@pretense/cli 0.6.17 → 0.6.19

package/dist/{chunk-EFDPBFXJ.js → chunk-XY4NRTOT.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.17" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.19" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-EFDPBFXJ.js";
+} from "./chunk-XY4NRTOT.js";
 import {
   __commonJS,
   __toESM,
@@ -11952,6 +11952,48 @@ var EXTENDED_PATTERNS = [
     defaultAction: "block",
     pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----[ \t]*\r?\n(?:[ \t]*\r?\n|[ \t]*[A-Za-z][A-Za-z0-9_-]{0,40}:[^\r\n]{0,1000}\r?\n){0,40}(?:[ \t]*[A-Za-z0-9+/=]{16,80}[ \t]*(?:\r?\n|$)){1,400}/g
   },
+  // ESCAPED SINGLE-LINE PEM private key — the `.env` / JSON / k8s-secret / CI-var
+  // idiom where the key is stored as ONE line with LITERAL `\n` (backslash-n)
+  // escape sequences instead of real newlines:
+  //
+  //   PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nMIIE…\n-----END RSA PRIVATE KEY-----"
+  //
+  // WHY THIS EXISTS (P0 egress, v0.6.19). Both END-anchored PEM detectors above
+  // (`private-key-block`, `private-key-body`) require a REAL newline (`\r?\n`,
+  // 0x0A) after the banner and a base64 body drawn from `[A-Za-z0-9+/=\s]`. In
+  // the escaped form the separators are the two literal characters `\` + `n`,
+  // and a backslash is in NEITHER body charset — so those detectors never match,
+  // and only the banner-only `private-key` detector (patterns.ts) fires. That
+  // spans just `-----BEGIN … KEY-----`; mutate/redact then rewrites the BANNER
+  // and leaves the real base64 body verbatim on the wire, while `audit` reports
+  // `detectorKinds:["private-key"]` — a FALSE assurance that the key was handled.
+  // Confirmed leaking against the shipped 0.6.18 engine (mutate + proxy egress).
+  //
+  // This detector spans the WHOLE escaped block (banner → body → END) so the
+  // mutator's PEM branch replaces the entire key, not just the marker. Being the
+  // LONGER same-severity match it wins interval-dedup over the banner-only
+  // `private-key`, exactly as `private-key-block` does for real multi-line keys.
+  //
+  // PRECISION / no prose-destruction. END-ANCHORED with a `\1` BACKREFERENCE, so
+  // a `BEGIN RSA …` can only close on `-----END RSA …-----` (never a far-away
+  // unrelated END). The body charset is base64 (`[A-Za-z0-9+/=]`) plus the
+  // literal escape sequences `\n`/`\r`/`\t` and space/tab ONLY — ordinary prose
+  // (`.`, `,`, `:`, other punctuation) STOPS the match at the first such char, so
+  // this can never swallow a document. Real MULTI-LINE PEMs contain 0x0A newline
+  // characters, which are in neither branch of the body class, so this detector
+  // does NOT match them — they stay owned by `private-key-block`.
+  //
+  // ReDoS-safe: the two body alternatives are disjoint on their first character
+  // (`\\[rnt]` begins with a backslash; the class excludes backslash), so every
+  // position has exactly one parse; the quantifier is lazy, bounded at 8000, and
+  // terminated by the required `-----END` anchor.
+  {
+    name: "private-key-escaped",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /-----BEGIN ((?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?)-----(?:\\[rnt]|[A-Za-z0-9+/= \t]){1,8000}?-----END \1-----/g
+  },
   // AWS *temporary* (STS) access key — `ASIA` + 16. STRICT by design (review
   // fix): the first cut widened the critical/BLOCK `aws-access-key` detector to
   // `(?:AKIA|ASIA)[0-9A-Z]{16}`, which hard-400'd benign traffic because `ASIA`
@@ -12308,6 +12350,32 @@ var SECRET_PATTERNS = [
     defaultAction: "block",
     pattern: /\brk_(?:test|live)_[A-Za-z0-9]{20,}\b/g
   },
+  {
+    // Pretense's OWN API key (`prtns_live_…` / `prtns_test_…`), minted by the
+    // backend `/api/cli/auth/validate`. VALUE-DRIVEN by construction: the
+    // `prtns_(live|test)_` prefix is matched on the LITERAL wherever it appears,
+    // regardless of the assignee's name or the source language.
+    //
+    // WHY THIS DETECTOR EXISTS (P0 egress, v0.6.19). A live `prtns_live_` token
+    // assigned to a variable whose name is NOT a recognised secret-label tail —
+    // `INTERNAL_HMAC_KEY = "prtns_live_…"` (bare `key` and the compound
+    // `hmac_key` are BOTH deliberately absent from SECRET_LABEL_TAILS), or
+    // `InternalHmacKey = …` — matched NO named detector, so it egressed to the
+    // LLM in cleartext and survived `mutate --stdout`. Only tokens that happened
+    // to land in a `…token`/`…secret`/`…password`-suffixed binding were caught,
+    // an inconsistency that depended on the variable name and therefore on the
+    // language's naming convention. A credential must be caught on its own shape.
+    //
+    // Precision: the `prtns_(live|test)_` prefix plus a 16+ base62 body is a
+    // near-zero-false-positive signal — nothing benign carries it — so this is
+    // safe as an unlabelled, value-driven detector on the always-mutate egress
+    // path, exactly like the Stripe `sk_live_` / GitHub `ghp_` prefixes above.
+    name: "pretense-api-key",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /\bprtns_(?:live|test)_[A-Za-z0-9]{16,}\b/g
+  },
   // Communications
   {
     name: "slack-token",
@@ -12869,7 +12937,7 @@ var ENV_PATTERNS = [
     // specific env-var names rather than generic secret-label tails, so they do
     // not belong in the shared vocabulary.
     pattern: new RegExp(
-      `(?<![A-Za-z0-9])(?:[A-Z0-9]+[._-])*(?:${ENV_SECRET_LABEL_ALTERNATION}|DATABASE_URL|VAULT_TOKEN)\\s*[=:]\\s*(?!['"\\s])(?!\\$)(?!process\\.env)(?!os\\.environ)(?![A-Za-z][A-Za-z0-9+.-]*:\\/\\/)(?!sk[-_]|pk_|rk_|whsec_|xox[bpors]-|ghp_|gho_|ghs_|glpat-|hf_|AKIA|AIza)[A-Za-z0-9/+._@:!#%^&*?~-]{8,}`,
+      `(?<![A-Za-z0-9])(?:[A-Z0-9]+[._-])*(?:${ENV_SECRET_LABEL_ALTERNATION}|DATABASE_URL|VAULT_TOKEN)\\s*[=:]\\s*(?!['"\\s])(?!\\$)(?!process\\.env)(?!os\\.environ)(?![A-Za-z][A-Za-z0-9+.-]*:\\/\\/)(?!sk[-_]|pk_|rk_|whsec_|xox[bpors]-|ghp_|gho_|ghs_|glpat-|hf_|prtns_(?:live|test)_|AKIA|AIza)[A-Za-z0-9/+._@:!#%^&*?~-]{8,}`,
       "gi"
     ),
     // PRECISION: reject `PASSWORD=changeme`, `PASSWORD=<your-password>` and
@@ -15633,7 +15701,7 @@ ${end}`;
   }
   const shaped = shapePreservingSynthetic(finding.type, v, digest);
   if (shaped !== null) return shaped;
-  const prefix = v.match(/^(?:sk_live_|sk_test_|pk_live_|pk_test_|ghp_|gho_|ghu_|ghs_|ghr_|AKIA|ASIA|AIza|xoxb-|xoxp-|xoxa-|xoxr-|hf_|eyJ)/)?.[0] ?? "";
+  const prefix = v.match(/^(?:sk_live_|sk_test_|pk_live_|pk_test_|prtns_live_|prtns_test_|ghp_|gho_|ghu_|ghs_|ghr_|AKIA|ASIA|AIza|xoxb-|xoxp-|xoxa-|xoxr-|hf_|eyJ)/)?.[0] ?? "";
   const fillerLen = Math.max(1, v.length - prefix.length);
   const filler = digest.repeat(Math.ceil(fillerLen / digest.length)).slice(0, fillerLen);
   return prefix + filler;
@@ -16514,11 +16582,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.17" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.19" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "6f467e565f6f035a63fe420acef1019ddf2455f0".length > 0 ? "6f467e565f6f035a63fe420acef1019ddf2455f0" : UNKNOWN_COMMIT;
+  return "79bc3b0f2c6a2ff139ae392d2de37679a06308a6".length > 0 ? "79bc3b0f2c6a2ff139ae392d2de37679a06308a6" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -17269,6 +17337,57 @@ function toSecretFindings(matches) {
 function isBase64Blob(text) {
   return text.length >= 256 && !/\s/.test(text) && /^[A-Za-z0-9+/_=-]+$/.test(text);
 }
+var BLOB_SECRET_INDICATORS = [
+  /AKIA[0-9A-Z]{16}/,
+  // AWS access key id
+  /ASIA[0-9A-Z]{16}/,
+  // AWS temporary access key id
+  /gh[opsu]_[A-Za-z0-9]{36}/,
+  // GitHub PAT / OAuth / app / refresh
+  /github_pat_[0-9A-Za-z_]{22,}/,
+  // GitHub fine-grained PAT
+  /sk-ant-[A-Za-z0-9_-]{24,}/,
+  // Anthropic API key
+  /sk_live_[A-Za-z0-9]{20,}/,
+  // Stripe live secret key
+  /rk_live_[A-Za-z0-9]{20,}/,
+  // Stripe live restricted key
+  /AIza[0-9A-Za-z_-]{35}/,
+  // Google API key
+  /xox[baprs]-[0-9A-Za-z-]{10,}/,
+  // Slack token
+  /npm_[A-Za-z0-9]{36}/,
+  // npm token
+  /glpat-[0-9A-Za-z_-]{20}/,
+  // GitLab PAT
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/
+  // PEM private key banner
+];
+function blobSecretIndicator(text) {
+  for (const re of BLOB_SECRET_INDICATORS) {
+    if (re.test(text)) return re.source.slice(0, 24);
+  }
+  return null;
+}
+var BLOB_DECODE_SCAN_MAX_CHARS = 4 * 1024 * 1024;
+function decodedTextIfLikelyText(text) {
+  if (text.length > BLOB_DECODE_SCAN_MAX_CHARS) return null;
+  let buf;
+  try {
+    buf = Buffer.from(text.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+  } catch {
+    return null;
+  }
+  if (buf.length === 0) return null;
+  const sample = Math.min(buf.length, 4096);
+  let printable = 0;
+  for (let i = 0; i < sample; i++) {
+    const b = buf[i] ?? 0;
+    if (b === 9 || b === 10 || b === 13 || b >= 32 && b <= 126) printable++;
+  }
+  if (printable / sample < 0.85) return null;
+  return buf.toString("utf8");
+}
 var CONTROL_CHAR_RE = /[\u0000-\u001f]/;
 var CONTROL_CHAR_RE_G = /[\u0000-\u001f]/g;
 function tokenizeBodyDeep(body, scanText, derivation) {
@@ -17306,11 +17425,39 @@ function tokenizeBodyDeep(body, scanText, derivation) {
     }
     return out;
   };
-  const tokenizeLeaf = (text) => {
-    if (isBase64Blob(text)) {
-      skippedUnscannable++;
-      return text;
+  const redactWholeBlob = (text, type) => {
+    const { content, mutations } = mutateSecrets(
+      text,
+      [{ value: text, offset: 0, length: text.length, type }],
+      derivation
+    );
+    for (const mu of mutations) {
+      if (!secretMap.has(mu.replacement)) secretMap.set(mu.replacement, mu.original);
+    }
+    foundTypes.add(type);
+    secretsTokenized++;
+    return content;
+  };
+  const scanBlobLeaf = (text) => {
+    const ind = blobSecretIndicator(text);
+    if (ind) return redactWholeBlob(text, `unscannable-blob:${ind}`);
+    const decoded = decodedTextIfLikelyText(text);
+    if (decoded !== null) {
+      const s = scanText(decoded);
+      if (s.incomplete) {
+        scanIncomplete = true;
+        droppedFindings += s.limits.droppedFindings;
+        for (const r of s.limits.reasons) incompleteReasons.add(r);
+      }
+      if (toSecretFindings(s.matches).length > 0) {
+        return redactWholeBlob(text, "unscannable-blob:encoded-secret");
+      }
     }
+    skippedUnscannable++;
+    return text;
+  };
+  const tokenizeLeaf = (text) => {
+    if (isBase64Blob(text)) return scanBlobLeaf(text);
     return tokenizeText(text);
   };
   const stack = [body];

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-EFDPBFXJ.js";
+} from "./chunk-XY4NRTOT.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.17",
+  "version": "0.6.19",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -23,15 +23,15 @@
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
+    "@pretense/billing": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
     "@pretense/protocol": "0.1.0",
-    "@pretense/billing": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
+    "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/scanner": "0.2.0"
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",