@pretense/cli 0.6.16 → 0.6.18

package/dist/{chunk-MH6CXHTM.js → chunk-QT5E625F.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.16" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.18" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-MH6CXHTM.js";
+} from "./chunk-QT5E625F.js";
 import {
   __commonJS,
   __toESM,
@@ -3892,10 +3892,10 @@ var Minipass = class extends EventEmitter {
    * Return a void Promise that resolves once the stream ends.
    */
   async promise() {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       this.on(DESTROYED, () => reject(new Error("stream destroyed")));
       this.on("error", (er) => reject(er));
-      this.on("end", () => resolve7());
+      this.on("end", () => resolve8());
     });
   }
   /**
@@ -3919,7 +3919,7 @@ var Minipass = class extends EventEmitter {
         return Promise.resolve({ done: false, value: res });
       if (this[EOF])
         return stop();
-      let resolve7;
+      let resolve8;
       let reject;
       const onerr = (er) => {
         this.off("data", ondata);
@@ -3933,19 +3933,19 @@ var Minipass = class extends EventEmitter {
         this.off("end", onend);
         this.off(DESTROYED, ondestroy);
         this.pause();
-        resolve7({ value, done: !!this[EOF] });
+        resolve8({ value, done: !!this[EOF] });
       };
       const onend = () => {
         this.off("error", onerr);
         this.off("data", ondata);
         this.off(DESTROYED, ondestroy);
         stop();
-        resolve7({ done: true, value: void 0 });
+        resolve8({ done: true, value: void 0 });
       };
       const ondestroy = () => onerr(new Error("stream destroyed"));
       return new Promise((res2, rej) => {
         reject = rej;
-        resolve7 = res2;
+        resolve8 = res2;
         this.once(DESTROYED, ondestroy);
         this.once("error", onerr);
         this.once("end", onend);
@@ -4917,9 +4917,9 @@ var PathBase = class {
     if (this.#asyncReaddirInFlight) {
       await this.#asyncReaddirInFlight;
     } else {
-      let resolve7 = () => {
+      let resolve8 = () => {
       };
-      this.#asyncReaddirInFlight = new Promise((res) => resolve7 = res);
+      this.#asyncReaddirInFlight = new Promise((res) => resolve8 = res);
       try {
         for (const e of await this.#fs.promises.readdir(fullpath, {
           withFileTypes: true
@@ -4932,7 +4932,7 @@ var PathBase = class {
         children.provisional = 0;
       }
       this.#asyncReaddirInFlight = void 0;
-      resolve7();
+      resolve8();
     }
     return children.slice(0, children.provisional);
   }
@@ -10413,7 +10413,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve7) => setTimeout(resolve7));
+            await new Promise((resolve8) => setTimeout(resolve8));
             maxReadCount = 3;
             continue;
           }
@@ -14408,7 +14408,7 @@ import { createHmac, hkdfSync, randomBytes as randomBytes2 } from "crypto";
 import { createHash, randomBytes } from "crypto";
 import { readFileSync as readFileSync4, existsSync as existsSync22 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join22, dirname, parse } from "path";
+import { join as join22, dirname, parse, resolve } from "path";
 import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
 import { join as join4 } from "path";
@@ -14481,6 +14481,7 @@ function tighten(path2, exact, kind) {
     );
   }
 }
+var PROJECT_ROOT_ENV = "PRETENSE_PROJECT_ROOT";
 var KEYS_DIR_NAME = join22(".pretense", "keys");
 function keysDir() {
   return join22(homedir2(), KEYS_DIR_NAME);
@@ -14503,7 +14504,25 @@ var PROJECT_MARKERS = [
   ".hg",
   ".svn"
 ];
+function markersAt(dir, home) {
+  return dir === home ? PROJECT_MARKERS.filter((m) => m !== ".pretense") : PROJECT_MARKERS;
+}
 function findProjectRoot(filePath) {
+  let dir = dirname(filePath);
+  const { root } = parse(dir);
+  const startDir = dir;
+  const home = homedir2();
+  while (true) {
+    if (markersAt(dir, home).some((m) => existsSync22(join22(dir, m)))) {
+      return dir;
+    }
+    if (dir === root) return startDir;
+    const parent = dirname(dir);
+    if (parent === dir) return startDir;
+    dir = parent;
+  }
+}
+function legacyFindProjectRoot(filePath) {
   let dir = dirname(filePath);
   const { root } = parse(dir);
   const startDir = dir;
@@ -14517,6 +14536,21 @@ function findProjectRoot(filePath) {
     dir = parent;
   }
 }
+function resolveProjectRoot(filePath) {
+  const override2 = process.env[PROJECT_ROOT_ENV];
+  if (override2 && override2.trim()) return resolve(override2.trim());
+  return findProjectRoot(filePath);
+}
+function candidateProjectRoots(filePath) {
+  const out = [];
+  const override2 = process.env[PROJECT_ROOT_ENV];
+  if (override2 && override2.trim()) out.push(resolve(override2.trim()));
+  out.push(findProjectRoot(filePath));
+  out.push(dirname(filePath));
+  out.push(legacyFindProjectRoot(filePath));
+  const seen = /* @__PURE__ */ new Set();
+  return out.filter((r) => seen.has(r) ? false : (seen.add(r), true));
+}
 function findProjectRootForDir(dir) {
   return findProjectRoot(join22(dir, "__pretense_probe__"));
 }
@@ -16335,7 +16369,7 @@ import { join as join5 } from "path";
 import { parse as parseYaml } from "yaml";
 import { readFileSync as readFileSync23 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname3, join as join23, resolve } from "path";
+import { dirname as dirname3, join as join23, resolve as resolve2 } from "path";
 import https from "https";
 
 // ../packages/tls/dist/index.js
@@ -16471,7 +16505,7 @@ function versionFromCliPackageJson() {
         }
       } catch {
       }
-      const parent = resolve(dir, "..");
+      const parent = resolve2(dir, "..");
       if (parent === dir) break;
       dir = parent;
     }
@@ -16480,11 +16514,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.16" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.18" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "65c9faca2983b357369c6f91aa0cad0cf3a70b82".length > 0 ? "65c9faca2983b357369c6f91aa0cad0cf3a70b82" : UNKNOWN_COMMIT;
+  return "220d098b1829361f3d0043fb24275e5fdfb84429".length > 0 ? "220d098b1829361f3d0043fb24275e5fdfb84429" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -17235,6 +17269,57 @@ function toSecretFindings(matches) {
 function isBase64Blob(text) {
   return text.length >= 256 && !/\s/.test(text) && /^[A-Za-z0-9+/_=-]+$/.test(text);
 }
+var BLOB_SECRET_INDICATORS = [
+  /AKIA[0-9A-Z]{16}/,
+  // AWS access key id
+  /ASIA[0-9A-Z]{16}/,
+  // AWS temporary access key id
+  /gh[opsu]_[A-Za-z0-9]{36}/,
+  // GitHub PAT / OAuth / app / refresh
+  /github_pat_[0-9A-Za-z_]{22,}/,
+  // GitHub fine-grained PAT
+  /sk-ant-[A-Za-z0-9_-]{24,}/,
+  // Anthropic API key
+  /sk_live_[A-Za-z0-9]{20,}/,
+  // Stripe live secret key
+  /rk_live_[A-Za-z0-9]{20,}/,
+  // Stripe live restricted key
+  /AIza[0-9A-Za-z_-]{35}/,
+  // Google API key
+  /xox[baprs]-[0-9A-Za-z-]{10,}/,
+  // Slack token
+  /npm_[A-Za-z0-9]{36}/,
+  // npm token
+  /glpat-[0-9A-Za-z_-]{20}/,
+  // GitLab PAT
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/
+  // PEM private key banner
+];
+function blobSecretIndicator(text) {
+  for (const re of BLOB_SECRET_INDICATORS) {
+    if (re.test(text)) return re.source.slice(0, 24);
+  }
+  return null;
+}
+var BLOB_DECODE_SCAN_MAX_CHARS = 4 * 1024 * 1024;
+function decodedTextIfLikelyText(text) {
+  if (text.length > BLOB_DECODE_SCAN_MAX_CHARS) return null;
+  let buf;
+  try {
+    buf = Buffer.from(text.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+  } catch {
+    return null;
+  }
+  if (buf.length === 0) return null;
+  const sample = Math.min(buf.length, 4096);
+  let printable = 0;
+  for (let i = 0; i < sample; i++) {
+    const b = buf[i] ?? 0;
+    if (b === 9 || b === 10 || b === 13 || b >= 32 && b <= 126) printable++;
+  }
+  if (printable / sample < 0.85) return null;
+  return buf.toString("utf8");
+}
 var CONTROL_CHAR_RE = /[\u0000-\u001f]/;
 var CONTROL_CHAR_RE_G = /[\u0000-\u001f]/g;
 function tokenizeBodyDeep(body, scanText, derivation) {
@@ -17272,11 +17357,39 @@ function tokenizeBodyDeep(body, scanText, derivation) {
     }
     return out;
   };
-  const tokenizeLeaf = (text) => {
-    if (isBase64Blob(text)) {
-      skippedUnscannable++;
-      return text;
+  const redactWholeBlob = (text, type) => {
+    const { content, mutations } = mutateSecrets(
+      text,
+      [{ value: text, offset: 0, length: text.length, type }],
+      derivation
+    );
+    for (const mu of mutations) {
+      if (!secretMap.has(mu.replacement)) secretMap.set(mu.replacement, mu.original);
+    }
+    foundTypes.add(type);
+    secretsTokenized++;
+    return content;
+  };
+  const scanBlobLeaf = (text) => {
+    const ind = blobSecretIndicator(text);
+    if (ind) return redactWholeBlob(text, `unscannable-blob:${ind}`);
+    const decoded = decodedTextIfLikelyText(text);
+    if (decoded !== null) {
+      const s = scanText(decoded);
+      if (s.incomplete) {
+        scanIncomplete = true;
+        droppedFindings += s.limits.droppedFindings;
+        for (const r of s.limits.reasons) incompleteReasons.add(r);
+      }
+      if (toSecretFindings(s.matches).length > 0) {
+        return redactWholeBlob(text, "unscannable-blob:encoded-secret");
+      }
     }
+    skippedUnscannable++;
+    return text;
+  };
+  const tokenizeLeaf = (text) => {
+    if (isBase64Blob(text)) return scanBlobLeaf(text);
     return tokenizeText(text);
   };
   const stack = [body];
@@ -17989,14 +18102,14 @@ if (isMain) {
 init_esm_shims();
 import net from "net";
 function isPortFree(port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const srv = net.createServer();
     srv.once("error", () => {
-      srv.close(() => resolve7(false));
-      resolve7(false);
+      srv.close(() => resolve8(false));
+      resolve8(false);
     });
     srv.once("listening", () => {
-      srv.close(() => resolve7(true));
+      srv.close(() => resolve8(true));
     });
     srv.listen(port);
   });
@@ -18662,7 +18775,7 @@ import { Command as Command5, Option, InvalidArgumentError as InvalidArgumentErr
 import chalk5 from "chalk";
 import { readFileSync as readFileSync8, statSync as statSync3, readdirSync as readdirSync2, openSync, readSync, closeSync } from "fs";
 import { execSync as execSync3 } from "child_process";
-import { resolve as resolve2, join as join8, extname as extname2, basename } from "path";
+import { resolve as resolve3, join as join8, extname as extname2, basename } from "path";
 
 // src/safe-output.ts
 init_esm_shims();
@@ -18789,7 +18902,7 @@ function isBinaryFile(filePath) {
 }
 var SEVERITY_ORDER = { low: 0, medium: 1, high: 2, critical: 3 };
 function collectFiles(target) {
-  const abs = resolve2(target);
+  const abs = resolve3(target);
   let stat;
   try {
     stat = statSync3(abs);
@@ -20469,7 +20582,7 @@ import {
   readFileSync as readFileSync13,
   mkdirSync as mkdirSync3
 } from "fs";
-import { join as join15, resolve as resolve3 } from "path";
+import { join as join15, resolve as resolve4 } from "path";
 var HOOK_SCRIPTS = {
   "pre-commit": `#!/bin/sh
 # Pretense AI Firewall \u2014 pre-commit hook
@@ -20511,7 +20624,7 @@ function installCommand() {
     "-m, --mode <mode>",
     "Hook mode: pre-commit, pre-push (omit to install both)"
   ).option("-f, --force", "Overwrite existing hooks without prompting", false).option("-d, --dir <path>", "Project directory (defaults to cwd)", ".").action((opts) => {
-    const dir = resolve3(opts.dir);
+    const dir = resolve4(opts.dir);
     const force = opts.force;
     const modeArg = opts.mode;
     if (modeArg && !VALID_MODES.includes(modeArg)) {
@@ -20887,7 +21000,7 @@ init_esm_shims();
 import { Command as Command15 } from "commander";
 import chalk14 from "chalk";
 import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17, resolve as resolve4 } from "path";
+import { join as join17, resolve as resolve5 } from "path";
 var DEFAULT_CONFIG_YAML = `scan:
   secrets: block
   pii: redact
@@ -20914,7 +21027,7 @@ verbose: false
 `;
 function quickstartCommand() {
   return new Command15("quickstart").description("One-command setup: init + install hooks + show next steps").option("-d, --dir <path>", "Directory to scan", ".").option("--dry-run", "Print what would be written without writing", false).action(async (opts) => {
-    const dir = resolve4(opts.dir);
+    const dir = resolve5(opts.dir);
     console.log(chalk14.bold.cyan("\n  Pretense Quickstart\n"));
     console.log(chalk14.dim("  Setting up AI firewall for this project...\n"));
     console.log(chalk14.dim("  [1/4] Scanning codebase..."));
@@ -20971,7 +21084,7 @@ import { Command as Command16, Option as Option2 } from "commander";
 import chalk16 from "chalk";
 import { readFileSync as readFileSync15, writeFileSync as writeFileSync7, chmodSync as chmodSync4, existsSync as existsSync15 } from "fs";
 import { createHash as createHash3 } from "crypto";
-import { resolve as resolve5, extname as extname4 } from "path";
+import { resolve as resolve6, extname as extname4 } from "path";
 
 // src/secret-crypto.ts
 init_esm_shims();
@@ -21156,7 +21269,7 @@ function preflightReversalMap(mapPath, absFile, content, contentSha, force) {
     to overwrite it deliberately.`
     };
   }
-  const existingFile = existing.file ? resolve5(existing.file) : void 0;
+  const existingFile = existing.file ? resolve6(existing.file) : void 0;
   if (existingFile && existingFile !== absFile) {
     if (force) {
       return { action: "write", generation: 1, supersededSha: existing.originalSha };
@@ -21326,8 +21439,8 @@ async function runMutate(file, opts = {}) {
     return 0;
   }
   reportUnmutatable(unmutatable);
-  const absFile = resolve5(file);
-  const projectRoot = findProjectRoot(absFile);
+  const absFile = resolve6(file);
+  const projectRoot = resolveProjectRoot(absFile);
   const result = mutateSecrets(content, findings, { projectRoot, keysDir: opts.keysDir });
   let effectiveMap;
   if (preview) {
@@ -21480,7 +21593,7 @@ init_esm_shims();
 import { Command as Command17 } from "commander";
 import chalk17 from "chalk";
 import { readFileSync as readFileSync16, existsSync as existsSync16, statSync as statSync6 } from "fs";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 import { createHash as createHash4 } from "crypto";
 function sha256Hex3(s) {
   return createHash4("sha256").update(s, "utf8").digest("hex");
@@ -21539,7 +21652,7 @@ function loadReversalMap(mapPath) {
 }
 function runReverse(file, opts = {}) {
   const reverseStartMs = Date.now();
-  const absPath = resolve6(file);
+  const absPath = resolve7(file);
   if (!existsSync16(absPath) || !statSync6(absPath).isFile()) {
     console.error(chalk17.red(`
   x File not found: ${file}
@@ -21561,30 +21674,41 @@ function runReverse(file, opts = {}) {
   const mapFile = loadReversalMap(mapPath);
   let plainMutations;
   if (mapFile.encrypted) {
-    const projectRoot = findProjectRoot(mapFile.file ?? absPath);
-    const key = readProjectKey(projectRoot, opts.keysDir);
-    if (!key) {
-      console.error(
-        chalk17.red(`
-  x Encryption key not found for this project \u2014 cannot decrypt the reversal map.`) + chalk17.dim(`
-    Expected a key derived from ${projectRoot}. Reverse must run where the map was created.
-`)
-      );
-      return 1;
+    const keySource = mapFile.file ?? absPath;
+    const roots = candidateProjectRoots(keySource);
+    let decrypted;
+    let anyKeyPresent = false;
+    for (const root of roots) {
+      const key = readProjectKey(root, opts.keysDir);
+      if (!key) continue;
+      anyKeyPresent = true;
+      try {
+        decrypted = mapFile.mutations.map((m) => ({
+          original: decryptSecret(m.original, key),
+          replacement: m.replacement
+        }));
+        break;
+      } catch {
+        decrypted = void 0;
+      }
     }
-    try {
-      plainMutations = mapFile.mutations.map((m) => ({
-        original: decryptSecret(m.original, key),
-        replacement: m.replacement
-      }));
-    } catch {
+    if (!decrypted) {
+      const looked = roots.join("\n      ");
       console.error(
         chalk17.red(`
-  x Failed to decrypt the reversal map (wrong key or corrupt data). File left untouched.
+  x Encryption key not found for this file \u2014 cannot decrypt the reversal map.`) + (anyKeyPresent ? chalk17.dim(`
+    A key was present but did not decrypt this map (wrong key or corrupt data).`) : chalk17.dim(`
+    No key was found under any known project location for this file.`)) + chalk17.dim(`
+    Looked under these project roots (keys dir ${opts.keysDir ?? "~/.pretense/keys"}):`) + chalk17.dim(`
+      ${looked}`) + chalk17.dim(`
+    Run \`reverse\` on the SAME machine and HOME where you mutated the file,`) + chalk17.dim(`
+    or set ${chalk17.cyan("PRETENSE_PROJECT_ROOT")} to the project root used at mutate time.`) + chalk17.dim(`
+  File left untouched.
 `)
       );
       return 1;
     }
+    plainMutations = decrypted;
   } else {
     plainMutations = mapFile.mutations.map((m) => ({ original: m.original, replacement: m.replacement }));
   }

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-MH6CXHTM.js";
+} from "./chunk-QT5E625F.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -23,15 +23,15 @@
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
+    "@pretense/billing": "0.1.0",
     "@pretense/protocol": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
-    "@pretense/proxy": "0.1.0",
+    "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
+    "@pretense/proxy": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/billing": "0.1.0",
-    "@pretense/learner": "0.2.0"
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",