openclaw/scripts/audit-triad-files.js

#!/usr/bin/env node
// Triad File Audit — Identifies TM-specific vs generic files
// Usage: node scripts/audit-triad-files.js

import fs from "fs";
import path from "path";
import { fileURLToPath } from "url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const workspaceRoot = path.join(__dirname, "..");

// Patterns that indicate TM-specific (private) data
const PRIVATE_PATTERNS = [
  /192\.168\.\d+\.\d+/, // IP addresses
  /MT[A-Z0-9]{20,}/, // Discord tokens
  /\b\d{17,19}\b/, // Discord IDs (18-digit snowflakes)
  /silica-animus|testbench|tabula-myriad/, // Hostnames
  /ssh-ed25519|ssh-rsa/, // SSH keys
  /password.*[!@#$%^&*]/, // Complex passwords
];

// Files that are always TM-specific
const ALWAYS_PRIVATE = new Set([
  "TOOLS.md",
  "MEMORY.md",
  "IDENTITY.md",
  "USER.md",
  ".aura/consensus.db",
  ".ssh/",
]);

// Files that are always generic (public)
const ALWAYS_PUBLIC = new Set([
  "AGENTS.md", // Keep, but strip TM topology
  "SOUL.md",
  "skills/",
  "scripts/",
  "docs/",
]);

console.log("🦞 Triad File Audit — Scanning workspace...\n");

const results = {
  private: [],
  public: [],
  needsReview: [],
};

// Scan root .md files
const rootFiles = fs
  .readdirSync(workspaceRoot)
  .filter((f) => f.endsWith(".md"))
  .filter(
    (f) =>
      !["README.md", "CONTRIBUTING.md", "SECURITY.md", "VISION.md", "CHANGELOG.md"].includes(f),
  );

rootFiles.forEach((file) => {
  const filePath = path.join(workspaceRoot, file);
  const content = fs.readFileSync(filePath, "utf8");

  if (ALWAYS_PRIVATE.has(file)) {
    results.private.push({ path: file, reason: "Always private (instance-specific)" });
    return;
  }

  if (ALWAYS_PUBLIC.has(file)) {
    results.public.push({ path: file, reason: "Generic (liberation tech)" });
    return;
  }

  // Check for private patterns
  const hasPrivateData = PRIVATE_PATTERNS.some((pattern) => pattern.test(content));

  if (hasPrivateData) {
    results.needsReview.push({
      path: file,
      reason: "Contains TM-specific data (IPs, tokens, hostnames)",
      action: "Strip private data → move to Tabula_Myriad",
    });
  } else {
    results.public.push({ path: file, reason: "No private data detected" });
  }
});

// Scan skills directory
const skillsPath = path.join(workspaceRoot, "skills");
if (fs.existsSync(skillsPath)) {
  const skillDirs = fs.readdirSync(skillsPath).filter((f) => f !== "node_modules");
  skillDirs.forEach((skill) => {
    if (skill.startsWith("triad-")) {
      results.public.push({
        path: `skills/${skill}/`,
        reason: "Generic triad skill (any agent can use)",
      });
    } else {
      results.public.push({ path: `skills/${skill}/`, reason: "Generic skill" });
    }
  });
}

// Output report
console.log("📦 PRIVATE (Move to Tabula_Myriad):");
results.private.forEach((r) => console.log(`  ❌ ${r.path} — ${r.reason}`));

console.log("\n✅ PUBLIC (Stay in openclaw):");
results.public.forEach((r) => console.log(`  ✅ ${r.path} — ${r.reason}`));

console.log("\n⚠️  NEEDS REVIEW (Strip private data):");
results.needsReview.forEach((r) => console.log(`  ⚠️  ${r.path} — ${r.action}`));

console.log("\n🦞 Audit complete. Review ⚠️ files before committing to public repo.\n");

// Write audit report
const reportPath = path.join(workspaceRoot, "scripts", "audit-report.json");
fs.writeFileSync(reportPath, JSON.stringify(results, null, 2));
console.log(`📝 Report saved: ${reportPath}`);