sharekit-cli 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cde6c59b8fa8f0a9b7405d8f67ccba50390a1cfeb03a10628f39cfc7b1c823c
-  data.tar.gz: 9d86a7780e71640e1597d57912113a9c154256eb799aa2e28e7408686dbb2844
+  metadata.gz: 7b29c0f30ebaaf2763d471c1ef587cc8fa1d6d32e1a1964ea6749f9b6e9fde48
+  data.tar.gz: 2afc9c73934a31825c8ef0e0531ab85b8e386cebf9daf0f2ec12bb34f994fce4
 SHA512:
-  metadata.gz: 7bea1ae6dc74aab3e5a3a57d45e4c9ad986b046485f26020a2bbafbb1cb626250e30a748490b671cd6be9c78be62d729cdade72df9e6afcacb04496ca24bf8c5
-  data.tar.gz: 8a02b6895b8318687478166602ec1341cc537b2d44e4b3351ab6771807c2df9679a07b380d99557c11caf50f9a9267221716e1db0823c6111e951df1f064585b
+  metadata.gz: 7e8314ef9e2cc42af165c8d18c9b6e1aced24c1de9a9ad7bec43a491d7c0f5929f479d939c8073c4739a2884a89f594a869ac0b47f6ef577074f0ce8e8e14357
+  data.tar.gz: af337d25884e2fce90ee4dc98855d1be0f6dee87c25c5c08064594f9d2fd1e107f54fed9e7bfc92a46656836863d5f291273e41dd6a7a0897c756b6c95696e8a

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 ## [Unreleased]
 
+## [0.2.0] - 2026-07-26
+
+- `scan --ai-triage` labels each finding `true_positive`, `false_positive` or
+  `uncertain` with a confidence and a one-line rationale, via RubyLLM structured
+  output. Works against any RubyLLM provider; `--provider ollama` needs no setup.
+- `ruby_llm` is an **optional** dependency, not a runtime one: `scan` alone pulls
+  nothing new, and `--ai-triage` without it reports how to install it. Run
+  `gem install ruby_llm` to enable triage.
+- Secret values are never transmitted, and there is no opt-out. Findings are
+  reduced to their shape (length plus Shannon entropy) before the prompt is
+  built. See `docs/adr/2026-07-26-redact-always-ai-triage.md`.
+- Verdicts are advisory: the high-severity gate ignores them.
+
 ## [0.1.0] - 2026-07-25
 
 - Initial release

data/README.md

@@ -20,6 +20,13 @@ idioms that don't have a clean TS equivalent:
   without the scanner caring which.
 - **`case/in` pattern matching** in `Reporter.format_line`, matching directly on the `Finding`'s
   deconstructed fields instead of manual attribute access.
+- **`Data#with` for the triage pass.** Verdicts are layered onto findings by returning new
+  `Finding`s, so the scan result is never mutated and an untriaged finding is structurally
+  the same object it always was. The triage fields default to `nil` via a keyword-splat
+  `super`, which is how `Data.define` takes defaults at all.
+- **`autoload` for the AI path.** `require "ruby_llm"` pulls in a provider stack that a plain
+  `scan` never touches, so `Triage` is resolved on first reference. One stdlib line instead of
+  an optional-dependency dance.
 - **Thor** for CLI dispatch instead of hand-parsed `ARGV`/flags.
 - **`git ls-files`, not a hand-rolled ignore-file parser.** `scan` defers to git for
   `.gitignore`-aware file listing when run inside a repo (via `Open3`, argv-array — no shell
@@ -27,17 +34,14 @@ idioms that don't have a clean TS equivalent:
 
 ## Install
 
-Not yet published to RubyGems. Install straight from git:
-
 ```bash
-gem install specific_install
-gem specific_install https://github.com/LucasSantana-Dev/sharekit-cli.git
+gem install sharekit-cli
 ```
 
 Or add to a `Gemfile`:
 
 ```ruby
-gem "sharekit-cli", git: "https://github.com/LucasSantana-Dev/sharekit-cli.git"
+gem "sharekit-cli"
 ```
 
 ## Usage
@@ -67,6 +71,52 @@ otherwise. `init` copies `~/.claude/CLAUDE.md` and `~/.cursor/.cursorrules` into
 (or writes placeholders if they don't exist) and scans everything it copies for secrets before
 reporting success.
 
+### AI triage
+
+`--ai-triage` labels each finding as a real leak, a placeholder, or unclear, so a docs
+sample stops looking exactly like a live key.
+
+It needs one extra gem, which `scan` itself does not:
+
+```bash
+gem install ruby_llm
+```
+
+That is deliberate. A secret scanner shouldn't drag a provider stack into every install, so
+`ruby_llm` is optional: `sharekit-cli scan` never loads it, and `--ai-triage` without it fails
+with instructions rather than a `LoadError`.
+
+```bash
+sharekit-cli scan --ai-triage                                        # any configured provider
+sharekit-cli scan --ai-triage --provider ollama --model qwen3:4b \
+                  --assume-model-exists                              # fully local
+```
+
+```text
+  ⚠  Secret patterns detected:
+    config/secrets.env:1 [AWS Access Key ID] …_KEY=AKIAEXAMPLEKEY000000
+      → likely real (95% confident) Config path, not a test or docs fixture.
+    docs/example.md:3 [AWS Access Key ID] …ple `AKIAIOSFODNN7EXAMPLE…
+      → likely placeholder (98% confident) Documentation path, context says "for example".
+
+  ⚠  AI verdicts are advisory: the high-severity gate ignores them.
+```
+
+**Secret values are never sent, and there is no flag to send them.** Before a prompt is
+built, each finding's line is re-read from disk and every secret in it is replaced by its
+shape alone, as `[REDACTED chars=20 entropy=3.8]`. What the model gets is the rule name,
+the path, the line number, that shape, and whatever context survived. Redaction runs on the
+whole line rather than the truncated `preview` for a reason: truncation can cut a secret so
+that its own rule no longer matches it, and the fragment would survive. Reasoning is in
+[the ADR](docs/adr/2026-07-26-redact-always-ai-triage.md).
+
+Credentials come from `ANTHROPIC_API_KEY` or `OPENAI_API_KEY`. `--provider ollama` needs
+neither and defaults to `http://localhost:11434/v1` (override with `OLLAMA_API_BASE`), which
+keeps even the redacted shape on your machine.
+
+Verdicts annotate; they never unblock. A model deciding a live key isn't a key is not a
+failure mode worth having, so the gate stays independent of it.
+
 ### Rules
 
 | Rule                          | Severity |
@@ -84,7 +134,7 @@ reporting success.
 
 ```bash
 bin/setup                            # install dependencies
-bundle exec rspec                    # run the test suite (61 examples)
+bundle exec rspec                    # run the test suite (92 examples)
 bundle exec rubocop                  # lint
 bundle exec bundler-audit check --update  # dependency vulnerability scan
 bin/console                          # interactive prompt

data/docs/adr/2026-07-26-redact-always-ai-triage.md

@@ -0,0 +1,57 @@
+# Redact always in AI triage
+
+- Status: accepted
+- Date: 2026-07-26
+
+## Context
+
+`scan` is rule-driven, so it reports what a regex matched, not what the match
+means. `AKIAIOSFODNN7EXAMPLE` in `docs/example.md` and a live key in
+`config/secrets.env` produce the same high-severity finding, and the gate blocks
+on both. Classifying findings needs a model, which means deciding what a secret
+scanner is allowed to transmit about the secrets it just found.
+
+The tool's whole promise is that it runs before you publish something. Sending
+credentials to a third-party API in order to ask whether they are credentials
+would invert that promise, and "we only send it when you pass `--raw`" still
+ships a foot-gun in a security tool.
+
+## Decision
+
+Triage sends a finding's shape, never its value, with no opt-out.
+
+- Every payload line is passed through `Redactor` first. A masked token is
+  replaced by its length and Shannon entropy, e.g. `[REDACTED chars=20
+  entropy=3.8]`.
+- Redaction runs against the line re-read from disk, not the `Finding`'s
+  `preview`. Truncation can cut a secret mid-token so its own rule no longer
+  matches it, and the surviving fragment would ride along into the prompt.
+- Every `Scanner` rule is applied, not just the one that produced the finding,
+  so a second secret sharing the line is masked too. Sensitive env-var values are
+  masked by key name, and a generic backstop masks any remaining run of 20+
+  characters from the secret alphabet.
+- `--provider ollama` works with no configuration, so the redacted shape can stay
+  on the machine as well.
+- Verdicts are advisory. The high-severity gate ignores them.
+
+## Consequences
+
+Classification accuracy is lower than it would be with raw values: the model
+judges from rule name, path, line number, entropy and surviving context. That
+turned out to be enough on the cases that matter, because the strongest signal is
+the path (`docs/`, `spec/`, `*.example`) rather than the characters.
+
+The generic backstop is deliberately over-eager. It masks long URLs, hashes and
+base64 in prose, which makes some prompts noisier than necessary. Safety over
+prompt tidiness: the claim "nothing 20 characters or longer from the secret
+alphabet survives" is only true if it applies to material no rule claimed.
+
+Keeping the gate model-independent means a false `false_positive` cannot unblock
+a publish. It also means triage does not reduce the work when the verdict is
+right, it only tells you where to look first. Letting verdicts relax the gate is
+the obvious next request; it stays refused.
+
+## Revisit when
+
+Someone needs triage to change the exit code, or a provider offers an
+attestable-local guarantee strong enough to reconsider what may be transmitted.

data/lib/sharekit/cli/finding.rb

@@ -7,14 +7,22 @@ module Sharekit
     # Immutable value object for one scan hit. Data.define gives us structural
     # equality and Hash-pattern deconstruction (`in {severity:, rule:}`) for free —
     # a plain TS interface has neither.
-    Finding = Data.define(:rule, :file, :line, :preview, :severity) do
+    #
+    # The triage fields default to nil, so a scan-only run builds a Finding the
+    # same way it always did, and `Triage` layers verdicts on with `#with` rather
+    # than mutating anything.
+    Finding = Data.define(:rule, :file, :line, :preview, :severity,
+                          :verdict, :confidence, :rationale) do
       include Comparable
 
+      def initialize(verdict: nil, confidence: nil, rationale: nil, **) = super
+
       def <=>(other)
         SEVERITY_RANK.fetch(severity) <=> SEVERITY_RANK.fetch(other.severity)
       end
 
       def high? = severity == :high
+      def triaged? = !verdict.nil?
     end
   end
 end

data/lib/sharekit/cli/redactor.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require_relative "scanner"
+
+module Sharekit
+  module Cli
+    # Strips secret material out of a line before it can leave the machine.
+    #
+    # Redaction runs against the *original* line, never a Finding's truncated
+    # preview: truncation can cut a secret mid-token so that the rule pattern no
+    # longer matches it, which would let the surviving fragment through.
+    #
+    # A masked secret is replaced by its shape (length + Shannon entropy), which
+    # is what a classifier actually needs to tell a live key from EXAMPLE_KEY.
+    module Redactor
+      # Backstop for high-entropy material no Scanner rule claims. Runs last, so
+      # rule-labelled hits keep their own mask.
+      GENERIC_SECRET_PATTERN = %r{[A-Za-z0-9+/=_-]{20,}}
+      MASK_PREFIX = "[REDACTED"
+
+      module_function
+
+      # Masks every secret-shaped run in +line+: every Scanner rule, then
+      # sensitive env-var values, then the generic backstop. All rules run, not
+      # just the one that produced the finding, so a second secret sharing the
+      # line cannot ride along into a prompt.
+      def redact(line)
+        masked = Scanner::RULES.reduce(line) do |acc, rule|
+          acc.gsub(rule.pattern) { |hit| mask(hit) }
+        end
+        mask_env_values(masked).gsub(GENERIC_SECRET_PATTERN) { |hit| mask(hit) }
+      end
+
+      def mask(secret)
+        "#{MASK_PREFIX} chars=#{secret.length} entropy=#{format("%.1f", entropy(secret))}]"
+      end
+
+      # Shannon entropy in bits per character. Random tokens land near 4+ bits;
+      # placeholders like AKIAIOSFODNN7EXAMPLE sit noticeably lower.
+      def entropy(str)
+        return 0.0 if str.empty?
+
+        length = str.length.to_f
+        str.each_char.tally.values.sum do |count|
+          probability = count / length
+          -probability * Math.log2(probability)
+        end
+      end
+
+      # Scanner's ENV_VAR_PATTERN ends in `(.*)$`, which swallows the rest of the line,
+      # so the first assignment is the only one it ever examines. That is fine for
+      # reporting one finding per line, but as a redaction pass it leaks: in
+      # `PATH=/usr/bin API_KEY=short` the boring first key short-circuits the check and
+      # the real secret is never masked, while being too short for the generic
+      # backstop. Redaction therefore matches one assignment at a time. Quoted forms
+      # are listed explicitly because a bare `\S*` stops at the space in `KEY="a b"`.
+      ENV_ASSIGNMENT_PATTERN = /(?:^|\s)(?:export\s+)?([A-Z_]+)=("[^"]*"|'[^']*'|\S*)/
+
+      def mask_env_values(line)
+        line.gsub(ENV_ASSIGNMENT_PATTERN) do |hit|
+          key = Regexp.last_match(1)
+          value = Regexp.last_match(2)
+          next hit unless Scanner::SENSITIVE_KEY_PATTERN.match?(key)
+          next hit if value.empty? || value.start_with?(MASK_PREFIX)
+
+          hit.sub(value, mask(value))
+        end
+      end
+    end
+  end
+end

data/lib/sharekit/cli/reporter.rb

@@ -8,6 +8,10 @@ module Sharekit
       YELLOW = "\e[33m"
       RESET = "\e[0m"
 
+      VERDICT_LABELS = { "true_positive" => "likely real",
+                         "false_positive" => "likely placeholder",
+                         "uncertain" => "unclear" }.freeze
+
       module_function
 
       def report(findings, force: false)
@@ -16,19 +20,32 @@ module Sharekit
           return
         end
 
+        print_findings(findings)
+        gate!(findings, force:)
+      end
+
+      def print_findings(findings)
         puts "#{YELLOW}\n  ⚠  Secret patterns detected:#{RESET}"
         findings.each { |finding| puts "#{YELLOW}    #{format_line(finding)}#{RESET}" }
-        puts "#{YELLOW}\n  ⚠  Review and redact secrets before pushing to a public repository.\n#{RESET}"
-
-        gate!(findings, force:)
+        puts "#{YELLOW}\n  ⚠  Review and redact secrets before pushing to a public repository.#{RESET}"
+        if findings.any?(&:triaged?)
+          puts "#{YELLOW}  ⚠  AI verdicts are advisory: the high-severity gate ignores them.#{RESET}"
+        end
+        puts ""
       end
 
       # Data.define objects deconstruct into a Hash for free, so `in` can match
       # directly on the fields we care about — no case/when + manual field access.
+      # The untriaged branch comes first, so a nil verdict never reaches the
+      # formatting that assumes one.
       def format_line(finding)
         case finding
-        in { file:, line:, rule:, preview: }
+        in { verdict: nil, file:, line:, rule:, preview: }
           "#{file}:#{line} [#{rule}] #{preview}"
+        in { verdict:, confidence:, rationale:, file:, line:, rule:, preview: }
+          "#{file}:#{line} [#{rule}] #{preview}\n" \
+            "      → #{VERDICT_LABELS.fetch(verdict, verdict)} " \
+            "(#{(confidence * 100).round}% confident) #{rationale}"
         end
       end
 

data/lib/sharekit/cli/triage.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require "ruby_llm"
+require "ruby_llm/schema"
+require_relative "redactor"
+
+module Sharekit
+  module Cli
+    # Classifies findings as real leaks or false positives with an LLM.
+    #
+    # SECURITY: the model never receives secret material, and there is no flag to
+    # opt out. Every payload line is rebuilt from the file on disk and passed
+    # through Redactor first, so what ships is the finding's *shape*: rule name,
+    # path, line number, length and entropy of the masked token, and whatever
+    # surrounding context survived redaction. Point --provider at Ollama to keep
+    # even that on the machine.
+    #
+    # Verdicts are advisory. Triage annotates output; it never relaxes the
+    # high-severity gate, because a model must not be what decides a live key
+    # isn't a key.
+    module Triage
+      VERDICTS = %w[true_positive false_positive uncertain].freeze
+
+      # Ollama's conventional local endpoint, so --provider ollama needs no setup.
+      OLLAMA_DEFAULT_BASE = "http://localhost:11434/v1"
+
+      RATIONALE_LIMIT = 120
+
+      SOURCE_UNAVAILABLE = "[source unavailable]"
+
+      # A missing API key or an unknown model id raise off a different branch of
+      # RubyLLM's hierarchy than provider/HTTP faults, and they are the two most
+      # likely failures here, so both branches are caught.
+      FAILURES = [RubyLLM::Error, RubyLLM::ConfigurationError,
+                  RubyLLM::ModelNotFoundError, Faraday::Error].freeze
+
+      # Findings go over as an indexed list in one request, and verdicts are
+      # matched back by index. A verdict for an index the model skipped or
+      # invented is dropped rather than shifting every later finding's answer.
+      class Schema < RubyLLM::Schema
+        array :verdicts do
+          object do
+            integer :index, description: "index of the finding being judged"
+            string :verdict, enum: VERDICTS
+            number :confidence, description: "0.0 to 1.0"
+            string :rationale, description: "one sentence, at most #{RATIONALE_LIMIT} characters"
+          end
+        end
+      end
+
+      SYSTEM_PROMPT = <<~PROMPT
+        You triage secret-scanner findings for a tool that runs before someone
+        publishes a directory. For each finding decide whether it is a real leaked
+        credential (true_positive), a placeholder, example, test fixture or
+        documentation sample (false_positive), or genuinely unclear (uncertain).
+
+        Secret values have been redacted before reaching you. A masked token shows
+        only its length and Shannon entropy, as
+        "[REDACTED chars=20 entropy=3.8]". Judge from the rule name, the file path,
+        the line number, and the surrounding context. High entropy and a config or
+        source path suggest a real credential; low entropy, or paths like
+        spec/, test/, fixtures/, docs/, README, *.example, *.sample suggest not.
+
+        Never claim to have read the secret. Reply for every index you are given.
+      PROMPT
+
+      module_function
+
+      # Returns a new array of findings, each with triage fields filled where the
+      # model answered. Findings the model skipped come back untouched.
+      def call(findings, **chat_options)
+        return findings if findings.empty?
+
+        verdicts = request(findings, **chat_options)
+        findings.each_with_index.map do |finding, index|
+          verdict = verdicts[index]
+          verdict ? finding.with(**verdict) : finding
+        end
+      end
+
+      def request(findings, **chat_options)
+        configure
+        chat = RubyLLM.chat(**chat_options.compact)
+                      .with_instructions(SYSTEM_PROMPT)
+                      .with_schema(Schema)
+        # On 1.16 a schema-backed reply arrives parsed on #content (there is no
+        # #parsed), and stays a String if the provider returned unparseable JSON.
+        parse(chat.ask(prompt_for(findings)).content, findings.size)
+      rescue *FAILURES => e
+        raise Error, "AI triage failed: #{e.class}: #{e.message}"
+      end
+
+      # RubyLLM reads no provider credentials from the environment on its own,
+      # and a CLI has nowhere else to get them.
+      def configure
+        RubyLLM.configure do |config|
+          config.anthropic_api_key = ENV.fetch("ANTHROPIC_API_KEY", nil)
+          config.openai_api_key = ENV.fetch("OPENAI_API_KEY", nil)
+          config.ollama_api_base = ENV.fetch("OLLAMA_API_BASE", OLLAMA_DEFAULT_BASE)
+        end
+      end
+
+      # Rebuilds each finding's line from disk so redaction sees the whole line,
+      # never the already-truncated preview.
+      def prompt_for(findings)
+        lines = Hash.new { |cache, path| cache[path] = read_lines(path) }
+
+        findings.each_with_index.map { |finding, index| entry(finding, index, lines) }.join("\n")
+      end
+
+      # There is deliberately no fallback to `finding.preview` when the file cannot be
+      # read: the preview is truncated, and a fragment cut mid-token matches neither its
+      # own rule nor the generic backstop, which is the exact leak reading from disk
+      # exists to prevent. Losing one finding's context is the cheaper failure. The path
+      # is redacted too, so a token embedded in a filename cannot ride along.
+      def entry(finding, index, lines)
+        raw = lines[finding.file]&.[](finding.line - 1)
+        <<~ENTRY
+          #{index}. rule=#{finding.rule} severity=#{finding.severity}
+             location=#{Redactor.redact(finding.file)}:#{finding.line}
+             context=#{raw ? Redactor.redact(raw.chomp) : SOURCE_UNAVAILABLE}
+        ENTRY
+      end
+
+      def read_lines(path)
+        File.readlines(path, encoding: "UTF-8")
+      rescue ArgumentError, SystemCallError
+        nil
+      end
+
+      def parse(content, count)
+        return {} unless content.is_a?(Hash)
+
+        Array(content["verdicts"]).each_with_object({}) do |row, acc|
+          index = verdict_index(row, count)
+          next unless index
+
+          acc[index] = { verdict: row["verdict"],
+                         confidence: row["confidence"].to_f.clamp(0.0, 1.0),
+                         rationale: rationale(row["rationale"]) }
+        end
+      end
+
+      # Models routinely blow past the length the schema asks for, and these land
+      # in a terminal one line per finding, so the limit is enforced here too.
+      def rationale(raw)
+        text = raw.to_s.strip
+        return text if text.length <= RATIONALE_LIMIT
+
+        "#{text[0, RATIONALE_LIMIT - 1]}…"
+      end
+
+      # Only an in-range index paired with a label we asked for is usable; anything
+      # else is dropped so it cannot shift another finding's verdict.
+      def verdict_index(row, count)
+        return unless row.is_a?(Hash)
+
+        index = row["index"]
+        return unless index.is_a?(Integer) && index.between?(0, count - 1)
+        return unless VERDICTS.include?(row["verdict"])
+
+        index
+      end
+    end
+  end
+end

data/lib/sharekit/cli/version.rb

@@ -2,6 +2,6 @@
 
 module Sharekit
   module Cli
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/lib/sharekit/cli.rb

@@ -9,9 +9,15 @@ require_relative "cli/file_lister"
 require_relative "cli/init"
 
 module Sharekit
+  # Command-line entry points for scanning a directory for leaked secrets and
+  # scaffolding a publishable profile.
   module Cli
     class Error < StandardError; end
 
+    # Loading ruby_llm pulls in a provider stack that a plain `scan` never needs,
+    # so Triage is resolved on first reference instead of at boot.
+    autoload :Triage, "sharekit/cli/triage"
+
     # Thor gives us subcommand dispatch, flag parsing, and --help for free —
     # the TS original hand-parses process.argv/flags itself.
     class App < Thor
@@ -22,14 +28,23 @@ module Sharekit
                     type: :boolean,
                     default: false,
                     desc: "exit 0 even if high-severity findings detected"
+      method_option :ai_triage,
+                    type: :boolean,
+                    default: false,
+                    desc: "label findings true/false positive with an LLM (secret values are redacted first)"
+      method_option :model,
+                    type: :string,
+                    desc: "model id for --ai-triage (default: RubyLLM's configured default)"
+      method_option :provider,
+                    type: :string,
+                    desc: "provider for --ai-triage, e.g. anthropic, openai, ollama"
+      method_option :assume_model_exists,
+                    type: :boolean,
+                    default: false,
+                    desc: "skip model-registry validation, needed for local Ollama models"
       def scan(dir = ".")
-        findings = FileLister.list(dir).flat_map do |path|
-          Scanner.scan(File.read(path, encoding: "UTF-8"), file: path).to_a
-        rescue ArgumentError, Errno::ENOENT, Errno::EACCES => e
-          puts "    ~ Skipped #{path}: #{e.class}"
-          []
-        end
-
+        findings = collect_findings(dir)
+        findings = triage(findings) if options[:ai_triage]
         Reporter.report(findings, force: options[:force])
       rescue Error => e
         warn e.message
@@ -55,6 +70,31 @@ module Sharekit
       end
 
       no_commands do
+        def collect_findings(dir)
+          FileLister.list(dir).flat_map do |path|
+            Scanner.scan(File.read(path, encoding: "UTF-8"), file: path).to_a
+          rescue ArgumentError, Errno::ENOENT, Errno::EACCES => e
+            puts "    ~ Skipped #{path}: #{e.class}"
+            []
+          end
+        end
+
+        def triage(findings)
+          return findings if findings.empty?
+
+          puts "\n  … AI triage: #{findings.size} finding(s), secret values redacted before sending"
+          Triage.call(findings,
+                      model: options[:model],
+                      provider: options[:provider]&.to_sym,
+                      assume_model_exists: options[:assume_model_exists])
+        rescue LoadError => e
+          # ruby_llm is optional: a scan-only install should not have to carry a
+          # provider stack. Autoloading Triage is what surfaces its absence here.
+          raise Error, "--ai-triage needs the ruby_llm gem, which is not installed. " \
+                        "Install it with `gem install ruby_llm` (or add it to your Gemfile). " \
+                        "(#{e.message})"
+        end
+
         def print_init_summary(result)
           result.created.each { |path| puts "  + #{path}" }
           puts "\n  ✓ Created profile at #{result.profile_dir}\n\n"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sharekit-cli
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Lucas Santana
@@ -38,13 +38,16 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- docs/adr/2026-07-26-redact-always-ai-triage.md
 - exe/sharekit-cli
 - lib/sharekit/cli.rb
 - lib/sharekit/cli/file_lister.rb
 - lib/sharekit/cli/finding.rb
 - lib/sharekit/cli/init.rb
+- lib/sharekit/cli/redactor.rb
 - lib/sharekit/cli/reporter.rb
 - lib/sharekit/cli/scanner.rb
+- lib/sharekit/cli/triage.rb
 - lib/sharekit/cli/version.rb
 - sig/sharekit/cli.rbs
 homepage: https://github.com/LucasSantana-Dev/sharekit-cli