@searls/turbocommit 0.11.0 → 0.12.1

package/lib/git.js

@@ -1,4 +1,5 @@
 const { execSync } = require('child_process')
+const path = require('path')
 
 function git (args, opts = {}) {
   const cwd = opts.cwd || process.cwd()
@@ -17,6 +18,16 @@ function gitRoot (cwd) {
   }
 }
 
+function gitCommonDir (cwd) {
+  try {
+    const out = git('rev-parse --git-common-dir', { cwd })
+    if (!out) return null
+    return path.isAbsolute(out) ? out : path.resolve(cwd, out)
+  } catch {
+    return null
+  }
+}
+
 function hasChanges (cwd) {
   try {
     git('diff --quiet HEAD', { cwd })
@@ -72,6 +83,7 @@ function esc (s) {
 module.exports = {
   git,
   gitRoot,
+  gitCommonDir,
   hasChanges,
   addAndCommit,
   hasCommits,

package/lib/redact.js

@@ -0,0 +1,156 @@
+const SAFE_NAMES = new Set([
+  // Shell / OS
+  'HOME', 'USER', 'SHELL', 'PATH', 'PWD', 'OLDPWD', 'LANG', 'TERM',
+  'EDITOR', 'VISUAL', 'PAGER', 'HOSTNAME', 'LOGNAME', 'DISPLAY', 'TZ',
+  'TMPDIR', 'SHLVL', '_', 'BROWSER', 'COMMAND_MODE', 'COLUMNS', 'LINES',
+  'MANPATH', 'INFOPATH',
+
+  // Terminal
+  'COLORTERM', 'TERM_PROGRAM', 'TERM_PROGRAM_VERSION', 'TERM_SESSION_ID',
+  'ITERM_SESSION_ID', 'ITERM_PROFILE', 'APPLE_TERMINAL_ID',
+
+  // Locale
+  'LC_ALL', 'LC_COLLATE', 'LC_CTYPE', 'LC_MESSAGES', 'LC_MONETARY',
+  'LC_NUMERIC', 'LC_TIME',
+
+  // XDG
+  'XDG_DATA_HOME', 'XDG_CONFIG_HOME', 'XDG_STATE_HOME', 'XDG_CACHE_HOME',
+  'XDG_RUNTIME_DIR', 'XDG_DATA_DIRS', 'XDG_CONFIG_DIRS', 'XDG_SESSION_TYPE',
+  'XDG_CURRENT_DESKTOP', 'XDG_SESSION_CLASS', 'XDG_SESSION_ID', 'XDG_SEAT',
+  'XDG_VTNR', 'XDG_MENU_PREFIX',
+
+  // Dev environment
+  'NODE_ENV', 'RAILS_ENV', 'RACK_ENV', 'GO_ENV', 'MIX_ENV', 'FLASK_ENV',
+  'DEBUG', 'VERBOSE', 'LOG_LEVEL', 'PORT', 'HOST', 'CI',
+  'NVM_DIR', 'NVM_BIN', 'NVM_INC', 'NVM_CD_FLAGS',
+  'VOLTA_HOME', 'HOMEBREW_PREFIX', 'HOMEBREW_CELLAR', 'HOMEBREW_REPOSITORY',
+  'HOMEBREW_SHELLENV_PREFIX',
+
+  // SSH / GPG (socket paths, not keys)
+  'SSH_AUTH_SOCK', 'SSH_AGENT_PID', 'GPG_AGENT_INFO', 'GPG_TTY',
+
+  // Git
+  'GIT_EDITOR', 'GIT_PAGER', 'GIT_TERMINAL_PROMPT'
+])
+
+// Values that are common English words, config toggles, or well-known
+// non-secret defaults. Checked case-insensitively.
+const SAFE_VALUES = new Set([
+  // Boolean-like
+  'true', 'false', 'yes', 'no', 'on', 'off',
+
+  // Environment modes
+  'development', 'production', 'staging', 'test', 'testing',
+  'dev', 'prod', 'local', 'ci', 'qa', 'sandbox', 'preview',
+  'canary', 'demo', 'benchmark', 'profile', 'uat', 'integration',
+  'preprod', 'pre-production', 'stage', 'deployment',
+
+  // Log levels
+  'trace', 'debug', 'info', 'warn', 'warning', 'error', 'fatal',
+  'critical', 'notice', 'verbose', 'silent', 'quiet', 'off',
+
+  // Common toggles/modes
+  'enabled', 'disabled', 'always', 'never', 'auto', 'default',
+  'manual', 'none', 'null', 'undefined', 'inherit', 'unset',
+  'strict', 'lax', 'permissive', 'enforcing', 'noninteractive',
+
+  // Editors, pagers, browsers (bare names)
+  'vim', 'vi', 'nano', 'emacs', 'nvim', 'code', 'subl', 'mate',
+  'micro', 'ed', 'pico', 'gedit', 'kate', 'hx', 'kak', 'kakoune',
+  'joe', 'emacsclient', 'less', 'more', 'most', 'cat',
+  'open', 'firefox', 'chromium', 'links', 'lynx', 'w3m', 'safari', 'opera',
+
+  // Common English words that appear as env values
+  'allow', 'deny', 'block', 'drop', 'accept', 'reject',
+  'public', 'private', 'master', 'main', 'release',
+  'read', 'write', 'root', 'latest', 'stable', 'edge',
+  'screen', 'random', 'node', 'ruby', 'python', 'go', 'java',
+  'rust', 'php', 'slim', 'alpine',
+  'localhost',
+
+  // Platform/architecture identifiers
+  'linux', 'darwin', 'win32', 'windows', 'freebsd', 'openbsd',
+  'netbsd', 'sunos', 'aix', 'android', 'cygwin', 'msys',
+  'x86_64', 'amd64', 'x64', 'arm64', 'aarch64', 'i386', 'i686',
+  'ia32', 'armv7l', 'arm', 'ppc64le', 's390x', 'riscv64',
+
+  // TERM values
+  'xterm', 'xterm-256color', 'xterm-color', 'xterm-16color',
+  'screen', 'screen-256color', 'tmux', 'tmux-256color',
+  'linux', 'vt100', 'vt220', 'dumb', 'ansi', 'rxvt',
+  'rxvt-unicode', 'rxvt-unicode-256color', 'alacritty', 'kitty',
+  'wezterm', 'eterm-color', 'foot', 'foot-extra',
+  'gnome-256color', 'konsole-256color', 'st-256color',
+  'putty', 'putty-256color',
+
+  // COLORTERM
+  'truecolor', '24bit',
+
+  // TERM_PROGRAM
+  'apple_terminal', 'iterm.app', 'vscode', 'hyper',
+
+  // Docker/CI identifiers
+  'bullseye', 'bookworm', 'jammy', 'lts',
+  'travis-ci', 'circleci', 'codeship', 'github-actions',
+  'gitlab-ci', 'jenkins', 'buildkite',
+
+  // System users
+  'nobody', 'www-data', 'daemon', 'nonroot', 'appuser',
+  'nginx', 'postgres', 'mysql', 'redis',
+
+  // XDG session types
+  'x11', 'wayland', 'tty',
+
+  // Metasyntactic / genuinely-never-a-credential values
+  'todo', 'fixme', 'tbd', 'n/a',
+  'xxx', 'yyy', 'zzz', 'foo', 'bar', 'baz',
+  'lorem', 'temp', 'tmp', 'blah'
+])
+
+// Pattern-based rules for values that match known non-secret formats
+const SAFE_VALUE_PATTERNS = [
+  /^\d+$/, // pure numeric
+  /^(.)\1+$/, // repeated single char (xxxx, ****, ....)
+  /^\d+\.\d+\.\d+(-[\w.]+)?$/, // semver (18.17.1, 1.0.0-beta.1)
+  /^[a-z]{2}_[A-Z]{2}([.\w-]*)?$/, // locale (en_US.UTF-8)
+  /^(C|POSIX)(\.UTF-8)?$/, // C/POSIX locale
+  /^[A-Z][a-z]+\/[A-Za-z_]+$/, // timezone (America/New_York)
+  /^(UTC|Etc\/UTC|US\/\w+)$/, // timezone shorthand
+  /^\/[a-z][\w/.-]*$/, // unix path (/usr/local/bin)
+  /^(https?|redis|mongodb|postgres(ql)?|mysql|amqp|smtp|memcached|elasticsearch):\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0|::1)/, // localhost URLs
+  /^(xterm|screen|tmux|linux|vt\d+|dumb|ansi|rxvt|alacritty|kitty|wezterm|foot)(-[\w]+)*$/, // TERM identifiers
+  /^(localhost)?:\d+(\.\d+)?$/, // X11 DISPLAY (:0, :0.0)
+  /^wayland-\d+$/, // Wayland display
+  /^sqlite:(\/\/\/)?(:\w+:|[\w./]+)$/ // sqlite URLs
+]
+
+function isSafeValue (value) {
+  if (!value || value.length <= 3) return true
+  if (SAFE_VALUES.has(value.toLowerCase())) return true
+  for (const pattern of SAFE_VALUE_PATTERNS) {
+    if (pattern.test(value)) return true
+  }
+  return false
+}
+
+function buildRedactions (env) {
+  env = env || process.env
+  const entries = []
+  for (const [name, value] of Object.entries(env)) {
+    if (SAFE_NAMES.has(name)) continue
+    if (isSafeValue(value)) continue
+    entries.push({ name, value })
+  }
+  entries.sort((a, b) => b.value.length - a.value.length)
+  return entries
+}
+
+function redact (text, redactions) {
+  if (!text) return text
+  for (const { name, value } of redactions) {
+    text = text.replaceAll(value, '[REDACTED:' + name + ']')
+  }
+  return text
+}
+
+module.exports = { buildRedactions, redact }

package/lib/run.js

@@ -8,6 +8,7 @@ const { gitRoot, hasChanges, addAndCommit, hasCommits, currentBranch, pushClean
 const { logEvent } = require('./log')
 const { wrapText } = require('./wrap')
 const { hasTrackedModifications, cleanupTracking } = require('./track')
+const { redact, buildRedactions } = require('./redact')
 const { getAncestors, savePending, collectPending, cleanupConsumed, cleanupStale, readWatermark, saveWatermark, resolveParentCommit } = require('./session')
 
 /**
@@ -187,9 +188,12 @@ function run (input) {
     const coauthor = resolveCoauthor(config, hookInput.transcript_path, root)
     const tag = coauthor ? '\n\n' + coauthor : ''
 
-    const sha = addAndCommit(root, headline, wrappedBody + tag)
+    const redactions = buildRedactions()
+    const safeHeadline = redact(headline, redactions)
+    const safeBody = redact(wrappedBody + tag, redactions)
+    const sha = addAndCommit(root, safeHeadline, safeBody)
 
-    logEvent('success', { project, branch, context, title: headline })
+    logEvent('success', { project, branch, context, title: safeHeadline })
 
     if (config.push === true) {
       if (pushClean(root)) {

package/lib/session.js

@@ -1,28 +1,36 @@
 const fs = require('fs')
 const path = require('path')
 const { ensureDir } = require('./io')
+const { gitCommonDir } = require('./git')
 
 const BREADCRUMB_THRESHOLD_MS = 2000
 const STALE_TTL_MS = 24 * 60 * 60 * 1000
 
 function turbocommitDir (root) {
-  return path.join(root, '.git', 'turbocommit')
+  if (!root) return null
+  const gitDir = gitCommonDir(root)
+  if (!gitDir) return null
+  return path.join(gitDir, 'turbocommit')
 }
 
 function breadcrumbDir (root) {
-  return path.join(turbocommitDir(root), 'breadcrumbs')
+  const base = turbocommitDir(root)
+  return base && path.join(base, 'breadcrumbs')
 }
 
 function chainDir (root) {
-  return path.join(turbocommitDir(root), 'chains')
+  const base = turbocommitDir(root)
+  return base && path.join(base, 'chains')
 }
 
 function pendingDir (root) {
-  return path.join(turbocommitDir(root), 'pending')
+  const base = turbocommitDir(root)
+  return base && path.join(base, 'pending')
 }
 
 function watermarkDir (root) {
-  return path.join(turbocommitDir(root), 'watermarks')
+  const base = turbocommitDir(root)
+  return base && path.join(base, 'watermarks')
 }
 
 /**
@@ -42,6 +50,7 @@ function handleSessionEnd (input, root) {
   if (!sessionId) return
 
   const dir = breadcrumbDir(root)
+  if (!dir) return
   ensureDir(dir)
   const data = { session_id: sessionId, timestamp: Date.now() }
   fs.writeFileSync(path.join(dir, sessionId + '.json'), JSON.stringify(data) + '\n')
@@ -67,7 +76,7 @@ function handleSessionStart (input, root) {
   if (source !== 'clear' && source !== 'resume') return
 
   const dir = breadcrumbDir(root)
-  if (!fs.existsSync(dir)) return
+  if (!dir || !fs.existsSync(dir)) return
 
   // Scan breadcrumbs for closest match
   const now = Date.now()
@@ -108,6 +117,7 @@ function handleSessionStart (input, root) {
 
   // Write chain for this session
   const cDir = chainDir(root)
+  if (!cDir) return
   ensureDir(cDir)
   const chain = { parent: best.session_id, ancestors }
   fs.writeFileSync(path.join(cDir, sessionId + '.json'), JSON.stringify(chain) + '\n')
@@ -134,7 +144,9 @@ function getAncestors (root, sessionId) {
  */
 let pendingSeq = 0
 function savePending (root, sessionId, transcript) {
-  const dir = path.join(pendingDir(root), sessionId)
+  const base = pendingDir(root)
+  if (!base) return
+  const dir = path.join(base, sessionId)
   ensureDir(dir)
   const timestamp = String(Date.now()) + '-' + String(pendingSeq++).padStart(4, '0')
   fs.writeFileSync(path.join(dir, timestamp + '.txt'), transcript)
@@ -146,8 +158,10 @@ function savePending (root, sessionId, transcript) {
  */
 function collectPending (root, sessionIds) {
   const results = []
+  const base = pendingDir(root)
+  if (!base) return results
   for (const sid of sessionIds) {
-    const dir = path.join(pendingDir(root), sid)
+    const dir = path.join(base, sid)
     let files
     try {
       files = fs.readdirSync(dir).sort()
@@ -183,6 +197,7 @@ function readWatermark (root, sessionId) {
  */
 function saveWatermark (root, sessionId, pairs, commit) {
   const dir = watermarkDir(root)
+  if (!dir) return
   ensureDir(dir)
   fs.writeFileSync(path.join(dir, sessionId + '.json'), JSON.stringify({ pairs, commit }) + '\n')
 }
@@ -209,9 +224,11 @@ function resolveParentCommit (root, sessionId) {
  * Delete consumed pending + chain files after commit.
  */
 function cleanupConsumed (root, sessionIds) {
+  const base = pendingDir(root)
+  if (!base) return
   for (const sid of sessionIds) {
     // Remove pending dir
-    const dir = path.join(pendingDir(root), sid)
+    const dir = path.join(base, sid)
     try {
       const files = fs.readdirSync(dir)
       for (const file of files) {
@@ -232,6 +249,7 @@ function cleanupStale (root, maxAgeMs) {
   const ttl = maxAgeMs != null ? maxAgeMs : STALE_TTL_MS
   const now = Date.now()
   const base = turbocommitDir(root)
+  if (!base) return
 
   for (const sub of ['breadcrumbs', 'chains', 'tracking', 'watermarks']) {
     const dir = path.join(base, sub)

package/lib/track.js

@@ -1,16 +1,21 @@
 const fs = require('fs')
 const path = require('path')
 const { ensureDir } = require('./io')
+const { turbocommitDir } = require('./session')
 
 /**
- * Directory under .git where turbocommit stores tracking state.
+ * Directory under the git common dir where turbocommit stores tracking state.
+ * Returns null when the root isn't resolvable to a git repo (including when
+ * run outside a repo, which is not expected during normal operation).
  */
 function trackingDir (root) {
-  return path.join(root, '.git', 'turbocommit', 'tracking')
+  const base = turbocommitDir(root)
+  return base && path.join(base, 'tracking')
 }
 
 function trackingPath (root, sessionId) {
-  return path.join(trackingDir(root), sessionId + '.jsonl')
+  const dir = trackingDir(root)
+  return dir && path.join(dir, sessionId + '.jsonl')
 }
 
 /**
@@ -72,6 +77,7 @@ function handleTrack (input, root) {
   if (toolName === 'Bash' && typeof toolInput.command !== 'string') return
 
   const file = trackingPath(root, sessionId)
+  if (!file) return
   ensureDir(path.dirname(file))
   fs.appendFileSync(file, JSON.stringify(entry) + '\n')
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@searls/turbocommit",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Auto-commit after every Claude Code turn",
   "bin": {
     "turbocommit": "./cli.js"