from pathlib import Path
import json, re, sys
out = Path(__file__).resolve().parent
findings = []
files = [p for p in out.rglob('*') if p.is_file() and p.name not in ('scan.json', 'packet-manifest.sha256')]
patterns = [r'-----BEGIN [A-Z ]*PRIVATE KEY-----', r'gh[pousr]_[A-Za-z0-9]{30,}', r'AKIA[0-9A-Z]{16}', r'(?i)(?:api_key|password|access_token)\s*[:=]\s*[\"\'][A-Za-z0-9_+/=-]{24,}']
for p in files:
 if p.is_symlink(): findings.append({'path':str(p.relative_to(out)), 'kind':'symlink'}); continue
 raw = p.read_bytes()
 try: text = raw.decode('utf8')
 except UnicodeDecodeError: findings.append({'path':str(p.relative_to(out)), 'kind':'non-UTF8'}); continue
 if b'\x00' in raw: findings.append({'path':str(p.relative_to(out)), 'kind':'NUL'})
 for pattern in patterns:
  if re.search(pattern,text): findings.append({'path':str(p.relative_to(out)), 'kind':'credential-pattern'})
result = {'files':len(files), 'findings':findings, 'scope':'packet only: UTF-8/NUL, symlinks, private-key and credential-value patterns; no live reads'}
(out/'scan.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps(result)); sys.exit(bool(findings))