to-checkout`. git runs `reference-transaction` and `post-index-change` very often, so
+they run only if the repository had them when you installed; install again after adding one. `hooks uninstall` puts
+`core.hooksPath` back. Running the repository's own setup step again, if it sets `core.hooksPath`, turns the guards
+off until you install them again.
+
+## The Claude Code plugin
+
+The plugin checks what Claude Code is about to post, before the tool call runs. When it finds something, it denies
+the call and gives Claude the report as the reason, so Claude can fix the text and try again. It needs Claude Code
+2.1.295 or newer and Node 22.18 or newer on `PATH`, and it reads the same config files as the guards.
+
+1. Add this repository as a plugin marketplace:
+
+   ```sh
+   claude plugin marketplace add deanbot/second-read
+   ```
+
+2. Install the plugin:
+
+   ```sh
+   claude plugin install second-read@second-read
+   ```
+
+3. Check that it's installed and enabled:
+
+   ```sh
+   claude plugin list
+   ```
+
+It checks:
+
+- **Bash commands that post through `gh`:** the same `gh` commands as the shim, behind `env`, `sudo` and the like,
+  and `gh api` calls that send fields (`-f`, `-F`, including `@file`) or an `--input` body, unless they're `GET`. A GraphQL query
+  is checked when it's a mutation.
+- **`git commit` and `git tag` messages**, from `-m`, `-F` and `--trailer`. What a push sends is the `pre-push`
+  hook's to check.
+- **GitHub tools from MCP servers:** any tool with `github` in its name, in any case, apart from the ones that only
+  read (`get_`, `list_`, `search_`, `_read`). Every string it's given is checked, except `owner` and `repo`. A
+  file's contents are checked like the lines a push adds, so `exempt_files` applies to them.
+
+A body can come from a heredoc (`--body "$(cat <<'EOF' … EOF)"`), a here-string, a file, or `cat`, `echo` or
+`printf` piped in. A file the same command writes first, as in `cat > body.md <<'EOF'`, is read from the command,
+since the hook runs before it does. Posts inside `$(…)` and backticks are checked too. A body the shell fills in
+only when the command runs, such as `--body "$BODY"` or what `xargs` adds, can't be read beforehand, so the call is
+denied. Put the text in the command, or in a file and pass its path.
+
+The plugin never approves a call. A clean post goes on to Claude Code's usual permission check. Its deny holds in
+`bypassPermissions` mode too: a session run with `--permission-mode bypassPermissions` on Claude Code 2.1.302 had
+its leaking post refused.
+
+If the hook itself fails or times out, the call is denied. A hook that can't run at all, because `node` isn't on
+`PATH` or is older than 22.18, denies every Bash call, not only posts. To get out of that:
+
+1. Turn the plugin off, from a terminal:
+
+   ```sh
+   claude plugin disable second-read@second-read
+   ```
+
+2. Install Node 22.18 or newer.
+
+3. Turn the plugin back on:
+
+   ```sh
+   claude plugin enable second-read@second-read
+   ```
+
+Before Claude Code 2.1.295, the hook's `onFailure` setting is ignored, so a hook that crashes lets the call through.
+
+A setup script can tell whether the plugin is in place with `claude plugin list --json`, which lists it as
+`"id": "second-read@second-read"` with `"enabled": true`.
+
+## License
+
+[MIT](./LICENSE)

package/dist/checks.js

@@ -0,0 +1,325 @@
+import { escapeRegExp, fold, originalSpan, termPattern, wordPattern } from "./normalize.js";
+export const KINDS = ["commit", "issue", "pr", "comment", "review"];
+export const KIND_NAMES = {
+    commit: "this commit message",
+    issue: "this issue",
+    pr: "this pull request",
+    comment: "this comment",
+    review: "this review",
+};
+export const DEFAULT_ALLOWED_EMAILS = [
+    "*@users.noreply.github.com",
+    "noreply@github.com",
+    "git@github.com",
+    "noreply@*",
+    "no-reply@*",
+    "*@users.noreply.gitlab.com",
+    "*@example.com",
+    "*@example.org",
+    "*@example.net",
+    "*@*.example",
+    "*@*.test",
+    "*@*.invalid",
+];
+// Generic places under the home folder that say nothing about the person.
+export const DEFAULT_ALLOWED_PATHS = [
+    "~/.config",
+    "~/.local",
+    "~/.cache",
+    "~/.ssh",
+    "~/.gitconfig",
+    "~/.npmrc",
+    "~/.bashrc",
+    "~/.bash_profile",
+    "~/.zshrc",
+    "~/.profile",
+];
+// Account and machine names too generic to flag.
+const GENERIC_NAMES = new Set([
+    "admin", "app", "dev", "ec2-user", "guest", "localhost", "node", "nobody", "root", "runner", "ubuntu", "user",
+    "vagrant",
+].map(nameKey));
+// Machine names a system or an installer sets, and words for the kind or model of computer. A word someone might pick
+// as a name stays out, since a chosen name can say who they are; the user's own allowed_names takes in those. These
+// never apply to the account name, which is often the person's own name, and some of these are given names.
+const DEFAULT_MACHINE_NAMES = new Set([
+    "Mac", "MacBook", "MacBook-Air", "MacBook-Pro", "Mac-mini", "Mac-Pro", "Mac-Studio", "iMac", "iMac-Pro",
+    "computer", "desktop", "laptop", "notebook", "workstation", "server",
+    "raspberrypi", "penguin", "steamdeck", "debian", "fedora", "kali", "archiso", "manjaro", "pop-os", "nixos",
+    "docker-desktop",
+].map(nameKey));
+// A name as it's compared with the lists above: folded, without separators, and without the number a system adds
+// to tell two machines apart, as in "MacBook-Pro-2".
+function nameKey(name) {
+    return fold(name.replace(/[-_ ]\d+$/, "")).text.replace(/[^\p{L}\p{N}]+/gu, "");
+}
+const TEMP_FOLDERS = ["/tmp", "/var/tmp", "/private/tmp", "/var/folders", "/private/var/folders"];
+// Money and accounts, over folded text. Each entry is [word, pattern]; `allowed_words` switches off a word.
+// A word that's also ordinary dev language (subscription, plan, tier, budget, quota) counts only beside a money word.
+const MONEY = [
+    ["billing", "billing|billed"],
+    ["invoice", "invoices?|invoiced"],
+    ["payment", "payments?|(?:pay|paid|paying) for|pay as you go|pay-as-you-go"],
+    [
+        "subscription",
+        "(?:my|monthly|annual|yearly|weekly|free|paid|premium|pro|business|enterprise|trial) subscriptions?" +
+            "|subscriptions? (?:fees?|prices?|pricing|costs?|charges?|renewals?|payments?|billing|plans?|tiers?)" +
+            "|(?:(?:upgrad|downgrad)(?:e|es|ed|ing)|cancel(?:s|led|ling|ed|ing)?|renew(?:s|ed|ing)?)" +
+            " (?:my|our|the|your|a|their) subscriptions?",
+    ],
+    [
+        "spending",
+        "spend(?:ing)? (?:limits?|caps?|alerts?)|spending money" +
+            "|(?:my|our|their|monthly|annual|yearly|personal|household|cloud) spending",
+    ],
+    ["budget", "(?:my|our|monthly|annual|yearly|weekly|personal|household|money|cash|spending) budgets?"],
+    [
+        "plan",
+        "(?:free|paid|pro|max|plus|team|business|enterprise|premium|pricing|billing|monthly|annual|yearly) plans?" +
+            "|(?:(?:upgrad|downgrad|chang)(?:e|es|ed|ing)|cancel(?:s|led|ling|ed|ing)?) (?:my|our|the|your|a|their) plan",
+    ],
+    ["tier", "(?:free|paid|pro|premium) tiers?"],
+    ["pricing", "pricing"],
+    [
+        "usage limit",
+        "usage (?:limits?|caps?|quotas?)|overage (?:charges?|fees?|costs?|pricing)" +
+            "|(?:billing|plan|paid|subscription|account) quotas?",
+    ],
+    ["card", "credit cards?|debit cards?|bank accounts?|bank statements?"],
+    ["refund", "refunds?|refunded|chargebacks?"],
+    ["trial", "free trials?|trial period"],
+];
+// Amounts of money. A "$" before a single digit is left alone, since "$1" is usually a shell argument.
+const AMOUNT = /(?<![\p{L}\p{N}$])(?:\$\s?(?:\d{1,3}(?:,\d{3})+|\d{2,}|\d(?=[.,]\d|\s?(?:k|m|bn)(?![\p{L}])|\s?(?:\/|a |per )))|[€£¥₹]\s?\d)[\d,]*(?:\.\d+)?(?:\s?(?:k|m|bn)(?![\p{L}]))?|(?<![\p{L}\p{N}.])\d[\d,]*(?:\.\d+)?\s?(?:usd|eur|gbp|dollars?|euros?|bucks)(?![\p{L}])/gu;
+const EMAIL = /(?<![\p{L}\p{N}._%+-])[\p{L}\p{N}._%+-]+@[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)*\.\p{L}{2,}(?![\p{L}\p{N}-])/gu;
+const PATH_TAIL = "[^\\s'\"`<>()\\[\\]{}|,;]*";
+const TRAILING_PUNCTUATION = /[.,:;!?]+$/;
+export function check(input, options) {
+    const { identity, rules } = options;
+    const folded = fold(input);
+    const allowedWords = new Set(rules.allowedWords.map((w) => collapse(fold(w).text)));
+    const allowedPaths = [...DEFAULT_ALLOWED_PATHS, ...rules.allowedPaths].map(canonicalPath);
+    const allowedEmails = [...DEFAULT_ALLOWED_EMAILS, ...rules.allowedEmails].map(globPattern);
+    const spans = [];
+    // Text that's fine to post: an allowed email or path. A name or word inside it isn't a finding either.
+    const allowed = [];
+    for (const prefix of homePrefixes(identity)) {
+        const re = new RegExp(`(?<![\\w.-])${escapeRegExp(prefix)}(?![\\w.-])${PATH_TAIL}`, "gi");
+        for (const m of input.matchAll(re))
+            spans.push(pathSpan("home path", m));
+    }
+    const tilde = new RegExp(`(?<![\\w~/.$-])(?:~|\\$HOME|\\$\\{HOME\\}|%USERPROFILE%)([\\\\/]${PATH_TAIL})`, "g");
+    for (const m of input.matchAll(tilde)) {
+        const span = pathSpan("home path", m);
+        const path = canonicalPath("~" + input.slice(m.index + m[0].length - m[1].length, span.end));
+        if (path === "~" || isAllowedPath(path, allowedPaths))
+            allowed.push([span.start, span.end]);
+        else
+            spans.push(span);
+    }
+    const temps = [...TEMP_FOLDERS, ...identity.tempDirs.map(trimSlash).filter((d) => d.length > 1)];
+    for (const prefix of new Set(temps)) {
+        const re = new RegExp(`(?<![\\w.~/$%-])${escapeRegExp(prefix)}(?![\\w.-])${PATH_TAIL}`, "g");
+        for (const m of input.matchAll(re)) {
+            const span = pathSpan("temp folder", m);
+            if (isAllowedPath(canonicalPath(input.slice(span.start, span.end)), allowedPaths)) {
+                allowed.push([span.start, span.end]);
+            }
+            else
+                spans.push(span);
+        }
+    }
+    for (const m of input.matchAll(EMAIL)) {
+        const email = m[0].toLowerCase();
+        const span = { category: "email", start: m.index, end: m.index + m[0].length };
+        if (allowedEmails.some((re) => re.test(email)))
+            allowed.push([span.start, span.end]);
+        else
+            spans.push(span);
+    }
+    const names = [
+        ["account name", identity.user],
+        ["machine name", identity.host.split(".")[0] ?? ""],
+    ];
+    // Only the user's own file can allow a name: naming it in a repository would post it.
+    const allowedNames = new Set(rules.allowedNames.map(nameKey));
+    for (const [category, name] of names) {
+        const key = nameKey(name);
+        if (name.length < 3 || GENERIC_NAMES.has(key) || allowedNames.has(key))
+            continue;
+        if (category === "machine name" && DEFAULT_MACHINE_NAMES.has(key))
+            continue;
+        const re = termPattern(name);
+        if (re)
+            spans.push(...foldedSpans(folded, re, category));
+    }
+    for (const [word, source] of MONEY) {
+        if (allowedWords.has(word))
+            continue;
+        spans.push(...foldedSpans(folded, wordPattern(source), "money", allowedWords, word));
+    }
+    if (!allowedWords.has("amounts"))
+        spans.push(...foldedSpans(folded, AMOUNT, "money", allowedWords, "amounts"));
+    // Private terms and the user's own addresses are never allowed by a repository, wherever they appear. They come
+    // first, so the user's address is reported as theirs rather than as an email outside the allowlist.
+    const shown = [...neverAllowed(folded, options), ...outsideAllowed(spans, allowed)];
+    return toFindings(input, outermost(shown));
+}
+// Only the private terms and the user's own addresses, for text whose other findings are the repository's own
+// business, such as an exempt file's added lines. A term inside a path or an email is found here, where check
+// reports the wider span.
+export function checkTerms(input, options) {
+    return toFindings(input, outermost(neverAllowed(fold(input), options)));
+}
+function neverAllowed(folded, { identity, rules }) {
+    const terms = rules.terms.flatMap((term) => {
+        const re = termPattern(term);
+        return re ? foldedSpans(folded, re, "private term") : [];
+    });
+    return [...terms, ...ownEmailSpans(folded, identity.emails, rules.userAllowedEmails)];
+}
+// The user's own addresses, whatever a repository allows: a pattern there such as "*@*.co.uk" or "*@gmail.com"
+// takes in theirs too. A noreply address is made to be posted. The user's own file allows one only by naming it
+// exactly, since a pattern there is for other people's addresses.
+function ownEmailSpans(folded, emails, userAllowed) {
+    const allowed = new Set(userAllowed.map((e) => fold(e).text));
+    const own = new Set(emails.map((e) => fold(e.trim()).text).filter((e) => !isNoreply(e) && !allowed.has(e)));
+    if (own.size === 0)
+        return [];
+    const spans = [];
+    for (const m of folded.text.matchAll(EMAIL)) {
+        if (!own.has(m[0]))
+            continue;
+        const [start, end] = originalSpan(folded, m.index, m.index + m[0].length);
+        spans.push({ category: "your email", start, end });
+    }
+    return spans;
+}
+const NOREPLY_DOMAINS = ["users.noreply.github.com", "users.noreply.gitlab.com"];
+function isNoreply(email) {
+    const at = email.lastIndexOf("@");
+    const local = email.slice(0, at);
+    return local === "noreply" || local === "no-reply" || NOREPLY_DOMAINS.includes(email.slice(at + 1));
+}
+// An allowed path that takes in the whole home folder or a whole temp folder, which leaves that check nothing to do:
+// "~" in any spelling, a temp folder's root, or a folder above one, such as "/var".
+export function isBlanketPath(path) {
+    const allowed = [canonicalPath(path)];
+    return ["~", ...TEMP_FOLDERS].some((root) => isAllowedPath(root, allowed));
+}
+// An allowed email pattern with no fixed domain: "*@*", "someone@*", "*@*.com". The domain must be written out,
+// or be "*." and then one with a dot in it, as in "*@*.example.org". A pattern with no "@" matches no email.
+export function isBlanketEmail(glob) {
+    const at = glob.lastIndexOf("@");
+    if (at < 0)
+        return false;
+    const domain = glob.slice(at + 1);
+    return domain.includes("*") && !/^\*\.[^*.]+(?:\.[^*.]+)+$/.test(domain);
+}
+function homePrefixes(identity) {
+    const prefixes = new Set();
+    const home = trimSlash(identity.home);
+    if (home.length > 1) {
+        prefixes.add(home);
+        prefixes.add(home.replaceAll("\\", "/"));
+    }
+    if (identity.user) {
+        for (const p of ["/Users/", "/home/", "C:\\Users\\", "C:/Users/"])
+            prefixes.add(p + identity.user);
+    }
+    return prefixes;
+}
+function pathSpan(category, m) {
+    const text = m[0].replace(TRAILING_PUNCTUATION, "");
+    return { category, start: m.index, end: m.index + text.length };
+}
+function foldedSpans(folded, re, category, allowed, word) {
+    const spans = [];
+    for (const m of folded.text.matchAll(re)) {
+        if (m[0].length === 0)
+            continue;
+        if (allowed?.has(collapse(m[0])))
+            continue;
+        const [start, end] = originalSpan(folded, m.index, m.index + m[0].length);
+        spans.push(word === undefined ? { category, start, end } : { category, word, start, end });
+    }
+    return spans;
+}
+// Keeps a span only when no other span contains it, so a path isn't also reported for the account name in it.
+function outermost(spans) {
+    const sorted = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+    const kept = [];
+    let reach = -1;
+    for (const s of sorted) {
+        if (s.end <= reach)
+            continue;
+        kept.push(s);
+        reach = s.end;
+    }
+    return kept;
+}
+function outsideAllowed(spans, allowed) {
+    if (allowed.length === 0)
+        return spans;
+    const sortedAllowed = [...allowed].sort((a, b) => a[0] - b[0]);
+    const kept = [];
+    let next = 0;
+    let reach = -1;
+    for (const s of [...spans].sort((a, b) => a.start - b.start)) {
+        while (next < sortedAllowed.length && sortedAllowed[next][0] <= s.start) {
+            reach = Math.max(reach, sortedAllowed[next][1]);
+            next++;
+        }
+        if (s.end > reach)
+            kept.push(s);
+    }
+    return kept;
+}
+// Spans arrive sorted by start, so line and column are counted in one pass over the input.
+function toFindings(input, spans) {
+    let i = 0;
+    let line = 1;
+    let column = 1;
+    return spans.map((s) => {
+        while (i < s.start) {
+            const code = input.codePointAt(i);
+            if (code === 0x0a) {
+                line++;
+                column = 1;
+            }
+            else
+                column++;
+            i += code > 0xffff ? 2 : 1;
+        }
+        const finding = {
+            category: s.category,
+            line,
+            column,
+            text: input.slice(s.start, s.end),
+            start: s.start,
+            end: s.end,
+        };
+        if (s.word !== undefined)
+            finding.word = s.word;
+        return finding;
+    });
+}
+function canonicalPath(path) {
+    const p = path
+        .replaceAll("\\", "/")
+        .replace(/^(?:\$HOME|\$\{HOME\}|%USERPROFILE%)(?=\/|$)/, "~");
+    return trimSlash(p);
+}
+function isAllowedPath(path, allowed) {
+    return allowed.some((a) => path === a || path.startsWith(a + "/"));
+}
+function globPattern(glob) {
+    const source = glob.toLowerCase().split("*").map(escapeRegExp).join("[^@\\s]*");
+    return new RegExp(`^${source}$`, "u");
+}
+function trimSlash(path) {
+    return path.length > 1 ? path.replace(/[\\/]+$/, "") : path;
+}
+function collapse(s) {
+    return s.trim().replace(/\s+/g, " ");
+}