@coderook/cli 0.25.3 → 0.25.4

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.25.3",
+  "version": "0.25.4",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.whoami = whoami;
 exports.projects = projects;
+exports.findPublicProject = findPublicProject;
 exports.findProject = findProject;
 exports.health = health;
 exports.mergeTracks = mergeTracks;
@@ -76,13 +77,77 @@ async function projects() {
         updatedAt: String(row.updatedAt ?? row.createdAt ?? ""),
     }));
 }
-/** Find a project by slug or display name, so either reads naturally. */
+/**
+ * One public project, by the two names that identify it.
+ *
+ * Reachable without an account, which is what public means. Only the lookup
+ * goes this way: once the project has been named, everything else is fetched
+ * through the ordinary repository routes, which already serve a public
+ * project to anybody who asks.
+ */
+async function findPublicProject(owner, slug) {
+    try {
+        const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}`, { headers: { accept: "application/json", ...(0, identify_js_1.clientHeaders)() } });
+        if (!response.ok)
+            return null;
+        const row = (await response.json());
+        if (!row.id)
+            return null;
+        return {
+            id: String(row.id),
+            slug: String(row.slug ?? slug),
+            name: String(row.displayName || row.slug || slug),
+            visibility: String(row.visibility ?? "public"),
+            defaultBranch: String(row.defaultBranch || "main"),
+            versionCount: Number(row.versionCount ?? 0),
+            fileCount: Number(row.fileCount ?? 0),
+            storedBytes: Number(row.storedSize ?? 0),
+            updatedAt: String(row.updatedAt ?? row.createdAt ?? ""),
+        };
+    }
+    catch {
+        /* Offline, or no such project. Either way there is nothing to return. */
+        return null;
+    }
+}
+/**
+ * Find a project by slug or display name, so either reads naturally.
+ *
+ * Your own account first, then — for `owner/slug`, or a name that is not
+ * yours — the public listing.
+ *
+ * Without that second step the only projects reachable by name were your
+ * own, which made `cbx clone somebody/their-project` answer "No project named
+ * … on this account" and `git clone coderook://somebody/their-project` hand
+ * back an empty repository. Both are the instruction printed on every public
+ * project page, aimed at exactly the people who do not own the thing.
+ */
 async function findProject(reference) {
-    const wanted = reference.trim().toLowerCase();
-    const all = await projects();
-    return (all.find((project) => project.slug.toLowerCase() === wanted) ??
-        all.find((project) => project.name.toLowerCase() === wanted) ??
-        null);
+    const trimmed = reference.trim();
+    const slash = trimmed.lastIndexOf("/");
+    const owner = slash > 0 ? trimmed.slice(0, slash) : "";
+    const bare = (slash > 0 ? trimmed.slice(slash + 1) : trimmed).toLowerCase();
+    /*
+      An owner was named, so it is somebody's project rather than a name to
+      guess at. Yours is still checked first: naming yourself is allowed, and
+      the authenticated listing knows about private projects the public one
+      cannot see.
+    */
+    const all = await projects().catch(() => []);
+    const ownersMatch = (project) => project.slug.toLowerCase() === bare || project.name.toLowerCase() === bare;
+    if (!owner) {
+        const mine = all.find(ownersMatch);
+        if (mine)
+            return mine;
+        return null;
+    }
+    const me = await whoami().catch(() => null);
+    if (me && (me.username ?? "").toLowerCase() === owner.toLowerCase()) {
+        const mine = all.find(ownersMatch);
+        if (mine)
+            return mine;
+    }
+    return findPublicProject(owner, bare);
 }
 /** Whether the service is reachable, and what encodings it accepts. */
 async function health() {

package/dist/cli/src/cli.js

@@ -637,6 +637,15 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
           would reject the publication and the import would be lossy.
         */
         ...(hasFlag(parsed, "allow-ignored") ? { allowIgnored: true } : {}),
+        /*
+          The same answer, told to the service.
+    
+          The check above is the one that asks a person, and it is the better
+          place to ask — it is where the files are. But it is also the part an
+          old build or a patched one does not run, so the service asks again and
+          refuses unless this says the question was put and answered.
+        */
+        ...(hasFlag(parsed, "allow-secrets") ? { allowSecrets: true } : {}),
         ...(link ? { known: link.local ?? link.manifest ?? {} } : {}),
     });
     let result;
@@ -925,7 +934,11 @@ async function commandClone(parsed) {
     }
     const project = await (0, api_js_2.findProject)(reference);
     if (!project) {
-        console.error(red(`No project named ${reference} on this account.`));
+        console.error(red(`No project named ${reference}.` +
+            (reference.includes("/")
+                ? " Check the owner and the name, and that it is public."
+                : " It is not on your account — for somebody else's, name them" +
+                    " too: cbx clone <owner>/<project>.")));
         return 1;
     }
     if (!project.versionCount) {

package/dist/cli/src/git_history.js

@@ -51,14 +51,20 @@ function parseRemoteUrl(url) {
         }
     }
     rest = rest.replace(/^\/+/, "").replace(/\/+$/, "");
-    // An owner segment is accepted and ignored: a token already says who this
-    // is, and silently pushing to a different account than the URL named would
-    // be a worse outcome than not supporting the form at all.
+    /*
+      The owner is carried, and what it is used for differs by direction.
+      Fetching honours it, because `coderook://somebody/their-project` is the
+      line printed on every public project page and it has to reach their
+      project rather than look for that name on yours. Pushing still ignores
+      it: the token says who you are, and quietly publishing to an account the
+      URL named instead would be the worse mistake of the two.
+    */
     const parts = rest.split("/").filter(Boolean);
     const slug = parts[parts.length - 1] ?? "";
+    const owner = parts.length > 1 ? parts[parts.length - 2] : "";
     if (!slug)
         throw new Error(`Not a CodeRook remote URL: ${url}`);
-    return { slug };
+    return { owner, slug };
 }
 /**
  * Pull the git commit id back out of a version message, if it carries one.

package/dist/cli/src/git_remote.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AlreadyReported = void 0;
 exports.main = main;
 /**
  * `git push coderook` — a git remote helper.
@@ -110,6 +111,20 @@ const version_js_1 = require("./version.js");
 const publish_js_1 = require("./publish.js");
 const git_history_js_1 = require("./git_history.js");
 const api_js_1 = require("./api.js");
+/** A fetch that cannot be served. Carried out so the process can exit non-zero. */
+class ImportFailed extends Error {
+}
+/**
+ * A failure this code has already explained.
+ *
+ * The entry point prints whatever reaches it, which is right for a surprise
+ * and wrong for a refusal that has just been set out in full — the person
+ * would read the same paragraph twice, the second time with a program name
+ * in front of it.
+ */
+class AlreadyReported extends Error {
+}
+exports.AlreadyReported = AlreadyReported;
 /** Everything the helper writes for a person goes to stderr; stdout is protocol. */
 function say(text) {
     node_process_1.default.stderr.write(`${text}\n`);
@@ -489,12 +504,19 @@ async function recordPushedCommits(marks) {
  * unchanged across a thousand versions is downloaded and sent to git once.
  */
 async function doImport(refs, url) {
-    const { slug } = (0, git_history_js_1.parseRemoteUrl)(url);
-    const project = await (0, api_js_1.findProject)(slug);
+    const { owner, slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+    const project = await (0, api_js_1.findProject)(owner ? `${owner}/${slug}` : slug);
     if (!project) {
-        say(`No CodeRook project called "${slug}", or you cannot read it.`);
+        say(`No CodeRook project called "${owner ? `${owner}/${slug}` : slug}",` +
+            " or you cannot read it.");
+        /*
+          `done` closes the stream cleanly, but git reads "no refs" as "an empty
+          repository" and reports success — so a clone of something that is not
+          there made an empty folder and exited zero. Saying so on the way out is
+          what turns that into a failure the person can see.
+        */
         send("done");
-        return;
+        throw new ImportFailed(`No CodeRook project called "${owner ? `${owner}/${slug}` : slug}", or you cannot read it.`);
     }
     const repositoryId = project.id;
     const state = await remoteState(repositoryId);
@@ -693,7 +715,34 @@ async function doImport(refs, url) {
     }
 }
 async function doPush(requests, url) {
-    const { slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+    /*
+      A push never goes to the account named in the URL — it goes to the one the
+      token belongs to. Publishing somebody's work to a different account on
+      their behalf would be the worse mistake of the two.
+  
+      But it is not enough to ignore the name, now that fetching honours it.
+      The same URL would then read from one account and write to another: a
+      push to `coderook://somebody/their-project` quietly made a private
+      project of that name on your own account and reported success, while git
+      printed "To coderook://somebody/their-project". Saying no is the honest
+      answer, and it leaves the person a working one.
+    */
+    const { owner, slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+    if (owner) {
+        const me = await (0, api_js_1.whoami)().catch(() => null);
+        const mine = (me?.username ?? "").toLowerCase();
+        if (mine && owner.toLowerCase() !== mine) {
+            say(`This remote names ${owner}, and you are signed in as ${mine}.` +
+                ` A push goes to your own account, so it would land somewhere the` +
+                ` URL does not name.`);
+            say(`To publish your own copy: git remote set-url origin coderook://${mine}/${slug}`);
+            for (const request of requests) {
+                send(`error ${request.dst} this remote belongs to ${owner}, not to ${mine}`);
+            }
+            send("");
+            return;
+        }
+    }
     const marks = await readMarks();
     /*
       Re-read the project before every ref, not once before the batch.
@@ -1056,6 +1105,40 @@ async function doPush(requests, url) {
 `);
                         throw error;
                     }
+                    if (failure?.kind === "credentials") {
+                        /*
+                          The one refusal a push cannot answer. `cbx submit` can ask and
+                          be told yes; git has nowhere to put that question, so the way
+                          through is to take the key out — which is the better answer
+                          anyway.
+                        */
+                        send(`error ${request.dst} this commit carries a credential`);
+                        say(`
+  ${failure.message}
+`);
+                        /*
+                          Deleting the file in a later commit does not help, and saying
+                          "take it out and commit again" sends people in circles: a push
+                          publishes every commit as its own version, so the commit that
+                          introduced the key still carries it however many commits follow.
+                          The history has to lose it.
+                        */
+                        say(`  A later commit that deletes it is not enough — every commit` +
+                            ` being pushed
+  becomes a version, and the one that added` +
+                            ` the key still carries it.
+` +
+                            `  Rewrite it out (git rebase -i, or git commit --amend if it` +
+                            ` is the last one),
+  or publish this deliberately with` +
+                            ` cbx submit --allow-secrets.
+`);
+                        /*
+                          Reported already, and in more detail than the wrapper can. The
+                          marker stops the bin printing the same paragraph a second time.
+                        */
+                        throw new AlreadyReported(failure.message);
+                    }
                     if (failure?.kind === "conflict") {
                         send(`error ${request.dst} somebody published to "${branch}" while this push was running`);
                         say(`
@@ -1124,6 +1207,12 @@ async function main(argv) {
     (0, identify_js_1.declareClient)("cli", version_js_1.VERSION);
     const pending = [];
     const importing = [];
+    /*
+      Whether a fetch asked for something that is not there. Git reads "no
+      refs" as "an empty repository" and reports success, so without this a
+      clone of a project you cannot see left an empty folder and exited zero.
+    */
+    let unservable = false;
     for await (const line of lines()) {
         const command = line.trim();
         if (command === "capabilities") {
@@ -1144,8 +1233,35 @@ async function main(argv) {
         }
         if (command === "list" || command === "list for-push") {
             try {
-                const { slug } = (0, git_history_js_1.parseRemoteUrl)(url);
-                const project = await (0, api_js_1.findProject)(slug);
+                const { owner, slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+                const named = owner ? `${owner}/${slug}` : slug;
+                const project = await (0, api_js_1.findProject)(named);
+                /*
+                  A fetch of something that is not there has to say so here.
+        
+                  Git asks `list` first and only asks to import the refs it is
+                  offered, so a project nobody can read never reaches the import at
+                  all — it is simply a listing with nothing in it, which git reports
+                  as an empty repository and calls a success. Refusing at this point
+                  is the only place the answer can still be "no".
+        
+                  `list for-push` is exempt: pushing to a name that does not exist
+                  yet is how a project gets created.
+                */
+                if (command === "list" && !project) {
+                    say(`No CodeRook project called "${named}", or you cannot read it.`);
+                    unservable = true;
+                    /*
+                      The listing is deliberately left unterminated.
+          
+                      An empty but well-formed list is a valid answer meaning "an empty
+                      repository", and git takes it as one: it reports success, leaves
+                      a folder with nothing but .git in it, and ignores whatever the
+                      helper exits with. Ending the conversation instead is the only
+                      answer git reads as a failure.
+                    */
+                    break;
+                }
                 if (command === "list for-push") {
                     const known = await remoteRefs(project?.id ?? null);
                     for (const [ref, sha] of known)
@@ -1228,10 +1344,18 @@ async function main(argv) {
                     await doImport(batch, url);
                 }
                 catch (error) {
-                    say(`Import failed: ${error instanceof Error ? error.message : String(error)}`);
-                    // `done` regardless, so fast-import closes cleanly instead of git
-                    // waiting on a stream that will never end.
-                    send("done");
+                    /*
+                      A project that could not be found has already said so and closed
+                      the stream. Anything else has not, and fast-import would wait on
+                      a stream that never ends.
+                    */
+                    if (error instanceof ImportFailed) {
+                        unservable = true;
+                    }
+                    else {
+                        say(`Import failed: ${error instanceof Error ? error.message : String(error)}`);
+                        send("done");
+                    }
                 }
                 continue;
             }
@@ -1254,5 +1378,5 @@ async function main(argv) {
             continue;
         }
     }
-    return 0;
+    return unservable ? 1 : 0;
 }

package/dist/cli/src/git_remote_bin.js

@@ -14,9 +14,39 @@ Object.defineProperty(exports, "__esModule", { value: true });
 */
 const node_process_1 = __importDefault(require("node:process"));
 const git_remote_js_1 = require("./git_remote.js");
+/**
+ * Finish, without cutting the pipe to git mid-sentence.
+ *
+ * `process.exit()` ends the process immediately, while stdout may still hold
+ * writes queued for git. On Windows that surfaced as
+ *
+ *   Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c
+ *
+ * on the way out of a clone — libuv tearing down a handle that was still
+ * being written to. Setting the code instead lets the loop drain what is
+ * owed and end on its own, which is also the only way git reliably sees the
+ * last of the protocol.
+ *
+ * The timer is the belt: it only fires if something else is still holding
+ * the loop open, and being unreferenced it cannot be the thing holding it.
+ */
+function finish(code) {
+    node_process_1.default.exitCode = code;
+    /* stdin is already at EOF by the time main returns; this releases it. */
+    node_process_1.default.stdin.pause();
+    setTimeout(() => node_process_1.default.exit(code), 5000).unref();
+}
 (0, git_remote_js_1.main)(node_process_1.default.argv.slice(2))
-    .then((code) => node_process_1.default.exit(code))
+    .then(finish)
     .catch((error) => {
-    node_process_1.default.stderr.write(`git-remote-coderook: ${error instanceof Error ? error.message : String(error)}\n`);
-    node_process_1.default.exit(1);
+    /*
+      Said once. A refusal that has already set itself out in full does not
+      want the same paragraph printed again with a program name in front of
+      it — which is what a reader got when a push was turned down for
+      carrying a credential.
+    */
+    if (!(error instanceof git_remote_js_1.AlreadyReported)) {
+        node_process_1.default.stderr.write(`git-remote-coderook: ${error instanceof Error ? error.message : String(error)}\n`);
+    }
+    finish(1);
 });

package/dist/cli/src/publish.js

@@ -15,6 +15,7 @@ function uploadRequestFor(input) {
         baseVersionId: input.baseVersionId,
         ...(input.track ? { track: input.track } : {}),
         ...(input.allowIgnored ? { allowIgnored: true } : {}),
+        ...(input.allowSecrets ? { allowSecrets: true } : {}),
         ...(input.acknowledged ? { acknowledged: true } : {}),
         ...(input.acknowledgedNoLicence ? { acknowledgedNoLicence: true } : {}),
         ...(input.baseVersionId
@@ -29,6 +30,14 @@ function classifyPublishFailure(error) {
     if (code === "merge_required" || code === "track_moved") {
         return { kind: "conflict", message };
     }
+    /*
+      A credential the service refused. Named separately because the answer is
+      not "try again" — it is "take the key out", and for a push there is no
+      flag to pass instead, because git has nowhere to ask the question.
+    */
+    if (code === "version_credentials") {
+        return { kind: "credentials", message };
+    }
     if (!code &&
         /fetch failed|ECONNRESET|socket hang up|network|ETIMEDOUT/i.test(message)) {
         return { kind: "interrupted", message };

package/dist/desktop-app/src/main/secret_patterns.js

@@ -23,6 +23,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CREDENTIAL_PATTERNS = void 0;
 exports.looksLikePlaceholder = looksLikePlaceholder;
 exports.findCredentials = findCredentials;
+exports.maskCredentials = maskCredentials;
+exports.maskAssignedValues = maskAssignedValues;
 exports.worthReading = worthReading;
 exports.looksLikeText = looksLikeText;
 /*
@@ -262,6 +264,78 @@ function findCredentials(text) {
     }
     return found.sort((left, right) => left.line - right.line);
 }
+/**
+ * The same text with any credential in it covered over.
+ *
+ * Used where a file's contents are about to be shown rather than scanned —
+ * the diff pane being the case that mattered. The upload warning is careful
+ * never to repeat a key back, and the pane behind it was printing one in
+ * full, so the same window both refused to show a credential and showed one.
+ *
+ * The prefix survives, because it names the service and is not the secret,
+ * and it is what makes the line recognisable as the one to go and fix. The
+ * rest becomes bullets of the same length, so nothing about the shape of the
+ * value is lost except the value.
+ *
+ * Deliberately built on the same patterns and the same placeholder rule as
+ * `findCredentials`: if the two disagreed, the pane would either cover
+ * something the warning ignored or reveal something it flagged.
+ */
+function maskCredentials(text) {
+    const claimed = [];
+    for (const pattern of exports.CREDENTIAL_PATTERNS) {
+        const expression = new RegExp(pattern.match.source, pattern.match.flags);
+        for (const match of text.matchAll(expression)) {
+            const at = match.index ?? 0;
+            const to = at + match[0].length;
+            if (claimed.some(([from, until]) => at < until && to > from))
+                continue;
+            if (looksLikePlaceholder(match[0]))
+                continue;
+            const value = match[0];
+            const keep = value.slice(0, 7);
+            claimed.push([at, to, `${keep}${"•".repeat(Math.max(3, value.length - 7))}`]);
+        }
+    }
+    if (!claimed.length)
+        return text;
+    claimed.sort((left, right) => left[0] - right[0]);
+    let out = "";
+    let cursor = 0;
+    for (const [at, to, replacement] of claimed) {
+        out += text.slice(cursor, at) + replacement;
+        cursor = to;
+    }
+    return out + text.slice(cursor);
+}
+/**
+ * Every assigned value in a line covered over, whatever shape it is.
+ *
+ * For files that are credentials by their name rather than by their
+ * contents. A `.env` holds `TOKEN=<32 random characters>`: it matches no
+ * service's format, so the pattern scan cannot see it, and the only thing
+ * saying it is a secret is the file it is sitting in. In that file every
+ * value is treated as one.
+ *
+ * The name is kept and the value goes. Which keys are set is the useful part
+ * of the diff — that a line was added, and which setting it was — and none
+ * of that requires showing what it was set to.
+ *
+ * A comment is left alone: it is prose, and blanking it makes the file
+ * unreadable for no gain.
+ */
+function maskAssignedValues(text) {
+    const trimmed = text.trimStart();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("//")) {
+        return text;
+    }
+    return text.replace(/^(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]\s*)(\S.*)$/, (_whole, head, value) => {
+        const bare = value.replace(/^["']|["']$/g, "");
+        if (!bare)
+            return text;
+        return `${head}${"•".repeat(Math.min(24, Math.max(3, bare.length)))}`;
+    });
+}
 /*
   Extensions worth reading. Everything else is either compiled, compressed, or
   media — a credential in a JPEG is not a case worth slowing every upload for,

package/dist/desktop-app/src/main/upload.js

@@ -1162,6 +1162,7 @@ class Uploader {
                     : { expectedHeadVersionId: request.expectedHeadVersionId }),
                 ...(request.track ? { track: request.track } : {}),
                 ...(request.allowIgnored ? { allowIgnored: true } : {}),
+                ...(request.allowSecrets ? { allowSecrets: true } : {}),
                 /*
                   Names this attempt so a retry after a lost connection is answered
                   with the version already made, rather than making a second one.

package/dist/desktop-app/src/main/worktree.js

@@ -21,6 +21,7 @@ exports.evaluateRules = evaluateRules;
 exports.detectPrivateDirectories = detectPrivateDirectories;
 exports.detectPastedCredentials = detectPastedCredentials;
 exports.uploadConcerns = uploadConcerns;
+exports.isCredentialByName = isCredentialByName;
 exports.detectSecrets = detectSecrets;
 /** Reading a project folder: changed files, diffs, and rule measurement. */
 const node_child_process_1 = require("node:child_process");
@@ -54,49 +55,49 @@ async function git(root, ...args) {
  * file would produce an incomplete project that looked backed up, so likely
  * secrets are warned about instead (docs/UPLOAD_POLICY.md).
  */
-exports.STARTER_IGNORE = `# Dependencies and generated output
-node_modules/
-dist/
-build/
-out/
-.next/
-target/
-__pycache__/
-.venv/
-venv/
-*.log
-
-# Large model weights
-models/**
-*.safetensors
-*.ckpt
-*.pt
-*.pth
-
-# Caches and local state
-.venv/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.cache/
-*.pyc
-
-# A browser or Electron profile that has been left in the project folder.
-# These hold files another program keeps open — a LOCK that cannot be read
-# while it runs will stop a save outright — and nothing in them is the work.
-IndexedDB/
-Local Storage/
-Session Storage/
-Service Worker/
-Network/
-GPUCache/
-Code Cache/
-blob_storage/
-Local State
-Preferences
-
-# Archives of the project, inside the project
-*.cbx
+exports.STARTER_IGNORE = `# Dependencies and generated output
+node_modules/
+dist/
+build/
+out/
+.next/
+target/
+__pycache__/
+.venv/
+venv/
+*.log
+
+# Large model weights
+models/**
+*.safetensors
+*.ckpt
+*.pt
+*.pth
+
+# Caches and local state
+.venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.cache/
+*.pyc
+
+# A browser or Electron profile that has been left in the project folder.
+# These hold files another program keeps open — a LOCK that cannot be read
+# while it runs will stop a save outright — and nothing in them is the work.
+IndexedDB/
+Local Storage/
+Session Storage/
+Service Worker/
+Network/
+GPUCache/
+Code Cache/
+blob_storage/
+Local State
+Preferences
+
+# Archives of the project, inside the project
+*.cbx
 `;
 /** The shared rules file, committed with the project. */
 exports.IGNORE_FILE = ".gitignore";
@@ -508,6 +509,21 @@ async function fileSizes(root, files) {
 /** The unified diff for one file, including files git does not track yet. */
 async function fileDiff(root, file, ignoreWhitespace = false) {
     const output = await git(root, "diff", "--no-ext-diff", "--unified=3", ...(ignoreWhitespace ? ["--ignore-all-space"] : []), "--", file);
+    /*
+      What leaves this function is what the window will show, so a credential
+      is covered here rather than in the pane.
+  
+      Masking in the renderer would still have sent the key to the window,
+      where a screenshot, the developer tools or an accidental copy all reach
+      it. Not sending it is the only version of this that actually holds.
+  
+      Two rules, because there are two kinds. A key pasted into ordinary source
+      is recognised by its own format. A `.env` is not — its contents match no
+      service's shape — and is recognised only by the name of the file, so
+      everything after the first `=` on a line goes.
+    */
+    const named = isCredentialByName(file);
+    const cover = (text) => named ? (0, secret_patterns_js_1.maskAssignedValues)(text) : (0, secret_patterns_js_1.maskCredentials)(text);
     const hunks = [];
     let current = null;
     let oldLine = 0;
@@ -532,7 +548,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                 kind: "add",
                 number: newLine++,
                 oldNumber: null,
-                text: raw.slice(1),
+                text: cover(raw.slice(1)),
             });
         }
         else if (raw.startsWith("-")) {
@@ -540,7 +556,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                 kind: "del",
                 number: oldLine,
                 oldNumber: oldLine++,
-                text: raw.slice(1),
+                text: cover(raw.slice(1)),
             });
         }
         else if (raw.startsWith(" ")) {
@@ -548,7 +564,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                 kind: "ctx",
                 number: newLine,
                 oldNumber: oldLine,
-                text: raw.slice(1),
+                text: cover(raw.slice(1)),
             });
             oldLine += 1;
             newLine += 1;
@@ -570,7 +586,7 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
                     kind: "add",
                     number: index + 1,
                     oldNumber: null,
-                    text,
+                    text: cover(text),
                 })),
             },
         ];
@@ -975,6 +991,22 @@ async function uploadConcerns(root, include) {
     };
 }
 /** Files the flow must ask about before the first upload. */
+/**
+ * Whether this path is a credential by its name alone.
+ *
+ * Pulled out of `detectSecrets` so the diff can ask the same question the
+ * upload warning asks. A `.env` holds `TOKEN=<32 random characters>`, which
+ * matches no service's format and so is invisible to the pattern scan — the
+ * only thing that identifies it is the name of the file it is sitting in.
+ */
+function isCredentialByName(relativePath) {
+    const parts = relativePath.split("/");
+    const name = (parts[parts.length - 1] ?? "").toLowerCase();
+    return (SECRET_NAMES.has(name) ||
+        name.startsWith(".env.") ||
+        SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
+        parts.slice(0, -1).includes("secrets"));
+}
 async function detectSecrets(root) {
     const found = [];
     const pending = [root];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.25.3",
+  "version": "0.25.4",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",