@pretense/cli 0.6.2 → 0.6.5

package/dist/index.js

@@ -10385,7 +10385,6 @@ function listPresetIds() {
 
 // ../packages/scanner/dist/index.js
 import { gunzipSync } from "zlib";
-import { createRequire } from "module";
 var SECRET_LABEL_TAILS = [
   // password family
   "password",
@@ -13279,259 +13278,6 @@ function resolveSafeSpan(original, map, viewStart, viewEnd, value, cost) {
   if (!spanContainsValue(slice, value, cost)) return null;
   return { start, end, value: slice };
 }
-var _native;
-function loadNative() {
-  if (_native !== void 0) return _native;
-  try {
-    const require2 = createRequire(import.meta.url);
-    const mod = require2("@pretense/scanner-rs");
-    if (typeof mod?.semanticScan !== "function") {
-      _native = null;
-    } else {
-      _native = mod;
-    }
-  } catch {
-    _native = null;
-  }
-  return _native;
-}
-var _astProbe;
-function isAstCoreAvailable() {
-  if (_astProbe !== void 0) return _astProbe;
-  const native = loadNative();
-  if (!native) {
-    _astProbe = false;
-    return false;
-  }
-  try {
-    native.semanticScan("", "typescript");
-    _astProbe = true;
-  } catch {
-    _astProbe = false;
-  }
-  return _astProbe;
-}
-function makeByteToChar(text) {
-  let ascii = true;
-  for (let i = 0; i < text.length; i++) {
-    if (text.charCodeAt(i) > 127) {
-      ascii = false;
-      break;
-    }
-  }
-  if (ascii) return (b) => b;
-  const totalBytes = Buffer.byteLength(text, "utf8");
-  const table = new Int32Array(totalBytes + 1);
-  let byte = 0;
-  for (let charIdx = 0; charIdx < text.length; ) {
-    const cp = text.codePointAt(charIdx);
-    const unitLen = cp > 65535 ? 2 : 1;
-    const byteLen = Buffer.byteLength(String.fromCodePoint(cp), "utf8");
-    for (let k = 0; k < byteLen; k++) table[byte + k] = charIdx;
-    byte += byteLen;
-    charIdx += unitLen;
-  }
-  table[totalBytes] = text.length;
-  return (b) => {
-    if (b <= 0) return 0;
-    if (b >= totalBytes) return text.length;
-    return table[b];
-  };
-}
-function isInsideAnySpan(start, end, spans) {
-  for (const s of spans) {
-    if (s.start > start) break;
-    if (start >= s.start && end <= s.end) return true;
-  }
-  return false;
-}
-var CREDENTIAL_NAME = /(?:^|[._-]|(?<=[a-z0-9]))(?:api[_-]?key|api[_-]?secret|secret|secrets|token|password|passwd|pwd|access[_-]?key|access[_-]?token|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer[_-]?token|session[_-]?secret|encryption[_-]?key|signing[_-]?key)s?$/i;
-var CREDENTIAL_SETTER = /^(?:set|with|configure|use|update|put|load|init)[_-]?(?:api[_-]?key|api[_-]?secret|secret|token|password|passwd|pwd|access[_-]?key|access[_-]?token|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer[_-]?token|credential|credentials|key)s?$/i;
-function looksLikeCredentialName(name) {
-  return CREDENTIAL_NAME.test(name);
-}
-function looksLikeCredentialSetter(callee) {
-  const last = callee.split(".").pop() ?? callee;
-  return CREDENTIAL_SETTER.test(last);
-}
-function unquoteLiteral(literal) {
-  const t = literal.trim();
-  if (t.length < 2) return null;
-  const open = t[0];
-  const close = t[t.length - 1];
-  if (open === '"' && close === '"' || open === "'" && close === "'" || open === "`" && close === "`") {
-    return t.slice(1, -1);
-  }
-  const firstQuote = t.search(/["'`]/);
-  if (firstQuote >= 0) {
-    const q = t[firstQuote];
-    const lastQuote = t.lastIndexOf(q);
-    if (lastQuote > firstQuote) return t.slice(firstQuote + 1, lastQuote);
-  }
-  return null;
-}
-var STRING_LITERAL_RX = /^\s*["'`]/;
-function dataFlowMatches(text, sem, nextId2) {
-  const matches = [];
-  const findings = [];
-  for (const edge of sem.edges) {
-    const isAssign = edge.kind === "Assignment" && looksLikeCredentialName(edge.from);
-    const isSetter = edge.kind === "Call" && looksLikeCredentialSetter(edge.from);
-    if (!isAssign && !isSetter) continue;
-    if (!STRING_LITERAL_RX.test(edge.to)) continue;
-    const inner = unquoteLiteral(edge.to);
-    if (inner === null || inner.length === 0) continue;
-    const span = locateLiteral(text, edge.to, edge.line);
-    const start = span && span.start >= 0 ? span.start : 0;
-    const end = span && span.end >= 0 ? span.end : 0;
-    const severity = "high";
-    const category = "secret";
-    const action = "redact";
-    const type = "dataflow-credential";
-    const id = nextId2();
-    const masked = maskCredential(inner);
-    matches.push({ id, category, type, value: inner, masked, start, end, severity, action, confidence: 0.85 });
-    findings.push({
-      ruleId: type,
-      value: inner,
-      masked,
-      severity,
-      category,
-      line: edge.line,
-      column: span?.column ?? 0,
-      start,
-      end,
-      action,
-      confidence: 0.85
-    });
-  }
-  return { matches, findings };
-}
-function maskCredential(value) {
-  if (value.length <= 8) return "***";
-  return value.slice(0, 4) + "..." + value.slice(-4);
-}
-function locateLiteral(text, literalSource, line) {
-  let lineStart = 0;
-  let curLine = 1;
-  for (let i = 0; i < text.length && curLine < line; i++) {
-    if (text.charCodeAt(i) === 10) {
-      curLine++;
-      lineStart = i + 1;
-    }
-  }
-  let idx = text.indexOf(literalSource, lineStart);
-  if (idx < 0) idx = text.indexOf(literalSource);
-  if (idx < 0) return null;
-  const lineNlBefore = text.lastIndexOf("\n", idx);
-  const column = lineNlBefore < 0 ? idx : idx - lineNlBefore - 1;
-  return { start: idx, end: idx + literalSource.length, column };
-}
-var SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1 };
-function rebuildFindings(matches, findingsByMatchId) {
-  const out = [];
-  for (const m of matches) {
-    const f = findingsByMatchId.get(m.id);
-    if (f) out.push(f);
-  }
-  return out;
-}
-function dedupeMatches(matches) {
-  const sorted = [...matches].sort(
-    (a, b) => a.start - b.start || SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || b.confidence - a.confidence
-  );
-  const kept = [];
-  for (const m of sorted) {
-    const overlap = kept.find(
-      (k) => m.start < k.end && k.start < m.end && !(m.start === 0 && m.end === 0)
-    );
-    if (!overlap) {
-      kept.push(m);
-    }
-  }
-  const seenZero = /* @__PURE__ */ new Set();
-  return kept.filter((m) => {
-    if (m.start === 0 && m.end === 0) {
-      const key = `${m.type}:${m.value}`;
-      if (seenZero.has(key)) return false;
-      seenZero.add(key);
-    }
-    return true;
-  });
-}
-async function scanLevel2(text, language, opts = {}) {
-  const lang = language ?? opts.language ?? "typescript";
-  const base = opts.presidioUrl ? await scanWithPresidio(text, opts.presidioUrl, opts) : scan(text, opts);
-  const native = loadNative();
-  if (!native) return base;
-  let sem;
-  try {
-    sem = native.semanticScan(text, lang);
-  } catch {
-    return base;
-  }
-  const byteToChar = makeByteToChar(text);
-  const commentSpans = [];
-  for (const node of sem.nodes) {
-    if (node.class === "Comment") {
-      commentSpans.push({ start: byteToChar(node.start_byte), end: byteToChar(node.end_byte) });
-    }
-  }
-  commentSpans.sort((a, b) => a.start - b.start || a.end - b.end);
-  const findingsById = /* @__PURE__ */ new Map();
-  base.matches.forEach((m, i) => findingsById.set(m.id, base.findings[i] ?? toFinding(text, m)));
-  const survivingMatches = base.matches.filter(
-    (m) => m.start === m.end || !isInsideAnySpan(m.start, m.end, commentSpans)
-  );
-  let dfMatches = [];
-  if (opts.dataFlow !== false) {
-    let counter = 0;
-    const nextId2 = () => `l2df_${++counter}`;
-    const df = dataFlowMatches(text, sem, nextId2);
-    df.matches.forEach((m, i) => findingsById.set(m.id, df.findings[i] ?? toFinding(text, m)));
-    dfMatches = df.matches.filter((m) => !isInsideAnySpan(m.start, m.end, commentSpans));
-  }
-  const deduped = dedupeMatches([...survivingMatches, ...dfMatches]).sort(
-    (a, b) => a.start - b.start || SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]
-  );
-  const dedupedFindings = rebuildFindings(deduped, findingsById).sort(
-    (a, b) => a.start - b.start || SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]
-  );
-  const clean = deduped.filter((m) => m.action === "block" || m.action === "redact").length === 0;
-  return {
-    clean,
-    matches: deduped,
-    findings: dedupedFindings,
-    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    durationMs: base.durationMs,
-    patternCount: base.patternCount,
-    // Bounded-work state is a property of the underlying scan and MUST survive
-    // this merge — dropping it here would re-create the silent-incomplete hole
-    // one layer up.
-    incomplete: base.incomplete,
-    limits: base.limits
-  };
-}
-function toFinding(text, m) {
-  const before = text.slice(0, m.start);
-  const line = (before.match(/\n/g) ?? []).length + 1;
-  const lastNl = before.lastIndexOf("\n");
-  const column = lastNl === -1 ? m.start : m.start - lastNl - 1;
-  return {
-    ruleId: m.type,
-    value: m.value,
-    masked: m.masked,
-    severity: m.severity,
-    category: m.category,
-    line,
-    column,
-    start: m.start,
-    end: m.end,
-    action: m.action,
-    confidence: m.confidence,
-    ...m.entropy !== void 0 ? { entropy: m.entropy } : {}
-  };
-}
 var MIN_SPAN_VERIFY_CHARS = 1024 * 1024;
 var MAX_SPAN_VERIFY_CHARS = 256 * 1024 * 1024;
 var SPAN_VERIFY_CHARS_PER_CHAR = 64;
@@ -13878,60 +13624,6 @@ function scan(text, opts = {}) {
     limits
   };
 }
-async function scanWithPresidio(text, presidioUrl, opts = {}) {
-  const { presidio: _presidio, ...syncOpts } = opts;
-  const base = scan(text, syncOpts);
-  const nlIndex = buildNewlineIndex(text);
-  try {
-    const resp = await fetch(`${presidioUrl}/analyze`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ text, language: "en" }),
-      signal: AbortSignal.timeout(2e3)
-    });
-    if (!resp.ok) return base;
-    const presidioResults = await resp.json();
-    for (const pr of presidioResults) {
-      const alreadyCovered = base.matches.some((m) => m.start <= pr.start && m.end >= pr.end);
-      if (!alreadyCovered && pr.score >= 0.7) {
-        const value = text.slice(pr.start, pr.end);
-        const type = `presidio-${pr.entity_type.toLowerCase()}`;
-        const severity = pr.score >= 0.9 ? "high" : "medium";
-        base.matches.push({
-          id: nextId(),
-          category: "pii",
-          type,
-          value,
-          masked: "***",
-          start: pr.start,
-          end: pr.end,
-          severity,
-          action: "redact",
-          confidence: pr.score
-        });
-        const { line, column } = lineColFromOffset(text, pr.start, nlIndex);
-        base.findings.push({
-          ruleId: type,
-          value,
-          masked: "***",
-          severity,
-          category: "pii",
-          line,
-          column,
-          start: pr.start,
-          end: pr.end,
-          action: "redact",
-          confidence: pr.score
-        });
-      }
-    }
-    base.matches.sort((a, b) => a.start - b.start);
-    base.findings.sort((a, b) => a.start - b.start);
-    base.clean = base.matches.filter((m) => m.action === "block" || m.action === "redact").length === 0;
-  } catch {
-  }
-  return base;
-}
 
 // ../packages/mutator/dist/index.js
 init_esm_shims();
@@ -15862,6 +15554,30 @@ function extractDeltas(line, provider) {
         delta[prop] = v;
       }
     });
+  } else if (provider === "google") {
+    const candidates = json["candidates"];
+    if (!Array.isArray(candidates)) return null;
+    for (let ci = 0; ci < candidates.length; ci++) {
+      const cand = candidates[ci];
+      const candIndex = typeof cand["index"] === "number" ? cand["index"] : ci;
+      const content = cand["content"];
+      if (!content) continue;
+      const parts = content["parts"];
+      if (!Array.isArray(parts)) continue;
+      for (const part of parts) {
+        if (typeof part["text"] !== "string") continue;
+        const isThought = part["thought"] === true;
+        refs.push({
+          key: `g:${candIndex}:${isThought ? "thought" : "text"}`,
+          index: candIndex,
+          kind: isThought ? "google_thought" : "google_text",
+          text: part["text"],
+          set: (v) => {
+            part["text"] = v;
+          }
+        });
+      }
+    }
   } else {
     const choices = json["choices"];
     if (!Array.isArray(choices) || choices.length === 0) return null;
@@ -15907,6 +15623,14 @@ function toJsonStringContextMap(map) {
   }
   return out;
 }
+function classifyStreamProvider(upstream) {
+  const u = upstream.toLowerCase();
+  if (u.includes("anthropic")) return "anthropic";
+  if (u.includes("generativelanguage") || u.includes("googleapis") || u.includes("gemini")) {
+    return "google";
+  }
+  return "openai";
+}
 async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
   const buffers = /* @__PURE__ */ new Map();
   const bufferMeta = /* @__PURE__ */ new Map();
@@ -16021,6 +15745,12 @@ function buildFlushEvent(text, provider, kind, index) {
     const delta2 = kind === "input_json" ? { type: "input_json_delta", partial_json: text } : kind === "thinking" ? { type: "thinking_delta", thinking: text } : { type: "text_delta", text };
     return "data: " + JSON.stringify({ type: "content_block_delta", index, delta: delta2 });
   }
+  if (provider === "google") {
+    const part = kind === "google_thought" ? { text, thought: true } : { text };
+    return "data: " + JSON.stringify({
+      candidates: [{ content: { parts: [part], role: "model" }, index }]
+    });
+  }
   const delta = kind === "openai_tool_args" ? { tool_calls: [{ index, function: { arguments: text } }] } : { content: text };
   return "data: " + JSON.stringify({
     id: "pretense-flush",
@@ -16276,7 +16006,7 @@ function tokenizeBodyDeep(body, scanText) {
   };
 }
 async function handleStreaming(upstreamResp, map, requestId, upstream) {
-  const provider = upstream.includes("anthropic") ? "anthropic" : "openai";
+  const provider = classifyStreamProvider(upstream);
   return streamWithRollingBuffer(upstreamResp, map, provider, requestId);
 }
 function createProxy(opts = {}) {
@@ -16750,7 +16480,10 @@ Upgrade to ${_upgradeTier === "enterprise" ? "Enterprise" : "Pro"} for ${_upgrad
     for (const [orig, syn] of globalMap.entries()) {
       if (!secretMap.has(syn)) reverseMap.set(orig, syn);
     }
-    if (body["stream"] === true) {
+    const upstreamIsSse = (upstreamResp.headers.get("content-type") ?? "").includes(
+      "text/event-stream"
+    );
+    if (body["stream"] === true || upstreamIsSse) {
       return handleStreaming(upstreamResp, reverseMap, requestId, upstream);
     }
     let respBody;
@@ -16987,71 +16720,13 @@ function filterExisting(files) {
     }
   });
 }
-function langForFile(filePath) {
-  switch (filePath ? extname2(filePath).toLowerCase() : "") {
-    case ".py":
-      return "python";
-    case ".go":
-      return "go";
-    case ".java":
-      return "java";
-    case ".rb":
-      return "ruby";
-    case ".rs":
-      return "rust";
-    case ".cs":
-      return "csharp";
-    case ".js":
-    case ".jsx":
-      return "javascript";
-    case ".tsx":
-    case ".ts":
-      return "typescript";
-    default:
-      return "typescript";
-  }
-}
-function resolveScanLevel(opts) {
-  if (opts.ast) return 2;
-  const raw2 = opts.level;
-  if (raw2 === void 0 || raw2 === "1") return 1;
-  if (raw2 === "2") return 2;
-  console.error(chalk3.red(`
-  x Invalid --level: "${raw2}". Use 1 (regex) or 2 (AST/data-flow).
-`));
-  process.exit(1);
-}
-var _astFallbackNoticePrinted = false;
-function resolveLevelWithAst(opts) {
-  const level = resolveScanLevel(opts);
-  if (level === 1) return { level, astUsed: false };
-  const astUsed = isAstCoreAvailable();
-  if (!astUsed && !_astFallbackNoticePrinted) {
-    console.error(
-      chalk3.yellow("\n  ! AST core (@pretense/scanner-rs) unavailable \u2014 falling back to L1 (regex).") + chalk3.dim("\n    Build the native core to enable L2 data-flow detection.\n")
-    );
-    _astFallbackNoticePrinted = true;
-  }
-  return { level, astUsed };
-}
-function effectiveScanLevel(requested, astUsed) {
-  return requested === 2 && astUsed ? 2 : 1;
-}
-function levelLabel(level, astUsed) {
-  if (level === 1) return "L1 \xB7 regex";
-  return astUsed ? "L2 \xB7 AST + regex" : "L2 \u2192 L1 (AST unavailable)";
-}
 async function scanContent(content, opts, filePath) {
-  const base = {
+  return scan(content, {
     contextAware: true,
     entropyAnalysis: opts.entropy !== false,
     ...filePath ? { filePath } : {},
     ...opts.presetName ? { presetName: opts.presetName } : {}
-  };
-  if (resolveScanLevel(opts) === 2) {
-    return await scanLevel2(content, langForFile(filePath), base);
-  }
-  return scan(content, base);
+  });
 }
 async function scanFile(filePath, opts) {
   const content = readFileSync5(filePath, "utf-8");
@@ -17142,7 +16817,6 @@ function resolveFormat(opts, defaultSarif = false) {
   return "text";
 }
 async function outputMultiFileResults(label, files, opts, { defaultSarif = false, ciMode = false } = {}) {
-  const { level, astUsed } = resolveLevelWithAst(opts);
   const sourceFiles = files.filter(isSupportedFile);
   if (sourceFiles.length === 0) {
     const fmt3 = resolveFormat(opts, defaultSarif);
@@ -17190,7 +16864,7 @@ async function outputMultiFileResults(label, files, opts, { defaultSarif = false
   console.log(chalk3.cyan(`
   Pretense Scan \u2014 ${label}
 `));
-  console.log(chalk3.dim(`  Files: ${sourceFiles.length} | Patterns: ${getPatternCount()} | Level: ${levelLabel(level, astUsed)}
+  console.log(chalk3.dim(`  Files: ${sourceFiles.length} | Patterns: ${getPatternCount()}
 `));
   for (const { file, result } of allResults) printFindings(file, result);
   console.log(chalk3.dim(`
@@ -17199,7 +16873,7 @@ async function outputMultiFileResults(label, files, opts, { defaultSarif = false
   process.exit(findingsExitCode);
 }
 function addScanOpts(cmd) {
-  return cmd.option("--json", "Output results as JSON (alias for --format json)", false).option("--format <fmt>", "Output format: text, json, sarif, csv (default: text)").option("--severity <lvl>", "Minimum severity to report: low, medium, high, critical").option("--no-entropy", "Disable entropy-based detection", false).option("--level <n>", "Detection level: 1 = regex (default), 2 = AST/data-flow (falls back to 1 unless the native addon is built locally)", "1").option("--ast", "Alias for --level 2 (falls back to level 1 unless the native addon is built locally)").option(
+  return cmd.option("--json", "Output results as JSON (alias for --format json)", false).option("--format <fmt>", "Output format: text, json, sarif, csv (default: text)").option("--severity <lvl>", "Minimum severity to report: low, medium, high, critical").option("--no-entropy", "Disable entropy-based detection", false).option(
     "--policy <preset>",
     `Apply a compliance preset (${COMPLIANCE_PRESET_IDS.join(", ")}); overrides scan.compliancePreset in pretense.yaml`
   );
@@ -17293,7 +16967,7 @@ function pathSubcommand() {
   });
 }
 function scanCommand() {
-  const cmd = new Command3("scan").description("Scan for secrets and PII (file, directory, or git-aware modes)").argument("[file]", "File to scan (omit to read from stdin)").option("--json", "Output results as JSON (alias for --format json)", false).option("--format <fmt>", "Output format: text, json, sarif, csv (default: text)").option("--severity <lvl>", "Minimum severity to report: low, medium, high, critical").option("--no-entropy", "Disable entropy-based detection", false).option("--level <n>", "Detection level: 1 = regex (default), 2 = AST/data-flow (falls back to 1 unless the native addon is built locally)", "1").option("--ast", "Alias for --level 2 (falls back to level 1 unless the native addon is built locally)").option(
+  const cmd = new Command3("scan").description("Scan for secrets and PII (file, directory, or git-aware modes)").argument("[file]", "File to scan (omit to read from stdin)").option("--json", "Output results as JSON (alias for --format json)", false).option("--format <fmt>", "Output format: text, json, sarif, csv (default: text)").option("--severity <lvl>", "Minimum severity to report: low, medium, high, critical").option("--no-entropy", "Disable entropy-based detection", false).option(
     "--policy <preset>",
     `Apply a compliance preset (${COMPLIANCE_PRESET_IDS.join(", ")}); overrides scan.compliancePreset in pretense.yaml`
   ).action(async (file, opts = {}) => {
@@ -17338,14 +17012,12 @@ function scanCommand() {
       for await (const chunk of process.stdin) chunks.push(chunk);
       content = Buffer.concat(chunks).toString("utf-8");
     }
-    const { level, astUsed } = resolveLevelWithAst(opts);
-    const effectiveLevel = effectiveScanLevel(level, astUsed);
     const rawResult = await scanContent(content, opts, file);
     const filteredMatches = filterBySeverity(rawResult.matches, opts?.severity);
     const result = { ...rawResult, matches: filteredMatches, clean: filteredMatches.length === 0 };
     const fmt2 = resolveFormat(opts ?? {});
     if (fmt2 === "json") {
-      console.log(JSON.stringify({ ...result, level: effectiveLevel, requestedLevel: level }, null, 2));
+      console.log(JSON.stringify(result, null, 2));
       process.exit(result.clean ? 0 : 1);
     }
     if (fmt2 === "sarif") {
@@ -17361,7 +17033,7 @@ function scanCommand() {
     console.log(chalk3.cyan(`
   Pretense Scan \u2014 ${file ?? "stdin"}
 `));
-    console.log(chalk3.dim(`  Patterns: ${getPatternCount()} | Level: ${levelLabel(level, astUsed)} | Duration: ${result.durationMs}ms
+    console.log(chalk3.dim(`  Patterns: ${getPatternCount()} | Duration: ${result.durationMs}ms
 `));
     if (result.clean) {
       console.log(chalk3.green("  \u2713 No secrets or PII detected\n"));
@@ -17567,8 +17239,12 @@ function logsCommand() {
       entries = store.getRecentEntries(limit);
       store.close();
     } catch {
-      console.log(chalk6.dim("\n  No audit data available. The audit database has not been initialized yet."));
-      console.log(chalk6.dim("  Run " + chalk6.cyan("pretense start") + " and make some requests first.\n"));
+      if (opts.json) {
+        console.log("[]");
+        return;
+      }
+      console.error(chalk6.dim("\n  No audit data available. The audit database has not been initialized yet."));
+      console.error(chalk6.dim("  Run " + chalk6.cyan("pretense start") + " and make some requests first.\n"));
       return;
     }
     if (opts.json) {
@@ -18791,7 +18467,7 @@ import { Command as Command14 } from "commander";
 import chalk13 from "chalk";
 import { readFileSync as readFileSync14, writeFileSync as writeFileSync9, chmodSync as chmodSync6 } from "fs";
 import { createHash as createHash3 } from "crypto";
-import { resolve as resolve4, extname as extname4 } from "path";
+import { resolve as resolve4 } from "path";
 
 // src/secret-crypto.ts
 init_esm_shims();
@@ -18887,106 +18563,43 @@ var REVERSAL_MAP_VERSION = 2;
 function sha256Hex2(s) {
   return createHash3("sha256").update(s, "utf8").digest("hex");
 }
-function langForFile2(filePath) {
-  switch (extname4(filePath).toLowerCase()) {
-    case ".py":
-      return "python";
-    case ".go":
-      return "go";
-    case ".java":
-      return "java";
-    case ".rb":
-      return "ruby";
-    case ".rs":
-      return "rust";
-    case ".cs":
-      return "csharp";
-    case ".js":
-    case ".jsx":
-      return "javascript";
-    case ".tsx":
-    case ".ts":
-      return "typescript";
-    default:
-      return "typescript";
-  }
-}
-function resolveMutateLevel(opts) {
-  if (opts.ast) return 2;
-  const raw2 = opts.level;
-  if (raw2 === void 0 || raw2 === "1") return 1;
-  if (raw2 === "2") return 2;
-  console.error(chalk13.red(`
-  x Invalid --level: "${raw2}". Use 1 (regex) or 2 (AST/data-flow).
-`));
-  process.exit(1);
-}
-function overlaps2(aOff, aLen, bOff, bLen) {
-  return aOff < bOff + bLen && bOff < aOff + aLen;
-}
-function innerValueFinding(content, m) {
-  if (m.end <= m.start || m.value.length === 0) return null;
-  const raw2 = content.slice(m.start, m.end);
-  const idx = raw2.indexOf(m.value);
-  if (idx < 0) return null;
-  return { value: m.value, offset: m.start + idx, length: m.value.length, type: m.type };
-}
-async function collectMutationFindings(content, file, level) {
+async function collectMutationFindings(content, file) {
   const l1 = scan(content, { contextAware: true, entropyAnalysis: true, filePath: file });
-  const findings = l1.matches.map((m) => ({
+  return l1.matches.map((m) => ({
     value: m.value,
     offset: m.start,
     length: m.end - m.start,
     type: m.type
   }));
-  if (level === 2) {
-    if (!isAstCoreAvailable()) {
-      console.error(
-        chalk13.yellow("  ! AST core (@pretense/scanner-rs) unavailable \u2014 mutating with L1 (regex).")
-      );
-    }
-    const l2 = await scanLevel2(content, langForFile2(file), {
-      contextAware: true,
-      entropyAnalysis: true,
-      filePath: file
-    });
-    for (const m of l2.matches) {
-      if (m.type !== "dataflow-credential") continue;
-      const f = innerValueFinding(content, m);
-      if (!f) continue;
-      if (findings.some((e) => overlaps2(f.offset, f.length, e.offset, e.length))) continue;
-      findings.push(f);
-    }
-  }
-  return findings;
 }
 async function runMutate(file, opts = {}) {
-  const level = resolveMutateLevel(opts);
-  let content;
+  let raw2;
   try {
-    content = readFileSync14(file, "utf-8");
+    raw2 = readFileSync14(file);
   } catch {
     console.error(chalk13.red(`
   x Cannot read file: ${file}
 `));
     return 1;
   }
-  const findings = await collectMutationFindings(content, file, level);
+  const content = raw2.toString("utf-8");
+  if (!Buffer.from(content, "utf-8").equals(raw2)) {
+    console.error(
+      chalk13.red(`
+  x Not valid UTF-8: ${file}`) + chalk13.dim(`
+  Mutating would replace the undecodable bytes with U+FFFD and the`) + chalk13.dim(`
+  original content could not be restored. File left untouched.
+`)
+    );
+    return 1;
+  }
+  const findings = await collectMutationFindings(content, file);
   if (findings.length === 0) {
     console.error(chalk13.dim(`  No secrets found in ${file} \u2014 nothing to mutate.`));
     if (!opts.inPlace && !opts.output) process.stdout.write(content);
     return 0;
   }
   const result = mutateSecrets(content, findings);
-  if (opts.inPlace) {
-    writeFileSync9(file, result.content);
-    console.error(chalk13.green(`  \u2713 Mutated ${result.mutations.length} secrets in ${file} (in-place)`));
-  } else if (opts.output) {
-    writeFileSync9(opts.output, result.content);
-    console.error(chalk13.green(`  \u2713 Mutated ${result.mutations.length} secrets \u2192 ${opts.output}`));
-  } else {
-    process.stdout.write(result.content);
-  }
   if (opts.map) {
     const absFile = resolve4(file);
     const projectKey = getOrCreateProjectKey(findProjectRoot(absFile), opts.keysDir);
@@ -19001,7 +18614,18 @@ async function runMutate(file, opts = {}) {
         type: m.type
       }))
     };
-    writeFileSync9(opts.map, JSON.stringify(mapFile, null, 2), { mode: 384 });
+    try {
+      writeFileSync9(opts.map, JSON.stringify(mapFile, null, 2), { mode: 384 });
+    } catch (e) {
+      console.error(
+        chalk13.red(`
+  x Cannot write reversal map: ${opts.map}`) + chalk13.dim(`
+    ${e.message}`) + chalk13.dim(`
+  Nothing was mutated \u2014 without a map the original could not be restored.
+`)
+      );
+      return 1;
+    }
     try {
       chmodSync6(opts.map, 384);
     } catch {
@@ -19010,13 +18634,32 @@ async function runMutate(file, opts = {}) {
       chalk13.green(`  \u2713 Wrote encrypted reversal map \u2192 ${opts.map}`) + chalk13.dim(" (AES-256-GCM, mode 0600)")
     );
   }
+  try {
+    if (opts.inPlace) {
+      writeFileSync9(file, result.content);
+      console.error(chalk13.green(`  \u2713 Mutated ${result.mutations.length} secrets in ${file} (in-place)`));
+    } else if (opts.output) {
+      writeFileSync9(opts.output, result.content);
+      console.error(chalk13.green(`  \u2713 Mutated ${result.mutations.length} secrets \u2192 ${opts.output}`));
+    } else {
+      process.stdout.write(result.content);
+    }
+  } catch (e) {
+    console.error(
+      chalk13.red(`
+  x Cannot write mutated content: ${opts.output ?? file}`) + chalk13.dim(`
+    ${e.message}
+`)
+    );
+    return 1;
+  }
   if (opts.showMap) {
     console.error(JSON.stringify(result.mutations, null, 2));
   }
   return 0;
 }
 function mutateCommand() {
-  return new Command14("mutate").description("Mutate secrets in a file to deterministic synthetics").argument("<file>", "File to mutate").option("-i, --in-place", "Write back to the input file").option("-o, --output <path>", "Write mutated content to a specific file").option("--map <path>", "Write the encrypted reversal map (for `pretense reverse`) to a file").option("--level <n>", "Detection level: 1 = regex (default), 2 = AST/data-flow", "1").option("--ast", "Alias for --level 2 (AST/data-flow analysis)").option("--show-map", "Print mutation map JSON to stderr").action(async (file, opts) => {
+  return new Command14("mutate").description("Mutate secrets in a file to deterministic synthetics").argument("<file>", "File to mutate").option("-i, --in-place", "Write back to the input file").option("-o, --output <path>", "Write mutated content to a specific file").option("--map <path>", "Write the encrypted reversal map (for `pretense reverse`) to a file").option("--show-map", "Print mutation map JSON to stderr").action(async (file, opts) => {
     const code = await runMutate(file, opts);
     process.exit(code);
   });
@@ -19527,7 +19170,7 @@ function findClosestCommand(input, knownCommands) {
   return bestDist <= 3 ? best : null;
 }
 var program = new Command20();
-program.name("pretense").description(chalk19.bold("AI firewall") + " \u2014 mutates proprietary code before LLM API calls").version("0.6.2", "-v, --version").addHelpText("after", `
+program.name("pretense").description(chalk19.bold("AI firewall") + " \u2014 mutates proprietary code before LLM API calls").version("0.6.5", "-v, --version").addHelpText("after", `
 ${chalk19.bold("Quick start:")}
   ${chalk19.cyan("pretense scan")} ${chalk19.dim("<file|dir>")}        Scan for secrets and PII
   ${chalk19.cyan("pretense mutate")} ${chalk19.dim("<file>")}           Preview code mutations

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.2",
+  "version": "0.6.5",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -11,14 +11,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsx src/index.ts",
-    "prepublishOnly": "pnpm build",
-    "postinstall": "node -e \"fs.existsSync('dist/postinstall.js') && import('./dist/postinstall.js')\" || true",
-    "test": "vitest run",
-    "lint": "tsc --noEmit"
-  },
   "dependencies": {
     "better-sqlite3": "^11.0.0",
     "chalk": "^5.3.0",
@@ -26,19 +18,19 @@
     "yaml": "^2.4.0"
   },
   "devDependencies": {
-    "@pretense/billing": "workspace:*",
-    "@pretense/compliance-engine": "workspace:*",
-    "@pretense/protocol": "workspace:*",
-    "@pretense/learner": "workspace:*",
-    "@pretense/mutator": "workspace:*",
-    "@pretense/proxy": "workspace:*",
-    "@pretense/scanner": "workspace:*",
-    "@pretense/store": "workspace:*",
     "@types/node": "^20.0.0",
     "tsup": "^8.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
-    "vitest": "^1.0.0"
+    "vitest": "^1.0.0",
+    "@pretense/protocol": "0.1.0",
+    "@pretense/learner": "0.2.0",
+    "@pretense/mutator": "0.2.0",
+    "@pretense/scanner": "0.2.0",
+    "@pretense/store": "0.2.0",
+    "@pretense/proxy": "0.1.0",
+    "@pretense/compliance-engine": "0.1.0",
+    "@pretense/billing": "0.1.0"
   },
   "publishConfig": {
     "access": "public",
@@ -78,5 +70,12 @@
   },
   "engines": {
     "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsx src/index.ts",
+    "postinstall": "node -e \"fs.existsSync('dist/postinstall.js') && import('./dist/postinstall.js')\" || true",
+    "test": "vitest run",
+    "lint": "tsc --noEmit"
   }
-}
+}