feat: complete TASK-WP0-01 toolchain skeleton

2026-07-27 17:13:01 +08:00
parent 67e7a17d96
commit ae20eaf01f
39 changed files with 3588 additions and 0 deletions
@@ -0,0 +1,32 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { extname, join, relative } from "node:path";
+
+const scanRoots = ["apps", "packages", "scripts", "supervisor", "tests"];
+const textExtensions = new Set([".cs", ".json", ".mjs", ".ts", ".tsx", ".yaml", ".yml"]);
+const findings = [];
+
+function visit(path) {
+  for (const name of readdirSync(path)) {
+    const child = join(path, name);
+    const relativePath = relative(process.cwd(), child).replaceAll("\\", "/");
+    if (["bin", "dist", "node_modules", "obj"].includes(name)) continue;
+    if (statSync(child).isDirectory()) {
+      visit(child);
+      continue;
+    }
+    if (!textExtensions.has(extname(name)) || relativePath === "scripts/redaction-scan.mjs") continue;
+
+    const content = readFileSync(child, "utf8");
+    const prohibited = [
+      /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+      /[A-Za-z]:\\Users\\[^\\\s]+/,
+      /(?:api[_-]?key|password|secret)\s*[:=]\s*["'][^"']{8,}["']/i,
+    ];
+    if (prohibited.some((pattern) => pattern.test(content))) findings.push(relativePath);
+  }
+}
+
+for (const root of scanRoots) visit(root);
+
+console.log(JSON.stringify({ findings, status: findings.length === 0 ? "passed" : "failed" }, null, 2));
+if (findings.length > 0) process.exit(1);