WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

2026-09-22 16:19:06 +08:00
commit f7fc992f57
3929 changed files with 1006607 additions and 0 deletions
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# check-secret-tokens.sh — fail if a real-looking credential was committed to
+# the CLI's human-facing docs. An agent-first CLI's docs are where a live
+# API key or JWT most easily gets pasted by accident (copying a working
+# session into a how-to). Same intent as a gitleaks/doc-token pre-commit scan.
+#
+# Heuristic, low false-positive: a real WeKnora API key is `sk-` followed by a
+# long high-entropy body that CONTAINS A DIGIT (e.g.
+# sk-bVd4ebLoyn-DKevdkgw527XAakwv4G6Tz6FhgXPlOpBO-Ico); placeholder words like
+# `sk-specific` / `sk-staging` have no digit and are short, so they pass. JWTs
+# are three base64url segments. Lines that look like placeholders
+# (EXAMPLE / REDACTED / <...> / YOUR_ / xxxx) are ignored.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# Doc surface to scan (where a pasted live token is the real risk).
+FILES=$(git ls-files 'skills/**/*.md' 'README.md' 'AGENTS.md' 'CHANGELOG.md' 'ROADMAP.md' 2>/dev/null || true)
+[ -z "$FILES" ] && { echo "no doc files to scan"; exit 0; }
+
+# sk- key: prefix + >=24 body chars including at least one digit.
+KEY_RE='sk-[A-Za-z0-9_-]*[0-9][A-Za-z0-9_-]*'
+# Only flag long bodies; require total match length >= 27 (sk- + 24).
+JWT_RE='eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'
+PLACEHOLDER='EXAMPLE|REDACTED|PLACEHOLDER|YOUR_|xxxx|<[a-z]'
+
+fail=0
+for f in $FILES; do
+  while IFS=: read -r line content; do
+    [ -z "$content" ] && continue
+    # Skip lines that are clearly illustrative placeholders.
+    echo "$content" | grep -qE "$PLACEHOLDER" && continue
+    # API key: require >=24 chars after sk- (matched token length >= 27).
+    if echo "$content" | grep -oE "$KEY_RE" | grep -qE '^.{27,}$'; then
+      echo "POSSIBLE API KEY in $f:$line"
+      echo "  $content" | sed -E 's/(sk-[A-Za-z0-9_-]{6})[A-Za-z0-9_-]+/\1…REDACTED/g'
+      fail=1
+    fi
+    if echo "$content" | grep -qE "$JWT_RE"; then
+      echo "POSSIBLE JWT in $f:$line"
+      fail=1
+    fi
+  done < <(grep -nE "sk-[A-Za-z0-9_-]|eyJ[A-Za-z0-9_-]" "$f" 2>/dev/null || true)
+done
+
+if [ "$fail" -ne 0 ]; then
+  echo
+  echo "A real-looking credential is committed in docs. Replace it with a"
+  echo "placeholder (e.g. sk-EXAMPLE / <api-key> / \$(weknora auth token))."
+  exit 1
+fi
+echo "no committed credentials found in docs"
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# check-skill-wire-vocab.sh — fail if the agent-facing docs still reference wire
+# vocabulary that the CLI has renamed or removed. Wire-shape changes must sweep
+# every agent-facing doc in the same PR.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# legacy_term:replacement — extend this list in the SAME commit that
+# renames/removes a flag, command, tool, or error code.
+BANNED=(
+  "agent_invoke:session_ask (MCP tool renamed in v0.9)"
+  "agent invoke:session ask --agent (moved in v0.9)"
+  "mcp.readonly_mode:removed in v0.9 (never emitted)"
+  "mcp.tool_not_allowed:removed in v0.9 (never emitted)"
+  "mcp.schema_unknown_command:removed in v0.9 (never emitted)"
+  "auth login --host:profile add --host (auth login dropped --host in v0.9)"
+  "auth login --name:profile add <name> (auth login dropped --name in v0.9)"
+  "agent create --kb:agent create --attach-kb (renamed in v0.9)"
+  "kb init:kb config set (renamed — kb init removed)"
+  "continue-stream:session resume (renamed)"
+  "retry_command:retry_argv (error envelope field renamed in v0.10)"
+)
+
+# Current-truth sources only. AGENTS.md is the authoritative wire contract that
+# skills are condensed from — a rename that lands in skills/ but not here leaves
+# the source of truth wrong.
+#
+# CHANGELOG.md and README.md are deliberately NOT scanned. Both will name
+# legacy terms when recording a rename or writing upgrade notes for agents
+# moving between CLI versions; scanning them would guarantee a false positive.
+SCAN_TARGETS=(skills/ AGENTS.md)
+
+# The v0.10 retry_command miss happened because the scan silently covered less
+# than the docs that needed covering. Fail loudly if a target disappears rather
+# than quietly shrinking coverage again.
+for target in "${SCAN_TARGETS[@]}"; do
+  if [ ! -e "$target" ]; then
+    echo "scan target '$target' does not exist — update SCAN_TARGETS" >&2
+    exit 2
+  fi
+done
+
+fail=0
+for entry in "${BANNED[@]}"; do
+  term="${entry%%:*}"
+  why="${entry#*:}"
+  if hits=$(grep -rn --include='*.md' -F "$term" "${SCAN_TARGETS[@]}" 2>/dev/null); then
+    echo "BANNED wire vocab '$term' found (use: $why):"
+    echo "$hits"
+    fail=1
+  fi
+done
+exit $fail