@ankurhalder/codebase-snapshot 4.0.1 → 4.0.3

package/dist/bin.js

@@ -1334,12 +1334,8 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
-var activeSecretRules = null;
-function setActiveSecretRules(rules) {
-  activeSecretRules = rules === null ? null : [...rules];
-}
 function pathScanRules(extraRules) {
-  const fallback = extraRules ?? activeSecretRules ?? [];
+  const fallback = extraRules ?? [];
   return [...DEFAULT_SECRET_PATTERNS, ...fallback];
 }
 function findSecretInPath(relativePath, extraRules) {
@@ -1379,7 +1375,12 @@ function findSecretInPath(relativePath, extraRules) {
 function maskSkipPaths(records, extraRules) {
   return records.map((record) => {
     const hit = findSecretInPath(record.path, extraRules);
-    return hit ? { ...record, path: hit.masked } : record;
+    const detail = record.detail ? findSecretInPath(record.detail, extraRules) : null;
+    return {
+      ...record,
+      path: hit ? hit.masked : record.path,
+      ...detail ? { detail: detail.masked } : {}
+    };
   });
 }
 function globToRegExp(glob) {
@@ -2520,7 +2521,6 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     ...aliasedRules ?? []
   ]);
   const secretRules = disableDefaultPatterns ? compiledCustomRules : [...compileSecretRules(DEFAULT_SECRET_PATTERNS), ...compiledCustomRules];
-  setActiveSecretRules(secretRules);
   const cliMonolith = cliOptions?.includeMonolith;
   const includeMonolith = cliMonolith ?? strictBoolean(userConfig?.includeMonolith, false, "`includeMonolith`");
   const artifacts = resolveArtifacts(
@@ -5228,6 +5228,9 @@ function validateSnapshot(configInput) {
       });
     }
   }
+  const maskValue = (value) => findSecretInPath(value, config.secretRules)?.masked ?? value;
+  const currentExcludes = config.excludePatterns.map(maskValue);
+  const currentInclude = config.include.map(maskValue);
   const recorded = manifest.config;
   if (recorded && typeof recorded === "object") {
     if (recorded.maxPartBytes !== config.maxPartBytes) {
@@ -5256,15 +5259,15 @@ function validateSnapshot(configInput) {
       );
     }
     const recordedExcludes = Array.isArray(recorded.excludePatterns) ? recorded.excludePatterns : [];
-    if (recordedExcludes.join("\0") !== config.excludePatterns.join("\0")) {
+    if (recordedExcludes.join("\0") !== currentExcludes.join("\0")) {
       drift.configMismatches.push(
-        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${config.excludePatterns.join(", ")}]`
+        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${currentExcludes.join(", ")}]`
       );
     }
     const recordedInclude = Array.isArray(recorded.include) ? recorded.include : [];
-    if (recordedInclude.join("\0") !== config.include.join("\0")) {
+    if (recordedInclude.join("\0") !== currentInclude.join("\0")) {
       drift.configMismatches.push(
-        `include: manifest [${recordedInclude.join(", ")}] vs current [${config.include.join(", ")}]`
+        `include: manifest [${recordedInclude.join(", ")}] vs current [${currentInclude.join(", ")}]`
       );
     }
     if (recorded?.artifacts && typeof recorded.artifacts === "object") {
@@ -5444,7 +5447,7 @@ function validateSnapshot(configInput) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.1";
+var GENERATOR_VERSION = "4.0.3";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto3.createHash("sha256").update(input).digest("hex");
@@ -6285,6 +6288,7 @@ function generateSnapshot(configInput, options) {
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
   const validationErrors = verifyInMemory(files, parts, maxEffectiveBudget);
   const totalContentBytes = files.reduce((total, file) => total + file.includedBytes, 0);
+  const maskName = (value) => maskPathText(value, config.secretRules);
   const manifest = {
     schemaVersion: SCHEMA_VERSION,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6305,13 +6309,13 @@ function generateSnapshot(configInput, options) {
       includeMonolith: config.includeMonolith,
       includeSensitiveFiles: config.includeSensitiveFiles,
       artifacts: { ...config.artifacts },
-      include: [...config.include],
+      include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
       budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
-      excludePatterns: [...config.excludePatterns],
-      layers: config.layers.map((layer2) => layer2.name),
-      kinds: config.kinds.map((kind) => kind.kind)
+      excludePatterns: [...config.excludePatterns].map(maskName),
+      layers: config.layers.map((layer2) => maskName(layer2.name)),
+      kinds: config.kinds.map((kind) => maskName(kind.kind))
     },
     counts: {
       totalFiles: files.length,
@@ -6967,8 +6971,8 @@ function buildAgentContract() {
         "snapshot.config.mjs",
         "snapshot.config.cjs",
         "snapshot.config.json",
-        ".snapshotrc",
         ".snapshotrc.json",
+        ".snapshotrc",
         'package.json \u2192 "snapshot" key'
       ],
       settings: [
@@ -7909,6 +7913,8 @@ async function runWatchLoop(invocation, resolved) {
     (segment) => segment === outName || segment === tmpName || segment.startsWith(`${outName}.backup-`) || VCS_SEGMENTS.has(segment)
   );
   let running = false;
+  let quietUntil = 0;
+  const QUIET_MS = 1500;
   const regenerate = async () => {
     if (running) return;
     running = true;
@@ -7946,6 +7952,7 @@ async function runWatchLoop(invocation, resolved) {
     } catch (err) {
       warn(`\u274C ${err.message}`);
     } finally {
+      quietUntil = performance.now() + QUIET_MS;
       running = false;
     }
   };
@@ -7953,6 +7960,7 @@ async function runWatchLoop(invocation, resolved) {
   void regenerate();
   let timer = null;
   const watcher = fs11.watch(resolved.cwd, { recursive: true }, (_event, filename) => {
+    if (performance.now() < quietUntil) return;
     if (filename) {
       const changed = path12.resolve(resolved.cwd, filename.toString());
       if (isGenerated(changed)) return;

package/dist/{chunk-RGIMMEAW.js → chunk-L7QBLC4C.js}

@@ -2188,12 +2188,8 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
-var activeSecretRules = null;
-function setActiveSecretRules(rules) {
-  activeSecretRules = rules === null ? null : [...rules];
-}
 function pathScanRules(extraRules) {
-  const fallback = extraRules ?? activeSecretRules ?? [];
+  const fallback = extraRules ?? [];
   return [...DEFAULT_SECRET_PATTERNS, ...fallback];
 }
 function findSecretInPath(relativePath, extraRules) {
@@ -2233,7 +2229,12 @@ function findSecretInPath(relativePath, extraRules) {
 function maskSkipPaths(records, extraRules) {
   return records.map((record) => {
     const hit = findSecretInPath(record.path, extraRules);
-    return hit ? { ...record, path: hit.masked } : record;
+    const detail = record.detail ? findSecretInPath(record.detail, extraRules) : null;
+    return {
+      ...record,
+      path: hit ? hit.masked : record.path,
+      ...detail ? { detail: detail.masked } : {}
+    };
   });
 }
 function globToRegExp(glob) {
@@ -2923,6 +2924,9 @@ async function loadConfigFileDetailed(cwd) {
 }
 async function loadConfigFile(cwd) {
   const loaded = await loadConfigFileDetailed(cwd);
+  if (loaded.errors.length > 0) {
+    throw new Error(`The config file could not be read: ${loaded.errors.join("; ")}`);
+  }
   return loaded.config;
 }
 var MIN_MAX_PART_BYTES = 4096;
@@ -3244,7 +3248,6 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     ...aliasedRules ?? []
   ]);
   const secretRules = disableDefaultPatterns ? compiledCustomRules : [...compileSecretRules(DEFAULT_SECRET_PATTERNS), ...compiledCustomRules];
-  setActiveSecretRules(secretRules);
   const cliMonolith = cliOptions?.includeMonolith;
   const includeMonolith = cliMonolith ?? strictBoolean(userConfig?.includeMonolith, false, "`includeMonolith`");
   const artifacts = resolveArtifacts(
@@ -4273,6 +4276,9 @@ function validateSnapshot(configInput) {
       });
     }
   }
+  const maskValue = (value) => findSecretInPath(value, config.secretRules)?.masked ?? value;
+  const currentExcludes = config.excludePatterns.map(maskValue);
+  const currentInclude = config.include.map(maskValue);
   const recorded = manifest.config;
   if (recorded && typeof recorded === "object") {
     if (recorded.maxPartBytes !== config.maxPartBytes) {
@@ -4301,15 +4307,15 @@ function validateSnapshot(configInput) {
       );
     }
     const recordedExcludes = Array.isArray(recorded.excludePatterns) ? recorded.excludePatterns : [];
-    if (recordedExcludes.join("\0") !== config.excludePatterns.join("\0")) {
+    if (recordedExcludes.join("\0") !== currentExcludes.join("\0")) {
       drift.configMismatches.push(
-        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${config.excludePatterns.join(", ")}]`
+        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${currentExcludes.join(", ")}]`
       );
     }
     const recordedInclude = Array.isArray(recorded.include) ? recorded.include : [];
-    if (recordedInclude.join("\0") !== config.include.join("\0")) {
+    if (recordedInclude.join("\0") !== currentInclude.join("\0")) {
       drift.configMismatches.push(
-        `include: manifest [${recordedInclude.join(", ")}] vs current [${config.include.join(", ")}]`
+        `include: manifest [${recordedInclude.join(", ")}] vs current [${currentInclude.join(", ")}]`
       );
     }
     if (recorded?.artifacts && typeof recorded.artifacts === "object") {
@@ -5404,7 +5410,7 @@ async function runInit(options) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.1";
+var GENERATOR_VERSION = "4.0.3";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto.createHash("sha256").update(input).digest("hex");
@@ -6245,6 +6251,7 @@ function generateSnapshot(configInput, options) {
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
   const validationErrors = verifyInMemory(files, parts, maxEffectiveBudget);
   const totalContentBytes = files.reduce((total, file) => total + file.includedBytes, 0);
+  const maskName = (value) => maskPathText(value, config.secretRules);
   const manifest = {
     schemaVersion: SCHEMA_VERSION,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6265,13 +6272,13 @@ function generateSnapshot(configInput, options) {
       includeMonolith: config.includeMonolith,
       includeSensitiveFiles: config.includeSensitiveFiles,
       artifacts: { ...config.artifacts },
-      include: [...config.include],
+      include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
       budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
-      excludePatterns: [...config.excludePatterns],
-      layers: config.layers.map((layer2) => layer2.name),
-      kinds: config.kinds.map((kind) => kind.kind)
+      excludePatterns: [...config.excludePatterns].map(maskName),
+      layers: config.layers.map((layer2) => maskName(layer2.name)),
+      kinds: config.kinds.map((kind) => maskName(kind.kind))
     },
     counts: {
       totalFiles: files.length,
@@ -6451,5 +6458,5 @@ async function generateSnapshotAsync(configInput, options) {
 }
 
 export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, validateSnapshot };
-//# sourceMappingURL=chunk-RGIMMEAW.js.map
-//# sourceMappingURL=chunk-RGIMMEAW.js.map
+//# sourceMappingURL=chunk-L7QBLC4C.js.map
+//# sourceMappingURL=chunk-L7QBLC4C.js.map

package/dist/cli.cjs

@@ -1356,12 +1356,8 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
-var activeSecretRules = null;
-function setActiveSecretRules(rules) {
-  activeSecretRules = rules === null ? null : [...rules];
-}
 function pathScanRules(extraRules) {
-  const fallback = extraRules ?? activeSecretRules ?? [];
+  const fallback = extraRules ?? [];
   return [...DEFAULT_SECRET_PATTERNS, ...fallback];
 }
 function findSecretInPath(relativePath, extraRules) {
@@ -1401,7 +1397,12 @@ function findSecretInPath(relativePath, extraRules) {
 function maskSkipPaths(records, extraRules) {
   return records.map((record) => {
     const hit = findSecretInPath(record.path, extraRules);
-    return hit ? { ...record, path: hit.masked } : record;
+    const detail = record.detail ? findSecretInPath(record.detail, extraRules) : null;
+    return {
+      ...record,
+      path: hit ? hit.masked : record.path,
+      ...detail ? { detail: detail.masked } : {}
+    };
   });
 }
 function globToRegExp(glob) {
@@ -2533,7 +2534,6 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     ...aliasedRules ?? []
   ]);
   const secretRules = disableDefaultPatterns ? compiledCustomRules : [...compileSecretRules(DEFAULT_SECRET_PATTERNS), ...compiledCustomRules];
-  setActiveSecretRules(secretRules);
   const cliMonolith = cliOptions?.includeMonolith;
   const includeMonolith = cliMonolith ?? strictBoolean(userConfig?.includeMonolith, false, "`includeMonolith`");
   const artifacts = resolveArtifacts(
@@ -5208,6 +5208,9 @@ function validateSnapshot(configInput) {
       });
     }
   }
+  const maskValue = (value) => findSecretInPath(value, config.secretRules)?.masked ?? value;
+  const currentExcludes = config.excludePatterns.map(maskValue);
+  const currentInclude = config.include.map(maskValue);
   const recorded = manifest.config;
   if (recorded && typeof recorded === "object") {
     if (recorded.maxPartBytes !== config.maxPartBytes) {
@@ -5236,15 +5239,15 @@ function validateSnapshot(configInput) {
       );
     }
     const recordedExcludes = Array.isArray(recorded.excludePatterns) ? recorded.excludePatterns : [];
-    if (recordedExcludes.join("\0") !== config.excludePatterns.join("\0")) {
+    if (recordedExcludes.join("\0") !== currentExcludes.join("\0")) {
       drift.configMismatches.push(
-        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${config.excludePatterns.join(", ")}]`
+        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${currentExcludes.join(", ")}]`
       );
     }
     const recordedInclude = Array.isArray(recorded.include) ? recorded.include : [];
-    if (recordedInclude.join("\0") !== config.include.join("\0")) {
+    if (recordedInclude.join("\0") !== currentInclude.join("\0")) {
       drift.configMismatches.push(
-        `include: manifest [${recordedInclude.join(", ")}] vs current [${config.include.join(", ")}]`
+        `include: manifest [${recordedInclude.join(", ")}] vs current [${currentInclude.join(", ")}]`
       );
     }
     if (recorded?.artifacts && typeof recorded.artifacts === "object") {
@@ -5424,7 +5427,7 @@ function validateSnapshot(configInput) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.1";
+var GENERATOR_VERSION = "4.0.3";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto__namespace.createHash("sha256").update(input).digest("hex");
@@ -6265,6 +6268,7 @@ function generateSnapshot(configInput, options) {
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
   const validationErrors = verifyInMemory(files, parts, maxEffectiveBudget);
   const totalContentBytes = files.reduce((total, file) => total + file.includedBytes, 0);
+  const maskName = (value) => maskPathText(value, config.secretRules);
   const manifest = {
     schemaVersion: SCHEMA_VERSION,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6285,13 +6289,13 @@ function generateSnapshot(configInput, options) {
       includeMonolith: config.includeMonolith,
       includeSensitiveFiles: config.includeSensitiveFiles,
       artifacts: { ...config.artifacts },
-      include: [...config.include],
+      include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
       budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
-      excludePatterns: [...config.excludePatterns],
-      layers: config.layers.map((layer2) => layer2.name),
-      kinds: config.kinds.map((kind) => kind.kind)
+      excludePatterns: [...config.excludePatterns].map(maskName),
+      layers: config.layers.map((layer2) => maskName(layer2.name)),
+      kinds: config.kinds.map((kind) => maskName(kind.kind))
     },
     counts: {
       totalFiles: files.length,
@@ -6947,8 +6951,8 @@ function buildAgentContract() {
         "snapshot.config.mjs",
         "snapshot.config.cjs",
         "snapshot.config.json",
-        ".snapshotrc",
         ".snapshotrc.json",
+        ".snapshotrc",
         'package.json \u2192 "snapshot" key'
       ],
       settings: [
@@ -7897,6 +7901,8 @@ async function runWatchLoop(invocation, resolved) {
     (segment) => segment === outName || segment === tmpName || segment.startsWith(`${outName}.backup-`) || VCS_SEGMENTS.has(segment)
   );
   let running = false;
+  let quietUntil = 0;
+  const QUIET_MS = 1500;
   const regenerate = async () => {
     if (running) return;
     running = true;
@@ -7934,6 +7940,7 @@ async function runWatchLoop(invocation, resolved) {
     } catch (err) {
       warn(`\u274C ${err.message}`);
     } finally {
+      quietUntil = performance.now() + QUIET_MS;
       running = false;
     }
   };
@@ -7941,6 +7948,7 @@ async function runWatchLoop(invocation, resolved) {
   void regenerate();
   let timer = null;
   const watcher = fs9__namespace.watch(resolved.cwd, { recursive: true }, (_event, filename) => {
+    if (performance.now() < quietUntil) return;
     if (filename) {
       const changed = path10__namespace.resolve(resolved.cwd, filename.toString());
       if (isGenerated(changed)) return;

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { parseByteSize, GENERATOR_VERSION, ARTIFACT_NAMES, getPreset, unknownPresetMessage, MIN_MAX_PART_BYTES, loadConfigFileDetailed, resolveConfig, validateSnapshot, explainPath, compareManifests, loadManifest, renderDiffText, generateSnapshot, GENERATOR_NAME, runInit, PromptCancelled, SCHEMA_VERSION, PRESETS, renderExplainText } from './chunk-RGIMMEAW.js';
+import { parseByteSize, GENERATOR_VERSION, ARTIFACT_NAMES, getPreset, unknownPresetMessage, MIN_MAX_PART_BYTES, loadConfigFileDetailed, resolveConfig, validateSnapshot, explainPath, compareManifests, loadManifest, renderDiffText, generateSnapshot, GENERATOR_NAME, runInit, PromptCancelled, SCHEMA_VERSION, PRESETS, renderExplainText } from './chunk-L7QBLC4C.js';
 import * as fs from 'fs';
 import * as path2 from 'path';
 import { parseArgs } from 'util';
@@ -483,8 +483,8 @@ function buildAgentContract() {
         "snapshot.config.mjs",
         "snapshot.config.cjs",
         "snapshot.config.json",
-        ".snapshotrc",
         ".snapshotrc.json",
+        ".snapshotrc",
         'package.json \u2192 "snapshot" key'
       ],
       settings: [
@@ -1433,6 +1433,8 @@ async function runWatchLoop(invocation, resolved) {
     (segment) => segment === outName || segment === tmpName || segment.startsWith(`${outName}.backup-`) || VCS_SEGMENTS.has(segment)
   );
   let running = false;
+  let quietUntil = 0;
+  const QUIET_MS = 1500;
   const regenerate = async () => {
     if (running) return;
     running = true;
@@ -1470,6 +1472,7 @@ async function runWatchLoop(invocation, resolved) {
     } catch (err) {
       warn(`\u274C ${err.message}`);
     } finally {
+      quietUntil = performance.now() + QUIET_MS;
       running = false;
     }
   };
@@ -1477,6 +1480,7 @@ async function runWatchLoop(invocation, resolved) {
   void regenerate();
   let timer = null;
   const watcher = fs.watch(resolved.cwd, { recursive: true }, (_event, filename) => {
+    if (performance.now() < quietUntil) return;
     if (filename) {
       const changed = path2.resolve(resolved.cwd, filename.toString());
       if (isGenerated(changed)) return;

package/dist/index.cjs

@@ -2218,12 +2218,8 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
-var activeSecretRules = null;
-function setActiveSecretRules(rules) {
-  activeSecretRules = rules === null ? null : [...rules];
-}
 function pathScanRules(extraRules) {
-  const fallback = extraRules ?? activeSecretRules ?? [];
+  const fallback = extraRules ?? [];
   return [...DEFAULT_SECRET_PATTERNS, ...fallback];
 }
 function findSecretInPath(relativePath, extraRules) {
@@ -2263,7 +2259,12 @@ function findSecretInPath(relativePath, extraRules) {
 function maskSkipPaths(records, extraRules) {
   return records.map((record) => {
     const hit = findSecretInPath(record.path, extraRules);
-    return hit ? { ...record, path: hit.masked } : record;
+    const detail = record.detail ? findSecretInPath(record.detail, extraRules) : null;
+    return {
+      ...record,
+      path: hit ? hit.masked : record.path,
+      ...detail ? { detail: detail.masked } : {}
+    };
   });
 }
 function globToRegExp(glob) {
@@ -2953,6 +2954,9 @@ async function loadConfigFileDetailed(cwd) {
 }
 async function loadConfigFile(cwd) {
   const loaded = await loadConfigFileDetailed(cwd);
+  if (loaded.errors.length > 0) {
+    throw new Error(`The config file could not be read: ${loaded.errors.join("; ")}`);
+  }
   return loaded.config;
 }
 var MIN_MAX_PART_BYTES = 4096;
@@ -3274,7 +3278,6 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     ...aliasedRules ?? []
   ]);
   const secretRules = disableDefaultPatterns ? compiledCustomRules : [...compileSecretRules(DEFAULT_SECRET_PATTERNS), ...compiledCustomRules];
-  setActiveSecretRules(secretRules);
   const cliMonolith = cliOptions?.includeMonolith;
   const includeMonolith = cliMonolith ?? strictBoolean(userConfig?.includeMonolith, false, "`includeMonolith`");
   const artifacts = resolveArtifacts(
@@ -4303,6 +4306,9 @@ function validateSnapshot(configInput) {
       });
     }
   }
+  const maskValue = (value) => findSecretInPath(value, config.secretRules)?.masked ?? value;
+  const currentExcludes = config.excludePatterns.map(maskValue);
+  const currentInclude = config.include.map(maskValue);
   const recorded = manifest.config;
   if (recorded && typeof recorded === "object") {
     if (recorded.maxPartBytes !== config.maxPartBytes) {
@@ -4331,15 +4337,15 @@ function validateSnapshot(configInput) {
       );
     }
     const recordedExcludes = Array.isArray(recorded.excludePatterns) ? recorded.excludePatterns : [];
-    if (recordedExcludes.join("\0") !== config.excludePatterns.join("\0")) {
+    if (recordedExcludes.join("\0") !== currentExcludes.join("\0")) {
       drift.configMismatches.push(
-        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${config.excludePatterns.join(", ")}]`
+        `excludePatterns: manifest [${recordedExcludes.join(", ")}] vs current [${currentExcludes.join(", ")}]`
       );
     }
     const recordedInclude = Array.isArray(recorded.include) ? recorded.include : [];
-    if (recordedInclude.join("\0") !== config.include.join("\0")) {
+    if (recordedInclude.join("\0") !== currentInclude.join("\0")) {
       drift.configMismatches.push(
-        `include: manifest [${recordedInclude.join(", ")}] vs current [${config.include.join(", ")}]`
+        `include: manifest [${recordedInclude.join(", ")}] vs current [${currentInclude.join(", ")}]`
       );
     }
     if (recorded?.artifacts && typeof recorded.artifacts === "object") {
@@ -5434,7 +5440,7 @@ async function runInit(options) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.1";
+var GENERATOR_VERSION = "4.0.3";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto__namespace.createHash("sha256").update(input).digest("hex");
@@ -6275,6 +6281,7 @@ function generateSnapshot(configInput, options) {
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
   const validationErrors = verifyInMemory(files, parts, maxEffectiveBudget);
   const totalContentBytes = files.reduce((total, file) => total + file.includedBytes, 0);
+  const maskName = (value) => maskPathText(value, config.secretRules);
   const manifest = {
     schemaVersion: SCHEMA_VERSION,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6295,13 +6302,13 @@ function generateSnapshot(configInput, options) {
       includeMonolith: config.includeMonolith,
       includeSensitiveFiles: config.includeSensitiveFiles,
       artifacts: { ...config.artifacts },
-      include: [...config.include],
+      include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
       budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
-      excludePatterns: [...config.excludePatterns],
-      layers: config.layers.map((layer2) => layer2.name),
-      kinds: config.kinds.map((kind) => kind.kind)
+      excludePatterns: [...config.excludePatterns].map(maskName),
+      layers: config.layers.map((layer2) => maskName(layer2.name)),
+      kinds: config.kinds.map((kind) => maskName(kind.kind))
     },
     counts: {
       totalFiles: files.length,

package/dist/index.d.cts

@@ -495,7 +495,7 @@ declare function matchesExclude(relativePath: string, pattern: string): boolean;
 declare function collectFiles(cwd: string, options?: CollectOptions): CollectResult;
 
 declare const GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-declare const GENERATOR_VERSION = "4.0.1";
+declare const GENERATOR_VERSION = "4.0.3";
 declare const SCHEMA_VERSION = "3.0.0";
 interface GenerateOptions {
     /** Compute the full manifest but write nothing to disk. */

package/dist/index.d.ts

@@ -495,7 +495,7 @@ declare function matchesExclude(relativePath: string, pattern: string): boolean;
 declare function collectFiles(cwd: string, options?: CollectOptions): CollectResult;
 
 declare const GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-declare const GENERATOR_VERSION = "4.0.1";
+declare const GENERATOR_VERSION = "4.0.3";
 declare const SCHEMA_VERSION = "3.0.0";
 interface GenerateOptions {
     /** Compute the full manifest but write nothing to disk. */

package/dist/index.js

@@ -1,3 +1,3 @@
-export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, validateSnapshot } from './chunk-RGIMMEAW.js';
+export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, validateSnapshot } from './chunk-L7QBLC4C.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankurhalder/codebase-snapshot",
-  "version": "4.0.1",
+  "version": "4.0.3",
   "description": "Production-grade LLM codebase snapshot generator, auditor, and AST partitioner",
   "keywords": [
     "codebase",