Remove tracked plaintext credential scripts

tests/unit/test_documentation_consistency.py

@@ -20,6 +20,7 @@ NONEXISTENT_VISUAL_PLAN_NAME = "AI_ICT_" + "视觉盯盘与主动告警增强方
 ACTIVE_TOP_LEVEL_DOCS = {
     "AI_ICT_实盘辅助分析决策助手上线必做清单_2026-05-18_v1.md",
     "AI_ICT_实盘辅助分析决策助手使用说明_2026-05-18_v1.md",
+    "AI_ICT_敏感凭据低风险清理记录_2026-05-18_v1.md",
     "AI_ICT_分析助手主线增强开发计划_2026-05-14_v1.md",
     "AI_ICT_实盘辅助分析决策助手可用性评估与补齐方案_2026-05-17_v1.md",
     "AI_ICT_全自动开发执行流程_v1.md",

tests/unit/test_secret_static_checks.py

@@ -0,0 +1,58 @@
+import contextlib
+import io
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from scripts import run_secret_static_checks
+
+
+class SecretStaticChecksTests(unittest.TestCase):
+    def test_detects_expect_password_without_printing_value(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            root = Path(tmpdir)
+            script = root / "deploy.exp"
+            script.write_text('set password "123456"\n', encoding="utf-8")
+
+            result = run_secret_static_checks.run_secret_static_checks(root=root, files=(script,))
+
+        self.assertFalse(result["passed"])
+        self.assertEqual(result["findings"][0]["pattern"], "expect_password_literal")
+        self.assertNotIn("123456", json.dumps(result, ensure_ascii=False))
+
+    def test_allows_placeholder_env_examples(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            root = Path(tmpdir)
+            example = root / ".env.example"
+            example.write_text("OKX_API_SECRET=<set-in-shell>\n", encoding="utf-8")
+
+            result = run_secret_static_checks.run_secret_static_checks(root=root, files=(example,))
+
+        self.assertTrue(result["passed"])
+
+    def test_detects_tracked_runtime_env(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            root = Path(tmpdir)
+            env_file = root / ".env"
+            env_file.write_text("DATABASE_URL=postgresql://user:pass@localhost/db\n", encoding="utf-8")
+
+            result = run_secret_static_checks.run_secret_static_checks(root=root, files=(env_file,))
+
+        self.assertFalse(result["passed"])
+        self.assertEqual(result["findings"][0]["pattern"], "tracked_runtime_env")
+
+    def test_json_output_is_machine_readable_and_redacted(self) -> None:
+        output = io.StringIO()
+
+        with contextlib.redirect_stdout(output):
+            exit_code = run_secret_static_checks.main(env={"SECRET_CHECKS_OUTPUT_JSON": "1"})
+
+        summary = json.loads(output.getvalue())
+        self.assertEqual(exit_code, 0)
+        self.assertTrue(summary["passed"])
+        self.assertIn("checked_file_count", summary)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_trading_delivery_readiness.py

@@ -21,6 +21,7 @@ EXPECTED_COMMAND_GROUPS = (
             '.venv/bin/python -m unittest discover -s tests/unit -p "test_*.py"',
             ".venv/bin/python scripts/run_offline_checks.py",
             ".venv/bin/python scripts/check_local_demo_readiness.py",
+            ".venv/bin/python scripts/run_secret_static_checks.py",
             ".venv/bin/python scripts/check_trading_delivery_readiness.py",
         ),
     ),
@@ -60,7 +61,7 @@ EXPECTED_COMMAND_GROUPS = (
             "git rev-parse HEAD",
             "docker compose -p ai-ict -f /root/deploy/ai-ict/docker-compose.yml logs --tail=100 ai-ict",
             "git worktree add /tmp/ai-ict-rollback <last-known-good-sha>",
-            "cd /tmp/ai-ict-rollback && ./scripts/deploy_server.exp",
+            "cd /tmp/ai-ict-rollback && AI_ICT_DEPLOY_PASSWORD=<set-in-shell> AI_ICT_DEPLOY_USE_SUDO=1 .venv/bin/python scripts/deploy_with_password.py --host 192.168.3.90 --user yuqei --port 22 --remote-path /home/yuqei/project/ai-exchange --remote-archive /home/yuqei/ai-ict-deploy.tgz",
             "rm -rf /tmp/ai-ict-rollback",
         ),
     ),