@rigour-labs/core 5.2.9 → 5.3.0

package/dist/hooks/input-validator.js

@@ -16,6 +16,8 @@
  * - Azure / GCP / Stripe / Twilio keys
  *
  */
+import { classifyDLPDetection } from './dlp-confidence.js';
+import { isLearnedAllowSync, loadDLPFeedbackStoreSync } from './dlp-feedback.js';
 const CREDENTIAL_PATTERNS = [
     // ── Cloud Provider Keys ───────────────────────────────────
     {
@@ -53,7 +55,7 @@ const CREDENTIAL_PATTERNS = [
     // ── API Keys (Provider-Specific Prefixes) ─────────────────
     {
         type: 'openai_key',
-        regex: /\b(sk-(?:proj-)?[A-Za-z0-9]{20,})\b/g,
+        regex: /\b(sk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{24,})\b/g,
         severity: 'critical',
         description: 'OpenAI API key detected',
         recommendation: 'Use process.env.OPENAI_API_KEY instead',
@@ -85,7 +87,7 @@ const CREDENTIAL_PATTERNS = [
     },
     {
         type: 'twilio_key',
-        regex: /\b(SK[a-f0-9]{32})\b/g,
+        regex: /(?:TWILIO[_-]?(?:API[_-]?)?KEY|twilio[_-]?api[_-]?key)\s*[:=]\s*['"]?(SK[a-f0-9]{32})['"]?/gi,
         severity: 'high',
         description: 'Twilio API key detected',
         recommendation: 'Use process.env.TWILIO_API_KEY instead',
@@ -119,7 +121,7 @@ const CREDENTIAL_PATTERNS = [
     // ── Database Connection Strings ───────────────────────────
     {
         type: 'database_url',
-        regex: /\b((?:postgres(?:ql)?|mysql|mariadb|mssql|mongodb(?:\+srv)?|redis|rediss|amqp|amqps):\/\/[^\s'"`,;}{)]+)/gi,
+        regex: /\b((?:postgres(?:ql)?|mysql|mariadb|mssql|mongodb(?:\+srv)?|redis|rediss|amqp|amqps):\/\/[^/\s@]+:[^@/\s]+@[^\s'"`,;}{)]+)/gi,
         severity: 'critical',
         description: 'Database connection string with credentials detected',
         recommendation: 'Use process.env.DATABASE_URL instead',
@@ -243,80 +245,31 @@ function shannonEntropy(str) {
         return sum - p * Math.log2(p);
     }, 0);
 }
-/**
- * Smart context filter — decides if a detection is a real credential or a false positive.
- *
- * The challenge: build logs can contain BOTH false positives (variable names mentioned
- * in npm warnings) AND real leaks (a password accidentally echoed in CI output).
- *
- * Strategy:
- * 1. If the match has an actual SECRET VALUE (high entropy, long random string) → KEEP IT
- * 2. If the match is just a variable NAME reference with no real value → SKIP IT
- * 3. If the match is in a documentation/comment context → SKIP IT
- */
-function isLikelyFalsePositive(detection, input) {
-    const { match, type, position } = detection;
-    // Provider-specific prefixed keys are ALWAYS real (AKIA*, sk-*, ghp_*, etc.)
-    const prefixedTypes = [
-        'aws_access_key', 'openai_key', 'anthropic_key', 'github_token',
-        'stripe_key', 'slack_token', 'sendgrid_key', 'private_key',
-        'private_key_full', 'jwt_token', 'bearer_token', 'database_url',
-        'credentials_in_url', 'gcp_service_account',
-    ];
-    if (prefixedTypes.includes(type))
+/** Credential-less local DB URLs (no user:pass@) are safe for dev discussion. */
+function isCredentiallessLocalUrl(url) {
+    if (/:[^/@\s]+@[^/\s]+/i.test(url))
         return false;
-    // Get the line containing the match
-    const lineStart = input.lastIndexOf('\n', (position?.start ?? 0)) + 1;
-    const lineEnd = input.indexOf('\n', (position?.end ?? match.length));
-    const line = input.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
-    // npm notice/warn lines mentioning variable names (not values)
-    if (/^npm\s+(?:notice|warn|WARN|ERR!)/i.test(line))
-        return true;
-    // Docker build step output referencing env var names
-    if (/^#\d+\s+[\d.]+\s/.test(line)) {
-        // But if there's an actual assignment with a value, keep it
-        if (/[:=]\s*['"]?[A-Za-z0-9+/=_-]{20,}/.test(match))
-            return false;
+    return /:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::|\/|$)/i.test(url);
+}
+function isPlaceholderEnvValue(value) {
+    return /^(?:your[_-]?)?(?:api[_-]?)?key[_-]?here$/i.test(value)
+        || /^your[_-]/i.test(value)
+        || /^replace[_-]?me$/i.test(value)
+        || /^changeme$/i.test(value)
+        || /^not-a-real/i.test(value)
+        || /^super-secret-client-id-string$/i.test(value)
+        || /^x{8,}$/i.test(value);
+}
+function looksLikeLowEntropyOpenAiKey(match) {
+    const suffix = match.replace(/^sk-(?:proj-)?/i, '');
+    if (suffix.length < 24)
         return true;
-    }
-    // "digest:", "hash:", "checksum:" followed by hex — not credentials
-    if (/(?:digest|hash|checksum|sha256|sha1|md5)\s*[:=]/i.test(line))
+    if (/^(.)\1{5,}/.test(suffix))
         return true;
-    // Error messages referencing env var names without values
-    if (/(?:missing|undefined|not set|not found|required)\s+.*(?:NPM_TOKEN|DOCKER_PASSWORD|PYPI_TOKEN)/i.test(line))
+    if (shannonEntropy(suffix) < 3.8)
         return true;
-    // For generic patterns (password_assignment, env_variable, ci_secret, base64/hex_secret):
-    // Check if the captured VALUE has enough entropy to be a real secret
-    const genericTypes = ['password_assignment', 'env_variable', 'ci_secret', 'base64_secret', 'hex_secret', 'high_entropy_secret'];
-    if (genericTypes.includes(type)) {
-        // Extract the value portion (after = or : )
-        const valueMatch = match.match(/[:=]\s*['"]?(.+?)['"]?\s*$/);
-        if (valueMatch) {
-            const value = valueMatch[1];
-            const entropy = shannonEntropyForFilter(value);
-            // Low entropy + short = likely a placeholder, example, or variable name
-            if (entropy < 3.0 && value.length < 16)
-                return true;
-            // Pure numeric strings in log context (build numbers, timestamps)
-            if (/^\d+$/.test(value))
-                return true;
-        }
-    }
     return false;
 }
-/** Shannon entropy helper for the context filter */
-function shannonEntropyForFilter(str) {
-    if (str.length === 0)
-        return 0;
-    const freq = {};
-    for (const c of str)
-        freq[c] = (freq[c] || 0) + 1;
-    const len = str.length;
-    return Object.values(freq).reduce((sum, f) => {
-        const p = f / len;
-        return sum - p * Math.log2(p);
-    }, 0);
-}
 // ── Core Scanner ──────────────────────────────────────────────────
 /**
  * Redact a matched credential for safe display.
@@ -360,6 +313,18 @@ export function scanInputForCredentials(input, config = {}) {
             if (capturedValue.length < minSecretLength && pattern.type !== 'private_key') {
                 continue;
             }
+            if (pattern.type === 'database_url' && isCredentiallessLocalUrl(fullMatch)) {
+                continue;
+            }
+            if (pattern.type === 'openai_key' && looksLikeLowEntropyOpenAiKey(fullMatch)) {
+                continue;
+            }
+            if (pattern.type === 'env_variable') {
+                const envVal = fullMatch.split('=').slice(1).join('=').replace(/^['"]|['"]$/g, '').trim();
+                if (!envVal || isPlaceholderEnvValue(envVal)) {
+                    continue;
+                }
+            }
             // Check ignore patterns
             const isIgnored = ignoreRegexes.some(ignore => {
                 ignore.lastIndex = 0;
@@ -418,7 +383,7 @@ export function scanInputForCredentials(input, config = {}) {
     while ((entropyMatch = entropyRegex.exec(input)) !== null) {
         const value = entropyMatch[1];
         const entropy = shannonEntropy(value);
-        if (entropy > 4.5 && value.length >= 24) {
+        if (entropy > 4.5 && value.length >= 24 && !isPlaceholderEnvValue(value)) {
             // Only add if not already caught by a more specific pattern
             const alreadyCaught = detections.some(d => d.position && entropyMatch.index >= d.position.start && entropyMatch.index < d.position.end);
             if (!alreadyCaught) {
@@ -435,22 +400,66 @@ export function scanInputForCredentials(input, config = {}) {
             }
         }
     }
-    // ── Context filter: remove false positives from log/doc/CI output ──
-    const filtered = detections.filter(d => !isLikelyFalsePositive(d, input));
+    // ── Confidence engine: score candidates and suppress allowed false positives ──
+    const useLearned = config.use_learned_feedback !== false && !!config.cwd;
+    const feedbackStore = useLearned && config.cwd
+        ? loadDLPFeedbackStoreSync(config.cwd)
+        : null;
+    const classified = detections.map(d => {
+        if (feedbackStore) {
+            const start = d.position?.start ?? 0;
+            const lineStart = input.lastIndexOf('\n', start) + 1;
+            const lineEnd = input.indexOf('\n', start);
+            const line = input.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
+            if (isLearnedAllowSync(feedbackStore, d.type, d.match, line)) {
+                return {
+                    ...d,
+                    confidence: 12,
+                    decision: 'allow',
+                    reason_codes: ['learned_false_positive'],
+                };
+            }
+        }
+        return {
+            ...d,
+            ...classifyDLPDetection(d, input),
+        };
+    });
+    // Line-level learned expansion: one false-positive mark allows sibling patterns on same line
+    const learnedStarts = new Set(classified
+        .filter(d => d.decision === 'allow' && d.reason_codes?.includes('learned_false_positive'))
+        .map(d => d.position?.start ?? -1));
+    const expanded = classified.map(d => {
+        const start = d.position?.start ?? -1;
+        if (start >= 0 && learnedStarts.has(start) && d.decision !== 'allow') {
+            return {
+                ...d,
+                confidence: 12,
+                decision: 'allow',
+                reason_codes: ['learned_false_positive'],
+            };
+        }
+        return d;
+    });
+    const actionable = expanded.filter(d => d.decision !== 'allow');
+    const allowed = expanded.filter(d => d.decision === 'allow');
     // Deduplicate overlapping detections (keep highest severity)
-    const deduped = deduplicateDetections(filtered);
+    const deduped = deduplicateDetections(actionable);
+    const allowedDeduped = deduplicateDetections(allowed);
     // Sort by severity (critical first)
     const severityOrder = { critical: 0, high: 1, medium: 2 };
     deduped.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
     const blockOnDetection = config.block_on_detection ?? true;
+    const hasBlock = deduped.some(d => d.decision === 'block');
     const status = deduped.length === 0
         ? 'clean'
-        : blockOnDetection
+        : blockOnDetection && hasBlock
             ? 'blocked'
             : 'warning';
     return {
         status,
         detections: deduped,
+        ...(allowedDeduped.length > 0 ? { allowed_detections: allowedDeduped } : {}),
         duration_ms: Date.now() - start,
         scanned_length: input.length,
     };
@@ -467,7 +476,6 @@ function deduplicateDetections(detections) {
         return posA - posB;
     });
     const result = [];
-    const severityOrder = { critical: 0, high: 1, medium: 2 };
     for (const detection of sorted) {
         const overlapping = result.find(existing => {
             if (!existing.position || !detection.position)
@@ -477,7 +485,7 @@ function deduplicateDetections(detections) {
         });
         if (overlapping) {
             // Keep the higher severity detection
-            if (severityOrder[detection.severity] < severityOrder[overlapping.severity]) {
+            if (shouldReplaceDetection(detection, overlapping)) {
                 const idx = result.indexOf(overlapping);
                 result[idx] = detection;
             }
@@ -488,25 +496,45 @@ function deduplicateDetections(detections) {
     }
     return result;
 }
+function shouldReplaceDetection(candidate, existing) {
+    const severityOrder = { critical: 0, high: 1, medium: 2 };
+    const decisionOrder = { block: 0, warn: 1, allow: 2 };
+    const severityDelta = severityOrder[candidate.severity] - severityOrder[existing.severity];
+    if (severityDelta !== 0)
+        return severityDelta < 0;
+    const candidateDecision = decisionOrder[candidate.decision ?? 'warn'];
+    const existingDecision = decisionOrder[existing.decision ?? 'warn'];
+    if (candidateDecision !== existingDecision)
+        return candidateDecision < existingDecision;
+    return (candidate.confidence ?? 0) > (existing.confidence ?? 0);
+}
 /**
  * Format a blocked input result for display in IDE/terminal.
  * Used by hooks and CLI for human-readable output.
  */
 export function formatDLPAlert(result) {
     if (result.status === 'clean') {
+        const allowedCount = result.allowed_detections?.length ?? 0;
+        if (allowedCount > 0) {
+            return `✓ Input clean — allowed ${allowedCount} sample or safe credential-like value${allowedCount === 1 ? '' : 's'}.`;
+        }
         return '✓ Input clean — no credentials detected.';
     }
     const icon = result.status === 'blocked' ? '🛑' : '⚠️';
     const header = result.status === 'blocked'
-        ? `${icon} BLOCKED — ${result.detections.length} credential(s) detected in agent input`
-        : `${icon} WARNING — ${result.detections.length} credential(s) detected in agent input`;
+        ? `${icon} BLOCKED — likely live secret (${result.detections.length} finding${result.detections.length === 1 ? '' : 's'})`
+        : `${icon} WARNING — token-like value needs review (${result.detections.length} finding${result.detections.length === 1 ? '' : 's'})`;
     const details = result.detections.map(d => {
-        const complianceStr = d.compliance.length > 0
+        const showCompliance = result.status === 'blocked' && d.compliance.length > 0;
+        const confidence = d.confidence !== undefined ? ` | Confidence: ${d.confidence}%` : '';
+        const reasons = d.reason_codes?.length ? `\n    Why: ${formatReasonCodes(d.reason_codes)}` : '';
+        const complianceStr = showCompliance
             ? `\n    Compliance: ${d.compliance.join(', ')}`
             : '';
         return [
-            `  [${d.severity.toUpperCase()}] ${d.description}`,
+            `  [${d.severity.toUpperCase()}] ${d.description}${confidence}`,
             `    Detected: ${d.redacted}`,
+            reasons,
             `    → ${d.recommendation}`,
             complianceStr,
         ].filter(Boolean).join('\n');
@@ -530,7 +558,22 @@ export function createDLPAuditEntry(result, metadata) {
             severity: d.severity,
             redacted: d.redacted,
             description: d.description,
+            confidence: d.confidence,
+            decision: d.decision,
+            reason_codes: d.reason_codes,
             compliance: d.compliance,
         })),
+        allowed_detections: (result.allowed_detections ?? []).map(d => ({
+            type: d.type,
+            severity: d.severity,
+            redacted: d.redacted,
+            description: d.description,
+            confidence: d.confidence,
+            decision: d.decision,
+            reason_codes: d.reason_codes,
+        })),
     };
 }
+function formatReasonCodes(reasonCodes) {
+    return reasonCodes.map(reason => reason.replace(/_/g, ' ')).join(', ');
+}

package/dist/hooks/input-validator.test.js

@@ -7,14 +7,16 @@ import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, } from '.
 // ── Cloud Provider Keys ──────────────────────────────────────────
 describe('scanInputForCredentials — AWS', () => {
     it('detects AWS Access Key IDs', () => {
-        const result = scanInputForCredentials('Here is my key: AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('Here is my key: AKIAZ9Y8X7W6V5U4T3Q2');
         expect(result.status).toBe('blocked');
         expect(result.detections).toHaveLength(1);
         expect(result.detections[0].type).toBe('aws_access_key');
         expect(result.detections[0].severity).toBe('critical');
+        expect(result.detections[0].decision).toBe('block');
+        expect(result.detections[0].confidence).toBeGreaterThanOrEqual(80);
     });
     it('detects AWS Secret Key assignments', () => {
-        const result = scanInputForCredentials('aws_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"');
+        const result = scanInputForCredentials('aws_secret_access_key = "Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6B5C4A3D2E1F0"');
         expect(result.status).toBe('blocked');
         expect(result.detections.some(d => d.type === 'aws_secret_key')).toBe(true);
     });
@@ -38,27 +40,27 @@ describe('scanInputForCredentials — Azure', () => {
 // ── API Keys (Provider-Specific) ─────────────────────────────────
 describe('scanInputForCredentials — API keys', () => {
     it('detects OpenAI key', () => {
-        const result = scanInputForCredentials('sk-proj-abc1234567890ABCDEFGH');
+        const result = scanInputForCredentials('sk-proj-Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6');
         expect(result.status).toBe('blocked');
         expect(result.detections[0].type).toBe('openai_key');
     });
     it('detects Anthropic key', () => {
-        const result = scanInputForCredentials('sk-ant-api03-abcdefghijklmnop123456');
+        const result = scanInputForCredentials('sk-ant-api03-Z9Y8X7W6V5U4T3S2R1Q0');
         expect(result.status).toBe('blocked');
         expect(result.detections[0].type).toBe('anthropic_key');
     });
     it('detects GitHub PAT', () => {
-        const result = scanInputForCredentials('ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh12');
+        const result = scanInputForCredentials('ghp_Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6B5C4A3D2');
         expect(result.status).toBe('blocked');
         expect(result.detections[0].type).toBe('github_token');
     });
     it('detects Stripe live key', () => {
-        const result = scanInputForCredentials('sk_live_51HxAbCdEfGhIjKlMnOpQrStU');
+        const result = scanInputForCredentials('sk_live_Z9Y8X7W6V5U4T3S2R1Q0P9O8');
         expect(result.status).toBe('blocked');
         expect(result.detections[0].type).toBe('stripe_key');
     });
     it('detects SendGrid key', () => {
-        const result = scanInputForCredentials('SG.abcdefghijklmnopqrstuv.1234567890abcdefghijklmnopqrstuvwxyz1234567');
+        const result = scanInputForCredentials('SG.Z9Y8X7W6V5U4T3S2R1Q0P9.Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6B5C4A3D2E1F0GH7');
         expect(result.status).toBe('blocked');
         expect(result.detections[0].type).toBe('sendgrid_key');
     });
@@ -88,7 +90,7 @@ describe('scanInputForCredentials — Database URLs', () => {
         expect(dbDetection).toBeDefined();
     });
     it('detects MongoDB connection string', () => {
-        const result = scanInputForCredentials('mongodb+srv://admin:s3cret@cluster0.abc123.mongodb.net/production');
+        const result = scanInputForCredentials('mongodb+srv://admin:s3cret@cluster0.prod.mongodb.net/production');
         expect(result.status).toBe('blocked');
     });
     it('detects Redis connection string', () => {
@@ -107,24 +109,30 @@ describe('scanInputForCredentials — Tokens', () => {
 });
 // ── Generic Patterns ─────────────────────────────────────────────
 describe('scanInputForCredentials — Generic patterns', () => {
-    it('detects password assignment', () => {
-        const result = scanInputForCredentials("password = 'SuperSecret123!'");
-        expect(result.status).toBe('blocked');
-        expect(result.detections[0].type).toBe('password_assignment');
+    it('allows ambiguous short password assignment without high entropy', () => {
+        const result = scanInputForCredentials("password = 'WinterAccess987!'");
+        expect(result.status).toBe('clean');
     });
-    it('detects api_key assignment', () => {
+    it('allows placeholder api_key assignment', () => {
         const result = scanInputForCredentials('api_key: "abcdefghijklmnopqrstuvwxyz"');
-        expect(result.status).toBe('blocked');
+        expect(result.status).toBe('clean');
+        expect(result.detections).toHaveLength(0);
+        expect(result.allowed_detections?.[0].reason_codes).toContain('safe_example_value');
     });
-    it('detects .env format', () => {
-        const result = scanInputForCredentials('DATABASE_PASSWORD=myS3cr3tP@ssw0rd!');
-        expect(result.status).toBe('blocked');
+    it('warns on high-entropy api_key assignment', () => {
+        const result = scanInputForCredentials('api_key: "Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4"');
+        expect(result.status).toBe('warning');
+        expect(result.detections[0].decision).toBe('warn');
+        expect(result.detections[0].reason_codes).toContain('high_entropy');
+    });
+    it('warns on high-entropy .env format values', () => {
+        const result = scanInputForCredentials('DATABASE_PASSWORD=Z9y8X7w6V5u4T3s2R1q0P9o8N7m6B5c4Xy');
+        expect(result.status).toBe('warning');
         expect(result.detections.some(d => d.type === 'env_variable')).toBe(true);
     });
-    it('detects URL with embedded credentials', () => {
+    it('allows placeholder URL with embedded credentials', () => {
         const result = scanInputForCredentials('http://admin:password123@internal-api.company.com/v1');
-        expect(result.status).toBe('blocked');
-        expect(result.detections.some(d => d.type === 'credentials_in_url')).toBe(true);
+        expect(result.status).toBe('clean');
     });
 });
 // ── Clean Input ──────────────────────────────────────────────────
@@ -142,6 +150,27 @@ describe('scanInputForCredentials — Clean input', () => {
         const result = scanInputForCredentials('password = "xxx"');
         expect(result.status).toBe('clean'); // too short
     });
+    it('returns clean for SSH host aliases without sensitive options', () => {
+        const result = scanInputForCredentials('ssh deploy@staging');
+        expect(result.status).toBe('clean');
+    });
+    it('returns clean for public Stripe keys', () => {
+        const result = scanInputForCredentials('STRIPE_PUBLIC_KEY=pk_test_123456789012345678901234');
+        expect(result.status).toBe('clean');
+        expect(result.allowed_detections?.[0].reason_codes).toContain('public_or_test_key');
+    });
+    it('returns clean for fake provider samples in docs', () => {
+        const result = scanInputForCredentials('// example: AKIAIOSFODNN7EXAMPLE');
+        expect(result.status).toBe('clean');
+    });
+    it('returns clean for checksum lines', () => {
+        const result = scanInputForCredentials('sha256:abcdefabcdefabcdefabcdefabcdefabcdef');
+        expect(result.status).toBe('clean');
+    });
+    it('returns clean for env variable references', () => {
+        const result = scanInputForCredentials('NPM_TOKEN=${NPM_TOKEN}');
+        expect(result.status).toBe('clean');
+    });
 });
 // ── Config Options ───────────────────────────────────────────────
 describe('scanInputForCredentials — Config', () => {
@@ -150,7 +179,7 @@ describe('scanInputForCredentials — Config', () => {
         expect(result.status).toBe('clean');
     });
     it('returns warning instead of blocked when block_on_detection is false', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE', { block_on_detection: false });
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2', { block_on_detection: false });
         expect(result.status).toBe('warning');
         expect(result.detections).toHaveLength(1);
     });
@@ -163,7 +192,7 @@ describe('scanInputForCredentials — Config', () => {
         const result = scanInputForCredentials('internal-token-XYZ123456', {
             custom_patterns: ['internal-token-[A-Z0-9]+'],
         });
-        expect(result.status).toBe('blocked');
+        expect(result.status).toBe('warning');
         expect(result.detections[0].type).toBe('custom_pattern');
     });
     it('respects ignore patterns', () => {
@@ -190,27 +219,26 @@ describe('scanInputForCredentials — Performance', () => {
 describe('scanInputForCredentials — Deduplication', () => {
     it('deduplicates overlapping detections and keeps higher severity', () => {
         // Input that might trigger both generic password_assignment and a more specific pattern
-        const input = 'api_key = "sk-proj-abc1234567890ABCDEFGH"';
+        const input = 'api_key = "sk-proj-Z9Y8X7W6V5U4T3S2R1Q0P9O8N7M6"';
         const result = scanInputForCredentials(input);
         // Should not have duplicate detections for the same match region
         const positions = result.detections.map(d => d.position?.start);
         const uniquePositions = new Set(positions);
-        // The exact count depends on pattern overlaps, but there should be some deduplication
-        expect(result.detections.length).toBeLessThanOrEqual(positions.length);
+        expect(uniquePositions.size).toBe(positions.length);
     });
 });
 // ── Redaction ────────────────────────────────────────────────────
 describe('scanInputForCredentials — Redaction', () => {
     it('redacts matched credentials', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2');
         expect(result.detections[0].redacted).toContain('****');
-        expect(result.detections[0].redacted).not.toBe('AKIAIOSFODNN7EXAMPLE');
+        expect(result.detections[0].redacted).not.toBe('AKIAZ9Y8X7W6V5U4T3Q2');
     });
 });
 // ── Compliance ───────────────────────────────────────────────────
 describe('scanInputForCredentials — Compliance', () => {
     it('includes compliance tags for AWS keys', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2');
         expect(result.detections[0].compliance).toContain('SOC2-CC6.1');
         expect(result.detections[0].compliance).toContain('HIPAA-164.312');
         expect(result.detections[0].compliance).toContain('PCI-DSS-3.4');
@@ -224,28 +252,30 @@ describe('formatDLPAlert', () => {
         expect(alert).toContain('clean');
     });
     it('shows BLOCKED header when credentials found', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2');
         const alert = formatDLPAlert(result);
         expect(alert).toContain('BLOCKED');
-        expect(alert).toContain('credential');
+        expect(alert).toContain('likely live secret');
     });
     it('shows WARNING header when block_on_detection is false', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE', { block_on_detection: false });
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2', { block_on_detection: false });
         const alert = formatDLPAlert(result);
         expect(alert).toContain('WARNING');
     });
     it('includes severity, redacted value, and recommendation', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2');
         const alert = formatDLPAlert(result);
         expect(alert).toContain('CRITICAL');
         expect(alert).toContain('****');
+        expect(alert).toContain('Confidence');
+        expect(alert).toContain('Why');
         expect(alert).toContain('process.env');
     });
 });
 // ── createDLPAuditEntry ──────────────────────────────────────────
 describe('createDLPAuditEntry', () => {
     it('creates structured audit entry', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2');
         const entry = createDLPAuditEntry(result, { agent: 'claude', userId: 'test-user' });
         expect(entry.type).toBe('dlp_event');
         expect(entry.agent).toBe('claude');
@@ -261,11 +291,39 @@ describe('createDLPAuditEntry', () => {
         expect(entry.timestamp).toBe(ts);
     });
     it('redacts credentials in audit log (no raw match)', () => {
-        const result = scanInputForCredentials('AKIAIOSFODNN7EXAMPLE');
+        const result = scanInputForCredentials('AKIAZ9Y8X7W6V5U4T3Q2');
         const entry = createDLPAuditEntry(result, { agent: 'claude' });
         const detections = entry.detections;
         // Audit entry should have redacted field but NOT the raw match
         expect(detections[0].redacted).toBeDefined();
         expect(detections[0].match).toBeUndefined();
+        expect(detections[0].confidence).toBeDefined();
+        expect(detections[0].decision).toBe('block');
+    });
+});
+describe('false positive regression', () => {
+    it('allows engineering prompts about API key storage', () => {
+        const result = scanInputForCredentials('Should Cursor Admin API keys be stored in ~/.rigour/settings.json under cursor.apiKey?');
+        expect(result.status).toBe('clean');
+    });
+    it('allows credential-less localhost database URLs', () => {
+        expect(scanInputForCredentials('redis://localhost:6379').status).toBe('clean');
+        expect(scanInputForCredentials('mongodb://localhost:27017/test').status).toBe('clean');
+    });
+    it('allows placeholder env assignments', () => {
+        expect(scanInputForCredentials('API_KEY=your-key-here').status).toBe('clean');
+        expect(scanInputForCredentials('api_key = "replace-me"').status).toBe('clean');
+    });
+    it('allows bare SK-like token without Twilio context', () => {
+        expect(scanInputForCredentials('SK-test-fixture-not-a-real-twilio-key').status).toBe('clean');
+    });
+    it('allows sk-proj examples in comments', () => {
+        expect(scanInputForCredentials('// sk-proj-abcdefghijklmnopqrstuvwxyz').status).toBe('clean');
+    });
+    it('still blocks live production database URLs', () => {
+        expect(scanInputForCredentials('postgresql://user:password@prod-server:5432/mydb').status).toBe('blocked');
+    });
+    it('still blocks live AWS keys in prose', () => {
+        expect(scanInputForCredentials('Here is my key: AKIAZ9Y8X7W6V5U4T3Q2').status).toBe('blocked');
     });
 });

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export * from './utils/logger.js';
 export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
 export * from './hooks/index.js';
-export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getProviderKey, getAgentConfig, getCliPreferences, updateProviderKey, removeProviderKey } from './settings.js';
+export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getProviderKey, getAgentConfig, getCliPreferences, updateProviderKey, removeProviderKey, getCursorApiKey, updateCursorApiKey } from './settings.js';
 export type { RigourSettings, ResolvedDeepOptions, CLIDeepOptions } from './settings.js';
 export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
@@ -32,3 +32,8 @@ export { IncrementalCache } from './services/incremental-cache.js';
 export type { IncrementalResult } from './services/incremental-cache.js';
 export { renderScoreGauge, renderSeveritySection, renderGateGrid, renderBrainStatus, renderFullReport, renderMcpHeadline, renderFixAttribution } from './services/terminal-renderer.js';
 export type { RenderOptions, GateResult } from './services/terminal-renderer.js';
+export * from './context/cache-engine.js';
+export * from './context/context-session.js';
+export * from './context/index-bridge.js';
+export * from './services/context-telemetry-service.js';
+export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';

package/dist/index.js

@@ -13,7 +13,7 @@ export { FileScanner } from './utils/scanner.js';
 export * from './services/score-history.js';
 export * from './hooks/index.js';
 // Settings Module (Global user config at ~/.rigour/settings.json)
-export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getProviderKey, getAgentConfig, getCliPreferences, updateProviderKey, removeProviderKey } from './settings.js';
+export { loadSettings, saveSettings, getSettingsPath, resolveDeepOptions, getProviderKey, getAgentConfig, getCliPreferences, updateProviderKey, removeProviderKey, getCursorApiKey, updateCursorApiKey } from './settings.js';
 // Deep Analysis Pipeline (v4.0+)
 export { DeepAnalysisGate } from './gates/deep-analysis.js';
 export { createProvider } from './inference/index.js';
@@ -32,6 +32,12 @@ export { getProvenanceTrends, getQualityTrend } from './services/adaptive-thresh
 export { IncrementalCache } from './services/incremental-cache.js';
 // Terminal Renderer (rich CLI/MCP output)
 export { renderScoreGauge, renderSeveritySection, renderGateGrid, renderBrainStatus, renderFullReport, renderMcpHeadline, renderFixAttribution } from './services/terminal-renderer.js';
+// Context Telemetry & 4-Layer Caching Engine
+export * from './context/cache-engine.js';
+export * from './context/context-session.js';
+export * from './context/index-bridge.js';
+export * from './services/context-telemetry-service.js';
+export { recordContextEvent, recordModelUsage, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics, } from './storage/index.js';
 // Pattern Index is intentionally NOT exported here to prevent
 // native dependency issues (sharp/transformers) from leaking into
 // non-AI parts of the system.