@ankurhalder/codebase-snapshot 4.0.5 → 4.0.7

package/dist/bin.js

@@ -874,7 +874,7 @@ var DEFAULT_SECRET_PATTERNS = [
   },
   {
     rule: "aws-access-key-id",
-    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}/
+    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA|ABIA)[0-9A-Z]{16}/
   },
   {
     // The name is no longer limited to the three snake_case spellings: an
@@ -913,7 +913,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // and batch tokens), `whsec_` (Stripe webhook secret), `dckr_pat_` (Docker
     // Hub), `hf_` (HuggingFace), `ya29.` (Google OAuth access token).
     rule: "known-vendor-token-prefix",
-    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128})/
+    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|glrt-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|hvb\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128}|sk_test_[A-Za-z0-9]{16,64}|1\/\/0[A-Za-z0-9_-]{20,64})/
   },
   {
     rule: "slack-webhook-url",
@@ -1945,6 +1945,7 @@ import * as fs4 from "fs";
 import { createHash } from "crypto";
 import * as path4 from "path";
 import { pathToFileURL } from "url";
+var CONFIG_DIR_SYMBOL = /* @__PURE__ */ Symbol.for("codebase-snapshot.configDir");
 var CONFIG_FILENAMES = [
   "snapshot.config.ts",
   "snapshot.config.js",
@@ -2483,7 +2484,8 @@ function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
   return resolved;
 }
 function resolveConfig(userConfig, cliOptions, baseDir) {
-  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir);
+  const configDir = userConfig?.[CONFIG_DIR_SYMBOL];
+  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir ?? configDir);
   const forcedPreset = resolvePresetName(userConfig?.preset);
   if (forcedPreset !== void 0 && !getPreset(forcedPreset)) {
     throw new Error(unknownPresetMessage(forcedPreset));
@@ -2583,7 +2585,11 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     hooks: resolveHooks(userConfig?.hooks),
     layers,
     kinds,
-    excludePatterns: resolveExcludePatterns(userConfig?.excludePatterns),
+    // `exclude` is the flag spelling of the same setting; writing it in a config used to
+    // be ignored without a word.
+    excludePatterns: resolveExcludePatterns(
+      userConfig?.excludePatterns ?? userConfig?.exclude
+    ),
     secretRules
   });
 }
@@ -2730,21 +2736,28 @@ function isBinaryExtension(filePath) {
   return BINARY_EXTENSIONS.has(ext);
 }
 function isBinaryBuffer(buffer) {
-  const checkLength = Math.min(buffer.length, 8192);
-  for (let index = 0; index < checkLength; index++) {
+  for (let index = 0; index < buffer.length; index++) {
     if (buffer[index] === 0) return true;
   }
   return false;
 }
+var BINARY_SCAN_BYTES = 8 * 1024 * 1024;
+var CHUNK = 64 * 1024;
 function isBinaryFile(absolutePath) {
   if (isBinaryExtension(absolutePath)) return true;
   let fd;
   try {
     fd = fs5.openSync(absolutePath, "r");
-    const buffer = Buffer.alloc(8192);
-    const bytesRead = fs5.readSync(fd, buffer, 0, 8192, 0);
-    if (bytesRead === 0) return false;
-    return isBinaryBuffer(buffer.subarray(0, bytesRead));
+    const buffer = Buffer.alloc(CHUNK);
+    let position = 0;
+    while (position < BINARY_SCAN_BYTES) {
+      const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
+      const bytesRead = fs5.readSync(fd, buffer, 0, wanted, position);
+      if (bytesRead === 0) return false;
+      if (isBinaryBuffer(buffer.subarray(0, bytesRead))) return true;
+      position += bytesRead;
+    }
+    return false;
   } catch {
     return false;
   } finally {
@@ -3421,11 +3434,11 @@ function addScripts(cwd, notes) {
   const scripts = parsed.scripts && typeof parsed.scripts === "object" ? parsed.scripts : {};
   const added = [];
   if (!scripts.snapshot) {
-    scripts.snapshot = "codebase-snapshot generate";
+    scripts.snapshot = "npx @ankurhalder/codebase-snapshot generate";
     added.push("snapshot");
   }
   if (!scripts["snapshot:validate"]) {
-    scripts["snapshot:validate"] = "codebase-snapshot validate";
+    scripts["snapshot:validate"] = "npx @ankurhalder/codebase-snapshot validate";
     added.push("snapshot:validate");
   }
   if (added.length === 0) return [];
@@ -5498,7 +5511,7 @@ function validateSnapshot(configInput) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.5";
+var GENERATOR_VERSION = "4.0.7";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto3.createHash("sha256").update(input).digest("hex");
@@ -6265,8 +6278,8 @@ function generateSnapshot(configInput, options) {
     const lineCount = countLines(rawContent);
     totalLines += lineCount;
     totalSizeBytes += stats.size;
-    const layer2 = classifyLayer(relativePath, config.layers);
-    const kind = classifyKind(relativePath, config.kinds);
+    const layer2 = maskPathText(classifyLayer(relativePath, config.layers), config.secretRules);
+    const kind = maskPathText(classifyKind(relativePath, config.kinds), config.secretRules);
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
@@ -6359,7 +6372,9 @@ function generateSnapshot(configInput, options) {
       name: GENERATOR_NAME,
       version: GENERATOR_VERSION
     },
-    git: gitInfo,
+    // A branch name is user input and can carry a token: it reaches the manifest,
+    // the README and the audit report.
+    git: { ...gitInfo, branch: maskPathText(gitInfo.branch, config.secretRules) },
     budgets: {
       maxPartBytes: config.maxPartBytes,
       largeFileBytes: config.largeFileBytes
@@ -6376,7 +6391,12 @@ function generateSnapshot(configInput, options) {
       include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
-      budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
+      budgets: {
+        default: config.budgets.default,
+        byLayer: Object.fromEntries(
+          Object.entries(config.budgets.byLayer).map(([name, bytes]) => [maskName(name), bytes])
+        )
+      },
       excludePatterns: [...config.excludePatterns].map(maskName),
       layers: config.layers.map((layer2) => maskName(layer2.name)),
       kinds: config.kinds.map((kind) => maskName(kind.kind))
@@ -7514,6 +7534,19 @@ function parseCliArgs(argv) {
     }
     command = resolved;
   }
+  if (explicitMode !== void 0) {
+    const resolvedMode = COMMAND_ALIASES.get(explicitMode);
+    if (!resolvedMode) {
+      throw new UsageError(
+        `Unknown --mode "${explicitMode}". Expected one of: ${Array.from(COMMAND_ALIASES.keys()).join(", ")}.`
+      );
+    }
+    if (firstPositional !== void 0 && resolvedMode !== command) {
+      throw new UsageError(
+        `--mode ${explicitMode} contradicts the command "${firstPositional}". Pass one or the other.`
+      );
+    }
+  }
   const expectedArgs = COMMAND_ARITY[command];
   if (args.length !== expectedArgs) {
     if (command === "explain") {
@@ -7532,6 +7565,7 @@ function parseCliArgs(argv) {
   if (rawFormat !== "text" && rawFormat !== "json") {
     throw new UsageError(`--format must be "text" or "json", received "${rawFormat}".`);
   }
+  let onlyNamesMonolith = false;
   const rawSkip = values["skip-artifacts"];
   const rawOnly = values["only-artifacts"];
   if (rawSkip !== void 0 && rawOnly !== void 0) {
@@ -7540,6 +7574,7 @@ function parseCliArgs(argv) {
   let skipArtifacts;
   if (rawOnly !== void 0) {
     const keep = parseArtifactList(String(rawOnly), "--only-artifacts");
+    onlyNamesMonolith = keep.includes("monolith");
     skipArtifacts = ARTIFACT_NAMES.filter(
       (name) => !keep.includes(name)
     );
@@ -7594,7 +7629,7 @@ function parseCliArgs(argv) {
     target: values.target === void 0 ? void 0 : String(values.target),
     cwd: values.cwd === void 0 ? process.cwd() : path12.resolve(String(values.cwd)),
     outDir: values["out-dir"] === void 0 ? void 0 : String(values["out-dir"]),
-    includeMonolith: values["include-monolith"] === true ? true : void 0,
+    includeMonolith: values["include-monolith"] === true || onlyNamesMonolith === true ? true : void 0,
     includeSensitiveFiles: values["include-sensitive-files"] === true ? true : void 0,
     maxPartBytes: parseByteOption(
       values["max-part-bytes"],

package/dist/{chunk-PCNDUNKT.js → chunk-VRJTXNJV.js}

@@ -1729,7 +1729,7 @@ var DEFAULT_SECRET_PATTERNS = [
   },
   {
     rule: "aws-access-key-id",
-    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}/
+    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA|ABIA)[0-9A-Z]{16}/
   },
   {
     // The name is no longer limited to the three snake_case spellings: an
@@ -1768,7 +1768,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // and batch tokens), `whsec_` (Stripe webhook secret), `dckr_pat_` (Docker
     // Hub), `hf_` (HuggingFace), `ya29.` (Google OAuth access token).
     rule: "known-vendor-token-prefix",
-    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128})/
+    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|glrt-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|hvb\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128}|sk_test_[A-Za-z0-9]{16,64}|1\/\/0[A-Za-z0-9_-]{20,64})/
   },
   {
     rule: "slack-webhook-url",
@@ -2665,6 +2665,7 @@ function walkDirectory(dir, baseDir, rootReal, visited, isRoot = false) {
 }
 
 // src/config.ts
+var CONFIG_DIR_SYMBOL = /* @__PURE__ */ Symbol.for("codebase-snapshot.configDir");
 var CONFIG_FILENAMES = [
   "snapshot.config.ts",
   "snapshot.config.js",
@@ -2925,6 +2926,13 @@ async function loadConfigFileDetailed(cwd) {
 }
 async function loadConfigFile(cwd) {
   const loaded = await loadConfigFileDetailed(cwd);
+  if (loaded.config && loaded.file && typeof loaded.config === "object") {
+    Object.defineProperty(loaded.config, CONFIG_DIR_SYMBOL, {
+      value: path10.dirname(loaded.file),
+      enumerable: false,
+      configurable: true
+    });
+  }
   if (loaded.errors.length > 0) {
     throw new Error(`The config file could not be read: ${loaded.errors.join("; ")}`);
   }
@@ -3210,7 +3218,8 @@ function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
   return resolved;
 }
 function resolveConfig(userConfig, cliOptions, baseDir) {
-  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir);
+  const configDir = userConfig?.[CONFIG_DIR_SYMBOL];
+  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir ?? configDir);
   const forcedPreset = resolvePresetName(userConfig?.preset);
   if (forcedPreset !== void 0 && !getPreset(forcedPreset)) {
     throw new Error(unknownPresetMessage(forcedPreset));
@@ -3310,7 +3319,11 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     hooks: resolveHooks(userConfig?.hooks),
     layers,
     kinds,
-    excludePatterns: resolveExcludePatterns(userConfig?.excludePatterns),
+    // `exclude` is the flag spelling of the same setting; writing it in a config used to
+    // be ignored without a word.
+    excludePatterns: resolveExcludePatterns(
+      userConfig?.excludePatterns ?? userConfig?.exclude
+    ),
     secretRules
   });
 }
@@ -4077,21 +4090,28 @@ function isBinaryExtension(filePath) {
   return BINARY_EXTENSIONS.has(ext);
 }
 function isBinaryBuffer(buffer) {
-  const checkLength = Math.min(buffer.length, 8192);
-  for (let index = 0; index < checkLength; index++) {
+  for (let index = 0; index < buffer.length; index++) {
     if (buffer[index] === 0) return true;
   }
   return false;
 }
+var BINARY_SCAN_BYTES = 8 * 1024 * 1024;
+var CHUNK = 64 * 1024;
 function isBinaryFile(absolutePath) {
   if (isBinaryExtension(absolutePath)) return true;
   let fd;
   try {
     fd = fs9.openSync(absolutePath, "r");
-    const buffer = Buffer.alloc(8192);
-    const bytesRead = fs9.readSync(fd, buffer, 0, 8192, 0);
-    if (bytesRead === 0) return false;
-    return isBinaryBuffer(buffer.subarray(0, bytesRead));
+    const buffer = Buffer.alloc(CHUNK);
+    let position = 0;
+    while (position < BINARY_SCAN_BYTES) {
+      const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
+      const bytesRead = fs9.readSync(fd, buffer, 0, wanted, position);
+      if (bytesRead === 0) return false;
+      if (isBinaryBuffer(buffer.subarray(0, bytesRead))) return true;
+      position += bytesRead;
+    }
+    return false;
   } catch {
     return false;
   } finally {
@@ -5261,11 +5281,11 @@ function addScripts(cwd, notes) {
   const scripts = parsed.scripts && typeof parsed.scripts === "object" ? parsed.scripts : {};
   const added = [];
   if (!scripts.snapshot) {
-    scripts.snapshot = "codebase-snapshot generate";
+    scripts.snapshot = "npx @ankurhalder/codebase-snapshot generate";
     added.push("snapshot");
   }
   if (!scripts["snapshot:validate"]) {
-    scripts["snapshot:validate"] = "codebase-snapshot validate";
+    scripts["snapshot:validate"] = "npx @ankurhalder/codebase-snapshot validate";
     added.push("snapshot:validate");
   }
   if (added.length === 0) return [];
@@ -5461,7 +5481,7 @@ async function runInit(options) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.5";
+var GENERATOR_VERSION = "4.0.7";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto.createHash("sha256").update(input).digest("hex");
@@ -6228,8 +6248,8 @@ function generateSnapshot(configInput, options) {
     const lineCount = countLines(rawContent);
     totalLines += lineCount;
     totalSizeBytes += stats.size;
-    const layer2 = classifyLayer(relativePath, config.layers);
-    const kind = classifyKind(relativePath, config.kinds);
+    const layer2 = maskPathText(classifyLayer(relativePath, config.layers), config.secretRules);
+    const kind = maskPathText(classifyKind(relativePath, config.kinds), config.secretRules);
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
@@ -6322,7 +6342,9 @@ function generateSnapshot(configInput, options) {
       name: GENERATOR_NAME,
       version: GENERATOR_VERSION
     },
-    git: gitInfo,
+    // A branch name is user input and can carry a token: it reaches the manifest,
+    // the README and the audit report.
+    git: { ...gitInfo, branch: maskPathText(gitInfo.branch, config.secretRules) },
     budgets: {
       maxPartBytes: config.maxPartBytes,
       largeFileBytes: config.largeFileBytes
@@ -6339,7 +6361,12 @@ function generateSnapshot(configInput, options) {
       include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
-      budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
+      budgets: {
+        default: config.budgets.default,
+        byLayer: Object.fromEntries(
+          Object.entries(config.budgets.byLayer).map(([name, bytes]) => [maskName(name), bytes])
+        )
+      },
       excludePatterns: [...config.excludePatterns].map(maskName),
       layers: config.layers.map((layer2) => maskName(layer2.name)),
       kinds: config.kinds.map((kind) => maskName(kind.kind))
@@ -6522,5 +6549,5 @@ async function generateSnapshotAsync(configInput, options) {
 }
 
 export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, unknownPresetMessage, validateSnapshot };
-//# sourceMappingURL=chunk-PCNDUNKT.js.map
-//# sourceMappingURL=chunk-PCNDUNKT.js.map
+//# sourceMappingURL=chunk-VRJTXNJV.js.map
+//# sourceMappingURL=chunk-VRJTXNJV.js.map

package/dist/cli.cjs

@@ -896,7 +896,7 @@ var DEFAULT_SECRET_PATTERNS = [
   },
   {
     rule: "aws-access-key-id",
-    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}/
+    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA|ABIA)[0-9A-Z]{16}/
   },
   {
     // The name is no longer limited to the three snake_case spellings: an
@@ -935,7 +935,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // and batch tokens), `whsec_` (Stripe webhook secret), `dckr_pat_` (Docker
     // Hub), `hf_` (HuggingFace), `ya29.` (Google OAuth access token).
     rule: "known-vendor-token-prefix",
-    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128})/
+    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|glrt-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|hvb\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128}|sk_test_[A-Za-z0-9]{16,64}|1\/\/0[A-Za-z0-9_-]{20,64})/
   },
   {
     rule: "slack-webhook-url",
@@ -1957,6 +1957,7 @@ function renderDiffText(diff) {
   section("changed:", diff.changed);
   return lines.join("\n");
 }
+var CONFIG_DIR_SYMBOL = /* @__PURE__ */ Symbol.for("codebase-snapshot.configDir");
 var CONFIG_FILENAMES = [
   "snapshot.config.ts",
   "snapshot.config.js",
@@ -2495,7 +2496,8 @@ function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
   return resolved;
 }
 function resolveConfig(userConfig, cliOptions, baseDir) {
-  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir);
+  const configDir = userConfig?.[CONFIG_DIR_SYMBOL];
+  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir ?? configDir);
   const forcedPreset = resolvePresetName(userConfig?.preset);
   if (forcedPreset !== void 0 && !getPreset(forcedPreset)) {
     throw new Error(unknownPresetMessage(forcedPreset));
@@ -2595,7 +2597,11 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     hooks: resolveHooks(userConfig?.hooks),
     layers,
     kinds,
-    excludePatterns: resolveExcludePatterns(userConfig?.excludePatterns),
+    // `exclude` is the flag spelling of the same setting; writing it in a config used to
+    // be ignored without a word.
+    excludePatterns: resolveExcludePatterns(
+      userConfig?.excludePatterns ?? userConfig?.exclude
+    ),
     secretRules
   });
 }
@@ -2738,21 +2744,28 @@ function isBinaryExtension(filePath) {
   return BINARY_EXTENSIONS.has(ext);
 }
 function isBinaryBuffer(buffer) {
-  const checkLength = Math.min(buffer.length, 8192);
-  for (let index = 0; index < checkLength; index++) {
+  for (let index = 0; index < buffer.length; index++) {
     if (buffer[index] === 0) return true;
   }
   return false;
 }
+var BINARY_SCAN_BYTES = 8 * 1024 * 1024;
+var CHUNK = 64 * 1024;
 function isBinaryFile(absolutePath) {
   if (isBinaryExtension(absolutePath)) return true;
   let fd;
   try {
     fd = fs9__namespace.openSync(absolutePath, "r");
-    const buffer = Buffer.alloc(8192);
-    const bytesRead = fs9__namespace.readSync(fd, buffer, 0, 8192, 0);
-    if (bytesRead === 0) return false;
-    return isBinaryBuffer(buffer.subarray(0, bytesRead));
+    const buffer = Buffer.alloc(CHUNK);
+    let position = 0;
+    while (position < BINARY_SCAN_BYTES) {
+      const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
+      const bytesRead = fs9__namespace.readSync(fd, buffer, 0, wanted, position);
+      if (bytesRead === 0) return false;
+      if (isBinaryBuffer(buffer.subarray(0, bytesRead))) return true;
+      position += bytesRead;
+    }
+    return false;
   } catch {
     return false;
   } finally {
@@ -3417,11 +3430,11 @@ function addScripts(cwd, notes) {
   const scripts = parsed.scripts && typeof parsed.scripts === "object" ? parsed.scripts : {};
   const added = [];
   if (!scripts.snapshot) {
-    scripts.snapshot = "codebase-snapshot generate";
+    scripts.snapshot = "npx @ankurhalder/codebase-snapshot generate";
     added.push("snapshot");
   }
   if (!scripts["snapshot:validate"]) {
-    scripts["snapshot:validate"] = "codebase-snapshot validate";
+    scripts["snapshot:validate"] = "npx @ankurhalder/codebase-snapshot validate";
     added.push("snapshot:validate");
   }
   if (added.length === 0) return [];
@@ -5477,7 +5490,7 @@ function validateSnapshot(configInput) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.5";
+var GENERATOR_VERSION = "4.0.7";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto__namespace.createHash("sha256").update(input).digest("hex");
@@ -6244,8 +6257,8 @@ function generateSnapshot(configInput, options) {
     const lineCount = countLines(rawContent);
     totalLines += lineCount;
     totalSizeBytes += stats.size;
-    const layer2 = classifyLayer(relativePath, config.layers);
-    const kind = classifyKind(relativePath, config.kinds);
+    const layer2 = maskPathText(classifyLayer(relativePath, config.layers), config.secretRules);
+    const kind = maskPathText(classifyKind(relativePath, config.kinds), config.secretRules);
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
@@ -6338,7 +6351,9 @@ function generateSnapshot(configInput, options) {
       name: GENERATOR_NAME,
       version: GENERATOR_VERSION
     },
-    git: gitInfo,
+    // A branch name is user input and can carry a token: it reaches the manifest,
+    // the README and the audit report.
+    git: { ...gitInfo, branch: maskPathText(gitInfo.branch, config.secretRules) },
     budgets: {
       maxPartBytes: config.maxPartBytes,
       largeFileBytes: config.largeFileBytes
@@ -6355,7 +6370,12 @@ function generateSnapshot(configInput, options) {
       include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
-      budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
+      budgets: {
+        default: config.budgets.default,
+        byLayer: Object.fromEntries(
+          Object.entries(config.budgets.byLayer).map(([name, bytes]) => [maskName(name), bytes])
+        )
+      },
       excludePatterns: [...config.excludePatterns].map(maskName),
       layers: config.layers.map((layer2) => maskName(layer2.name)),
       kinds: config.kinds.map((kind) => maskName(kind.kind))
@@ -7501,6 +7521,19 @@ function parseCliArgs(argv) {
     }
     command = resolved;
   }
+  if (explicitMode !== void 0) {
+    const resolvedMode = COMMAND_ALIASES.get(explicitMode);
+    if (!resolvedMode) {
+      throw new UsageError(
+        `Unknown --mode "${explicitMode}". Expected one of: ${Array.from(COMMAND_ALIASES.keys()).join(", ")}.`
+      );
+    }
+    if (firstPositional !== void 0 && resolvedMode !== command) {
+      throw new UsageError(
+        `--mode ${explicitMode} contradicts the command "${firstPositional}". Pass one or the other.`
+      );
+    }
+  }
   const expectedArgs = COMMAND_ARITY[command];
   if (args.length !== expectedArgs) {
     if (command === "explain") {
@@ -7519,6 +7552,7 @@ function parseCliArgs(argv) {
   if (rawFormat !== "text" && rawFormat !== "json") {
     throw new UsageError(`--format must be "text" or "json", received "${rawFormat}".`);
   }
+  let onlyNamesMonolith = false;
   const rawSkip = values["skip-artifacts"];
   const rawOnly = values["only-artifacts"];
   if (rawSkip !== void 0 && rawOnly !== void 0) {
@@ -7527,6 +7561,7 @@ function parseCliArgs(argv) {
   let skipArtifacts;
   if (rawOnly !== void 0) {
     const keep = parseArtifactList(String(rawOnly), "--only-artifacts");
+    onlyNamesMonolith = keep.includes("monolith");
     skipArtifacts = ARTIFACT_NAMES.filter(
       (name) => !keep.includes(name)
     );
@@ -7581,7 +7616,7 @@ function parseCliArgs(argv) {
     target: values.target === void 0 ? void 0 : String(values.target),
     cwd: values.cwd === void 0 ? process.cwd() : path10__namespace.resolve(String(values.cwd)),
     outDir: values["out-dir"] === void 0 ? void 0 : String(values["out-dir"]),
-    includeMonolith: values["include-monolith"] === true ? true : void 0,
+    includeMonolith: values["include-monolith"] === true || onlyNamesMonolith === true ? true : void 0,
     includeSensitiveFiles: values["include-sensitive-files"] === true ? true : void 0,
     maxPartBytes: parseByteOption(
       values["max-part-bytes"],

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { loadConfigFileDetailed, resolveConfig, validateSnapshot, explainPath, compareManifests, loadManifest, renderDiffText, generateSnapshot, GENERATOR_VERSION, ARTIFACT_NAMES, getPreset, unknownPresetMessage, GENERATOR_NAME, runInit, PromptCancelled, MIN_MAX_PART_BYTES, SCHEMA_VERSION, PRESETS, parseByteSize, renderExplainText } from './chunk-PCNDUNKT.js';
+import { loadConfigFileDetailed, resolveConfig, validateSnapshot, explainPath, compareManifests, loadManifest, renderDiffText, generateSnapshot, GENERATOR_VERSION, ARTIFACT_NAMES, getPreset, unknownPresetMessage, GENERATOR_NAME, runInit, PromptCancelled, MIN_MAX_PART_BYTES, SCHEMA_VERSION, PRESETS, parseByteSize, renderExplainText } from './chunk-VRJTXNJV.js';
 import * as fs from 'fs';
 import * as path2 from 'path';
 import { parseArgs } from 'util';
@@ -970,6 +970,19 @@ function parseCliArgs(argv) {
     }
     command = resolved;
   }
+  if (explicitMode !== void 0) {
+    const resolvedMode = COMMAND_ALIASES.get(explicitMode);
+    if (!resolvedMode) {
+      throw new UsageError(
+        `Unknown --mode "${explicitMode}". Expected one of: ${Array.from(COMMAND_ALIASES.keys()).join(", ")}.`
+      );
+    }
+    if (firstPositional !== void 0 && resolvedMode !== command) {
+      throw new UsageError(
+        `--mode ${explicitMode} contradicts the command "${firstPositional}". Pass one or the other.`
+      );
+    }
+  }
   const expectedArgs = COMMAND_ARITY[command];
   if (args.length !== expectedArgs) {
     if (command === "explain") {
@@ -988,6 +1001,7 @@ function parseCliArgs(argv) {
   if (rawFormat !== "text" && rawFormat !== "json") {
     throw new UsageError(`--format must be "text" or "json", received "${rawFormat}".`);
   }
+  let onlyNamesMonolith = false;
   const rawSkip = values["skip-artifacts"];
   const rawOnly = values["only-artifacts"];
   if (rawSkip !== void 0 && rawOnly !== void 0) {
@@ -996,6 +1010,7 @@ function parseCliArgs(argv) {
   let skipArtifacts;
   if (rawOnly !== void 0) {
     const keep = parseArtifactList(String(rawOnly), "--only-artifacts");
+    onlyNamesMonolith = keep.includes("monolith");
     skipArtifacts = ARTIFACT_NAMES.filter(
       (name) => !keep.includes(name)
     );
@@ -1050,7 +1065,7 @@ function parseCliArgs(argv) {
     target: values.target === void 0 ? void 0 : String(values.target),
     cwd: values.cwd === void 0 ? process.cwd() : path2.resolve(String(values.cwd)),
     outDir: values["out-dir"] === void 0 ? void 0 : String(values["out-dir"]),
-    includeMonolith: values["include-monolith"] === true ? true : void 0,
+    includeMonolith: values["include-monolith"] === true || onlyNamesMonolith === true ? true : void 0,
     includeSensitiveFiles: values["include-sensitive-files"] === true ? true : void 0,
     maxPartBytes: parseByteOption(
       values["max-part-bytes"],

package/dist/index.cjs

@@ -1758,7 +1758,7 @@ var DEFAULT_SECRET_PATTERNS = [
   },
   {
     rule: "aws-access-key-id",
-    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}/
+    pattern: /(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA|ABIA)[0-9A-Z]{16}/
   },
   {
     // The name is no longer limited to the three snake_case spellings: an
@@ -1797,7 +1797,7 @@ var DEFAULT_SECRET_PATTERNS = [
     // and batch tokens), `whsec_` (Stripe webhook secret), `dckr_pat_` (Docker
     // Hub), `hf_` (HuggingFace), `ya29.` (Google OAuth access token).
     rule: "known-vendor-token-prefix",
-    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128})/
+    pattern: /\b(?:glpat-[A-Za-z0-9_-]{20,64}|glrt-[A-Za-z0-9_-]{20,64}|hvs\.[A-Za-z0-9_-]{20,128}|hvb\.[A-Za-z0-9_-]{20,128}|s\.[A-Za-z0-9]{20,64}|whsec_[A-Za-z0-9]{20,64}|dckr_pat_[A-Za-z0-9_-]{20,64}|hf_[A-Za-z0-9]{30,64}|ya29\.[A-Za-z0-9_-]{20,128}|sk_test_[A-Za-z0-9]{16,64}|1\/\/0[A-Za-z0-9_-]{20,64})/
   },
   {
     rule: "slack-webhook-url",
@@ -2694,6 +2694,7 @@ function walkDirectory(dir, baseDir, rootReal, visited, isRoot = false) {
 }
 
 // src/config.ts
+var CONFIG_DIR_SYMBOL = /* @__PURE__ */ Symbol.for("codebase-snapshot.configDir");
 var CONFIG_FILENAMES = [
   "snapshot.config.ts",
   "snapshot.config.js",
@@ -2954,6 +2955,13 @@ async function loadConfigFileDetailed(cwd) {
 }
 async function loadConfigFile(cwd) {
   const loaded = await loadConfigFileDetailed(cwd);
+  if (loaded.config && loaded.file && typeof loaded.config === "object") {
+    Object.defineProperty(loaded.config, CONFIG_DIR_SYMBOL, {
+      value: path10__namespace.dirname(loaded.file),
+      enumerable: false,
+      configurable: true
+    });
+  }
   if (loaded.errors.length > 0) {
     throw new Error(`The config file could not be read: ${loaded.errors.join("; ")}`);
   }
@@ -3239,7 +3247,8 @@ function resolveCandidateCwd(userConfig, cliOptions, baseDir) {
   return resolved;
 }
 function resolveConfig(userConfig, cliOptions, baseDir) {
-  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir);
+  const configDir = userConfig?.[CONFIG_DIR_SYMBOL];
+  const cwd = resolveCandidateCwd(userConfig ?? null, cliOptions, baseDir ?? configDir);
   const forcedPreset = resolvePresetName(userConfig?.preset);
   if (forcedPreset !== void 0 && !getPreset(forcedPreset)) {
     throw new Error(unknownPresetMessage(forcedPreset));
@@ -3339,7 +3348,11 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     hooks: resolveHooks(userConfig?.hooks),
     layers,
     kinds,
-    excludePatterns: resolveExcludePatterns(userConfig?.excludePatterns),
+    // `exclude` is the flag spelling of the same setting; writing it in a config used to
+    // be ignored without a word.
+    excludePatterns: resolveExcludePatterns(
+      userConfig?.excludePatterns ?? userConfig?.exclude
+    ),
     secretRules
   });
 }
@@ -4106,21 +4119,28 @@ function isBinaryExtension(filePath) {
   return BINARY_EXTENSIONS.has(ext);
 }
 function isBinaryBuffer(buffer) {
-  const checkLength = Math.min(buffer.length, 8192);
-  for (let index = 0; index < checkLength; index++) {
+  for (let index = 0; index < buffer.length; index++) {
     if (buffer[index] === 0) return true;
   }
   return false;
 }
+var BINARY_SCAN_BYTES = 8 * 1024 * 1024;
+var CHUNK = 64 * 1024;
 function isBinaryFile(absolutePath) {
   if (isBinaryExtension(absolutePath)) return true;
   let fd;
   try {
     fd = fs9__namespace.openSync(absolutePath, "r");
-    const buffer = Buffer.alloc(8192);
-    const bytesRead = fs9__namespace.readSync(fd, buffer, 0, 8192, 0);
-    if (bytesRead === 0) return false;
-    return isBinaryBuffer(buffer.subarray(0, bytesRead));
+    const buffer = Buffer.alloc(CHUNK);
+    let position = 0;
+    while (position < BINARY_SCAN_BYTES) {
+      const wanted = Math.min(CHUNK, BINARY_SCAN_BYTES - position);
+      const bytesRead = fs9__namespace.readSync(fd, buffer, 0, wanted, position);
+      if (bytesRead === 0) return false;
+      if (isBinaryBuffer(buffer.subarray(0, bytesRead))) return true;
+      position += bytesRead;
+    }
+    return false;
   } catch {
     return false;
   } finally {
@@ -5290,11 +5310,11 @@ function addScripts(cwd, notes) {
   const scripts = parsed.scripts && typeof parsed.scripts === "object" ? parsed.scripts : {};
   const added = [];
   if (!scripts.snapshot) {
-    scripts.snapshot = "codebase-snapshot generate";
+    scripts.snapshot = "npx @ankurhalder/codebase-snapshot generate";
     added.push("snapshot");
   }
   if (!scripts["snapshot:validate"]) {
-    scripts["snapshot:validate"] = "codebase-snapshot validate";
+    scripts["snapshot:validate"] = "npx @ankurhalder/codebase-snapshot validate";
     added.push("snapshot:validate");
   }
   if (added.length === 0) return [];
@@ -5490,7 +5510,7 @@ async function runInit(options) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.5";
+var GENERATOR_VERSION = "4.0.7";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto__namespace.createHash("sha256").update(input).digest("hex");
@@ -6257,8 +6277,8 @@ function generateSnapshot(configInput, options) {
     const lineCount = countLines(rawContent);
     totalLines += lineCount;
     totalSizeBytes += stats.size;
-    const layer2 = classifyLayer(relativePath, config.layers);
-    const kind = classifyKind(relativePath, config.kinds);
+    const layer2 = maskPathText(classifyLayer(relativePath, config.layers), config.secretRules);
+    const kind = maskPathText(classifyKind(relativePath, config.kinds), config.secretRules);
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
@@ -6351,7 +6371,9 @@ function generateSnapshot(configInput, options) {
       name: GENERATOR_NAME,
       version: GENERATOR_VERSION
     },
-    git: gitInfo,
+    // A branch name is user input and can carry a token: it reaches the manifest,
+    // the README and the audit report.
+    git: { ...gitInfo, branch: maskPathText(gitInfo.branch, config.secretRules) },
     budgets: {
       maxPartBytes: config.maxPartBytes,
       largeFileBytes: config.largeFileBytes
@@ -6368,7 +6390,12 @@ function generateSnapshot(configInput, options) {
       include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
-      budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
+      budgets: {
+        default: config.budgets.default,
+        byLayer: Object.fromEntries(
+          Object.entries(config.budgets.byLayer).map(([name, bytes]) => [maskName(name), bytes])
+        )
+      },
       excludePatterns: [...config.excludePatterns].map(maskName),
       layers: config.layers.map((layer2) => maskName(layer2.name)),
       kinds: config.kinds.map((kind) => maskName(kind.kind))

package/dist/index.d.cts

@@ -495,7 +495,7 @@ declare function matchesExclude(relativePath: string, pattern: string): boolean;
 declare function collectFiles(cwd: string, options?: CollectOptions): CollectResult;
 
 declare const GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-declare const GENERATOR_VERSION = "4.0.5";
+declare const GENERATOR_VERSION = "4.0.7";
 declare const SCHEMA_VERSION = "3.0.0";
 interface GenerateOptions {
     /** Compute the full manifest but write nothing to disk. */

package/dist/index.d.ts

@@ -495,7 +495,7 @@ declare function matchesExclude(relativePath: string, pattern: string): boolean;
 declare function collectFiles(cwd: string, options?: CollectOptions): CollectResult;
 
 declare const GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-declare const GENERATOR_VERSION = "4.0.5";
+declare const GENERATOR_VERSION = "4.0.7";
 declare const SCHEMA_VERSION = "3.0.0";
 interface GenerateOptions {
     /** Compute the full manifest but write nothing to disk. */

package/dist/index.js

@@ -1,3 +1,3 @@
-export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, validateSnapshot } from './chunk-PCNDUNKT.js';
+export { ARTIFACT_NAMES, DEFAULT_ANSWERS, DEFAULT_SECRET_PATTERNS, GENERATOR_NAME, GENERATOR_VERSION, LANGUAGE_PROFILES, MIN_MAX_PART_BYTES, PRESETS, PromptCancelled, SCHEMA_VERSION, anchorForPath, assertReplaceable, assertUsableConfigInput, collectFiles, compareManifests, countLines, defineConfig, detectLanguage, detectPreset, explainPath, fenceForContent, fenceForText, generateProjectTree, generateSnapshot, generateSnapshotAsync, getPreset, globToRegExp, isBinaryBuffer, isBinaryExtension, isBinaryFile, isInteractive, isResolvedConfig, isSensitivePath, listPresetNames, loadConfigFile, loadConfigFileDetailed, loadManifest, markResolvedConfig, matchRule, matchesExclude, normalizeResolvedConfig, parseByteSize, partitionFiles, profileForPath, renderConfig, renderDiffText, renderExplainText, renderMinimalConfig, renumberParts, resolveConfig, resolveSafeOutputDirs, runInit, scanAndRedactSecrets, stripJsonComments, summarizeJson, summarizeMarkdown, summarizeTypeScriptSource, summarizeWithProfile, supportsTypeScriptImports, truncatePreview, truncateToBytes, validateSnapshot } from './chunk-VRJTXNJV.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankurhalder/codebase-snapshot",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "description": "Production-grade LLM codebase snapshot generator, auditor, and AST partitioner",
   "keywords": [
     "codebase",