@safetnsr/vet 0.2.1 → 0.4.0

package/dist/checks/secrets.js

@@ -0,0 +1,280 @@
+import { existsSync, readdirSync, readFileSync, statSync, createReadStream } from 'node:fs';
+import { join, relative, extname, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { execSync } from 'node:child_process';
+import { createInterface } from 'node:readline';
+// ── Shannon entropy ──────────────────────────────────────────────────────────
+function calculateEntropy(str) {
+    if (str.length === 0)
+        return 0;
+    const freq = {};
+    for (const ch of str)
+        freq[ch] = (freq[ch] ?? 0) + 1;
+    let entropy = 0;
+    const len = str.length;
+    for (const count of Object.values(freq)) {
+        const p = count / len;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+function isHighEntropy(str) {
+    if (str.length < 20)
+        return false;
+    if (!/^[a-zA-Z0-9+/=_-]+$/.test(str))
+        return false;
+    return calculateEntropy(str) > 4.5;
+}
+const LEAK_PATTERNS = [
+    { name: 'Google API Key', regex: /AIza[0-9A-Za-z_-]{35}/g, severity: 'high' },
+    { name: 'Stripe Secret Key', regex: /sk_live_[0-9a-zA-Z]{24,}/g, severity: 'critical' },
+    { name: 'Stripe Publishable Key', regex: /pk_live_[0-9a-zA-Z]{24,}/g, severity: 'info' },
+    { name: 'Anthropic API Key', regex: /sk-ant-[a-zA-Z0-9_-]{40,}/g, severity: 'critical' },
+    { name: 'OpenAI API Key', regex: /sk-(?!live_)[a-zA-Z0-9]{20,}/g, severity: 'critical' },
+    { name: 'GitHub Token (ghp)', regex: /ghp_[a-zA-Z0-9]{36}/g, severity: 'critical' },
+    { name: 'GitHub Token (gho)', regex: /gho_[a-zA-Z0-9]{36}/g, severity: 'critical' },
+    { name: 'GitHub Token (ghu)', regex: /ghu_[a-zA-Z0-9]{36}/g, severity: 'critical' },
+    { name: 'GitHub Token (ghs)', regex: /ghs_[a-zA-Z0-9]{36}/g, severity: 'critical' },
+    { name: 'GitHub Token (ghr)', regex: /ghr_[a-zA-Z0-9]{36}/g, severity: 'critical' },
+    { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/g, severity: 'critical' },
+    { name: 'JWT Token', regex: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+/g, severity: 'medium' },
+    { name: 'Private Key', regex: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g, severity: 'critical' },
+    { name: 'MongoDB Connection String', regex: /mongodb:\/\/[^\s'"]+/g, severity: 'high' },
+    { name: 'Postgres Connection String', regex: /postgres:\/\/[^\s'"]+/g, severity: 'high' },
+    { name: 'MySQL Connection String', regex: /mysql:\/\/[^\s'"]+/g, severity: 'high' },
+    { name: 'Redis Connection String', regex: /redis:\/\/[^\s'"]+/g, severity: 'high' },
+    { name: 'Slack Token', regex: /xox[bpsa]-[a-zA-Z0-9-]+/g, severity: 'critical' },
+    { name: 'Twilio API Key', regex: /SK[a-f0-9]{32}/g, severity: 'high' },
+    { name: 'SendGrid API Key', regex: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g, severity: 'high' },
+];
+const ENV_PATTERNS = [
+    { provider: 'Anthropic', pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/, envVars: ['ANTHROPIC_API_KEY'], costEstimate: '$20-500/mo' },
+    { provider: 'OpenAI', pattern: /sk-proj-[a-zA-Z0-9_-]{20,}/, envVars: ['OPENAI_API_KEY'], costEstimate: '$20-1000/mo' },
+    { provider: 'Google AI', pattern: /AIza[a-zA-Z0-9_-]{35}/, envVars: ['GOOGLE_AI_API_KEY', 'GEMINI_API_KEY'], costEstimate: '$10-500/mo' },
+    { provider: 'Replicate', pattern: /r8_[a-zA-Z0-9]{37}/, envVars: ['REPLICATE_API_TOKEN'], costEstimate: '$5-200/mo' },
+    { provider: 'HuggingFace', pattern: /hf_[a-zA-Z0-9]{34}/, envVars: ['HF_TOKEN', 'HUGGINGFACE_API_KEY'], costEstimate: '$0-100/mo' },
+    { provider: 'Groq', pattern: /gsk_[a-zA-Z0-9]{48,}/, envVars: ['GROQ_API_KEY'], costEstimate: '$0-50/mo' },
+    { provider: 'Fireworks', pattern: /fw_[a-zA-Z0-9]{30,}/, envVars: ['FIREWORKS_API_KEY'], costEstimate: '$5-200/mo' },
+    { provider: 'DeepSeek', pattern: /sk-[a-f0-9]{32,}/, envVars: ['DEEPSEEK_API_KEY'], costEstimate: '$5-100/mo' },
+];
+const ENV_ONLY_PROVIDERS = new Set(['Cohere', 'Mistral', 'Together']);
+function detectEnvKeys(line) {
+    const matches = [];
+    const seen = new Set();
+    for (const p of ENV_PATTERNS) {
+        if (p.envVars) {
+            for (const envVar of p.envVars) {
+                const envRe = new RegExp(`${envVar}\\s*=\\s*["']?([^"'\\s#]+)["']?`);
+                const m = line.match(envRe);
+                if (m && m[1] && m[1].length >= 8 && !seen.has(m[1])) {
+                    seen.add(m[1]);
+                    matches.push({ provider: p.provider, key: m[1], costEstimate: p.costEstimate });
+                }
+            }
+        }
+        if (ENV_ONLY_PROVIDERS.has(p.provider))
+            continue;
+        const m = line.match(p.pattern);
+        if (m && m[0] && !seen.has(m[0])) {
+            seen.add(m[0]);
+            matches.push({ provider: p.provider, key: m[0], costEstimate: p.costEstimate });
+        }
+    }
+    return matches;
+}
+function isGitTracked(filePath) {
+    try {
+        const result = execSync(`git ls-files --error-unmatch "${filePath}"`, {
+            cwd: dirname(filePath),
+            stdio: ['pipe', 'pipe', 'pipe'],
+            encoding: 'utf-8',
+        });
+        return result.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function maskKey(key) {
+    if (key.length <= 8)
+        return '****';
+    return key.slice(0, 4) + '…' + key.slice(-4);
+}
+// ── Build output scanning ────────────────────────────────────────────────────
+const SCANNABLE_EXTS = new Set(['.js', '.mjs', '.cjs', '.css', '.html', '.json', '.map']);
+const SKIP_EXTS = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.webp',
+    '.woff', '.woff2', '.ttf', '.eot', '.otf',
+    '.wasm', '.zip', '.gz', '.br',
+    '.mp4', '.mp3', '.wav', '.webm', '.pdf',
+]);
+const BUILD_DIRS = ['dist', 'build', '.next', 'out', 'public'];
+function detectBuildDir(cwd) {
+    for (const candidate of BUILD_DIRS) {
+        const full = join(cwd, candidate);
+        if (existsSync(full) && statSync(full).isDirectory())
+            return full;
+    }
+    return null;
+}
+function walkBuild(dir) {
+    const results = [];
+    try {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === 'node_modules')
+                    continue;
+                results.push(...walkBuild(full));
+            }
+            else {
+                results.push(full);
+            }
+        }
+    }
+    catch { /* skip */ }
+    return results;
+}
+function shouldScan(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    if (SKIP_EXTS.has(ext))
+        return false;
+    return SCANNABLE_EXTS.has(ext);
+}
+async function scanBuildFile(filePath) {
+    const findings = [];
+    const ext = extname(filePath).toLowerCase();
+    if (ext === '.map') {
+        findings.push({ name: 'Source Map', severity: 'medium', preview: 'Source map exposes original source code', line: 0 });
+        return findings;
+    }
+    const rl = createInterface({ input: createReadStream(filePath, { encoding: 'utf8' }), crlfDelay: Infinity });
+    let lineNumber = 0;
+    for await (const lineText of rl) {
+        lineNumber++;
+        for (const pattern of LEAK_PATTERNS) {
+            pattern.regex.lastIndex = 0;
+            let m;
+            while ((m = pattern.regex.exec(lineText)) !== null) {
+                const masked = lineText.replace(m[0], m[0].slice(0, 4) + '****' + m[0].slice(-4));
+                findings.push({ name: pattern.name, severity: pattern.severity, preview: masked.slice(0, 120), line: lineNumber });
+                if (m[0].length === 0) {
+                    pattern.regex.lastIndex++;
+                    break;
+                }
+            }
+            pattern.regex.lastIndex = 0;
+        }
+    }
+    return findings;
+}
+// ── Dev environment scanning ─────────────────────────────────────────────────
+function findEnvFiles(dir, maxDepth = 3, depth = 0) {
+    if (depth > maxDepth)
+        return [];
+    const files = [];
+    try {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isFile()) {
+                if (entry.name === '.env' || entry.name.startsWith('.env.') || entry.name.endsWith('.env')) {
+                    files.push(full);
+                }
+            }
+            else if (entry.isDirectory() && !entry.name.startsWith('.') && entry.name !== 'node_modules') {
+                files.push(...findEnvFiles(full, maxDepth, depth + 1));
+            }
+        }
+    }
+    catch { /* skip */ }
+    return files;
+}
+function scanEnvFile(filePath) {
+    const findings = [];
+    try {
+        const lines = readFileSync(filePath, 'utf-8').split('\n');
+        const gitTracked = isGitTracked(filePath);
+        for (const line of lines) {
+            if (line.trimStart().startsWith('#'))
+                continue;
+            for (const m of detectEnvKeys(line)) {
+                findings.push({ ...m, gitTracked, file: filePath });
+            }
+        }
+    }
+    catch { /* skip */ }
+    return findings;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkSecrets(cwd) {
+    const issues = [];
+    // 1. Build output scan
+    const buildDir = detectBuildDir(cwd);
+    if (buildDir) {
+        const buildFiles = walkBuild(buildDir).filter(f => shouldScan(f));
+        for (const file of buildFiles) {
+            try {
+                const findings = await scanBuildFile(file);
+                for (const f of findings) {
+                    issues.push({
+                        severity: f.severity === 'critical' ? 'error' : f.severity === 'high' ? 'warning' : 'info',
+                        message: `[build] ${f.name}: ${f.preview}`,
+                        file: relative(cwd, file),
+                        line: f.line || undefined,
+                        fixable: false,
+                    });
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    // 2. .env files in project
+    const envFiles = findEnvFiles(cwd);
+    for (const envFile of envFiles) {
+        const findings = scanEnvFile(envFile);
+        for (const f of findings) {
+            const relPath = relative(cwd, f.file);
+            const severity = f.gitTracked ? 'error' : 'warning';
+            issues.push({
+                severity,
+                message: `[env] ${f.provider} key in ${relPath}${f.gitTracked ? ' (git-tracked!)' : ''} — ${maskKey(f.key)} (${f.costEstimate})`,
+                file: relPath,
+                fixable: false,
+                fixHint: f.gitTracked ? 'remove from git: git rm --cached ' + relPath : undefined,
+            });
+        }
+    }
+    // 3. Home dotfiles (shell history, rc files)
+    const home = homedir();
+    const dotfiles = ['.bashrc', '.zshrc', '.bash_profile', '.profile', '.zprofile'];
+    for (const name of dotfiles) {
+        const fp = join(home, name);
+        if (!existsSync(fp))
+            continue;
+        const findings = scanEnvFile(fp);
+        for (const f of findings) {
+            issues.push({
+                severity: 'warning',
+                message: `[home] ${f.provider} key in ~/${name} — ${maskKey(f.key)} (${f.costEstimate})`,
+                file: `~/${name}`,
+                fixable: false,
+            });
+        }
+    }
+    // Score: each critical issue = -3, warning = -1
+    const errors = issues.filter(i => i.severity === 'error').length;
+    const warnings = issues.filter(i => i.severity === 'warning').length;
+    const score = Math.max(0, Math.min(10, 10 - errors * 3 - warnings * 1));
+    const buildNote = buildDir ? '' : ' (no build dir found)';
+    return {
+        name: 'secrets',
+        score: Math.round(score * 10) / 10,
+        maxScore: 10,
+        issues,
+        summary: issues.length === 0
+            ? `no leaked secrets detected${buildNote}`
+            : `${issues.length} secret${issues.length !== 1 ? 's' : ''} found${buildNote}`,
+    };
+}

package/dist/cli.js

@@ -5,9 +5,11 @@ import { isGitRepo, readFile, c } from './util.js';
 import { checkReady } from './checks/ready.js';
 import { checkDiff } from './checks/diff.js';
 import { checkModels } from './checks/models.js';
-import { checkLinks } from './checks/links.js';
 import { checkConfig } from './checks/config.js';
 import { checkHistory } from './checks/history.js';
+import { checkScan } from './checks/scan.js';
+import { checkSecrets } from './checks/secrets.js';
+import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON } from './reporter.js';
 const args = process.argv.slice(2);
@@ -35,10 +37,21 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet --since HEAD~5     check specific commit range
     npx @safetnsr/vet --watch            live monitoring during AI sessions
     npx @safetnsr/vet init               generate configs + hooks
+    npx @safetnsr/vet receipt            show last agent session receipt
+
+  ${c.dim}checks:${c.reset}
+    ready     codebase readiness for AI agents
+    diff      AI-specific anti-patterns in recent changes
+    models    deprecated/risky model usage
+    config    agent config hygiene
+    history   git history quality
+    scan      malicious patterns in agent config files
+    secrets   leaked secrets in build output and .env files
+    receipt   last agent session audit (informational)
 
   ${c.dim}options:${c.reset}
     --ci          CI mode (exit 1 if score < threshold)
-    --fix         auto-fix configs, models, links
+    --fix         auto-fix configs, models
     --since REF   diff against specific commit/range
     --watch       re-run on file changes
     --json        JSON output
@@ -54,11 +67,11 @@ if (flags.has('--version') || flags.has('-v')) {
         console.log(pkg.version);
     }
     catch {
-        console.log('0.2.0');
+        console.log('0.3.0');
     }
     process.exit(0);
 }
-const COMMANDS = ['init'];
+const COMMANDS = ['init', 'receipt'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -81,6 +94,11 @@ if (command === 'init') {
     await init(cwd);
     process.exit(0);
 }
+if (command === 'receipt') {
+    const format = isJSON ? 'json' : 'ascii';
+    await runReceiptCommand(format);
+    process.exit(0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -90,12 +108,10 @@ if (isFix) {
     console.log(`\n  ${c.bold}vet --fix${c.reset}\n`);
     const { fixConfig } = await import('./fix/config.js');
     const { fixModels } = await import('./fix/models.js');
-    const { fixLinks } = await import('./fix/links.js');
     const configResult = fixConfig(cwd);
     const modelsResult = fixModels(cwd, ignore);
-    const linksResult = fixLinks(cwd, ignore);
-    const allMessages = [...configResult.messages, ...modelsResult.messages, ...linksResult.messages];
-    const totalFixed = configResult.fixed + modelsResult.fixed + linksResult.fixed;
+    const allMessages = [...configResult.messages, ...modelsResult.messages];
+    const totalFixed = configResult.fixed + modelsResult.fixed;
     if (allMessages.length > 0) {
         for (const msg of allMessages)
             console.log(msg);
@@ -104,7 +120,7 @@ if (isFix) {
     process.exit(0);
 }
 async function runChecks() {
-    const allChecks = ['ready', 'diff', 'models', 'links', 'config', 'history'];
+    const allChecks = ['ready', 'diff', 'models', 'config', 'history', 'scan', 'secrets', 'receipt'];
     const enabledChecks = config.checks || allChecks;
     const results = [];
     // ready and models are async (try rich subpackages first, fallback to built-in)
@@ -114,12 +130,16 @@ async function runChecks() {
         results.push(checkDiff(cwd, { since }));
     if (enabledChecks.includes('models'))
         results.push(await checkModels(cwd, ignore));
-    if (enabledChecks.includes('links'))
-        results.push(checkLinks(cwd, ignore));
     if (enabledChecks.includes('config'))
         results.push(checkConfig(cwd, ignore));
     if (enabledChecks.includes('history'))
         results.push(checkHistory(cwd));
+    if (enabledChecks.includes('scan'))
+        results.push(checkScan(cwd));
+    if (enabledChecks.includes('secrets'))
+        results.push(await checkSecrets(cwd));
+    if (enabledChecks.includes('receipt'))
+        results.push(await checkReceipt(cwd));
     return score(cwd, results);
 }
 // --watch mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "vet your AI-generated code — one command, six checks, zero config",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
   ],
   "scripts": {
     "build": "tsc",
-    "dev": "tsx src/cli.ts"
+    "dev": "tsx src/cli.ts",
+    "test": "node --import tsx/esm --test 'test/*.test.mjs'"
   },
   "keywords": [
     "ai",