@intentius/chant 0.54.0 → 0.54.2

package/dist/audit/discover.d.ts

@@ -63,6 +63,15 @@ export declare function ciLexiconForPath(path: string): AuditLexicon | undefined
 /**
  * Whether a path is worth reading/fetching at all. Bounds the local walk and,
  * crucially, the remote fetch (so we never pull a whole repo's contents).
+ *
+ * nginx configs (#1979) ride along the way `wrangler.toml` does: the NGX
+ * scanner (`./nginx.ts`) reads them directly, no lexicon plugin — but a
+ * scanner can only see what this filter admits, so its own path detector is
+ * part of the candidate set. (Found the hard way: the checks shipped wired
+ * into the CLI while no `.conf` ever survived collection, so they were
+ * unreachable on both the local and hosted paths.) Content confirmation —
+ * a `conf.d/` file that isn't nginx — happens at parse time in the scanner,
+ * never here.
  */
 export declare function isCandidatePath(path: string): boolean;
 /**

package/dist/audit/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,sGAAuG,CAAC;AAEnI;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAgLD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB1D"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,sGAAuG,CAAC;AAEnI;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAgLD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB1D"}

package/dist/audit/secrets.d.ts

@@ -86,10 +86,7 @@ export declare const ENTROPY_RULE_ID = "SEC010";
  * trigger it.
  */
 export declare function looksLikeIdentifierSlug(value: string): boolean;
-/**
- * Scan a set of files for likely secrets/credentials. Pure with respect to
- * the filesystem and network. Findings never carry the matched value —
- * only its rule id, kind, file/line, and a redaction-safe fingerprint.
- */
+/** Is this a dependency lockfile the secrets scan should skip? */
+export declare function isLockfilePath(path: string): boolean;
 export declare function scanForSecrets(files: ScannableFile[], opts?: SecretsScanOptions): AuditFinding[];
 //# sourceMappingURL=secrets.d.ts.map

package/dist/audit/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAsCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAkEpG"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAqED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAmEpG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.54.0",
+  "version": "0.54.2",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/discover.ts

@@ -33,6 +33,7 @@ import { basename, join, relative } from "path";
 import { parseYAML } from "../yaml";
 import type { LexiconPlugin } from "../lexicon";
 import type { AuditInput, AuditLexicon } from "./core";
+import { isNginxConfigPath } from "./nginx";
 
 /** Lexicons the auditor knows how to detect and run checks for. */
 export const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"] as const;
@@ -267,6 +268,15 @@ export function ciLexiconForPath(path: string): AuditLexicon | undefined {
 /**
  * Whether a path is worth reading/fetching at all. Bounds the local walk and,
  * crucially, the remote fetch (so we never pull a whole repo's contents).
+ *
+ * nginx configs (#1979) ride along the way `wrangler.toml` does: the NGX
+ * scanner (`./nginx.ts`) reads them directly, no lexicon plugin — but a
+ * scanner can only see what this filter admits, so its own path detector is
+ * part of the candidate set. (Found the hard way: the checks shipped wired
+ * into the CLI while no `.conf` ever survived collection, so they were
+ * unreachable on both the local and hosted paths.) Content confirmation —
+ * a `conf.d/` file that isn't nginx — happens at parse time in the scanner,
+ * never here.
  */
 export function isCandidatePath(path: string): boolean {
   const name = basename(path);
@@ -275,6 +285,7 @@ export function isCandidatePath(path: string): boolean {
   if (name === "Chart.yaml") return true;
   if (isSecretBearingName(name)) return true;
   if (isWranglerConfigName(name)) return true;
+  if (isNginxConfigPath(path)) return true;
   return /\.(ya?ml|json|template)$/i.test(name);
 }
 

package/src/audit/secrets.test.ts

@@ -300,4 +300,19 @@ describe("scanForSecrets — file handling", () => {
     expect(findings[0].severity).toBe("error");
     expect(findings[0].lexicon).toBe("secrets");
   });
+
+  test("dependency lockfiles are skipped entirely — integrity hashes are not secrets", () => {
+    // The exact false-positive class that failed the first dogfooding repo:
+    // one lockfile's sha512 integrity fields read as hundreds of SEC010s.
+    const integrity = `"integrity": "sha512-${"a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0u1V2w3X4y5Z6".repeat(2)}"`;
+    for (const path of ["package-lock.json", "web/package-lock.json", "yarn.lock", "pnpm-lock.yaml", "Cargo.lock", "go.sum"]) {
+      expect(scanForSecrets([{ path, content: `${integrity}\n` }]), path).toEqual([]);
+    }
+    // Even a real credential shape stays silent there — the file is skipped,
+    // not entropy-tuned; a credential does not live in a machine-written
+    // lockfile, and per-file skipping is what keeps the rule explainable.
+    expect(scanForSecrets([{ path: "package-lock.json", content: `${FAKE_AWS_KEY}\n` }])).toEqual([]);
+    // A non-lockfile with the same content still fires.
+    expect(scanForSecrets([{ path: "config.json", content: `${integrity}\n` }]).length).toBeGreaterThan(0);
+  });
 });

package/src/audit/secrets.ts

@@ -337,6 +337,38 @@ function lineNumberFor(starts: number[], index: number): number {
  * the filesystem and network. Findings never carry the matched value —
  * only its rule id, kind, file/line, and a redaction-safe fingerprint.
  */
+/**
+ * Machine-generated dependency lockfiles. Skipped entirely: they are wall-to-
+ * wall content-integrity hashes (`sha512-…` and friends), which the entropy
+ * heuristic reads as hundreds of "possible secrets" per file — a single
+ * `package-lock.json` produced 438 merge-worthy SEC010 findings on the first
+ * repo that dogfooded this at `--fail-on merge-worthy`. Integrity hashes are
+ * public by construction, a credential does not live in a lockfile, and no
+ * other scanner reads them.
+ */
+const LOCKFILE_NAMES = new Set([
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lock",
+  "deno.lock",
+  "Cargo.lock",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "composer.lock",
+  "Gemfile.lock",
+  "go.sum",
+  "flake.lock",
+]);
+
+/** Is this a dependency lockfile the secrets scan should skip? */
+export function isLockfilePath(path: string): boolean {
+  const name = path.split("/").pop() ?? path;
+  return LOCKFILE_NAMES.has(name);
+}
+
 export function scanForSecrets(files: ScannableFile[], opts: SecretsScanOptions = {}): AuditFinding[] {
   const entropyThreshold = opts.entropyThreshold ?? DEFAULT_ENTROPY_THRESHOLD;
   const entropyMinLength = opts.entropyMinLength ?? DEFAULT_ENTROPY_MIN_LENGTH;
@@ -347,6 +379,7 @@ export function scanForSecrets(files: ScannableFile[], opts: SecretsScanOptions
 
   for (const file of files) {
     if (!file.content) continue;
+    if (isLockfilePath(file.path)) continue;
     const lines = file.content.split("\n");
     const starts = lineStarts(file.content);
     const claimed: Array<[number, number]> = [];

package/src/cli/commands/audit.test.ts

@@ -614,3 +614,38 @@ describe("Wrangler config audit (#446)", () => {
     rmSync(dir, { recursive: true, force: true });
   });
 });
+
+describe("nginx config audit (#1979)", () => {
+  function tmpRepo(): string {
+    const dir = join(tmpdir(), `chant-audit-nginx-${process.pid}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+  }
+
+  test("audits an nginx config end to end, even when no lexicon is installed", async () => {
+    // The whole-path proof the family shipped without: an nginx file must
+    // survive candidate COLLECTION (isCandidatePath) before the NGX scanner
+    // can ever see it — a scanner-level unit test cannot catch a filter that
+    // drops the file first.
+    const dir = tmpRepo();
+    mkdirSync(join(dir, "nginx"), { recursive: true });
+    writeFileSync(
+      join(dir, "nginx", "default.conf"),
+      "server {\n  listen 80;\n  location /files {\n    autoindex on;\n  }\n}\n",
+    );
+    const result = await auditCommand({ path: dir, plugins: [], format: "json" });
+    expect(result.status).toBe("no-lexicons"); // no lexicon installed — still not a clean miss
+    expect(result.findings.map((f) => f.checkId)).toContain("NGX003");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("a systemd-style conf.d drop-in is collected but contributes nothing (content-confirmed)", async () => {
+    const dir = tmpRepo();
+    mkdirSync(join(dir, "conf.d"), { recursive: true });
+    writeFileSync(join(dir, "conf.d", "override.conf"), "[Service]\nRestart=always\n");
+    const result = await auditCommand({ path: dir, plugins: [] });
+    expect(result.success).toBe(true);
+    expect(result.findings.map((f) => f.checkId)).not.toEqual(expect.arrayContaining([expect.stringMatching(/^NGX/)]));
+    rmSync(dir, { recursive: true, force: true });
+  });
+});