update-1.6.2

scripts/secret-scan.sh

@@ -23,14 +23,29 @@ fi
 
 # Private keys and common live-token shapes must not be committed. Placeholders in
 # templates/docs are intentionally allowed.
-# Distributed deployment bundles intentionally contain three complete `.env`
-# templates. They must remain placeholder-only; every other private env/key file
-# is still forbidden.
 if grep -E '(^|/)\.env$|\.pem$|\.p12$|\.pfx$|(^|/)id_rsa$|(^|/)id_ed25519$' "$FILES" \
-    | grep -Ev '^deployments/(master|cpu-subagent|gpu-subagent|agent|knowledge|ollama|combined)/\.env$' >/dev/null; then
+    | grep -Ev '^deployments/[^/]+/\.env$' >/dev/null; then
   bad "private environment/key material found"
 fi
 
+# Deployment role .env files are intentionally shipped as complete templates.
+# Reject them if a sensitive field is populated with anything other than an
+# empty value or an explicit CHANGE_ME placeholder.
+for f in deployments/*/.env; do
+  [ -f "$f" ] || continue
+  awk -F= '
+    /^[[:space:]]*#/ || NF < 2 { next }
+    $1 ~ /(PASSWORD|SECRET|TOKEN|API_KEY|CLIENT_SECRET)$/ {
+      v=$0; sub(/^[^=]*=/,"",v)
+      if (v != "" && v !~ /^CHANGE_ME/) {
+        print FILENAME ": unsafe populated secret field " $1 > "/dev/stderr"
+        bad=1
+      }
+    }
+    END { exit bad ? 1 : 0 }
+  ' "$f" || bad "deployment .env contains a populated secret: $f"
+done
+
 if [ "$HAVE_GIT" = true ]; then
   if git grep -nE -- '-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----' -- ':!*.example' ':!*.md' >"$KEYS" 2>/dev/null; then
     cat "$KEYS" >&2; bad "private key material found"
@@ -51,30 +66,6 @@ else
   fi
 fi
 
-# Checked-in deployment .env files are templates, never live configuration.
-for envf in \
-  deployments/master/.env \
-  deployments/cpu-subagent/.env \
-  deployments/gpu-subagent/.env \
-  deployments/agent/.env \
-  deployments/knowledge/.env \
-  deployments/ollama/.env \
-  deployments/combined/.env; do
-  [ -f "$envf" ] || continue
-  if awk -F= '
-    /^[[:space:]]*#/ || NF < 2 { next }
-    {
-      key=$1; sub(/^[[:space:]]+/, "", key); sub(/[[:space:]]+$/, "", key)
-      val=$0; sub(/^[^=]*=/, "", val)
-      if (key ~ /(TOKEN|PASSWORD|SECRET|CLIENT_ID|CLIENT_SECRET|API_KEY)$/ && val != "" && val !~ /^CHANGE_ME/) {
-        print FILENAME ":" NR ": live-looking secret in " key > "/dev/stderr";
-        bad=1
-      }
-    }
-    END { exit bad ? 1 : 0 }
-  ' "$envf"; then :; else bad "deployment template contains a non-placeholder secret: $envf"; fi
-done
-
 # Reject accidental binary blobs outside explicitly expected assets.
 while IFS= read -r f; do
   [ -f "$f" ] || continue