feat(scan): read @openshell comments in Ruby, Rust, Java and more; report unscanned languages - #21

…ns are reported (#25)

## What and why

Reworks how `exclude` behaves so it stops failing silently.

- **Root cause of the "anchor matches nothing" case:** with `scan .` /
`lint .` the walker yields `./packages/cli/a.ts`, and the relative path
kept the leading `.`, so `^packages/cli/` never matched. Relative paths
are now normalised (this also removes the `./` prefix from source paths
in the generated policy comments, a separate small bug seen on
Paperclip).
- **Dead patterns are reported:** in a whole-repo scan, any
`[scan].exclude` or `[lint].exclude` pattern that matches no file prints
`warning: [scan].exclude pattern ... matches no file`, with a hint.
Regex-looking patterns (`^packages/(admin|cli)/`) get "exclude patterns
are not regexes: ... list one entry per directory". Partial scans stay
quiet; stdout and `--json` are unchanged.
- **One exclude list:** files excluded by `[scan].exclude` are never
read, so `lint` already inherits them (checked, including with a `.`
path). `[lint].exclude` stays as lint-only extras. This is now stated in
the config docs and the README, with the literal (not regex) matching
rule and a per-directory example.

Tests: `tests/excludes.rs` (shared exclude with and without a `.` path,
no `./` prefix, regex pattern warning, dead lint pattern, partial scan
quiet). `TOOLCHAIN=1.94 scripts/ci-local.sh` and stable clippy pass.

Ordering: touches `do_scan` in `main.rs` and `scan.rs` like #21 (comment
leaders); whichever merges second needs a trivial rebase.

Closes #9

Signed-off-by: Ilan Harel <[email protected]>
Co-authored-by: Ilan Harel <[email protected]>

…ials (#28)

## What and why

Credentials read through dynamic lookups (Ruby `ENV[key.to_s.upcase]`,
Go viper `SetEnvPrefix` + `GetString`, litellm choosing the variable by
model name) cannot be found statically, so lint did not flag them and
provider detection missed them. They cannot be solved by analysis, so
this documents the limit and adds a way to declare them once.

- New `[providers] expect = ["GITHUB_PERSONAL_ACCESS_TOKEN"]` in
`openshell-annotate.toml`. Each entry behaves like an `@openshell
provider ENV` directive: it is mapped to a profile (profile dirs or
`[providers.env]`), shows up in the providers JSON/script (or as
`unmapped`, with source `openshell-annotate.toml: [providers].expect`),
and counts as declared for the `lint` env-read check.
- Entries must look like environment variable names; anything else is a
config error.
- README: new "dynamic lookups" item in Limits (with the three real
examples from github-mcp-server, pocketrb and mini-swe-agent) and the
config block.

This fixes the issue the way it proposed: documentation plus the config
key, no attempt at static resolution.

Tests: `tests/providers_expect.rs` (lint flag disappears, providers
output, invalid entry). `TOOLCHAIN=1.94 scripts/ci-local.sh` and stable
clippy pass.

Ordering: the README Limits bullet sits next to the one #21 edits, so
whichever merges second needs a trivial rebase.

Closes #17

Signed-off-by: Ilan Harel <[email protected]>
Co-authored-by: Ilan Harel <[email protected]>

…entials (#30)

## What and why

Three of five tested projects needed a hand-written custom provider
profile, and `providers.sh` only said `# UNMAPPED ... write a custom
profile`.

- **`generate --scaffold-profiles DIR`** writes `DIR/<id>.yaml` for
every unmapped credential (id = env var lower-cased with hyphens): the
credential, plus endpoints, `access` and binaries taken from the
`egress` directives in the file that declares the credential. `tls=skip`
endpoints get `allow_uninspected_credentials: true` (OpenShell's profile
lint requires it for L4-only credentialed endpoints); credentials with
no egress in their file get `endpoints: []` and TODO comments. Existing
files are kept, nothing is written without the flag, no secret values
are involved. The `UNMAPPED` comment in `providers.sh` now points to the
flag.
- **Misleading duplicate warning:** `egress X duplicates an endpoint the
profile adds` is now only shown when the profile's `binaries` overlap
the rule's binaries (profile bound to `gh`/`git`, app is `node`: the
explicit rule is needed, no warning). Profiles that list no binaries
keep the old behaviour.
- README section "Credentials with no provider profile"; CLI.md
regenerated.

Checked with the real tool: skeletons generated from
anthropic-proxy-rs's sidecar (`tls=skip` case) and synthetic cases all
pass `openshell provider profile lint -f` (OpenShell 0.1.6 on the dev
server). CI cannot run that, so the tests reload the skeletons with our
own profile loader.

Tests: `tests/scaffold_profiles.rs` (3 tests) and a unit test.
`TOOLCHAIN=1.94 scripts/ci-local.sh` and stable clippy pass.

Ordering: independent (new module `scaffold.rs`; small edits in
`providers.rs`, `generate.rs`, `main.rs`'s `Generate` arm). Another PR
(#26) edits other parts of `main.rs`, and #21/#25 edit `do_scan`; any of
them may need a trivial rebase.

Closes #13

---------

Signed-off-by: Ilan Harel <[email protected]>
Co-authored-by: Ilan Harel <[email protected]>