@pretense/cli 0.6.17 → 0.6.18

package/dist/{chunk-EFDPBFXJ.js → chunk-QT5E625F.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.17" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.18" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-EFDPBFXJ.js";
+} from "./chunk-QT5E625F.js";
 import {
   __commonJS,
   __toESM,
@@ -16514,11 +16514,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.17" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.18" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "6f467e565f6f035a63fe420acef1019ddf2455f0".length > 0 ? "6f467e565f6f035a63fe420acef1019ddf2455f0" : UNKNOWN_COMMIT;
+  return "220d098b1829361f3d0043fb24275e5fdfb84429".length > 0 ? "220d098b1829361f3d0043fb24275e5fdfb84429" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -17269,6 +17269,57 @@ function toSecretFindings(matches) {
 function isBase64Blob(text) {
   return text.length >= 256 && !/\s/.test(text) && /^[A-Za-z0-9+/_=-]+$/.test(text);
 }
+var BLOB_SECRET_INDICATORS = [
+  /AKIA[0-9A-Z]{16}/,
+  // AWS access key id
+  /ASIA[0-9A-Z]{16}/,
+  // AWS temporary access key id
+  /gh[opsu]_[A-Za-z0-9]{36}/,
+  // GitHub PAT / OAuth / app / refresh
+  /github_pat_[0-9A-Za-z_]{22,}/,
+  // GitHub fine-grained PAT
+  /sk-ant-[A-Za-z0-9_-]{24,}/,
+  // Anthropic API key
+  /sk_live_[A-Za-z0-9]{20,}/,
+  // Stripe live secret key
+  /rk_live_[A-Za-z0-9]{20,}/,
+  // Stripe live restricted key
+  /AIza[0-9A-Za-z_-]{35}/,
+  // Google API key
+  /xox[baprs]-[0-9A-Za-z-]{10,}/,
+  // Slack token
+  /npm_[A-Za-z0-9]{36}/,
+  // npm token
+  /glpat-[0-9A-Za-z_-]{20}/,
+  // GitLab PAT
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/
+  // PEM private key banner
+];
+function blobSecretIndicator(text) {
+  for (const re of BLOB_SECRET_INDICATORS) {
+    if (re.test(text)) return re.source.slice(0, 24);
+  }
+  return null;
+}
+var BLOB_DECODE_SCAN_MAX_CHARS = 4 * 1024 * 1024;
+function decodedTextIfLikelyText(text) {
+  if (text.length > BLOB_DECODE_SCAN_MAX_CHARS) return null;
+  let buf;
+  try {
+    buf = Buffer.from(text.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+  } catch {
+    return null;
+  }
+  if (buf.length === 0) return null;
+  const sample = Math.min(buf.length, 4096);
+  let printable = 0;
+  for (let i = 0; i < sample; i++) {
+    const b = buf[i] ?? 0;
+    if (b === 9 || b === 10 || b === 13 || b >= 32 && b <= 126) printable++;
+  }
+  if (printable / sample < 0.85) return null;
+  return buf.toString("utf8");
+}
 var CONTROL_CHAR_RE = /[\u0000-\u001f]/;
 var CONTROL_CHAR_RE_G = /[\u0000-\u001f]/g;
 function tokenizeBodyDeep(body, scanText, derivation) {
@@ -17306,11 +17357,39 @@ function tokenizeBodyDeep(body, scanText, derivation) {
     }
     return out;
   };
-  const tokenizeLeaf = (text) => {
-    if (isBase64Blob(text)) {
-      skippedUnscannable++;
-      return text;
+  const redactWholeBlob = (text, type) => {
+    const { content, mutations } = mutateSecrets(
+      text,
+      [{ value: text, offset: 0, length: text.length, type }],
+      derivation
+    );
+    for (const mu of mutations) {
+      if (!secretMap.has(mu.replacement)) secretMap.set(mu.replacement, mu.original);
     }
+    foundTypes.add(type);
+    secretsTokenized++;
+    return content;
+  };
+  const scanBlobLeaf = (text) => {
+    const ind = blobSecretIndicator(text);
+    if (ind) return redactWholeBlob(text, `unscannable-blob:${ind}`);
+    const decoded = decodedTextIfLikelyText(text);
+    if (decoded !== null) {
+      const s = scanText(decoded);
+      if (s.incomplete) {
+        scanIncomplete = true;
+        droppedFindings += s.limits.droppedFindings;
+        for (const r of s.limits.reasons) incompleteReasons.add(r);
+      }
+      if (toSecretFindings(s.matches).length > 0) {
+        return redactWholeBlob(text, "unscannable-blob:encoded-secret");
+      }
+    }
+    skippedUnscannable++;
+    return text;
+  };
+  const tokenizeLeaf = (text) => {
+    if (isBase64Blob(text)) return scanBlobLeaf(text);
     return tokenizeText(text);
   };
   const stack = [body];

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-EFDPBFXJ.js";
+} from "./chunk-QT5E625F.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.17",
+  "version": "0.6.18",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -23,15 +23,15 @@
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
-    "@pretense/compliance-engine": "0.1.0",
-    "@pretense/protocol": "0.1.0",
     "@pretense/billing": "0.1.0",
+    "@pretense/protocol": "0.1.0",
+    "@pretense/compliance-engine": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
+    "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/scanner": "0.2.0"
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",