Auto Repo Setup

Security scan passed
Scanned at: 2026-05-31T20:17:11.595969
Tool: gitleaks + pattern-based validation
Content hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

#!/usr/bin/env python3
"""环境检查脚本 — 验证代码库运行所需的基础设施。

用法:
    python scripts/check_env.py [--fix]

返回码:
    0 — 全部通过
    1 — 有缺失，但 --fix 未指定
    2 — 修复尝试后仍有失败
"""

from __future__ import annotations

import argparse
import shutil
import subprocess
import sys
from dataclasses import dataclass, field
from typing import List


@dataclass
class CheckResult:
    name: str
    passed: bool
    message: str = ""
    fix_cmd: str = ""


def run_cmd(cmd: list[str]) -> tuple[int, str, str]:
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return r.returncode, r.stdout, r.stderr
    except FileNotFoundError:
        return 127, "", f"command not found: {cmd[0]}"
    except Exception as e:
        return 1, "", str(e)


def check_git() -> CheckResult:
    code, out, err = run_cmd(["git", "--version"])
    if code != 0:
        return CheckResult("git", False, err or "git not found", "brew install git")
    return CheckResult("git", True, out.strip().split("\n")[0])


def check_ffmpeg() -> CheckResult:
    code, out, err = run_cmd(["ffmpeg", "-version"])
    if code != 0:
        return CheckResult(
            "ffmpeg", False, err or "ffmpeg not found", "brew install ffmpeg"
        )
    first = out.strip().split("\n")[0]
    return CheckResult("ffmpeg", True, first)


def check_uv() -> CheckResult:
    code, out, err = run_cmd(["uv", "--version"])
    if code != 0:
        return CheckResult(
            "uv",
            False,
            err or "uv not found",
            "curl -LsSf https://astral.sh/uv/install.sh | sh",
        )
    return CheckResult("uv", True, out.strip())


def check_python_via_uv() -> CheckResult:
    code, out, err = run_cmd(["uv", "run", "python", "--version"])
    if code != 0:
        return CheckResult(
            "python (via uv)",
            False,
            err or "python not available via uv",
            "uv python install",
        )
    return CheckResult("python (via uv)", True, out.strip())


def check_pyproject_deps() -> CheckResult:
    code, out, err = run_cmd(["uv", "sync", "--locked"])
    if code != 0:
        return CheckResult(
            "dependencies (uv sync)",
            False,
            (err or out)[:200],
            "uv sync",
        )
    return CheckResult("dependencies (uv sync)", True, "lockfile satisfied")


def check_dot_env() -> CheckResult:
    import os

    if not os.path.exists(".env"):
        return CheckResult(
            ".env file",
            False,
            ".env not found",
            "cp .env.example .env && edit with real values",
        )
    with open(".env") as f:
        content = f.read()
    placeholders = ["YOUR_KEY_HERE", "REPLACE_ME", "placeholder", "example"]
    found = [p for p in placeholders if p.lower() in content.lower()]
    if found:
        return CheckResult(
            ".env file",
            False,
            f"still contains placeholders: {found}",
            "edit .env with real values",
        )
    return CheckResult(".env file", True, "configured")


def main() -> int:
    parser = argparse.ArgumentParser(description="Check repo environment")
    parser.add_argument("--fix", action="store_true", help="Attempt to auto-fix issues")
    args = parser.parse_args()

    checks: List[CheckResult] = []

    # Ordered: system deps → python env → project deps → config
    checks.append(check_git())
    checks.append(check_ffmpeg())
    checks.append(check_uv())
    checks.append(check_python_via_uv())
    checks.append(check_pyproject_deps())
    checks.append(check_dot_env())

    passed = [c for c in checks if c.passed]
    failed = [c for c in checks if not c.passed]

    print("=" * 50)
    print("Environment Check Report")
    print("=" * 50)

    for c in passed:
        print(f"  ✅ {c.name}: {c.message}")

    for c in failed:
        print(f"  ❌ {c.name}: {c.message}")
        if c.fix_cmd:
            print(f"     Fix: {c.fix_cmd}")

    print("=" * 50)
    print(f"Result: {len(passed)}/{len(checks)} passed")

    if not failed:
        print("🎉 All checks passed! You're ready to go.")
        return 0

    if args.fix:
        print("\n--fix specified, attempting repairs...")
        # In practice, auto-fix is limited — we print suggestions
        for c in failed:
            if c.fix_cmd:
                print(f"  Run: {c.fix_cmd}")
        print("Please re-run after fixing.")
        return 2

    print("\nRun with --fix to see repair commands, or ask Claude Code for help.")
    return 1


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
"""一键初始化项目的 SessionStart hook。

用法:
    python init_session_start_hook.py --repo /path/to/project [--guide ONBOARDING.md] [--update-gitignore]

功能:
    1. 创建 .claude/settings.json（SessionStart hook 配置）
    2. 创建 .claude/hooks/session-start-check.sh（24h 缓存 + 环境自检提示）
    3. 可选更新 .gitignore（允许 .claude/settings.json 和 hooks/ 入 git）

要求:
    - 目标目录必须是 git 仓库（或 --force 跳过检查）
    - 不会覆盖已有配置（除非 --force-overwrite）
"""

from __future__ import annotations

import argparse
import json
import os
import stat
import sys
from pathlib import Path


SETTINGS_JSON = """\
{
  "hooks": {
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/session-start-check.sh"
          }
        ]
      }
    ]
  }
}
"""

HOOK_TEMPLATE = """#!/usr/bin/env bash
# SessionStart hook for {project_name}
# 24h cache + simplified nudge — agent reads {guide_file} for actual commands.

CACHE_DIR="$HOME/.claude/cache/env-check"
mkdir -p "$CACHE_DIR"

# Use repo absolute path hash as cache key
REPO_HASH=$(cd "$(dirname "$0")/../.." && pwd | sha256sum | cut -d' ' -f1)
CACHE_FILE="$CACHE_DIR/$REPO_HASH"

# Silent if checked within 24h
if [ -f "$CACHE_FILE" ] && [ "$(find "$CACHE_FILE" -mtime -1 2>/dev/null)" ]; then
    exit 0
fi

# Create cache + output concise nudge
touch "$CACHE_FILE"
echo "【环境自检】你刚刚进入 {project_name} 仓库。请在执行任何任务前，先阅读 {guide_file} 并按 Step 1-3 验证环境。任一失败则按 {guide_file} 修复。"
"""

GITIGNORE_RULES = """
# Allow project-level Claude Code settings + hooks to be shared
!.claude/settings.json
!.claude/hooks/
.claude/settings.local.json
.claude/cache/
.claude/debug/
"""


def detect_project_name(repo_path: Path) -> str:
    """从目录名或 git remote 推断项目名称。"""
    name = repo_path.name
    git_config = repo_path / ".git" / "config"
    if git_config.exists():
        try:
            text = git_config.read_text(encoding="utf-8", errors="replace")
            for line in text.splitlines():
                if "url =" in line:
                    url = line.split("=", 1)[1].strip()
                    # Extract repo name from git@host:owner/repo.git or https://host/owner/repo.git
                    if "/" in url:
                        part = url.rsplit("/", 1)[1]
                        if part.endswith(".git"):
                            part = part[:-4]
                        if part:
                            return part
        except Exception:
            pass
    return name


def init_hook(repo_path: Path, guide_file: str, update_gitignore: bool, force_overwrite: bool, force_non_git: bool) -> int:
    if not repo_path.exists():
        print(f"❌ 目录不存在: {repo_path}", file=sys.stderr)
        return 1

    if not (repo_path / ".git").exists() and not force_non_git:
        print(f"❌ {repo_path} 不是 git 仓库。如需继续，加 --force-non-git", file=sys.stderr)
        return 1

    project_name = detect_project_name(repo_path)
    claude_dir = repo_path / ".claude"
    hooks_dir = claude_dir / "hooks"
    settings_file = claude_dir / "settings.json"
    hook_file = hooks_dir / "session-start-check.sh"
    gitignore_file = repo_path / ".gitignore"

    # Create directories
    hooks_dir.mkdir(parents=True, exist_ok=True)

    # Write settings.json
    if settings_file.exists() and not force_overwrite:
        print(f"⚠️  已存在，跳过: {settings_file}")
    else:
        settings_file.write_text(SETTINGS_JSON, encoding="utf-8")
        print(f"✅ 创建: {settings_file}")

    # Write hook script
    if hook_file.exists() and not force_overwrite:
        print(f"⚠️  已存在，跳过: {hook_file}")
    else:
        hook_content = HOOK_TEMPLATE.format(project_name=project_name, guide_file=guide_file)
        hook_file.write_text(hook_content, encoding="utf-8")
        # Make executable
        hook_file.chmod(hook_file.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
        print(f"✅ 创建: {hook_file}")

    # Update .gitignore
    if update_gitignore:
        if gitignore_file.exists():
            existing = gitignore_file.read_text(encoding="utf-8", errors="replace")
            # Check if rules already present
            if "!.claude/settings.json" in existing:
                print(f"ℹ️  .gitignore 已包含 Claude 规则，跳过")
            else:
                with open(gitignore_file, "a", encoding="utf-8") as f:
                    f.write(GITIGNORE_RULES)
                print(f"✅ 更新: {gitignore_file}")
        else:
            gitignore_file.write_text(GITIGNORE_RULES.lstrip("\n"), encoding="utf-8")
            print(f"✅ 创建: {gitignore_file}")

    print("\n📋 总结:")
    print(f"   项目: {project_name}")
    print(f"   路径: {repo_path}")
    print(f"   指南: {guide_file}")
    print(f"   Hook: {hook_file}")
    if update_gitignore:
        print(f"   Gitignore: 已更新")
    print("\n下次 Claude Code 进入此仓库时，SessionStart hook 会自动触发。")
    return 0


def main() -> int:
    parser = argparse.ArgumentParser(description="Initialize SessionStart hook for a project")
    parser.add_argument("--repo", required=True, help="Target repository path")
    parser.add_argument("--guide", default="ONBOARDING.md", help="Guide file name to reference in hook (default: ONBOARDING.md)")
    parser.add_argument("--update-gitignore", action="store_true", help="Update .gitignore to allow .claude/ files")
    parser.add_argument("--force-overwrite", action="store_true", help="Overwrite existing files")
    parser.add_argument("--force-non-git", action="store_true", help="Allow running on non-git directory")
    args = parser.parse_args()

    return init_hook(
        repo_path=Path(args.repo).resolve(),
        guide_file=args.guide,
        update_gitignore=args.update_gitignore,
        force_overwrite=args.force_overwrite,
        force_non_git=args.force_non_git,
    )


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env bash
# sanitize_history.sh — 检查并清理 git 历史中的敏感信息
# 用法: ./sanitize_history.sh [--check-only] [--path <repo-root>]
#
# 注意：此脚本只辅助检查，最终修复（orphan branch / BFG）需要人工确认后执行。

set -euo pipefail

REPO_ROOT="$(pwd)"
CHECK_ONLY=false

while [[ $# -gt 0 ]]; do
  case "$1" in
    --check-only) CHECK_ONLY=true; shift ;;
    --path) REPO_ROOT="$2"; shift 2 ;;
    *) echo "Unknown arg: $1"; exit 1 ;;
  esac
done

cd "$REPO_ROOT"

echo "========================================="
echo "Sanitization Check — $REPO_ROOT"
echo "========================================="

# 1. 检查常见敏感模式（全 git 历史）
echo ""
echo "[1/4] Scanning git history for common secrets..."

PATTERNS=(
  'sk-[a-zA-Z0-9_-]{20,}'           # API keys
  'sk-or-v1-[a-zA-Z0-9_-]+'         # OpenRouter
  'sk-ant-[a-zA-Z0-9_-]+'           # Anthropic
  'sk-proj-[a-zA-Z0-9_-]+'          # OpenAI project
  'AK[0-9A-Za-z]{16,}'              # Aliyun AK
  'ghp_[a-zA-Z0-9]{36}'             # GitHub PAT
  '[A-Za-z0-9/+=]{40}'              # Generic long base64
)

FOUND_ISSUES=0
for pat in "${PATTERNS[@]}"; do
  matches=$(git log --all -p -G "$pat" -- | head -20 || true)
  if [[ -n "$matches" ]]; then
    echo "  ⚠️  Pattern matched: $pat"
    echo "$matches" | head -5
    FOUND_ISSUES=$((FOUND_ISSUES + 1))
  fi
done

if [[ $FOUND_ISSUES -eq 0 ]]; then
  echo "  ✅ No common secret patterns found in history."
fi

# 2. 检查个人绝对路径
echo ""
echo "[2/4] Scanning for personal absolute paths..."

PATH_PATTERNS=(
  '/Users/[a-zA-Z0-9_-]+/'
  '/home/[a-zA-Z0-9_-]+/'
)

PATH_ISSUES=0
for pat in "${PATH_PATTERNS[@]}"; do
  matches=$(git log --all -p -G "$pat" -- | grep -oE "$pat" | sort -u | head -10 || true)
  if [[ -n "$matches" ]]; then
    echo "  ⚠️  Personal paths found:"
    echo "$matches"
    PATH_ISSUES=$((PATH_ISSUES + 1))
  fi
done

if [[ $PATH_ISSUES -eq 0 ]]; then
  echo "  ✅ No personal absolute paths found."
fi

# 3. 检查私有域名
echo ""
echo "[3/4] Scanning for private infrastructure domains..."

# 扩展此列表以匹配你的私有域名
PRIVATE_DOMAINS=(
  '<private-domain>\.dev'
  '<private-domain>\.pro'
  '<your-domain>\.ai'
)

DOMAIN_ISSUES=0
for dom in "${PRIVATE_DOMAINS[@]}"; do
  matches=$(git log --all -p -G "$dom" -- | head -10 || true)
  if [[ -n "$matches" ]]; then
    echo "  ⚠️  Private domain found: $dom"
    DOMAIN_ISSUES=$((DOMAIN_ISSUES + 1))
  fi
done

if [[ $DOMAIN_ISSUES -eq 0 ]]; then
  echo "  ✅ No private domains found."
fi

# 4. 当前工作区检查
echo ""
echo "[4/4] Checking current working tree..."

if git rev-parse --git-dir > /dev/null 2>&1; then
  # 检查未提交的文件中是否有敏感信息
  UNCOMMITTED=$(git diff --cached --name-only || true)
  if [[ -n "$UNCOMMITTED" ]]; then
    echo "  ℹ️  Staged files:"
    echo "$UNCOMMITTED" | sed 's/^/    /'
  fi
else
  echo "  ⚠️  Not a git repository."
fi

echo ""
echo "========================================="
echo "Summary: $((FOUND_ISSUES + PATH_ISSUES + DOMAIN_ISSUES)) potential issues found"
echo "========================================="

if [[ "$CHECK_ONLY" == true ]]; then
  echo "--check-only specified. No changes made."
  exit 0
fi

# 如果发现问题，提供修复建议
if [[ $((FOUND_ISSUES + PATH_ISSUES + DOMAIN_ISSUES)) -gt 0 ]]; then
  echo ""
  echo "建议修复流程："
  echo "1. 评估影响：哪些 commit 含敏感信息？是否已 push 到 remote？"
  echo "2. 在 provider 后台 revoke 已泄露的 key"
  echo "3. 生成新 key 替换 .env"
  echo "4. 清理历史（选一）："
  echo "   A) Orphan branch（历史可全丢）：git checkout --orphan new-history"
  echo "   B) BFG Repo-Cleaner（保留历史）：https://rtyley.github.io/bfg-repo-cleaner/"
  echo "5. 通知其他协作者重新 clone"
  exit 1
fi

echo "✅ History looks clean."
exit 0