From 09821e8cfe527da64e81997ef4b7e894c1ba15de Mon Sep 17 00:00:00 2001
From: Thierno Bah <44367278+soulbah@users.noreply.github.com>
Date: Thu, 8 Oct 2026 07:24:02 +0200
Subject: [PATCH 1/2] fix: inspect symlink modes and public message patterns

---
 scripts/check-publication.ts  | 40 +++++++++++++++++++++++++----------
 scripts/publication-safety.ts |  9 +++-----
 2 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/scripts/check-publication.ts b/scripts/check-publication.ts
index 4fd734f..87f8ce9 100644
--- a/scripts/check-publication.ts
+++ b/scripts/check-publication.ts
@@ -19,26 +19,44 @@ export function trackedPublicationIssues(
       throw new Error("Publication refused: cannot read tracked Git content");
     }
   };
-  const names = git(
-    revision && revision !== ":"
-      ? ["ls-tree", "-r", "--name-only", "-z", revision]
-      : ["ls-files", "-z"],
+  const records = git(
+    revision && revision !== ":" ? ["ls-tree", "-r", "-z", revision] : ["ls-files", "-s", "-z"],
   )
     .toString()
     .split("\0")
     .filter(Boolean);
-  return names.flatMap((path) => {
+  const entries = new Map(
+    records.map((entry) => {
+      const separator = entry.indexOf("\t");
+      return [entry.slice(separator + 1), entry.slice(0, separator).split(" ")[0]];
+    }),
+  );
+  return [...entries].flatMap(([path, mode]) => {
     const full = join(directory, path);
     let body: Buffer;
-    if (revision) body = git(["show", `${revision === ":" ? "" : revision}:${path}`]);
-    else {
+    if (revision) {
+      body = git(["show", `${revision === ":" ? "" : revision}:${path}`]);
+      if (mode === "120000") {
+        return [{ path, rule: "symlink", line: 1 }];
+      }
+      if (mode !== "100644" && mode !== "100755")
+        return [{ path, rule: "irregular-entry", line: 1 }];
+    } else {
+      let stat;
       try {
-        const stat = lstatSync(full);
-        if (stat.isSymbolicLink()) return [{ path, rule: "symlink", line: 1 }];
-        body = readFileSync(full);
+        stat = lstatSync(full);
       } catch (error) {
         if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
-        throw error;
+        throw new Error("Publication refused: cannot inspect tracked entry");
+      }
+      if (stat.isSymbolicLink()) {
+        return [{ path, rule: "symlink", line: 1 }];
+      }
+      if (!stat.isFile()) return [{ path, rule: "irregular-entry", line: 1 }];
+      try {
+        body = readFileSync(full);
+      } catch {
+        throw new Error("Publication refused: cannot read tracked file");
       }
     }
     // Binary metadata is included; a tracked path is never skipped because it is ignored.
diff --git a/scripts/publication-safety.ts b/scripts/publication-safety.ts
index 64cb90d..ea63fe5 100644
--- a/scripts/publication-safety.ts
+++ b/scripts/publication-safety.ts
@@ -7,15 +7,12 @@ const rules: Array<[string, RegExp]> = [
   ],
   [
     "credential",
-    /BEGIN (?:RSA|OPENSSH|EC|DSA)? ?PRIVATE KEY|(?:github_pat_|ghp_)[A-Za-z0-9_]{12,}/gu,
-  ],
-  [
-    "private-workspace",
-    /(?:rootform-dev\/)?notes\/(?:public-separation|candidate-|ci-budget|operator-preferences|agentic-delivery|editor-qualification|site-quality|language-learning)/gu,
+    /BEGIN (?:RSA|OPENSSH|EC|DSA)? ?PRIVATE KEY|(?:github_pat_|gh[pousr]_|npm_)[A-Za-z0-9_]{12,}|\b(?:AKIA|ASIA)[A-Z0-9]{16}\b|xox[abprs]-[A-Za-z0-9-]{12,}|AIza[A-Za-z0-9_-]{35}|\bBearer\s+[A-Za-z0-9._~+/-]{24,}=*|\b(?:CLOUDFLARE_API_TOKEN|AWS_SECRET_ACCESS_KEY|OPENAI_API_KEY|API_TOKEN|API_KEY)\s*[:=]\s*["\x27]?[A-Za-z0-9_+./~-]{24,}/gu,
   ],
+  ["private-workspace", /\b(?:rootform-dev\/)?notes\/[A-Za-z0-9][A-Za-z0-9._/-]*/gu],
   [
     "session-instructions",
-    /^\s*(?:#+\s*)?(?:system prompt|agent handoff|session report|rapport de session|instructions? (?:to|aux|pour) (?:models?|agents?)|model routing)\b|(?:Fable\s*5\.1|DeepSeek[- ]V4|Claude[- ](?:Opus|Fable)).{0,50}(?:review|revue|Max|max|instructions?)/gimu,
+    /^\s*(?:#+\s*)?(?:system prompt|agent handoff|session report|rapport de session|instructions? (?:to|aux|pour) (?:models?|agents?)|model routing)\b|\b[A-Z][A-Za-z0-9_-]*[- ]V?\d+\.\d+\s+(?:Max|Ultra)\b.{0,40}\b(?:review|revue|instructions?)\b|\b(?:model routing|review with|revue avec)\s*[:=]/gimu,
   ],
   [
     "private-activity",

From 4e7816b9a9095aec58006413afd34278530d7fd5 Mon Sep 17 00:00:00 2001
From: Thierno Bah <44367278+soulbah@users.noreply.github.com>
Date: Thu, 8 Oct 2026 07:28:49 +0200
Subject: [PATCH 2/2] fix: type tracked entry metadata

---
 scripts/check-publication.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/check-publication.ts b/scripts/check-publication.ts
index 87f8ce9..b8a5920 100644
--- a/scripts/check-publication.ts
+++ b/scripts/check-publication.ts
@@ -28,7 +28,7 @@ export function trackedPublicationIssues(
   const entries = new Map(
     records.map((entry) => {
       const separator = entry.indexOf("\t");
-      return [entry.slice(separator + 1), entry.slice(0, separator).split(" ")[0]];
+      return [entry.slice(separator + 1), entry.slice(0, separator).split(" ")[0]] as const;
     }),
   );
   return [...entries].flatMap(([path, mode]) => {
@@ -42,7 +42,7 @@ export function trackedPublicationIssues(
       if (mode !== "100644" && mode !== "100755")
         return [{ path, rule: "irregular-entry", line: 1 }];
     } else {
-      let stat;
+      let stat: ReturnType<typeof lstatSync>;
       try {
         stat = lstatSync(full);
       } catch (error) {