@agentvibes/guardrails 0.1.0

package/dist/iterate.js

@@ -0,0 +1,79 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+function readTask(task) {
+    if (existsSync(task))
+        return readFileSync(task, "utf8");
+    return task;
+}
+const FEEDBACK_HEADER = "The verification gate FAILED on your previous attempt. Fix ONLY the findings below — do not refactor anything the gate did not name, do not weaken any rule, config, or baseline. Findings:";
+export function runIterate(opts) {
+    if (opts.task === undefined || opts.cmd === undefined) {
+        console.error("guardrails iterate: --task <file-or-text> and --cmd '<runner command>' are required. See README 'Iterate harness'.");
+        return 2;
+    }
+    const taskText = readTask(opts.task);
+    const gateCmd = opts.gate ?? `node ${opts.cliPath} verify-diff`;
+    const dir = mkdtempSync(join(tmpdir(), "guardrails-iterate-"));
+    const attempts = [];
+    let feedback = "";
+    for (let attempt = 1; attempt <= opts.max; attempt++) {
+        const prompt = feedback === "" ? taskText : `${taskText}\n\n${FEEDBACK_HEADER}\n${feedback}`;
+        const promptFile = join(dir, `prompt-${attempt}.md`);
+        writeFileSync(promptFile, prompt);
+        const t0 = performance.now();
+        const agent = spawnSync("bash", ["-c", opts.cmd], {
+            input: prompt,
+            encoding: "utf8",
+            env: {
+                ...process.env,
+                GUARDRAILS_PROMPT_FILE: promptFile,
+                GUARDRAILS_ATTEMPT: String(attempt),
+            },
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        const gate = spawnSync("bash", ["-c", gateCmd], {
+            encoding: "utf8",
+            maxBuffer: 64 * 1024 * 1024,
+        });
+        const seconds = Math.round((performance.now() - t0) / 100) / 10;
+        const gateOut = `${gate.stdout}${gate.stderr}`;
+        const gateTail = gateOut
+            .split("\n")
+            .filter((l) => l !== "")
+            .slice(-30)
+            .join("\n");
+        attempts.push({
+            attempt,
+            agentExit: agent.status ?? -1,
+            gateExit: gate.status ?? -1,
+            gateTail,
+            seconds,
+        });
+        console.error(`guardrails iterate: attempt ${attempt}/${opts.max} — agent exit ${agent.status}, gate exit ${gate.status} (${seconds}s)`);
+        // ast-grep-ignore: kind-if-without-match -- gate.status is spawnSync's numeric exit code (number | null), not a discriminated-union tag
+        if (gate.status === 0) {
+            finish(opts.json, attempts, true);
+            return 0;
+        }
+        feedback = gateTail;
+    }
+    finish(opts.json, attempts, false);
+    return 1;
+}
+function finish(json, attempts, green) {
+    if (json) {
+        console.log(JSON.stringify({ command: "iterate", green, attempts }, null, 2));
+        return;
+    }
+    console.log(`guardrails iterate: ${green ? "GREEN" : "still red"} after ${attempts.length} attempt(s)`);
+    for (const a of attempts) {
+        console.log(`  attempt ${a.attempt}: agent exit ${a.agentExit}, gate exit ${a.gateExit}, ${a.seconds}s`);
+    }
+    if (!green) {
+        const last = attempts[attempts.length - 1];
+        console.log(`last gate output:\n${last?.gateTail ?? ""}`);
+    }
+}
+//# sourceMappingURL=iterate.js.map

package/dist/iterate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iterate.js","sourceRoot":"","sources":["../src/iterate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoCjC,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,eAAe,GACnB,6LAA6L,CAAC;AAEhM,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,CAAC,KAAK,CACX,oHAAoH,CACrH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,CAAC,OAAO,cAAc,CAAC;IAChE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,OAAO,KAAK,CAAC,CAAC;QACrD,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAElC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;YAChD,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,sBAAsB,EAAE,UAAU;gBAClC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;aACpC;YACD,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAC9C,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO;aACrB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;aACvB,KAAK,CAAC,CAAC,EAAE,CAAC;aACV,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3B,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CACX,+BAA+B,OAAO,IAAI,IAAI,CAAC,GAAG,iBAAiB,KAAK,CAAC,MAAM,eAAe,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAC1H,CAAC;QAEF,wIAAwI;QACxI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,IAAa,EAAE,QAAmB,EAAE,KAAc;IAChE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CACT,uBAAuB,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,UAAU,QAAQ,CAAC,MAAM,aAAa,CAC3F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,SAAS,eAAe,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/iterateTest.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/iterateTest.js

@@ -0,0 +1,91 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { packageRoot } from "./packagePaths.js";
+// Fixtures for the iterate harness, with a fake "agent" instead of an LLM:
+//   1. converging agent — writes a violation on attempt 1, fixes it on
+//      attempt 2 (because the feedback loop told it to) → GREEN in 2 attempts
+//   2. stubborn agent — keeps the violation every attempt → exit 1 at --max
+// Also pins the feedback contract: attempt 2's prompt file must contain the
+// gate's findings from attempt 1.
+function iterate(cwd, agentScript, max) {
+    const res = spawnSync("node", [
+        join(packageRoot, "dist", "cli.js"),
+        "iterate",
+        "--task",
+        "Implement the widget per spec.",
+        "--cmd",
+        `node ${agentScript}`,
+        "--max",
+        String(max),
+    ], { cwd, encoding: "utf8" });
+    if (res.error)
+        throw res.error;
+    return { status: res.status ?? -1, out: `${res.stdout}${res.stderr}` };
+}
+function expectStep(step, ok, detail) {
+    if (!ok) {
+        console.error(`FAIL iterate: ${step}\n${detail}`);
+        return false;
+    }
+    console.log(`  ok  iterate: ${step}`);
+    return true;
+}
+function gitRepo(dir) {
+    const git = (...args) => {
+        const r = spawnSync("git", ["-C", dir, ...args], { encoding: "utf8" });
+        if (r.status !== 0)
+            throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+    };
+    git("init", "-q");
+    writeFileSync(join(dir, "base.ts"), "export const ok = 1;\n");
+    git("add", "-A");
+    git("-c", "user.email=t@t", "-c", "user.name=t", "commit", "-qm", "init");
+}
+const CONVERGING_AGENT = `
+const fs = require("node:fs");
+const attempt = Number(process.env.GUARDRAILS_ATTEMPT);
+const prompt = fs.readFileSync(process.env.GUARDRAILS_PROMPT_FILE, "utf8");
+if (attempt === 1) {
+  fs.writeFileSync("widget.ts", "export const w = (x: unknown) => x as any;\\n");
+} else {
+  // The harness contract: the retry prompt carries the gate's findings.
+  if (!prompt.includes("as-any-escape")) { console.error("no feedback in prompt"); process.exit(9); }
+  fs.writeFileSync("widget.ts", "export const w = (x: number): number => x;\\n");
+}
+`;
+const STUBBORN_AGENT = `
+const fs = require("node:fs");
+fs.writeFileSync("widget.ts", "export const w = (x: unknown) => x as any;\\n");
+`;
+function main() {
+    const base = mkdtempSync(join(tmpdir(), "guardrails-iterate-test-"));
+    try {
+        const conv = join(base, "conv");
+        const stub = join(base, "stub");
+        for (const d of [conv, stub]) {
+            spawnSync("mkdir", ["-p", d]);
+            gitRepo(d);
+        }
+        writeFileSync(join(conv, "agent.cjs"), CONVERGING_AGENT);
+        writeFileSync(join(stub, "agent.cjs"), STUBBORN_AGENT);
+        const green = iterate(conv, "agent.cjs", 4);
+        if (!expectStep("converging agent → green on attempt 2 via feedback", green.status === 0 && green.out.includes("GREEN after 2 attempt(s)"), green.out)) {
+            return 1;
+        }
+        const red = iterate(stub, "agent.cjs", 2);
+        if (!expectStep("stubborn agent → exit 1 at --max with last findings", red.status === 1 &&
+            red.out.includes("still red after 2 attempt(s)") &&
+            red.out.includes("as-any-escape"), red.out)) {
+            return 1;
+        }
+        console.log("iterate fixtures passed");
+        return 0;
+    }
+    finally {
+        rmSync(base, { recursive: true, force: true });
+    }
+}
+process.exit(main());
+//# sourceMappingURL=iterateTest.js.map

package/dist/iterateTest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iterateTest.js","sourceRoot":"","sources":["../src/iterateTest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,2EAA2E;AAC3E,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,kCAAkC;AAElC,SAAS,OAAO,CAAC,GAAW,EAAE,WAAmB,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,SAAS,CACnB,MAAM,EACN;QACE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,SAAS;QACT,QAAQ;QACR,gCAAgC;QAChC,OAAO;QACP,QAAQ,WAAW,EAAE;QACrB,OAAO;QACP,MAAM,CAAC,GAAG,CAAC;KACZ,EACD,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC1B,CAAC;IACF,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,EAAW,EAAE,MAAc;IAC3D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAQ,EAAE;QACtC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC;IACF,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClB,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC9D,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,gBAAgB,GAAG;;;;;;;;;;;CAWxB,CAAC;AAEF,MAAM,cAAc,GAAG;;;CAGtB,CAAC;AAEF,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACzD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5C,IACE,CAAC,UAAU,CACT,oDAAoD,EACpD,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EACpE,KAAK,CAAC,GAAG,CACV,EACD,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,UAAU,CACT,qDAAqD,EACrD,GAAG,CAAC,MAAM,KAAK,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EACnC,GAAG,CAAC,GAAG,CACR,EACD,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC"}

package/dist/leakPatterns.d.ts

@@ -0,0 +1,5 @@
+export interface LeakPattern {
+    id: string;
+    regex: RegExp;
+}
+export declare const LEAK_PATTERNS: LeakPattern[];

package/dist/leakPatterns.js

@@ -0,0 +1,22 @@
+// Built-in patterns for `guardrails leaks` — GENERIC credential shapes only.
+// Deliberately NO infrastructure markers here: a list of private hostnames,
+// org names, or subnets is itself a fact about the private topology (spec
+// layer A″: code carries mechanisms, config carries facts), so house marker
+// lists reach the scanner through `.guardrails/leaks.txt`, a
+// `[leaks] patterns_file =` manifest entry, or a plugin's `leakPatterns()` —
+// never through this public package.
+export const LEAK_PATTERNS = [
+    { id: "github-token", regex: /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/ },
+    { id: "github-fine-grained-token", regex: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/ },
+    { id: "anthropic-key", regex: /\bsk-ant-[A-Za-z0-9-]{10,}\b/ },
+    { id: "openai-key", regex: /\bsk-proj-[A-Za-z0-9_-]{20,}\b/ },
+    { id: "aws-access-key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
+    { id: "npm-token", regex: /\bnpm_[A-Za-z0-9]{36}\b/ },
+    { id: "gitlab-token", regex: /\bglpat-[A-Za-z0-9_-]{20}\b/ },
+    { id: "slack-token", regex: /\bxox[bap]-[A-Za-z0-9-]{10,}\b/ },
+    {
+        id: "private-key-block",
+        regex: /-----BEGIN (RSA |EC |OPENSSH |PGP )?PRIVATE KEY( BLOCK)?-----/,
+    },
+];
+//# sourceMappingURL=leakPatterns.js.map

package/dist/leakPatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leakPatterns.js","sourceRoot":"","sources":["../src/leakPatterns.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,6DAA6D;AAC7D,6EAA6E;AAC7E,qCAAqC;AAOrC,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,2CAA2C,EAAE;IAC1E,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAC9E,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC9D,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,gCAAgC,EAAE;IAC7D,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACvD,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACrD,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC5D,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,gCAAgC,EAAE;IAC9D;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,+DAA+D;KACvE;CACF,CAAC"}

package/dist/leaks.d.ts

@@ -0,0 +1,8 @@
+import { type LeakPattern } from "./leakPatterns.js";
+export interface LeakFinding {
+    file: string;
+    line: number;
+    patternId: string;
+}
+export declare function scanForLeaks(targets: string[], patterns: LeakPattern[], exemptFiles: Set<string>): LeakFinding[];
+export declare function runLeaks(targets: string[], json: boolean, patternsFile?: string): Promise<number>;

package/dist/leaks.js

@@ -0,0 +1,211 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { LEAK_PATTERNS } from "./leakPatterns.js";
+import { loadPlugin, resolvePluginName } from "./pluginResolve.js";
+import { readTomlTable } from "./tomlTable.js";
+import { tryResolveTool } from "./toolResolve.js";
+// `guardrails leaks [paths]` — the public/private boundary gate (spec layer
+// A″). The package ships only GENERIC credential patterns; house marker lists
+// (a fact about a private topology) load at runtime from, in order:
+//   1. built-ins (leakPatterns.ts)
+//   2. .guardrails/leaks.txt in the target repo
+//   3. the file named by `patterns_file =` under [leaks] in .agentvibes/project.toml
+//   4. the project's guardrails plugin, via its optional leakPatterns() hook
+// Exit 1 on any hit; exit 2 on an unloadable pattern (a gate that silently
+// drops a bad pattern is a coverage hole nobody can see).
+const SKIP_DIRS = new Set([
+    "node_modules",
+    "dist",
+    ".git",
+    "coverage",
+    ".turbo",
+    "build",
+    ".next",
+    ".claude",
+]);
+class PatternLoadError extends Error {
+}
+/**
+ * Pattern-file format: one pattern per line, `#` comments and blanks skipped.
+ * A line is `<id> <regex>` (split on first whitespace); a single-token line is
+ * a bare regex with a generated id.
+ */
+function parsePatternFile(path) {
+    const patterns = [];
+    const lines = readFileSync(path, "utf8").split("\n");
+    lines.forEach((raw, i) => {
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#"))
+            return;
+        const sp = line.search(/\s/);
+        const id = sp > 0 ? line.slice(0, sp) : `pattern-${i + 1}`;
+        const source = sp > 0 ? line.slice(sp).trim() : line;
+        try {
+            patterns.push({ id, regex: new RegExp(source) });
+        }
+        catch (err) {
+            throw new PatternLoadError(`${path}:${i + 1}: invalid regex '${source}' (${err instanceof Error ? err.message : String(err)})`);
+        }
+    });
+    return patterns;
+}
+async function loadPatterns(cwd, extraPatternFiles) {
+    const patterns = [...LEAK_PATTERNS];
+    const sources = [`built-in generic (${LEAK_PATTERNS.length})`];
+    const exemptFiles = new Set();
+    const fileCandidates = [...extraPatternFiles, join(cwd, ".guardrails", "leaks.txt")];
+    const leaksConfig = readTomlTable(join(cwd, ".agentvibes", "project.toml"), "leaks");
+    const configured = leaksConfig.patterns_file;
+    if (configured !== undefined && configured !== "") {
+        fileCandidates.push(isAbsolute(configured) ? configured : join(cwd, configured));
+    }
+    for (const candidate of fileCandidates) {
+        const abs = resolve(candidate);
+        if (!existsSync(abs) || exemptFiles.has(abs))
+            continue;
+        const loaded = parsePatternFile(abs);
+        patterns.push(...loaded);
+        sources.push(`${abs} (${loaded.length})`);
+        exemptFiles.add(abs);
+    }
+    const pluginName = resolvePluginName(cwd);
+    if (pluginName !== undefined) {
+        const plugin = await loadPlugin(cwd, pluginName);
+        if (plugin.leakPatterns !== undefined) {
+            const specs = plugin.leakPatterns();
+            for (const spec of specs) {
+                try {
+                    patterns.push({ id: spec.id, regex: new RegExp(spec.pattern) });
+                }
+                catch (err) {
+                    throw new PatternLoadError(`plugin ${plugin.name} leakPatterns(): invalid regex for '${spec.id}' (${err instanceof Error ? err.message : String(err)})`);
+                }
+            }
+            sources.push(`plugin ${plugin.name} (${specs.length})`);
+        }
+    }
+    return { patterns, sources, exemptFiles };
+}
+function isTextFile(buf) {
+    return !buf.subarray(0, 8192).includes(0);
+}
+// lstat, never following symlinks: a symlinked foreign tree is not this
+// repo's content (fileWalk.ts records the incident that taught this).
+function walk(path, out, exemptFiles) {
+    let st;
+    try {
+        st = lstatSync(path);
+    }
+    catch {
+        return;
+    }
+    if (st.isFile()) {
+        if (!exemptFiles.has(resolve(path)) && !path.endsWith(".tgz"))
+            out.push(path);
+        return;
+    }
+    if (!st.isDirectory())
+        return;
+    for (const entry of readdirSync(path)) {
+        if (SKIP_DIRS.has(entry))
+            continue;
+        walk(join(path, entry), out, exemptFiles);
+    }
+}
+export function scanForLeaks(targets, patterns, exemptFiles) {
+    const files = [];
+    for (const t of targets)
+        walk(t, files, exemptFiles);
+    const findings = [];
+    for (const file of files) {
+        let buf;
+        try {
+            buf = readFileSync(file);
+        }
+        catch {
+            continue;
+        }
+        if (!isTextFile(buf))
+            continue;
+        const lines = buf.toString("utf8").split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (line === undefined)
+                continue;
+            for (const p of patterns) {
+                if (p.regex.test(line))
+                    findings.push({ file, line: i + 1, patternId: p.id });
+            }
+        }
+    }
+    return findings;
+}
+function runGitleaks(target) {
+    const tool = tryResolveTool("gitleaks");
+    if (tool === undefined) {
+        return {
+            ran: false,
+            ok: true,
+            detail: "gitleaks not found (PATH or mise) — pattern scan only. Install: mise use -g gitleaks@latest",
+        };
+    }
+    const [cmd, ...prefix] = tool.argv;
+    if (cmd === undefined)
+        return { ran: false, ok: true, detail: "gitleaks argv empty" };
+    const res = spawnSync(cmd, [...prefix, "detect", "--no-git", "--no-banner", "--redact", "--source", target], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    if (res.error)
+        return { ran: false, ok: true, detail: `gitleaks failed to start: ${res.error.message}` };
+    // ast-grep-ignore: kind-if-without-match -- res.status is spawnSync's numeric exit code (number | null), not a discriminated-union tag
+    if (res.status === 0)
+        return { ran: true, ok: true, detail: `gitleaks ${tool.version}: clean` };
+    return {
+        ran: true,
+        ok: false,
+        detail: `gitleaks ${tool.version}: findings\n${res.stdout.slice(0, 4000)}${res.stderr.slice(0, 2000)}`,
+    };
+}
+export async function runLeaks(targets, json, patternsFile) {
+    const paths = targets.length > 0 ? targets : ["."];
+    // --patterns <file>: an EXTRA pattern file for this run — how a public
+    // repo's CI scans itself against a house list it must not ship (the list is
+    // fetched from a private repo at CI time and never committed here).
+    if (patternsFile !== undefined && !existsSync(patternsFile)) {
+        console.error(`guardrails leaks: --patterns file not found: ${patternsFile}`);
+        return 2;
+    }
+    let loaded;
+    try {
+        loaded = await loadPatterns(process.cwd(), patternsFile === undefined ? [] : [patternsFile]);
+    }
+    catch (err) {
+        console.error(`guardrails leaks: ${err instanceof Error ? err.message : String(err)}`);
+        return 2;
+    }
+    const findings = scanForLeaks(paths, loaded.patterns, loaded.exemptFiles);
+    const gitleaks = runGitleaks(paths[0] ?? ".");
+    const ok = findings.length === 0 && gitleaks.ok;
+    if (json) {
+        console.log(JSON.stringify({
+            command: "leaks",
+            targets: paths,
+            ok,
+            patternSources: loaded.sources,
+            findings,
+            gitleaks,
+        }, null, 2));
+        return ok ? 0 : 1;
+    }
+    console.log(`patterns: ${loaded.sources.join(", ")}`);
+    for (const f of findings) {
+        console.log(`error[leak:${f.patternId}]: ${f.file}:${f.line}`);
+    }
+    console.log(gitleaks.detail);
+    if (ok) {
+        console.log(`guardrails leaks: OK — no leak-pattern hits in ${paths.join(" ")}`);
+        return 0;
+    }
+    console.log(`guardrails leaks: ${findings.length} finding(s)${gitleaks.ok ? "" : " + gitleaks findings"}. Public code holds mechanisms; private facts (hostnames, paths, org names, tokens) belong in the private ops package / project config.`);
+    return 1;
+}
+//# sourceMappingURL=leaks.js.map

package/dist/leaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaks.js","sourceRoot":"","sources":["../src/leaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAoB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,4EAA4E;AAC5E,8EAA8E;AAC9E,oEAAoE;AACpE,mCAAmC;AACnC,gDAAgD;AAChD,qFAAqF;AACrF,6EAA6E;AAC7E,2EAA2E;AAC3E,0DAA0D;AAE1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAgBH,MAAM,gBAAiB,SAAQ,KAAK;CAAG;AAEvC;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,MAAM,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CACpG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,iBAA2B;IAClE,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,qBAAqB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAClD,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1C,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CACxB,UAAU,MAAM,CAAC,IAAI,uCAAuC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAC7H,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,wEAAwE;AACxE,sEAAsE;AACtE,SAAS,IAAI,CAAC,IAAY,EAAE,GAAa,EAAE,WAAwB;IACjE,IAAI,EAAgC,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO;IAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAiB,EACjB,QAAuB,EACvB,WAAwB;IAExB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,EAAE,KAAK;YACV,EAAE,EAAE,IAAI;YACR,MAAM,EACJ,6FAA6F;SAChG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,SAAS,CACnB,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAChF,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAClD,CAAC;IACF,IAAI,GAAG,CAAC,KAAK;QACX,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5F,uIAAuI;IACvI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,OAAO,SAAS,EAAE,CAAC;IAChG,OAAO;QACL,GAAG,EAAE,IAAI;QACT,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,YAAY,IAAI,CAAC,OAAO,eAAe,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE;KACvG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAiB,EACjB,IAAa,EACb,YAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEnD,uEAAuE;IACvE,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC;IAEhD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,EAAE;YACF,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,QAAQ;YACR,QAAQ;SACT,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kDAAkD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CACT,qBAAqB,QAAQ,CAAC,MAAM,cAAc,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,yIAAyI,CACrO,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/leaksRed.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/leaksRed.js

@@ -0,0 +1,62 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { packageRoot } from "./packagePaths.js";
+// Gate-can-go-red tests for `guardrails leaks`:
+//   1. a fixture with a credential-shaped string (built-in generic pattern)
+//      turns the gate red, a clean dir does not;
+//   2. the runtime pattern-loading mechanism works — a `.guardrails/leaks.txt`
+//      pattern fires on matching content, and the pattern file itself is
+//      exempt from the scan (it necessarily contains its own markers).
+// The token is ASSEMBLED from halves so this test's own source never
+// contains a credential-shaped string.
+const TOKENISH = ["ghp_", "a".repeat(36)].join("");
+function leaks(cwd, target) {
+    const res = spawnSync("node", [join(packageRoot, "dist", "cli.js"), "leaks", target], {
+        cwd,
+        encoding: "utf8",
+    });
+    if (res.error)
+        throw res.error;
+    return res.status ?? -1;
+}
+function expectExit(step, got, want) {
+    if (got !== want) {
+        console.error(`FAIL leaks-red: ${step} exited ${got}, expected ${want}`);
+        return false;
+    }
+    console.log(`  ok  leaks-red: ${step} → exit ${want}`);
+    return true;
+}
+function main() {
+    const dir = mkdtempSync(join(tmpdir(), "guardrails-leaks-red-"));
+    try {
+        const badFile = join(dir, "config.ts");
+        writeFileSync(badFile, `const t = "${TOKENISH}";\n`);
+        if (!expectExit("token-shaped fixture (gate goes red)", leaks(dir, "."), 1))
+            return 1;
+        rmSync(badFile);
+        writeFileSync(join(dir, "clean.ts"), 'export const apiBase = "https://example.invalid";\n');
+        if (!expectExit("clean dir (gate goes green)", leaks(dir, "."), 0))
+            return 1;
+        // Runtime pattern loading: a repo-local pattern file arms a marker the
+        // public package does not know.
+        mkdirSync(join(dir, ".guardrails"));
+        writeFileSync(join(dir, ".guardrails", "leaks.txt"), "custom-marker examplecorp-internal\n");
+        writeFileSync(join(dir, "infra.ts"), 'const host = "examplecorp-internal.example";\n');
+        if (!expectExit("repo-local pattern fires (leaks.txt mechanism)", leaks(dir, "."), 1))
+            return 1;
+        // The pattern file itself must be exempt — it contains its own marker.
+        rmSync(join(dir, "infra.ts"));
+        if (!expectExit("pattern file self-exempt (green with only leaks.txt)", leaks(dir, "."), 0)) {
+            return 1;
+        }
+        return 0;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+process.exit(main());
+//# sourceMappingURL=leaksRed.js.map

package/dist/leaksRed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaksRed.js","sourceRoot":"","sources":["../src/leaksRed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,gDAAgD;AAChD,4EAA4E;AAC5E,iDAAiD;AACjD,+EAA+E;AAC/E,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,uCAAuC;AAEvC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnD,SAAS,KAAK,CAAC,GAAW,EAAE,MAAc;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE;QACpF,GAAG;QACH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAC/B,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IACzD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,WAAW,GAAG,cAAc,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,WAAW,IAAI,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI;IACX,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACvC,aAAa,CAAC,OAAO,EAAE,cAAc,QAAQ,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,sCAAsC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAEtF,MAAM,CAAC,OAAO,CAAC,CAAC;QAChB,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,qDAAqD,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAE7E,uEAAuE;QACvE,gCAAgC;QAChC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAC7F,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,gDAAgD,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,gDAAgD,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAEhG,uEAAuE;QACvE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,sDAAsD,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5F,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC"}

package/dist/metrics.d.ts

@@ -0,0 +1,10 @@
+export interface MetricsOptions {
+    targets: string[];
+    json: boolean;
+    check: boolean;
+    updateBaseline: boolean;
+    force: boolean;
+    snapshot: boolean;
+    baselinePath: string | undefined;
+}
+export declare function runMetrics(opts: MetricsOptions): number;