fix: keep the local checkout path out of the reproduction report

[SurefireStudios]

Closes #13.

What was leaking

Several of the reproduced commands echo their own working directory, and the report records each command's output verbatim. That directory is a temporary checkout under the OS temp directory, which on most machines sits inside a home directory, so the published report carried a real local path:

"tail": "> stateproof@1.0.0 typecheck C:\Users\<name>\AppData\Local\Temp\stateproof-clean-DBN0Qm\n..."

The scanner has a rule for exactly that shape, absolute-user-path, and it did not fire. JSON stores the separators doubled and the rule looks for single ones.

Two changes, because either alone leaves a gap

clean-reproduction.ts replaces the checkout path with <checkout> at the point output is recorded, rather than scrubbing the file afterwards. It covers both separators, since tools disagree about which to print on Windows, and the resolved path as well, since macOS reports its temp directory through a symlink. Replacement runs longest-variant-first so no path is partly rewritten by one of its own prefixes.

scan-secrets.ts applies each rule to the unescaped text as well as the text as written. This is deliberately not scoped to the absolute-path rule: any rule whose pattern contains a separator had the same blind spot, so the fix belongs at the point rules are applied. It is a second pass only when the text actually contains an escaped backslash.

Verification

Both halves are demonstrated rather than asserted, since vitest only collects packages/*/test and apps/*/test:

1. The scanner now catches it. Run against the old report, pnpm scan:secrets reports FINDING submission/clean-reproduction-report.json: an absolute local user path, excerpt C:\Users\Haz. Before this change the same file scanned CLEAN.
2. The redaction works. pnpm test:clean-reproduction re-ran end to end and PASSED. The regenerated report contains zero occurrences of Users and the tails now read > stateproof@1.0.0 typecheck <checkout>.
3. Together they are clean. pnpm scan:secrets now reports RESULT: CLEAN, 0 findings.

pnpm typecheck passes.

The report is regenerated, which is a fresh run of the reproduction rather than an edit of a recorded result, as the issue anticipated.

Note

Low Risk

Overview
This PR sanitizes local filesystem paths from reproduction command output before they are persisted in the published report. scripts/clean-reproduction.ts is updated to strip the temporary checkout prefix from each command's tail/cwd fields (replacing it with a neutral marker like <tmp>), and scripts/scan-secrets.ts gains a new scanner rule that detects absolute temp-directory paths matching the same shape so the leak can be caught going forward. The two regenerated artifacts under submission/ (the JSON and Markdown report) reflect the change, now showing the redacted path instead of the real user temp directory.

^{Written by Gitzilla for commit 1b6e675. This will update automatically on new runs. Configure in the Gitzilla dashboard.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.