@coderook/cli 0.18.0 → 0.19.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -416,6 +416,47 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         }
         console.log(dim("Sending them anyway, because --allow-secrets was given."));
     }
+    /*
+      Keys pasted into files that are not keys.
+  
+      The check above reads names, which finds what a tool wrote and is blind to
+      what a person typed. This one reads the files being sent — the case where
+      somebody pasted a token into `settings.py` to get something working and it
+      stayed there, in a file with an ordinary name that every other check waves
+      through.
+  
+      Refused separately from `--allow-secrets`, because the answer is different:
+      a `.env` should not be sent and the fix is to leave it out, while a source
+      file should be sent and the fix is to take the key out of it.
+    */
+    const pasted = await (0, worktree_js_1.detectPastedCredentials)(folder, files.map((file) => file.path));
+    const stillPasted = pasted.filter((finding) => !exposed.includes(finding.path));
+    if (stillPasted.length) {
+        console.log(red(`
+${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
+        for (const finding of stillPasted.slice(0, 20)) {
+            console.log(`  ${finding.path}`);
+            for (const one of finding.found.slice(0, 3)) {
+                console.log(dim(`    line ${one.line}: ${one.name}`));
+            }
+            if (finding.found.length > 3) {
+                console.log(dim(`    …and ${finding.found.length - 3} more`));
+            }
+        }
+        if (stillPasted.length > 20) {
+            console.log(dim(`  …and ${stillPasted.length - 20} more`));
+        }
+        if (!hasFlag(parsed, "allow-secrets")) {
+            console.error(`
+Nothing was sent. Move the key into an environment variable, and if` +
+                ` it has ever been published, replace it at the service that issued` +
+                ` it — a key that has leaked stays leaked.` +
+                `
+Pass ${accent("--allow-secrets")} if these are not real keys.`);
+            return 1;
+        }
+        console.log(dim("Sending them anyway, because --allow-secrets was given."));
+    }
     if (hasFlag(parsed, "dry-run", "n")) {
         console.log(`${files.length} file${files.length === 1 ? "" : "s"} would be sent:`);
         for (const file of files)
@@ -1208,7 +1249,10 @@ const SPECS = [
         options: [
             { flags: "-m, --message <text>", description: "what changed, in a sentence" },
             { flags: "-n, --dry-run", description: "show what would be sent, send nothing" },
-            { flags: "--allow-secrets", description: "send files that look like credentials" },
+            {
+                flags: "--allow-secrets",
+                description: "send files that look like credentials, and files with keys inside",
+            },
             {
                 flags: "--track <name>",
                 description: "save onto this line, just this once",

package/dist/desktop-app/src/main/secret_patterns.js

@@ -0,0 +1,371 @@
+"use strict";
+/**
+ * Credentials recognised by what they are, not by what they are called.
+ *
+ * The existing check reads names: `.env`, `id_ed25519`, anything ending
+ * `.pem`. That catches the files a tool writes without being asked, which is
+ * where most accidental leaks come from — and it is completely blind to the
+ * other kind, where somebody pastes a key into `config.py` while getting
+ * something working and never takes it out. That file has an ordinary name,
+ * sits in an ordinary folder, and every check we had waved it through.
+ *
+ * So these patterns match the keys themselves. Each one is a format some
+ * service publishes and no ordinary text produces: a fixed prefix and a fixed
+ * length, not "a long random-looking string", which would flag every hash and
+ * teach people to ignore the warning. A check that cries wolf is worse than
+ * no check, because it trains the answer.
+ *
+ * Nothing here ever returns the secret. A finding is a file, a line, and what
+ * kind of key it is — enough to go and look, and safe to put in a log, a
+ * window, or a bug report.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_PATTERNS = void 0;
+exports.looksLikePlaceholder = looksLikePlaceholder;
+exports.findCredentials = findCredentials;
+exports.worthReading = worthReading;
+exports.looksLikeText = looksLikeText;
+/*
+  Ordered most specific first. `sk-ant-…` is also a match for the more general
+  `sk-…`, and whichever runs first should be the one that gets to name it —
+  the scan below drops later matches that overlap an earlier one, so this
+  order is what decides that "an Anthropic API key" beats "an OpenAI API key".
+*/
+exports.CREDENTIAL_PATTERNS = [
+    {
+        id: "private-key",
+        name: "a private key",
+        /*
+          The header alone is not a key. Documentation writes it constantly —
+          `-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----` is how
+          every example shows the shape — so the match requires real key material
+          after it. Escaped newlines count as newlines, because a key embedded in
+          JSON or a JavaScript string is exactly how a service-account file
+          carries one, and that is the case worth catching.
+        */
+        match: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----(?:\s|\\[rn])*[A-Za-z0-9+/=]{40,}/g,
+    },
+    {
+        id: "anthropic",
+        name: "an Anthropic API key",
+        match: /\bsk-ant-[A-Za-z0-9_-]{24,}/g,
+    },
+    {
+        id: "openai",
+        name: "an OpenAI API key",
+        match: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,}/g,
+    },
+    {
+        id: "aws-access-key",
+        name: "an AWS access key",
+        match: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g,
+    },
+    {
+        id: "azure-storage-key",
+        name: "an Azure storage key",
+        match: /AccountKey=[A-Za-z0-9+/]{80,}={0,2}/g,
+    },
+    {
+        id: "github-token",
+        name: "a GitHub token",
+        match: /\bgh[pousr]_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        id: "github-pat",
+        name: "a GitHub fine-grained token",
+        match: /\bgithub_pat_[A-Za-z0-9_]{22,}/g,
+    },
+    {
+        id: "gitlab-token",
+        name: "a GitLab token",
+        match: /\bglpat-[A-Za-z0-9_-]{20,}/g,
+    },
+    {
+        id: "google-api-key",
+        name: "a Google API key",
+        match: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    },
+    {
+        id: "slack-token",
+        name: "a Slack token",
+        match: /\bxox[baprs]-[0-9A-Za-z-]{10,}/g,
+    },
+    {
+        id: "stripe-live-key",
+        name: "a live Stripe key",
+        match: /\b[sr]k_live_[0-9A-Za-z]{20,}/g,
+    },
+    {
+        id: "sendgrid",
+        name: "a SendGrid key",
+        match: /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{30,}/g,
+    },
+    {
+        id: "npm-token",
+        name: "an npm token",
+        match: /\bnpm_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        id: "planetscale",
+        name: "a PlanetScale credential",
+        match: /\bpscale_(?:tkn|pw|oauth)_[A-Za-z0-9_-]{32,}/g,
+    },
+    {
+        id: "huggingface",
+        name: "a Hugging Face token",
+        match: /\bhf_[A-Za-z0-9]{34,}/g,
+    },
+    {
+        id: "discord-bot-token",
+        name: "a Discord bot token",
+        match: /\b[MNO][A-Za-z0-9_-]{23,26}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,}/g,
+    },
+    {
+        id: "twilio-sid",
+        name: "a Twilio account SID",
+        match: /\bAC[0-9a-f]{32}\b/g,
+    },
+    {
+        /*
+          The one that is a sentence rather than a token. A database URL with the
+          password still in it is how a whole database gets handed over, and it
+          does not look like a key at all — which is exactly why nothing caught
+          it before.
+        */
+        id: "database-url",
+        name: "a database password in a connection string",
+        /*
+          The host is part of the match on purpose. Documentation is full of
+          these, and what distinguishes a real one is not the password — which is
+          often literally the word "password" in both — but where it points.
+          Matching through the host lets the placeholder check see `localhost`
+          and `example.com` and stay quiet.
+        */
+        match: /\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s:@/]+:[^\s:@/]+@[^\s/?#"']+/g,
+    },
+];
+/*
+  Words that mean "this is the shape, not the secret".
+
+  Documentation is full of keys, and every one of them is fake. Flagging those
+  would put a warning on the README of every project that explains its own
+  configuration — and a warning that is usually wrong is a warning people
+  learn to click past, including the time it is right.
+*/
+const PLACEHOLDER = [
+    "example",
+    "placeholder",
+    "your-",
+    "your_",
+    "yourkey",
+    "youraccount",
+    "changeme",
+    "change-me",
+    "redacted",
+    "dummy",
+    "sample",
+    "insert",
+    "replace",
+    "notreal",
+    "fake",
+    "test-key",
+    /*
+      Where a connection string points, when it points nowhere real. A database
+      URL aimed at the machine it is written on is somebody's own setup, not a
+      credential anybody else can use.
+    */
+    "localhost",
+    "127.0.0.1",
+    "0.0.0.0",
+    "host:port",
+    ":password@",
+    ":pass@",
+    ":secret@",
+    "xxxx",
+    "0000",
+    "1234567890",
+    "abcdef123456",
+];
+/** Whether this looks like documentation rather than a live credential. */
+function looksLikePlaceholder(value) {
+    const flat = value.toLowerCase();
+    if (PLACEHOLDER.some((word) => flat.includes(word)))
+        return true;
+    /*
+      A value the program builds at run time is not a value in the file. Code
+      that assembles a connection string from variables —
+      `postgresql://${user}:${password}@${host}` — is the ordinary way to do it
+      and holds no secret at all, so flagging it would put a warning on the
+      correct pattern and none on the wrong one.
+    */
+    if (/\$\{|\{\{|%\(|%s|\$\(|<[A-Za-z_][A-Za-z0-9_ -]*>/.test(value)) {
+        return true;
+    }
+    /*
+      A run of one repeated character is somebody drawing a key rather than
+      pasting one. Real keys do not contain `aaaaaaaaaa`.
+    */
+    if (/(.)\1{7,}/.test(value))
+        return true;
+    return false;
+}
+/** How much of a match is safe to repeat back. */
+function hint(value) {
+    const head = value.slice(0, 7);
+    return `${head}…`;
+}
+/**
+ * The credentials in this text.
+ *
+ * Overlapping matches are resolved in favour of whichever pattern is listed
+ * first, so a key that fits two formats is named as the more specific one
+ * rather than reported twice.
+ */
+function findCredentials(text) {
+    const claimed = [];
+    const found = [];
+    /* Line starts, computed once, so a match's line is a lookup not a scan. */
+    const starts = [0];
+    for (let at = text.indexOf("\n"); at !== -1; at = text.indexOf("\n", at + 1)) {
+        starts.push(at + 1);
+    }
+    const lineOf = (index) => {
+        let low = 0;
+        let high = starts.length - 1;
+        while (low < high) {
+            const middle = Math.ceil((low + high) / 2);
+            if (starts[middle] <= index)
+                low = middle;
+            else
+                high = middle - 1;
+        }
+        return low + 1;
+    };
+    for (const pattern of exports.CREDENTIAL_PATTERNS) {
+        // Fresh each time: a /g regex carries lastIndex between calls.
+        const expression = new RegExp(pattern.match.source, pattern.match.flags);
+        for (const match of text.matchAll(expression)) {
+            const at = match.index ?? 0;
+            const to = at + match[0].length;
+            if (claimed.some(([from, until]) => at < until && to > from))
+                continue;
+            if (looksLikePlaceholder(match[0]))
+                continue;
+            claimed.push([at, to]);
+            found.push({
+                id: pattern.id,
+                name: pattern.name,
+                line: lineOf(at),
+                hint: hint(match[0]),
+            });
+        }
+    }
+    return found.sort((left, right) => left.line - right.line);
+}
+/*
+  Extensions worth reading. Everything else is either compiled, compressed, or
+  media — a credential in a JPEG is not a case worth slowing every upload for,
+  and a scan that reads a repository of video is a scan people turn off.
+*/
+const READABLE = new Set([
+    "",
+    ".bash",
+    ".bat",
+    ".c",
+    ".cfg",
+    ".clj",
+    ".cmd",
+    ".conf",
+    ".config",
+    ".cpp",
+    ".cs",
+    ".css",
+    ".csv",
+    ".dart",
+    ".dockerfile",
+    ".editorconfig",
+    ".env",
+    ".ex",
+    ".exs",
+    ".fish",
+    ".go",
+    ".gradle",
+    ".groovy",
+    ".h",
+    ".hpp",
+    ".hs",
+    ".htm",
+    ".html",
+    ".ini",
+    ".ipynb",
+    ".java",
+    ".js",
+    ".json",
+    ".jsonc",
+    ".jsx",
+    ".kt",
+    ".kts",
+    ".less",
+    ".lua",
+    ".m",
+    ".md",
+    ".mdx",
+    ".mjs",
+    ".mts",
+    ".php",
+    ".pl",
+    ".plist",
+    ".properties",
+    ".ps1",
+    ".psm1",
+    ".py",
+    ".r",
+    ".rb",
+    ".rs",
+    ".sbt",
+    ".scala",
+    ".scss",
+    ".sh",
+    ".sql",
+    ".svelte",
+    ".swift",
+    ".tf",
+    ".tfvars",
+    ".toml",
+    ".ts",
+    ".tsx",
+    ".txt",
+    ".vue",
+    ".xml",
+    ".yaml",
+    ".yml",
+    ".zsh",
+]);
+/** Whether a file with this name is worth reading for credentials. */
+function worthReading(name) {
+    const lower = name.toLowerCase();
+    const dot = lower.lastIndexOf(".");
+    /*
+      A leading dot is the whole name, not an extension: `.env` and `.npmrc`
+      are files called that, and treating `env` as their extension would let
+      the wrong ones through and read the wrong ones twice.
+    */
+    const extension = dot <= 0 ? "" : lower.slice(dot);
+    if (READABLE.has(extension))
+        return true;
+    // Named files with no extension that are nearly always configuration.
+    return ["dockerfile", "makefile", "procfile", "rakefile"].includes(lower);
+}
+/** Whether these first bytes are text rather than something compiled. */
+function looksLikeText(bytes) {
+    /*
+      A NUL byte is the reliable tell. Checking a prefix rather than the whole
+      file keeps this cheap, and a file that is text for its first few kilobytes
+      and binary after is not a shape that occurs by accident.
+    */
+    const upTo = Math.min(bytes.byteLength, 8192);
+    for (let at = 0; at < upTo; at += 1)
+        if (bytes[at] === 0)
+            return false;
+    return true;
+}

package/dist/desktop-app/src/main/worktree.js

@@ -19,6 +19,7 @@ exports.fileDiff = fileDiff;
 exports.projectTree = projectTree;
 exports.evaluateRules = evaluateRules;
 exports.detectPrivateDirectories = detectPrivateDirectories;
+exports.detectPastedCredentials = detectPastedCredentials;
 exports.uploadConcerns = uploadConcerns;
 exports.detectSecrets = detectSecrets;
 /** Reading a project folder: changed files, diffs, and rule measurement. */
@@ -29,6 +30,7 @@ const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const node_util_1 = require("node:util");
 const rules_js_1 = require("./rules.js");
+const secret_patterns_js_1 = require("./secret_patterns.js");
 const run = (0, node_util_1.promisify)(node_child_process_1.execFile);
 /** Past this the evaluation reports truncated rather than walking forever. */
 exports.EVALUATION_FILE_LIMIT = 300_000;
@@ -892,15 +894,84 @@ async function detectPrivateDirectories(root) {
  * behind is not being published, and raising it would train people to dismiss
  * the question that matters.
  */
+/*
+  Bounds for the content scan, stated rather than discovered.
+
+  This reads files, which the name check never did, so it is the one check
+  whose cost grows with the project. A person waiting to publish will not wait
+  long, and a scan they turn off protects nobody — so it reads what it can
+  inside these limits and is honest about stopping.
+*/
+const MOST_SCANNED_FILES = 20_000;
+const MOST_SCANNED_BYTES = 256 * 1024 * 1024;
+/** Past this a file is data, not something somebody pasted a key into. */
+const MOST_FILE_BYTES = 2 * 1024 * 1024;
+/** Enough to make the point; a list of five hundred is not read. */
+const MOST_FINDINGS = 40;
+/**
+ * Credentials sitting inside files that are not credentials.
+ *
+ * The name check finds the files a tool wrote — `.env`, a cached login, an
+ * SSH key. This finds the other kind, and it is the kind nothing caught: a
+ * key pasted into `settings.py` while getting something working, in a file
+ * with an ordinary name that every check waved through.
+ *
+ * Narrowed to the selection, like the rest of the concerns: a file the rules
+ * already leave behind is not being published, and raising it would train
+ * people to dismiss the question that matters.
+ */
+async function detectPastedCredentials(root, include) {
+    const found = [];
+    let read = 0;
+    let bytes = 0;
+    for (const relative of include) {
+        if (found.length >= MOST_FINDINGS)
+            break;
+        if (read >= MOST_SCANNED_FILES || bytes >= MOST_SCANNED_BYTES)
+            break;
+        const name = relative.slice(relative.lastIndexOf("/") + 1);
+        if (!(0, secret_patterns_js_1.worthReading)(name))
+            continue;
+        const full = node_path_1.default.join(root, relative.split("/").join(node_path_1.default.sep));
+        let contents;
+        try {
+            const info = await (0, promises_1.stat)(full);
+            if (!info.isFile() || info.size > MOST_FILE_BYTES)
+                continue;
+            contents = await (0, promises_1.readFile)(full);
+        }
+        catch {
+            /* Unreadable is the scan's problem, not something to report as clean. */
+            continue;
+        }
+        read += 1;
+        bytes += contents.byteLength;
+        if (!(0, secret_patterns_js_1.looksLikeText)(contents))
+            continue;
+        const credentials = (0, secret_patterns_js_1.findCredentials)(contents.toString("utf8"));
+        if (credentials.length)
+            found.push({ path: relative, found: credentials });
+    }
+    return found;
+}
 async function uploadConcerns(root, include) {
     const chosen = new Set(include);
-    const [named, folders] = await Promise.all([
+    const [named, folders, pasted] = await Promise.all([
         detectSecrets(root),
         detectPrivateDirectories(root),
+        detectPastedCredentials(root, include),
     ]);
+    const secrets = named.filter((file) => chosen.has(file));
     return {
-        secrets: named.filter((file) => chosen.has(file)),
+        secrets,
         shielded: folders.filter((finding) => [...chosen].some((file) => file === finding.path || file.startsWith(`${finding.path}/`))),
+        /*
+          A file already refused by name is not raised twice. Saying "this is a
+          credential" and "there is a credential inside it" about the same file
+          is two warnings for one problem, and the first one is the actionable
+          one.
+        */
+        pasted: pasted.filter((finding) => !secrets.includes(finding.path)),
     };
 }
 /** Files the flow must ask about before the first upload. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",