@cybedefend/vibedefend 1.2.4 → 1.3.0

package/README.md

@@ -39,7 +39,7 @@ VibeDefend auto-detects and wires whichever of these you have installed.
 | **Business + Security Rules** *(injected pre-edit)* | ✅ | ✅ | ✅ | ⚠️ writes only | ✅ |
 | **Action Guards** *(hard block on deny)* | ✅ all tools | ✅ all tools | ✅ all tools | ⚠️ writes + MCP fallback¹ | ❌ not yet wired |
 | **Session Start** *(loads doctrine + proposals inbox)* | ✅ | ✅ | ✅ | ⚠️ proxied² | ✅ |
-| **Session Review** *(end-of-session gap analysis)* | ✅ | ✅ | ✅ | ✅ | ✅ |
+| **Session Review** *(end-of-session gap analysis + pre-commit diff scan)* | ✅ | ✅ | ✅ | ✅ | ✅ |
 | **PreCompact** *(long-session gap analysis)* | ✅ | ✅ | ❌ no event | ❌ no event | ✅ |
 | **Doctrine backstop** *(per-prompt reminder)* | ✅ | ❌ | ✱ via MCP³ | ❌ | ❌ |
 | **Min version** | latest | ≥ 1.7 | latest | latest | ≥ 1.110 |
@@ -54,6 +54,13 @@ VibeDefend auto-detects and wires whichever of these you have installed.
 
 **Codex setup gotcha:** Codex 0.131+ requires you to approve each hook via the `/hooks` panel inside Codex *before* they fire. After running `vibedefend install`, open Codex, run `/hooks`, and trust the `cybedefend` entries — until you do that the panel will show `Installed N / Active 0`.
 
+**Pre-commit diff scan (on by default):** when Session Review fires, the agent
+is also asked to run a quick **diff scan** (SAST / IaC / secrets) on the files
+it changed this session, via the `cybe_scan_diff` MCP tool — a best-effort
+pre-commit check that complements (never replaces) a full scan. It rides on the
+Session Review hook, so it follows the same edits threshold. Decline it at
+install, or set `"enableDiffScan": false` in `~/.cybedefend/runtime-config.json`.
+
 Unchecked agents stay untouched. Re-run `vibedefend install` later to
 toggle any on or off.
 

package/dist/config.js

@@ -19,15 +19,25 @@ export const REGIONS = [
     },
 ];
 /**
- * Defaults the installer pre-fills for the hook config step. Tuned from the
- * earlier debug sessions: threshold=3 hides typo-fix noise without missing
- * meaningful work; auto-propose stays OFF because policy mutations need an
- * explicit user "yes" in the chat by default.
+ * Defaults the installer pre-fills for the hook config step.
+ *
+ * `reviewThreshold: 1` — the gap-analysis runs after EVERY session (even a
+ * single edit). It is a safety net: running the review is decoupled from
+ * proposing a rule. Restraint against over-proposing lives in the review
+ * PROMPT (see `composeReviewBody` in hooks/runtime/session-review.ts), which
+ * proposes at most one rule and only for a durable, reusable invariant — so a
+ * low threshold surfaces genuine gaps without spamming proposals. Raise it if
+ * a team finds the nudge too noisy. `autoProposeMode` stays OFF because policy
+ * mutations need an explicit user "yes" in the chat by default.
  */
 export const HOOK_DEFAULTS = {
     enableSessionReview: true,
-    reviewThreshold: 3,
+    reviewThreshold: 1,
     autoProposeMode: false,
     autoUpdate: true,
+    // Pre-commit diff scan ON by default: the Stop hook asks the agent to scan
+    // the files it changed (cybe_scan_diff) before the user commits. Opt-out at
+    // install. Rides on session-review, so it only fires when that hook is on.
+    enableDiffScan: true,
 };
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAgCA,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kFAAkF;QACpF,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;KACX;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;KACX;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;CACR,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAgCA,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kFAAkF;QACpF,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;KACX;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;KACX;CACO,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;IAChB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,cAAc,EAAE,IAAI;CACZ,CAAC"}

package/dist/doctor.js

@@ -18,14 +18,31 @@ import { HOOK_DEFAULTS } from './config.js';
 import { log } from './utils.js';
 import { pkg } from './version.js';
 /**
- * The hook tunables persisted in `runtime-config.json` and the install-time
- * `HookConfig` share the exact same shape, so a loaded `RuntimeConfig.hooks`
- * is a valid `HookConfig`. Fall back to `HOOK_DEFAULTS` when the config file
- * is absent or corrupt.
+ * Resolve the install-time `HookConfig` from the persisted `RuntimeConfig`.
+ *
+ * `RuntimeConfig.hooks` is nearly the install-time `HookConfig` shape, except
+ * `enableDiffScan` is optional on disk (configs written before that feature
+ * shipped omit it). We backfill it from `HOOK_DEFAULTS` so a doctor repair
+ * re-renders a complete, explicit config. Falls back to `HOOK_DEFAULTS`
+ * entirely when the config file is absent or corrupt.
  */
 function resolveHookConfig() {
-    const cfg = loadRuntimeConfig();
-    return cfg?.hooks ?? { ...HOOK_DEFAULTS };
+    return resolveHookConfigFrom(loadRuntimeConfig()?.hooks);
+}
+/**
+ * Pure backfill: given the persisted `RuntimeConfig.hooks` (or `undefined`
+ * when no config exists), return a complete `HookConfig`. `enableDiffScan` is
+ * defaulted from `HOOK_DEFAULTS` when absent so the default-on rollout reaches
+ * legacy configs, while an explicit `false` is preserved (opt-out survives a
+ * doctor repair). Exported for unit testing.
+ */
+export function resolveHookConfigFrom(hooks) {
+    if (!hooks)
+        return { ...HOOK_DEFAULTS };
+    return {
+        ...hooks,
+        enableDiffScan: hooks.enableDiffScan ?? HOOK_DEFAULTS.enableDiffScan,
+    };
 }
 /** Pure: derive the repair list from a gathered state. */
 export function deriveRepairs(state) {

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,OAAO,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,yDAAyD;SACvE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,qEAAqE;YACvE,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,0EAA0E;YAC5E,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;gBACnB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,2DAA2D;gBAClF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;oBAClC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;wBAC7B,OAAO,EAAE,EAAE;wBACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;wBAC9C,MAAM;wBACN,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE;gBACjB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,mEAAmE;gBAC1F,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrC,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,WAAW;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,GAAI,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,EAAE,MACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC;;;;;;;;GAQG;AACH,SAAS,iBAAiB;IACxB,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyC;IAEzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACxC,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;KACrE,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,yDAAyD;SACvE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,qEAAqE;YACvE,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,0EAA0E;YAC5E,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;gBACnB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,2DAA2D;gBAClF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;oBAClC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;wBAC7B,OAAO,EAAE,EAAE;wBACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;wBAC9C,MAAM;wBACN,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE;gBACjB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,mEAAmE;gBAC1F,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrC,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,WAAW;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,GAAI,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,EAAE,MACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACxD,CAAC"}

package/dist/guards-evaluator/redact.js

@@ -41,6 +41,31 @@ const PATTERNS = [
         re: /AKIA[0-9A-Z]{16}/g,
         captureIndex: null,
     },
+    // 4b. Anthropic API key (matched before the generic sk- pattern below)
+    {
+        re: /sk-ant-[0-9A-Za-z_-]{16,}/g,
+        captureIndex: null,
+    },
+    // 4c. OpenAI API key
+    {
+        re: /sk-[0-9A-Za-z]{20,}/g,
+        captureIndex: null,
+    },
+    // 4d. Google API key
+    {
+        re: /AIza[0-9A-Za-z_-]{35,}/g,
+        captureIndex: null,
+    },
+    // 4e. Slack token (bot/user/app/refresh/legacy)
+    {
+        re: /xox[baprs]-[0-9A-Za-z-]{10,}/g,
+        captureIndex: null,
+    },
+    // 4f. Credentials embedded in a URL: scheme://user:pass@host — redact user:pass
+    {
+        re: /(?<=:\/\/)[^/\s:@]+:[^/\s:@]+(?=@)/g,
+        captureIndex: null,
+    },
     // 5. Bearer token — preserve the "Bearer " keyword, replace only the token.
     //    Group 1 = the prefix ("Bearer "), group 2 = the token value.
     {

package/dist/guards-evaluator/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/guards-evaluator/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAiB9B,MAAM,QAAQ,GAAmB;IAC/B,sDAAsD;IACtD;QACE,EAAE,EAAE,oDAAoD;QACxD,YAAY,EAAE,IAAI;KACnB;IACD,gBAAgB;IAChB;QACE,EAAE,EAAE,sBAAsB;QAC1B,YAAY,EAAE,IAAI;KACnB;IACD,sCAAsC;IACtC;QACE,EAAE,EAAE,oCAAoC;QACxC,YAAY,EAAE,IAAI;KACnB;IACD,uBAAuB;IACvB;QACE,EAAE,EAAE,mBAAmB;QACvB,YAAY,EAAE,IAAI;KACnB;IACD,4EAA4E;IAC5E,kEAAkE;IAClE;QACE,EAAE,EAAE,8BAA8B;QAClC,YAAY,EAAE,CAAC;KAChB;IACD,4EAA4E;IAC5E;QACE,EAAE,EAAE,oBAAoB;QACxB,YAAY,EAAE,IAAI;KACnB;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,mCAAmC;IACnC;QACE,EAAE,EAAE,iIAAiI;QACrI,YAAY,EAAE,IAAI;KACnB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,KAAK,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC5C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QAEjB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjD,yDAAyD;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAC;gBAC7C,0DAA0D;gBAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,IAAI,GAAG,GAAG,CAAC,CAAC;gBACZ,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBACpD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;wBACpB,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;wBAC5C,OAAO,IAAI,EAAE,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACzD,GAAG,GAAG,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;oBACrC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/guards-evaluator/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAiB9B,MAAM,QAAQ,GAAmB;IAC/B,sDAAsD;IACtD;QACE,EAAE,EAAE,oDAAoD;QACxD,YAAY,EAAE,IAAI;KACnB;IACD,gBAAgB;IAChB;QACE,EAAE,EAAE,sBAAsB;QAC1B,YAAY,EAAE,IAAI;KACnB;IACD,sCAAsC;IACtC;QACE,EAAE,EAAE,oCAAoC;QACxC,YAAY,EAAE,IAAI;KACnB;IACD,uBAAuB;IACvB;QACE,EAAE,EAAE,mBAAmB;QACvB,YAAY,EAAE,IAAI;KACnB;IACD,uEAAuE;IACvE;QACE,EAAE,EAAE,4BAA4B;QAChC,YAAY,EAAE,IAAI;KACnB;IACD,qBAAqB;IACrB;QACE,EAAE,EAAE,sBAAsB;QAC1B,YAAY,EAAE,IAAI;KACnB;IACD,qBAAqB;IACrB;QACE,EAAE,EAAE,yBAAyB;QAC7B,YAAY,EAAE,IAAI;KACnB;IACD,gDAAgD;IAChD;QACE,EAAE,EAAE,+BAA+B;QACnC,YAAY,EAAE,IAAI;KACnB;IACD,gFAAgF;IAChF;QACE,EAAE,EAAE,qCAAqC;QACzC,YAAY,EAAE,IAAI;KACnB;IACD,4EAA4E;IAC5E,kEAAkE;IAClE;QACE,EAAE,EAAE,8BAA8B;QAClC,YAAY,EAAE,CAAC;KAChB;IACD,4EAA4E;IAC5E;QACE,EAAE,EAAE,oBAAoB;QACxB,YAAY,EAAE,IAAI;KACnB;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,mCAAmC;IACnC;QACE,EAAE,EAAE,iIAAiI;QACrI,YAAY,EAAE,IAAI;KACnB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,KAAK,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC5C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QAEjB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjD,yDAAyD;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAC;gBAC7C,0DAA0D;gBAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,IAAI,GAAG,GAAG,CAAC,CAAC;gBACZ,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBACpD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;wBACpB,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;wBAC5C,OAAO,IAAI,EAAE,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACzD,GAAG,GAAG,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;oBACrC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}