bridge + sync: onboard windy-text, windy-call, windy-cell (telephony in scope, GitHub Actions dead since 08-14; deploy.yml disabled)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

api/tests/test_secret_guard.py

@@ -117,3 +117,32 @@ def test_public_scan_excuses_by_hash_and_by_path():
     # a PEM header anywhere outside the allowed paths still counts
     assert not ps.excused("windy-agent", "private key block", "ffff0000", ["tests/keys/a.pem", "deploy/k.pem"], allow)
     assert not ps.excused("other", "openai key", "aaaa1111", ["x"], allow)
+
+
+HEX32 = "0123456789abcdef" * 2  # synthetic
+
+
+def test_twilio_shapes_hash_only_and_no_md5_noise():
+    kinds = lambda t: [k for k, _ in ss.find(t)]  # noqa: E731
+    assert kinds(f'TWILIO_AUTH_TOKEN = "{HEX32}"') == ["32-hex secret assignment"]
+    assert kinds(f"auth_token: {HEX32}") == ["32-hex secret assignment"]
+    assert kinds("AC" + HEX32) == ["twilio sid/api key"]
+    assert kinds("SK" + HEX32) == ["twilio sid/api key"]
+    # plain md5 / uuid-without-dashes / a 64-hex sha256 are NOT secrets by shape
+    assert kinds(f"md5 = {HEX32}") == []
+    assert kinds(f"checksum_key = {HEX32}{HEX32}") == []
+    assert kinds(f"name = 'x{HEX32}'") == []
+    # the hash is of the value alone, so renaming the variable keeps the same allow hash
+    a = ss.find(f"A_TOKEN={HEX32}")[0][1]
+    b = ss.find(f"OTHER_SECRET: '{HEX32}'")[0][1]
+    assert a == b == ss.h8(HEX32)
+    assert HEX32 not in repr(ss.find(f"A_TOKEN={HEX32}"))
+
+
+def test_warn_kinds_do_not_block(monkeypatch):
+    f = sg.cg.Finding("a.py", 1, "32-hex secret assignment", "32-hex secret assignment #abcd1234")
+    monkeypatch.setattr(sg, "MODE", "block")
+    monkeypatch.setattr(sg, "WARN_KINDS", {"32-hex secret assignment"})
+    assert sg.status_for([f], True)[0] == "success"
+    monkeypatch.setattr(sg, "WARN_KINDS", set())
+    assert sg.status_for([f], True)[0] == "failure"

ci/secret-guard-allow.yml

@@ -51,3 +51,9 @@ allow:
     paths: ["api/tests/test_secret_guard.py"]
     kinds: [private key block]
     reason: "The guard's own test uses a PEM header string as a sample."
+  - repo: windy-code
+    hashes: ["23f32607"]
+    reason: "VS Code OSS extensions' package.json aiKey: Microsoft's public telemetry (App Insights) key, shipped in every VS Code build; not a Windy credential."
+  - repo: windytalk
+    hashes: ["c4189d79"]
+    reason: "apps/desktop/test/diagnostics.test.ts redaction fixture (hexSecret beside a fake sk-ant token); hash checked against the lockbox 10-01: not present."

scripts/pr_status_bridge.py

@@ -54,7 +54,7 @@ REPOS = os.environ.get(
     " windy-drops windy-code-web windy-code windy-traveler windy-registry eternitas"
     " windy-translate windytranslate-site windytraveler-site windy-hand"
     " windy-cloud-sites windy-cloud-domains windy-cloud-vps windytalk windy-pro windy-mind"
-    " windy-inbox",
+    " windy-inbox windy-text windy-call windy-cell",
 ).split()
 
 # Gitea run status -> GitHub status state. `skipped` is deliberately absent: a

scripts/secret_guard.py

@@ -27,6 +27,8 @@ import secret_shapes as ss  # noqa: E402
 ROOT = Path(__file__).resolve().parents[1]
 ALLOW_FILE = Path(os.environ.get("SECRET_GUARD_ALLOW", ROOT / "ci" / "secret-guard-allow.yml"))
 MODE = os.environ.get("SECRET_GUARD_MODE", "warn")
+# Kinds that only WARN (rolled out warn-first); empty = every kind blocks in block mode.
+WARN_KINDS = {k for k in os.environ.get("SECRET_GUARD_WARN_KINDS", "").split(",") if k}
 NEVER = re.compile(r"(^|/)(node_modules|vendor|third_party)/")
 
 
@@ -94,8 +96,11 @@ def status_for(findings, whole_tree: bool, grant=()):
     if not findings:
         return "success", f"OK: no secret-shaped strings {scope}", None
     f, n = findings[0], len(findings)
-    state = "failure" if MODE == "block" else "success"
+    soft = MODE != "block" or all(x.kind in WARN_KINDS for x in findings)
-    lead = "BLOCKED" if MODE == "block" else "⚠ WARN (not blocking)"
+    state = "success" if soft else "failure"
+    lead = "⚠ WARN (not blocking)" if soft else "BLOCKED"
+    if not soft:
+        f = next(x for x in findings if x.kind not in WARN_KINDS)
     return state, f"{lead}: {n} secret-shaped string{'s' if n > 1 else ''} {scope}, e.g. {f.path}:{f.line} {f.match}"[:140], f
 
 

scripts/secret_shapes.py

@@ -18,13 +18,18 @@ PATTERNS: list[tuple[str, re.Pattern[str]]] = [
     ("openai key", re.compile(r"\bsk-(?:proj-|svcacct-)?(?!ant-)[A-Za-z0-9_-]{32,}")),
     ("stripe live key", re.compile(r"\b[rs]k_live_[A-Za-z0-9]{20,}")),
     ("google api key", re.compile(r"\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])")),
+    # Twilio (Windy Text 10-01: a live auth token sat in test files for months). An auth token
+    # is a bare 32-hex with no prefix, so it is only caught when ASSIGNED to a secret-ish name.
+    ("twilio sid/api key", re.compile(r"\b(?:AC|SK)[0-9a-f]{32}\b")),
+    ("32-hex secret assignment", re.compile(
+        r"(?i)\b[a-z0-9_.-]*(?:token|secret|key|password)[a-z0-9_.-]*[\"']?\s*[:=]\s*[\"']?(?P<v>(?<![0-9a-f])[0-9a-f]{32}(?![0-9a-f]))")),
     ("private key block", re.compile(r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----")),
 ]
 
 # git grep -E (POSIX ERE) prefilter: cheap superset of PATTERNS.
 PREFILTER = ("[0-9]{8,10}:[A-Za-z0-9_-]{35}|gh[pousr]_[A-Za-z0-9]{36}|github_pat_|(AKIA|ASIA)[0-9A-Z]{16}"
              "|xox[abprs]-|sk-ant-|sk-[A-Za-z0-9_-]{32}|sk-proj-|[rs]k_live_|AIza[0-9A-Za-z_-]{35}"
-             "|-----BEGIN [A-Z ]*PRIVATE KEY-----")
+             "|-----BEGIN [A-Z ]*PRIVATE KEY-----|(AC|SK)[0-9a-f]{32}|[0-9a-fA-F]{32}")
 
 
 def h8(value: str | bytes) -> str:
@@ -36,5 +41,5 @@ def find(text: str) -> list[tuple[str, str]]:
     out = []
     for kind, rx in PATTERNS:
         for m in rx.finditer(text):
-            out.append((kind, h8(m.group(0))))
+            out.append((kind, h8(m.group('v') if 'v' in rx.groupindex else m.group(0))))
     return out

scripts/sync_from_github.sh

@@ -38,7 +38,7 @@ FAILED=0
 
 # Repos Windy Git tracks FROM GitHub. Remove a repo from this list at the moment
 # it flips to Windy-Git-first, or the sync will fight its authors and win.
-REPOS="${SYNC_REPOS:-windy-calendar windy-search windy-registry Windy-Clone WindyCloud windy-cloud-sites windy-mind eternitas windy-agent windy-git windy-chat windy-mail windy-connect windy-drops windy-code-web windy-code windy-traveler windy-translate windytranslate-site windytraveler-site windy-hand windy-cloud-domains windy-cloud-vps windytalk windy-pro windy-inbox}"
+REPOS="${SYNC_REPOS:-windy-calendar windy-search windy-registry Windy-Clone WindyCloud windy-cloud-sites windy-mind eternitas windy-agent windy-git windy-chat windy-mail windy-connect windy-drops windy-code-web windy-code windy-traveler windy-translate windytranslate-site windytraveler-site windy-hand windy-cloud-domains windy-cloud-vps windytalk windy-pro windy-inbox windy-text windy-call windy-cell}"
 
 # Repos whose TAGS must not reach Windy Git. A tag push fires `on: push: tags`
 # workflows; windy-pro's build-electron is a matrix over ubuntu/macos/windows-