worktree-shield 0.1.0__py3-none-any.whl

worktree_shield/privacy.py

@@ -0,0 +1,237 @@
+"""Making collected text safe to print and to share.
+
+Everything that leaves the tool (terminal, JSON, Markdown) is built from redacted data:
+redaction runs on the snapshot *before* any renderer sees it.
+"""
+
+from __future__ import annotations
+
+import getpass
+import re
+import socket
+from collections import Counter
+from collections.abc import Callable
+from dataclasses import dataclass, fields, is_dataclass, replace
+from enum import Enum
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, TypeVar, cast
+
+if TYPE_CHECKING:
+    from worktree_shield.models import Snapshot
+
+T = TypeVar("T")
+
+_ESCAPE_SEQUENCE = re.compile(
+    r"\x1b\[[0-?]*[ -/]*[@-~]"  # CSI: colours, cursor movement, screen clearing
+    r"|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?"  # OSC: window titles, hyperlinks
+    r"|\x1b[@-_]"  # other two-byte escapes
+)
+_CONTROL = re.compile(r"[\x00-\x08\x0b-\x1f\x7f-\x9f]")
+
+
+def strip_control(text: str) -> str:
+    """Remove terminal escape sequences and control characters, keeping tabs and newlines.
+
+    Collected output can come from a broken or hostile environment; without this a
+    crafted package name could rewrite the user's terminal when a report is shown.
+    """
+    return _CONTROL.sub("", _ESCAPE_SEQUENCE.sub("", text))
+
+
+@dataclass(frozen=True, slots=True)
+class RedactionContext:
+    """The identifying values of the machine the report is made on."""
+
+    home: str | None = None
+    user: str | None = None
+    hostname: str | None = None
+
+    @classmethod
+    def current(cls) -> RedactionContext:
+        """Read the values for the current user; missing ones stay ``None``."""
+        return cls(
+            home=_safe(lambda: str(Path.home())),
+            user=_safe(getpass.getuser),
+            hostname=_safe(socket.gethostname),
+        )
+
+
+def _safe(read: Callable[[], str]) -> str | None:
+    try:
+        value = read()
+    except (OSError, KeyError, RuntimeError):
+        return None
+    return value or None
+
+
+Replacement = str | Callable[[re.Match[str]], str]
+
+_REDACTED = "<redacted>"
+_REDACTED_TOKEN = "<redacted-token>"  # noqa: S105 - the placeholder, not a token
+
+_URL_CREDENTIALS = re.compile(r"\b([a-zA-Z][a-zA-Z0-9+.-]*://)([^/\s?#]*)@")
+"""``scheme://user:password@`` — greedy up to the last ``@`` of the authority."""
+
+_NAME_AND_SEPARATOR = re.compile(r"""(?<![\w-])([A-Za-z_][A-Za-z0-9_]*)(["']?\s*[=:]\s*)""")
+_VALUE = re.compile(r"""("[^"]*"|'[^']*'|[^\s,;}]+)""")
+"""``NAME=value``, ``name: value``, ``"name": "value"``; the name decides if it is secret."""
+
+_SECRET_SUFFIXES = ("token", "secret", "password", "passwd", "apikey", "credential", "credentials")
+_SECRET_PARTS = frozenset({"key", "auth", "pass", "pat"})
+
+_TOKENS = re.compile(
+    r"(?<![A-Za-z0-9_-])(?:"
+    r"gh[pousr]_[A-Za-z0-9]{36,}"  # GitHub
+    r"|github_pat_[A-Za-z0-9_]{22,}"
+    r"|hf_[A-Za-z0-9]{30,}"  # Hugging Face
+    r"|sk-[A-Za-z0-9_-]{20,}"  # OpenAI, Anthropic
+    r"|(?:AKIA|ASIA)[0-9A-Z]{16}"  # AWS access key id
+    r"|xox[abprs]-[A-Za-z0-9-]{10,}"  # Slack
+    r"|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}"  # JWT
+    r")(?![A-Za-z0-9_-])"
+)
+_BEARER = re.compile(r"(?i)\b(bearer\s+)[A-Za-z0-9._~+/=-]{8,}")
+
+
+def _is_secret_name(name: str) -> bool:
+    """``HF_TOKEN``, ``accessToken``, ``DB_PASSWORD``, ``OPENAI_API_KEY``: yes.
+    ``tokenizers``, ``CUDA_HOME``, ``author``, ``KEYBOARD``: no."""
+    parts = [part for part in name.lower().split("_") if part]
+    return any(part in _SECRET_PARTS or part.endswith(_SECRET_SUFFIXES) for part in parts)
+
+
+_MIN_NAME_LENGTH = 3
+_GENERIC_NAMES = frozenset(
+    {
+        "root", "user", "admin", "guest", "localhost", "linux", "ubuntu", "debian",
+        "fedora", "arch", "archlinux", "manjaro", "pop-os", "mint", "kali", "raspberrypi",
+    }
+)  # fmt: skip
+"""Names that identify nobody and appear in ordinary text (distribution names as hosts)."""
+
+
+def _word_pattern(name: str) -> re.Pattern[str] | None:
+    if len(name) < _MIN_NAME_LENGTH or name.lower() in _GENERIC_NAMES:
+        return None
+    # Whole words only: not inside "malice" or "alice_env", not an already redacted
+    # "<user>", but a sentence-ending period is fine.
+    return re.compile(rf"(?<![\w.<>-]){re.escape(name)}(?![\w<>-]|\.\w)")
+
+
+# Other accounts' home directories. The name may not start with "<", so already redacted
+# paths are left alone.
+_OTHER_HOMES: tuple[tuple[re.Pattern[str], str], ...] = (
+    (re.compile(r"(/home/)[^/\s:'\"<>]+"), r"\1<user>"),
+    (re.compile(r"(/Users/)[^/\s:'\"<>]+"), r"\1<user>"),
+    (re.compile(r"([A-Za-z]:\\Users\\)[^\\\s:'\"<>]+"), r"\1<user>"),
+)
+
+
+class Redactor:
+    """Removes identifying and secret values from text and from whole snapshots.
+
+    One redactor is used per report; :attr:`summary` then tells how many values of each
+    kind were removed, which the report shows so the user knows redaction happened.
+    """
+
+    def __init__(self, context: RedactionContext) -> None:
+        self._counts: Counter[str] = Counter()
+        self._steps: list[tuple[str, re.Pattern[str], Replacement]] = []
+        home = context.home.rstrip("/\\") if context.home else ""
+        if len(home) > 1:  # a home of "/" would redact every absolute path
+            boundary = r"(?=[/\\]|$|[^\w.-])"
+            self._steps.append(("home_path", re.compile(re.escape(home) + boundary), "~"))
+        for pattern, replacement in _OTHER_HOMES:
+            self._steps.append(("home_path", pattern, replacement))
+        # Host before user: "alice-laptop" is a host name even when the user is "alice".
+        for category, name, placeholder in (
+            ("host_name", context.hostname, "<host>"),
+            ("user_name", context.user, "<user>"),
+        ):
+            word = _word_pattern(name) if name else None
+            if word is not None:
+                self._steps.append((category, word, placeholder))
+
+    def text(self, value: str) -> str:
+        """Return ``value`` without control characters, identifying or secret values."""
+        result = strip_control(value)
+        result = _URL_CREDENTIALS.sub(self._url_credentials, result)
+        result = self._secret_assignments(result)
+        for token_pattern, placeholder in (
+            (_TOKENS, _REDACTED_TOKEN),
+            (_BEARER, r"\1" + _REDACTED_TOKEN),
+        ):
+            result, count = token_pattern.subn(placeholder, result)
+            self._counts["token"] += count
+        for category, pattern, replacement in self._steps:
+            result, count = pattern.subn(replacement, result)
+            self._counts[category] += count
+        return result
+
+    def redact(self, obj: T) -> T:
+        """Return a redacted copy of ``obj``.
+
+        Strings are redacted; dataclasses (frozen ones too), tuples, lists and dicts are
+        copied with their contents redacted; enums, numbers, booleans and ``None`` are
+        returned unchanged. The original object is never modified.
+        """
+        return cast(T, self._redact(obj))
+
+    @property
+    def summary(self) -> dict[str, int]:
+        """How many values of each kind this redactor has removed so far."""
+        return {category: count for category, count in self._counts.items() if count}
+
+    def _redact(self, obj: Any) -> Any:
+        if isinstance(obj, Enum):  # StrEnum members are str; keep them as they are
+            return obj
+        if isinstance(obj, str):
+            return self.text(obj)
+        if is_dataclass(obj) and not isinstance(obj, type):
+            changes = {f.name: self._redact(getattr(obj, f.name)) for f in fields(obj) if f.init}
+            return replace(obj, **changes)
+        if isinstance(obj, tuple):
+            return tuple(self._redact(item) for item in obj)
+        if isinstance(obj, list):
+            return [self._redact(item) for item in obj]
+        if isinstance(obj, dict):
+            return {self._redact(key): self._redact(item) for key, item in obj.items()}
+        return obj
+
+    def _url_credentials(self, match: re.Match[str]) -> str:
+        scheme, credentials = match.group(1), match.group(2)
+        if credentials == _REDACTED:
+            return match.group(0)
+        self._counts["url_credentials"] += 1
+        return f"{scheme}{_REDACTED}@"
+
+    def _secret_assignments(self, text: str) -> str:
+        # Scanned by hand rather than with re.sub: the value of a harmless name must not be
+        # consumed, or "env: DB_PASSWORD=hunter2" would hide the password inside the value
+        # of "env". After a harmless name the scan resumes right after its separator.
+        parts: list[str] = []
+        pos = 0
+        while match := _NAME_AND_SEPARATOR.search(text, pos):
+            parts.append(text[pos : match.end()])
+            pos = match.end()
+            value = _VALUE.match(text, pos)
+            if (
+                value is not None
+                and _is_secret_name(match.group(1))
+                and not value.group(0).startswith("<redacted")
+            ):
+                parts.append(_REDACTED)
+                pos = value.end()
+                self._counts["secret_value"] += 1
+        parts.append(text[pos:])
+        return "".join(parts)
+
+
+def redact_snapshot(snapshot: Snapshot, context: RedactionContext | None = None) -> Snapshot:
+    """The snapshot redacted for output, with a record of what was removed."""
+    from worktree_shield.models import RedactionCount
+
+    redactor = Redactor(context or RedactionContext.current())
+    redacted = redactor.redact(snapshot)
+    counts = tuple(RedactionCount(kind, n) for kind, n in sorted(redactor.summary.items()))
+    return replace(redacted, redactions=counts)

worktree_shield/reports/__init__.py

@@ -0,0 +1 @@
+"""Renderers: they receive an already redacted snapshot and only format it."""

worktree_shield/reports/findings.py

@@ -0,0 +1,176 @@
+"""Terminal report of ``scan``: what needs attention in full, everything else in a line.
+
+Collected text is added as plain ``Text``. Findings that follow from another one
+(``caused_by``) are shown under it rather than as separate problems.
+"""
+
+from __future__ import annotations
+
+from collections import Counter
+from collections.abc import Callable
+from pathlib import PurePosixPath
+
+from rich.console import Console
+from rich.table import Table
+from rich.text import Text
+
+from worktree_shield.collectors.envfiles import LOCAL_FILES
+from worktree_shield.models import Finding, Snapshot, Status
+from worktree_shield.plan import Suggestion
+from worktree_shield.reports.terminal import (
+    display_path,
+    redaction_line,
+    render_failed_discovery,
+    worktree_names,
+)
+from worktree_shield.rules.common import VERIFY, VERIFY_WITH_ENV
+
+PROBLEMS = (Status.FAIL, Status.WARN, Status.UNKNOWN)
+LABEL = {
+    Status.FAIL: "FAIL",
+    Status.WARN: "WARN",
+    Status.UNKNOWN: "UNKNOWN",
+    Status.PASS: "PASS",
+    Status.NOT_APPLICABLE: "N/A",
+    Status.NOT_TESTED: "NOT TESTED",
+}
+_STYLE = {Status.FAIL: "bold red", Status.WARN: "bold yellow", Status.UNKNOWN: "bold magenta"}
+_ORDER = {status: index for index, status in enumerate(PROBLEMS)}
+
+
+def counts_line(findings: tuple[Finding, ...]) -> str:
+    """``2 fail, 3 warn, 1 unknown, 6 pass, 1 not applicable``."""
+    counts = Counter(f.status for f in findings)
+    parts = [
+        f"{counts[status]} {label}"
+        for status, label in (
+            (Status.FAIL, "fail"),
+            (Status.WARN, "warn"),
+            (Status.UNKNOWN, "unknown"),
+            (Status.PASS, "pass"),
+            (Status.NOT_APPLICABLE, "not applicable"),
+            (Status.NOT_TESTED, "not tested"),
+        )
+        if counts[status]
+    ]
+    return ", ".join(parts) if parts else "no findings"
+
+
+def render_scan(snapshot: Snapshot, console: Console, *, show_all: bool = False) -> None:
+    """The scan report of an already redacted, diagnosed snapshot."""
+    repository = snapshot.repository
+    console.print(Text(f"worktree-shield {snapshot.tool_version}", style="bold"))
+    if repository is None:
+        render_failed_discovery(snapshot, console)
+        return
+    name, parent = worktree_names(repository)
+    count = len(repository.worktrees)
+    policy = snapshot.policy
+    source = display_path(policy.source) if policy and policy.source else "built-in defaults"
+    console.print(Text(f"{count} worktree{'s' if count != 1 else ''}, policy: {source}"))
+    if parent is not None:
+        console.print(Text(f"Worktrees are named relative to {display_path(parent)}", style="dim"))
+    console.print(Text(counts_line(snapshot.findings), style="bold"))
+    problems = [f for f in snapshot.findings if f.status in PROBLEMS and f.caused_by is None]
+    problems.sort(key=lambda f: _ORDER[f.status])  # stable: catalog order within a status
+    followers = [f for f in snapshot.findings if f.status in PROBLEMS and f.caused_by]
+    for finding in problems:
+        console.print()
+        _render_problem(finding, name, console)
+        for follower in followers:
+            if follower.caused_by == finding.id:
+                console.print(
+                    Text(f"      Follows from it: {follower.id} {follower.summary}", style="dim")
+                )
+    orphans = [f for f in followers if f.caused_by not in {p.id for p in problems}]
+    for finding in orphans:
+        console.print()
+        _render_problem(finding, name, console)
+    rest = [f for f in snapshot.findings if f.status not in PROBLEMS]
+    if rest and show_all:
+        console.print()
+        table = Table(box=None, show_edge=False, pad_edge=False, show_header=False)
+        table.add_column("Status", no_wrap=True)
+        table.add_column("Rule", no_wrap=True)
+        table.add_column("Summary", overflow="fold")
+        for finding in rest:
+            table.add_row(Text(LABEL[finding.status]), Text(finding.id), Text(finding.summary))
+        console.print(table)
+    elif rest:
+        console.print()
+        console.print(
+            Text(
+                f"{len(rest)} more checks passed or did not apply (--all lists them).", style="dim"
+            )
+        )
+    console.print()
+    footer = "Read-only: nothing in the repository was run, changed or locked."
+    line = redaction_line(snapshot)
+    console.print(Text(footer + (f" {line}." if line else ""), style="dim"))
+
+
+def _render_problem(finding: Finding, label: Callable[[str], str], console: Console) -> None:
+    header = Text()
+    header.append(f"{LABEL[finding.status]:<8}", style=_STYLE.get(finding.status, "bold"))
+    header.append(f"{finding.id}  ", style="bold")
+    header.append(finding.summary)
+    if finding.certainty is not None:
+        header.append(f"  ({finding.certainty.value})", style="dim")
+    console.print(header)
+    console.print(Text(f"        {finding.reason}"))
+    if finding.evidence:
+        table = Table(
+            box=None, show_edge=False, pad_edge=False, show_header=False, padding=(0, 2, 0, 0)
+        )
+        table.add_column("indent", width=6)
+        table.add_column("Worktree", no_wrap=True)
+        table.add_column("Where", overflow="fold")
+        table.add_column("What", overflow="fold")
+        for item in finding.evidence:
+            table.add_row(
+                Text(""),
+                Text(label(item.key)),
+                Text(display_path(item.source)),
+                Text(item.value or ""),
+            )
+        console.print(table)
+    if finding.recommended_action:
+        console.print(Text(f"        Next: {finding.recommended_action}"))
+    if finding.verify_command:
+        console.print(Text(f"        Check: {finding.verify_command}", style="dim"))
+    for limitation in finding.limitations:
+        console.print(Text(f"        Note: {limitation}", style="dim"))
+
+
+def render_plan(snapshot: Snapshot, suggestions: list[Suggestion], console: Console) -> None:
+    """The suggested changes, grouped by worktree; nothing is applied."""
+    console.print(Text(f"worktree-shield {snapshot.tool_version}", style="bold"))
+    if snapshot.repository is None:
+        render_failed_discovery(snapshot, console)
+        return
+    if not suggestions:
+        console.print(Text("Nothing to change: no collision needs attention."))
+        return
+    name, _ = worktree_names(snapshot.repository)
+    in_env = any(PurePosixPath(s.where.split(":", 1)[0]).name in LOCAL_FILES for s in suggestions)
+    reads_env = snapshot.policy is not None and snapshot.policy.include_env_files
+    check = VERIFY_WITH_ENV if in_env and not reads_env else VERIFY
+    console.print(
+        Text(f"Suggested changes. Nothing was changed: make them yourself, then run {check}.")
+    )
+    by_worktree: dict[str, list[Suggestion]] = {}
+    for suggestion in suggestions:
+        by_worktree.setdefault(suggestion.worktree, []).append(suggestion)
+    for worktree, items in by_worktree.items():
+        console.print()
+        console.print(Text(name(worktree), style="bold"))
+        table = Table(box=None, show_edge=False, pad_edge=False, show_header=False)
+        table.add_column("indent", width=2)
+        table.add_column("Where", no_wrap=True)
+        table.add_column("Change", overflow="fold")
+        table.add_column("Rule", no_wrap=True, style="dim")
+        for item in items:
+            table.add_row(
+                Text(""), Text(display_path(item.where)), Text(item.change), Text(item.rule)
+            )
+        console.print(table)

worktree_shield/reports/json_report.py

@@ -0,0 +1,61 @@
+"""JSON output: the diagnosed snapshot as plain data, for CI, agents and bug reports.
+
+The format is versioned by ``schema_version`` and described by docs/json-schema-v1.json;
+a contract test keeps the two in step. Pass a redacted snapshot.
+"""
+
+from __future__ import annotations
+
+import json
+from collections import Counter
+from dataclasses import fields, is_dataclass
+from enum import Enum
+from typing import Any
+
+from worktree_shield.models import Snapshot, Status
+
+WORST_FIRST = (
+    Status.FAIL,
+    Status.WARN,
+    Status.UNKNOWN,
+    Status.PASS,
+    Status.NOT_TESTED,
+    Status.NOT_APPLICABLE,
+)
+
+
+def summary(snapshot: Snapshot) -> dict[str, Any]:
+    """What a script looks at first; every value follows from the findings."""
+    counts = Counter(finding.status for finding in snapshot.findings)
+    worst = next((status.value for status in WORST_FIRST if counts.get(status)), None)
+    repository = snapshot.repository
+    return {
+        "worktrees": len(repository.worktrees) if repository is not None else None,
+        "counts": {status.value: counts.get(status, 0) for status in Status},
+        "worst": worst,
+        "strict_failure": counts.get(Status.FAIL, 0) > 0,
+    }
+
+
+def snapshot_to_dict(snapshot: Snapshot) -> dict[str, Any]:
+    """Plain dicts, lists and scalars; enums become their documented string values."""
+    plain = _plain(snapshot)
+    if not isinstance(plain, dict):  # pragma: no cover - a dataclass becomes a dict
+        raise TypeError("snapshot did not serialise to an object")
+    plain["summary"] = summary(snapshot)
+    return plain
+
+
+def render_json(snapshot: Snapshot) -> str:
+    """Indented JSON with a trailing newline."""
+    return json.dumps(snapshot_to_dict(snapshot), indent=2, ensure_ascii=False) + "\n"
+
+
+def _plain(value: Any) -> Any:
+    if isinstance(value, Enum):
+        return value.value
+    if is_dataclass(value) and not isinstance(value, type):
+        return {f.name: _plain(getattr(value, f.name)) for f in fields(value)}
+    if isinstance(value, tuple | list):
+        return [_plain(item) for item in value]
+    return value

worktree_shield/reports/markdown.py

@@ -0,0 +1,103 @@
+"""Markdown output: an issue- or PR-ready report of an already redacted snapshot.
+
+Collected text is escaped, so a path containing ``|`` cannot break a table and
+``<tag>`` cannot become HTML in an issue tracker; values go in code spans whose fence is
+longer than any backtick run inside them.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Callable
+
+from worktree_shield.models import Finding, Snapshot
+from worktree_shield.reports.findings import LABEL, PROBLEMS, counts_line
+from worktree_shield.reports.terminal import redaction_line, worktree_names
+
+PROJECT_URL = "https://github.com/BhuwanJoshi-01/worktree-shield"
+_SPECIAL = re.compile(r"([\\`*_\[\]<>|#])")
+
+
+def text(value: str) -> str:
+    """Plain text that Markdown and HTML will not interpret; one line."""
+    return _SPECIAL.sub(r"\\\1", " ".join(value.split()))
+
+
+def code(value: str) -> str:
+    """An inline code span that survives any backticks inside the value."""
+    flat = " ".join(value.split())
+    longest = max((len(run) for run in re.findall(r"`+", flat)), default=0)
+    fence = "`" * (longest + 1)
+    padding = " " if flat.startswith("`") or flat.endswith("`") else ""
+    return f"{fence}{padding}{flat}{padding}{fence}"
+
+
+def cell_code(value: str) -> str:
+    """A code span for a table cell: GitHub splits cells at ``|`` even inside code spans
+    unless it is escaped."""
+    return code(value).replace("|", "\\|")
+
+
+def render_markdown(snapshot: Snapshot) -> str:
+    """The report: counts, a table of every finding, then what needs attention."""
+    lines = ["# Worktree collision report", ""]
+    repository = snapshot.repository
+    if repository is None:
+        lines += ["The worktrees could not be listed:", ""]
+        lines += [f"- {code(f.probe)}: {text(f.detail)}" for f in snapshot.probe_failures]
+        return "\n".join([*lines, "", _footer(snapshot), ""])
+    name, _ = worktree_names(repository)
+    policy = snapshot.policy
+    source = code(policy.source) if policy and policy.source else "built-in defaults"
+    count = len(repository.worktrees)
+    lines += [
+        f"**{text(counts_line(snapshot.findings))}** across {count} "
+        f"worktree{'s' if count != 1 else ''}. Policy: {source}.",
+        "",
+        f"worktree-shield {text(snapshot.tool_version)}, {text(snapshot.created_at)}.",
+        "",
+    ]
+    if snapshot.findings:
+        lines += ["| Status | Rule | Finding | Certainty |", "| --- | --- | --- | --- |"]
+        for finding in snapshot.findings:
+            certainty = finding.certainty.value if finding.certainty else "—"
+            lines.append(
+                f"| {LABEL[finding.status]} | {code(finding.id)} | {text(finding.summary)} "
+                f"| {certainty} |"
+            )
+        lines.append("")
+    problems = [f for f in snapshot.findings if f.status in PROBLEMS]
+    if problems:
+        lines += ["## What needs attention", ""]
+        for finding in problems:
+            lines += _details(finding, name)
+    return "\n".join([*lines, _footer(snapshot), ""])
+
+
+def _details(finding: Finding, label: Callable[[str], str]) -> list[str]:
+    title = f"### {LABEL[finding.status]} {code(finding.id)}: {text(finding.summary)}"
+    lines = [title, "", text(finding.reason), ""]
+    if finding.caused_by:
+        lines += [f"Follows from {code(finding.caused_by)}.", ""]
+    if finding.evidence:
+        lines += ["| Worktree | Where | What |", "| --- | --- | --- |"]
+        for item in finding.evidence:
+            value = cell_code(item.value) if item.value is not None else "not reported"
+            lines.append(f"| {text(label(item.key))} | {cell_code(item.source)} | {value} |")
+        lines.append("")
+    if finding.recommended_action:
+        lines += [f"**Next step:** {text(finding.recommended_action)}", ""]
+    if finding.verify_command:
+        lines += [f"**Check afterwards:** {code(finding.verify_command)}", ""]
+    for limitation in finding.limitations:
+        lines += [f"*Note:* {text(limitation)}", ""]
+    return lines
+
+
+def _footer(snapshot: Snapshot) -> str:
+    closing = (
+        f"---\n\nMade by [worktree-shield]({PROJECT_URL}), read-only: nothing in the "
+        "repository was run, changed or locked."
+    )
+    line = redaction_line(snapshot)
+    return closing + (f" {text(line)}." if line else "")