@pretense/cli 0.6.18 → 0.6.19

package/dist/{chunk-QT5E625F.js → chunk-XY4NRTOT.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.18" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.19" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-QT5E625F.js";
+} from "./chunk-XY4NRTOT.js";
 import {
   __commonJS,
   __toESM,
@@ -11952,6 +11952,48 @@ var EXTENDED_PATTERNS = [
     defaultAction: "block",
     pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----[ \t]*\r?\n(?:[ \t]*\r?\n|[ \t]*[A-Za-z][A-Za-z0-9_-]{0,40}:[^\r\n]{0,1000}\r?\n){0,40}(?:[ \t]*[A-Za-z0-9+/=]{16,80}[ \t]*(?:\r?\n|$)){1,400}/g
   },
+  // ESCAPED SINGLE-LINE PEM private key — the `.env` / JSON / k8s-secret / CI-var
+  // idiom where the key is stored as ONE line with LITERAL `\n` (backslash-n)
+  // escape sequences instead of real newlines:
+  //
+  //   PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nMIIE…\n-----END RSA PRIVATE KEY-----"
+  //
+  // WHY THIS EXISTS (P0 egress, v0.6.19). Both END-anchored PEM detectors above
+  // (`private-key-block`, `private-key-body`) require a REAL newline (`\r?\n`,
+  // 0x0A) after the banner and a base64 body drawn from `[A-Za-z0-9+/=\s]`. In
+  // the escaped form the separators are the two literal characters `\` + `n`,
+  // and a backslash is in NEITHER body charset — so those detectors never match,
+  // and only the banner-only `private-key` detector (patterns.ts) fires. That
+  // spans just `-----BEGIN … KEY-----`; mutate/redact then rewrites the BANNER
+  // and leaves the real base64 body verbatim on the wire, while `audit` reports
+  // `detectorKinds:["private-key"]` — a FALSE assurance that the key was handled.
+  // Confirmed leaking against the shipped 0.6.18 engine (mutate + proxy egress).
+  //
+  // This detector spans the WHOLE escaped block (banner → body → END) so the
+  // mutator's PEM branch replaces the entire key, not just the marker. Being the
+  // LONGER same-severity match it wins interval-dedup over the banner-only
+  // `private-key`, exactly as `private-key-block` does for real multi-line keys.
+  //
+  // PRECISION / no prose-destruction. END-ANCHORED with a `\1` BACKREFERENCE, so
+  // a `BEGIN RSA …` can only close on `-----END RSA …-----` (never a far-away
+  // unrelated END). The body charset is base64 (`[A-Za-z0-9+/=]`) plus the
+  // literal escape sequences `\n`/`\r`/`\t` and space/tab ONLY — ordinary prose
+  // (`.`, `,`, `:`, other punctuation) STOPS the match at the first such char, so
+  // this can never swallow a document. Real MULTI-LINE PEMs contain 0x0A newline
+  // characters, which are in neither branch of the body class, so this detector
+  // does NOT match them — they stay owned by `private-key-block`.
+  //
+  // ReDoS-safe: the two body alternatives are disjoint on their first character
+  // (`\\[rnt]` begins with a backslash; the class excludes backslash), so every
+  // position has exactly one parse; the quantifier is lazy, bounded at 8000, and
+  // terminated by the required `-----END` anchor.
+  {
+    name: "private-key-escaped",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /-----BEGIN ((?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?)-----(?:\\[rnt]|[A-Za-z0-9+/= \t]){1,8000}?-----END \1-----/g
+  },
   // AWS *temporary* (STS) access key — `ASIA` + 16. STRICT by design (review
   // fix): the first cut widened the critical/BLOCK `aws-access-key` detector to
   // `(?:AKIA|ASIA)[0-9A-Z]{16}`, which hard-400'd benign traffic because `ASIA`
@@ -12308,6 +12350,32 @@ var SECRET_PATTERNS = [
     defaultAction: "block",
     pattern: /\brk_(?:test|live)_[A-Za-z0-9]{20,}\b/g
   },
+  {
+    // Pretense's OWN API key (`prtns_live_…` / `prtns_test_…`), minted by the
+    // backend `/api/cli/auth/validate`. VALUE-DRIVEN by construction: the
+    // `prtns_(live|test)_` prefix is matched on the LITERAL wherever it appears,
+    // regardless of the assignee's name or the source language.
+    //
+    // WHY THIS DETECTOR EXISTS (P0 egress, v0.6.19). A live `prtns_live_` token
+    // assigned to a variable whose name is NOT a recognised secret-label tail —
+    // `INTERNAL_HMAC_KEY = "prtns_live_…"` (bare `key` and the compound
+    // `hmac_key` are BOTH deliberately absent from SECRET_LABEL_TAILS), or
+    // `InternalHmacKey = …` — matched NO named detector, so it egressed to the
+    // LLM in cleartext and survived `mutate --stdout`. Only tokens that happened
+    // to land in a `…token`/`…secret`/`…password`-suffixed binding were caught,
+    // an inconsistency that depended on the variable name and therefore on the
+    // language's naming convention. A credential must be caught on its own shape.
+    //
+    // Precision: the `prtns_(live|test)_` prefix plus a 16+ base62 body is a
+    // near-zero-false-positive signal — nothing benign carries it — so this is
+    // safe as an unlabelled, value-driven detector on the always-mutate egress
+    // path, exactly like the Stripe `sk_live_` / GitHub `ghp_` prefixes above.
+    name: "pretense-api-key",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /\bprtns_(?:live|test)_[A-Za-z0-9]{16,}\b/g
+  },
   // Communications
   {
     name: "slack-token",
@@ -12869,7 +12937,7 @@ var ENV_PATTERNS = [
     // specific env-var names rather than generic secret-label tails, so they do
     // not belong in the shared vocabulary.
     pattern: new RegExp(
-      `(?<![A-Za-z0-9])(?:[A-Z0-9]+[._-])*(?:${ENV_SECRET_LABEL_ALTERNATION}|DATABASE_URL|VAULT_TOKEN)\\s*[=:]\\s*(?!['"\\s])(?!\\$)(?!process\\.env)(?!os\\.environ)(?![A-Za-z][A-Za-z0-9+.-]*:\\/\\/)(?!sk[-_]|pk_|rk_|whsec_|xox[bpors]-|ghp_|gho_|ghs_|glpat-|hf_|AKIA|AIza)[A-Za-z0-9/+._@:!#%^&*?~-]{8,}`,
+      `(?<![A-Za-z0-9])(?:[A-Z0-9]+[._-])*(?:${ENV_SECRET_LABEL_ALTERNATION}|DATABASE_URL|VAULT_TOKEN)\\s*[=:]\\s*(?!['"\\s])(?!\\$)(?!process\\.env)(?!os\\.environ)(?![A-Za-z][A-Za-z0-9+.-]*:\\/\\/)(?!sk[-_]|pk_|rk_|whsec_|xox[bpors]-|ghp_|gho_|ghs_|glpat-|hf_|prtns_(?:live|test)_|AKIA|AIza)[A-Za-z0-9/+._@:!#%^&*?~-]{8,}`,
       "gi"
     ),
     // PRECISION: reject `PASSWORD=changeme`, `PASSWORD=<your-password>` and
@@ -15633,7 +15701,7 @@ ${end}`;
   }
   const shaped = shapePreservingSynthetic(finding.type, v, digest);
   if (shaped !== null) return shaped;
-  const prefix = v.match(/^(?:sk_live_|sk_test_|pk_live_|pk_test_|ghp_|gho_|ghu_|ghs_|ghr_|AKIA|ASIA|AIza|xoxb-|xoxp-|xoxa-|xoxr-|hf_|eyJ)/)?.[0] ?? "";
+  const prefix = v.match(/^(?:sk_live_|sk_test_|pk_live_|pk_test_|prtns_live_|prtns_test_|ghp_|gho_|ghu_|ghs_|ghr_|AKIA|ASIA|AIza|xoxb-|xoxp-|xoxa-|xoxr-|hf_|eyJ)/)?.[0] ?? "";
   const fillerLen = Math.max(1, v.length - prefix.length);
   const filler = digest.repeat(Math.ceil(fillerLen / digest.length)).slice(0, fillerLen);
   return prefix + filler;
@@ -16514,11 +16582,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.18" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.19" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "220d098b1829361f3d0043fb24275e5fdfb84429".length > 0 ? "220d098b1829361f3d0043fb24275e5fdfb84429" : UNKNOWN_COMMIT;
+  return "79bc3b0f2c6a2ff139ae392d2de37679a06308a6".length > 0 ? "79bc3b0f2c6a2ff139ae392d2de37679a06308a6" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-QT5E625F.js";
+} from "./chunk-XY4NRTOT.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.18",
+  "version": "0.6.19",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -24,8 +24,8 @@
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
     "@pretense/billing": "0.1.0",
-    "@pretense/protocol": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
+    "@pretense/protocol": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",