const excluded = /(^|\/)(node_modules|dist|data|workspace|\.git)(\/|$)/u;
const suspicious = [
  /sk-[A-Za-z0-9_-]{20,}/u,
  /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----/u,
];
const violations: string[] = [];

for await (const path of new Bun.Glob(
  "**/*.{ts,js,json,md,yaml,yml,css,html}",
).scan(".")) {
  if (excluded.test(path)) continue;
  const content = await Bun.file(path).text();
  if (suspicious.some((pattern) => pattern.test(content)))
    violations.push(`${path}: 疑似包含真实凭据`);
  if (path.startsWith("apps/web/") && content.includes("DEEPSEEK_API_KEY"))
    violations.push(`${path}: 客户端不得引用模型密钥环境变量`);
}

if (violations.length) {
  console.error(violations.join("\n"));
  process.exit(1);
}
console.log("敏感信息检查通过。");